samsung-sm8650/android_kernel_samsung_sm8650-modules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

disp: msm: sde: avoid sde debugfs register access based on HW ownership

Browse Source 
Add VM ownership checks before accessing the HW through the debugfs
path in sde crtc/encoder/connector modules to avoid illegal access.

Change-Id: I4ff8f29353835d263beb2091bdeec40125addbf8
Signed-off-by: Veera Sundaram Sankaran <veeras@codeaurora.org>
This commit is contained in:
Veera Sundaram Sankaran
2020-12-08 15:34:17 -08:00
committed by Dhaval Patel
parent a40c87b676
commit d26e510b77
3 changed files with 40 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

18
msm/sde/sde_connector.c
View File

@@ -1978,6 +1978,8 @@ static ssize_t _sde_debugfs_conn_cmd_tx_write(struct file *file,
{ {
struct drm_connector *connector = file->private_data; struct drm_connector *connector = file->private_data;
struct sde_connector *c_conn = NULL; struct sde_connector *c_conn = NULL;
struct sde_vm_ops *vm_ops;
struct sde_kms *sde_kms;
char *input, *token, *input_copy, *input_dup = NULL; char *input, *token, *input_copy, *input_dup = NULL;
const char *delim = " "; const char *delim = " ";
char buffer[MAX_CMD_PAYLOAD_SIZE] = {0}; char buffer[MAX_CMD_PAYLOAD_SIZE] = {0};
@@ -1988,9 +1990,14 @@ static ssize_t _sde_debugfs_conn_cmd_tx_write(struct file *file,
SDE_ERROR("invalid argument(s), conn %d\n", connector != NULL); SDE_ERROR("invalid argument(s), conn %d\n", connector != NULL);
return -EINVAL; return -EINVAL;
} }
c_conn = to_sde_connector(connector); c_conn = to_sde_connector(connector);
sde_kms = _sde_connector_get_kms(&c_conn->base);
if (!sde_kms) {
SDE_ERROR("invalid kms\n");
return -EINVAL;
}
if (!c_conn->ops.cmd_transfer) { if (!c_conn->ops.cmd_transfer) {
SDE_ERROR("no cmd transfer support for connector name %s\n", SDE_ERROR("no cmd transfer support for connector name %s\n",
c_conn->name); c_conn->name);
@@ -2001,6 +2008,14 @@ static ssize_t _sde_debugfs_conn_cmd_tx_write(struct file *file,
if (!input) if (!input)
return -ENOMEM; return -ENOMEM;
vm_ops = sde_vm_get_ops(sde_kms);
sde_vm_lock(sde_kms);
if (vm_ops && vm_ops->vm_owns_hw && !vm_ops->vm_owns_hw(sde_kms)) {
SDE_DEBUG("op not supported due to HW unavailablity\n");
rc = -EOPNOTSUPP;
goto end;
}
if (copy_from_user(input, p, count)) { if (copy_from_user(input, p, count)) {
SDE_ERROR("copy from user failed\n"); SDE_ERROR("copy from user failed\n");
rc = -EFAULT; rc = -EFAULT;
@@ -2050,6 +2065,7 @@ static ssize_t _sde_debugfs_conn_cmd_tx_write(struct file *file,
end1: end1:
kfree(input_dup); kfree(input_dup);
end: end:
sde_vm_unlock(sde_kms);
kfree(input); kfree(input);
return rc; return rc;
} }

