TechPanelGM/kernel_xiaomi_sm8250
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

soc: qcom: dcc: Avoid dcc_sram_writel overflow

Browse Source 
If the config_list is too long,they may beyond the capacity of Dcc sram,
so add verification of offset before dcc_sram_writel.

Change-Id: I40e8dd66f154fe4c260ad331ef89d8952b510cfa
Signed-off-by: Yuanfang Zhang <zhangyuanfang@codeaurora.org>
Signed-off-by: Srinivasarao P <spathi@codeaurora.org>
This commit is contained in:
Yuanfang Zhang
2018-08-17 13:03:40 +08:00
committed by Gerrit - the friendly Code Review server
parent 53d803404a
commit 1f6dc5f64e
1 changed files with 26 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

33
drivers/soc/qcom/dcc.c
View File

@@ -33,8 +33,6 @@
#define dcc_readl(drvdata, off) \ #define dcc_readl(drvdata, off) \
__raw_readl(drvdata->base + off) __raw_readl(drvdata->base + off)
#define dcc_sram_writel(drvdata, val, off) \
__raw_writel((val), drvdata->ram_base + off)
#define dcc_sram_readl(drvdata, off) \ #define dcc_sram_readl(drvdata, off) \
__raw_readl(drvdata->ram_base + off) __raw_readl(drvdata->ram_base + off)
@@ -123,6 +121,16 @@ struct dcc_drvdata {
uint64_t xpu_addr; uint64_t xpu_addr;
uint32_t xpu_unlock_count; uint32_t xpu_unlock_count;
}; };
static int dcc_sram_writel(struct dcc_drvdata *drvdata,
uint32_t val, uint32_t off)
{
if (unlikely(off > (drvdata->ram_size - 4)))
return -EINVAL;
__raw_writel((val), drvdata->ram_base + off);
return 0;
}
static int dcc_cfg_xpu(struct dcc_drvdata *drvdata, bool enable) static int dcc_cfg_xpu(struct dcc_drvdata *drvdata, bool enable)
{ {
@@ -271,12 +279,17 @@ static int __dcc_ll_cfg(struct dcc_drvdata *drvdata)
if (!prev_addr || prev_addr != addr || prev_off > off) { if (!prev_addr || prev_addr != addr || prev_off > off) {
/* Check if we need to write link of prev entry */ /* Check if we need to write link of prev entry */
if (link) { if (link) {
dcc_sram_writel(drvdata, link, sram_offset); ret = dcc_sram_writel(drvdata,
link, sram_offset);
if (ret)
goto overstep;
sram_offset += 4; sram_offset += 4;
} }
/* Write address */ /* Write address */
dcc_sram_writel(drvdata, addr, sram_offset); ret = dcc_sram_writel(drvdata, addr, sram_offset);
if (ret)
goto overstep;
sram_offset += 4; sram_offset += 4;
/* Reset link and prev_off */ /* Reset link and prev_off */
@@ -316,7 +329,9 @@ static int __dcc_ll_cfg(struct dcc_drvdata *drvdata)
((entry->len << 8) & BM(8, 14))) << pos; ((entry->len << 8) & BM(8, 14))) << pos;
if (pos) { if (pos) {
dcc_sram_writel(drvdata, link, sram_offset); ret = dcc_sram_writel(drvdata, link, sram_offset);
if (ret)
goto overstep;
sram_offset += 4; sram_offset += 4;
link = 0; link = 0;
} }
@@ -326,12 +341,16 @@ static int __dcc_ll_cfg(struct dcc_drvdata *drvdata)
} }
if (link) { if (link) {
dcc_sram_writel(drvdata, link, sram_offset); ret = dcc_sram_writel(drvdata, link, sram_offset);
if (ret)
goto overstep;
sram_offset += 4; sram_offset += 4;
} }
/* Setting zero to indicate end of the list */ /* Setting zero to indicate end of the list */
dcc_sram_writel(drvdata, 0, sram_offset); ret = dcc_sram_writel(drvdata, 0, sram_offset);
if (ret)
goto overstep;
sram_offset += 4; sram_offset += 4;
/* check if the data will overstep */ /* check if the data will overstep */