Implements shadow stack related prctls for qemu-user on riscv. Allocates
shadow stack from host memory using `target_mmap` and tears down when
user issues prctl to disable using `target_munmap`.
Signed-off-by: Deepak Gupta <de...@rivosinc.com>
Co-developed-by: Jesse Huang <jesse.hu...@sifive.com>
Co-developed-by: Jim Shu <jim....@sifive.com>
Co-developed-by: Andy Chiu <andy.c...@sifive.com>
---
linux-user/riscv/cpu_loop.c | 50 +++++++++++++++++++++++++++++++++
linux-user/riscv/target_cpu.h | 7 +++++
linux-user/riscv/target_prctl.h | 27 ++++++++++++++++++
target/riscv/cpu.c | 4 +++
target/riscv/cpu.h | 1 +
5 files changed, 89 insertions(+)
diff --git a/linux-user/riscv/cpu_loop.c b/linux-user/riscv/cpu_loop.c
index 52c49c2e42..22670b68e0 100644
--- a/linux-user/riscv/cpu_loop.c
+++ b/linux-user/riscv/cpu_loop.c
@@ -25,6 +25,7 @@
#include "signal-common.h"
#include "elf.h"
#include "semihosting/common-semi.h"
+#include "user-mmap.h"
void cpu_loop(CPURISCVState *env)
{
@@ -94,6 +95,55 @@ void cpu_loop(CPURISCVState *env)
}
}
+#define ZICFISS_GUARD_SIZE (2UL * TARGET_PAGE_SIZE)
+#define ZICFISS_STACK_SIZE (16UL * TARGET_PAGE_SIZE)
+#define ZICFISS_THREAD_SIZE (ZICFISS_STACK_SIZE + ZICFISS_GUARD_SIZE)
+
+void zicfiss_shadow_stack_alloc(CPUArchState *env)
+{
+ uintptr_t new_base;
+
+ /* SS page should be surrounded by two guard pages */
+ new_base = (uintptr_t) target_mmap(0, ZICFISS_THREAD_SIZE, PROT_NONE,
+ MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
+ if ((intptr_t)new_base == -1) {
+ perror("shadow stack alloc failure");
+ exit(EXIT_FAILURE);
+ }
+ new_base += TARGET_PAGE_SIZE;
+ int ret = mprotect((void *)new_base, ZICFISS_STACK_SIZE,
+ PROT_READ | PROT_WRITE);
+ if (ret == -1) {
+ perror("shadow stack mprotect failure");
+ exit(EXIT_FAILURE);
+ }
+
+ env->ssp_base = new_base;
+ env->ssp = new_base + ZICFISS_STACK_SIZE;
+}
+
+void zicfiss_shadow_stack_release(CPUArchState *env)
+{
+ abi_ulong mmap_base;
+
+ if (env->ssp == 0) {
+ perror("release empty shadow stack");
+ exit(EXIT_FAILURE);
+ }
+
+ /* It should match shadow stack allocation. */
+ mmap_base = env->ssp_base - TARGET_PAGE_SIZE;
+
+ int ret = target_munmap(mmap_base, ZICFISS_THREAD_SIZE);
+ if (ret == -1) {
+ perror("shadow stack release failure");
+ exit(EXIT_FAILURE);
+ }
+
+ env->ssp_base = 0;
+ env->ssp = 0;
+}
+
void target_cpu_copy_regs(CPUArchState *env, struct target_pt_regs *regs)
{
CPUState *cpu = env_cpu(env);
diff --git a/linux-user/riscv/target_cpu.h b/linux-user/riscv/target_cpu.h
index 9c642367a3..bba54d93eb 100644
--- a/linux-user/riscv/target_cpu.h
+++ b/linux-user/riscv/target_cpu.h
@@ -1,6 +1,9 @@
#ifndef RISCV_TARGET_CPU_H
#define RISCV_TARGET_CPU_H
+extern void zicfiss_shadow_stack_alloc(CPUArchState *env);
+extern void zicfiss_shadow_stack_release(CPUArchState *env);
+
static inline void cpu_clone_regs_child(CPURISCVState *env, target_ulong newsp,
unsigned flags)
{
@@ -9,6 +12,10 @@ static inline void cpu_clone_regs_child(CPURISCVState *env,
target_ulong newsp,
}
env->gpr[xA0] = 0;
+
+ if (flags & CLONE_VM) {
+ zicfiss_shadow_stack_alloc(env);
+ }
}
static inline void cpu_clone_regs_parent(CPURISCVState *env, unsigned flags)
diff --git a/linux-user/riscv/target_prctl.h b/linux-user/riscv/target_prctl.h
index d7f9f954c9..6293d61519 100644
--- a/linux-user/riscv/target_prctl.h
+++ b/linux-user/riscv/target_prctl.h
@@ -13,6 +13,33 @@ static abi_long do_prctl_cfi(CPUArchState *env,
if (env_archcpu(env)->cfg.ext_zicfilp) {
switch (option) {
+ case PR_GET_SHADOW_STACK_STATUS:
+ abi_ulong bcfi_status = 0;
+ /* indirect branch tracking is enabled on the task or not */
+ bcfi_status |= (env->ubcfien ? PR_INDIR_BR_LP_ENABLE : 0);
+ return copy_to_user(flag, &bcfi_status, sizeof(bcfi_status)) ? \
+ -EFAULT : 0;
+
+ case PR_SET_SHADOW_STACK_STATUS:
+ /* if any other bit is set, its invalid param */
+ if (flag & ~PR_SHADOW_STACK_ENABLE) {
+ return -TARGET_EINVAL;
+ }
+
+ if ((flag & PR_SHADOW_STACK_ENABLE)
+ && (env->ssp == 0 && !env->ubcfien)) {
+ zicfiss_shadow_stack_alloc(env);
+ } else {
+ zicfiss_shadow_stack_release(env);
+ }
+ env->ubcfien = (flag & PR_SHADOW_STACK_ENABLE);
+ tb_flush(env_cpu(env));
+ return 0;
+
+ /* locking not implemented (also not needed for qemu-user) yet */
+ case PR_LOCK_SHADOW_STACK_STATUS:
+ return -TARGET_EINVAL;
+
case PR_GET_INDIR_BR_LP_STATUS:
abi_ulong fcfi_status = 0;
/* indirect branch tracking is enabled on the task or not */
diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index e1ff246c24..5a34eee10c 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -1001,6 +1001,10 @@ static void riscv_cpu_reset_hold(Object *obj, ResetType
type)
/* on reset ssp is set to 0 */
env->ssp = 0;
+#ifdef CONFIG_USER_ONLY
+ env->ssp_base = 0;
+#endif
+
/*
* Bits 10, 6, 2 and 12 of mideleg are read only 1 when the Hypervisor
* extension is enabled.
diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
index 82475490ab..af89fc1268 100644
--- a/target/riscv/cpu.h
+++ b/target/riscv/cpu.h
@@ -232,6 +232,7 @@ struct CPUArchState {
uint32_t elf_flags;
bool ufcfien;
bool ubcfien;
+ target_ulong ssp_base;
#endif
#ifndef CONFIG_USER_ONLY
--
2.44.0
