Project

General

Profile

ExynosModemIsolation » History » Version 7

Denis 'GNUtoo' Carikli, 03/02/2020 10:49 AM
fix typo

1 7 Denis 'GNUtoo' Carikli
h1. Exynos 3110 devices with RAM chips shared between the modem and the system on a chip
2 1 Paul Kocialkowski
3 7 Denis 'GNUtoo' Carikli
This article talks about a very serious freedom, privacy and security issue we found during Replicant development.
4 1 Paul Kocialkowski
5 7 Denis 'GNUtoo' Carikli
We found that the modem wasn't isolated and was potentially able to read and write part of the RAM used by Replicant.
6
7
h2. Affected devices:
8
9
* Nexus S (GT-I9020)
10
* Nexus S (GT-I9020A)
11
* Nexus S (GT-I9023)
12
13 1 Paul Kocialkowski
h2. Hardware design matrix
14
15
|_. *Chip* |_. Controlled by the CPU |_. Controlled by the modem |_. Connected to the modem |
16
| GPS | Yes | No | No? |
17
| Audio CODEC | Yes | No | Yes |
18
| NAND | Yes | No | No |
19 3 Paul Kocialkowski
| RAM | Yes | Yes (96Mib at least) | Yes |
20 1 Paul Kocialkowski
| WiFi/Bluetooth | Yes | No | No |
21
| Sensors | Yes | No | No |
22
| NFC | Yes | No | No |
23
| Camera | Yes | No | No |
24
25 5 Denis 'GNUtoo' Carikli
h2. Modem isolation
26 1 Paul Kocialkowski
27 5 Denis 'GNUtoo' Carikli
The modem (XMM 6160) is separated from the SoC and communicates with it via serial over 16Mib of shared memory: this is bad since it means that RAM is compromised (at least 80Mib + 16Mib = 96Mib) and can be used to spy.
28
Regarding audio, the modem is connected to the CODEC but cannot control it (the SoC has to enable routing from/to the modem).
29
There is no evidence that the GPS is connected to the modem, but since we cannot check on the hardware, there is no proof it's not connected to it either. The SoC is able to control the GPS power though, so we can keep it off.
30
Since the SoC has to load the modem firmware over the (fake) serial, and following the datasheets, the modem is not connected to the NAND.
31
32 3 Paul Kocialkowski
The modem is able to spy on (at least) 96 Mib of the main memory. So far, we cannot tell:
33
* if it can only spy 80Mib or the full memory
34 1 Paul Kocialkowski
* if it can be fixed or not
35 4 Paul Kocialkowski
36
The Linux kernel is being loaded at the beginning of the shared memory bank (0x30000000), however the kernel should be off when it loads.
37 1 Paul Kocialkowski
38
h3. Kernel details
39
40 5 Denis 'GNUtoo' Carikli
In "kernel-crespo/arch/arm/mach-s5pv210/dev-herring-phone.c":https://git.replicant.us/replicant/kernel_samsung_crespo/tree/arch/arm/mach-s5pv210/dev-herring-phone.c#n49 we have:
41 1 Paul Kocialkowski
<pre>
42
static struct resource mdmctl_res[] = {
43
[...]
44
        [2] = {
45
                .name = "onedram",
46
                .start = (S5PV210_PA_SDRAM + 0x05000000),
47
                .end = (S5PV210_PA_SDRAM + 0x05000000 + SZ_16M - 1),
48
                .flags = IORESOURCE_MEM,
49
        },
50
};
51
</pre>
52
53
* S5PV210_PA_SDRAM is 0x30000000
54 3 Paul Kocialkowski
* 0x05000000 is 80Mib
55 1 Paul Kocialkowski
* mdmctl_res goes in a platform device struct which is passed to the modem driver:
56
57
<pre>
58
static struct platform_device modemctl = {
59
        .name = "modemctl",
60
        .id = -1,
61
        .num_resources = ARRAY_SIZE(mdmctl_res),
62
        .resource = mdmctl_res,
63
        .dev = {
64
                .platform_data = &mdmctl_data,
65
        },
66
};
67
</pre>
68
69 6 Denis 'GNUtoo' Carikli
And in the board file, in "kernel-crespo/arch/arm/mach-s5pv210/mach-herring.c":https://git.replicant.us/replicant/kernel_samsung_crespo/tree/arch/arm/mach-s5pv210/mach-herring.c#n5596 we have: 
70 1 Paul Kocialkowski
<pre>
71
static void __init herring_fixup(struct machine_desc *desc,
72
                struct tag *tags, char **cmdline,
73
                struct meminfo *mi)
74
{
75
        mi->bank[0].start = 0x30000000;
76
        mi->bank[0].size = 80 * SZ_1M;
77
        mi->bank[0].node = 0;
78
</pre>
79
80 3 Paul Kocialkowski
So we can suppose that there is at least one ram chip that is shared between the modem and the main CPU. Avoiding the use of this memory bank would result in loosing 80Mib of memory.
81 4 Paul Kocialkowski
82
h3. Fix attempt
83
84
An ideal fix fix would be to lose that 80Mib of RAM so that the shared memory can still be used for SoC/Modem communication but can't spy on the SoC data on RAM. The fact that it's the kernel loading address makes the task more difficult (it may require the bootloader cooperation, which is non-free).
85
86
The current diff with the Nexus S kernel is here, but it doesn't boot at all with the following changes (and mkbootimg changes):
87
88
<pre>
89
diff --git a/arch/arm/configs/herring_defconfig b/arch/arm/configs/herring_defconfig
90
old mode 100755
91
new mode 100644
92
index 11abbf0..99bf3f5
93
--- a/arch/arm/configs/herring_defconfig
94
+++ b/arch/arm/configs/herring_defconfig
95
@@ -1,7 +1,7 @@
96
 #
97
 # Automatically generated make config: don't edit
98
 # Linux kernel version: 2.6.35.7
99
-# Fri Jun  3 07:07:08 2011
100
+# Sun Apr  8 14:40:16 2012
101
 #
102
 CONFIG_ARM=y
103
 CONFIG_HAVE_PWM=y
104
@@ -418,8 +418,8 @@ CONFIG_ALIGNMENT_TRAP=y
105
 #
106
 CONFIG_ZBOOT_ROM_TEXT=0
107
 CONFIG_ZBOOT_ROM_BSS=0
108
-CONFIG_CMDLINE="console=ttyFIQ0"
109
-# CONFIG_CMDLINE_FORCE is not set
110
+CONFIG_CMDLINE="console=ttyFIQ0 no_console_suspend earlyprintk=serial,ttySAC2,115200 androidboot.serialno=3733BAB66DE200EC androidboot.bootloader=I9020XXKA3 androidboot.baseband=I9020XXKB3 androidboot.info=0x4,0x0,1 androidboot.carrier=EUR gain_code=3 s3cfb.bootloaderfb=0x34a00000 mach-herring.lcd_type=0x00000000 oem_state=unlocked"
111
+CONFIG_CMDLINE_FORCE=y
112
 # CONFIG_XIP_KERNEL is not set
113
 # CONFIG_KEXEC is not set
114
 
