Re: [PATCH] NX protection for kernel data : fix 32 bits S3 suspend

From: "H. Peter Anvin" <hpa@zytor.com>
To: matthieu castet <castet.matthieu@free.fr>
Cc: Ingo Molnar <mingo@elte.hu>,
	Linux Kernel list <linux-kernel@vger.kernel.org>,
	linux-security-module@vger.kernel.org,
	Matthias Hopf <mhopf@suse.de>,
	rjw@sisk.pl, Andrew Morton <akpm@linux-foundation.org>,
	Suresh Siddha <suresh.b.siddha@intel.com>
Subject: Re: [PATCH] NX protection for kernel data : fix 32 bits S3 suspend
Date: Mon, 14 Feb 2011 12:55:04 -0800	[thread overview]
Message-ID: <4D5996A8.3070605@zytor.com> (raw)
In-Reply-To: <4D56B0E6.5040600@free.fr>

On 02/12/2011 08:10 AM, matthieu castet wrote:
>>
>> No, you're really barking down the wrong path on this.  The trampoline
>> code is tiny; I don't think it is really worth trying to NX-ify it.  The
> Even if the trampoline is tiny, a hole is a hole.
> 
> The trampoline code job is to jump from low memory (realmode) to
> somewhere in kernel text.
> Why should we enable paging or use kernel page table for doing that ?
> 

That's not the problem.  The problem is that most of the "trampoline
codes" need parameters which need to be written by the kernel before
invocation.  Separating the address spaces out into text and
writable-for-the-kernel data is possible, but messy since the individual
chunks each have different addressing constraints.  I tried to get them
into the same link, but that has turned out to be very difficult and
probably will require a fair bit of restructuring, especially the code
shared with the boot code.

	-hpa

-- 
H. Peter Anvin, Intel Open Source Technology Center
I work for Intel.  I don't speak on their behalf.