From patchwork Tue Jun 13 23:15:53 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Dmitry Osipenko X-Patchwork-Id: 9785063 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id A056960384 for ; Wed, 14 Jun 2017 00:41:56 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 933EA28567 for ; Wed, 14 Jun 2017 00:41:56 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 8824828573; Wed, 14 Jun 2017 00:41:56 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-4.1 required=2.0 tests=BAYES_00, DKIM_ADSP_CUSTOM_MED, DKIM_SIGNED, FREEMAIL_FROM, RCVD_IN_DNSWL_MED, T_DKIM_INVALID autolearn=ham version=3.3.1 Received: from gabe.freedesktop.org (gabe.freedesktop.org [131.252.210.177]) (using TLSv1.2 with cipher DHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.wl.linuxfoundation.org (Postfix) with ESMTPS id 30E7728567 for ; Wed, 14 Jun 2017 00:41:56 +0000 (UTC) Received: from gabe.freedesktop.org (localhost [127.0.0.1]) by gabe.freedesktop.org (Postfix) with ESMTP id 244456E3F6; Wed, 14 Jun 2017 00:41:03 +0000 (UTC) X-Original-To: dri-devel@lists.freedesktop.org Delivered-To: dri-devel@lists.freedesktop.org Received: from mail-lf0-x244.google.com (mail-lf0-x244.google.com [IPv6:2a00:1450:4010:c07::244]) by gabe.freedesktop.org (Postfix) with ESMTPS id E5A916E3D6 for ; Tue, 13 Jun 2017 23:38:59 +0000 (UTC) Received: by mail-lf0-x244.google.com with SMTP id x81so14865450lfb.3 for ; Tue, 13 Jun 2017 16:38:59 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:to:cc:subject:date:message-id:in-reply-to:references :in-reply-to:references; bh=tka8OZE0oPst8u2z2CB9Y1P1IYnX5wHJa2NNFWIqOU0=; b=jY4VfZodl0nyWNOZaUvlA57T+vLljBufFUpMMmUqXln07HNRHJn51pOdLNsLlf/C5Y X26SE17/kTXvUTl1adXvebpa5z+boLeLZeZUEAdTB7aa37AhbNrHRVDOiSBX+OMfSvM5 hJm1yzb7RYuoPHOjw5NkTKLuFePCkV4/Ow+2J4Itw+QKurHaJtPftFhjl+am8p42cYTp ciYkUFuQs35me0aS20YME9UD1l82lfjt2MVJEKJGZiVJg6eZBprjcppSHpjWyn20G2of AWyf8cwPVpMV0q4UqeoGFCNIS1fefeYjWJKro5tdLPN2dCqiHUnxujX9jzSEupnKNxeV tmPg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:in-reply-to:references; bh=tka8OZE0oPst8u2z2CB9Y1P1IYnX5wHJa2NNFWIqOU0=; b=A1wIPdlmRsLfPjTqx04v8KeqLC67VyzO+75yzZSzi+cHGWKImWDo9Esm4Dbe6Im0aE 8K7IXsaf4pMOwU5t5d+mcx4/8rKVk+OMI1gT1xEofRdoxwCNt0+/AWounBXTFQK+L1gk WHgbsrMybb0PlkrjVRD6nSL+Th32sU9QaWG3dYMrkW9yeBN4XPND1PuBtXgSC79qPSSW OC0VEgLYnQXm2DLJ5X/q5VKspmUwBAJa/qPlIrxNNTlSOBmKBg+jVzzmN7gk0MNSccwB kv6W6hPjWf7B3fl9l658M6b7UszwpVkieodxT9oRyqhvGeTlhMnjhduLHYLA2Kvw8mFd cPLw== X-Gm-Message-State: AKS2vOwf1dxyMxdFUvWp0YFkqqyfEFEQaiHECsxGBvmZrJVr36jjo2FC xD/8KLswl+gphQ== X-Received: by 10.46.9.4 with SMTP id 4mr727718ljj.23.1497397138359; Tue, 13 Jun 2017 16:38:58 -0700 (PDT) Received: from localhost.localdomain (ppp109-252-91-7.pppoe.spdop.ru. [109.252.91.7]) by smtp.gmail.com with ESMTPSA id f27sm3785725lfa.27.2017.06.13.16.38.56 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Tue, 13 Jun 2017 16:38:57 -0700 (PDT) From: Dmitry Osipenko To: Thierry Reding , Mikko Perttunen , Erik Faye-Lund Subject: [PATCH v2 14/22] gpu: host1x: Forbid relocation address shifting in the firewall Date: Wed, 14 Jun 2017 02:15:53 +0300 Message-Id: <5e6f06d3e57db40c1c4947282ef7336369c3360f.1497394243.git.digetx@gmail.com> X-Mailer: git-send-email 2.13.0 In-Reply-To: References: In-Reply-To: References: X-Mailman-Approved-At: Wed, 14 Jun 2017 00:40:59 +0000 Cc: linux-tegra@vger.kernel.org, DRI Development X-BeenThere: dri-devel@lists.freedesktop.