Project

General

Profile

ExynosModemIsolation » History » Version 18

Denis 'GNUtoo' Carikli, 03/02/2020 11:40 AM

1 9 Denis 'GNUtoo' Carikli
h1. Exynos 3110 modem isolation
2 1 Paul Kocialkowski
3 11 Denis 'GNUtoo' Carikli
{{toc}}
4
5 7 Denis 'GNUtoo' Carikli
This article talks about a very serious freedom, privacy and security issue we found during Replicant development.
6 1 Paul Kocialkowski
7 9 Denis 'GNUtoo' Carikli
We found that the modem wasn't isolated and was potentially able to read and write part of the RAM used by Replicant on several devices with an Exynos 3110.
8 7 Denis 'GNUtoo' Carikli
9
h2. Affected devices:
10
11 10 Denis 'GNUtoo' Carikli
At least the following devices are affected:
12
13
* Galaxy S (GT-I9000)
14 7 Denis 'GNUtoo' Carikli
* Nexus S (GT-I9020)
15
* Nexus S (GT-I9020A)
16
* Nexus S (GT-I9023)
17
18 1 Paul Kocialkowski
h2. Hardware design matrix
19
20
|_. *Chip* |_. Controlled by the CPU |_. Controlled by the modem |_. Connected to the modem |
21
| GPS | Yes | No | No? |
22
| Audio CODEC | Yes | No | Yes |
23
| NAND | Yes | No | No |
24 3 Paul Kocialkowski
| RAM | Yes | Yes (96Mib at least) | Yes |
25 1 Paul Kocialkowski
| WiFi/Bluetooth | Yes | No | No |
26
| Sensors | Yes | No | No |
27
| NFC | Yes | No | No |
28
| Camera | Yes | No | No |
29
30 5 Denis 'GNUtoo' Carikli
h2. Modem isolation
31 1 Paul Kocialkowski
32 15 Denis 'GNUtoo' Carikli
The modem (XMM 6160) is separated from the System on a chip and communicates with it over 16Mib of shared memory that comes from a 96MiB RAM chip.
33
34
The issue is that the remaining 80M of this RAM chip are also used as normal RAM by the CPU running Replicant.
35
36
Because of that, we don't have any assurance that the modem cannot read and write all the memory in that RAM chip, enabling it to either passively monitor what is going on, and/or to take control of the CPU running Replicant.
37
38
While the hardware design could ensure that only some lines of the data address are made accessible to the modem, we don't have enough documentation to verify that, and even if it was the case it couldn't be guaranteed for every single device used with Replicant.
39
40
This is bad: it means that RAM in general is potentially compromised.
41
42 5 Denis 'GNUtoo' Carikli
Regarding audio, the modem is connected to the CODEC but cannot control it (the SoC has to enable routing from/to the modem).
43
There is no evidence that the GPS is connected to the modem, but since we cannot check on the hardware, there is no proof it's not connected to it either. The SoC is able to control the GPS power though, so we can keep it off.
44 1 Paul Kocialkowski
Since the SoC has to load the modem firmware over the (fake) serial, and following the datasheets, the modem is not connected to the NAND.
45 5 Denis 'GNUtoo' Carikli
46 15 Denis 'GNUtoo' Carikli
The modem is potentially able to read and write (at least) 96 Mib of the main memory. So far, we cannot tell:
47 3 Paul Kocialkowski
* if it can only spy 80Mib or the full memory
48 1 Paul Kocialkowski
* if it can be fixed or not
49 4 Paul Kocialkowski
50
The Linux kernel is being loaded at the beginning of the shared memory bank (0x30000000), however the kernel should be off when it loads.
51 1 Paul Kocialkowski
52 12 Denis 'GNUtoo' Carikli
h3. Nexus S (GT-I902x) Kernel details
53 1 Paul Kocialkowski
54 5 Denis 'GNUtoo' Carikli
In "kernel-crespo/arch/arm/mach-s5pv210/dev-herring-phone.c":https://git.replicant.us/replicant/kernel_samsung_crespo/tree/arch/arm/mach-s5pv210/dev-herring-phone.c#n49 we have:
55 1 Paul Kocialkowski
<pre>
56
static struct resource mdmctl_res[] = {
57
[...]
58
        [2] = {
59
                .name = "onedram",
60
                .start = (S5PV210_PA_SDRAM + 0x05000000),
61
                .end = (S5PV210_PA_SDRAM + 0x05000000 + SZ_16M - 1),
62
                .flags = IORESOURCE_MEM,
63
        },
64
};
65
</pre>
66
67
* S5PV210_PA_SDRAM is 0x30000000
68
* 0x05000000 is 80Mib
69
70 15 Denis 'GNUtoo' Carikli
So for this RAM chip we have:
71
72 17 Denis 'GNUtoo' Carikli
|_. CPU physical address range |_. Usage |
73
| 0x30000000 -> 0x30000000 + 80MiB -1 | System RAM |
74
| 0x30000000 + 80MiB -> 0x30000000 + 80MiB + 16MiB - 1 | Modem shared memory |
75 15 Denis 'GNUtoo' Carikli
76
77
mdmctl_res goes in a platform device struct which is passed to the modem driver:
78
79 1 Paul Kocialkowski
<pre>
80
static struct platform_device modemctl = {
81
        .name = "modemctl",
82
        .id = -1,
83
        .num_resources = ARRAY_SIZE(mdmctl_res),
84
        .resource = mdmctl_res,
85
        .dev = {
86
                .platform_data = &mdmctl_data,
87
        },
88
};
89
</pre>
90
91 6 Denis 'GNUtoo' Carikli
