[lkml]   [2009]   [Oct]   [20]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
    Patch in this message
    Subject[PATCH v3] [x86] detect and report lack of NX protections
    It is possible for x86_64 systems to lack the NX bit (see check_efer())
    either due to the hardware lacking support or the BIOS having turned
    off the CPU capability, so NX status should be reported. Additionally,
    anyone booting NX-capable CPUs in 32bit mode without PAE will lack NX
    functionality, so this change provides feedback for that case as well.

    v2: use "Alert:" instead of "Warning:" to avoid confusion with WARN_ON()
    v3: use "Notice:" instead of "Alert:" to avoid confusion with KERN_ALERT,
    and switch to KERN_NOTICE, in keeping with its use for "normal but
    significant condition" messages.

    Signed-off-by: Kees Cook <>
    arch/x86/mm/init.c | 10 ++++++++++
    arch/x86/mm/setup_nx.c | 2 ++
    2 files changed, 12 insertions(+), 0 deletions(-)

    diff --git a/arch/x86/mm/init.c b/arch/x86/mm/init.c
    index 73ffd55..8472293 100644
    --- a/arch/x86/mm/init.c
    +++ b/arch/x86/mm/init.c
    @@ -149,6 +149,16 @@ unsigned long __init_refok init_memory_mapping(unsigned long start,
    if (nx_enabled)
    printk(KERN_INFO "NX (Execute Disable) protection: active\n");
    + else if (cpu_has_pae)
    +#if defined(CONFIG_X86_64) || defined(CONFIG_X86_PAE)
    + /* PAE kernel, PAE CPU, without NX */
    + printk(KERN_NOTICE "Notice: NX (Execute Disable) protection "
    + "missing in CPU or disabled in BIOS!\n");
    + /* 32bit non-PAE kernel, PAE CPU */
    + printk(KERN_NOTICE "Notice: NX (Execute Disable) protection "
    + "cannot be enabled: non-PAE kernel!\n");

    /* Enable PSE if available */
    if (cpu_has_pse)
    diff --git a/arch/x86/mm/setup_nx.c b/arch/x86/mm/setup_nx.c
    index 513d8ed..b039a4c 100644
    --- a/arch/x86/mm/setup_nx.c
    +++ b/arch/x86/mm/setup_nx.c
    @@ -53,6 +53,8 @@ void __init set_nx(void)
    void set_nx(void)
    + /* notice if _PAGE_NX was removed during check_efer() */
    + nx_enabled = ((__supported_pte_mask & _PAGE_NX) == _PAGE_NX);


    Kees Cook
    Ubuntu Security Team

     \ /
      Last update: 2009-10-20 06:59    [W:3.533 / U:0.172 seconds]
    ©2003-2017 Jasper Spaans. hosted at Digital OceanAdvertise on this site