From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-wm1-f42.google.com (mail-wm1-f42.google.com [209.85.128.42]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id AEC9222687A for ; Thu, 20 Mar 2025 21:25:33 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.128.42 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1742505936; cv=none; b=MbO50iKwwOApJu866cy5OlOvCJPp90i/R1S1/rOtBhu0fQ62fNBD34EM0KZDAdL8MERnwZoSFRlrOjqsdPSHlbcTfaFo43XFOU+0Lzg9CIylJnszttCUkwn+vGVqHJFw0QKONrPmANYeWk8Q1oTBI8YH1BWHVb7rxAeEdY1LxNs= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1742505936; c=relaxed/simple; bh=vI1BPqRdoy10g+WgmlSAf2KikeZLxUqHEVWTLCbIm9w=; h=Mime-Version:Content-Type:Date:Message-Id:Cc:To:From:Subject: References:In-Reply-To; b=uWRZp0yqKMqQRm1t8Fo252qF5/D8eWNdzR3+YFLZrKooSRjdyrNRRTahfxNlb+10cgJUPdzz3Tmrxly8ujcZZQip+x3CsSuX2lXNfiE+7zcfvQRH+z3Qn2lTs6EMn9Wda4zgzslRV466TNBI7FaxxW3WfdN8KkoW6WR2Y56Poac= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=ventanamicro.com; spf=pass smtp.mailfrom=ventanamicro.com; dkim=pass (2048-bit key) header.d=ventanamicro.com header.i=@ventanamicro.com header.b=id1O5h57; arc=none smtp.client-ip=209.85.128.42 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=ventanamicro.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=ventanamicro.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=ventanamicro.com header.i=@ventanamicro.com header.b="id1O5h57" Received: by mail-wm1-f42.google.com with SMTP id 5b1f17b1804b1-43cf861f936so1526905e9.3 for ; Thu, 20 Mar 2025 14:25:33 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ventanamicro.com; s=google; t=1742505932; x=1743110732; darn=vger.kernel.org; h=in-reply-to:references:subject:from:to:cc:message-id:date :content-transfer-encoding:mime-version:from:to:cc:subject:date :message-id:reply-to; bh=/BM8p6OTMwPELuLuoM3O1JzZA7D2mDcWqh6aQhebe2w=; b=id1O5h57dAQjiDasqV2/7bP8JCx+7wK0qTWvGUFZIikYjPdQhH440cY1WkFWuPLj3E Wp7ELiRUOwLbv5xP26jsNv+e+z5qxeEWZEMtqgt6f3YuPZQ7GnRgkJbiDOFgVLYwjdiq /IrpNJBwrDRmcHHY327m6kexMF28rtSydbs07mSXy9UtxD0wR5Vf9pRUPX2f3H1F/X17 BLbBNEnL9EBL4C4F6lnyA2w5DxOzdHlFTzNg/JFLzYwN5q59FOdRGCBMtAwJoJROJ/mb bJzdsa09nUyagj+fGusJD4w9365g5eMjbI/lVbEVJ2yfgG+zA5kvI99zIvRdbfFbUWQ5 k9Nw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1742505932; x=1743110732; h=in-reply-to:references:subject:from:to:cc:message-id:date :content-transfer-encoding:mime-version:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to; bh=/BM8p6OTMwPELuLuoM3O1JzZA7D2mDcWqh6aQhebe2w=; b=t+Vm/hqKMeJWMb8Y+j7wjjYnv7ZI3Q4CJL4LCui4ETL++N0MDFVd1ME3chjrxZblWG f6rwYtazbQEf5I9m1hSXDX9nW6G36EKRns5siGgQLT+xefYQUFX9FXz/MwJAHl2TyGnL w3r6WBM0Ai3MKhgpM9zzUjNObcTl/ZrJ2OvEqu9Q2bf+7zH4TA/WjlIyiKSa9qwBa+jZ k59eIQtJvqc5wHCvfeE5+uZA0ivPp5WS9i8INQe3aNAvqnUY4GG0Kau9/mDA8Nq331/s Bs6CVpZb7pU+FkYLns0y/WFxpouoLTyzD7t/15ZYyH0s4Rld3W5/tvSGbc5yaXo53Nku