Re: [PATCH v3 4/4] x86: Split .init section to satisfy UEFI CA memory mitigation

[Frediano Ziglio <freddy77@xxxxxxxxx>]

On Tue, 16 Jun 2026 at 13:40, Andrew Cooper <andrew.cooper3@xxxxxxxxxx> wrote:
>
> On 16/06/2026 1:30 pm, Jan Beulich wrote:
> > On 16.06.2026 13:29, Andrew Cooper wrote:
> >> On 16/06/2026 12:20 pm, Marek Marczykowski-Górecki wrote:
> >>> On Tue, Jun 16, 2026 at 11:13:36AM +0100, Frediano Ziglio wrote:
> >>>> From: Frediano Ziglio <frediano.ziglio@xxxxxxxxx>
> >>>>
> >>>> Currently .init section is both writeable and executable, split data and 
> >>>> code
> >>>> to have 2 sections satisfying W^X rule.
> >>>>
> >>>> It is a requirement for NX_COMPAT so the PE can be loaded with W^X perms
> >>>> in the pagetables.
> >>>>
> >>>> NX_COMPAT is a requirement from shim-review,
> >>>> https://github.com/rhboot/shim-review#do-you-have-the-nx-bit-set-in-your-shim-if-so-is-your-entire-boot-stack-nx-compatible-and-what-testing-have-you-done-to-ensure-such-compatibility
> >>>>
> >>>> Signed-off-by: Frediano Ziglio <frediano.ziglio@xxxxxxxxxx>
> >>> Acked-by: Marek Marczykowski-Górecki <marmarek@xxxxxxxxxxxxxxxxxxxxxx>
> >>>
> >>> Is that the last piece necessary to satisfy the NX_COMPAT requirement? If
> >>> so, I suppose a subsequent patch should actually set the
> >>> IMAGE_DLLCHARACTERISTICS_NX_COMPAT bit (IIUC ld --nxcompat option), right?

At the moment we don't have downstream patches changing the nxcompat
specifically. Recent toolchains combinations are setting that flag
automatically.

> >> We need to satisfy everything in
> >> https://github.com/xenserver/xen.pg/blob/XS-9/patches/correct-sections-permissions.patch
> >>
> >> .reloc needs to be non-discardable and writeable.
> > Writable? Why?
>
> Because we take fatal pagefaults against it when it's really read-only.
>
> But as for why, I'll have to defer that to Frediano/Ross who did the
> work originally.
>

Wait, there's a bit of confusion. The .reloc section needs to be
non-discardable but read-only is fine, it's the .rodata section that
has to be writable. The reason is that some variables are "read
mostly" or "writable during init". This is consistent with what the
script is doing.

> >
> >>   This will require a very recent binutils and a patch (series?) from Jan.
> > Seeing that no patch had been submitted so far, I recently added this to my
> > todo list, yes. But really I was hoping that someone else would make the
> > small change that I expect is going to be needed.
>
> If you can explain what change is needed then maybe someone else can do it.
>
> But right now, all I know is it's a new binutils and "something".
>
> ~Andrew

The patch was not submitted as similar patches were rejected as too
"hacky" and instead was suggested to have binutils changes. On the
other hand, former binutils must continue to "work" even if they
create wrong output. So instead of having to wait 5/6 years so that
all Xen supported binutils have the features we need we have that
patch in our series.

Frediano