lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Message-ID: <20151003064637.GA23054@gmail.com> Date: Sat, 3 Oct 2015 08:46:37 +0200 From: Ingo Molnar <mingo@...nel.org> To: Paolo Bonzini <pbonzini@...hat.com> Cc: Linus Torvalds <torvalds@...ux-foundation.org>, Dave Hansen <dave@...1.net>, Kees Cook <keescook@...gle.com>, "x86@...nel.org" <x86@...nel.org>, LKML <linux-kernel@...r.kernel.org>, Linux-MM <linux-mm@...ck.org>, Andrew Morton <akpm@...ux-foundation.org>, Peter Zijlstra <a.p.zijlstra@...llo.nl>, Andy Lutomirski <luto@...nel.org>, Borislav Petkov <bp@...en8.de> Subject: Re: [PATCH 26/26] x86, pkeys: Documentation * Paolo Bonzini <pbonzini@...hat.com> wrote: > > > On 02/10/2015 13:58, Linus Torvalds wrote: > > On Fri, Oct 2, 2015 at 7:49 AM, Paolo Bonzini <pbonzini@...hat.com> wrote: > >> On 02/10/2015 00:48, Linus Torvalds wrote: > >>> It's quite likely that you will find that compilers put read-only > >>> constants in the text section, knowing that executable means readable. > >> > >> Not on x86 (because it has large immediates; RISC machines and s390 do > >> put large constants in the text section). > >> > >> But at the very least jump tables reside in the .text seection. > > > > Yes, at least traditionally gcc put things like the jump tables for > > switch() statements immediately next to the code. That caused lots of > > pain on the P4, where the L1 I$ and D$ were exclusive. I think that > > caused gcc to then put the jump tables further away, and it might be > > in a separate section these days - but it might also just be > > "sufficiently aligned" that the L1 cache issue isn't in play any more. > > > > Anyway, because of the P4 exclusive L1 I/D$ issue we can pretty much > > rest easy knowing that the data accesses and text accesses should be > > separated by at least one cacheline (maybe even 128 bytes - I think > > the L4 used 64-byte line size, but it was sub-sections of a 128-byte > > bigger line - but that might have been in the L2 only). > > > > But I could easily see the compiler/linker still putting them in the > > same ELF segment. > > You're entirely right, it puts them in .rodata actually. But .rodata is > in the same segment as .text: > > $ readelf --segments /bin/true > ... > Section to Segment mapping: > Segment Sections... > 00 > 01 .interp > 02 .interp .note.ABI-tag .note.gnu.build-id .gnu.hash .dynsym > .dynstr .gnu.version .gnu.version_r .rela.dyn .rela.plt .init > .plt .text .fini .rodata .eh_frame_hdr .eh_frame > 03 .init_array .fini_array .jcr .data.rel.ro .dynamic .got .data .bss > 04 .dynamic > 05 .note.ABI-tag .note.gnu.build-id > 06 .eh_frame_hdr > 07 > 08 .init_array .fini_array .jcr .data.rel.ro .dynamic .got Is there an easy(-ish) way (i.e. using compiler/linker flags, not linker scripts) to build the ELF binary in such a way so that non-code data: .rodata .eh_frame_hdr .eh_frame ... gets put into a separate (readonly and non-executable) segment? That would enable things from the distro side AFAICS, right? (assuming I'm reading the ELF dump right.) Or does this need binutils surgery? Thanks, Ingo -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@...r.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
Powered by blists - more mailing lists