Messages in this thread | | | Date | Mon, 07 Feb 2011 12:07:27 -0800 | From | "H. Peter Anvin" <> | Subject | Re: [PATCH] NX protection for kernel data : fix 32 bits S3 suspend |
| |
On 02/07/2011 11:59 AM, castet.matthieu@free.fr wrote: > For .39 I hope we could remove most of the RWX rights after init (This means > make low memory trampoline NX or !RW). > This should be possible on : > - 32 bit if wakeup use trampoline_32 [1] that doesn't enable paging in low > memory (can be NX) > - trampoline_64 need fix to support NX on data section. It tries to read data > section before enabling NX. A possible fix is to use its own page table [2]. And > the kernel one can be NX.
What *should* happen -- ideally for .39 -- is that NX (and RO!) protection should be done per linear mapping, not per physical page. A page that is mapped more than once is mapped for a different purpose, and as such probably should have different permissions. A lot of the static_protections() garbage is about enforcing those as exceptions, but let's face it, that should be the *norm*.
-hpa
| |