ASM: Add marker for non-executable stack

hanno-becker · mkannwischer · commit 734e659ed3a8 · 2025-12-05T13:22:01.000+08:00
This commit extends simpasm to automatically emit the marker
`.section .note.GNU-stack,"",@progbits` marking the stack
as non-executable.

Signed-off-by: Hanno Becker &lt;beckphan@amazon.co.uk&gt;
diff --git a/mldsa/src/fips202/native/aarch64/src/keccak_f1600_x1_scalar_asm.S b/mldsa/src/fips202/native/aarch64/src/keccak_f1600_x1_scalar_asm.S
@@ -18,6 +18,9 @@
  *   dev/fips202/aarch64/src/keccak_f1600_x1_scalar_asm.S using scripts/simpasm. Do not modify it directly.
  */
 
+#if defined(__ELF__)
+.section .note.GNU-stack,"",@progbits
+#endif
 
 .text
 .balign 4
diff --git a/mldsa/src/fips202/native/aarch64/src/keccak_f1600_x1_v84a_asm.S b/mldsa/src/fips202/native/aarch64/src/keccak_f1600_x1_v84a_asm.S
@@ -35,6 +35,9 @@
  *   dev/fips202/aarch64/src/keccak_f1600_x1_v84a_asm.S using scripts/simpasm. Do not modify it directly.
  */
 
+#if defined(__ELF__)
+.section .note.GNU-stack,"",@progbits
+#endif
 
 .text
 .balign 4
diff --git a/mldsa/src/fips202/native/aarch64/src/keccak_f1600_x2_v84a_asm.S b/mldsa/src/fips202/native/aarch64/src/keccak_f1600_x2_v84a_asm.S
@@ -35,6 +35,9 @@
  *   dev/fips202/aarch64/src/keccak_f1600_x2_v84a_asm.S using scripts/simpasm. Do not modify it directly.
  */
 
+#if defined(__ELF__)
+.section .note.GNU-stack,"",@progbits
+#endif
 
 .text
 .balign 4
diff --git a/mldsa/src/fips202/native/aarch64/src/keccak_f1600_x4_v8a_scalar_hybrid_asm.S b/mldsa/src/fips202/native/aarch64/src/keccak_f1600_x4_v8a_scalar_hybrid_asm.S
@@ -18,6 +18,9 @@
  *   dev/fips202/aarch64/src/keccak_f1600_x4_v8a_scalar_hybrid_asm.S using scripts/simpasm. Do not modify it directly.
  */
 
+#if defined(__ELF__)
+.section .note.GNU-stack,"",@progbits
+#endif
 
 .text
 .balign 4
diff --git a/mldsa/src/fips202/native/aarch64/src/keccak_f1600_x4_v8a_v84a_scalar_hybrid_asm.S b/mldsa/src/fips202/native/aarch64/src/keccak_f1600_x4_v8a_v84a_scalar_hybrid_asm.S
@@ -20,6 +20,9 @@
  *   dev/fips202/aarch64/src/keccak_f1600_x4_v8a_v84a_scalar_hybrid_asm.S using scripts/simpasm. Do not modify it directly.
  */
 
+#if defined(__ELF__)
+.section .note.GNU-stack,"",@progbits
+#endif
 
 .text
 .balign 4
diff --git a/mldsa/src/native/aarch64/src/intt.S b/mldsa/src/native/aarch64/src/intt.S
@@ -30,6 +30,9 @@
  *   dev/aarch64_opt/src/intt.S using scripts/simpasm. Do not modify it directly.
  */
 
+#if defined(__ELF__)
+.section .note.GNU-stack,"",@progbits
+#endif
 
 .text
 .balign 4
diff --git a/mldsa/src/native/aarch64/src/mld_polyvecl_pointwise_acc_montgomery_l4.S b/mldsa/src/native/aarch64/src/mld_polyvecl_pointwise_acc_montgomery_l4.S
@@ -10,6 +10,9 @@
  *   dev/aarch64_opt/src/mld_polyvecl_pointwise_acc_montgomery_l4.S using scripts/simpasm. Do not modify it directly.
  */
 
+#if defined(__ELF__)
+.section .note.GNU-stack,"",@progbits
+#endif
 
 .text
 .balign 4
diff --git a/mldsa/src/native/aarch64/src/mld_polyvecl_pointwise_acc_montgomery_l5.S b/mldsa/src/native/aarch64/src/mld_polyvecl_pointwise_acc_montgomery_l5.S
@@ -10,6 +10,9 @@
  *   dev/aarch64_opt/src/mld_polyvecl_pointwise_acc_montgomery_l5.S using scripts/simpasm. Do not modify it directly.
  */
 
+#if defined(__ELF__)
+.section .note.GNU-stack,"",@progbits
+#endif
 
 .text
 .balign 4
diff --git a/mldsa/src/native/aarch64/src/mld_polyvecl_pointwise_acc_montgomery_l7.S b/mldsa/src/native/aarch64/src/mld_polyvecl_pointwise_acc_montgomery_l7.S
@@ -10,6 +10,9 @@
  *   dev/aarch64_opt/src/mld_polyvecl_pointwise_acc_montgomery_l7.S using scripts/simpasm. Do not modify it directly.
  */
 
