Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 310ec827 authored by Manoj Prabhu B's avatar Manoj Prabhu B Committed by Gerrit - the friendly Code Review server
Browse files

memshare: Remove HLOS S2 mapping for memshare client's memory 



The patch removes HLOS stage 2 mapping for memshare allocated
memory preventing speculative access by APPS. The patch also
prevents unmapping of newly allocated memory to a non-guaranteed
client by a state machine tracking power down event and new memory
request.

Change-Id: I6ee84d272ff22f8c2071ddf723dad3d89c71cf5a
Signed-off-by: default avatarManoj Prabhu B <bmanoj@codeaurora.org>
parent 7de48d1f

drivers/soc/qcom/memshare/msm_memshare.c

+28 −11
Original line number Diff line number Diff line 
/* Copyright (c) 2013-2017, The Linux Foundation. All rights reserved.

/* Copyright (c) 2013-2018, The Linux Foundation. All rights reserved.

 *

 * This program is free software; you can redistribute it and/or modify

 * it under the terms of the GNU General Public License version 2 and
@@ -324,7 +324,7 @@ static int modem_notifier_cb(struct notifier_block *this, unsigned long code, 
{

	int i;

	int ret;

	u32 source_vmlist[2] = {VMID_HLOS, VMID_MSS_MSA};

	u32 source_vmlist[1] = {VMID_MSS_MSA};

	int dest_vmids[1] = {VMID_HLOS};

	int dest_perms[1] = {PERM_READ|PERM_WRITE|PERM_EXEC};

	struct notif_data *notifdata = NULL;
@@ -335,6 +335,9 @@ static int modem_notifier_cb(struct notifier_block *this, unsigned long code, 


	case SUBSYS_BEFORE_SHUTDOWN:

		bootup_request++;

		for (i = 0; ((i < MAX_CLIENTS) &&

			!memblock[i].guarantee); i++)

			memblock[i].alloc_request = 0;

		break;



	case SUBSYS_RAMDUMP_NOTIFICATION:
@@ -374,14 +377,15 @@ static int modem_notifier_cb(struct notifier_block *this, unsigned long code, 
				if (memblock[i].peripheral ==

					DHMS_MEM_PROC_MPSS_V01 &&

					!memblock[i].guarantee &&

					memblock[i].allotted) {

					memblock[i].allotted &&

					!memblock[i].alloc_request) {

					pr_debug("memshare: hypervisor unmapping  for client id: %d\n",

						memblock[i].client_id);

					ret = hyp_assign_phys(

							memblock[i].phy_addr,

							memblock[i].size,

							source_vmlist,

							2, dest_vmids,

							1, dest_vmids,

							dest_perms, 1);

					if (ret &&

						memblock[i].hyp_mapping == 1) {
@@ -393,7 +397,6 @@ static int modem_notifier_cb(struct notifier_block *this, unsigned long code, 
						 */

						pr_err("memshare: %s, failed to unmap the region\n",

							__func__);

						memblock[i].hyp_mapping = 1;

					} else {

						memblock[i].hyp_mapping = 0;

					}
@@ -425,9 +428,8 @@ static void shared_hyp_mapping(int client_id) 
{

	int ret;

	u32 source_vmlist[1] = {VMID_HLOS};

	int dest_vmids[2] = {VMID_HLOS, VMID_MSS_MSA};

	int dest_perms[2] = {PERM_READ|PERM_WRITE,

				PERM_READ|PERM_WRITE};

	int dest_vmids[1] = {VMID_MSS_MSA};

	int dest_perms[1] = {PERM_READ|PERM_WRITE};



	if (client_id == DHMS_MEM_CLIENT_INVALID) {

		pr_err("memshare: %s, Invalid Client\n", __func__);
@@ -437,7 +439,7 @@ static void shared_hyp_mapping(int client_id) 
	ret = hyp_assign_phys(memblock[client_id].phy_addr,

			memblock[client_id].size,

			source_vmlist, 1, dest_vmids,

			dest_perms, 2);

			dest_perms, 1);



	if (ret != 0) {

		pr_err("memshare: hyp_assign_phys failed size=%u err=%d\n",
@@ -539,6 +541,7 @@ static int handle_alloc_generic_req(void *req_h, void *req, void *conn_h) 
			memblock[client_id].allotted = 1;

			memblock[client_id].size = alloc_req->num_bytes;

			memblock[client_id].peripheral = alloc_req->proc_id;

			memblock[client_id].alloc_request = 1;

		}

	}

	pr_debug("memshare: In %s, free memory count for client id: %d = %d",
@@ -603,9 +606,11 @@ static int handle_free_generic_req(void *req_h, void *req, void *conn_h) 
{

	struct mem_free_generic_req_msg_v01 *free_req;

	struct mem_free_generic_resp_msg_v01 free_resp;

	int rc;

	int flag = 0;

	int rc, flag = 0, ret = 0;

	uint32_t client_id;

	u32 source_vmlist[1] = {VMID_MSS_MSA};

	int dest_vmids[1] = {VMID_HLOS};

	int dest_perms[1] = {PERM_READ|PERM_WRITE|PERM_EXEC};



	mutex_lock(&memsh_drv->mem_free);

	free_req = (struct mem_free_generic_req_msg_v01 *)req;
@@ -624,6 +629,17 @@ static int handle_free_generic_req(void *req_h, void *req, void *conn_h) 
					memblock[client_id].allotted) {

		pr_debug("memshare: %s: size: %d",

				__func__, memblock[client_id].size);

		ret = hyp_assign_phys(memblock[client_id].phy_addr,

				memblock[client_id].size, source_vmlist, 1,

				dest_vmids, dest_perms, 1);

		if (ret && memblock[client_id].hyp_mapping == 1) {

		/*

		 * This is an error case as hyp mapping was successful

		 * earlier but during unmap it lead to failure.

		 */

			pr_err("memshare: %s, failed to unmap the region\n",

				__func__);

		}

		dma_free_attrs(memsh_drv->dev, memblock[client_id].size,

			memblock[client_id].virtual_addr,

			memblock[client_id].phy_addr,
@@ -959,6 +975,7 @@ static int memshare_child_probe(struct platform_device *pdev) 
			return rc;

		}

		memblock[num_clients].allotted = 1;

		memblock[num_clients].alloc_request = 1;

		shared_hyp_mapping(num_clients);

	}

drivers/soc/qcom/memshare/msm_memshare.h

+3 −1
Original line number Diff line number Diff line 
/* Copyright (c) 2013-2017, The Linux Foundation. All rights reserved.

/* Copyright (c) 2013-2018, The Linux Foundation. All rights reserved.

 *

 * This program is free software; you can redistribute it and/or modify

 * it under the terms of the GNU General Public License version 2 and
@@ -39,6 +39,8 @@ struct mem_blocks { 
	uint32_t guarantee;

	/* Memory alloted or not */

	uint32_t allotted;

	/* Memory allocation request received or not */

	uint32_t alloc_request;

	/* Size required for client */

	uint32_t size;

	/*