hostsidetests/securitybulletin/securityPatch/CVE-2016-8431/local_poc.h

/*
 * Copyright (C) 2017 The Android Open Source Project
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 *      http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */
#ifndef __LOCAL_POC_H__
#define __LOCAL_POC_H__

#define SIOCIWFIRSTPRIV 0x8BE0
#define SIOCGIWNAME     0x8B01
#define IOCTL_SET_STRUCT_FOR_EM         (SIOCIWFIRSTPRIV + 11)
#define PRIV_CUSTOM_BWCS_CMD            13
#define PRIV_CMD_OID                    15
#define PRIV_CMD_SW_CTRL                20
#define PRIV_CMD_WSC_PROBE_REQ          22

enum host1x_class {
        HOST1X_CLASS_HOST1X = 0x1,
        HOST1X_CLASS_NVENC = 0x21,
        HOST1X_CLASS_VI = 0x30,
        HOST1X_CLASS_ISPA = 0x32,
        HOST1X_CLASS_ISPB = 0x34,
        HOST1X_CLASS_GR2D = 0x51,
        HOST1X_CLASS_GR2D_SB = 0x52,
        HOST1X_CLASS_VIC = 0x5D,
        HOST1X_CLASS_GR3D = 0x60,
        HOST1X_CLASS_NVJPG = 0xC0,
        HOST1X_CLASS_NVDEC = 0xF0,
};

#define DRM_TEGRA_GEM_CREATE		0x00
#define DRM_COMMAND_BASE                0x40
#define DRM_COMMAND_END                 0xA0

#define DRM_TEGRA_OPEN_CHANNEL          0x05
#define DRM_TEGRA_CLOSE_CHANNEL         0x06
#define DRM_TEGRA_SUBMIT		0x08

struct drm_tegra_open_channel {
        __u32 client;
        __u32 pad;
        __u64 context;
};

struct drm_tegra_close_channel {
        __u64 context;
};

struct drm_tegra_cmdbuf {
	__u32 handle;
	__u32 offset;
	__u32 words;
	__u32 pad;
};

struct host1x_waitchk {
	struct host1x_bo *bo;
	__u32 offset;
	__u32 syncpt_id;
	__u32 thresh;
};

struct drm_tegra_waitchk {
	__u32 handle;
	__u32 offset;
	__u32 syncpt;
	__u32 thresh;
};

struct drm_tegra_submit {
	__u64 context;
	__u32 num_syncpts;
	__u32 num_cmdbufs;
	__u32 num_relocs;
	__u32 num_waitchks;
	__u32 waitchk_mask;
	__u32 timeout;
	__u64 syncpts;
	__u64 cmdbufs;
	__u64 relocs;
	__u64 waitchks;
	__u32 fence;		/* Return value */
	__u32 reserved0;
	__u64 fences;
	__u32 reserved1[2];	/* future expansion */
};

struct drm_tegra_gem_create {
	__u64 size;
	__u32 flags;
	__u32 handle;
};

struct drm_gem_close {
	__u32 handle;
	__u32 pad;
};

struct drm_mode_map_dumb {
	__u32 handle;
	__u32 pad;
	__u64 offset;
};

#define DRM_IOCTL_BASE                  'd'
#define DRM_IOWR(nr,type)       _IOWR(DRM_IOCTL_BASE,nr,type)
#define DRM_IOW(nr,type)		_IOW(DRM_IOCTL_BASE,nr,type)

#define DRM_IOCTL_TEGRA_OPEN_CHANNEL DRM_IOWR(DRM_COMMAND_BASE + DRM_TEGRA_OPEN_CHANNEL, struct drm_tegra_open_channel)
#define DRM_IOCTL_TEGRA_CLOSE_CHANNEL DRM_IOWR(DRM_COMMAND_BASE + DRM_TEGRA_CLOSE_CHANNEL, struct drm_tegra_open_channel)
#define DRM_IOCTL_TEGRA_SUBMIT DRM_IOWR(DRM_COMMAND_BASE + DRM_TEGRA_SUBMIT, struct drm_tegra_submit)
#define DRM_IOCTL_TEGRA_GEM_CREATE DRM_IOWR(DRM_COMMAND_BASE + DRM_TEGRA_GEM_CREATE, struct drm_tegra_gem_create)
#define DRM_IOCTL_GEM_CLOSE		DRM_IOW (0x09, struct drm_gem_close)
#define DRM_IOCTL_MODE_MAP_DUMB    DRM_IOWR(0xB3, struct drm_mode_map_dumb)

struct drm_tegra_syncpt {
	__u32 id;
	__u32 incrs;
};

struct list_head {
	struct list_head *next, *prev;
};

struct kobject {
	const char			*name;
	struct list_head	entry;
	struct kobject		*parent;
	void	*kset;
	void	*ktype;
	void	*sd;
	unsigned long refcount;
	unsigned int state_initialized:1;
	unsigned int state_in_sysfs:1;
	unsigned int state_add_uevent_sent:1;
	unsigned int state_remove_uevent_sent:1;
	unsigned int uevent_suppress:1;
};

struct device {
	struct device	*parent;
	void	*p;
	void*	pad0[8];
	char	*init_name; 
	void	*type;
	void*	pad1[5];
	void	*bus;
	void	*driver;
	void	*platform_data;
	void	*driver_data;
};

struct host1x_info {
	int	nb_channels;		
	int	nb_pts;
	int	nb_bases;
	int	nb_mlocks;
	int	(*init)(void *);
	int	sync_offset;
};

struct host1x_syncpt_ops {
	void (*restore)(void *syncpt);
	void (*restore_wait_base)(void *syncpt);
	void (*load_wait_base)(void *syncpt);
	__u32 (*load)(void *syncpt);
	int (*cpu_incr)(void *syncpt);
	int (*patch_wait)(void *syncpt, void *patch_addr);
};

struct host1x {
	struct host1x_info *info;
	void	*regs;
	void	*syncpt;
	void	*bases;
	struct device *dev;
	void	*clk;
	void	*clk_actmon;
	void*	pad[5];
	void	*intr_wq;
	int intr_syncpt_irq;
	int intr_general_irq;
	__u32 intstatus;
	void (*host_isr[32])(__u32, void *);
	void *host_isr_priv[32];
	struct host1x_syncpt_ops *syncpt_op;
	void	*intr_op;
	void	*channel_op;
	void	*cdma_op;
	void	*cdma_pb_op;
	void	*actmon_op;
	void	*debug_op;
};

struct host1x_client {
	struct list_head list;
	void *parent;
	struct device *dev;
	void *ops;
};

struct tegra_drm_client_ops {
	void* open_channel;
	void* close_channel; 
	void* reset;
	void* is_add_reg;
	void* submit;
};

struct tegra_drm_client {
	unsigned char pad[232];
	struct list_head list;
	struct tegra_drm_client_ops *ops;
};

struct tegra_drm_context {
	struct tegra_drm_client *client;
	void *channel;
	struct list_head list;
};

struct drm_tegra_reloc {
	struct {
		__u32 handle;
		__u32 offset;
	} cmdbuf;
	struct {
		__u32 handle;
		__u32 offset;
	} target;
	__u32 shift;
	__u32 pad;
};

#endif