[igt-dev] [PATCH v2 7/7] xe_vm: Add EIO test

[Matthew Brost <matthew.brost@intel.com>]

Let's make sure bad input to VM bind doesn't crash the driver or leak
resources.

Signed-off-by: Matthew Brost <matthew.brost@intel.com>
---
 lib/xe/xe_ioctl.c | 22 +++++++++++
 lib/xe/xe_ioctl.h |  4 ++
 tests/xe/xe_vm.c  | 95 +++++++++++++++++++++++++++++++++++++++++++++++
 3 files changed, 121 insertions(+)

diff --git a/lib/xe/xe_ioctl.c b/lib/xe/xe_ioctl.c
index 77e6d2d13..b9bfc2e8e 100644
--- a/lib/xe/xe_ioctl.c
+++ b/lib/xe/xe_ioctl.c
@@ -70,6 +70,28 @@ void xe_vm_unbind_all_async(int fd, uint32_t vm, uint32_t engine,
 			    sync, num_syncs, 0, 0);
 }
 
+int __xe_vm_bind_array(int fd, uint32_t vm, uint32_t engine,
+		       struct drm_xe_vm_bind_op *bind_ops,
+		       uint32_t num_bind, struct drm_xe_sync *sync,
+		       uint32_t num_syncs)
+{
+	struct drm_xe_vm_bind bind = {
+		.vm_id = vm,
+		.num_binds = num_bind,
+		.vector_of_binds = (uintptr_t)bind_ops,
+		.num_syncs = num_syncs,
+		.syncs = (uintptr_t)sync,
+		.engine_id = engine,
+	};
+
+	igt_assert(num_bind > 1);
+
+	if (igt_ioctl(fd, DRM_IOCTL_XE_VM_BIND, &bind))
+		return -errno;
+
+	return 0;
+}
+
 void xe_vm_bind_array(int fd, uint32_t vm, uint32_t engine,
 		      struct drm_xe_vm_bind_op *bind_ops,
 		      uint32_t num_bind, struct drm_xe_sync *sync,
diff --git a/lib/xe/xe_ioctl.h b/lib/xe/xe_ioctl.h
index f5d39e81c..9757aab37 100644
--- a/lib/xe/xe_ioctl.h
+++ b/lib/xe/xe_ioctl.h
@@ -56,6 +56,10 @@ void xe_vm_bind_sync(int fd, uint32_t vm, uint32_t bo, uint64_t offset,
 		     uint64_t addr, uint64_t size);
 void xe_vm_unbind_sync(int fd, uint32_t vm, uint64_t offset,
 		       uint64_t addr, uint64_t size);
+int __xe_vm_bind_array(int fd, uint32_t vm, uint32_t engine,
+		       struct drm_xe_vm_bind_op *bind_ops,
+		       uint32_t num_bind, struct drm_xe_sync *sync,
+		       uint32_t num_syncs);
 void xe_vm_bind_array(int fd, uint32_t vm, uint32_t engine,
 		      struct drm_xe_vm_bind_op *bind_ops,
 		      uint32_t num_bind, struct drm_xe_sync *sync,
diff --git a/tests/xe/xe_vm.c b/tests/xe/xe_vm.c
index f6d71d0e0..78320fc48 100644
--- a/tests/xe/xe_vm.c
+++ b/tests/xe/xe_vm.c
@@ -294,6 +294,98 @@ static void unbind_all(int fd, int n_vmas)
 
