From patchwork Fri Apr 4 02:15:18 2014 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Kees Cook X-Patchwork-Id: 3935431 Return-Path: X-Original-To: patchwork-linux-arm@patchwork.kernel.org Delivered-To: patchwork-parsemail@patchwork1.web.kernel.org Received: from mail.kernel.org (mail.kernel.org [198.145.19.201]) by patchwork1.web.kernel.org (Postfix) with ESMTP id 689C79F357 for ; Fri, 4 Apr 2014 02:18:29 +0000 (UTC) Received: from mail.kernel.org (localhost [127.0.0.1]) by mail.kernel.org (Postfix) with ESMTP id 5E30120375 for ; Fri, 4 Apr 2014 02:18:28 +0000 (UTC) Received: from casper.infradead.org (casper.infradead.org [85.118.1.10]) (using TLSv1.2 with cipher DHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id 37F0C2035D for ; Fri, 4 Apr 2014 02:18:27 +0000 (UTC) Received: from merlin.infradead.org ([2001:4978:20e::2]) by casper.infradead.org with esmtps (Exim 4.80.1 #2 (Red Hat Linux)) id 1WVthO-00043Z-Un; Fri, 04 Apr 2014 02:17:43 +0000 Received: from localhost ([::1] helo=merlin.infradead.org) by merlin.infradead.org with esmtp (Exim 4.80.1 #2 (Red Hat Linux)) id 1WVth0-0003ny-4D; Fri, 04 Apr 2014 02:17:18 +0000 Received: from smtp.outflux.net ([2001:19d0:2:6:c0de:0:736d:7470]) by merlin.infradead.org with esmtps (Exim 4.80.1 #2 (Red Hat Linux)) id 1WVtgw-0003mt-Q1 for linux-arm-kernel@lists.infradead.org; Fri, 04 Apr 2014 02:17:15 +0000 Received: from www.outflux.net (serenity.outflux.net [10.2.0.2]) by vinyl.outflux.net (8.14.4/8.14.4/Debian-2ubuntu2.1) with ESMTP id s342FV2P029778; Thu, 3 Apr 2014 19:15:31 -0700 From: Kees Cook To: linux-arm-kernel@lists.infradead.org Subject: [PATCH 1/2] ARM: mm: mark non-text sections non-executable Date: Thu, 3 Apr 2014 19:15:18 -0700 Message-Id: <1396577719-14786-2-git-send-email-keescook@chromium.org> X-Mailer: git-send-email 1.7.9.5 In-Reply-To: <1396577719-14786-1-git-send-email-keescook@chromium.org> References: <1396577719-14786-1-git-send-email-keescook@chromium.org> X-MIMEDefang-Filter: outflux$Revision: 1.316 $ X-HELO: www.outflux.net X-Scanned-By: MIMEDefang 2.71 on 10.2.0.1 X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20140403_221715_075332_EBE9D05C X-CRM114-Status: GOOD ( 20.14 ) X-Spam-Score: -2.5 (--) Cc: Russell King , Kees Cook , Catalin Marinas , Laura Abbott , Will Deacon , linux-kernel@vger.kernel.org, Rabin Vincent , Alexander Holler X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+patchwork-linux-arm=patchwork.kernel.org@lists.infradead.org X-Spam-Status: No, score=-4.8 required=5.0 tests=BAYES_00, RCVD_IN_DNSWL_MED, RP_MATCHES_RCVD, UNPARSEABLE_RELAY autolearn=unavailable version=3.3.1 X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on mail.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP Adds CONFIG_ARM_KERNMEM_PERMS to separate the kernel memory regions into section-sized areas that can have different permisions. Performs the NX permission changes during free_initmem, so that init memory can be reclaimed. This uses section size instead of PMD size to reduce memory caps on non-LPAE systems. Based on work by Brad Spengler, Larry Bassel, and Laura Abbott. Signed-off-by: Kees Cook --- arch/arm/kernel/vmlinux.lds.S | 17 ++++++++ arch/arm/mm/Kconfig | 9 ++++ arch/arm/mm/init.c | 92 +++++++++++++++++++++++++++++++++++++++++ arch/arm/mm/mmu.c | 13 +++++- 4 files changed, 130 insertions(+), 1 deletion(-) diff --git a/arch/arm/kernel/vmlinux.lds.S