Increase the max allowed value of base layer pid
from 6 to 63 as per the spec.
Change-Id: Ie51de329a1f67633dd488bc15b3d37101a1a0b33
Signed-off-by: Mahesh Voorugonda <quic_mvoorugo@quicinc.com>
Mahesh Voorugondaauthored and Agnimitra Sencommited 2023-09-21 12:58:08 -07:00
er_ctxt->rp pointer is updated by MDM which is untrusted to HLOS,
it could be arbitrary value.
If there is security issue on MDM, and updated pointer which is not
align then driver will never come out of loop where checking against
dev_rp != rp.
So added check to make sure it is in the buffer range & aligned to 128bit.
Change-Id: Ib484e07f2c75fcd657a4ccc648a3a20de3edeebc
Signed-off-by: Krishna chaitanya chundru <quic_krichai@quicinc.com>
Signed-off-by: Paras Sharma <quic_parass@quicinc.com>
(cherry picked from commit 9a0593979577cb86eebc9503b4bbe3e27f9e195a)
Paras Sharmaauthored and Errikayala Subramanyamcommited 2023-08-24 00:41:09 -07:00
Postamble packets are executed in privileged mode by gpu. So we should keep
them in a privileged scratch buffer to block userspace access. For
targets with APRIV feature support, we can mark the preemption scratch
buffer as privileged too to avoid similar issues in future.
Change-Id: Ifda360dda251083f38dfde80ce1b5dc83daae902
Signed-off-by: Akhil P Oommen <quic_akhilpo@quicinc.com>
Signed-off-by: Kaushal Sanadhya <quic_ksanadhy@quicinc.com>
Akhil P Oommenauthored and Gerrit - the friendly Code Review servercommited 2023-04-18 23:22:17 -07:00
Before putting a page back in the pool be sure that it doesn't have
any additional references that would be a signal that somebody else
is looking at the page and that it would be a bad idea to keep it
around and run the risk of accidentally handing it to a different
process.
Change-Id: Ic0dedbad0cf2ffb34b76ad23e393c5a911114b82
Signed-off-by: Jordan Crouse <jcrouse@codeaurora.org>
Signed-off-by: Harshitha Sai Neelati <quic_hsaineel@quicinc.com>
Harshitha Sai Neelatiauthored and Rajesh Kemisetticommited 2023-03-05 20:20:35 +05:30
Currently we don't ensure if vma->vm_file is associated with dma_buf. This
can cause issues later when private_data from a non dma_buf file is used as
dma_buf structure. Hence get the fd that is associated with vma->vm_file
and use dma_buf_get() to get pointer to dma_buf structure. dma_buf_get()
ensures that the file from the input fd is associated with dma_buf.
Change-Id: Ib78aef8b16bedca5ca86d3a132278ff9f07dce73
Signed-off-by: Puranam V G Tejaswi <quic_pvgtejas@quicinc.com>
Puranam V G Tejaswiauthored and Rajesh Kemisetticommited 2023-03-05 08:43:08 +05:30
Add bounds check on values read from shared memory in the tx path.
In cases where the VM is misbehaving, the ipcrtr fifo xport should
exit and print a warning when bogus values may cause out of bounds to
be read.
Change-Id: I2d219b36a4d7ddb137f232f47f4fe2e662add98d
Signed-off-by: Sarannya S <quic_sarannya@quicinc.com>
Sarannya Sauthored and Gerrit - the friendly Code Review servercommited 2023-01-04 21:42:04 -08:00
Untrusted application can attach to guestOS and staticPD if it can
somehow make INIT IOCTL call with ATTACH flag. This is a potential
security issue as the untrusted application can crash guestOS or
staticPD. Restrict attach to guestOS or staticPD request if request
is being made using non-secure device node.
Change-Id: I322c7b242fd0baaf1c1bce2d83b992fecb0ca593
Acked-by: Ekansh Gupta <ekangupt@qti.qualcomm.com>
Signed-off-by: Vamsi Krishna Gattupalli <quic_vgattupa@quicinc.com>
Vamsi Krishna Gattupalliauthored and Gerrit - the friendly Code Review servercommited 2022-07-08 02:17:36 -07:00
Get the dma_buf handle directly from 'vm_file' after
doing necessary checks on the file.
Change-Id: Id5eec16588d64e4e28483b32bb52d4d3d9b86b99
Signed-off-by: ravnar <quic_ravnar@quicinc.com>
Signed-off-by: Sanjay Yadav <quic_sanjyada@quicinc.com>
Signed-off-by: Abhishek Barman <quic_abarman@quicinc.com>
Signed-off-by: Kamal Agrawal <quic_kamaagra@quicinc.com>
Abhishek Barmanauthored and Kamal Agrawalcommited 2022-05-11 15:07:20 +05:30
Currently gpuaddr_in_range() accepts only the gpuaddr & returns
true if it lies in valid range. But this does not mean that the
entire buffer is within range.
