From: Szabolcs Nagy <szabolcs.nagy@arm.com>
To: libc-alpha@sourceware.org
Cc: Sudakshina Das <Sudi.Das@arm.com>
Subject: [PATCH 00/12] aarch64: branch protection support
Date: Thu, 30 Apr 2020 18:34:58 +0100 [thread overview]
Message-ID: <20200430173458.GV29015@arm.com> (raw)
Indirect branch target identification (BTI, armv8.5-a) and return
address signing using pointer authentication (PAC-RET, armv8.3-a)
can be used for security hardening against some control flow hijack
attacks.
In gcc these are exposed via -mbranch-protection=bti+pac-ret which
is the same as -mbranch-protection=standard and gcc can be configured
via --enable-standard-branch-protection to use them by default.
BTI requires libc support: it is an opt-in feature per ELF module
via a GNU property NOTE that the dynamic linker has to check and
mprotect the executable pages with PROT_BTI. And libc objects that
are statically linked into user binaries must be BTI compatible
for the GNU property NOTE to be present. (The property NOTE is
handled by linux for static linked executables and for the ld.so.)
PAC-RET does not require libc runtime support, but, just like BTI,
it can be used in libc binaries.
The patch series is not finalized:
- PAC-RET may need to be configure checked and disabled if user
did not explicitly configured glibc with standard branch
protection, because it can have compatibility problems:
requires recent libgcc for working unwinding.
- The GNU property ELF marking can trigger ugly linker warnings
before binutils-2.33 so probably BTI should not be added
unconditionally either.
- Changed the logic of how NOTEs are processed (which may
affect x86 too) because I only wanted to handle PT_GNU_PROPERTY
not PT_NOTE on aarch64. (Otherwise note handling is similar
to the x86 code.)
- Some changes may be better handled by target hooks
(e.g. moved abi-note.S to C and copied the syscall template
just to add the BTI property NOTE)
- The -pg profiling abi with PAC-RET is not finalized: _mcount
currently may get a signed return address as argument so either
it has to remove it or gcc -pg has to be fixed not to pass
such argument to _mcount. (glibc gmon tests currently fail)
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=94791
- Redefined RETURN_ADDRESS for aarch64, this may change depending
on the ruling about
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=94891
- I was considering separating out the bits that are necessary for
just enabling BTI to work in user binaries from changes that are
needed for building glibc itself with BTI, but decided against
it as it needs more work, cannot work with static linking and
unlikely to be very useful.
Ran cross tests in qemu using the linux bti patches from
git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git
i did some changes to the posted patches and rerunning the tests
now, the previous results:
FAIL: gmon/tst-gmon-gprof
FAIL: gmon/tst-gmon-pie-gprof
FAIL: gmon/tst-gmon-static-gprof
_mcount ABI with pac-ret
FAIL: misc/tst-atomic
FAIL: nptl/tst-cancel7
FAIL: nptl/tst-cancelx7
not reproducible issues
FAIL: elf/tst-ldconfig-ld_so_conf-update
not sure, likely something in my cross test setup makes
/etc/ld.so.cache not being reread after a change (nfs?).
FAIL: elf/tst-audit14
FAIL: elf/tst-audit15
FAIL: elf/tst-audit16
missing /dev/stdout (even if i have /dev/stdout
these fail because reading /proc/self/fd/1 fails
in my cross test setup)
FAIL: io/ftwtest
FAIL: libio/tst-wfile-sync
FAIL: nptl/test-cond-printers
FAIL: nptl/test-condattr-printers
FAIL: nptl/test-mutex-printers
FAIL: nptl/test-mutexattr-printers
FAIL: nptl/test-rwlock-printers
FAIL: nptl/test-rwlockattr-printers
cross test issues
Sudakshina Das (3):
aarch64: Add BTI landing pads to assembly code
aarch64: support BTI enabled binaries
aarch64: Configure option to build glibc with branch protection
Szabolcs Nagy (9):
elf.h: Add PT_GNU_PROPERTY
elf.h: add aarch64 property definitions
aarch64: Rename place holder .S files to .c
aarch64: fix swapcontext for BTI
aarch64: fix RTLD_START for BTI
aarch64: fix syscalls for BTI
Rewrite abi-note.S in C.
