drivers/gpu/drm/i915/i915_query.c

   1 /*
   2  * SPDX-License-Identifier: MIT
   3  *
   4  * Copyright © 2018 Intel Corporation
   5  */
   6
   7 #include <linux/nospec.h>
   8
   9 #include "i915_drv.h"
  10 #include "i915_query.h"
  11 #include <uapi/drm/i915_drm.h>
  12
  13 static int query_topology_info(struct drm_i915_private *dev_priv,
  14                                struct drm_i915_query_item *query_item)
  15 {
  16         const struct sseu_dev_info *sseu = &INTEL_INFO(dev_priv)->sseu;
  17         struct drm_i915_query_topology_info topo;
  18         u32 slice_length, subslice_length, eu_length, total_length;
  19
  20         if (query_item->flags != 0)
  21                 return -EINVAL;
  22
  23         if (sseu->max_slices == 0)
  24                 return -ENODEV;
  25
  26         BUILD_BUG_ON(sizeof(u8) != sizeof(sseu->slice_mask));
  27
  28         slice_length = sizeof(sseu->slice_mask);
  29         subslice_length = sseu->max_slices *
  30                 DIV_ROUND_UP(sseu->max_subslices,
  31                              sizeof(sseu->subslice_mask[0]) * BITS_PER_BYTE);
  32         eu_length = sseu->max_slices * sseu->max_subslices *
  33                 DIV_ROUND_UP(sseu->max_eus_per_subslice, BITS_PER_BYTE);
  34
  35         total_length = sizeof(topo) + slice_length + subslice_length + eu_length;
  36
  37         if (query_item->length == 0)
  38                 return total_length;
  39
  40         if (query_item->length < total_length)
  41                 return -EINVAL;
  42
  43         if (copy_from_user(&topo, u64_to_user_ptr(query_item->data_ptr),
  44                            sizeof(topo)))
  45                 return -EFAULT;
  46
  47         if (topo.flags != 0)
  48                 return -EINVAL;
  49
  50         if (!access_ok(VERIFY_WRITE, u64_to_user_ptr(query_item->data_ptr),
  51                        total_length))
  52                 return -EFAULT;
  53
  54         memset(&topo, 0, sizeof(topo));
  55         topo.max_slices = sseu->max_slices;
  56         topo.max_subslices = sseu->max_subslices;
  57         topo.max_eus_per_subslice = sseu->max_eus_per_subslice;
  58
  59         topo.subslice_offset = slice_length;
  60         topo.subslice_stride = DIV_ROUND_UP(sseu->max_subslices, BITS_PER_BYTE);
  61         topo.eu_offset = slice_length + subslice_length;
  62         topo.eu_stride =
  63                 DIV_ROUND_UP(sseu->max_eus_per_subslice, BITS_PER_BYTE);
  64
  65         if (__copy_to_user(u64_to_user_ptr(query_item->data_ptr),
  66                            &topo, sizeof(topo)))
  67                 return -EFAULT;
  68
  69         if (__copy_to_user(u64_to_user_ptr(query_item->data_ptr + sizeof(topo)),
  70                            &sseu->slice_mask, slice_length))
  71                 return -EFAULT;
  72
  73         if (__copy_to_user(u64_to_user_ptr(query_item->data_ptr +
  74                                            sizeof(topo) + slice_length),
  75                            sseu->subslice_mask, subslice_length))
  76                 return -EFAULT;
  77
  78         if (__copy_to_user(u64_to_user_ptr(query_item->data_ptr +
  79                                            sizeof(topo) +
  80                                            slice_length + subslice_length),
  81                            sseu->eu_mask, eu_length))
  82                 return -EFAULT;
  83
  84         return total_length;
  85 }
  86
  87 static int (* const i915_query_funcs[])(struct drm_i915_private *dev_priv,
  88                                         struct drm_i915_query_item *query_item) = {
  89         query_topology_info,
  90 };
  91
  92 int i915_query_ioctl(struct drm_device *dev, void *data, struct drm_file *file)
  93 {
  94         struct drm_i915_private *dev_priv = to_i915(dev);
  95         struct drm_i915_query *args = data;
  96         struct drm_i915_query_item __user *user_item_ptr =
  97                 u64_to_user_ptr(args->items_ptr);
  98         u32 i;
  99
 100         if (args->flags != 0)
 101                 return -EINVAL;
 102
 103         for (i = 0; i < args->num_items; i++, user_item_ptr++) {
 104                 struct drm_i915_query_item item;
 105                 unsigned long func_idx;
 106                 int ret;
 107
 108                 if (copy_from_user(&item, user_item_ptr, sizeof(item)))
 109                         return -EFAULT;
 110
 111                 if (item.query_id == 0)
 112                         return -EINVAL;
 113
 114                 if (overflows_type(item.query_id - 1, unsigned long))
 115                         return -EINVAL;
 116
 117                 func_idx = item.query_id - 1;
 118
 119                 ret = -EINVAL;
 120                 if (func_idx < ARRAY_SIZE(i915_query_funcs)) {
 121                         func_idx = array_index_nospec(func_idx,
 122                                                       ARRAY_SIZE(i915_query_funcs));
 123                         ret = i915_query_funcs[func_idx](dev_priv, &item);
 124                 }
 125
 126                 /* Only write the length back to userspace if they differ. */
 127                 if (ret != item.length && put_user(ret, &user_item_ptr->length))
 128                         return -EFAULT;
 129         }
 130
 131         return 0;
 132 }