[PATCH v7 0/2] arm64: refactor the rodata=xxx

[PATCH v7 0/2] arm64: refactor the rodata=xxx

[Huang Shijie]

From Documentation/admin-guide/kernel-parameters.txt, we know that:
 rodata=	[KNL,EARLY]
	on	Mark read-only kernel memory as read-only (default).
	off	Leave read-only kernel memory writable for debugging.
	full	Mark read-only kernel memory and aliases as read-only
		[arm64]

So the "rodata=on" is the default.

But the current code does not follow the document, it makes "rodata=full"
as the default.

This patch set follows Anshuman Khandual's suggetions.
It makes the "rodata=on" as the default, and removes the CONFIG_RODATA_FULL_DEFAULT_ENABLED.

v7:
  Change the code by following Will's suggestions.
  
v6:
  Fix a small issue pointed by Randy Dunlap.
  https://lists.infradead.org/pipermail/linux-arm-kernel/2025-July/1041488.html
  
v5:
  Rebase this patch set with linux-next20250627
  https://lists.infradead.org/pipermail/linux-arm-kernel/2025-June/1040297.html

v4:
  Follows Anshuman Khandual/Ard Biesheuvel's suggetions:
  - Change commit message format.
  - Change the titile name.
  - others
  https://lists.infradead.org/pipermail/linux-arm-kernel/2024-December/985629.html

v3:
  Follows Anshuman Khandual's suggetions:
  - Merge patch 1 and patch 3 into one patch.
  - Remove patch 4
  - update comments and document.
   https://lists.infradead.org/pipermail/linux-arm-kernel/2024-December/984344.html

v2:
  Follows Will's suggetions.
  Add a new file fine-tuning-tips.rst for the expert users.
   https://lists.infradead.org/pipermail/linux-arm-kernel/2024-November/981190.html

v1:
   https://lists.infradead.org/pipermail/linux-arm-kernel/2024-October/971415.html


Huang Shijie (2):
  arm64: refactor the rodata=xxx
  arm64/Kconfig: Remove CONFIG_RODATA_FULL_DEFAULT_ENABLED

 Documentation/admin-guide/kernel-parameters.txt |  5 +++--
 arch/arm64/Kconfig                              | 14 --------------
 arch/arm64/include/asm/setup.h                  |  4 ++--
 arch/arm64/mm/pageattr.c                        |  2 +-
 4 files changed, 6 insertions(+), 19 deletions(-)

-- 
2.40.1

[PATCH v7 1/2] arm64: refactor the rodata=xxx

[Huang Shijie]

As per admin guide documentation, "rodata=on" should be the default on
platforms. Documentation/admin-guide/kernel-parameters.txt describes
these options as

   rodata=         [KNL,EARLY]
           on      Mark read-only kernel memory as read-only (default).
           off     Leave read-only kernel memory writable for debugging.
           full    Mark read-only kernel memory and aliases as read-only
                   [arm64]

But on arm64 platform, RODATA_FULL_DEFAULT_ENABLED is enabled by default,
so "rodata=full" is the default instead.

This patch implements the following changes:
 - Make "rodata=on" behaviour same as the original "rodata=full".
   This keeps align with the x86.
 - Make "rodata=noalias" (new) behaviour same as the original "rodata=on"
 - Drop the original "rodata=full"

After this patch, the "rodata=on" will be the default on arm64 platform
as well.

Different rodata options may have different performance, so record more
detail information here:

 rodata=on (default)
    This applies read-only attributes to VM areas and to the linear
    alias of the backing pages as well. This prevents code or read-
    only data from being modified (inadvertently or intentionally),
    via another mapping for the same memory page.

    But this might cause linear map region to be mapped down to base
    pages, which may adversely affect performance in some cases.

 rodata=off
    This provides more block mappings and contiguous hints for linear
    map region which would minimize TLB footprint. This also leaves
    read-only kernel memory writable for debugging.

 rodata=noalias
    This provides more block mappings and contiguous hints for linear
    map region which would minimize TLB footprint. This leaves the linear
    alias of read-only mappings in the vmalloc space writeable, making
    them susceptible to inadvertent modification by software.