V9AQ== X-Forwarded-Encrypted: i=1; AJvYcCWmmxZbjAQJNdje8yeWp+ZesdCAYVoYTXm/dJ42Ob/jrsF4TrTdEOAikjLBR43ylufcZDzqi+Uy8CgJ@vger.kernel.org X-Gm-Message-State: AOJu0YwqeBmCfWvYvh3SOeXw0rhCw8mb5Wg/I3pwlIIwaXSOqWBkbRwR lUkaCtQxOzdOc7qMcHEnuDOlmRF+4Oig+69Bu9Sid+ODfLWnJA79ypn/6qEmrw4= X-Gm-Gg: ASbGncu49SD3Vx/TsXMj0jbRp/kaL/n01onfdtyZ+biknvYSvKjukqxyfVG31IMuO9t 7T5OcZjPPJOf/MFa5hxiCo1e4YE2z0NqKezoHvHxVNo5aJqySWR/1qYfb1x89Dja7xaKJ8P+fyS nIDuzanvQlHOPekUEfE/zhONbq4XMbjzKIHVFIeTQ86HpTbo61x7MpWleroMd0qjjUBnzVURccP 841smmjsHiAwgXH5NIdRkyd+B0IDd+zlAdnuuCwYJdHT+nUZ+aFOY2S8wzdWqj3hOdi8pESxMcD XIRKGt+mmqwBSV6DRDdfYgHvGUg869GUEnB+bJ1Bs/PaXOL5bIVPWNwRNvgQcWoIfEAZEt/C0Wl wP4j0 X-Google-Smtp-Source: AGHT+IENUyr/tuJjthynG7pDAFWYzf7OBnXUo8NpuhgchW3KTo0PDxUCxZfCqwEA5Mqzg2/ebVjxow== X-Received: by 2002:a05:600c:46c3:b0:439:8294:2115 with SMTP id 5b1f17b1804b1-43d50a53d12mr2494095e9.8.1742505931793; Thu, 20 Mar 2025 14:25:31 -0700 (PDT) Received: from localhost (ip-89-103-73-235.bb.vodafone.cz. [89.103.73.235]) by smtp.gmail.com with ESMTPSA id ffacd0b85a97d-3997f9efe55sm579763f8f.88.2025.03.20.14.25.31 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 20 Mar 2025 14:25:31 -0700 (PDT) Precedence: bulk X-Mailing-List: linux-arch@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=UTF-8 Date: Thu, 20 Mar 2025 22:25:30 +0100 Message-Id: Cc: , , , , , , , , , , , , , , , , , , , , , "Zong Li" , "linux-riscv" To: "Deepak Gupta" , "Thomas Gleixner" , "Ingo Molnar" , "Borislav Petkov" , "Dave Hansen" , , "H. Peter Anvin" , "Andrew Morton" , "Liam R. Howlett" , "Vlastimil Babka" , "Lorenzo Stoakes" , "Paul Walmsley" , "Palmer Dabbelt" , "Albert Ou" , "Conor Dooley" , "Rob Herring" , "Krzysztof Kozlowski" , "Arnd Bergmann" , "Christian Brauner" , "Peter Zijlstra" , "Oleg Nesterov" , "Eric Biederman" , "Kees Cook" , "Jonathan Corbet" , "Shuah Khan" , "Jann Horn" , "Conor Dooley" From: =?utf-8?q?Radim_Kr=C4=8Dm=C3=A1=C5=99?= Subject: Re: [PATCH v12 25/28] riscv: create a config for shadow stack and landing pad instr support References: <20250314-v5_user_cfi_series-v12-0-e51202b53138@rivosinc.com> <20250314-v5_user_cfi_series-v12-25-e51202b53138@rivosinc.com> In-Reply-To: <20250314-v5_user_cfi_series-v12-25-e51202b53138@rivosinc.com> 2025-03-14T14:39:44-07:00, Deepak Gupta : > This patch creates a config for shadow stack support and landing pad inst= r > support. Shadow stack support and landing instr support can be enabled by > selecting `CONFIG_RISCV_USER_CFI`. Selecting `CONFIG_RISCV_USER_CFI` wire= s > up path to enumerate CPU support and if cpu support exists, kernel will > support cpu assisted user mode cfi. > > If CONFIG_RISCV_USER_CFI is selected, select `ARCH_USES_HIGH_VMA_FLAGS`, > `ARCH_HAS_USER_SHADOW_STACK` and DYNAMIC_SIGFRAME for riscv. > > Reviewed-by: Zong Li > Signed-off-by: Deepak Gupta > --- > diff --git a/arch/riscv/Kconfig b/arch/riscv/Kconfig > @@ -250,6 +250,26 @@ config ARCH_HAS_BROKEN_DWARF5 > +config RISCV_USER_CFI > + def_bool y > + bool "riscv userspace control flow integrity" > + depends on 64BIT && $(cc-option,-mabi=3Dlp64 -march=3Drv64ima_zicfiss) > + depends on RISCV_ALTERNATIVE > + select ARCH_HAS_USER_SHADOW_STACK > + select ARCH_USES_HIGH_VMA_FLAGS > + select DYNAMIC_SIGFRAME > + help > + Provides CPU assisted control flow integrity to userspace tasks. > + Control flow integrity is provided by implementing shadow stack for > + backward edge and indirect branch tracking for forward edge in progra= m. > + Shadow stack protection is a hardware feature that detects function > + return address corruption. This helps mitigate ROP attacks. > + Indirect branch tracking enforces that all indirect branches must lan= d > + on a landing pad instruction else CPU will fault. This mitigates agai= nst > + JOP / COP attacks. Applications must be enabled to use it, and old us= er- > + space does not get protection "for free". > + default y A high level question to kick off my review: Why are landing pads and shadow stacks merged together? Apart from adding build flexibility, we could also split the patches into two isolated series, because the features are independent. From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id B9837C36000 for ; Thu, 20 Mar 2025 21:25:44 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender: Content-Transfer-Encoding:Content-Type:List-Subscribe:List-Help:List-Post: List-Archive:List-Unsubscribe:List-Id:In-Reply-To:References:Subject:From:To: Cc:Message-Id:Date:Mime-Version:Reply-To:Content-ID:Content-Description: Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID: List-Owner; bh=yHgsPyl/SqZ1ffBP+tlLp/3vCK5Zl4iBHjqkC2Lqtqo=; b=tS4KigHk1HzRYo 8zhqjsSy/mFRwkcrCgaMkpfp+At14MWTkBhDZAkfyKR9RqhX7itu/N7adbfBGGjxIEdmjflpLATbR vvpD0/mSQGIyjg2v2zXdBjCrfyjLRKWrB4/jK2i5JttHS0dRxF0BwHTYXeHMeGJ7wdl0ulL/LoxzF 7Nwj8/IYsHNR+rvSvMWHvYO3IZEeLgi9wx3KUqQvLl0wPNPKijdQ29Ja5YW0O5Wk9UugzhpstZZqV Fw+lgi6hm8RBVCwpHWUbcXKHiJZenLf5HkKRHcJJCZK+GMBdrln0AfgAKkO3rXgPezKfdUYYC8spY /vojp5bRciQm3cH9+CAA==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.98 #2 (Red Hat Linux)) id 1tvNOS-0000000DEwH-2FCS; Thu, 20 Mar 2025 21:25:36 +0000 Received: from mail-wm1-x332.google.com ([2a00:1450:4864:20::332]) by bombadil.infradead.org with esmtps (Exim 4.98 #2 (Red Hat Linux)) id 1tvNOQ-0000000DEvB-0ozT for linux-riscv@lists.infradead.org; Thu, 20 Mar 2025 21:25:35 +0000 Received: by mail-wm1-x332.google.com with SMTP id 5b1f17b1804b1-43ba8bbeae2so1476565e9.0 for ; Thu, 20 Mar 2025 14:25:33 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ventanamicro.com; s=google; t=1742505932; x=1743110732; darn=lists.infradead.org; h=in-reply-to:references:subject:from:to:cc:message-id:date :content-transfer-encoding:mime-version:from:to:cc:subject:date :message-id:reply-to; bh=/BM8p6OTMwPELuLuoM3O1JzZA7D2mDcWqh6aQhebe2w=; b=cE3MzaHwS7vBfE9+KSzuhDzQgRBfn7l9SIDVBApYVyBBBhHHeT7FbWEE84Yzo/byEm hKB5xnW0Q3PUgwjTaMdMDFo4LsG6H8a6eYYd/eOfUr0Ilh58tu8WH51gDyhQKnKy5KSD n6zJr5gTQ8gqQeFHJt6GiRRa46DXL+BhZ6PLsqotqsbA4KN9cy/n5hBr0MIugg/3rQ2x mSBWcDH5FUeHzYCx7uRJdXOuuSSX/myUXkGYwJZkXlnMdGVwdX8GGtvoCPKMAEgN0QOK knC9J6pQr+ojLboewC1GakkfPg/e6UYnYy+iHZ5x21ZsvBRD1UMQS94u7SsbFHjW0Z61 4kww== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1742505932; x=1743110732; h=in-reply-to:references:subject:from:to:cc:message-id:date :content-transfer-encoding:mime-version:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to; bh=/BM8p6OTMwPELuLuoM3O1JzZA7D2mDcWqh6aQhebe2w=; b=Iy4kFrnQLQOck7Mx6hCi9bi2jdB5qcwkx7tP+Q/w4FCLf1Qgtx4bneyhYHrt2HUFA3 PBPp0RdwBonlcxHfGuhoAURm1zSRWG5KSvneijIVi6CAwczgdc6G2t4V3dSbmIffGzV/ jRmgk577tFQauii4Y/yheGfdSolPznjWOtfSnHKstSUg8WJvlmG79nOu7VU8KCXEYoi8 7/Tc1rV7UTA2ljxcc5AYBjiJSA8d0VQOD2dfrn9wg04yPyoqaHaKo+FRAkfwGr9GQPgH rsVVookTBIXS9CWzYlf3gYbNXv5OeOoWkhFD+j5N12EtM1k5gTLKeuAEWDUR7zMIBvUR 4SYg== X-Forwarded-Encrypted: i=1; AJvYcCUNSnSYR5PnJE9B8p8WlnZDNV9fY2wvjn4l535xWkD+GEtKohMIvxMI3Y+YiMwAB6FHFC59HFLc9LYKrw==@lists.infradead.org X-Gm-Message-State: AOJu0YyuHhNWwK36qWXOZOM4TovotlWZ8IGzpRncM6xWlgqQ8BchqjxY 8Baj0t7rM5wSF0wvhAyK7SQbJhq8jqhANg0DAbB26GFXT+GUnKmO8DWS/29Am0M= X-Gm-Gg: ASbGnctrIQSdf8kYiKQdBjie5MTc1SkcsM0JGsXTZYBtUxqI2VioBY5YOuEohHOR7+o yhQ5IUG4T1bMYo9zNWqt9Sz76aGojlOV54zC1yzLqQSNeK/S8kSjPOBCNJCBAYTQE8YpnltWFnN TEmWCN+GJNnfKKWw1/6SpgxBO5cjEilsuKQzmZLoFcU/NzWU4gYkXsxkQiTO8JDphUkSnV80zgH bGu77hSJPVt6msaWuU9raUfuyQS7KS4RIuwKGgPo4wMBc//nUOdH+x9n4JRMIZYuz+nN6rWUQN5 jRw0puL56P7MFCtIArymYi97NYXfQUVcOHP6A0KN87k9Ou5o2qQ80Vfv0Boe11hn4fYX7qMfNWE zKYC4 X-Google-Smtp-Source: AGHT+IENUyr/tuJjthynG7pDAFWYzf7OBnXUo8NpuhgchW3KTo0PDxUCxZfCqwEA5Mqzg2/ebVjxow== X-Received: by 2002:a05:600c:46c3:b0:439:8294:2115 with SMTP id 5b1f17b1804b1-43d50a53d12mr2494095e9.8.1742505931793; Thu, 20 Mar 2025 14:25:31 -0700 (PDT) Received: from localhost (ip-89-103-73-235.bb.vodafone.cz. [89.103.73.235]) by smtp.gmail.com with ESMTPSA id ffacd0b85a97d-3997f9efe55sm579763f8f.88.2025.03.20.14.25.31 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 20 Mar 2025 14:25:31 -0700 (PDT) Mime-Version: 1.0 Date: Thu, 20 Mar 2025 22:25:30 +0100 Message-Id: Cc: , , , , , , , , , , , , , , , , , , , , , "Zong Li" , "linux-riscv" To: "Deepak Gupta" , "Thomas Gleixner" , "Ingo Molnar" , "Borislav Petkov" , "Dave Hansen" , , "H. Peter Anvin" , "Andrew Morton" , "Liam R. Howlett" , "Vlastimil Babka" , "Lorenzo Stoakes" , "Paul Walmsley" , "Palmer Dabbelt" , "Albert Ou" , "Conor Dooley" , "Rob Herring" , "Krzysztof Kozlowski" , "Arnd Bergmann" , "Christian Brauner" , "Peter Zijlstra" , "Oleg Nesterov" , "Eric Biederman" , "Kees Cook" , "Jonathan Corbet" , "Shuah Khan" , "Jann Horn" , "Conor Dooley" From: =?utf-8?q?Radim_Kr=C4=8Dm=C3=A1=C5=99?