+#if defined(__ELF__)
+.section .note.GNU-stack,"",@progbits
+#endif
 
 .text
 .balign 4
diff --git a/mldsa/src/native/aarch64/src/ntt.S b/mldsa/src/native/aarch64/src/ntt.S
@@ -30,6 +30,9 @@
  *   dev/aarch64_opt/src/ntt.S using scripts/simpasm. Do not modify it directly.
  */
 
+#if defined(__ELF__)
+.section .note.GNU-stack,"",@progbits
+#endif
 
 .text
 .balign 4
diff --git a/mldsa/src/native/aarch64/src/pointwise_montgomery.S b/mldsa/src/native/aarch64/src/pointwise_montgomery.S
@@ -10,6 +10,9 @@
  *   dev/aarch64_opt/src/pointwise_montgomery.S using scripts/simpasm. Do not modify it directly.
  */
 
+#if defined(__ELF__)
+.section .note.GNU-stack,"",@progbits
+#endif
 
 .text
 .balign 4
diff --git a/mldsa/src/native/aarch64/src/poly_caddq_asm.S b/mldsa/src/native/aarch64/src/poly_caddq_asm.S
@@ -11,6 +11,9 @@
  *   dev/aarch64_opt/src/poly_caddq_asm.S using scripts/simpasm. Do not modify it directly.
  */
 
+#if defined(__ELF__)
+.section .note.GNU-stack,"",@progbits
+#endif
 
 .text
 .balign 4
diff --git a/mldsa/src/native/aarch64/src/poly_chknorm_asm.S b/mldsa/src/native/aarch64/src/poly_chknorm_asm.S
@@ -11,6 +11,9 @@
  *   dev/aarch64_opt/src/poly_chknorm_asm.S using scripts/simpasm. Do not modify it directly.
  */
 
+#if defined(__ELF__)
+.section .note.GNU-stack,"",@progbits
+#endif
 
 .text
 .balign 4
diff --git a/mldsa/src/native/aarch64/src/poly_decompose_32_asm.S b/mldsa/src/native/aarch64/src/poly_decompose_32_asm.S
@@ -11,6 +11,9 @@
  *   dev/aarch64_opt/src/poly_decompose_32_asm.S using scripts/simpasm. Do not modify it directly.
  */
 
+#if defined(__ELF__)
+.section .note.GNU-stack,"",@progbits
+#endif
 
 .text
 .balign 4
diff --git a/mldsa/src/native/aarch64/src/poly_decompose_88_asm.S b/mldsa/src/native/aarch64/src/poly_decompose_88_asm.S
@@ -11,6 +11,9 @@
  *   dev/aarch64_opt/src/poly_decompose_88_asm.S using scripts/simpasm. Do not modify it directly.
  */
 
+#if defined(__ELF__)
+.section .note.GNU-stack,"",@progbits
+#endif
 
 .text
 .balign 4
diff --git a/mldsa/src/native/aarch64/src/poly_use_hint_32_asm.S b/mldsa/src/native/aarch64/src/poly_use_hint_32_asm.S
@@ -11,6 +11,9 @@
  *   dev/aarch64_opt/src/poly_use_hint_32_asm.S using scripts/simpasm. Do not modify it directly.
  */
 
+#if defined(__ELF__)
+.section .note.GNU-stack,"",@progbits
+#endif
 
 .text
 .balign 4
diff --git a/mldsa/src/native/aarch64/src/poly_use_hint_88_asm.S b/mldsa/src/native/aarch64/src/poly_use_hint_88_asm.S
@@ -11,6 +11,9 @@
  *   dev/aarch64_opt/src/poly_use_hint_88_asm.S using scripts/simpasm. Do not modify it directly.
  */
 
+#if defined(__ELF__)
+.section .note.GNU-stack,"",@progbits
+#endif
 
 .text
 .balign 4
diff --git a/mldsa/src/native/aarch64/src/polyz_unpack_17_asm.S b/mldsa/src/native/aarch64/src/polyz_unpack_17_asm.S
@@ -12,6 +12,9 @@
  *   dev/aarch64_opt/src/polyz_unpack_17_asm.S using scripts/simpasm. Do not modify it directly.
  */
 
+#if defined(__ELF__)
+.section .note.GNU-stack,"",@progbits
+#endif
 
 .text
 .balign 4
diff --git a/mldsa/src/native/aarch64/src/polyz_unpack_19_asm.S b/mldsa/src/native/aarch64/src/polyz_unpack_19_asm.S
@@ -12,6 +12,9 @@
  *   dev/aarch64_opt/src/polyz_unpack_19_asm.S using scripts/simpasm. Do not modify it directly.
  */
 
+#if defined(__ELF__)
+.section .note.GNU-stack,"",@progbits
+#endif
 
 .text
 .balign 4
diff --git a/mldsa/src/native/aarch64/src/rej_uniform_asm.S b/mldsa/src/native/aarch64/src/rej_uniform_asm.S
@@ -13,6 +13,9 @@
  *   dev/aarch64_opt/src/rej_uniform_asm.S using scripts/simpasm. Do not modify it directly.
  */
 
