Re: [tip:x86/security] x86: Add NX protection for kernel data

[Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>]

> -	 * .data and .bss should always be writable.
> +	 * .data and .bss should always be writable, but xen won't like
> +	 * if we make page table rw (that live in .data or .bss)
>  	 */
> +#ifdef CONFIG_X86_32
>  	if (within(address, (unsigned long)_sdata, (unsigned long)_edata) ||
> -	    within(address, (unsigned long)__bss_start, (unsigned long)__bss_stop))
> -		pgprot_val(required) |= _PAGE_RW;
> +	    within(address, (unsigned long)__bss_start, (unsigned long)__bss_stop)) {
> +		unsigned int level;
> +		if (lookup_address(address, &level) && (level != PG_LEVEL_4K))
> +			pgprot_val(forbidden) |= _PAGE_RW;
> +	}
> +#endif
>  
>  #if defined(CONFIG_X86_64) && defined(CONFIG_DEBUG_RODATA)
> 
> fyi, it does make it boot.

Hold it.. ccache is a wonderful tool but I think I've just "rebuilt" the
binaries with the .bss HPAGE_ALIGN aligment by mistake, so this path got never
taken.