b/arch/arm/kernel/vmlinux.lds.S index 7bcee5c9b604..08fa667ef2f1 100644 --- a/arch/arm/kernel/vmlinux.lds.S +++ b/arch/arm/kernel/vmlinux.lds.S @@ -8,6 +8,9 @@ #include #include #include +#ifdef CONFIG_ARM_KERNMEM_PERMS +#include +#endif #define PROC_INFO \ . = ALIGN(4); \ @@ -90,6 +93,11 @@ SECTIONS _text = .; HEAD_TEXT } + +#ifdef CONFIG_ARM_KERNMEM_PERMS + . = ALIGN(1< #include +#ifdef CONFIG_ARM_KERNMEM_PERMS +#include +#include +#endif + #include #include @@ -621,11 +626,98 @@ void __init mem_init(void) } } +#ifdef CONFIG_ARM_KERNMEM_PERMS +struct section_perm { + unsigned long start; + unsigned long end; + pmdval_t mask; + pmdval_t prot; +}; + +struct section_perm section_perms[] = { + /* Make pages tables, etc before _stext RW (set NX). */ + { + .start = PAGE_OFFSET, + .end = (unsigned long)_stext, + .mask = ~PMD_SECT_XN, + .prot = PMD_SECT_XN, + }, + /* Make init RW (set NX). */ + { + .start = (unsigned long)__init_begin, + .end = (unsigned long)_sdata, + .mask = ~PMD_SECT_XN, + .prot = PMD_SECT_XN, + }, +}; + +static inline void section_update(unsigned long addr, pmdval_t mask, + pmdval_t prot) +{ + pmd_t *pmd = pmd_off_k(addr); + +#ifdef CONFIG_ARM_LPAE + pmd[0] = __pmd((pmd_val(pmd[0]) & mask) | prot); +#else + if (addr & SECTION_SIZE) + pmd[1] = __pmd((pmd_val(pmd[1]) & mask) | prot); + else + pmd[0] = __pmd((pmd_val(pmd[0]) & mask) | prot); +#endif + flush_pmd_entry(pmd); +} + +static inline bool arch_has_strict_perms(void) +{ + unsigned int cr; + + if (cpu_architecture() < CPU_ARCH_ARMv6) + return false; + + cr = get_cr(); + if (!(cr & CR_XP)) + return false; + + return true; +} + +static inline void fix_kernmem_perms(void) +{ + unsigned long addr; + unsigned int i; + + if (!arch_has_strict_perms()) + return; + + for (i = 0; i < ARRAY_SIZE(section_perms); i++) { + if (!IS_ALIGNED(section_perms[i].start, SECTION_SIZE) || + !IS_ALIGNED(section_perms[i].end, SECTION_SIZE)) { + pr_err("BUG: section %lx-%lx not aligned to %lx\n", + section_perms[i].start, section_perms[i].end, + SECTION_SIZE); + continue; + } + + for (addr = section_perms[i].start; + addr < section_perms[i].end; + addr += SECTION_SIZE) + section_update(addr, section_perms[i].mask, + section_perms[i].prot); + } +} +#else +static inline void fix_kernmem_perms(void) { } +#endif /* CONFIG_ARM_KERNMEM_PERMS */ + void free_initmem(void) { #ifdef CONFIG_HAVE_TCM extern char __tcm_start, __tcm_end; +#endif + + fix_kernmem_perms(); +#ifdef CONFIG_HAVE_TCM poison_init_mem(&__tcm_start, &__tcm_end - &__tcm_start); free_reserved_area(&__tcm_start, &__tcm_end, -1, "TCM link"); #endif diff --git a/arch/arm/mm/mmu.c b/arch/arm/mm/mmu.c index a623cb3ad012..9d89de8cc349 100644 --- a/arch/arm/mm/mmu.c +++ b/arch/arm/mm/mmu.c @@ -1369,13 +1369,24 @@ static void __init map_lowmem(void) if (start >= end) break; - if (end < kernel_x_start || start >= kernel_x_end) { + if (end < kernel_x_start) { map.pfn = __phys_to_pfn(start); map.virtual = __phys_to_virt(start); map.length = end - start; map.type = MT_MEMORY_RWX; create_mapping(&map); + } else if (start >= kernel_x_end) { + map.pfn = __phys_to_pfn(start); + map.virtual = __phys_to_virt(start); + map.length = end - start; +#ifdef CONFIG_ARM_KERNMEM_PERMS + map.type = MT_MEMORY_RW; +#else + map.type = MT_MEMORY_RWX; +#endif + + create_mapping(&map); } else { /* This better cover the entire kernel */ if (start < kernel_x_start) {