Am Freitag, den 09.12.2016, 12:21 +0100 schrieb Christian Gmeiner: > Reading some registers end in a system crash ala: > > Unhandled fault: external abort on non-linefetch (0x1028) at 0xfe641000 > Internal error: : 1028 [#1] PREEMPT ARM > > Avoid those by register validation. Avoiding crashes is one thing, but I believe this needs to go further and avoid reads from any register that isn't a performance counter. This probably isn't a big hole, but we want to avoid leaking the GPU state to userspace. Regards, Lucas > > Signed-off-by: Christian Gmeiner <christian.gmeiner@xxxxxxxxx> > --- > drivers/gpu/drm/etnaviv/etnaviv_gem_submit.c | 26 ++++++++++++++++++++++++++ > 1 file changed, 26 insertions(+) > > diff --git a/drivers/gpu/drm/etnaviv/etnaviv_gem_submit.c b/drivers/gpu/drm/etnaviv/etnaviv_gem_submit.c > index 08f9b3d..4383c0d 100644 > --- a/drivers/gpu/drm/etnaviv/etnaviv_gem_submit.c > +++ b/drivers/gpu/drm/etnaviv/etnaviv_gem_submit.c > @@ -277,6 +277,27 @@ static int submit_reloc(struct etnaviv_gem_submit *submit, void *stream, > return 0; > } > > +static int readback_reg_valid(unsigned reg) > +{ > + /* > + * 0x000..0x200: ok > + * 0x200..0x400: crash > + * 0x400..0x800: ok > + * 0x800..0xa00: crash > + * 0xa00..0xc00: crash > + * 0xc00..0xe00: crash > + * 0xe00..0x1000: crash > + * everything above: crash > + */ > + if (reg >= 0x200 && reg < 400) > + return 0; > + > + if (reg >= 0x800) > + return 0; > + > + return 1; > +} > + > static int submit_readback(struct etnaviv_gem_submit *submit, > struct etnaviv_cmdbuf *cmdbuf, > const struct drm_etnaviv_gem_submit_readback *readbacks, > @@ -303,6 +324,11 @@ static int submit_readback(struct etnaviv_gem_submit *submit, > return -EINVAL; > } > > + if (!readback_reg_valid(r->reg)) { > + DRM_ERROR("invalid readback reg (would cause crash)"); > + return -EINVAL; > + } > + > cmdbuf->readbacks[i].bo_vma = etnaviv_gem_vmap(&bo->obj->base); > cmdbuf->readbacks[i].offset = r->readback_offset; > cmdbuf->readbacks[i].reg = r->reg; _______________________________________________ dri-devel mailing list dri-devel@xxxxxxxxxxxxxxxxxxxxx https://lists.freedesktop.org/mailman/listinfo/dri-devel