linux-kernel - Re: [PATCH 1/2] x86: Fix kernel panic when booting with XD disabled in uEFI firmware

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20151208122557.GA2518@codeblueprint.co.uk>
Date:	Tue, 8 Dec 2015 12:25:57 +0000
From:	Matt Fleming <matt@...eblueprint.co.uk>
To:	Kosuke Tatsukawa <tatsu@...jp.nec.com>
Cc:	Thomas Gleixner <tglx@...utronix.de>,
	Ingo Molnar <mingo@...hat.com>,
	"H. Peter Anvin" <hpa@...or.com>,
	"x86@...nel.org" <x86@...nel.org>,
	"linux-efi@...r.kernel.org" <linux-efi@...r.kernel.org>,
	"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
	Borislav Petkov <bp@...en8.de>
Subject: Re: [PATCH 1/2] x86: Fix kernel panic when booting with XD disabled
 in uEFI firmware

On Mon, 07 Dec, at 11:10:43PM, Kosuke Tatsukawa wrote:
> 
> Thank you pointing that out.
> 
> linux-4.4-rc3 booted without a problem on a real server even with XD
> turned off by the firmware.  I didn't notice this before because I was
> using an older version of the kernel on the real server, and doing
> investigation on a KVM guest.
> 
> The "noexec=off" kernel parameter still seems to come up with EFI
> runtime service disabled though.  Do you think this should be left alone
> as an disadvantage for using a bad option?

Good question.

I couldn't find any other examples of code that returns an error if
PAGE_NX isn't supported either by the hardware or via the noexec
command line option. Things like set_memory_x() and set_memory_nx()
return success without actually doing anything.

While I'm all for using hardware security features wherever possible,
such as force-enabling it in commit 04633df0c43d ("x86/cpu: Call
verify_cpu() after having entered long mode too"), if the user has
explicitly turned it off on the kernel command line, we should still
try and provide EFI services.

Borislav, what do you think about stripping PAGE_NX from 'page_flags'
in kernel_map_pages_in_pgd() if NX isn't supported, rather than
returning EINVAL? At least that way EFI runtime services would still
work.
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/