| Message ID | 20201026230254.911912-6-atish.patra@wdc.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | Improve kernel section protections | expand |
On Mon, Oct 26, 2020 at 04:02:53PM -0700, Atish Patra wrote: > Currently, .init.text & .init.data are intermixed which makes it impossible > apply different permissions to them. .init.data shouldn't need exec > permissions while .init.text shouldn't have write permission. > > Keep them in separate sections so that different permissions are applied to > each section. This improves the kernel protection under > CONFIG_STRICT_KERNEL_RWX. We also need to restore the permissions for the > entire _init section after it is freed so that those pages can be used for > other purpose. > > Signed-off-by: Atish Patra <atish.patra@wdc.com> > --- > arch/riscv/include/asm/sections.h | 2 ++ > arch/riscv/include/asm/set_memory.h | 2 ++ > arch/riscv/kernel/setup.c | 9 +++++ > arch/riscv/kernel/vmlinux.lds.S | 51 ++++++++++++++++------------- > arch/riscv/mm/init.c | 8 ++++- > arch/riscv/mm/pageattr.c | 6 ++++ > 6 files changed, 54 insertions(+), 24 deletions(-) > > diff --git a/arch/riscv/include/asm/sections.h b/arch/riscv/include/asm/sections.h > index 3a9971b1210f..1595c5b60cfd 100644 > --- a/arch/riscv/include/asm/sections.h > +++ b/arch/riscv/include/asm/sections.h > @@ -9,5 +9,7 @@ > > extern char _start[]; > extern char _start_kernel[]; > +extern char __init_data_begin[], __init_data_end[]; > +extern char __init_text_begin[], __init_text_end[]; > > #endif /* __ASM_SECTIONS_H */ > diff --git a/arch/riscv/include/asm/set_memory.h b/arch/riscv/include/asm/set_memory.h > index 4cc3a4e2afd3..913429c9c1ae 100644 > --- a/arch/riscv/include/asm/set_memory.h > +++ b/arch/riscv/include/asm/set_memory.h > @@ -15,6 +15,7 @@ int set_memory_ro(unsigned long addr, int numpages); > int set_memory_rw(unsigned long addr, int numpages); > int set_memory_x(unsigned long addr, int numpages); > int set_memory_nx(unsigned long addr, int numpages); > +int set_memory_default(unsigned long addr, int numpages); > void protect_kernel_text_data(void); > #else > static inline int set_memory_ro(unsigned long addr, int numpages) { return 0; } > @@ -22,6 +23,7 @@ static inline int set_memory_rw(unsigned long addr, int numpages) { return 0; } > static inline int set_memory_x(unsigned long addr, int numpages) { return 0; } > static inline int set_memory_nx(unsigned long addr, int numpages) { return 0; } > static inline void protect_kernel_text_data(void) {}; > +static inline int set_memory_default(unsigned long addr, int numpages) { return 0; } > #endif > > int set_direct_map_invalid_noflush(struct page *page); > diff --git a/arch/riscv/kernel/setup.c b/arch/riscv/kernel/setup.c > index b722c5bf892c..abfbdc8cfef3 100644 > --- a/arch/riscv/kernel/setup.c > +++ b/arch/riscv/kernel/setup.c > @@ -123,3 +123,12 @@ static int __init topology_init(void) > return 0; > } > subsys_initcall(topology_init); > + > +void free_initmem(void) > +{ > + unsigned long init_begin = (unsigned long)__init_begin; > + unsigned long init_end = (unsigned long)__init_end; > + > + set_memory_default(init_begin, (init_end - init_begin) >> PAGE_SHIFT); And what does "default" imply? Maybe set_memory_rw() would better name ... > + free_initmem_default(POISON_FREE_INITMEM); > +} ... > diff --git a/arch/riscv/mm/pageattr.c b/arch/riscv/mm/pageattr.c > index 19fecb362d81..04f3fc16aa9c 100644 > --- a/arch/riscv/mm/pageattr.c > +++ b/arch/riscv/mm/pageattr.c > @@ -128,6 +128,12 @@ static int __set_memory(unsigned long addr, int numpages, pgprot_t set_mask, > return ret; > } > > +int set_memory_default(unsigned long addr, int numpages) > +{ > + return __set_memory(addr, numpages, __pgprot(_PAGE_KERNEL), > + __pgprot(_PAGE_EXEC)); ... because you'd need to find what _PAGE_KERNEL is, do bitwise ops and than find out that default is apparently RW :) > +} > + > int set_memory_ro(unsigned long addr, int numpages) > { > return __set_memory(addr, numpages, __pgprot(_PAGE_READ), > -- > 2.25.1 >
