xref: /linux/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c (revision 64b4c4cdfddd31d3a0ec468afccb7ff7cd926682)
1 // SPDX-License-Identifier: GPL-2.0 OR MIT
2 /*
3  * Copyright 2014-2022 Advanced Micro Devices, Inc.
4  *
5  * Permission is hereby granted, free of charge, to any person obtaining a
6  * copy of this software and associated documentation files (the "Software"),
7  * to deal in the Software without restriction, including without limitation
8  * the rights to use, copy, modify, merge, publish, distribute, sublicense,
9  * and/or sell copies of the Software, and to permit persons to whom the
10  * Software is furnished to do so, subject to the following conditions:
11  *
12  * The above copyright notice and this permission notice shall be included in
13  * all copies or substantial portions of the Software.
14  *
15  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
16  * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
17  * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL
18  * THE COPYRIGHT HOLDER(S) OR AUTHOR(S) BE LIABLE FOR ANY CLAIM, DAMAGES OR
19  * OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
20  * ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
21  * OTHER DEALINGS IN THE SOFTWARE.
22  */
23 
24 #include <linux/device.h>
25 #include <linux/err.h>
26 #include <linux/fs.h>
27 #include <linux/file.h>
28 #include <linux/overflow.h>
29 #include <linux/sched.h>
30 #include <linux/slab.h>
31 #include <linux/uaccess.h>
32 #include <linux/compat.h>
33 #include <uapi/linux/kfd_ioctl.h>
34 #include <linux/time.h>
35 #include <linux/mm.h>
36 #include <linux/mman.h>
37 #include <linux/ptrace.h>
38 #include <linux/dma-buf.h>
39 #include <linux/processor.h>
40 #include "kfd_priv.h"
41 #include "kfd_device_queue_manager.h"
42 #include "kfd_svm.h"
43 #include "amdgpu_amdkfd.h"
44 #include "kfd_smi_events.h"
45 #include "amdgpu_dma_buf.h"
46 #include "kfd_debug.h"
47 
48 static long kfd_ioctl(struct file *, unsigned int, unsigned long);
49 static int kfd_open(struct inode *, struct file *);
50 static int kfd_release(struct inode *, struct file *);
51 static int kfd_mmap(struct file *, struct vm_area_struct *);
52 
53 static const char kfd_dev_name[] = "kfd";
54 
55 static const struct file_operations kfd_fops = {
56 	.owner = THIS_MODULE,
57 	.unlocked_ioctl = kfd_ioctl,
58 	.compat_ioctl = compat_ptr_ioctl,
59 	.open = kfd_open,
60 	.release = kfd_release,
61 	.mmap = kfd_mmap,
62 };
63 
64 static int kfd_char_dev_major = -1;
65 struct device *kfd_device;
66 static const struct class kfd_class = {
67 	.name = kfd_dev_name,
68 };
69 
70 static inline struct kfd_process_device *kfd_lock_pdd_by_id(struct kfd_process *p, __u32 gpu_id)
71 {
72 	struct kfd_process_device *pdd;
73 
74 	mutex_lock(&p->mutex);
75 	pdd = kfd_process_device_data_by_id(p, gpu_id);
76 
77 	if (pdd)
78 		return pdd;
79 
80 	mutex_unlock(&p->mutex);
81 	return NULL;
82 }
83 
84 static inline void kfd_unlock_pdd(struct kfd_process_device *pdd)
85 {
86 	mutex_unlock(&pdd->process->mutex);
87 }
88 
89 int kfd_chardev_init(void)
90 {
91 	int err = 0;
92 
93 	kfd_char_dev_major = register_chrdev(0, kfd_dev_name, &kfd_fops);
94 	err = kfd_char_dev_major;
95 	if (err < 0)
96 		goto err_register_chrdev;
97 
98 	err = class_register(&kfd_class);
99 	if (err)
100 		goto err_class_create;
101 
102 	kfd_device = device_create(&kfd_class, NULL,
103 				   MKDEV(kfd_char_dev_major, 0),
104 				   NULL, kfd_dev_name);
105 	err = PTR_ERR(kfd_device);
106 	if (IS_ERR(kfd_device))
107 		goto err_device_create;
108 
109 	return 0;
110 
111 err_device_create:
112 	class_unregister(&kfd_class);
113 err_class_create:
114 	unregister_chrdev(kfd_char_dev_major, kfd_dev_name);
115 err_register_chrdev:
116 	return err;
117 }
118 
119 void kfd_chardev_exit(void)
120 {
121 	device_destroy(&kfd_class, MKDEV(kfd_char_dev_major, 0));
122 	class_unregister(&kfd_class);
123 	unregister_chrdev(kfd_char_dev_major, kfd_dev_name);
124 	kfd_device = NULL;
125 }
126 
127 
128 static int kfd_open(struct inode *inode, struct file *filep)
129 {
130 	struct kfd_process *process;
131 	bool is_32bit_user_mode;
132 
133 	if (iminor(inode) != 0)
134 		return -ENODEV;
135 
136 	is_32bit_user_mode = in_compat_syscall();
137 
138 	if (is_32bit_user_mode) {
139 		dev_warn(kfd_device,
140 			"Process %d (32-bit) failed to open /dev/kfd\n"
141 			"32-bit processes are not supported by amdkfd\n",
142 			current->pid);
143 		return -EPERM;
144 	}
145 
146 	process = kfd_create_process(current);
147 	if (IS_ERR(process))
148 		return PTR_ERR(process);
149 
150 	/* filep now owns the reference returned by kfd_create_process */
151 	filep->private_data = process;
152 
153 	dev_dbg(kfd_device, "process pid %d opened kfd node, compat mode (32 bit) - %d\n",
154 		process->lead_thread->pid, process->is_32bit_user_mode);
155 
156 	return 0;
157 }
158 
159 static int kfd_release(struct inode *inode, struct file *filep)
160 {
161 	struct kfd_process *process = filep->private_data;
162 
163 	if (!process)
164 		return 0;
165 
166 	if (process->context_id != KFD_CONTEXT_ID_PRIMARY)
167 		kfd_process_notifier_release_internal(process);
168 
169 	kfd_unref_process(process);
170 
171 	return 0;
172 }
173 
174 static int kfd_ioctl_get_version(struct file *filep, struct kfd_process *p,
175 					void *data)
176 {
177 	struct kfd_ioctl_get_version_args *args = data;
178 
179 	args->major_version = KFD_IOCTL_MAJOR_VERSION;
180 	args->minor_version = KFD_IOCTL_MINOR_VERSION;
181 
182 	return 0;
183 }
184 
185 static int set_queue_properties_from_user(struct queue_properties *q_properties,
186 				struct kfd_ioctl_create_queue_args *args)
187 {
188 	/*
189 	 * Repurpose queue percentage to accommodate new features:
190 	 * bit 0-7: queue percentage
191 	 * bit 8-15: pm4_target_xcc
192 	 */
193 	if ((args->queue_percentage & 0xFF) > KFD_MAX_QUEUE_PERCENTAGE) {
194 		pr_err("Queue percentage must be between 0 to KFD_MAX_QUEUE_PERCENTAGE\n");
195 		return -EINVAL;
196 	}
197 
198 	if (args->queue_priority > KFD_MAX_QUEUE_PRIORITY) {
199 		pr_err("Queue priority must be between 0 to KFD_MAX_QUEUE_PRIORITY\n");
200 		return -EINVAL;
201 	}
202 
203 	if ((args->ring_base_address) &&
204 		(!access_ok((const void __user *) args->ring_base_address,
205 			sizeof(uint64_t)))) {
206 		pr_err("Can't access ring base address\n");
207 		return -EFAULT;
208 	}
209 
210 	if (!is_power_of_2(args->ring_size) && (args->ring_size != 0)) {
211 		pr_err("Ring size must be a power of 2 or 0\n");
212 		return -EINVAL;
213 	}
214 
215 	if (args->ring_size < KFD_MIN_QUEUE_RING_SIZE) {
216 		args->ring_size = KFD_MIN_QUEUE_RING_SIZE;
217 		pr_debug("Size lower. clamped to KFD_MIN_QUEUE_RING_SIZE");
218 	}
219 
220 	if ((args->metadata_ring_size != 0) && !is_power_of_2(args->metadata_ring_size)) {
221 		pr_err("Metadata ring size must be a power of 2 or 0\n");
222 		return -EINVAL;
223 	}
224 
225 	if (!access_ok((const void __user *) args->read_pointer_address,
226 			sizeof(uint32_t))) {
227 		pr_err("Can't access read pointer\n");
228 		return -EFAULT;
229 	}
230 
231 	if (!access_ok((const void __user *) args->write_pointer_address,
232 			sizeof(uint32_t))) {
233 		pr_err("Can't access write pointer\n");
234 		return -EFAULT;
235 	}
236 
237 	if (args->eop_buffer_address &&
238 		!access_ok((const void __user *) args->eop_buffer_address,
239 			sizeof(uint32_t))) {
240 		pr_debug("Can't access eop buffer");
241 		return -EFAULT;
242 	}
243 
244 	if (args->ctx_save_restore_address &&
245 		!access_ok((const void __user *) args->ctx_save_restore_address,
246 			sizeof(uint32_t))) {
247 		pr_debug("Can't access ctx save restore buffer");
248 		return -EFAULT;
249 	}
250 
251 	q_properties->is_interop = false;
252 	q_properties->is_gws = false;
253 	q_properties->queue_percent = args->queue_percentage & 0xFF;
254 	/* bit 8-15 are repurposed to be PM4 target XCC */
255 	q_properties->pm4_target_xcc = (args->queue_percentage >> 8) & 0xFF;
256 	q_properties->priority = args->queue_priority;
257 	q_properties->queue_address = args->ring_base_address;
258 	q_properties->queue_size = args->ring_size;
259 	if (args->queue_type == KFD_IOC_QUEUE_TYPE_COMPUTE_AQL)
260 		q_properties->metadata_queue_size = args->metadata_ring_size;
261 
262 	q_properties->read_ptr = (void __user *)args->read_pointer_address;
263 	q_properties->write_ptr = (void __user *)args->write_pointer_address;
264 	q_properties->eop_ring_buffer_address = args->eop_buffer_address;
265 	q_properties->eop_ring_buffer_size = args->eop_buffer_size;
266 	q_properties->ctx_save_restore_area_address =
267 			args->ctx_save_restore_address;
268 	q_properties->ctx_save_restore_area_size = args->ctx_save_restore_size;
269 	q_properties->ctl_stack_size = args->ctl_stack_size;
270 	q_properties->sdma_engine_id = args->sdma_engine_id;
271 	if (args->queue_type == KFD_IOC_QUEUE_TYPE_COMPUTE ||
272 		args->queue_type == KFD_IOC_QUEUE_TYPE_COMPUTE_AQL)
273 		q_properties->type = KFD_QUEUE_TYPE_COMPUTE;
274 	else if (args->queue_type == KFD_IOC_QUEUE_TYPE_SDMA)
275 		q_properties->type = KFD_QUEUE_TYPE_SDMA;
276 	else if (args->queue_type == KFD_IOC_QUEUE_TYPE_SDMA_XGMI)
277 		q_properties->type = KFD_QUEUE_TYPE_SDMA_XGMI;
278 	else if (args->queue_type == KFD_IOC_QUEUE_TYPE_SDMA_BY_ENG_ID)
279 		q_properties->type = KFD_QUEUE_TYPE_SDMA_BY_ENG_ID;
280 	else
281 		return -ENOTSUPP;
282 
283 	if (args->queue_type == KFD_IOC_QUEUE_TYPE_COMPUTE_AQL)
284 		q_properties->format = KFD_QUEUE_FORMAT_AQL;
285 	else
286 		q_properties->format = KFD_QUEUE_FORMAT_PM4;
287 
288 	pr_debug("Queue Percentage: %d, %d\n",
289 			q_properties->queue_percent, args->queue_percentage);
290 
291 	pr_debug("Queue Priority: %d, %d\n",
292 			q_properties->priority, args->queue_priority);
293 
294 	pr_debug("Queue Address: 0x%llX, 0x%llX\n",
295 			q_properties->queue_address, args->ring_base_address);
296 
297 	pr_debug("Queue Size: 0x%llX, %u\n",
298 			q_properties->queue_size, args->ring_size);
299 
300 	pr_debug("Queue r/w Pointers: %px, %px\n",
301 			q_properties->read_ptr,
302 			q_properties->write_ptr);
303 
304 	pr_debug("Queue Format: %d\n", q_properties->format);
305 
306 	pr_debug("Queue EOP: 0x%llX\n", q_properties->eop_ring_buffer_address);
307 
308 	pr_debug("Queue CTX save area: 0x%llX\n",
309 			q_properties->ctx_save_restore_area_address);
310 
311 	return 0;
312 }
313 
314 static int kfd_ioctl_create_queue(struct file *filep, struct kfd_process *p,
315 					void *data)
316 {
317 	struct kfd_ioctl_create_queue_args *args = data;
318 	struct kfd_node *dev;
319 	int err = 0;
320 	unsigned int queue_id;
321 	struct kfd_process_device *pdd;
322 	struct queue_properties q_properties;
323 	uint32_t doorbell_offset_in_process = 0;
324 
325 	memset(&q_properties, 0, sizeof(struct queue_properties));
326 
327 	pr_debug("Creating queue ioctl\n");
328 
329 	err = set_queue_properties_from_user(&q_properties, args);
330 	if (err)
331 		return err;
332 
333 	pr_debug("Looking for gpu id 0x%x\n", args->gpu_id);
334 
335 	mutex_lock(&p->mutex);
336 
337 	pdd = kfd_process_device_data_by_id(p, args->gpu_id);
338 	if (!pdd) {
339 		pr_debug("Could not find gpu id 0x%x\n", args->gpu_id);
340 		err = -EINVAL;
341 		goto err_pdd;
342 	}
343 	dev = pdd->dev;
344 
345 	pdd = kfd_bind_process_to_device(dev, p);
346 	if (IS_ERR(pdd)) {
347 		err = -ESRCH;
348 		goto err_bind_process;
349 	}
350 
351 	if (q_properties.type == KFD_QUEUE_TYPE_SDMA_BY_ENG_ID) {
352 		int max_sdma_eng_id = kfd_get_num_sdma_engines(dev) +
353 				      kfd_get_num_xgmi_sdma_engines(dev) - 1;
354 
355 		if (q_properties.sdma_engine_id > max_sdma_eng_id) {
356 			err = -EINVAL;
357 			pr_err("sdma_engine_id %i exceeds maximum id of %i\n",
358 			       q_properties.sdma_engine_id, max_sdma_eng_id);
359 			goto err_sdma_engine_id;
360 		}
361 	}
362 
363 	if (!pdd->qpd.proc_doorbells) {
364 		err = kfd_alloc_process_doorbells(dev->kfd, pdd);
365 		if (err) {
366 			pr_debug("failed to allocate process doorbells\n");
367 			goto err_bind_process;
368 		}
369 	}
370 
371 	err = kfd_queue_acquire_buffers(pdd, &q_properties);
372 	if (err) {
373 		pr_debug("failed to acquire user queue buffers\n");
374 		goto err_acquire_queue_buf;
375 	}
376 
377 	pr_debug("Creating queue for process pid %d on gpu 0x%x\n",
378 			p->lead_thread->pid,
379 			dev->id);
380 
381 	err = pqm_create_queue(&p->pqm, dev, &q_properties, &queue_id,
382 			NULL, NULL, NULL, &doorbell_offset_in_process);
383 	if (err != 0)
384 		goto err_create_queue;
385 
386 	args->queue_id = queue_id;
387 
388 
389 	/* Return gpu_id as doorbell offset for mmap usage */
390 	args->doorbell_offset = KFD_MMAP_TYPE_DOORBELL;
391 	args->doorbell_offset |= KFD_MMAP_GPU_ID(args->gpu_id);
392 	if (KFD_IS_SOC15(dev))
393 		/* On SOC15 ASICs, include the doorbell offset within the
394 		 * process doorbell frame, which is 2 pages.
