diff options
| author | Andrew Turner <andrew@FreeBSD.org> | 2023-10-02 15:55:31 +0000 |
|---|---|---|
| committer | Andrew Turner <andrew@FreeBSD.org> | 2023-10-10 09:52:16 +0000 |
| commit | d09a64e15d8fad6588b9aad62979f20afa8441df (patch) | |
| tree | aaec11914fd035cc9d3bc88e79a8579abb356d94 | |
| parent | e340882d3e49a98aa39b13041a2bf714c30dccdf (diff) | |
| download | src-d09a64e15d8fad6588b9aad62979f20afa8441df.tar.gz src-d09a64e15d8fad6588b9aad62979f20afa8441df.zip | |
arm64: Enable kernel branch protection
Add the build flags to enable branch protection on arm64. This enable
the use of PAC and BTI in the kernel.
For PAC we already install the kernel keys when entering the kernel
from userspace so this will start using these to sign the stack.
For BTI we need to mark the kernel page tables with a new guarded page
field. As this will require all code that could be reached through a
function pointer with an appropriate branch target instruction we
are enabling this before setting the field.
As the pointer authentication support shouldn't be reached via a
function pointer it is safe to not enable the use of BTI there.
Reviewed by: markj
Sponsored by: Arm Ltd
Differential Revision: https://reviews.freebsd.org/D42079
| -rw-r--r-- | sys/conf/kern.mk | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/sys/conf/kern.mk b/sys/conf/kern.mk index b508bc81b5f0..72b7387d3959 100644 --- a/sys/conf/kern.mk +++ b/sys/conf/kern.mk @@ -140,6 +140,8 @@ INLINE_LIMIT?= 8000 CFLAGS += -mgeneral-regs-only # Reserve x18 for pcpu data CFLAGS += -ffixed-x18 +# Build with BTI+PAC +CFLAGS += -mbranch-protection=standard INLINE_LIMIT?= 8000 .endif |