115
@@ -823,8 +823,6 @@ CONFIG_UEVENT_HELPER_PATH=""
116
 CONFIG_STANDALONE=y
117
 CONFIG_PREVENT_FIRMWARE_BUILD=y
118
 # CONFIG_FW_LOADER is not set
119
-# CONFIG_FIRMWARE_IN_KERNEL is not set
120
-CONFIG_EXTRA_FIRMWARE=""
121
 # CONFIG_DEBUG_DRIVER is not set
122
 # CONFIG_DEBUG_DEVRES is not set
123
 # CONFIG_SYS_HYPERVISOR is not set
124
@@ -835,7 +833,7 @@ CONFIG_MTD=y
125
 CONFIG_MTD_CONCAT=y
126
 CONFIG_MTD_PARTITIONS=y
127
 # CONFIG_MTD_REDBOOT_PARTS is not set
128
-# CONFIG_MTD_CMDLINE_PARTS is not set
129
+CONFIG_MTD_CMDLINE_PARTS=y
130
 # CONFIG_MTD_AFS_PARTS is not set
131
 # CONFIG_MTD_AR7_PARTS is not set
132
 
133
@@ -1191,6 +1189,7 @@ CONFIG_DEVKMEM=y
134
 CONFIG_SERIAL_SAMSUNG=y
135
 CONFIG_SERIAL_SAMSUNG_UARTS_4=y
136
 CONFIG_SERIAL_SAMSUNG_UARTS=4
137
+# CONFIG_SERIAL_SAMSUNG_DEBUG is not set
138
 CONFIG_SERIAL_SAMSUNG_CONSOLE=y
139
 CONFIG_SERIAL_S5PV210=y
140
 # CONFIG_SERIAL_MAX3100 is not set
141
@@ -2046,7 +2045,9 @@ CONFIG_HAVE_ARCH_KGDB=y
142
 CONFIG_DEBUG_USER=y
143
 CONFIG_DEBUG_ERRORS=y
144
 # CONFIG_DEBUG_STACK_USAGE is not set
145
-# CONFIG_DEBUG_LL is not set
146
+CONFIG_DEBUG_LL=y
147
+CONFIG_EARLY_PRINTK=y
148
+# CONFIG_DEBUG_ICEDCC is not set
149
 CONFIG_OC_ETM=y
150
 CONFIG_DEBUG_S3C_UART=2
151
 
