Re: [musl] PAC/BTI Support on aarch64

[Szabolcs Nagy <nsz@port70.net>]

* Rich Felker <dalias@libc.org> [2024-02-15 09:06:40 -0500]:

> On Thu, Feb 15, 2024 at 08:29:15AM -0500, Stefan O'Rear wrote:
> > On Tue, Feb 13, 2024, at 9:19 PM, Rich Felker wrote:
> > > What is the situation on x86? Does it use the same kind of per-page
> > > enforcement mode, or is it only global, requiring disabling it if any
> > > DSO lacks support? Is the endbr64 opcode a guaranteed-safe nop on
> > > older ISA levels, or does it need to be conditional?
> > 
> > The situation for hardware control flow hardening on risc-v is two
> > in-development extensions:
> > 
> > Zicfilp (landing pads) provides a 4-byte instruction which marks valid
> > targets for indirect jumps and calls, written `lpad LABEL`.  This is
> > an *architectural NOP at all ISA levels*.  Enforcement is
> > process-global, not per-page.
> > 
> > Indirect jumps can be exempted from landing pad depending on which
> > register is used for the address; this is expected to be used if the
> > address is obtained from read-only memory or an auipc instruction, so
> > jump tables do not use landing pads, nor are landing pads needed after
> > direct calls regardless of length.  A function which is not a visible
> > symbol and does not have its address taken does not need a landing pad.
> > 
> > The ABI function return is a member of the set of indirect jumps
> > which bypass landing pad checks, so no landing pads are needed at the
> > return sites of ABI function calls.  Zicfilp intentionally does not
> > provide any protection against ROP, a different extension must be used
> > to protect return addresses.
> 
> This all sounds very good and reasonable to support.


process global setting is not practical
because legacy code maybe dlopened so libc
cannot decide when to enable the feature.

linux in general only provides per thread disable
for such features which does not help with dlopen.


> > Both shadow stacks and landing pads are enabled by bits in the senvcfg
> > register, and are exposed via a prctl.  The shadow stack prctl is being