Add PS_NOBTCFI, a per-process flag indicating that Branch Target

Control Flow Integrity has been disabled for the process.  At
exec-time, set that flag iff EXEC_NOBTCFI is passed from the ELF
exec bits (which set it based on presence of a PT_OPENBSD_NOBTCFI
segment).  This will be used by the amd64 code.

kern_exec.c part by kettenis@
ok guenther@ deraadt@

diff --git a/sys/kern/kern_exec.c b/sys/kern/kern_exec.c
index 2622fb4..3f3112b 100644 (file)
--- a/sys/kern/kern_exec.c
+++ b/sys/kern/kern_exec.c
@@ -1,4 +1,4 @@
-/*     $OpenBSD: kern_exec.c,v 1.249 2023/07/06 07:49:52 deraadt Exp $ */
+/*     $OpenBSD: kern_exec.c,v 1.250 2023/07/10 03:31:57 guenther Exp $        */
 /*     $NetBSD: kern_exec.c,v 1.75 1996/02/09 18:59:28 christos Exp $  */
 
 /*-
@@ -531,6 +531,11 @@ sys_execve(struct proc *p, void *v, register_t *retval)
        if (otvp)
                vrele(otvp);
 
+       if (pack.ep_flags & EXEC_NOBTCFI)
+               atomic_setbits_int(&p->p_p->ps_flags, PS_NOBTCFI);
+       else
+               atomic_clearbits_int(&p->p_p->ps_flags, PS_NOBTCFI);
+
        atomic_setbits_int(&pr->ps_flags, PS_EXEC);
        if (pr->ps_flags & PS_PPWAIT) {
                atomic_clearbits_int(&pr->ps_flags, PS_PPWAIT);

diff --git a/sys/sys/proc.h b/sys/sys/proc.h
index aa81494..176fa38 100644 (file)
--- a/sys/sys/proc.h
+++ b/sys/sys/proc.h
@@ -1,4 +1,4 @@
-/*     $OpenBSD: proc.h,v 1.343 2023/07/04 11:14:00 jsg Exp $  */
+/*     $OpenBSD: proc.h,v 1.344 2023/07/10 03:31:58 guenther Exp $     */
 /*     $NetBSD: proc.h,v 1.44 1996/04/22 01:23:21 christos Exp $       */
 
 /*-
@@ -281,6 +281,7 @@ struct process {
 #define        PS_EXECPLEDGE   0x00400000      /* Has exec pledges */
 #define        PS_ORPHAN       0x00800000      /* Process is on an orphan list */
 #define        PS_CHROOT       0x01000000      /* Process is chrooted */
+#define        PS_NOBTCFI      0x02000000      /* No Branch Target CFI */
 
 #define        PS_BITS \
     ("\20" "\01CONTROLT" "\02EXEC" "\03INEXEC" "\04EXITING" "\05SUGID" \
@@ -288,7 +289,7 @@ struct process {
      "\013WAITED" "\014COREDUMP" "\015SINGLEEXIT" "\016SINGLEUNWIND" \
      "\017NOZOMBIE" "\020STOPPED" "\021SYSTEM" "\022EMBRYO" "\023ZOMBIE" \
      "\024NOBROADCASTKILL" "\025PLEDGE" "\026WXNEEDED" "\027EXECPLEDGE" \
-     "\030ORPHAN" "\031CHROOT")
+     "\030ORPHAN" "\031CHROOT" "\032NOBTCFI")
 
 
 struct kcov_dev;