[PATCH 0/7] ARM: Map sections RO/XN

[Sascha Hauer]

So far we mapped all RAM as read write with execute permission. This
series series hardens this a bit. The barebox text segment will be
mapped readonly with execute permission, the RO data section as readonly
without execute permission and the remaining RAM will lose its execute
permission.

I tested this series on ARMv7 and ARMv8. I am not confident though that
there are no regressions, so this new behaviour is behind a Kconfig
option. It is default-y, but can be disabled for debugging purposses.
Once this series has proven stable it can be removed.

I haven't tested it on ARMv4-v6 due to the lack of hardware. I tried on
Qemu, but the write protection did not work as expected. This should be
resolved before merging.

Signed-off-by: Sascha Hauer <s.hauer at pengutronix.de>
---
Sascha Hauer (7):
      memory: request RO data section as separate region
      ARM: pass barebox base to mmu_early_enable()
      ARM: mmu: move ARCH_MAP_WRITECOMBINE to header
      ARM: MMU: map memory for barebox proper pagewise
      ARM: MMU: map text segment ro and data segments execute never
      ARM: MMU64: map memory for barebox proper pagewise
      ARM: MMU64: map text segment ro and data segments execute never

 arch/arm/Kconfig                 |  12 +++++
 arch/arm/cpu/mmu-common.h        |   4 ++
 arch/arm/cpu/mmu_32.c            |  86 +++++++++++++++++++++++++++------
 arch/arm/cpu/mmu_64.c            | 101 +++++++++++++++++++++++++++++++++++----
 arch/arm/cpu/uncompress.c        |   9 ++--
 arch/arm/include/asm/mmu.h       |   2 +-
 arch/arm/include/asm/pgtable64.h |   1 +
 arch/arm/lib32/barebox.lds.S     |   3 +-
 arch/arm/lib64/barebox.lds.S     |   5 +-
 common/memory.c                  |   6 ++-
 include/mmu.h                    |   1 +
 11 files changed, 198 insertions(+), 32 deletions(-)
---
base-commit: 340e930140e76827cf5cac731e6afe2836e28242
change-id: 20250613-arm-mmu-xn-ro-1a1d996496ae

Best regards,
-- 
Sascha Hauer <s.hauer at pengutronix.de>