Page MenuHomeFreeBSD

arm64: Enable kernel branch protection

Authored by andrew on Oct 4 2023, 3:23 PM.
Referenced Files
Unknown Object (File)
Wed, Jun 12, 2:41 PM
Unknown Object (File)
Wed, Jun 5, 7:01 AM
Unknown Object (File)
Sat, Jun 1, 7:22 AM
Unknown Object (File)
Thu, May 30, 5:55 PM
Unknown Object (File)
May 23 2024, 9:55 AM
Unknown Object (File)
May 20 2024, 3:53 AM
Unknown Object (File)
May 11 2024, 11:27 AM
Unknown Object (File)
May 11 2024, 4:28 AM



Add the build flags to enable branch protection on arm64. This enable
the use of PAC and BTI in the kernel.

For PAC we already install the kernel keys when entering the kernel
from userspace so this will start using these to sign the stack.

For BTI we need to mark the kernel page tables with a new guarded page
field. As this will require all code that could be reached through a
function pointer with an appropriate branch target instruction we
are enabling this before setting the field.

As the pointer authentication support shouldn't be reached via a
function pointer it is safe to not enable the use of BTI there.

Sponsored by: Arm Ltd

Diff Detail

rG FreeBSD src repository
Lint Not Applicable
Tests Not Applicable

Event Timeline

andrew requested review of this revision.Oct 4 2023, 3:23 PM

Should this work with gcc as well?


It works with at least Clang 9+ and GCC 9.3+

This revision is now accepted and ready to land.Oct 6 2023, 2:44 PM
This revision was automatically updated to reflect the committed changes.