1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
|
id = 998
title = "AArch64: SCTLR_EL1.BT0 set incorrectly in user mode"
state = "closed"
created_at = "2022-04-22T15:22:46.821Z"
closed_at = "2022-05-05T17:53:48.578Z"
labels = ["Closed::Fixed", "accel: TCG", "linux-user", "target: arm"]
url = "https://gitlab.com/qemu-project/qemu/-/issues/998"
host-os = "Ubuntu 20.04"
host-arch = "ARM"
qemu-version = "v7.0.0-rc4"
guest-os = "Fedora 34"
guest-arch = "ARM"
description = """PACIASP normally acts as a BTI landing pad, but not in every situation. When SCTLR_EL1.BT is set, PACIASP checks that the indirect branch originates from X16 or X17 when the indirect branch is taken from a BTI guarded area. Linux sets this bit, ideally QEMU-user should too. This sample program should crash with a SIGILL if QEMU is working correctly, otherwise it will crash with a SIGSEGV.
#include <stdint.h>
#include <stdlib.h>
#include <unistd.h>
#include <string.h>
#include <stdio.h>
#include <sys/mman.h>
// PACIASP is a valid BTI landing pad, but there are some conditions
// under Linux which sets SCTLR_ELx.BT0 = 1. In this mode, a branch
// onto a PACIASP landing pad is only valid if it originates from
// x16 or x17 (i.e. br x17 is OK, br x3 is not).
// More info on page D5-4851 of the Arm Architecture Reference Manual (ARM DDI 0487H.a).
// Sample function which starts with a paciasp instruction
// (comes from -mbranch-protection=pac-ret+leaf)
void indirect_fn(int i) {
// paciasp instruction inserted here - should crash with SIGILL here if everything's operating OK.
i = i+1;
// Can't access this function from the copied location, so will segfault.
fprintf(stderr, "reachable\\n");
}
int main(int argc, char **argv) {
// It's difficult to get a whole binary BTI compatible without the appropriate crtbegin etc
// so instead map a page and copy the sample function there.
void *e = mmap(0, getpagesize(), PROT_READ | PROT_WRITE, MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
if (e == MAP_FAILED) {
return 1;
}
memcpy(e, (void*)indirect_fn, 64);
mprotect(e, getpagesize(), PROT_READ | PROT_EXEC | PROT_BTI);
// paciasp is a valid landing pad if the branch comes from an unprotected area,
// so to ensure that we're protected - assemble an intermediate shim that's also PROT_BTI.
void *f = mmap(0, getpagesize(), PROT_READ | PROT_WRITE, MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
if (f == MAP_FAILED) {
return 1;
}
uint32_t *x = (uint32_t*)f;
x[0] = 0xd503245fuL; // bti c
x[1] = 0xd61f0060uL; // br x1 - n.b. must be BR
mprotect(f, getpagesize(), PROT_READ | PROT_EXEC | PROT_BTI);
// Jump to the shim
asm volatile (
"mov x3, %0\\n"
"mov x2, %1\\n"
"blr x2\\n"
: : "p"(e), "p"(f) : "x2", "x3");
// Execution should not reach here
return 1;
}"""
reproduce = """1. Compile with `clang-12 -g --sysroot=/work/home/fedora-rootfs/fedora_aarch64 -o sample --target=aarch64-linux-gnu -mbranch-protection=pac-ret+leaf -march=armv8-a -O1 -g sample.c` or similar.
2. Run with `../qemu/build/qemu-aarch64 --cpu max -L ~/fedora-rootfs/fedora_aarch64 sample`"""
additional = """n/a"""
|