diff --git a/devbuild.sh b/devbuild.sh new file mode 100755 index 000000000000..095d3a34ec77 --- /dev/null +++ b/devbuild.sh @@ -0,0 +1,5 @@ +#!/bin/sh +git checkout wip +git commit -am "WIP $(date -Iseconds)" +git push dev +ssh morellobox 'cd ~/cheri/cheribuild && ./cheribuild.py cheribsd-morello-purecap --cheribsd/build-options "CHERI_STACK_TEMP_SAFETY=yes" --subdir "libexec/rtld-elf/ lib/libsys/"' diff --git a/lib/libsys/Makefile b/lib/libsys/Makefile index 0c5455cffbd7..be926aca87d4 100644 --- a/lib/libsys/Makefile +++ b/lib/libsys/Makefile @@ -1,8 +1,13 @@ PACKAGE= clibs SHLIBDIR?= /lib + .include +.ifdef CHERI_STACK_TEMP_SAFETY +CFLAGS+=-DCHERI_STACK_TEMP_SAFETY +.endif + LIBC_SRCTOP?= ${SRCTOP}/lib/libc LIBSYS_SRCTOP?= ${SRCTOP}/lib/libsys diff --git a/lib/libsys/mmap_c18n.c b/lib/libsys/mmap_c18n.c index c2e91b121578..c47d37952dbc 100644 --- a/lib/libsys/mmap_c18n.c +++ b/lib/libsys/mmap_c18n.c @@ -30,6 +30,9 @@ __mmap(void *addr, size_t len, int prot, int flags, int fd, off_t offset) perms = CHERI_PERM_SYSCALL; #ifdef __aarch64__ perms |= CHERI_PERM_EXECUTIVE; +#endif +#ifdef CHERI_STACK_TEMP_SAFETY + perms |= CHERI_PERM_STORE_LOCAL_CAP; #endif ret = cheri_perms_clear(ret, perms); } diff --git a/libexec/rtld-elf/Makefile b/libexec/rtld-elf/Makefile index 0f400924eb6b..20e58caeb49e 100644 --- a/libexec/rtld-elf/Makefile +++ b/libexec/rtld-elf/Makefile @@ -4,6 +4,10 @@ RTLD_ELF_DIR:= ${.PARSEDIR} +.ifdef CHERI_STACK_TEMP_SAFETY +CFLAGS+=-DCHERI_STACK_TEMP_SAFETY +.endif + .ifdef BUILD_RTLD_DEBUG DEBUG+=-DDEBUG .endif diff --git a/libexec/rtld-elf/rtld_c18n.c b/libexec/rtld-elf/rtld_c18n.c index 08c5a4f754e4..e76bb6de72dc 100644 --- a/libexec/rtld-elf/rtld_c18n.c +++ b/libexec/rtld-elf/rtld_c18n.c @@ -884,11 +884,16 @@ get_or_create_untrusted_stk(compart_id_t cid, struct stk_table **tablep) size = C18N_STACK_SIZE; stk = create_stk(size); +#ifdef CHERI_STACK_TEMP_SAFETY + stk = cheri_perms_clear(stk, CHERI_PERM_GLOBAL); +#endif + table->meta->compart_stk[cid] = (struct stk_table_stk_info) { .size = size, .begin = stk - size }; - table->entries[cid].stack = cheri_perms_clear(stk, CHERI_PERM_SW_VMEM); + uint64_t perms = CHERI_PERM_SW_VMEM; + table->entries[cid].stack = cheri_perms_clear(stk, perms); atomic_fetch_add_explicit(&c18n_stats->rcs_ustack, 1, memory_order_relaxed);