And in the board file, in "kernel-crespo/arch/arm/mach-s5pv210/mach-herring.c":https://git.replicant.us/replicant/kernel_samsung_crespo/tree/arch/arm/mach-s5pv210/mach-herring.c#n5596 we have: 
92 1 Paul Kocialkowski
<pre>
93
static void __init herring_fixup(struct machine_desc *desc,
94
                struct tag *tags, char **cmdline,
95
                struct meminfo *mi)
96
{
97
        mi->bank[0].start = 0x30000000;
98
        mi->bank[0].size = 80 * SZ_1M;
99
        mi->bank[0].node = 0;
100 14 Denis 'GNUtoo' Carikli
        [...]
101
}
102 1 Paul Kocialkowski
</pre>
103 3 Paul Kocialkowski
104 18 Denis 'GNUtoo' Carikli
So we can suppose that there is at least one ram chip that is shared between the modem and the main CPU. Avoiding the use of this memory bank would result in loosing at least 80Mib of memory.
105 13 Denis 'GNUtoo' Carikli
106
h3. Galaxy S (GT-I9000) Kernel details
107
108
In "arch/arm/mach-s5pv210/dev-s1-phone.c":https://git.replicant.us/replicant/kernel_samsung_aries/tree/arch/arm/mach-s5pv210/dev-s1-phone.c#n43 we have:
109
<pre>
110
static struct resource onedram_res[] = {
111
[...]
112
	[0] = {
113
		.start = (S5PV210_PA_SDRAM + 0x05000000),
114
		.end = (S5PV210_PA_SDRAM + 0x05000000 + SZ_16M - 1),
115
		.flags = IORESOURCE_MEM,
116
		},
117
};
118 1 Paul Kocialkowski
</pre>
119
120
* S5PV210_PA_SDRAM is 0x30000000
121
* 0x05000000 is 80Mib
122 15 Denis 'GNUtoo' Carikli
123
So for this RAM chip we have:
124
125 17 Denis 'GNUtoo' Carikli
|_. CPU physical address range |_. Usage |
126
| 0x30000000 -> 0x30000000 + 80MiB -1 | System RAM |
127
| 0x30000000 + 80MiB -> 0x30000000 + 80MiB + 16MiB - 1 | Modem shared memory |
128 15 Denis 'GNUtoo' Carikli
129
mdmctl_res goes in a platform device struct which is passed to the modem driver:
130 13 Denis 'GNUtoo' Carikli
131
<pre>
132
static struct platform_device onedram = {
133
		.name = "onedram",
134
		.id = -1,
135
		.num_resources = ARRAY_SIZE(onedram_res),
136
		.resource = onedram_res,
137
		.dev = {
138
			.platform_data = &onedram_data,
139
			},
140
		};
141
</pre>
142
143
And in the board file, in "arch/arm/mach-s5pv210/mach-aries.c":https://git.replicant.us/replicant/kernel_samsung_aries/tree/arch/arm/mach-s5pv210/mach-aries.c#n5204 we have: 
144
<pre>
145
static void __init aries_fixup(struct machine_desc *desc,
146
		struct tag *tags, char **cmdline,
147
		struct meminfo *mi)
148
{
149
	mi->bank[0].start = 0x30000000;
150
	mi->bank[0].size = 80 * SZ_1M;
151
        [...]
152
}
153
</pre>
154
155 18 Denis 'GNUtoo' Carikli
So we can suppose that there is at least one ram chip that is shared between the modem and the main CPU. Avoiding the use of this memory bank would result in loosing at least 80Mib of memory.
156 13 Denis 'GNUtoo' Carikli
157 8 Denis 'GNUtoo' Carikli
h3. Workaround attempt
158 1 Paul Kocialkowski
159 8 Denis 'GNUtoo' Carikli
It might be possible to limit the amount of damage by relying on the fact that the modem has to be booted by Replicant, and make sure that the RAM chip that is shared with the modem isn't used for other things than this memory sharing.
160
161
This would make us lose about 80Mib of RAM, and the shared memory would still be used for SoC/Modem communication but as the RAM chip would be used only for that, so the modem would not be able read and write problematic data on it.
162
163
We would also need to make sure that the booloader doesn't load the kernel in that region or that the kernel is relocated to some other region before intializing the modem.
164 4 Paul Kocialkowski
165
The current diff with the Nexus S kernel is here, but it doesn't boot at all with the following changes (and mkbootimg changes):
166
167
<pre>
168
diff --git a/arch/arm/configs/herring_defconfig b/arch/arm/configs/herring_defconfig
169
old mode 100755
170
new mode 100644
171
index 11abbf0..99bf3f5
172
--- a/arch/arm/configs/herring_defconfig
173
+++ b/arch/arm/configs/herring_defconfig
174
@@ -1,7 +1,7 @@
175
 #
176
 # Automatically generated make config: don't edit
177
 # Linux kernel version: 2.6.35.7
178
-# Fri Jun  3 07:07:08 2011
179
+# Sun Apr  8 14:40:16 2012
180
 #
181
 CONFIG_ARM=y
182
 CONFIG_HAVE_PWM=y
183
@@ -418,8 +418,8 @@ CONFIG_ALIGNMENT_TRAP=y
184
 #
185
 CONFIG_ZBOOT_ROM_TEXT=0
186
 CONFIG_ZBOOT_ROM_BSS=0
187
-CONFIG_CMDLINE="console=ttyFIQ0"
188
-# CONFIG_CMDLINE_FORCE is not set
189
+CONFIG_CMDLINE="console=ttyFIQ0 no_console_suspend earlyprintk=serial,ttySAC2,115200 androidboot.serialno=3733BAB66DE200EC androidboot.bootloader=I9020XXKA3 androidboot.baseband=I9020XXKB3 androidboot.info=0x4,0x0,1 androidboot.carrier=EUR gain_code=3 s3cfb.bootloaderfb=0x34a00000 mach-herring.lcd_type=0x00000000 oem_state=unlocked"
190
+CONFIG_CMDLINE_FORCE=y
191
 # CONFIG_XIP_KERNEL is not set
192
 # CONFIG_KEXEC is not set
193
 