= Subject: Re: [PATCH v12 25/28] riscv: create a config for shadow stack and landing pad instr support References: <20250314-v5_user_cfi_series-v12-0-e51202b53138@rivosinc.com> <20250314-v5_user_cfi_series-v12-25-e51202b53138@rivosinc.com> In-Reply-To: <20250314-v5_user_cfi_series-v12-25-e51202b53138@rivosinc.com> X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20250320_142534_230847_C8297E00 X-CRM114-Status: GOOD ( 12.11 ) X-BeenThere: linux-riscv@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: "linux-riscv" Errors-To: linux-riscv-bounces+linux-riscv=archiver.kernel.org@lists.infradead.org 2025-03-14T14:39:44-07:00, Deepak Gupta : > This patch creates a config for shadow stack support and landing pad instr > support. Shadow stack support and landing instr support can be enabled by > selecting `CONFIG_RISCV_USER_CFI`. Selecting `CONFIG_RISCV_USER_CFI` wires > up path to enumerate CPU support and if cpu support exists, kernel will > support cpu assisted user mode cfi. > > If CONFIG_RISCV_USER_CFI is selected, select `ARCH_USES_HIGH_VMA_FLAGS`, > `ARCH_HAS_USER_SHADOW_STACK` and DYNAMIC_SIGFRAME for riscv. > > Reviewed-by: Zong Li > Signed-off-by: Deepak Gupta > --- > diff --git a/arch/riscv/Kconfig b/arch/riscv/Kconfig > @@ -250,6 +250,26 @@ config ARCH_HAS_BROKEN_DWARF5 > +config RISCV_USER_CFI > + def_bool y > + bool "riscv userspace control flow integrity" > + depends on 64BIT && $(cc-option,-mabi=lp64 -march=rv64ima_zicfiss) > + depends on RISCV_ALTERNATIVE > + select ARCH_HAS_USER_SHADOW_STACK > + select ARCH_USES_HIGH_VMA_FLAGS > + select DYNAMIC_SIGFRAME > + help > + Provides CPU assisted control flow integrity to userspace tasks. > + Control flow integrity is provided by implementing shadow stack for > + backward edge and indirect branch tracking for forward edge in program. > + Shadow stack protection is a hardware feature that detects function > + return address corruption. This helps mitigate ROP attacks. > + Indirect branch tracking enforces that all indirect branches must land > + on a landing pad instruction else CPU will fault. This mitigates against > + JOP / COP attacks. Applications must be enabled to use it, and old user- > + space does not get protection "for free". > + default y A high level question to kick off my review: Why are landing pads and shadow stacks merged together? Apart from adding build flexibility, we could also split the patches into two isolated series, because the features are independent. _______________________________________________ linux-riscv mailing list linux-riscv@lists.infradead.org http://lists.infradead.org/mailman/listinfo/linux-riscv