On October 10, 2019 4:57:36 PM PDT, Kees Cook [off-list ref] wrote:

On Thu, Oct 10, 2019 at 08:03:31PM +0200, Borislav Petkov wrote:

quoted

On Thu, Sep 26, 2019 at 10:55:33AM -0700, Kees Cook wrote:

quoted

This series works to move the linker sections for NOTES and
EXCEPTION_TABLE into the RO_DATA area, where they belong on most
(all?) architectures. The problem being addressed was the discovery
by Rick Edgecombe that the exception table was accidentally marked
executable while he was developing his execute-only-memory series.

When

quoted

quoted

permissions were flipped from readable-and-executable to

only-executable,

quoted

quoted

the exception table became unreadable, causing things to explode

rather

quoted

quoted

badly. :)

Roughly speaking, the steps are:

- regularize the linker names for PT_NOTE and PT_LOAD program

headers

quoted

quoted

  (to "note" and "text" respectively)
- regularize restoration of linker section to program header

assignment

quoted

quoted

  (when PT_NOTE exists)
- move NOTES into RO_DATA
- finish macro naming conversions for RO_DATA and RW_DATA
- move EXCEPTION_TABLE into RO_DATA on architectures where this is

clear

quoted

quoted

- clean up some x86-specific reporting of kernel memory resources
- switch x86 linker fill byte from x90 (NOP) to 0xcc (INT3), just

because

quoted

quoted

  I finally realized what that trailing ": 0x9090" meant -- and we

should

quoted

quoted

  trap, not slide, if execution lands in section padding

Yap, nice patchset overall.

Thanks!

quoted

quoted

Since these changes are treewide, I'd love to get

architecture-maintainer

quoted

quoted

Acks and either have this live in x86 -tip or in my own tree,

however

quoted

quoted

people think it should go.

Sure, I don't mind taking v2 through tip once I get ACKs from the
respective arch maintainers.

Okay, excellent. I've only had acks from arm64, but I'll call it out
again in v2. Thanks for the review!

I would like to once again advocate for the generalized link table mechanism. It is nuts that each individual table should need vmlinux.lds hacking across architectures.
-- 
Sent from my Android device with K-9 Mail. Please excuse my brevity.