1// SPDX-License-Identifier: GPL-2.0-only
2/*
3 * Copyright (C) 2013 Red Hat
4 * Author: Rob Clark <robdclark@gmail.com>
5 */
6
7/* For debugging crashes, userspace can:
8 *
9 *   tail -f /sys/kernel/debug/dri/<minor>/rd > logfile.rd
10 *
11 * to log the cmdstream in a format that is understood by freedreno/cffdump
12 * utility.  By comparing the last successfully completed fence #, to the
13 * cmdstream for the next fence, you can narrow down which process and submit
14 * caused the gpu crash/lockup.
15 *
16 * Additionally:
17 *
18 *   tail -f /sys/kernel/debug/dri/<minor>/hangrd > logfile.rd
19 *
20 * will capture just the cmdstream from submits which triggered a GPU hang.
21 *
22 * This bypasses drm_debugfs_create_files() mainly because we need to use
23 * our own fops for a bit more control.  In particular, we don't want to
24 * do anything if userspace doesn't have the debugfs file open.
25 *
26 * The module-param "rd_full", which defaults to false, enables snapshotting
27 * all (non-written) buffers in the submit, rather than just cmdstream bo's.
28 * This is useful to capture the contents of (for example) vbo's or textures,
29 * or shader programs (if not emitted inline in cmdstream).
30 */
31
32#include <linux/circ_buf.h>
33#include <linux/debugfs.h>
34#include <linux/kfifo.h>
35#include <linux/uaccess.h>
36#include <linux/wait.h>
37
38#include <drm/drm_file.h>
39
40#include "msm_drv.h"
41#include "msm_gpu.h"
42#include "msm_gem.h"
43
44bool rd_full = false;
45MODULE_PARM_DESC(rd_full, "If true, $debugfs/.../rd will snapshot all buffer contents");
46module_param_named(rd_full, rd_full, bool, 0600);
47
48#ifdef CONFIG_DEBUG_FS
49
50enum rd_sect_type {
51	RD_NONE,
52	RD_TEST,       /* ascii text */
53	RD_CMD,        /* ascii text */
54	RD_GPUADDR,    /* u32 gpuaddr, u32 size */
55	RD_CONTEXT,    /* raw dump */
56	RD_CMDSTREAM,  /* raw dump */
57	RD_CMDSTREAM_ADDR, /* gpu addr of cmdstream */
58	RD_PARAM,      /* u32 param_type, u32 param_val, u32 bitlen */
59	RD_FLUSH,      /* empty, clear previous params */
60	RD_PROGRAM,    /* shader program, raw dump */
61	RD_VERT_SHADER,
62	RD_FRAG_SHADER,
63	RD_BUFFER_CONTENTS,
64	RD_GPU_ID,
65};
66
67#define BUF_SZ 512  /* should be power of 2 */
68
69/* space used: */
70#define circ_count(circ) \
71	(CIRC_CNT((circ)->head, (circ)->tail, BUF_SZ))
72#define circ_count_to_end(circ) \
73	(CIRC_CNT_TO_END((circ)->head, (circ)->tail, BUF_SZ))
74/* space available: */
75#define circ_space(circ) \
76	(CIRC_SPACE((circ)->head, (circ)->tail, BUF_SZ))
77#define circ_space_to_end(circ) \
78	(CIRC_SPACE_TO_END((circ)->head, (circ)->tail, BUF_SZ))
79
80struct msm_rd_state {
81	struct drm_device *dev;
82
83	bool open;
84
85	/* current submit to read out: */
86	struct msm_gem_submit *submit;
87
88	/* fifo access is synchronized on the producer side by
89	 * struct_mutex held by submit code (otherwise we could
90	 * end up w/ cmds logged in different order than they
91	 * were executed).  And read_lock synchronizes the reads
92	 */
93	struct mutex read_lock;
94
95	wait_queue_head_t fifo_event;
96	struct circ_buf fifo;
97
98	char buf[BUF_SZ];
99};
100
101static void rd_write(struct msm_rd_state *rd, const void *buf, int sz)
102{
103	struct circ_buf *fifo = &rd->fifo;
104	const char *ptr = buf;
105
106	while (sz > 0) {
107		char *fptr = &fifo->buf[fifo->head];
108		int n;
109
110		wait_event(rd->fifo_event, circ_space(&rd->fifo) > 0 || !rd->open);
111		if (!rd->open)
112			return;
113
114		/* Note that smp_load_acquire() is not strictly required
115		 * as CIRC_SPACE_TO_END() does not access the tail more
116		 * than once.
