tjh.dev / kernel
Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

drm/ttm/tests: add a test to exercise ttm_bo_swapout

Currently, ttm_bo_swapout is not exercised by the TTM KUnit tests.

It used to be exercised until commit 76689eb52667 ("drm/ttm: remove
ttm_bo_validate_swapout test"), but that test was removed as it was
unreliable due to requiring to allocate half of the system memory.

Calling ttm_bo_swapout directly with a single allocated BO, however, does
not suffer from that problem, and was able to detect a UAF introduced by
commit c06da4b3573a ("drm/ttm: Tidy usage of local variables a little
bit"), when built with KASAN.

When applying a fix to that UAF, the test passed without any issues.

Cc: Tvrtko Ursulin <tvrtko.ursulin@igalia.com>
Cc: Christian König <christian.koenig@amd.com>
Reviewed-by: Tvrtko Ursulin <tvrtko.ursulin@igalia.com>
Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@igalia.com>
Signed-off-by: Tvrtko Ursulin <tursulin@ursulin.net>
Link: https://lore.kernel.org/r/20260309-ttm_bo_swapout_test-v2-1-219f64046cfe@igalia.com

authored by

Thadeu Lima de Souza Cascardo and committed by
Tvrtko Ursulin d11ac904 acee19f9

+43
+41
drivers/gpu/drm/ttm/tests/ttm_bo_validate_test.c
··· 759 759 ttm_mock_manager_fini(priv->ttm_dev, snd_mem); 760 760 } 761 761 762 + static void ttm_bo_validate_swapout(struct kunit *test) 763 + { 764 + u32 mem_type = TTM_PL_TT; 765 + struct ttm_test_devices *priv = test->priv; 766 + struct ttm_operation_ctx ctx_init = { }; 767 + enum ttm_bo_type bo_type = ttm_bo_type_device; 768 + struct ttm_resource_manager *man; 769 + struct ttm_placement *placement; 770 + struct ttm_buffer_object *bo; 771 + struct ttm_place *place; 772 + int err; 773 + s64 swapped; 774 + 775 + ttm_mock_manager_init(priv->ttm_dev, mem_type, MANAGER_SIZE); 776 + man = ttm_manager_type(priv->ttm_dev, mem_type); 777 + KUNIT_ASSERT_NOT_NULL(test, man); 778 + 779 + place = ttm_place_kunit_init(test, mem_type, 0); 780 + placement = ttm_placement_kunit_init(test, place, 1); 781 + 782 + bo = kunit_kzalloc(test, sizeof(*bo), GFP_KERNEL); 783 + KUNIT_ASSERT_NOT_NULL(test, bo); 784 + 785 + drm_gem_private_object_init(priv->drm, &bo->base, MANAGER_SIZE); 786 + err = ttm_bo_init_reserved(priv->ttm_dev, bo, bo_type, placement, 787 + PAGE_SIZE, &ctx_init, NULL, NULL, 788 + &dummy_ttm_bo_destroy); 789 + KUNIT_EXPECT_EQ(test, err, 0); 790 + dma_resv_unlock(bo->base.resv); 791 + 792 + swapped = ttm_bo_swapout(priv->ttm_dev, &ctx_init, man, GFP_KERNEL, 793 + MANAGER_SIZE / PAGE_SIZE); 794 + KUNIT_EXPECT_EQ(test, swapped, MANAGER_SIZE / PAGE_SIZE); 795 + KUNIT_EXPECT_EQ(test, bo->resource->mem_type, TTM_PL_SYSTEM); 796 + KUNIT_EXPECT_TRUE(test, bo->ttm->page_flags & TTM_TT_FLAG_SWAPPED); 797 + 798 + ttm_bo_fini(bo); 799 + ttm_mock_manager_fini(priv->ttm_dev, mem_type); 800 + } 801 + 762 802 static void ttm_bo_validate_happy_evict(struct kunit *test) 763 803 { 764 804 u32 mem_type = TTM_PL_VRAM, mem_multihop = TTM_PL_TT, ··· 1193 1153 KUNIT_CASE(ttm_bo_validate_move_fence_signaled), 1194 1154 KUNIT_CASE_PARAM(ttm_bo_validate_move_fence_not_signaled, 1195 1155 ttm_bo_validate_wait_gen_params), 1156 + KUNIT_CASE(ttm_bo_validate_swapout), 1196 1157 KUNIT_CASE(ttm_bo_validate_happy_evict), 1197 1158 KUNIT_CASE(ttm_bo_validate_all_pinned_evict), 1198 1159 KUNIT_CASE(ttm_bo_validate_allowed_only_evict),
+2
drivers/gpu/drm/ttm/ttm_bo.c
··· 32 32 #define pr_fmt(fmt) "[TTM] " fmt 33 33 34 34 #include <drm/drm_print.h> 35 + #include <drm/drm_util.h> 35 36 #include <drm/ttm/ttm_allocation.h> 36 37 #include <drm/ttm/ttm_bo.h> 37 38 #include <drm/ttm/ttm_placement.h> ··· 1231 1230 1232 1231 return ttm_lru_walk_for_evict(&swapout_walk.walk, bdev, man, target); 1233 1232 } 1233 + EXPORT_SYMBOL_FOR_TESTS_ONLY(ttm_bo_swapout); 1234 1234 1235 1235 void ttm_bo_tt_destroy(struct ttm_buffer_object *bo) 1236 1236 {