Enabling PAC and BTI on AArch64 for Linux

Certain versions of Arm 64-bit processors have features that can help provide control flow integrity and reduce gadget space, making software more robust in the face of attack. Pointer Authentication Codes (PAC) work by signing and verifying indirect branch targets and branch target instructions (BTI) function by marking all valid branch locations. These technologies harden the control flow by ensuring that modification of control flow values are cryptographically verified and that control flow can only be transferred to valid locations. Details on how this works can be found in another Arm blog post on BTI and PAC.

This post is going to spare the underlying implementation details and is going to focus on the A processors and the Linux ecosystem of C/C++ code, ELF, exception handling, and toolchains. The goal being to provide a pragmatic guide for enablement throughout that ecosystem. This is also specifically for C and C++ projects that may optionally contain intermixed assembly, as assembly code modification is required to enable support. Other languages may or may not support these technologies at this time and will not be discussed. All these examples were executed on a Linux machine with support for PAC and BTI. To test if your machine has support for pac and bti you can run the following command:

cat /proc/cpuinfo | grep -E -o "bti|pac" | sort | uniq
bti
pac

Enabling C/C++ Code

Contemporary versions of both the gcc and clang compiler suites, runtimes and assorted binutils support PAC and BTI. Enabling a C or C++ project is as simple as passing the compiler option -mbranch-protection=standard. This will enable the standard set of PAC and BTI features. To facilitate in verifying the project is built with BTI one can optionally specify the linker option -zforce-bti,--fatal-warnings.

The linker flags will force the linker to generate an error and output what object files do not support BTI.

Additionally, you can check the produced ELF binary for support using readelf -n <binary> . We will create an empty C file and compile it to an object file and check the resulting object file for a set of special flags. For Example:

touch empty.c
gcc -mbranch-protection=standard -c -o empty.o empty.c
readelf -n empty.o

Displaying notes found in: .note.gnu.property
Owner Data size Description
GNU 0x00000010 NT_GNU_PROPERTY_TYPE_0
Properties: AArch64 feature: BTI, PAC

The "Properties" section will indicate PAC and/or BTI support. The main issues with supporting PAC and BTI, is projects utilize standalone assembly, and the assembly must be instrumented to provide this support.

Enabling Assembly

The simplest way to enable assembly is to rewrite it using a combination of C/C++, intrinsics and inline assembly if needed. Modern compilers are very capable of generating optimized assembly routines that are often better than hand coded assembly. However, certain use case may dictate otherwise, and thus existing or new assembly will need modification for 3 specific cases:

• BTI: instrumenting call and jump points in assembly
• PAC: instrumenting routines to sign and verify the link register
• ELF: instrumenting the GNU Notes section to indicate PAC and BTI support

Example Program

We will use the following example program containing both C and Assembly sources. The C code calls an assembly routine called call_function which takes a function pointer as the first argument and jumps to it. Create the following files indicated below. The source code examples can also be found at https://gitlab.arm.com/pac-and-bti-blog/blog-example. The source repository is annotated with tags and the tag name will be associated with the example via the "Tag" keyword, along with a link, for those using the source code repository.

Tag: Example-1

main.c:

// Declaration of the assembly routines
extern void call_function(void (*func)());
extern void my_jump();

int main() {
    // Call the assembly routine **indirectly** using a function pointer
    // and pass the jump location as well.
    void (*fn)(void (*func)()) = call_function;
    fn(my_jump);
    return 0;
}

call_function.S:

.section .rodata
.align 3
.Lstring:
    .string "Hello From My Jump!"

.section .text
.global my_jump
.global call_function

my_jump:
    stp x29, x30, [sp, #-16]!
    // Print "Hello From My Jump!" using puts.
    // puts can modify registers, so push the return address in x1
    // to the stack
    adrp    x0, .Lstring        // Get the page the string is within
    add x0, x0, :lo12:.Lstring  // Get the page offset (handles relocations ADD_ABS_LO12_NC)
    bl      puts                // puts prints the string in x0

    ldp x29, x30, [sp], #16
    ret

// Function prototype
// void call_function(void (*func)())
call_function:
    // Save link register and frame pointer, allocating enough space for
    // saving the return location.
    stp x29, x30, [sp, #-16]!
    mov x29, sp
     
    // x0 is the caller's first argument, so jump
    // to the "function" pointed by x0 and save
    // the return address to the stack
    adr lr, return_loc
    br x0  //intentionally avoiding a branch and link, you'll see why later.
return_loc:
    // Restore link register and frame pointer
    ldp x29, x30, [sp], #16

    // Return from the function
    ret

Makefile:

ASFLAGS ?= $(CFLAGS)

OBJS := main.o \
	call_function.o

main: $(OBJS)
	$(CC) $(CFLAGS) $(LDFLAGS) -o $@ $^

.PHONY: clean
clean:
	@printf "Cleaning...\n" && rm -rf $(OBJS) main

Compiling

To compile the example code execute:

make
./main
Hello From My Jump!

