From: Jan Beulich <jbeulich@suse.com>
To: Andrew Cooper <andrew.cooper3@citrix.com>
Cc: "Roger Pau Monné" <roger.pau@citrix.com>, "Wei Liu" <wl@xen.org>,
Xen-devel <xen-devel@lists.xenproject.org>
Subject: Re: [PATCH 7/8] x86/boot: Support __ro_after_init
Date: Thu, 2 Dec 2021 14:10:38 +0100 [thread overview]
Message-ID: <1628edef-ca52-31ec-6e46-6865694aa834@suse.com> (raw)
In-Reply-To: <20211130100445.31156-8-andrew.cooper3@citrix.com>
On 30.11.2021 11:04, Andrew Cooper wrote:
> For security hardening reasons, it advantageous to make setup-once data
> immutable after boot. Borrow __ro_after_init from Linux.
>
> On x86, place .data.ro_after_init at the start of .rodata, excluding it from
> the early permission restrictions. Re-apply RO restrictions to the whole of
> .rodata in init_done(), attempting to reform the superpage if possible.
>
> For architectures which don't implement __ro_after_init explicitly, variables
> merges into .data.
>
> Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
Reviewed-by: Jan Beulich <jbeulich@suse.com>
next prev parent reply other threads:[~2021-12-02 13:11 UTC|newest]
Thread overview: 24+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-11-30 10:04 [PATCH 0/8] x86: Support for __ro_after_init Andrew Cooper
2021-11-30 10:04 ` [PATCH 1/8] x86/boot: Drop incorrect mapping at l2_xenmap[0] Andrew Cooper
2021-11-30 10:33 ` Jan Beulich
2021-11-30 11:14 ` Andrew Cooper
2021-11-30 11:22 ` Jan Beulich
2021-11-30 12:39 ` Andrew Cooper
2021-11-30 10:04 ` [PATCH 2/8] x86/boot: Better describe the pagetable relocation loops Andrew Cooper
2021-12-02 11:43 ` Jan Beulich
2021-11-30 10:04 ` [PATCH 3/8] x86/boot: Fix data placement around __high_start() Andrew Cooper
2021-12-02 11:49 ` Jan Beulich
2021-12-02 14:06 ` Andrew Cooper
2021-11-30 10:04 ` [PATCH 4/8] x86/mm: Drop bogus cacheability logic in update_xen_mappings() Andrew Cooper
2021-11-30 13:11 ` Andrew Cooper
2021-11-30 14:56 ` Andrew Cooper
2021-11-30 10:04 ` [PATCH 5/8] x86/boot: Drop xen_virt_end Andrew Cooper
2021-12-02 11:56 ` Jan Beulich
2021-12-02 14:07 ` Andrew Cooper
2021-11-30 10:04 ` [PATCH 6/8] x86/boot: Adjust .text/.rodata/etc permissions in one place Andrew Cooper
2021-12-02 12:15 ` Jan Beulich
2021-11-30 10:04 ` [PATCH 7/8] x86/boot: Support __ro_after_init Andrew Cooper
2021-12-02 13:10 ` Jan Beulich [this message]
2021-11-30 10:04 ` [PATCH RFC 8/8] x86/boot: Check that permission restrictions have taken effect Andrew Cooper
2021-12-02 13:33 ` Jan Beulich
2021-12-06 18:12 ` Andrew Cooper
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1628edef-ca52-31ec-6e46-6865694aa834@suse.com \
--to=jbeulich@suse.com \
--cc=andrew.cooper3@citrix.com \
--cc=roger.pau@citrix.com \
--cc=wl@xen.org \
--cc=xen-devel@lists.xenproject.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.