From: Ramalingam C <ramalingam.c@intel.com> To: intel-gfx <intel-gfx@lists.freedesktop.org>, dri-devel <dri-devel@lists.freedesktop.org> Cc: CQ Tang <cq.tang@intel.com>, Hellstrom Thomas <thomas.hellstrom@intel.com>, Chris Wilson <chris@chris-wilson.co.uk> Subject: [PATCH 3/4] drm/i915/selftest: Clear the output buffers before GPU writes Date: Mon, 14 Mar 2022 23:50:04 +0530 [thread overview] Message-ID: <20220314182005.17071-4-ramalingam.c@intel.com> (raw) In-Reply-To: <20220314182005.17071-1-ramalingam.c@intel.com> From: Chris Wilson <chris@chris-wilson.co.uk> When testing whether we can get the GPU to leak information about non-privileged state, we first need to ensure that the output buffer is set to a known value as the HW may opt to skip the write into memory for a non-privileged read of a sensitive register. We chose POISON_INUSE (0x5a) so that is both non-zero and distinct from the poison values used during the test. Reported-by: CQ Tang <cq.tang@intel.com> Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk> Cc: CQ Tang <cq.tang@intel.com> cc: Joonas Lahtinen <joonas.lahtinen@linux.intel.com> Signed-off-by: Ramalingam C <ramalingam.c@intel.com> --- drivers/gpu/drm/i915/gt/selftest_lrc.c | 32 ++++++++++++++++++++++---- 1 file changed, 28 insertions(+), 4 deletions(-) diff --git a/drivers/gpu/drm/i915/gt/selftest_lrc.c b/drivers/gpu/drm/i915/gt/selftest_lrc.c index 0a8ed4246082..b9cc89de01bf 100644 --- a/drivers/gpu/drm/i915/gt/selftest_lrc.c +++ b/drivers/gpu/drm/i915/gt/selftest_lrc.c @@ -1346,6 +1346,30 @@ static int compare_isolation(struct intel_engine_cs *engine, return err; } +static struct i915_vma * +create_result_vma(struct i915_address_space *vm, unsigned long sz) +{ + struct i915_vma *vma; + void *ptr; + + vma = create_user_vma(vm, sz); + if (IS_ERR(vma)) + return vma; + + /* Set the results to a known value distinct from the poison */ + ptr = i915_gem_object_pin_map(vma->obj, I915_MAP_WC); + if (IS_ERR(ptr)) { + i915_vma_put(vma); + return ERR_CAST(ptr); + } + + memset(ptr, POISON_INUSE, vma->size); + i915_gem_object_flush_map(vma->obj); + i915_gem_object_unpin_map(vma->obj); + + return vma; +} + static int __lrc_isolation(struct intel_engine_cs *engine, u32 poison) { u32 *sema = memset32(engine->status_page.addr + 1000, 0, 1); @@ -1364,13 +1388,13 @@ static int __lrc_isolation(struct intel_engine_cs *engine, u32 poison) goto err_A; } - ref[0] = create_user_vma(A->vm, SZ_64K); + ref[0] = create_result_vma(A->vm, SZ_64K); if (IS_ERR(ref[0])) { err = PTR_ERR(ref[0]); goto err_B; } - ref[1] = create_user_vma(A->vm, SZ_64K); + ref[1] = create_result_vma(A->vm, SZ_64K); if (IS_ERR(ref[1])) { err = PTR_ERR(ref[1]); goto err_ref0; @@ -1392,13 +1416,13 @@ static int __lrc_isolation(struct intel_engine_cs *engine, u32 poison) } i915_request_put(rq); - result[0] = create_user_vma(A->vm, SZ_64K); + result[0] = create_result_vma(A->vm, SZ_64K); if (IS_ERR(result[0])) { err = PTR_ERR(result[0]); goto err_ref1; } - result[1] = create_user_vma(A->vm, SZ_64K); + result[1] = create_result_vma(A->vm, SZ_64K); if (IS_ERR(result[1])) { err = PTR_ERR(result[1]); goto err_result0; -- 2.20.1
WARNING: multiple messages have this Message-ID (diff)
From: Ramalingam C <ramalingam.c@intel.com> To: intel-gfx <intel-gfx@lists.freedesktop.org>, dri-devel <dri-devel@lists.freedesktop.org> Cc: CQ Tang <cq.tang@intel.com>, Hellstrom Thomas <thomas.hellstrom@intel.com>, Chris Wilson <chris@chris-wilson.co.uk> Subject: [Intel-gfx] [PATCH 3/4] drm/i915/selftest: Clear the output buffers before GPU writes Date: Mon, 14 Mar 2022 23:50:04 +0530 [thread overview] Message-ID: <20220314182005.17071-4-ramalingam.c@intel.com> (raw) In-Reply-To: <20220314182005.17071-1-ramalingam.c@intel.com> From: Chris Wilson <chris@chris-wilson.co.uk> When testing whether we can get the GPU to leak information about non-privileged state, we first need to ensure that the output buffer is set to a known value as the HW may opt to skip the write into memory for a non-privileged read of a sensitive register. We chose POISON_INUSE (0x5a) so that is both non-zero and distinct from the poison values used during the test. Reported-by: CQ Tang <cq.tang@intel.com> Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk> Cc: CQ Tang <cq.tang@intel.com> cc: Joonas Lahtinen <joonas.lahtinen@linux.intel.com> Signed-off-by: Ramalingam C <ramalingam.c@intel.com> --- drivers/gpu/drm/i915/gt/selftest_lrc.c | 32 ++++++++++++++++++++++---- 1 file changed, 28 insertions(+), 4 deletions(-) diff --git a/drivers/gpu/drm/i915/gt/selftest_lrc.c b/drivers/gpu/drm/i915/gt/selftest_lrc.c index 0a8ed4246082..b9cc89de01bf 100644 --- a/drivers/gpu/drm/i915/gt/selftest_lrc.c +++ b/drivers/gpu/drm/i915/gt/selftest_lrc.c @@ -1346,6 +1346,30 @@ static int compare_isolation(struct intel_engine_cs *engine, return err; } +static struct i915_vma * +create_result_vma(struct i915_address_space *vm, unsigned long sz) +{ + struct i915_vma *vma; + void *ptr; + + vma = create_user_vma(vm, sz); + if (IS_ERR(vma)) + return vma; + + /* Set the results to a known value distinct from the poison */ + ptr = i915_gem_object_pin_map(vma->obj, I915_MAP_WC); + if (IS_ERR(ptr)) { + i915_vma_put(vma); + return ERR_CAST(ptr); + } + + memset(ptr, POISON_INUSE, vma->size); + i915_gem_object_flush_map(vma->obj); + i915_gem_object_unpin_map(vma->obj); + + return vma; +} + static int __lrc_isolation(struct intel_engine_cs *engine, u32 poison) { u32 *sema = memset32(engine->status_page.addr + 1000, 0, 1); @@ -1364,13 +1388,13 @@ static int __lrc_isolation(struct intel_engine_cs *engine, u32 poison) goto err_A; } - ref[0] = create_user_vma(A->vm, SZ_64K); + ref[0] = create_result_vma(A->vm, SZ_64K); if (IS_ERR(ref[0])) { err = PTR_ERR(ref[0]); goto err_B; } - ref[1] = create_user_vma(A->vm, SZ_64K); + ref[1] = create_result_vma(A->vm, SZ_64K); if (IS_ERR(ref[1])) { err = PTR_ERR(ref[1]); goto err_ref0; @@ -1392,13 +1416,13 @@ static int __lrc_isolation(struct intel_engine_cs *engine, u32 poison) } i915_request_put(rq); - result[0] = create_user_vma(A->vm, SZ_64K); + result[0] = create_result_vma(A->vm, SZ_64K); if (IS_ERR(result[0])) { err = PTR_ERR(result[0]); goto err_ref1; } - result[1] = create_user_vma(A->vm, SZ_64K); + result[1] = create_result_vma(A->vm, SZ_64K); if (IS_ERR(result[1])) { err = PTR_ERR(result[1]); goto err_result0; -- 2.20.1
next prev parent reply other threads:[~2022-03-14 18:19 UTC|newest] Thread overview: 23+ messages / expand[flat|nested] mbox.gz Atom feed top 2022-03-14 18:20 [PATCH 0/4] lrc selftest fixes Ramalingam C 2022-03-14 18:20 ` [Intel-gfx] " Ramalingam C 2022-03-14 18:20 ` [PATCH 1/4] drm/i915/gt: Explicitly clear BB_OFFSET for new contexts Ramalingam C 2022-03-14 18:20 ` [Intel-gfx] " Ramalingam C 2022-04-08 14:45 ` Thomas Hellström 2022-03-14 18:20 ` [PATCH 2/4] drm/i915/selftests: Check for incomplete LRI from the context image Ramalingam C 2022-03-14 18:20 ` [Intel-gfx] " Ramalingam C 2022-04-08 14:38 ` Thomas Hellström (Intel) 2022-03-14 18:20 ` Ramalingam C [this message] 2022-03-14 18:20 ` [Intel-gfx] [PATCH 3/4] drm/i915/selftest: Clear the output buffers before GPU writes Ramalingam C 2022-03-21 23:26 ` [PATCH v2 " Ramalingam C 2022-03-21 23:26 ` [Intel-gfx] " Ramalingam C 2022-04-08 14:40 ` [Intel-gfx] [PATCH " Thomas Hellström 2022-03-14 18:20 ` [PATCH 4/4] drm/i915/selftest: Always cancel semaphore on error Ramalingam C 2022-03-14 18:20 ` [Intel-gfx] " Ramalingam C 2022-04-08 14:43 ` Thomas Hellström 2022-03-14 20:46 ` [Intel-gfx] ✗ Fi.CI.CHECKPATCH: warning for lrc selftest fixes (rev2) Patchwork 2022-03-14 20:47 ` [Intel-gfx] ✗ Fi.CI.SPARSE: " Patchwork 2022-03-14 21:18 ` [Intel-gfx] ✗ Fi.CI.BAT: failure " Patchwork 2022-03-22 2:18 ` [Intel-gfx] ✗ Fi.CI.CHECKPATCH: warning for lrc selftest fixes (rev3) Patchwork 2022-03-22 2:19 ` [Intel-gfx] ✗ Fi.CI.SPARSE: " Patchwork 2022-03-22 2:23 ` [Intel-gfx] ✗ Fi.CI.DOCS: " Patchwork 2022-03-22 2:50 ` [Intel-gfx] ✗ Fi.CI.BAT: failure " Patchwork
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=20220314182005.17071-4-ramalingam.c@intel.com \ --to=ramalingam.c@intel.com \ --cc=chris@chris-wilson.co.uk \ --cc=cq.tang@intel.com \ --cc=dri-devel@lists.freedesktop.org \ --cc=intel-gfx@lists.freedesktop.org \ --cc=thomas.hellstrom@intel.com \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.