On Tue, Oct 27, 2020 at 3:46 AM Mike Rapoport <rppt@kernel.org> wrote: > > On Mon, Oct 26, 2020 at 04:02:53PM -0700, Atish Patra wrote: > > Currently, .init.text & .init.data are intermixed which makes it impossible > > apply different permissions to them. .init.data shouldn't need exec > > permissions while .init.text shouldn't have write permission. > > > > Keep them in separate sections so that different permissions are applied to > > each section. This improves the kernel protection under > > CONFIG_STRICT_KERNEL_RWX. We also need to restore the permissions for the > > entire _init section after it is freed so that those pages can be used for > > other purpose. > > > > Signed-off-by: Atish Patra <atish.patra@wdc.com> > > --- > > arch/riscv/include/asm/sections.h | 2 ++ > > arch/riscv/include/asm/set_memory.h | 2 ++ > > arch/riscv/kernel/setup.c | 9 +++++ > > arch/riscv/kernel/vmlinux.lds.S | 51 ++++++++++++++++------------- > > arch/riscv/mm/init.c | 8 ++++- > > arch/riscv/mm/pageattr.c | 6 ++++ > > 6 files changed, 54 insertions(+), 24 deletions(-) > > > > diff --git a/arch/riscv/include/asm/sections.h b/arch/riscv/include/asm/sections.h > > index 3a9971b1210f..1595c5b60cfd 100644 > > --- a/arch/riscv/include/asm/sections.h > > +++ b/arch/riscv/include/asm/sections.h > > @@ -9,5 +9,7 @@ > > > > extern char _start[]; > > extern char _start_kernel[]; > > +extern char __init_data_begin[], __init_data_end[]; > > +extern char __init_text_begin[], __init_text_end[]; > > > > #endif /* __ASM_SECTIONS_H */ > > diff --git a/arch/riscv/include/asm/set_memory.h b/arch/riscv/include/asm/set_memory.h > > index 4cc3a4e2afd3..913429c9c1ae 100644 > > --- a/arch/riscv/include/asm/set_memory.h > > +++ b/arch/riscv/include/asm/set_memory.h > > @@ -15,6 +15,7 @@ int set_memory_ro(unsigned long addr, int numpages); > > int set_memory_rw(unsigned long addr, int numpages); > > int set_memory_x(unsigned long addr, int numpages); > > int set_memory_nx(unsigned long addr, int numpages); > > +int set_memory_default(unsigned long addr, int numpages); > > void protect_kernel_text_data(void); > > #else > > static inline int set_memory_ro(unsigned long addr, int numpages) { return 0; } > > @@ -22,6 +23,7 @@ static inline int set_memory_rw(unsigned long addr, int numpages) { return 0; } > > static inline int set_memory_x(unsigned long addr, int numpages) { return 0; } > > static inline int set_memory_nx(unsigned long addr, int numpages) { return 0; } > > static inline void protect_kernel_text_data(void) {}; > > +static inline int set_memory_default(unsigned long addr, int numpages) { return 0; } > > #endif > > > > int set_direct_map_invalid_noflush(struct page *page); > > diff --git a/arch/riscv/kernel/setup.c b/arch/riscv/kernel/setup.c > > index b722c5bf892c..abfbdc8cfef3 100644 > > --- a/arch/riscv/kernel/setup.c > > +++ b/arch/riscv/kernel/setup.c > > @@ -123,3 +123,12 @@ static int __init topology_init(void) > > return 0; > > } > > subsys_initcall(topology_init); > > + > > +void free_initmem(void) > > +{ > > + unsigned long init_begin = (unsigned long)__init_begin; > > + unsigned long init_end = (unsigned long)__init_end; > > + > > + set_memory_default(init_begin, (init_end - init_begin) >> PAGE_SHIFT); > > And what does "default" imply? > Maybe set_memory_rw() would better name ... > > > + free_initmem_default(POISON_FREE_INITMEM); > > +} > > ... > > > diff --git a/arch/riscv/mm/pageattr.c b/arch/riscv/mm/pageattr.c > > index 19fecb362d81..04f3fc16aa9c 100644 > > --- a/arch/riscv/mm/pageattr.c > > +++ b/arch/riscv/mm/pageattr.c > > @@ -128,6 +128,12 @@ static