BTI

Step one when enabling BTI is to enable it through the compiler. In this case, we will use -mbranch-protection=bti so we only get the instructions for BTI and not PAC. We will also add the linker flags to force an error if BTI is not enabled within an ELF object file. We will use the Makefile to compile all the examples with differing sets of CFLAGS and LDFLAGS.

Perform the following to compile the code with bti support:

CFLAGS="-mbranch-protection=bti" LDFLAGS='-Wl,-zforce-bti,--fatal-warnings' make
cc -mbranch-protection=bti   -c -o main.o main.c
cc -mbranch-protection=bti   -c -o call_function.o call_function.S
cc -mbranch-protection=bti -Wl,-zforce-bti,--fatal-warnings -o main main.o call_function.o
/usr/bin/ld: call_function.o: warning: BTI turned on by -z force-bti when all inputs do not have BTI in NOTE section.
collect2: error: ld returned 1 exit status
make: *** [Makefile:7: main] Error 1

As designed, the linker errored and reported that BTI is not enabled in the two assembly object files. The next step will be enabling BTI, and a convenient way of doing so, is with support from the C pre-processor which enables conditional compilation and they include features within the C/C++ languages. It can be leveraged so that BTI is support is included conditionally. BTI can be included unconditionally, and the linker will discard the GNU note section flags when combined with other object files that do not declare BTI in the GNU Notes section. Additionally, the BTI instructions will NOP, but you will still pay a cycle count penalty on the NOP operation. With that stated, let's create a header file and include it within our assembly so that the BTI instructions are enabled only when compiled, assembled and linked explicitly with support. Documentation on the feature test macros to use can be found at Arm's Developer documentation on Feature Test Macros.

Tag: Example-2

aarch64.h:

#ifndef _AARCH_64_H_
#define _AARCH_64_H_

/*
 * References:
 *  - https://developer.arm.com/documentation/101028/0012/5--Feature-test-macros
 *  - https://github.com/ARM-software/abi-aa/blob/main/aaelf64/aaelf64.rst
 */

#if defined(__ARM_FEATURE_BTI_DEFAULT) && __ARM_FEATURE_BTI_DEFAULT == 1
  #define BTI_J bti j /* for jumps, IE br instructions */
  #define BTI_C bti c  /* for calls, IE bl instructions */
  #define GNU_PROPERTY_AARCH64_BTI 1 /* bit 0 GNU Notes is for BTI support */
#else
  #define BTI_J
  #define BTI_C
  #define GNU_PROPERTY_AARCH64_BTI 0
#endif

/* Add the BTI support to GNU Notes section */
#if GNU_PROPERTY_AARCH64_BTI != 0
    .pushsection .note.gnu.property, "a"; /* Start a new allocatable section */
    .balign 8; /* align it on a byte boundry */
    .long 4; /* size of "GNU\0" */
    .long 0x10; /* size of descriptor */
    .long 0x5; /* NT_GNU_PROPERTY_TYPE_0 */
    .asciz "GNU";
    .long 0xc0000000; /* GNU_PROPERTY_AARCH64_FEATURE_1_AND */
    .long 4; /* Four bytes of data */
    .long GNU_PROPERTY_AARCH64_BTI; /* BTI is enabled */
    .long 0; /* padding for 8 byte alignment */
    .popsection; /* end the section */
#endif

#endif

Now that the header file is in place, let's augment the assembly file.

call_function.S:

#include "aarch64.h"

.section .rodata
.align 3
.Lstring:
    .string "Hello From My Jump!"

