From nobody Mon Apr 6 21:33:51 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id ECED5ECAAD5 for ; Thu, 1 Sep 2022 18:17:17 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S233919AbiIASRQ (ORCPT ); Thu, 1 Sep 2022 14:17:16 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:41640 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234131AbiIASRJ (ORCPT ); Thu, 1 Sep 2022 14:17:09 -0400 Received: from galois.linutronix.de (Galois.linutronix.de [IPv6:2a0a:51c0:0:12e:550::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 21CDD7A755; Thu, 1 Sep 2022 11:17:07 -0700 (PDT) Date: Thu, 01 Sep 2022 18:17:03 -0000 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linutronix.de; s=2020; t=1662056225; h=from:from:sender:sender:reply-to:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=Y9GQDEkFf5qaOjyHLJiXUYg9GaIW5Sg6K87UHYjPCYo=; b=dU7MnFyPjGmuH8zo3HO4uLOjZpg5QHuPgGQeO+TjYgu/NPvQepxw5SywqtmGHDyIN+SmIT G6i2QMV7nCoh4MBgWb4QMQQwD4gsnDdh7LNpHt1yPhbk5/RVvxfNpg6G6QZEruYtIoKsC4 TpkF5waVFVAH8chrE/WulUjaFdqSsD3weKmVGtyC06MVXMfvWlpJ38tDgb2xjHeiovX473 k1LWykNKkMUwnVYvUkUGLGvPEB3EwdL9Quv8NIl1YyPydg7BPKZTgYwrVuXxQL5jW5Sbb0 35Gcc+G5JhZWHcbVLJ+d79ReFzKk5PHyr6zY730X15F9QImGtgtvhQOY/jQyKA== DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=linutronix.de; s=2020e; t=1662056225; h=from:from:sender:sender:reply-to:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=Y9GQDEkFf5qaOjyHLJiXUYg9GaIW5Sg6K87UHYjPCYo=; b=3mF8+8JENQFaB6yxPlV94/J/n7fhTNj5SKVcOnznecH4Fd8Slk6T6bdwuZ9Y7IvdoS2OA/ mMaCtVHtRs33NzAw== From: "tip-bot2 for Peter Zijlstra" Sender: tip-bot2@linutronix.de Reply-to: linux-kernel@vger.kernel.org To: linux-tip-commits@vger.kernel.org Subject: [tip: x86/mm] x86/mm: Refuse W^X violations Cc: "Peter Zijlstra (Intel)" , Dave Hansen , x86@kernel.org, linux-kernel@vger.kernel.org In-Reply-To: References: MIME-Version: 1.0 Message-ID: <166205622353.401.14415663682148720649.tip-bot2@tip-bot2> Robot-ID: Robot-Unsubscribe: Contact to get blacklisted from these emails Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org The following commit has been merged into the x86/mm branch of tip: Commit-ID: 652c5bf380ad018e15006a7f8349800245ddbbad Gitweb: https://git.kernel.org/tip/652c5bf380ad018e15006a7f834980024= 5ddbbad Author: Peter Zijlstra AuthorDate: Mon, 29 Aug 2022 12:18:03 +02:00 Committer: Dave Hansen CommitterDate: Thu, 01 Sep 2022 11:10:19 -07:00 x86/mm: Refuse W^X violations x86 has STRICT_*_RWX, but not even a warning when someone violates it. Add this warning and fully refuse the transition. Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Dave Hansen Link: https://lkml.kernel.org/r/YwySW3ROc21hN7g9@hirez.programming.kicks-as= s.net --- arch/x86/mm/pat/set_memory.c | 32 ++++++++++++++++++++++++++++++++ 1 file changed, 32 insertions(+) diff --git a/arch/x86/mm/pat/set_memory.c b/arch/x86/mm/pat/set_memory.c index 6a9043b..1a2d637 100644 --- a/arch/x86/mm/pat/set_memory.c +++ b/arch/x86/mm/pat/set_memory.c @@ -580,6 +580,33 @@ static inline pgprot_t static_protections(pgprot_t pro= t, unsigned long start, } =20 /* + * Validate and enforce strict W^X semantics. + */ +static inline pgprot_t verify_rwx(pgprot_t old, pgprot_t new, unsigned lon= g start, + unsigned long pfn, unsigned long npg) +{ + unsigned long end; + + if (!cpu_feature_enabled(X86_FEATURE_NX)) + return new; + + if (!((pgprot_val(old) ^ pgprot_val(new)) & (_PAGE_RW | _PAGE_NX))) + return new; + + if ((pgprot_val(new) & (_PAGE_RW | _PAGE_NX)) !=3D _PAGE_RW) + return new; + + end =3D start + npg * PAGE_SIZE - 1; + WARN_ONCE(1, "CPA refuse W^X violation: %016llx -> %016llx range: 0x%016l= x - 0x%016lx PFN %lx\n", + (unsigned long long)pgprot_val(old), + (unsigned long long)pgprot_val(new), + start, end, pfn); + + /* refuse the transition into WX */ + return old; +} + +/* * Lookup the page table entry for a virtual address in a specific pgd. * Return a pointer to the entry and the level of the mapping. */ @@ -885,6 +912,8 @@ static int __should_split_large_page(pte_t *kpte, unsig= ned long address, new_prot =3D static_protections(req_prot, lpaddr, old_pfn, numpages, psize, CPA_DETECT); =20 + new_prot =3D verify_rwx(old_prot, new_prot, lpaddr, old_pfn, numpages); + /* * If there is a conflict, split the large page. * @@ -1525,6 +1554,7 @@ repeat: =20 if (level =3D=3D PG_LEVEL_4K) { pte_t new_pte; + pgprot_t old_prot =3D pte_pgprot(old_pte); pgprot_t new_prot =3D pte_pgprot(old_pte); unsigned long pfn =3D pte_pfn(old_pte); =20 @@ -1536,6 +1566,8 @@ repeat: new_prot =3D static_protections(new_prot, address, pfn, 1, 0, CPA_PROTECT); =20 + new_prot =3D verify_rwx(old_prot, new_prot, address, pfn, 1); + new_prot =3D pgprot_clear_protnone_bits(new_prot); =20 /*