about summary refs log tree commit diff
path: root/sysdeps
Commit message (Collapse)AuthorAgeFilesLines
* cheri: malloc: exact capability check in free/realloc arm/morello/mainSzabolcs Nagy2023-04-052-26/+41
| | | | | | | | | | | | Capability narrowing uses a lookup table from an address to the internally used wide capability. Keep the narrow capability in the table instead of just the address and check it. This allows free and realloc to check their input and only accept capabilities exactly matching what was returned by malloc. When a user adds restrictions on top of malloc returned capabilities (e.g. narrower bounds), realloc could bypass those restrictions when it simply looked up the internal wide capability for the address.
* TODO(vdso): aarch64: morello: disable VDSO loadingSzabolcs Nagy2023-02-211-0/+21
| | | | | | | | Once the kernel starts providing a VDSO, old binaries should continue to work (without using the new VDSO). For this we set the vdso to 0 independently of auxv, otherwise glibc attempts to load it even if the target has no vdso symbols specified and the load can crash since the setup code is not purecap compatible.
* TODO(uapi): aarch64: morello: update HWCAP2_MORELLOSzabolcs Nagy2023-02-021-1/+1
|
* cheri: malloc: Set fixed mmap_threshold for capability narrowingSzabolcs Nagy2022-12-091-0/+4
| | | | | | | | | | | | | Capability narrowing requires extra alignment for large allocations, this can cause significant heap fragmentation so ensure large allocations use a single mmap and unmaped on free. The fragmentation is bug 14581. This patch disables dynamic mmap threshold when cap_narrowing is enabled and uses a threshold of 256 kbytes on morello (which means at most 64 byte alignment requirement on the heap). The dynamic threshold could quickly grow very big and stay there making the fragmentation issue common.
* aarch64: morello: malloc: better lookup table resize logicSzabolcs Nagy2022-12-081-1/+1
| | | | | | Capability narrowing uses a lookup table and the old logic could cause unnecessary resizes after deletes with the smallest lookup table size.
* cheri: malloc: Capability narrowing using internal lookup tableSzabolcs Nagy2022-11-222-3/+301
| | | | | | | | | | | | | | | Add more cap_ hooks to implement narrowing without depending on a global capability covering the heap. Either recording every narrowed capability in a lookup table or recording every mapping used for the heap are supported. The morello implmentation uses a lookup table for now. The lookup table adds memory overhead, failure paths and locks. Recording and removing entries from the lookup table must be done carefully in realloc so on failure the old pointer is usable and on success the old pointer is immediately reusable concurrently. The locks require fork hooks so malloc works in multi-threaded fork child.
* cheri: malloc: Initial capability narrowing supportSzabolcs Nagy2022-11-222-0/+100
| | | | | | | | | | | | | | Public interfaces return pointers with narrow bounds, this internally requires bumping the size and alignment requirement of allocations so the bounds are representible. When pointers with narrow bounds need to be turned back to have wide bounds (free, realloc), the pointer is rederived from DDC. (So this patch relies on DDC to cover all heap memory with RW permission.) Allocations above the mmap threshold waste memory for alignment and realloc often falls back to the inefficient alloc, copy, free sequence instead of mremap or other inplace solution.
* cheri: Update libc.abilist for getauxptrCarlos Eduardo Seo2022-11-2236-0/+72
| | | | Updates libc.abilist files for getauxptr to version 2.37.
* cheri: stdio-common: Add test for %#p printf modifierCarlos Eduardo Seo2022-11-222-0/+101
| | | | Testcase for printing capabilities.
* cheri: Fix sigevent ABISzabolcs Nagy2022-11-221-1/+5
| | | | Adjust padding to accommodate pointer size and alignment increase.
* cheri: fix posix timersSzabolcs Nagy2022-11-221-0/+20
| | | | | | | | | | | | | We need to distinguish timerids that are small integers returned by the kernel and timerids that are pointers to struct timer. The existing pointer tagging does not work for CHERI because of the pointer shift. Simply use the top bit without shift to tag pointers. This still relies on the top byte ignore of aarch64 (the top byte does not affect the capability representation) and that pointers are not tagged for other reasons (like HWASAN). Note: this is morello specific and does not work for generic cheri.
* TODO(uapi): cheri: start: restrict auxv capability permissionsSzabolcs Nagy2022-11-222-0/+4
| | | | TODO: not needed with full pcuabi
* aarch64: morello: fix DL_SYMBOL_ADDRESSSzabolcs Nagy2022-11-226-2/+67
| | | | | | | It has to return a pointer that can be dereferenced, so it must be derived correctly from RX and RW capabilities. Try to have tight object bounds and seal function symbols.
* aarch64: morello: add D_PTR_RWSzabolcs Nagy2022-11-222-1/+5
| | | | Writable version of D_PTR, required for updating GOT[1] and GOT[2].
