[PATCH 09/10] drm/etnaviv: validate readback register address

[Christian Gmeiner]

Reading some registers end in a system crash ala:

  Unhandled fault: external abort on non-linefetch (0x1028) at 0xfe641000
  Internal error: : 1028 [#1] PREEMPT ARM

Avoid those by register validation.

Signed-off-by: Christian Gmeiner <christian.gmeiner at gmail.com>
---
 drivers/gpu/drm/etnaviv/etnaviv_gem_submit.c | 26 ++++++++++++++++++++++++++
 1 file changed, 26 insertions(+)

diff --git a/drivers/gpu/drm/etnaviv/etnaviv_gem_submit.c b/drivers/gpu/drm/etnaviv/etnaviv_gem_submit.c
index 08f9b3d..4383c0d 100644
--- a/drivers/gpu/drm/etnaviv/etnaviv_gem_submit.c
+++ b/drivers/gpu/drm/etnaviv/etnaviv_gem_submit.c
@@ -277,6 +277,27 @@ static int submit_reloc(struct etnaviv_gem_submit *submit, void *stream,
 	return 0;
 }
 
+static int readback_reg_valid(unsigned reg)
+{
+	/*
+	 * 0x000..0x200:     ok
+	 * 0x200..0x400:     crash
+	 * 0x400..0x800:     ok
+	 * 0x800..0xa00:     crash
+	 * 0xa00..0xc00:     crash
+	 * 0xc00..0xe00:     crash
+	 * 0xe00..0x1000:    crash
+	 * everything above: crash
+	 */
+	if (reg >= 0x200 && reg < 400)
+		return 0;
+
+	if (reg >= 0x800)
+		return 0;
+
+	return 1;
+}
+
 static int submit_readback(struct etnaviv_gem_submit *submit,
 		struct etnaviv_cmdbuf *cmdbuf,
 		const struct drm_etnaviv_gem_submit_readback *readbacks,
@@ -303,6 +324,11 @@ static int submit_readback(struct etnaviv_gem_submit *submit,
 			return -EINVAL;
 		}
 
+		if (!readback_reg_valid(r->reg)) {
+			DRM_ERROR("invalid readback reg (would cause crash)");
+			return -EINVAL;
+		}
+
 		cmdbuf->readbacks[i].bo_vma = etnaviv_gem_vmap(&bo->obj->base);
 		cmdbuf->readbacks[i].offset = r->readback_offset;
 		cmdbuf->readbacks[i].reg = r->reg;
-- 
2.9.3