lkml.org 
[lkml]   [2009]   [Sep]   [4]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    Date
    From
    SubjectRe: [PATCH V3] x86: NX protection for kernel data

    * Siarhei Liakh <sliakh.lkml@gmail.com> wrote:

    > This patch expands functionality of CONFIG_DEBUG_RODATA to set main
    > (static) kernel data area as NX.
    > The following steps are taken to achieve this:
    > 1. Linker script is adjusted so .text always starts and ends on a page boundary
    > 2. Linker script is adjusted so .rodata and .data always start and
    > end on a page boundary
    > 3. void mark_nxdata_nx(void) added to arch/x86/mm/init.c with actual
    > functionality: NX is set for all pages from _etext through _end.
    > 4. mark_nxdata_nx() called from free_initmem() (after init has been released)
    > 5. free_init_pages() sets released memory NX in arch/x86/mm/init.c
    >
    > The patch have been developed for Linux 2.6.31-rc7 x86 by Siarhei Liakh
    > <sliakh.lkml@gmail.com> and Xuxian Jiang <jiang@cs.ncsu.edu>.
    >
    > V1: initial patch for 2.6.30
    > V2: patch for 2.6.31-rc7
    > V3: moved all code into arch/x86, adjusted credits

    ok, i like it.

    One small cleanliness detail before we can apply it to the x86 tree:

    > --- a/arch/x86/mm/init.c
    > +++ b/arch/x86/mm/init.c
    > @@ -440,11 +441,31 @@ void free_init_pages(char *what, unsigned long
    > begin, unsigned long end)
    > #endif
    > }
    >
    > +#ifndef CONFIG_DEBUG_RODATA
    > +static inline void mark_nxdata_nx(void) { }
    > +#else
    > +void mark_nxdata_nx(void)
    > +{
    > + /*
    > + * When this called, init has already been executed and released,
    > + * so everything past _etext sould be NX.
    > + */
    > + unsigned long start = PFN_ALIGN(_etext);
    > + unsigned long size = PFN_ALIGN(_end) - start;
    > +
    > + printk(KERN_INFO "NX-protecting the kernel data: %lx, %lu pages\n",
    > + start, size >> PAGE_SHIFT);
    > + set_pages_nx(virt_to_page(start), size >> PAGE_SHIFT);
    > +}
    > +#endif

    This #ifdef looks ugly, it starts with an #ifndef which is inverted
    logic and mark_nxdata_nx() is a global symbol, needlessly. It should
    be written as something like:

    static void mark_nxdata_nx(void)
    {
    #ifdef CONFIG_DEBUG_RODATA
    ...
    #endif
    }

    Thanks,

    Ingo


    \
     
     \ /
      Last update: 2009-09-04 09:49    [W:0.039 / U:31.796 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site