Signed-off-by: Huang Shijie <shijie@os.amperecomputing.com>
---
 Documentation/admin-guide/kernel-parameters.txt | 5 +++--
 arch/arm64/include/asm/setup.h                  | 4 ++--
 2 files changed, 5 insertions(+), 4 deletions(-)

diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt
index db84a629f7b1..138e0db5af64 100644
--- a/Documentation/admin-guide/kernel-parameters.txt
+++ b/Documentation/admin-guide/kernel-parameters.txt
@@ -6418,8 +6418,9 @@
 	rodata=		[KNL,EARLY]
 		on	Mark read-only kernel memory as read-only (default).
 		off	Leave read-only kernel memory writable for debugging.
-		full	Mark read-only kernel memory and aliases as read-only
-		        [arm64]
+		noalias	Mark read-only kernel memory as read-only but retain
+			writable aliases in the direct map for regions outside
+			of the kernel image. [arm64]
 
 	rockchip.usb_uart
 			[EARLY]
diff --git a/arch/arm64/include/asm/setup.h b/arch/arm64/include/asm/setup.h
index ba269a7a3201..3d96dde4d214 100644
--- a/arch/arm64/include/asm/setup.h
+++ b/arch/arm64/include/asm/setup.h
@@ -21,7 +21,7 @@ static inline bool arch_parse_debug_rodata(char *arg)
 	if (!arg)
 		return false;
 
-	if (!strcmp(arg, "full")) {
+	if (!strcmp(arg, "on")) {
 		rodata_enabled = rodata_full = true;
 		return true;
 	}
@@ -31,7 +31,7 @@ static inline bool arch_parse_debug_rodata(char *arg)
 		return true;
 	}
 
-	if (!strcmp(arg, "on")) {
+	if (!strcmp(arg, "noalias")) {
 		rodata_enabled = true;
 		rodata_full = false;
 		return true;
-- 
2.40.1

Re: [PATCH v7 1/2] arm64: refactor the rodata=xxx

[Anshuman Khandual]

On 09/09/25 9:02 AM, Huang Shijie wrote:
> As per admin guide documentation, "rodata=on" should be the default on
> platforms. Documentation/admin-guide/kernel-parameters.txt describes
> these options as
> 
>    rodata=         [KNL,EARLY]
>            on      Mark read-only kernel memory as read-only (default).
>            off     Leave read-only kernel memory writable for debugging.
>            full    Mark read-only kernel memory and aliases as read-only
>                    [arm64]
> 
> But on arm64 platform, RODATA_FULL_DEFAULT_ENABLED is enabled by default,
> so "rodata=full" is the default instead.
> 
> This patch implements the following changes:
>  - Make "rodata=on" behaviour same as the original "rodata=full".
>    This keeps align with the x86.
>  - Make "rodata=noalias" (new) behaviour same as the original "rodata=on"
>  - Drop the original "rodata=full"
> 
> After this patch, the "rodata=on" will be the default on arm64 platform
> as well.
> 
> Different rodata options may have different performance, so record more
> detail information here:
> 
>  rodata=on (default)
>     This applies read-only attributes to VM areas and to the linear
>     alias of the backing pages as well. This prevents code or read-
>     only data from being modified (inadvertently or intentionally),
>     via another mapping for the same memory page.
> 
>     But this might cause linear map region to be mapped down to base
>     pages, which may adversely affect performance in some cases.
> 
>  rodata=off
>     This provides more block mappings and contiguous hints for linear
>     map region which would minimize TLB footprint. This also leaves
>     read-only kernel memory writable for debugging.
> 
>  rodata=noalias
>     This provides more block mappings and contiguous hints for linear
>     map region which would minimize TLB footprint. This leaves the linear
>     alias of read-only mappings in the vmalloc space writeable, making

						typo     ^^^^^^^^
>     them susceptible to inadvertent modification by software.
> 
> Signed-off-by: Huang Shijie <shijie@os.amperecomputing.com>
> ---
>  Documentation/admin-guide/kernel-parameters.txt | 5 +++--
>  arch/arm64/include/asm/setup.h                  | 4 ++--
>  2 files changed, 5 insertions(+), 4 deletions(-)
> 
> diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt
> index db84a629f7b1..138e0db5af64 100644
> --- a/Documentation/admin-guide/kernel-parameters.txt
> +++ b/Documentation/admin-guide/kernel-parameters.txt
> @@ -6418,8 +6418,9 @@
>  	rodata=		[KNL,EARLY]
>  		on	Mark read-only kernel memory as read-only (default).
>  		off	Leave read-only kernel memory writable for debugging.
> -		full	Mark read-only kernel memory and aliases as read-only
> -		        [arm64]
> +		noalias	Mark read-only kernel memory as read-only but retain
> +			writable aliases in the direct map for regions outside
> +			of the kernel image. [arm64]

Should not the arm64 specific performance implications be mentioned
in the above documentation update as well ? But in case this appears
too much platform specific - probably do consider adding them above
or inside arch_parse_debug_rodata() as an in-code documentation. 

     rodata=on (default)
        This applies read-only attributes to VM areas and to the linear
        alias of the backing pages as well. This prevents code or read-
        only data from being modified (inadvertently or intentionally),
        via another mapping for the same memory page.