* aarch64: morello: Return bounded pointer in __tls_get_addrSzabolcs Nagy2022-11-223-9/+65
| | | | | | | | | There is no traditional TLS support in morello that would explicitly call __tls_get_addr, but the libc uses it internally and the returned pointer escapes to user code. So bound the pointers according to the tls symbol size instead of doing so in each caller. (Affects dlsym and dynamic TLSDESC.)
* aarch64: morello: dynamic linking supportSzabolcs Nagy2022-11-228-2/+856
| | | | | | | | | | | | | | | | | | | | | | | | Add morello specific dl-machine.h. Add morello dynamic relocation processing support for purecap ABI. Only support R_AARCH64_NONE, R_AARCH64_ABS64 and R_AARCH64_RELATIVE dynamic relocs from the lp64 ABI. RELATIVE and IRELATIVE relocs use a helper function from cheri-rel.h to construct a capability. Also fixed the IRELATIVE handling for static linking. Use new machine routines on morello for load address computation so it is a valid capability: void *elf_machine_runtime_dynamic (void) void elf_machine_rtld_base_setup (struct link_map *map, void *args) The ld.so load address and RX, RW capabilities are derived from auxv and the RW ranges are set up based on the ld.so program headers early. __tls_get_addr should return a bounded pointer instead of fixing it in _dl_make_tlsdesc_dynamic, this is done in a separate patch.
* aarch64: morello: add lazy binding entry codeSzabolcs Nagy2022-11-221-0/+136
|
* cheri: elf: fix SYMBOL_ADDRESS to return RX derived pointerSzabolcs Nagy2022-11-221-2/+5
| | | | | | All symbol addresses can be derived from the RX capability of the module (l_map_start). For RW object symbols pointer will have to be rederived from l_rw_start.
* cheri: elf: Use elfptr_t for function symbol fixupSzabolcs Nagy2022-11-221-1/+1
| | | | Propagate capabilities during lazy binding and IFUNC fixup in dlsym.
* aarch64: morello: add dl-r_debug.hSzabolcs Nagy2022-11-221-0/+61
| | | | | | | | Used internally for r_debug tests, but with the assumption that the return value can be dereferenced, so change the prototype and return a valid capability. Also used in pldd, where we only support purecap abi processes.
* aarch64: elf: avoid loading incompatible binariesSzabolcs Nagy2022-11-221-1/+2
| | | | Prevent lp64 ld.so loading purecap binaries.
* cheri: elf: use RX, RW capabilities to derive pointersSzabolcs Nagy2022-11-221-1/+2
| | | | | | | | | | | | | Instead of map->l_addr + offset use dl_rx_ptr (map, offset) dl_rw_ptr (map, offset) depending on RX or RW permission requirement.
* cheri: elf: change l_entry to be elfptr_tSzabolcs Nagy2022-11-222-5/+5
| | | | | | | | | | | | It is simpler and more consistent to make l_entry a capability throughout instead of leaving it as an address and converting before use: The AT_ENTRY auxv entry is specified to be a capability and a number if internal l_entry usage is simpler if it is elfptr_t. Functions returning a pointer to the user entry are also changed to use elfptr_t.
* aarch64: morello: add purecap ld.so _start codeSzabolcs Nagy2022-11-221-0/+110
| | | | | | | | | The purecap version of aarch64 dl-start.S. Note: self relocation of ld.so is handled by the rtld bootstrap code. The ldso internal _dl_start still expects continuous argc, argv, envp, auxv, so that's emulated (since the purecap ELF entry passes them in separate registers).
* aarch64: morello: rtld: define DL_RO_DYN_SECTIONSzabolcs Nagy2022-11-221-0/+25
| | | | The dynamic section cannot be relocated to hold pointers in place.
* aarch64: morello: fix ldconfig for purecap abiSzabolcs Nagy2022-11-224-1/+20
| | | | | | Add purecap ld cache flag. Add the purecap ld.so name to known names. Handle lib64c system library paths. And set the purecap abi flag on cache entries.
* aarch64: morello: disable the vpcs testSzabolcs Nagy2022-11-221-1/+1
| | | | The asm code of the test is for lp64 ABI only.
* aarch64: morello: add purecap ucontext supportCarlos Eduardo Seo2022-11-229-0/+493
| | | | | | | | | Adjust ucontext layout for purecap ABI and add make/get/set/swapcontext implementations accordingly. Note: mcontext layout follows the linux sigcontext struct, in userspace *context functions rely on the c registers stored in the extension area and ignore the mcontext fields for x registers.
* aarch64: morello: add purecap setjmp/longjmpCarlos Eduardo Seo2022-11-223-1/+176
| | | | | Similar to lp64 setjmp/longjmp, but handles capability registers. Save q regs instead of d regs to simplify the offset computation.