395 		 */
396 		args->doorbell_offset |= doorbell_offset_in_process;
397 
398 	mutex_unlock(&p->mutex);
399 
400 	pr_debug("Queue id %d was created successfully\n", args->queue_id);
401 
402 	pr_debug("Ring buffer address == 0x%016llX\n",
403 			args->ring_base_address);
404 
405 	pr_debug("Read ptr address    == 0x%016llX\n",
406 			args->read_pointer_address);
407 
408 	pr_debug("Write ptr address   == 0x%016llX\n",
409 			args->write_pointer_address);
410 
411 	kfd_dbg_ev_raise(KFD_EC_MASK(EC_QUEUE_NEW), p, dev, queue_id, false, NULL, 0);
412 	return 0;
413 
414 err_create_queue:
415 	kfd_queue_unref_bo_vas(pdd, &q_properties);
416 	kfd_queue_release_buffers(pdd, &q_properties);
417 err_acquire_queue_buf:
418 err_sdma_engine_id:
419 err_bind_process:
420 err_pdd:
421 	mutex_unlock(&p->mutex);
422 	return err;
423 }
424 
425 static int kfd_ioctl_destroy_queue(struct file *filp, struct kfd_process *p,
426 					void *data)
427 {
428 	int retval;
429 	struct kfd_ioctl_destroy_queue_args *args = data;
430 
431 	pr_debug("Destroying queue id %d for process pid %d\n",
432 				args->queue_id,
433 				p->lead_thread->pid);
434 
435 	mutex_lock(&p->mutex);
436 
437 	retval = pqm_destroy_queue(&p->pqm, args->queue_id);
438 
439 	mutex_unlock(&p->mutex);
440 	return retval;
441 }
442 
443 static int kfd_ioctl_update_queue(struct file *filp, struct kfd_process *p,
444 					void *data)
445 {
446 	int retval;
447 	struct kfd_ioctl_update_queue_args *args = data;
448 	struct queue_properties properties;
449 
450 	/*
451 	 * Repurpose queue percentage to accommodate new features:
452 	 * bit 0-7: queue percentage
453 	 * bit 8-15: pm4_target_xcc
454 	 */
455 	if ((args->queue_percentage & 0xFF) > KFD_MAX_QUEUE_PERCENTAGE) {
456 		pr_err("Queue percentage must be between 0 to KFD_MAX_QUEUE_PERCENTAGE\n");
457 		return -EINVAL;
458 	}
459 
460 	if (args->queue_priority > KFD_MAX_QUEUE_PRIORITY) {
461 		pr_err("Queue priority must be between 0 to KFD_MAX_QUEUE_PRIORITY\n");
462 		return -EINVAL;
463 	}
464 
465 	if ((args->ring_base_address) &&
466 		(!access_ok((const void __user *) args->ring_base_address,
467 			sizeof(uint64_t)))) {
468 		pr_err("Can't access ring base address\n");
469 		return -EFAULT;
470 	}
471 
472 	if (!is_power_of_2(args->ring_size) && (args->ring_size != 0)) {
473 		pr_err("Ring size must be a power of 2 or 0\n");
474 		return -EINVAL;
475 	}
476 
477 	if (args->ring_size < KFD_MIN_QUEUE_RING_SIZE) {
478 		args->ring_size = KFD_MIN_QUEUE_RING_SIZE;
479 		pr_debug("Size lower. clamped to KFD_MIN_QUEUE_RING_SIZE");
480 	}
481 
482 	properties.queue_address = args->ring_base_address;
483 	properties.queue_size = args->ring_size;
484 	properties.queue_percent = args->queue_percentage & 0xFF;
485 	/* bit 8-15 are repurposed to be PM4 target XCC */
486 	properties.pm4_target_xcc = (args->queue_percentage >> 8) & 0xFF;
487 	properties.priority = args->queue_priority;
488 
489 	pr_debug("Updating queue id %d for process pid %d\n",
490 			args->queue_id, p->lead_thread->pid);
491 
492 	mutex_lock(&p->mutex);
493 
494 	retval = pqm_update_queue_properties(&p->pqm, args->queue_id, &properties);
495 
496 	mutex_unlock(&p->mutex);
497 
498 	return retval;
499 }
500 
501 static int kfd_ioctl_set_cu_mask(struct file *filp, struct kfd_process *p,
502 					void *data)
503 {
504 	int retval;
505 	const int max_num_cus = 1024;
506 	struct kfd_ioctl_set_cu_mask_args *args = data;
507 	struct mqd_update_info minfo = {0};
508 	uint32_t __user *cu_mask_ptr = (uint32_t __user *)args->cu_mask_ptr;
509 	size_t cu_mask_size = sizeof(uint32_t) * (args->num_cu_mask / 32);
510 
511 	if ((args->num_cu_mask % 32) != 0) {
512 		pr_debug("num_cu_mask 0x%x must be a multiple of 32",
513 				args->num_cu_mask);
514 		return -EINVAL;
515 	}
516 
517 	minfo.cu_mask.count = args->num_cu_mask;
518 	if (minfo.cu_mask.count == 0) {
519 		pr_debug("CU mask cannot be 0");
520 		return -EINVAL;
521 	}
522 
523 	/* To prevent an unreasonably large CU mask size, set an arbitrary
524 	 * limit of max_num_cus bits.  We can then just drop any CU mask bits
525 	 * past max_num_cus bits and just use the first max_num_cus bits.
526 	 */
527 	if (minfo.cu_mask.count > max_num_cus) {
528 		pr_debug("CU mask cannot be greater than 1024 bits");
529 		minfo.cu_mask.count = max_num_cus;
530 		cu_mask_size = sizeof(uint32_t) * (max_num_cus/32);
531 	}
532 
533 	minfo.cu_mask.ptr = memdup_user(cu_mask_ptr, cu_mask_size);
534 	if (IS_ERR(minfo.cu_mask.ptr)) {
535 		pr_debug("Could not copy CU mask from userspace");
536 		return PTR_ERR(minfo.cu_mask.ptr);
537 	}
538 
539 	mutex_lock(&p->mutex);
540 
541 	retval = pqm_update_mqd(&p->pqm, args->queue_id, &minfo);
542 
543 	mutex_unlock(&p->mutex);
544 
545 	kfree(minfo.cu_mask.ptr);
546 	return retval;
547 }
548 
549 static int kfd_ioctl_get_queue_wave_state(struct file *filep,
550 					  struct kfd_process *p, void *data)
551 {
552 	struct kfd_ioctl_get_queue_wave_state_args *args = data;
553 	int r;
554 
555 	mutex_lock(&p->mutex);
556 
557 	r = pqm_get_wave_state(&p->pqm, args->queue_id,
558 			       (void __user *)args->ctl_stack_address,
559 			       &args->ctl_stack_used_size,
560 			       &args->save_area_used_size);
561 
562 	mutex_unlock(&p->mutex);
563 
564 	return r;
565 }
566 
567 static int kfd_ioctl_set_memory_policy(struct file *filep,
568 					struct kfd_process *p, void *data)
569 {
570 	struct kfd_ioctl_set_memory_policy_args *args = data;
571 	int err = 0;
572 	struct kfd_process_device *pdd;
573 	enum cache_policy default_policy, alternate_policy;
574 
575 	if (args->default_policy != KFD_IOC_CACHE_POLICY_COHERENT
576 	    && args->default_policy != KFD_IOC_CACHE_POLICY_NONCOHERENT) {
577 		return -EINVAL;
578 	}
579 
580 	if (args->alternate_policy != KFD_IOC_CACHE_POLICY_COHERENT
581 	    && args->alternate_policy != KFD_IOC_CACHE_POLICY_NONCOHERENT) {
582 		return -EINVAL;
583 	}
584 
585 	mutex_lock(&p->mutex);
586 	pdd = kfd_process_device_data_by_id(p, args->gpu_id);
587 	if (!pdd) {
588 		pr_debug("Could not find gpu id 0x%x\n", args->gpu_id);
589 		err = -EINVAL;
590 		goto err_pdd;
591 	}
592 
593 	pdd = kfd_bind_process_to_device(pdd->dev, p);
594 	if (IS_ERR(pdd)) {
595 		err = -ESRCH;
596 		goto out;
597 	}
598 
599 	default_policy = (args->default_policy == KFD_IOC_CACHE_POLICY_COHERENT)
600 			 ? cache_policy_coherent : cache_policy_noncoherent;
601 
602 	alternate_policy =
603 		(args->alternate_policy == KFD_IOC_CACHE_POLICY_COHERENT)
604 		   ? cache_policy_coherent : cache_policy_noncoherent;
605 
606 	if (!pdd->dev->dqm->ops.set_cache_memory_policy(pdd->dev->dqm,
607 				&pdd->qpd,
608 				default_policy,
609 				alternate_policy,
610 				(void __user *)args->alternate_aperture_base,
611 				args->alternate_aperture_size,
612 				args->misc_process_flag))
613 		err = -EINVAL;
614 
615 out:
616 err_pdd:
617 	mutex_unlock(&p->mutex);
618 
619 	return err;
620 }
621 
622 static int kfd_ioctl_set_trap_handler(struct file *filep,
623 					struct kfd_process *p, void *data)
624 {
625 	struct kfd_ioctl_set_trap_handler_args *args = data;
626 	int err = 0;
627 	struct kfd_process_device *pdd;
628 
629 	mutex_lock(&p->mutex);
630 
631 	pdd = kfd_process_device_data_by_id(p, args->gpu_id);
632 	if (!pdd) {
633 		err = -EINVAL;
634 		goto err_pdd;
635 	}
636 
637 	pdd = kfd_bind_process_to_device(pdd->dev, p);
638 	if (IS_ERR(pdd)) {
639 		err = -ESRCH;
640 		goto out;
641 	}
642 
643 	kfd_process_set_trap_handler(&pdd->qpd, args->tba_addr, args->tma_addr);
644 
645 out:
646 err_pdd:
647 	mutex_unlock(&p->mutex);
648 
649 	return err;
650 }
651 
652 static int kfd_ioctl_dbg_register(struct file *filep,
653 				struct kfd_process *p, void *data)
654 {
655 	return -EPERM;
656 }
657 
658 static int kfd_ioctl_dbg_unregister(struct file *filep,
659 				struct kfd_process *p, void *data)
660 {
661 	return -EPERM;
662 }
663 
664 static int kfd_ioctl_dbg_address_watch(struct file *filep,
665 					struct kfd_process *p, void *data)
666 {
667 	return -EPERM;
668 }
669 
670 /* Parse and generate fixed size data structure for wave control */
671 static int kfd_ioctl_dbg_wave_control(struct file *filep,
672 					struct kfd_process *p, void *data)
673 {
674 	return -EPERM;
675 }
676 
677 static int kfd_ioctl_get_clock_counters(struct file *filep,
678 				struct kfd_process *p, void *data)
679 {
680 	struct kfd_ioctl_get_clock_counters_args *args = data;
681 	struct kfd_process_device *pdd;
682 
683 	mutex_lock(&p->mutex);
684 	pdd = kfd_process_device_data_by_id(p, args->gpu_id);
685 	mutex_unlock(&p->mutex);
686 	if (pdd)
687 		/* Reading GPU clock counter from KGD */
688 		args->gpu_clock_counter = amdgpu_amdkfd_get_gpu_clock_counter(pdd->dev->adev);
689 	else
690 		/* Node without GPU resource */
691 		args->gpu_clock_counter = 0;
692 
693 	/* No access to rdtsc. Using raw monotonic time */
694 	args->cpu_clock_counter = ktime_get_raw_ns();
695 	args->system_clock_counter = ktime_get_boottime_ns();
696 
697 	/* Since the counter is in nano-seconds we use 1GHz frequency */
698 	args->system_clock_freq = 1000000000;
699 
700 	return 0;
701 }
702 
703 
704 static int kfd_ioctl_get_process_apertures(struct file *filp,
705 				struct kfd_process *p, void *data)
706 {
707 	struct kfd_ioctl_get_process_apertures_args *args = data;
708 	struct kfd_process_device_apertures *pAperture;
709 	int i;
710 
711 	dev_dbg(kfd_device, "get apertures for process pid %d", p->lead_thread->pid);
712 
713 	args->num_of_nodes = 0;
714 
715 	mutex_lock(&p->mutex);
716 	/* Run over all pdd of the process */
717 	for (i = 0; i < p->n_pdds; i++) {
718 		struct kfd_process_device *pdd = p->pdds[i];
719 
720 		pAperture =
721 			&args->process_apertures[args->num_of_nodes];
722 		pAperture->gpu_id = pdd->dev->id;
723 		pAperture->lds_base = pdd->lds_base;
724 		pAperture->lds_limit = pdd->lds_limit;
725 		pAperture->gpuvm_base = pdd->gpuvm_base;
726 		pAperture->gpuvm_limit = pdd->gpuvm_limit;
727 		pAperture->scratch_base = pdd->scratch_base;
728 		pAperture->scratch_limit = pdd->scratch_limit;
729 
730 		dev_dbg(kfd_device,
731 			"node id %u\n", args->num_of_nodes);
732 		dev_dbg(kfd_device,
733 			"gpu id %u\n", pdd->dev->id);
734 		dev_dbg(kfd_device,
735 			"lds_base %llX\n", pdd->lds_base);
736 		dev_dbg(kfd_device,
737 			"lds_limit %llX\n", pdd->lds_limit);
738 		dev_dbg(kfd_device,
739 			"gpuvm_base %llX\n", pdd->gpuvm_base);
740 		dev_dbg(kfd_device,
741 			"gpuvm_limit %llX\n", pdd->gpuvm_limit);
742 		dev_dbg(kfd_device,
743 			"scratch_base %llX\n", pdd->scratch_base);
744 		dev_dbg(kfd_device,
745 			"scratch_limit %llX\n", pdd->scratch_limit);
746 
747 		if (++args->num_of_nodes >= NUM_OF_SUPPORTED_GPUS)
748 			break;
749 	}
750 	mutex_unlock(&p->mutex);
751 
752 	return 0;
753 }
754 
755 static int kfd_ioctl_get_process_apertures_new(struct file *filp,
756 				struct kfd_process *p, void *data)
757 {
758 	struct kfd_ioctl_get_process_apertures_new_args *args = data;
759 	struct kfd_process_device_apertures *pa;
760 	int ret;
761 	int i;
762 
763 	dev_dbg(kfd_device, "get apertures for process pid %d",
764 			p->lead_thread->pid);
765 
766 	if (args->num_of_nodes == 0) {
767 		/* Return number of nodes, so that user space can alloacate
768 		 * sufficient memory
769 		 */
770 		mutex_lock(&p->mutex);
771 		args->num_of_nodes = p->n_pdds;
772 		goto out_unlock;
773 	}
774 
775 	if (args->num_of_nodes > kfd_topology_get_num_devices())
776 		return -EINVAL;
777 
778 	/* Fill in process-aperture information for all available
779 	 * nodes, but not more than args->num_of_nodes as that is
780 	 * the amount of memory allocated by user
781 	 */
782 	pa = kzalloc_objs(struct kfd_process_device_apertures,
783 			  args->num_of_nodes);
784 	if (!pa)
785 		return -ENOMEM;
786 
787 	mutex_lock(&p->mutex);
788 
789 	if (!p->n_pdds) {
790 		args->num_of_nodes = 0;
791 		kfree(pa);
792 		goto out_unlock;
793 	}
794 
795 	/* Run over all pdd of the process */
796 	for (i = 0; i < min(p->n_pdds, args->num_of_nodes); i++) {
797 		struct kfd_process_device *pdd = p->pdds[i];
798 
799 		pa[i].gpu_id = pdd->dev->id;
800 		pa[i].lds_base = pdd->lds_base;
801 		pa[i].lds_limit = pdd->lds_limit;
802 		pa[i].gpuvm_base = pdd->gpuvm_base;
803 		pa[i].gpuvm_limit = pdd->gpuvm_limit;
804 		pa[i].scratch_base = pdd->scratch_base;
805 		pa[i].scratch_limit = pdd->scratch_limit;
806 
807 		dev_dbg(kfd_device,
808 			"gpu id %u\n", pdd->dev->id);
809 		dev_dbg(kfd_device,
810 			"lds_base %llX\n", pdd->lds_base);
811 		dev_dbg(kfd_device,
812 			"lds_limit %llX\n", pdd->lds_limit);
813 		dev_dbg(kfd_device,
814 			"gpuvm_base %llX\n", pdd->gpuvm_base);
815 		dev_dbg(kfd_device,
816 			"gpuvm_limit %llX\n", pdd->gpuvm_limit);
817 		dev_dbg(kfd_device,
818 			"scratch_base %llX\n", pdd->scratch_base);
819 		dev_dbg(kfd_device,
820 			"scratch_limit %llX\n", pdd->scratch_limit);
821 	}
822 	mutex_unlock(&p->mutex);
823 
824 	args->num_of_nodes = i;
825 	ret = copy_to_user(
826 			(void __user *)args->kfd_process_device_apertures_ptr,
827 			pa,
828 			(i * sizeof(struct kfd_process_device_apertures)));
829 	kfree(pa);
830 	return ret ? -EFAULT : 0;
831 
832 out_unlock:
833 	mutex_unlock(&p->mutex);
834 	return 0;
835 }
836 
837 static int kfd_ioctl_create_event(struct file *filp, struct kfd_process *p,
838 					void *data)
839 {
840 	struct kfd_ioctl_create_event_args *args = data;
841 	int err;
842 
843 	/* For dGPUs the event page is allocated in user mode. The
844 	 * handle is passed to KFD with the first call to this IOCTL
845 	 * through the event_page_offset field.