117		 */
118		n = min(sz, circ_space_to_end(&rd->fifo));
119		memcpy(fptr, ptr, n);
120
121		smp_store_release(&fifo->head, (fifo->head + n) & (BUF_SZ - 1));
122		sz  -= n;
123		ptr += n;
124
125		wake_up_all(&rd->fifo_event);
126	}
127}
128
129static void rd_write_section(struct msm_rd_state *rd,
130		enum rd_sect_type type, const void *buf, int sz)
131{
132	rd_write(rd, &type, 4);
133	rd_write(rd, &sz, 4);
134	rd_write(rd, buf, sz);
135}
136
137static ssize_t rd_read(struct file *file, char __user *buf,
138		size_t sz, loff_t *ppos)
139{
140	struct msm_rd_state *rd = file->private_data;
141	struct circ_buf *fifo = &rd->fifo;
142	const char *fptr = &fifo->buf[fifo->tail];
143	int n = 0, ret = 0;
144
145	mutex_lock(&rd->read_lock);
146
147	ret = wait_event_interruptible(rd->fifo_event,
148			circ_count(&rd->fifo) > 0);
149	if (ret)
150		goto out;
151
152	/* Note that smp_load_acquire() is not strictly required
153	 * as CIRC_CNT_TO_END() does not access the head more than
154	 * once.
155	 */
156	n = min_t(int, sz, circ_count_to_end(&rd->fifo));
157	if (copy_to_user(buf, fptr, n)) {
158		ret = -EFAULT;
159		goto out;
160	}
161
162	smp_store_release(&fifo->tail, (fifo->tail + n) & (BUF_SZ - 1));
163	*ppos += n;
164
165	wake_up_all(&rd->fifo_event);
166
167out:
168	mutex_unlock(&rd->read_lock);
169	if (ret)
170		return ret;
171	return n;
172}
173
174static int rd_open(struct inode *inode, struct file *file)
175{
176	struct msm_rd_state *rd = inode->i_private;
177	struct drm_device *dev = rd->dev;
178	struct msm_drm_private *priv = dev->dev_private;
179	struct msm_gpu *gpu = priv->gpu;
180	uint64_t val;
181	uint32_t gpu_id;
182	int ret = 0;
183
184	mutex_lock(&dev->struct_mutex);
185
186	if (rd->open || !gpu) {
187		ret = -EBUSY;
188		goto out;
189	}
190
191	file->private_data = rd;
192	rd->open = true;
193
194	/* Reset fifo to clear any previously unread data: */
195	rd->fifo.head = rd->fifo.tail = 0;
196
197	/* the parsing tools need to know gpu-id to know which
198	 * register database to load.
199	 */
200	gpu->funcs->get_param(gpu, MSM_PARAM_GPU_ID, &val);
201	gpu_id = val;
202
203	rd_write_section(rd, RD_GPU_ID, &gpu_id, sizeof(gpu_id));
204
205out:
206	mutex_unlock(&dev->struct_mutex);
207	return ret;
208}
209
210static int rd_release(struct inode *inode, struct file *file)
211{
212	struct msm_rd_state *rd = inode->i_private;
213
214	rd->open = false;
215	wake_up_all(&rd->fifo_event);
216
217	return 0;
218}
219
220
221static const struct file_operations rd_debugfs_fops = {
222	.owner = THIS_MODULE,
223	.open = rd_open,
224	.read = rd_read,
225	.llseek = no_llseek,
226	.release = rd_release,
227};
228
229
230static void rd_cleanup(struct msm_rd_state *rd)
231{
232	if (!rd)
233		return;
234
235	mutex_destroy(&rd->read_lock);
236	kfree(rd);
237}
238
239static struct msm_rd_state *rd_init(struct drm_minor *minor, const char *name)
240{
241	struct msm_rd_state *rd;
242
243	rd = kzalloc(sizeof(*rd), GFP_KERNEL);
244	if (!rd)
245		return ERR_PTR(-ENOMEM);
246
247	rd->dev = minor->dev;
248	rd->fifo.buf = rd->buf;
249
250	mutex_init(&rd->read_lock);
251
252	init_waitqueue_head(&rd->fifo_event);
253
254	debugfs_create_file(name, S_IFREG | S_IRUGO, minor->debugfs_root, rd,
255			    &rd_debugfs_fops);
256
257	return rd;
258}
259
260int msm_rd_debugfs_init(struct drm_minor *minor)
261{
262	struct msm_drm_private *priv = minor->dev->dev_private;
263	struct msm_rd_state *rd;
264	int ret;
265
266	/* only create on first minor: */
267	if (priv->rd)
268		return 0;
269
270	rd = rd_init(minor, "rd");
271	if (IS_ERR(rd)) {
272		ret = PTR_ERR(rd);
