Page MenuHomeFreeBSD

arm64: Enable kernel branch protection
ClosedPublic

Authored by andrew on Oct 4 2023, 3:23 PM.
Tags
None
Referenced Files
Unknown Object (File)
Mon, Apr 15, 7:34 AM
Unknown Object (File)
Mon, Mar 25, 12:46 PM
Unknown Object (File)
Sat, Mar 23, 1:12 PM
Unknown Object (File)
Mar 14 2024, 7:48 PM
Unknown Object (File)
Mar 11 2024, 8:31 AM
Unknown Object (File)
Mar 7 2024, 3:08 AM
Unknown Object (File)
Feb 29 2024, 2:59 PM
Unknown Object (File)
Feb 28 2024, 9:48 AM
Subscribers

Details

Summary

Add the build flags to enable branch protection on arm64. This enable
the use of PAC and BTI in the kernel.

For PAC we already install the kernel keys when entering the kernel
from userspace so this will start using these to sign the stack.

For BTI we need to mark the kernel page tables with a new guarded page
field. As this will require all code that could be reached through a
function pointer with an appropriate branch target instruction we
are enabling this before setting the field.

As the pointer authentication support shouldn't be reached via a
function pointer it is safe to not enable the use of BTI there.

Sponsored by: Arm Ltd

Diff Detail

Repository
rG FreeBSD src repository
Lint
Lint Not Applicable
Unit
Tests Not Applicable

Event Timeline

andrew requested review of this revision.Oct 4 2023, 3:23 PM
sys/conf/kern.mk
144

Should this work with gcc as well?

sys/conf/kern.mk
144

It works with at least Clang 9+ and GCC 9.3+ https://godbolt.org/z/6MG7vfPWW

This revision is now accepted and ready to land.Oct 6 2023, 2:44 PM
This revision was automatically updated to reflect the committed changes.