From patchwork Tue Mar 14 10:13:29 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Evgeniy Baskov X-Patchwork-Id: 69452 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a5d:5915:0:0:0:0:0 with SMTP id v21csp1677346wrd; Tue, 14 Mar 2023 03:35:52 -0700 (PDT) X-Google-Smtp-Source: AK7set9zyguS0pCfVALYDvDHh3h3NbBhsPeiHhN1XpLwBqwHc3UMGHqi+cGJ0M0CPW3UjAUNai16 X-Received: by 2002:a05:6a20:e688:b0:c7:6cb7:cfbf with SMTP id mz8-20020a056a20e68800b000c76cb7cfbfmr33761461pzb.10.1678790152022; Tue, 14 Mar 2023 03:35:52 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1678790152; cv=none; d=google.com; s=arc-20160816; b=FP4JFZad7Y/cHNAT0+SL8fLUmfIwfB+tG/8DePoDEeVad/YcwqJhQgcAXKpu3lss6Q vilGZmToWG4vozMDj9iuPRtwnXyj3pychDdDyjypsyRPtmfQowQ9fcmKfqWNrg81Ulr5 jex9pQDEOT+wDWNIDW4KYPDo8mTB9fbfWXiG3MmpqaEiUNzW2IOIC2Pih/iRxSVVsoAZ vR9cX64x0To3geljDrw2u2eeWLmI8AjGMtVe5w65othVZ+X6O+MwPXffSPbrAhRZRlnG TFGViRFF+v4rm7W+ZmwohjrhuZ42okHOlCUPIbpvKDgR5BEo5ieI0sez7DMNOa8GP9vF tgzQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :references:in-reply-to:message-id:date:subject:cc:to:from :dkim-signature:dkim-filter; bh=EFJb9tTw64ENt680pifdKRXpvL7PgePGOnq6mgMilbI=; b=ZoWi0t/7TdI1vrdCctS2YbLO5KaTGAoiIFV+eXAD4f4nRQPEkPSoiCC08qBj8wSD1j 4x85NhxTcW4Mkx7t7vEudef9dpxOAgR2lOX52mUfJiXUuqCOwoPH9B+lFDEVNd7rNGhK kwErrrGbQSjkE8AsDzKD+emiJbvwgBYAmFqll6BMF5OK9aiF5ViEERmZklhksmqknqyQ u9JzLQCACcWDvsbXHKNieQRlTfn26rKrU1cxfcUG3cO05Uo0WUh6/y5RFXfNAy7eELTE ouDG0k2jv/RNcUgP9m/+d8lGWlYbwP9a3J7MAHNKThVzhwBO5ZupPV3X4RHyOu1qukvK noaA== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@ispras.ru header.s=default header.b=ggABUxDr; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=ispras.ru Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id h16-20020aa796d0000000b00622821ff7desi1868384pfq.134.2023.03.14.03.35.39; Tue, 14 Mar 2023 03:35:51 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=pass header.i=@ispras.ru header.s=default header.b=ggABUxDr; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=ispras.ru Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229961AbjCNKWx (ORCPT + 99 others); Tue, 14 Mar 2023 06:22:53 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:48958 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S230182AbjCNKW1 (ORCPT ); Tue, 14 Mar 2023 06:22:27 -0400 Received: from mail.ispras.ru (mail.ispras.ru [83.149.199.84]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 554719BA74; Tue, 14 Mar 2023 03:22:02 -0700 (PDT) Received: from localhost.localdomain (unknown [83.149.199.65]) by mail.ispras.ru (Postfix) with ESMTPSA id CDC7B40755D2; Tue, 14 Mar 2023 10:14:00 +0000 (UTC) DKIM-Filter: OpenDKIM Filter v2.11.0 mail.ispras.ru CDC7B40755D2 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ispras.ru; s=default; t=1678788840; bh=EFJb9tTw64ENt680pifdKRXpvL7PgePGOnq6mgMilbI=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=ggABUxDrzLvNuUbajlU0vfcHk6kjIt3AhOX8yP6tIfcNDRtbNZ0Monp4gLl4Q/x8P