From owner-freebsd-current@FreeBSD.ORG Tue Oct 18 22:37:45 2011 Return-Path: Delivered-To: current@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 8CC0D1065675 for ; Tue, 18 Oct 2011 22:37:45 +0000 (UTC) (envelope-from oliver.pntr@gmail.com) Received: from mail-yw0-f54.google.com (mail-yw0-f54.google.com [209.85.213.54]) by mx1.freebsd.org (Postfix) with ESMTP id 444458FC18 for ; Tue, 18 Oct 2011 22:37:44 +0000 (UTC) Received: by ywm3 with SMTP id 3so1389374ywm.13 for ; Tue, 18 Oct 2011 15:37:44 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type:content-transfer-encoding; bh=lntKN5jiMCcTctZSaj4bMtn8j0REapJ8oCICR8HXBXc=; b=dlSbBXDsmEHgiHa7+f/Kdcs3dEIk1qRT6u4VjglxWTapl49uLztZoe4Q1ZBBeV8eNr gaRw1wZ2OKlm1dfrwAul6AqsF926WUqg8C334OIhQlVrfpi5PsvZM0DUvbX3LHhPCmOQ A4/tlhu8Cvdc6gx//+bIVNjdGIJ4/MHdyUtA0= MIME-Version: 1.0 Received: by 10.182.227.41 with SMTP id rx9mr749329obc.12.1318977464403; Tue, 18 Oct 2011 15:37:44 -0700 (PDT) Received: by 10.182.144.73 with HTTP; Tue, 18 Oct 2011 15:37:44 -0700 (PDT) In-Reply-To: References: <20111018090750.GG50300@deviant.kiev.zoral.com.ua> <20111018183219.GN50300@deviant.kiev.zoral.com.ua> Date: Wed, 19 Oct 2011 00:37:44 +0200 Message-ID: From: Oliver Pinter To: Arnaud Lacombe Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: quoted-printable Cc: Kostik Belousov , Garrett Cooper , current@freebsd.org Subject: Re: [RFC] Enable nxstack by default X-BeenThere: freebsd-current@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Discussions about the use of FreeBSD-current List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 18 Oct 2011 22:37:45 -0000 In NetBSD has been some PaX feature [0] implemented. (ASLR, W^X (~nxstack), mprotect restriction, veriexec, mmap randomization[2]...) [0] http://pax.grsecurity.net/docs/index.html [1] http://www.netbsd.org/~elad/recent/man/security.8.html [2] http://people.freebsd.org/~ssouhlal/testing/stackgap-20050527.diff On 10/19/11, Arnaud Lacombe wrote: > Hi, > > 2011/10/18 Kostik Belousov : >> On Tue, Oct 18, 2011 at 01:06:27PM -0400, Arnaud Lacombe wrote: >>> Hi, >>> >>> On Tue, Oct 18, 2011 at 12:53 PM, Oliver Pinter >>> wrote: >>> > On 10/18/11, Arnaud Lacombe wrote: >>> >> Hi, >>> >> >>> >> On Tue, Oct 18, 2011 at 11:44 AM, Garrett Cooper >>> >> wrote: >>> >>> On Tue, 18 Oct 2011, Arnaud Lacombe wrote: >>> >>> >>> >>>> Hi, >>> >>>> >>> >>>> On Tue, Oct 18, 2011 at 5:07 AM, Kostik Belousov >>> >>>> >>> >>>> wrote: >>> >>>>> >>> >>>>> On Mon, Oct 17, 2011 at 09:30:56PM +0200, Oliver Pinter wrote: >>> >>>>>> >>> >>>>>> Hi all! >>> >>>>>> >>> >>>>>> I think, it's the time to enable the nxstack feature. Any >>> >>>>>> comments, >>> >>>>>> pros, cons? >>> >>>>> >>> >>>>> I dragged the change long enough for it to miss the 9.0. >>> >>>>> After the 9.0 is released, I will flip the switch with the >>> >>>>> following >>> >>>>> change. >>> >>>>> >>> >>>>> diff --git a/sys/kern/imgact_elf.c b/sys/kern/imgact_elf.c >>> >>>>> index 8455f48..926fe64 100644 >>> >>>>> --- a/sys/kern/imgact_elf.c >>> >>>>> +++ b/sys/kern/imgact_elf.c >>> >>>>> @@ -118,7 +118,12 @@ static int elf_legacy_coredump =3D 