273		goto fail;
274	}
275
276	priv->rd = rd;
277
278	rd = rd_init(minor, "hangrd");
279	if (IS_ERR(rd)) {
280		ret = PTR_ERR(rd);
281		goto fail;
282	}
283
284	priv->hangrd = rd;
285
286	return 0;
287
288fail:
289	msm_rd_debugfs_cleanup(priv);
290	return ret;
291}
292
293void msm_rd_debugfs_cleanup(struct msm_drm_private *priv)
294{
295	rd_cleanup(priv->rd);
296	priv->rd = NULL;
297
298	rd_cleanup(priv->hangrd);
299	priv->hangrd = NULL;
300}
301
302static void snapshot_buf(struct msm_rd_state *rd,
303		struct msm_gem_submit *submit, int idx,
304		uint64_t iova, uint32_t size, bool full)
305{
306	struct msm_gem_object *obj = submit->bos[idx].obj;
307	unsigned offset = 0;
308	const char *buf;
309
310	if (iova) {
311		offset = iova - submit->bos[idx].iova;
312	} else {
313		iova = submit->bos[idx].iova;
314		size = obj->base.size;
315	}
316
317	/*
318	 * Always write the GPUADDR header so can get a complete list of all the
319	 * buffers in the cmd
320	 */
321	rd_write_section(rd, RD_GPUADDR,
322			(uint32_t[3]){ iova, size, iova >> 32 }, 12);
323
324	if (!full)
325		return;
326
327	/* But only dump the contents of buffers marked READ */
328	if (!(submit->bos[idx].flags & MSM_SUBMIT_BO_READ))
329		return;
330
331	buf = msm_gem_get_vaddr_active(&obj->base);
332	if (IS_ERR(buf))
333		return;
334
335	buf += offset;
336
337	rd_write_section(rd, RD_BUFFER_CONTENTS, buf, size);
338
339	msm_gem_put_vaddr(&obj->base);
340}
341
342/* called under struct_mutex */
343void msm_rd_dump_submit(struct msm_rd_state *rd, struct msm_gem_submit *submit,
344		const char *fmt, ...)
345{
346	struct drm_device *dev = submit->dev;
347	struct task_struct *task;
348	char msg[256];
349	int i, n;
350
351	if (!rd->open)
352		return;
353
354	/* writing into fifo is serialized by caller, and
355	 * rd->read_lock is used to serialize the reads
356	 */
357	WARN_ON(!mutex_is_locked(&dev->struct_mutex));
358
359	if (fmt) {
360		va_list args;
361
362		va_start(args, fmt);
363		n = vscnprintf(msg, sizeof(msg), fmt, args);
364		va_end(args);
365
366		rd_write_section(rd, RD_CMD, msg, ALIGN(n, 4));
367	}
368
369	rcu_read_lock();
370	task = pid_task(submit->pid, PIDTYPE_PID);
371	if (task) {
372		n = scnprintf(msg, sizeof(msg), "%.*s/%d: fence=%u",
373				TASK_COMM_LEN, task->comm,
374				pid_nr(submit->pid), submit->seqno);
375	} else {
376		n = scnprintf(msg, sizeof(msg), "???/%d: fence=%u",
377				pid_nr(submit->pid), submit->seqno);
378	}
379	rcu_read_unlock();
380
381	rd_write_section(rd, RD_CMD, msg, ALIGN(n, 4));
382
383	for (i = 0; i < submit->nr_bos; i++)
384		snapshot_buf(rd, submit, i, 0, 0, should_dump(submit, i));
385
386	for (i = 0; i < submit->nr_cmds; i++) {
387		uint32_t szd  = submit->cmd[i].size; /* in dwords */
388
389		/* snapshot cmdstream bo's (if we haven't already): */
390		if (!should_dump(submit, i)) {
391			snapshot_buf(rd, submit, submit->cmd[i].idx,
392					submit->cmd[i].iova, szd * 4, true);
393		}
394	}
395
396	for (i = 0; i < submit->nr_cmds; i++) {
397		uint64_t iova = submit->cmd[i].iova;
398		uint32_t szd  = submit->cmd[i].size; /* in dwords */
399
400		switch (submit->cmd[i].type) {
401		case MSM_SUBMIT_CMD_IB_TARGET_BUF:
402			/* ignore IB-targets, we've logged the buffer, the
403			 * parser tool will follow the IB based on the logged
404			 * buffer/gpuaddr, so nothing more to do.
405			 */
406			break;
407		case MSM_SUBMIT_CMD_CTX_RESTORE_BUF:
408		case MSM_SUBMIT_CMD_BUF:
409			rd_write_section(rd, RD_CMDSTREAM_ADDR,
410				(uint32_t[3]){ iova, szd, iova >> 32 }, 12);
411			break;
412		}
413	}
414}
415#endif
416