From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id 6C879C369A1 for ; Wed, 9 Apr 2025 14:19:36 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 4328D280084; Wed, 9 Apr 2025 10:19:35 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id 3E1E1280081; Wed, 9 Apr 2025 10:19:35 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 28216280084; Wed, 9 Apr 2025 10:19:35 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0017.hostedemail.com [216.40.44.17]) by kanga.kvack.org (Postfix) with ESMTP id 0DC77280081 for ; Wed, 9 Apr 2025 10:19:35 -0400 (EDT) Received: from smtpin15.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay07.hostedemail.com (Postfix) with ESMTP id 6E817160D1A for ; Wed, 9 Apr 2025 14:19:35 +0000 (UTC) X-FDA: 83314713510.15.B6E2A05 Received: from mail-pg1-f176.google.com (mail-pg1-f176.google.com [209.85.215.176]) by imf18.hostedemail.com (Postfix) with ESMTP id 8FC0B1C0009 for ; Wed, 9 Apr 2025 14:19:33 +0000 (UTC) Authentication-Results: imf18.hostedemail.com; dkim=pass header.d=rivosinc-com.20230601.gappssmtp.com header.s=20230601 header.b=eIHGkXyA; spf=pass (imf18.hostedemail.com: domain of debug@rivosinc.com designates 209.85.215.176 as permitted sender) smtp.mailfrom=debug@rivosinc.com; dmarc=none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1744208373; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=oOgTt3TJCCtZC0mLU59SS0hlKxJUYGJ18JNxrJvKvcQ=; b=oZW/fIc7+O3wrwERIfmLsOXKIykZ1Km4uNxnhVLQD7E2Bi7bB2w0X3Gd8+yVvv2TVkEyQg BGfBlH//azPb0eSRQKYTvqkYS3cNUyX41GdySXjgXjKseD1TI1lKkyAGYqpT4rDhiKK4oC YTZOiES/dkKxC2S4JU6aKQXZrtcBW9E= ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1744208373; a=rsa-sha256; cv=none; b=tW83SbhZ4k/SBNJz1+NGp5Y9pxZqxHlfBsDbQ40RAu4MxS/EAIViu7GKSuu0ZDtKfTAvb5 dg22/DOV5N/ZW5v0n32uqWS4gBgdhmxfcIMpxuQfM1tJ0BzlVtC5FjcG6gPk2bUnjmz/qf BrYasrLx/KsWTLVs+URIUXhgo67UPSw= ARC-Authentication-Results: i=1; imf18.hostedemail.com; dkim=pass header.d=rivosinc-com.20230601.gappssmtp.com header.s=20230601 header.b=eIHGkXyA; spf=pass (imf18.hostedemail.com: domain of debug@rivosinc.com designates 209.85.215.176 as permitted sender) smtp.mailfrom=debug@rivosinc.com; dmarc=none Received: by mail-pg1-f176.google.com with SMTP id 41be03b00d2f7-af590aea813so858799a12.0 for ; Wed, 09 Apr 2025 07:19:33 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rivosinc-com.20230601.gappssmtp.com; s=20230601; t=1744208372; x=1744813172; darn=kvack.org; h=in-reply-to:content-transfer-encoding:content-disposition :mime-version:references:message-id:subject:cc:to:from:date:from:to :cc:subject:date:message-id:reply-to; bh=oOgTt3TJCCtZC0mLU59SS0hlKxJUYGJ18JNxrJvKvcQ=; b=eIHGkXyAWMGzSmnzhcvmzZvRzdhCjSDPrDPN0iaekPleb7daqqmFGZ67dslqkDjfh4 