Fixes a boot issue on non-ACPI i386 machines that need X permissions on

the BIOS region in the ISA hole.

Also fix a separate unrelated issue relating to placing R/O (no X)
permissions on the kernel symbol area on bsd.rd.

ok deraadt

3 files changed, 32 insertions, 8 deletions

diff --git a/sys/arch/i386/conf/ld.script b/sys/arch/i386/conf/ld.script
index aa0665b828a..58867dd459e 100644
--- a/sys/arch/i386/conf/ld.script
+++ b/sys/arch/i386/conf/ld.script
@@ -1,4 +1,4 @@
-/*	$OpenBSD: ld.script,v 1.2 2015/08/15 19:01:39 mlarkin Exp $	*/
+/*	$OpenBSD: ld.script,v 1.3 2016/02/20 19:59:01 mlarkin Exp $	*/
 
 /*
  * Copyright (c) 2015 Mike Larkin <mlarkin@openbsd.org>
@@ -113,7 +113,7 @@ SECTIONS
 		. = ALIGN(0x1000);
 	} :bss
 	__kernel_bss_end = .;
-	. = ALIGN(0x200000);
+	. = ALIGN(0x1000);
 	_end = .;
 	PROVIDE (end = .);
 	__kernel_end_phys = . & 0xfffffff;
diff --git a/sys/arch/i386/i386/bios.c b/sys/arch/i386/i386/bios.c
index af08a893286..54f89774604 100644
--- a/sys/arch/i386/i386/bios.c
+++ b/sys/arch/i386/i386/bios.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: bios.c,v 1.113 2015/09/16 04:18:52 daniel Exp $	*/
+/*	$OpenBSD: bios.c,v 1.114 2016/02/20 19:59:01 mlarkin Exp $	*/
 
 /*
  * Copyright (c) 1997-2001 Michael Shalayeff
@@ -170,7 +170,7 @@ biosattach(struct device *parent, struct device *self, void *aux)
 	struct smbtable bios;
 	volatile u_int8_t *va;
 	char scratch[64], *str;
-	int flags, smbiosrev = 0, ncpu = 0;
+	int flags, smbiosrev = 0, ncpu = 0, isa_hole_exec = 0;
 #if NACPI > 0
 	int usingacpi = 0;
 #endif
@@ -404,6 +404,7 @@ biosattach(struct device *parent, struct device *self, void *aux)
 		ba.ba_iot = bia->ba_iot;
 		ba.ba_apmp = apm;
 		config_found(self, &ba, bios_print);
+		isa_hole_exec = 1;
 	}
 #endif
 
@@ -478,12 +479,20 @@ biosattach(struct device *parent, struct device *self, void *aux)
 			    (paddr_t)off, len, EX_NOWAIT)))
 				printf(":%d", i);
 
+			isa_hole_exec = 1;
 			va += len - 512;
 		}
 		if (str)
 			printf("\n");
 	}
 
+	/*
+	 * If we had no BIOS / proms that need exec permission in the ISA
+	 * hole, remove X permissions.
+	 */
+	if (!isa_hole_exec)
+		pmap_write_protect(pmap_kernel(), (vaddr_t)atdevbase,
+		    (vaddr_t)atdevbase + IOM_SIZE, PROT_READ | PROT_WRITE);
 }
 
 void
diff --git a/sys/arch/i386/i386/pmapae.c b/sys/arch/i386/i386/pmapae.c
index 9a55ba8e64c..9210ed6b609 100644
--- a/sys/arch/i386/i386/pmapae.c
+++ b/sys/arch/i386/i386/pmapae.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: pmapae.c,v 1.47 2015/10/23 09:36:09 kettenis Exp $	*/
+/*	$OpenBSD: pmapae.c,v 1.48 2016/02/20 19:59:01 mlarkin Exp $	*/
 
 /*
  * Copyright (c) 2006-2008 Michael Shalayeff
@@ -94,9 +94,12 @@
 #include <machine/gdt.h>
 
 #include <dev/isa/isareg.h>
+#include <i386/isa/isa_machdep.h>
 #include <sys/msgbuf.h>
 #include <stand/boot/bootarg.h>
 
+#include "ksyms.h"
+
 /*
  * this file contains the code for the "pmap module."   the module's
  * job is to manage the hardware's virtual to physical address mappings.
@@ -641,8 +644,17 @@ pmap_bootstrap_pae(void)
 		}
 		bits = pmap_pte_bits_86(va) | pmap_pg_g;
 
-		/* At this point, only kernel text should be executable */
-		if (va >= (vaddr_t)&kernel_text && va <= (vaddr_t)&etext)
+		/*
+		 * At this point, ideally only kernel text should be executable.
+		 * However, we need to leave the ISA hole executable to handle
+		 * bios32, pcibios, and apmbios calls that may potentially
+		 * happen later since we don't know (yet) which of those may be
+		 * in use. Later (in biosattach), we will reset the permissions
+		 * according to what we actually need.
+		 */
+		if ((va >= (vaddr_t)&kernel_text && va <= (vaddr_t)&etext) ||
+		    (va >= (vaddr_t)atdevbase && va <=
+		     (vaddr_t)(atdevbase + IOM_SIZE)))
 			bits |= PG_X;
 		else
 			bits &= ~PG_X;
@@ -707,8 +719,11 @@ pmap_bootstrap_pae(void)
 	    PROT_READ | PROT_WRITE);
 	pmap_write_protect(kpm, (vaddr_t)&__bss_start, (vaddr_t)&end,
 	    PROT_READ | PROT_WRITE);
+
+#if defined(DDB) || NKSYMS > 0
 	pmap_write_protect(kpm, ssym, esym, PROT_READ);
- }
+#endif
+}
 
 /*
  * p t p   f u n c t i o n s