.section .text
.global my_jump
.global call_function

my_jump:
    stp x29, x30, [sp, #-16]!
    // Print "Hello From My Jump!" using puts.
    // puts can modify registers, so push the return address in x1
    // to the stack
    adrp    x0, .Lstring        // Get the page the string is within
    add x0, x0, :lo12:.Lstring  // Get the page offset (handles relocations ADD_ABS_LO12_NC)
    bl      puts                // puts prints the string in x0

    ldp x29, x30, [sp], #16
    ret

// Function prototype
// void call_function(void (*func)())
call_function:
    BTI_C
    // Save link register and frame pointer, allocating enough space for
    // saving the return location.
    stp x29, x30, [sp, #-16]!
    mov x29, sp

    // x0 is the caller's first argument, so jump
    // to the "function" pointed by x0 and save
    // the return address to the stack
    adr lr, return_loc
    br x0  //intentionally avoiding a branch and link, you'll see why later.
return_loc:
    // Restore link register and frame pointer
    ldp x29, x30, [sp], #16

    // Return from the function
    ret

As a reminder, since main.c and Makefile require no modifications, it will not be displayed. However, we will need to clean, and rebuild:

make clean
LDFLAGS='-Wl,-zforce-bti,--fatal-warnings' CFLAGS="-mbranch-protection=bti" make
cc -mbranch-protection=bti -c -o main.o main.c
cc -mbranch-protection=bti -c -o call_function.o call_function.S
cc -mbranch-protection=bti -c -o my_jump.o my_jump.S
cc -mbranch-protection=bti -Wl,-zforce-bti,--fatal-warnings -o main main.o call_function.o my_jump.o

Notice now the linker no longer complains about "missing the BTI in Note section" and now we can check that the BTI bit is set in the ELF object file:

readelf -n main

Displaying notes found in: .note.gnu.property
  Owner                Data size 	Description
  GNU                  0x00000010	NT_GNU_PROPERTY_TYPE_0
      Properties: AArch64 feature: BTI

We can also execute the program:

./main
Illegal instruction (core dumped)

Wait, it did not work. Why? 

The example was intentionally omitting the bti j instruction for the landing pad for the jump. Since the ELF GNU Notes declared that it has support for BTI, the linker or loader mapped the executable pages with PROT_BTI and a runtime exception occurred, as designed. Now, let's add the landing pad to my_jump .

Tag: Example-3

call_function.S:

#include "aarch64.h"

.section .rodata
.align 3
.Lstring:
    .string "Hello From My Jump!"

.section .text
.global my_jump
.global call_function

my_jump:
    BTI_J
    stp x29, x30, [sp, #-16]!
    // Print "Hello From My Jump!" using puts.
    // puts can modify registers, so push the return address in x1
    // to the stack
    adrp    x0, .Lstring        // Get the page the string is within
    add x0, x0, :lo12:.Lstring  // Get the page offset (handles relocations ADD_ABS_LO12_NC)
    bl      puts                // puts prints the string in x0

    ldp x29, x30, [sp], #16
    ret

// Function prototype
// void call_function(void (*func)())
call_function:
    BTI_C
    // Save link register and frame pointer, allocating enough space for
    // saving the return location.
    stp x29, x30, [sp, #-16]!
    mov x29, sp

    // x0 is the caller's first argument, so jump
    // to the "function" pointed by x0 and save
    // the return address to the stack
    adr lr, return_loc
    br x0  //Later has arrived, it's to highlight use of bti j.
return_loc:
    // Restore link register and frame pointer
    ldp x29, x30, [sp], #16

    // Return from the function
    ret

Then we can re-build the code and run the executable as follows:

make clean
CFLAGS="-mbranch-protection=bti" make
./main
Hello From My Jump!

One thing of note is when to use bti j vs bti c. Generally speaking, functions called from C/C++ will be through a bl instruction and would use bti c. Whereas assembly will need to be audited to understand the context. It is still useful to audit the C/C++ code with something like objdump -d or having gcc output the assembler. Let's audit the generated assembly and verify how it is calling my_function .

gcc -mbranch-protection=bti -S -o main.S main.c

    .arch armv8-a
    .file   "main.c"
    .text
    .align  2
    .global main
    .type   main, %function
main:
.LFB0:
    .cfi_startproc
    hint    34 // bti c
    stp x29, x30, [sp, -32]!
    .cfi_def_cfa_offset 32
    .cfi_offset 29, -32
    .cfi_offset 30, -24
    mov x29, sp
    adrp    x0, call_function
    add x0, x0, :lo12:call_function
    str x0, [sp, 24]
    ldr x1, [sp, 24]
    adrp    x0, my_jump
    add x0, x0, :lo12:my_jump
    blr x1
    mov w0, 0
    ldp x29, x30, [sp], 32
    .cfi_restore 30
    .cfi_restore 29
    .cfi_def_cfa_offset 0
    ret
    .cfi_endproc
.LFE0:
    .size   main, .-main
    .ident  "GCC: (GNU) 14.2.1 20240801 (Red Hat 14.2.1-1)"
    .section    .note.GNU-stack,"",@progbits
    .section    .note.gnu.property,"a"
    .align  3
    .word   4
    .word   16
    .word   5
    .string "GNU"
    .word   3221225472
    .word   4
    .word   1
    .align  3

The BTI instruction bti jc, would be valid in both locations, but it is best to limit the scope of the target to how the program is using it, as it will limit the attackers possibilities. If an entry point serves as both a jump and call location, then it would be appropriate to mark it with a bti jc.

