[PATCH v4 0/3] aarch64: Support enforcing BTI

[Jeremy Linton]

Hi,

On 12/1/25 10:14 AM, Yury Khrustalev wrote:
> Current behaviour on AArch64 targets that support Branch Target
> Authentication (BTI) allows to load a dependency that is not
> BTI-marked. It is useful to support another behaviour when loading
> a dependency without BTI-marking results in an error. To allow
> switching between these modes, we add a new Glibc tunable called
> glibc.cpu.aarch64_bti.
> 
> The default value 0 of this tunable corresponds to existing behaviour
> and we label this value as "permissive". To enforce BTI protection,
> the process should be started with the value 1 of this tunable. In
> such a case all dependencies loaded by the dynamic loader will have
> to be correctly marked, otherwise the process will be aborted. If an
> unmarked module is loaded via dlopen(), an error will be returned and
> such module will not be loaded.
> 
> To facilitate testing, we also need to add new configure checks.

I built this for fedora and tested it on on an armv9 machine with BTI 
enabled/disabled. Both standalone on the command line for particular 
applications, but also globally using systemd to set the environment 
variable via systemd.setenv and friends. This assures that services (or 
the boot path) remains BTI protected.

Further. the unit tests behaviors appear to be correct over GCC building 
wiht/without -mbranch-protection as well as whether the host machine 
supports BTI.

So the set appears to do what it claims on the tin, thanks for taking 
care of this.

Tested-by: Jeremy Linton <jeremy.linton@arm.com>




> 
> ---
> 
> Passes regression in AArch64. OK for trunk?
> Base commit: 20092f2ef6
> 
> ---
> 
> Changes in v4:
>   - Merged commits 2 and 3 from v3 (adding a tunable and using it
>     are both in the same commit now).
>   - Added link to the sysvabi64 document for more information on
>     ELF properties.
>   - Small fixes based on feedback.
>   - v3: https://inbox.sourceware.org/libc-alpha/20251126164557.4058839-1-yury.khrustalev@arm.com/
> 
> Changes in v3:
>   - Changed configure check that determines if BTI protection
>     is available (similar to GCS checks from [1]). No need to
>     deal with autoconf preprocessor macros.
>   - v2: https://inbox.sourceware.org/libc-alpha/20251119163521.2065210-1-yury.khrustalev@arm.com/
> 
> Changes in v2:
>   - Fixed several things based on upstream feedback.
>   - Added new configure check for a macro defined by a compiler
>     to check if BTI branch protection was enabled.
>   - v1: https://inbox.sourceware.org/libc-alpha/20251031153704.3883875-1-yury.khrustalev@arm.com/
> 
> [1]: https://inbox.sourceware.org/libc-alpha/20251124154157.3560464-1-yury.khrustalev@arm.com/
> 
> ---
> 
> Yury Khrustalev (3):
>    aarch64: Add configure checks for BTI support
>    aarch64: Support enforcing BTI on dependencies
>    aarch64: Add tests for glibc.cpu.aarch64_bti behaviour
> 
>   manual/tunables.texi                          |  17 +++
>   sysdeps/aarch64/Makefile                      |  57 ++++++-
>   sysdeps/aarch64/configure                     | 144 ++++++++++++++++++
>   sysdeps/aarch64/configure.ac                  |  36 +++++
>   sysdeps/aarch64/cpu-features.h                |   5 +
>   sysdeps/aarch64/dl-bti.c                      |  15 ++
>   sysdeps/aarch64/dl-tunables.list              |   6 +
>   sysdeps/aarch64/linkmap.h                     |   1 +
>   sysdeps/aarch64/tst-bti-abort-imm.c           |   3 +
>   sysdeps/aarch64/tst-bti-abort-transitive.c    |   3 +
>   sysdeps/aarch64/tst-bti-abort-unprot.c        |   3 +
>   sysdeps/aarch64/tst-bti-abort.sh              |  39 +++++
>   sysdeps/aarch64/tst-bti-dep-prot.c            |   3 +
>   sysdeps/aarch64/tst-bti-dlopen-imm.c          |   6 +
>   sysdeps/aarch64/tst-bti-dlopen-prot.c         |   6 +
>   sysdeps/aarch64/tst-bti-dlopen-transitive.c   |   6 +
>   sysdeps/aarch64/tst-bti-mod-prot.c            |  30 ++++
>   sysdeps/aarch64/tst-bti-mod-unprot.c          |  30 ++++
>   sysdeps/aarch64/tst-bti-mod.c                 |  27 ++++
>   sysdeps/aarch64/tst-bti-permissive-dlopen.c   |   6 +
>   sysdeps/aarch64/tst-bti-permissive-imm.c      |   3 +
>   .../aarch64/tst-bti-permissive-transitive.c   |   3 +
>   sysdeps/aarch64/tst-bti-skeleton-dlopen.c     |  62 ++++++++
>   sysdeps/aarch64/tst-bti-skeleton.c            |  45 ++++++
>   .../unix/sysv/linux/aarch64/cpu-features.c    |   2 +
>   sysdeps/unix/sysv/linux/aarch64/dl-procinfo.c |  16 ++
>   26 files changed, 573 insertions(+), 1 deletion(-)
>   create mode 100644 sysdeps/aarch64/tst-bti-abort-imm.c
>   create mode 100644 sysdeps/aarch64/tst-bti-abort-transitive.c
>   create mode 100644 sysdeps/aarch64/tst-bti-abort-unprot.c
>   create mode 100644 sysdeps/aarch64/tst-bti-abort.sh
>   create mode 100644 sysdeps/aarch64/tst-bti-dep-prot.c
>   create mode 100644 sysdeps/aarch64/tst-bti-dlopen-imm.c
>   create mode 100644 sysdeps/aarch64/tst-bti-dlopen-prot.c
>   create mode 100644 sysdeps/aarch64/tst-bti-dlopen-transitive.c
>   create mode 100644 sysdeps/aarch64/tst-bti-mod-prot.c
>   create mode 100644 sysdeps/aarch64/tst-bti-mod-unprot.c
>   create mode 100644 sysdeps/aarch64/tst-bti-mod.c
>   create mode 100644 sysdeps/aarch64/tst-bti-permissive-dlopen.c
>   create mode 100644 sysdeps/aarch64/tst-bti-permissive-imm.c
>   create mode 100644 sysdeps/aarch64/tst-bti-permissive-transitive.c
>   create mode 100644 sysdeps/aarch64/tst-bti-skeleton-dlopen.c
>   create mode 100644 sysdeps/aarch64/tst-bti-skeleton.c
>