[PATCH v10 1/3] drm/amdgpu: Add ioctl to get bo info
Christian König
christian.koenig at amd.com
Thu Aug 7 14:51:24 UTC 2025
On 07.08.25 16:00, David Francis wrote:
> Add new ioctl DRM_IOCTL_AMDGPU_GEM_BO_INFO.
>
> This ioctl returns a list of bos with their handles, sizes,
> and flags and domains.
>
> This ioctl is meant to be used during CRIU checkpoint and
> provide information needed to reconstruct the bos
> in CRIU restore.
>
> Signed-off-by: David Francis <David.Francis at amd.com>
> ---
> drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c | 1 +
> drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c | 73 +++++++++++++++++++++++++
> drivers/gpu/drm/amd/amdgpu/amdgpu_gem.h | 2 +
> include/uapi/drm/amdgpu_drm.h | 33 +++++++++++
> 4 files changed, 109 insertions(+)
>
> diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c
> index 4ff3a2eaaf55..9ee4644b508d 100644
> --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c
> +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c
> @@ -3031,6 +3031,7 @@ const struct drm_ioctl_desc amdgpu_ioctls_kms[] = {
> DRM_IOCTL_DEF_DRV(AMDGPU_USERQ, amdgpu_userq_ioctl, DRM_AUTH|DRM_RENDER_ALLOW),
> DRM_IOCTL_DEF_DRV(AMDGPU_USERQ_SIGNAL, amdgpu_userq_signal_ioctl, DRM_AUTH|DRM_RENDER_ALLOW),
> DRM_IOCTL_DEF_DRV(AMDGPU_USERQ_WAIT, amdgpu_userq_wait_ioctl, DRM_AUTH|DRM_RENDER_ALLOW),
> + DRM_IOCTL_DEF_DRV(AMDGPU_GEM_BO_INFO, amdgpu_gem_bo_info_ioctl, DRM_AUTH|DRM_RENDER_ALLOW),
> };
>
> static const struct drm_driver amdgpu_kms_driver = {
> diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c
> index e3f65977eeee..ec80b751e697 100644
> --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c
> +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c
> @@ -1032,6 +1032,79 @@ int amdgpu_gem_op_ioctl(struct drm_device *dev, void *data,
> return r;
> }
>
> +/**
> + * drm_amdgpu_gem_bo_info_ioctl - get information about a process' buffer objects
> + *
> + * @dev: drm device pointer
> + * @data: drm_amdgpu_criu_bo_info_args
> + * @filp: drm file pointer
> + *
> + * num_bos is set as an input to the size of the bo_buckets array.
> + * num_bos is sent back as output as the number of bos in the process.
> + * If that number is larger than the size of the array, the ioctl must
> + * be retried.
> + *
> + * Returns:
> + * 0 for success, -errno for errors.
> + */
> +int amdgpu_gem_bo_info_ioctl(struct drm_device *dev, void *data,
> + struct drm_file *filp)
> +{
> + struct drm_amdgpu_gem_bo_info *args = data;
> + struct drm_amdgpu_gem_bo_info_bucket *bo_buckets;
> + struct drm_gem_object *gobj;
> + int id, ret = 0;
> + int bo_index = 0;
> + int num_bos = 0;
> +
> + spin_lock(&filp->table_lock);
> + idr_for_each_entry(&filp->object_idr, gobj, id)
> + num_bos += 1;
> + spin_unlock(&filp->table_lock);
Yeah that won't work likes this.
> +
> + if (args->num_bos < num_bos) {
> + args->num_bos = num_bos;
> + return 0;
> + }
> + args->num_bos = num_bos;
> + if (num_bos == 0)
> + return 0;
> +
> + bo_buckets = kvcalloc(num_bos, sizeof(*bo_buckets), GFP_KERNEL);
> + if (!bo_buckets)
> + return -ENOMEM;
> +
> + spin_lock(&filp->table_lock);
> + idr_for_each_entry(&filp->object_idr, gobj, id) {
> + struct amdgpu_bo *bo = gem_to_amdgpu_bo(gobj);
> + struct drm_amdgpu_gem_bo_info_bucket *bo_bucket;
> +
> + bo_bucket = &bo_buckets[bo_index];
You are relying on that the table won't change after dropping the spinlock, but that's not guaranteed.
You need some extra check here to not write over the end of the buffer or otherwise you create a really nice API to hijack the kernel.