int __set_memory(unsigned long addr, int numpages, pgprot_t set_mask, > > return ret; > > } > > > > +int set_memory_default(unsigned long addr, int numpages) > > +{ > > + return __set_memory(addr, numpages, __pgprot(_PAGE_KERNEL), > > + __pgprot(_PAGE_EXEC)); > > ... because you'd need to find what _PAGE_KERNEL is, do bitwise ops and > than find out that default is apparently RW :) > Yeah. But We have explicitly disable the EXECUTE bit as these pages were marked with RWX earlier. set_memory_rw makes sure that RW bits are set but doesn't disable the X bit. > > +} > > + > > int set_memory_ro(unsigned long addr, int numpages) > > { > > return __set_memory(addr, numpages, __pgprot(_PAGE_READ), > > -- > > 2.25.1 > > > > -- > Sincerely yours, > Mike. > > _______________________________________________ > linux-riscv mailing list > linux-riscv@lists.infradead.org > http://lists.infradead.org/mailman/listinfo/linux-riscv
On Thu, Oct 29, 2020 at 12:21:41PM -0700, Atish Patra wrote: > On Tue, Oct 27, 2020 at 3:46 AM Mike Rapoport <rppt@kernel.org> wrote: > > > > On Mon, Oct 26, 2020 at 04:02:53PM -0700, Atish Patra wrote: > > > Currently, .init.text & .init.data are intermixed which makes it impossible > > > apply different permissions to them. .init.data shouldn't need exec > > > permissions while .init.text shouldn't have write permission. > > > > > > Keep them in separate sections so that different permissions are applied to > > > each section. This improves the kernel protection under > > > CONFIG_STRICT_KERNEL_RWX. We also need to restore the permissions for the > > > entire _init section after it is freed so that those pages can be used for > > > other purpose. > > > > > > Signed-off-by: Atish Patra <atish.patra@wdc.com> > > > --- > > > arch/riscv/include/asm/sections.h | 2 ++ > > > arch/riscv/include/asm/set_memory.h | 2 ++ > > > arch/riscv/kernel/setup.c | 9 +++++ > > > arch/riscv/kernel/vmlinux.lds.S | 51 ++++++++++++++++------------- > > > arch/riscv/mm/init.c | 8 ++++- > > > arch/riscv/mm/pageattr.c | 6 ++++ > > > 6 files changed, 54 insertions(+), 24 deletions(-) > > > > > > diff --git a/arch/riscv/include/asm/sections.h b/arch/riscv/include/asm/sections.h > > > index 3a9971b1210f..1595c5b60cfd 100644 > > > --- a/arch/riscv/include/asm/sections.h > > > +++ b/arch/riscv/include/asm/sections.h > > > @@ -9,5 +9,7 @@ > > > > > > extern char _start[]; > > > extern char _start_kernel[]; > > > +extern char __init_data_begin[], __init_data_end[]; > > > +extern char __init_text_begin[], __init_text_end[]; > > > > > > #endif /* __ASM_SECTIONS_H */ > > > diff --git a/arch/riscv/include/asm/set_memory.h b/arch/riscv/include/asm/set_memory.h > > > index 4cc3a4e2afd3..913429c9c1ae 100644 > > > --- a/arch/riscv/include/asm/set_memory.h > > > +++ b/arch/riscv/include/asm/set_memory.h > > > @@ -15,6 +15,7 @@ int set_memory_ro(unsigned long addr, int numpages); > > > int set_memory_rw(unsigned long addr, int numpages); > > > int set_memory_x(unsigned long addr, int numpages); > > > int set_memory_nx(unsigned long addr, int numpages); > > > +int set_memory_default(unsigned long addr, int numpages); > > > void protect_kernel_text_data(void); > > > #else > > > static inline int set_memory_ro(unsigned long addr, int numpages) { return 0; } > > > @@ -22,6 +23,7 @@ static inline int set_memory_rw(unsigned long addr, int numpages) { return 0; } > > > static inline int set_memory_x(unsigned long addr, int numpages) { return 0; } > > > static inline int set_memory_nx(unsigned long addr, int numpages) { return 0; } > > > static inline void protect_kernel_text_data(void) {}; > > > +static inline int set_memory_default(unsigned long addr, int numpages) { return 0; } > > > #endif > > > > > > int set_direct_map_invalid_noflush(struct page *page); > > > diff --git a/arch/riscv/kernel/setup.c