846 	 */
847 	if (args->event_page_offset) {
848 		mutex_lock(&p->mutex);
849 		err = kfd_kmap_event_page(p, args->event_page_offset);
850 		mutex_unlock(&p->mutex);
851 		if (err)
852 			return err;
853 	}
854 
855 	err = kfd_event_create(filp, p, args->event_type,
856 				args->auto_reset != 0, args->node_id,
857 				&args->event_id, &args->event_trigger_data,
858 				&args->event_page_offset,
859 				&args->event_slot_index);
860 
861 	pr_debug("Created event (id:0x%08x) (%s)\n", args->event_id, __func__);
862 	return err;
863 }
864 
865 static int kfd_ioctl_destroy_event(struct file *filp, struct kfd_process *p,
866 					void *data)
867 {
868 	struct kfd_ioctl_destroy_event_args *args = data;
869 
870 	return kfd_event_destroy(p, args->event_id);
871 }
872 
873 static int kfd_ioctl_set_event(struct file *filp, struct kfd_process *p,
874 				void *data)
875 {
876 	struct kfd_ioctl_set_event_args *args = data;
877 
878 	return kfd_set_event(p, args->event_id);
879 }
880 
881 static int kfd_ioctl_reset_event(struct file *filp, struct kfd_process *p,
882 				void *data)
883 {
884 	struct kfd_ioctl_reset_event_args *args = data;
885 
886 	return kfd_reset_event(p, args->event_id);
887 }
888 
889 static int kfd_ioctl_wait_events(struct file *filp, struct kfd_process *p,
890 				void *data)
891 {
892 	struct kfd_ioctl_wait_events_args *args = data;
893 
894 	return kfd_wait_on_events(p, args->num_events,
895 			(void __user *)args->events_ptr,
896 			(args->wait_for_all != 0),
897 			&args->timeout, &args->wait_result);
898 }
899 static int kfd_ioctl_set_scratch_backing_va(struct file *filep,
900 					struct kfd_process *p, void *data)
901 {
902 	struct kfd_ioctl_set_scratch_backing_va_args *args = data;
903 	struct kfd_process_device *pdd;
904 	struct kfd_node *dev;
905 	long err;
906 
907 	mutex_lock(&p->mutex);
908 	pdd = kfd_process_device_data_by_id(p, args->gpu_id);
909 	if (!pdd) {
910 		err = -EINVAL;
911 		goto err_pdd;
912 	}
913 	dev = pdd->dev;
914 
915 	pdd = kfd_bind_process_to_device(dev, p);
916 	if (IS_ERR(pdd)) {
917 		err = PTR_ERR(pdd);
918 		goto bind_process_to_device_fail;
919 	}
920 
921 	pdd->qpd.sh_hidden_private_base = args->va_addr;
922 
923 	mutex_unlock(&p->mutex);
924 
925 	if (dev->dqm->sched_policy == KFD_SCHED_POLICY_NO_HWS &&
926 	    pdd->qpd.vmid != 0 && dev->kfd2kgd->set_scratch_backing_va)
927 		dev->kfd2kgd->set_scratch_backing_va(
928 			dev->adev, args->va_addr, pdd->qpd.vmid);
929 
930 	return 0;
931 
932 bind_process_to_device_fail:
933 err_pdd:
934 	mutex_unlock(&p->mutex);
935 	return err;
936 }
937 
938 static int kfd_ioctl_get_tile_config(struct file *filep,
939 		struct kfd_process *p, void *data)
940 {
941 	struct kfd_ioctl_get_tile_config_args *args = data;
942 	struct kfd_process_device *pdd;
943 	struct tile_config config;
944 	int err = 0;
945 
946 	mutex_lock(&p->mutex);
947 	pdd = kfd_process_device_data_by_id(p, args->gpu_id);
948 	mutex_unlock(&p->mutex);
949 	if (!pdd)
950 		return -EINVAL;
951 
952 	amdgpu_amdkfd_get_tile_config(pdd->dev->adev, &config);
953 
954 	args->gb_addr_config = config.gb_addr_config;
955 	args->num_banks = config.num_banks;
956 	args->num_ranks = config.num_ranks;
957 
958 	if (args->num_tile_configs > config.num_tile_configs)
959 		args->num_tile_configs = config.num_tile_configs;
960 	err = copy_to_user((void __user *)args->tile_config_ptr,
961 			config.tile_config_ptr,
962 			args->num_tile_configs * sizeof(uint32_t));
963 	if (err) {
964 		args->num_tile_configs = 0;
965 		return -EFAULT;
966 	}
967 
968 	if (args->num_macro_tile_configs > config.num_macro_tile_configs)
969 		args->num_macro_tile_configs =
970 				config.num_macro_tile_configs;
971 	err = copy_to_user((void __user *)args->macro_tile_config_ptr,
972 			config.macro_tile_config_ptr,
973 			args->num_macro_tile_configs * sizeof(uint32_t));
974 	if (err) {
975 		args->num_macro_tile_configs = 0;
976 		return -EFAULT;
977 	}
978 
979 	return 0;
980 }
981 
982 static int kfd_ioctl_acquire_vm(struct file *filep, struct kfd_process *p,
983 				void *data)
984 {
985 	struct kfd_ioctl_acquire_vm_args *args = data;
986 	struct kfd_process_device *pdd;
987 	struct file *drm_file;
988 	int ret;
989 
990 	drm_file = fget(args->drm_fd);
991 	if (!drm_file)
992 		return -EINVAL;
993 
994 	mutex_lock(&p->mutex);
995 	pdd = kfd_process_device_data_by_id(p, args->gpu_id);
996 	if (!pdd) {
997 		ret = -EINVAL;
998 		goto err_pdd;
999 	}
1000 
1001 	if (pdd->drm_file) {
1002 		ret = pdd->drm_file == drm_file ? 0 : -EBUSY;
1003 		goto err_drm_file;
1004 	}
1005 
1006 	ret = kfd_process_device_init_vm(pdd, drm_file);
1007 	if (ret)
1008 		goto err_unlock;
1009 
1010 	/* On success, the PDD keeps the drm_file reference */
1011 	mutex_unlock(&p->mutex);
1012 
1013 	return 0;
1014 
1015 err_unlock:
1016 err_pdd:
1017 err_drm_file:
1018 	mutex_unlock(&p->mutex);
1019 	fput(drm_file);
1020 	return ret;
1021 }
1022 
1023 bool kfd_dev_is_large_bar(struct kfd_node *dev)
1024 {
1025 	if (dev->kfd->adev->debug_largebar) {
1026 		pr_debug("Simulate large-bar allocation on non large-bar machine\n");
1027 		return true;
1028 	}
1029 
1030 	if (dev->local_mem_info.local_mem_size_private == 0 &&
1031 	    dev->local_mem_info.local_mem_size_public > 0)
1032 		return true;
1033 
1034 	if (dev->local_mem_info.local_mem_size_public == 0 &&
1035 	    dev->kfd->adev->gmc.is_app_apu) {
1036 		pr_debug("APP APU, Consider like a large bar system\n");
1037 		return true;
1038 	}
1039 
1040 	return false;
1041 }
1042 
1043 static int kfd_ioctl_get_available_memory(struct file *filep,
1044 					  struct kfd_process *p, void *data)
1045 {
1046 	struct kfd_ioctl_get_available_memory_args *args = data;
1047 	struct kfd_process_device *pdd = kfd_lock_pdd_by_id(p, args->gpu_id);
1048 
1049 	if (!pdd)
1050 		return -EINVAL;
1051 	args->available = amdgpu_amdkfd_get_available_memory(pdd->dev->adev,
1052 							pdd->dev->node_id);
1053 	kfd_unlock_pdd(pdd);
1054 	return 0;
1055 }
1056 
1057 static int kfd_ioctl_alloc_memory_of_gpu(struct file *filep,
1058 					struct kfd_process *p, void *data)
1059 {
1060 	struct kfd_ioctl_alloc_memory_of_gpu_args *args = data;
1061 	struct kfd_process_device *pdd;
1062 	void *mem;
1063 	struct kfd_node *dev;
1064 	int idr_handle;
1065 	long err;
1066 	uint64_t offset = args->mmap_offset;
1067 	uint32_t flags = args->flags;
1068 
1069 	if (args->size == 0)
1070 		return -EINVAL;
1071 
1072 	if (p->context_id != KFD_CONTEXT_ID_PRIMARY && (flags & KFD_IOC_ALLOC_MEM_FLAGS_USERPTR)) {
1073 		pr_debug("USERPTR is not supported on non-primary kfd_process\n");
1074 
1075 		return -EOPNOTSUPP;
1076 	}
1077 
1078 #if IS_ENABLED(CONFIG_HSA_AMD_SVM)
1079 	/* Flush pending deferred work to avoid racing with deferred actions
1080 	 * from previous memory map changes (e.g. munmap).
1081 	 */
1082 	svm_range_list_lock_and_flush_work(&p->svms, current->mm);
1083 	mutex_lock(&p->svms.lock);
1084 	mmap_write_unlock(current->mm);
1085 
1086 	/* Skip a special case that allocates VRAM without VA,
1087 	 * VA will be invalid of 0.
1088 	 */
1089 	if (!(!args->va_addr && (flags & KFD_IOC_ALLOC_MEM_FLAGS_VRAM)) &&
1090 	    interval_tree_iter_first(&p->svms.objects,
1091 				     args->va_addr >> PAGE_SHIFT,
1092 				     (args->va_addr + args->size - 1) >> PAGE_SHIFT)) {
1093 		pr_err("Address: 0x%llx already allocated by SVM\n",
1094 			args->va_addr);
1095 		mutex_unlock(&p->svms.lock);
1096 		return -EADDRINUSE;
1097 	}
1098 
1099 	/* When register user buffer check if it has been registered by svm by
1100 	 * buffer cpu virtual address.
1101 	 */
1102 	if ((flags & KFD_IOC_ALLOC_MEM_FLAGS_USERPTR) &&
1103 	    interval_tree_iter_first(&p->svms.objects,
1104 				     args->mmap_offset >> PAGE_SHIFT,
1105 				     (args->mmap_offset  + args->size - 1) >> PAGE_SHIFT)) {
1106 		pr_err("User Buffer Address: 0x%llx already allocated by SVM\n",
1107 			args->mmap_offset);
1108 		mutex_unlock(&p->svms.lock);
1109 		return -EADDRINUSE;
1110 	}
1111 
1112 	mutex_unlock(&p->svms.lock);
1113 #endif
1114 	mutex_lock(&p->mutex);
1115 	pdd = kfd_process_device_data_by_id(p, args->gpu_id);
1116 	if (!pdd) {
1117 		err = -EINVAL;
1118 		goto err_pdd;
1119 	}
1120 
1121 	dev = pdd->dev;
1122 
1123 	if ((flags & KFD_IOC_ALLOC_MEM_FLAGS_PUBLIC) &&
1124 		(flags & KFD_IOC_ALLOC_MEM_FLAGS_VRAM) &&
1125 		!kfd_dev_is_large_bar(dev)) {
1126 		pr_err("Alloc host visible vram on small bar is not allowed\n");
1127 		err = -EINVAL;
1128 		goto err_large_bar;
1129 	}
1130 
1131 	pdd = kfd_bind_process_to_device(dev, p);
1132 	if (IS_ERR(pdd)) {
1133 		err = PTR_ERR(pdd);
1134 		goto err_unlock;
1135 	}
1136 
1137 	if (flags & KFD_IOC_ALLOC_MEM_FLAGS_DOORBELL) {
1138 		if (args->size != kfd_doorbell_process_slice(dev->kfd)) {
1139 			err = -EINVAL;
1140 			goto err_unlock;
1141 		}
1142 		offset = kfd_get_process_doorbells(pdd);
1143 		if (!offset) {
1144 			err = -ENOMEM;
1145 			goto err_unlock;
1146 		}
1147 	} else if (flags & KFD_IOC_ALLOC_MEM_FLAGS_MMIO_REMAP) {
1148 		if (args->size != PAGE_SIZE) {
1149 			err = -EINVAL;
1150 			goto err_unlock;
1151 		}
1152 		offset = dev->adev->rmmio_remap.bus_addr;
1153 		if (!offset || (PAGE_SIZE > 4096)) {
1154 			err = -ENOMEM;
1155 			goto err_unlock;
1156 		}
1157 	}
1158 
1159 	err = amdgpu_amdkfd_gpuvm_alloc_memory_of_gpu(
1160 		dev->adev, args->va_addr, args->size,
1161 		pdd->drm_priv, (struct kgd_mem **) &mem, &offset,
1162 		flags, false);
1163 
1164 	if (err)
1165 		goto err_unlock;
1166 
1167 	idr_handle = kfd_process_device_create_obj_handle(pdd, mem);
1168 	if (idr_handle < 0) {
1169 		err = -EFAULT;
1170 		goto err_free;
1171 	}
1172 
1173 	/* Update the VRAM usage count */
1174 	if (flags & KFD_IOC_ALLOC_MEM_FLAGS_VRAM) {
1175 		uint64_t size = args->size;
1176 
1177 		if (flags & KFD_IOC_ALLOC_MEM_FLAGS_AQL_QUEUE_MEM)
1178 			size >>= 1;
1179 		atomic64_add(PAGE_ALIGN(size), &pdd->vram_usage);
1180 	}
1181 
1182 	mutex_unlock(&p->mutex);
1183 
1184 	args->handle = MAKE_HANDLE(args->gpu_id, idr_handle);
1185 	args->mmap_offset = offset;
1186 
1187 	/* MMIO is mapped through kfd device
1188 	 * Generate a kfd mmap offset
1189 	 */
1190 	if (flags & KFD_IOC_ALLOC_MEM_FLAGS_MMIO_REMAP)
1191 		args->mmap_offset = KFD_MMAP_TYPE_MMIO
1192 					| KFD_MMAP_GPU_ID(args->gpu_id);
1193 
1194 	return 0;
1195 
1196 err_free:
1197 	amdgpu_amdkfd_gpuvm_free_memory_of_gpu(dev->adev, (struct kgd_mem *)mem,
1198 					       pdd->drm_priv, NULL);
1199 err_unlock:
1200 err_pdd:
1201 err_large_bar:
1202 	mutex_unlock(&p->mutex);
1203 	return err;
1204 }
1205 
1206 static int kfd_ioctl_free_memory_of_gpu(struct file *filep,
1207 					struct kfd_process *p, void *data)
1208 {
1209 	struct kfd_ioctl_free_memory_of_gpu_args *args = data;
1210 	struct kfd_process_device *pdd;
1211 	void *mem;
1212 	int ret;
1213 	uint64_t size = 0;
1214 
1215 	mutex_lock(&p->mutex);
1216 	/*
1217 	 * Safeguard to prevent user space from freeing signal BO.
1218 	 * It will be freed at process termination.
1219 	 */
1220 	if (p->signal_handle && (p->signal_handle == args->handle)) {
1221 		pr_err("Free signal BO is not allowed\n");
1222 		ret = -EPERM;
1223 		goto err_unlock;
1224 	}
1225 
1226 	pdd = kfd_process_device_data_by_id(p, GET_GPU_ID(args->handle));
1227 	if (!pdd) {
1228 		pr_err("Process device data doesn't exist\n");
1229 		ret = -EINVAL;
1230 		goto err_pdd;
1231 	}
1232 
1233 	mem = kfd_process_device_translate_handle(
1234 		pdd, GET_IDR_HANDLE(args->handle));
1235 	if (!mem) {
1236 		ret = -EINVAL;
1237 		goto err_unlock;
1238 	}
1239 
1240 	ret = amdgpu_amdkfd_gpuvm_free_memory_of_gpu(pdd->dev->adev,
1241 				(struct kgd_mem *)mem, pdd->drm_priv, &size);
1242 
1243 	/* If freeing the buffer failed, leave the handle in place for
1244 	 * clean-up during process tear-down.
1245 	 */
1246 	if (!ret)
1247 		kfd_process_device_remove_obj_handle(
1248 			pdd, GET_IDR_HANDLE(args->handle));
1249 
1250 	atomic64_sub(size, &pdd->vram_usage);
1251 
1252 err_unlock:
1253 err_pdd:
1254 	mutex_unlock(&p->mutex);
1255 	return ret;
1256 }
1257 
1258 static int kfd_ioctl_map_memory_to_gpu(struct file *filep,
1259 					struct kfd_process *p, void *data)
1260 {
1261 	struct kfd_ioctl_map_memory_to_gpu_args *args = data;
1262 	struct kfd_process_device *pdd, *peer_pdd;
1263 	void *mem;
1264 	struct kfd_node *dev;
1265 	long err = 0;
1266 	int i;
1267 	uint32_t *devices_arr = NULL;
1268 
1269 	if (!args->n_devices) {
1270 		pr_debug("Device IDs array empty\n");
1271 		return -EINVAL;
1272 	}
1273 	if (args->n_success > args->n_devices) {
1274 		pr_debug("n_success exceeds n_devices\n");
1275 		return -EINVAL;
1276 	}
1277 
1278 	devices_arr = kmalloc_array(args->n_devices, sizeof(*devices_arr),
1279 				    GFP_KERNEL);
1280 	if (!devices_arr)
1281 		return -ENOMEM;
1282 
1283 	err = copy_from_user(devices_arr,
1284 			     (void __user *)args->device_ids_array_ptr,
1285 			     args->n_devices * sizeof(*devices_arr));
1286 	if (err != 0) {
1287 		err = -EFAULT;
1288 		goto copy_from_user_failed;
1289 	}
1290 
1291 	mutex_lock(&p->mutex);
1292 	pdd = kfd_process_device_data_by_id(p, GET_GPU_ID(args->handle));
1293 	if (!pdd) {
1294 		err = -EINVAL;
1295 		goto get_process_device_data_failed;
1296 	}
1297 	dev = pdd->dev;
1298 
1299 	pdd = kfd_bind_process_to_device(dev, p);
1300 	if (IS_ERR(pdd)) {
1301 		err = PTR_ERR(pdd);
1302 		goto bind_process_to_device_failed;
1303 	}
1304 
1305 	mem = kfd_process_device_translate_handle(pdd,
1306 						GET_IDR_HANDLE(args->handle));
1307 	if (!mem) {
1308 		err = -ENOMEM;
1309 		goto get_mem_obj_from_handle_failed;
1310 	}
1311 
1312 	for (i = args->n_success; i < args->n_devices; i++) {
1313 		peer_pdd = kfd_process_device_data_by_id(p, devices_arr[i]);
1314 		if (!peer_pdd) {
1315 			pr_debug("Getting device by id failed for 0x%x\n",
1316 				 devices_arr[i]);
1317 			err = -EINVAL;
1318 			goto get_mem_obj_from_handle_failed;
1319 		}
1320 
1321 		peer_pdd = kfd_bind_process_to_device(peer_pdd->dev, p);
1322 		if (IS_ERR(peer_pdd)) {
1323 			err = PTR_ERR(peer_pdd);
1324 			goto get_mem_obj_from_handle_failed;
1325 		}
1326 
1327 		err = amdgpu_amdkfd_gpuvm_map_memory_to_gpu(
1328 			peer_pdd->dev->adev, (struct kgd_mem *)mem,
1329 			peer_pdd->drm_priv);
1330 		if (err) {
1331 			struct pci_dev *pdev = peer_pdd->dev->adev->pdev;
