[Intel-gfx] [CI] drm/i915/selftests: Verify context isolation

* [Intel-gfx] [CI] drm/i915/selftests: Verify context isolation
@ 2020-04-23 10:15 Chris Wilson
  2020-04-23 10:59 ` [Intel-gfx] ✗ Fi.CI.CHECKPATCH: warning for drm/i915/selftests: Verify context isolation (rev3) Patchwork
                   ` (9 more replies)
  0 siblings, 10 replies; 11+ messages in thread
From: Chris Wilson @ 2020-04-23 10:15 UTC (permalink / raw)
  To: intel-gfx

No unprivileged context should ever be allowed to modify state that is
visible to another; there should be no backchannels available or control
leakage for malicious actors.

This test tries to write to a set of random registers using
non-privileged instructions (ala userspace). It should only be allowed
to write into its context state, and all writes should not be visible to
a second context. To verify this, we store the value of the register
before writing to it in context A (as this should be the default value
inherited from the golden context state) and do a read back from context
B of the same register. The reads from both contexts should be identical,
the default value, except for a few free running counters (either global
or local).

Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Cc: Mika Kuoppala <mika.kuoppala@linux.intel.com>
---
 .../drm/i915/gem/selftests/i915_gem_context.c | 411 ++++++++++++++++++
 1 file changed, 411 insertions(+)

diff --git a/drivers/gpu/drm/i915/gem/selftests/i915_gem_context.c b/drivers/gpu/drm/i915/gem/selftests/i915_gem_context.c
index f4f933240b39..b5b3981076f3 100644
--- a/drivers/gpu/drm/i915/gem/selftests/i915_gem_context.c
+++ b/drivers/gpu/drm/i915/gem/selftests/i915_gem_context.c
@@ -1865,6 +1865,416 @@ static int igt_vm_isolation(void *arg)
 	return err;
 }
 
