public inbox for linux-kernel@vger.kernel.org
 help / color / mirror / Atom feed
From: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
To: hpa@zytor.com, tglx@linutronix.de, x86@kernel.org
Cc: Linux Kernel list <linux-kernel@vger.kernel.org>,
	Ingo Molnar <mingo@elte.hu>,
	linux-security-module@vger.kernel.org,
	Ian Campbell <Ian.Campbell@eu.citrix.com>,
	Kees Cook <kees.cook@canonical.com>,
	matthieu castet <castet.matthieu@free.fr>
Subject: for tip-bugfix? Re: [PATCH] NX protection for kernel data : fix xen boot
Date: Wed, 2 Feb 2011 15:55:04 -0500	[thread overview]
Message-ID: <20110202205504.GA6936@dumpdata.com> (raw)
In-Reply-To: <4D41ED13.5020105@free.fr>

On Thu, Jan 27, 2011 at 11:09:23PM +0100, matthieu castet wrote:
> I think it should be applied before 2.6.38 release, because without
> this patch xen doesn't boot on x86_32 with CONFIG_DEBUG_RODATA.
> 
Hey tglx + hpa,

The title is a bit wrong, the issue here is not with the NX bit
but with setting RW on RO areas in the .bss area.

I was wondering if you guys would be OK picking this up in your
"tip-2.6.38-rc4-bug-fix" branch for Linus? I've done the baremetal tests
on this patch (x86, x86_64) and have not found any regressions with it.


> >From 08f54ec4007ab0df231d81ed436632aa7f605feb Mon Sep 17 00:00:00 2001
> From: Matthieu CASTET <castet.matthieu@free.fr>
> Date: Thu, 20 Jan 2011 21:11:45 +0100
> Subject: [PATCH] NX protection for kernel data : fix xen boot
> 
> Xen want page table pages read only.
> 
> But the initial page table (from head_*.S) live in .data or .bss.
> 
> That was broken by 64edc8ed5ffae999d8d413ba006850e9e34166cb.
> Revert the problematic part as it is only a protection and
> not really needed.
> 
> Signed-off-by: Matthieu CASTET <castet.matthieu@free.fr>
> Tested-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
> ---
>  arch/x86/mm/pageattr.c |    8 --------
>  1 files changed, 0 insertions(+), 8 deletions(-)
> 
> diff --git a/arch/x86/mm/pageattr.c b/arch/x86/mm/pageattr.c
> index 2ad6c48..951eb4a 100644
> --- a/arch/x86/mm/pageattr.c
> +++ b/arch/x86/mm/pageattr.c
> @@ -256,7 +256,6 @@ static inline pgprot_t static_protections(pgprot_t prot, unsigned long address,
>  				   unsigned long pfn)
>  {
>  	pgprot_t forbidden = __pgprot(0);
> -	pgprot_t required = __pgprot(0);
>  
>  	/*
>  	 * The BIOS area between 640k and 1Mb needs to be executable for
> @@ -286,12 +285,6 @@ static inline pgprot_t static_protections(pgprot_t prot, unsigned long address,
>  	if (within(pfn, __pa((unsigned long)__start_rodata) >> PAGE_SHIFT,
>  		   __pa((unsigned long)__end_rodata) >> PAGE_SHIFT))
>  		pgprot_val(forbidden) |= _PAGE_RW;
> -	/*
> -	 * .data and .bss should always be writable.
> -	 */
> -	if (within(address, (unsigned long)_sdata, (unsigned long)_edata) ||
> -	    within(address, (unsigned long)__bss_start, (unsigned long)__bss_stop))
> -		pgprot_val(required) |= _PAGE_RW;
>  
>  #if defined(CONFIG_X86_64) && defined(CONFIG_DEBUG_RODATA)
>  	/*
> @@ -331,7 +324,6 @@ static inline pgprot_t static_protections(pgprot_t prot, unsigned long address,
>  #endif
>  
>  	prot = __pgprot(pgprot_val(prot) & ~pgprot_val(forbidden));
> -	prot = __pgprot(pgprot_val(prot) | pgprot_val(required));
>  
>  	return prot;
>  }
> -- 
> 1.7.2.3
> 


      reply	other threads:[~2011-02-02 20:57 UTC|newest]

Thread overview: 2+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2011-01-27 22:09 [PATCH] NX protection for kernel data : fix xen boot matthieu castet
2011-02-02 20:55 ` Konrad Rzeszutek Wilk [this message]

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20110202205504.GA6936@dumpdata.com \
    --to=konrad.wilk@oracle.com \
    --cc=Ian.Campbell@eu.citrix.com \
    --cc=castet.matthieu@free.fr \
    --cc=hpa@zytor.com \
    --cc=kees.cook@canonical.com \
    --cc=linux-kernel@vger.kernel.org \
    --cc=linux-security-module@vger.kernel.org \
    --cc=mingo@elte.hu \
    --cc=tglx@linutronix.de \
    --cc=x86@kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox