[PATCH v3 2/4] aarch64: Add glibc.cpu.aarch64_bti tunable

[Adhemerval Zanella Netto]

I think this patch should be merged with the following one, since I do
see much logic of adding the documentation and the tunable without the
enforcement logic.

On 26/11/25 13:45, Yury Khrustalev wrote:
> ---
>  manual/tunables.texi                           | 16 ++++++++++++++++
>  sysdeps/aarch64/dl-tunables.list               |  6 ++++++
>  sysdeps/unix/sysv/linux/aarch64/cpu-features.c |  2 ++
>  sysdeps/unix/sysv/linux/aarch64/dl-procinfo.c  | 16 ++++++++++++++++
>  4 files changed, 40 insertions(+)
> 
> diff --git a/manual/tunables.texi b/manual/tunables.texi
> index 4d3c6e9933..cbbde8f412 100644
> --- a/manual/tunables.texi
> +++ b/manual/tunables.texi
> @@ -598,6 +598,22 @@ This tunable is specific to x86-64 and effective only when the lazy
>  binding is disabled.
>  @end deftp
>  
> +@deftp Tunable glibc.cpu.aarch64_bti
> +This tunable controls Branch Target Identification (BTI) handling for the
> +process. This handling is implemented via protecting the memory mapping
> +with @code{PROT_BTI} for modules that are marked with the appropriate ELF
> +property.

Maybe that this is enable with the presence of GNU_PROPERTY_AARCH64_FEATURE_1_AND
along with GNU_PROPERTY_AARCH64_FEATURE_1_BTI.  I think it can be useful
add more context on the manual.

> +
> +Accepted values are:
> +
> +0 = permissive: BTI protection is enabled only for modules that have BTI
> +marking (default).
> +
> +1 = enforced: if a module that does not have BTI marking is loaded, it is
> +an error (either a process abort or a @code{dlopen} error if this binary
> +is loaded via @code{dlopen}).
> +@end deftp
> +
>  @deftp Tunable glibc.cpu.aarch64_gcs
>  This tunable controls Guarded Control Stack (GCS) for the process.
>  
> diff --git a/sysdeps/aarch64/dl-tunables.list b/sysdeps/aarch64/dl-tunables.list
> index d461c1e9db..40757ac046 100644
> --- a/sysdeps/aarch64/dl-tunables.list
> +++ b/sysdeps/aarch64/dl-tunables.list
> @@ -21,6 +21,12 @@ glibc {
>      name {
>        type: STRING
>      }
> +    aarch64_bti {
> +      type: UINT_64
> +      minval: 0
> +      maxval: 1
> +      default: 0
> +    }
>      aarch64_gcs {
>        type: UINT_64
>        minval: 0
> diff --git a/sysdeps/unix/sysv/linux/aarch64/cpu-features.c b/sysdeps/unix/sysv/linux/aarch64/cpu-features.c
> index 1acc82d077..a05a4ce794 100644
> --- a/sysdeps/unix/sysv/linux/aarch64/cpu-features.c
> +++ b/sysdeps/unix/sysv/linux/aarch64/cpu-features.c
> @@ -137,6 +137,8 @@ init_cpu_features (struct cpu_features *cpu_features)
>  
>    /* Check if BTI is supported.  */
>    cpu_features->bti = GLRO (dl_hwcap2) & HWCAP2_BTI;
> +  if (cpu_features->bti)
> +    GLRO (dl_aarch64_bti) = TUNABLE_GET (glibc, cpu, aarch64_bti, uint64_t, 0);
>  
>    /* Setup memory tagging support if the HW and kernel support it, and if
>       the user has requested it.  */
> diff --git a/sysdeps/unix/sysv/linux/aarch64/dl-procinfo.c b/sysdeps/unix/sysv/linux/aarch64/dl-procinfo.c
> index 20966e0478..20083b1475 100644
> --- a/sysdeps/unix/sysv/linux/aarch64/dl-procinfo.c
> +++ b/sysdeps/unix/sysv/linux/aarch64/dl-procinfo.c
> @@ -56,5 +56,21 @@ PROCINFO_CLASS struct cpu_features _dl_aarch64_cpu_features
>  # endif
>  #endif
>  
> +#if !IS_IN (ldconfig)
> +# if !defined PROCINFO_DECL && defined SHARED
> +  ._dl_aarch64_bti
> +# else
> +PROCINFO_CLASS unsigned long _dl_aarch64_bti

Does it need to be an unsigned long? From the manual documentation
a boot is should suffice.

> +# endif
> +# ifndef PROCINFO_DECL
> += 0
> +# endif
> +# if !defined SHARED || defined PROCINFO_DECL
> +;
> +# else
> +,
> +# endif
> +#endif
> +
>  #undef PROCINFO_DECL
>  #undef PROCINFO_CLASS