+static struct i915_vma *create_vma(struct i915_address_space *vm, size_t sz)
+{
+	struct drm_i915_gem_object *obj;
+	struct i915_vma *vma;
+
+	obj = i915_gem_object_create_internal(vm->i915, sz);
+	if (IS_ERR(obj))
+		return ERR_CAST(obj);
+
+	vma = i915_vma_instance(obj, vm, NULL);
+	if (IS_ERR(vma))
+		i915_gem_object_put(obj);
+
+	return vma;
+}
+
+static int iso_write(struct i915_gem_context *ctx,
+		     struct intel_engine_cs *engine,
+		     struct drm_i915_gem_object *obj,
+		     u32 *ctl)
+{
+	struct i915_vma *batch, *vma;
+	struct intel_context *ce;
+	struct i915_request *rq;
+	u32 *cs;
+	int err;
+	int i;
+
+	ce = i915_gem_context_get_engine(ctx, engine->legacy_idx);
+	if (IS_ERR(ce))
+		return PTR_ERR(ce);
+
+	batch = create_vma(ce->vm, 64 << 10);
+	if (IS_ERR(batch))
+		return PTR_ERR(batch);
+
+	vma = i915_vma_instance(obj, ce->vm, NULL);
+	if (IS_ERR(vma)) {
+		err = PTR_ERR(vma);
+		goto err_batch;
+	}
+
+	err = i915_vma_pin(batch, 0, 0, PIN_USER);
+	if (err)
+		goto err_batch;
+
+	err = i915_vma_pin(vma, 0, 0, PIN_USER);
+	if (err)
+		goto err_unpin_batch;
+
+	cs = i915_gem_object_pin_map(batch->obj, I915_MAP_WC);
+	if (IS_ERR(cs)) {
+		err = PTR_ERR(cs);
+		goto err_vma;
+	}
+
+	for (i = 0; i < 1024; i++) {
+		*cs++ = MI_LOAD_REGISTER_IMM(1);
+		*cs++ = ctl[4 * i + 0];
+		*cs++ = ctl[4 * i + 1];
+	}
+	*cs++ = MI_BATCH_BUFFER_END;
+
+	i915_gem_object_flush_map(batch->obj);
+	i915_gem_object_unpin_map(batch->obj);
+
+	rq = intel_context_create_request(ce);
+	if (IS_ERR(rq)) {
+		err = PTR_ERR(rq);
+		goto err_vma;
+	}
+
+	i915_vma_lock(vma);
+	err = i915_request_await_object(rq, vma->obj, true);
+	if (err == 0)
+		err = i915_vma_move_to_active(vma, rq, EXEC_OBJECT_WRITE);
+	i915_vma_unlock(vma);
+	if (err)
+		goto err_rq;
+
+	i915_vma_lock(batch);
+	err = i915_request_await_object(rq, batch->obj, false);
+	if (err == 0)
+		err = i915_vma_move_to_active(batch, rq, 0);
+	i915_vma_unlock(batch);
+	if (err)
+		goto err_rq;
+
+	err = engine->emit_bb_start(rq, batch->node.start, batch->node.size, 0);
+
+err_rq:
+	i915_request_add(rq);
+err_vma:
+	i915_vma_unpin(vma);
+err_unpin_batch:
+	i915_vma_unpin(batch);
+err_batch:
+	i915_vma_put(batch);
+	return err;
+}
+
+static int iso_read(struct i915_gem_context *ctx,
+		    struct intel_engine_cs *engine,
+		    struct drm_i915_gem_object *obj,
+		    u32 *ctl,
+		    int idx)
+{
+	struct i915_vma *batch, *vma;
+	struct intel_context *ce;
+	struct i915_request *rq;
+	u32 *cs;
+	int err;
+	int i;
+
+	ce = i915_gem_context_get_engine(ctx, engine->legacy_idx);
+	if (IS_ERR(ce))
+		return PTR_ERR(ce);
+
+	batch = create_vma(ce->vm, 64 << 10);
+	if (IS_ERR(batch))
+		return PTR_ERR(batch);
+
+	vma = i915_vma_instance(obj, ce->vm, NULL);
+	if (IS_ERR(vma)) {
+		err = PTR_ERR(vma);
+		goto err_batch;
+	}
+
+	err = i915_vma_pin(batch, 0, 0, PIN_USER);
+	if (err)
+		goto err_batch;
+
+	err = i915_vma_pin(vma, 0, 0, PIN_USER);
+	if (err)
+		goto err_unpin_batch;
+
+	cs = i915_gem_object_pin_map(batch->obj, I915_MAP_WC);
+	if (IS_ERR(cs)) {
+		err = PTR_ERR(cs);
+		goto err_vma;
+	}
+
+	for (i = 0; i < 1024; i++) {