dRR7tmNqdXWA8CsANhJalF4AU2DL0ue4264+fRNf5shOvEWAg0RkkkaMT7n4dVEOMKNg 8Sa5WUWnahbWm6lH+tqfBJRQJAVWz4HDWmFKxx13HPLUPDcFiUzAbO9Q/tI0T4LO0rAx Wb4wLs7O1V5YKlIcb4XkmDHAhHQ/QcIN0f6Buent0K3ifqGzlyXRT8TxNjAtcRlJYccZ lAOvuGsKy7uIRSUCMS9W+s9wkW6uSCM9cdWhWnf3v6KRYiSavdKCc2YUHkbYkfjZghnC ZkBQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1744208372; x=1744813172; h=in-reply-to:content-transfer-encoding:content-disposition :mime-version:references:message-id:subject:cc:to:from:date :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=oOgTt3TJCCtZC0mLU59SS0hlKxJUYGJ18JNxrJvKvcQ=; b=UIVE9NC6g5QBMOF3zr5/HUYmztogFWlrNlfFr9C1q4piFjyUY6m4wrHYgvsi3e8Q5H vE79GFeOtqPEnDjCnNJdH5SvHAGagTXG1Qs6mmUK9nCAfv0i1Vt8Ycp9AbKtwrjlc5R1 NUKyIDGTUGZlnNxAHgj+YA+8KpxbqGnpF1bCr7EssL+td2sZ7WDoX2CJj1+pDQ7aJqhI tkushIDXC7hmrGE1VjhsGzZdoJkF1fAXfXArkiw1zgFK30i0em/x0rqHUI4wadOmHCS1 HICaKL/YckvoljhKu3KjijAsr8Ed5OYNeIsuxHaskd8g0zL4+HgGgQgsWvrTATmrslFz ETig== X-Forwarded-Encrypted: i=1; AJvYcCW9G9CTlTZ3/LfKMAS3mqPZnGUVxqMlczs26Uab3usk+HPR40X/cdMYO6JcSDwhuqv9FADNU323fg==@kvack.org X-Gm-Message-State: AOJu0YwvvaBTDnYIxA0aH1lWMG4LwLrULyX9OX/0o5h2oXoATnVH5Dl5 RP5c/KAA8dg7qjstPEBucxbQ2xETw0/O9TPsg066v3Xi4D27TpodeKrK/OEnZPo= X-Gm-Gg: ASbGncsNDTGB9woWUleBkdFhOSUFAMJibyQfGFsLemBFjroXKepntutC9FSLeyt2I/3 zHNjQsbyv3hw7Cpoo3LuQxL1I8JgQrcFUkcDCuwgLSVnbLTXdke4GuU0kQDq7FQljXdoNBj3psg qT7u8No/JPMikzI0DqUSeSWCQSCVfcZOZGvu+ixbiCj4NRNQEkAijJJqNx+U+8MVucOqp/l/SpF 2z59hyJ38hUQCSNgAscVNT9NFLNVQxiB+iDljF1X9XznznqHYlEnVR0rSEXCdAKcTsOvQ4MsTy5 ag+3jcVzVtBKO7rGua13ct9m13/JW9/AUav6MQQz6ZDMWhx6EY0= X-Google-Smtp-Source: AGHT+IEahP8JSiSgxvTh2n1gKbLAyTu8vcSecPJE9+mInATF99BTGal5h90YFsqI5Wz0yhAcDuqM7w== X-Received: by 2002:a17:902:cec5:b0:215:a2f4:d4ab with SMTP id d9443c01a7336-22ac324879cmr39874945ad.7.1744208372199; Wed, 09 Apr 2025 07:19:32 -0700 (PDT) Received: from debug.ba.rivosinc.com ([64.71.180.162]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-22ac7c97a1bsm12321045ad.148.2025.04.09.07.19.29 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 09 Apr 2025 07:19:31 -0700 (PDT) Date: Wed, 9 Apr 2025 07:19:28 -0700 From: Deepak Gupta To: Zong Li Cc: Thomas Gleixner , Ingo Molnar , Borislav Petkov , Dave Hansen , x86@kernel.org, "H. Peter Anvin" , Andrew Morton , "Liam R. Howlett" , Vlastimil Babka , Lorenzo Stoakes , Paul Walmsley , Palmer Dabbelt , Albert Ou , Conor Dooley , Rob Herring , Krzysztof Kozlowski , Arnd Bergmann , Christian Brauner , Peter Zijlstra , Oleg Nesterov , Eric Biederman , Kees Cook , Jonathan Corbet , Shuah Khan , Jann Horn , Conor Dooley , linux-kernel@vger.kernel.org, linux-fsdevel@vger.kernel.org, linux-mm@kvack.org, linux-riscv@lists.infradead.org, devicetree@vger.kernel.org, linux-arch@vger.kernel.org, linux-doc@vger.kernel.org, linux-kselftest@vger.kernel.org, alistair.francis@wdc.com, richard.henderson@linaro.org, jim.shu@sifive.com, andybnac@gmail.com, kito.cheng@sifive.com, charlie@rivosinc.com, atishp@rivosinc.com, evan@rivosinc.com, cleger@rivosinc.com, alexghiti@rivosinc.com, samitolvanen@google.com, broonie@kernel.org, rick.p.edgecombe@intel.com Subject: Re: [PATCH v12 10/28] riscv/mm: Implement map_shadow_stack() syscall Message-ID: References: <20250314-v5_user_cfi_series-v12-0-e51202b53138@rivosinc.com> <20250314-v5_user_cfi_series-v12-10-e51202b53138@rivosinc.com> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8; format=flowed Content-Disposition: inline Content-Transfer-Encoding: 8bit In-Reply-To: X-Stat-Signature: gd17smckxkupdmw3n7ha91xnmnkkdx8c X-Rspam-User: X-Rspamd-Queue-Id: 8FC0B1C0009 X-Rspamd-Server: rspam08 X-HE-Tag: 1744208373-704703 X-HE-Meta: U2FsdGVkX18e0fu3HoTQwD736yDR4Db4CCreEbFGAJ2WKql/FoPh/u5gJhmoNca8+WYHmaHeQJLICxRCJ0OrPZxVw22mJxxK8qBEYNaAPWCYvS/tBS/Z3624Ix6lSvXO2nskOGAhZxtcVZQB9XeoLjPalwwNyRUgRLZ9QrkY1ZNqXs749skpfot9enW892ERm/s/SGWOiC/BPDErMLKFin5BSvYgZrzhbbwui2/fpsgZMlYqOY3LZr5U84aWNyCzhf0yAleO+JesQTXdiC5QTVsZDV7fax6iuQU12G/oXY3tkRrJgmu3FAR76FBLduVQ9/DZqYDoHDBuAFaUrrhgxL2Dd3SQFB2yMCILIigmvf+MKufvdaSN7tXPuVf8PclGGKaYRjDV0BhyvKovr5swQBKZ8GcHEAgwd+qzigayOLWAr2YUsjCWFZ/u9NFc2/Y8gFSEISpX7MJtJpv6nrC5PJgtabdqnwtMYYYpAy6SawsOAJHGDgf3YOyuXnPhnfF+/wgZz3TnH5rMJWeHlHwQCSmrmy+/V1I+f++vSXFsVdgCa/HZGcFZsIYXQlfDgRxREDhpidOey/KgvLKiYQbhrLvGxXPOJ9UmetADHJzafLZcxjC0wtVwVibDu0p3hPsmHsO+8oFZkZvW2XvO6CJzHwq4HQuc98JHcCDSJTjmKdiX82gU5qlFRGgteO4vsN98tEYZJjbBfnb2Kliee5Sm37yvv3QPNxt0xKPoO5d5yt5yGLqPvt/dQ9yQt3rhLbQCoOwe1WSnFYpi7ncY4J6aIvDb/CX3sY2UA2395gECL4AH3z+pjVljpIbKd//PLqhoDpBHPftlpCxYhI5K3QpugWF69+NCuWR0EuIoTK0ZqIhF+X/JVNnHtTsoHud221FBEzg88IPG/K9iHzGLiRfn7MgVgUoQNFoeIawJk35YiYOMkOBu+mHfxMerJaFk5ROPpem2zIgisj450x/8UJ3 HmNxV3/S 2yT0G6BknIkNNEbaFaUidg7W1iyxpZE/gd/HshDU63lz+JB3lxzALtNjKIlEKOBRcrqEoyvGjGU29J3E3Z6UwYFIQStI8ayyMSG8SxNlzebfofhARocAwmqs1O4n/clVHCHmYb7rDywy6MNX2ZbLZM+WRTPboYrXZvWE7Lu2vxfy5QuP6b2vgEdcdVE8Dh3puZHue X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: List-Subscribe: List-Unsubscribe: On Mon, Apr 07, 2025 at 12:50:35PM +0800, Zong Li wrote: >On Sat, Mar 15, 2025 at 5:39 AM Deepak Gupta wrote: >> >> As discussed extensively in the changelog for the addition of this >> syscall on x86 ("x86/shstk: Introduce map_shadow_stack syscall") the >> existing mmap() and madvise() syscalls do not map entirely well onto the >> security requirements for shadow stack memory since they lead to windows >> where memory is allocated but not yet protected or stacks which are not >> properly