d/freebsd-dev
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
14327f5334
freebsd-dev/sys
History
Mark Johnston 14327f5334 Tighten mapping protections on preloaded files on amd64. 
- We load the kernel at 0x200000.  Memory below that address need not
  be executable, so do not map it as such.
- Remove references to .ldata and related sections in the kernel linker
  script.  They come from ld.bfd's default linker script, but are not
  used, and we now use ld.lld to link the amd64 kernel.  lld does not
  contain a default linker script.
- Pad the .bss to a 2MB as we do between .text and .data.  This
  forces the loader to load additional files starting in the following
  2MB page, preserving the use of superpage mappings for kernel data.
- Map memory above the kernel image with NX.  The kernel linker now
  upgrades protections as needed, and other preloaded file types
  (e.g., entropy, microcode) need not be mapped with execute permissions
  in the first place.

Reviewed by:	kib
MFC after:	1 month
Sponsored by:	Netflix
Differential Revision:	https://reviews.freebsd.org/D21859
2019-10-18 14:05:13 +00:00
..
amd64 Tighten mapping protections on preloaded files on amd64. 2019-10-18 14:05:13 +00:00
arm Remove page locking from pmap_mincore(). 2019-10-16 22:03:27 +00:00
arm64 linux: futex_mtx should follow futex_list 2019-10-18 12:25:33 +00:00
bsm
cam Add kern.cam.da.X.quirks tunable, similar existing for ada. 2019-09-26 14:48:39 +00:00
cddl MFV r353637: 10844 Serialize ZTHR operations to eliminate races 2019-10-16 09:29:01 +00:00
compat linux: futex_mtx should follow futex_list 2019-10-18 12:25:33 +00:00
conf Tighten mapping protections on preloaded files on amd64. 2019-10-18 14:05:13 +00:00
contrib Fix read past end of struct in ncsw glue code. 2019-10-12 23:16:17 +00:00
crypto Stop using des_cblock * for arguments to DES functions. 2019-08-26 17:25:07 +00:00
ddb ddb(4): Add some support for lexing IPv6 addresses 2019-09-09 16:32:23 +00:00
dev gpioiic: add the detach method 2019-10-18 12:34:30 +00:00
dts dtso: allwinner: Add an overlay for H3 thermal node 2019-08-24 13:26:34 +00:00
fs (4/6) Protect page valid with the busy lock. 2019-10-15 03:45:41 +00:00
gdb gdb(4): Implement support for NoAckMode 2019-10-17 22:37:25 +00:00
geom Make all the gnop parameters optional in the request from userland, 2019-10-16 21:49:44 +00:00
gnu arm: dts: ti: Fix mmc3 instance by setting it to disabled 2019-10-07 08:11:49 +00:00
i386 linux: futex_mtx should follow futex_list 2019-10-18 12:25:33 +00:00
isa
kern Apply mapping protections to preloaded kernel modules on amd64. 2019-10-18 13:56:45 +00:00
kgssapi Stop using des_cblock * for arguments to DES functions. 2019-08-26 17:25:07 +00:00
libkern Remove zlib 1.0.4 from kernel. 2019-08-25 17:13:00 +00:00
mips Remove page locking from pmap_mincore(). 2019-10-16 22:03:27 +00:00
modules attach itwd to the module build on x86 2019-10-16 15:01:44 +00:00
net Implement NetGDB(4) 2019-10-17 21:33:01 +00:00
net80211 Don't use if_maddr_rlock() in 802.11, use epoch(9) directly instead. 2019-10-10 23:55:33 +00:00
netgraph Don't use if_maddr_rlock() in ng_eiface(4), use epoch(9) directly instead. 2019-10-10 23:49:19 +00:00
netinet debugnet(4): Add optional full-duplex mode 2019-10-17 20:25:15 +00:00
netinet6 Fix panic in network stack due to use after free when receiving 2019-10-16 09:11:49 +00:00
netipsec Widen NET_EPOCH coverage. 2019-10-07 22:40:05 +00:00
netpfil pf: Must be in NET_EPOCH to call icmp_error 2019-10-18 03:36:26 +00:00
netsmb Stop using des_cblock * for arguments to DES functions. 2019-08-26 17:25:07 +00:00
nfs
nfsclient
nfsserver
nlm
ofed VLAN_TRUNKDEV() requires epochification in ibcore after r353292. 2019-10-16 08:56:07 +00:00
opencrypto kTLS support for TLS 1.3 2019-09-27 19:17:40 +00:00
powerpc Split out a more generic debugnet(4) from netdump(4) 2019-10-17 16:23:03 +00:00
riscv Remove page locking from pmap_mincore(). 2019-10-16 22:03:27 +00:00
rpc Avoid relying on header pollution from sys/refcount.h. 2019-07-29 20:26:01 +00:00
security Define macro VM_MAP_ENTRY_FOREACH for enumerating the entries in a vm_map. 2019-10-08 07:14:21 +00:00
sparc64 Split out a more generic debugnet(4) from netdump(4) 2019-10-17 16:23:03 +00:00
sys Implement NetGDB(4) 2019-10-17 21:33:01 +00:00
teken Adjust teken to allow build as part of loader 2019-09-05 18:07:40 +00:00
tests
tools fw_stub.awk: use @generated tag in generated files 2019-09-11 13:35:22 +00:00
ufs ufs: add root vnode caching 2019-10-06 22:18:03 +00:00
vm Apply mapping protections to preloaded kernel modules on amd64. 2019-10-18 13:56:45 +00:00
x86 x86: Remove unused variable from r353712 2019-10-18 02:25:30 +00:00
xdr
xen
Makefile