From: guenther <guenther@openbsd.org>
Date: Mon, 10 Jul 2023 03:31:57 +0000 (+0000)
Subject: Add PS_NOBTCFI, a per-process flag indicating that Branch Target
X-Git-Url: http://artulab.com/gitweb/?a=commitdiff_plain;h=a8701c595f11859a59ce61b3bc5be334963a2e65;p=openbsd

Add PS_NOBTCFI, a per-process flag indicating that Branch Target
Control Flow Integrity has been disabled for the process.  At
exec-time, set that flag iff EXEC_NOBTCFI is passed from the ELF
exec bits (which set it based on presence of a PT_OPENBSD_NOBTCFI
segment).  This will be used by the amd64 code.

kern_exec.c part by kettenis@
ok guenther@ deraadt@
---

diff --git a/sys/kern/kern_exec.c b/sys/kern/kern_exec.c
index 2622fb4a961..3f3112b018f 100644
--- a/sys/kern/kern_exec.c
+++ b/sys/kern/kern_exec.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: kern_exec.c,v 1.249 2023/07/06 07:49:52 deraadt Exp $	*/
+/*	$OpenBSD: kern_exec.c,v 1.250 2023/07/10 03:31:57 guenther Exp $	*/
 /*	$NetBSD: kern_exec.c,v 1.75 1996/02/09 18:59:28 christos Exp $	*/
 
 /*-
@@ -531,6 +531,11 @@ sys_execve(struct proc *p, void *v, register_t *retval)
 	if (otvp)
 		vrele(otvp);
 
+	if (pack.ep_flags & EXEC_NOBTCFI)
+		atomic_setbits_int(&p->p_p->ps_flags, PS_NOBTCFI);
+	else
+		atomic_clearbits_int(&p->p_p->ps_flags, PS_NOBTCFI);
+
 	atomic_setbits_int(&pr->ps_flags, PS_EXEC);
 	if (pr->ps_flags & PS_PPWAIT) {
 		atomic_clearbits_int(&pr->ps_flags, PS_PPWAIT);
diff --git a/sys/sys/proc.h b/sys/sys/proc.h
index aa814945573..176fa3849db 100644
--- a/sys/sys/proc.h
+++ b/sys/sys/proc.h
@@ -1,4 +1,4 @@
-/*	$OpenBSD: proc.h,v 1.343 2023/07/04 11:14:00 jsg Exp $	*/
+/*	$OpenBSD: proc.h,v 1.344 2023/07/10 03:31:58 guenther Exp $	*/
 /*	$NetBSD: proc.h,v 1.44 1996/04/22 01:23:21 christos Exp $	*/
 
 /*-
@@ -281,6 +281,7 @@ struct process {
 #define	PS_EXECPLEDGE	0x00400000	/* Has exec pledges */
 #define	PS_ORPHAN	0x00800000	/* Process is on an orphan list */
 #define	PS_CHROOT	0x01000000	/* Process is chrooted */
+#define	PS_NOBTCFI	0x02000000	/* No Branch Target CFI */
 
 #define	PS_BITS \
     ("\20" "\01CONTROLT" "\02EXEC" "\03INEXEC" "\04EXITING" "\05SUGID" \
@@ -288,7 +289,7 @@ struct process {
      "\013WAITED" "\014COREDUMP" "\015SINGLEEXIT" "\016SINGLEUNWIND" \
      "\017NOZOMBIE" "\020STOPPED" "\021SYSTEM" "\022EMBRYO" "\023ZOMBIE" \
      "\024NOBROADCASTKILL" "\025PLEDGE" "\026WXNEEDED" "\027EXECPLEDGE" \
-     "\030ORPHAN" "\031CHROOT")
+     "\030ORPHAN" "\031CHROOT" "\032NOBTCFI")
 
 
 struct kcov_dev;