igt/gem_mmap_gtt: Exercise concurrent pagefaulting

This should hit the BUG inside remap_pfn_range in

commit c5158fabeaf53ed2c614c3333aaa4b3cce80f500
Author: Chris Wilson <chris@chris-wilson.co.uk>
Date:   Tue Jun 10 12:14:41 2014 +0100

[   27.767634] kernel BUG at mm/memory.c:2315!
[   27.767655] invalid opcode: 0000 [#1] SMP
[   27.767679] Modules linked in: cpufreq_userspace cpufreq_powersave cpufreq_stats cpufreq_conservative binfmt_misc nfs lockd fscache sunrpc hid_generic usbhid hid x86_pkg_temp_thermal microcode i2c_i801 lpc_ich mfd_core battery acpi_cpufreq evdev processor ac loop ehci_pci xhci_hcd ehci_hcd sr_mod usbcore cdrom usb_common fan thermal
[   27.767872] CPU: 3 PID: 912 Comm: gem_mmap_gtt Not tainted 3.15.0-rc8+ #953
[   27.767903] Hardware name: Intel Corporation Shark Bay Client platform/Flathead Creek Crb, BIOS HSWLPTU1.86C.0109.R03.1301282055 01/28/2013
[   27.767956] task: ffff880448415010 ti: ffff88044d22c000 task.ti: ffff88044d22c000
[   27.767988] RIP: 0010:[<ffffffff81130734>]  [<ffffffff81130734>] remap_pfn_range+0x2a4/0x400
[   27.768033] RSP: 0000:ffff88044d22fc28  EFLAGS: 00010282
[   27.768057] RAX: 0000000000020002 RBX: 00000000000a3b57 RCX: ffff880448b73fe8
[   27.768088] RDX: 0000000000000002 RSI: ffff880000000000 RDI: ffffea000efe8158
[   27.768119] RBP: ffff88044d22fcd8 R08: 00007fc7b57fe000 R09: 00007fc7b57fe000
[   27.768150] R10: 00000000000001fd R11: 0000000000000a9a R12: ffffea000efe8128
[   27.768180] R13: 0000000000000001 R14: 00007fc7b57fd000 R15: 800000000000002f
[   27.768212] FS:  00007fc7977fc700(0000) GS:ffff88045e380000(0000) knlGS:0000000000000000
[   27.768246] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[   27.768272] CR2: 00007fc7b67fd000 CR3: 000000044866c000 CR4: 00000000001407e0
[   27.768303] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[   27.768333] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[   27.768363] Stack:
[   27.768374]  ffff880448bbb6f8 00000000ffffffff 00007fc7b57fdfff 00007fc7b57fdfff
[   27.768414]  00007fc7b57fe000 ffff88044866c7f8 ffff8804496b08f0 00007fc7b57fdfff
[   27.768454]  fffffff8038ee35a 0000000000001000 ffff88044c208180 00007fc7b57fe000
[   27.768494] Call Trace:
[   27.768511]  [<ffffffff81365277>] i915_gem_fault+0x337/0x340
[   27.768538]  [<ffffffff8112d3c4>] __do_fault+0x34/0x70
[   27.768565]  [<ffffffff8109088e>] ? wake_up_process+0x1e/0x40
[   27.768592]  [<ffffffff8113015c>] do_shared_fault.isra.96+0x2c/0x1f0
[   27.768623]  [<ffffffff81502405>] ? rwsem_down_read_failed+0xe5/0x130
[   27.768654]  [<ffffffff810a2519>] ? __rwsem_do_wake+0x129/0x160
[   27.768682]  [<ffffffff81131085>] handle_mm_fault+0x2b5/0xb80
[   27.768712]  [<ffffffff81270a64>] ? call_rwsem_down_read_failed+0x14/0x30
[   27.768745]  [<ffffffff81036c67>] __do_page_fault+0x167/0x4c0
[   27.768774]  [<ffffffff8109a540>] ? pick_next_task_fair+0x700/0x870
[   27.768804]  [<ffffffff814ff23b>] ? __schedule+0x27b/0x860
[   27.768831]  [<ffffffff81036fec>] do_page_fault+0xc/0x10
[   27.768857]  [<ffffffff815034a2>] page_fault+0x22/0x30
[   27.768881] Code: 4d 85 ed 49 0f 44 d7 80 cc 02 49 81 c6 00 10 00 00 48 83 c3 01 48 83 c1 08 48 09 d0 48 89 41 f8 4d 39 f0 74 32 48 83 39 00 74 c4 <0f> 0b 66 2e 0f 1f 84 00 00 00 00 00 48 39 37 75 63 48 8b 45 c8
[   27.769081] RIP  [<ffffffff81130734>] remap_pfn_range+0x2a4/0x400
[   27.769113]  RSP <ffff88044d22fc28>

Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>

diff --git a/tests/Makefile.am b/tests/Makefile.am
index 71ecdf2..10b34c0 100644 (file)
--- a/tests/Makefile.am
+++ b/tests/Makefile.am
@@ -53,6 +53,8 @@ gem_fence_thrash_CFLAGS = $(AM_CFLAGS) $(THREAD_CFLAGS)
 gem_fence_thrash_LDADD = $(LDADD) -lpthread
 gem_flink_race_CFLAGS = $(AM_CFLAGS) $(THREAD_CFLAGS)
 gem_flink_race_LDADD = $(LDADD) -lpthread
+gem_mmap_gtt_CFLAGS = $(AM_CFLAGS) $(THREAD_CFLAGS)
+gem_mmap_gtt_LDADD = $(LDADD) -lpthread
 gem_threaded_access_tiled_CFLAGS = $(AM_CFLAGS) $(THREAD_CFLAGS)
 gem_threaded_access_tiled_LDADD = $(LDADD) -lpthread
 gem_tiled_swapping_CFLAGS = $(AM_CFLAGS) $(THREAD_CFLAGS)

diff --git a/tests/gem_mmap_gtt.c b/tests/gem_mmap_gtt.c
index 7ba5e39..c315470 100644 (file)
--- a/tests/gem_mmap_gtt.c
+++ b/tests/gem_mmap_gtt.c
@@ -32,6 +32,7 @@
 #include <string.h>
 #include <fcntl.h>
 #include <inttypes.h>
+#include <pthread.h>
 #include <errno.h>
 #include <sys/stat.h>
 #include <sys/ioctl.h>
@@ -126,6 +127,63 @@ test_copy(int fd)
        munmap(src, OBJECT_SIZE);
 }
 
+enum test_read_write {
+       READ_BEFORE_WRITE,
+       READ_AFTER_WRITE,
+};
+
+static void
+test_read_write(int fd, enum test_read_write order)
+{
+       uint32_t handle;
+       void *ptr;
+       volatile uint32_t val = 0;
+
+       handle = gem_create(fd, OBJECT_SIZE);
+
+       ptr = gem_mmap(fd, handle, OBJECT_SIZE, PROT_READ | PROT_WRITE);
+       igt_assert(ptr != MAP_FAILED);
+
+       if (order == READ_BEFORE_WRITE) {
+               val = *(uint32_t *)ptr;
+               *(uint32_t *)ptr = val;
+       } else {
+               *(uint32_t *)ptr = val;
+               val = *(uint32_t *)ptr;
+       }
+
+       gem_close(fd, handle);
+       munmap(ptr, OBJECT_SIZE);
+}
+
+static void
+test_read_write2(int fd, enum test_read_write order)
+{
+       uint32_t handle;
+       void *r, *w;
+       volatile uint32_t val = 0;
+
+       handle = gem_create(fd, OBJECT_SIZE);
+
+       r = gem_mmap(fd, handle, OBJECT_SIZE, PROT_READ);
+       igt_assert(r != MAP_FAILED);
+
+       w = gem_mmap(fd, handle, OBJECT_SIZE, PROT_READ | PROT_WRITE);
+       igt_assert(w != MAP_FAILED);
+
+       if (order == READ_BEFORE_WRITE) {
+               val = *(uint32_t *)r;
+               *(uint32_t *)w = val;
+       } else {
+               *(uint32_t *)w = val;
+               val = *(uint32_t *)r;
+       }
+
+       gem_close(fd, handle);
+       munmap(r, OBJECT_SIZE);
+       munmap(w, OBJECT_SIZE);
+}
+
 static void
 test_write(int fd)
 {
@@ -181,6 +239,54 @@ test_read(int fd)
        munmap(dst, OBJECT_SIZE);
 }
 
+struct thread_fault_concurrent {
+       pthread_t thread;
+       int id;
+       uint32_t **ptr;
+};
+
+static void *
+thread_fault_concurrent(void *closure)
+{
+       struct thread_fault_concurrent *t = closure;
+       uint32_t val = 0;
+       int n;
+
+       for (n = 0; n < 32; n++) {
+               if (n & 1)
+                       *t->ptr[(n + t->id) % 32] = val;
+               else
+                       val = *t->ptr[(n + t->id) % 32];
+       }
+
+       return NULL;
+}
+
+static void
+test_fault_concurrent(int fd)
+{
+       uint32_t *ptr[32];
+       struct thread_fault_concurrent thread[64];
+       int n;
+
+       for (n = 0; n < 32; n++) {
+               ptr[n] = create_pointer(fd);
+       }
+
+       for (n = 0; n < 64; n++) {
+               thread[n].ptr = ptr;
+               thread[n].id = n;
+               pthread_create(&thread[n].thread, NULL, thread_fault_concurrent, &thread[n]);
+       }
+
+       for (n = 0; n < 64; n++)
+               pthread_join(thread[n].thread, NULL);
+
+       for (n = 0; n < 32; n++) {
+               munmap(ptr[n], OBJECT_SIZE);
+       }
+}
+
 static void
 run_without_prefault(int fd,
                        void (*func)(int fd))
@@ -210,6 +316,16 @@ igt_main
                test_write(fd);
        igt_subtest("write-gtt")
                test_write_gtt(fd);
+       igt_subtest("read-write")
+               test_read_write(fd, READ_BEFORE_WRITE);
+       igt_subtest("write-read")
+               test_read_write(fd, READ_AFTER_WRITE);
+       igt_subtest("read-write-distinct")
+               test_read_write2(fd, READ_BEFORE_WRITE);
+       igt_subtest("write-read-distinct")
+               test_read_write2(fd, READ_AFTER_WRITE);
+       igt_subtest("fault-concurrent")
+               test_fault_concurrent(fd);
        igt_subtest("read-no-prefault")
                run_without_prefault(fd, test_read);
        igt_subtest("write-no-prefault")