Messages in this thread | | | Date | Sat, 22 Nov 2008 11:20:56 +0100 | From | Takashi Iwai <> | Subject | Re: vm86 segfaults with NX bit |
| |
At Fri, 21 Nov 2008 18:42:04 +0100, Egbert Eich wrote: > > Takashi Iwai writes: > > At Thu, 20 Nov 2008 08:58:44 -0800, > > Arjan van de Ven wrote: > > > > > > On Thu, 20 Nov 2008 16:39:06 +0100 > > > Takashi Iwai <tiwai@suse.de> wrote: > > > > > > > Hi, > > > > > > > > X guys reported that VESA driver segfaults in vm86 mode with a kernel > > > > with CONFIG_X86_PAE, and it turned to be the NX bit. See Novell > > > > bugzilla #443440: > > > > https://bugzilla.novell.com/show_bug.cgi?id=443440 > > > > > > > > I can confirm that the latest 2.6.28-rc still causes the same problem, > > > > and it disappears when booted with noexec=off option. > > > > > > > > Also, when NX bit is reset for the first 1MB (or smaller) in > > > > do_sys_vm86(), it also works as expected. But I have little clue > > > > where to restore the bit again. > > > > > > > > Any good suggestions / solutions? > > > > > > > > > > did the code that mapped this memory setup use PROT_EXEC ? > > > > A good question... > > Luc, Egbert, how does VESA driver handle it? > > > Yes, we set the PROT_EXEC for the VBIOS. But the segfault doesn't happen > in VBIOS as far as I can tell. It happens on the 'exit instruction', a > hlt (0xf6) which is trapped by vm86 so it returns to the caller. > This is done by putting 0xf6 into address 0x600 and putting this address > on the stack. > The memory that's mapped at 0x600 in the Xserver's address space is > allocated thru shmget() and attached to the right place in the processes > memory space for vm86. > We should call mprotect() on these ranges to set this memory executable. > Hey, this code was orginally written almost 10 years ago! > > The patch below fixes the issue.
Good to know that a die-hard bug is fixed now. Thanks!
Takashi
| |