From: Eric Huang Date: Thu, 30 Apr 2026 15:17:21 +0000 (-0400) Subject: drm/amdkfd: remove obsolete codes for kfd_mmap X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=6888eb31578b9737d24bd6c0c529a6f91796966f;p=thirdparty%2Fkernel%2Flinux.git drm/amdkfd: remove obsolete codes for kfd_mmap kfd_reserved_mem_mmap is only for mapping CWSR on APU in IOMMUv2 mode, which is no longer supported, and qpd->cwsr_base has been set before calling kfd_process_init_cwsr_apu, which is the only caller for KFD_MMAP_TYPE_RESERVED_MEM, so kfd_process_init_cwsr_apu is not functional anymore, remove them together. On the other hand, it will fix a vulnerability issue to abuse KFD_MMAP_TYPE_RESERVED_MEM of kfd_mmap from userspace. Signed-off-by: Eric Huang Reviewed-by: Felix Kuehling Signed-off-by: Alex Deucher --- diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c b/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c index 7668966a3e040..dd27d7ba2ee2d 100644 --- a/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c +++ b/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c @@ -147,11 +147,6 @@ static int kfd_open(struct inode *inode, struct file *filep) if (IS_ERR(process)) return PTR_ERR(process); - if (kfd_process_init_cwsr_apu(process, filep)) { - kfd_unref_process(process); - return -EFAULT; - } - /* filep now owns the reference returned by kfd_create_process */ filep->private_data = process; @@ -3540,9 +3535,8 @@ static int kfd_mmap(struct file *filep, struct vm_area_struct *vma) return kfd_event_mmap(process, vma); case KFD_MMAP_TYPE_RESERVED_MEM: - if (!dev) - return -ENODEV; - return kfd_reserved_mem_mmap(dev, process, vma); + pr_warn("KFD_MMAP_TYPE_RESERVED_MEM is no longer supported\n"); + return -EINVAL; case KFD_MMAP_TYPE_MMIO: if (!dev) return -ENODEV; diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_priv.h b/drivers/gpu/drm/amd/amdkfd/kfd_priv.h index 74ea792455f53..9fe5c66d8013a 100644 --- a/drivers/gpu/drm/amd/amdkfd/kfd_priv.h +++ b/drivers/gpu/drm/amd/amdkfd/kfd_priv.h @@ -986,9 +986,6 @@ struct kfd_process { struct kobject *kobj_queues; struct attribute attr_pasid; - /* Keep track cwsr init */ - bool has_cwsr; - /* Exception code enable mask and status */ uint64_t exception_enable_mask; uint64_t exception_status; @@ -1104,8 +1101,6 @@ struct kfd_process_device *kfd_create_process_device_data(struct kfd_node *dev, bool kfd_process_xnack_mode(struct kfd_process *p, bool supported); -int kfd_reserved_mem_mmap(struct kfd_node *dev, struct kfd_process *process, - struct vm_area_struct *vma); void kfd_process_notifier_release_internal(struct kfd_process *p); /* KFD process API for creating and translating handles */ @@ -1222,9 +1217,6 @@ void kfd_process_set_trap_handler(struct qcm_process_device *qpd, void kfd_process_set_trap_debug_flag(struct qcm_process_device *qpd, bool enabled); -/* CWSR initialization */ -int kfd_process_init_cwsr_apu(struct kfd_process *process, struct file *filep); - /* CRIU */ /* * Need to increment KFD_CRIU_PRIV_VERSION each time a change is made to any of the CRIU private diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_process.c b/drivers/gpu/drm/amd/amdkfd/kfd_process.c index d28ca581cad05..9228e4a949ed1 100644 --- a/drivers/gpu/drm/amd/amdkfd/kfd_process.c +++ b/drivers/gpu/drm/amd/amdkfd/kfd_process.c @@ -1409,50 +1409,6 @@ void kfd_cleanup_processes(void) mmu_notifier_synchronize(); } -int kfd_process_init_cwsr_apu(struct kfd_process *p, struct file *filep) -{ - unsigned long offset; - int i; - - if (p->has_cwsr) - return 0; - - for (i = 0; i < p->n_pdds; i++) { - struct kfd_node *dev = p->pdds[i]->dev; - struct qcm_process_device *qpd = &p->pdds[i]->qpd; - - if (!dev->kfd->cwsr_enabled || qpd->cwsr_kaddr || qpd->cwsr_base) - continue; - - offset = KFD_MMAP_TYPE_RESERVED_MEM | KFD_MMAP_GPU_ID(dev->id); - qpd->tba_addr = (int64_t)vm_mmap(filep, 0, - KFD_CWSR_TBA_TMA_SIZE, PROT_READ | PROT_EXEC, - MAP_SHARED, offset); - - if (IS_ERR_VALUE(qpd->tba_addr)) { - int err = qpd->tba_addr; - - dev_err(dev->adev->dev, - "Failure to set tba address. error %d.\n", err); - qpd->tba_addr = 0; - qpd->cwsr_kaddr = NULL; - return err; - } - - memcpy(qpd->cwsr_kaddr, dev->kfd->cwsr_isa, dev->kfd->cwsr_isa_size); - - kfd_process_set_trap_debug_flag(qpd, p->debug_trap_enabled); - - qpd->tma_addr = qpd->tba_addr + KFD_CWSR_TMA_OFFSET; - pr_debug("set tba :0x%llx, tma:0x%llx, cwsr_kaddr:%p for pqm.\n", - qpd->tba_addr, qpd->tma_addr, qpd->cwsr_kaddr); - } - - p->has_cwsr = true; - - return 0; -} - static int kfd_process_device_init_cwsr_dgpu(struct kfd_process_device *pdd) { struct kfd_node *dev = pdd->dev; @@ -2228,38 +2184,6 @@ int kfd_resume_all_processes(void) return ret; } -int kfd_reserved_mem_mmap(struct kfd_node *dev, struct kfd_process *process, - struct vm_area_struct *vma) -{ - struct kfd_process_device *pdd; - struct qcm_process_device *qpd; - - if ((vma->vm_end - vma->vm_start) != KFD_CWSR_TBA_TMA_SIZE) { - dev_err(dev->adev->dev, "Incorrect CWSR mapping size.\n"); - return -EINVAL; - } - - pdd = kfd_get_process_device_data(dev, process); - if (!pdd) - return -EINVAL; - qpd = &pdd->qpd; - - qpd->cwsr_kaddr = (void *)__get_free_pages(GFP_KERNEL | __GFP_ZERO, - get_order(KFD_CWSR_TBA_TMA_SIZE)); - if (!qpd->cwsr_kaddr) { - dev_err(dev->adev->dev, - "Error allocating per process CWSR buffer.\n"); - return -ENOMEM; - } - - vm_flags_set(vma, VM_IO | VM_DONTCOPY | VM_DONTEXPAND - | VM_NORESERVE | VM_DONTDUMP | VM_PFNMAP); - /* Mapping pages to user process */ - return remap_pfn_range(vma, vma->vm_start, - PFN_DOWN(__pa(qpd->cwsr_kaddr)), - KFD_CWSR_TBA_TMA_SIZE, vma->vm_page_prot); -} - /* assumes caller holds process lock. */ int kfd_process_drain_interrupts(struct kfd_process_device *pdd) {