starred/qemu
1
0
Fork 0
mirror of https://github.com/qemu/qemu.git synced 2026-02-04 05:35:39 +00:00
Code Issues 380 Packages Projects Releases Wiki Activity

linux-user/aarch64: Implement prctls for GCS

Browse Source 
This is PR_GET_SHADOW_STACK_STATUS, PR_SET_SHADOW_STACK_STATUS,
and PR_LOCK_SHADOW_STACK_STATUS.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20251008215613.300150-64-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
This commit is contained in:
Richard Henderson
2025-10-08 14:56:03 -07:00
committed by Peter Maydell
parent 9c5dfe8b56
commit d0e16dcad9
4 changed files with 168 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

38
linux-user/aarch64/gcs-internal.h Normal file
View File

@@ -0,0 +1,38 @@
/*
* AArch64 gcs functions for linux-user
*
* SPDX-License-Identifier: GPL-2.0-or-later
*/
#ifndef AARCH64_GCS_INTERNAL_H
#define AARCH64_GCS_INTERNAL_H
#ifndef PR_SHADOW_STACK_ENABLE
# define PR_SHADOW_STACK_ENABLE (1U << 0)
# define PR_SHADOW_STACK_WRITE (1U << 1)
# define PR_SHADOW_STACK_PUSH (1U << 2)
#endif
static inline uint64_t gcs_get_el0_mode(CPUArchState *env)
{
uint64_t cr = env->cp15.gcscr_el[0];
abi_ulong flags = 0;
flags |= cr & GCSCR_PCRSEL ? PR_SHADOW_STACK_ENABLE : 0;
flags |= cr & GCSCR_STREN ? PR_SHADOW_STACK_WRITE : 0;
flags |= cr & GCSCR_PUSHMEN ? PR_SHADOW_STACK_PUSH : 0;
return flags;
}
static inline void gcs_set_el0_mode(CPUArchState *env, uint64_t flags)
{
uint64_t cr = GCSCRE0_NTR;
cr |= flags & PR_SHADOW_STACK_ENABLE ? GCSCR_RVCHKEN | GCSCR_PCRSEL : 0;
cr |= flags & PR_SHADOW_STACK_WRITE ? GCSCR_STREN : 0;
cr |= flags & PR_SHADOW_STACK_PUSH ? GCSCR_PUSHMEN : 0;
env->cp15.gcscr_el[0] = cr;
}
#endif

96
linux-user/aarch64/target_prctl.h
View File

@@ -6,8 +6,10 @@
#ifndef AARCH64_TARGET_PRCTL_H
#define AARCH64_TARGET_PRCTL_H
#include "qemu/units.h"
#include "target/arm/cpu-features.h"
#include "mte_user_helper.h"
#include "gcs-internal.h"
static abi_long do_prctl_sve_get_vl(CPUArchState *env)
{
@@ -206,4 +208,98 @@ static abi_long do_prctl_get_tagged_addr_ctrl(CPUArchState *env)
}
#define do_prctl_get_tagged_addr_ctrl do_prctl_get_tagged_addr_ctrl
static abi_long do_prctl_get_shadow_stack_status(CPUArchState *env,
abi_long arg2)
{
ARMCPU *cpu = env_archcpu(env);
if (!cpu_isar_feature(aa64_gcs, cpu)) {
return -TARGET_EINVAL;
}
return put_user_ual(gcs_get_el0_mode(env), arg2);
}
#define do_prctl_get_shadow_stack_status do_prctl_get_shadow_stack_status
static abi_long gcs_alloc(abi_ulong hint, abi_ulong size)
{
/*
* Without softmmu, we cannot protect GCS memory properly.
* Make do with normal read/write permissions. This at least allows
* emulation of correct programs which don't access the gcs stack
* with normal instructions.
*/
return target_mmap(hint, size, PROT_READ | PROT_WRITE,
MAP_PRIVATE | MAP_ANONYMOUS |
(hint ? MAP_FIXED_NOREPLACE : 0), -1, 0);
}
static abi_ulong gcs_new_stack(TaskState *ts)
{
/* Use guest_stack_size as a proxy for RLIMIT_STACK. */
abi_ulong size = MIN(MAX(guest_stack_size / 2, TARGET_PAGE_SIZE), 2 * GiB);
abi_ulong base = gcs_alloc(0, size);
if (base == -1) {
return -1;
}
ts->gcs_base = base;
ts->gcs_size = size;
return base + size - 8;
}
static abi_long do_prctl_set_shadow_stack_status(CPUArchState *env,
abi_long new_mode)
{
ARMCPU *cpu = env_archcpu(env);
TaskState *ts = get_task_state(env_cpu(env));
abi_long cur_mode;
if (!cpu_isar_feature(aa64_gcs, cpu)) {
return -TARGET_EINVAL;
}
if (new_mode & ~(PR_SHADOW_STACK_ENABLE |
PR_SHADOW_STACK_WRITE |
PR_SHADOW_STACK_PUSH)) {
return -TARGET_EINVAL;
}
cur_mode = gcs_get_el0_mode(env);
if ((new_mode ^ cur_mode) & ts->gcs_el0_locked) {
return -TARGET_EBUSY;
}
if (new_mode & ~cur_mode & PR_SHADOW_STACK_ENABLE) {
abi_long gcspr;
if (ts->gcs_base || env->cp15.gcspr_el[0]) {
return -EINVAL;
}
gcspr = gcs_new_stack(ts);
if (gcspr == -1) {
return -TARGET_ENOMEM;
}
env->cp15.gcspr_el[0] = gcspr;
}
gcs_set_el0_mode(env, new_mode);
arm_rebuild_hflags(env);
return 0;
}
#define do_prctl_set_shadow_stack_status do_prctl_set_shadow_stack_status
static abi_long do_prctl_lock_shadow_stack_status(CPUArchState *env,
abi_long arg2)
{
ARMCPU *cpu = env_archcpu(env);
TaskState *ts = get_task_state(env_cpu(env));
if (!cpu_isar_feature(aa64_gcs, cpu)) {
return -EINVAL;
}
ts->gcs_el0_locked |= arg2;
return 0;
}
#define do_prctl_lock_shadow_stack_status do_prctl_lock_shadow_stack_status
#endif /* AARCH64_TARGET_PRCTL_H */

