Messages in this thread | | | Date | Tue, 10 Nov 2009 09:46:22 -0800 | From | Kees Cook <> | Subject | Re: [PATCH v4] [x86] detect and report lack of NX protections |
| |
On Tue, Nov 10, 2009 at 09:12:44AM -0800, H. Peter Anvin wrote: > On 11/10/2009 08:57 AM, Kees Cook wrote: > > > > 64-bit does not set nx_enabled to "1" by default anywhere. And setting > > the default to 1 in check_efer() seemed out of place to me. > > > > If it doesn't set nx_enabled anywhere, you'll end up with the message > > + printk(KERN_NOTICE "Notice: NX (Execute Disable) protection " > + "missing in CPU or disabled in BIOS!\n"); > > which seems obviously wrong... no?
The kernel as-is does not set nx_enabled for 64-bit, so this message is skipped completely:
if (nx_enabled) printk(KERN_INFO "NX (Execute Disable) protection: active\n");
The only time this printk is shown is on 32-bit with PAE (with NX). There is no "else" currently.
My patch seeks to do two things: - report the "active" message on 64-bit (if not disabled in check_efer()) - report "zomg NX missing" for all cases when PAE is available to the CPU.
To implement the first, the set_nx() routine for non-PAE 32-bit and all 64-bit needs to have nx_enabled set correctly (which is done in the second set_nx() that was empty in arch/x86/mm/setup_nx.c).
To implement the second, the following logic is then added to the "if (nx_enabled)" case in arch/x86/mm/init.c as an "else":
else if (cpu_has_pae) #if defined(CONFIG_X86_64) || defined(CONFIG_X86_PAE) /* PAE kernel, PAE CPU, without NX */ printk(KERN_NOTICE "Notice: NX (Execute Disable) protection " "missing in CPU or disabled in BIOS!\n"); #else /* 32bit non-PAE kernel, PAE CPU */ printk(KERN_NOTICE "Notice: NX (Execute Disable) protection " "cannot be enabled: non-PAE kernel!\n"); #endif
-- Kees Cook Ubuntu Security Team
| |