1 /* 2 * SPDX-License-Identifier: MIT 3 * 4 * Copyright © 2018 Intel Corporation 5 */ 6 7 #include <linux/nospec.h> 8 9 #include "i915_drv.h" 10 #include "i915_perf.h" 11 #include "i915_query.h" 12 #include "gt/intel_engine_user.h" 13 #include <uapi/drm/i915_drm.h> 14 15 static int copy_query_item(void *query_hdr, size_t query_sz, 16 u32 total_length, 17 struct drm_i915_query_item *query_item) 18 { 19 if (query_item->length == 0) 20 return total_length; 21 22 if (query_item->length < total_length) 23 return -EINVAL; 24 25 if (copy_from_user(query_hdr, u64_to_user_ptr(query_item->data_ptr), 26 query_sz)) 27 return -EFAULT; 28 29 return 0; 30 } 31 32 static int fill_topology_info(const struct sseu_dev_info *sseu, 33 struct drm_i915_query_item *query_item, 34 intel_sseu_ss_mask_t subslice_mask) 35 { 36 struct drm_i915_query_topology_info topo; 37 u32 slice_length, subslice_length, eu_length, total_length; 38 int ss_stride = GEN_SSEU_STRIDE(sseu->max_subslices); 39 int eu_stride = GEN_SSEU_STRIDE(sseu->max_eus_per_subslice); 40 int ret; 41 42 BUILD_BUG_ON(sizeof(u8) != sizeof(sseu->slice_mask)); 43 44 if (sseu->max_slices == 0) 45 return -ENODEV; 46 47 slice_length = sizeof(sseu->slice_mask); 48 subslice_length = sseu->max_slices * ss_stride; 49 eu_length = sseu->max_slices * sseu->max_subslices * eu_stride; 50 total_length = sizeof(topo) + slice_length + subslice_length + 51 eu_length; 52 53 ret = copy_query_item(&topo, sizeof(topo), total_length, query_item); 54 55 if (ret != 0) 56 return ret; 57 58 memset(&topo, 0, sizeof(topo)); 59 topo.max_slices = sseu->max_slices; 60 topo.max_subslices = sseu->max_subslices; 61 topo.max_eus_per_subslice = sseu->max_eus_per_subslice; 62 63 topo.subslice_offset = slice_length; 64 topo.subslice_stride = ss_stride; 65 topo.eu_offset = slice_length + subslice_length; 66 topo.eu_stride = eu_stride; 67 68 if (copy_to_user(u64_to_user_ptr(query_item->data_ptr), 69 &topo, sizeof(topo))) 70 return -EFAULT; 71 72 if (copy_to_user(u64_to_user_ptr(query_item->data_ptr + sizeof(topo)), 73 &sseu->slice_mask, slice_length)) 74 return -EFAULT; 75 76 if (intel_sseu_copy_ssmask_to_user(u64_to_user_ptr(query_item->data_ptr + 77 sizeof(topo) + slice_length), 78 sseu)) 79 return -EFAULT; 80 81 if (intel_sseu_copy_eumask_to_user(u64_to_user_ptr(query_item->data_ptr + 82 sizeof(topo) + 83 slice_length + subslice_length), 84 sseu)) 85 return -EFAULT; 86 87 return total_length; 88 } 89 90 static int query_topology_info(struct drm_i915_private *dev_priv, 91 struct drm_i915_query_item *query_item) 92 { 93 const struct sseu_dev_info *sseu = &to_gt(dev_priv)->info.sseu; 94 95 if (query_item->flags != 0) 96 return -EINVAL; 97 98 return fill_topology_info(sseu, query_item, sseu->subslice_mask); 99 } 100 101 static int query_geometry_subslices(struct drm_i915_private *i915, 102 struct drm_i915_query_item *query_item) 103 { 104 const struct sseu_dev_info *sseu; 105 struct intel_engine_cs *engine; 106 struct i915_engine_class_instance classinstance; 107 108 if (GRAPHICS_VER_FULL(i915) < IP_VER(12, 50)) 109 return -ENODEV; 110 111 classinstance = *((struct i915_engine_class_instance *)&query_item->flags); 112 113 engine = intel_engine_lookup_user(i915, (u8)classinstance.engine_class, 114 (u8)classinstance.engine_instance); 