Skip to content

Commit a7408db

Browse files
committed
Apply protection against ROP/JOP attacks for aarch64 on asm_trampoline.S
The BTI flag must be applied in assembler sources for this class of attacks to be mitigated on newer aarch64 processors. See also: https://sourceware.org/annobin/annobin.html/Test-branch-protection.html and https://community.arm.com/arm-community-blogs/b/architectures-and-processors-blog/posts/enabling-pac-and-bti-on-aarch64
1 parent 7e83cf8 commit a7408db

File tree

1 file changed

+27
-0
lines changed

1 file changed

+27
-0
lines changed

Python/asm_trampoline.S

+27
Original file line numberDiff line numberDiff line change
@@ -20,10 +20,18 @@ _Py_trampoline_func_start:
2020
#if defined(__aarch64__) && defined(__AARCH64EL__) && !defined(__ILP32__)
2121
// ARM64 little endian, 64bit ABI
2222
// generate with aarch64-linux-gnu-gcc 12.1
23+
#if defined(__ARM_FEATURE_PAC_DEFAULT) && (__ARM_FEATURE_PAC_DEFAULT & 1) == 1 || \
24+
defined(__ARM_FEATURE_BTI_DEFAULT) && __ARM_FEATURE_BTI_DEFAULT == 1
25+
hint 25
26+
#endif
2327
stp x29, x30, [sp, -16]!
2428
mov x29, sp
2529
blr x3
2630
ldp x29, x30, [sp], 16
31+
#if defined(__ARM_FEATURE_PAC_DEFAULT) && (__ARM_FEATURE_PAC_DEFAULT & 1) == 1 || \
32+
defined(__ARM_FEATURE_BTI_DEFAULT) && __ARM_FEATURE_BTI_DEFAULT == 1
33+
hint 29
34+
#endif
2735
ret
2836
#endif
2937
#ifdef __riscv
@@ -55,3 +63,22 @@ _Py_trampoline_func_end:
5563
.align 8
5664
4:
5765
#endif // __x86_64__
66+
#if defined(__aarch64__) && defined(__AARCH64EL__) && !defined(__ILP32__)
67+
#if defined(__ARM_FEATURE_BTI_DEFAULT) && __ARM_FEATURE_BTI_DEFAULT == 1 || \
68+
defined(__ARM_FEATURE_PAC_DEFAULT) && (__ARM_FEATURE_PAC_DEFAULT & 1) == 1
69+
.pushsection .note.gnu.property, "a"
70+
.align 3
71+
.word 2f - 1f
72+
.word 4f - 3f
73+
.word 5 /* NT_GNU_PROPERTY_TYPE_0 */
74+
1: .asciz "GNU"
75+
76+
2: .align 3
77+
3: .word 0xc0000000 /* type: GNU_PROPERTY_AARCH64_FEATURE_1_AND */
78+
.word 6f - 5f /* size */
79+
5: .word 3 /* value: GNU_PROPERTY_AARCH64_FEATURE_1_BTI */
80+
81+
6: .align 3
82+
4: .popsection
83+
#endif
84+
#endif

0 commit comments

Comments
 (0)