arm64: Set the Guarded Page flag in the kernel

[andrew]

Summary

Now the kernel and modules are built with branch protection we can
enablethe Guarded Page flag in the page tables. This causes indirect
branches to a location without a correct landing pad instruction to
raise an exception.

This should help mitigate some attacks where a function pointer is
changed to point somewhere other than the start of the function,
however it doesn't stop an attacker pointing it to an unintended
function.

Sponsored by: Arm Ltd
Sponsored by: The FreeBSD Foundation (earlier version)

[markj]

Can you set this flag on intermediate translation table entries as well?

[alc]

In D42080#960496, @markj wrote:

Can you set this flag on intermediate translation table entries as well?

No, it only exists in leaves.

[alc]

For the most part, these changes are setting the guarded bit on mappings that are already no-execute. Is there a reason to do that? To be clear, I don't object to doing so. It just seems redundant.

[andrew]

I put it on all entries as I though it would be safer. If we miss setting the *XN flags the kernel could still branch into data, however with the GP flag always set it's more difficult.

[scottph]

Looks good, my BTI capable machine continues booting with this applied.

[andrew]

Add pmap_bti_get and use it in functions that can create userspace mappings.
It will later be used to support userspace BTI.

[andrew]

Build & run fixes

[markj]

sys/arm64/arm64/pmap.c

436

Please group this with other function prototypes below. Or, define the function together with pmap_pte_prot(), and then you don't need the forward declaration.

7854

Do you need a __diagused annotation for va?

7854

pmap_pte_bti() would be a better name in my opinion.

[alc]

sys/arm64/arm64/pmap.c

7854

I agree. It's consistent with similar functions.

[andrew]

• Rename pmap_bti_get to pmap_pte_bti
• Move the pmap_pte_bti definition
• Check and use pmap_pte_bti while locked to reduce the userspace support diff
• Make the virtual address as __diagused