From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.4 (2020-01-24) on inbox.vuxu.org X-Spam-Level: X-Spam-Status: No, score=-3.1 required=5.0 tests=HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI,RCVD_IN_DNSWL_MED,RCVD_IN_MSPIKE_H4, RCVD_IN_MSPIKE_WL,T_SCC_BODY_TEXT_LINE autolearn=ham autolearn_force=no version=3.4.4 Received: from second.openwall.net (second.openwall.net [193.110.157.125]) by inbox.vuxu.org (Postfix) with SMTP id 98F0D25C27 for ; Sat, 2 Mar 2024 15:45:53 +0100 (CET) Received: (qmail 32083 invoked by uid 550); 2 Mar 2024 14:42:05 -0000 Mailing-List: contact musl-help@lists.openwall.com; run by ezmlm Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-ID: Reply-To: musl@lists.openwall.com Received: (qmail 32042 invoked from network); 2 Mar 2024 14:42:05 -0000 Date: Sat, 2 Mar 2024 09:45:56 -0500 From: Rich Felker To: Stefan O'Rear , musl@lists.openwall.com, Markus Wichmann , enh Message-ID: <20240302144556.GC4163@brightrain.aerifal.cx> References: <20240212224657.GA4163@brightrain.aerifal.cx> <20240213020834.GB4163@brightrain.aerifal.cx> <20240214021925.GC4163@brightrain.aerifal.cx> <82c59be8-6a6e-467e-9383-476660821ca5@app.fastmail.com> <20240215140639.GF4163@brightrain.aerifal.cx> <20240302143345.GC1884416@port70.net> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20240302143345.GC1884416@port70.net> User-Agent: Mutt/1.5.21 (2010-09-15) Subject: Re: [musl] PAC/BTI Support on aarch64 On Sat, Mar 02, 2024 at 03:33:45PM +0100, Szabolcs Nagy wrote: > * Rich Felker [2024-02-15 09:06:40 -0500]: > > > On Thu, Feb 15, 2024 at 08:29:15AM -0500, Stefan O'Rear wrote: > > > On Tue, Feb 13, 2024, at 9:19 PM, Rich Felker wrote: > > > > What is the situation on x86? Does it use the same kind of per-page > > > > enforcement mode, or is it only global, requiring disabling it if any > > > > DSO lacks support? Is the endbr64 opcode a guaranteed-safe nop on > > > > older ISA levels, or does it need to be conditional? > > > > > > The situation for hardware control flow hardening on risc-v is two > > > in-development extensions: > > > > > > Zicfilp (landing pads) provides a 4-byte instruction which marks valid > > > targets for indirect jumps and calls, written `lpad LABEL`. This is > > > an *architectural NOP at all ISA levels*. Enforcement is > > > process-global, not per-page. > > > > > > Indirect jumps can be exempted from landing pad depending on which > > > register is used for the address; this is expected to be used if the > > > address is obtained from read-only memory or an auipc instruction, so > > > jump tables do not use landing pads, nor are landing pads needed after > > > direct calls regardless of length. A function which is not a visible > > > symbol and does not have its address taken does not need a landing pad. > > > > > > The ABI function return is a member of the set of indirect jumps > > > which bypass landing pad checks, so no landing pads are needed at the > > > return sites of ABI function calls. Zicfilp intentionally does not > > > provide any protection against ROP, a different extension must be used > > > to protect return addresses. > > > > This all sounds very good and reasonable to support. > > process global setting is not practical > because legacy code maybe dlopened so libc > cannot decide when to enable the feature. That's exactly what you need process-global: so as soon as you dlopen an incompatible library, all enforcement gets turned off and everything turns into nops. > linux in general only provides per thread disable > for such features which does not help with dlopen. Indeed this is a problem. The kernel needs to provide a way to make sure none of the special instructions, which may still be pending (and blocked by arbitrarily many interrupting stack frames) fault if executed after disabling. In theory there are horrible ways userspace could do this if we wrapped signal handlers and patched things up at every signal return (to restart any interrupted critical section), but that kind of invasiveness is not worth it to support shadow stacks. Rich