[PATCH, BFD, LD, AArch64, 4/4] Add --pac-plt to enable PLTs protected with PAC.

[Szabolcs Nagy]

On 06/03/2019 10:39, Sudakshina Das wrote:
> +static const bfd_byte elfNN_aarch64_small_plt0_pac_entry[PLT_PAC_ENTRY_SIZE] =
> +{
> +  0xf0, 0x7b, 0xbf, 0xa9,	/* stp x16, x30, [sp, #-16]!  */
> +  0x10, 0x00, 0x00, 0x90,	/* adrp x16, (GOT+16)  */
> +#if ARCH_SIZE == 64
> +  0x11, 0x0A, 0x40, 0xf9,	/* ldr x17, [x16, #PLT_GOT+0x10]  */
> +  0x10, 0x42, 0x00, 0x91,	/* add x16, x16,#PLT_GOT+0x10   */
> +#else
> +  0x11, 0x0A, 0x40, 0xb9,	/* ldr w17, [x16, #PLT_GOT+0x8]  */
> +  0x10, 0x22, 0x00, 0x11,	/* add w16, w16,#PLT_GOT+0x8   */
> +#endif
> +  0x9f, 0x21, 0x03, 0xd5,	/* autia1716 */
> +  0x20, 0x02, 0x1f, 0xd6,	/* br x17  */
> +  0x1f, 0x20, 0x03, 0xd5,	/* nop */
> +  0x1f, 0x20, 0x03, 0xd5,	/* nop */
> +  0x1f, 0x20, 0x03, 0xd5,	/* nop */
> +};
> +
> +static const bfd_byte
> +elfNN_aarch64_small_plt0_bti_pac_entry[PLT_BTI_PAC_ENTRY_SIZE] =
> +{
> +  0x5f, 0x24, 0x03, 0xd5,	/* bti c.  */
> +  0xf0, 0x7b, 0xbf, 0xa9,	/* stp x16, x30, [sp, #-16]!  */
> +  0x10, 0x00, 0x00, 0x90,	/* adrp x16, (GOT+16)  */
> +#if ARCH_SIZE == 64
> +  0x11, 0x0A, 0x40, 0xf9,	/* ldr x17, [x16, #PLT_GOT+0x10]  */
> +  0x10, 0x42, 0x00, 0x91,	/* add x16, x16,#PLT_GOT+0x10   */
> +#else
> +  0x11, 0x0A, 0x40, 0xb9,	/* ldr w17, [x16, #PLT_GOT+0x8]  */
> +  0x10, 0x22, 0x00, 0x11,	/* add w16, w16,#PLT_GOT+0x8   */
> +#endif
> +  0x9f, 0x21, 0x03, 0xd5,	/* autia1716 */
> +  0x20, 0x02, 0x1f, 0xd6,	/* br x17  */
> +  0x1f, 0x20, 0x03, 0xd5,	/* nop */
> +  0x1f, 0x20, 0x03, 0xd5,	/* nop */
> +  0x1f, 0x20, 0x03, 0xd5,	/* nop */
> +};

sorry i hadn't noticed this before,
PLT0 does not need a PAC variant because the
PLTGOT[2] entry that's loaded here is readonly
protected under relro (i think the linker
script magic for relro guarantees this).

in principle using autia here works too
(just additional unnecessary autia in the lazy
resolution code path), however this is ABI
between a dynamic linker and static linker:
with such PLT0 the PLTGOT[2] has to be filled
in with a signed pointer.

it seems our ELF ABI does not describe this
(PLT sequence should be in the SYS V ABI),
i think if we agree that relro always protects
PLTGOT[2] then we can still change this.
(to reduce the number of supported PLT0 entries)