Merge "ion: Ensure secure HLOS accessible buffers are zeroed when allocated" (e18bfc16) · Commits · e / devices / android_kernel_fairphone_FP5

drivers/staging/android/ion/heaps/ion_carveout_heap.c

+2 −0

Original line number	Diff line number	Diff line
		@@ -379,6 +379,8 @@ static void ion_sc_heap_free(struct ion_buffer *buffer)
		return;
		}

		if (hlos_accessible_buffer(buffer))
		ion_buffer_zero(buffer);
		ion_carveout_free(child, paddr, buffer->size);
		sg_free_table(table);
		kfree(table);

drivers/staging/android/ion/heaps/ion_cma_heap.c

+15 −3

Original line number	Diff line number	Diff line
		@@ -5,7 +5,7 @@
		* Copyright (C) Linaro 2012
		* Author: <benjamin.gaignard@linaro.org> for ST-Ericsson.
		*
		* Copyright (c) 2016-2019, The Linux Foundation. All rights reserved.
		* Copyright (c) 2016-2020, The Linux Foundation. All rights reserved.
		*/

		#include <linux/device.h>
		@@ -29,6 +29,11 @@ struct ion_cma_heap {
		container_of(to_msm_ion_heap(x), struct ion_cma_heap, heap)

		/* ION CMA heap operations functions */
		static bool ion_heap_is_cma_heap_type(enum ion_heap_type type)
		{
		return type == ION_HEAP_TYPE_DMA;
		}

		static int ion_cma_allocate(struct ion_heap heap, struct ion_buffer buffer,
		unsigned long len,
		unsigned long flags)
		@@ -42,6 +47,13 @@ static int ion_cma_allocate(struct ion_heap heap, struct ion_buffer buffer,
		int ret;
		struct device *dev = cma_heap->heap.dev;

		if (ion_heap_is_cma_heap_type(buffer->heap->type) &&
		is_secure_allocation(buffer->flags)) {
		pr_err("%s: CMA heap doesn't support secure allocations\n",
		__func__);
		return -EINVAL;
		}

		if (align > CONFIG_CMA_ALIGNMENT)
		align = CONFIG_CMA_ALIGNMENT;

		@@ -49,7 +61,7 @@ static int ion_cma_allocate(struct ion_heap heap, struct ion_buffer buffer,
		if (!pages)
		return -ENOMEM;

		if (!(flags & ION_FLAG_SECURE)) {
		if (hlos_accessible_buffer(buffer)) {
		if (PageHighMem(pages)) {
		unsigned long nr_clear_pages = nr_pages;
		struct page *page = pages;
		@@ -68,7 +80,7 @@ static int ion_cma_allocate(struct ion_heap heap, struct ion_buffer buffer,
		}

		if (MAKE_ION_ALLOC_DMA_READY \|\|
		(flags & ION_FLAG_SECURE) \|\|
		(!hlos_accessible_buffer(buffer)) \|\|
		(!ion_buffer_cached(buffer)))
		ion_pages_sync_for_device(dev, pages, size,
		DMA_BIDIRECTIONAL);

drivers/staging/android/ion/heaps/ion_secure_util.c

+5 −0

Original line number	Diff line number	Diff line
		@@ -31,6 +31,11 @@ bool is_secure_vmid_valid(int vmid)
		(!ret && vmid == trusted_vm_vmid));
		}

		bool is_secure_allocation(unsigned long flags)
		{
		return !!(flags & (ION_FLAGS_CP_MASK \| ION_FLAG_SECURE));
		}

		int get_secure_vmid(unsigned long flags)
		{
		int ret;

drivers/staging/android/ion/heaps/ion_secure_util.h

+3 −1

Original line number	Diff line number	Diff line
		/* SPDX-License-Identifier: GPL-2.0-only */
		/*
		* Copyright (c) 2017-2019, The Linux Foundation. All rights reserved.
		* Copyright (c) 2017-2020, The Linux Foundation. All rights reserved.
		*/

		#include "msm_ion_priv.h"
		@@ -22,4 +22,6 @@ int ion_hyp_assign_from_flags(u64 base, u64 size, unsigned long flags);

		bool hlos_accessible_buffer(struct ion_buffer *buffer);

		bool is_secure_allocation(unsigned long flags);

		#endif /* _ION_SECURE_UTIL_H */

drivers/staging/android/ion/heaps/ion_system_heap.c

+2 −2

Original line number	Diff line number	Diff line
		@@ -288,7 +288,7 @@ static int ion_system_heap_allocate(struct ion_heap *heap,
		return -ENOMEM;

		if (ion_heap_is_system_heap_type(buffer->heap->type) &&
		is_secure_vmid_valid(vmid)) {
		is_secure_allocation(buffer->flags)) {
		pr_info("%s: System heap doesn't support secure allocations\n",
		__func__);
		return -EINVAL;
		@@ -426,7 +426,7 @@ void ion_system_heap_free(struct ion_buffer *buffer)

		if (!(buffer->private_flags & ION_PRIV_FLAG_SHRINKER_FREE) &&
		!(buffer->flags & ION_FLAG_POOL_FORCE_ALLOC)) {
		if (vmid < 0)
		if (hlos_accessible_buffer(buffer))
		ion_buffer_zero(buffer);
		} else if (vmid > 0) {
		if (ion_hyp_unassign_sg(table, &vmid, 1, true))