diff --git a/xen/test/livepatch/Makefile b/xen/test/livepatch/Makefile
index d987a8367f..4caa9e2432 100644
--- a/xen/test/livepatch/Makefile
+++ b/xen/test/livepatch/Makefile
@@ -142,7 +142,10 @@ xen_expectations_fail-objs := xen_expectations_fail.o xen_hello_world_func.o not
 
 
 quiet_cmd_livepatch = LD      $@
-cmd_livepatch = $(LD) $(XEN_LDFLAGS) $(build_id_linker) -r -o $@ $(real-prereqs)
+define cmd_livepatch
+    $(LD) $(XEN_LDFLAGS) $(build_id_linker) -r -o $@ $(real-prereqs); \
+    $(OBJCOPY) --set-section-flags ".livepatch.funcs=alloc,readonly" $@
+endef
 
 $(obj)/%.livepatch: FORCE
 	$(call if_changed,livepatch)
diff --git a/xen/test/livepatch/xen_action_hooks.c b/xen/test/livepatch/xen_action_hooks.c
index fa0b3ab35f..30c2c5de3c 100644
--- a/xen/test/livepatch/xen_action_hooks.c
+++ b/xen/test/livepatch/xen_action_hooks.c
@@ -84,7 +84,8 @@ LIVEPATCH_REVERT_HOOK(revert_hook);
 
 LIVEPATCH_POSTREVERT_HOOK(post_revert_hook);
 
-struct livepatch_func __section(".livepatch.funcs") livepatch_xen_hello_world = {
+const struct livepatch_func __section(".livepatch.funcs")
+livepatch_xen_hello_world = {
     .version = LIVEPATCH_PAYLOAD_VERSION,
     .name = hello_world_patch_this_fnc,
     .new_addr = xen_hello_world,
diff --git a/xen/test/livepatch/xen_action_hooks_marker.c b/xen/test/livepatch/xen_action_hooks_marker.c
index d2e22f70d1..eb31a4abc4 100644
--- a/xen/test/livepatch/xen_action_hooks_marker.c
+++ b/xen/test/livepatch/xen_action_hooks_marker.c
@@ -96,7 +96,8 @@ LIVEPATCH_POSTAPPLY_HOOK(post_apply_hook);
 LIVEPATCH_PREREVERT_HOOK(pre_revert_hook);
 LIVEPATCH_POSTREVERT_HOOK(post_revert_hook);
 
-struct livepatch_func __section(".livepatch.funcs") livepatch_xen_hello_world = {
+const struct livepatch_func __section(".livepatch.funcs")
+livepatch_xen_hello_world = {
     .version = LIVEPATCH_PAYLOAD_VERSION,
     .name = hello_world_patch_this_fnc,
     .new_addr = xen_hello_world,
diff --git a/xen/test/livepatch/xen_action_hooks_noapply.c b/xen/test/livepatch/xen_action_hooks_noapply.c
index 646a5fd2f0..92d10d53ff 100644
--- a/xen/test/livepatch/xen_action_hooks_noapply.c
+++ b/xen/test/livepatch/xen_action_hooks_noapply.c
@@ -120,7 +120,8 @@ LIVEPATCH_POSTAPPLY_HOOK(post_apply_hook);
 LIVEPATCH_PREREVERT_HOOK(pre_revert_hook);
 LIVEPATCH_POSTREVERT_HOOK(post_revert_hook);
 
-struct livepatch_func __section(".livepatch.funcs") livepatch_xen_hello_world = {
+const struct livepatch_func __section(".livepatch.funcs")
+livepatch_xen_hello_world = {
     .version = LIVEPATCH_PAYLOAD_VERSION,
     .name = hello_world_patch_this_fnc,
     .new_addr = xen_hello_world,
diff --git a/xen/test/livepatch/xen_action_hooks_norevert.c b/xen/test/livepatch/xen_action_hooks_norevert.c
index c5fbab1746..fc2d33b531 100644
--- a/xen/test/livepatch/xen_action_hooks_norevert.c
+++ b/xen/test/livepatch/xen_action_hooks_norevert.c
@@ -115,7 +115,8 @@ LIVEPATCH_POSTAPPLY_HOOK(post_apply_hook);
 LIVEPATCH_PREREVERT_HOOK(pre_revert_hook);
 LIVEPATCH_POSTREVERT_HOOK(post_revert_hook);
 
-struct livepatch_func __section(".livepatch.funcs") livepatch_xen_hello_world = {
+const struct livepatch_func __section(".livepatch.funcs")
+livepatch_xen_hello_world = {
     .version = LIVEPATCH_PAYLOAD_VERSION,
     .name = hello_world_patch_this_fnc,
     .new_addr = xen_hello_world,
diff --git a/xen/test/livepatch/xen_bye_world.c b/xen/test/livepatch/xen_bye_world.c
index 2700f0eedd..86589205d8 100644
--- a/xen/test/livepatch/xen_bye_world.c
+++ b/xen/test/livepatch/xen_bye_world.c
@@ -14,7 +14,8 @@
 static const char bye_world_patch_this_fnc[] = "xen_extra_version";
 extern const char *xen_bye_world(void);
 
-struct livepatch_func __section(".livepatch.funcs") livepatch_xen_bye_world = {
+const struct livepatch_func __section(".livepatch.funcs")
+livepatch_xen_bye_world = {
     .version = LIVEPATCH_PAYLOAD_VERSION,
     .name = bye_world_patch_this_fnc,
     .new_addr = xen_bye_world,
diff --git a/xen/test/livepatch/xen_expectations.c b/xen/test/livepatch/xen_expectations.c
index c8175a458b..06c752c818 100644
--- a/xen/test/livepatch/xen_expectations.c
+++ b/xen/test/livepatch/xen_expectations.c
@@ -15,7 +15,8 @@
 static const char livepatch_exceptions_str[] = "xen_extra_version";
 extern const char *xen_hello_world(void);
 