b/arch/riscv/kernel/setup.c > > > index b722c5bf892c..abfbdc8cfef3 100644 > > > --- a/arch/riscv/kernel/setup.c > > > +++ b/arch/riscv/kernel/setup.c > > > @@ -123,3 +123,12 @@ static int __init topology_init(void) > > > return 0; > > > } > > > subsys_initcall(topology_init); > > > + > > > +void free_initmem(void) > > > +{ > > > + unsigned long init_begin = (unsigned long)__init_begin; > > > + unsigned long init_end = (unsigned long)__init_end; > > > + > > > + set_memory_default(init_begin, (init_end - init_begin) >> PAGE_SHIFT); > > > > And what does "default" imply? > > Maybe set_memory_rw() would better name ... > > > > > + free_initmem_default(POISON_FREE_INITMEM); > > > +} > > > > ... > > > > > diff --git a/arch/riscv/mm/pageattr.c b/arch/riscv/mm/pageattr.c > > > index 19fecb362d81..04f3fc16aa9c 100644 > > > --- a/arch/riscv/mm/pageattr.c > > > +++ b/arch/riscv/mm/pageattr.c > > > @@ -128,6 +128,12 @@ static int __set_memory(unsigned long addr, int numpages, pgprot_t set_mask, > > > return ret; > > > } > > > > > > +int set_memory_default(unsigned long addr, int numpages) > > > +{ > > > + return __set_memory(addr, numpages, __pgprot(_PAGE_KERNEL), > > > + __pgprot(_PAGE_EXEC)); > > > > ... because you'd need to find what _PAGE_KERNEL is, do bitwise ops and > > than find out that default is apparently RW :) > > > > Yeah. But We have explicitly disable the EXECUTE bit as these pages were marked > with RWX earlier. set_memory_rw makes sure that RW bits are set but > doesn't disable > the X bit. Maybe set_memory_rw_nx() then? Then there will be no ambiguity about what this function does. Besides, having set_memory_default() and set_direct_map_default() with different masks would be confusing :) > > > +} > > > + > > > int set_memory_ro(unsigned long addr, int numpages) > > > { > > > return __set_memory(addr, numpages, __pgprot(_PAGE_READ), > > > -- > > > 2.25.1 > > > > > > > -- > > Sincerely yours, > > Mike. > > > > _______________________________________________ > > linux-riscv mailing list > > linux-riscv@lists.infradead.org > > http://lists.infradead.org/mailman/listinfo/linux-riscv > > > > -- > Regards, > Atish
On Fri, Oct 30, 2020 at 1:49 AM Mike Rapoport <rppt@kernel.org> wrote: > > On Thu, Oct 29, 2020 at 12:21:41PM -0700, Atish Patra wrote: > > On Tue, Oct 27, 2020 at 3:46 AM Mike Rapoport <rppt@kernel.org> wrote: > > > > > > On Mon, Oct 26, 2020 at 04:02:53PM -0700, Atish Patra wrote: > > > > Currently, .init.text & .init.data are intermixed which makes it impossible > > > > apply different permissions to them. .init.data shouldn't need exec > > > > permissions while .init.text shouldn't have write permission. > > > > > > > > Keep them in separate sections so that different permissions are applied to > > > > each section. This improves the kernel protection under > > > > CONFIG_STRICT_KERNEL_RWX. We also need to restore the permissions for the > > > > entire _init section after it is freed so that those pages can be used for > > > > other purpose. > > > > > > > > Signed-off-by: Atish Patra <atish.patra@wdc.com> > > > > --- > > > > arch/riscv/include/asm/sections.h | 2 ++ > > > > arch/riscv/include/asm/set_memory.h | 2 ++ > > > > arch/riscv/kernel/setup.c | 9 +++++ > > > > arch/riscv/kernel/vmlinux.lds.S | 51 ++++++++++++++++------------- > > > > arch/riscv/mm/init.c | 8 ++++- > > > > arch/riscv/mm/pageattr.c | 6 ++++ > > > > 6 files changed, 54 insertions(+), 24 deletions(-) > > > > > > > > diff --git a/arch/riscv/include/asm/sections.h b/arch/riscv/include/asm/sections.h > > > > index 3a9971b1210f..1595c5b60cfd 100644 > > > > --- a/arch/riscv/include/asm/sections.h > > > > +++ b/arch/riscv/include/asm/sections.h > > > > @@ -9,5 +9,7 @@ > > > > > > > > extern char _start[]; > > > > extern char _start_kernel[]; > > > > +extern