From patchwork Thu Nov 28 13:10:45 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Chris Wilson X-Patchwork-Id: 11265995 Return-Path: Received: from mail.kernel.org (pdx-korg-mail-1.web.codeaurora.org [172.30.200.123]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 066E96C1 for ; Thu, 28 Nov 2019 13:11:03 +0000 (UTC) Received: from gabe.freedesktop.org (gabe.freedesktop.org [131.252.210.177]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id E1BB12071F for ; Thu, 28 Nov 2019 13:11:02 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org E1BB12071F Authentication-Results: mail.kernel.org; dmarc=none (p=none dis=none) header.from=chris-wilson.co.uk Authentication-Results: mail.kernel.org; spf=none smtp.mailfrom=intel-gfx-bounces@lists.freedesktop.org Received: from gabe.freedesktop.org (localhost [127.0.0.1]) by gabe.freedesktop.org (Postfix) with ESMTP id 76BF56E7EA; Thu, 28 Nov 2019 13:11:01 +0000 (UTC) X-Original-To: intel-gfx@lists.freedesktop.org Delivered-To: intel-gfx@lists.freedesktop.org Received: from fireflyinternet.com (mail.fireflyinternet.com [109.228.58.192]) by gabe.freedesktop.org (Postfix) with ESMTPS id AA2F06E7EA; Thu, 28 Nov 2019 13:10:59 +0000 (UTC) X-Default-Received-SPF: pass (skip=forwardok (res=PASS)) x-ip-name=78.156.65.138; Received: from haswell.alporthouse.com (unverified [78.156.65.138]) by fireflyinternet.com (Firefly Internet (M1)) with ESMTP id 19376280-1500050 for multiple; Thu, 28 Nov 2019 13:10:47 +0000 From: Chris Wilson To: intel-gfx@lists.freedesktop.org Date: Thu, 28 Nov 2019 13:10:45 +0000 Message-Id: <20191128131045.3886684-1-chris@chris-wilson.co.uk> X-Mailer: git-send-email 2.24.0 In-Reply-To: <20191126172556.21805-4-zbigniew.kempczynski@intel.com> References: <20191126172556.21805-4-zbigniew.kempczynski@intel.com> MIME-Version: 1.0 Subject: [Intel-gfx] [PATCH i-g-t] tests/i915/gem_mmap_offset: Add new API test for gem_mmap_offset X-BeenThere: intel-gfx@lists.freedesktop.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: Intel graphics driver community testing & development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: igt-dev@lists.freedesktop.org Errors-To: intel-gfx-bounces@lists.freedesktop.org Sender: "Intel-gfx" From: Lukasz Kalamarz Few simple tests which tries to create / mmap buffer objects using GEM_MMAP_OFFSET uAPI. v2: change from WC -> WB (according to Chris review comment) v3: add mmap-offset-close-race test Signed-off-by: Lukasz Kalamarz Signed-off-by: Zbigniew Kempczyński Cc: Chris Wilson Cc: Vanshidhar Konda --- Required (look to gem_mmap_(gtt,wc,cpu) for ideas): size - check we can handle objects beyond a reasonable limit (note the kernel fails at beyond RAM) forked - interactions with pagefault + new mmap_offsets across threads/processes suspend - check speed is consistent before/after suspend coherency - combinatorial checker between all pointer types, prw and gpu --- tests/Makefile.sources | 3 + tests/i915/gem_mmap_offset.c | 426 +++++++++++++++++++++++++++++++++++ tests/meson.build | 1 + 3 files changed, 430 insertions(+) create mode 100644 tests/i915/gem_mmap_offset.c diff --git a/tests/Makefile.sources b/tests/Makefile.sources index a211851cf..ddbc69bc8 100644 --- a/tests/Makefile.sources +++ b/tests/Makefile.sources @@ -325,6 +325,9 @@ gem_mmap_SOURCES = i915/gem_mmap.c TESTS_progs += gem_mmap_gtt gem_mmap_gtt_SOURCES = i915/gem_mmap_gtt.c +TESTS_progs += gem_mmap_offset +gem_mmap_offset_SOURCES = i915/gem_mmap_offset.c + TESTS_progs += gem_mmap_offset_exhaustion gem_mmap_offset_exhaustion_SOURCES = i915/gem_mmap_offset_exhaustion.c diff --git a/tests/i915/gem_mmap_offset.c b/tests/i915/gem_mmap_offset.c new file mode 100644 index 000000000..e02f0fb60 --- /dev/null +++ b/tests/i915/gem_mmap_offset.c @@ -0,0 +1,426 @@ +/* + * Copyright © 2019 Intel Corporation + * + * Permission is hereby granted, free of charge, to any person obtaining a + * copy of this software and associated documentation files (the "Software"), + * to deal in the Software without restriction, including without limitation + * the rights to use, copy, modify, merge, publish, distribute, sublicense, + * and/or sell copies of the Software, and to permit persons to whom the + * Software is furnished to do so, subject to the following conditions: + * + * The above copyright notice and this permission notice (including the next + * paragraph) shall be included in all copies or substantial portions of the + * Software. + * + * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR + * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, + * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL + * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER + * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING + * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS + * IN THE SOFTWARE. + */ + +#include +#include +#include +#include +#include +#include "drm.h" + +#include "igt.h" +#include "igt_x86.h" + +IGT_TEST_DESCRIPTION("Basic MMAP_OFFSET IOCTL tests for mem regions\n"); + +static const struct mmap_offset { + const char *name; + unsigned int type; + unsigned int domain; +} mmap_offset_types[] = { + { "gtt", I915_MMAP_OFFSET_GTT, I915_GEM_DOMAIN_GTT }, + { "wb", I915_MMAP_OFFSET_WB, I915_GEM_DOMAIN_CPU }, + { "wc", I915_MMAP_OFFSET_WC, I915_GEM_DOMAIN_WC }, + { "uc", I915_MMAP_OFFSET_UC, I915_GEM_DOMAIN_WC }, + {}, +}; + +#define for_each_mmap_offset_type(__t) \ + for (const struct mmap_offset *__t = mmap_offset_types; \ + (__t)->name; \ + (__t)++) + +static int mmap_offset_ioctl(int i915, struct drm_i915_gem_mmap_offset *arg) +{ + int err = 0; + + if (igt_ioctl(i915, DRM_IOCTL_I915_GEM_MMAP_OFFSET, arg)) { + err = -errno; + igt_assume(err); + } + + errno = 0; + return err; +} + +static void bad_object(int i915) +{ + uint32_t real_handle; + uint32_t handles[20]; + int i = 0; + + real_handle = gem_create(i915, 4096); + + handles[i++] = 0xdeadbeef; + for (int bit = 0; bit < 16; bit++) + handles[i++] = real_handle | (1 << (bit + 16)); + handles[i] = real_handle + 1; + + for (; i >= 0; i--) { + struct drm_i915_gem_mmap_offset arg = { + .handle = handles[i], + .flags = I915_MMAP_OFFSET_WB, + }; + + igt_debug("Trying MMAP IOCTL with handle %x\n", + handles[i]); + igt_assert_eq(mmap_offset_ioctl(i915, &arg), + -ENOENT); + } + + gem_close(i915, real_handle); +} + +static void bad_flags(int i915) +{ + struct drm_i915_gem_mmap_offset arg = { + .handle = gem_create(i915, 4096), + .flags = -1ull, + }; + + igt_assert_eq(mmap_offset_ioctl(i915, &arg), -EINVAL); + gem_close(i915, arg.handle); +} + +static void basic_uaf(int i915) +{ + const uint32_t obj_size = 4096; + + for_each_mmap_offset_type(t) { + uint32_t handle = gem_create(i915, obj_size); + uint8_t *expected, *buf, *addr; + + addr = __gem_mmap_offset(i915, handle, 0, obj_size, + PROT_READ | PROT_WRITE, + t->type); + if (!addr) { + gem_close(i915, handle); + continue; + } + + expected = calloc(obj_size, sizeof(*expected)); + gem_set_domain(i915, handle, t->domain, 0); + igt_assert_f(memcmp(addr, expected, obj_size) == 0, + "mmap(%s) not clear on gem_create()\n", + t->name); + free(expected); + + buf = calloc(obj_size, sizeof(*buf)); + memset(buf + 1024, 0x01, 1024); + gem_write(i915, handle, 0, buf, obj_size); + gem_set_domain(i915, handle, t->domain, 0); + igt_assert_f(memcmp(buf, addr, obj_size) == 0, + "mmap(%s) not coherent with gem_write()\n", + t->name); + + gem_set_domain(i915, handle, t->domain, t->domain); + memset(addr + 2048, 0xff, 1024); + gem_read(i915, handle, 0, buf, obj_size); + gem_set_domain(i915, handle, t->domain, 0); + igt_assert_f(memcmp(buf, addr, obj_size) == 0, + "mmap(%s) not coherent with gem_read()\n", + t->name); + + gem_close(i915, handle); + igt_assert_f(memcmp(buf, addr, obj_size) == 0, + "mmap(%s) not resident after gem_close()\n", + t->name); + free(buf); + + igt_debug("Testing unmapping\n"); + munmap(addr, obj_size); + } +} + +static void isolation(int i915) +{ + for_each_mmap_offset_type(t) { + struct drm_i915_gem_mmap_offset mmap_arg = { + .flags = t->type + }; + int A = gem_reopen_driver(i915); + int B = gem_reopen_driver(i915); + uint64_t offset_a, offset_b; + uint32_t a, b; + void *ptr; + + a = gem_create(A, 4096); + b = gem_open(B, gem_flink(A, a)); + + mmap_arg.handle = a; + if (mmap_offset_ioctl(i915, &mmap_arg)) { + close(A); + close(B); + continue; + } + offset_a = mmap_arg.offset; + + mmap_arg.handle = b; + igt_assert_eq(mmap_offset_ioctl(i915, &mmap_arg), 0); + offset_b = mmap_arg.offset; + + igt_info("A[%s]: {fd:%d, handle:%d, offset:%"PRIx64"}\n", + t->name, A, a, offset_a); + igt_info("B[%s]: {fd:%d, handle:%d, offset:%"PRIx64"}\n", + t->name, B, b, offset_b); + + ptr = mmap64(0, 4096, PROT_READ, MAP_SHARED, B, offset_a); + igt_assert(ptr == MAP_FAILED); + + ptr = mmap64(0, 4096, PROT_READ, MAP_SHARED, A, offset_b); + igt_assert(ptr == MAP_FAILED); + + close(B); + + ptr = mmap64(0, 4096, PROT_READ, MAP_SHARED, A, offset_a); + igt_assert(ptr != MAP_FAILED); + munmap(ptr, 4096); + + close(A); + + ptr = mmap64(0, 4096, PROT_READ, MAP_SHARED, A, offset_a); + igt_assert(ptr == MAP_FAILED); + } +} + +static void pf_nonblock(int i915) +{ + igt_spin_t *spin = igt_spin_new(i915); + + for_each_mmap_offset_type(t) { + uint32_t *ptr; + + ptr = __gem_mmap_offset(i915, spin->handle, 0, 4096, + PROT_READ | PROT_WRITE, + t->type); + if (!ptr) + continue; + + igt_set_timeout(1, t->name); + /* no set-domain as we want to verify the pagefault is async */ + ptr[256] = 0; + igt_reset_timeout(); + + munmap(ptr, 4096); + } + + igt_spin_free(i915, spin); +} + +static void close_race(int i915, int timeout) +{ + const int ncpus = sysconf(_SC_NPROCESSORS_ONLN); + _Atomic uint32_t *handles; + size_t len = ALIGN((ncpus + 1) * sizeof(uint32_t), 4096); + + handles = mmap64(0, len, PROT_WRITE, MAP_SHARED | MAP_ANON, -1, 0); + igt_assert(handles != MAP_FAILED); + + igt_fork(child, ncpus + 1) { + do { + struct drm_i915_gem_mmap_offset mmap_arg = {}; + const int i = 1 + random() % ncpus; + uint32_t old; + + mmap_arg.handle = gem_create(i915, 4096); + mmap_arg.flags = I915_MMAP_OFFSET_WB; + old = atomic_exchange(&handles[i], mmap_arg.handle); + ioctl(i915, DRM_IOCTL_GEM_CLOSE, &old); + + if (ioctl(i915, + DRM_IOCTL_I915_GEM_MMAP_OFFSET, + &mmap_arg) != -1) { + void *ptr; + + ptr = mmap64(0, 4096, + PROT_WRITE, MAP_SHARED, i915, + mmap_arg.offset); + if (ptr != MAP_FAILED) { + *(volatile uint32_t *)ptr = 0; + munmap(ptr, 4096); + } + } + + } while (!READ_ONCE(handles[0])); + } + + sleep(timeout); + handles[0] = 1; + igt_waitchildren(); + + for (int i = 1; i <= ncpus; i++) + ioctl(i915, DRM_IOCTL_GEM_CLOSE, handles[i]); + munmap(handles, len); +} + +static uint64_t