arm64: add better page protections to arm64

Add page protections for arm64 similar to those in arm.
This is for security reasons to prevent certain classes
of exploits. The current method:

- Map all memory as either RWX or RW. We round to the nearest
  section to avoid creating page tables before everything is mapped
- Once everything is mapped, if either end of the RWX section should
  not be X, we split the PMD and remap as necessary
- When initmem is to be freed, we change the permissions back to
  RW (using stop machine if necessary to flush the TLB)
- If CONFIG_DEBUG_RODATA is set, the read only sections are set
  read only.

Acked-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Tested-by: Kees Cook <keescook@chromium.org>
Tested-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Signed-off-by: Laura Abbott <lauraa@codeaurora.org>
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>

1 files changed, 15 insertions, 2 deletions

diff --git a/arch/arm64/kernel/vmlinux.lds.S b/arch/arm64/kernel/vmlinux.lds.S
index 9965ec87cbec..5d9d2dca530d 100644
--- a/arch/arm64/kernel/vmlinux.lds.S
+++ b/arch/arm64/kernel/vmlinux.lds.S
@@ -8,6 +8,7 @@
 #include <asm/thread_info.h>
 #include <asm/memory.h>
 #include <asm/page.h>
+#include <asm/pgtable.h>
 
 #include "image.h"
 
@@ -49,6 +50,14 @@ PECOFF_FILE_ALIGNMENT = 0x200;
 #define PECOFF_EDATA_PADDING
 #endif
 
+#ifdef CONFIG_DEBUG_ALIGN_RODATA
+#define ALIGN_DEBUG_RO                  . = ALIGN(1<<SECTION_SHIFT);
+#define ALIGN_DEBUG_RO_MIN(min)         ALIGN_DEBUG_RO
+#else
+#define ALIGN_DEBUG_RO
+#define ALIGN_DEBUG_RO_MIN(min)         . = ALIGN(min);
+#endif
+
 SECTIONS
 {
         /*
@@ -71,6 +80,7 @@ SECTIONS
                 _text = .;
                 HEAD_TEXT
         }
+        ALIGN_DEBUG_RO
         .text : {                       /* Real text segment            */
                 _stext = .;             /* Text and read-only data      */
                         __exception_text_start = .;
@@ -87,19 +97,22 @@ SECTIONS
                 *(.got)                 /* Global offset table          */
         }
 
+        ALIGN_DEBUG_RO
         RO_DATA(PAGE_SIZE)
         EXCEPTION_TABLE(8)
         NOTES
+        ALIGN_DEBUG_RO
         _etext = .;                     /* End of text and rodata section */
 
-        . = ALIGN(PAGE_SIZE);
+        ALIGN_DEBUG_RO_MIN(PAGE_SIZE)
         __init_begin = .;
 
         INIT_TEXT_SECTION(8)
         .exit.text : {
                 ARM_EXIT_KEEP(EXIT_TEXT)
         }
-        . = ALIGN(16);
+
+        ALIGN_DEBUG_RO_MIN(16)
         .init.data : {
                 INIT_DATA
                 INIT_SETUP(16)