Re: [PATCH] NX protection for kernel data : fix 32 bits S3 suspend

["H. Peter Anvin" <hpa@zytor.com>]

On 02/07/2011 11:59 AM, castet.matthieu@free.fr wrote:
> For .39 I hope we could remove most of the RWX rights after init (This means
> make low memory trampoline NX or !RW).
> This should be possible on :
> - 32 bit if wakeup use trampoline_32 [1] that doesn't enable paging in low
> memory (can be NX)
> - trampoline_64 need fix to support NX on data section. It tries to read data
> section before enabling NX. A possible fix is to use its own page table [2]. And
> the kernel one can be NX.

What *should* happen -- ideally for .39 -- is that NX (and RO!)
protection should be done per linear mapping, not per physical page.  A
page that is mapped more than once is mapped for a different purpose,
and as such probably should have different permissions.  A lot of the
static_protections() garbage is about enforcing those as exceptions, but
let's face it, that should be the *norm*.

	-hpa