[PATCH 1/2] arm: hwcap: add new hwcap for identifying PXN bits

[PATCH 1/2] arm: hwcap: add new hwcap for identifying PXN bits

[Jungseung Lee]

Modern ARMv7-A/R cores can optionally implement below new
hardware feature:

- PXN:
Privileged execute-never(PXN) is a security feature. PXN bit
determines whether the processor can execute software from
the region. This is effective solution against ret2usr attack.

This patch adds new HWCAP defines to describe new feature.
On an implementation that does not include the LPAE, PXN is
optionally supported.

Signed-off-by: Jungseung Lee <js07.lee@gmail.com>
---
 arch/arm/include/uapi/asm/hwcap.h | 1 +
 arch/arm/kernel/setup.c           | 5 +++++
 2 files changed, 6 insertions(+)

diff --git a/arch/arm/include/uapi/asm/hwcap.h b/arch/arm/include/uapi/asm/hwcap.h
index 20d12f2..a06faba 100644
--- a/arch/arm/include/uapi/asm/hwcap.h
+++ b/arch/arm/include/uapi/asm/hwcap.h
@@ -27,6 +27,7 @@
 #define HWCAP_IDIV	(HWCAP_IDIVA | HWCAP_IDIVT)
 #define HWCAP_LPAE	(1 << 20)
 #define HWCAP_EVTSTRM	(1 << 21)
+#define HWCAP_PXN   (1 << 22)       /* Privileged execute-never */
 
 /*
  * HWCAP2 flags - for elf_hwcap2 (in kernel) and AT_HWCAP2
diff --git a/arch/arm/kernel/setup.c b/arch/arm/kernel/setup.c
index c031063..48828fe 100644
--- a/arch/arm/kernel/setup.c
+++ b/arch/arm/kernel/setup.c
@@ -390,6 +390,10 @@ static void __init cpuid_init_hwcaps(void)
 
 	/* LPAE implies atomic ldrd/strd instructions */
 	vmsa = (read_cpuid_ext(CPUID_EXT_MMFR0) & 0xf) >> 0;
+
+	if (vmsa >= 4)
+		elf_hwcap |= HWCAP_PXN;
+
 	if (vmsa >= 5)
 		elf_hwcap |= HWCAP_LPAE;
 }
@@ -1015,6 +1019,7 @@ static const char *hwcap_str[] = {
 	"vfpd32",
 	"lpae",
 	"evtstrm",
+	"pxn",
 	NULL
 };
 
-- 
1.9.1

[PATCH 2/2] arm: Support for the PXN CPU feature on ARMv7.

[Jungseung Lee]

- PXN:
Privileged execute-never(PXN) is a security feature. PXN bits
determines whether the processor can execute software from
the region. This is effective solution against ret2usr attack.

This patch set PXN bit on user page table for preventing
user code execution with privilege mode.

Signed-off-by: Jungseung Lee <js07.lee@gmail.com>
---
 arch/arm/include/asm/pgalloc.h              | 8 +++++++-
 arch/arm/include/asm/pgtable-2level-hwdef.h | 2 ++
 2 files changed, 9 insertions(+), 1 deletion(-)

diff --git a/arch/arm/include/asm/pgalloc.h b/arch/arm/include/asm/pgalloc.h
index 78a7793..f4f4fd3 100644
--- a/arch/arm/include/asm/pgalloc.h
+++ b/arch/arm/include/asm/pgalloc.h
@@ -157,7 +157,13 @@ pmd_populate_kernel(struct mm_struct *mm, pmd_t *pmdp, pte_t *ptep)
 static inline void
 pmd_populate(struct mm_struct *mm, pmd_t *pmdp, pgtable_t ptep)
 {
-	__pmd_populate(pmdp, page_to_phys(ptep), _PAGE_USER_TABLE);
+#ifdef CONFIG_CPU_V7
+	if (elf_hwcap & HWCAP_PXN)
+		__pmd_populate(pmdp, page_to_phys(ptep),
+				_PAGE_USER_TABLE | PMD_PXNTABLE);
+	else
+#endif
+		__pmd_populate(pmdp, page_to_phys(ptep), _PAGE_USER_TABLE);
 }
 #define pmd_pgtable(pmd) pmd_page(pmd)
 