atomic_compare_swap_u64(_Atomic(uint64_t) *ptr, + uint64_t oldval, uint64_t newval) +{ + atomic_compare_exchange_strong(ptr, &oldval, newval); + return oldval; +} + +static uint64_t get_npages(_Atomic(uint64_t) *global, uint64_t npages) +{ + uint64_t try, old, max; + + max = *global; + do { + old = max; + try = 1 + npages % (max / 2); + max -= try; + } while ((max = atomic_compare_swap_u64(global, old, max)) != old); + + return try; +} + +struct thread_clear { + _Atomic(uint64_t) max; + int timeout; + int i915; +}; + +static int create_ioctl(int i915, struct drm_i915_gem_create *create) +{ + int err = 0; + + if (igt_ioctl(i915, DRM_IOCTL_I915_GEM_CREATE, create)) { + err = -errno; + igt_assume(err != 0); + } + + errno = 0; + return err; +} + +static void *thread_clear(void *data) +{ + struct thread_clear *arg = data; + const struct mmap_offset *t; + unsigned long checked = 0; + int i915 = arg->i915; + + t = mmap_offset_types; + igt_until_timeout(arg->timeout) { + struct drm_i915_gem_create create = {}; + uint64_t npages; + void *ptr; + + npages = random(); + npages <<= 32; + npages |= random(); + npages = get_npages(&arg->max, npages); + create.size = npages << 12; + + create_ioctl(i915, &create); + ptr = __gem_mmap_offset(i915, create.handle, 0, create.size, + PROT_READ | PROT_WRITE, + t->type); + /* No set-domains as we are being as naughty as possible */ + for (uint64_t page = 0; ptr && page < npages; page++) { + uint64_t x[8] = { + page * 4096 + + sizeof(x) * ((page % (4096 - sizeof(x)) / sizeof(x))) + }; + + if (page & 1) + igt_memcpy_from_wc(x, ptr + x[0], sizeof(x)); + else + memcpy(x, ptr + x[0], sizeof(x)); + + for (int i = 0; i < ARRAY_SIZE(x); i++) + igt_assert_eq_u64(x[i], 0); + } + if (ptr) + munmap(ptr, create.size); + gem_close(i915, create.handle); + checked += npages; + + atomic_fetch_add(&arg->max, npages); + + if (!(++t)->name) + t = mmap_offset_types; + } + + return (void *)(uintptr_t)checked; +} + +static void always_clear(int i915, int timeout) +{ + struct thread_clear arg = { + .i915 = i915, + .timeout = timeout, + .max = intel_get_avail_ram_mb() << (20 - 12), /* in pages */ + }; + const int ncpus = sysconf(_SC_NPROCESSORS_ONLN); + unsigned long checked; + pthread_t thread[ncpus]; + void *result; + + for (int i = 0; i < ncpus; i++) + pthread_create(&thread[i], NULL, thread_clear, &arg); + + checked = 0; + for (int i = 0; i < ncpus; i++) { + pthread_join(thread[i], &result); + checked += (uintptr_t)result; + } + igt_info("Checked %'lu page allocations\n", checked); +} + + +igt_main +{ + int i915; + + igt_fixture { + i915 = drm_open_driver(DRIVER_INTEL); + gem_require_mmap_offset(i915); + } + + igt_describe("Verify mapping to invalid gem objects won't be created"); + igt_subtest_f("bad-object") + bad_object(i915); + igt_subtest_f("bad-flags") + bad_flags(i915); + + igt_describe("Check buffer object mapping persists after gem_close"); + igt_subtest_f("basic-uaf") + basic_uaf(i915); + + igt_subtest_f("isolation") + isolation(i915); + igt_subtest_f("pf-nonblock") + pf_nonblock(i915); + + igt_describe("Check race between close and mmap offset between threads"); + igt_subtest_f("close-race") + close_race(i915, 20); + + igt_subtest_f("clear") + always_clear(i915, 20); + + igt_fixture { + close(i915); + } +} diff --git a/tests/meson.build b/tests/meson.build index 18788d44b..05dea1f4e 100644 --- a/tests/meson.build +++ b/tests/meson.build @@ -174,6 +174,7 @@ i915_progs = [ 'gem_media_vme', 'gem_mmap', 'gem_mmap_gtt', + 'gem_mmap_offset', 'gem_mmap_offset_exhaustion', 'gem_mmap_wc', 'gem_partial_pwrite_pread',