mbox series

[v2,00/13] aarch64: branch protection support

Message ID cover.1589277641.git.szabolcs.nagy@arm.com
Headers show
Series aarch64: branch protection support | expand

Message

Szabolcs Nagy May 12, 2020, 10:14 a.m. UTC 
Indirect branch target identification (BTI, armv8.5-a) and return
address signing using pointer authentication (PAC-RET, armv8.3-a)
can be used for security hardening against some control flow hijack
attacks.

In gcc these are exposed via -mbranch-protection=bti+pac-ret which
is the same as -mbranch-protection=standard and gcc can be configured
via --enable-standard-branch-protection to use them by default.

BTI requires libc support: it is an opt-in feature per ELF module
via a GNU property NOTE that the dynamic linker has to check and
mprotect the executable pages with PROT_BTI. And libc objects that
are statically linked into user binaries must be BTI compatible
for the GNU property NOTE to be present. (The property NOTE is
handled by linux for static linked executables and for the ld.so.)

PAC-RET does not require libc runtime support, but, just like BTI,
it can be used in libc binaries.

v2:
- removed --enable-branch-protection-standard configure option,
  branch protection in glibc is enabled based on the compiler default.
- GNU property notes are disabled if compiler/linker has no support.
- pac-ret is enabled based on compiler defaults.
- PATCH 03: cleaner csu/abi-note.c and fix arm/abi-note.S.
- PATCH 04: new (bti config check).
- PATCH 09: drop the umount2 change.
- PATCH 10: use bool instead of int.
- PATCH 10: fix code style and comments.
- PATCH 10: add linux version requirement to description.
- PATCH 11: new (pac-ret config check).
- PATCH 12: only use pac-ret if HAVE_AARCH64_PAC_RET.
- PATCH 12: fix pac-ret use in dl-trampoline.S.
- PATCH 13: use static inline instead of macro, update description.
- addressed some of the reviews from Adhemerval, the remaining ones
  are marked as TODO in the descriptions and will require another
  test run or agreement on the design.

Ran cross tests in qemu using the linux for-next/bti-user branch of
git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git

FAIL: elf/tst-audit14
FAIL: elf/tst-audit15
FAIL: elf/tst-audit16
	cross test issues.
	(/dev/stdout is not a regular file, but pipe created by sshd)
FAIL: elf/tst-ldconfig-ld_so_conf-update
	cross test issue.
	(seems to be the lack of etc/ld.so.cache which is not installed
	when cross building glibc)
XPASS: elf/tst-protected1a
XPASS: elf/tst-protected1b
FAIL: gmon/tst-gmon-gprof
FAIL: gmon/tst-gmon-pie-gprof
FAIL: gmon/tst-gmon-static-gprof
	-pg abi (_mcount does not drop pac but receives address with it)
	https://gcc.gnu.org/bugzilla/show_bug.cgi?id=94791
UNSUPPORTED: iconv/tst-gconv-init-failure
FAIL: io/ftwtest
FAIL: libio/tst-wfile-sync
	cross test issues.
UNSUPPORTED: math/test-fesetexcept-traps
UNSUPPORTED: math/test-fexcept-traps
UNSUPPORTED: math/test-nearbyint-except-2
UNSUPPORTED: misc/tst-pkey
FAIL: nptl/test-cond-printers
FAIL: nptl/test-condattr-printers
FAIL: nptl/test-mutex-printers
FAIL: nptl/test-mutexattr-printers
FAIL: nptl/test-rwlock-printers
FAIL: nptl/test-rwlockattr-printers
	cross test issues.
FAIL: nptl/tst-cancel7
FAIL: nptl/tst-cancelx7
	bug 14232
UNSUPPORTED: posix/tst-spawn4-compat
UNSUPPORTED: resolv/tst-resolv-ai_idn
UNSUPPORTED: resolv/tst-resolv-ai_idn-latin1
Summary of test results:
     17 FAIL
   4123 PASS
      8 UNSUPPORTED
     17 XFAIL
      2 XPASS

Sudakshina Das (2):
  aarch64: Add BTI landing pads to assembly code
  aarch64: enable BTI at runtime

Szabolcs Nagy (11):
  elf.h: Add PT_GNU_PROPERTY
  elf.h: add aarch64 property definitions
  Rewrite abi-note.S in C.
  aarch64: configure test for BTI support
  aarch64: Rename place holder .S files to .c
  aarch64: fix swapcontext for BTI
  aarch64: fix RTLD_START for BTI
  aarch64: fix syscalls for BTI
  aarch64: configure check for pac-ret code generation
  aarch64: Add pac-ret support to asm files
  aarch64: redefine RETURN_ADDRESS to strip PAC

