* Re: [PATCH] x86/mm: Do not warn about PCI BIOS W+X mappings
2018-10-08 19:53 [PATCH] x86/mm: Do not warn about PCI BIOS W+X mappings Thomas Gleixner
@ 2018-10-08 20:01 ` Borislav Petkov
2018-10-09 0:00 ` Kees Cook
` (2 subsequent siblings)
3 siblings, 0 replies; 5+ messages in thread
From: Borislav Petkov @ 2018-10-08 20:01 UTC (permalink / raw)
To: Thomas Gleixner
Cc: LKML, x86, Paul Menzel, Joerg Roedel, Kees Cook, Bjorn Helgaas
On Mon, Oct 08, 2018 at 09:53:48PM +0200, Thomas Gleixner wrote:
> PCI BIOS requires the BIOS area 0x0A0000-0x0FFFFFF to be mapped W+X for
> various legacy reasons. When CONFIG_DEBUG_WX is enabled, this triggers the
> WX warning, but this is misleading because the mapping is required and is
> not a result of an accidental oversight.
>
> Prevent the full warning when PCI BIOS is enabled and the detected WX
> mapping is in the BIOS area. Just emit a pr_warn() which denotes the
> fact. This is partially duplicating the info which the PCI BIOS code emits
> when it maps the area as executable, but that info is not in the context of
> the WX checking output.
>
> Reported-by: Paul Menzel <pmenzel@molgen.mpg.de>
> Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
> Cc: Joerg Roedel <joro@8bytes.org>
> Cc: Kees Cook <keescook@chromium.org>
> Cc: Bjorn Helgaas <bhelgaas@google.com>
Tested-by: Borislav Petkov <bp@suse.de>
--
Regards/Gruss,
Boris.
Good mailing practices for 400: avoid top-posting and trim the reply.
^ permalink raw reply [flat|nested] 5+ messages in thread* Re: [PATCH] x86/mm: Do not warn about PCI BIOS W+X mappings
2018-10-08 19:53 [PATCH] x86/mm: Do not warn about PCI BIOS W+X mappings Thomas Gleixner
2018-10-08 20:01 ` Borislav Petkov
@ 2018-10-09 0:00 ` Kees Cook
2018-10-10 13:18 ` [tip:x86/mm] " tip-bot for Thomas Gleixner
2018-10-11 23:23 ` [PATCH] " Paul Menzel
3 siblings, 0 replies; 5+ messages in thread
From: Kees Cook @ 2018-10-09 0:00 UTC (permalink / raw)
To: Thomas Gleixner; +Cc: LKML, X86 ML, Paul Menzel, Joerg Roedel, Bjorn Helgaas
On Mon, Oct 8, 2018 at 12:53 PM, Thomas Gleixner <tglx@linutronix.de> wrote:
> PCI BIOS requires the BIOS area 0x0A0000-0x0FFFFFF to be mapped W+X for
> various legacy reasons. When CONFIG_DEBUG_WX is enabled, this triggers the
> WX warning, but this is misleading because the mapping is required and is
> not a result of an accidental oversight.
>
> Prevent the full warning when PCI BIOS is enabled and the detected WX
> mapping is in the BIOS area. Just emit a pr_warn() which denotes the
> fact. This is partially duplicating the info which the PCI BIOS code emits
> when it maps the area as executable, but that info is not in the context of
> the WX checking output.
>
> Reported-by: Paul Menzel <pmenzel@molgen.mpg.de>
> Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
> Cc: Joerg Roedel <joro@8bytes.org>
> Cc: Kees Cook <keescook@chromium.org>
> Cc: Bjorn Helgaas <bhelgaas@google.com>
> ---
> arch/x86/mm/dump_pagetables.c | 35 +++++++++++++++++++++++++++--------
> 1 file changed, 27 insertions(+), 8 deletions(-)
>
> --- a/arch/x86/mm/dump_pagetables.c
> +++ b/arch/x86/mm/dump_pagetables.c
> @@ -19,7 +19,9 @@
> #include <linux/sched.h>
> #include <linux/seq_file.h>
> #include <linux/highmem.h>
> +#include <linux/pci.h>
>
> +#include <asm/e820/types.h>
> #include <asm/pgtable.h>
>
> /*
> @@ -241,6 +243,29 @@ static unsigned long normalize_addr(unsi
> return (signed long)(u << shift) >> shift;
> }
>
> +static void note_wx(struct pg_state *st)
> +{
> + unsigned long npages;
> +
> + npages = (st->current_address - st->start_address) / PAGE_SIZE;
> +
> +#ifdef CONFIG_PCI_BIOS
> + /*
> + * If PCI BIOS is enabled, the PCI BIOS area is forced to WX.