* cheri: rseq: remove const to avoid readonly permissionSzabolcs Nagy2022-11-221-0/+14
| | | | | | | | | | Using const on the definition does not work for a pure capability ABI: the capability permissions when accessing the object will be read only. Use a hack to hide the public declaration in the TU where the const objects are initialized. (This should work on non-capability targets too, but to err on the safe side only enable the hack on capability targets.)
* cheri: Fix capability permissions of PROT_NONE maps in test codeSzabolcs Nagy2022-11-221-1/+1
|
* aarch64: morello: nptl: fix thread pointer setupSzabolcs Nagy2022-11-221-0/+5
|
* aarch64: morello: nptl: fix pthread types for 128 bit pointersSzabolcs Nagy2022-11-221-1/+11
|
* cheri: nptl: fix pthread_attr_t alignmentSzabolcs Nagy2022-11-221-0/+1
| | | | | Alignment of the public definition did not match the internal layout. Ensure that the type is at least pointer aligned.
* cheri: nptl: fix thread ID types for capabilitiesSzabolcs Nagy2022-11-222-0/+8
|
* cheri: Implement 128-bit atomicsSzabolcs Nagy2022-11-221-0/+21
| | | | Arm Morello requires 128-bit atomics.
* cheri: Setup RX, RW capabilities for static linkingSzabolcs Nagy2022-11-221-2/+7
| | | | At least tls image access requires RX capability of the main link_map.
* cheri: elf: add dl_{rx,rw}_ptr to derive addresses within a mapSzabolcs Nagy2022-11-221-0/+28
| | | | To derive pointers within a module from the per module RX and RW caps.
* cheri: fix static linking early allocationSzabolcs Nagy2022-11-221-1/+1
| | | | Store mmap result to intptr_t instead of long.
* cheri: don't use dl_random for pointer manglingSzabolcs Nagy2022-11-221-0/+5
| | | | | | | | Pointer mangling cannot be supported on capability architectures. And there is not enough bytes in dl_random for 128 bit pointers. Stack guard is still loaded from dl_random: stack protection is unlikely to be useful on a capability architecture, but it works.
* aarch64: morello: add purecap start codeSzabolcs Nagy2022-11-222-0/+215
| | | | | | | | | | | | | | | | | | Written in C so the self relocation code in crt1.o is easier to maintain. The purecap ELF entry is special: passes separate argc, argv, envp, auxv in registers instead of on the stack. For each module there will be separate RW and RX capabilities that cover the writable and all load segments respectively. The relative reloc processing code is prepared for such separate capabilities. The static link detection (for self relocation) is not ideal, it relies on relocations that don't work in PIC, so it is ifdefed out for Scrt1.o. (Currently adrp of undefined weak symbol is not fixed up by the linker to be 0 so we use movz to detect the presence of __rela_dyn_start.)
* cheri: change __libc_start_main prototypeSzabolcs Nagy2022-11-221-0/+32
| | | | | | | | | | | | The prototype of __libc_start_main is changed to void __libc_start_main (int main (int, char **, char **, void *), int argc, char **argv, char **envp, void *auxv, void rtld_fini (void), void *sp); so envp is passed down separately and the unused init, fini args are dropped.
* aarch64: morello: purecap crti.S and crtn.SCarlos Eduardo Seo2022-11-222-0/+141
| | | | Purecap ABI versions of crti.S and crtn.S.
* cheri: aarch64: Add header for CHERI permissionsCarlos Eduardo Seo2022-11-221-0/+84
| | | | | | | | | New file containing the capability permission bits. The capability permission bits are defined in the Arm Architecture Reference Manual Suplement- Morello for A-Profile Architecture: https://developer.arm.com/documentation/ddi0606/latest
* cheri: elf: use elfptr_t for auxv parsingSzabolcs Nagy2022-11-221-2/+2
|
* cheri: Fix pselect signal mask argumentSzabolcs Nagy2022-11-221-5/+12
| | | | | | The signal mask argument is passed as a struct with a pointer and size in the linux syscall abi, but the types used in glibc were wrong for CHERI due to an x32 specific hack.
* TODO(uapi): narrow capability in mmap and mremapSzabolcs Nagy2022-11-222-3/+40
| | | | | | | | | | | This is a temporary workaround. length is rounded up to pagesize and don't use exact bound (bounds will be larger if exact value is not representable). capability permissions are roughly emulated too. TODO: kernel should do this
* TODO(uapi): aarch64: morello: add HWCAP2_MORELLOSzabolcs Nagy2022-11-221-0/+1
| | | | TODO: this is the value in the 5.18 kernel, will change later.
* TODO(uapi): aarch64: morello: use non-ifunc gettimeofdaySzabolcs Nagy2022-11-221-1/+3
| | | | TODO: Remove this once morello has vdso gettimeofday.
* TODO(uapi): aarch64: morello: make brk always failSzabolcs Nagy2022-11-221-0/+25
| | | | TODO: drop this once linux brk always fails.
generated by cgit-pink 1.4.1 (git 2.36.1) at 2024-09-03 00:05:02 +0000