Re: [PATCH] x86/mm: Set NX bit when making pages present

[Dave Hansen <dave.hansen@intel.com>]

[-- Attachment #1: Type: text/plain, Size: 822 bytes --]

On 9/19/22 11:14, Edgecombe, Rick P wrote:
> Clearly somehow it is though. The original report has this in the log:
> Notice: NX (Execute Disable) protection cannot be enabled: non-PAE
> kernel!

Ah, crud.  Nice catch, btw.

So, the CPU has NX, making cpu_feature_enabled(X86_FEATURE_NX)==1, but
the page table mode does not have support.

I guess we can either clear X86_FEATURE_NX around the "protection cannot
be enabled" message, or do something like the attached patch and just do
the check at runtime.

I'm not sure we want to mess with X86_FEATURE_NX itself.  It seems to
get used for a few different things, including on the KVM side.

0day folks, can you see if _this_ one (totally untested) helps the
situation?  At least this is a real oddball case.  It's not something
that folks are very likely to hit at all.

[-- Attachment #2: nx.patch --]
[-- Type: text/x-patch, Size: 923 bytes --]

diff --git a/arch/x86/kernel/setup.c b/arch/x86/kernel/setup.c
index 216fee7144ee..005492257abb 100644
--- a/arch/x86/kernel/setup.c
+++ b/arch/x86/kernel/setup.c
@@ -844,6 +844,7 @@ static void __init x86_report_nx(void)
 		/* 32bit non-PAE kernel, NX cannot be used */
 		printk(KERN_NOTICE "Notice: NX (Execute Disable) protection "
 		       "cannot be enabled: non-PAE kernel!\n");
+		__supported_pte_mask &= ~_PAGE_NX;
 #endif
 	}
 }
diff --git a/arch/x86/mm/pat/set_memory.c b/arch/x86/mm/pat/set_memory.c
index 1a2d6376251c..f8162fe94bd0 100644
--- a/arch/x86/mm/pat/set_memory.c
+++ b/arch/x86/mm/pat/set_memory.c
@@ -587,7 +587,7 @@ static inline pgprot_t verify_rwx(pgprot_t old, pgprot_t new, unsigned long star
 {
 	unsigned long end;
 
-	if (!cpu_feature_enabled(X86_FEATURE_NX))
+	if (!(__supported_pte_mask & _PAGE_NX))
 		return new;
 
 	if (!((pgprot_val(old) ^ pgprot_val(new)) & (_PAGE_RW | _PAGE_NX)))