        But this might cause linear map region to be mapped down to base
        pages, which may adversely affect performance in some cases.

     rodata=off
        This provides more block mappings and contiguous hints for linear
        map region which would minimize TLB footprint. This also leaves
        read-only kernel memory writable for debugging.

     rodata=noalias
        This provides more block mappings and contiguous hints for linear
        map region which would minimize TLB footprint. This leaves the linear
        alias of read-only mappings in the vmalloc space writeable, making
        them susceptible to inadvertent modification by software.

>  
>  	rockchip.usb_uart
>  			[EARLY]
> diff --git a/arch/arm64/include/asm/setup.h b/arch/arm64/include/asm/setup.h
> index ba269a7a3201..3d96dde4d214 100644
> --- a/arch/arm64/include/asm/setup.h
> +++ b/arch/arm64/include/asm/setup.h
> @@ -21,7 +21,7 @@ static inline bool arch_parse_debug_rodata(char *arg)
>  	if (!arg)
>  		return false;
>  
> -	if (!strcmp(arg, "full")) {
> +	if (!strcmp(arg, "on")) {
>  		rodata_enabled = rodata_full = true;
>  		return true;
>  	}
> @@ -31,7 +31,7 @@ static inline bool arch_parse_debug_rodata(char *arg)
>  		return true;
>  	}
>  
> -	if (!strcmp(arg, "on")) {
> +	if (!strcmp(arg, "noalias")) {
>  		rodata_enabled = true;
>  		rodata_full = false;
>  		return true;

Re: [PATCH v7 1/2] arm64: refactor the rodata=xxx

[Shijie Huang]

On 09/09/2025 12:29, Anshuman Khandual wrote:
> On 09/09/25 9:02 AM, Huang Shijie wrote:
>> As per admin guide documentation, "rodata=on" should be the default on
>> platforms. Documentation/admin-guide/kernel-parameters.txt describes
>> these options as
>>
>>     rodata=         [KNL,EARLY]
>>             on      Mark read-only kernel memory as read-only (default).
>>             off     Leave read-only kernel memory writable for debugging.
>>             full    Mark read-only kernel memory and aliases as read-only
>>                     [arm64]
>>
>> But on arm64 platform, RODATA_FULL_DEFAULT_ENABLED is enabled by default,
>> so "rodata=full" is the default instead.
>>
>> This patch implements the following changes:
>>   - Make "rodata=on" behaviour same as the original "rodata=full".
>>     This keeps align with the x86.
>>   - Make "rodata=noalias" (new) behaviour same as the original "rodata=on"
>>   - Drop the original "rodata=full"
>>
>> After this patch, the "rodata=on" will be the default on arm64 platform
>> as well.
>>
>> Different rodata options may have different performance, so record more
>> detail information here:
>>
>>   rodata=on (default)
>>      This applies read-only attributes to VM areas and to the linear
>>      alias of the backing pages as well. This prevents code or read-
>>      only data from being modified (inadvertently or intentionally),
>>      via another mapping for the same memory page.
>>
>>      But this might cause linear map region to be mapped down to base
>>      pages, which may adversely affect performance in some cases.
>>
>>   rodata=off
>>      This provides more block mappings and contiguous hints for linear
>>      map region which would minimize TLB footprint. This also leaves
>>      read-only kernel memory writable for debugging.
>>
>>   rodata=noalias
>>      This provides more block mappings and contiguous hints for linear
>>      map region which would minimize TLB footprint. This leaves the linear
>>      alias of read-only mappings in the vmalloc space writeable, making
> 						typo     ^^^^^^^^
What's the typo? It seems "writeable" is okay.
>>      them susceptible to inadvertent modification by software.
>>
>> Signed-off-by: Huang Shijie <shijie@os.amperecomputing.com>
>> ---
>>   Documentation/admin-guide/kernel-parameters.txt | 5 +++--
>>   arch/arm64/include/asm/setup.h                  | 4 ++--
>>   2 files changed, 5 insertions(+), 4 deletions(-)
>>
>> diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt
>> index db84a629f7b1..138e0db5af64 100644
>> --- a/Documentation/admin-guide/kernel-parameters.txt
>> +++ b/Documentation/admin-guide/kernel-parameters.txt
>> @@ -6418,8 +6418,9 @@
>>   	rodata=		[KNL,EARLY]
>>   		on	Mark read-only kernel memory as read-only (default).
>>   		off	Leave read-only kernel memory writable for debugging.
>> -		full	Mark read-only kernel memory and aliases as read-only
>> -		        [arm64]
>> +		noalias	Mark read-only kernel memory as read-only but retain
>> +			writable aliases in the direct map for regions outside
>> +			of the kernel image. [arm64]
> Should not the arm64 specific performance implications be mentioned
> in the above documentation update as well ? But in case this appears
> too much platform specific - probably do consider adding them above
> or inside arch_parse_debug_rodata() as an in-code documentation.