1332 
1333 			dev_err(dev->adev->dev,
1334 			       "Failed to map peer:%04x:%02x:%02x.%d mem_domain:%d\n",
1335 			       pci_domain_nr(pdev->bus),
1336 			       pdev->bus->number,
1337 			       PCI_SLOT(pdev->devfn),
1338 			       PCI_FUNC(pdev->devfn),
1339 			       ((struct kgd_mem *)mem)->domain);
1340 			goto map_memory_to_gpu_failed;
1341 		}
1342 		args->n_success = i+1;
1343 	}
1344 
1345 	err = amdgpu_amdkfd_gpuvm_sync_memory(dev->adev, (struct kgd_mem *) mem, true);
1346 	if (err) {
1347 		pr_debug("Sync memory failed, wait interrupted by user signal\n");
1348 		goto sync_memory_failed;
1349 	}
1350 
1351 	mutex_unlock(&p->mutex);
1352 
1353 	/* Flush TLBs after waiting for the page table updates to complete */
1354 	for (i = 0; i < args->n_devices; i++) {
1355 		peer_pdd = kfd_process_device_data_by_id(p, devices_arr[i]);
1356 		if (WARN_ON_ONCE(!peer_pdd))
1357 			continue;
1358 		kfd_flush_tlb(peer_pdd);
1359 	}
1360 	kfree(devices_arr);
1361 
1362 	return err;
1363 
1364 get_process_device_data_failed:
1365 bind_process_to_device_failed:
1366 get_mem_obj_from_handle_failed:
1367 map_memory_to_gpu_failed:
1368 sync_memory_failed:
1369 	mutex_unlock(&p->mutex);
1370 copy_from_user_failed:
1371 	kfree(devices_arr);
1372 
1373 	return err;
1374 }
1375 
1376 static int kfd_ioctl_unmap_memory_from_gpu(struct file *filep,
1377 					struct kfd_process *p, void *data)
1378 {
1379 	struct kfd_ioctl_unmap_memory_from_gpu_args *args = data;
1380 	struct kfd_process_device *pdd, *peer_pdd;
1381 	void *mem;
1382 	long err = 0;
1383 	uint32_t *devices_arr = NULL, i;
1384 	bool flush_tlb;
1385 
1386 	if (!args->n_devices) {
1387 		pr_debug("Device IDs array empty\n");
1388 		return -EINVAL;
1389 	}
1390 	if (args->n_success > args->n_devices) {
1391 		pr_debug("n_success exceeds n_devices\n");
1392 		return -EINVAL;
1393 	}
1394 
1395 	devices_arr = kmalloc_array(args->n_devices, sizeof(*devices_arr),
1396 				    GFP_KERNEL);
1397 	if (!devices_arr)
1398 		return -ENOMEM;
1399 
1400 	err = copy_from_user(devices_arr,
1401 			     (void __user *)args->device_ids_array_ptr,
1402 			     args->n_devices * sizeof(*devices_arr));
1403 	if (err != 0) {
1404 		err = -EFAULT;
1405 		goto copy_from_user_failed;
1406 	}
1407 
1408 	mutex_lock(&p->mutex);
1409 	pdd = kfd_process_device_data_by_id(p, GET_GPU_ID(args->handle));
1410 	if (!pdd) {
1411 		err = -EINVAL;
1412 		goto bind_process_to_device_failed;
1413 	}
1414 
1415 	mem = kfd_process_device_translate_handle(pdd,
1416 						GET_IDR_HANDLE(args->handle));
1417 	if (!mem) {
1418 		err = -ENOMEM;
1419 		goto get_mem_obj_from_handle_failed;
1420 	}
1421 
1422 	for (i = args->n_success; i < args->n_devices; i++) {
1423 		peer_pdd = kfd_process_device_data_by_id(p, devices_arr[i]);
1424 		if (!peer_pdd) {
1425 			err = -EINVAL;
1426 			goto get_mem_obj_from_handle_failed;
1427 		}
1428 		err = amdgpu_amdkfd_gpuvm_unmap_memory_from_gpu(
1429 			peer_pdd->dev->adev, (struct kgd_mem *)mem, peer_pdd->drm_priv);
1430 		if (err) {
1431 			pr_debug("Failed to unmap from gpu %d/%d\n", i, args->n_devices);
1432 			goto unmap_memory_from_gpu_failed;
1433 		}
1434 		args->n_success = i+1;
1435 	}
1436 
1437 	flush_tlb = kfd_flush_tlb_after_unmap(pdd->dev->kfd);
1438 	if (flush_tlb) {
1439 		err = amdgpu_amdkfd_gpuvm_sync_memory(pdd->dev->adev,
1440 				(struct kgd_mem *) mem, true);
1441 		if (err) {
1442 			pr_debug("Sync memory failed, wait interrupted by user signal\n");
1443 			goto sync_memory_failed;
1444 		}
1445 	}
1446 
1447 	/* Flush TLBs after waiting for the page table updates to complete */
1448 	for (i = 0; i < args->n_devices; i++) {
1449 		peer_pdd = kfd_process_device_data_by_id(p, devices_arr[i]);
1450 		if (WARN_ON_ONCE(!peer_pdd))
1451 			continue;
1452 		if (flush_tlb)
1453 			kfd_flush_tlb(peer_pdd);
1454 
1455 		/* Remove dma mapping after tlb flush to avoid IO_PAGE_FAULT */
1456 		err = amdgpu_amdkfd_gpuvm_dmaunmap_mem(mem, peer_pdd->drm_priv);
1457 		if (err)
1458 			goto sync_memory_failed;
1459 	}
1460 
1461 	mutex_unlock(&p->mutex);
1462 
1463 	kfree(devices_arr);
1464 
1465 	return 0;
1466 
1467 bind_process_to_device_failed:
1468 get_mem_obj_from_handle_failed:
1469 unmap_memory_from_gpu_failed:
1470 sync_memory_failed:
1471 	mutex_unlock(&p->mutex);
1472 copy_from_user_failed:
1473 	kfree(devices_arr);
1474 	return err;
1475 }
1476 
1477 static int kfd_ioctl_alloc_queue_gws(struct file *filep,
1478 		struct kfd_process *p, void *data)
1479 {
1480 	int retval;
1481 	struct kfd_ioctl_alloc_queue_gws_args *args = data;
1482 	struct queue *q;
1483 	struct kfd_node *dev;
1484 
1485 	mutex_lock(&p->mutex);
1486 	q = pqm_get_user_queue(&p->pqm, args->queue_id);
1487 
1488 	if (q) {
1489 		dev = q->device;
1490 	} else {
1491 		retval = -EINVAL;
1492 		goto out_unlock;
1493 	}
1494 
1495 	if (!dev->gws) {
1496 		retval = -ENODEV;
1497 		goto out_unlock;
1498 	}
1499 
1500 	if (dev->dqm->sched_policy == KFD_SCHED_POLICY_NO_HWS) {
1501 		retval = -ENODEV;
1502 		goto out_unlock;
1503 	}
1504 
1505 	if (p->debug_trap_enabled && (!kfd_dbg_has_gws_support(dev) ||
1506 				      kfd_dbg_has_cwsr_workaround(dev))) {
1507 		retval = -EBUSY;
1508 		goto out_unlock;
1509 	}
1510 
1511 	retval = pqm_set_gws(&p->pqm, args->queue_id, args->num_gws ? dev->gws : NULL);
1512 	mutex_unlock(&p->mutex);
1513 
1514 	args->first_gws = 0;
1515 	return retval;
1516 
1517 out_unlock:
1518 	mutex_unlock(&p->mutex);
1519 	return retval;
1520 }
1521 
1522 static int kfd_ioctl_get_dmabuf_info(struct file *filep,
1523 		struct kfd_process *p, void *data)
1524 {
1525 	struct kfd_ioctl_get_dmabuf_info_args *args = data;
1526 	struct kfd_node *dev = NULL;
1527 	struct amdgpu_device *dmabuf_adev;
1528 	void *metadata_buffer = NULL;
1529 	uint32_t flags;
1530 	int8_t xcp_id;
1531 	unsigned int i;
1532 	int r;
1533 
1534 	/* Find a KFD GPU device that supports the get_dmabuf_info query */
1535 	for (i = 0; kfd_topology_enum_kfd_devices(i, &dev) == 0; i++)
1536 		if (dev && !kfd_devcgroup_check_permission(dev))
1537 			break;
1538 	if (!dev)
1539 		return -EINVAL;
1540 
1541 	if (args->metadata_ptr) {
1542 		metadata_buffer = kzalloc(args->metadata_size, GFP_KERNEL);
1543 		if (!metadata_buffer)
1544 			return -ENOMEM;
1545 	}
1546 
1547 	/* Get dmabuf info from KGD */
1548 	r = amdgpu_amdkfd_get_dmabuf_info(dev->adev, args->dmabuf_fd,
1549 					  &dmabuf_adev, &args->size,
1550 					  metadata_buffer, args->metadata_size,
1551 					  &args->metadata_size, &flags, &xcp_id);
1552 	if (r)
1553 		goto exit;
1554 
1555 	if (xcp_id >= 0)
1556 		args->gpu_id = dmabuf_adev->kfd.dev->nodes[xcp_id]->id;
1557 	else
1558 		args->gpu_id = dev->id;
1559 	args->flags = flags;
1560 
1561 	/* Copy metadata buffer to user mode */
1562 	if (metadata_buffer) {
1563 		r = copy_to_user((void __user *)args->metadata_ptr,
1564 				 metadata_buffer, args->metadata_size);
1565 		if (r != 0)
1566 			r = -EFAULT;
1567 	}
1568 
1569 exit:
1570 	kfree(metadata_buffer);
1571 
1572 	return r;
1573 }
1574 
1575 static int kfd_ioctl_import_dmabuf(struct file *filep,
1576 				   struct kfd_process *p, void *data)
1577 {
1578 	struct kfd_ioctl_import_dmabuf_args *args = data;
1579 	struct kfd_process_device *pdd;
1580 	int idr_handle;
1581 	uint64_t size;
1582 	void *mem;
1583 	int r;
1584 
1585 	mutex_lock(&p->mutex);
1586 	pdd = kfd_process_device_data_by_id(p, args->gpu_id);
1587 	if (!pdd) {
1588 		r = -EINVAL;
1589 		goto err_unlock;
1590 	}
1591 
1592 	pdd = kfd_bind_process_to_device(pdd->dev, p);
1593 	if (IS_ERR(pdd)) {
1594 		r = PTR_ERR(pdd);
1595 		goto err_unlock;
1596 	}
1597 
1598 	r = amdgpu_amdkfd_gpuvm_import_dmabuf_fd(pdd->dev->adev, args->dmabuf_fd,
1599 						 args->va_addr, pdd->drm_priv,
1600 						 (struct kgd_mem **)&mem, &size,
1601 						 NULL);
1602 	if (r)
1603 		goto err_unlock;
1604 
1605 	idr_handle = kfd_process_device_create_obj_handle(pdd, mem);
1606 	if (idr_handle < 0) {
1607 		r = -EFAULT;
1608 		goto err_free;
1609 	}
1610 
1611 	mutex_unlock(&p->mutex);
1612 
1613 	args->handle = MAKE_HANDLE(args->gpu_id, idr_handle);
1614 
1615 	return 0;
1616 
1617 err_free:
1618 	amdgpu_amdkfd_gpuvm_free_memory_of_gpu(pdd->dev->adev, (struct kgd_mem *)mem,
1619 					       pdd->drm_priv, NULL);
1620 err_unlock:
1621 	mutex_unlock(&p->mutex);
1622 	return r;
1623 }
1624 
1625 static int kfd_ioctl_export_dmabuf(struct file *filep,
1626 				   struct kfd_process *p, void *data)
1627 {
1628 	struct kfd_ioctl_export_dmabuf_args *args = data;
1629 	struct kfd_process_device *pdd;
1630 	struct dma_buf *dmabuf;
1631 	struct kfd_node *dev;
1632 	void *mem;
1633 	int ret = 0;
1634 
1635 	dev = kfd_device_by_id(GET_GPU_ID(args->handle));
1636 	if (!dev)
1637 		return -EINVAL;
1638 
1639 	mutex_lock(&p->mutex);
1640 
1641 	pdd = kfd_get_process_device_data(dev, p);
1642 	if (!pdd) {
1643 		ret = -EINVAL;
1644 		goto err_unlock;
1645 	}
1646 
1647 	mem = kfd_process_device_translate_handle(pdd,
1648 						GET_IDR_HANDLE(args->handle));
1649 	if (!mem) {
1650 		ret = -EINVAL;
1651 		goto err_unlock;
1652 	}
1653 
1654 	ret = amdgpu_amdkfd_gpuvm_export_dmabuf(mem, &dmabuf);
1655 	mutex_unlock(&p->mutex);
1656 	if (ret)
1657 		goto err_out;
1658 
1659 	ret = dma_buf_fd(dmabuf, args->flags);
1660 	if (ret < 0) {
1661 		dma_buf_put(dmabuf);
1662 		goto err_out;
1663 	}
1664 	/* dma_buf_fd assigns the reference count to the fd, no need to
1665 	 * put the reference here.
1666 	 */
1667 	args->dmabuf_fd = ret;
1668 
1669 	return 0;
1670 
1671 err_unlock:
1672 	mutex_unlock(&p->mutex);
1673 err_out:
1674 	return ret;
1675 }
1676 
1677 /* Handle requests for watching SMI events */
1678 static int kfd_ioctl_smi_events(struct file *filep,
1679 				struct kfd_process *p, void *data)
1680 {
1681 	struct kfd_ioctl_smi_events_args *args = data;
1682 	struct kfd_process_device *pdd;
1683 
1684 	mutex_lock(&p->mutex);
1685 
1686 	pdd = kfd_process_device_data_by_id(p, args->gpuid);
1687 	mutex_unlock(&p->mutex);
1688 	if (!pdd)
1689 		return -EINVAL;
1690 
1691 	return kfd_smi_event_open(pdd->dev, &args->anon_fd);
1692 }
1693 
1694 static int kfd_ioctl_svm_validate(void *kdata, unsigned int usize)
1695 {
1696 	struct kfd_ioctl_svm_args *args = kdata;
1697 	size_t expected = struct_size(args, attrs, args->nattr);
1698 
1699 	if (expected == SIZE_MAX || usize < expected)
1700 		return -EINVAL;
1701 	return 0;
1702 }
1703 
1704 #if IS_ENABLED(CONFIG_HSA_AMD_SVM)
1705 
1706 static int kfd_ioctl_set_xnack_mode(struct file *filep,
1707 				    struct kfd_process *p, void *data)
1708 {
1709 	struct kfd_ioctl_set_xnack_mode_args *args = data;
1710 	int r = 0;
1711 
1712 	mutex_lock(&p->mutex);
1713 	if (args->xnack_enabled >= 0) {
1714 		if (!list_empty(&p->pqm.queues)) {
1715 			pr_debug("Process has user queues running\n");
1716 			r = -EBUSY;
1717 			goto out_unlock;
1718 		}
1719 
1720 		if (p->xnack_enabled == args->xnack_enabled)
1721 			goto out_unlock;
1722 
1723 		if (args->xnack_enabled && !kfd_process_xnack_mode(p, true)) {
1724 			r = -EPERM;
1725 			goto out_unlock;
1726 		}
1727 
1728 		r = svm_range_switch_xnack_reserve_mem(p, args->xnack_enabled);
1729 	} else {
1730 		args->xnack_enabled = p->xnack_enabled;
1731 	}
1732 
1733 out_unlock:
1734 	mutex_unlock(&p->mutex);
1735 
1736 	return r;
1737 }
1738 
1739 static int kfd_ioctl_svm(struct file *filep, struct kfd_process *p, void *data)
1740 {
1741 	struct kfd_ioctl_svm_args *args = data;
1742 	int r = 0;
1743 
1744 	if (p->context_id != KFD_CONTEXT_ID_PRIMARY) {
1745 		pr_debug("SVM ioctl not supported on non-primary kfd process\n");
1746 
1747 		return -EOPNOTSUPP;
1748 	}
1749 
1750 	pr_debug("start 0x%llx size 0x%llx op 0x%x nattr 0x%x\n",
1751 		 args->start_addr, args->size, args->op, args->nattr);
1752 
1753 	if ((args->start_addr & ~PAGE_MASK) || (args->size & ~PAGE_MASK))
1754 		return -EINVAL;
1755 	if (!args->start_addr || !args->size)
1756 		return -EINVAL;
1757 
1758 	r = svm_ioctl(p, args->op, args->start_addr, args->size, args->nattr,
1759 		      args->attrs);
1760 
1761 	return r;
1762 }
1763 #else
1764 static int kfd_ioctl_set_xnack_mode(struct file *filep,
1765 				    struct kfd_process *p, void *data)
1766 {
1767 	return -EPERM;
1768 }
1769 static int kfd_ioctl_svm(struct file *filep, struct kfd_process *p, void *data)
1770 {
1771 	return -EPERM;
1772 }
1773 #endif
1774 
1775 static int criu_checkpoint_process(struct kfd_process *p,
1776 			     uint8_t __user *user_priv_data,
1777 			     uint64_t *priv_offset)
1778 {
1779 	struct kfd_criu_process_priv_data process_priv;
1780 	int ret;
1781 
1782 	memset(&process_priv, 0, sizeof(process_priv));
1783 
1784 	process_priv.version = KFD_CRIU_PRIV_VERSION;
1785 	/* For CR, we don't consider negative xnack mode which is used for
1786 	 * querying without changing it, here 0 simply means disabled and 1
1787 	 * means enabled so retry for finding a valid PTE.
1788 	 */
1789 	process_priv.xnack_mode = p->xnack_enabled ? 1 : 0;
1790 
1791 	ret = copy_to_user(user_priv_data + *priv_offset,
1792 				&process_priv, sizeof(process_priv));
1793 
1794 	if (ret) {
1795 		pr_err("Failed to copy process information to user\n");
1796 		ret = -EFAULT;
1797 	}
1798 
1799 	*priv_offset += sizeof(process_priv);
1800 	return ret;
1801 }
1802 
1803 static int criu_checkpoint_devices(struct kfd_process *p,
1804 			     uint32_t num_devices,
1805 			     uint8_t __user *user_addr,
1806 			     uint8_t __user *user_priv_data,
1807 			     uint64_t *priv_offset)
1808 {
1809 	struct kfd_criu_device_priv_data *device_priv = NULL;
1810 	struct kfd_criu_device_bucket *device_buckets = NULL;
1811 	int ret = 0, i;
1812 
1813 	device_buckets = kvzalloc(num_devices * sizeof(*device_buckets), GFP_KERNEL);
1814 	if (!device_buckets) {
1815 		ret = -ENOMEM;
1816 		goto exit;
1817 	}
1818 
1819 	device_priv = kvzalloc(num_devices * sizeof(*device_priv), GFP_KERNEL);
1820 	if (!device_priv) {
1821 		ret = -ENOMEM;
1822 		goto exit;
1823 	}
1824 
1825 	for (i = 0; i < num_devices; i++) {
1826 		struct kfd_process_device *pdd = p->pdds[i];
1827 
1828 		device_buckets[i].user_gpu_id = pdd->user_gpu_id;
1829 		device_buckets[i].actual_gpu_id = pdd->dev->id;
1830 
1831 		/*
1832 		 * priv_data does not contain useful information for now and is reserved for
1833 		 * future use, so we do not set its contents.
