From mboxrd@z Thu Jan 1 00:00:00 1970 From: David Brown Subject: [PATCH] arm64: make CONFIG_DEBUG_RODATA non-optional Date: Wed, 27 Jan 2016 17:09:06 -0700 Message-ID: <20160128000906.GA42530@davidb.org> References: <1453226922-16831-1-git-send-email-keescook@chromium.org> <1453226922-16831-4-git-send-email-keescook@chromium.org> <20160127211105.GA41450@davidb.org> Reply-To: kernel-hardening@lists.openwall.com Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii; format=flowed Return-path: List-Post: List-Help: List-Unsubscribe: List-Subscribe: Content-Disposition: inline In-Reply-To: To: Kees Cook Cc: "kernel-hardening@lists.openwall.com" , Ingo Molnar , Andy Lutomirski , "H. Peter Anvin" , Michael Ellerman , Mathias Krause , Thomas Gleixner , "x86@kernel.org" , Arnd Bergmann , PaX Team , Emese Revfy , LKML , linux-arch , Catalin Marinas , Will Deacon , Marc Zyngier , yalin wang , Zi Shen Lim , Yang Shi , Mark Rutland , Ard Biesheuvel , Laura Abbott , "Suzuki K. Poulose" List-Id: linux-arch.vger.kernel.org >From 2efef8aa0f8f7f6277ffebe4ea6744fc93d54644 Mon Sep 17 00:00:00 2001 From: David Brown Date: Wed, 27 Jan 2016 13:58:44 -0800 This removes the CONFIG_DEBUG_RODATA option and makes it always enabled. Signed-off-by: David Brown --- v1: This is in the same spirit as the x86 patch, removing allowing this option to be config selected. The associated patch series adds a runtime option for the same thing. However, it does affect the way some things are mapped, and could possibly result in either increased memory usage, or a performance hit (due to TLB misses from 4K pages). I've tested this on a Hikey 96board (hi6220-hikey.dtb), both with and without 'rodata=off' on the command line. arch/arm64/Kconfig | 3 +++ arch/arm64/Kconfig.debug | 10 ---------- arch/arm64/kernel/insn.c | 2 +- arch/arm64/kernel/vmlinux.lds.S | 5 +---- arch/arm64/mm/mmu.c | 12 ------------ 5 files changed, 5 insertions(+), 27 deletions(-) diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig index 8cc6228..ffa617a 100644 --- a/arch/arm64/Kconfig +++ b/arch/arm64/Kconfig @@ -201,6 +201,9 @@ config KERNEL_MODE_NEON config FIX_EARLYCON_MEM def_bool y +config DEBUG_RODATA + def_bool y + config PGTABLE_LEVELS int default 2 if ARM64_16K_PAGES && ARM64_VA_BITS_36 diff --git a/arch/arm64/Kconfig.debug b/arch/arm64/Kconfig.debug index e13c4bf..db994ec 100644 --- a/arch/arm64/Kconfig.debug +++ b/arch/arm64/Kconfig.debug @@ -48,16 +48,6 @@ config DEBUG_SET_MODULE_RONX against certain classes of kernel exploits. If in doubt, say "N". -config DEBUG_RODATA - bool "Make kernel text and rodata read-only" - help - If this is set, kernel text and rodata will be made read-only. This - is to help catch accidental or malicious attempts to change the - kernel's executable code. Additionally splits rodata from kernel - text so it can be made explicitly non-executable. - - If in doubt, say Y - config DEBUG_ALIGN_RODATA depends on DEBUG_RODATA && ARM64_4K_PAGES bool "Align linker sections up to SECTION_SIZE" diff --git a/arch/arm64/kernel/insn.c b/arch/arm64/kernel/insn.c index 7371455..a04bdef 100644 --- a/arch/arm64/kernel/insn.c +++ b/arch/arm64/kernel/insn.c @@ -95,7 +95,7 @@ static void __kprobes *patch_map(void *addr, int fixmap) if (module && IS_ENABLED(CONFIG_DEBUG_SET_MODULE_RONX)) page = vmalloc_to_page(addr); - else if (!module && IS_ENABLED(CONFIG_DEBUG_RODATA)) + else if (!module) page = virt_to_page(addr); else return addr; diff --git a/arch/arm64/kernel/vmlinux.lds.S b/arch/arm64/kernel/vmlinux.lds.S index e3928f5..f80903c 100644 --- a/arch/arm64/kernel/vmlinux.lds.S +++ b/arch/arm64/kernel/vmlinux.lds.S @@ -65,12 +65,9 @@ PECOFF_FILE_ALIGNMENT = 0x200; #if defined(CONFIG_DEBUG_ALIGN_RODATA) #define ALIGN_DEBUG_RO . = ALIGN(1< Received: from mail-oi0-f54.google.com ([209.85.218.54]:34252 "EHLO mail-oi0-f54.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S934227AbcA1AIv (ORCPT ); Wed, 27 Jan 2016 19:08:51 -0500 Received: by mail-oi0-f54.google.com with SMTP id k206so16697293oia.1 for ; Wed, 27 Jan 2016 16:08:51 -0800 (PST) Date: Wed, 27 Jan 2016 17:09:06 -0700 From: David Brown Subject: [PATCH] arm64: make CONFIG_DEBUG_RODATA non-optional Message-ID: <20160128000906.GA42530@davidb.org> References: <1453226922-16831-1-git-send-email-keescook@chromium.org> <1453226922-16831-4-git-send-email-keescook@chromium.org> <20160127211105.GA41450@davidb.org> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii; format=flowed Content-Disposition: inline In-Reply-To: Sender: linux-arch-owner@vger.kernel.org List-ID: To: Kees Cook Cc: "kernel-hardening@lists.openwall.com" , Ingo Molnar , Andy Lutomirski , "H. Peter Anvin" , Michael Ellerman , Mathias Krause , Thomas Gleixner , "x86@kernel.org" , Arnd Bergmann , PaX Team , Emese Revfy , LKML , linux-arch , Catalin Marinas , Will Deacon , Marc Zyngier , yalin wang , Zi Shen Lim , Yang Shi , Mark Rutland , Ard Biesheuvel , Laura Abbott , "Suzuki K. Poulose" , Steve Capper , Jeremy Linton , Mark Salter , linux-arm-kernel@lists.infradead.org Message-ID: <20160128000906.JCHyv-YbR3tZbIaijaw7D_xFQiAqHdmhvxapJJrQ3lw@z>