On Mon, 20 Apr 2020 at 15:37, Arjan van de Ven <arjan@xxxxxxxxxxxxxxx> wrote: > > On 4/20/2020 5:01 AM, Ard Biesheuvel wrote: > > Is that the only prerequisite? I.e., is it sufficient for another > > architecture to add -ffunction-sections to the module CFLAGS to get > > this functionality? (assuming it defines CONFIG_FG_KASLR=y) > > I suspect you also need/want at least normal KASLR enabled as > a "does it even make sense" common sense threshold Fair enough. But that is more of a policy concern than a functional concern. FWIW I took patches #8 and #9, hardwired a couple of CONFIG_FG_KASLR=y checks and added the -ffunction-sections GCC option for the modules, and everything appears to be working as expected on arm64. I was just wondering if I was missing something. Note that arm64 does not have a decompressor, so there the fine grained randomization of the core kernel is not really feasible using the approach presented here.
