From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-wm1-f73.google.com (mail-wm1-f73.google.com [209.85.128.73]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 5C36C4964F for ; Fri, 19 Jun 2026 16:40:19 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.128.73 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781887220; cv=none; b=QhvjwPdr0u+bU6itcfI+4NDLfWj++XPwuNxFjZsGK52QhF3b3yz2TYKTPBRRENV0gI+fgh1QSR3iL/FX7Dv9BJQ0FaX/esC3eSaDMJ74kJNkJ6KlhMvlQHgqdY0bpd9YgBCi7V36QIXandd2Y4ikxDYNo0S8OIAXq2JtUdepApw= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781887220; c=relaxed/simple; bh=peBMTIxJ8PeJnaZhWmscp4QjmId7ovHEgIso7OlkGtU=; h=Date:Mime-Version:Message-ID:Subject:From:To:Cc:Content-Type; b=TekkJtF3j+8hKxAmG8k/MjgctqQThjH2P2mhpKwfOtfYmf/M6psKWN8DFhqfa/xX0uryXdqVul9CPu17olkruOkPrrAFITt6TxzggRFJdO3rGmTmLhEygMH/EDde7j9EFaWpU9hyZaMabZkyz6dqwos7vlA9nOgRKT8emu/WRE0= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com; spf=pass smtp.mailfrom=flex--ardb.bounces.google.com; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b=axojX3bD; arc=none smtp.client-ip=209.85.128.73 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=flex--ardb.bounces.google.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="axojX3bD" Received: by mail-wm1-f73.google.com with SMTP id 5b1f17b1804b1-490ace40f13so9442105e9.3 for ; Fri, 19 Jun 2026 09:40:19 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20251104; t=1781887218; x=1782492018; darn=vger.kernel.org; h=cc:to:from:subject:message-id:mime-version:date:from:to:cc:subject :date:message-id:reply-to; bh=/fDThUXERwUUEs/z9ucajXv7UAnqFyxEUTJ+qPyvpvk=; b=axojX3bDIQ7cFj1/rS3tmsky+k0ZUcocsiBnyz8ISmFWXAbaCiqZ2Ta925wewhrU2E a6Dys+Rc7YsHfWtHukfpEnE3HIFQ2V8guUfqujvzG3WjTJ9xnz/5PozfHmDMNei69FsP muD7S5g16YQAPGL/YIwNtP2/u6Y0f/NIe86Dj73HIrWNsT50Q/fctYpJzxvtCYyuayLu EAI7N97wcZ+qxxRmdK2Tyn9CyXTI9J57S6K0ze+nz7T4X/rXFzK0mML1svB9PFJbnUPx zSWrbTZKMsizqKFI3h0KizrWJ0GaZJMnQ8ZMMDOxEVt3sBbUdyidt7uwuduBDJgWTspe qz6g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1781887218; x=1782492018; h=cc:to:from:subject:message-id:mime-version:date:x-gm-message-state :from:to:cc:subject:date:message-id:reply-to; bh=/fDThUXERwUUEs/z9ucajXv7UAnqFyxEUTJ+qPyvpvk=; b=oFMkInOkSjGnn0vfIuK0CKSkkKwsDC3JTftHsrvlyBsFp2UP/QDEZvozn3aoLZrPdp YR6XEScpD0h1BgaaQucwr9TE0h9HCLHOdpw1a56Iwr7TW7iXU928TVnZuzAhZ4pRK988 P4wvbvfn1g6k5ntwRW19hl15wZG9kRvP/tv0YaDmvRlrz4JZv87D1CuJotZXoFrGkMI0 HKUjct9JvwrQrfbPolfJRbb0CxdDkjph6k1TVY0gAfB+oETk1O6q21eHBjpZyVhyM/QE Qs1TaiBYk/xtnoItzPpiiZ+9wskyLUQjRBDnr3g5h+36GYgaXfj/Het/D7gTe4O8qGaS MtcA== X-Gm-Message-State: AOJu0Yxy6G9lrWz+uCM1v5G+Ry7UA32nj8jGZGAbb+xxDaFgKpFoV/2a L6ZuS0OCiXqvsWZCZdWRQu4caMKJPvvYZWzsl9cLYYiGR8t6LmLU6hLESu5i5gCI/2I4slBU6g= = X-Received: from wmbiw8.prod.google.com ([2002:a05:600c:54c8:b0:48f:de4f:a90]) (user=ardb job=prod-delivery.src-stubby-dispatcher) by 2002:a05:600c:8b21:b0:490:bd66:e523 with SMTP id 5b1f17b1804b1-4923f5721d3mr84433615e9.20.1781887217523; Fri, 19 Jun 2026 09:40:17 -0700 (PDT) Date: Fri, 19 Jun 2026 18:39:41 +0200 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 X-Developer-Key: i=ardb@kernel.org; a=openpgp; fpr=F43D03328115A198C90016883D200E9CA6329909 X-Developer-Signature: v=1; a=openpgp-sha256; l=2051; i=ardb@kernel.org; h=from:subject; bh=FiCLQUGsKnSPIAZDP2PiOA1tidCSE9QccB+wefg2gW0=; b=owGbwMvMwCVmkMcZplerG8N4Wi2JIcu04KxD+RSxUHeV+d9vrZH98iZmT4NDZ8rTTuYd5ht1T wuqvVToKGVhEONikBVTZBGY/ffdztMTpWqdZ8nCzGFlAhnCwMUpABP5sYGR4Xdd39bnqz4zR3Jf PDA1r/CE3uEnmgKp/CL5mf7yV4TX8TL899aL8+PcZXatfqLm3JMKa99+r5r6aJZn2fVyj50Lv1u JswAA X-Mailer: git-send-email 2.55.0.rc0.738.g0c8ab3ebcc-goog Message-ID: <20260619163940.3185308-2-ardb+git@google.com> Subject: [PATCH] arm64: mm: Defer read-only remap of data/bss linear alias From: Ard Biesheuvel To: linux-arm-kernel@lists.infradead.org Cc: linux-kernel@vger.kernel.org, catalin.marinas@arm.com, will@kernel.org, Ard Biesheuvel , Fuad Tabba Content-Type: text/plain; charset="UTF-8" From: Ard Biesheuvel Fuad reports that in some cases, the KVM init code may apply relocations to variables that reside in .data, and does so via the linear map. This means that remapping .data read-only beforehand is a bad idea, and results in an early boot crash. These variables in .data are only present when CONFIG_NVHE_EL2_DEBUG or CONFIG_NVHE_EL2_TRACING are enabled, which is why it was not spotted in testing. So move the remap to mark_rodata_ro(), which is a reasonable place to put this, and ensures that it happens much later during the boot. It also means that rodata=off is now taken into account, and so the linear alias will remain writable in that case. Cc: Fuad Tabba Fixes: f2ba877402e5 ("arm64: mm: Map the kernel data/bss read-only in the linear map") Signed-off-by: Ard Biesheuvel --- arch/arm64/mm/mmu.c | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) diff --git a/arch/arm64/mm/mmu.c b/arch/arm64/mm/mmu.c index 9f354971b7e4..1f7eca86b5c1 100644 --- a/arch/arm64/mm/mmu.c +++ b/arch/arm64/mm/mmu.c @@ -1198,11 +1198,6 @@ static void __init map_mem(void) __map_memblock(start, end, pgprot_tagged(PAGE_KERNEL), flags); } - - /* Map the kernel data/bss read-only in the linear map */ - __map_memblock(init_end, kernel_end, PAGE_KERNEL_RO, flags); - flush_tlb_kernel_range((unsigned long)lm_alias(__init_end), - (unsigned long)lm_alias(__bss_stop)); } void mark_rodata_ro(void) @@ -1221,6 +1216,12 @@ void mark_rodata_ro(void) update_mapping_prot(__pa_symbol(_text), (unsigned long)_text, (unsigned long)_stext - (unsigned long)_text, PAGE_KERNEL_RO); + + /* Map the kernel data/bss read-only in the linear map */ + update_mapping_prot(__pa_symbol(__init_end), + (unsigned long)lm_alias(__init_end), + (unsigned long)__bss_stop - (unsigned long)__init_end, + PAGE_KERNEL_RO); } static void __init declare_vma(struct vm_struct *vma, -- 2.55.0.rc0.738.g0c8ab3ebcc-goog