aarch64: Add pac-ret support to asm files
aarch64: redefine RETURN_ADDRESS to strip PAC
configure | 14 +-
configure.ac | 6 +
csu/{abi-note.S => abi-note.c} | 24 +--
elf/dl-load.c | 2 +
elf/elf.h | 7 +
elf/rtld.c | 2 +
sysdeps/aarch64/Makefile | 8 +
sysdeps/aarch64/__longjmp.S | 1 +
.../aarch64/{bsd-_setjmp.S => bsd-_setjmp.c} | 0
.../aarch64/{bsd-setjmp.S => bsd-setjmp.c} | 0
sysdeps/aarch64/configure | 31 ++++
sysdeps/aarch64/configure.ac | 19 ++
sysdeps/aarch64/crti.S | 12 ++
sysdeps/aarch64/crtn.S | 10 ++
sysdeps/aarch64/dl-bti.c | 54 ++++++
sysdeps/aarch64/dl-machine.h | 5 +-
sysdeps/aarch64/dl-prop.h | 170 ++++++++++++++++++
sysdeps/aarch64/dl-tlsdesc.S | 13 ++
sysdeps/aarch64/dl-trampoline.S | 19 +-
sysdeps/aarch64/linkmap.h | 1 +
sysdeps/aarch64/memchr.S | 1 +
sysdeps/aarch64/memcmp.S | 1 +
sysdeps/aarch64/memcpy.S | 1 +
sysdeps/aarch64/{memmove.S => memmove.c} | 0
sysdeps/aarch64/memrchr.S | 1 +
sysdeps/aarch64/memset.S | 1 +
sysdeps/aarch64/multiarch/memchr_nosimd.S | 1 +
sysdeps/aarch64/multiarch/memcpy_falkor.S | 1 +
sysdeps/aarch64/multiarch/memcpy_thunderx.S | 1 +
sysdeps/aarch64/multiarch/memcpy_thunderx2.S | 1 +
sysdeps/aarch64/multiarch/memmove_falkor.S | 1 +
sysdeps/aarch64/multiarch/memset_base64.S | 1 +
sysdeps/aarch64/multiarch/memset_kunpeng.S | 1 +
sysdeps/aarch64/multiarch/strlen_asimd.S | 1 +
sysdeps/aarch64/rawmemchr.S | 1 +
sysdeps/aarch64/setjmp.S | 1 +
sysdeps/aarch64/start.S | 2 +
sysdeps/aarch64/strchr.S | 1 +
sysdeps/aarch64/strchrnul.S | 1 +
sysdeps/aarch64/strcmp.S | 1 +
sysdeps/aarch64/strcpy.S | 1 +
sysdeps/aarch64/strlen.S | 1 +
sysdeps/aarch64/strncmp.S | 1 +
sysdeps/aarch64/strnlen.S | 1 +
sysdeps/aarch64/strrchr.S | 1 +
sysdeps/aarch64/sysdep.h | 53 +++++-
sysdeps/unix/sysv/linux/aarch64/__read_tp.S | 1 +
sysdeps/unix/sysv/linux/aarch64/bits/hwcap.h | 1 +
sysdeps/unix/sysv/linux/aarch64/bits/mman.h | 31 ++++
sysdeps/unix/sysv/linux/aarch64/clone.S | 1 +
.../unix/sysv/linux/aarch64/cpu-features.c | 3 +
.../unix/sysv/linux/aarch64/cpu-features.h | 1 +
sysdeps/unix/sysv/linux/aarch64/getcontext.S | 1 +
sysdeps/unix/sysv/linux/aarch64/ioctl.S | 1 +
.../unix/sysv/linux/aarch64/libc-__read_tp.S | 1 +
sysdeps/unix/sysv/linux/aarch64/setcontext.S | 1 +
sysdeps/unix/sysv/linux/aarch64/swapcontext.S | 15 +-
.../sysv/linux/aarch64/syscall-template.S | 20 +++
sysdeps/unix/sysv/linux/aarch64/syscall.S | 1 +
sysdeps/unix/sysv/linux/aarch64/umount2.S | 25 +++
sysdeps/unix/sysv/linux/aarch64/vfork.S | 1 +
61 files changed, 564 insertions(+), 16 deletions(-)
rename csu/{abi-note.S => abi-note.c} (85%)
rename sysdeps/aarch64/{bsd-_setjmp.S => bsd-_setjmp.c} (100%)
rename sysdeps/aarch64/{bsd-setjmp.S => bsd-setjmp.c} (100%)
create mode 100644 sysdeps/aarch64/dl-bti.c
create mode 100644 sysdeps/aarch64/dl-prop.h
rename sysdeps/aarch64/{memmove.S => memmove.c} (100%)
create mode 100644 sysdeps/unix/sysv/linux/aarch64/bits/mman.h