#ifndef _AARCH_64_H_
#define _AARCH_64_H_
 
/*
 * References:
 *  - https://developer.arm.com/documentation/101028/0012/5--Feature-test-macros
 *  - https://github.com/ARM-software/abi-aa/blob/main/aaelf64/aaelf64.rst
 */
 
#if defined(__ARM_FEATURE_BTI_DEFAULT) && __ARM_FEATURE_BTI_DEFAULT == 1
  #define BTI_J bti j /* for jumps, IE br instructions */
  #define BTI_C bti c  /* for calls, IE bl instructions */
  #define GNU_PROPERTY_AARCH64_BTI 1 /* bit 0 GNU Notes is for BTI support */
#else
  #define BTI_J
  #define BTI_C
  #define GNU_PROPERTY_AARCH64_BTI 0
#endif
 
#if defined(__ARM_FEATURE_PAC_DEFAULT)
  #if __ARM_FEATURE_PAC_DEFAULT & 1
    #define SIGN_LR paciasp /* sign with the A key */
    #define VERIFY_LR autiasp /* verify with the A key */
  #elif __ARM_FEATURE_PAC_DEFAULT & 2
    #define SIGN_LR pacibsp /* sign with the b key */
    #define VERIFY_LR autibsp /* verify with the b key */
  #endif
  #define GNU_PROPERTY_AARCH64_POINTER_AUTH 2 /* bit 1 GNU Notes is for PAC support */
#else
  #define SIGN_LR
  #define VERIFY_LR
  #define GNU_PROPERTY_AARCH64_POINTER_AUTH 0
#endif
 
/* Add the BTI support to GNU Notes section */
#if GNU_PROPERTY_AARCH64_BTI != 0 || GNU_PROPERTY_AARCH64_POINTER_AUTH != 0
    .pushsection .note.gnu.property, "a"; /* Start a new allocatable section */
    .balign 8; /* align it on a byte boundry */
    .long 4; /* size of "GNU\0" */
    .long 0x10; /* size of descriptor */
    .long 0x5; /* NT_GNU_PROPERTY_TYPE_0 */
    .asciz "GNU";
    .long 0xc0000000; /* GNU_PROPERTY_AARCH64_FEATURE_1_AND */
    .long 4; /* Four bytes of data */
    .long (GNU_PROPERTY_AARCH64_BTI|GNU_PROPERTY_AARCH64_POINTER_AUTH); /* BTI or PAC is enabled */
    .long 0; /* padding for 8 byte alignment */
    .popsection; /* end the section */
#endif
 
#endif

#include "aarch64.h"
 
.section .rodata
.align 3
.Lstring:
    .string "Hello From My Jump!"
 
.section .text
.global my_jump
.global call_function
 
my_jump:
    BTI_J
    stp x29, x30, [sp, #-16]!
    // Print "Hello From My Jump!" using puts.
    // puts can modify registers, so push the return address in x1
    // to the stack
    adrp    x0, .Lstring        // Get the page the string is within
    add x0, x0, :lo12:.Lstring  // Get the page offset (handles relocations ADD_ABS_LO12_NC)
    bl      puts                // puts prints the string in x0
 
    ldp x29, x30, [sp], #16
    ret
 
// Function prototype
// void call_function(void (*func)())
call_function:
    BTI_C
    SIGN_LR
    // Save link register and frame pointer, allocating enough space for
    // saving the return location.
    stp x29, x30, [sp, #-16]!
    mov x29, sp
 
    // x0 is the caller's first argument, so jump
    // to the "function" pointed by x0 and save
    // the return address to the stack
    adr lr, return_loc
    br x0  //Later has arrived, it's to highlight use of bti j.
return_loc:
    // Restore link register and frame pointer
    ldp x29, x30, [sp], #16
 
    // Return from the function
    VERIFY_LR
    ret

make clean
CFLAGS="-mbranch-protection=pac-ret" make
./main
Hello From My Jump!

readelf -n main

Displaying notes found in: .note.gnu.property
  Owner                Data size 	Description
  GNU                  0x00000010	NT_GNU_PROPERTY_TYPE_0
      Properties: AArch64 feature: PAC

Read Part 2