Re: [RFC][PATCH] s390, postinit-readonly: implement post-init RO

[Heiko Carstens <heiko.carstens@de.ibm.com>]

On Tue, Mar 08, 2016 at 09:51:05AM +0100, Christian Borntraeger wrote:
> On 03/08/2016 01:41 AM, Kees Cook wrote:
> 
> >> --- a/arch/s390/kernel/vmlinux.lds.S
> >> +++ b/arch/s390/kernel/vmlinux.lds.S
> >> @@ -52,6 +52,12 @@ SECTIONS
> >>
> >>         RW_DATA_SECTION(0x100, PAGE_SIZE, THREAD_SIZE)
> >>
> >> +       . = ALIGN(PAGE_SIZE)
> 
> 
> missing ";" ?
> 
> 
> With that  and your fixes, this function claims to mark 0kB and 
> lkdtm can still write. Reason is that _edata is 0xc11008 and start is
> 0x0c11000.
> 
> making _edata page aligned as well, does now try to mark one page, but then
> we run into the next issue, that 
> 
> static void change_page_attr(unsigned long addr, int numpages,
>                              pte_t (*set) (pte_t))
> {
>         pte_t *ptep;
>         int i;
> 
>         for (i = 0; i < numpages; i++) {
>                 ptep = walk_page_table(addr);
> 
> triggers this
>                 if (WARN_ON_ONCE(!ptep))
>                         break;
> 
> because the kernel decided to map this with a large page. So we need
> to fix this function to then break the large page into a smaller chunk....

Yes... however that's a rather large change. I'll try to come up with a
patch that has less impact and implement the code that splits the kernel
mapping later.
Looking at our vmemmap code makes me realize that this code needs also to
be improved.