1/*
  2 * SPDX-License-Identifier: MIT
  3 *
  4 * Copyright © 2018 Intel Corporation
  5 */
  6
  7#include <linux/nospec.h>
  8
  9#include "i915_drv.h"
 10#include "i915_query.h"
 11#include <uapi/drm/i915_drm.h>
 12
 13static int query_topology_info(struct drm_i915_private *dev_priv,
 14			       struct drm_i915_query_item *query_item)
 15{
 16	const struct sseu_dev_info *sseu = &INTEL_INFO(dev_priv)->sseu;
 17	struct drm_i915_query_topology_info topo;
 18	u32 slice_length, subslice_length, eu_length, total_length;
 19
 20	if (query_item->flags != 0)
 21		return -EINVAL;
 22
 23	if (sseu->max_slices == 0)
 24		return -ENODEV;
 25
 26	BUILD_BUG_ON(sizeof(u8) != sizeof(sseu->slice_mask));
 27
 28	slice_length = sizeof(sseu->slice_mask);
 29	subslice_length = sseu->max_slices *
 30		DIV_ROUND_UP(sseu->max_subslices,
 31			     sizeof(sseu->subslice_mask[0]) * BITS_PER_BYTE);
 32	eu_length = sseu->max_slices * sseu->max_subslices *
 33		DIV_ROUND_UP(sseu->max_eus_per_subslice, BITS_PER_BYTE);
 34
 35	total_length = sizeof(topo) + slice_length + subslice_length + eu_length;
 36
 37	if (query_item->length == 0)
 38		return total_length;
 39
 40	if (query_item->length < total_length)
 41		return -EINVAL;
 42
 43	if (copy_from_user(&topo, u64_to_user_ptr(query_item->data_ptr),
 44			   sizeof(topo)))
 45		return -EFAULT;
 46
 47	if (topo.flags != 0)
 48		return -EINVAL;
 49
 50	if (!access_ok(VERIFY_WRITE, u64_to_user_ptr(query_item->data_ptr),
 51		       total_length))
 52		return -EFAULT;
 53
 54	memset(&topo, 0, sizeof(topo));
 55	topo.max_slices = sseu->max_slices;
 56	topo.max_subslices = sseu->max_subslices;
 57	topo.max_eus_per_subslice = sseu->max_eus_per_subslice;
 58
 59	topo.subslice_offset = slice_length;
 60	topo.subslice_stride = DIV_ROUND_UP(sseu->max_subslices, BITS_PER_BYTE);
 61	topo.eu_offset = slice_length + subslice_length;
 62	topo.eu_stride =
 63		DIV_ROUND_UP(sseu->max_eus_per_subslice, BITS_PER_BYTE);
 64
 65	if (__copy_to_user(u64_to_user_ptr(query_item->data_ptr),
 66			   &topo, sizeof(topo)))
 67		return -EFAULT;
 68
 69	if (__copy_to_user(u64_to_user_ptr(query_item->data_ptr + sizeof(topo)),
 70			   &sseu->slice_mask, slice_length))
 71		return -EFAULT;
 72
 73	if (__copy_to_user(u64_to_user_ptr(query_item->data_ptr +
 74					   sizeof(topo) + slice_length),
 75			   sseu->subslice_mask, subslice_length))
 76		return -EFAULT;
 77
 78	if (__copy_to_user(u64_to_user_ptr(query_item->data_ptr +
 79					   sizeof(topo) +
 80					   slice_length + subslice_length),
 81			   sseu->eu_mask, eu_length))
 82		return -EFAULT;
 83
 84	return total_length;
 85}
 86
 87static int (* const i915_query_funcs[])(struct drm_i915_private *dev_priv,
 88					struct drm_i915_query_item *query_item) = {
 89	query_topology_info,
 90};
 91
 92int i915_query_ioctl(struct drm_device *dev, void *data, struct drm_file *file)
 93{
 94	struct drm_i915_private *dev_priv = to_i915(dev);
 95	struct drm_i915_query *args = data;
 96	struct drm_i915_query_item __user *user_item_ptr =
 97		u64_to_user_ptr(args->items_ptr);
 98	u32 i;
 99
100	if (args->flags != 0)
101		return -EINVAL;
102
103	for (i = 0; i < args->num_items; i++, user_item_ptr++) {
104		struct drm_i915_query_item item;
105		unsigned long func_idx;
106		int ret;
107
108		if (copy_from_user(&item, user_item_ptr, sizeof(item)))
109			return -EFAULT;
110
111		if (item.query_id == 0)
112			return -EINVAL;
113
114		if (overflows_type(item.query_id - 1, unsigned long))
115			return -EINVAL;
116
117		func_idx = item.query_id - 1;
118
119		ret = -EINVAL;
120		if (func_idx < ARRAY_SIZE(i915_query_funcs)) {
121			func_idx = array_index_nospec(func_idx,
122						      ARRAY_SIZE(i915_query_funcs));
123			ret = i915_query_funcs[func_idx](dev_priv, &item);
124		}
125
126		/* Only write the length back to userspace if they differ. */
127		if (ret != item.length && put_user(ret, &user_item_ptr->length))
128			return -EFAULT;
129	}
130
131	return 0;
132}