From mboxrd@z Thu Jan 1 00:00:00 1970 From: Andi Kleen Subject: Re: [PATCH v8] RO/NX protection for loadable kernel modules Date: Wed, 03 Feb 2010 00:05:39 +0100 Message-ID: <873a1jdyrg.fsf@basil.nowhere.org> References: <817ecb6f1001311522q52bf4eebmb748c486dcd5ad35@mail.gmail.com> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Return-path: Received: from one.firstfloor.org ([213.235.205.2]:55627 "EHLO one.firstfloor.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1756904Ab0BBXFl (ORCPT ); Tue, 2 Feb 2010 18:05:41 -0500 In-Reply-To: <817ecb6f1001311522q52bf4eebmb748c486dcd5ad35@mail.gmail.com> (Siarhei Liakh's message of "Sun, 31 Jan 2010 18:22:35 -0500") Sender: linux-next-owner@vger.kernel.org List-ID: To: Siarhei Liakh Cc: linux-kernel@vger.kernel.org, linux-security-module@vger.kernel.org, linux-next@vger.kernel.org, Arjan van de Ven , James Morris , Andrew Morton , Andi Kleen , Thomas Gleixner , "H. Peter Anvin" , Ingo Molnar , Rusty Russell , Stephen Rothwell , Dave Jones Siarhei Liakh writes: > This patch is a logical extension of the protection provided by > CONFIG_DEBUG_RODATA to LKMs. The protection is provided by splitting > module_core and module_init into three logical parts each and setting > appropriate page access permissions for each individual section: My current kernel has 52 modules loaded, most of them very small. Assuming the additional alignment of the data section cost two more pages on average (I think that's a good assumption), that's roughly 424KB of additional memory, plus associated runtime costs in increased TLB usage. What would I get for that if I applied the patch and enabled the option? That information seems to be missing in this patch submission. Did you find any bugs with this option? -Andi -- ak@linux.intel.com -- Speaking for myself only.