[PATCH v6 08/14] aarch64: enable BTI at runtime

[Szabolcs Nagy]

The 07/13/2020 14:14, Szabolcs Nagy wrote:
> The 07/11/2020 08:58, Richard Henderson wrote:
> > On 7/1/20 7:39 AM, Szabolcs Nagy wrote:
> > > +  unsigned prot = PROT_READ | PROT_EXEC | PROT_BTI;
> > > +
> > > +  for (phdr = map->l_phdr; phdr < &map->l_phdr[map->l_phnum]; ++phdr)
> > > +    if (phdr->p_type == PT_LOAD && (phdr->p_flags & PF_X))
> > > +      {
> > > +	ElfW(Addr) start = phdr->p_vaddr + map->l_addr;
> > > +	ElfW(Addr) len = phdr->p_memsz;
> > > +	if (__mprotect ((void *) start, len, prot) < 0)
> > 
> > Spend an extra cycle or two and honor the exact set of p_flags?
> > 
> > If I construct an executable but non-readable PT_LOAD segment, that should be
> > fine.  RWX with BTI would undoubtedly be an unusual case, but perhaps not
> > implausible in the context of a JIT with a statically allocated buffer.
> 
> i will commit the attached fix tomorrow
> unless there are comments on it.
> 

> From ee5765a839f6a40a61960264ed46393dc5d6c534 Mon Sep 17 00:00:00 2001
> From: Szabolcs Nagy <szabolcs.nagy@arm.com>
> Date: Mon, 13 Jul 2020 11:28:18 +0100
> Subject: [PATCH] aarch64: Respect p_flags when protecting code with PROT_BTI
> 
> Use PROT_READ and PROT_WRITE according to the load segment p_flags
> when adding PROT_BTI.
> 
> This is before processing relocations which may drop PROT_BTI in
> case of textrels.  Executable stacks are not protected via PROT_BTI
> either.  PROT_BTI is hardening in case memory corruption happened,
> it's value is reduced if there is writable and executable memory
> available so missing it on such memory is fine, but we should
> respect the p_flags and should not drop PROT_WRITE.
> ---
>  sysdeps/aarch64/dl-bti.c | 9 ++++++++-
>  1 file changed, 8 insertions(+), 1 deletion(-)
> 
> diff --git a/sysdeps/aarch64/dl-bti.c b/sysdeps/aarch64/dl-bti.c
> index 965ddcc732..01ffb69a4a 100644
> --- a/sysdeps/aarch64/dl-bti.c
> +++ b/sysdeps/aarch64/dl-bti.c
> @@ -24,13 +24,20 @@ static int
>  enable_bti (struct link_map *map, const char *program)
>  {
>    const ElfW(Phdr) *phdr;
> -  unsigned prot = PROT_READ | PROT_EXEC | PROT_BTI;
> +  unsigned prot;
>  
>    for (phdr = map->l_phdr; phdr < &map->l_phdr[map->l_phnum]; ++phdr)
>      if (phdr->p_type == PT_LOAD && (phdr->p_flags & PF_X))
>        {
>  	void *start = (void *) (phdr->p_vaddr + map->l_addr);
>  	size_t len = phdr->p_memsz;
> +
> +	prot = PROT_EXEC | PROT_BTI;
> +	if (ph->p_flags & PF_R)

should be phdr-> instead of ph->

and i will have to wait for the tests to finish too which
takes about 40h.

> +	  prot |= PROT_READ;
> +	if (ph->p_flags & PF_W)
> +	  prot |= PROT_WRITE;
> +
>  	if (__mprotect (start, len, prot) < 0)
>  	  {
>  	    if (program)
> -- 
> 2.17.1
>