> +
> + bo_bucket->size = amdgpu_bo_size(bo);
> + bo_bucket->alloc_flags = bo->flags & (~AMDGPU_GEM_CREATE_VRAM_WIPE_ON_RELEASE);
> + bo_bucket->preferred_domains = bo->preferred_domains;
> + bo_bucket->gem_handle = id;
> +
> + if (bo->tbo.base.import_attach)
> + bo_bucket->flags |= AMDGPU_GEM_BO_INFO_FLAG_IS_IMPORT;
> +
> + bo_index += 1;
> + }
> + spin_unlock(&filp->table_lock);
> +
> + ret = copy_to_user((void __user *)args->bo_buckets, bo_buckets, num_bos * sizeof(*bo_buckets));
> + if (ret) {
> + pr_debug("Failed to copy BO information to user\n");
> + ret = -EFAULT;
> + }
> +
> + kvfree(bo_buckets);
> +
> + return ret;
> +}
> +
> +
> static int amdgpu_gem_align_pitch(struct amdgpu_device *adev,
> int width,
> int cpp,
> diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_gem.h b/drivers/gpu/drm/amd/amdgpu/amdgpu_gem.h
> index b51e8f95ee86..d33b19fd1488 100644
> --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_gem.h
> +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_gem.h
> @@ -67,6 +67,8 @@ int amdgpu_gem_va_ioctl(struct drm_device *dev, void *data,
> struct drm_file *filp);
> int amdgpu_gem_op_ioctl(struct drm_device *dev, void *data,
> struct drm_file *filp);
> +int amdgpu_gem_bo_info_ioctl(struct drm_device *dev, void *data,
> + struct drm_file *filp);
>
> int amdgpu_gem_metadata_ioctl(struct drm_device *dev, void *data,
> struct drm_file *filp);
> diff --git a/include/uapi/drm/amdgpu_drm.h b/include/uapi/drm/amdgpu_drm.h
> index bdedbaccf776..1b3d2ba2f556 100644
> --- a/include/uapi/drm/amdgpu_drm.h
> +++ b/include/uapi/drm/amdgpu_drm.h
> @@ -57,6 +57,7 @@ extern "C" {
> #define DRM_AMDGPU_USERQ 0x16
> #define DRM_AMDGPU_USERQ_SIGNAL 0x17
> #define DRM_AMDGPU_USERQ_WAIT 0x18
> +#define DRM_AMDGPU_GEM_BO_INFO 0x19
BO_INFO is a bit misleading, maybe name that DRM_AMDGPU_GEM_HANDLES.
>
> #define DRM_IOCTL_AMDGPU_GEM_CREATE DRM_IOWR(DRM_COMMAND_BASE + DRM_AMDGPU_GEM_CREATE, union drm_amdgpu_gem_create)
> #define DRM_IOCTL_AMDGPU_GEM_MMAP DRM_IOWR(DRM_COMMAND_BASE + DRM_AMDGPU_GEM_MMAP, union drm_amdgpu_gem_mmap)
> @@ -77,6 +78,7 @@ extern "C" {
> #define DRM_IOCTL_AMDGPU_USERQ DRM_IOWR(DRM_COMMAND_BASE + DRM_AMDGPU_USERQ, union drm_amdgpu_userq)
> #define DRM_IOCTL_AMDGPU_USERQ_SIGNAL DRM_IOWR(DRM_COMMAND_BASE + DRM_AMDGPU_USERQ_SIGNAL, struct drm_amdgpu_userq_signal)
> #define DRM_IOCTL_AMDGPU_USERQ_WAIT DRM_IOWR(DRM_COMMAND_BASE + DRM_AMDGPU_USERQ_WAIT, struct drm_amdgpu_userq_wait)
> +#define DRM_IOCTL_AMDGPU_GEM_BO_INFO DRM_IOWR(DRM_COMMAND_BASE + DRM_AMDGPU_GEM_BO_INFO, struct drm_amdgpu_gem_bo_info)
>
> /**
> * DOC: memory domains
> @@ -811,6 +813,37 @@ struct drm_amdgpu_gem_op {
> __u64 value;
> };
>
> +#define AMDGPU_GEM_BO_INFO_FLAG_IS_IMPORT (1 << 0)
> +
> +struct drm_amdgpu_gem_bo_info {
> + /* User pointer to array of drm_amdgpu_criu_bo_bucket */
That structure was renamed.
> + __u64 bo_buckets;
> +
> + /* IN: Size of bo_buckets buffer. OUT: Number of bos in process (if larger than size of buffer, must retry) */
> + __u32 num_bos;
> +
> + __u32 padding;
> +};
> +
> +struct drm_amdgpu_gem_bo_info_bucket {
Why bucket? Maybe "entry" instead?
> + /* Size of bo */
> + __u64 size;
> +
> + /* GEM_CREATE flags for re-creation of buffer */
> + __u64 alloc_flags;
> +
> + /* Pending how to handle this; provides information needed to remake the buffer on restore */
> + __u32 preferred_domains;
> +
> + /* Currently just one flag: IS_IMPORT */
> + __u32 flags;
> +
> + /* gem handle of buffer object */
> + __u32 gem_handle;
Make that the first member, it's basically the whole reason we have that here.
Regards,
Christian.
> +
> + __u32 padding;
> +};
> +
> #define AMDGPU_VA_OP_MAP 1
> #define AMDGPU_VA_OP_UNMAP 2
> #define AMDGPU_VA_OP_CLEAR 3
More information about the amd-gfx
mailing list