and safely initialised. Instead a new syscall map_shadow_stack() >> has been defined which allocates and initialises a shadow stack page. >> >> This patch implements this syscall for riscv. riscv doesn't require token >> to be setup by kernel because user mode can do that by itself. However to >> provide compatibility and portability with other architectues, user mode >> can specify token set flag. >> >> Reviewed-by: Zong Li >> Signed-off-by: Deepak Gupta >> --- >> arch/riscv/kernel/Makefile | 1 + >> arch/riscv/kernel/usercfi.c | 144 ++++++++++++++++++++++++++++++++++++++++++++ >> 2 files changed, 145 insertions(+) >> >> diff --git a/arch/riscv/kernel/Makefile b/arch/riscv/kernel/Makefile >> index 8d186bfced45..3a861d320654 100644 >> --- a/arch/riscv/kernel/Makefile >> +++ b/arch/riscv/kernel/Makefile >> @@ -125,3 +125,4 @@ obj-$(CONFIG_ACPI) += acpi.o >> obj-$(CONFIG_ACPI_NUMA) += acpi_numa.o >> >> obj-$(CONFIG_GENERIC_CPU_VULNERABILITIES) += bugs.o >> +obj-$(CONFIG_RISCV_USER_CFI) += usercfi.o >> diff --git a/arch/riscv/kernel/usercfi.c b/arch/riscv/kernel/usercfi.c >> new file mode 100644 >> index 000000000000..24022809a7b5 >> --- /dev/null >> +++ b/arch/riscv/kernel/usercfi.c >> @@ -0,0 +1,144 @@ >> +// SPDX-License-Identifier: GPL-2.0 >> +/* >> + * Copyright (C) 2024 Rivos, Inc. >> + * Deepak Gupta >> + */ >> + >> +#include >> +#include >> +#include >> +#include >> +#include >> +#include >> +#include >> +#include >> +#include >> +#include >> +#include >> +#include >> + >> +#define SHSTK_ENTRY_SIZE sizeof(void *) >> + >> +/* >> + * Writes on shadow stack can either be `sspush` or `ssamoswap`. `sspush` can happen >> + * implicitly on current shadow stack pointed to by CSR_SSP. `ssamoswap` takes pointer to >> + * shadow stack. To keep it simple, we plan to use `ssamoswap` to perform writes on shadow >> + * stack. >> + */ >> +static noinline unsigned long amo_user_shstk(unsigned long *addr, unsigned long val) >> +{ >> + /* >> + * Never expect -1 on shadow stack. Expect return addresses and zero >> + */ >> + unsigned long swap = -1; >> + >> + __enable_user_access(); >> + asm goto( >> + ".option push\n" >> + ".option arch, +zicfiss\n" >> + "1: ssamoswap.d %[swap], %[val], %[addr]\n" > >Hi Deepak, >It just came to my mind, do we need to ensure that menvcfg.SSE is not >zero before executing the ssamoswap instruction? Since ssamoswap is >not encoded using MOP, I’m wondering if we should make sure that >executing ssamoswap won’t accidentally trigger an illegal instruction >exception. Thanks. FWFT patches turn SSE during early boot. There is a bug there though, I need to check if those FWFT SBI call succeeded or not. If it failed then itshould set a