From: Sascha Hauer <s.hauer@pengutronix.de>
To: Ahmad Fatoum <a.fatoum@pengutronix.de>,
BAREBOX <barebox@lists.infradead.org>
Subject: [PATCH v2 0/6] ARM: Map sections RO/XN
Date: Tue, 17 Jun 2025 16:28:07 +0200 [thread overview]
Message-ID: <20250617-mmu-xn-ro-v2-0-3c7aa9046b67@pengutronix.de> (raw)
So far we mapped all RAM as read write with execute permission. This
series series hardens this a bit. The barebox text segment will be
mapped readonly with execute permission, the RO data section as readonly
without execute permission and the remaining RAM will lose its execute
permission.
I tested this series on ARMv5, ARMv7 and ARMv8. I am not confident
though that there are no regressions, so this new behaviour is behind a
Kconfig option. It is default-y, but can be disabled for debugging
purposses. Once this series has proven stable it can be removed.
Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
---
Changes in v2:
- Tested and fixed for ARMv5
- merge create_pages() and create_sections() into one functions (ahmad)
- introduce function to create mapping flags based on CONFIG_ARM_MMU_PERMISSIONS
- Link to v1: https://lore.barebox.org/20250606-mmu-xn-ro-v1-0-7ee6ddd134d4@pengutronix.de
---
Sascha Hauer (6):
ARM: pass barebox base to mmu_early_enable()
ARM: mmu: move ARCH_MAP_WRITECOMBINE to header
ARM: MMU: map memory for barebox proper pagewise
ARM: MMU: map text segment ro and data segments execute never
ARM: MMU64: map memory for barebox proper pagewise
ARM: MMU64: map text segment ro and data segments execute never
arch/arm/Kconfig | 12 ++++++
arch/arm/cpu/lowlevel_32.S | 1 +
arch/arm/cpu/mmu-common.h | 20 +++++++++
arch/arm/cpu/mmu_32.c | 89 ++++++++++++++++++++++++++++++++--------
arch/arm/cpu/mmu_64.c | 82 +++++++++++++++++++++++++++---------
arch/arm/cpu/uncompress.c | 9 ++--
arch/arm/include/asm/mmu.h | 2 +-
arch/arm/include/asm/pgtable64.h | 1 +
arch/arm/lib32/barebox.lds.S | 3 +-
arch/arm/lib64/barebox.lds.S | 5 ++-
common/memory.c | 7 +++-
include/mmu.h | 1 +
12 files changed, 186 insertions(+), 46 deletions(-)
---
base-commit: 2ae2aa65792b5634e1e9b682fa7ef649569800d4
change-id: 20250606-mmu-xn-ro-e2a4c4b080a4
Best regards,
--
Sascha Hauer <s.hauer@pengutronix.de>
next reply other threads:[~2025-06-17 17:11 UTC|newest]
Thread overview: 10+ messages / expand[flat|nested] mbox.gz Atom feed top
2025-06-17 14:28 Sascha Hauer [this message]
2025-06-17 14:28 ` [PATCH v2 1/6] ARM: pass barebox base to mmu_early_enable() Sascha Hauer
2025-06-17 14:28 ` [PATCH v2 2/6] ARM: mmu: move ARCH_MAP_WRITECOMBINE to header Sascha Hauer
2025-06-17 14:28 ` [PATCH v2 3/6] ARM: MMU: map memory for barebox proper pagewise Sascha Hauer
2025-06-17 14:28 ` [PATCH v2 4/6] ARM: MMU: map text segment ro and data segments execute never Sascha Hauer
2025-06-18 8:13 ` Ahmad Fatoum
2025-06-17 14:28 ` [PATCH v2 5/6] ARM: MMU64: map memory for barebox proper pagewise Sascha Hauer
2025-06-18 8:32 ` Ahmad Fatoum
2025-06-17 14:28 ` [PATCH v2 6/6] ARM: MMU64: map text segment ro and data segments execute never Sascha Hauer
2025-06-18 8:33 ` Ahmad Fatoum
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20250617-mmu-xn-ro-v2-0-3c7aa9046b67@pengutronix.de \
--to=s.hauer@pengutronix.de \
--cc=a.fatoum@pengutronix.de \
--cc=barebox@lists.infradead.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox