linux-kernel - Re: [PATCH 4/9] arm64: dts: qcom: msm8916: Reserve firmware memory dynamically

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Wed, 13 Sep 2023 21:39:50 +0200
From:   Konrad Dybcio <konrad.dybcio@...aro.org>
To:     Stephan Gerhold <stephan@...hold.net>,
        Bryan O'Donoghue <bryan.odonoghue@...aro.org>
Cc:     Bjorn Andersson <andersson@...nel.org>,
        Andy Gross <agross@...nel.org>, linux-arm-msm@...r.kernel.org,
        devicetree@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH 4/9] arm64: dts: qcom: msm8916: Reserve firmware memory
 dynamically

On 13.09.2023 12:14, Stephan Gerhold wrote:
> On Wed, Sep 13, 2023 at 10:12:12AM +0100, Bryan O'Donoghue wrote:
>> On 13/09/2023 10:06, Konrad Dybcio wrote:
>>> On 11.09.2023 19:41, Stephan Gerhold wrote:
>>>> Most of the reserved firmware memory on MSM8916 can be relocated when
>>>> respecting the required alignment. To avoid having to precompute the
>>>> reserved memory regions in every board DT, describe the actual
>>>> requirements (size, alignment, alloc-ranges) using the dynamic reserved
>>>> memory allocation.
>>>>
>>>> This approach has several advantages:
>>>>
>>>>   1. We can define "templates" for the reserved memory regions in
>>>>      msm8916.dtsi and keep only device-specific details in the board DT.
>>>>      This is useful for the "mpss" region size for example, which varies
>>>>      from device to device. It is no longer necessary to redefine all
>>>>      firmware regions to shift their addresses.
>>>>
>>>>   2. When some of the functionality (e.g. WCNSS, Modem, Venus) is not
>>>>      enabled or needed for a device, the reserved memory can stay
>>>>      disabled, freeing up the unused reservation for Linux.
>>>>
>>>>   3. Devices with special requirements for one of the firmware regions
>>>>      are handled automatically. For example, msm8916-longcheer-l8150
>>>>      has non-relocatable "wcnss" firmware that must be loaded exactly
>>>>      at address 0x8b600000. When this is defined as a static region,
>>>>      the other dynamic allocations automatically adjust to a different
>>>>      place with suitable alignment.
>>>>
>>>> All in all this approach significantly reduces the boilerplate necessary
>>>> to define the different firmware regions, and makes it easier to enable
>>>> functionality on the different devices.
>>>>
>>>> Signed-off-by: Stephan Gerhold <stephan@...hold.net>
>>>> ---
>>> [...]
>>>
>>>>   		mpss_mem: mpss@...00000 {
>>>> +			/*
>>>> +			 * The memory region for the mpss firmware is generally
>>>> +			 * relocatable and could be allocated dynamically.
>>>> +			 * However, many firmware versions tend to fail when
>>>> +			 * loaded to some special addresses, so it is hard to
>>>> +			 * define reliable alloc-ranges.
>>>> +			 *
>>>> +			 * alignment = <0x0 0x400000>;
>>>> +			 * alloc-ranges = <0x0 0x86800000 0x0 0x8000000>;
>>>> +			 */
>>> Do we know of any devices that this would actually work on?
> 
> Yes, the "modem" firmware on DB410c seems to be fine with literally all
> correctly aligned addresses I've tested so far. But when I manually
> experimented with other addresses on actual smartphones it exploded on
> certain addresses, specific to the firmware version / device.
Moreover, the "modem" on DB410c would probably be fine with
*anything* you try to give it..

[...]

> 
>  - On DB410c it works just fine. All addresses I tried work without any
>    problems.
> 
>  - On longcheer-l8150 the modem firmare works fine when the memory
>    region starts somewhere between 0x86800000 and 0x8a800000. It also
>    works again after 0x8e800000. But on anything between 0x8a800000 and
>    0x8e800000 it's broken for who knows what reason.
> 
>  - On some Samsung devices only 0x86800000 and maybe one or two other
>    addresses worked, again for who knows what reason. Most other
>    addresses were broken.
Were you able to find a phone (likely a very reference-design-based
one) that this worked on, btw?

[...]

> To be safe my conclusion was to keep mpss at a fixed address and only
> allocate the others dynamically. This is how the patch implements it.
That sounds like the sane approach indeed.

Konrad