Because safe-syscall.S does not go through the C compiler, the
.note.gnu.property note has to be added manually. Safe syscalls do not
involve any indirect branch or stack unwinding, so they are trivially
safe for IBT or shadow stacks.
Signed-off-by: Paolo Bonzini <pbonz...@redhat.com>
---
linux-user/host/i386/safe-syscall.inc.S | 19 +++++++++++++++++++
linux-user/host/x86_64/safe-syscall.inc.S | 19 +++++++++++++++++++
2 files changed, 38 insertions(+)
diff --git a/linux-user/host/i386/safe-syscall.inc.S
b/linux-user/host/i386/safe-syscall.inc.S
index 9e58fc6504..6c6d568d62 100644
--- a/linux-user/host/i386/safe-syscall.inc.S
+++ b/linux-user/host/i386/safe-syscall.inc.S
@@ -98,3 +98,22 @@ safe_syscall_end:
.cfi_endproc
.size safe_syscall_base, .-safe_syscall_base
+
+ .pushsection ".note.gnu.property", "a"
+ .p2align 2
+ .long 1f - 0f /* name length. */
+ .long 4f - 1f /* data length. */
+ .long 5 /* NT_GNU_PROPERTY_TYPE_0. */
+0:
+ .asciz "GNU" /* vendor name. */
+ .p2align 2
+1:
+ /* GNU_PROPERTY_X86_FEATURE_1_AND. */
+ .long 0xc0000002 /* pr_type. */
+ .long 3f - 2f /* pr_datasz. */
+2:
+ .long 0x3 /* IBT, SHSTK */
+3:
+ .p2align 2
+4:
+ .popsection
diff --git a/linux-user/host/x86_64/safe-syscall.inc.S
b/linux-user/host/x86_64/safe-syscall.inc.S
index f36992daa3..e1a57db338 100644
--- a/linux-user/host/x86_64/safe-syscall.inc.S
+++ b/linux-user/host/x86_64/safe-syscall.inc.S
@@ -89,3 +89,22 @@ safe_syscall_end:
.cfi_endproc
.size safe_syscall_base, .-safe_syscall_base
+
+ .pushsection ".note.gnu.property", "a"
+ .p2align 3
+ .long 1f - 0f /* name length. */
+ .long 4f - 1f /* data length. */
+ .long 5 /* NT_GNU_PROPERTY_TYPE_0. */
+0:
+ .asciz "GNU" /* vendor name. */
+ .p2align 3
+1:
+ /* GNU_PROPERTY_X86_FEATURE_1_AND. */
+ .long 0xc0000002 /* pr_type. */
+ .long 3f - 2f /* pr_datasz. */
+2:
+ .long 0x3 /* IBT, SHSTK */
+3:
+ .p2align 3
+4:
+ .popsection
--
2.20.1
