Skip to content
Permalink
Browse files
x86, vmlinux.lds.S: Page align RO data for xo text
RO data starts right after the kernel text. If the kernel text doesn’t end
exactly on a 2MB page boundary, then the last page of text will share a page
with the RO data. This prevents all of the text being set as execute-only,
since it would make the RO data not readable.

So page align the start of the RO data when CONFIG_XO_TEXT so this does not
happen. This usually results in the last page of kernel text being a 4k page
instead of a 2MB one. The RO data could be 2MB aligned to avoid this, but at
the cost of extra memory usage. So have it be a 4k page, as it is the
compromise PTI used when setting some pages non-global.

Signed-off-by: Rick Edgecombe <rick.p.edgecombe@intel.com>
  • Loading branch information
rpedgeco committed Aug 23, 2019
1 parent 79b157b commit 428f889a5c52ca85b763cf484ed666a33259b6ef
Showing 2 changed files with 11 additions and 0 deletions.
@@ -872,6 +872,9 @@ config STRICT_MODULE_RWX
and non-text memory will be made non-executable. This provides
protection against certain security exploits (e.g. writing to text)

config STRICT_KERNEL_NR
bool "Align kernel rodata so all kernel text can be set not readable"

# select if the architecture provides an asm/dma-direct.h header
config ARCH_HAS_PHYS_TO_DMA
bool
@@ -143,6 +143,14 @@ SECTIONS
#endif
} :text = 0x9090

/*
* If the kernel text is XO, make sure no data shares the page with the
* kernel text.
*/
#ifdef CONFIG_XO_TEXT
. = ALIGN(PAGE_SIZE);
#endif

/* End of text section */
_etext = .;

0 comments on commit 428f889

Please sign in to comment.