From: Will Deacon <will.deacon@arm.com> To: Kees Cook <keescook@chromium.org> Cc: "linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>, Rob Herring <robh@kernel.org>, Laura Abbott <lauraa@codeaurora.org>, Leif Lindholm <leif.lindholm@linaro.org>, Stephen Boyd <sboyd@codeaurora.org>, "msalter@redhat.com" <msalter@redhat.com>, Rabin Vincent <rabin@rab.in>, Liu hua <sdu.liu@huawei.com>, Nikolay Borisov <Nikolay.Borisov@arm.com>, Nicolas Pitre <nicolas.pitre@linaro.org>, Tomasz Figa <t.figa@samsung.com>, Doug Anderson <dianders@google.com>, Jason Wessel <jason.wessel@windriver.com>, Catalin Marinas <Catalin.Marinas@arm.com>, Russell King - ARM Linux <linux@arm.linux.org.uk>, "linux-arm-kernel@lists.infradead.org" <linux-arm-kernel@lists.infradead.org>, "linux-doc@vger.kernel.org" <linux-doc@vger.kernel.org> Subject: Re: [PATCH v4 7/8] ARM: mm: allow non-text sections to be non-executable Date: Tue, 19 Aug 2014 13:33:42 +0100 [thread overview] Message-ID: <20140819123342.GJ23128@arm.com> (raw) In-Reply-To: <1407949593-16121-8-git-send-email-keescook@chromium.org> On Wed, Aug 13, 2014 at 06:06:32PM +0100, Kees Cook wrote: > Adds CONFIG_ARM_KERNMEM_PERMS to separate the kernel memory regions > into section-sized areas that can have different permisions. Performs > the NX permission changes during free_initmem, so that init memory can be > reclaimed. > > This uses section size instead of PMD size to reduce memory lost to > padding on non-LPAE systems. > > Based on work by Brad Spengler, Larry Bassel, and Laura Abbott. [...] > diff --git a/arch/arm/kernel/vmlinux.lds.S b/arch/arm/kernel/vmlinux.lds.S > index 6f57cb94367f..a3d07ca2bbb4 100644 > --- a/arch/arm/kernel/vmlinux.lds.S > +++ b/arch/arm/kernel/vmlinux.lds.S > @@ -8,6 +8,9 @@ > #include <asm/thread_info.h> > #include <asm/memory.h> > #include <asm/page.h> > +#ifdef CONFIG_ARM_KERNMEM_PERMS > +#include <asm/pgtable.h> > +#endif > > #define PROC_INFO \ > . = ALIGN(4); \ > @@ -90,6 +93,11 @@ SECTIONS > _text = .; > HEAD_TEXT > } > + > +#ifdef CONFIG_ARM_KERNMEM_PERMS > + . = ALIGN(1<<SECTION_SHIFT); > +#endif > + > .text : { /* Real text segment */ > _stext = .; /* Text and read-only data */ > __exception_text_start = .; > @@ -145,7 +153,11 @@ SECTIONS > _etext = .; /* End of text and rodata section */ > > #ifndef CONFIG_XIP_KERNEL > +# ifdef CONFIG_ARM_KERNMEM_PERMS > + . = ALIGN(1<<SECTION_SHIFT); > +# else > . = ALIGN(PAGE_SIZE); > +# endif This might be cleaner if we had a single macro (ALIGN_MIN?) that expanded to ALIGN(1 << SECTION_SHIFT) #ifdef CONFIG_ARM_KERNMEM_PERMS. > diff --git a/arch/arm/mm/init.c b/arch/arm/mm/init.c > index ad82c05bfc3a..ccf392ef40d4 100644 > --- a/arch/arm/mm/init.c > +++ b/arch/arm/mm/init.c > @@ -32,6 +32,11 @@ > #include <asm/tlb.h> > #include <asm/fixmap.h> > > +#ifdef CONFIG_ARM_KERNMEM_PERMS > +#include <asm/system_info.h> > +#include <asm/cp15.h> > +#endif We already #include cp15.h in this file. If you need system_info.h, I don't think you should bother making the include conditional. > +/* > + * Updates section permissions only for the current mm (sections are > + * copied into each mm). During startup, this is the init_mm. > + */ > +static inline void section_update(unsigned long addr, pmdval_t mask, > + pmdval_t prot) > +{ > + struct mm_struct *mm; > + pmd_t *pmd; > + > + mm = current->active_mm; > + pmd = pmd_offset(pud_offset(pgd_offset(mm, addr), addr), addr); > + > +#ifdef CONFIG_ARM_LPAE > + pmd[0] = __pmd((pmd_val(pmd[0]) & mask) | prot); > +#else > + if (addr & SECTION_SIZE) > + pmd[1] = __pmd((pmd_val(pmd[1]) & mask) | prot); > + else > + pmd[0] = __pmd((pmd_val(pmd[0]) & mask) | prot); > +#endif > + flush_pmd_entry(pmd); > + local_flush_tlb_kernel_range(addr, addr + SECTION_SIZE); Why only a local flush? You're changing global mappings here, right? > +} > + > +/* Make sure extended page tables are in use. */ > +static inline bool arch_has_strict_perms(void) > +{ > + unsigned int cr; > + > + if (cpu_architecture() < CPU_ARCH_ARMv6) > + return false; > + > + cr = get_cr(); > + if (!(cr & CR_XP)) > + return false; > + > + return true; return !!(get_cr() & CR_XP)? > +} > + > +#define set_section_perms(perms, field) { \ > + size_t i; \ > + unsigned long addr; \ > + \ > + if (!arch_has_strict_perms()) \ > + return; \ > + \ > + for (i = 0; i < ARRAY_SIZE(perms); i++) { \ > + if (!IS_ALIGNED(perms[i].start, SECTION_SIZE) || \ > + !IS_ALIGNED(perms[i].end, SECTION_SIZE)) { \ > + pr_err("BUG: section %lx-%lx not aligned to %lx\n", \ > + perms[i].start, perms[i].end, \ > + SECTION_SIZE); \ > + continue; \ > + } \ > + \ > + for (addr = perms[i].start; \ > + addr < perms[i].end; \ > + addr += SECTION_SIZE) \ > + section_update(addr, perms[i].mask, \ > + perms[i].field); \ > + } \ > +} > + > +static inline void fix_kernmem_perms(void) > +{ > + set_section_perms(nx_perms, prot); > +} > +#else > +static inline void fix_kernmem_perms(void) { } > +#endif /* CONFIG_ARM_KERNMEM_PERMS */ > + > void free_initmem(void) > { > #ifdef CONFIG_HAVE_TCM > extern char __tcm_start, __tcm_end; > +#endif > + > + fix_kernmem_perms(); > > +#ifdef CONFIG_HAVE_TCM You could avoid the double #ifdef by moving the tcm stuff into another function (free_tcmmem?) Will
WARNING: multiple messages have this Message-ID (diff)
From: will.deacon@arm.com (Will Deacon) To: linux-arm-kernel@lists.infradead.org Subject: [PATCH v4 7/8] ARM: mm: allow non-text sections to be non-executable Date: Tue, 19 Aug 2014 13:33:42 +0100 [thread overview] Message-ID: <20140819123342.GJ23128@arm.com> (raw) In-Reply-To: <1407949593-16121-8-git-send-email-keescook@chromium.org> On Wed, Aug 13, 2014 at 06:06:32PM +0100, Kees Cook wrote: > Adds CONFIG_ARM_KERNMEM_PERMS to separate the kernel memory regions > into section-sized areas that can have different permisions. Performs > the NX permission changes during free_initmem, so that init memory can be > reclaimed. > > This uses section size instead of PMD size to reduce memory lost to > padding on non-LPAE systems. > > Based on work by Brad Spengler, Larry Bassel, and Laura Abbott. [...] > diff --git a/arch/arm/kernel/vmlinux.lds.S b/arch/arm/kernel/vmlinux.lds.S > index 6f57cb94367f..a3d07ca2bbb4 100644 > --- a/arch/arm/kernel/vmlinux.lds.S > +++ b/arch/arm/kernel/vmlinux.lds.S > @@ -8,6 +8,9 @@ > #include <asm/thread_info.h> > #include <asm/memory.h> > #include <asm/page.h> > +#ifdef CONFIG_ARM_KERNMEM_PERMS > +#include <asm/pgtable.h> > +#endif > > #define PROC_INFO \ > . = ALIGN(4); \ > @@ -90,6 +93,11 @@ SECTIONS > _text = .; > HEAD_TEXT > } > + > +#ifdef CONFIG_ARM_KERNMEM_PERMS > + . = ALIGN(1<<SECTION_SHIFT); > +#endif > + > .text : { /* Real text segment */ > _stext = .; /* Text and read-only data */ > __exception_text_start = .; > @@ -145,7 +153,11 @@ SECTIONS > _etext = .; /* End of text and rodata section */ > > #ifndef CONFIG_XIP_KERNEL > +# ifdef CONFIG_ARM_KERNMEM_PERMS > + . = ALIGN(1<<SECTION_SHIFT); > +# else > . = ALIGN(PAGE_SIZE); > +# endif This might be cleaner if we had a single macro (ALIGN_MIN?) that expanded to ALIGN(1 << SECTION_SHIFT) #ifdef CONFIG_ARM_KERNMEM_PERMS. > diff --git a/arch/arm/mm/init.c b/arch/arm/mm/init.c > index ad82c05bfc3a..ccf392ef40d4 100644 > --- a/arch/arm/mm/init.c > +++ b/arch/arm/mm/init.c > @@ -32,6 +32,11 @@ > #include <asm/tlb.h> > #include <asm/fixmap.h> > > +#ifdef CONFIG_ARM_KERNMEM_PERMS > +#include <asm/system_info.h> > +#include <asm/cp15.h> > +#endif We already #include cp15.h in this file. If you need system_info.h, I don't think you should bother making the include conditional. > +/* > + * Updates section permissions only for the current mm (sections are > + * copied into each mm). During startup, this is the init_mm. > + */ > +static inline void section_update(unsigned long addr, pmdval_t mask, > + pmdval_t prot) > +{ > + struct mm_struct *mm; > + pmd_t *pmd; > + > + mm = current->active_mm; > + pmd = pmd_offset(pud_offset(pgd_offset(mm, addr), addr), addr); > + > +#ifdef CONFIG_ARM_LPAE > + pmd[0] = __pmd((pmd_val(pmd[0]) & mask) | prot); > +#else > + if (addr & SECTION_SIZE) > + pmd[1] = __pmd((pmd_val(pmd[1]) & mask) | prot); > + else > + pmd[0] = __pmd((pmd_val(pmd[0]) & mask) | prot); > +#endif > + flush_pmd_entry(pmd); > + local_flush_tlb_kernel_range(addr, addr + SECTION_SIZE); Why only a local flush? You're changing global mappings here, right? > +} > + > +/* Make sure extended page tables are in use. */ > +static inline bool arch_has_strict_perms(void) > +{ > + unsigned int cr; > + > + if (cpu_architecture() < CPU_ARCH_ARMv6) > + return false; > + > + cr = get_cr(); > + if (!(cr & CR_XP)) > + return false; > + > + return true; return !!(get_cr() & CR_XP)? > +} > + > +#define set_section_perms(perms, field) { \ > + size_t i; \ > + unsigned long addr; \ > + \ > + if (!arch_has_strict_perms()) \ > + return; \ > + \ > + for (i = 0; i < ARRAY_SIZE(perms); i++) { \ > + if (!IS_ALIGNED(perms[i].start, SECTION_SIZE) || \ > + !IS_ALIGNED(perms[i].end, SECTION_SIZE)) { \ > + pr_err("BUG: section %lx-%lx not aligned to %lx\n", \ > + perms[i].start, perms[i].end, \ > + SECTION_SIZE); \ > + continue; \ > + } \ > + \ > + for (addr = perms[i].start; \ > + addr < perms[i].end; \ > + addr += SECTION_SIZE) \ > + section_update(addr, perms[i].mask, \ > + perms[i].field); \ > + } \ > +} > + > +static inline void fix_kernmem_perms(void) > +{ > + set_section_perms(nx_perms, prot); > +} > +#else > +static inline void fix_kernmem_perms(void) { } > +#endif /* CONFIG_ARM_KERNMEM_PERMS */ > + > void free_initmem(void) > { > #ifdef CONFIG_HAVE_TCM > extern char __tcm_start, __tcm_end; > +#endif > + > + fix_kernmem_perms(); > > +#ifdef CONFIG_HAVE_TCM You could avoid the double #ifdef by moving the tcm stuff into another function (free_tcmmem?) Will