1834 		 */
1835 	}
1836 
1837 	ret = copy_to_user(user_addr, device_buckets, num_devices * sizeof(*device_buckets));
1838 	if (ret) {
1839 		pr_err("Failed to copy device information to user\n");
1840 		ret = -EFAULT;
1841 		goto exit;
1842 	}
1843 
1844 	ret = copy_to_user(user_priv_data + *priv_offset,
1845 			   device_priv,
1846 			   num_devices * sizeof(*device_priv));
1847 	if (ret) {
1848 		pr_err("Failed to copy device information to user\n");
1849 		ret = -EFAULT;
1850 	}
1851 	*priv_offset += num_devices * sizeof(*device_priv);
1852 
1853 exit:
1854 	kvfree(device_buckets);
1855 	kvfree(device_priv);
1856 	return ret;
1857 }
1858 
1859 static uint32_t get_process_num_bos(struct kfd_process *p)
1860 {
1861 	uint32_t num_of_bos = 0;
1862 	int i;
1863 
1864 	/* Run over all PDDs of the process */
1865 	for (i = 0; i < p->n_pdds; i++) {
1866 		struct kfd_process_device *pdd = p->pdds[i];
1867 		void *mem;
1868 		int id;
1869 
1870 		idr_for_each_entry(&pdd->alloc_idr, mem, id) {
1871 			struct kgd_mem *kgd_mem = (struct kgd_mem *)mem;
1872 
1873 			if (!kgd_mem->va || kgd_mem->va > pdd->gpuvm_base)
1874 				num_of_bos++;
1875 		}
1876 	}
1877 	return num_of_bos;
1878 }
1879 
1880 static int criu_get_prime_handle(struct kgd_mem *mem,
1881 				 int flags, u32 *shared_fd,
1882 				 struct file **file)
1883 {
1884 	struct dma_buf *dmabuf;
1885 	int ret;
1886 
1887 	ret = amdgpu_amdkfd_gpuvm_export_dmabuf(mem, &dmabuf);
1888 	if (ret) {
1889 		pr_err("dmabuf export failed for the BO\n");
1890 		return ret;
1891 	}
1892 
1893 	ret = get_unused_fd_flags(flags);
1894 	if (ret < 0) {
1895 		pr_err("dmabuf create fd failed, ret:%d\n", ret);
1896 		goto out_free_dmabuf;
1897 	}
1898 
1899 	*shared_fd = ret;
1900 	*file = dmabuf->file;
1901 	return 0;
1902 
1903 out_free_dmabuf:
1904 	dma_buf_put(dmabuf);
1905 	return ret;
1906 }
1907 
1908 static void commit_files(struct file **files,
1909 			 struct kfd_criu_bo_bucket *bo_buckets,
1910 			 unsigned int count,
1911 			 int err)
1912 {
1913 	while (count--) {
1914 		struct file *file = files[count];
1915 
1916 		if (!file)
1917 			continue;
1918 		if (err) {
1919 			fput(file);
1920 			put_unused_fd(bo_buckets[count].dmabuf_fd);
1921 		} else {
1922 			fd_install(bo_buckets[count].dmabuf_fd, file);
1923 		}
1924 	}
1925 }
1926 
1927 static int criu_checkpoint_bos(struct kfd_process *p,
1928 			       uint32_t num_bos,
1929 			       uint8_t __user *user_bos,
1930 			       uint8_t __user *user_priv_data,
1931 			       uint64_t *priv_offset)
1932 {
1933 	struct kfd_criu_bo_bucket *bo_buckets;
1934 	struct kfd_criu_bo_priv_data *bo_privs;
1935 	struct file **files = NULL;
1936 	int ret = 0, pdd_index, bo_index = 0, id;
1937 	void *mem;
1938 
1939 	bo_buckets = kvzalloc(num_bos * sizeof(*bo_buckets), GFP_KERNEL);
1940 	if (!bo_buckets)
1941 		return -ENOMEM;
1942 
1943 	bo_privs = kvzalloc(num_bos * sizeof(*bo_privs), GFP_KERNEL);
1944 	if (!bo_privs) {
1945 		ret = -ENOMEM;
1946 		goto exit;
1947 	}
1948 
1949 	files = kvzalloc(num_bos * sizeof(struct file *), GFP_KERNEL);
1950 	if (!files) {
1951 		ret = -ENOMEM;
1952 		goto exit;
1953 	}
1954 
1955 	for (pdd_index = 0; pdd_index < p->n_pdds; pdd_index++) {
1956 		struct kfd_process_device *pdd = p->pdds[pdd_index];
1957 		struct amdgpu_bo *dumper_bo;
1958 		struct kgd_mem *kgd_mem;
1959 
1960 		idr_for_each_entry(&pdd->alloc_idr, mem, id) {
1961 			struct kfd_criu_bo_bucket *bo_bucket;
1962 			struct kfd_criu_bo_priv_data *bo_priv;
1963 			int i, dev_idx = 0;
1964 
1965 			kgd_mem = (struct kgd_mem *)mem;
1966 			dumper_bo = kgd_mem->bo;
1967 
1968 			/* Skip checkpointing BOs that are used for Trap handler
1969 			 * code and state. Currently, these BOs have a VA that
1970 			 * is less GPUVM Base
1971 			 */
1972 			if (kgd_mem->va && kgd_mem->va <= pdd->gpuvm_base)
1973 				continue;
1974 
1975 			bo_bucket = &bo_buckets[bo_index];
1976 			bo_priv = &bo_privs[bo_index];
1977 
1978 			bo_bucket->gpu_id = pdd->user_gpu_id;
1979 			bo_bucket->addr = (uint64_t)kgd_mem->va;
1980 			bo_bucket->size = amdgpu_bo_size(dumper_bo);
1981 			bo_bucket->alloc_flags = (uint32_t)kgd_mem->alloc_flags;
1982 			bo_priv->idr_handle = id;
1983 
1984 			if (bo_bucket->alloc_flags & KFD_IOC_ALLOC_MEM_FLAGS_USERPTR) {
1985 				ret = amdgpu_ttm_tt_get_userptr(&dumper_bo->tbo,
1986 								&bo_priv->user_addr);
1987 				if (ret) {
1988 					pr_err("Failed to obtain user address for user-pointer bo\n");
1989 					goto exit;
1990 				}
1991 			}
1992 			if (bo_bucket->alloc_flags
1993 			    & (KFD_IOC_ALLOC_MEM_FLAGS_VRAM | KFD_IOC_ALLOC_MEM_FLAGS_GTT)) {
1994 				ret = criu_get_prime_handle(kgd_mem,
1995 						bo_bucket->alloc_flags &
1996 						KFD_IOC_ALLOC_MEM_FLAGS_WRITABLE ? DRM_RDWR : 0,
1997 						&bo_bucket->dmabuf_fd, &files[bo_index]);
1998 				if (ret)
1999 					goto exit;
2000 			} else {
2001 				bo_bucket->dmabuf_fd = KFD_INVALID_FD;
2002 			}
2003 
2004 			if (bo_bucket->alloc_flags & KFD_IOC_ALLOC_MEM_FLAGS_DOORBELL)
2005 				bo_bucket->offset = KFD_MMAP_TYPE_DOORBELL |
2006 					KFD_MMAP_GPU_ID(pdd->dev->id);
2007 			else if (bo_bucket->alloc_flags &
2008 				KFD_IOC_ALLOC_MEM_FLAGS_MMIO_REMAP)
2009 				bo_bucket->offset = KFD_MMAP_TYPE_MMIO |
2010 					KFD_MMAP_GPU_ID(pdd->dev->id);
2011 			else
2012 				bo_bucket->offset = amdgpu_bo_mmap_offset(dumper_bo);
2013 
2014 			for (i = 0; i < p->n_pdds; i++) {
2015 				if (amdgpu_amdkfd_bo_mapped_to_dev(p->pdds[i]->drm_priv, kgd_mem))
2016 					bo_priv->mapped_gpuids[dev_idx++] = p->pdds[i]->user_gpu_id;
2017 			}
2018 
2019 			pr_debug("bo_size = 0x%llx, bo_addr = 0x%llx bo_offset = 0x%llx\n"
2020 					"gpu_id = 0x%x alloc_flags = 0x%x idr_handle = 0x%x",
2021 					bo_bucket->size,
2022 					bo_bucket->addr,
2023 					bo_bucket->offset,
2024 					bo_bucket->gpu_id,
2025 					bo_bucket->alloc_flags,
2026 					bo_priv->idr_handle);
2027 			bo_index++;
2028 		}
2029 	}
2030 
2031 	ret = copy_to_user(user_bos, bo_buckets, num_bos * sizeof(*bo_buckets));
2032 	if (ret) {
2033 		pr_err("Failed to copy BO information to user\n");
2034 		ret = -EFAULT;
2035 		goto exit;
2036 	}
2037 
2038 	ret = copy_to_user(user_priv_data + *priv_offset, bo_privs, num_bos * sizeof(*bo_privs));
2039 	if (ret) {
2040 		pr_err("Failed to copy BO priv information to user\n");
2041 		ret = -EFAULT;
2042 		goto exit;
2043 	}
2044 
2045 	*priv_offset += num_bos * sizeof(*bo_privs);
2046 
2047 exit:
2048 	commit_files(files, bo_buckets, bo_index, ret);
2049 	kvfree(files);
2050 	kvfree(bo_buckets);
2051 	kvfree(bo_privs);
2052 	return ret;
2053 }
2054 
2055 static int criu_get_process_object_info(struct kfd_process *p,
2056 					uint32_t *num_devices,
2057 					uint32_t *num_bos,
2058 					uint32_t *num_objects,
2059 					uint64_t *objs_priv_size)
2060 {
2061 	uint64_t queues_priv_data_size, svm_priv_data_size, priv_size;
2062 	uint32_t num_queues, num_events, num_svm_ranges;
2063 	int ret;
2064 
2065 	*num_devices = p->n_pdds;
2066 	*num_bos = get_process_num_bos(p);
2067 
2068 	ret = kfd_process_get_queue_info(p, &num_queues, &queues_priv_data_size);
2069 	if (ret)
2070 		return ret;
2071 
2072 	num_events = kfd_get_num_events(p);
2073 
2074 	svm_range_get_info(p, &num_svm_ranges, &svm_priv_data_size);
2075 
2076 	*num_objects = num_queues + num_events + num_svm_ranges;
2077 
2078 	if (objs_priv_size) {
2079 		priv_size = sizeof(struct kfd_criu_process_priv_data);
2080 		priv_size += *num_devices * sizeof(struct kfd_criu_device_priv_data);
2081 		priv_size += *num_bos * sizeof(struct kfd_criu_bo_priv_data);
2082 		priv_size += queues_priv_data_size;
2083 		priv_size += num_events * sizeof(struct kfd_criu_event_priv_data);
2084 		priv_size += svm_priv_data_size;
2085 		*objs_priv_size = priv_size;
2086 	}
2087 	return 0;
2088 }
2089 
2090 static int criu_checkpoint(struct file *filep,
2091 			   struct kfd_process *p,
2092 			   struct kfd_ioctl_criu_args *args)
2093 {
2094 	int ret;
2095 	uint32_t num_devices, num_bos, num_objects;
2096 	uint64_t priv_size, priv_offset = 0, bo_priv_offset;
2097 
2098 	if (!args->devices || !args->bos || !args->priv_data)
2099 		return -EINVAL;
2100 
2101 	mutex_lock(&p->mutex);
2102 
2103 	if (!p->n_pdds) {
2104 		pr_err("No pdd for given process\n");
2105 		ret = -ENODEV;
2106 		goto exit_unlock;
2107 	}
2108 
2109 	/* Confirm all process queues are evicted */
2110 	if (!p->queues_paused) {
2111 		pr_err("Cannot dump process when queues are not in evicted state\n");
2112 		/* CRIU plugin did not call op PROCESS_INFO before checkpointing */
2113 		ret = -EINVAL;
2114 		goto exit_unlock;
2115 	}
2116 
2117 	ret = criu_get_process_object_info(p, &num_devices, &num_bos, &num_objects, &priv_size);
2118 	if (ret)
2119 		goto exit_unlock;
2120 
2121 	if (num_devices != args->num_devices ||
2122 	    num_bos != args->num_bos ||
2123 	    num_objects != args->num_objects ||
2124 	    priv_size != args->priv_data_size) {
2125 
2126 		ret = -EINVAL;
2127 		goto exit_unlock;
2128 	}
2129 
2130 	/* each function will store private data inside priv_data and adjust priv_offset */
2131 	ret = criu_checkpoint_process(p, (uint8_t __user *)args->priv_data, &priv_offset);
2132 	if (ret)
2133 		goto exit_unlock;
2134 
2135 	ret = criu_checkpoint_devices(p, num_devices, (uint8_t __user *)args->devices,
2136 				(uint8_t __user *)args->priv_data, &priv_offset);
2137 	if (ret)
2138 		goto exit_unlock;
2139 
2140 	/* Leave room for BOs in the private data. They need to be restored
2141 	 * before events, but we checkpoint them last to simplify the error
2142 	 * handling.
2143 	 */
2144 	bo_priv_offset = priv_offset;
2145 	priv_offset += num_bos * sizeof(struct kfd_criu_bo_priv_data);
2146 
2147 	if (num_objects) {
2148 		ret = kfd_criu_checkpoint_queues(p, (uint8_t __user *)args->priv_data,
2149 						 &priv_offset);
2150 		if (ret)
2151 			goto exit_unlock;
2152 
2153 		ret = kfd_criu_checkpoint_events(p, (uint8_t __user *)args->priv_data,
2154 						 &priv_offset);
2155 		if (ret)
2156 			goto exit_unlock;
2157 
2158 		ret = kfd_criu_checkpoint_svm(p, (uint8_t __user *)args->priv_data, &priv_offset);
2159 		if (ret)
2160 			goto exit_unlock;
2161 	}
2162 
2163 	/* This must be the last thing in this function that can fail.
2164 	 * Otherwise we leak dmabuf file descriptors.
2165 	 */
2166 	ret = criu_checkpoint_bos(p, num_bos, (uint8_t __user *)args->bos,
2167 			   (uint8_t __user *)args->priv_data, &bo_priv_offset);
2168 
2169 exit_unlock:
2170 	mutex_unlock(&p->mutex);
2171 	if (ret)
2172 		pr_err("Failed to dump CRIU ret:%d\n", ret);
2173 	else
2174 		pr_debug("CRIU dump ret:%d\n", ret);
2175 
2176 	return ret;
2177 }
2178 
2179 static int criu_restore_process(struct kfd_process *p,
2180 				struct kfd_ioctl_criu_args *args,
2181 				uint64_t *priv_offset,
2182 				uint64_t max_priv_data_size)
2183 {
2184 	int ret = 0;
2185 	struct kfd_criu_process_priv_data process_priv;
2186 
2187 	if (*priv_offset + sizeof(process_priv) > max_priv_data_size)
2188 		return -EINVAL;
2189 
2190 	ret = copy_from_user(&process_priv,
2191 				(void __user *)(args->priv_data + *priv_offset),
2192 				sizeof(process_priv));
2193 	if (ret) {
2194 		pr_err("Failed to copy process private information from user\n");
2195 		ret = -EFAULT;
2196 		goto exit;
2197 	}
2198 	*priv_offset += sizeof(process_priv);
2199 
2200 	if (process_priv.version != KFD_CRIU_PRIV_VERSION) {
2201 		pr_err("Invalid CRIU API version (checkpointed:%d current:%d)\n",
2202 			process_priv.version, KFD_CRIU_PRIV_VERSION);
2203 		return -EINVAL;
2204 	}
2205 
2206 	pr_debug("Setting XNACK mode\n");
2207 	if (process_priv.xnack_mode && !kfd_process_xnack_mode(p, true)) {
2208 		pr_err("xnack mode cannot be set\n");
2209 		ret = -EPERM;
2210 		goto exit;
2211 	} else {
2212 		pr_debug("set xnack mode: %d\n", process_priv.xnack_mode);
2213 		p->xnack_enabled = process_priv.xnack_mode;
2214 	}
2215 
2216 exit:
2217 	return ret;
2218 }
2219 
2220 static int criu_restore_devices(struct kfd_process *p,
2221 				struct kfd_ioctl_criu_args *args,
2222 				uint64_t *priv_offset,
2223 				uint64_t max_priv_data_size)
2224 {
2225 	struct kfd_criu_device_bucket *device_buckets;
2226 	struct kfd_criu_device_priv_data *device_privs;
2227 	int ret = 0;
2228 	uint32_t i;
2229 
2230 	if (args->num_devices != p->n_pdds)
2231 		return -EINVAL;
2232 
2233 	if (*priv_offset + (args->num_devices * sizeof(*device_privs)) > max_priv_data_size)
2234 		return -EINVAL;
2235 
2236 	device_buckets = kmalloc_objs(*device_buckets, args->num_devices);
2237 	if (!device_buckets)
2238 		return -ENOMEM;
2239 
2240 	ret = copy_from_user(device_buckets, (void __user *)args->devices,
2241 				args->num_devices * sizeof(*device_buckets));
2242 	if (ret) {
2243 		pr_err("Failed to copy devices buckets from user\n");
2244 		ret = -EFAULT;
2245 		goto exit;
2246 	}
2247 
2248 	for (i = 0; i < args->num_devices; i++) {
2249 		struct kfd_node *dev;
2250 		struct kfd_process_device *pdd;
2251 		struct file *drm_file;
2252 
2253 		/* device private data is not currently used */
2254 
2255 		if (!device_buckets[i].user_gpu_id) {
2256 			pr_err("Invalid user gpu_id\n");
2257 			ret = -EINVAL;
2258 			goto exit;
2259 		}
2260 
2261 		dev = kfd_device_by_id(device_buckets[i].actual_gpu_id);
2262 		if (!dev) {
2263 			pr_err("Failed to find device with gpu_id = %x\n",
2264 				device_buckets[i].actual_gpu_id);
2265 			ret = -EINVAL;
2266 			goto exit;
2267 		}
2268 
2269 		pdd = kfd_get_process_device_data(dev, p);
2270 		if (!pdd) {
2271 			pr_err("Failed to get pdd for gpu_id = %x\n",
2272 					device_buckets[i].actual_gpu_id);
2273 			ret = -EINVAL;
2274 			goto exit;
2275 		}
2276 		pdd->user_gpu_id = device_buckets[i].user_gpu_id;
2277 
2278 		drm_file = fget(device_buckets[i].drm_fd);
2279 		if (!drm_file) {
2280 			pr_err("Invalid render node file descriptor sent from plugin (%d)\n",
2281 				device_buckets[i].drm_fd);
2282 			ret = -EINVAL;
2283 			goto exit;
2284 		}
2285 
2286 		if (pdd->drm_file) {
2287 			ret = -EINVAL;
2288 			goto exit;
2289 		}
2290 
2291 		/* create the vm using render nodes for kfd pdd */
2292 		if (kfd_process_device_init_vm(pdd, drm_file)) {
2293 			pr_err("could not init vm for given pdd\n");
2294 			/* On success, the PDD keeps the drm_file reference */
2295 			fput(drm_file);
2296 			ret = -EINVAL;
2297 			goto exit;
2298 		}
2299 		/*
2300 		 * pdd now already has the vm bound to render node so below api won't create a new
2301 		 * exclusive kfd mapping but use existing one with renderDXXX but is still needed
2302 		 * for iommu v2 binding  and runtime pm.
2303 		 */
2304 		pdd = kfd_bind_process_to_device(dev, p);
2305 		if (IS_ERR(pdd)) {
2306 			ret = PTR_ERR(pdd);
2307 			goto exit;
2308 		}
2309 
2310 		if (!pdd->qpd.proc_doorbells) {
2311 			ret = kfd_alloc_process_doorbells(dev->kfd, pdd);
2312 			if (ret)
2313 				goto exit;
2314 		}
2315 	}
2316 
2317 	/*
2318 	 * We are not copying device private data from user as we are not using the data for now,
2319 	 * but we still adjust for its private data.