115 116 if (!engine) 117 return -EINVAL; 118 119 if (engine->class != RENDER_CLASS) 120 return -EINVAL; 121 122 sseu = &engine->gt->info.sseu; 123 124 return fill_topology_info(sseu, query_item, sseu->geometry_subslice_mask); 125 } 126 127 static int 128 query_engine_info(struct drm_i915_private *i915, 129 struct drm_i915_query_item *query_item) 130 { 131 struct drm_i915_query_engine_info __user *query_ptr = 132 u64_to_user_ptr(query_item->data_ptr); 133 struct drm_i915_engine_info __user *info_ptr; 134 struct drm_i915_query_engine_info query; 135 struct drm_i915_engine_info info = { }; 136 unsigned int num_uabi_engines = 0; 137 struct intel_engine_cs *engine; 138 int len, ret; 139 140 if (query_item->flags) 141 return -EINVAL; 142 143 for_each_uabi_engine(engine, i915) 144 num_uabi_engines++; 145 146 len = struct_size(query_ptr, engines, num_uabi_engines); 147 148 ret = copy_query_item(&query, sizeof(query), len, query_item); 149 if (ret != 0) 150 return ret; 151 152 if (query.num_engines || query.rsvd[0] || query.rsvd[1] || 153 query.rsvd[2]) 154 return -EINVAL; 155 156 info_ptr = &query_ptr->engines[0]; 157 158 for_each_uabi_engine(engine, i915) { 159 info.engine.engine_class = engine->uabi_class; 160 info.engine.engine_instance = engine->uabi_instance; 161 info.flags = I915_ENGINE_INFO_HAS_LOGICAL_INSTANCE; 162 info.capabilities = engine->uabi_capabilities; 163 info.logical_instance = ilog2(engine->logical_mask); 164 165 if (copy_to_user(info_ptr, &info, sizeof(info))) 166 return -EFAULT; 167 168 query.num_engines++; 169 info_ptr++; 170 } 171 172 if (copy_to_user(query_ptr, &query, sizeof(query))) 173 return -EFAULT; 174 175 return len; 176 } 177 178 static int can_copy_perf_config_registers_or_number(u32 user_n_regs, 179 u64 user_regs_ptr, 180 u32 kernel_n_regs) 181 { 182 /* 183 * We'll just put the number of registers, and won't copy the 184 * register. 185 */ 186 if (user_n_regs == 0) 187 return 0; 188 189 if (user_n_regs < kernel_n_regs) 190 return -EINVAL; 191 192 return 0; 193 } 194 195 static int copy_perf_config_registers_or_number(const struct i915_oa_reg *kernel_regs, 196 u32 kernel_n_regs, 197 u64 user_regs_ptr, 198 u32 *user_n_regs) 199 { 200 u32 __user *p = u64_to_user_ptr(user_regs_ptr); 201 u32 r; 202 203 if (*user_n_regs == 0) { 204 *user_n_regs = kernel_n_regs; 205 return 0; 206 } 207 208 *user_n_regs = kernel_n_regs; 209 210 if (!user_write_access_begin(p, 2 * sizeof(u32) * kernel_n_regs)) 211 return -EFAULT; 212 213 for (r = 0; r < kernel_n_regs; r++, p += 2) { 214 unsafe_put_user(i915_mmio_reg_offset(kernel_regs[r].addr), 215 p, Efault); 216 unsafe_put_user(kernel_regs[r].value, p + 1, Efault); 217 } 218 user_write_access_end(); 219 return 0; 220 Efault: 221 user_write_access_end(); 222 return -EFAULT; 223 } 224 225 static int query_perf_config_data(struct drm_i915_private *i915, 226 struct drm_i915_query_item *query_item, 227 bool use_uuid) 228 { 229 struct drm_i915_query_perf_config __user *user_query_config_ptr = 230 u64_to_user_ptr(query_item->data_ptr); 231 struct drm_i915_perf_oa_config __user *user_config_ptr = 232 u64_to_user_ptr(query_item->data_ptr + 233 sizeof(struct drm_i915_query_perf_config)); 234 struct drm_i915_perf_oa_config user_config; 235 struct i915_perf *perf = &i915->perf; 236 struct i915_oa_config *oa_config; 237 char uuid[UUID_STRING_LEN + 1]; 238 u64 config_id; 239 u32 flags, total_size; 240 int ret; 241 242 if (!perf->i915) 243 return -ENODEV; 244 245 total_size = 246 sizeof(struct drm_i915_query_perf_config) + 247 sizeof(struct drm_i915_perf_oa_config); 248 249 if (query_item->length == 0) 250 return total_size; 251 252 if (query_item->length < total_size) { 253 drm_dbg(&i915->drm, 254 "Invalid query config data item size=%u expected=%u\n", 255 query_item->length, total_size); 256 return -EINVAL; 257 } 258 259 if (get_user(flags, &user_query_config_ptr->flags)) 260 return -EFAULT; 261 262 if (flags != 0) 263 return -EINVAL; 264 265 if (use_uuid) { 266 struct i915_oa_config *tmp; 267 int id; 268 269 BUILD_BUG_ON(sizeof(user_query_config_ptr->uuid) >= sizeof(uuid)); 270 271 memset(&uuid, 0, sizeof(uuid)); 272 if (copy_from_user(uuid, user_query_config_ptr->uuid, 273 sizeof(user_query_config_ptr->uuid))) 274 return -EFAULT; 275 276 oa_config = NULL; 277 rcu_read_lock(); 278 idr_for_each_entry(&perf->metrics_idr, tmp, id) { 279 if (!strcmp(tmp->uuid, uuid)) { 280 oa_config = i915_oa_config_get(tmp); 281 break; 282 } 283 } 284 rcu_read_unlock(); 285 } else { 286 if (get_user(config_id, &user_query_config_ptr->config)) 287 return -EFAULT; 288 289 oa_config = i915_perf_get_oa_config(perf, config_id); 290 } 291 if (!oa_config) 292 return -ENOENT; 293 294 if (copy_from_user(&user_config, user_config_ptr, sizeof(user_config))) { 295 ret = -EFAULT; 296 goto out; 297 } 298 299 ret = can_copy_perf_config_registers_or_number(user_config.n_boolean_regs, 300 user_config.boolean_regs_ptr, 301 oa_config->b_counter_regs_len); 302 if (ret) 303 goto out; 304 305 ret = can_copy_perf_config_registers_or_number(user_config.n_flex_regs, 306 user_config.flex_regs_ptr, 307 oa_config->flex_regs_len); 308 if (ret) 309 goto out; 310 311 ret = can_copy_perf_config_registers_or_number(user_config.n_mux_regs, 312 user_config.mux_regs_ptr, 313 oa_config->mux_regs_len); 314 if (ret) 315 goto out; 316 317 ret = copy_perf_config_registers_or_number(oa_config->b_counter_regs, 318 oa_config->b_counter_regs_len, 319 user_config.boolean_regs_ptr, 320 &user_config.n_boolean_regs); 321 if (ret) 322 goto out; 323 324 ret = copy_perf_config_registers_or_number(oa_config->flex_regs, 325 oa_config->flex_regs_len, 326 user_config.flex_regs_ptr, 327 &user_config.n_flex_regs); 328 if (ret) 329 goto out; 330 331 ret = copy_perf_config_registers_or_number(oa_config->mux_regs, 332 oa_config->mux_regs_len, 333 user_config.mux_regs_ptr, 334 &user_config.n_mux_regs); 335 if (ret) 336 goto out; 337 338 memcpy(user_config.uuid, oa_config->uuid, sizeof(user_config.uuid)); 339 340 if (copy_to_user(user_config_ptr, &user_config, sizeof(user_config))) { 341 ret = -EFAULT; 342 goto out; 343 } 344 345 ret = total_size; 346 347 out: 348 i915_oa_config_put(oa_config); 349 return ret; 350 } 351 352 static size_t sizeof_perf_config_list(size_t count) 353 { 354 return sizeof(struct drm_i915_query_perf_config) + sizeof(u64) * count; 355 } 356 357 static size_t sizeof_perf_metrics(struct i915_perf *perf) 358 { 359 struct i915_oa_config *tmp; 360 size_t i; 361 int id; 362 363 i = 1; 364 rcu_read_lock(); 365 idr_for_each_entry(&perf->metrics_idr, tmp, id) 