History

drm/amdkfd: Check against device cgroup

Participate in device cgroup. All kfd devices are exposed via /dev/kfd. So use /dev/dri/renderN node. Before exposing the device to a task check if it has permission to access it. If the task (based on its cgroup) can access /dev/dri/renderN then expose the device via kfd node. If the task cannot access /dev/dri/renderN then process device data (pdd) is not created. This will ensure that task cannot use the device. In sysfs topology, all device nodes are visible irrespective of the task cgroup. The sysfs node directories are created at driver load time and cannot be changed dynamically. However, access to information inside nodes is controlled based on the task's cgroup permissions.

Harish Kasiviswanathan committed 8 years ago

Commit 6b855f71 parent 4b7d4d43 files · +36 −2Browse files

Unified · Split

3 files
  1. drivers/gpu/drm/amd/amdkfd/kfd_flat_memory.c +7 −2
  2. drivers/gpu/drm/amd/amdkfd/kfd_priv.h +17 −0
  3. drivers/gpu/drm/amd/amdkfd/kfd_topology.c +12 −0
drivers/gpu/drm/amd/amdkfd/kfd_flat_memory.c+7−2
@@ -369,8 +369,13 @@ int kfd_init_apertures(struct kfd_process *process) · 368 unmodified lines
369 369
370 /*Iterating over all devices*/370 /*Iterating over all devices*/
371 while (kfd_topology_enum_kfd_devices(id, &dev) == 0) {371 while (kfd_topology_enum_kfd_devices(id, &dev) == 0) {
372 if (!dev) {372 if (!dev || kfd_devcgroup_check_permission(dev)) {
373 id++; /* Skip non GPU devices */373 /* Skip non GPU devices and devices to which the
374 * current process have no access to. Access can be
375 * limited by placing the process in a specific
376 * cgroup hierarchy
377 */
378 id++;
374 continue;379 continue;
375 }380 }
376 381
drivers/gpu/drm/amd/amdkfd/kfd_priv.h+17−0
@@ -36,6 +36,8 @@ · 35 unmodified lines
36#include <linux/seq_file.h>36#include <linux/seq_file.h>
37#include <linux/kref.h>37#include <linux/kref.h>
38#include <linux/sysfs.h>38#include <linux/sysfs.h>
39#include <linux/device_cgroup.h>
40#include <drm/drmP.h>
39#include <kgd_kfd_interface.h>41#include <kgd_kfd_interface.h>
40 42
41#include "amd_shared.h"43#include "amd_shared.h"
@@ -1042,6 +1044,21 @@ bool kfd_is_locked(void); · 1000 unmodified lines
1042void kfd_inc_compute_active(struct kfd_dev *dev);1044void kfd_inc_compute_active(struct kfd_dev *dev);
1043void kfd_dec_compute_active(struct kfd_dev *dev);1045void kfd_dec_compute_active(struct kfd_dev *dev);
1044 1046
1047/* Cgroup Support */
1048/* Check with device cgroup if @kfd device is accessible */
1049static inline int kfd_devcgroup_check_permission(struct kfd_dev *kfd)
1050{
1051#if defined(CONFIG_CGROUP_DEVICE)
1052 struct drm_device *ddev = kfd->ddev;
1053
1054 return devcgroup_check_permission(DEVCG_DEV_CHAR, ddev->driver->major,
1055 ddev->render->index,
1056 DEVCG_ACC_WRITE | DEVCG_ACC_READ);
1057#else
1058 return 0;
1059#endif
1060}
1061
1045/* Debugfs */1062/* Debugfs */
1046#if defined(CONFIG_DEBUG_FS)1063#if defined(CONFIG_DEBUG_FS)
1047 1064
drivers/gpu/drm/amd/amdkfd/kfd_topology.c+12−0
@@ -269,6 +269,8 @@ static ssize_t iolink_show(struct kobject *kobj, struct attribute *attr, · 268 unmodified lines
269 buffer[0] = 0;269 buffer[0] = 0;
270 270
271 iolink = container_of(attr, struct kfd_iolink_properties, attr);271 iolink = container_of(attr, struct kfd_iolink_properties, attr);
272 if (iolink->gpu && kfd_devcgroup_check_permission(iolink->gpu))
273 return -EPERM;
272 sysfs_show_32bit_prop(buffer, "type", iolink->iolink_type);274 sysfs_show_32bit_prop(buffer, "type", iolink->iolink_type);