Modify the function to accept size as a parameter and check that
both starting & ending points of buffer lie within mmu range.
Change-Id: I1d722295b9a27e746bfdb6d3bf409ffe722193cb
Signed-off-by: Rohan Sethi <quic_rohsethi@quicinc.com>
Signed-off-by: Abhishek Barman <quic_abarman@quicinc.com>
Signed-off-by: Kamal Agrawal <quic_kamaagra@quicinc.com>
Abhishek Barmanauthored and Kamal Agrawalcommited 2022-05-11 14:59:18 +05:30
Performance counter values need not be retained across contexts unless
specifically requested for debug. Zap the counters by initialising
perfcounter SRAM with 0's using GPU_RBBM_PERFCTR_SRAM_INIT_CMD.
Add pm4 packets during context switches and add a KMD postamble packet to
clear the counters during preemption. Do not enable perfcounter save and
restore unless requested.
Change-Id: I371779ce659c07a1cc664327f5ecdcf0374201d8
Signed-off-by: Mohammed Mirza Mandayappurath Manzoor <quic_mmandaya@quicinc.com>
Signed-off-by: Sebanti Das <quic_sebadas@quicinc.com>
Signed-off-by: Pankaj Gupta <quic_gpankaj@quicinc.com>
Pankaj Guptaauthored and Sebanti Dascommited 2022-03-21 13:36:41 +05:30
Currently performance counters are global and can be read by anyone. Change
the behaviour to disable reading global counters as default and add a sysfs
node to enable/disable reads.
Change-Id: Ic3785acd9bd7425c2a844ed103d7b870d9f80adf
Signed-off-by: Mohammed Mirza Mandayappurath Manzoor <quic_mmandaya@quicinc.com>
Signed-off-by: Harshitha Sai Neelati <quic_hsaineel@quicinc.com>
Signed-off-by: Pankaj Gupta <quic_gpankaj@quicinc.com>
Signed-off-by: Sebanti Das <quic_sebadas@quicinc.com>
Pankaj Guptaauthored and Sebanti Dascommited 2022-03-21 13:32:45 +05:30
Consider a scenario where user allocates anonymous memory but does not
write to it. Here the physical pages are not yet allocated. Now when this
memory is requested to be imported, a list of newly allocated zero pages
is obtained using get_user_pages(). Currently cache flush is not done for
these pages and hence GPU sees stale data. Fix this by performing cache
flush on these pages.
Change-Id: Id1e8aa20e8a9de112761732ed92f30c01088840b
Signed-off-by: Puranam V G Tejaswi <quic_pvgtejas@quicinc.com>
Signed-off-by: Sebanti Das <quic_sebadas@quicinc.com>
Signed-off-by: Kamal Agrawal <quic_kamaagra@quicinc.com>
Puranam V G Tejaswiauthored and Kamal Agrawalcommited 2022-02-01 12:44:29 +05:30
Currently, clean up is not done properly for anonymous buffer
(KGSL_MEM_ENTRY_USER). Fix it by freeing up resources allocated
during memdesc_sg_virt.
Change-Id: I75bff2e718b494c102a8075a5f27323e1823b212
Signed-off-by: Kamal Agrawal <kamaagra@codeaurora.org>
Signed-off-by: Rajesh Kemisetti <rajeshk@codeaurora.org>
Kamal Agrawalauthored and Rajesh Kemisetticommited 2021-12-23 18:45:24 +05:30
Update the register protection configuration as per the latest
recommendation.
Change-Id: I70365268e8e4c7ee4ff28538f22e970822e4edf0
Signed-off-by: Akhil P Oommen <akhilpo@codeaurora.org>
Akhil P Oommenauthored and Kamal Agrawalcommited 2021-11-08 12:17:13 +05:30
Access file private data structures inside the
mutex lock only to avoid use-after-free issues.
Change-Id: Ibae25aa31eeb7a7afada3dd0ecc236615223dfc9
Signed-off-by: srikanthreddy ponogoti <sponogot@codeaurora.org>
srikanthreddy ponogotiauthored and Gerrit - the friendly Code Review servercommited 2021-11-01 23:48:14 -07:00
Make sure there is enough room in the memory descriptor to store the
entire profiling buffer object.