194
@@ -823,8 +823,6 @@ CONFIG_UEVENT_HELPER_PATH=""
195
 CONFIG_STANDALONE=y
196
 CONFIG_PREVENT_FIRMWARE_BUILD=y
197
 # CONFIG_FW_LOADER is not set
198
-# CONFIG_FIRMWARE_IN_KERNEL is not set
199
-CONFIG_EXTRA_FIRMWARE=""
200
 # CONFIG_DEBUG_DRIVER is not set
201
 # CONFIG_DEBUG_DEVRES is not set
202
 # CONFIG_SYS_HYPERVISOR is not set
203
@@ -835,7 +833,7 @@ CONFIG_MTD=y
204
 CONFIG_MTD_CONCAT=y
205
 CONFIG_MTD_PARTITIONS=y
206
 # CONFIG_MTD_REDBOOT_PARTS is not set
207
-# CONFIG_MTD_CMDLINE_PARTS is not set
208
+CONFIG_MTD_CMDLINE_PARTS=y
209
 # CONFIG_MTD_AFS_PARTS is not set
210
 # CONFIG_MTD_AR7_PARTS is not set
211
 
212
@@ -1191,6 +1189,7 @@ CONFIG_DEVKMEM=y
213
 CONFIG_SERIAL_SAMSUNG=y
214
 CONFIG_SERIAL_SAMSUNG_UARTS_4=y
215
 CONFIG_SERIAL_SAMSUNG_UARTS=4
216
+# CONFIG_SERIAL_SAMSUNG_DEBUG is not set
217
 CONFIG_SERIAL_SAMSUNG_CONSOLE=y
218
 CONFIG_SERIAL_S5PV210=y
219
 # CONFIG_SERIAL_MAX3100 is not set
220
@@ -2046,7 +2045,9 @@ CONFIG_HAVE_ARCH_KGDB=y
221
 CONFIG_DEBUG_USER=y
222
 CONFIG_DEBUG_ERRORS=y
223
 # CONFIG_DEBUG_STACK_USAGE is not set
224
-# CONFIG_DEBUG_LL is not set
225
+CONFIG_DEBUG_LL=y
226
+CONFIG_EARLY_PRINTK=y
227
+# CONFIG_DEBUG_ICEDCC is not set
228
 CONFIG_OC_ETM=y
229
 CONFIG_DEBUG_S3C_UART=2
230
 
