From: Thadeu Lima de Souza Cascardo Date: Mon, 9 Mar 2026 18:47:04 +0000 (-0300) Subject: drm/ttm/tests: add a test to exercise ttm_bo_swapout X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=d11ac9043435cf1ddf1abc59fa774eb6c0ca4e51;p=thirdparty%2Fkernel%2Flinux.git drm/ttm/tests: add a test to exercise ttm_bo_swapout Currently, ttm_bo_swapout is not exercised by the TTM KUnit tests. It used to be exercised until commit 76689eb52667 ("drm/ttm: remove ttm_bo_validate_swapout test"), but that test was removed as it was unreliable due to requiring to allocate half of the system memory. Calling ttm_bo_swapout directly with a single allocated BO, however, does not suffer from that problem, and was able to detect a UAF introduced by commit c06da4b3573a ("drm/ttm: Tidy usage of local variables a little bit"), when built with KASAN. When applying a fix to that UAF, the test passed without any issues. Cc: Tvrtko Ursulin Cc: Christian König Reviewed-by: Tvrtko Ursulin Signed-off-by: Thadeu Lima de Souza Cascardo Signed-off-by: Tvrtko Ursulin Link: https://lore.kernel.org/r/20260309-ttm_bo_swapout_test-v2-1-219f64046cfe@igalia.com --- diff --git a/drivers/gpu/drm/ttm/tests/ttm_bo_validate_test.c b/drivers/gpu/drm/ttm/tests/ttm_bo_validate_test.c index e32f3c8d7b84b..2db221f6fc3a1 100644 --- a/drivers/gpu/drm/ttm/tests/ttm_bo_validate_test.c +++ b/drivers/gpu/drm/ttm/tests/ttm_bo_validate_test.c @@ -759,6 +759,46 @@ static void ttm_bo_validate_move_fence_not_signaled(struct kunit *test) ttm_mock_manager_fini(priv->ttm_dev, snd_mem); } +static void ttm_bo_validate_swapout(struct kunit *test) +{ + u32 mem_type = TTM_PL_TT; + struct ttm_test_devices *priv = test->priv; + struct ttm_operation_ctx ctx_init = { }; + enum ttm_bo_type bo_type = ttm_bo_type_device; + struct ttm_resource_manager *man; + struct ttm_placement *placement; + struct ttm_buffer_object *bo; + struct ttm_place *place; + int err; + s64 swapped; + + ttm_mock_manager_init(priv->ttm_dev, mem_type, MANAGER_SIZE); + man = ttm_manager_type(priv->ttm_dev, mem_type); + KUNIT_ASSERT_NOT_NULL(test, man); + + place = ttm_place_kunit_init(test, mem_type, 0); + placement = ttm_placement_kunit_init(test, place, 1); + + bo = kunit_kzalloc(test, sizeof(*bo), GFP_KERNEL); + KUNIT_ASSERT_NOT_NULL(test, bo); + + drm_gem_private_object_init(priv->drm, &bo->base, MANAGER_SIZE); + err = ttm_bo_init_reserved(priv->ttm_dev, bo, bo_type, placement, + PAGE_SIZE, &ctx_init, NULL, NULL, + &dummy_ttm_bo_destroy); + KUNIT_EXPECT_EQ(test, err, 0); + dma_resv_unlock(bo->base.resv); + + swapped = ttm_bo_swapout(priv->ttm_dev, &ctx_init, man, GFP_KERNEL, + MANAGER_SIZE / PAGE_SIZE); + KUNIT_EXPECT_EQ(test, swapped, MANAGER_SIZE / PAGE_SIZE); + KUNIT_EXPECT_EQ(test, bo->resource->mem_type, TTM_PL_SYSTEM); + KUNIT_EXPECT_TRUE(test, bo->ttm->page_flags & TTM_TT_FLAG_SWAPPED); + + ttm_bo_fini(bo); + ttm_mock_manager_fini(priv->ttm_dev, mem_type); +} + static void ttm_bo_validate_happy_evict(struct kunit *test) { u32 mem_type = TTM_PL_VRAM, mem_multihop = TTM_PL_TT, @@ -1153,6 +1193,7 @@ static struct kunit_case ttm_bo_validate_test_cases[] = { KUNIT_CASE(ttm_bo_validate_move_fence_signaled), KUNIT_CASE_PARAM(ttm_bo_validate_move_fence_not_signaled, ttm_bo_validate_wait_gen_params), + KUNIT_CASE(ttm_bo_validate_swapout), KUNIT_CASE(ttm_bo_validate_happy_evict), KUNIT_CASE(ttm_bo_validate_all_pinned_evict), KUNIT_CASE(ttm_bo_validate_allowed_only_evict), diff --git a/drivers/gpu/drm/ttm/ttm_bo.c b/drivers/gpu/drm/ttm/ttm_bo.c index a9024e7b34deb..d85f0a37ac35f 100644 --- a/drivers/gpu/drm/ttm/ttm_bo.c +++ b/drivers/gpu/drm/ttm/ttm_bo.c @@ -32,6 +32,7 @@ #define pr_fmt(fmt) "[TTM] " fmt #include +#include #include #include #include @@ -1230,6 +1231,7 @@ s64 ttm_bo_swapout(struct ttm_device *bdev, struct ttm_operation_ctx *ctx, return ttm_lru_walk_for_evict(&swapout_walk.walk, bdev, man, target); } +EXPORT_SYMBOL_FOR_TESTS_ONLY(ttm_bo_swapout); void ttm_bo_tt_destroy(struct ttm_buffer_object *bo) {