273 sysfs_show_32bit_prop(buffer, "version_major", iolink->ver_maj);275 sysfs_show_32bit_prop(buffer, "version_major", iolink->ver_maj);
274 sysfs_show_32bit_prop(buffer, "version_minor", iolink->ver_min);276 sysfs_show_32bit_prop(buffer, "version_minor", iolink->ver_min);
@@ -305,6 +307,8 @@ static ssize_t mem_show(struct kobject *kobj, struct attribute *attr, · 30 unmodified lines
305 buffer[0] = 0;307 buffer[0] = 0;
306 308
307 mem = container_of(attr, struct kfd_mem_properties, attr);309 mem = container_of(attr, struct kfd_mem_properties, attr);
310 if (mem->gpu && kfd_devcgroup_check_permission(mem->gpu))
311 return -EPERM;
308 sysfs_show_32bit_prop(buffer, "heap_type", mem->heap_type);312 sysfs_show_32bit_prop(buffer, "heap_type", mem->heap_type);
309 sysfs_show_64bit_prop(buffer, "size_in_bytes", mem->size_in_bytes);313 sysfs_show_64bit_prop(buffer, "size_in_bytes", mem->size_in_bytes);
310 sysfs_show_32bit_prop(buffer, "flags", mem->flags);314 sysfs_show_32bit_prop(buffer, "flags", mem->flags);
@@ -334,6 +338,8 @@ static ssize_t kfd_cache_show(struct kobject *kobj, struct attribute *attr, · 23 unmodified lines
334 buffer[0] = 0;338 buffer[0] = 0;
335 339
336 cache = container_of(attr, struct kfd_cache_properties, attr);340 cache = container_of(attr, struct kfd_cache_properties, attr);
341 if (cache->gpu && kfd_devcgroup_check_permission(cache->gpu))
342 return -EPERM;
337 sysfs_show_32bit_prop(buffer, "processor_id_low",343 sysfs_show_32bit_prop(buffer, "processor_id_low",
338 cache->processor_id_low);344 cache->processor_id_low);
339 sysfs_show_32bit_prop(buffer, "level", cache->cache_level);345 sysfs_show_32bit_prop(buffer, "level", cache->cache_level);
@@ -414,6 +420,8 @@ static ssize_t node_show(struct kobject *kobj, struct attribute *attr, · 74 unmodified lines
414 if (strcmp(attr->name, "gpu_id") == 0) {420 if (strcmp(attr->name, "gpu_id") == 0) {
415 dev = container_of(attr, struct kfd_topology_device,421 dev = container_of(attr, struct kfd_topology_device,
416 attr_gpuid);422 attr_gpuid);
423 if (dev->gpu && kfd_devcgroup_check_permission(dev->gpu))
424 return -EPERM;
417 return sysfs_show_32bit_val(buffer, dev->gpu_id);425 return sysfs_show_32bit_val(buffer, dev->gpu_id);
418 }426 }
419 427
@@ -421,11 +429,15 @@ static ssize_t node_show(struct kobject *kobj, struct attribute *attr, · 1 unmodified line
421 dev = container_of(attr, struct kfd_topology_device,429 dev = container_of(attr, struct kfd_topology_device,
422 attr_name);430 attr_name);
423 431
432 if (dev->gpu && kfd_devcgroup_check_permission(dev->gpu))
433 return -EPERM;
424 return sysfs_show_str_val(buffer, dev->node_props.name);434 return sysfs_show_str_val(buffer, dev->node_props.name);
425 }435 }
426 436
427 dev = container_of(attr, struct kfd_topology_device,437 dev = container_of(attr, struct kfd_topology_device,
428 attr_props);438 attr_props);
439 if (dev->gpu && kfd_devcgroup_check_permission(dev->gpu))
440 return -EPERM;
429 sysfs_show_32bit_prop(buffer, "cpu_cores_count",441 sysfs_show_32bit_prop(buffer, "cpu_cores_count",
430 dev->node_props.cpu_cores_count);442 dev->node_props.cpu_cores_count);
431 sysfs_show_32bit_prop(buffer, "simd_count",443 sysfs_show_32bit_prop(buffer, "simd_count",

Keyboard shortcuts

General

Show keyboard shortcuts
?
Focus the current search
/

Issues and pull requests

Open filters
f

Issues, pull requests and Inbox

Select next item
j↓
Select previous item
k↑
Open selected item
Enter
Dismiss filters or clear selection
Esc

Repository code

Go to file
t