FAIL: test_072_config_debug_rodata (__main__.KernelSecurityTest) on SRU kernel 3.5.0-226.39 omap4

[Paul Larson]

https://jenkins.qa.ubuntu.com/job/sru_kernel-quantal-generic-armhf_omap4_panda_ES-serial/111/testReport/junit/autotest/ubuntu_qrt_kernel_security/test_kernel_security_py/ has the details, but this is not one I recall seeing before.

06/11 02:51:19 ERROR|base_utils:0114| [stderr] ======================================================================
06/11 02:51:19 ERROR|base_utils:0114| [stderr] FAIL: test_072_config_debug_rodata (__main__.KernelSecurityTest)
06/11 02:51:19 ERROR|base_utils:0114| [stderr] CONFIG_DEBUG_RODATA enabled
06/11 02:51:19 ERROR|base_utils:0114| [stderr] ----------------------------------------------------------------------
06/11 02:51:19 ERROR|base_utils:0114| [stderr] Traceback (most recent call last):
06/11 02:51:19 ERROR|base_utils:0114| [stderr] File "./test-kernel-security.py", line 664, in test_072_config_debug_rodata
06/11 02:51:19 ERROR|base_utils:0114| [stderr] self.assertEqual(self._test_config('DEBUG_RODATA'), expected)
06/11 02:51:19 ERROR|base_utils:0114| [stderr] AssertionError: True != False
06/11 02:51:19 ERROR|base_utils:0114| [stderr]
06/11 02:51:19 ERROR|base_utils:0114| [stderr] ----------------------------------------------------------------------
06/11 02:51:19 ERROR|base_utils:0114| [stderr] Ran 52 tests in 78.542s

[Seth Arnold (seth-arnold)]

See also https://bugs.launchpad.net/ubuntu/+source/linux-ti-omap4/+bug/1027524

Here's the test in question:

    def test_072_config_debug_rodata(self):
        '''CONFIG_DEBUG_RODATA enabled'''

        expected = True
        # Enabled in a security update for pre-Intrepid
        if not self.kernel_at_least('2.6.22'):
            self._skipped("only Gutsy and later")
            expected = False
        else:
            # Arch-specific
            if self.dpkg_arch not in ['i386','amd64']:
                self._skipped("only x86")
                expected = False
            # Hardy Xen doesn't have it?
            if self.lsb_release['Release'] == 8.04 and \
               self.kernel_version.endswith('-xen'):
                self._skipped("ignored on Hardy Xen")
                expected = False

        self.assertEqual(self._test_config('DEBUG_RODATA'), expected)

This is the version pulled from the security team's QRT framework; as I read it, it expects CONFIG_DEBUG_RODATA to be set only on x86 and x86-64 platforms. The result of this config is used in init/main.c:

#ifndef CONFIG_DEBUG_RODATA
static inline void mark_rodata_ro(void) { }
#endif
/* ... */
static int __ref kernel_init(void *unused)
{
        kernel_init_freeable();
        /* need to finish all async __init code before freeing the memory */
        async_synchronize_full();
        free_initmem();
        mark_rodata_ro(); /* called here */
        system_state = SYSTEM_RUNNING;
        numa_default_policy();
/* ... */

So, if CONFIG_DEBUG_RODATA is defined then the architecture needs to supply a mark_rodata_ro() function.

I don't know the kernel's configuration system well enough to explain how our omap4 kernels boot with this defined -- at least in the kernel source trees I have readily available, only x86, x86-64, and parisc have a mark_rodata_ro() function defined.

We want this configuration turned on for platforms where it makes sense -- and I'm not sure how it makes sense to turn it on for our ARM kernels. I assume, and probably whoever wrote this test assumed as well, that turning on CONFIG_DEBUG_RODATA would lead to non-functioning kernels on platforms that don't supply a mark_rodata_ro() function. And yet, my pandaboard boots.

This should not hold up kernel releases; this configuration has been set for many releases (http://pastebin.ubuntu.com/5762155/) and appears to have no ill-effect on my pandaboard.

Perhaps this configuration setting should be turned off on our ARM kernels, to avoid re-triggering this test.

I would like to understand this better, however. Could a friendly member of the kernel team please help me understand this? Thanks

[Paul Larson (pwlars)]

This is present in the 3.2.0-1443-omap4 #62 LTS kernel I'm testing right now on precise

[Steve Beattie (sbeattie)]

The test case in question has been adjusted to take into account that CONFIG_DEBUG_RODATA is enabled for arm arches as well. Closing.