2320 	 */
2321 	*priv_offset += args->num_devices * sizeof(*device_privs);
2322 
2323 exit:
2324 	kfree(device_buckets);
2325 	return ret;
2326 }
2327 
2328 static int criu_restore_memory_of_gpu(struct kfd_process_device *pdd,
2329 				      struct kfd_criu_bo_bucket *bo_bucket,
2330 				      struct kfd_criu_bo_priv_data *bo_priv,
2331 				      struct kgd_mem **kgd_mem)
2332 {
2333 	int idr_handle;
2334 	int ret;
2335 	const bool criu_resume = true;
2336 	u64 offset;
2337 
2338 	if (bo_priv->idr_handle > INT_MAX)
2339 		return -EINVAL;
2340 
2341 	if (bo_bucket->alloc_flags & KFD_IOC_ALLOC_MEM_FLAGS_DOORBELL) {
2342 		if (bo_bucket->size !=
2343 				kfd_doorbell_process_slice(pdd->dev->kfd))
2344 			return -EINVAL;
2345 
2346 		offset = kfd_get_process_doorbells(pdd);
2347 		if (!offset)
2348 			return -ENOMEM;
2349 	} else if (bo_bucket->alloc_flags & KFD_IOC_ALLOC_MEM_FLAGS_MMIO_REMAP) {
2350 		/* MMIO BOs need remapped bus address */
2351 		if (bo_bucket->size != PAGE_SIZE) {
2352 			pr_err("Invalid page size\n");
2353 			return -EINVAL;
2354 		}
2355 		offset = pdd->dev->adev->rmmio_remap.bus_addr;
2356 		if (!offset || (PAGE_SIZE > 4096)) {
2357 			pr_err("amdgpu_amdkfd_get_mmio_remap_phys_addr failed\n");
2358 			return -ENOMEM;
2359 		}
2360 	} else if (bo_bucket->alloc_flags & KFD_IOC_ALLOC_MEM_FLAGS_USERPTR) {
2361 		offset = bo_priv->user_addr;
2362 	}
2363 	/* Create the BO */
2364 	ret = amdgpu_amdkfd_gpuvm_alloc_memory_of_gpu(pdd->dev->adev, bo_bucket->addr,
2365 						      bo_bucket->size, pdd->drm_priv, kgd_mem,
2366 						      &offset, bo_bucket->alloc_flags, criu_resume);
2367 	if (ret) {
2368 		pr_err("Could not create the BO\n");
2369 		return ret;
2370 	}
2371 	pr_debug("New BO created: size:0x%llx addr:0x%llx offset:0x%llx\n",
2372 		 bo_bucket->size, bo_bucket->addr, offset);
2373 
2374 	/* Restore previous IDR handle */
2375 	pr_debug("Restoring old IDR handle for the BO");
2376 	idr_handle = idr_alloc(&pdd->alloc_idr, *kgd_mem, bo_priv->idr_handle,
2377 			       bo_priv->idr_handle + 1, GFP_KERNEL);
2378 
2379 	if (idr_handle < 0) {
2380 		pr_err("Could not allocate idr\n");
2381 		amdgpu_amdkfd_gpuvm_free_memory_of_gpu(pdd->dev->adev, *kgd_mem, pdd->drm_priv,
2382 						       NULL);
2383 		return -ENOMEM;
2384 	}
2385 
2386 	if (bo_bucket->alloc_flags & KFD_IOC_ALLOC_MEM_FLAGS_DOORBELL)
2387 		bo_bucket->restored_offset = KFD_MMAP_TYPE_DOORBELL | KFD_MMAP_GPU_ID(pdd->dev->id);
2388 	if (bo_bucket->alloc_flags & KFD_IOC_ALLOC_MEM_FLAGS_MMIO_REMAP) {
2389 		bo_bucket->restored_offset = KFD_MMAP_TYPE_MMIO | KFD_MMAP_GPU_ID(pdd->dev->id);
2390 	} else if (bo_bucket->alloc_flags & KFD_IOC_ALLOC_MEM_FLAGS_GTT) {
2391 		bo_bucket->restored_offset = offset;
2392 	} else if (bo_bucket->alloc_flags & KFD_IOC_ALLOC_MEM_FLAGS_VRAM) {
2393 		bo_bucket->restored_offset = offset;
2394 		/* Update the VRAM usage count */
2395 		atomic64_add(bo_bucket->size, &pdd->vram_usage);
2396 	}
2397 	return 0;
2398 }
2399 
2400 static int criu_restore_bo(struct kfd_process *p,
2401 			   struct kfd_criu_bo_bucket *bo_bucket,
2402 			   struct kfd_criu_bo_priv_data *bo_priv,
2403 			   struct file **file)
2404 {
2405 	struct kfd_process_device *pdd;
2406 	struct kgd_mem *kgd_mem;
2407 	int ret;
2408 	int j;
2409 
2410 	pr_debug("Restoring BO size:0x%llx addr:0x%llx gpu_id:0x%x flags:0x%x idr_handle:0x%x\n",
2411 		 bo_bucket->size, bo_bucket->addr, bo_bucket->gpu_id, bo_bucket->alloc_flags,
2412 		 bo_priv->idr_handle);
2413 
2414 	pdd = kfd_process_device_data_by_id(p, bo_bucket->gpu_id);
2415 	if (!pdd) {
2416 		pr_err("Failed to get pdd\n");
2417 		return -ENODEV;
2418 	}
2419 
2420 	ret = criu_restore_memory_of_gpu(pdd, bo_bucket, bo_priv, &kgd_mem);
2421 	if (ret)
2422 		return ret;
2423 
2424 	/* now map these BOs to GPU/s */
2425 	for (j = 0; j < p->n_pdds; j++) {
2426 		struct kfd_node *peer;
2427 		struct kfd_process_device *peer_pdd;
2428 
2429 		if (!bo_priv->mapped_gpuids[j])
2430 			break;
2431 
2432 		peer_pdd = kfd_process_device_data_by_id(p, bo_priv->mapped_gpuids[j]);
2433 		if (!peer_pdd)
2434 			return -EINVAL;
2435 
2436 		peer = peer_pdd->dev;
2437 
2438 		peer_pdd = kfd_bind_process_to_device(peer, p);
2439 		if (IS_ERR(peer_pdd))
2440 			return PTR_ERR(peer_pdd);
2441 
2442 		ret = amdgpu_amdkfd_gpuvm_map_memory_to_gpu(peer->adev, kgd_mem,
2443 							    peer_pdd->drm_priv);
2444 		if (ret) {
2445 			pr_err("Failed to map to gpu %d/%d\n", j, p->n_pdds);
2446 			return ret;
2447 		}
2448 	}
2449 
2450 	pr_debug("map memory was successful for the BO\n");
2451 	/* create the dmabuf object and export the bo */
2452 	if (bo_bucket->alloc_flags
2453 	    & (KFD_IOC_ALLOC_MEM_FLAGS_VRAM | KFD_IOC_ALLOC_MEM_FLAGS_GTT)) {
2454 		ret = criu_get_prime_handle(kgd_mem, DRM_RDWR,
2455 					    &bo_bucket->dmabuf_fd, file);
2456 		if (ret)
2457 			return ret;
2458 	} else {
2459 		bo_bucket->dmabuf_fd = KFD_INVALID_FD;
2460 	}
2461 
2462 	return 0;
2463 }
2464 
2465 static int criu_restore_bos(struct kfd_process *p,
2466 			    struct kfd_ioctl_criu_args *args,
2467 			    uint64_t *priv_offset,
2468 			    uint64_t max_priv_data_size)
2469 {
2470 	struct kfd_criu_bo_bucket *bo_buckets = NULL;
2471 	struct kfd_criu_bo_priv_data *bo_privs = NULL;
2472 	struct file **files = NULL;
2473 	int ret = 0;
2474 	uint32_t i = 0;
2475 
2476 	if (*priv_offset + (args->num_bos * sizeof(*bo_privs)) > max_priv_data_size)
2477 		return -EINVAL;
2478 
2479 	/* Prevent MMU notifications until stage-4 IOCTL (CRIU_RESUME) is received */
2480 	amdgpu_amdkfd_block_mmu_notifications(p->kgd_process_info);
2481 
2482 	bo_buckets = kvmalloc_objs(*bo_buckets, args->num_bos);
2483 	if (!bo_buckets)
2484 		return -ENOMEM;
2485 
2486 	files = kvzalloc(args->num_bos * sizeof(struct file *), GFP_KERNEL);
2487 	if (!files) {
2488 		ret = -ENOMEM;
2489 		goto exit;
2490 	}
2491 
2492 	ret = copy_from_user(bo_buckets, (void __user *)args->bos,
2493 			     args->num_bos * sizeof(*bo_buckets));
2494 	if (ret) {
2495 		pr_err("Failed to copy BOs information from user\n");
2496 		ret = -EFAULT;
2497 		goto exit;
2498 	}
2499 
2500 	bo_privs = kvmalloc_objs(*bo_privs, args->num_bos);
2501 	if (!bo_privs) {
2502 		ret = -ENOMEM;
2503 		goto exit;
2504 	}
2505 
2506 	ret = copy_from_user(bo_privs, (void __user *)args->priv_data + *priv_offset,
2507 			     args->num_bos * sizeof(*bo_privs));
2508 	if (ret) {
2509 		pr_err("Failed to copy BOs information from user\n");
2510 		ret = -EFAULT;
2511 		goto exit;
2512 	}
2513 	*priv_offset += args->num_bos * sizeof(*bo_privs);
2514 
2515 	/* Create and map new BOs */
2516 	for (; i < args->num_bos; i++) {
2517 		ret = criu_restore_bo(p, &bo_buckets[i], &bo_privs[i], &files[i]);
2518 		if (ret) {
2519 			pr_debug("Failed to restore BO[%d] ret%d\n", i, ret);
2520 			goto exit;
2521 		}
2522 	} /* done */
2523 
2524 	/* Copy only the buckets back so user can read bo_buckets[N].restored_offset */
2525 	ret = copy_to_user((void __user *)args->bos,
2526 				bo_buckets,
2527 				(args->num_bos * sizeof(*bo_buckets)));
2528 	if (ret)
2529 		ret = -EFAULT;
2530 
2531 exit:
2532 	commit_files(files, bo_buckets, i, ret);
2533 	kvfree(files);
2534 	kvfree(bo_buckets);
2535 	kvfree(bo_privs);
2536 	return ret;
2537 }
2538 
2539 static int criu_restore_objects(struct file *filep,
2540 				struct kfd_process *p,
2541 				struct kfd_ioctl_criu_args *args,
2542 				uint64_t *priv_offset,
2543 				uint64_t max_priv_data_size)
2544 {
2545 	int ret = 0;
2546 	uint32_t i;
2547 
2548 	BUILD_BUG_ON(offsetof(struct kfd_criu_queue_priv_data, object_type));
2549 	BUILD_BUG_ON(offsetof(struct kfd_criu_event_priv_data, object_type));
2550 	BUILD_BUG_ON(offsetof(struct kfd_criu_svm_range_priv_data, object_type));
2551 
2552 	for (i = 0; i < args->num_objects; i++) {
2553 		uint32_t object_type;
2554 
2555 		if (*priv_offset + sizeof(object_type) > max_priv_data_size) {
2556 			pr_err("Invalid private data size\n");
2557 			return -EINVAL;
2558 		}
2559 
2560 		ret = get_user(object_type, (uint32_t __user *)(args->priv_data + *priv_offset));
2561 		if (ret) {
2562 			pr_err("Failed to copy private information from user\n");
2563 			goto exit;
2564 		}
2565 
2566 		switch (object_type) {
2567 		case KFD_CRIU_OBJECT_TYPE_QUEUE:
2568 			ret = kfd_criu_restore_queue(p, (uint8_t __user *)args->priv_data,
2569 						     priv_offset, max_priv_data_size);
2570 			if (ret)
2571 				goto exit;
2572 			break;
2573 		case KFD_CRIU_OBJECT_TYPE_EVENT:
2574 			ret = kfd_criu_restore_event(filep, p, (uint8_t __user *)args->priv_data,
2575 						     priv_offset, max_priv_data_size);
2576 			if (ret)
2577 				goto exit;
2578 			break;
2579 		case KFD_CRIU_OBJECT_TYPE_SVM_RANGE:
2580 			ret = kfd_criu_restore_svm(p, (uint8_t __user *)args->priv_data,
2581 						     priv_offset, max_priv_data_size);
2582 			if (ret)
2583 				goto exit;
2584 			break;
2585 		default:
2586 			pr_err("Invalid object type:%u at index:%d\n", object_type, i);
2587 			ret = -EINVAL;
2588 			goto exit;
2589 		}
2590 	}
2591 exit:
2592 	return ret;
2593 }
2594 
2595 static int criu_restore(struct file *filep,
2596 			struct kfd_process *p,
2597 			struct kfd_ioctl_criu_args *args)
2598 {
2599 	uint64_t priv_offset = 0;
2600 	int ret = 0;
2601 
2602 	pr_debug("CRIU restore (num_devices:%u num_bos:%u num_objects:%u priv_data_size:%llu)\n",
2603 		 args->num_devices, args->num_bos, args->num_objects, args->priv_data_size);
2604 
2605 	if ((args->num_bos > 0 && !args->bos) || !args->devices || !args->priv_data ||
2606 	    !args->priv_data_size || !args->num_devices)
2607 		return -EINVAL;
2608 
2609 	mutex_lock(&p->mutex);
2610 
2611 	/*
2612 	 * Set the process to evicted state to avoid running any new queues before all the memory
2613 	 * mappings are ready.
2614 	 */
2615 	ret = kfd_process_evict_queues(p, KFD_QUEUE_EVICTION_CRIU_RESTORE);
2616 	if (ret)
2617 		goto exit_unlock;
2618 
2619 	/* Each function will adjust priv_offset based on how many bytes they consumed */
2620 	ret = criu_restore_process(p, args, &priv_offset, args->priv_data_size);
2621 	if (ret)
2622 		goto exit_unlock;
2623 
2624 	ret = criu_restore_devices(p, args, &priv_offset, args->priv_data_size);
2625 	if (ret)
2626 		goto exit_unlock;
2627 
2628 	ret = criu_restore_bos(p, args, &priv_offset, args->priv_data_size);
2629 	if (ret)
2630 		goto exit_unlock;
2631 
2632 	ret = criu_restore_objects(filep, p, args, &priv_offset, args->priv_data_size);
2633 	if (ret)
2634 		goto exit_unlock;
2635 
2636 	if (priv_offset != args->priv_data_size) {
2637 		pr_err("Invalid private data size\n");
2638 		ret = -EINVAL;
2639 	}
2640 
2641 exit_unlock:
2642 	mutex_unlock(&p->mutex);
2643 	if (ret)
2644 		pr_err("Failed to restore CRIU ret:%d\n", ret);
2645 	else
2646 		pr_debug("CRIU restore successful\n");
2647 
2648 	return ret;
2649 }
2650 
2651 static int criu_unpause(struct file *filep,
2652 			struct kfd_process *p,
2653 			struct kfd_ioctl_criu_args *args)
2654 {
2655 	int ret;
2656 
2657 	mutex_lock(&p->mutex);
2658 
2659 	if (!p->queues_paused) {
2660 		mutex_unlock(&p->mutex);
2661 		return -EINVAL;
2662 	}
2663 
2664 	ret = kfd_process_restore_queues(p);
2665 	if (ret)
2666 		pr_err("Failed to unpause queues ret:%d\n", ret);
2667 	else
2668 		p->queues_paused = false;
2669 
2670 	mutex_unlock(&p->mutex);
2671 
2672 	return ret;
2673 }
2674 
2675 static int criu_resume(struct file *filep,
2676 			struct kfd_process *p,
2677 			struct kfd_ioctl_criu_args *args)
2678 {
2679 	struct kfd_process *target = NULL;
2680 	struct pid *pid = NULL;
2681 	int ret = 0;
2682 
2683 	pr_debug("Inside %s, target pid for criu restore: %d\n", __func__,
2684 		 args->pid);
2685 
2686 	pid = find_get_pid(args->pid);
2687 	if (!pid) {
2688 		pr_err("Cannot find pid info for %i\n", args->pid);
2689 		return -ESRCH;
2690 	}
2691 
2692 	pr_debug("calling kfd_lookup_process_by_pid\n");
2693 	target = kfd_lookup_process_by_pid(pid);
2694 
2695 	put_pid(pid);
2696 
2697 	if (!target) {
2698 		pr_debug("Cannot find process info for %i\n", args->pid);
2699 		return -ESRCH;
2700 	}
2701 
2702 	mutex_lock(&target->mutex);
2703 	ret = kfd_criu_resume_svm(target);
2704 	if (ret) {
2705 		pr_err("kfd_criu_resume_svm failed for %i\n", args->pid);
2706 		goto exit;
2707 	}
2708 
2709 	ret =  amdgpu_amdkfd_criu_resume(target->kgd_process_info);
2710 	if (ret)
2711 		pr_err("amdgpu_amdkfd_criu_resume failed for %i\n", args->pid);
2712 
2713 exit:
2714 	mutex_unlock(&target->mutex);
2715 
2716 	kfd_unref_process(target);
2717 	return ret;
2718 }
2719 
2720 static int criu_process_info(struct file *filep,
2721 				struct kfd_process *p,
2722 				struct kfd_ioctl_criu_args *args)
2723 {
2724 	int ret = 0;
2725 
2726 	mutex_lock(&p->mutex);
2727 
2728 	if (!p->n_pdds) {
2729 		pr_err("No pdd for given process\n");
2730 		ret = -ENODEV;
2731 		goto err_unlock;
2732 	}
2733 
2734 	ret = kfd_process_evict_queues(p, KFD_QUEUE_EVICTION_CRIU_CHECKPOINT);
2735 	if (ret)
2736 		goto err_unlock;
2737 
2738 	p->queues_paused = true;
2739 
2740 	args->pid = task_pid_nr_ns(p->lead_thread,
2741 					task_active_pid_ns(p->lead_thread));
2742 
2743 	ret = criu_get_process_object_info(p, &args->num_devices, &args->num_bos,
2744 					   &args->num_objects, &args->priv_data_size);
2745 	if (ret)
2746 		goto err_unlock;
2747 
2748 	dev_dbg(kfd_device, "Num of devices:%u bos:%u objects:%u priv_data_size:%lld\n",
2749 				args->num_devices, args->num_bos, args->num_objects,
2750 				args->priv_data_size);
2751 
2752 err_unlock:
2753 	if (ret) {
2754 		kfd_process_restore_queues(p);
2755 		p->queues_paused = false;
2756 	}
2757 	mutex_unlock(&p->mutex);
2758 	return ret;
2759 }
2760 
2761 static int kfd_ioctl_criu(struct file *filep, struct kfd_process *p, void *data)
2762 {
2763 	struct kfd_ioctl_criu_args *args = data;
2764 	int ret;
2765 
2766 	dev_dbg(kfd_device, "CRIU operation: %d\n", args->op);
2767 	switch (args->op) {
2768 	case KFD_CRIU_OP_PROCESS_INFO:
2769 		ret = criu_process_info(filep, p, args);
2770 		break;
2771 	case KFD_CRIU_OP_CHECKPOINT:
2772 		ret = criu_checkpoint(filep, p, args);
2773 		break;
2774 	case KFD_CRIU_OP_UNPAUSE:
2775 		ret = criu_unpause(filep, p, args);
2776 		break;
2777 	case KFD_CRIU_OP_RESTORE:
2778 		ret = criu_restore(filep, p, args);
2779 		break;
2780 	case KFD_CRIU_OP_RESUME:
2781 		ret = criu_resume(filep, p, args);
2782 		break;
2783 	default:
2784 		dev_dbg(kfd_device, "Unsupported CRIU operation:%d\n", args->op);
2785 		ret = -EINVAL;
2786 		break;
2787 	}
2788 
2789 	if (ret)
2790 		dev_dbg(kfd_device, "CRIU operation:%d err:%d\n", args->op, ret);
2791 
2792 	return ret;
2793 }
2794 
2795 static int runtime_enable(struct kfd_process *p, uint64_t r_debug,
2796 			bool enable_ttmp_setup)
2797 {
2798 	int i = 0, ret = 0;
2799 
2800 	if (p->is_runtime_retry)
2801 		goto retry;
2802 
2803 	if (p->runtime_info.runtime_state != DEBUG_RUNTIME_STATE_DISABLED)
2804 		return -EBUSY;
2805 
2806 	for (i = 0; i < p->n_pdds; i++) {
2807 		struct kfd_process_device *pdd = p->pdds[i];
2808 
2809 		if (pdd->qpd.queue_count)
2810 			return -EEXIST;
2811 
2812 		/*
2813 		 * Setup TTMPs by default.