-struct livepatch_func __section(".livepatch.funcs") livepatch_exceptions = {
+const struct livepatch_func __section(".livepatch.funcs")
+livepatch_exceptions = {
     .version = LIVEPATCH_PAYLOAD_VERSION,
     .name = livepatch_exceptions_str,
     .new_addr = xen_hello_world,
diff --git a/xen/test/livepatch/xen_expectations_fail.c b/xen/test/livepatch/xen_expectations_fail.c
index 36a110286f..f42c19a953 100644
--- a/xen/test/livepatch/xen_expectations_fail.c
+++ b/xen/test/livepatch/xen_expectations_fail.c
@@ -16,7 +16,8 @@ extern const char *xen_hello_world(void);
 
 #define EXPECT_BYTES_COUNT 6
 
-struct livepatch_func __section(".livepatch.funcs") livepatch_exceptions = {
+const struct livepatch_func __section(".livepatch.funcs")
+livepatch_exceptions = {
     .version = LIVEPATCH_PAYLOAD_VERSION,
     .name = livepatch_exceptions_str,
     .new_addr = xen_hello_world,
diff --git a/xen/test/livepatch/xen_hello_world.c b/xen/test/livepatch/xen_hello_world.c
index 02f3f85dc0..08ab2f197e 100644
--- a/xen/test/livepatch/xen_hello_world.c
+++ b/xen/test/livepatch/xen_hello_world.c
@@ -47,7 +47,8 @@ LIVEPATCH_UNLOAD_HOOK(hi_func);
 
 LIVEPATCH_UNLOAD_HOOK(check_fnc);
 
-struct livepatch_func __section(".livepatch.funcs") livepatch_xen_hello_world = {
+const struct livepatch_func __section(".livepatch.funcs")
+livepatch_xen_hello_world = {
     .version = LIVEPATCH_PAYLOAD_VERSION,
     .name = hello_world_patch_this_fnc,
     .new_addr = xen_hello_world,
diff --git a/xen/test/livepatch/xen_nop.c b/xen/test/livepatch/xen_nop.c
index a224b7c670..6dea657365 100644
--- a/xen/test/livepatch/xen_nop.c
+++ b/xen/test/livepatch/xen_nop.c
@@ -14,7 +14,7 @@
  * running this test-case you MUST verify that the assumptions are
  * correct (Hint: make debug and look in xen.s).
  */
-struct livepatch_func __section(".livepatch.funcs") livepatch_nop = {
+const struct livepatch_func __section(".livepatch.funcs") livepatch_nop = {
     .version = LIVEPATCH_PAYLOAD_VERSION,
     .old_size = MINOR_VERSION_SZ,
 
diff --git a/xen/test/livepatch/xen_prepost_hooks.c b/xen/test/livepatch/xen_prepost_hooks.c
index 17f5af6a19..00b0b3abb0 100644
--- a/xen/test/livepatch/xen_prepost_hooks.c
+++ b/xen/test/livepatch/xen_prepost_hooks.c
@@ -102,7 +102,8 @@ LIVEPATCH_POSTAPPLY_HOOK(post_apply_hook);
 LIVEPATCH_PREREVERT_HOOK(pre_revert_hook);
 LIVEPATCH_POSTREVERT_HOOK(post_revert_hook);
 
-struct livepatch_func __section(".livepatch.funcs") livepatch_xen_hello_world = {
+const struct livepatch_func __section(".livepatch.funcs")
+livepatch_xen_hello_world = {
     .version = LIVEPATCH_PAYLOAD_VERSION,
     .name = hello_world_patch_this_fnc,
     .new_addr = xen_hello_world,
diff --git a/xen/test/livepatch/xen_prepost_hooks_fail.c b/xen/test/livepatch/xen_prepost_hooks_fail.c
index 52fd7f642e..8497715646 100644
--- a/xen/test/livepatch/xen_prepost_hooks_fail.c
+++ b/xen/test/livepatch/xen_prepost_hooks_fail.c
@@ -55,7 +55,8 @@ LIVEPATCH_POSTAPPLY_HOOK(unreachable_post_hook);
 LIVEPATCH_PREREVERT_HOOK(unreachable_pre_hook);
 LIVEPATCH_POSTREVERT_HOOK(unreachable_post_hook);
 
-struct livepatch_func __section(".livepatch.funcs") livepatch_xen_hello_world = {
+const struct livepatch_func __section(".livepatch.funcs")
+livepatch_xen_hello_world = {
     .version = LIVEPATCH_PAYLOAD_VERSION,
     .name = hello_world_patch_this_fnc,
     .new_addr = xen_hello_world,
diff --git a/xen/test/livepatch/xen_replace_world.c b/xen/test/livepatch/xen_replace_world.c
index 78a8f528b3..272cc55e82 100644
--- a/xen/test/livepatch/xen_replace_world.c
+++ b/xen/test/livepatch/xen_replace_world.c
@@ -13,7 +13,8 @@
 static const char xen_replace_world_name[] = "xen_extra_version";
 extern const char *xen_replace_world(void);
 
-struct livepatch_func __section(".livepatch.funcs") livepatch_xen_replace_world = {
+const struct livepatch_func __section(".livepatch.funcs")
+livepatch_xen_replace_world = {
     .version = LIVEPATCH_PAYLOAD_VERSION,
     .name = xen_replace_world_name,
     .old_addr = 0, /* Forces the hypervisor to lookup .name */