> + * Inform about it, but avoid the warning.
> + */
> + if (pcibios_enabled && st->start_address >= PAGE_OFFSET + BIOS_BEGIN &&
> + st->current_address <= PAGE_OFFSET + BIOS_END) {
> + pr_warn_once("x86/mm: PCI BIOS W+X mapping %lu pages\n", npages);
> + return;
> + }
> +#endif
> + /* Account the WX pages */
> + st->wx_pages += npages;
> + WARN_ONCE(1, "x86/mm: Found insecure W+X mapping at address %p/%pS\n",
> + (void *)st->start_address, (void *)st->start_address);
Probably we should just drop the "%p/" part. %pS should give us
everything we need and %p will be meaningless normally.
Otherwise, yes, this look good.
-Kees
--
Kees Cook
Pixel Security
^ permalink raw reply [flat|nested] 5+ messages in thread* [tip:x86/mm] x86/mm: Do not warn about PCI BIOS W+X mappings
2018-10-08 19:53 [PATCH] x86/mm: Do not warn about PCI BIOS W+X mappings Thomas Gleixner
2018-10-08 20:01 ` Borislav Petkov
2018-10-09 0:00 ` Kees Cook
@ 2018-10-10 13:18 ` tip-bot for Thomas Gleixner
2018-10-11 23:23 ` [PATCH] " Paul Menzel
3 siblings, 0 replies; 5+ messages in thread
From: tip-bot for Thomas Gleixner @ 2018-10-10 13:18 UTC (permalink / raw)
To: linux-tip-commits
Cc: tglx, mingo, joro, linux-kernel, hpa, keescook, bp, pmenzel, bhelgaas
Commit-ID: c200dac78fec66d87ef262cac38cfe4feabdf737
Gitweb: https://git.kernel.org/tip/c200dac78fec66d87ef262cac38cfe4feabdf737
Author: Thomas Gleixner <tglx@linutronix.de>
AuthorDate: Mon, 8 Oct 2018 21:53:48 +0200
Committer: Thomas Gleixner <tglx@linutronix.de>
CommitDate: Wed, 10 Oct 2018 15:16:13 +0200
x86/mm: Do not warn about PCI BIOS W+X mappings
PCI BIOS requires the BIOS area 0x0A0000-0x0FFFFFF to be mapped W+X for
various legacy reasons. When CONFIG_DEBUG_WX is enabled, this triggers the
WX warning, but this is misleading because the mapping is required and is
not a result of an accidental oversight.
Prevent the full warning when PCI BIOS is enabled and the detected WX
mapping is in the BIOS area. Just emit a pr_warn() which denotes the
fact. This is partially duplicating the info which the PCI BIOS code emits
when it maps the area as executable, but that info is not in the context of
the WX checking output.
Remove the extra %p printout in the WARN_ONCE() while at it. %pS is enough.
Reported-by: Paul Menzel <pmenzel@molgen.mpg.de>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Tested-by: Borislav Petkov <bp@suse.de>
Cc: Joerg Roedel <joro@8bytes.org>
Cc: Kees Cook <keescook@chromium.org>
Cc: Bjorn Helgaas <bhelgaas@google.com>
Link: https://lkml.kernel.org/r/alpine.DEB.2.21.1810082151160.2455@nanos.tec.linutronix.de
---
arch/x86/mm/dump_pagetables.c | 35 +++++++++++++++++++++++++++--------
1 file changed, 27 insertions(+), 8 deletions(-)
diff --git a/arch/x86/mm/dump_pagetables.c b/arch/x86/mm/dump_pagetables.c
index a12afff146d1..fc37bbd23eb8 100644
--- a/arch/x86/mm/dump_pagetables.c
+++ b/arch/x86/mm/dump_pagetables.c
@@ -19,7 +19,9 @@
#include <linux/sched.h>
#include <linux/seq_file.h>
#include <linux/highmem.h>
+#include <linux/pci.h>
+#include <asm/e820/types.h>
#include <asm/pgtable.h>
/*
@@ -241,6 +243,29 @@ static unsigned long normalize_addr(unsigned long u)
return (signed long)(u << shift) >> shift;
}
+static void note_wx(struct pg_state *st)
+{
+ unsigned long npages;
+
+ npages = (st->current_address - st->start_address) / PAGE_SIZE;
+
+#ifdef CONFIG_PCI_BIOS
+ /*
+ * If PCI BIOS is enabled, the PCI BIOS area is forced to WX.