char __init_data_begin[], __init_data_end[]; > > > > +extern char __init_text_begin[], __init_text_end[]; > > > > > > > > #endif /* __ASM_SECTIONS_H */ > > > > diff --git a/arch/riscv/include/asm/set_memory.h b/arch/riscv/include/asm/set_memory.h > > > > index 4cc3a4e2afd3..913429c9c1ae 100644 > > > > --- a/arch/riscv/include/asm/set_memory.h > > > > +++ b/arch/riscv/include/asm/set_memory.h > > > > @@ -15,6 +15,7 @@ int set_memory_ro(unsigned long addr, int numpages); > > > > int set_memory_rw(unsigned long addr, int numpages); > > > > int set_memory_x(unsigned long addr, int numpages); > > > > int set_memory_nx(unsigned long addr, int numpages); > > > > +int set_memory_default(unsigned long addr, int numpages); > > > > void protect_kernel_text_data(void); > > > > #else > > > > static inline int set_memory_ro(unsigned long addr, int numpages) { return 0; } > > > > @@ -22,6 +23,7 @@ static inline int set_memory_rw(unsigned long addr, int numpages) { return 0; } > > > > static inline int set_memory_x(unsigned long addr, int numpages) { return 0; } > > > > static inline int set_memory_nx(unsigned long addr, int numpages) { return 0; } > > > > static inline void protect_kernel_text_data(void) {}; > > > > +static inline int set_memory_default(unsigned long addr, int numpages) { return 0; } > > > > #endif > > > > > > > > int set_direct_map_invalid_noflush(struct page *page); > > > > diff --git a/arch/riscv/kernel/setup.c b/arch/riscv/kernel/setup.c > > > > index b722c5bf892c..abfbdc8cfef3 100644 > > > > --- a/arch/riscv/kernel/setup.c > > > > +++ b/arch/riscv/kernel/setup.c > > > > @@ -123,3 +123,12 @@ static int __init topology_init(void) > > > > return 0; > > > > } > > > > subsys_initcall(topology_init); > > > > + > > > > +void free_initmem(void) > > > > +{ > > > > + unsigned long init_begin = (unsigned long)__init_begin; > > > > + unsigned long init_end = (unsigned long)__init_end; > > > > + > > > > + set_memory_default(init_begin, (init_end - init_begin) >> PAGE_SHIFT); > > > > > > And what does "default" imply? > > > Maybe set_memory_rw() would better name ... > > > > > > > + free_initmem_default(POISON_FREE_INITMEM); > > > > +} > > > > > > ... > > > > > > > diff --git a/arch/riscv/mm/pageattr.c b/arch/riscv/mm/pageattr.c > > > > index 19fecb362d81..04f3fc16aa9c 100644 > > > > --- a/arch/riscv/mm/pageattr.c > > > > +++ b/arch/riscv/mm/pageattr.c > > > > @@ -128,6 +128,12 @@ static int __set_memory(unsigned long addr, int numpages, pgprot_t set_mask, > > > > return ret; > > > > } > > > > > > > > +int set_memory_default(unsigned long addr, int numpages) > > > > +{ > > > > + return __set_memory(addr, numpages, __pgprot(_PAGE_KERNEL), > > > > + __pgprot(_PAGE_EXEC)); > > > > > > ... because you'd need to find what _PAGE_KERNEL is, do bitwise ops and > > > than find out that default is apparently RW :) > > > > > > > Yeah. But We have explicitly disable the EXECUTE bit as these pages were marked > > with RWX earlier. set_memory_rw makes sure that RW bits are set but > > doesn't disable > > the X bit. > > Maybe set_memory_rw_nx() then? > Then there will be no ambiguity about what this function does. > Sure. I will do that in v2. > Besides, having set_memory_default() and set_direct_map_default() with > different masks would be confusing :) > Of course :). > > > > +} > > > > + > > > > int set_memory_ro(unsigned long addr, int numpages) > > > > { > > > > return __set_memory(addr, numpages, __pgprot(_PAGE_READ), > > > > -- > > > > 2.25.1 > > > > > > > > > > -- > > > Sincerely yours, > > > Mike. > > > > > > _______________________________________________ > > > linux-riscv mailing list > > > linux-riscv@lists.infradead.org > > > http://lists.infradead.org/mailman/listinfo/linux-riscv > > > > > > > > -- > > Regards, > > Atish > > -- > Sincerely yours, > Mike.
