From: Borislav Petkov <bp@alien8.de>
To: Joerg Roedel <joro@8bytes.org>
Cc: Thomas Gleixner <tglx@linutronix.de>,
Paul Menzel <pmenzel@molgen.mpg.de>,
linux-mm@kvack.org, x86@kernel.org,
lkml <linux-kernel@vger.kernel.org>
Subject: Re: x86/mm: Found insecure W+X mapping at address (ptrval)/0xc00a0000
Date: Thu, 4 Oct 2018 10:14:38 +0200 [thread overview]
Message-ID: <20181004081429.GB1864@zn.tnic> (raw)
In-Reply-To: <20181004080321.GA3630@8bytes.org>
On Thu, Oct 04, 2018 at 10:03:21AM +0200, Joerg Roedel wrote:
> I also triggered this when working in the PTI-x32 code. It always
> happens on a 32-bit PAE kernel for me.
>
> Tracking it down I ended up in (iirc) arch/x86/mm/pageattr.c
> function static_protections():
>
> /*
> * The BIOS area between 640k and 1Mb needs to be executable for
> * PCI BIOS based config access (CONFIG_PCI_GOBIOS) support.
> */
> #ifdef CONFIG_PCI_BIOS
> if (pcibios_enabled && within(pfn, BIOS_BEGIN >> PAGE_SHIFT, BIOS_END >> PAGE_SHIFT))
> pgprot_val(forbidden) |= _PAGE_NX;
> #endif
>
> I think that is the reason we are seeing this in that configuration.
So looking at this, BIOS_BEGIN and BIOS_END is the same range as the ISA
range:
#define ISA_START_ADDRESS 0x000a0000
#define ISA_END_ADDRESS 0x00100000
#define BIOS_BEGIN 0x000a0000
#define BIOS_END 0x00100000
and I did try marking the ISA range RO in mark_rodata_ro() but the
machine wouldn't boot after. So I'm guessing BIOS needs to write there
some crap.
--
Regards/Gruss,
Boris.
Good mailing practices for 400: avoid top-posting and trim the reply.
next prev parent reply other threads:[~2018-10-04 8:14 UTC|newest]
Thread overview: 23+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-09-19 6:55 x86/mm: Found insecure W+X mapping at address (ptrval)/0xc00a0000 Paul Menzel
2018-09-19 8:09 ` Thomas Gleixner
2018-09-20 7:07 ` Paul Menzel
2018-09-20 22:51 ` Thomas Gleixner
2018-09-24 21:47 ` Paul Menzel
2018-09-28 14:55 ` Thomas Gleixner
2018-10-03 21:22 ` Borislav Petkov
2018-10-04 3:11 ` Paul Menzel
2018-10-04 7:48 ` Borislav Petkov
2018-10-04 8:03 ` Joerg Roedel
2018-10-04 8:14 ` Borislav Petkov [this message]
2018-10-04 8:40 ` Paul Menzel
2018-10-04 8:49 ` Borislav Petkov
2018-10-04 8:59 ` Paul Menzel
2018-10-04 10:54 ` Borislav Petkov
2018-10-04 11:00 ` Paul Menzel
2018-10-04 11:12 ` Borislav Petkov
2018-10-04 8:43 ` Joerg Roedel
2018-10-04 8:48 ` Borislav Petkov
2018-10-05 9:27 ` Thomas Gleixner
2018-10-05 9:39 ` Paul Menzel
2018-10-08 19:37 ` Thomas Gleixner
2018-10-08 20:08 ` Bjorn Helgaas
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20181004081429.GB1864@zn.tnic \
--to=bp@alien8.de \
--cc=joro@8bytes.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-mm@kvack.org \
--cc=pmenzel@molgen.mpg.de \
--cc=tglx@linutronix.de \
--cc=x86@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.