From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mga02.intel.com (mga02.intel.com [134.134.136.20]) by gabe.freedesktop.org (Postfix) with ESMTPS id CCFBA10E1FF for ; Tue, 2 May 2023 06:55:35 +0000 (UTC) From: Matthew Brost To: igt-dev@lists.freedesktop.org Date: Mon, 1 May 2023 23:55:36 -0700 Message-Id: <20230502065536.3223489-8-matthew.brost@intel.com> In-Reply-To: <20230502065536.3223489-1-matthew.brost@intel.com> References: <20230502065536.3223489-1-matthew.brost@intel.com> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Subject: [igt-dev] [PATCH v2 7/7] xe_vm: Add EIO test List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: igt-dev-bounces@lists.freedesktop.org Sender: "igt-dev" List-ID: Let's make sure bad input to VM bind doesn't crash the driver or leak resources. Signed-off-by: Matthew Brost --- lib/xe/xe_ioctl.c | 22 +++++++++++ lib/xe/xe_ioctl.h | 4 ++ tests/xe/xe_vm.c | 95 +++++++++++++++++++++++++++++++++++++++++++++++ 3 files changed, 121 insertions(+) diff --git a/lib/xe/xe_ioctl.c b/lib/xe/xe_ioctl.c index 77e6d2d13..b9bfc2e8e 100644 --- a/lib/xe/xe_ioctl.c +++ b/lib/xe/xe_ioctl.c @@ -70,6 +70,28 @@ void xe_vm_unbind_all_async(int fd, uint32_t vm, uint32_t engine, sync, num_syncs, 0, 0); } +int __xe_vm_bind_array(int fd, uint32_t vm, uint32_t engine, + struct drm_xe_vm_bind_op *bind_ops, + uint32_t num_bind, struct drm_xe_sync *sync, + uint32_t num_syncs) +{ + struct drm_xe_vm_bind bind = { + .vm_id = vm, + .num_binds = num_bind, + .vector_of_binds = (uintptr_t)bind_ops, + .num_syncs = num_syncs, + .syncs = (uintptr_t)sync, + .engine_id = engine, + }; + + igt_assert(num_bind > 1); + + if (igt_ioctl(fd, DRM_IOCTL_XE_VM_BIND, &bind)) + return -errno; + + return 0; +} + void xe_vm_bind_array(int fd, uint32_t vm, uint32_t engine, struct drm_xe_vm_bind_op *bind_ops, uint32_t num_bind, struct drm_xe_sync *sync, diff --git a/lib/xe/xe_ioctl.h b/lib/xe/xe_ioctl.h index f5d39e81c..9757aab37 100644 --- a/lib/xe/xe_ioctl.h +++ b/lib/xe/xe_ioctl.h @@ -56,6 +56,10 @@ void xe_vm_bind_sync(int fd, uint32_t vm, uint32_t bo, uint64_t offset, uint64_t addr, uint64_t size); void xe_vm_unbind_sync(int fd, uint32_t vm, uint64_t offset, uint64_t addr, uint64_t size); +int __xe_vm_bind_array(int fd, uint32_t vm, uint32_t engine, + struct drm_xe_vm_bind_op *bind_ops, + uint32_t num_bind, struct drm_xe_sync *sync, + uint32_t num_syncs); void xe_vm_bind_array(int fd, uint32_t vm, uint32_t engine, struct drm_xe_vm_bind_op *bind_ops, uint32_t num_bind, struct drm_xe_sync *sync, diff --git a/tests/xe/xe_vm.c b/tests/xe/xe_vm.c index f6d71d0e0..78320fc48 100644 --- a/tests/xe/xe_vm.c +++ b/tests/xe/xe_vm.c @@ -294,6 +294,98 @@ static void unbind_all(int fd, int n_vmas) #define MAP_ADDRESS 0x00007fadeadbe000 +/** + * SUBTEST: eio + * Description: + * Verifies bad input to vm bind is handled correctly and doesn't crash the + * driver + * Run type: FULL + * TODO: change ``'Run type' == FULL`` to a better category + */ +static void eio(int fd) +{ + size_t size = xe_get_default_alignment(fd); + struct drm_xe_vm_bind_op bind_ops[2]; + uint32_t vm; + uint32_t bo; + uint32_t async_bind_engine; + uint32_t sync_bind_engine; + int ret, i; + + vm = xe_vm_create(fd, 0, 0); + bo = xe_bo_create(fd, 0, vm, size); + async_bind_engine = xe_bind_engine_create(fd, vm, 0, true); + sync_bind_engine = xe_bind_engine_create(fd, vm, 0, false); + + /* Bad BO */ + ret = __xe_vm_bind(fd, vm, 0, bo + 1, 0, 0x40000, + size, XE_VM_BIND_OP_MAP, NULL, 0, 0, 0); + igt_assert(ret == -ENOENT); + + /* Bad BO /w an engine */ + ret = __xe_vm_bind(fd, vm, sync_bind_engine, bo + 1, 0, 0x40000, + size, XE_VM_BIND_OP_MAP, NULL, 0, 0, 0); + igt_assert(ret == -ENOENT); + + /* Invalid engine */ + ret = __xe_vm_bind(fd, vm, sync_bind_engine + async_bind_engine, bo, 0, + 0x40000, size, XE_VM_BIND_OP_MAP, NULL, 0, 0, 0); + igt_assert(ret == -ENOENT); + + /* Bad BO offset */ + ret = __xe_vm_bind(fd, vm, 0, bo, xe_get_default_alignment(fd) * 2, 0x40000, + size, XE_VM_BIND_OP_MAP, NULL, 0, 0, 0); + igt_assert(ret == -EINVAL); + + /* Bad BO offset /w an engine */ + ret = __xe_vm_bind(fd, vm, sync_bind_engine, bo, + xe_get_default_alignment(fd) * 2, 0x40000, + size, XE_VM_BIND_OP_MAP, NULL, 0, 0, 0); + igt_assert(ret == -EINVAL); + + /* Bad BO 2nd op */ + memset(bind_ops, 0, sizeof(bind_ops)); + for (i = 0; i < 2; ++i) { + bind_ops[i].obj = bo + i; + bind_ops[i].obj_offset = 0; + bind_ops[i].range = size; + bind_ops[i].addr = 0x40000 * (i + 1); + bind_ops[i].op = XE_VM_BIND_OP_MAP; + } + ret = __xe_vm_bind_array(fd, vm, 0, bind_ops, 2, 0, 0); + igt_assert(ret == -ENOENT); + + /* Bad BO /w an engine 2nd op */ + memset(bind_ops, 0, sizeof(bind_ops)); + for (i = 0; i < 2; ++i) { + bind_ops[i].obj = bo + i; + bind_ops[i].obj_offset = 0; + bind_ops[i].range = size; + bind_ops[i].addr = 0x40000 * (i + 1); + bind_ops[i].op = XE_VM_BIND_OP_MAP; + } + ret = __xe_vm_bind_array(fd, vm, sync_bind_engine, bind_ops, 2, 0, 0); + igt_assert(ret == -ENOENT); + + /* userptr_invalid 2nd op */ + memset(bind_ops, 0, sizeof(bind_ops)); + for (i = 0; i < 2; ++i) { + bind_ops[i].obj = !i ? bo : 0; + bind_ops[i].obj_offset = !i ? 0 : MAP_ADDRESS; + bind_ops[i].range = size; + bind_ops[i].addr = 0x40000 * (i + 1); + bind_ops[i].op = !i ? XE_VM_BIND_OP_MAP : + XE_VM_BIND_OP_MAP_USERPTR; + } + ret = __xe_vm_bind_array(fd, vm, sync_bind_engine, bind_ops, 2, 0, 0); + igt_assert(ret == -EFAULT); + + xe_engine_destroy(fd, async_bind_engine); + xe_engine_destroy(fd, sync_bind_engine); + gem_close(fd, bo); + xe_vm_destroy(fd, vm); +} + /** * SUBTEST: userptr-invalid * Description: @@ -1847,6 +1939,9 @@ igt_main igt_subtest("unbind-all-8-vmas") unbind_all(fd, 8); + igt_subtest("eio") + eio(fd); + igt_subtest("userptr-invalid") userptr_invalid(fd); -- 2.34.1