arm: Support for the PXN CPU feature on ARMv7
PATCH RESEND 1/1 arm: Support for the PXN CPU feature on ARMv7
Modern ARMv7-A/R cores can optionally implement below new hardware feature:
- PXN:
Privileged execute-never(PXN) is a security feature. PXN bit determines whether the processor can execute software from the region. This is effective solution against ret2usr attack. On an implementation that does not include the LPAE, PXN is optionally supported.
This patch set PXN bit on user page table for preventing user code execution with privilege mode.
--- arch/arm/include/asm/pgalloc.h | 12 +++++++++++- arch/arm/include/asm/pgtable-2level-hwdef.h | 2 ++ arch/arm/kernel/setup.c | 7 +++++++ 3 files changed, 20 insertions(+), 1 deletion(-)
arch/arm/include/asm/pgalloc.h +11 -1
@@ -25,6 +25,10 @@#define _PAGE_USER_TABLE (PMD_TYPE_TABLE | PMD_BIT4 | PMD_DOMAIN(DOMAIN_USER))#define _PAGE_KERNEL_TABLE (PMD_TYPE_TABLE | PMD_BIT4 | PMD_DOMAIN(DOMAIN_KERNEL)) +#ifdef CONFIG_CPU_V7 +extern bool cpu_has_pxn; +#endif +#ifdef CONFIG_ARM_LPAE static inline pmd_t *pmd_alloc_one (struct mm_struct *mm,unsigned long addr)
@@ -157,7 +161,13 @@ pmd_populate_kernel(struct mm_struct *mm, pmd_t *pmdp, pte_t *ptep)static inline void pmd_populate (struct mm_struct *mm,pmd_t *pmdp,pgtable_t ptep) { -__pmd_populate (pmdp,page_to_phys (ptep), _PAGE_USER_TABLE); +#ifdef CONFIG_CPU_V7 +if (cpu_has_pxn) +__pmd_populate (pmdp,page_to_phys (ptep), + _PAGE_USER_TABLE |PMD_PXNTABLE ); + else +#endif +__pmd_populate (pmdp,page_to_phys (ptep), _PAGE_USER_TABLE); }#define pmd_pgtable (pmd) pmd_page(pmd)
arch/arm/include/asm/pgtable-2level-hwdef.h +2 -0
@@ -20,12 +20,14 @@#define PMD_TYPE_FAULT (_AT(pmdval_t, 0) << 0)#define PMD_TYPE_TABLE (_AT(pmdval_t, 1) << 0)#define PMD_TYPE_SECT (_AT(pmdval_t, 2) << 0) +#define PMD_PXNTABLE (_AT(pmdval_t, 1) << 2)/* v7 */ #define PMD_BIT4 (_AT(pmdval_t, 1) << 4)#define PMD_DOMAIN (x) (_AT(pmdval_t, (x)) << 5)#define PMD_PROTECTION (_AT(pmdval_t, 1) << 9)/* v5 */ /* * - section */ +#define PMD_SECT_PXN (_AT(pmdval_t, 1) << 0)/* v7 */ #define PMD_SECT_BUFFERABLE (_AT(pmdval_t, 1) << 2)#define PMD_SECT_CACHEABLE (_AT(pmdval_t, 1) << 3)#define PMD_SECT_XN (_AT(pmdval_t, 1) << 4)/* v6 */
arch/arm/kernel/setup.c +7 -0
@@ -104,6 +104,9 @@ EXPORT_SYMBOL(elf_hwcap);unsigned int elf_hwcap2__read_mostly ;EXPORT_SYMBOL (elf_hwcap2); +#ifdef CONFIG_CPU_V7 +bool cpu_has_pxn; +#endif #ifdef MULTI_CPU struct processor processor__read_mostly ;
@@ -390,6 +393,10 @@ static void __init cpuid_init_hwcaps(void)/* LPAE implies atomic ldrd/strd instructions */ vmsa = (read_cpuid_ext (CPUID_EXT_MMFR0 ) &0xf ) >>0 ; +#ifdef CONFIG_CPU_V7 +if (vmsa >=4 ) + cpu_has_pxn =1 ; +#endif if (vmsa >=5 ) elf_hwcap |=HWCAP_LPAE ; }
Signature · 1 line
1.9.1
PATCH RESEND 1/1 arm: Support for the PXN CPU feature on ARMv7
Quoted 10 lines · Jungseung Lee
Modern ARMv7-A/R cores can optionally implement below new hardware feature:
- PXN:
Privileged execute-never(PXN) is a security feature. PXN bit determines whether the processor can execute software from the region. This is effective solution against ret2usr attack. On an implementation that does not include the LPAE, PXN is optionally supported.