next prev parent reply other threads:[~2014-08-19 12:33 UTC|newest] Thread overview: 52+ messages / expand[flat|nested] mbox.gz Atom feed top 2014-08-13 17:06 [PATCH v4 0/8] arm: support CONFIG_RODATA Kees Cook 2014-08-13 17:06 ` Kees Cook 2014-08-13 17:06 ` [PATCH v4 1/8] arm: use generic fixmap.h Kees Cook 2014-08-13 17:06 ` Kees Cook 2014-08-13 17:06 ` [PATCH v4 2/8] ARM: expand fixmap region to 3MB Kees Cook 2014-08-13 17:06 ` Kees Cook 2014-08-19 12:26 ` Will Deacon 2014-08-19 12:26 ` Will Deacon 2014-08-20 12:16 ` Kees Cook 2014-08-20 12:16 ` Kees Cook 2014-08-26 14:37 ` Will Deacon 2014-08-26 14:37 ` Will Deacon 2014-08-13 17:06 ` [PATCH v4 3/8] arm: fixmap: implement __set_fixmap() Kees Cook 2014-08-13 17:06 ` Kees Cook 2014-08-13 17:06 ` [PATCH v4 4/8] arm: use fixmap for text patching when text is RO Kees Cook 2014-08-13 17:06 ` Kees Cook 2014-08-19 12:29 ` Will Deacon 2014-08-19 12:29 ` Will Deacon 2014-08-20 12:28 ` Kees Cook 2014-08-20 12:28 ` Kees Cook 2014-09-03 21:43 ` Kees Cook 2014-09-03 21:43 ` Kees Cook 2014-09-04 9:27 ` Will Deacon 2014-09-04 9:27 ` Will Deacon 2014-09-04 14:00 ` Kees Cook 2014-09-04 14:00 ` Kees Cook 2014-09-04 14:06 ` Will Deacon 2014-09-04 14:06 ` Will Deacon 2014-08-13 17:06 ` [PATCH v4 5/8] ARM: kexec: Make .text R/W in machine_kexec Kees Cook 2014-08-13 17:06 ` Kees Cook 2014-08-13 17:06 ` [PATCH v4 6/8] arm: kgdb: Handle read-only text / modules Kees Cook 2014-08-13 17:06 ` Kees Cook 2014-08-13 17:06 ` [PATCH v4 7/8] ARM: mm: allow non-text sections to be non-executable Kees Cook 2014-08-13 17:06 ` Kees Cook 2014-08-19 12:33 ` Will Deacon [this message] 2014-08-19 12:33 ` Will Deacon 2014-08-20 12:37 ` Kees Cook 2014-08-20 12:37 ` Kees Cook 2014-08-26 14:43 ` Will Deacon 2014-08-26 14:43 ` Will Deacon 2014-08-29 16:04 ` Kees Cook 2014-08-29 16:04 ` Kees Cook 2014-08-31 14:59 ` Rabin Vincent 2014-08-31 14:59 ` Rabin Vincent 2014-08-13 17:06 ` [PATCH v4 8/8] ARM: mm: allow text and rodata sections to be read-only Kees Cook 2014-08-13 17:06 ` Kees Cook 2014-08-19 12:36 ` Will Deacon 2014-08-19 12:36 ` Will Deacon 2014-08-20 12:52 ` Kees Cook 2014-08-20 12:52 ` Kees Cook 2014-08-13 17:38 ` [PATCH v4 0/8] arm: support CONFIG_RODATA Nicolas Pitre 2014-08-13 17:38 ` Nicolas Pitre
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=20140819123342.GJ23128@arm.com \ --to=will.deacon@arm.com \ --cc=Catalin.Marinas@arm.com \ --cc=Nikolay.Borisov@arm.com \ --cc=dianders@google.com \ --cc=jason.wessel@windriver.com \ --cc=keescook@chromium.org \ --cc=lauraa@codeaurora.org \ --cc=leif.lindholm@linaro.org \ --cc=linux-arm-kernel@lists.infradead.org \ --cc=linux-doc@vger.kernel.org \ --cc=linux-kernel@vger.kernel.org \ --cc=linux@arm.linux.org.uk \ --cc=msalter@redhat.com \ --cc=nicolas.pitre@linaro.org \ --cc=rabin@rab.in \ --cc=robh@kernel.org \ --cc=sboyd@codeaurora.org \ --cc=sdu.liu@huawei.com \ --cc=t.figa@samsung.com \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.