From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id C71CCC433EF for ; Mon, 13 Jun 2022 23:39:48 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender: Content-Transfer-Encoding:Content-Type:List-Subscribe:List-Help:List-Post: List-Archive:List-Unsubscribe:List-Id:In-Reply-To:MIME-Version:References: Message-ID:Subject:Cc:To:From:Date:Reply-To:Content-ID:Content-Description: Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID: List-Owner; bh=J6VC73CR5fkX8IrfzJw5wRabgytucvQ9II+BC5WRUh4=; b=X2IJpCE4Q16UVs 8LnHytV5IooPp2y4Z12za2KUftIaBLdcPldvih8L2nA3L9/G2JAA3YZUu1LlJ4WXgFYn//FtyTFX3 DWEk1KZPkF5EQsAivG7OXgmx5Ru0JOclb4trGdkHsjKI9lRfhvsaJ8Svp4+FNDk4NPaNAOQDyQnW+ ZNdCYDkqNjDGx3QEY9rKaRQ6jHqfYR/upLyblEItoKRl93O4bj1EGdx+dM1uEoPE76z3BQ1W35MWU F4Bzn7PFDBAKfEJ7JEvCbaPGX1tXPDIKq7g6ELFwiVBZPFkQIlAccJR7nudTEXazBeCry/8Kt/PZR lkYsMt4tjtHXcRSXPq0A==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.94.2 #2 (Red Hat Linux)) id 1o0tdM-006J5i-Ad; Mon, 13 Jun 2022 23:38:12 +0000 Received: from mail-pj1-x102b.google.com ([2607:f8b0:4864:20::102b]) by bombadil.infradead.org with esmtps (Exim 4.94.2 #2 (Red Hat Linux)) id 1o0tdJ-006J4j-5h for linux-arm-kernel@lists.infradead.org; Mon, 13 Jun 2022 23:38:10 +0000 Received: by mail-pj1-x102b.google.com with SMTP id gc3-20020a17090b310300b001e33092c737so7488190pjb.3 for ; Mon, 13 Jun 2022 16:38:08 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; h=date:from:to:cc:subject:message-id:references:mime-version :content-disposition:in-reply-to; bh=yYnPEs+7/EXNKs1SsvGN2RDxQEUA+G2bdjO5VBujtGw=; b=S7zd2SJb98eiuS1hTdsLGxZdBfKOAjfqKZDpEP25H9fmqxQ4rH4DVMb5nxf82fJ6e4 1I6NmI5I0mMvvSSfdcp9nCgNyzfbAxCVgoBFIvIp/g+v7yI/TMjcjDRg1nqEU+U66dWX B5GIIxBluY3wvR9xHtnc5LMyerTTGJHrN46Ao= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:date:from:to:cc:subject:message-id:references :mime-version:content-disposition:in-reply-to; bh=yYnPEs+7/EXNKs1SsvGN2RDxQEUA+G2bdjO5VBujtGw=; b=gO7vA0+0APFapTuJN5rIdL0ky3OMOIIpg+yh05voro7+Svq0sZoTg3MwS/Kjs4x2Q7 iI8H2dbCZtHHoUEDH1cXA7rt4ohJpGxtRYf2IusD2uEiizzVhMpWexqLe0T77VuqcDdz nWG18y/qv4QHrKR5eh5jKQyCnV8o0b7gIvf5TN6SQQO57ys3sQuugU59NlbofmXPfNjA 5sqci+3TDzdg6Xdk8GOge4YuTQNUgcOJ3tyyuBS/e062s4u67QvZZ1CMcrJlzOExOXcG 89SzdInz0VdeZjl3Mp25jHzLhwy4HE3CwSKz5rCOFhox/zMXtWuW9kndWvZsk4vccFqt adLA== X-Gm-Message-State: AJIora/Ad/KTI3vmwKltLyCo8GARQQA0kGd6h7JptIXP6cZwLB/rOexM LV1v2HjjQ5Vhlbw0WUJPiFRfqg== X-Google-Smtp-Source: AGRyM1swu2ld1DxnRxMPl8aaTtMdbFsCt/DFNKG1CKXGkaGwR9A6TVWvwkIY+y+u84XhPfalzpKLiw== X-Received: by 2002:a17:90b:4f81:b0:1e8:84b0:6aaf with SMTP id qe1-20020a17090b4f8100b001e884b06aafmr1278603pjb.66.1655163487586; Mon, 13 Jun 2022 16:38:07 -0700 (PDT) Received: from www.outflux.net (smtp.outflux.net. [198.145.64.163]) by smtp.gmail.com with ESMTPSA id p16-20020a056a000a1000b0050dc76281b4sm6196710pfh.142.2022.06.13.16.38.07 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 13 Jun 2022 16:38:07 -0700 (PDT) Date: Mon, 13 Jun 2022 16:38:06 -0700 From: Kees Cook To: Ard Biesheuvel Cc: linux-arm-kernel@lists.infradead.org, linux-hardening@vger.kernel.org, Marc Zyngier , Will Deacon , Mark Rutland , Catalin Marinas , Mark Brown , Anshuman Khandual Subject: Re: [PATCH v4 22/26] arm64: mm: move ro_after_init section into the data segment Message-ID: <202206131630.B6AE6ECEA3@keescook> References: <20220613144550.3760857-1-ardb@kernel.org> <20220613144550.3760857-23-ardb@kernel.org> <202206130959.3C01F529@keescook> MIME-Version: 1.0 Content-Disposition: inline In-Reply-To: X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20220613_163809_297397_77E74DA1 X-CRM114-Status: GOOD ( 19.51 ) X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+linux-arm-kernel=archiver.kernel.org@lists.infradead.org On Mon, Jun 13, 2022 at 07:16:15PM +0200, Ard Biesheuvel wrote: > On Mon, 13 Jun 2022 at 19:00, Kees Cook wrote: > > > > On Mon, Jun 13, 2022 at 04:45:46PM +0200, Ard Biesheuvel wrote: > > > Currently, the ro_after_init sections sits right in the middle of the > > > text/rodata/inittext segment, making it difficult to map any of those > > > non-writable during early boot. So instead, move it to the start of > > > .data, and update the init sequences so that the section is remapped > > > read-only once startup completes. > > > > > > Note that this moves the entire HYP data section into .data as well - > > > this likely needs to remain as a single block for now, but could perhaps > > > split into a .rodata and .data..ro_after_init section later. > > > > If I'm reading this correctly, this means that .data..ro_after_init now > > lives between .data and .rodata? > > > > No, between .initdata and .data Ah, doesn't this mean more padding (for segment alignment) used? On other architectures .data..ro_after_init tried to be near the writable/read-only boundary so segment padding was only needed on one side (e.g. it could live at the end of .rodata without segment alignment but before .data which was segment aligned.) Then when .rodata was made read-only (after __init), .data..ro_after_init would also get set read-only. In this case, I think it ends up needing segment alignment both at the front and the end, since the .initdata and .data are freed and left writable, respectively? -- Kees Cook _______________________________________________ linux-arm-kernel mailing list linux-arm-kernel@lists.infradead.org http://lists.infradead.org/mailman/listinfo/linux-arm-kernel