2 * Copyright © 2013 Google
3 * Copyright © 2013 Intel Corporation
5 * Permission is hereby granted, free of charge, to any person obtaining a
6 * copy of this software and associated documentation files (the "Software"),
7 * to deal in the Software without restriction, including without limitation
8 * the rights to use, copy, modify, merge, publish, distribute, sublicense,
9 * and/or sell copies of the Software, and to permit persons to whom the
10 * Software is furnished to do so, subject to the following conditions:
12 * The above copyright notice and this permission notice (including the next
13 * paragraph) shall be included in all copies or substantial portions of the
16 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
17 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
18 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
19 * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
20 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
21 * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS
25 * Kees Cook <keescook@chromium.org>
26 * Daniel Vetter <daniel.vetter@ffwll.ch>
40 #include <sys/ioctl.h>
43 #include <sys/types.h>
47 #include "intel_gpu_tools.h"
50 * Testcase: Kernel relocation overflows are caught.
56 struct drm_i915_gem_exec_object2 *execobjs;
57 struct drm_i915_gem_execbuffer2 execbuf = { 0 };
58 struct drm_i915_gem_relocation_entry *reloc;
61 uint32_t batch_handle;
64 static void source_offset_tests(void)
66 struct drm_i915_gem_relocation_entry single_reloc;
69 handle = gem_create(fd, 4096);
71 execobjs[1].handle = batch_handle;
72 execobjs[1].relocation_count = 0;
73 execobjs[1].relocs_ptr = 0;
75 execobjs[0].handle = handle;
76 execobjs[0].relocation_count = 1;
77 execobjs[0].relocs_ptr = (uintptr_t) &single_reloc;
78 execbuf.buffer_count = 2;
81 igt_subtest("source-offset-end") {
82 single_reloc.offset = 4096 - 4;
83 single_reloc.delta = 0;
84 single_reloc.target_handle = handle;
85 single_reloc.read_domains = I915_GEM_DOMAIN_RENDER;
86 single_reloc.write_domain = I915_GEM_DOMAIN_RENDER;
87 single_reloc.presumed_offset = 0;
89 igt_assert(ioctl(fd, DRM_IOCTL_I915_GEM_EXECBUFFER2, &execbuf) == 0);
92 igt_subtest("source-offset-big") {
93 single_reloc.offset = 4096;
94 single_reloc.delta = 0;
95 single_reloc.target_handle = handle;
96 single_reloc.read_domains = I915_GEM_DOMAIN_RENDER;
97 single_reloc.write_domain = I915_GEM_DOMAIN_RENDER;
98 single_reloc.presumed_offset = 0;
100 igt_assert(ioctl(fd, DRM_IOCTL_I915_GEM_EXECBUFFER2, &execbuf) != 0);
101 igt_assert(errno == EINVAL);
104 igt_subtest("source-offset-negative") {
105 single_reloc.offset = (int64_t) -4;
106 single_reloc.delta = 0;
107 single_reloc.target_handle = handle;
108 single_reloc.read_domains = I915_GEM_DOMAIN_RENDER;
109 single_reloc.write_domain = I915_GEM_DOMAIN_RENDER;
110 single_reloc.presumed_offset = 0;
112 igt_assert(ioctl(fd, DRM_IOCTL_I915_GEM_EXECBUFFER2, &execbuf) != 0);
113 igt_assert(errno == EINVAL);
116 igt_subtest("source-offset-unaligned") {
117 single_reloc.offset = 1;
118 single_reloc.delta = 0;
119 single_reloc.target_handle = handle;
120 single_reloc.read_domains = I915_GEM_DOMAIN_RENDER;
121 single_reloc.write_domain = I915_GEM_DOMAIN_RENDER;
122 single_reloc.presumed_offset = 0;
124 igt_assert(ioctl(fd, DRM_IOCTL_I915_GEM_EXECBUFFER2, &execbuf) != 0);
125 igt_assert(errno == EINVAL);
129 execobjs[0].handle = batch_handle;
130 execobjs[0].relocation_count = 0;
131 execobjs[0].relocs_ptr = 0;
133 execbuf.buffer_count = 1;
136 igt_subtest("batch-start-unaligend") {
137 execbuf.batch_start_offset = 1;
138 execbuf.batch_len = 8;
140 igt_assert(ioctl(fd, DRM_IOCTL_I915_GEM_EXECBUFFER2, &execbuf) != 0);
141 igt_assert(errno == EINVAL);
144 igt_subtest("batch-end-unaligend") {
