• Ard Biesheuvel's avatar
    arm64: enable CONFIG_DEBUG_RODATA by default · 57efac2f
    Ard Biesheuvel authored
    In spite of its name, CONFIG_DEBUG_RODATA is an important hardening feature
    for production kernels, and distros all enable it by default in their
    kernel configs. However, since enabling it used to result in more granular,
    and thus less efficient kernel mappings, it is not enabled by default for
    performance reasons.
    
    However, since commit 2f39b5f9 ("arm64: mm: Mark .rodata as RO"), the
    various kernel segments (.text, .rodata, .init and .data) are already
    mapped individually, and the only effect of setting CONFIG_DEBUG_RODATA is
    that the existing .text and .rodata mappings are updated late in the boot
    sequence to have their read-only attributes set, which means that any
    performance concerns related to enabling CONFIG_DEBUG_RODATA are no longer
    valid.
    
    So from now on, make CONFIG_DEBUG_RODATA default to 'y'
    Signed-off-by: default avatarArd Biesheuvel <ard.biesheuvel@linaro.org>
    Acked-by: default avatarMark Rutland <mark.rutland@arm.com>
    Acked-by: default avatarKees Cook <keescook@chromium.org>
    Signed-off-by: default avatarCatalin Marinas <catalin.marinas@arm.com>
    57efac2f
Kconfig.debug 2.84 KB