Will had already suggested do not add them for the 
arch_parse_debug_rodata():

https://lists.infradead.org/pipermail/linux-arm-kernel/2025-September/1060135.html



Thanks

Huang Shijie

Re: [PATCH v7 1/2] arm64: refactor the rodata=xxx

[Anshuman Khandual]

On 09/09/25 10:56 AM, Shijie Huang wrote:
> 
> On 09/09/2025 12:29, Anshuman Khandual wrote:
>> On 09/09/25 9:02 AM, Huang Shijie wrote:
>>> As per admin guide documentation, "rodata=on" should be the default on
>>> platforms. Documentation/admin-guide/kernel-parameters.txt describes
>>> these options as
>>>
>>>     rodata=         [KNL,EARLY]
>>>             on      Mark read-only kernel memory as read-only (default).
>>>             off     Leave read-only kernel memory writable for debugging.
>>>             full    Mark read-only kernel memory and aliases as read-only
>>>                     [arm64]
>>>
>>> But on arm64 platform, RODATA_FULL_DEFAULT_ENABLED is enabled by default,
>>> so "rodata=full" is the default instead.
>>>
>>> This patch implements the following changes:
>>>   - Make "rodata=on" behaviour same as the original "rodata=full".
>>>     This keeps align with the x86.
>>>   - Make "rodata=noalias" (new) behaviour same as the original "rodata=on"
>>>   - Drop the original "rodata=full"
>>>
>>> After this patch, the "rodata=on" will be the default on arm64 platform
>>> as well.
>>>
>>> Different rodata options may have different performance, so record more
>>> detail information here:
>>>
>>>   rodata=on (default)
>>>      This applies read-only attributes to VM areas and to the linear
>>>      alias of the backing pages as well. This prevents code or read-
>>>      only data from being modified (inadvertently or intentionally),
>>>      via another mapping for the same memory page.
>>>
>>>      But this might cause linear map region to be mapped down to base
>>>      pages, which may adversely affect performance in some cases.
>>>
>>>   rodata=off
>>>      This provides more block mappings and contiguous hints for linear
>>>      map region which would minimize TLB footprint. This also leaves
>>>      read-only kernel memory writable for debugging.
>>>
>>>   rodata=noalias
>>>      This provides more block mappings and contiguous hints for linear
>>>      map region which would minimize TLB footprint. This leaves the linear
>>>      alias of read-only mappings in the vmalloc space writeable, making
>>                         typo     ^^^^^^^^
> What's the typo? It seems "writeable" is okay.

Alright.
>>>      them susceptible to inadvertent modification by software.
>>>
>>> Signed-off-by: Huang Shijie <shijie@os.amperecomputing.com>
>>> ---
>>>   Documentation/admin-guide/kernel-parameters.txt | 5 +++--
>>>   arch/arm64/include/asm/setup.h                  | 4 ++--
>>>   2 files changed, 5 insertions(+), 4 deletions(-)
>>>
>>> diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt
>>> index db84a629f7b1..138e0db5af64 100644
>>> --- a/Documentation/admin-guide/kernel-parameters.txt
>>> +++ b/Documentation/admin-guide/kernel-parameters.txt
>>> @@ -6418,8 +6418,9 @@
>>>       rodata=        [KNL,EARLY]
>>>           on    Mark read-only kernel memory as read-only (default).
>>>           off    Leave read-only kernel memory writable for debugging.
>>> -        full    Mark read-only kernel memory and aliases as read-only
>>> -                [arm64]
>>> +        noalias    Mark read-only kernel memory as read-only but retain
>>> +            writable aliases in the direct map for regions outside
>>> +            of the kernel image. [arm64]
>> Should not the arm64 specific performance implications be mentioned
>> in the above documentation update as well ? But in case this appears
>> too much platform specific - probably do consider adding them above
>> or inside arch_parse_debug_rodata() as an in-code documentation.
> 
> Will had already suggested do not add them for the arch_parse_debug_rodata():
> 
> https://lists.infradead.org/pipermail/linux-arm-kernel/2025-September/1060135.html
Alright.

Reviewed-by: Anshuman Khandual <anshuman.khandual@arm.com>

[PATCH v7 2/2] arm64/Kconfig: Remove CONFIG_RODATA_FULL_DEFAULT_ENABLED

[Huang Shijie]

After patch "arm64: refacotr the rodata=xxx",
the "rodata=on" becomes the default.

     ......................................
	if (!strcmp(arg, "on")) {
		rodata_enabled = rodata_full = true;
		return true;
	}
     ......................................

The rodata_full is always "true" via "rodata=on" and does not
depend on the config RODATA_FULL_DEFAULT_ENABLED anymore,
so it can be dropped.

Reviewed-by: Anshuman Khandual <anshuman.khandual@arm.com>
Signed-off-by: Huang Shijie <shijie@os.amperecomputing.com>
---
 arch/arm64/Kconfig       | 14 --------------
 arch/arm64/mm/pageattr.c |  2 +-
 2 files changed, 1 insertion(+), 15 deletions(-)

diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig
index 1bd9c364da6e..5d15bcd0702e 100644
--- a/arch/arm64/Kconfig
+++ b/arch/arm64/Kconfig
@@ -1673,20 +1673,6 @@ config MITIGATE_SPECTRE_BRANCH_HISTORY
 	  When taking an exception from user-space, a sequence of branches
 	  or a firmware call overwrites the branch history.
 
-config RODATA_FULL_DEFAULT_ENABLED
-	bool "Apply r/o permissions of VM areas also to their linear aliases"
-	default y
-	help
-	  Apply read-only attributes of VM areas to the linear alias of
-	  the backing pages as well. This prevents code or read-only data
-	  from being modified (inadvertently or intentionally) via another
-	  mapping of the same memory page. This additional enhancement can
-	  be turned off at runtime by passing rodata=[off|on] (and turned on
-	  with rodata=full if this option is set to 'n')
-
-	  This requires the linear region to be mapped down to pages,
-	  which may adversely affect performance in some cases.
-
 config ARM64_SW_TTBR0_PAN
 	bool "Emulate Privileged Access Never using TTBR0_EL1 switching"
 	depends on !KCSAN
diff --git a/arch/arm64/mm/pageattr.c b/arch/arm64/mm/pageattr.c
index 04d4a8f676db..667aff1efe49 100644
--- a/arch/arm64/mm/pageattr.c
+++ b/arch/arm64/mm/pageattr.c
@@ -20,7 +20,7 @@ struct page_change_data {
 	pgprot_t clear_mask;
 };
 
-bool rodata_full __ro_after_init = IS_ENABLED(CONFIG_RODATA_FULL_DEFAULT_ENABLED);
+bool rodata_full __ro_after_init = true;
 
 bool can_set_direct_map(void)
 {
-- 
2.40.1

Re: [PATCH v7 0/2] arm64: refactor the rodata=xxx

[Will Deacon]

On Tue, 09 Sep 2025 11:32:34 +0800, Huang Shijie wrote:
> >From Documentation/admin-guide/kernel-parameters.txt, we know that:
>  rodata=	[KNL,EARLY]
> 	on	Mark read-only kernel memory as read-only (default).
> 	off	Leave read-only kernel memory writable for debugging.
> 	full	Mark read-only kernel memory and aliases as read-only
> 		[arm64]
> 
> [...]

Applied to arm64 (for-next/mm), thanks!

[1/2] arm64: refactor the rodata=xxx
      (no commit info)
[2/2] arm64/Kconfig: Remove CONFIG_RODATA_FULL_DEFAULT_ENABLED
      https://git.kernel.org/arm64/c/bfbbb0d3215f

Cheers,
-- 
Will

https://fixes.arm64.dev
https://next.arm64.dev
https://will.arm64.dev