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: Direct Rendering Infrastructure - Development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Errors-To: dri-devel-bounces@lists.freedesktop.org Sender: "dri-devel" X-Virus-Scanned: ClamAV using ClamSMTP Incorrectly shifted relocation address will cause a lower memory corruption and likely a hang on a write or a read of an arbitrary data in case of IOMMU absent. As of now there is no use for the address shifting (at least on Tegra20) and adding a proper shifting / sizes validation is much more work. Let's forbid it in the firewall till a proper validation is implemented. Signed-off-by: Dmitry Osipenko Reviewed-by: Erik Faye-Lund --- drivers/gpu/host1x/dev.c | 4 ++++ drivers/gpu/host1x/dev.h | 1 + drivers/gpu/host1x/job.c | 24 ++++++++++++++++++++++++ 3 files changed, 29 insertions(+) diff --git a/drivers/gpu/host1x/dev.c b/drivers/gpu/host1x/dev.c index 6a805ed908c3..21da331ce092 100644 --- a/drivers/gpu/host1x/dev.c +++ b/drivers/gpu/host1x/dev.c @@ -72,6 +72,7 @@ static const struct host1x_info host1x01_info = { .init = host1x01_init, .sync_offset = 0x3000, .dma_mask = DMA_BIT_MASK(32), + .version = 1, }; static const struct host1x_info host1x02_info = { @@ -82,6 +83,7 @@ static const struct host1x_info host1x02_info = { .init = host1x02_init, .sync_offset = 0x3000, .dma_mask = DMA_BIT_MASK(32), + .version = 2, }; static const struct host1x_info host1x04_info = { @@ -92,6 +94,7 @@ static const struct host1x_info host1x04_info = { .init = host1x04_init, .sync_offset = 0x2100, .dma_mask = DMA_BIT_MASK(34), + .version = 4, }; static const struct host1x_info host1x05_info = { @@ -102,6 +105,7 @@ static const struct host1x_info host1x05_info = { .init = host1x05_init, .sync_offset = 0x2100, .dma_mask = DMA_BIT_MASK(34), + .version = 5, }; static const struct of_device_id host1x_of_match[] = { diff --git a/drivers/gpu/host1x/dev.h b/drivers/gpu/host1x/dev.h index 229d08b6a45e..c6997651b336 100644 --- a/drivers/gpu/host1x/dev.h +++ b/drivers/gpu/host1x/dev.h @@ -100,6 +100,7 @@ struct host1x_info { int (*init)(struct host1x *host1x); /* initialize per SoC ops */ unsigned int sync_offset; /* offset of syncpoint registers */ u64 dma_mask; /* mask of addressable memory */ + unsigned int version; /* host1x's version */ }; struct host1x { diff --git a/drivers/gpu/host1x/job.c b/drivers/gpu/host1x/job.c index 4208329ca2af..7825643da324 100644 --- a/drivers/gpu/host1x/job.c +++ b/drivers/gpu/host1x/job.c @@ -333,6 +333,27 @@ static bool check_reloc(struct host1x_reloc *reloc, struct host1x_bo *cmdbuf, return true; } +static bool check_reloc_shift(struct device *dev, struct host1x_reloc *reloc) +{ + struct host1x *host = dev_get_drvdata(dev->parent); + + /* skip newer Tegra's since IOMMU is supposed to be used by + * them and not all address registers with their shifts are + * publicly documented */ + if (host->info->version > 1) + return true; + + /* skip Tegra30 with IOMMU enabled */ + if (host->domain) + return true; + + /* relocation shift value validation isn't implemented yet */ + if (reloc->shift) + return false; + + return true; +} + struct host1x_firewall { struct host1x_job *job; struct device *dev; @@ -359,6 +380,9 @@ static int check_register(struct host1x_firewall *fw, unsigned long offset) if (!check_reloc(fw->reloc, fw->cmdbuf, fw->offset)) return -EINVAL; + if (!check_reloc_shift(fw->dev, fw->reloc)) + return -EINVAL; + fw->num_relocs--; fw->reloc++; }