0; >>> >>>>> =A0SYSCTL_INT(_debug, OID_AUTO, __elfN(legacy_coredump), CTLFLAG_= RW, >>> >>>>> =A0 =A0 &elf_legacy_coredump, 0, ""); >>> >>>>> >>> >>>>> -static int __elfN(nxstack) =3D 0; >>> >>>>> +int __elfN(nxstack) =3D >>> >>>>> +#if defined(__amd64__) || defined(__powerpc64__) /* both 64 and = 32 >>> >>>>> bit >>> >>>>> */ >>> >>>>> >>> >>>> Why leaving 32bits x86 CPU supporting the NX feature behind ? >>> >>> >>> >>> Most likely because it was assumed that i386 doesn't fully support >>> >>> it. >>> >>> According to ye great Wikipedia, NX support didn't roll into i386 >>> >>> until >>> >>> Prescott, which was pretty late in the non-64-bit capable family of >>> >>> CPUs, >>> >>> as >>> >>> its successor -- Conroe -- was 64-bit. Intel detuned some of the >>> >>> early >>> >>> Dual >>> >>> Core Pentiums, e.g. the Yonahs to not talk 64-bit. Not sure about >>> >>> AMD. >>> >>> >>> >>> There are probably more details in binutils, gcc, etc, that I'm >>> >>> missing >>> >>> and >>> >>> Kostik can expound on. >>> >>> >>> >> NX support is advertised in the cpuid flags, just add the logic to >>> >> handle this interface. Kostik's patch is just incomplete, but he's g= ot >>> >> a commit bit so he can commit it as-is, as he will. >>> >> >>> >> If nonexec_stack becomes the default, it should be on every CPU >>> >> supporting the feature, not just the low-hanging one. >>> >> >>> >> =A0- Arnaud >>> >> >>> > >>> > the NX detection code already implemented in i386, but this feature >>> > required PAE: >>> > >>> yes, this is the conclusion I reached too. But this does not change >>> the fact that the VM should know about that, and this is missing from >>> Kostik's patch. I guess the first hunk should read: >>> >>> @@ -118,7 +118,12 @@ static int elf_legacy_coredump =3D 0; >>> =A0SYSCTL_INT(_debug, OID_AUTO, __elfN(legacy_coredump), CTLFLAG_RW, >>> =A0 =A0 &elf_legacy_coredump, 0, ""); >>> >>> -static int __elfN(nxstack) =3D 0; >>> +int __elfN(nxstack) =3D >>> +#if defined(PAE) || defined(__amd64__) || defined(__powerpc64__) /* >>> both 64 and 32 bit */ >>> + =A0 =A0 =A0 1; >>> +#else >>> + =A0 =A0 =A0 0; >>> +#endif >>> =A0SYSCTL_INT(__CONCAT(_kern_elf, __ELF_WORD_SIZE), OID_AUTO, >>> =A0 =A0 nxstack, CTLFLAG_RW, &__elfN(nxstack), 0, >>> =A0 =A0 __XSTRING(__CONCAT(ELF, __ELF_WORD_SIZE)) ": enable non-executa= ble >>> stack"); >> >> Your patch is not right, it will cause even more user confusion. >> The presence of the PAE kernel does not imply that CPU supports nx. >> >> Below is the updated patch that turns on nxstack by default for the PAE >> kernels on NX-capable CPUs. Note that i386 usermode fully supports the >> PT_GNU_STACK annotations and cares about not enabling nx on stack pages >> unneccessary, but my main target was compat32 on amd64. >> >> The fact that nxstack is not enabled by default does not prevent >> administrator from manually enabling the feature. >> >> Since you worried so much about PAE case, I sincerely expect that you >> will test the change. Thank you in advance. >> > I will. > > Btw, NetBSD has been going down the path of system unit test, > especially of kernel/userland