From c3cdcaddc2241a2e31aa45c2866ac620929d9a15 Mon Sep 17 00:00:00 2001
From: "Isaac J. Manjarres" <isaacm@quicinc.com>
Date: Tue, 1 Sep 2020 01:30:19 -0700
Subject: [PATCH] ARM: dts: msm: Use a carveout for memshare memory

The memshare driver currently uses CMA memory for its usecases. This
is problematic, as CMA memory has a normal cached mapping in the kernel,
which allows for speculative access. This makes it possible for a
speculative cache-line fill to occur, prior to the memory being unmapped
from the stage-2 page tables of Linux, as well as XPU protected. The
cache-line can later be evicted, while the memory is still XPU protected.
This results in a write to the system cache, which is blocked by the XPU,
resulting in an XPU violation.

Given the nature of the memshare usecases (i.e. the memory is allocated
once, and never given back to Linux), move the memshare driver to using
a carveout. Using a carveout makes it so that there are no normal cached
mappings in the kernel for the memory, which prevents speculative
cache-line fills from occurring.

Change-Id: I97e2fe144c8fde364ecd40fdd181a881ca93c4b1
---
 qcom/holi.dtsi    |  9 +++++++++
 qcom/lahaina.dtsi | 14 ++++++++++++++
 qcom/shima.dtsi   |  9 +++++++++
 3 files changed, 32 insertions(+)

diff --git a/qcom/holi.dtsi b/qcom/holi.dtsi
index bb11e3532557..b6200c578fcd 100644
--- a/qcom/holi.dtsi
+++ b/qcom/holi.dtsi
@@ -381,6 +381,14 @@
 			alignment = <0x0 0x400000>;
 			size = <0x0 0x1000000>;
 		};
+
+		memshare_mem: memshare_region {
+			compatible = "shared-dma-pool";
+			no-map;
+			alloc-ranges = <0x0 0x00000000 0x0 0xffffffff>;
+			alignment = <0x0 0x100000>;
+			size = <0x0 0x800000>;
+		};
 	};
 
 	soc: soc { };
@@ -1044,6 +1052,7 @@
 		qcom,client_3 {
 			compatible = "qcom,memshare-peripheral";
 			qcom,peripheral-size = <0x500000>;
+			memory-region = <&memshare_mem>;
 			qcom,client-id = <1>;
 			qcom,allocate-on-request;
 			label = "modem";
diff --git a/qcom/lahaina.dtsi b/qcom/lahaina.dtsi
index ad41e9a34f1d..24a2aa33f694 100644
--- a/qcom/lahaina.dtsi
+++ b/qcom/lahaina.dtsi
@@ -523,6 +523,19 @@
 			label = "dfps_data_region";
 		};
 
+		memshare_mem: memshare_region {
+			compatible = "shared-dma-pool";
+			no-map;
+			/*
+			 * Memory shared with modem needs to be outside of
+			 * the CLADE address space, which begins at
+			 * 0xE0000000 and spans 512 MB.
+			 */
+			alloc-ranges = <0x0 0x00000000 0x0 0xdfffffff>;
+			alignment = <0x0 0x100000>;
+			size = <0x0 0x800000>;
+		};
+
 		non_secure_display_memory: non_secure_display_region {
 			compatible = "shared-dma-pool";
 			alloc-ranges = <0x0 0x00000000 0x0 0xffffffff>;
@@ -2288,6 +2301,7 @@
 		qcom,client_3 {
 			compatible = "qcom,memshare-peripheral";
 			qcom,peripheral-size = <0x500000>;
+			memory-region = <&memshare_mem>;
 			qcom,client-id = <1>;
 			qcom,allocate-on-request;
 			label = "modem";
diff --git a/qcom/shima.dtsi b/qcom/shima.dtsi
index c60a2aa56528..1fbf1e069ec4 100644
--- a/qcom/shima.dtsi
+++ b/qcom/shima.dtsi
@@ -428,6 +428,14 @@
 			size = <0x0 0x400000>;
 		};
 
+		memshare_mem: memshare_region {
+			compatible = "shared-dma-pool";
+			no-map;
+			alloc-ranges = <0x0 0x00000000 0x0 0xffffffff>;
+			alignment = <0x0 0x100000>;
+			size = <0x0 0x800000>;
+		};
+
 		dump_mem: mem_dump_region {
 			compatible = "shared-dma-pool";
 			alloc-ranges = <0x0 0x00000000 0x0 0xffffffff>;
@@ -775,6 +783,7 @@
 		qcom,client_3 {
 			compatible = "qcom,memshare-peripheral";
 			qcom,peripheral-size = <0x500000>;
+			memory-region = <&memshare_mem>;
 			qcom,client-id = <1>;
 			qcom,allocate-on-request;
 			label = "modem";