Preface: Snapdragon chipsets, which are a type of System-on-a-Chip (SoC), often include memory components, such as RAM (Random Access Memory) and ROM (Read-Only Memory), within the chip itself. This integrated approach allows for faster and more efficient data processing within the device.
Background: In Qualcomm Snapdragon SoCs, the Adreno GPU is responsible for graphics and compute tasks. The GPU is managed through a combination of firmware, drivers (like KGSL on Android), and secure execution environments. Authorized memory operations are typically handled as follows:
1. Initialization Phase
- The GPU driver (KGSL) initializes the GPU and sets up memory mappings.
- The TrustZone or Secure Execution Environment (SEE) may be involved in verifying firmware and boot integrity.
2. Command Submission
- Memory operations (e.g., buffer allocation, mapping, copying) are submitted via command buffers.
- These buffers are managed by the GPU Command Processor (CP) and passed through the Ringbuffer.
3. Permission Check
- Before execution, the GPU driver and firmware perform permission checks:
- Is the memory region accessible to the current process?
- Is the memory marked as GPU-accessible?
- Are the command buffers properly signed or validated?
- These checks may involve IOMMU (Input-Output Memory Management Unit) to ensure memory isolation and protection.
Ref: The IOMMU (Input-Output Memory Management Unit) is responsible for managing DMA (Direct Memory Access) from I/O devices and ensuring that these devices can only access the memory they are authorized to. A problem where the IOMMU is not checking permissions would mean that I/O devices could potentially access memory they shouldn’t, leading to security vulnerabilities and system instability.
Vulnerability details: Memory corruption due to unauthorized command execution in GPU micronode while executing specific sequence of commands.
Official announcement: Please see the link for details
https://docs.qualcomm.com/product/publicresources/securitybulletin/june-2025-bulletin.html