2 * Copyright © 2013 Google
3 * Copyright © 2013 Intel Corporation
5 * Permission is hereby granted, free of charge, to any person obtaining a
6 * copy of this software and associated documentation files (the "Software"),
7 * to deal in the Software without restriction, including without limitation
8 * the rights to use, copy, modify, merge, publish, distribute, sublicense,
9 * and/or sell copies of the Software, and to permit persons to whom the
10 * Software is furnished to do so, subject to the following conditions:
12 * The above copyright notice and this permission notice (including the next
13 * paragraph) shall be included in all copies or substantial portions of the
16 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
17 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
18 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
19 * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
20 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
21 * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS
25 * Kees Cook <keescook@chromium.org>
26 * Daniel Vetter <daniel.vetter@ffwll.ch>
27 * Rafael Barbalho <rafael.barbalho@intel.com>
41 #include <sys/ioctl.h>
44 #include <sys/types.h>
48 #include "intel_gpu_tools.h"
51 * Testcase: Kernel relocation overflows are caught.
57 struct drm_i915_gem_exec_object2 *execobjs;
58 struct drm_i915_gem_execbuffer2 execbuf = { 0 };
59 struct drm_i915_gem_relocation_entry *reloc;
62 uint32_t batch_handle;
64 static void source_offset_tests(int devid, bool reloc_gtt)
66 struct drm_i915_gem_relocation_entry single_reloc;
68 char *relocation_type;
71 handle = gem_create(fd, 8192);
73 execobjs[1].handle = batch_handle;
74 execobjs[1].relocation_count = 0;
75 execobjs[1].relocs_ptr = 0;
77 execobjs[0].handle = handle;
78 execobjs[0].relocation_count = 1;
79 execobjs[0].relocs_ptr = (uintptr_t) &single_reloc;
80 execbuf.buffer_count = 2;
83 dst_gtt = gem_mmap(fd, handle, 8192, PROT_READ | PROT_WRITE);
84 igt_assert(dst_gtt != MAP_FAILED);
85 gem_set_domain(fd, handle, I915_GEM_DOMAIN_GTT, I915_GEM_DOMAIN_GTT);
86 memset(dst_gtt, 0, 8192);
87 munmap(dst_gtt, 8192);
88 relocation_type = "reloc-gtt";
90 relocation_type = "reloc-cpu";
94 if (intel_gen(devid) >= 8) {
95 igt_subtest_f("source-offset-page-stradle-gen8+-%s", relocation_type) {
96 single_reloc.offset = 4096 - 4;
97 single_reloc.delta = 0;
98 single_reloc.target_handle = handle;
99 single_reloc.read_domains = I915_GEM_DOMAIN_RENDER;
100 single_reloc.write_domain = I915_GEM_DOMAIN_RENDER;
101 single_reloc.presumed_offset = 0;
103 igt_assert(ioctl(fd, DRM_IOCTL_I915_GEM_EXECBUFFER2, &execbuf) == 0);
104 single_reloc.delta = 1024;
105 igt_assert(ioctl(fd, DRM_IOCTL_I915_GEM_EXECBUFFER2, &execbuf) == 0);
108 igt_subtest_f("source-offset-end-gen8+-%s", relocation_type) {
109 single_reloc.offset = 8192 - 8;
110 single_reloc.delta = 0;
111 single_reloc.target_handle = handle;
112 single_reloc.read_domains = I915_GEM_DOMAIN_RENDER;
113 single_reloc.write_domain = I915_GEM_DOMAIN_RENDER;
114 single_reloc.presumed_offset = 0;
116 igt_assert(ioctl(fd, DRM_IOCTL_I915_GEM_EXECBUFFER2, &execbuf) == 0);