366 i++; 367 rcu_read_unlock(); 368 369 return sizeof_perf_config_list(i); 370 } 371 372 static int query_perf_config_list(struct drm_i915_private *i915, 373 struct drm_i915_query_item *query_item) 374 { 375 struct drm_i915_query_perf_config __user *user_query_config_ptr = 376 u64_to_user_ptr(query_item->data_ptr); 377 struct i915_perf *perf = &i915->perf; 378 u64 *oa_config_ids = NULL; 379 int alloc, n_configs; 380 u32 flags; 381 int ret; 382 383 if (!perf->i915) 384 return -ENODEV; 385 386 if (query_item->length == 0) 387 return sizeof_perf_metrics(perf); 388 389 if (get_user(flags, &user_query_config_ptr->flags)) 390 return -EFAULT; 391 392 if (flags != 0) 393 return -EINVAL; 394 395 n_configs = 1; 396 do { 397 struct i915_oa_config *tmp; 398 u64 *ids; 399 int id; 400 401 #ifdef __linux__ 402 ids = krealloc(oa_config_ids, 403 n_configs * sizeof(*oa_config_ids), 404 GFP_KERNEL); 405 if (!ids) 406 return -ENOMEM; 407 #else 408 ids = kmalloc(n_configs * sizeof(*oa_config_ids), 409 GFP_KERNEL); 410 if (!ids) 411 return -ENOMEM; 412 if (n_configs > 1) 413 memcpy(ids, oa_config_ids, 414 (n_configs - 1) * sizeof(*oa_config_ids)); 415 kfree(oa_config_ids); 416 #endif 417 418 alloc = fetch_and_zero(&n_configs); 419 420 ids[n_configs++] = 1ull; /* reserved for test_config */ 421 rcu_read_lock(); 422 idr_for_each_entry(&perf->metrics_idr, tmp, id) { 423 if (n_configs < alloc) 424 ids[n_configs] = id; 425 n_configs++; 426 } 427 rcu_read_unlock(); 428 429 oa_config_ids = ids; 430 } while (n_configs > alloc); 431 432 if (query_item->length < sizeof_perf_config_list(n_configs)) { 433 drm_dbg(&i915->drm, 434 "Invalid query config list item size=%u expected=%zu\n", 435 query_item->length, 436 sizeof_perf_config_list(n_configs)); 437 kfree(oa_config_ids); 438 return -EINVAL; 439 } 440 441 if (put_user(n_configs, &user_query_config_ptr->config)) { 442 kfree(oa_config_ids); 443 return -EFAULT; 444 } 445 446 ret = copy_to_user(user_query_config_ptr + 1, 447 oa_config_ids, 448 n_configs * sizeof(*oa_config_ids)); 449 kfree(oa_config_ids); 450 if (ret) 451 return -EFAULT; 452 453 return sizeof_perf_config_list(n_configs); 454 } 455 456 static int query_perf_config(struct drm_i915_private *i915, 457 struct drm_i915_query_item *query_item) 458 { 459 switch (query_item->flags) { 460 case DRM_I915_QUERY_PERF_CONFIG_LIST: 461 return query_perf_config_list(i915, query_item); 462 case DRM_I915_QUERY_PERF_CONFIG_DATA_FOR_UUID: 463 return query_perf_config_data(i915, query_item, true); 464 case DRM_I915_QUERY_PERF_CONFIG_DATA_FOR_ID: 465 return query_perf_config_data(i915, query_item, false); 466 default: 467 return -EINVAL; 468 } 469 } 470 471 static int query_memregion_info(struct drm_i915_private *i915, 472 struct drm_i915_query_item *query_item) 473 { 474 struct drm_i915_query_memory_regions __user *query_ptr = 475 u64_to_user_ptr(query_item->data_ptr); 476 struct drm_i915_memory_region_info __user *info_ptr = 477 &query_ptr->regions[0]; 478 struct drm_i915_memory_region_info info = { }; 479 struct drm_i915_query_memory_regions query; 480 struct intel_memory_region *mr; 481 u32 total_length; 482 int ret, id, i; 483 484 if (query_item->flags != 0) 485 return -EINVAL; 486 487 total_length = sizeof(query); 488 