From owner-freebsd-current@FreeBSD.ORG Tue Oct 18 17:06:29 2011 Return-Path: Delivered-To: current@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 6B2AE106564A for ; Tue, 18 Oct 2011 17:06:29 +0000 (UTC) (envelope-from lacombar@gmail.com) Received: from mail-ww0-f50.google.com (mail-ww0-f50.google.com [74.125.82.50]) by mx1.freebsd.org (Postfix) with ESMTP id EA7FE8FC0A for ; Tue, 18 Oct 2011 17:06:28 +0000 (UTC) Received: by wwi18 with SMTP id 18so1166602wwi.31 for ; Tue, 18 Oct 2011 10:06:27 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type:content-transfer-encoding; bh=D8N4hHURXWdDoKqFcTR8Nf3cufhNTcYgldXtG8Oqxqw=; b=IvgHmpcY5u/0GYc8Ce6g2YZELX8Yc5w2TEwbk+Ks2vuJrni2BYasKQVk3ARoT7zyit AUl770iUmemUQBFOGI+nato50M5qdmx1Xb2WAk5xqcdzo2JjaGOGOOODjdzX8naM66Ie KWI2I371uH3T2zDJnrPlq/AUa0Ee/NsK49Eho= MIME-Version: 1.0 Received: by 10.227.141.201 with SMTP id n9mr1102427wbu.49.1318957587381; Tue, 18 Oct 2011 10:06:27 -0700 (PDT) Received: by 10.180.103.198 with HTTP; Tue, 18 Oct 2011 10:06:27 -0700 (PDT) In-Reply-To: References: <20111018090750.GG50300@deviant.kiev.zoral.com.ua> Date: Tue, 18 Oct 2011 13:06:27 -0400 Message-ID: From: Arnaud Lacombe To: Oliver Pinter Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: quoted-printable Cc: Garrett Cooper , Kostik Belousov , current@freebsd.org Subject: Re: [RFC] Enable nxstack by default X-BeenThere: freebsd-current@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Discussions about the use of FreeBSD-current List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 18 Oct 2011 17:06:29 -0000 Hi, On Tue, Oct 18, 2011 at 12:53 PM, Oliver Pinter wro= te: > On 10/18/11, Arnaud Lacombe wrote: >> Hi, >> >> On Tue, Oct 18, 2011 at 11:44 AM, Garrett Cooper wr= ote: >>> On Tue, 18 Oct 2011, Arnaud Lacombe wrote: >>> >>>> Hi, >>>> >>>> On Tue, Oct 18, 2011 at 5:07 AM, Kostik Belousov >>>> wrote: >>>>> >>>>> On Mon, Oct 17, 2011 at 09:30:56PM +0200, Oliver Pinter wrote: >>>>>> >>>>>> Hi all! >>>>>> >>>>>> I think, it's the time to enable the nxstack feature. Any comments, >>>>>> pros, cons? >>>>> >>>>> I dragged the change long enough for it to miss the 9.0. >>>>> After the 9.0 is released, I will flip the switch with the following >>>>> change. >>>>> >>>>> diff --git a/sys/kern/imgact_elf.c b/sys/kern/imgact_elf.c >>>>> index 8455f48..926fe64 100644 >>>>> --- a/sys/kern/imgact_elf.c >>>>> +++ b/sys/kern/imgact_elf.c >>>>> @@ -118,7 +118,12 @@ static int elf_legacy_coredump =3D 0; >>>>> =A0SYSCTL_INT(_debug, OID_AUTO, __elfN(legacy_coredump), CTLFLAG_RW, >>>>> =A0 =A0 &elf_legacy_coredump, 0, ""); >>>>> >>>>> -static int __elfN(nxstack) =3D 0; >>>>> +int __elfN(nxstack) =3D >>>>> +#if defined(__amd64__) || defined(__powerpc64__) /* both 64 and 32 b= it >>>>> */ >>>>> >>>> Why leaving 32bits x86 CPU supporting the NX feature behind ? >>> >>> Most likely because it was assumed that i386 doesn't fully support it. >>> According to ye great Wikipedia, NX support didn't roll into i386 until >>> Prescott, which was pretty late in the non-64-bit capable family of CPU= s, >>> as >>> its successor -- Conroe -- was 64-bit. Intel detuned some of the early >>> Dual >>> Core Pentiums, e.g. the Yonahs to not talk 64-bit. Not sure about AMD. >>> >>> There are probably more details in binutils, gcc, etc, that I'm missing >>> and >>> Kostik can expound on. >>> >> NX support is advertised in the cpuid flags, just add the logic to >> handle this interface. Kostik's patch is just incomplete, but he's got >> a commit bit so he can commit it as-is, as he will. >> >> If nonexec_stack becomes the default, it should be on every CPU >> supporting the feature, not just the low-hanging one. >> >> =A0- Arnaud >> > > the NX detection code already implemented in i386, but this feature > required PAE: > yes, this is the conclusion I reached too. But this does not change the fact that the VM should know about that, and this is missing from Kostik's patch. I guess the first hunk should read: @@ -118,7 +118,12 @@ static int elf_legacy_coredump =3D 0; SYSCTL_INT(_debug, OID_AUTO, __elfN(legacy_coredump), CTLFLAG_RW, &elf_legacy_coredump, 0, ""); -static int __elfN(nxstack) =3D 0; +int __elfN(nxstack) =3D +#if defined(PAE) || defined(__amd64__) || defined(__powerpc64__) /* both 64 and 32 bit */ + 1; +#else + 0; +#endif SYSCTL_INT(__CONCAT(_kern_elf, __ELF_WORD_SIZE), OID_AUTO, nxstack, CTLFLAG_RW, &__elfN(nxstack), 0, __XSTRING(__CONCAT(ELF, __ELF_WORD_SIZE)) ": enable non-executable stac= k"); - Arnaud