linux-kernel - Re: [PATCH] arm64: dts: qcom: sdm845: Define guard pages within the rmtfs region

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <789a2ffa637842215084a39eeee94993a315ccbe@postmarketos.org>
Date: Tue, 21 Oct 2025 02:49:50 +0000
From: "Paul Sajna" <sajattack@...tmarketos.org>
To: david@...t.cz, "Bjorn Andersson" <andersson@...nel.org>, "Konrad Dybcio"
 <konradybcio@...nel.org>, "Rob Herring" <robh@...nel.org>, "Krzysztof
 Kozlowski" <krzk+dt@...nel.org>, "Conor Dooley" <conor+dt@...nel.org>
Cc: linux-arm-msm@...r.kernel.org, devicetree@...r.kernel.org,
 linux-kernel@...r.kernel.org, phone-devel@...r.kernel.org, "David
 Heidelberg" <david@...t.cz>
Subject: Re: [PATCH] arm64: dts: qcom: sdm845: Define guard pages within the
 rmtfs region

October 20, 2025 at 9:12 PM, "David Heidelberg via B4 Relay" <devnull+david.ixit.cz@...nel.org mailto:devnull+david.ixit.cz@...nel.org?to=%22David%20Heidelberg%20via%20B4%20Relay%22%20%3Cdevnull%2Bdavid.ixit.cz%40kernel.org%3E > wrote:


> 
> From: David Heidelberg <david@...t.cz>
> 
> Use qcom,use-guard-pages property instead of polluting device-tree with
> lower and upper rmtfs guard nodes.
> 
> No functional change intended.
> 
> cosmetic: set name the node rmtfs-region.
> 
> Signed-off-by: David Heidelberg <david@...t.cz>
> ---
> Tested on OnePlus 6T.
> ---
>  arch/arm64/boot/dts/qcom/sdm845-lg-common.dtsi | 17 +++--------------
>  arch/arm64/boot/dts/qcom/sdm845-oneplus-common.dtsi | 18 +++---------------
>  2 files changed, 6 insertions(+), 29 deletions(-)
> 
> diff --git a/arch/arm64/boot/dts/qcom/sdm845-lg-common.dtsi b/arch/arm64/boot/dts/qcom/sdm845-lg-common.dtsi
> index 99dafc6716e76..83b98bad19dd2 100644
> --- a/arch/arm64/boot/dts/qcom/sdm845-lg-common.dtsi
> +++ b/arch/arm64/boot/dts/qcom/sdm845-lg-common.dtsi
> @@ -99,26 +99,15 @@ memory@...00000 {
>  no-map;
>  };
>  
> - /* rmtfs lower guard */
> - memory@...00000 {
> - reg = <0 0xf0800000 0 0x1000>;
> - no-map;
> - };
> -
> - rmtfs_mem: memory@...01000 {
> + rmtfs_mem: rmtfs-region@...00000 {
>  compatible = "qcom,rmtfs-mem";
> - reg = <0 0xf0801000 0 0x200000>;
> + reg = <0 0xf0800000 0 0x202000>;
> + qcom,use-guard-pages;
>  no-map;
>  
>  qcom,client-id = <1>;
>  qcom,vmid = <QCOM_SCM_VMID_MSS_MSA>;
>  };
> -
> - /* rmtfs upper guard */
> - memory@...01000 {
> - reg = <0 0xf0a01000 0 0x1000>;
> - no-map;
> - };
>  };
>  
>  gpio-keys {
> diff --git a/arch/arm64/boot/dts/qcom/sdm845-oneplus-common.dtsi b/arch/arm64/boot/dts/qcom/sdm845-oneplus-common.dtsi
> index dcfffb271fcf3..61d63003fa371 100644
> --- a/arch/arm64/boot/dts/qcom/sdm845-oneplus-common.dtsi
> +++ b/arch/arm64/boot/dts/qcom/sdm845-oneplus-common.dtsi
> @@ -75,32 +75,20 @@ key-vol-up {
>  };
>  
>  reserved-memory {
> - /*
> - * The rmtfs_mem needs to be guarded due to "XPU limitations"
> - * it is otherwise possible for an allocation adjacent to the
> - * rmtfs_mem region to trigger an XPU violation, causing a crash.
> - */
> - rmtfs_lower_guard: rmtfs-lower-guard@...00000 {
> - no-map;
> - reg = <0 0xf5b00000 0 0x1000>;
> - };
>  /*
>  * The rmtfs memory region in downstream is 'dynamically allocated'
>  * but given the same address every time. Hard code it as this address is
>  * where the modem firmware expects it to be.
>  */
> - rmtfs_mem: rmtfs-mem@...01000 {
> + rmtfs_mem: rmtfs-region@...00000 {
>  compatible = "qcom,rmtfs-mem";
> - reg = <0 0xf5b01000 0 0x200000>;
> + reg = <0 0xf5b00000 0 0x202000>;
> + qcom,use-guard-pages;
>  no-map;
>  
>  qcom,client-id = <1>;
>  qcom,vmid = <QCOM_SCM_VMID_MSS_MSA>;
>  };
> - rmtfs_upper_guard: rmtfs-upper-guard@...01000 {
> - no-map;
> - reg = <0 0xf5d01000 0 0x1000>;
> - };
>  
>  /*
>  * It seems like reserving the old rmtfs_mem region is also needed to prevent
> 
> ---
> base-commit: 606da5bb165594c052ee11de79bf05bc38bc1aa6
> change-id: 20251020-sdm845-use-guard-pages-9c2b2fa0b71e
> 
> Best regards,
> -- 
> David Heidelberg <david@...t.cz>
>

I tried something similar before and didn't have much luck with it. I'll test your patch when I have time.