Re: [musl] PAC/BTI Support on aarch64

[Rich Felker <dalias@libc.org>]

On Sat, Mar 02, 2024 at 03:33:45PM +0100, Szabolcs Nagy wrote:
> * Rich Felker <dalias@libc.org> [2024-02-15 09:06:40 -0500]:
> 
> > On Thu, Feb 15, 2024 at 08:29:15AM -0500, Stefan O'Rear wrote:
> > > On Tue, Feb 13, 2024, at 9:19 PM, Rich Felker wrote:
> > > > What is the situation on x86? Does it use the same kind of per-page
> > > > enforcement mode, or is it only global, requiring disabling it if any
> > > > DSO lacks support? Is the endbr64 opcode a guaranteed-safe nop on
> > > > older ISA levels, or does it need to be conditional?
> > > 
> > > The situation for hardware control flow hardening on risc-v is two
> > > in-development extensions:
> > > 
> > > Zicfilp (landing pads) provides a 4-byte instruction which marks valid
> > > targets for indirect jumps and calls, written `lpad LABEL`.  This is
> > > an *architectural NOP at all ISA levels*.  Enforcement is
> > > process-global, not per-page.
> > > 
> > > Indirect jumps can be exempted from landing pad depending on which
> > > register is used for the address; this is expected to be used if the
> > > address is obtained from read-only memory or an auipc instruction, so
> > > jump tables do not use landing pads, nor are landing pads needed after
> > > direct calls regardless of length.  A function which is not a visible
> > > symbol and does not have its address taken does not need a landing pad.
> > > 
> > > The ABI function return is a member of the set of indirect jumps
> > > which bypass landing pad checks, so no landing pads are needed at the
> > > return sites of ABI function calls.  Zicfilp intentionally does not
> > > provide any protection against ROP, a different extension must be used
> > > to protect return addresses.
> > 
> > This all sounds very good and reasonable to support.
> 
> process global setting is not practical
> because legacy code maybe dlopened so libc
> cannot decide when to enable the feature.

That's exactly what you need process-global: so as soon as you dlopen
an incompatible library, all enforcement gets turned off and
everything turns into nops.

> linux in general only provides per thread disable
> for such features which does not help with dlopen.

Indeed this is a problem. The kernel needs to provide a way to make
sure none of the special instructions, which may still be pending (and
blocked by arbitrarily many interrupting stack frames) fault if
executed after disabling. In theory there are horrible ways userspace
could do this if we wrapped signal handlers and patched things up at
every signal return (to restart any interrupted critical section), but
that kind of invasiveness is not worth it to support shadow stacks.

Rich