nagai/kernel
3
0
Fork 0
forked from mirrors/linux
Code Pull requests Activity

device_cgroup: Export devcgroup_check_permission

Browse source 
For AMD compute (amdkfd) driver.

All AMD compute devices are exported via single device node /dev/kfd. As
a result devices cannot be controlled individually using device cgroup.

AMD compute devices will rely on its graphics counterpart that exposes
/dev/dri/renderN node for each device. For each task (based on its
cgroup), KFD driver will check if /dev/dri/renderN node is accessible
before exposing it.

Signed-off-by: Harish Kasiviswanathan <Harish.Kasiviswanathan@amd.com>
Acked-by: Tejun Heo <tj@kernel.org>
Acked-by: Felix Kuehling <Felix.Kuehling@amd.com>
Reviewed-by: Roman Gushchin <guro@fb.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
This commit is contained in:
Harish Kasiviswanathan 2019-05-16 11:37:16 -04:00 committed by Alex Deucher
parent a3e520a25c
commit 4b7d4d453f
2 changed files with 17 additions and 17 deletions
repo.diff.show_diff_stats Download patch file Download diff file Expand all files Collapse all files

19
include/linux/device_cgroup.h
View file

@ -12,26 +12,15 @@
#define DEVCG_DEV_ALL 4 /* this represents all devices */ #define DEVCG_DEV_ALL 4 /* this represents all devices */
#ifdef CONFIG_CGROUP_DEVICE #ifdef CONFIG_CGROUP_DEVICE
extern int __devcgroup_check_permission(short type, u32 major, u32 minor, int devcgroup_check_permission(short type, u32 major, u32 minor,
short access); short access);
#else #else
static inline int __devcgroup_check_permission(short type, u32 major, u32 minor, static inline int devcgroup_check_permission(short type, u32 major, u32 minor,
short access) short access)
{ return 0; } { return 0; }
#endif #endif
#if defined(CONFIG_CGROUP_DEVICE) || defined(CONFIG_CGROUP_BPF) #if defined(CONFIG_CGROUP_DEVICE) || defined(CONFIG_CGROUP_BPF)
static inline int devcgroup_check_permission(short type, u32 major, u32 minor,
short access)
{
int rc = BPF_CGROUP_RUN_PROG_DEVICE_CGROUP(type, major, minor, access);
if (rc)
return -EPERM;
return __devcgroup_check_permission(type, major, minor, access);
}
static inline int devcgroup_inode_permission(struct inode *inode, int mask) static inline int devcgroup_inode_permission(struct inode *inode, int mask)
{ {
short type, access = 0; short type, access = 0;

15
security/device_cgroup.c
View file

@ -801,8 +801,8 @@ struct cgroup_subsys devices_cgrp_subsys = {
* *
* returns 0 on success, -EPERM case the operation is not permitted * returns 0 on success, -EPERM case the operation is not permitted
*/ */
int __devcgroup_check_permission(short type, u32 major, u32 minor, static int __devcgroup_check_permission(short type, u32 major, u32 minor,
short access) short access)
{ {
struct dev_cgroup *dev_cgroup; struct dev_cgroup *dev_cgroup;
bool rc; bool rc;
@ -824,3 +824,14 @@ int __devcgroup_check_permission(short type, u32 major, u32 minor,
return 0; return 0;
} }
int devcgroup_check_permission(short type, u32 major, u32 minor, short access)
{
int rc = BPF_CGROUP_RUN_PROG_DEVICE_CGROUP(type, major, minor, access);
if (rc)
return -EPERM;
return __devcgroup_check_permission(type, major, minor, access);
}
EXPORT_SYMBOL(devcgroup_check_permission);