Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 8e8554cc authored by Tharun Kumar Merugu's avatar Tharun Kumar Merugu Committed by Gerrit - the friendly Code Review server
Browse files

msm: adsprpc: validate dma physical address after mapping 



Verify that buffer physical address is within the CMA heap range
to ensure contiguous memory for remote subsystems without SMMU
stage 1 enabled.

Change-Id: Ia17fba6177ad9b2ebc8c7c38560d8f70025aaad9
Acked-by: default avatarViswanatham Paduchuri <vpaduchu@qti.qualcomm.com>
Signed-off-by: default avatarTharun Kumar Merugu <mtharu@codeaurora.org>
parent 8f2d81a9

drivers/char/adsprpc.c

+14 −0
Original line number Diff line number Diff line
@@ -874,6 +874,7 @@ static int fastrpc_mmap_create(struct fastrpc_file *fl, int fd, 
				goto bail;

		}

		map->phys = sg_dma_address(map->table->sgl);



		if (sess->smmu.cb) {

			if (fl->cid != SDSP_DOMAIN_ID)

				map->phys += ((uint64_t)sess->smmu.cb << 32);
@@ -883,7 +884,18 @@ static int fastrpc_mmap_create(struct fastrpc_file *fl, int fd, 
		} else {

			map->size = buf_page_size(len);

		}



		vmid = fl->apps->channel[fl->cid].vmid;

		if (!sess->smmu.enabled && !vmid) {

			VERIFY(err, map->phys >= me->range.addr &&

			map->phys + map->size <=

			me->range.addr + me->range.size);

			if (err) {

				pr_err("adsprpc: %s: phys addr 0x%llx (size 0x%zx) out of CMA heap range\n",

					__func__, map->phys, map->size);

				goto bail;

			}

		}

		if (vmid) {

			int srcVM[1] = {VMID_HLOS};

			int destVM[2] = {VMID_HLOS, vmid};
@@ -3716,6 +3728,8 @@ static int fastrpc_probe(struct platform_device *pdev) 
					srcVM, 1, destVM, destVMperm, 4));

			if (err)

				goto bail;

			me->range.addr = range.addr;

			me->range.size = range.size;

		}

		return 0;

	}