drm/ttm/tests: add a test to exercise ttm_bo_swapout

Currently, ttm_bo_swapout is not exercised by the TTM KUnit tests.

It used to be exercised until commit 76689eb52667 ("drm/ttm: remove
ttm_bo_validate_swapout test"), but that test was removed as it was
unreliable due to requiring to allocate half of the system memory.

Calling ttm_bo_swapout directly with a single allocated BO, however, does
not suffer from that problem, and was able to detect a UAF introduced by
commit c06da4b3573a ("drm/ttm: Tidy usage of local variables a little
bit"), when built with KASAN.

When applying a fix to that UAF, the test passed without any issues.

Cc: Tvrtko Ursulin <tvrtko.ursulin@igalia.com>
Cc: Christian König <christian.koenig@amd.com>
Reviewed-by: Tvrtko Ursulin <tvrtko.ursulin@igalia.com>
Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@igalia.com>
Signed-off-by: Tvrtko Ursulin <tursulin@ursulin.net>
Link: https://lore.kernel.org/r/20260309-ttm_bo_swapout_test-v2-1-219f64046cfe@igalia.com

diff --git a/drivers/gpu/drm/ttm/tests/ttm_bo_validate_test.c b/drivers/gpu/drm/ttm/tests/ttm_bo_validate_test.c
index e32f3c8d7b84b62a8b1491cf007dc988b6194593..2db221f6fc3a1fe5dcc5d5b112d3c22dca2a253b 100644 (file)
--- a/drivers/gpu/drm/ttm/tests/ttm_bo_validate_test.c
+++ b/drivers/gpu/drm/ttm/tests/ttm_bo_validate_test.c
@@ -759,6 +759,46 @@ static void ttm_bo_validate_move_fence_not_signaled(struct kunit *test)
        ttm_mock_manager_fini(priv->ttm_dev, snd_mem);
 }
 
+static void ttm_bo_validate_swapout(struct kunit *test)
+{
+       u32 mem_type = TTM_PL_TT;
+       struct ttm_test_devices *priv = test->priv;
+       struct ttm_operation_ctx ctx_init = { };
+       enum ttm_bo_type bo_type = ttm_bo_type_device;
+       struct ttm_resource_manager *man;
+       struct ttm_placement *placement;
+       struct ttm_buffer_object *bo;
+       struct ttm_place *place;
+       int err;
+       s64 swapped;
+
+       ttm_mock_manager_init(priv->ttm_dev, mem_type, MANAGER_SIZE);
+       man = ttm_manager_type(priv->ttm_dev, mem_type);
+       KUNIT_ASSERT_NOT_NULL(test, man);
+
+       place = ttm_place_kunit_init(test, mem_type, 0);
+       placement = ttm_placement_kunit_init(test, place, 1);
+
+       bo = kunit_kzalloc(test, sizeof(*bo), GFP_KERNEL);
+       KUNIT_ASSERT_NOT_NULL(test, bo);
+
+       drm_gem_private_object_init(priv->drm, &bo->base, MANAGER_SIZE);
+       err = ttm_bo_init_reserved(priv->ttm_dev, bo, bo_type, placement,
+                                  PAGE_SIZE, &ctx_init, NULL, NULL,
+                                  &dummy_ttm_bo_destroy);
+       KUNIT_EXPECT_EQ(test, err, 0);
+       dma_resv_unlock(bo->base.resv);
+
+       swapped = ttm_bo_swapout(priv->ttm_dev, &ctx_init, man, GFP_KERNEL,
+                                MANAGER_SIZE / PAGE_SIZE);
+       KUNIT_EXPECT_EQ(test, swapped, MANAGER_SIZE / PAGE_SIZE);
+       KUNIT_EXPECT_EQ(test, bo->resource->mem_type, TTM_PL_SYSTEM);
+       KUNIT_EXPECT_TRUE(test, bo->ttm->page_flags & TTM_TT_FLAG_SWAPPED);
+
+       ttm_bo_fini(bo);
+       ttm_mock_manager_fini(priv->ttm_dev, mem_type);
+}
+
 static void ttm_bo_validate_happy_evict(struct kunit *test)
 {
        u32 mem_type = TTM_PL_VRAM, mem_multihop = TTM_PL_TT,
@@ -1153,6 +1193,7 @@ static struct kunit_case ttm_bo_validate_test_cases[] = {
        KUNIT_CASE(ttm_bo_validate_move_fence_signaled),
        KUNIT_CASE_PARAM(ttm_bo_validate_move_fence_not_signaled,
                         ttm_bo_validate_wait_gen_params),
+       KUNIT_CASE(ttm_bo_validate_swapout),
        KUNIT_CASE(ttm_bo_validate_happy_evict),
        KUNIT_CASE(ttm_bo_validate_all_pinned_evict),
        KUNIT_CASE(ttm_bo_validate_allowed_only_evict),

diff --git a/drivers/gpu/drm/ttm/ttm_bo.c b/drivers/gpu/drm/ttm/ttm_bo.c
index a9024e7b34deba23375c73d49c756363044a94ac..d85f0a37ac35f36ce526519ad5d4395752211f06 100644 (file)
--- a/drivers/gpu/drm/ttm/ttm_bo.c
+++ b/drivers/gpu/drm/ttm/ttm_bo.c
@@ -32,6 +32,7 @@
 #define pr_fmt(fmt) "[TTM] " fmt
 
 #include <drm/drm_print.h>
+#include <drm/drm_util.h>
 #include <drm/ttm/ttm_allocation.h>
 #include <drm/ttm/ttm_bo.h>
 #include <drm/ttm/ttm_placement.h>
@@ -1230,6 +1231,7 @@ s64 ttm_bo_swapout(struct ttm_device *bdev, struct ttm_operation_ctx *ctx,
 
        return ttm_lru_walk_for_evict(&swapout_walk.walk, bdev, man, target);
 }
+EXPORT_SYMBOL_FOR_TESTS_ONLY(ttm_bo_swapout);
 
 void ttm_bo_tt_destroy(struct ttm_buffer_object *bo)
 {