Hi this is v2 of [0] [1] This is an attempt to map the U-Boot binary properly and enhance its security posture but leave the area we load binaries unaffected and RWX.
What I have done but decided not to include was Simons suggestion of using DM for the cpu ops. I've spent some time doing this but once I finished I realised that the DM cpu ops are only present in a handful of boards. Since we want this to work for all boards I've kept the DM branch here [2] but still use the weak function approach on the patchset. I can resend it once we have boards supporting the DM class. Changes since v1: - added r-b from Caleb. - The memory map only gets dumped if CONFIG_CMD_MEMINFO_MAP is enabled as Simon asked - reworded some patches and Kconfig messages according to Toms suggestions - Fixed suggestions from Richard on linker scripts and added a Kconfig option to reduce the required page alignment if the feature is not selected - Treating _u_boot_list as .rodata, they end up in RO memory now - The function changing attributes returns an int instead of void so we can reuse it in EFI for the memory attribute protocol -- Heinrich - Correctly cast the size as size_t instead of phys_addr_t in pgprot_set_attrs() Change since RFC: - Fixed the alignment of meminfo command when printing regions - 'meminfo' now prints arch specific attributes e.g PXN, UXN etc for arm instead of RW, RO, RX - Since we don't set the permissions of EFI runtime services yet and keep them as RWX, I removed the linker alignment changes which makes patch #3 easier to review. It's worth noting that qemu-arm sbsa was crashing with the efi services page aligned. This is probably due to a mismatch of memory, since the crash is only reproducible with QEMU instances that have < 2 GB of RAM. I'll fix that along with the efi runtime services - Defined memory attribute changes properly with an enum for RW, RO, RX instead of the hardcoded '1,2,3' I had on the RFC - Enabling mappings is now under a Kconfig (CONFIG_MMU_PGPROT), since peope reported crashes when testing this, which are orthogonal to this patch. We still have places in U-Boot where we define and later write const variables. This will lead to a crash now as const variables are properly managed and places in RO memory - Split patches to be easier to review - Added a patch updating 'meminfo' - Picked up acked-by tags from Jerome [0] https://lore.kernel.org/u-boot/20250205071714.635518-1-ilias.apalodi...@linaro.org/ [1] https://lore.kernel.org/u-boot/20250130072100.27297-1-ilias.apalodi...@linaro.org/ [2] https://source.denx.de/u-boot/custodians/u-boot-tpm/-/tree/fix_memory_permissions_uclass Neil tested a bunch of board as well so adding his tags here to be picked up for the entire series Tested-by: Neil Armstrong <neil.armstr...@linaro.org> # on AML-S905X-CC Tested-by: Neil Armstrong <neil.armstr...@linaro.org> # on AML-S805X-AC Tested-by: Neil Armstrong <neil.armstr...@linaro.org> # on BananaPi-M5 Tested-by: Neil Armstrong <neil.armstr...@linaro.org> # on BananaPi-M2S Tested-by: Neil Armstrong <neil.armstr...@linaro.org> # on SM8550-QRD Tested-by: Neil Armstrong <neil.armstr...@linaro.org> # on SM8550-HDK Tested-by: Neil Armstrong <neil.armstr...@linaro.org> # on SM8650-QRD Tested-by: Neil Armstrong <neil.armstr...@linaro.org> # on SM8650-HDK Cheers /Ilias Ilias Apalodimas (6): meminfo: add memory details for armv8 doc: update meminfo with arch specific information arm: Prepare linker scripts for memory permissions arm64: mmu_change_region_attr() add an option not to break PTEs treewide: Add a function to change page permissions arm64: Enable RW, RX and RO mappings for the relocated binary arch/arc/lib/cache.c | 6 +++ arch/arm/cpu/arm926ejs/cache.c | 6 +++ arch/arm/cpu/armv7/cache_v7.c | 6 +++ arch/arm/cpu/armv7m/cache.c | 6 +++ arch/arm/cpu/armv8/cache_v8.c | 57 ++++++++++++++++++-- arch/arm/cpu/armv8/fsl-layerscape/cpu.c | 10 ++-- arch/arm/cpu/armv8/u-boot.lds | 59 +++++++++++++------- arch/arm/include/asm/armv8/mmu.h | 2 + arch/arm/include/asm/system.h | 11 +++- arch/arm/lib/cache.c | 6 +++ arch/arm/mach-snapdragon/board.c | 2 +- arch/m68k/lib/cache.c | 6 +++ arch/nios2/lib/cache.c | 6 +++ arch/powerpc/lib/cache.c | 6 +++ arch/riscv/lib/cache.c | 6 +++ arch/sh/cpu/sh4/cache.c | 6 +++ arch/xtensa/lib/cache.c | 6 +++ cmd/meminfo.c | 6 +++ common/Kconfig | 13 +++++ common/board_r.c | 20 +++++++ doc/usage/cmd/meminfo.rst | 71 ++++++++++++++++++------- include/asm-generic/sections.h | 2 + include/cpu_func.h | 17 ++++++ 23 files changed, 288 insertions(+), 48 deletions(-) -- 2.47.2