interfaces, and already worked-out the > framework for that. Is that something FreeBSD would be interested in ? > > Thanks, > - Arnaud > >> diff --git a/sys/i386/i386/initcpu.c b/sys/i386/i386/initcpu.c >> index c2daf54..ec77adb 100644 >> --- a/sys/i386/i386/initcpu.c >> +++ b/sys/i386/i386/initcpu.c >> @@ -650,6 +650,8 @@ enable_sse(void) >> =A0#endif >> =A0} >> >> +extern int elf32_nxstack; >> + >> =A0void >> =A0initializecpu(void) >> =A0{ >> @@ -739,6 +741,7 @@ initializecpu(void) >> =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0msr =3D rdmsr(MSR_EFER) |= EFER_NXE; >> =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0wrmsr(MSR_EFER, msr); >> =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0pg_nx =3D PG_NX; >> + =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 elf32_nxstack =3D 1; >> =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0} >> =A0#endif >> =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0break; >> diff --git a/sys/kern/imgact_elf.c b/sys/kern/imgact_elf.c >> index 8455f48..926fe64 100644 >> --- a/sys/kern/imgact_elf.c >> +++ b/sys/kern/imgact_elf.c >> @@ -118,7 +118,12 @@ static int elf_legacy_coredump =3D 0; >> =A0SYSCTL_INT(_debug, OID_AUTO, __elfN(legacy_coredump), CTLFLAG_RW, >> =A0 =A0 &elf_legacy_coredump, 0, ""); >> >> -static int __elfN(nxstack) =3D 0; >> +int __elfN(nxstack) =3D >> +#if defined(__amd64__) || defined(__powerpc64__) /* both 64 and 32 bit = */ >> + =A0 =A0 =A0 1; >> +#else >> + =A0 =A0 =A0 0; >> +#endif >> =A0SYSCTL_INT(__CONCAT(_kern_elf, __ELF_WORD_SIZE), OID_AUTO, >> =A0 =A0 nxstack, CTLFLAG_RW, &__elfN(nxstack), 0, >> =A0 =A0 __XSTRING(__CONCAT(ELF, __ELF_WORD_SIZE)) ": enable non-executab= le >> stack"); >> diff --git a/sys/powerpc/aim/mmu_oea64.c b/sys/powerpc/aim/mmu_oea64.c >> index 7500462..0e27351 100644 >> --- a/sys/powerpc/aim/mmu_oea64.c >> +++ b/sys/powerpc/aim/mmu_oea64.c >> @@ -1445,6 +1445,8 @@ moea64_uma_page_alloc(uma_zone_t zone, int bytes, >> u_int8_t *flags, int wait) >> =A0 =A0 =A0 =A0return (void *)va; >> =A0} >> >> +extern int elf32_nxstack; >> + >> =A0void >> =A0moea64_init(mmu_t mmu) >> =A0{ >> @@ -1464,6 +1466,8 @@ moea64_init(mmu_t mmu) >> >> =A0uma_zone_set_allocf(moea64_mpvo_zone,moea64_uma_page_alloc); >> =A0 =A0 =A0 =A0} >> >> + =A0 =A0 =A0 elf32_nxstack =3D 1; >> + >> =A0 =A0 =A0 =A0moea64_initialized =3D TRUE; >> =A0} >> >> diff --git a/sys/powerpc/booke/machdep.c b/sys/powerpc/booke/machdep.c >> index c2b5e6f..82a37e1 100644 >> --- a/sys/powerpc/booke/machdep.c >> +++ b/sys/powerpc/booke/machdep.c >> @@ -192,6 +192,8 @@ void print_kernel_section_addr(void); >> =A0void print_kenv(void); >> =A0u_int booke_init(uint32_t, uint32_t); >> >> +extern int elf32_nxstack; >> + >> =A0static void >> =A0cpu_e500_startup(void *dummy) >> =A0{ >> @@ -227,6 +229,9 @@ cpu_e500_startup(void *dummy) >> =A0 =A0 =A0 =A0/* Set up buffers, so they can be used to read disk label= s. */ >> =A0 =A0 =A0 =A0bufinit(); >> =A0 =A0 =A0 =A0vm_pager_bufferinit(); >> + >> + =A0 =A0 =A0 /* Cpu supports execution permissions on the pages. */ >> + =A0 =A0 =A0 elf32_nxstack =3D 1; >> =A0} >> >> =A0static char * >> >