On Thu, Aug 25, 2016 at 12:49:45AM +0200, Mark Kettenis wrote:
> So enabling full hardware-enforced W^X is perhaps a bit to much at
> this moment. But enabling the bit that enforces that the kernel
> cannot execute pages that are writable by userland should be fine.
> The diff does this on all ARMv7 processors that include the
> Virtualization Extensions, which is what indicates that this
> functionality is supported.
>
> ok?
ok jsg@
Next is checking MMFR0.VMSA >= VMSA_V7_PXN and then setting the PXN
bit on user ptes so the kernel can't execute user executable pages
as well?
>
>
> Index: arch/arm/arm/cpufunc.c
> ===================================================================
> RCS file: /cvs/src/sys/arch/arm/arm/cpufunc.c,v
> retrieving revision 1.47
> diff -u -p -r1.47 cpufunc.c
> --- arch/arm/arm/cpufunc.c 22 Aug 2016 01:41:59 -0000 1.47
> +++ arch/arm/arm/cpufunc.c 24 Aug 2016 21:08:50 -0000
> @@ -529,6 +529,7 @@ armv7_setup()
> {
> uint32_t auxctrl, auxctrlmask;
> uint32_t cpuctrl, cpuctrlmask;
> + uint32_t id_pfr1;
>
> auxctrl = auxctrlmask = 0;
>
> @@ -568,6 +569,16 @@ armv7_setup()
>
> if (vector_page == ARM_VECTORS_HIGH)
> cpuctrl |= CPU_CONTROL_VECRELOC;
> +
> + /*
> + * Check for the Virtualization Extensions and enable UWXN of
> + * those are included.
> + */
> + __asm volatile("mrc p15, 0, %0, c0, c1, 1" : "=r"(id_pfr1));
> + if ((id_pfr1 & 0x0000f000) == 0x00001000) {
> + cpuctrlmask |= CPU_CONTROL_UWXN;
> + cpuctrl |= CPU_CONTROL_UWXN;
> + }
>
> /* Clear out the cache */
> cpu_idcache_wbinv_all();
> Index: arch/arm/include/armreg.h
> ===================================================================
> RCS file: /cvs/src/sys/arch/arm/include/armreg.h,v
> retrieving revision 1.36
> diff -u -p -r1.36 armreg.h
> --- arch/arm/include/armreg.h 24 Aug 2016 13:09:52 -0000 1.36
> +++ arch/arm/include/armreg.h 24 Aug 2016 21:08:51 -0000
> @@ -248,6 +248,8 @@
> #define CPU_CONTROL_L2 (1<<25) /* L2: L2 cache enable */
>
> /* added with v7 */
> +#define CPU_CONTROL_WXN (1<<19) /* WXN: Write implies XN */
> +#define CPU_CONTROL_UWXN (1<<20) /* UWXN: Unpriv write implies XN */
> #define CPU_CONTROL_NMFI (1<<27) /* NMFI: Non Maskable fast interrupt */
> #define CPU_CONTROL_TRE (1<<28) /* TRE: TEX Remap Enable */
> #define CPU_CONTROL_AFE (1<<29) /* AFE: Access Flag Enable */
>