diff --git a/arch/riscv/include/asm/sections.h b/arch/riscv/include/asm/sections.h index 3a9971b1210f..1595c5b60cfd 100644 --- a/arch/riscv/include/asm/sections.h +++ b/arch/riscv/include/asm/sections.h @@ -9,5 +9,7 @@ extern char _start[]; extern char _start_kernel[]; +extern char __init_data_begin[], __init_data_end[]; +extern char __init_text_begin[], __init_text_end[]; #endif /* __ASM_SECTIONS_H */ diff --git a/arch/riscv/include/asm/set_memory.h b/arch/riscv/include/asm/set_memory.h index 4cc3a4e2afd3..913429c9c1ae 100644 --- a/arch/riscv/include/asm/set_memory.h +++ b/arch/riscv/include/asm/set_memory.h @@ -15,6 +15,7 @@ int set_memory_ro(unsigned long addr, int numpages); int set_memory_rw(unsigned long addr, int numpages); int set_memory_x(unsigned long addr, int numpages); int set_memory_nx(unsigned long addr, int numpages); +int set_memory_default(unsigned long addr, int numpages); void protect_kernel_text_data(void); #else static inline int set_memory_ro(unsigned long addr, int numpages) { return 0; } @@ -22,6 +23,7 @@ static inline int set_memory_rw(unsigned long addr, int numpages) { return 0; } static inline int set_memory_x(unsigned long addr, int numpages) { return 0; } static inline int set_memory_nx(unsigned long addr, int numpages) { return 0; } static inline void protect_kernel_text_data(void) {}; +static inline int set_memory_default(unsigned long addr, int numpages) { return 0; } #endif int set_direct_map_invalid_noflush(struct page *page); diff --git a/arch/riscv/kernel/setup.c b/arch/riscv/kernel/setup.c index b722c5bf892c..abfbdc8cfef3 100644 --- a/arch/riscv/kernel/setup.c +++ b/arch/riscv/kernel/setup.c @@ -123,3 +123,12 @@ static int __init topology_init(void) return 0; } subsys_initcall(topology_init); + +void free_initmem(void) +{ + unsigned long init_begin = (unsigned long)__init_begin; + unsigned long init_end = (unsigned long)__init_end; + + set_memory_default(init_begin, (init_end - init_begin) >> PAGE_SHIFT); + free_initmem_default(POISON_FREE_INITMEM); +} diff --git a/arch/riscv/kernel/vmlinux.lds.S b/arch/riscv/kernel/vmlinux.lds.S index cacd7898ba7f..0a1874e48e8a 100644 --- a/arch/riscv/kernel/vmlinux.lds.S +++ b/arch/riscv/kernel/vmlinux.lds.S @@ -29,6 +29,26 @@ SECTIONS HEAD_TEXT_SECTION . = ALIGN(PAGE_SIZE); + .text : { + _text = .; + _stext = .; + TEXT_TEXT + SCHED_TEXT + CPUIDLE_TEXT + LOCK_TEXT + KPROBES_TEXT + ENTRY_TEXT + IRQENTRY_TEXT + SOFTIRQENTRY_TEXT + *(.fixup) + _etext = .; + } + +#ifdef CONFIG_EFI + . = ALIGN(PECOFF_SECTION_ALIGNMENT); + __pecoff_text_end = .; +#endif + . = ALIGN(SECTION_ALIGN); __init_begin = .; __init_text_begin = .; .init.text : AT(ADDR(.init.text) - LOAD_OFFSET) ALIGN(SECTION_ALIGN) { \ @@ -53,35 +73,20 @@ SECTIONS { EXIT_TEXT } + + __init_text_end = .; + . = ALIGN(SECTION_ALIGN); + /* Start of init data section */ + __init_data_begin = .; + INIT_DATA_SECTION(16) .exit.data : { EXIT_DATA } PERCPU_SECTION(L1_CACHE_BYTES) - __init_end = .; - . = ALIGN(SECTION_ALIGN); - .text : { - _text = .; - _stext = .; - TEXT_TEXT - SCHED_TEXT - CPUIDLE_TEXT - LOCK_TEXT - KPROBES_TEXT - ENTRY_TEXT - IRQENTRY_TEXT - SOFTIRQENTRY_TEXT - *(.fixup) - _etext = .; - } - -#ifdef CONFIG_EFI - . = ALIGN(PECOFF_SECTION_ALIGNMENT); - __pecoff_text_end = .; -#endif - - INIT_DATA_SECTION(16) + __init_data_end = .; + __init_end = .; /* Start of data section */ _sdata = .; diff --git a/arch/riscv/mm/init.c b/arch/riscv/mm/init.c index 5f196f8158d4..1bb3821d81d5 100644 --- a/arch/riscv/mm/init.c +++ b/arch/riscv/mm/init.c @@ -610,13 +610,19 @@ static inline void setup_vm_final(void) #ifdef CONFIG_STRICT_KERNEL_RWX void protect_kernel_text_data(void) { - unsigned long text_start = (unsigned long)_text; + unsigned long text_start = (unsigned long)_start; unsigned long text_end = (unsigned long)_etext; + unsigned long init_text_start = (unsigned long)__init_text_begin; + unsigned long init_text_end = (unsigned long)__init_text_end; + unsigned long init_data_start = (unsigned long)__init_data_begin; + unsigned long init_data_end = (unsigned long)__init_data_end; unsigned long rodata_start = (unsigned long)__start_rodata; unsigned long data_start = (unsigned long)_data; unsigned long max_low = (unsigned long)(__va(PFN_PHYS(max_low_pfn))); + set_memory_ro(init_text_start, (init_text_end - init_text_start) >> PAGE_SHIFT); set_memory_ro(text_start, (text_end - text_start) >> PAGE_SHIFT); + set_memory_nx(init_data_start, (init_data_end - init_data_start) >> PAGE_SHIFT); set_memory_nx(rodata_start, (data_start - rodata_start) >> PAGE_SHIFT); set_memory_nx(data_start, (max_low - data_start) >> PAGE_SHIFT); } diff --git a/arch/riscv/mm/pageattr.c b/arch/riscv/mm/pageattr.c index 19fecb362d81..04f3fc16aa9c 100644 --- a/arch/riscv/mm/pageattr.c +++ b/arch/riscv/mm/pageattr.c @@ -128,6 +128,12 @@ static int __set_memory(unsigned long addr, int numpages, pgprot_t set_mask, return ret; } +int set_memory_default(unsigned long addr, int numpages) +{ + return __set_memory(addr, numpages, __pgprot(_PAGE_KERNEL), + __pgprot(_PAGE_EXEC)); +} + int set_memory_ro(unsigned long addr, int numpages) { return __set_memory(addr, numpages, __pgprot(_PAGE_READ),
Currently, .init.text & .init.data are intermixed which makes it impossible apply different permissions to them. .init.data shouldn't need exec permissions while .init.text shouldn't have write permission. Keep them in separate sections so that different permissions are applied to each section. This improves the kernel protection under CONFIG_STRICT_KERNEL_RWX. We also need to restore the permissions for the entire _init section after it is freed so that those pages can be used for other purpose. Signed-off-by: Atish Patra <atish.patra@wdc.com> --- arch/riscv/include/asm/sections.h | 2 ++ arch/riscv/include/asm/set_memory.h | 2 ++ arch/riscv/kernel/setup.c | 9 +++++ arch/riscv/kernel/vmlinux.lds.S | 51 ++++++++++++++++------------- arch/riscv/mm/init.c | 8 ++++- arch/riscv/mm/pageattr.c | 6 ++++ 6 files changed, 54 insertions(+), 24 deletions(-)