drm/amdkfd: Check against device cgroup

Participate in device cgroup. All kfd devices are exposed via /dev/kfd. So use /dev/dri/renderN node. Before exposing the device to a task check if it has permission to access it. If the task (based on its cgroup) can access /dev/dri/renderN then expose the device via kfd node. If the task cannot access /dev/dri/renderN then process device data (pdd) is not created. This will ensure that task cannot use the device. In sysfs topology, all device nodes are visible irrespective of the task cgroup. The sysfs node directories are created at driver load time and cannot be changed dynamically. However, access to information inside nodes is controlled based on the task's cgroup permissions.

Harish Kasiviswanathan committed 8 years ago

Commit 6b855f71 parent 4b7d4d43 files · +36 −2Browse files

Unified · Split

3 files

drivers/gpu/drm/amd/amdkfd/kfd_flat_memory.c +7 −2
drivers/gpu/drm/amd/amdkfd/kfd_priv.h +17 −0
drivers/gpu/drm/amd/amdkfd/kfd_topology.c +12 −0

drivers/gpu/drm/amd/amdkfd/kfd_flat_memory.c+7−2

@@ -369,8 +369,13 @@ int kfd_init_apertures(struct kfd_process *process) · 368 unmodified lines
369	369
370	370	/Iterating over all devices/
371	371	while (kfd_topology_enum_kfd_devices(id, &dev) == 0) {
372		− if (!dev) {
373		− id++; /* Skip non GPU devices */
	372	+ if (!dev \|\| kfd_devcgroup_check_permission(dev)) {
	373	+ /* Skip non GPU devices and devices to which the
	374	+ * current process have no access to. Access can be
	375	+ * limited by placing the process in a specific
	376	+ * cgroup hierarchy
	377	+ */
	378	+ id++;
374	379	continue;
375	380	}
376	381

drivers/gpu/drm/amd/amdkfd/kfd_priv.h+17−0

@@ -36,6 +36,8 @@ · 35 unmodified lines
36	36	#include <linux/seq_file.h>
37	37	#include <linux/kref.h>
38	38	#include <linux/sysfs.h>
	39	+#include <linux/device_cgroup.h>
	40	+#include <drm/drmP.h>
39	41	#include <kgd_kfd_interface.h>
40	42
41	43	#include "amd_shared.h"
@@ -1042,6 +1044,21 @@ bool kfd_is_locked(void); · 1000 unmodified lines
1042	1044	void kfd_inc_compute_active(struct kfd_dev *dev);
1043	1045	void kfd_dec_compute_active(struct kfd_dev *dev);
1044	1046
	1047	+/* Cgroup Support */
	1048	+/* Check with device cgroup if @kfd device is accessible */
	1049	+static inline int kfd_devcgroup_check_permission(struct kfd_dev *kfd)
	1050	+{
	1051	+#if defined(CONFIG_CGROUP_DEVICE)
	1052	+ struct drm_device *ddev = kfd->ddev;
	1053	+
	1054	+ return devcgroup_check_permission(DEVCG_DEV_CHAR, ddev->driver->major,
	1055	+ ddev->render->index,
	1056	+ DEVCG_ACC_WRITE \| DEVCG_ACC_READ);
	1057	+#else
	1058	+ return 0;
	1059	+#endif
	1060	+}
	1061	+
1045	1062	/* Debugfs */
1046	1063	#if defined(CONFIG_DEBUG_FS)
1047	1064

drivers/gpu/drm/amd/amdkfd/kfd_topology.c+12−0

@@ -269,6 +269,8 @@ static ssize_t iolink_show(struct kobject kobj, struct attribute attr, · 268 unmodified lines
269	269	buffer[0] = 0;
270	270
271	271	iolink = container_of(attr, struct kfd_iolink_properties, attr);
	272	+ if (iolink->gpu && kfd_devcgroup_check_permission(iolink->gpu))
	273	+ return -EPERM;
272	274	sysfs_show_32bit_prop(buffer, "type", iolink->iolink_type);
273	275	sysfs_show_32bit_prop(buffer, "version_major", iolink->ver_maj);
274	276	sysfs_show_32bit_prop(buffer, "version_minor", iolink->ver_min);
@@ -305,6 +307,8 @@ static ssize_t mem_show(struct kobject kobj, struct attribute attr, · 30 unmodified lines
305	307	buffer[0] = 0;
306	308
307	309	mem = container_of(attr, struct kfd_mem_properties, attr);
	310	+ if (mem->gpu && kfd_devcgroup_check_permission(mem->gpu))
	311	+ return -EPERM;
308	312	sysfs_show_32bit_prop(buffer, "heap_type", mem->heap_type);
309	313	sysfs_show_64bit_prop(buffer, "size_in_bytes", mem->size_in_bytes);
310	314	sysfs_show_32bit_prop(buffer, "flags", mem->flags);
@@ -334,6 +338,8 @@ static ssize_t kfd_cache_show(struct kobject kobj, struct attribute attr, · 23 unmodified lines
334	338	buffer[0] = 0;
335	339
336	340	cache = container_of(attr, struct kfd_cache_properties, attr);
	341	+ if (cache->gpu && kfd_devcgroup_check_permission(cache->gpu))
	342	+ return -EPERM;
337	343	sysfs_show_32bit_prop(buffer, "processor_id_low",
338	344	cache->processor_id_low);
339	345	sysfs_show_32bit_prop(buffer, "level", cache->cache_level);
@@ -414,6 +420,8 @@ static ssize_t node_show(struct kobject kobj, struct attribute attr, · 74 unmodified lines
414	420	if (strcmp(attr->name, "gpu_id") == 0) {
415	421	dev = container_of(attr, struct kfd_topology_device,
416	422	attr_gpuid);
	423	+ if (dev->gpu && kfd_devcgroup_check_permission(dev->gpu))
	424	+ return -EPERM;
417	425	return sysfs_show_32bit_val(buffer, dev->gpu_id);
418	426	}
419	427
@@ -421,11 +429,15 @@ static ssize_t node_show(struct kobject kobj, struct attribute attr, · 1 unmodified line
421	429	dev = container_of(attr, struct kfd_topology_device,
422	430	attr_name);
423	431
	432	+ if (dev->gpu && kfd_devcgroup_check_permission(dev->gpu))
	433	+ return -EPERM;
424	434	return sysfs_show_str_val(buffer, dev->node_props.name);
425	435	}
426	436
427	437	dev = container_of(attr, struct kfd_topology_device,
428	438	attr_props);
	439	+ if (dev->gpu && kfd_devcgroup_check_permission(dev->gpu))
	440	+ return -EPERM;
429	441	sysfs_show_32bit_prop(buffer, "cpu_cores_count",
430	442	dev->node_props.cpu_cores_count);
431	443	sysfs_show_32bit_prop(buffer, "simd_count",

drm/amdkfd: Check against device cgroup

Keyboard shortcuts

General

Issues and pull requests

Issues, pull requests and Inbox

Repository code