Page MenuHomeFreeBSD

arm64: Enable kernel branch protection

Authored by andrew on Oct 4 2023, 3:23 PM.
Referenced Files
Unknown Object (File)
Mon, Apr 15, 7:34 AM
Unknown Object (File)
Mon, Mar 25, 12:46 PM
Unknown Object (File)
Sat, Mar 23, 1:12 PM
Unknown Object (File)
Mar 14 2024, 7:48 PM
Unknown Object (File)
Mar 11 2024, 8:31 AM
Unknown Object (File)
Mar 7 2024, 3:08 AM
Unknown Object (File)
Feb 29 2024, 2:59 PM
Unknown Object (File)
Feb 28 2024, 9:48 AM



Add the build flags to enable branch protection on arm64. This enable
the use of PAC and BTI in the kernel.

For PAC we already install the kernel keys when entering the kernel
from userspace so this will start using these to sign the stack.

For BTI we need to mark the kernel page tables with a new guarded page
field. As this will require all code that could be reached through a
function pointer with an appropriate branch target instruction we
are enabling this before setting the field.

As the pointer authentication support shouldn't be reached via a
function pointer it is safe to not enable the use of BTI there.

Sponsored by: Arm Ltd

Diff Detail

rG FreeBSD src repository
Lint Not Applicable
Tests Not Applicable

Event Timeline

andrew requested review of this revision.Oct 4 2023, 3:23 PM

Should this work with gcc as well?


It works with at least Clang 9+ and GCC 9.3+

This revision is now accepted and ready to land.Oct 6 2023, 2:44 PM
This revision was automatically updated to reflect the committed changes.