Bug 12071 - nx not enabled with 32/64bit PAE when forced off in BIOS
Summary: nx not enabled with 32/64bit PAE when forced off in BIOS
Status: REJECTED INVALID
Alias: None
Product: Platform Specific/Hardware
Classification: Unclassified
Component: i386 (show other bugs)
Hardware: All Linux
: P1 enhancement
Assignee: platform_i386
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2008-11-20 15:47 UTC by Kees Cook
Modified: 2008-11-21 10:38 UTC (History)
0 users

See Also:
Kernel Version: 2.6.27
Subsystem:
Regression: ---
Bisected commit-id:


Attachments
NX test case (43 bytes, text/plain)
2008-11-20 15:47 UTC, Kees Cook
Details

Description Kees Cook 2008-11-20 15:47:11 UTC
Latest working kernel version: unknown
Earliest failing kernel version: 2.6.24
Distribution: Ubuntu
Hardware Environment: Dell laptops, Intel CPUs T7250 and T5750
Software Environment: Ubuntu 8.04 (Hardy), Ubuntu 8.10 (Intrepid)
Problem Description:

When running 32bit PAE, the non-exec memory protection feature ("nx") does not appear to be activated on certain CPU models. With the 32bit -server kernel (PAE enabled) installed and booted, the attached program is expected to segfault. Some machines in this configuration are not correctly faulting.

Another way to detect the failure is seeing "nx" in "flags" in /proc/cpuinfo, but dmesg lacking the text:
NX (Execute Disable) protection: active

At first guess, it seems to be CPU model related. So far, the following Intel CPUs fail to segfault: T7250 and T5750. Operating correctly is a T7500.

I suspect that the "set_nx" routine in arch/x86/mm/init_32.c is perhaps mis-detecting the feature.

Steps to reproduce:

$ ./nx unsafe
b7f3a000-b7f3d000 rw-p b7f3a000 00:00 0
Running heap...
Executed

Instead of "Executed", I would expect "Segmentation Fault".
Comment 1 Kees Cook 2008-11-20 15:47:49 UTC
Created attachment 18959 [details]
NX test case
Comment 2 Kees Cook 2008-11-20 16:08:03 UTC
Also noted that on the T5750, "nx" only shows up on CPU1:

$ grep flags /proc/cpuinfo
flags : fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush dts acpi mmx fxsr sse sse2 ss ht tm pbe lm constant_tsc arch_perfmon pebs bts pni monitor ds_cpl est tm2 ssse3 cx16 xtpr lahf_lm
flags : fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush dts acpi mmx fxsr sse sse2 ss ht tm pbe nx lm constant_tsc arch_perfmon pebs bts pni monitor ds_cpl est tm2 ssse3 cx16 xtpr lahf_lm

(re: Regression tag, it is possible this has never worked for whatever CPUs are seeing this issue.)
Comment 3 Kees Cook 2008-11-20 16:29:50 UTC
Ah-ha, thanks to a hint from Arjan, it seems this is a BIOS override.  On another Dell I was able to disable nx by turning of the "CPU XD Support" under "Security".  Is there some way to work around this, perhaps?
Comment 4 Alan 2008-11-21 10:38:09 UTC
Linux honours the BIOS. That is what was clearly desired by users.

Note You need to log in before you can comment on or make changes to this bug.