linux-arm-kernel.lists.infradead.org archive mirror
 help / color / mirror / Atom feed
From: linux@arm.linux.org.uk (Russell King - ARM Linux)
To: linux-arm-kernel@lists.infradead.org
Subject: [PATCH v2] ARM: mm: flip priority of CONFIG_DEBUG_RODATA
Date: Wed, 23 Dec 2015 20:15:29 +0000	[thread overview]
Message-ID: <20151223201529.GX8644@n2100.arm.linux.org.uk> (raw)
In-Reply-To: <20151202202725.GA794@www.outflux.net>

On Wed, Dec 02, 2015 at 12:27:25PM -0800, Kees Cook wrote:
> The use of CONFIG_DEBUG_RODATA is generally seen as an essential part of
> kernel self-protection:
> http://www.openwall.com/lists/kernel-hardening/2015/11/30/13
> Additionally, its name has grown to mean things beyond just rodata. To
> get ARM closer to this, we ought to rearrange the names of the configs
> that control how the kernel protects its memory. What was called
> CONFIG_ARM_KERNMEM_PERMS is really doing the work that other architectures
> call CONFIG_DEBUG_RODATA.

Kees,

There is a subtle problem with the kernel memory permissions and the
DMA debugging.

DMA debugging checks whether we're trying to do DMA from the kernel
mappings (text, rodata, data etc).  It checks _text.._etext.  However,
when RODATA is enabled, we have about one section between _text and
_stext which are freed into the kernel's page pool, and then become
available for allocation and use for DMA.

This then causes the DMA debugging sanity check to fire.

So, I think I'll revert this change for the time being as it seems to
be causing many people problems, and having this enabled is creating
extra warnings when kernel debug options are enabled along with it.

Sorry.

-- 
RMK's Patch system: http://www.arm.linux.org.uk/developer/patches/
FTTC broadband for 0.8mile line: currently at 9.6Mbps down 400kbps up
according to speedtest.net.

  parent reply	other threads:[~2015-12-23 20:15 UTC|newest]

Thread overview: 17+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2015-12-02 20:27 [PATCH v2] ARM: mm: flip priority of CONFIG_DEBUG_RODATA Kees Cook
2015-12-03  0:05 ` Laura Abbott
2015-12-22 10:37 ` Geert Uytterhoeven
2015-12-23  0:36   ` Laura Abbott
2015-12-23 19:51 ` Tony Lindgren
2015-12-23 20:01   ` Russell King - ARM Linux
2015-12-23 20:18     ` Tony Lindgren
2015-12-23 20:31   ` Laura Abbott
2015-12-23 21:29     ` Tony Lindgren
2015-12-23 21:45       ` Nicolas Pitre
2015-12-24  0:11         ` Tony Lindgren
2015-12-24  0:34           ` Russell King - ARM Linux
2016-01-04 20:34             ` Kees Cook
2016-01-04 22:07               ` Russell King - ARM Linux
2016-02-05 21:48                 ` Kees Cook
2015-12-23 20:15 ` Russell King - ARM Linux [this message]
2015-12-23 21:26   ` Laura Abbott

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20151223201529.GX8644@n2100.arm.linux.org.uk \
    --to=linux@arm.linux.org.uk \
    --cc=linux-arm-kernel@lists.infradead.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).