Commit 2f39b5f9 authored by Jeremy Linton's avatar Jeremy Linton Committed by Catalin Marinas
Browse files

arm64: mm: Mark .rodata as RO 



Currently the .rodata section is actually still executable when DEBUG_RODATA
is enabled. This changes that so the .rodata is actually read only, no execute.
It also adds the .rodata section to the mem_init banner.

Signed-off-by: default avatarJeremy Linton <jeremy.linton@arm.com>
Reviewed-by: default avatarKees Cook <keescook@chromium.org>
Acked-by: default avatarMark Rutland <mark.rutland@arm.com>
[catalin.marinas@arm.com: added vm_struct vmlinux_rodata in map_kernel()]
Signed-off-by: default avatarCatalin Marinas <catalin.marinas@arm.com>
parent b7dc8d16

arch/arm64/kernel/vmlinux.lds.S

+3 −2
Original line number Diff line number Diff line
@@ -114,8 +114,9 @@ SECTIONS 
		*(.got)			/* Global offset table		*/

	}



	RO_DATA(PAGE_SIZE)

	EXCEPTION_TABLE(8)

	ALIGN_DEBUG_RO_MIN(PAGE_SIZE)

	RO_DATA(PAGE_SIZE)		/* everything from this point to */

	EXCEPTION_TABLE(8)		/* _etext will be marked RO NX   */

	NOTES



	ALIGN_DEBUG_RO_MIN(PAGE_SIZE)

arch/arm64/mm/init.c

+3 −1
Original line number Diff line number Diff line
@@ -363,6 +363,7 @@ void __init mem_init(void) 
		  "    vmalloc : 0x%16lx - 0x%16lx   (%6ld GB)\n"

		  "      .init : 0x%p" " - 0x%p" "   (%6ld KB)\n"

		  "      .text : 0x%p" " - 0x%p" "   (%6ld KB)\n"

		  "    .rodata : 0x%p" " - 0x%p" "   (%6ld KB)\n"

		  "      .data : 0x%p" " - 0x%p" "   (%6ld KB)\n"

#ifdef CONFIG_SPARSEMEM_VMEMMAP

		  "    vmemmap : 0x%16lx - 0x%16lx   (%6ld GB maximum)\n"
@@ -377,7 +378,8 @@ void __init mem_init(void) 
		  MLM(MODULES_VADDR, MODULES_END),

		  MLG(VMALLOC_START, VMALLOC_END),

		  MLK_ROUNDUP(__init_begin, __init_end),

		  MLK_ROUNDUP(_text, _etext),

		  MLK_ROUNDUP(_text, __start_rodata),

		  MLK_ROUNDUP(__start_rodata, _etext),

		  MLK_ROUNDUP(_sdata, _edata),

#ifdef CONFIG_SPARSEMEM_VMEMMAP

		  MLG((unsigned long)vmemmap,

arch/arm64/mm/mmu.c

+13 −6
Original line number Diff line number Diff line
@@ -449,12 +449,18 @@ static void __init map_mem(pgd_t *pgd) 


void mark_rodata_ro(void)

{

	if (!IS_ENABLED(CONFIG_DEBUG_RODATA))

		return;

	unsigned long section_size;



	section_size = (unsigned long)__start_rodata - (unsigned long)_stext;

	create_mapping_late(__pa(_stext), (unsigned long)_stext,

				(unsigned long)_etext - (unsigned long)_stext,

				PAGE_KERNEL_ROX);

			    section_size, PAGE_KERNEL_ROX);

	/*

	 * mark .rodata as read only. Use _etext rather than __end_rodata to

	 * cover NOTES and EXCEPTION_TABLE.

	 */

	section_size = (unsigned long)_etext - (unsigned long)__start_rodata;

	create_mapping_late(__pa(__start_rodata), (unsigned long)__start_rodata,

			    section_size, PAGE_KERNEL_RO);

}



void fixup_init(void)
@@ -493,9 +499,10 @@ static void __init map_kernel_chunk(pgd_t *pgd, void *va_start, void *va_end, 
 */

static void __init map_kernel(pgd_t *pgd)

{

	static struct vm_struct vmlinux_text, vmlinux_init, vmlinux_data;

	static struct vm_struct vmlinux_text, vmlinux_rodata, vmlinux_init, vmlinux_data;



	map_kernel_chunk(pgd, _stext, _etext, PAGE_KERNEL_EXEC, &vmlinux_text);

	map_kernel_chunk(pgd, _stext, __start_rodata, PAGE_KERNEL_EXEC, &vmlinux_text);

	map_kernel_chunk(pgd, __start_rodata, _etext, PAGE_KERNEL, &vmlinux_rodata);

	map_kernel_chunk(pgd, __init_begin, __init_end, PAGE_KERNEL_EXEC,

			 &vmlinux_init);

	map_kernel_chunk(pgd, _data, _end, PAGE_KERNEL, &vmlinux_data);

CRA Git | Maintained and supported by SUSTech CRA and CCSE