+#if defined(__ELF__)
+.section .note.GNU-stack,"",@progbits
+#endif
 
 .text
 .balign 4
diff --git a/mldsa/src/native/aarch64/src/rej_uniform_eta2_asm.S b/mldsa/src/native/aarch64/src/rej_uniform_eta2_asm.S
@@ -13,6 +13,9 @@
  *   dev/aarch64_opt/src/rej_uniform_eta2_asm.S using scripts/simpasm. Do not modify it directly.
  */
 
+#if defined(__ELF__)
+.section .note.GNU-stack,"",@progbits
+#endif
 
 .text
 .balign 4
diff --git a/mldsa/src/native/aarch64/src/rej_uniform_eta4_asm.S b/mldsa/src/native/aarch64/src/rej_uniform_eta4_asm.S
@@ -13,6 +13,9 @@
  *   dev/aarch64_opt/src/rej_uniform_eta4_asm.S using scripts/simpasm. Do not modify it directly.
  */
 
+#if defined(__ELF__)
+.section .note.GNU-stack,"",@progbits
+#endif
 
 .text
 .balign 4
diff --git a/mldsa/src/native/x86_64/src/intt.S b/mldsa/src/native/x86_64/src/intt.S
@@ -26,6 +26,9 @@
  *   dev/x86_64/src/intt.S using scripts/simpasm. Do not modify it directly.
  */
 
+#if defined(__ELF__)
+.section .note.GNU-stack,"",@progbits
+#endif
 
 .text
 .balign 4
diff --git a/mldsa/src/native/x86_64/src/ntt.S b/mldsa/src/native/x86_64/src/ntt.S
@@ -27,6 +27,9 @@
  *   dev/x86_64/src/ntt.S using scripts/simpasm. Do not modify it directly.
  */
 
+#if defined(__ELF__)
+.section .note.GNU-stack,"",@progbits
+#endif
 
 .text
 .balign 4
diff --git a/mldsa/src/native/x86_64/src/nttunpack.S b/mldsa/src/native/x86_64/src/nttunpack.S
@@ -28,6 +28,9 @@
  *   dev/x86_64/src/nttunpack.S using scripts/simpasm. Do not modify it directly.
  */
 
+#if defined(__ELF__)
+.section .note.GNU-stack,"",@progbits
+#endif
 
 .text
 .balign 4
diff --git a/mldsa/src/native/x86_64/src/pointwise.S b/mldsa/src/native/x86_64/src/pointwise.S
@@ -26,6 +26,9 @@
  *   dev/x86_64/src/pointwise.S using scripts/simpasm. Do not modify it directly.
  */
 
+#if defined(__ELF__)
+.section .note.GNU-stack,"",@progbits
+#endif
 
 .text
 .balign 4
diff --git a/mldsa/src/native/x86_64/src/pointwise_acc_l4.S b/mldsa/src/native/x86_64/src/pointwise_acc_l4.S
@@ -26,6 +26,9 @@
  *   dev/x86_64/src/pointwise_acc_l4.S using scripts/simpasm. Do not modify it directly.
  */
 
+#if defined(__ELF__)
+.section .note.GNU-stack,"",@progbits
+#endif
 
 .text
 .balign 4
diff --git a/mldsa/src/native/x86_64/src/pointwise_acc_l5.S b/mldsa/src/native/x86_64/src/pointwise_acc_l5.S
@@ -26,6 +26,9 @@
  *   dev/x86_64/src/pointwise_acc_l5.S using scripts/simpasm. Do not modify it directly.
  */
 
+#if defined(__ELF__)
+.section .note.GNU-stack,"",@progbits
+#endif
 
 .text
 .balign 4
diff --git a/mldsa/src/native/x86_64/src/pointwise_acc_l7.S b/mldsa/src/native/x86_64/src/pointwise_acc_l7.S
@@ -26,6 +26,9 @@
  *   dev/x86_64/src/pointwise_acc_l7.S using scripts/simpasm. Do not modify it directly.
  */
 
+#if defined(__ELF__)
+.section .note.GNU-stack,"",@progbits
+#endif
 
 .text
 .balign 4
diff --git a/proofs/hol_light/x86_64/mldsa/mldsa_ntt.S b/proofs/hol_light/x86_64/mldsa/mldsa_ntt.S
@@ -24,6 +24,9 @@
  *   dev/x86_64/src/ntt.S using scripts/simpasm. Do not modify it directly.
  */
 
+#if defined(__ELF__)
+.section .note.GNU-stack,"",@progbits
+#endif
 
 .text
 .balign 4
diff --git a/scripts/simpasm b/scripts/simpasm
@@ -267,6 +267,9 @@ def simplify(logger, args, asm_input, asm_output=None):
             f" *   {asm_input} using scripts/simpasm. Do not modify it directly.",
             " */",
             "",
+            "#if defined(__ELF__)",
+            '.section .note.GNU-stack,"",@progbits',
+            "#endif",
             "",
             ".text",
             ".balign 4",