 config.h.in                                   |   6 +
 csu/{abi-note.S => abi-note.c}                |  28 +--
 elf/dl-load.c                                 |   2 +
 elf/elf.h                                     |   7 +
 elf/rtld.c                                    |   2 +
 sysdeps/aarch64/Makefile                      |   4 +
 sysdeps/aarch64/__longjmp.S                   |   1 +
 .../aarch64/{bsd-_setjmp.S => bsd-_setjmp.c}  |   0
 .../aarch64/{bsd-setjmp.S => bsd-setjmp.c}    |   0
 sysdeps/aarch64/configure                     |  81 +++++++++
 sysdeps/aarch64/configure.ac                  |  40 +++++
 sysdeps/aarch64/crti.S                        |  12 ++
 sysdeps/aarch64/crtn.S                        |  10 ++
 sysdeps/aarch64/dl-bti.c                      |  54 ++++++
 sysdeps/aarch64/dl-machine.h                  |   5 +-
 sysdeps/aarch64/dl-prop.h                     | 170 ++++++++++++++++++
 sysdeps/aarch64/dl-tlsdesc.S                  |  13 ++
 sysdeps/aarch64/dl-trampoline.S               |  22 +++
 sysdeps/aarch64/linkmap.h                     |   3 +
 sysdeps/aarch64/memchr.S                      |   1 +
 sysdeps/aarch64/memcmp.S                      |   1 +
 sysdeps/aarch64/memcpy.S                      |   1 +
 sysdeps/aarch64/{memmove.S => memmove.c}      |   0
 sysdeps/aarch64/memrchr.S                     |   1 +
 sysdeps/aarch64/memset.S                      |   1 +
 sysdeps/aarch64/multiarch/memchr_nosimd.S     |   1 +
 sysdeps/aarch64/multiarch/memcpy_falkor.S     |   1 +
 sysdeps/aarch64/multiarch/memcpy_thunderx.S   |   1 +
 sysdeps/aarch64/multiarch/memcpy_thunderx2.S  |   1 +
 sysdeps/aarch64/multiarch/memmove_falkor.S    |   1 +
 sysdeps/aarch64/multiarch/memset_base64.S     |   1 +
 sysdeps/aarch64/multiarch/memset_kunpeng.S    |   1 +
 sysdeps/aarch64/multiarch/strlen_asimd.S      |   1 +
 sysdeps/aarch64/rawmemchr.S                   |   1 +
 sysdeps/aarch64/setjmp.S                      |   1 +
 sysdeps/aarch64/start.S                       |   2 +
 sysdeps/aarch64/strchr.S                      |   1 +
 sysdeps/aarch64/strchrnul.S                   |   1 +
 sysdeps/aarch64/strcmp.S                      |   1 +
 sysdeps/aarch64/strcpy.S                      |   1 +
 sysdeps/aarch64/strlen.S                      |   1 +
 sysdeps/aarch64/strncmp.S                     |   1 +
 sysdeps/aarch64/strnlen.S                     |   1 +
 sysdeps/aarch64/strrchr.S                     |   1 +
 sysdeps/aarch64/sysdep.h                      |  55 +++++-
 sysdeps/arm/abi-note.S                        |   8 -
 sysdeps/unix/sysv/linux/aarch64/__read_tp.S   |   1 +
 sysdeps/unix/sysv/linux/aarch64/bits/hwcap.h  |   1 +
 sysdeps/unix/sysv/linux/aarch64/bits/mman.h   |  31 ++++
 sysdeps/unix/sysv/linux/aarch64/clone.S       |   1 +
 .../unix/sysv/linux/aarch64/cpu-features.c    |   3 +
 .../unix/sysv/linux/aarch64/cpu-features.h    |   2 +
 sysdeps/unix/sysv/linux/aarch64/getcontext.S  |   1 +
 sysdeps/unix/sysv/linux/aarch64/ioctl.S       |   1 +
 .../unix/sysv/linux/aarch64/libc-__read_tp.S  |   1 +
 sysdeps/unix/sysv/linux/aarch64/setcontext.S  |   1 +
 sysdeps/unix/sysv/linux/aarch64/swapcontext.S |  15 +-
 .../sysv/linux/aarch64/syscall-template.S     |  20 +++
 sysdeps/unix/sysv/linux/aarch64/syscall.S     |   1 +
 sysdeps/unix/sysv/linux/aarch64/vfork.S       |   1 +
 60 files changed, 606 insertions(+), 22 deletions(-)
 rename csu/{abi-note.S => abi-note.c} (88%)
 rename sysdeps/aarch64/{bsd-_setjmp.S => bsd-_setjmp.c} (100%)
 rename sysdeps/aarch64/{bsd-setjmp.S => bsd-setjmp.c} (100%)
 create mode 100644 sysdeps/aarch64/dl-bti.c
 create mode 100644 sysdeps/aarch64/dl-prop.h
 rename sysdeps/aarch64/{memmove.S => memmove.c} (100%)
 delete mode 100644 sysdeps/arm/abi-note.S
 create mode 100644 sysdeps/unix/sysv/linux/aarch64/bits/mman.h
 create mode 100644 sysdeps/unix/sysv/linux/aarch64/syscall-template.S