On 21/07/14 02:09, Jerome Glisse wrote:
On Thu, Jul 17, 2014 at 04:29:28PM +0300, Oded Gabbay wrote:
From: Ben Goz ben.goz@amd.com
Signed-off-by: Ben Goz ben.goz@amd.com Signed-off-by: Oded Gabbay oded.gabbay@amd.com
drivers/gpu/drm/radeon/amdkfd/kfd_chardev.c | 133 +++++++++++++++++++++++++++- drivers/gpu/drm/radeon/amdkfd/kfd_priv.h | 8 ++ 2 files changed, 138 insertions(+), 3 deletions(-)
diff --git a/drivers/gpu/drm/radeon/amdkfd/kfd_chardev.c b/drivers/gpu/drm/radeon/amdkfd/kfd_chardev.c index d6580a6..a74693a 100644 --- a/drivers/gpu/drm/radeon/amdkfd/kfd_chardev.c +++ b/drivers/gpu/drm/radeon/amdkfd/kfd_chardev.c @@ -119,17 +119,144 @@ static int kfd_open(struct inode *inode, struct file *filep)
static long kfd_ioctl_create_queue(struct file *filep, struct kfd_process *p, void __user *arg) {
- return -ENODEV;
- struct kfd_ioctl_create_queue_args args;
- struct kfd_dev *dev;
- int err = 0;
- unsigned int queue_id;
- struct kfd_process_device *pdd;
- struct queue_properties q_properties;
- memset(&q_properties, 0, sizeof(struct queue_properties));
- if (copy_from_user(&args, arg, sizeof(args)))
return -EFAULT;- if (!access_ok(VERIFY_WRITE, args.read_pointer_address, sizeof(qptr_t))) {
pr_err("kfd: can't access read pointer");return -EFAULT;- }
- if (!access_ok(VERIFY_WRITE, args.write_pointer_address, sizeof(qptr_t))) {
pr_err("kfd: can't access write pointer");return -EFAULT;- }
- q_properties.is_interop = false;
- q_properties.queue_percent = args.queue_percentage;
- q_properties.priority = args.queue_priority;
- q_properties.queue_address = args.ring_base_address;
- q_properties.queue_size = args.ring_size;
- q_properties.read_ptr = (qptr_t *) args.read_pointer_address;
- q_properties.write_ptr = (qptr_t *) args.write_pointer_address;
So there is still no sanity check on any of the argument especialy the queue_size. I might have missed it, if so i think it really should be here inside the ioctl function as is simpler to find.
Fixed in v3.
- pr_debug("%s Arguments: Queue Percentage (%d, %d)\n"
"Queue Priority (%d, %d)\n""Queue Address (0x%llX, 0x%llX)\n""Queue Size (0x%llX, %u)\n""Queue r/w Pointers (0x%llX, 0x%llX)\n",__func__,q_properties.queue_percent, args.queue_percentage,q_properties.priority, args.queue_priority,q_properties.queue_address, args.ring_base_address,q_properties.queue_size, args.ring_size,(uint64_t) q_properties.read_ptr,(uint64_t) q_properties.write_ptr);One pr_debug call perline.
Fixed in v3.
- dev = kfd_device_by_id(args.gpu_id);
- if (dev == NULL)
return -EINVAL;- mutex_lock(&p->mutex);
- pdd = kfd_bind_process_to_device(dev, p);
- if (IS_ERR(pdd) < 0) {
err = PTR_ERR(pdd);goto err_bind_process;- }
- pr_debug("kfd: creating queue for PASID %d on GPU 0x%x\n",
p->pasid,dev->id);- err = pqm_create_queue(&p->pqm, dev, filep, &q_properties, 0, KFD_QUEUE_TYPE_COMPUTE, &queue_id);
- if (err != 0)
goto err_create_queue;- args.queue_id = queue_id;
- args.doorbell_address = (uint64_t)q_properties.doorbell_ptr;
- if (copy_to_user(arg, &args, sizeof(args))) {
err = -EFAULT;goto err_copy_args_out;- }
- mutex_unlock(&p->mutex);
- pr_debug("kfd: queue id %d was created successfully.\n"
" ring buffer address == 0x%016llX\n"" read ptr address == 0x%016llX\n"" write ptr address == 0x%016llX\n"" doorbell address == 0x%016llX\n",args.queue_id,args.ring_base_address,args.read_pointer_address,args.write_pointer_address,args.doorbell_address);Ditto
Fixed in v3.
- return 0;
+err_copy_args_out:
- pqm_destroy_queue(&p->pqm, queue_id);
+err_create_queue: +err_bind_process:
mutex_unlock(&p->mutex);
return err; }
static int kfd_ioctl_destroy_queue(struct file *filp, struct kfd_process *p, void __user *arg) {
- return -ENODEV;
int retval;
struct kfd_ioctl_destroy_queue_args args;
if (copy_from_user(&args, arg, sizeof(args)))
return -EFAULT;pr_debug("kfd: destroying queue id %d for PASID %d\n",
args.queue_id,p->pasid);mutex_lock(&p->mutex);
retval = pqm_destroy_queue(&p->pqm, args.queue_id);
mutex_unlock(&p->mutex);
return retval; }
static int kfd_ioctl_update_queue(struct file *filp, struct kfd_process *p, void __user *arg) {
- return -ENODEV;
- int retval;
- struct kfd_ioctl_update_queue_args args;
- struct queue_properties properties;
- if (copy_from_user(&args, arg, sizeof(args)))
return -EFAULT;- properties.queue_address = args.ring_base_address;
- properties.queue_size = args.ring_size;
- properties.queue_percent = args.queue_percentage;
- properties.priority = args.queue_priority;
Would need sanity check on argument.
fixed in v3. Oded
pr_debug("kfd: updating queue id %d for PASID %d\n", args.queue_id, p->pasid);
mutex_lock(&p->mutex);
retval = pqm_update_queue(&p->pqm, args.queue_id, &properties);
mutex_unlock(&p->mutex);
return retval; }
static long kfd_ioctl_set_memory_policy(struct file *filep, struct kfd_process *p, void __user *arg)
diff --git a/drivers/gpu/drm/radeon/amdkfd/kfd_priv.h b/drivers/gpu/drm/radeon/amdkfd/kfd_priv.h index 8a1de68..7ea0e81 100644 --- a/drivers/gpu/drm/radeon/amdkfd/kfd_priv.h +++ b/drivers/gpu/drm/radeon/amdkfd/kfd_priv.h @@ -418,7 +418,15 @@ struct process_queue_node {
int pqm_init(struct process_queue_manager *pqm, struct kfd_process *p); void pqm_uninit(struct process_queue_manager *pqm); +int pqm_create_queue(struct process_queue_manager *pqm,
struct kfd_dev *dev,struct file *f,struct queue_properties *properties,unsigned int flags,enum kfd_queue_type type,unsigned int *qid);+int pqm_update_queue(struct process_queue_manager *pqm, unsigned int qid, struct queue_properties *p);
/* Packet Manager */
-- 1.9.1