> On Jan 6, 2026, at 8:24 PM, Timur Tabi <[email protected]> wrote:
> 
> The NV_PFALCON_FALCON_DMATRFBASE/1 register pair supports DMA address
> up to 49 bits only, but the write to DMATRFBASE1 could exceed that.
> To mitigate, check first that the DMA address will fit.
> 
> Fixes: 69f5cd67ce41 ("gpu: nova-core: add falcon register definitions and 
> base code")
> Signed-off-by: Timur Tabi <[email protected]>

Reviewed-by: Joel Fernandes <[email protected]>

Thanks.



> ---
> drivers/gpu/nova-core/falcon.rs | 6 +++++-
> 1 file changed, 5 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/gpu/nova-core/falcon.rs b/drivers/gpu/nova-core/falcon.rs
> index 82c661aef594..fe5abf64dd2b 100644
> --- a/drivers/gpu/nova-core/falcon.rs
> +++ b/drivers/gpu/nova-core/falcon.rs
> @@ -493,7 +493,11 @@ fn dma_wr<F: FalconFirmware<Target = E>>(
>             Some(_) => (),
>         };
> 
> -        // Set up the base source DMA address.
> +        // Set up the base source DMA address.  DMATRFBASE only supports a 
> 49-bit address.
> +        if dma_start > kernel::dma::DmaMask::new::<49>().value() {
> +            dev_err!(self.dev, "DMA address {:#x} exceeds 49 bits\n", 
> dma_start);
> +            return Err(ERANGE);
> +        }
> 
>         regs::NV_PFALCON_FALCON_DMATRFBASE::default()
>             // CAST: `as u32` is used on purpose since we do want to strip 
> the upper bits, which
> 
> base-commit: 4348796233e736147e2e79c58784d0a9fb48867d
> --
> 2.52.0
> 

Reply via email to