Skip to content

Commit

Permalink
drm/i915/selftest: Clear the output buffers before GPU writes
Browse files Browse the repository at this point in the history
When testing whether we can get the GPU to leak information about
non-privileged state, we first need to ensure that the output buffer is
set to a known value as the HW may opt to skip the write into memory for
a non-privileged read of a sensitive register. We chose POISON_INUSE (0x5a)
so that is both non-zero and distinct from the poison values used during
the test.

v2:
  Use i915_gem_object_pin_map_unlocked

Reported-by: CQ Tang <cq.tang@intel.com>
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Cc: CQ Tang <cq.tang@intel.com>
cc: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
Signed-off-by: Ramalingam C <ramalingam.c@intel.com>
Reviewed-by: Thomas Hellstrom <thomas.hellstrom@linux.intel.com>
Signed-off-by: Karolina Drobnik <karolina.drobnik@intel.com>
Reviewed-by: Andi Shyti <andi.shyti@linux.intel.com>
Signed-off-by: Andi Shyti <andi.shyti@linux.intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/5cebab02d182c171cf40cb5b73d6c3eeb7619360.1663081418.git.karolina.drobnik@intel.com
  • Loading branch information
Chris Wilson authored and Andi Shyti committed Sep 14, 2022
1 parent 25e4b26 commit 42b2bdc
Showing 1 changed file with 28 additions and 4 deletions.
32 changes: 28 additions & 4 deletions drivers/gpu/drm/i915/gt/selftest_lrc.c
Original file line number Diff line number Diff line change
Expand Up @@ -1395,6 +1395,30 @@ static int compare_isolation(struct intel_engine_cs *engine,
return err;
}

static struct i915_vma *
create_result_vma(struct i915_address_space *vm, unsigned long sz)
{
struct i915_vma *vma;
void *ptr;

vma = create_user_vma(vm, sz);
if (IS_ERR(vma))
return vma;

/* Set the results to a known value distinct from the poison */
ptr = i915_gem_object_pin_map_unlocked(vma->obj, I915_MAP_WC);
if (IS_ERR(ptr)) {
i915_vma_put(vma);
return ERR_CAST(ptr);
}

memset(ptr, POISON_INUSE, vma->size);
i915_gem_object_flush_map(vma->obj);
i915_gem_object_unpin_map(vma->obj);

return vma;
}

static int __lrc_isolation(struct intel_engine_cs *engine, u32 poison)
{
u32 *sema = memset32(engine->status_page.addr + 1000, 0, 1);
Expand All @@ -1413,13 +1437,13 @@ static int __lrc_isolation(struct intel_engine_cs *engine, u32 poison)
goto err_A;
}

ref[0] = create_user_vma(A->vm, SZ_64K);
ref[0] = create_result_vma(A->vm, SZ_64K);
if (IS_ERR(ref[0])) {
err = PTR_ERR(ref[0]);
goto err_B;
}

ref[1] = create_user_vma(A->vm, SZ_64K);
ref[1] = create_result_vma(A->vm, SZ_64K);
if (IS_ERR(ref[1])) {
err = PTR_ERR(ref[1]);
goto err_ref0;
Expand All @@ -1441,13 +1465,13 @@ static int __lrc_isolation(struct intel_engine_cs *engine, u32 poison)
}
i915_request_put(rq);

result[0] = create_user_vma(A->vm, SZ_64K);
result[0] = create_result_vma(A->vm, SZ_64K);
if (IS_ERR(result[0])) {
err = PTR_ERR(result[0]);
goto err_ref1;
}

result[1] = create_user_vma(A->vm, SZ_64K);
result[1] = create_result_vma(A->vm, SZ_64K);
if (IS_ERR(result[1])) {
err = PTR_ERR(result[1]);
goto err_result0;
Expand Down

0 comments on commit 42b2bdc

Please sign in to comment.