2814 		 * Note that this call must remain here for MES ADD QUEUE to
2815 		 * skip_process_ctx_clear unconditionally as the first call to
2816 		 * SET_SHADER_DEBUGGER clears any stale process context data
2817 		 * saved in MES.
2818 		 */
2819 		if (pdd->dev->kfd->shared_resources.enable_mes) {
2820 			ret = kfd_dbg_set_mes_debug_mode(
2821 				pdd, !kfd_dbg_has_cwsr_workaround(pdd->dev));
2822 			if (ret)
2823 				return ret;
2824 		}
2825 	}
2826 
2827 	p->runtime_info.runtime_state = DEBUG_RUNTIME_STATE_ENABLED;
2828 	p->runtime_info.r_debug = r_debug;
2829 	p->runtime_info.ttmp_setup = enable_ttmp_setup;
2830 
2831 	if (p->runtime_info.ttmp_setup) {
2832 		for (i = 0; i < p->n_pdds; i++) {
2833 			struct kfd_process_device *pdd = p->pdds[i];
2834 
2835 			if (!kfd_dbg_is_rlc_restore_supported(pdd->dev)) {
2836 				amdgpu_gfx_off_ctrl(pdd->dev->adev, false);
2837 				pdd->dev->kfd2kgd->enable_debug_trap(
2838 						pdd->dev->adev,
2839 						true,
2840 						pdd->dev->vm_info.last_vmid_kfd);
2841 			} else if (kfd_dbg_is_per_vmid_supported(pdd->dev)) {
2842 				pdd->spi_dbg_override = pdd->dev->kfd2kgd->enable_debug_trap(
2843 						pdd->dev->adev,
2844 						false,
2845 						0);
2846 			}
2847 		}
2848 	}
2849 
2850 retry:
2851 	if (p->debug_trap_enabled) {
2852 		if (!p->is_runtime_retry) {
2853 			kfd_dbg_trap_activate(p);
2854 			kfd_dbg_ev_raise(KFD_EC_MASK(EC_PROCESS_RUNTIME),
2855 					p, NULL, 0, false, NULL, 0);
2856 		}
2857 
2858 		mutex_unlock(&p->mutex);
2859 		ret = down_interruptible(&p->runtime_enable_sema);
2860 		mutex_lock(&p->mutex);
2861 
2862 		p->is_runtime_retry = !!ret;
2863 	}
2864 
2865 	return ret;
2866 }
2867 
2868 static int runtime_disable(struct kfd_process *p)
2869 {
2870 	int i = 0, ret = 0;
2871 	bool was_enabled = p->runtime_info.runtime_state == DEBUG_RUNTIME_STATE_ENABLED;
2872 
2873 	p->runtime_info.runtime_state = DEBUG_RUNTIME_STATE_DISABLED;
2874 	p->runtime_info.r_debug = 0;
2875 
2876 	if (p->debug_trap_enabled) {
2877 		if (was_enabled)
2878 			kfd_dbg_trap_deactivate(p, false, 0);
2879 
2880 		if (!p->is_runtime_retry)
2881 			kfd_dbg_ev_raise(KFD_EC_MASK(EC_PROCESS_RUNTIME),
2882 					p, NULL, 0, false, NULL, 0);
2883 
2884 		mutex_unlock(&p->mutex);
2885 		ret = down_interruptible(&p->runtime_enable_sema);
2886 		mutex_lock(&p->mutex);
2887 
2888 		p->is_runtime_retry = !!ret;
2889 		if (ret)
2890 			return ret;
2891 	}
2892 
2893 	if (was_enabled && p->runtime_info.ttmp_setup) {
2894 		for (i = 0; i < p->n_pdds; i++) {
2895 			struct kfd_process_device *pdd = p->pdds[i];
2896 
2897 			if (!kfd_dbg_is_rlc_restore_supported(pdd->dev))
2898 				amdgpu_gfx_off_ctrl(pdd->dev->adev, true);
2899 		}
2900 	}
2901 
2902 	p->runtime_info.ttmp_setup = false;
2903 
2904 	/* disable ttmp setup */
2905 	for (i = 0; i < p->n_pdds; i++) {
2906 		struct kfd_process_device *pdd = p->pdds[i];
2907 		int last_err = 0;
2908 
2909 		if (kfd_dbg_is_per_vmid_supported(pdd->dev)) {
2910 			pdd->spi_dbg_override =
2911 					pdd->dev->kfd2kgd->disable_debug_trap(
2912 					pdd->dev->adev,
2913 					false,
2914 					pdd->dev->vm_info.last_vmid_kfd);
2915 
2916 			if (!pdd->dev->kfd->shared_resources.enable_mes)
2917 				last_err = debug_refresh_runlist(pdd->dev->dqm);
2918 			else
2919 				last_err = kfd_dbg_set_mes_debug_mode(pdd,
2920 							   !kfd_dbg_has_cwsr_workaround(pdd->dev));
2921 
2922 			if (last_err)
2923 				ret = last_err;
2924 		}
2925 	}
2926 
2927 	return ret;
2928 }
2929 
2930 static int kfd_ioctl_runtime_enable(struct file *filep, struct kfd_process *p, void *data)
2931 {
2932 	struct kfd_ioctl_runtime_enable_args *args = data;
2933 	int r;
2934 
2935 	mutex_lock(&p->mutex);
2936 
2937 	if (args->mode_mask & KFD_RUNTIME_ENABLE_MODE_ENABLE_MASK)
2938 		r = runtime_enable(p, args->r_debug,
2939 				!!(args->mode_mask & KFD_RUNTIME_ENABLE_MODE_TTMP_SAVE_MASK));
2940 	else
2941 		r = runtime_disable(p);
2942 
2943 	mutex_unlock(&p->mutex);
2944 
2945 	return r;
2946 }
2947 
2948 static int kfd_ioctl_set_debug_trap(struct file *filep, struct kfd_process *p, void *data)
2949 {
2950 	struct kfd_ioctl_dbg_trap_args *args = data;
2951 	struct task_struct *thread = NULL;
2952 	struct mm_struct *mm = NULL;
2953 	struct pid *pid = NULL;
2954 	struct kfd_process *target = NULL;
2955 	struct kfd_process_device *pdd = NULL;
2956 	int r = 0;
2957 
2958 	if (p->context_id != KFD_CONTEXT_ID_PRIMARY) {
2959 		pr_debug("Set debug trap ioctl can not be invoked on non-primary kfd process\n");
2960 
2961 		return -EOPNOTSUPP;
2962 	}
2963 
2964 	if (sched_policy == KFD_SCHED_POLICY_NO_HWS) {
2965 		pr_err("Debugging does not support sched_policy %i", sched_policy);
2966 		return -EINVAL;
2967 	}
2968 
2969 	pid = find_get_pid(args->pid);
2970 	if (!pid) {
2971 		pr_debug("Cannot find pid info for %i\n", args->pid);
2972 		r = -ESRCH;
2973 		goto out;
2974 	}
2975 
2976 	thread = get_pid_task(pid, PIDTYPE_PID);
2977 	if (!thread) {
2978 		r = -ESRCH;
2979 		goto out;
2980 	}
2981 
2982 	mm = get_task_mm(thread);
2983 	if (!mm) {
2984 		r = -ESRCH;
2985 		goto out;
2986 	}
2987 
2988 	if (args->op == KFD_IOC_DBG_TRAP_ENABLE) {
2989 		bool create_process;
2990 
2991 		rcu_read_lock();
2992 		create_process = thread && thread != current && ptrace_parent(thread) == current;
2993 		rcu_read_unlock();
2994 
2995 		target = create_process ? kfd_create_process(thread) :
2996 					kfd_lookup_process_by_pid(pid);
2997 	} else {
2998 		target = kfd_lookup_process_by_pid(pid);
2999 	}
3000 
3001 	if (IS_ERR_OR_NULL(target)) {
3002 		pr_debug("Cannot find process PID %i to debug\n", args->pid);
3003 		r = target ? PTR_ERR(target) : -ESRCH;
3004 		target = NULL;
3005 		goto out;
3006 	}
3007 
3008 	if (target->context_id != KFD_CONTEXT_ID_PRIMARY) {
3009 		pr_debug("Set debug trap ioctl not supported on non-primary kfd process\n");
3010 		r = -EOPNOTSUPP;
3011 		goto out;
3012 	}
3013 
3014 	/* Check if target is still PTRACED. */
3015 	rcu_read_lock();
3016 	if (target != p && args->op != KFD_IOC_DBG_TRAP_DISABLE
3017 				&& ptrace_parent(target->lead_thread) != current) {
3018 		pr_err("PID %i is not PTRACED and cannot be debugged\n", args->pid);
3019 		r = -EPERM;
3020 	}
3021 	rcu_read_unlock();
3022 
3023 	if (r)
3024 		goto out;
3025 
3026 	mutex_lock(&target->mutex);
3027 
3028 	if (args->op != KFD_IOC_DBG_TRAP_ENABLE && !target->debug_trap_enabled) {
3029 		pr_err("PID %i not debug enabled for op %i\n", args->pid, args->op);
3030 		r = -EINVAL;
3031 		goto unlock_out;
3032 	}
3033 
3034 	if (target->runtime_info.runtime_state != DEBUG_RUNTIME_STATE_ENABLED &&
3035 			(args->op == KFD_IOC_DBG_TRAP_SET_WAVE_LAUNCH_OVERRIDE ||
3036 			 args->op == KFD_IOC_DBG_TRAP_SET_WAVE_LAUNCH_MODE ||
3037 			 args->op == KFD_IOC_DBG_TRAP_SUSPEND_QUEUES ||
3038 			 args->op == KFD_IOC_DBG_TRAP_RESUME_QUEUES ||
3039 			 args->op == KFD_IOC_DBG_TRAP_SET_NODE_ADDRESS_WATCH ||
3040 			 args->op == KFD_IOC_DBG_TRAP_CLEAR_NODE_ADDRESS_WATCH ||
3041 			 args->op == KFD_IOC_DBG_TRAP_SET_FLAGS)) {
3042 		r = -EPERM;
3043 		goto unlock_out;
3044 	}
3045 
3046 	if (args->op == KFD_IOC_DBG_TRAP_SET_NODE_ADDRESS_WATCH ||
3047 	    args->op == KFD_IOC_DBG_TRAP_CLEAR_NODE_ADDRESS_WATCH) {
3048 		int user_gpu_id = kfd_process_get_user_gpu_id(target,
3049 				args->op == KFD_IOC_DBG_TRAP_SET_NODE_ADDRESS_WATCH ?
