Commit 4763ed4d authored by H. Peter Anvin's avatar H. Peter Anvin
Browse files

x86, mm: Clean up and simplify NX enablement 



The 32- and 64-bit code used very different mechanisms for enabling
NX, but even the 32-bit code was enabling NX in head_32.S if it is
available.  Furthermore, we had a bewildering collection of tests for
the available of NX.

This patch:

a) merges the 32-bit set_nx() and the 64-bit check_efer() function
   into a single x86_configure_nx() function.  EFER control is left
   to the head code.

b) eliminates the nx_enabled variable entirely.  Things that need to
   test for NX enablement can verify __supported_pte_mask directly,
   and cpu_has_nx gives the supported status of NX.

Signed-off-by: default avatarH. Peter Anvin <hpa@zytor.com>
Cc: Tejun Heo <tj@kernel.org>
Cc: Brian Gerst <brgerst@gmail.com>
Cc: Yinghai Lu <yinghai@kernel.org>
Cc: Pekka Enberg <penberg@cs.helsinki.fi>
Cc: Vegard Nossum <vegardno@ifi.uio.no>
Cc: Jeremy Fitzhardinge <jeremy.fitzhardinge@citrix.com>
Cc: Chris Wright <chrisw@sous-sol.org>
LKML-Reference: <1258154897-6770-5-git-send-email-hpa@zytor.com>
Acked-by: default avatarKees Cook <kees.cook@canonical.com>
parent 583140af

arch/x86/include/asm/proto.h

+1 −1
Original line number Diff line number Diff line
@@ -16,7 +16,7 @@ extern void ia32_sysenter_target(void); 


extern void syscall32_cpu_init(void);



extern void check_efer(void);

extern void x86_configure_nx(void);



extern int reboot_force;

arch/x86/kernel/cpu/common.c

+1 −1
Original line number Diff line number Diff line
@@ -1136,7 +1136,7 @@ void __cpuinit cpu_init(void) 
	wrmsrl(MSR_KERNEL_GS_BASE, 0);

	barrier();



	check_efer();

	x86_configure_nx();

	if (cpu != 0)

		enable_x2apic();

arch/x86/kernel/setup.c

+2 −6
Original line number Diff line number Diff line
@@ -787,21 +787,17 @@ void __init setup_arch(char **cmdline_p) 
	strlcpy(command_line, boot_command_line, COMMAND_LINE_SIZE);

	*cmdline_p = command_line;



#ifdef CONFIG_X86_64

	/*

	 * Must call this twice: Once just to detect whether hardware doesn't

	 * support NX (so that the early EHCI debug console setup can safely

	 * call set_fixmap(), and then again after parsing early parameters to

	 * honor the respective command line option.

	 */

	check_efer();

#endif

	x86_configure_nx();



	parse_early_param();



#ifdef CONFIG_X86_64

	check_efer();

#endif

	x86_configure_nx();



	/* Must be before kernel pagetables are setup */

	vmi_activate();

arch/x86/mm/init.c

+2 −2
Original line number Diff line number Diff line
@@ -146,8 +146,8 @@ unsigned long __init_refok init_memory_mapping(unsigned long start, 
	use_gbpages = direct_gbpages;

#endif



	set_nx();

	if (nx_enabled)

	/* XXX: replace this with Kees' improved messages */

	if (__supported_pte_mask & _PAGE_NX)

		printk(KERN_INFO "NX (Execute Disable) protection: active\n");



	/* Enable PSE if available */

arch/x86/mm/setup_nx.c

+6 −37
Original line number Diff line number Diff line
@@ -3,10 +3,8 @@ 
#include <linux/init.h>



#include <asm/pgtable.h>

#include <asm/proto.h>



int nx_enabled;



#if defined(CONFIG_X86_64) || defined(CONFIG_X86_PAE)

static int disable_nx __cpuinitdata;



/*
@@ -22,48 +20,19 @@ static int __init noexec_setup(char *str) 
	if (!str)

		return -EINVAL;

	if (!strncmp(str, "on", 2)) {

		__supported_pte_mask |= _PAGE_NX;

		disable_nx = 0;

	} else if (!strncmp(str, "off", 3)) {

		disable_nx = 1;

		__supported_pte_mask &= ~_PAGE_NX;

	}

	x86_configure_nx();

	return 0;

}

early_param("noexec", noexec_setup);

#endif



#ifdef CONFIG_X86_PAE

void __init set_nx(void)

void __cpuinit x86_configure_nx(void)

{

	unsigned int v[4], l, h;



	if (cpu_has_pae && (cpuid_eax(0x80000000) > 0x80000001)) {

		cpuid(0x80000001, &v[0], &v[1], &v[2], &v[3]);



		if ((v[3] & (1 << 20)) && !disable_nx) {

			rdmsr(MSR_EFER, l, h);

			l |= EFER_NX;

			wrmsr(MSR_EFER, l, h);

			nx_enabled = 1;

	if (cpu_has_nx && !disable_nx)

		__supported_pte_mask |= _PAGE_NX;

		}

	}

}

#else

void set_nx(void)

{

}

#endif



#ifdef CONFIG_X86_64

void __cpuinit check_efer(void)

{

	unsigned long efer;



	rdmsrl(MSR_EFER, efer);

	if (!(efer & EFER_NX) || disable_nx)

	else

		__supported_pte_mask &= ~_PAGE_NX;

}
 
#endif

CRA Git | Maintained and supported by SUSTech CRA and CCSE