Enabling AARCH64 BTI

Enabling AARCH64 BTI

[William Roberts]

I was looking at packages that don't declare BTI in the GNU Notes
section of the ELF file, and found libffi was missing that.
Investigating libffi, it enables BTI, but does not add it to the notes
section and if it's not in the notes section the linker/loader will
disable BTI for the target process.

https://github.com/libffi/libffi/pull/822

Here are some helpful notes and details on it as explained by others:
  - https://maskray.me/blog/2023-03-05-linker-notes-on-aarch64
  - https://reviews.llvm.org/D62609

Thanks,
Bill

Re: Enabling AARCH64 BTI

[DJ Delorie]

William Roberts via Libffi-discuss <libffi-discuss@sourceware.org>
writes:
> https://github.com/libffi/libffi/pull/822

Are there any labels in that *.S that need to be tagged with BTI ?

Re: Enabling AARCH64 BTI

[William Roberts]

[-- Attachment #1: Type: text/plain, Size: 370 bytes --]

No, but it needs to be enabled in the good new notes for the ELF file or it
gets disabled. I have a PR up.

On Tue, Feb 6, 2024, 15:10 DJ Delorie <dj@redhat.com> wrote:

> William Roberts via Libffi-discuss <libffi-discuss@sourceware.org>
> writes:
> > https://github.com/libffi/libffi/pull/822
>
> Are there any labels in that *.S that need to be tagged with BTI ?
>
>

Re: Enabling AARCH64 BTI

[DJ Delorie]

William Roberts <bill.c.roberts@gmail.com> writes:
> No, but it needs to be enabled in the good new notes for the ELF file
> or it gets disabled. I have a PR up.

I understood that part, I just didn't want it to go from "not enabled"
to "enabled but always crashes" ;-)

Re: Enabling AARCH64 BTI

[William Roberts]

On Tue, Feb 6, 2024, 16:36 DJ Delorie <dj@redhat.com> wrote:
>
> William Roberts <bill.c.roberts@gmail.com> writes:
> > No, but it needs to be enabled in the good new notes for the ELF file
> > or it gets disabled. I have a PR up.
>
> I understood that part, I just didn't want it to go from "not enabled"
> to "enabled but always crashes" ;-)
>

At least then we know where we're missing them for labels :-p
My initial testing was using libffi make check, so I'm assuming
that tests these flows? I haven't done negative testing yet.

I'm testing on a Fedora 39 VM running on an Apple M2. Note you need
to set -cpu max -acel tcg. Apple's HVF seems to be lacking BTI/PAC
support passthrough to the guest.