linux-kernel - Re: [PATCH v6 0/8] arm: support CONFIG

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Fri, 26 Sep 2014 12:21:10 +0100
From:	Will Deacon <will.deacon@....com>
To:	Kees Cook <keescook@...omium.org>
Cc:	Rabin Vincent <rabin@....in>, Laura Abbott <lauraa@...eaurora.org>,
	Rob Herring <robh@...nel.org>,
	Leif Lindholm <leif.lindholm@...aro.org>,
	"msalter@...hat.com" <msalter@...hat.com>,
	Liu hua <sdu.liu@...wei.com>,
	Nikolay Borisov <Nikolay.Borisov@....com>,
	Nicolas Pitre <nicolas.pitre@...aro.org>,
	Doug Anderson <dianders@...gle.com>,
	Jason Wessel <jason.wessel@...driver.com>,
	Catalin Marinas <Catalin.Marinas@....com>,
	Russell King - ARM Linux <linux@....linux.org.uk>,
	"linux-arm-kernel@...ts.infradead.org" 
	<linux-arm-kernel@...ts.infradead.org>,
	LKML <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH v6 0/8] arm: support CONFIG_RODATA

On Fri, Sep 26, 2014 at 06:58:05AM +0100, Kees Cook wrote:
> On Thu, Sep 18, 2014 at 12:19 PM, Kees Cook <keescook@...omium.org> wrote:
> > This is a series of patches to support CONFIG_RODATA on ARM, so that
> > the kernel text is RO, and non-text sections default to NX. To support
> > on-the-fly kernel text patching (via ftrace, kprobes, etc), fixmap
> > support has been finalized based on several versions of various patches
> > that are floating around on the mailing list. This series attempts to
> > include the least intrusive version, so that others can build on it for
> > future fixmap work.
> >
> > The series has been heavily tested, and appears to be working correctly:
> >
> > With CONFIG_ARM_PTDUMP, expected page table permissions are seen in
> > /sys/kernel/debug/kernel_page_tables.
> >
> > Using CONFIG_LKDTM, the kernel now correctly detects bad accesses for
> > for the following lkdtm tests via /sys/kernel/debug/provoke-crash/DIRECT:
> >         EXEC_DATA
> >         WRITE_RO
> >         WRITE_KERN
> >
> > ftrace works:
> >         CONFIG_FTRACE_STARTUP_TEST passes
> >         Enabling tracing works:
> >                 echo function > /sys/kernel/debug/tracing/current_tracer
> > kprobes works:
> >         CONFIG_ARM_KPROBES_TEST passes
> >
> > kexec works:
> >         kexec will load and start a new kernel
> >
> > Built with and without CONFIG_HIGHMEM, CONFIG_HIGHMEM_DEBUG, and
> > CONFIG_NR_CPUS=32.
> >
> > Thanks to everyone who has been testing this series and working on its
> > various pieces!
> >
> > Hopefully this should address Will's last concerns. :)
> >
> > Thanks!
> >
> > -Kees
> >
> > v6:
> > - always run patch_text under stop_machine (will.deacon)
> > - document set_fixmap's TLB flushing situation (will.deacon)
> 
> Hi Will,
> 
> Does this version look good to you? Should I turn it into a pull request?

The TLB flushing bits look sensible now, but the locking in __set_fixmap is
still pretty horrible (x86 just uses a mutex, not sure why we need to be
different). Still, it's Russell's call.

Will
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/