Messages in this thread | | | Date | Tue, 03 Oct 2023 14:53:17 -0700 | From | "H. Peter Anvin" <> | Subject | Re: [PATCH] x86_64: test that userspace stack is in fact NX |
| |
On October 3, 2023 1:46:20 PM PDT, Dave Hansen <dave.hansen@intel.com> wrote: >On 10/3/23 12:30, Ingo Molnar wrote: >> * Ingo Molnar <mingo@kernel.org> wrote: >>> Because not having NX in 2023 on any system that is threatened is a >>> big security vulnerability in itself, and whether the vendor or owner >>> intentionally did that or not doesn't really matter, and a failing >>> kernel testcase will be the least of their problems. >> BTW., it's also questionable whether the owner is *aware* of the fact that >> NX is not available: what if some kernel debug option cleared the NX flag, >> unintended, or there's some serious firmware bug? >> >> However unlikely those situations might be, I think unconditionally warning >> about NX not available is a very 2023 thing to do. > >100% agree for x86_64. Any sane x86_64 system has NX and the rest are >noise that can live with the error message, unless someone shows up with >a compelling reason why not. > >For 32-bit, the situation is reversed. The majority of 32-bit-only CPUs >never had NX. The only reason to even *do* this check on 32-bit is that >we think folks are running i386 kernels on x86_64 hardware _or_ we just >don't care about 32-bit in the first place. > >In the end, I think if we're going to do this test on i386, we should >_also_ do the 5-lines-of-code CPUID check. But I honestly don't care >that much. I wouldn't NAK (or not merge) this patch over it.
Perhaps we should also complain at people who are still running 32-bit kernels on 64-bit hardware? It has been 20 years...
| |