+		u64 addr = vma->node.start + (4 * i + idx) * sizeof(u32);
+
+		*cs++ = MI_STORE_REGISTER_MEM_GEN8;
+		*cs++ = ctl[4 * i + 0];
+		*cs++ = lower_32_bits(addr);
+		*cs++ = upper_32_bits(addr);
+	}
+	*cs++ = MI_BATCH_BUFFER_END;
+
+	i915_gem_object_flush_map(batch->obj);
+	i915_gem_object_unpin_map(batch->obj);
+
+	rq = intel_context_create_request(ce);
+	if (IS_ERR(rq)) {
+		err = PTR_ERR(rq);
+		goto err_vma;
+	}
+
+	i915_vma_lock(vma);
+	err = i915_request_await_object(rq, vma->obj, true);
+	if (err == 0)
+		err = i915_vma_move_to_active(vma, rq, EXEC_OBJECT_WRITE);
+	i915_vma_unlock(vma);
+	if (err)
+		goto err_rq;
+
+	i915_vma_lock(batch);
+	err = i915_request_await_object(rq, batch->obj, false);
+	if (err == 0)
+		err = i915_vma_move_to_active(batch, rq, 0);
+	i915_vma_unlock(batch);
+	if (err)
+		goto err_rq;
+
+	err = engine->emit_bb_start(rq, batch->node.start, batch->node.size, 0);
+
+err_rq:
+	i915_request_add(rq);
+err_vma:
+	i915_vma_unpin(vma);
+err_unpin_batch:
+	i915_vma_unpin(batch);
+err_batch:
+	i915_vma_put(batch);
+	return err;
+}
+
+static bool is_timestamp(struct drm_i915_private *i915, u32 x)
+{
+	struct intel_engine_cs *engine;
+
+	for_each_uabi_engine(engine, i915) {
+		if (x == engine->mmio_base + 0x358)
+			return true;
+
+		if (x == engine->mmio_base + 0x35c)
+			return true;
+
+		if (x == engine->mmio_base + 0x3a8)
+			return true;
+	}
+
+	return false;
+}
+
+static bool is_whitelist(struct drm_i915_private *i915, u32 x)
+{
+	struct intel_engine_cs *engine;
+
+	for_each_uabi_engine(engine, i915) {
+		const struct i915_wa_list *w = &engine->whitelist;
+		int i;
+
+		for (i = 0; i < w->count; i++) {
+			if (x == i915_mmio_reg_offset(w->list[i].reg))
+				return true;
+		}
+	}
+
+	return false;
+}
+
+static u32 random_reg(struct drm_i915_private *i915,
+		      struct rnd_state *prng)
+{
+	u32 x;
+
+	/*
+	 * Pick any u32 aligned value that is not known to a free running
+	 * counter (e.g. a timestamp).
+	 */
+	do {
+		x = prandom_u32_state(prng) % 10000 * sizeof(u32);
+		if (!is_timestamp(i915, x) && !is_whitelist(i915, x))
+			return x;
+	} while (1);
+}
+
+static void hexdump(const void *buf, size_t len)
+{
+	const size_t rowsize = 8 * sizeof(u32);
+	const void *prev = NULL;
+	bool skip = false;
+	size_t pos;
+
+	for (pos = 0; pos < len; pos += rowsize) {
+		char line[128];
+
+		if (prev && !memcmp(prev, buf + pos, rowsize)) {
+			if (!skip) {
+				pr_info("*\n");
+				skip = true;
+			}
+			continue;
+		}
+
+		WARN_ON_ONCE(hex_dump_to_buffer(buf + pos, len - pos,
+						rowsize, sizeof(u32),
+						line, sizeof(line),
+						false) >= sizeof(line));
+		pr_info("[%04zx] %s\n", pos, line);
+
+		prev = buf + pos;
+		skip = false;
+	}
+}
+
+static bool skip_isolation(const struct intel_engine_cs *engine)
+{
+	if (engine->class == COPY_ENGINE_CLASS && INTEL_GEN(engine->i915) == 9)
+		return true;
+
+	if (engine->class == RENDER_CLASS && INTEL_GEN(engine->i915) < 12)
+		return true;
+
+	return false;
+}
+
+static int igt_reg_isolation(void *arg)
+{
+	struct drm_i915_private *i915 = arg;
+	struct i915_gem_context *ctx_a, *ctx_b;
+	struct drm_i915_gem_object *obj;
+	struct intel_engine_cs *engine;