12
msm/sde/sde_crtc.c
View File

@@ -41,6 +41,7 @@
#include "sde_core_perf.h" #include "sde_core_perf.h"
#include "sde_trace.h" #include "sde_trace.h"
#include "msm_drv.h" #include "msm_drv.h"
#include "sde_vm.h"
#define SDE_PSTATES_MAX (SDE_STAGE_MAX * 4) #define SDE_PSTATES_MAX (SDE_STAGE_MAX * 4)
#define SDE_MULTIRECT_PLANE_MAX (SDE_STAGE_MAX * 2) #define SDE_MULTIRECT_PLANE_MAX (SDE_STAGE_MAX * 2)
@@ -6272,6 +6273,7 @@ static ssize_t _sde_crtc_misr_read(struct file *file,
struct sde_crtc *sde_crtc; struct sde_crtc *sde_crtc;
struct sde_kms *sde_kms; struct sde_kms *sde_kms;
struct sde_crtc_mixer *m; struct sde_crtc_mixer *m;
struct sde_vm_ops *vm_ops;
int i = 0, rc; int i = 0, rc;
ssize_t len = 0; ssize_t len = 0;
char buf[MISR_BUFF_SIZE + 1] = {'\0'}; char buf[MISR_BUFF_SIZE + 1] = {'\0'};
@@ -6292,8 +6294,17 @@ static ssize_t _sde_crtc_misr_read(struct file *file,
if (rc < 0) if (rc < 0)
return rc; return rc;
vm_ops = sde_vm_get_ops(sde_kms);
sde_vm_lock(sde_kms);
if (vm_ops && vm_ops->vm_owns_hw && !vm_ops->vm_owns_hw(sde_kms)) {
SDE_DEBUG("op not supported due to HW unavailability\n");
rc = -EOPNOTSUPP;
goto end;
}
if (sde_kms_is_secure_session_inprogress(sde_kms)) { if (sde_kms_is_secure_session_inprogress(sde_kms)) {
SDE_DEBUG("crtc:%d misr read not allowed\n", DRMID(crtc)); SDE_DEBUG("crtc:%d misr read not allowed\n", DRMID(crtc));
rc = -EOPNOTSUPP;
goto end; goto end;
} }
@@ -6343,6 +6354,7 @@ buff_check:
*ppos += len; /* increase offset */ *ppos += len; /* increase offset */
end: end:
sde_vm_unlock(sde_kms);
pm_runtime_put_sync(crtc->dev->dev); pm_runtime_put_sync(crtc->dev->dev);
return len; return len;
} }

11
msm/sde/sde_encoder.c
View File

@@ -41,6 +41,7 @@
#include "sde_hw_top.h" #include "sde_hw_top.h"
#include "sde_hw_qdss.h" #include "sde_hw_qdss.h"
#include "sde_encoder_dce.h" #include "sde_encoder_dce.h"
#include "sde_vm.h"
#define SDE_DEBUG_ENC(e, fmt, ...) SDE_DEBUG("enc%d " fmt,\ #define SDE_DEBUG_ENC(e, fmt, ...) SDE_DEBUG("enc%d " fmt,\
(e) ? (e)->base.base.id : -1, ##__VA_ARGS__) (e) ? (e)->base.base.id : -1, ##__VA_ARGS__)
@@ -4608,6 +4609,7 @@ static ssize_t _sde_encoder_misr_read(struct file *file,
struct sde_encoder_virt *sde_enc; struct sde_encoder_virt *sde_enc;
struct sde_kms *sde_kms = NULL; struct sde_kms *sde_kms = NULL;
struct drm_encoder *drm_enc; struct drm_encoder *drm_enc;
struct sde_vm_ops *vm_ops;
int i = 0, len = 0; int i = 0, len = 0;
char buf[MISR_BUFF_SIZE + 1] = {'\0'}; char buf[MISR_BUFF_SIZE + 1] = {'\0'};
int rc; int rc;
@@ -4633,6 +4635,14 @@ static ssize_t _sde_encoder_misr_read(struct file *file,
if (rc < 0) if (rc < 0)
return rc; return rc;
vm_ops = sde_vm_get_ops(sde_kms);
sde_vm_lock(sde_kms);
if (vm_ops && vm_ops->vm_owns_hw && !vm_ops->vm_owns_hw(sde_kms)) {
SDE_DEBUG("op not supported due to HW unavailablity\n");
rc = -EOPNOTSUPP;
goto end;
}
if (!sde_enc->misr_enable) { if (!sde_enc->misr_enable) {
len += scnprintf(buf + len, MISR_BUFF_SIZE - len, len += scnprintf(buf + len, MISR_BUFF_SIZE - len,
"disabled\n"); "disabled\n");
@@ -4680,6 +4690,7 @@ buff_check:
*ppos += len; /* increase offset */ *ppos += len; /* increase offset */
end: end:
sde_vm_unlock(sde_kms);
pm_runtime_put_sync(drm_enc->dev->dev); pm_runtime_put_sync(drm_enc->dev->dev);
return len; return len;
} }