@@ -2289,7 +2289,7 @@ static void load_elf_image(const char *image_name, int image_fd,
struct elfhdr *ehdr = (struct elfhdr *)bprm_buf;
struct elf_phdr *phdr;
abi_ulong load_addr, load_bias, loaddr, hiaddr, error;
- int i, retval;
+ int i, retval, prot_exec = PROT_EXEC;
const char *errmsg;
/* First of all, some simple consistency checks */
@@ -2324,17 +2324,89 @@ static void load_elf_image(const char *image_name, int image_fd,
loaddr = -1, hiaddr = 0;
info->alignment = 0;
for (i = 0; i < ehdr->e_phnum; ++i) {
- if (phdr[i].p_type == PT_LOAD) {
- abi_ulong a = phdr[i].p_vaddr - phdr[i].p_offset;
+ struct elf_phdr *eppnt = phdr + i;
+
+ if (eppnt->p_type == PT_LOAD) {
+ abi_ulong a = eppnt->p_vaddr - eppnt->p_offset;
if (a < loaddr) {
loaddr = a;
}
- a = phdr[i].p_vaddr + phdr[i].p_memsz;
+ a = eppnt->p_vaddr + eppnt->p_memsz;
if (a > hiaddr) {
hiaddr = a;
}
++info->nsegs;
- info->alignment |= phdr[i].p_align;
+ info->alignment |= eppnt->p_align;
+ } else if (eppnt->p_type == PT_GNU_PROPERTY) {
+#ifdef TARGET_AARCH64
+ /*
+ * Process NT_GNU_PROPERTY_TYPE_0.
+ *
+ * TODO: For AArch64, the PT_GNU_PROPERTY is authoritative:
+ * it is present if and only if NT_GNU_PROPERTY_TYPE_0 is.
+ * That may or may not be true for other architectures.
+ *
+ * TODO: The only item that is AArch64 specific is the
+ * GNU_PROPERTY_AARCH64_FEATURE_1_AND processing at the end.
+ * If we were to ever process GNU_PROPERTY_X86_*, all of the
+ * code through checking the gnu0 magic number is sharable.
+ * But for now, since this *is* only used by AArch64, don't
+ * process the note elsewhere.
+ */
+ const uint32_t gnu0_magic = const_le32('G' | 'N' << 8 | 'U' << 16);
+ uint32_t note[7];
+
+ /*
+ * The note contents are 7 words, but depending on LP64 vs ILP32
+ * there may be an 8th padding word at the end. Check for and
+ * read the minimum size. Further checks below will validate
+ * that the sizes of everything involved are as we expect.
+ */
+ if (eppnt->p_filesz < sizeof(note)) {
+ continue;
+ }
+ if (eppnt->p_offset + eppnt->p_filesz <= BPRM_BUF_SIZE) {
+ memcpy(note, bprm_buf + eppnt->p_offset, sizeof(note));
+ } else {
+ retval = pread(image_fd, note, sizeof(note), eppnt->p_offset);
+ if (retval != sizeof(note)) {
+ goto exit_perror;
+ }
+ }
+#ifdef BSWAP_NEEDED
+ for (i = 0; i < ARRAY_SIZE(note); ++i) {
+ bswap32s(note + i);
+ }
+#endif
+ /*
+ * Check that this is a NT_GNU_PROPERTY_TYPE_0 note.
+ * Again, descsz includes padding. Full size validation
+ * awaits checking the final payload.
+ */
+ if (note[0] != 4 || /* namesz */
+ note[1] < 12 || /* descsz */
+ note[2] != NT_GNU_PROPERTY_TYPE_0 || /* type */
+ note[3] != gnu0_magic) { /* name */
+ continue;
+ }
+ /*
+ * Check for the BTI feature. If present, this indicates
+ * that all the executable pages of the binary should be
+ * mapped with PROT_BTI, so that branch targets are enforced.
+ */
+ if (note[4] == GNU_PROPERTY_AARCH64_FEATURE_1_AND &&
+ note[5] == 4 &&
+ (note[6] & GNU_PROPERTY_AARCH64_FEATURE_1_BTI)) {
+ /*
+ * Elf notes are backward compatible to older cpus.
+ * Do not enable unless it is supported.
+ */
+ ARMCPU *cpu = ARM_CPU(thread_cpu);
+ if (cpu_isar_feature(aa64_bti, cpu)) {
+ prot_exec |= TARGET_PROT_BTI;
+ }
+ }
+#endif /* TARGET_AARCH64 */
}
}
@@ -2394,9 +2466,15 @@ static void load_elf_image(const char *image_name, int image_fd,
abi_ulong vaddr, vaddr_po, vaddr_ps, vaddr_ef, vaddr_em, vaddr_len;
int elf_prot = 0;
- if (eppnt->p_flags & PF_R) elf_prot = PROT_READ;
- if (eppnt->p_flags & PF_W) elf_prot |= PROT_WRITE;
- if (eppnt->p_flags & PF_X) elf_prot |= PROT_EXEC;
+ if (eppnt->p_flags & PF_R) {
+ elf_prot |= PROT_READ;
+ }
+ if (eppnt->p_flags & PF_W) {
+ elf_prot |= PROT_WRITE;
+ }
+ if (eppnt->p_flags & PF_X) {
+ elf_prot |= prot_exec;
+ }
vaddr = load_bias + eppnt->p_vaddr;
vaddr_po = TARGET_ELF_PAGEOFFSET(vaddr);
For aarch64, this includes the GNU_PROPERTY_AARCH64_FEATURE_1_BTI bit, which indicates that the image should be mapped with guarded pages. Signed-off-by: Richard Henderson <richard.henderson@linaro.org> --- linux-user/elfload.c | 94 ++++++++++++++++++++++++++++++++++++++++---- 1 file changed, 86 insertions(+), 8 deletions(-) --- Note: The behaviour here when GNU_PROPERTY_AARCH64_FEATURE_1_BTI is present differs from Dave's v1 patch set, in which the kernel refuses to load the binary if the host does not support BTI. However, I feel that's not the best way to introduce a feature that adds security and is otherwise designed to be backward compatible to such hosts. We should want entire distributions to be built indicating compatibility with BTI via this markup. I included this rationale in my review of Dave's patch set. r~ -- 2.17.1