1 /* 2 * SPDX-License-Identifier: MIT 3 * 4 * Copyright © 2018 Intel Corporation 5 */ 6 7 #include <linux/nospec.h> 8 9 #include "i915_drv.h" 10 #include "i915_query.h" 11 #include <uapi/drm/i915_drm.h> 12 13 static int query_topology_info(struct drm_i915_private *dev_priv, 14 struct drm_i915_query_item *query_item) 15 { 16 const struct sseu_dev_info *sseu = &INTEL_INFO(dev_priv)->sseu; 17 struct drm_i915_query_topology_info topo; 18 u32 slice_length, subslice_length, eu_length, total_length; 19 20 if (query_item->flags != 0) 21 return -EINVAL; 22 23 if (sseu->max_slices == 0) 24 return -ENODEV; 25 26 BUILD_BUG_ON(sizeof(u8) != sizeof(sseu->slice_mask)); 27 28 slice_length = sizeof(sseu->slice_mask); 29 subslice_length = sseu->max_slices * 30 DIV_ROUND_UP(sseu->max_subslices, 31 sizeof(sseu->subslice_mask[0]) * BITS_PER_BYTE); 32 eu_length = sseu->max_slices * sseu->max_subslices * 33 DIV_ROUND_UP(sseu->max_eus_per_subslice, BITS_PER_BYTE); 34 35 total_length = sizeof(topo) + slice_length + subslice_length + eu_length; 36 37 if (query_item->length == 0) 38 return total_length; 39 40 if (query_item->length < total_length) 41 return -EINVAL; 42 43 if (copy_from_user(&topo, u64_to_user_ptr(query_item->data_ptr), 44 sizeof(topo))) 45 return -EFAULT; 46 47 if (topo.flags != 0) 48 return -EINVAL; 49 50 if (!access_ok(VERIFY_WRITE, u64_to_user_ptr(query_item->data_ptr), 51 total_length)) 52 return -EFAULT; 53 54 memset(&topo, 0, sizeof(topo)); 55 topo.max_slices = sseu->max_slices; 56 topo.max_subslices = sseu->max_subslices; 57 topo.max_eus_per_subslice = sseu->max_eus_per_subslice; 58 59 topo.subslice_offset = slice_length; 60 topo.subslice_stride = DIV_ROUND_UP(sseu->max_subslices, BITS_PER_BYTE); 61 topo.eu_offset = slice_length + subslice_length; 62 topo.eu_stride = 63 DIV_ROUND_UP(sseu->max_eus_per_subslice, BITS_PER_BYTE); 64 65 if (__copy_to_user(u64_to_user_ptr(query_item->data_ptr), 66 &topo, sizeof(topo))) 67 return -EFAULT; 68 69 if (__copy_to_user(u64_to_user_ptr(query_item->data_ptr + sizeof(topo)), 70 &sseu->slice_mask, slice_length)) 71 return -EFAULT; 72 73 if (__copy_to_user(u64_to_user_ptr(query_item->data_ptr + 74 sizeof(topo) + slice_length), 75 sseu->subslice_mask, subslice_length)) 76 return -EFAULT; 77 78 if (__copy_to_user(u64_to_user_ptr(query_item->data_ptr + 79 sizeof(topo) + 80 slice_length + subslice_length), 81 sseu->eu_mask, eu_length)) 82 return -EFAULT; 83 84 return total_length; 85 } 86 87 static int (* const i915_query_funcs[])(struct drm_i915_private *dev_priv, 88 struct drm_i915_query_item *query_item) = { 89 query_topology_info, 90 }; 91 92 int i915_query_ioctl(struct drm_device *dev, void *data, struct drm_file *file) 93 { 94 struct drm_i915_private *dev_priv = to_i915(dev); 95 struct drm_i915_query *args = data; 96 struct drm_i915_query_item __user *user_item_ptr = 97 u64_to_user_ptr(args->items_ptr); 98 u32 i; 99 100 if (args->flags != 0) 101 return -EINVAL; 102 103 for (i = 0; i < args->num_items; i++, user_item_ptr++) { 104 struct drm_i915_query_item item; 105 unsigned long func_idx; 106 int ret; 107 108 if (copy_from_user(&item, user_item_ptr, sizeof(item))) 109 return -EFAULT; 110 111 if (item.query_id == 0) 112 return -EINVAL; 113 114 if (overflows_type(item.query_id - 1, unsigned long)) 115 return -EINVAL; 116 117 func_idx = item.query_id - 1; 118 119 ret = -EINVAL; 120 if (func_idx < ARRAY_SIZE(i915_query_funcs)) { 121 func_idx = array_index_nospec(func_idx, 122 ARRAY_SIZE(i915_query_funcs)); 123 ret = i915_query_funcs[func_idx](dev_priv, &item); 124 } 125 126 /* Only write the length back to userspace if they differ. */ 127 if (ret != item.length && put_user(ret, &user_item_ptr->length)) 128 return -EFAULT; 129 } 130 131 return 0; 132 } 133