 #define	MAP_ADDRESS	0x00007fadeadbe000
 
+/**
+ * SUBTEST: eio
+ * Description:
+ *	Verifies bad input to vm bind is handled correctly and doesn't crash the
+ *	driver
+ * Run type: FULL
+ * TODO: change ``'Run type' == FULL`` to a better category
+ */
+static void eio(int fd)
+{
+	size_t size = xe_get_default_alignment(fd);
+	struct drm_xe_vm_bind_op bind_ops[2];
+	uint32_t vm;
+	uint32_t bo;
+	uint32_t async_bind_engine;
+	uint32_t sync_bind_engine;
+	int ret, i;
+
+	vm = xe_vm_create(fd, 0, 0);
+	bo = xe_bo_create(fd, 0, vm, size);
+	async_bind_engine = xe_bind_engine_create(fd, vm, 0, true);
+	sync_bind_engine = xe_bind_engine_create(fd, vm, 0, false);
+
+	/* Bad BO */
+	ret = __xe_vm_bind(fd, vm, 0, bo + 1, 0, 0x40000,
+			   size, XE_VM_BIND_OP_MAP, NULL, 0, 0, 0);
+	igt_assert(ret == -ENOENT);
+
+	/* Bad BO /w an engine */
+	ret = __xe_vm_bind(fd, vm, sync_bind_engine, bo + 1, 0, 0x40000,
+			   size, XE_VM_BIND_OP_MAP, NULL, 0, 0, 0);
+	igt_assert(ret == -ENOENT);
+
+	/* Invalid engine */
+	ret = __xe_vm_bind(fd, vm, sync_bind_engine + async_bind_engine, bo, 0,
+			   0x40000, size, XE_VM_BIND_OP_MAP, NULL, 0, 0, 0);
+	igt_assert(ret == -ENOENT);
+
+	/* Bad BO offset */
+	ret = __xe_vm_bind(fd, vm, 0, bo, xe_get_default_alignment(fd) * 2, 0x40000,
+			   size, XE_VM_BIND_OP_MAP, NULL, 0, 0, 0);
+	igt_assert(ret == -EINVAL);
+
+	/* Bad BO offset /w an engine */
+	ret = __xe_vm_bind(fd, vm, sync_bind_engine, bo,
+			   xe_get_default_alignment(fd) * 2, 0x40000,
+			   size, XE_VM_BIND_OP_MAP, NULL, 0, 0, 0);
+	igt_assert(ret == -EINVAL);
+
+	/* Bad BO 2nd op */
+	memset(bind_ops, 0, sizeof(bind_ops));
+	for (i = 0; i < 2; ++i) {
+		bind_ops[i].obj = bo + i;
+		bind_ops[i].obj_offset = 0;
+		bind_ops[i].range = size;
+		bind_ops[i].addr = 0x40000 * (i + 1);
+		bind_ops[i].op = XE_VM_BIND_OP_MAP;
+	}
+	ret = __xe_vm_bind_array(fd, vm, 0, bind_ops, 2, 0, 0);
+	igt_assert(ret == -ENOENT);
+
+	/* Bad BO /w an engine 2nd op */
+	memset(bind_ops, 0, sizeof(bind_ops));
+	for (i = 0; i < 2; ++i) {
+		bind_ops[i].obj = bo + i;
+		bind_ops[i].obj_offset = 0;
+		bind_ops[i].range = size;
+		bind_ops[i].addr = 0x40000 * (i + 1);
+		bind_ops[i].op = XE_VM_BIND_OP_MAP;
+	}
+	ret = __xe_vm_bind_array(fd, vm, sync_bind_engine, bind_ops, 2, 0, 0);
+	igt_assert(ret == -ENOENT);
+
+	/* userptr_invalid 2nd op */
+	memset(bind_ops, 0, sizeof(bind_ops));
+	for (i = 0; i < 2; ++i) {
+		bind_ops[i].obj = !i ? bo : 0;
+		bind_ops[i].obj_offset = !i ? 0 : MAP_ADDRESS;
+		bind_ops[i].range = size;
+		bind_ops[i].addr = 0x40000 * (i + 1);
+		bind_ops[i].op = !i ? XE_VM_BIND_OP_MAP :
+			XE_VM_BIND_OP_MAP_USERPTR;
+	}
+	ret = __xe_vm_bind_array(fd, vm, sync_bind_engine, bind_ops, 2, 0, 0);
+	igt_assert(ret == -EFAULT);
+
+	xe_engine_destroy(fd, async_bind_engine);
+	xe_engine_destroy(fd, sync_bind_engine);
+	gem_close(fd, bo);
+	xe_vm_destroy(fd, vm);
+}
+
 /**
  * SUBTEST: userptr-invalid
  * Description:
@@ -1847,6 +1939,9 @@ igt_main
 	igt_subtest("unbind-all-8-vmas")
 		unbind_all(fd, 8);
 
+	igt_subtest("eio")
+		eio(fd);
+
 	igt_subtest("userptr-invalid")
 		userptr_invalid(fd);
 
-- 
2.34.1