119 igt_subtest_f("source-offset-overflow-gen8+-%s", relocation_type) {
120 single_reloc.offset = 8192 - 4;
121 single_reloc.delta = 0;
122 single_reloc.target_handle = handle;
123 single_reloc.read_domains = I915_GEM_DOMAIN_RENDER;
124 single_reloc.write_domain = I915_GEM_DOMAIN_RENDER;
125 single_reloc.presumed_offset = 0;
127 igt_assert(ioctl(fd, DRM_IOCTL_I915_GEM_EXECBUFFER2, &execbuf) != 0);
128 igt_assert(errno == EINVAL);
131 igt_subtest_f("source-offset-end-%s", relocation_type) {
132 single_reloc.offset = 8192 - 4;
133 single_reloc.delta = 0;
134 single_reloc.target_handle = handle;
135 single_reloc.read_domains = I915_GEM_DOMAIN_RENDER;
136 single_reloc.write_domain = I915_GEM_DOMAIN_RENDER;
137 single_reloc.presumed_offset = 0;
139 igt_assert(ioctl(fd, DRM_IOCTL_I915_GEM_EXECBUFFER2, &execbuf) == 0);
143 igt_subtest_f("source-offset-big-%s", relocation_type) {
144 single_reloc.offset = 8192;
145 single_reloc.delta = 0;
146 single_reloc.target_handle = handle;
147 single_reloc.read_domains = I915_GEM_DOMAIN_RENDER;
148 single_reloc.write_domain = I915_GEM_DOMAIN_RENDER;
149 single_reloc.presumed_offset = 0;
151 igt_assert(ioctl(fd, DRM_IOCTL_I915_GEM_EXECBUFFER2, &execbuf) != 0);
152 igt_assert(errno == EINVAL);
155 igt_subtest_f("source-offset-negative-%s", relocation_type) {
156 single_reloc.offset = (int64_t) -4;
157 single_reloc.delta = 0;
158 single_reloc.target_handle = handle;
159 single_reloc.read_domains = I915_GEM_DOMAIN_RENDER;
160 single_reloc.write_domain = I915_GEM_DOMAIN_RENDER;
161 single_reloc.presumed_offset = 0;
163 igt_assert(ioctl(fd, DRM_IOCTL_I915_GEM_EXECBUFFER2, &execbuf) != 0);
164 igt_assert(errno == EINVAL);
167 igt_subtest_f("source-offset-unaligned-%s", relocation_type) {
168 single_reloc.offset = 1;
169 single_reloc.delta = 0;
170 single_reloc.target_handle = handle;
171 single_reloc.read_domains = I915_GEM_DOMAIN_RENDER;
172 single_reloc.write_domain = I915_GEM_DOMAIN_RENDER;
173 single_reloc.presumed_offset = 0;
175 igt_assert(ioctl(fd, DRM_IOCTL_I915_GEM_EXECBUFFER2, &execbuf) != 0);
176 igt_assert(errno == EINVAL);
180 gem_close(fd, handle);
184 static void reloc_tests(void)
187 unsigned int total_unsigned = 0;
189 igt_subtest("invalid-address") {
190 /* Attempt unmapped single entry. */
191 execobjs[0].relocation_count = 1;
192 execobjs[0].relocs_ptr = 0;
193 execbuf.buffer_count = 1;
196 ioctl(fd, DRM_IOCTL_I915_GEM_EXECBUFFER2, &execbuf);
197 igt_assert(errno == EFAULT);
200 igt_subtest("single-overflow") {
201 /* Attempt single overflowed entry. */
202 execobjs[0].relocation_count = (1 << 31);
203 execobjs[0].relocs_ptr = (uintptr_t)reloc;
204 execbuf.buffer_count = 1;
207 ioctl(fd, DRM_IOCTL_I915_GEM_EXECBUFFER2, &execbuf);
208 igt_assert(errno == EINVAL);
212 execobjs[0].handle = batch_handle;
213 execobjs[0].relocation_count = 0;
214 execobjs[0].relocs_ptr = 0;
216 execbuf.buffer_count = 1;
219 igt_subtest("batch-start-unaligned") {
220 execbuf.batch_start_offset = 1;
221 execbuf.batch_len = 8;
223 igt_assert(ioctl(fd, DRM_IOCTL_I915_GEM_EXECBUFFER2, &execbuf) != 0);
224 igt_assert(errno == EINVAL);
227 igt_subtest("batch-end-unaligned") {
228 execbuf.batch_start_offset = 0;
