From: Sudakshina Das <Sudi.Das@arm.com>
To: "binutils@sourceware.org" <binutils@sourceware.org>
Cc: nd <nd@arm.com>, "nickc@redhat.com" <nickc@redhat.com>,
Richard Earnshaw <Richard.Earnshaw@arm.com>,
Ramana Radhakrishnan <Ramana.Radhakrishnan@arm.com>
Subject: [PATCH, BFD, LD, AArch64, 0/4] Add support for AArch64 BTI and PAC in the linker
Date: Wed, 06 Mar 2019 10:26:00 -0000 [thread overview]
Message-ID: <08762e41-1e80-a504-d840-f8715ea59a50@arm.com> (raw)
Hi
This patch series is aimed at giving support for the new Armv8.3-A
Pointer Authentication and Armv8.5-A Branch Target Identification
feature in the linker.
In order to support these, we propose to make the following changes:
1) We have defined .note.gnu.property for AArch64.
2) We have defined a new Program Property type
GNU_PROPERTY_AARCH64_FEATURE_1_AND and used 2 bits to represent
BTI and PAC respectively.
- GNU_PROPERTY_AARCH64_FEATURE_1_BTI
- GNU_PROPERTY_AARCH64_FEATURE_1_PAC (We have only reserved this bit
for now.)
3) We also need custom PLTs when these features are turned on and thus
we have defined the following processor-specific dynamic array tags:
- DT_AARCH64_BTI_PLT
- DT_AARCH64_PAC_PLT
Details of these can be found in the new AArch64 ELF documentation:
https://developer.arm.com/docs/ihi0056/latest/elf-for-the-arm-64-bit-architecture-aarch64-abi-2018q4
Command line options:
We introduce a new set of command line options for the linker in order
to support the correct PLTs
1) --pac-plt : In the presence of this option, the linker uses a PAC
enabled PLT. It also uses the dynamic tag DT_AARCH64_PAC_PLT to reflect
the same. Other tools like Objdump can use this to determine the size of
the PLTs.
2) --bti: In the presence of this option, the linker enables BTI with
the GNU_PROPERTY_AARCH64_FEATURE_1_BTI feature and also uses a BTI
enabled PLT. It also uses the dynamic tag DT_AARCH64_BTI_PLT to reflect
the choice of the PLTs. Other tools like Objdump can use this to
determine the size of the PLTs. Using this option can give a warning if
not all input objects are marked with GNU_PROPERTY_AARCH64_FEATURE_1_BTI.
3)--bti-nowarn - Same as above but does not emit any warnings.
In terms of the PLTs, in the presence of both --pac-plt and
--bti/--bti-nowarn, the linker chooses the PLTs protected with both BTI
and PAC and uses both DT_AARCH64_PAC_PLT and DT_AARCH64_BTI_PLT.
Interaction between Command line arguments and GNU NOTE section
1) For PAC, in the presence of --pac-plt along with BIND_NOW, the linker
can choose to ignore the pac-plt directive and use smaller PLTs without
compromising on security,
2) For BTI, the linker must also check for the
GNU_PROPERTY_AARCH64_FEATURE_1_BTI in its input. If all inputs have
GNU_PROPERTY_AARCH64_FEATURE_1_BTI, the final output will also be marked
as such. The PLT should also be protected with a BTI PLT in this case.
Thus even if there is no linker option to use BTI PLT, the linker
should be able to use them depending on the NOTE section. The user can
use the linker option --bti, to make sure that their intention of having
all input objects (and hence the output) marked with BTI is not
disrupted by any stray objects as this option will warn about it.
The following patches implement these changes as follows:
[1/4] Add support for GNU PROPERTIES in AArch64 for BTI and PAC:
[2/4] Add --bti-nowarn to enable BTI without warning and to select BTI
enabled PLTs
[3/4] Add --bti to enable BTI and select BTI enabled PLTs but also warn
for missing NOTE sections.
[4/4] Add --pac-plt to enable PLTs protected with PAC.
This is my first time making such intrusive changes to the linker.
Please be kind :P
Thanks
Sudi
next reply other threads:[~2019-03-06 10:26 UTC|newest]
Thread overview: 22+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-03-06 10:26 Sudakshina Das [this message]
2019-03-06 10:31 ` [PATCH, BFD, LD, AArch64, 1/4] Add support for GNU PROPERTIES in AArch64 for BTI and PAC Sudakshina Das
2019-03-06 10:34 ` [PATCH, BFD, LD, AArch64, 2/4] Add --bti-nowarn to enable BTI without warning and to select BTI enabled PLTs Sudakshina Das
2019-03-06 10:36 ` [PATCH, BFD, LD, AArch64, 3/4] Add --bti to enable BTI and select BTI enabled PLTs but also warn for missing NOTE sections Sudakshina Das
2019-03-06 10:39 ` [PATCH, BFD, LD, AArch64, 4/4] Add --pac-plt to enable PLTs protected with PAC Sudakshina Das
2019-04-11 14:47 ` Szabolcs Nagy
2019-03-07 12:37 ` [PATCH, BFD, LD, AArch64, 0/4] Add support for AArch64 BTI and PAC in the linker Nick Clifton
2019-03-07 14:28 ` Sudakshina Das
2019-03-07 15:26 ` Peter Smith
2019-03-07 15:35 ` Nick Clifton
2019-03-07 15:49 ` Szabolcs Nagy
2019-03-07 15:33 ` Nick Clifton
2019-03-07 17:53 ` Sudakshina Das
2019-03-08 10:07 ` Nick Clifton
2019-03-08 11:08 ` Szabolcs Nagy
2019-03-08 11:14 ` Ramana Radhakrishnan
2019-03-08 11:46 ` Peter Smith
2019-03-08 12:32 ` Nick Clifton
2019-03-08 12:44 ` Ramana Radhakrishnan
2019-03-08 13:36 ` Sudakshina Das
2019-03-11 12:30 ` Nick Clifton
2019-03-13 11:49 ` Sudakshina Das
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=08762e41-1e80-a504-d840-f8715ea59a50@arm.com \
--to=sudi.das@arm.com \
--cc=Ramana.Radhakrishnan@arm.com \
--cc=Richard.Earnshaw@arm.com \
--cc=binutils@sourceware.org \
--cc=nd@arm.com \
--cc=nickc@redhat.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).