231
diff --git a/arch/arm/mach-s5pv210/dev-herring-phone.c b/arch/arm/mach-s5pv210/dev-herring-phone.c
232
index f8798b3..ecef636 100755
233
--- a/arch/arm/mach-s5pv210/dev-herring-phone.c
234
+++ b/arch/arm/mach-s5pv210/dev-herring-phone.c
235
@@ -48,8 +48,8 @@ static struct resource mdmctl_res[] = {
236
 	},
237
 	[2] = {
238
 		.name = "onedram",
239
-		.start = (S5PV210_PA_SDRAM + 0x05000000),
240
-		.end = (S5PV210_PA_SDRAM + 0x05000000 + SZ_16M - 1),
241
+		.start = (0x30000000  + 0x05000000),
242
+		.end = (0x30000000  + 0x05000000 + SZ_16M - 1),
243
 		.flags = IORESOURCE_MEM,
244
 	},
245
 };
246
diff --git a/arch/arm/mach-s5pv210/mach-herring.c b/arch/arm/mach-s5pv210/mach-herring.c
247
index c3a0182..67fa1cf 100755
248
--- a/arch/arm/mach-s5pv210/mach-herring.c
249
+++ b/arch/arm/mach-s5pv210/mach-herring.c
250
@@ -5494,21 +5494,17 @@ static void __init herring_fixup(struct machine_desc *desc,
251
 		struct tag *tags, char **cmdline,
252
 		struct meminfo *mi)
253
 {
254
-	mi->bank[0].start = 0x30000000;
255
-	mi->bank[0].size = 80 * SZ_1M;
256
+	mi->bank[0].start = 0x40000000;
257
+	mi->bank[0].size = 256 * SZ_1M;
258
 	mi->bank[0].node = 0;
259
 
260
-	mi->bank[1].start = 0x40000000;
261
-	mi->bank[1].size = 256 * SZ_1M;
262
-	mi->bank[1].node = 1;
263
-
264
-	mi->bank[2].start = 0x50000000;
265
+	mi->bank[1].start = 0x50000000;
266
 	/* 1M for ram_console buffer */
267
-	mi->bank[2].size = 127 * SZ_1M;
268
-	mi->bank[2].node = 2;
269
-	mi->nr_banks = 3;
270
+	mi->bank[1].size = 127 * SZ_1M;
271
+	mi->bank[1].node = 1;
272
+	mi->nr_banks = 2;
273
 
274
-	ram_console_start = mi->bank[2].start + mi->bank[2].size;
275
+	ram_console_start = mi->bank[1].start + mi->bank[1].size;
276
 	ram_console_size = SZ_1M - SZ_4K;
277
 
278
 	pm_debug_scratchpad = ram_console_start + ram_console_size;
279
</pre>
280
281
<pre>
282
diff --git a/BoardConfigCommon.mk b/BoardConfigCommon.mk
283
index fff6d1b..c09d935 100755
284
--- a/BoardConfigCommon.mk
285
+++ b/BoardConfigCommon.mk
286
@@ -51,10 +51,10 @@ DEFAULT_FB_NUM := 2
287
 
288
 BOARD_NAND_PAGE_SIZE := 4096 -s 128
289
 
290
-BOARD_KERNEL_BASE := 0x30000000
291
+BOARD_KERNEL_BASE := 0x40000000
292
 BOARD_KERNEL_PAGESIZE := 4096
293
-BOARD_KERNEL_CMDLINE := console=ttyFIQ0 no_console_suspend
294
-
295
+BOARD_KERNEL_CMDLINE := console=ttyFIQ0 no_console_suspend earlyprintk=serial,ttySAC2,115200 bootmem_debug
296
+BOARD_FORCE_RAMDISK_ADDRESS := 0x41000000
297
 #TARGET_RECOVERY_UI_LIB := librecovery_ui_crespo
298
 TARGET_RELEASETOOLS_EXTENSIONS := device/samsung/crespo
299
</pre>