pRiB0dAKaypOKO/Ou7Ml1USRjoirdXCWolVA77DP3epJ+4NhlULw+xK0UIT6dbmYxV 8Fs5pW69Gi93ZNQSy0CtUwi7bSWHob8SqRPhH6N0= From: Evgeniy Baskov To: Ard Biesheuvel Cc: Evgeniy Baskov , Borislav Petkov , Andy Lutomirski , Dave Hansen , Ingo Molnar , Peter Zijlstra , Thomas Gleixner , Alexey Khoroshilov , Peter Jones , Gerd Hoffmann , "Limonciello, Mario" , joeyli , lvc-project@linuxtesting.org, x86@kernel.org, linux-efi@vger.kernel.org, linux-kernel@vger.kernel.org, linux-hardening@vger.kernel.org Subject: [PATCH v5 02/27] x86/build: Remove RWX sections and align on 4KB Date: Tue, 14 Mar 2023 13:13:29 +0300 Message-Id: X-Mailer: git-send-email 2.39.2 In-Reply-To: References: MIME-Version: 1.0 X-Spam-Status: No, score=-2.1 required=5.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,SPF_HELO_NONE,SPF_PASS, URIBL_BLOCKED autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= X-GMAIL-THRID: =?utf-8?q?1760339062150826345?= X-GMAIL-MSGID: =?utf-8?q?1760339062150826345?= Avoid creating sections simultaneously writable and readable to prepare for W^X implementation for the kernel itself (not the decompressor). Align kernel sections on page size (4KB) to allow protecting them in the page tables. Split init code form ".init" segment into separate R_X ".inittext" segment and make ".init" segment non-executable. Also add these segments to x86_32 architecture for consistency. Currently paging is disabled in x86_32 in compressed kernel, so protection is not applied anyways, but .init code was incorrectly placed in non-executable ".data" segment. This should not change anything meaningful in memory layout now, but might be required in case memory protection will also be implemented in compressed kernel for x86_32. Tested-by: Mario Limonciello Signed-off-by: Evgeniy Baskov --- arch/x86/kernel/vmlinux.lds.S | 15 ++++++++------- 1 file changed, 8 insertions(+), 7 deletions(-) diff --git a/arch/x86/kernel/vmlinux.lds.S b/arch/x86/kernel/vmlinux.lds.S index 25f155205770..81ea1236d293 100644 --- a/arch/x86/kernel/vmlinux.lds.S +++ b/arch/x86/kernel/vmlinux.lds.S @@ -102,12 +102,11 @@ jiffies = jiffies_64; PHDRS { text PT_LOAD FLAGS(5); /* R_E */ data PT_LOAD FLAGS(6); /* RW_ */ -#ifdef CONFIG_X86_64 -#ifdef CONFIG_SMP +#if defined(CONFIG_X86_64) && defined(CONFIG_SMP) percpu PT_LOAD FLAGS(6); /* RW_ */ #endif - init PT_LOAD FLAGS(7); /* RWE */ -#endif + inittext PT_LOAD FLAGS(5); /* R_E */ + init PT_LOAD FLAGS(6); /* RW_ */ note PT_NOTE FLAGS(0); /* ___ */ } @@ -226,9 +225,10 @@ SECTIONS #endif INIT_TEXT_SECTION(PAGE_SIZE) -#ifdef CONFIG_X86_64 - :init -#endif + :inittext + + . = ALIGN(PAGE_SIZE); + /* * Section for code used exclusively before alternatives are run. All @@ -240,6 +240,7 @@ SECTIONS .altinstr_aux : AT(ADDR(.altinstr_aux) - LOAD_OFFSET) { *(.altinstr_aux) } + :init INIT_DATA_SECTION(16)