mirrors/linux
2
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2026-05-16 13:41:48 -04:00
Code Issues Packages Projects Releases Wiki Activity

drm/ttm/tests: add a test to exercise ttm_bo_swapout

Browse Source 
Currently, ttm_bo_swapout is not exercised by the TTM KUnit tests.

It used to be exercised until commit 76689eb526 ("drm/ttm: remove
ttm_bo_validate_swapout test"), but that test was removed as it was
unreliable due to requiring to allocate half of the system memory.

Calling ttm_bo_swapout directly with a single allocated BO, however, does
not suffer from that problem, and was able to detect a UAF introduced by
commit c06da4b357 ("drm/ttm: Tidy usage of local variables a little
bit"), when built with KASAN.

When applying a fix to that UAF, the test passed without any issues.

Cc: Tvrtko Ursulin <tvrtko.ursulin@igalia.com>
Cc: Christian König <christian.koenig@amd.com>
Reviewed-by: Tvrtko Ursulin <tvrtko.ursulin@igalia.com>
Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@igalia.com>
Signed-off-by: Tvrtko Ursulin <tursulin@ursulin.net>
Link: https://lore.kernel.org/r/20260309-ttm_bo_swapout_test-v2-1-219f64046cfe@igalia.com
This commit is contained in:
Thadeu Lima de Souza Cascardo
2026-03-09 15:47:04 -03:00
committed by Tvrtko Ursulin
parent acee19f998
commit d11ac90434
2 changed files with 43 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

41
drivers/gpu/drm/ttm/tests/ttm_bo_validate_test.c
View File

@@ -759,6 +759,46 @@ static void ttm_bo_validate_move_fence_not_signaled(struct kunit *test)
ttm_mock_manager_fini(priv->ttm_dev, snd_mem);
}
static void ttm_bo_validate_swapout(struct kunit *test)
{
u32 mem_type = TTM_PL_TT;
struct ttm_test_devices *priv = test->priv;
struct ttm_operation_ctx ctx_init = { };
enum ttm_bo_type bo_type = ttm_bo_type_device;
struct ttm_resource_manager *man;
struct ttm_placement *placement;
struct ttm_buffer_object *bo;
struct ttm_place *place;
int err;
s64 swapped;
ttm_mock_manager_init(priv->ttm_dev, mem_type, MANAGER_SIZE);
man = ttm_manager_type(priv->ttm_dev, mem_type);
KUNIT_ASSERT_NOT_NULL(test, man);
place = ttm_place_kunit_init(test, mem_type, 0);
placement = ttm_placement_kunit_init(test, place, 1);
bo = kunit_kzalloc(test, sizeof(*bo), GFP_KERNEL);
KUNIT_ASSERT_NOT_NULL(test, bo);
drm_gem_private_object_init(priv->drm, &bo->base, MANAGER_SIZE);
err = ttm_bo_init_reserved(priv->ttm_dev, bo, bo_type, placement,
PAGE_SIZE, &ctx_init, NULL, NULL,
&dummy_ttm_bo_destroy);
KUNIT_EXPECT_EQ(test, err, 0);
dma_resv_unlock(bo->base.resv);
swapped = ttm_bo_swapout(priv->ttm_dev, &ctx_init, man, GFP_KERNEL,
MANAGER_SIZE / PAGE_SIZE);
KUNIT_EXPECT_EQ(test, swapped, MANAGER_SIZE / PAGE_SIZE);
KUNIT_EXPECT_EQ(test, bo->resource->mem_type, TTM_PL_SYSTEM);
KUNIT_EXPECT_TRUE(test, bo->ttm->page_flags & TTM_TT_FLAG_SWAPPED);
ttm_bo_fini(bo);
ttm_mock_manager_fini(priv->ttm_dev, mem_type);
}
static void ttm_bo_validate_happy_evict(struct kunit *test)
{
u32 mem_type = TTM_PL_VRAM, mem_multihop = TTM_PL_TT,
@@ -1153,6 +1193,7 @@ static struct kunit_case ttm_bo_validate_test_cases[] = {
KUNIT_CASE(ttm_bo_validate_move_fence_signaled),
KUNIT_CASE_PARAM(ttm_bo_validate_move_fence_not_signaled,
ttm_bo_validate_wait_gen_params),
KUNIT_CASE(ttm_bo_validate_swapout),
KUNIT_CASE(ttm_bo_validate_happy_evict),
KUNIT_CASE(ttm_bo_validate_all_pinned_evict),
KUNIT_CASE(ttm_bo_validate_allowed_only_evict),

2
drivers/gpu/drm/ttm/ttm_bo.c
View File

@@ -32,6 +32,7 @@
#define pr_fmt(fmt) "[TTM] " fmt
#include <drm/drm_print.h>
#include <drm/drm_util.h>
#include <drm/ttm/ttm_allocation.h>
#include <drm/ttm/ttm_bo.h>
#include <drm/ttm/ttm_placement.h>
@@ -1230,6 +1231,7 @@ s64 ttm_bo_swapout(struct ttm_device *bdev, struct ttm_operation_ctx *ctx,
return ttm_lru_walk_for_evict(&swapout_walk.walk, bdev, man, target);
}
EXPORT_SYMBOL_FOR_TESTS_ONLY(ttm_bo_swapout);
void ttm_bo_tt_destroy(struct ttm_buffer_object *bo)
{