[PATCH 3/4] aarch64: Support enforcing BTI on dependencies

[Yury Khrustalev]

---
 sysdeps/aarch64/dl-bti.c  | 18 ++++++++++++++++++
 sysdeps/aarch64/linkmap.h |  1 +
 2 files changed, 19 insertions(+)

diff --git a/sysdeps/aarch64/dl-bti.c b/sysdeps/aarch64/dl-bti.c
index de6130470e..3d9f3653bc 100644
--- a/sysdeps/aarch64/dl-bti.c
+++ b/sysdeps/aarch64/dl-bti.c
@@ -31,6 +31,10 @@
 void
 _dl_bti_protect (struct link_map *map, int fd)
 {
+
+  /* If we try to enable BTI protection, MAP must be BTI marked.  */
+  map->l_mach.bti = 1;
+
   const size_t pagesz = GLRO(dl_pagesize);
   const ElfW(Phdr) *phdr;
 
@@ -72,6 +76,10 @@ bti_failed (struct link_map *l, const char *program)
 		      N_("failed to turn on BTI protection"));
 }
 
+enum {
+  BTI_CHECK_PERMISSIVE = 0,
+  BTI_CHECK_ENFORCED = 1,
+};
 
 /* Enable BTI for L and its dependencies.  */
 
@@ -84,10 +92,20 @@ _dl_bti_check (struct link_map *l, const char *program)
   if (l->l_mach.bti_fail)
     bti_failed (l, program);
 
+  /* We enforce BTI if tunable is set and if this object has BTI marking.  */
+  bool enforce_bti = GLRO (dl_aarch64_bti) == BTI_CHECK_ENFORCED;
+
   for (unsigned int i = 0; i < l->l_searchlist.r_nlist; i++)
     {
       struct link_map *dep = l->l_searchlist.r_list[i];
       if (dep->l_mach.bti_fail)
 	bti_failed (dep, program);
+#ifdef SHARED
+      /* Ignore BTI marking on ld.so: its properties are not processed.  */
+      if (is_rtld_link_map (dep->l_real))
+        continue;
+#endif
+      if (enforce_bti && !dep->l_mach.bti)
+        bti_failed (dep, program);
     }
 }
diff --git a/sysdeps/aarch64/linkmap.h b/sysdeps/aarch64/linkmap.h
index e56c890aea..4cd0492209 100644
--- a/sysdeps/aarch64/linkmap.h
+++ b/sysdeps/aarch64/linkmap.h
@@ -24,4 +24,5 @@ struct link_map_machine
   void *tlsdesc_table;	  /* Address of TLS descriptor hash table.  */
   bool bti_fail;	  /* Failed to enable Branch Target Identification.  */
   bool gcs;		  /* Guarded Control Stack marking.  */
+  bool bti;		  /* Branch Target Identification marking.  */
 };
-- 
2.47.3