+ * Inform about it, but avoid the warning.
+ */
+ if (pcibios_enabled && st->start_address >= PAGE_OFFSET + BIOS_BEGIN &&
+ st->current_address <= PAGE_OFFSET + BIOS_END) {
+ pr_warn_once("x86/mm: PCI BIOS W+X mapping %lu pages\n", npages);
+ return;
+ }
+#endif
+ /* Account the WX pages */
+ st->wx_pages += npages;
+ WARN_ONCE(1, "x86/mm: Found insecure W+X mapping at address %pS\n",
+ (void *)st->start_address);
+}
+
/*
* This function gets called on a break in a continuous series
* of PTE entries; the next one is different so we need to
@@ -276,14 +301,8 @@ static void note_page(struct seq_file *m, struct pg_state *st,
unsigned long delta;
int width = sizeof(unsigned long) * 2;
- if (st->check_wx && (eff & _PAGE_RW) && !(eff & _PAGE_NX)) {
- WARN_ONCE(1,
- "x86/mm: Found insecure W+X mapping at address %p/%pS\n",
- (void *)st->start_address,
- (void *)st->start_address);
- st->wx_pages += (st->current_address -
- st->start_address) / PAGE_SIZE;
- }
+ if (st->check_wx && (eff & _PAGE_RW) && !(eff & _PAGE_NX))
+ note_wx(st);
/*
* Now print the actual finished series
^ permalink raw reply related [flat|nested] 5+ messages in thread* Re: [PATCH] x86/mm: Do not warn about PCI BIOS W+X mappings
2018-10-08 19:53 [PATCH] x86/mm: Do not warn about PCI BIOS W+X mappings Thomas Gleixner
` (2 preceding siblings ...)
2018-10-10 13:18 ` [tip:x86/mm] " tip-bot for Thomas Gleixner
@ 2018-10-11 23:23 ` Paul Menzel
3 siblings, 0 replies; 5+ messages in thread
From: Paul Menzel @ 2018-10-11 23:23 UTC (permalink / raw)
To: Thomas Gleixner, LKML; +Cc: x86, Joerg Roedel, Kees Cook, Bjorn Helgaas
Dear Thomas,
Am 08.10.2018 um 21:53 schrieb Thomas Gleixner:
> PCI BIOS requires the BIOS area 0x0A0000-0x0FFFFFF to be mapped W+X for
> various legacy reasons. When CONFIG_DEBUG_WX is enabled, this triggers the
> WX warning, but this is misleading because the mapping is required and is
> not a result of an accidental oversight.
>
> Prevent the full warning when PCI BIOS is enabled and the detected WX
> mapping is in the BIOS area. Just emit a pr_warn() which denotes the
> fact. This is partially duplicating the info which the PCI BIOS code emits
> when it maps the area as executable, but that info is not in the context of
> the WX checking output.
>
> Reported-by: Paul Menzel <pmenzel@molgen.mpg.de>
> Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
> Cc: Joerg Roedel <joro@8bytes.org>
> Cc: Kees Cook <keescook@chromium.org>
> Cc: Bjorn Helgaas <bhelgaas@google.com>
> ---
> arch/x86/mm/dump_pagetables.c | 35 +++++++++++++++++++++++++++--------
> 1 file changed, 27 insertions(+), 8 deletions(-)
Thank you for the patch. I tested it on the ASRock E350M1 with coreboot
and the SeaBIOS payload, and the insecure warning is gone.
Tested-by: Paul Menzel <pmenzel@molgen.mpg.de>
Should this be tagged for the stable series?
Kind regards,
Paul
^ permalink raw reply [flat|nested] 5+ messages in thread