Re: [PATCH v8] RO/NX protection for loadable kernel modules

[Rusty Russell]

On Wed, 3 Feb 2010 09:35:39 am Andi Kleen wrote:
> Siarhei Liakh <sliakh.lkml@xxxxxxxxx> writes:
> 
> > This patch is a logical extension of the protection provided by
> > CONFIG_DEBUG_RODATA to LKMs. The protection is provided by splitting
> > module_core and module_init into three logical parts each and setting
> > appropriate page access permissions for each individual section:
> 
> My current kernel has 52 modules loaded, most of them very small. 
> Assuming the additional alignment of the data section cost two more
> pages on average (I think that's a good assumption), that's roughly
> 424KB of additional memory, plus associated runtime costs in increased
> TLB usage.
> 
> What would I get for that if I applied the patch and enabled the option? 

Strict RO/NX protection.  But without the option enabled, the patch gives
best-effort protection, which is nice (for no additional space).

Cheers,
Rusty.
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/