for_each_memory_region(mr, i915, id) { 489 if (mr->private) 490 continue; 491 492 total_length += sizeof(info); 493 } 494 495 ret = copy_query_item(&query, sizeof(query), total_length, query_item); 496 if (ret != 0) 497 return ret; 498 499 if (query.num_regions) 500 return -EINVAL; 501 502 for (i = 0; i < ARRAY_SIZE(query.rsvd); i++) { 503 if (query.rsvd[i]) 504 return -EINVAL; 505 } 506 507 for_each_memory_region(mr, i915, id) { 508 if (mr->private) 509 continue; 510 511 info.region.memory_class = mr->type; 512 info.region.memory_instance = mr->instance; 513 info.probed_size = mr->total; 514 515 if (mr->type == INTEL_MEMORY_LOCAL) 516 info.probed_cpu_visible_size = resource_size(&mr->io); 517 else 518 info.probed_cpu_visible_size = mr->total; 519 520 if (perfmon_capable()) { 521 intel_memory_region_avail(mr, 522 &info.unallocated_size, 523 &info.unallocated_cpu_visible_size); 524 } else { 525 info.unallocated_size = info.probed_size; 526 info.unallocated_cpu_visible_size = 527 info.probed_cpu_visible_size; 528 } 529 530 if (__copy_to_user(info_ptr, &info, sizeof(info))) 531 return -EFAULT; 532 533 query.num_regions++; 534 info_ptr++; 535 } 536 537 if (__copy_to_user(query_ptr, &query, sizeof(query))) 538 return -EFAULT; 539 540 return total_length; 541 } 542 543 static int query_hwconfig_blob(struct drm_i915_private *i915, 544 struct drm_i915_query_item *query_item) 545 { 546 struct intel_gt *gt = to_gt(i915); 547 struct intel_hwconfig *hwconfig = >->info.hwconfig; 548 549 if (!hwconfig->size || !hwconfig->ptr) 550 return -ENODEV; 551 552 if (query_item->length == 0) 553 return hwconfig->size; 554 555 if (query_item->length < hwconfig->size) 556 return -EINVAL; 557 558 if (copy_to_user(u64_to_user_ptr(query_item->data_ptr), 559 hwconfig->ptr, hwconfig->size)) 560 return -EFAULT; 561 562 return hwconfig->size; 563 } 564 565 static int (* const i915_query_funcs[])(struct drm_i915_private *dev_priv, 566 struct drm_i915_query_item *query_item) = { 567 query_topology_info, 568 query_engine_info, 569 query_perf_config, 570 query_memregion_info, 571 query_hwconfig_blob, 572 query_geometry_subslices, 573 }; 574 575 int i915_query_ioctl(struct drm_device *dev, void *data, struct drm_file *file) 576 { 577 struct drm_i915_private *dev_priv = to_i915(dev); 578 struct drm_i915_query *args = data; 579 struct drm_i915_query_item __user *user_item_ptr = 580 u64_to_user_ptr(args->items_ptr); 581 u32 i; 582 583 if (args->flags != 0) 584 return -EINVAL; 585 586 for (i = 0; i < args->num_items; i++, user_item_ptr++) { 587 struct drm_i915_query_item item; 588 unsigned long func_idx; 589 int ret; 590 591 if (copy_from_user(&item, user_item_ptr, sizeof(item))) 592 return -EFAULT; 593 594 if (item.query_id == 0) 595 return -EINVAL; 596 597 if (overflows_type(item.query_id - 1, unsigned long)) 598 return -EINVAL; 599 600 func_idx = item.query_id - 1; 601 602 ret = -EINVAL; 603 if (func_idx < ARRAY_SIZE(i915_query_funcs)) { 604 func_idx = array_index_nospec(func_idx, 605 ARRAY_SIZE(i915_query_funcs)); 606 ret = i915_query_funcs[func_idx](dev_priv, &item); 607 } 608 609 /* Only write the length back to userspace if they differ. */ 610 if (ret != item.length && put_user(ret, &user_item_ptr->length)) 611 return -EFAULT; 612 } 613 614 return 0; 615 } 616