3050 					args->set_node_address_watch.gpu_id :
3051 					args->clear_node_address_watch.gpu_id);
3052 
3053 		pdd = kfd_process_device_data_by_id(target, user_gpu_id);
3054 		if (user_gpu_id == -EINVAL || !pdd) {
3055 			r = -ENODEV;
3056 			goto unlock_out;
3057 		}
3058 	}
3059 
3060 	switch (args->op) {
3061 	case KFD_IOC_DBG_TRAP_ENABLE:
3062 		if (target != p)
3063 			target->debugger_process = p;
3064 
3065 		r = kfd_dbg_trap_enable(target,
3066 					args->enable.dbg_fd,
3067 					(void __user *)args->enable.rinfo_ptr,
3068 					&args->enable.rinfo_size);
3069 		if (!r)
3070 			target->exception_enable_mask = args->enable.exception_mask;
3071 
3072 		break;
3073 	case KFD_IOC_DBG_TRAP_DISABLE:
3074 		r = kfd_dbg_trap_disable(target);
3075 		break;
3076 	case KFD_IOC_DBG_TRAP_SEND_RUNTIME_EVENT:
3077 		r = kfd_dbg_send_exception_to_runtime(target,
3078 				args->send_runtime_event.gpu_id,
3079 				args->send_runtime_event.queue_id,
3080 				args->send_runtime_event.exception_mask);
3081 		break;
3082 	case KFD_IOC_DBG_TRAP_SET_EXCEPTIONS_ENABLED:
3083 		kfd_dbg_set_enabled_debug_exception_mask(target,
3084 				args->set_exceptions_enabled.exception_mask);
3085 		break;
3086 	case KFD_IOC_DBG_TRAP_SET_WAVE_LAUNCH_OVERRIDE:
3087 		r = kfd_dbg_trap_set_wave_launch_override(target,
3088 				args->launch_override.override_mode,
3089 				args->launch_override.enable_mask,
3090 				args->launch_override.support_request_mask,
3091 				&args->launch_override.enable_mask,
3092 				&args->launch_override.support_request_mask);
3093 		break;
3094 	case KFD_IOC_DBG_TRAP_SET_WAVE_LAUNCH_MODE:
3095 		r = kfd_dbg_trap_set_wave_launch_mode(target,
3096 				args->launch_mode.launch_mode);
3097 		break;
3098 	case KFD_IOC_DBG_TRAP_SUSPEND_QUEUES:
3099 		r = suspend_queues(target,
3100 				args->suspend_queues.num_queues,
3101 				args->suspend_queues.grace_period,
3102 				args->suspend_queues.exception_mask,
3103 				(uint32_t *)args->suspend_queues.queue_array_ptr);
3104 
3105 		break;
3106 	case KFD_IOC_DBG_TRAP_RESUME_QUEUES:
3107 		r = resume_queues(target, args->resume_queues.num_queues,
3108 				(uint32_t *)args->resume_queues.queue_array_ptr);
3109 		break;
3110 	case KFD_IOC_DBG_TRAP_SET_NODE_ADDRESS_WATCH:
3111 		r = kfd_dbg_trap_set_dev_address_watch(pdd,
3112 				args->set_node_address_watch.address,
3113 				args->set_node_address_watch.mask,
3114 				&args->set_node_address_watch.id,
3115 				args->set_node_address_watch.mode);
3116 		break;
3117 	case KFD_IOC_DBG_TRAP_CLEAR_NODE_ADDRESS_WATCH:
3118 		r = kfd_dbg_trap_clear_dev_address_watch(pdd,
3119 				args->clear_node_address_watch.id);
3120 		break;
3121 	case KFD_IOC_DBG_TRAP_SET_FLAGS:
3122 		r = kfd_dbg_trap_set_flags(target, &args->set_flags.flags);
3123 		break;
3124 	case KFD_IOC_DBG_TRAP_QUERY_DEBUG_EVENT:
3125 		r = kfd_dbg_ev_query_debug_event(target,
3126 				&args->query_debug_event.queue_id,
3127 				&args->query_debug_event.gpu_id,
3128 				args->query_debug_event.exception_mask,
3129 				&args->query_debug_event.exception_mask);
3130 		break;
3131 	case KFD_IOC_DBG_TRAP_QUERY_EXCEPTION_INFO:
3132 		r = kfd_dbg_trap_query_exception_info(target,
3133 				args->query_exception_info.source_id,
3134 				args->query_exception_info.exception_code,
3135 				args->query_exception_info.clear_exception,
3136 				(void __user *)args->query_exception_info.info_ptr,
3137 				&args->query_exception_info.info_size);
3138 		break;
3139 	case KFD_IOC_DBG_TRAP_GET_QUEUE_SNAPSHOT:
3140 		r = pqm_get_queue_snapshot(&target->pqm,
3141 				args->queue_snapshot.exception_mask,
3142 				(void __user *)args->queue_snapshot.snapshot_buf_ptr,
3143 				&args->queue_snapshot.num_queues,
3144 				&args->queue_snapshot.entry_size);
3145 		break;
3146 	case KFD_IOC_DBG_TRAP_GET_DEVICE_SNAPSHOT:
3147 		r = kfd_dbg_trap_device_snapshot(target,
3148 				args->device_snapshot.exception_mask,
3149 				(void __user *)args->device_snapshot.snapshot_buf_ptr,
3150 				&args->device_snapshot.num_devices,
3151 				&args->device_snapshot.entry_size);
3152 		break;
3153 	default:
3154 		pr_err("Invalid option: %i\n", args->op);
3155 		r = -EINVAL;
3156 	}
3157 
3158 unlock_out:
3159 	mutex_unlock(&target->mutex);
3160 
3161 out:
3162 	if (thread)
3163 		put_task_struct(thread);
3164 
3165 	if (mm)
3166 		mmput(mm);
3167 
3168 	if (pid)
3169 		put_pid(pid);
3170 
3171 	if (target)
3172 		kfd_unref_process(target);
3173 
3174 	return r;
3175 }
3176 
3177 /* userspace programs need to invoke this ioctl explicitly on a FD to
3178  * create a secondary kfd_process which replacing its primary kfd_process
3179  */
3180 static int kfd_ioctl_create_process(struct file *filep, struct kfd_process *p, void *data)
3181 {
3182 	struct kfd_process *process;
3183 	int ret;
3184 
3185 	if (!filep->private_data || !p)
3186 		return -EINVAL;
3187 
3188 	/* Each FD owns only one kfd_process */
3189 	if (p->context_id != KFD_CONTEXT_ID_PRIMARY)
3190 		return -EINVAL;
3191 
3192 	mutex_lock(&kfd_processes_mutex);
3193 	if (p != filep->private_data) {
3194 		mutex_unlock(&kfd_processes_mutex);
3195 		return -EINVAL;
3196 	}
3197 
3198 	process = create_process(current, false);
3199 	if (IS_ERR(process)) {
3200 		mutex_unlock(&kfd_processes_mutex);
3201 		return PTR_ERR(process);
3202 	}
3203 
3204 	filep->private_data = process;
3205 	mutex_unlock(&kfd_processes_mutex);
3206 
3207 	ret = kfd_create_process_sysfs(process);
3208 	if (ret)
3209 		pr_warn("Failed to create sysfs entry for the kfd_process");
3210 
3211 	/* Each open() increases kref of the primary kfd_process,
3212 	 * so we need to reduce it here when we create a new secondary process replacing it
3213 	 */
3214 	kfd_unref_process(p);
3215 
3216 	return 0;
3217 }
3218 
3219 #define AMDKFD_IOCTL_DEF(ioctl, _func, _flags) \
3220 	[_IOC_NR(ioctl)] = {.cmd = ioctl, .func = _func, .flags = _flags, \
3221 			    .validate = NULL, .cmd_drv = 0, .name = #ioctl}
3222 
3223 #define AMDKFD_IOCTL_DEF_V(ioctl, _func, _validate, _flags) \
3224 	[_IOC_NR(ioctl)] = {.cmd = ioctl, .func = _func, .flags = _flags, \
3225 			    .validate = _validate, .cmd_drv = 0, .name = #ioctl}
3226 
3227 /** Ioctl table */
3228 static const struct amdkfd_ioctl_desc amdkfd_ioctls[] = {
3229 	AMDKFD_IOCTL_DEF(AMDKFD_IOC_GET_VERSION,
3230 			kfd_ioctl_get_version, 0),
3231 
3232 	AMDKFD_IOCTL_DEF(AMDKFD_IOC_CREATE_QUEUE,
3233 			kfd_ioctl_create_queue, 0),
3234 
3235 	AMDKFD_IOCTL_DEF(AMDKFD_IOC_DESTROY_QUEUE,
3236 			kfd_ioctl_destroy_queue, 0),
3237 
3238 	AMDKFD_IOCTL_DEF(AMDKFD_IOC_SET_MEMORY_POLICY,
3239 			kfd_ioctl_set_memory_policy, 0),
3240 
3241 	AMDKFD_IOCTL_DEF(AMDKFD_IOC_GET_CLOCK_COUNTERS,
3242 			kfd_ioctl_get_clock_counters, 0),
3243 
3244 	AMDKFD_IOCTL_DEF(AMDKFD_IOC_GET_PROCESS_APERTURES,
3245 			kfd_ioctl_get_process_apertures, 0),
3246 
3247 	AMDKFD_IOCTL_DEF(AMDKFD_IOC_UPDATE_QUEUE,
3248 			kfd_ioctl_update_queue, 0),
3249 
3250 	AMDKFD_IOCTL_DEF(AMDKFD_IOC_CREATE_EVENT,
3251 			kfd_ioctl_create_event, 0),
3252 
3253 	AMDKFD_IOCTL_DEF(AMDKFD_IOC_DESTROY_EVENT,
3254 			kfd_ioctl_destroy_event, 0),
3255 
3256 	AMDKFD_IOCTL_DEF(AMDKFD_IOC_SET_EVENT,
3257 			kfd_ioctl_set_event, 0),
3258 
3259 	AMDKFD_IOCTL_DEF(AMDKFD_IOC_RESET_EVENT,
3260 			kfd_ioctl_reset_event, 0),
3261 
3262 	AMDKFD_IOCTL_DEF(AMDKFD_IOC_WAIT_EVENTS,
3263 			kfd_ioctl_wait_events, 0),
3264 
3265 	AMDKFD_IOCTL_DEF(AMDKFD_IOC_DBG_REGISTER_DEPRECATED,
3266 			kfd_ioctl_dbg_register, 0),
3267 
3268 	AMDKFD_IOCTL_DEF(AMDKFD_IOC_DBG_UNREGISTER_DEPRECATED,
3269 			kfd_ioctl_dbg_unregister, 0),
3270 
3271 	AMDKFD_IOCTL_DEF(AMDKFD_IOC_DBG_ADDRESS_WATCH_DEPRECATED,
3272 			kfd_ioctl_dbg_address_watch, 0),
3273 
3274 	AMDKFD_IOCTL_DEF(AMDKFD_IOC_DBG_WAVE_CONTROL_DEPRECATED,
3275 			kfd_ioctl_dbg_wave_control, 0),
3276 
3277 	AMDKFD_IOCTL_DEF(AMDKFD_IOC_SET_SCRATCH_BACKING_VA,
3278 			kfd_ioctl_set_scratch_backing_va, 0),
3279 
3280 	AMDKFD_IOCTL_DEF(AMDKFD_IOC_GET_TILE_CONFIG,
3281 			kfd_ioctl_get_tile_config, 0),
3282 
3283 	AMDKFD_IOCTL_DEF(AMDKFD_IOC_SET_TRAP_HANDLER,
3284 			kfd_ioctl_set_trap_handler, 0),
3285 
3286 	AMDKFD_IOCTL_DEF(AMDKFD_IOC_GET_PROCESS_APERTURES_NEW,
3287 			kfd_ioctl_get_process_apertures_new, 0),
3288 
3289 	AMDKFD_IOCTL_DEF(AMDKFD_IOC_ACQUIRE_VM,
3290 			kfd_ioctl_acquire_vm, 0),
3291 
3292 	AMDKFD_IOCTL_DEF(AMDKFD_IOC_ALLOC_MEMORY_OF_GPU,
3293 			kfd_ioctl_alloc_memory_of_gpu, 0),
3294 
3295 	AMDKFD_IOCTL_DEF(AMDKFD_IOC_FREE_MEMORY_OF_GPU,
3296 			kfd_ioctl_free_memory_of_gpu, 0),
3297 
3298 	AMDKFD_IOCTL_DEF(AMDKFD_IOC_MAP_MEMORY_TO_GPU,
3299 			kfd_ioctl_map_memory_to_gpu, 0),
3300 
3301 	AMDKFD_IOCTL_DEF(AMDKFD_IOC_UNMAP_MEMORY_FROM_GPU,
3302 			kfd_ioctl_unmap_memory_from_gpu, 0),
3303 
3304 	AMDKFD_IOCTL_DEF(AMDKFD_IOC_SET_CU_MASK,
3305 			kfd_ioctl_set_cu_mask, 0),
3306 
3307 	AMDKFD_IOCTL_DEF(AMDKFD_IOC_GET_QUEUE_WAVE_STATE,
3308 			kfd_ioctl_get_queue_wave_state, 0),
3309 
3310 	AMDKFD_IOCTL_DEF(AMDKFD_IOC_GET_DMABUF_INFO,
3311 				kfd_ioctl_get_dmabuf_info, 0),
3312 
3313 	AMDKFD_IOCTL_DEF(AMDKFD_IOC_IMPORT_DMABUF,
3314 				kfd_ioctl_import_dmabuf, 0),
3315 
3316 	AMDKFD_IOCTL_DEF(AMDKFD_IOC_ALLOC_QUEUE_GWS,
3317 			kfd_ioctl_alloc_queue_gws, 0),
3318 
3319 	AMDKFD_IOCTL_DEF(AMDKFD_IOC_SMI_EVENTS,
3320 			kfd_ioctl_smi_events, 0),
3321 
3322 	AMDKFD_IOCTL_DEF_V(AMDKFD_IOC_SVM, kfd_ioctl_svm,
3323 			   kfd_ioctl_svm_validate, 0),
3324 
3325 	AMDKFD_IOCTL_DEF(AMDKFD_IOC_SET_XNACK_MODE,
3326 			kfd_ioctl_set_xnack_mode, 0),
3327 
3328 	AMDKFD_IOCTL_DEF(AMDKFD_IOC_CRIU_OP,
3329 			kfd_ioctl_criu, KFD_IOC_FLAG_CHECKPOINT_RESTORE),
3330 
3331 	AMDKFD_IOCTL_DEF(AMDKFD_IOC_AVAILABLE_MEMORY,
3332 			kfd_ioctl_get_available_memory, 0),
3333 
3334 	AMDKFD_IOCTL_DEF(AMDKFD_IOC_EXPORT_DMABUF,
3335 				kfd_ioctl_export_dmabuf, 0),
3336 
3337 	AMDKFD_IOCTL_DEF(AMDKFD_IOC_RUNTIME_ENABLE,
3338 			kfd_ioctl_runtime_enable, 0),
3339 
3340 	AMDKFD_IOCTL_DEF(AMDKFD_IOC_DBG_TRAP,
3341 			kfd_ioctl_set_debug_trap, 0),
3342 
3343 	AMDKFD_IOCTL_DEF(AMDKFD_IOC_CREATE_PROCESS,
3344 			kfd_ioctl_create_process, 0),
3345 };
3346 
3347 #define AMDKFD_CORE_IOCTL_COUNT	ARRAY_SIZE(amdkfd_ioctls)
3348 
3349 static long kfd_ioctl(struct file *filep, unsigned int cmd, unsigned long arg)
3350 {
3351 	struct kfd_process *process;
3352 	amdkfd_ioctl_t *func;
3353 	const struct amdkfd_ioctl_desc *ioctl = NULL;
3354 	unsigned int nr = _IOC_NR(cmd);
3355 	char stack_kdata[128];
3356 	char *kdata = NULL;
3357 	unsigned int usize, asize;
3358 	int retcode = -EINVAL;
3359 	bool ptrace_attached = false;
3360 
3361 	if (nr >= AMDKFD_CORE_IOCTL_COUNT) {
3362 		retcode = -ENOTTY;
3363 		goto err_i1;
3364 	}
3365 
3366 	if ((nr >= AMDKFD_COMMAND_START) && (nr < AMDKFD_COMMAND_END)) {
3367 		u32 amdkfd_size;
3368 
3369 		ioctl = &amdkfd_ioctls[nr];
3370 
3371 		amdkfd_size = _IOC_SIZE(ioctl->cmd);
3372 		usize = asize = _IOC_SIZE(cmd);
3373 		if (amdkfd_size > asize)
3374 			asize = amdkfd_size;
3375 
3376 		cmd = ioctl->cmd;
3377 	} else {
3378 		retcode = -ENOTTY;
3379 		goto err_i1;
3380 	}
3381 
3382 	dev_dbg(kfd_device, "ioctl cmd 0x%x (#0x%x), arg 0x%lx\n", cmd, nr, arg);
3383 
3384 	/* Get the process struct from the filep. Only the process
3385 	 * that opened /dev/kfd can use the file descriptor. Child
3386 	 * processes need to create their own KFD device context.
3387 	 */
3388 	process = filep->private_data;
3389 
3390 	rcu_read_lock();
3391 	if ((ioctl->flags & KFD_IOC_FLAG_CHECKPOINT_RESTORE) &&
3392 	    ptrace_parent(process->lead_thread) == current)
3393 		ptrace_attached = true;
3394 	rcu_read_unlock();
3395 
3396 	if (process->lead_thread != current->group_leader
3397 	    && !ptrace_attached) {
3398 		dev_dbg(kfd_device, "Using KFD FD in wrong process\n");
3399 		retcode = -EBADF;
3400 		goto err_i1;
3401 	}
3402 
3403 	/* Do not trust userspace, use our own definition */
3404 	func = ioctl->func;
3405 
3406 	if (unlikely(!func)) {
3407 		dev_dbg(kfd_device, "no function\n");
3408 		retcode = -EINVAL;
3409 		goto err_i1;
3410 	}
3411 
3412 	/*
3413 	 * Versions of docker shipped in Ubuntu 18.xx and 20.xx do not support
3414 	 * CAP_CHECKPOINT_RESTORE, so we also allow access if CAP_SYS_ADMIN as CAP_SYS_ADMIN is a
3415 	 * more priviledged access.
3416 	 */
3417 	if (unlikely(ioctl->flags & KFD_IOC_FLAG_CHECKPOINT_RESTORE)) {
3418 		if (!capable(CAP_CHECKPOINT_RESTORE) &&
3419 						!capable(CAP_SYS_ADMIN)) {
3420 			retcode = -EACCES;
3421 			goto err_i1;
3422 		}
3423 	}
3424 
3425 	if (cmd & (IOC_IN | IOC_OUT)) {
3426 		if (asize <= sizeof(stack_kdata)) {
3427 			kdata = stack_kdata;
3428 		} else {
3429 			kdata = kmalloc(asize, GFP_KERNEL);
3430 			if (!kdata) {
3431 				retcode = -ENOMEM;
3432 				goto err_i1;
3433 			}
3434 		}
3435 		if (asize > usize)
3436 			memset(kdata + usize, 0, asize - usize);
3437 	}
3438 
3439 	if (cmd & IOC_IN) {
3440 		if (copy_from_user(kdata, (void __user *)arg, usize) != 0) {
3441 			retcode = -EFAULT;
3442 			goto err_i1;
3443 		}
3444 	} else if (cmd & IOC_OUT) {
3445 		memset(kdata, 0, usize);
3446 	}
3447 
3448 	if (ioctl->validate) {
3449 		retcode = ioctl->validate(kdata, usize);
3450 		if (retcode)
3451 			goto err_i1;
3452 	}
3453 
3454 	retcode = func(filep, process, kdata);
3455 
3456 	if (cmd & IOC_OUT)
3457 		if (copy_to_user((void __user *)arg, kdata, usize) != 0)
3458 			retcode = -EFAULT;
3459 
3460 err_i1:
3461 	if (!ioctl)
3462 		dev_dbg(kfd_device, "invalid ioctl: pid=%d, cmd=0x%02x, nr=0x%02x\n",
3463 			  task_pid_nr(current), cmd, nr);
3464 
3465 	if (kdata != stack_kdata)
3466 		kfree(kdata);
3467 
3468 	if (retcode)
3469 		dev_dbg(kfd_device, "ioctl cmd (#0x%x), arg 0x%lx, ret = %d\n",
3470 				nr, arg, retcode);
3471 
3472 	return retcode;
3473 }
3474 
3475 static int kfd_mmio_mmap(struct kfd_node *dev, struct kfd_process *process,
3476 		      struct vm_area_struct *vma)
3477 {
3478 	phys_addr_t address;
3479 
3480 	if (vma->vm_end - vma->vm_start != PAGE_SIZE)
3481 		return -EINVAL;
3482 
3483 	if (PAGE_SIZE > 4096)
3484 		return -EINVAL;
3485 
3486 	address = dev->adev->rmmio_remap.bus_addr;
3487 
3488 	vm_flags_set(vma, VM_IO | VM_DONTCOPY | VM_DONTEXPAND | VM_NORESERVE |
3489 				VM_DONTDUMP | VM_PFNMAP);
3490 
3491 	vma->vm_page_prot = pgprot_noncached(vma->vm_page_prot);
3492 
3493 	pr_debug("process pid %d mapping mmio page\n"
3494 		 "     target user address == 0x%08llX\n"
3495 		 "     physical address    == 0x%08llX\n"
3496 		 "     vm_flags            == 0x%04lX\n"
3497 		 "     size                == 0x%04lX\n",
3498 		 process->lead_thread->pid, (unsigned long long) vma->vm_start,
3499 		 address, vma->vm_flags, PAGE_SIZE);
3500 
3501 	return io_remap_pfn_range(vma,
3502 				vma->vm_start,
3503 				address >> PAGE_SHIFT,
3504 				PAGE_SIZE,
3505 				vma->vm_page_prot);
3506 }
3507 
3508 
3509 static int kfd_mmap(struct file *filep, struct vm_area_struct *vma)
3510 {
3511 	struct kfd_process *process;
3512 	struct kfd_node *dev = NULL;
3513 	unsigned long mmap_offset;
3514 	unsigned int gpu_id;
3515 
3516 	process = filep->private_data;
3517 	if (!process)
3518 		return -ESRCH;
3519 
3520 	if (process->lead_thread != current->group_leader)
3521 		return -EBADF;
3522 
3523 	mmap_offset = vma->vm_pgoff << PAGE_SHIFT;
3524 	gpu_id = KFD_MMAP_GET_GPU_ID(mmap_offset);
3525 	if (gpu_id)
3526 		dev = kfd_device_by_id(gpu_id);
3527 
3528 	switch (mmap_offset & KFD_MMAP_TYPE_MASK) {
3529 	case KFD_MMAP_TYPE_DOORBELL:
3530 		if (!dev)
3531 			return -ENODEV;
3532 		return kfd_doorbell_mmap(dev, process, vma);
3533 
3534 	case KFD_MMAP_TYPE_EVENTS:
3535 		return kfd_event_mmap(process, vma);
3536 
3537 	case KFD_MMAP_TYPE_RESERVED_MEM:
3538 		pr_warn("KFD_MMAP_TYPE_RESERVED_MEM is no longer supported\n");
3539 		return -EINVAL;
3540 	case KFD_MMAP_TYPE_MMIO:
3541 		if (!dev)
3542 			return -ENODEV;
3543 		return kfd_mmio_mmap(dev, process, vma);
3544 	}
3545 
3546 	return -EFAULT;
3547 }
3548