Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
Received-SPF: Pass (protection.outlook.com: domain of xilinx.com designates
 149.199.60.83 as permitted sender) receiver=protection.outlook.com;
 client-ip=149.199.60.83; helo=xsj-pvapsmtpgw01;
From:   Amit Sunil Dhamne <amit.sunil.dhamne@xilinx.com>
To:     ard.biesheuvel@linaro.org, mingo@kernel.org,
        gregkh@linuxfoundation.org, matt@codeblueprint.co.uk,
        sudeep.holla@arm.com, hkallweit1@gmail.com, keescook@chromium.org,
        dmitry.torokhov@gmail.com, michal.simek@xilinx.com,
        rajanv@xilinx.com, tejas.patel@xilinx.com, jollys@xilinx.com
Cc:     linux-arm-kernel@lists.infradead.org, linux-kernel@vger.kernel.org,
        rajan.vaja@xilinx.com, jolly.shah@xilinx.com,
        Amit Sunil Dhamne <amit.sunil.dhamne@xilinx.com>
Subject: [PATCH 1/3] firmware: xilinx: Add validation check for IOCTL
Date:   Wed,  9 Sep 2020 17:20:02 -0700
Message-Id: <1599697204-32103-2-git-send-email-amit.sunil.dhamne@xilinx.com>
In-Reply-To: <1599697204-32103-1-git-send-email-amit.sunil.dhamne@xilinx.com>
References: <1599697204-32103-1-git-send-email-amit.sunil.dhamne@xilinx.com>
MIME-Version: 1.0
Content-Type: text/plain
Content-Transfer-Encoding: quoted-printable
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 10 Sep 2020 00:20:11.8022
 (UTC)
X-MS-Exchange-CrossTenant-Network-Message-Id: 14c5ebb9-c08e-4049-1352-08d8551f484b
X-MS-Exchange-CrossTenant-Id: 657af505-d5df-48d0-8300-c31994686c5c
X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=657af505-d5df-48d0-8300-c31994686c5c;Ip=[149.199.60.83];Helo=[xsj-pvapsmtpgw01]
X-MS-Exchange-CrossTenant-AuthSource: CY1NAM02FT021.eop-nam02.prod.protection.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Anonymous
X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem
X-MS-Exchange-Transport-CrossTenantHeadersStamped: SN6PR02MB4319
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

From: Tejas Patel <tejas.patel@xilinx.com>

Validate IOCTL ID for ZynqMP and Versal before calling
zynqmp_pm_invoke_fn().

Signed-off-by: Tejas Patel <tejas.patel@xilinx.com>
Signed-off-by: Amit Sunil Dhamne <amit.sunil.dhamne@xilinx.com>
---
 drivers/firmware/xilinx/zynqmp.c | 117 +++++++++++++++++++++++++++++++----=
----
 1 file changed, 95 insertions(+), 22 deletions(-)

diff --git a/drivers/firmware/xilinx/zynqmp.c b/drivers/firmware/xilinx/zyn=
qmp.c
index 8d1ff24..8fe0912 100644
--- a/drivers/firmware/xilinx/zynqmp.c
+++ b/drivers/firmware/xilinx/zynqmp.c
@@ -514,6 +514,89 @@ int zynqmp_pm_clock_getparent(u32 clock_id, u32 *paren=
t_id)
 EXPORT_SYMBOL_GPL(zynqmp_pm_clock_getparent);