Change-Id: I1e1c73097bb2bba9645b0a3c66fdbbc71d8ba8fa
Signed-off-by: Kamal Agrawal <kamaagra@codeaurora.org>
Kamal Agrawalauthored and Gerrit - the friendly Code Review servercommited 2021-09-27 07:23:22 -07:00
Until tx blocked signal response is received, allowing
tx may again fill the fifo. As tx_blocked_signal_sent
is already true glink will not be able to send tx blocked
signal again to remote host.
Do not allow tx unless response for previous tx blocked
signal is received.
CRs-Fixed: 3039195
Change-Id: Ib8137740f5a02958645934b55e33673394412919
Signed-off-by: Deepak Kumar Singh <deesin@codeaurora.org>
When memdesc_sg_virt returns error in kgsl_setup_anon_useraddr function,
the gpu address registered in SVM region will not be deregistered.
This change deregisters the gpu address on memdesc_sg_virt failure.
Change-Id: Ic99167e283a0c6331bb9f5f0b608b6cdb3c918e4
Signed-off-by: Neeraja P <neerp@codeaurora.org>
Signed-off-by: Rajesh Kemisetti <rajeshk@codeaurora.org>
Rajesh Kemisettiauthored and Harshitha Sai Neelaticommited 2021-08-16 13:57:05 +05:30
Drm file is not set to NULL after freeing it from drm
release. This can result in use-after-free issues in
some scenarios. Add a mutex lock and other proper null
checks to prevent such issues.
Change-Id: Ic35b0a76166b0f47a354b1737e6f4c3ac1437ed4
Signed-off-by: Nirmal Abraham <nabrah@codeaurora.org>
Signed-off-by: Althaf Neelanchirayil <aneelanc@codeaurora.org>
Krishna Manikandanauthored and Gerrit - the friendly Code Review servercommited 2021-08-09 23:45:58 -07:00
Added flag to indicate memory used
in process initialization. And, this memory
would not removed in internal unmap to avoid
UAF or double free.
Change-Id: Ifa621dee171b3d1f98b82302c847f4d767f3e736
Signed-off-by: Swathi K <kataka@codeaurora.org>
Protect add and update qos request with mutex to
avoid race condition when multiple threads try to add
or update request simultaneously.
Change-Id: Id33b81bf85246ec69c72bad59cca068e627bb21d
Acked-by: Deepika Singh <dsi@qti.qualcomm.com>
Signed-off-by: Jeya R <jeyr@codeaurora.org>
Jeya Rauthored and Gerrit - the friendly Code Review servercommited 2021-07-08 03:42:31 -07:00
Create local copy of current->comm to avoid the possibility of modification
in race condition.
Change-Id: Ie10f6577ed7edb9279a36039348e7a1ad25239f9
Acked-by: Nishant Chaubey <chaubey@qti.qualcomm.com>
Signed-off-by: Jeya R <jeyr@codeaurora.org>
Jeya Rauthored and Gerrit - the friendly Code Review servercommited 2021-04-01 00:40:49 -07:00
Adding fix to check the upper limit on the length
of the destination array while copying elements
from source address to avoid stack out of bound error.
Change-Id: I39d5768fa97f9d269cfb101a389bb771d13c7538
Signed-off-by: Monika Singh <monising@codeaurora.org>
Monika Singhauthored and Gerrit - the friendly Code Review servercommited 2021-03-14 22:33:55 -07:00
hold file reference till the sock event is sent.
Change-Id: I14d581f210c86e5771bec22a9aca7c78630e9ac1
Signed-off-by: Sharath Chandra Vurukala <sharathv@codeaurora.org>
Sharath Chandra Vurukalaauthored and Gerrit - the friendly Code Review servercommited 2021-03-10 01:39:08 -08:00
In kgsl_mem_entry_create, access map_count only if entry is allocated
successfully to avoid invalid access.
Change-Id: I57bce1aec2da6a27b6d13dbee96ed86a45c9660c
Signed-off-by: Deepak Kumar <dkumar@codeaurora.org>
Deepak Kumarauthored and Gerrit - the friendly Code Review servercommited 2021-03-07 23:52:20 -08:00
In kgsl_process_private_new() function there is inconsistency
in the refcount of current process PID. Fix this to avoid
overflowing of reference counter leading to use after free
of this struct.
Change-Id: I6291b9a05e139337e7f8471d0f9409fc839969a3
Signed-off-by: Archana Sriram <apsrir@codeaurora.org>
Archana Sriramauthored and Gerrit - the friendly Code Review servercommited 2021-02-01 02:59:28 -08:00
It shouldn't be illegal for memory descriptors to have multiple virtual
memory mappings under certain circumstances. If that is the case
tracking a single usermem address for each memdesc no longer makes much
sense. Get rid of the memdesc->usermem member and use an atomic counter
to track mappings instead.