+	struct igt_live_test t;
+	I915_RND_STATE(prng);
+	struct file *file;
+	u32 *ctl;
+	int err;
+	int i;
+
+	if (INTEL_GEN(i915) < 8) /* for LRM/SRM */
+		return 0;
+
+	/*
+	 * No state that we can write to from our context should be
+	 * observable by another.
+	 */
+
+	file = mock_file(i915);
+	if (IS_ERR(file))
+		return PTR_ERR(file);
+
+	err = igt_live_test_begin(&t, i915, __func__, "");
+	if (err)
+		goto out_file;
+
+	ctx_a = live_context(i915, file);
+	if (IS_ERR(ctx_a)) {
+		err = PTR_ERR(ctx_a);
+		goto out_file;
+	}
+
+	ctx_b = live_context(i915, file);
+	if (IS_ERR(ctx_b)) {
+		err = PTR_ERR(ctx_b);
+		goto out_file;
+	}
+
+	obj = i915_gem_object_create_internal(i915, 16 * 1024);
+	if (IS_ERR(obj)) {
+		err = PTR_ERR(obj);
+		goto out_file;
+	}
+
+	ctl = i915_gem_object_pin_map(obj, I915_MAP_WC);
+	if (IS_ERR(ctl))  {
+		err = PTR_ERR(ctl);
+		goto out_obj;
+	}
+
+	for (i = 0; i < 1024; i++) {
+		ctl[4 * i + 0] = random_reg(i915, &prng);
+		ctl[4 * i + 1] = prandom_u32_state(&prng); /* poison */
+	}
+
+	for_each_uabi_engine(engine, i915) {
+		if (!IS_ENABLED(CONFIG_DRM_I915_SELFTEST_BROKEN) &&
+		    skip_isolation(engine))
+			continue; /* Just don't even ask */
+
+		for (i = 0; i < 1024; i++) {
+			ctl[4 * i + 2] = 0xdeadbeef; /* before */
+			ctl[4 * i + 3] = 0x00c0ffee; /* after */
+		}
+		i915_gem_object_flush_map(obj);
+
+		err = iso_read(ctx_b, engine, obj, ctl, 2);
+		if (err)
+			break;
+
+		err = iso_read(ctx_a, engine, obj, ctl, 2);
+		if (err)
+			break;
+
+		/* Twice to record after the first pristine context save */
+		err = iso_read(ctx_b, engine, obj, ctl, 2);
+		if (err)
+			break;
+
+		err = iso_write(ctx_a, engine, obj, ctl);
+		if (err)
+			break;
+
+		err = iso_read(ctx_b, engine, obj, ctl, 3);
+		if (err)
+			break;
+
+		err = i915_gem_object_wait(obj,
+					   I915_WAIT_ALL |
+					   I915_WAIT_INTERRUPTIBLE,
+					   HZ / 2);
+		if (err)
+			break;
+
+		for (i = 0; i < 1024; i++) {
+			if (ctl[4 * i + 2] == ctl[4 * i + 3])
+				continue;
+
+			pr_err("%s: poison 0x%x with %08x, in:%08x, out:%08x\n",
+			       engine->name,
+			       ctl[4 * i + 0],
+			       ctl[4 * i + 1],
+			       ctl[4 * i + 2],
+			       ctl[4 * i + 3]);
+
+			/* If we read back the poison in its entirety, whoops */
+			if (ctl[4 * i + 3] == ctl[4 * i + 1])
+				err = -EINVAL;
+		}
+		if (err) {
+			hexdump(ctl, 16 * 1024);
+			break;
+		}
+	}
+
+	i915_gem_object_unpin_map(obj);
+	if (igt_live_test_end(&t))
+		err = -EIO;
+
+out_obj:
+	i915_gem_object_put(obj);
+out_file:
+	fput(file);
+	return err;
+}
+
 static bool skip_unused_engines(struct intel_context *ce, void *data)
 {
 	return !ce->state;
@@ -2000,6 +2410,7 @@ int i915_gem_context_live_selftests(struct drm_i915_private *i915)
 		SUBTEST(igt_ctx_sseu),
 		SUBTEST(igt_shared_ctx_exec),
 		SUBTEST(igt_vm_isolation),
+		SUBTEST(igt_reg_isolation),
 	};
 
 	if (intel_gt_is_wedged(&i915->gt))
-- 
2.20.1

_______________________________________________
Intel-gfx mailing list
Intel-gfx@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/intel-gfx

^ permalink raw reply related	[flat|nested] 11+ messages in thread