 /**
+ * versal_is_valid_ioctl() - Check whether IOCTL ID is valid or not for ve=
rsal
+ * @ioctl_id:  IOCTL ID
+ *
+ * Return: 1 if IOCTL is valid else 0
+ */
+static inline int versal_is_valid_ioctl(u32 ioctl_id)
+{
+       switch (ioctl_id) {
+       case IOCTL_SD_DLL_RESET:
+       case IOCTL_SET_SD_TAPDELAY:
+       case IOCTL_SET_PLL_FRAC_MODE:
+       case IOCTL_GET_PLL_FRAC_MODE:
+       case IOCTL_SET_PLL_FRAC_DATA:
+       case IOCTL_GET_PLL_FRAC_DATA:
+       case IOCTL_WRITE_GGS:
+       case IOCTL_READ_GGS:
+       case IOCTL_WRITE_PGGS:
+       case IOCTL_READ_PGGS:
+       case IOCTL_SET_BOOT_HEALTH_STATUS:
+               return 1;
+       default:
+               return 0;
+       }
+}
+
+/**
+ * zynqmp_is_valid_ioctl() - Check whether IOCTL ID is valid or not
+ * @ioctl_id:  IOCTL ID
+ *
+ * Return: 1 if IOCTL is valid else 0
+ */
+static inline int zynqmp_is_valid_ioctl(u32 ioctl_id)
+{
+       switch (ioctl_id) {
+       case IOCTL_SD_DLL_RESET:
+       case IOCTL_SET_SD_TAPDELAY:
+       case IOCTL_SET_PLL_FRAC_MODE:
+       case IOCTL_GET_PLL_FRAC_MODE:
+       case IOCTL_SET_PLL_FRAC_DATA:
+       case IOCTL_GET_PLL_FRAC_DATA:
+       case IOCTL_WRITE_GGS:
+       case IOCTL_READ_GGS:
+       case IOCTL_WRITE_PGGS:
+       case IOCTL_READ_PGGS:
+       case IOCTL_SET_BOOT_HEALTH_STATUS:
+               return 1;
+       default:
+               return 0;
+       }
+}
+
+/**
+ * zynqmp_pm_ioctl() - PM IOCTL API for device control and configs
+ * @node_id:   Node ID of the device
+ * @ioctl_id:  ID of the requested IOCTL
+ * @arg1:      Argument 1 to requested IOCTL call
+ * @arg2:      Argument 2 to requested IOCTL call
+ * @out:       Returned output value
+ *
+ * This function calls IOCTL to firmware for device control and configurat=
ion.
+ *
+ * Return: Returns status, either success or error+reason
+ */
+static int zynqmp_pm_ioctl(u32 node_id, u32 ioctl_id, u32 arg1, u32 arg2,
+                          u32 *out)
+{
+       struct device_node *np;
+
+       np =3D of_find_compatible_node(NULL, NULL, "xlnx,versal");
+       if (np) {
+               if (!versal_is_valid_ioctl(ioctl_id))
+                       return -EINVAL;
+       } else {
+               if (!zynqmp_is_valid_ioctl(ioctl_id))
+                       return -EINVAL;
+       }
+       of_node_put(np);
+
+       return zynqmp_pm_invoke_fn(PM_IOCTL, node_id, ioctl_id, arg1, arg2,
+                                  out);
+}
+
+/**
  * zynqmp_pm_set_pll_frac_mode() - PM API for set PLL mode
  *
  * @clk_id:    PLL clock ID
@@ -525,8 +608,7 @@ EXPORT_SYMBOL_GPL(zynqmp_pm_clock_getparent);
  */
 int zynqmp_pm_set_pll_frac_mode(u32 clk_id, u32 mode)
 {
-       return zynqmp_pm_invoke_fn(PM_IOCTL, 0, IOCTL_SET_PLL_FRAC_MODE,
-                                  clk_id, mode, NULL);
+       return zynqmp_pm_ioctl(0, IOCTL_SET_PLL_FRAC_MODE, clk_id, mode, NU=
LL);
 }
 EXPORT_SYMBOL_GPL(zynqmp_pm_set_pll_frac_mode);

@@ -542,8 +624,7 @@ EXPORT_SYMBOL_GPL(zynqmp_pm_set_pll_frac_mode);
  */
 int zynqmp_pm_get_pll_frac_mode(u32 clk_id, u32 *mode)
 {
-       return zynqmp_pm_invoke_fn(PM_IOCTL, 0, IOCTL_GET_PLL_FRAC_MODE,
-                                  clk_id, 0, mode);
+       return zynqmp_pm_ioctl(0, IOCTL_GET_PLL_FRAC_MODE, clk_id, 0, mode)=
;
 }
 EXPORT_SYMBOL_GPL(zynqmp_pm_get_pll_frac_mode);

@@ -560,8 +641,7 @@ EXPORT_SYMBOL_GPL(zynqmp_pm_get_pll_frac_mode);
  */
 int zynqmp_pm_set_pll_frac_data(u32 clk_id, u32 data)
 {
-       return zynqmp_pm_invoke_fn(PM_IOCTL, 0, IOCTL_SET_PLL_FRAC_DATA,
-                                  clk_id, data, NULL);
+       return zynqmp_pm_ioctl(0, IOCTL_SET_PLL_FRAC_DATA, clk_id, data, NU=
LL);
 }
 EXPORT_SYMBOL_GPL(zynqmp_pm_set_pll_frac_data);

@@ -577,8 +657,7 @@ EXPORT_SYMBOL_GPL(zynqmp_pm_set_pll_frac_data);
  */
 int zynqmp_pm_get_pll_frac_data(u32 clk_id, u32 *data)
 {
-       return zynqmp_pm_invoke_fn(PM_IOCTL, 0, IOCTL_GET_PLL_FRAC_DATA,
-                                  clk_id, 0, data);
+       return zynqmp_pm_ioctl(0, IOCTL_GET_PLL_FRAC_DATA, clk_id, 0, data)=
;
 }
 EXPORT_SYMBOL_GPL(zynqmp_pm_get_pll_frac_data);

