samsung-sm8650/android_kernel_samsung_sm8650-modules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

disp: msm: sde: avoid sde debugfs register access based on HW ownership

Browse Source 
Add VM ownership checks before accessing the HW through the debugfs
path in sde crtc/encoder/connector modules to avoid illegal access.

Change-Id: I4ff8f29353835d263beb2091bdeec40125addbf8
Signed-off-by: Veera Sundaram Sankaran <veeras@codeaurora.org>
This commit is contained in:
Veera Sundaram Sankaran
2020-12-08 15:34:17 -08:00
committed by Dhaval Patel
parent a40c87b676
commit d26e510b77
3 changed files with 40 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

18
msm/sde/sde_connector.c
View File

@@ -1978,6 +1978,8 @@ static ssize_t _sde_debugfs_conn_cmd_tx_write(struct file *file,
{
struct drm_connector *connector = file->private_data;
struct sde_connector *c_conn = NULL;
struct sde_vm_ops *vm_ops;
struct sde_kms *sde_kms;
char *input, *token, *input_copy, *input_dup = NULL;
const char *delim = " ";
char buffer[MAX_CMD_PAYLOAD_SIZE] = {0};
@@ -1988,9 +1990,14 @@ static ssize_t _sde_debugfs_conn_cmd_tx_write(struct file *file,
SDE_ERROR("invalid argument(s), conn %d\n", connector != NULL);
return -EINVAL;
}
c_conn = to_sde_connector(connector);
sde_kms = _sde_connector_get_kms(&c_conn->base);
if (!sde_kms) {
SDE_ERROR("invalid kms\n");
return -EINVAL;
}
if (!c_conn->ops.cmd_transfer) {
SDE_ERROR("no cmd transfer support for connector name %s\n",
c_conn->name);
@@ -2001,6 +2008,14 @@ static ssize_t _sde_debugfs_conn_cmd_tx_write(struct file *file,
if (!input)
return -ENOMEM;
vm_ops = sde_vm_get_ops(sde_kms);
sde_vm_lock(sde_kms);
if (vm_ops && vm_ops->vm_owns_hw && !vm_ops->vm_owns_hw(sde_kms)) {
SDE_DEBUG("op not supported due to HW unavailablity\n");
rc = -EOPNOTSUPP;
goto end;
}
if (copy_from_user(input, p, count)) {
SDE_ERROR("copy from user failed\n");
rc = -EFAULT;
@@ -2050,6 +2065,7 @@ static ssize_t _sde_debugfs_conn_cmd_tx_write(struct file *file,
end1:
kfree(input_dup);
end:
sde_vm_unlock(sde_kms);
kfree(input);
return rc;
}

12
msm/sde/sde_crtc.c
View File

@@ -41,6 +41,7 @@
#include "sde_core_perf.h"
#include "sde_trace.h"
#include "msm_drv.h"
#include "sde_vm.h"
#define SDE_PSTATES_MAX (SDE_STAGE_MAX * 4)
#define SDE_MULTIRECT_PLANE_MAX (SDE_STAGE_MAX * 2)
@@ -6272,6 +6273,7 @@ static ssize_t _sde_crtc_misr_read(struct file *file,
struct sde_crtc *sde_crtc;
struct sde_kms *sde_kms;
struct sde_crtc_mixer *m;
struct sde_vm_ops *vm_ops;
int i = 0, rc;
ssize_t len = 0;
char buf[MISR_BUFF_SIZE + 1] = {'\0'};
@@ -6292,8 +6294,17 @@ static ssize_t _sde_crtc_misr_read(struct file *file,
if (rc < 0)
return rc;
vm_ops = sde_vm_get_ops(sde_kms);
sde_vm_lock(sde_kms);
if (vm_ops && vm_ops->vm_owns_hw && !vm_ops->vm_owns_hw(sde_kms)) {
SDE_DEBUG("op not supported due to HW unavailability\n");
rc = -EOPNOTSUPP;
goto end;
}
if (sde_kms_is_secure_session_inprogress(sde_kms)) {
SDE_DEBUG("crtc:%d misr read not allowed\n", DRMID(crtc));
rc = -EOPNOTSUPP;
goto end;
}
@@ -6343,6 +6354,7 @@ buff_check:
*ppos += len; /* increase offset */
end:
sde_vm_unlock(sde_kms);
pm_runtime_put_sync(crtc->dev->dev);
return len;
}

11
msm/sde/sde_encoder.c
View File

@@ -41,6 +41,7 @@
#include "sde_hw_top.h"
#include "sde_hw_qdss.h"
#include "sde_encoder_dce.h"
#include "sde_vm.h"
#define SDE_DEBUG_ENC(e, fmt, ...) SDE_DEBUG("enc%d " fmt,\
(e) ? (e)->base.base.id : -1, ##__VA_ARGS__)
@@ -4608,6 +4609,7 @@ static ssize_t _sde_encoder_misr_read(struct file *file,
struct sde_encoder_virt *sde_enc;
struct sde_kms *sde_kms = NULL;
struct drm_encoder *drm_enc;
struct sde_vm_ops *vm_ops;
int i = 0, len = 0;
char buf[MISR_BUFF_SIZE + 1] = {'\0'};
int rc;
@@ -4633,6 +4635,14 @@ static ssize_t _sde_encoder_misr_read(struct file *file,
if (rc < 0)
return rc;
vm_ops = sde_vm_get_ops(sde_kms);
sde_vm_lock(sde_kms);
if (vm_ops && vm_ops->vm_owns_hw && !vm_ops->vm_owns_hw(sde_kms)) {
SDE_DEBUG("op not supported due to HW unavailablity\n");
rc = -EOPNOTSUPP;
goto end;
}
if (!sde_enc->misr_enable) {
len += scnprintf(buf + len, MISR_BUFF_SIZE - len,
"disabled\n");
@@ -4680,6 +4690,7 @@ buff_check:
*ppos += len; /* increase offset */
end:
sde_vm_unlock(sde_kms);
pm_runtime_put_sync(drm_enc->dev->dev);
return len;
}