Quoted 4 lines
This patch set PXN bit on user page table for preventing user code execution with privilege mode.
Signed-off-by Jungseung Lee <[email protected]>
I looked at the previous version but didn't get the time to reply. The idea is good but I have some comments below.
Quoted 11 lines
--- arch/arm/include/asm/pgalloc.h | 12 +++++++++++- arch/arm/include/asm/pgtable-2level-hwdef.h | 2 ++ arch/arm/kernel/setup.c | 7 +++++++ 3 files changed, 20 insertions(+), 1 deletion(-)arch/arm/include/asm/pgalloc.h +0
-0
arch/arm/include/asm/pgalloc.h line 30
Quoted 6 lines
arch/arm/include/asm/pgalloc.h +3
-0@@ -25,6 +25,10 @@#define _PAGE_USER_TABLE (PMD_TYPE_TABLE | PMD_BIT4 | PMD_DOMAIN(DOMAIN_USER))#define _PAGE_KERNEL_TABLE (PMD_TYPE_TABLE | PMD_BIT4 | PMD_DOMAIN(DOMAIN_KERNEL)) +#ifdef CONFIG_CPU_V7 +extern bool cpu_has_pxn; +#endif
It's better to use a function, e.g. cpu_has_pxn(), which is defined as 0 when !CONFIG_CPU_V7. This way you don't need many #ifdef's throughout the code.
arch/arm/include/asm/pgalloc.h pmd_populate_kernel(struct mm_struct *mm, pmd_t *pmdp, pte_t *ptep) · line 170
Quoted 13 lines
arch/arm/include/asm/pgalloc.h +7
-1static inline pmd_t *pmd_alloc_one (struct mm_struct *mm,unsigned long addr)@@ -157,7 +161,13 @@ pmd_populate_kernel(struct mm_struct *mm, pmd_t *pmdp, pte_t *ptep)static inline void pmd_populate (struct mm_struct *mm,pmd_t *pmdp,pgtable_t ptep) { -__pmd_populate (pmdp,page_to_phys (ptep), _PAGE_USER_TABLE); +#ifdef CONFIG_CPU_V7 +if (cpu_has_pxn) +__pmd_populate (pmdp,page_to_phys (ptep), + _PAGE_USER_TABLE |PMD_PXNTABLE ); + else +#endif +__pmd_populate (pmdp,page_to_phys (ptep), _PAGE_USER_TABLE);
For the classic MMU, we can only set the PXN at the PMD level. With LPAE, you could indeed use the hierarchical domain attributes (PXNTable) or set it at the PTE directly. I would strongly recommend the use of PXN attribute at the block/PTE level (bit 53). The reason for this is that with LPAE we allow huge pages and the pmd becomes a block mapping with the same bit layout as the PTE.
So you could define a cpu_has_classic_pxn() function and always set a PTE_EXT_PXN on user ptes (basically anywhere we use L_PTE_USER with LPAE).
Quoted 15 lines
arch/arm/kernel/setup.c +3
-0@@ -104,6 +104,9 @@ EXPORT_SYMBOL(elf_hwcap);unsigned int elf_hwcap2__read_mostly ;EXPORT_SYMBOL (elf_hwcap2); +#ifdef CONFIG_CPU_V7 +bool cpu_has_pxn; +#endif #ifdef MULTI_CPU struct processor processor__read_mostly ;
arch/arm/kernel/setup.c static void __init cpuid_init_hwcaps(void) · line 399
Quoted 7 lines
arch/arm/kernel/setup.c +4
-0@@ -390,6 +393,10 @@ static void __init cpuid_init_hwcaps(void)/* LPAE implies atomic ldrd/strd instructions */ vmsa = (read_cpuid_ext (CPUID_EXT_MMFR0 ) &0xf ) >>0 ; +#ifdef CONFIG_CPU_V7 +if (vmsa >=4 ) + cpu_has_pxn =1 ; +#endif
No need for #ifdef here as this function exits early if less then ARMv7.
Signature · 1 line
Catalin