@@ -595,8 +674,8 @@ EXPORT_SYMBOL_GPL(zynqmp_pm_get_pll_frac_data);
  */
 int zynqmp_pm_set_sd_tapdelay(u32 node_id, u32 type, u32 value)
 {
-       return zynqmp_pm_invoke_fn(PM_IOCTL, node_id, IOCTL_SET_SD_TAPDELAY=
,
-                                  type, value, NULL);
+       return zynqmp_pm_ioctl(node_id, IOCTL_SET_SD_TAPDELAY, type, value,
+                              NULL);
 }
 EXPORT_SYMBOL_GPL(zynqmp_pm_set_sd_tapdelay);

@@ -612,8 +691,7 @@ EXPORT_SYMBOL_GPL(zynqmp_pm_set_sd_tapdelay);
  */
 int zynqmp_pm_sd_dll_reset(u32 node_id, u32 type)
 {
-       return zynqmp_pm_invoke_fn(PM_IOCTL, node_id, IOCTL_SET_SD_TAPDELAY=
,
-                                  type, 0, NULL);
+       return zynqmp_pm_ioctl(node_id, IOCTL_SET_SD_TAPDELAY, type, 0, NUL=
L);
 }
 EXPORT_SYMBOL_GPL(zynqmp_pm_sd_dll_reset);

@@ -628,8 +706,7 @@ EXPORT_SYMBOL_GPL(zynqmp_pm_sd_dll_reset);
  */
 int zynqmp_pm_write_ggs(u32 index, u32 value)
 {
-       return zynqmp_pm_invoke_fn(PM_IOCTL, 0, IOCTL_WRITE_GGS,
-                                  index, value, NULL);
+       return zynqmp_pm_ioctl(0, IOCTL_WRITE_GGS, index, value, NULL);
 }
 EXPORT_SYMBOL_GPL(zynqmp_pm_write_ggs);

@@ -644,8 +721,7 @@ EXPORT_SYMBOL_GPL(zynqmp_pm_write_ggs);
  */
 int zynqmp_pm_read_ggs(u32 index, u32 *value)
 {
-       return zynqmp_pm_invoke_fn(PM_IOCTL, 0, IOCTL_READ_GGS,
-                                  index, 0, value);
+       return zynqmp_pm_ioctl(0, IOCTL_READ_GGS, index, 0, value);
 }
 EXPORT_SYMBOL_GPL(zynqmp_pm_read_ggs);

@@ -661,8 +737,7 @@ EXPORT_SYMBOL_GPL(zynqmp_pm_read_ggs);
  */
 int zynqmp_pm_write_pggs(u32 index, u32 value)
 {
-       return zynqmp_pm_invoke_fn(PM_IOCTL, 0, IOCTL_WRITE_PGGS, index, va=
lue,
-                                  NULL);
+       return zynqmp_pm_ioctl(0, IOCTL_WRITE_PGGS, index, value, NULL);
 }
 EXPORT_SYMBOL_GPL(zynqmp_pm_write_pggs);

@@ -678,8 +753,7 @@ EXPORT_SYMBOL_GPL(zynqmp_pm_write_pggs);
  */
 int zynqmp_pm_read_pggs(u32 index, u32 *value)
 {
-       return zynqmp_pm_invoke_fn(PM_IOCTL, 0, IOCTL_READ_PGGS, index, 0,
-                                  value);
+       return zynqmp_pm_ioctl(0, IOCTL_READ_PGGS, index, 0, value);
 }
 EXPORT_SYMBOL_GPL(zynqmp_pm_read_pggs);

@@ -694,8 +768,7 @@ EXPORT_SYMBOL_GPL(zynqmp_pm_read_pggs);
  */
 int zynqmp_pm_set_boot_health_status(u32 value)
 {
-       return zynqmp_pm_invoke_fn(PM_IOCTL, 0, IOCTL_SET_BOOT_HEALTH_STATU=
S,
-                                  value, 0, NULL);
+       return zynqmp_pm_ioctl(0, IOCTL_SET_BOOT_HEALTH_STATUS, value, 0, N=
ULL);
 }

 /**
--
2.7.4

This email and any attachments are intended for the sole use of the named r=
ecipient(s) and contain(s) confidential information that may be proprietary=
, privileged or copyrighted under applicable law. If you are not the intend=
ed recipient, do not read, copy, or forward this email message or any attac=
hments. Delete this email message and any attachments immediately.