Change-Id: Ic0dedbad31bafcd1019ccc8e68657cb7e3c72727
Signed-off-by: Jordan Crouse <jcrouse@codeaurora.org>
Signed-off-by: Harshitha Sai Neelati <hsaine@codeaurora.org>
Signed-off-by: Pranav Patel <pranavp@codeaurora.org>
Jordan Crouseauthored and Gerrit - the friendly Code Review servercommited 2021-02-01 02:59:04 -08:00
When SVM is being used there can only be one GPU address assigned
to the memory descriptor. Don't allow the GPU address to be changed
after it has been negotiated the first time by a process.
Change-Id: Ic0dedbad2a1b3ccdc2c1598a6c501b2be288d64e
Signed-off-by: Jordan Crouse <jcrouse@codeaurora.org>
Signed-off-by: Harshitha Sai Neelati <hsaine@codeaurora.org>
Signed-off-by: Pranav Patel <pranavp@codeaurora.org>
Jordan Crouseauthored and Gerrit - the friendly Code Review servercommited 2021-02-01 02:59:00 -08:00
Added a check to validate map before freeing it to avoid Use after
free scenario.
Change-Id: I484391ff7c55c0689530a928a2821ee5a1a0e10c
Signed-off-by: Vamsi krishna Gattupalli <vgattupa@codeaurora.org>
Vamsi krishna Gattupalliauthored and Gerrit - the friendly Code Review servercommited 2021-02-01 02:56:45 -08:00
Allocation of memory to user_ctxt_record is done based on adreno_device
flag. If a context is created when preemption is disabled, the memory
to user_ctxt_record is not allocated. Now if we enable preemption,
through the sysfs knob, the device flag is again set. We may try to
access user_ctxt_record in preemption_pre_ibsubmit(). So allocate memory
to user_ctxt_record based on the preemption feature flag instead
of preemption device flag.
Change-Id: I947ef5a1bfbd8bff471427fae60d7fcd507b85a2
Signed-off-by: Puranam V G Tejaswi <pvgtejas@codeaurora.org>
Signed-off-by: Harshitha Sai Neelati <hsaine@codeaurora.org>
Puranam V G Tejaswiauthored and Gerrit - the friendly Code Review servercommited 2021-02-01 02:56:26 -08:00
Add macros related to audio to fix compilation
error.
Change-Id: I7e13c429cfadb1a05c447cad3557d8d179fe22eb
Signed-off-by: Aditya Bavanari <abavanar@codeaurora.org>
Remove force-ufshc-probe in emmc based boot device.
It was added to cdp,dtsi for prototyping using UFS as
extended storage on eMMC target. This flag is not really
needed. Hence removing it.
Change-Id: I7a97c53e1db75050e9ca89ab67b480085c8790aa
Signed-off-by: Nitin Rawat <nitirawa@codeaurora.org>
Nitin Rawatauthored and Gerrit - the friendly Code Review servercommited 2020-11-19 02:46:24 -08:00
-Add HFI changes to firmware to set the 7.6k resolution
Change-Id: Ic7825d45648418c26744822a25096e38123fad58
Signed-off-by: Srinu Gorle <sgorle@codeaurora.org>
Rudra Venkatesh(Temp)authored and Srinu Gorlecommited 2020-11-10 15:14:18 +05:30
Mahesh Voorugonda
authored and
Agnimitra Sen
commited 
Paras Sharma
authored and
Errikayala Subramanyam
commited 
Naresh Kumar Lingagalla
authored and
Gerrit - the friendly Code Review server
commited 
Akhil P Oommen
authored and
Linux Build Service Account
authored and
Harshitha Sai Neelati
authored and
Rajesh Kemisetti
commited 
Puranam V G Tejaswi
authored and
Sarannya S
authored and
Vamsi Krishna Gattupalli
authored and
Abhishek Barman
authored and
Kamal Agrawal
commited 
Pankaj Gupta
authored and
Sebanti Das
commited 
Kamal Agrawal
authored and
Akhil P Oommen
authored and
srikanthreddy ponogoti
authored and
Deepak Kumar Singh
commited 
Rajesh Kemisetti
authored and
Harshitha Sai Neelati
commited 
Krishna Manikandan
authored and
Swathi K
commited 
Jeya R
authored and
Monika Singh
authored and
Sharath Chandra Vurukala
authored and
Deepak Kumar
authored and
Archana Sriram
authored and
Jordan Crouse
authored and
Vamsi krishna Gattupalli
authored and
Puranam V G Tejaswi
authored and
Chandan Gera
commited 
Aditya Bavanari
commited 
Nitin Rawat
authored and
Rahul Shahare
commited 
Rudra Venkatesh(Temp)
authored and
Srinu Gorle
commited