Commit d2aa1aca authored by Kees Cook's avatar Kees Cook Committed by Ingo Molnar

mm/init: Add 'rodata=off' boot cmdline parameter to disable read-only kernel mappings

It may be useful to debug writes to the readonly sections of memory,
so provide a cmdline "rodata=off" to allow for this. This can be
expanded in the future to support "log" and "write" modes, but that
will need to be architecture-specific.

This also makes KDB software breakpoints more usable, as read-only
mappings can now be disabled on any kernel.
Suggested-by: default avatarH. Peter Anvin <>
Signed-off-by: default avatarKees Cook <>
Cc: Andy Lutomirski <>
Cc: Arnd Bergmann <>
Cc: Borislav Petkov <>
Cc: Brian Gerst <>
Cc: David Brown <>
Cc: Denys Vlasenko <>
Cc: Emese Revfy <>
Cc: Linus Torvalds <>
Cc: Mathias Krause <>
Cc: Michael Ellerman <>
Cc: PaX Team <>
Cc: Peter Zijlstra <>
Cc: Thomas Gleixner <>
Cc: linux-arch <>
Link: default avatarIngo Molnar <>
parent e267d97b
......@@ -3491,6 +3491,10 @@ bytes respectively. Such letter suffixes can also be entirely omitted.
ro [KNL] Mount root device read-only on boot
rodata= [KNL]
on Mark read-only kernel memory as read-only (default).
off Leave read-only kernel memory writable for debugging.
root= [KNL] Root filesystem
See name_to_dev_t comment in init/do_mounts.c.
......@@ -93,9 +93,6 @@ static int kernel_init(void *);
extern void init_IRQ(void);
extern void fork_init(void);
extern void radix_tree_init(void);
static inline void mark_rodata_ro(void) { }
* Debug helper: via this flag we know that we are in 'early bootup code'
......@@ -929,6 +926,28 @@ static int try_to_run_init_process(const char *init_filename)
static noinline void __init kernel_init_freeable(void);
static bool rodata_enabled = true;
static int __init set_debug_rodata(char *str)
return strtobool(str, &rodata_enabled);
__setup("rodata=", set_debug_rodata);
static void mark_readonly(void)
if (rodata_enabled)
pr_info("Kernel memory protection disabled.\n");
static inline void mark_readonly(void)
pr_warn("This architecture does not have kernel memory protection.\n");
static int __ref kernel_init(void *unused)
int ret;
......@@ -937,7 +956,7 @@ static int __ref kernel_init(void *unused)
/* need to finish all async __init code before freeing the memory */
system_state = SYSTEM_RUNNING;
......@@ -153,13 +153,11 @@ static int _kdb_bp_install(struct pt_regs *regs, kdb_bp_t *bp)
} else {
kdb_printf("%s: failed to set breakpoint at 0x%lx\n",
__func__, bp->bp_addr);
if (!bp->bp_type) {
kdb_printf("Software breakpoints are unavailable.\n"
" Change the kernel CONFIG_DEBUG_RODATA=n\n"
" Boot the kernel with rodata=off\n"
" OR use hw breaks: help bph\n");
return 1;
return 0;
Markdown is supported
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment