lkml.org 
[lkml]   [2010]   [Jun]   [17]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
Date
From
Subject[PATCH] x86: clear XD_DISABLED flag on Intel to regain NX
This will clear the MSR_IA32_MISC_ENABLE_XD_DISABLE bit so that NX cannot
be inappropriately controlled by the BIOS on Intel CPUs. If NX actually
needs to be disabled, "noexec=off" can be used.

Signed-off-by: Kees Cook <kees.cook@canonical.com>
---
arch/x86/kernel/head_32.S | 19 +++++++++++++++++++
arch/x86/kernel/head_64.S | 18 ++++++++++++++++++
arch/x86/mm/setup_nx.c | 2 +-
3 files changed, 38 insertions(+), 1 deletions(-)

diff --git a/arch/x86/kernel/head_32.S b/arch/x86/kernel/head_32.S
index 37c3d4b..111e434 100644
--- a/arch/x86/kernel/head_32.S
+++ b/arch/x86/kernel/head_32.S
@@ -309,6 +309,25 @@ ENTRY(startup_32_smp)
subl $0x80000001, %eax
cmpl $(0x8000ffff-0x80000001), %eax
ja 6f
+
+ /* Is this "GenuineIntel"? */
+ movl $0x0, %eax
+ cpuid
+ cmpl $0x756e6547, %ebx
+ jnz 5f
+ cmpl $0x49656e69, %edx
+ jnz 5f
+ cmpl $0x6c65746e, %ecx
+ jnz 5f
+
+ /* Clear MSR_IA32_MISC_ENABLE_XD_DISABLE if set */
+ movl $MSR_IA32_MISC_ENABLE, %ecx
+ rdmsr
+ btrl $2, %edx
+ jnc 5f
+ wrmsr
+
+5:
mov $0x80000001, %eax
cpuid
/* Execute Disable bit supported? */
diff --git a/arch/x86/kernel/head_64.S b/arch/x86/kernel/head_64.S
index 3d1e6f1..e918e40 100644
--- a/arch/x86/kernel/head_64.S
+++ b/arch/x86/kernel/head_64.S
@@ -175,6 +175,24 @@ ENTRY(secondary_startup_64)
jmp *%rax
1:

+ /* Is this "GenuineIntel"? */
+ movl $0x0, %eax
+ cpuid
+ cmpl $0x756e6547, %ebx
+ jnz 5f
+ cmpl $0x49656e69, %edx
+ jnz 5f
+ cmpl $0x6c65746e, %ecx
+ jnz 5f
+
+ /* Clear MSR_IA32_MISC_ENABLE_XD_DISABLE if set */
+ movl $MSR_IA32_MISC_ENABLE, %ecx
+ rdmsr
+ btrl $2, %edx
+ jnc 5f
+ wrmsr
+
+5:
/* Check if nx is implemented */
movl $0x80000001, %eax
cpuid
diff --git a/arch/x86/mm/setup_nx.c b/arch/x86/mm/setup_nx.c
index a3250aa..410531d 100644
--- a/arch/x86/mm/setup_nx.c
+++ b/arch/x86/mm/setup_nx.c
@@ -41,7 +41,7 @@ void __init x86_report_nx(void)
{
if (!cpu_has_nx) {
printk(KERN_NOTICE "Notice: NX (Execute Disable) protection "
- "missing in CPU or disabled in BIOS!\n");
+ "missing in CPU!\n");
} else {
#if defined(CONFIG_X86_64) || defined(CONFIG_X86_PAE)
if (disable_nx) {
--
1.7.1
--
Kees Cook
Ubuntu Security Team


\
 
 \ /
  Last update: 2010-06-18 00:17    [W:0.538 / U:0.036 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site