5
linux-user/qemu.h
View File

@@ -121,6 +121,11 @@ struct TaskState {
abi_ulong child_tidptr;
#ifdef TARGET_M68K
abi_ulong tp_value;
#endif
#if defined(TARGET_AARCH64)
vaddr gcs_base;
abi_ulong gcs_size;
abi_ulong gcs_el0_locked;
#endif
int used; /* non zero if used */
struct image_info *info;

29
linux-user/syscall.c
View File

@@ -6353,6 +6353,11 @@ abi_long do_arch_prctl(CPUX86State *env, int code, abi_ulong addr)
# define PR_SME_VL_LEN_MASK 0xffff
# define PR_SME_VL_INHERIT (1 << 17)
#endif
#ifndef PR_GET_SHADOW_STACK_STATUS
# define PR_GET_SHADOW_STACK_STATUS 74
# define PR_SET_SHADOW_STACK_STATUS 75
# define PR_LOCK_SHADOW_STACK_STATUS 76
#endif
#include "target_prctl.h"
@@ -6399,6 +6404,15 @@ static abi_long do_prctl_inval1(CPUArchState *env, abi_long arg2)
#ifndef do_prctl_sme_set_vl
#define do_prctl_sme_set_vl do_prctl_inval1
#endif
#ifndef do_prctl_get_shadow_stack_status
#define do_prctl_get_shadow_stack_status do_prctl_inval1
#endif
#ifndef do_prctl_set_shadow_stack_status
#define do_prctl_set_shadow_stack_status do_prctl_inval1
#endif
#ifndef do_prctl_lock_shadow_stack_status
#define do_prctl_lock_shadow_stack_status do_prctl_inval1
#endif
static abi_long do_prctl_syscall_user_dispatch(CPUArchState *env,
abi_ulong arg2, abi_ulong arg3,
@@ -6499,6 +6513,21 @@ static abi_long do_prctl(CPUArchState *env, abi_long option, abi_long arg2,
return -TARGET_EINVAL;
}
return do_prctl_get_tagged_addr_ctrl(env);
case PR_GET_SHADOW_STACK_STATUS:
if (arg3 || arg4 || arg5) {
return -TARGET_EINVAL;
}
return do_prctl_get_shadow_stack_status(env, arg2);
case PR_SET_SHADOW_STACK_STATUS:
if (arg3 || arg4 || arg5) {
return -TARGET_EINVAL;
}
return do_prctl_set_shadow_stack_status(env, arg2);
case PR_LOCK_SHADOW_STACK_STATUS:
if (arg3 || arg4 || arg5) {
return -TARGET_EINVAL;
}
return do_prctl_lock_shadow_stack_status(env, arg2);
case PR_GET_UNALIGN:
return do_prctl_get_unalign(env, arg2);