145 execbuf.batch_start_offset = 0;
146 execbuf.batch_len = 7;
148 igt_assert(ioctl(fd, DRM_IOCTL_I915_GEM_EXECBUFFER2, &execbuf) != 0);
149 igt_assert(errno == EINVAL);
153 /* Undo damage for next tests. */
154 execbuf.batch_start_offset = 0;
155 execbuf.batch_len = 8;
157 gem_close(fd, handle);
161 static void reloc_tests(void)
164 unsigned int total_unsigned = 0;
166 igt_subtest("invalid-address") {
167 /* Attempt unmapped single entry. */
168 execobjs[0].relocation_count = 1;
169 execobjs[0].relocs_ptr = 0;
170 execbuf.buffer_count = 1;
173 ioctl(fd, DRM_IOCTL_I915_GEM_EXECBUFFER2, &execbuf);
174 igt_assert(errno == EFAULT);
177 igt_subtest("single-overflow") {
178 /* Attempt single overflowed entry. */
179 execobjs[0].relocation_count = (1 << 31);
180 execobjs[0].relocs_ptr = (uintptr_t)reloc;
181 execbuf.buffer_count = 1;
184 ioctl(fd, DRM_IOCTL_I915_GEM_EXECBUFFER2, &execbuf);
185 igt_assert(errno == EINVAL);
188 igt_subtest("wrapped-overflow") {
189 /* Attempt wrapped overflow entries. */
190 for (i = 0; i < num; i++) {
191 struct drm_i915_gem_exec_object2 *obj = &execobjs[i];
192 obj->handle = handles[i];
195 /* Wraps to 1 on last count. */
196 obj->relocation_count = 1 - total_unsigned;
197 obj->relocs_ptr = (uintptr_t)reloc;
199 obj->relocation_count = entries;
200 obj->relocs_ptr = (uintptr_t)reloc;
203 total_unsigned += obj->relocation_count;
205 execbuf.buffer_count = num;
208 ioctl(fd, DRM_IOCTL_I915_GEM_EXECBUFFER2, &execbuf);
209 igt_assert(errno == EINVAL);
213 static void buffer_count_tests(void)
215 igt_subtest("buffercount-overflow") {
216 for (int i = 0; i < num; i++) {
217 execobjs[i].relocation_count = 0;
218 execobjs[i].relocs_ptr = 0;
219 execobjs[i].handle = handles[i];
222 execobjs[0].relocation_count = 0;
223 execobjs[0].relocs_ptr = 0;
224 /* We only have num buffers actually, but the overflow will make
225 * sure we blow up the kernel before we blow up userspace. */
226 execbuf.buffer_count = num;
228 /* Put a real batch at the end. */
229 execobjs[num - 1].handle = batch_handle;
231 /* Make sure the basic thing would work first ... */
233 ioctl(fd, DRM_IOCTL_I915_GEM_EXECBUFFER2, &execbuf);
234 igt_assert(errno == 0);
236 /* ... then be evil: Overflow of the pointer table (which has a
237 * bit of lead datastructures, so no + 1 needed to overflow). */
238 execbuf.buffer_count = INT_MAX / sizeof(void *);
241 ioctl(fd, DRM_IOCTL_I915_GEM_EXECBUFFER2, &execbuf);
242 igt_assert(errno == EINVAL);
244 /* ... then be evil: Copying/allocating the array. */
245 execbuf.buffer_count = UINT_MAX / sizeof(execobjs[0]) + 1;
248 ioctl(fd, DRM_IOCTL_I915_GEM_EXECBUFFER2, &execbuf);
249 igt_assert(errno == EINVAL);
257 uint32_t batch_data [2] = { MI_NOOP, MI_BATCH_BUFFER_END };
261 /* Create giant reloc buffer area. */
263 entries = ((1ULL << 32) / (num - 1));
264 reloc_size = entries * sizeof(struct drm_i915_gem_relocation_entry);
265 reloc = mmap(NULL, reloc_size, PROT_READ | PROT_WRITE,
266 MAP_PRIVATE | MAP_ANON, -1, 0);
267 igt_assert(reloc != MAP_FAILED);
269 /* Allocate the handles we'll need to wrap. */
270 handles = calloc(num, sizeof(*handles));
271 for (int i = 0; i < num; i++)
272 handles[i] = gem_create(fd, 4096);
274 if (intel_gen(intel_get_drm_devid(fd)) >= 6)
275 ring = I915_EXEC_BLT;
279 /* Create relocation objects. */
280 execobjs = calloc(num, sizeof(*execobjs));
281 execbuf.buffers_ptr = (uintptr_t)execobjs;
282 execbuf.batch_start_offset = 0;
283 execbuf.batch_len = 8;
284 execbuf.cliprects_ptr = 0;
285 execbuf.num_cliprects = 0;
288 execbuf.flags = ring;
289 i915_execbuffer2_set_context_id(execbuf, 0);
292 batch_handle = gem_create(fd, 4096);
294 gem_write(fd, batch_handle, 0, batch_data, sizeof(batch_data));
299 source_offset_tests();
301 buffer_count_tests();
304 gem_close(fd, batch_handle);