[PATCH v3 00/13] aarch64: branch protection support
Szabolcs Nagy
szabolcs.nagy@arm.com
Fri May 15 14:40:44 GMT 2020
Indirect branch target identification (BTI, armv8.5-a) and return
address signing using pointer authentication (PAC-RET, armv8.3-a)
can be used for security hardening against some control flow hijack
attacks.
In gcc these are exposed via -mbranch-protection=bti+pac-ret which
is the same as -mbranch-protection=standard and gcc can be configured
via --enable-standard-branch-protection to use them by default.
BTI requires libc support: it is an opt-in feature per ELF module
via a GNU property note that the dynamic linker has to check and
mprotect the executable pages with PROT_BTI. And libc objects that
are statically linked into user binaries must be BTI compatible
for the GNU property note to be present. (The property note is
handled by linux for static linked executables and for the ld.so.)
PAC-RET does not require libc runtime support, (other than for
_mcount with current -pg code gen), but, just like BTI, it can be
used in libc binaries for security hardening.
v3:
- instead of END_FILE add note in sysdep.h.
- dropped the syscall template patch (END_FILE is not needed).
- PATCH 05: remove END_FILE macros.
- PATCH 05: clarify the GNU_PROPERTY macro and related defines.
- PATCH 09: separate hook for PT_GNU_PROPERTY handling.
- PATCH 09: modified rtld.c and dl-load.c accordingly.
- PATCH 09: rename linkmap->bti_guarded to linkmap->bti.
- PATCH 13: new patch, update _mcount for pac-ret.
- fixed TODOs except for the last two patches, which are written
for current gcc behaviour.
- I'm waiting for a review of PATCH 03 and welcome comments on
the rest of the set, which i consider done unless there are
changes on the gcc or linux side.
v2:
- removed --enable-branch-protection-standard configure option,
branch protection in glibc is enabled based on the compiler default.
- GNU property notes are disabled if compiler/linker has no support.
- pac-ret is enabled based on compiler defaults.
- PATCH 03: cleaner csu/abi-note.c and fix arm/abi-note.S.
- PATCH 04: new (bti config check).
- PATCH 09: drop the umount2 change.
- PATCH 10: use bool instead of int.
- PATCH 10: fix code style and comments.
- PATCH 10: add linux version requirement to description.
- PATCH 11: new (pac-ret config check).
- PATCH 12: only use pac-ret if HAVE_AARCH64_PAC_RET.
- PATCH 12: fix pac-ret use in dl-trampoline.S.
- PATCH 13: use static inline instead of macro, update description.
- addressed some of the reviews from Adhemerval, the remaining ones
are marked as TODO in the descriptions and will require another
test run or agreement on the design.
Ran cross tests in qemu using the linux for-next/bti-user branch of
git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git
FAIL: elf/tst-audit14
FAIL: elf/tst-audit15
FAIL: elf/tst-audit16
cross test issue. (/dev/stdout is pipe)
FAIL: elf/tst-ldconfig-ld_so_conf-update
cross test issue. (etc/ld.so.cache is missing)
XPASS: elf/tst-protected1a
XPASS: elf/tst-protected1b
UNSUPPORTED: iconv/tst-gconv-init-failure
FAIL: io/ftwtest
cross test issue. (symlink to nfs root)
FAIL: libio/tst-wfile-sync
cross test issue. (stdin is pipe, bug 24668)
UNSUPPORTED: math/test-fesetexcept-traps
UNSUPPORTED: math/test-fexcept-traps
UNSUPPORTED: math/test-nearbyint-except-2
UNSUPPORTED: misc/tst-pkey
FAIL: nptl/test-cond-printers
FAIL: nptl/test-condattr-printers
FAIL: nptl/test-mutex-printers
FAIL: nptl/test-mutexattr-printers
FAIL: nptl/test-rwlock-printers
FAIL: nptl/test-rwlockattr-printers
cross test issue.
FAIL: nptl/tst-cancel7
FAIL: nptl/tst-cancelx7
cross test issue. (racy test, bug 14232)
UNSUPPORTED: posix/tst-spawn4-compat
UNSUPPORTED: resolv/tst-resolv-ai_idn
UNSUPPORTED: resolv/tst-resolv-ai_idn-latin1
Summary of test results:
14 FAIL
4127 PASS
8 UNSUPPORTED
17 XFAIL
2 XPASS
Sudakshina Das (2):
aarch64: Add BTI support to assembly files
aarch64: enable BTI at runtime
Szabolcs Nagy (11):
elf.h: Add PT_GNU_PROPERTY
elf.h: add aarch64 property definitions
Rewrite abi-note.S in C.
aarch64: configure test for BTI support
aarch64: Rename place holder .S files to .c
aarch64: fix swapcontext for BTI
aarch64: fix RTLD_START for BTI
aarch64: configure check for pac-ret code generation
aarch64: Add pac-ret support to assembly files
aarch64: redefine RETURN_ADDRESS to strip PAC
aarch64: fix _mcount for pac-ret
config.h.in | 6 +
csu/{abi-note.S => abi-note.c} | 28 ++--
elf/dl-load.c | 13 ++
elf/elf.h | 7 +
elf/rtld.c | 6 +
sysdeps/aarch64/Makefile | 4 +
.../aarch64/{bsd-_setjmp.S => bsd-_setjmp.c} | 0
.../aarch64/{bsd-setjmp.S => bsd-setjmp.c} | 0
sysdeps/aarch64/configure | 81 ++++++++++
sysdeps/aarch64/configure.ac | 40 +++++
sysdeps/aarch64/crti.S | 10 ++
sysdeps/aarch64/crtn.S | 8 +
sysdeps/aarch64/dl-bti.c | 54 +++++++
sysdeps/aarch64/dl-machine.h | 5 +-
sysdeps/aarch64/dl-prop.h | 145 ++++++++++++++++++
sysdeps/aarch64/dl-tlsdesc.S | 11 ++
sysdeps/aarch64/dl-trampoline.S | 20 +++
sysdeps/aarch64/linkmap.h | 3 +
sysdeps/aarch64/machine-gmon.h | 2 +-
sysdeps/aarch64/{memmove.S => memmove.c} | 0
sysdeps/aarch64/start.S | 1 +
sysdeps/aarch64/sysdep.h | 57 ++++++-
sysdeps/arm/abi-note.S | 8 -
sysdeps/generic/dl-prop.h | 16 +-
sysdeps/unix/sysv/linux/aarch64/bits/hwcap.h | 1 +
sysdeps/unix/sysv/linux/aarch64/bits/mman.h | 31 ++++
.../unix/sysv/linux/aarch64/cpu-features.c | 3 +
.../unix/sysv/linux/aarch64/cpu-features.h | 2 +
sysdeps/unix/sysv/linux/aarch64/swapcontext.S | 14 +-
sysdeps/x86/dl-prop.h | 6 +
30 files changed, 554 insertions(+), 28 deletions(-)
rename csu/{abi-note.S => abi-note.c} (88%)
rename sysdeps/aarch64/{bsd-_setjmp.S => bsd-_setjmp.c} (100%)
rename sysdeps/aarch64/{bsd-setjmp.S => bsd-setjmp.c} (100%)
create mode 100644 sysdeps/aarch64/dl-bti.c
create mode 100644 sysdeps/aarch64/dl-prop.h
rename sysdeps/aarch64/{memmove.S => memmove.c} (100%)
delete mode 100644 sysdeps/arm/abi-note.S
create mode 100644 sysdeps/unix/sysv/linux/aarch64/bits/mman.h
--
2.17.1
More information about the Libc-alpha
mailing list