create mode 100644 sysdeps/unix/sysv/linux/aarch64/syscall-template.S
create mode 100644 sysdeps/unix/sysv/linux/aarch64/umount2.S
--
2.17.1
next reply other threads:[~2020-04-30 17:35 UTC|newest]
Thread overview: 48+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-04-30 17:34 Szabolcs Nagy [this message]
2020-04-30 17:37 ` [PATCH 01/12] elf.h: Add PT_GNU_PROPERTY Szabolcs Nagy
2020-05-07 14:49 ` Adhemerval Zanella
2020-04-30 17:37 ` [PATCH 02/12] elf.h: add aarch64 property definitions Szabolcs Nagy
2020-05-07 14:50 ` Adhemerval Zanella
2020-04-30 17:39 ` [PATCH 03/12] aarch64: Add BTI landing pads to assembly code Szabolcs Nagy
2020-05-07 16:55 ` Adhemerval Zanella
2020-05-11 11:38 ` Szabolcs Nagy
2020-05-11 19:13 ` Adhemerval Zanella
2020-04-30 17:40 ` [PATCH 04/12] aarch64: Rename place holder .S files to .c Szabolcs Nagy
2020-05-07 18:29 ` Adhemerval Zanella
2020-04-30 17:41 ` [PATCH 05/12] aarch64: fix swapcontext for BTI Szabolcs Nagy
2020-05-07 18:42 ` Adhemerval Zanella
2020-04-30 17:42 ` [PATCH 06/12] aarch64: fix RTLD_START " Szabolcs Nagy
2020-05-07 18:49 ` Adhemerval Zanella
2020-05-07 19:24 ` Szabolcs Nagy
2020-05-07 19:55 ` Adhemerval Zanella
2020-05-07 20:14 ` Szabolcs Nagy
2020-05-07 20:20 ` Adhemerval Zanella
2020-04-30 17:42 ` [PATCH 07/12] aarch64: fix syscalls " Szabolcs Nagy
2020-05-07 19:40 ` Adhemerval Zanella
2020-05-11 11:46 ` Szabolcs Nagy
2020-04-30 17:43 ` [PATCH 08/12] Rewrite abi-note.S in C Szabolcs Nagy
2020-04-30 20:07 ` Zack Weinberg
2020-05-01 9:23 ` Szabolcs Nagy
2020-05-01 14:07 ` Zack Weinberg
2020-04-30 17:44 ` [PATCH 09/12] aarch64: support BTI enabled binaries Szabolcs Nagy
2020-05-07 21:07 ` Adhemerval Zanella
2020-05-11 11:04 ` Szabolcs Nagy
2020-05-11 18:38 ` Adhemerval Zanella
2020-04-30 17:44 ` [PATCH 10/12] aarch64: Add pac-ret support to asm files Szabolcs Nagy
2020-05-08 16:59 ` Adhemerval Zanella
2020-05-11 8:27 ` Szabolcs Nagy
2020-05-11 18:39 ` Adhemerval Zanella
2020-04-30 17:45 ` [PATCH 11/12] aarch64: redefine RETURN_ADDRESS to strip PAC Szabolcs Nagy
2020-05-08 17:44 ` Adhemerval Zanella
2020-05-11 12:38 ` Szabolcs Nagy
2020-05-11 19:15 ` Adhemerval Zanella
2020-05-11 19:21 ` Florian Weimer
2020-05-11 20:13 ` Adhemerval Zanella
2020-05-11 20:18 ` Florian Weimer
2020-05-11 19:22 ` Florian Weimer
2020-05-11 20:45 ` Adhemerval Zanella
2020-05-12 8:42 ` Szabolcs Nagy
2020-04-30 17:45 ` [PATCH 12/12] aarch64: Configure option to build glibc with branch protection Szabolcs Nagy
2020-04-30 19:02 ` Joseph Myers
2020-05-08 17:53 ` Adhemerval Zanella
2020-05-04 11:27 ` [PATCH 00/12] aarch64: branch protection support Szabolcs Nagy
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20200430173458.GV29015@arm.com \
--to=szabolcs.nagy@arm.com \
--cc=Sudi.Das@arm.com \
--cc=libc-alpha@sourceware.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).