about summary refs log tree commit diff
path: root/sysdeps/aarch64/Makefile
diff options
context:
space:
mode:
authorSudakshina Das <sudi.das@arm.com>2020-06-22 10:57:20 +0100
committerSzabolcs Nagy <szabolcs.nagy@arm.com>2020-07-08 15:02:37 +0100
commit605338745ba15930e9acac46c32ce6cada12a52b (patch)
treed622e5001ef1c8918fd9cff340237e53a7b7c25c /sysdeps/aarch64/Makefile
parent5f846c8b0dea05554a48ec5ad13874cc757a886f (diff)
downloadglibc-605338745ba15930e9acac46c32ce6cada12a52b.tar.gz
glibc-605338745ba15930e9acac46c32ce6cada12a52b.tar.xz
glibc-605338745ba15930e9acac46c32ce6cada12a52b.zip
aarch64: enable BTI at runtime
Binaries can opt-in to using BTI via an ELF object file marking.
The dynamic linker has to then mprotect the executable segments
with PROT_BTI. In case of static linked executables or in case
of the dynamic linker itself, PROT_BTI protection is done by the
operating system.

On AArch64 glibc uses PT_GNU_PROPERTY instead of PT_NOTE to check
the properties of a binary because PT_NOTE can be unreliable with
old linkers (old linkers just append the notes of input objects
together and add them to the output without checking them for
consistency which means multiple incompatible GNU property notes
can be present in PT_NOTE).

BTI property is handled in the loader even if glibc is not built
with BTI support, so in theory user code can be BTI protected
independently of glibc. In practice though user binaries are not
marked with the BTI property if glibc has no support because the
static linked libc objects (crt files, libc_nonshared.a) are
unmarked.

This patch relies on Linux userspace API that is not yet in a
linux release but in v5.8-rc1 so scheduled to be in Linux 5.8.

Co-authored-by: Szabolcs Nagy <szabolcs.nagy@arm.com>
Reviewed-by: Adhemerval Zanella  <adhemerval.zanella@linaro.org>
Diffstat (limited to 'sysdeps/aarch64/Makefile')
-rw-r--r--sysdeps/aarch64/Makefile4
1 files changed, 4 insertions, 0 deletions
diff --git a/sysdeps/aarch64/Makefile b/sysdeps/aarch64/Makefile
index 9cb141004d..5ae8b082b0 100644
--- a/sysdeps/aarch64/Makefile
+++ b/sysdeps/aarch64/Makefile
@@ -1,6 +1,10 @@
 long-double-fcts = yes
 
 ifeq ($(subdir),elf)
+sysdep-dl-routines += dl-bti
+endif
+
+ifeq ($(subdir),elf)
 sysdep-dl-routines += tlsdesc dl-tlsdesc
 gen-as-const-headers += dl-link.sym