diff --git a/arch/arm/include/asm/pgtable-2level-hwdef.h b/arch/arm/include/asm/pgtable-2level-hwdef.h
index 5cfba15..89a620f 100644
--- a/arch/arm/include/asm/pgtable-2level-hwdef.h
+++ b/arch/arm/include/asm/pgtable-2level-hwdef.h
@@ -20,12 +20,14 @@
 #define PMD_TYPE_FAULT		(_AT(pmdval_t, 0) << 0)
 #define PMD_TYPE_TABLE		(_AT(pmdval_t, 1) << 0)
 #define PMD_TYPE_SECT		(_AT(pmdval_t, 2) << 0)
+#define PMD_PXNTABLE		(_AT(pmdval_t, 1) << 2)     /* v7 (optional) */
 #define PMD_BIT4		(_AT(pmdval_t, 1) << 4)
 #define PMD_DOMAIN(x)		(_AT(pmdval_t, (x)) << 5)
 #define PMD_PROTECTION		(_AT(pmdval_t, 1) << 9)		/* v5 */
 /*
  *   - section
  */
+#define PMD_SECT_PXN    (_AT(pmdval_t, 1) << 0)     /* v7 (optional) */
 #define PMD_SECT_BUFFERABLE	(_AT(pmdval_t, 1) << 2)
 #define PMD_SECT_CACHEABLE	(_AT(pmdval_t, 1) << 3)
 #define PMD_SECT_XN		(_AT(pmdval_t, 1) << 4)		/* v6 */
-- 
1.9.1

[PATCH 1/2] arm: hwcap: add new hwcap for identifying PXN bits

[Russell King - ARM Linux]

On Fri, Oct 24, 2014 at 06:57:34PM +0900, Jungseung Lee wrote:
> Modern ARMv7-A/R cores can optionally implement below new
> hardware feature:
> 
> - PXN:
> Privileged execute-never(PXN) is a security feature. PXN bit
> determines whether the processor can execute software from
> the region. This is effective solution against ret2usr attack.
> 
> This patch adds new HWCAP defines to describe new feature.
> On an implementation that does not include the LPAE, PXN is
> optionally supported.

Why does userspace need to know about this?

-- 
FTTC broadband for 0.8mile line: currently at 9.5Mbps down 400kbps up
according to speedtest.net.

[PATCH 1/2] arm: hwcap: add new hwcap for identifying PXN bits

[Catalin Marinas]

On Fri, Oct 24, 2014 at 10:57:34AM +0100, Jungseung Lee wrote:
> Modern ARMv7-A/R cores can optionally implement below new
> hardware feature:
> 
> - PXN:
> Privileged execute-never(PXN) is a security feature. PXN bit
> determines whether the processor can execute software from
> the region. This is effective solution against ret2usr attack.
> 
> This patch adds new HWCAP defines to describe new feature.
> On an implementation that does not include the LPAE, PXN is
> optionally supported.

Why does the user need to know about such feature? Just enable it in the
kernel if available.

-- 
Catalin

[PATCH 1/2] arm: hwcap: add new hwcap for identifying PXN bits

[Jungseung Lee]

Hi, Russell and Catalin

2014-10-24 19:11 GMT+09:00 Catalin Marinas <catalin.marinas@arm.com>:
> On Fri, Oct 24, 2014 at 10:57:34AM +0100, Jungseung Lee wrote:
>> Modern ARMv7-A/R cores can optionally implement below new
>> hardware feature:
>>
>> - PXN:
>> Privileged execute-never(PXN) is a security feature. PXN bit
>> determines whether the processor can execute software from
>> the region. This is effective solution against ret2usr attack.
>>
>> This patch adds new HWCAP defines to describe new feature.
>> On an implementation that does not include the LPAE, PXN is
>> optionally supported.
>
> Why does the user need to know about such feature? Just enable it in the
> kernel if available.
>
> --
> Catalin

Yes, there is no reason to need to know.
I'll find another route to get vmsa and send patch later.

-- 
Regards,
Jungseung Lee