Re: [PATCH v2 00/11] x86/EFI: prevent write-execute sections

[Roger Pau Monné <roger.pau@xxxxxxxxxx>]

On Mon, Apr 07, 2025 at 04:04:18PM +0200, Jan Beulich wrote:
> On 01.04.2025 15:26, Roger Pau Monné wrote:
> > nxcompat should be enabled by default I think?  I can of course make
> > it explicit by adding to the PE link command line.
> 
> --nxcompat wasn't the default originally, then was made the default for MinGW
> (and by mistake for everything else as well), then it being the default was
> undone for Cygwin. I've meanwhile submitted a patch to undo it for everything
> that isn't MinGW [1]. I simply don't think the linker is in the position to
> declare that every binary is NX-compatible. It's the programmers who have to
> determine that. With the flag not being honored everywhere one also can't
> simply test an EFI binary on a couple of hosts, at least as long as the EFI
> implementation there is a black box.

I think I looked at this reference:

https://sourceware.org/binutils/docs/ld/Options.html

When saying that nxcompat was enabled by default:

--nxcompat
--disable-nxcompat The image is compatible with the Data Execution
Prevention. This feature was introduced with MS Windows XP SP2 for
i386 PE targets. The option is enabled by default.

I guess the intent was to only enable it by default for Windows PE
images?  Anyway, as said earlier, I don't mind adding it.  FWIW, (I
think I commented with Andrew) I did saw this flag was already present
in our PE builds, even in it's current form, so that explains it.

Thanks, Roger.