229 execbuf.batch_len = 7;
231 igt_assert(ioctl(fd, DRM_IOCTL_I915_GEM_EXECBUFFER2, &execbuf) != 0);
232 igt_assert(errno == EINVAL);
236 /* Undo damage for next tests. */
237 execbuf.batch_start_offset = 0;
238 execbuf.batch_len = 8;
241 igt_subtest("wrapped-overflow") {
242 /* Attempt wrapped overflow entries. */
243 for (i = 0; i < num; i++) {
244 struct drm_i915_gem_exec_object2 *obj = &execobjs[i];
245 obj->handle = handles[i];
248 /* Wraps to 1 on last count. */
249 obj->relocation_count = 1 - total_unsigned;
250 obj->relocs_ptr = (uintptr_t)reloc;
252 obj->relocation_count = entries;
253 obj->relocs_ptr = (uintptr_t)reloc;
256 total_unsigned += obj->relocation_count;
258 execbuf.buffer_count = num;
261 ioctl(fd, DRM_IOCTL_I915_GEM_EXECBUFFER2, &execbuf);
262 igt_assert(errno == EINVAL);
266 static void buffer_count_tests(void)
268 igt_subtest("buffercount-overflow") {
269 for (int i = 0; i < num; i++) {
270 execobjs[i].relocation_count = 0;
271 execobjs[i].relocs_ptr = 0;
272 execobjs[i].handle = handles[i];
275 execobjs[0].relocation_count = 0;
276 execobjs[0].relocs_ptr = 0;
277 /* We only have num buffers actually, but the overflow will make
278 * sure we blow up the kernel before we blow up userspace. */
279 execbuf.buffer_count = num;
281 /* Put a real batch at the end. */
282 execobjs[num - 1].handle = batch_handle;
284 /* Make sure the basic thing would work first ... */
286 ioctl(fd, DRM_IOCTL_I915_GEM_EXECBUFFER2, &execbuf);
287 igt_assert(errno == 0);
289 /* ... then be evil: Overflow of the pointer table (which has a
290 * bit of lead datastructures, so no + 1 needed to overflow). */
291 execbuf.buffer_count = INT_MAX / sizeof(void *);
294 ioctl(fd, DRM_IOCTL_I915_GEM_EXECBUFFER2, &execbuf);
295 igt_assert(errno == EINVAL);
297 /* ... then be evil: Copying/allocating the array. */
298 execbuf.buffer_count = UINT_MAX / sizeof(execobjs[0]) + 1;
301 ioctl(fd, DRM_IOCTL_I915_GEM_EXECBUFFER2, &execbuf);
302 igt_assert(errno == EINVAL);
312 uint32_t batch_data [2] = { MI_NOOP, MI_BATCH_BUFFER_END };
316 devid = intel_get_drm_devid(fd);
318 /* Create giant reloc buffer area. */
320 entries = ((1ULL << 32) / (num - 1));
321 reloc_size = entries * sizeof(struct drm_i915_gem_relocation_entry);
322 reloc = mmap(NULL, reloc_size, PROT_READ | PROT_WRITE,
323 MAP_PRIVATE | MAP_ANON, -1, 0);
324 igt_assert(reloc != MAP_FAILED);
326 /* Allocate the handles we'll need to wrap. */
327 handles = calloc(num, sizeof(*handles));
328 for (int i = 0; i < num; i++)
329 handles[i] = gem_create(fd, 4096);
331 if (intel_gen(devid) >= 6)
332 ring = I915_EXEC_BLT;
336 /* Create relocation objects. */
337 execobjs = calloc(num, sizeof(*execobjs));
338 execbuf.buffers_ptr = (uintptr_t)execobjs;
339 execbuf.batch_start_offset = 0;
340 execbuf.batch_len = 8;
341 execbuf.cliprects_ptr = 0;
342 execbuf.num_cliprects = 0;
345 execbuf.flags = ring;
346 i915_execbuffer2_set_context_id(execbuf, 0);
349 batch_handle = gem_create(fd, 4096);
351 gem_write(fd, batch_handle, 0, batch_data, sizeof(batch_data));
356 source_offset_tests(devid, false);
357 source_offset_tests(devid, true);
359 buffer_count_tests();
362 gem_close(fd, batch_handle);