152
diff --git a/arch/arm/mach-s5pv210/dev-herring-phone.c b/arch/arm/mach-s5pv210/dev-herring-phone.c
153
index f8798b3..ecef636 100755
154
--- a/arch/arm/mach-s5pv210/dev-herring-phone.c
155
+++ b/arch/arm/mach-s5pv210/dev-herring-phone.c
156
@@ -48,8 +48,8 @@ static struct resource mdmctl_res[] = {
157
 	},
158
 	[2] = {
159
 		.name = "onedram",
160
-		.start = (S5PV210_PA_SDRAM + 0x05000000),
161
-		.end = (S5PV210_PA_SDRAM + 0x05000000 + SZ_16M - 1),
162
+		.start = (0x30000000  + 0x05000000),
163
+		.end = (0x30000000  + 0x05000000 + SZ_16M - 1),
164
 		.flags = IORESOURCE_MEM,
165
 	},
166
 };
167
diff --git a/arch/arm/mach-s5pv210/mach-herring.c b/arch/arm/mach-s5pv210/mach-herring.c
168
index c3a0182..67fa1cf 100755
169
--- a/arch/arm/mach-s5pv210/mach-herring.c
170
+++ b/arch/arm/mach-s5pv210/mach-herring.c
171
@@ -5494,21 +5494,17 @@ static void __init herring_fixup(struct machine_desc *desc,
172
 		struct tag *tags, char **cmdline,
173
 		struct meminfo *mi)
174
 {
175
-	mi->bank[0].start = 0x30000000;
176
-	mi->bank[0].size = 80 * SZ_1M;
177
+	mi->bank[0].start = 0x40000000;
178
+	mi->bank[0].size = 256 * SZ_1M;
179
 	mi->bank[0].node = 0;
180
 
181
-	mi->bank[1].start = 0x40000000;
182
-	mi->bank[1].size = 256 * SZ_1M;
183
-	mi->bank[1].node = 1;
184
-
185
-	mi->bank[2].start = 0x50000000;
186
+	mi->bank[1].start = 0x50000000;
187
 	/* 1M for ram_console buffer */
188
-	mi->bank[2].size = 127 * SZ_1M;
189
-	mi->bank[2].node = 2;
190
-	mi->nr_banks = 3;
191
+	mi->bank[1].size = 127 * SZ_1M;
192
+	mi->bank[1].node = 1;
193
+	mi->nr_banks = 2;
194
 
195
-	ram_console_start = mi->bank[2].start + mi->bank[2].size;
196
+	ram_console_start = mi->bank[1].start + mi->bank[1].size;
197
 	ram_console_size = SZ_1M - SZ_4K;
198
 
199
 	pm_debug_scratchpad = ram_console_start + ram_console_size;
200
</pre>
201
202
<pre>
203
diff --git a/BoardConfigCommon.mk b/BoardConfigCommon.mk
204
index fff6d1b..c09d935 100755
205
--- a/BoardConfigCommon.mk
206
+++ b/BoardConfigCommon.mk
207
@@ -51,10 +51,10 @@ DEFAULT_FB_NUM := 2
208
 
209
 BOARD_NAND_PAGE_SIZE := 4096 -s 128
210
 
211
-BOARD_KERNEL_BASE := 0x30000000
212
+BOARD_KERNEL_BASE := 0x40000000
213
 BOARD_KERNEL_PAGESIZE := 4096
214
-BOARD_KERNEL_CMDLINE := console=ttyFIQ0 no_console_suspend
215
-
216
+BOARD_KERNEL_CMDLINE := console=ttyFIQ0 no_console_suspend earlyprintk=serial,ttySAC2,115200 bootmem_debug
217
+BOARD_FORCE_RAMDISK_ADDRESS := 0x41000000
218
 #TARGET_RECOVERY_UI_LIB := librecovery_ui_crespo
219
 TARGET_RELEASETOOLS_EXTENSIONS := device/samsung/crespo
220
</pre>