global variable indicating shadow stack can't be turned on. And in that case this flow wouldn't be reachable. Soon I will post v13 with these changes. Thanks for noticing. > >> + _ASM_EXTABLE(1b, %l[fault]) >> + RISCV_ACQUIRE_BARRIER >> + ".option pop\n" >> + : [swap] "=r" (swap), [addr] "+A" (*addr) >> + : [val] "r" (val) >> + : "memory" >> + : fault >> + ); >> + __disable_user_access(); >> + return swap; >> +fault: >> + __disable_user_access(); >> + return -1; >> +} >> + >> +/* >> + * Create a restore token on the shadow stack. A token is always XLEN wide >> + * and aligned to XLEN. >> + */ >> +static int create_rstor_token(unsigned long ssp, unsigned long *token_addr) >> +{ >> + unsigned long addr; >> + >> + /* Token must be aligned */ >> + if (!IS_ALIGNED(ssp, SHSTK_ENTRY_SIZE)) >> + return -EINVAL; >> + >> + /* On RISC-V we're constructing token to be function of address itself */ >> + addr = ssp - SHSTK_ENTRY_SIZE; >> + >> + if (amo_user_shstk((unsigned long __user *)addr, (unsigned long)ssp) == -1) >> + return -EFAULT; >> + >> + if (token_addr) >> + *token_addr = addr; >> + >> + return 0; >> +} >> + >> +static unsigned long allocate_shadow_stack(unsigned long addr, unsigned long size, >> + unsigned long token_offset, bool set_tok) >> +{ >> + int flags = MAP_ANONYMOUS | MAP_PRIVATE; >> + struct mm_struct *mm = current->mm; >> + unsigned long populate, tok_loc = 0; >> + >> + if (addr) >> + flags |= MAP_FIXED_NOREPLACE; >> + >> + mmap_write_lock(mm); >> + addr = do_mmap(NULL, addr, size, PROT_READ, flags, >> + VM_SHADOW_STACK | VM_WRITE, 0, &populate, NULL); >> + mmap_write_unlock(mm); >> + >> + if (!set_tok || IS_ERR_VALUE(addr)) >> + goto out; >> + >> + if (create_rstor_token(addr + token_offset, &tok_loc)) { >> + vm_munmap(addr, size); >> + return -EINVAL; >> + } >> + >> + addr = tok_loc; >> + >> +out: >> + return addr; >> +} >> + >> +SYSCALL_DEFINE3(map_shadow_stack, unsigned long, addr, unsigned long, size, unsigned int, flags) >> +{ >> + bool set_tok = flags & SHADOW_STACK_SET_TOKEN; >> + unsigned long aligned_size = 0; >> + >> + if (!cpu_supports_shadow_stack()) >> + return -EOPNOTSUPP; >> + >> + /* Anything other than set token should result in invalid param */ >> + if (flags & ~SHADOW_STACK_SET_TOKEN) >> + return -EINVAL; >> + >> + /* >> + * Unlike other architectures, on RISC-V, SSP pointer is held in CSR_SSP and is available >> + * CSR in all modes. CSR accesses are performed using 12bit index programmed in instruction >> + * itself. This provides static property on register programming and writes to CSR can't >> + * be unintentional from programmer's perspective. As long as programmer has guarded areas >> + * which perform writes to CSR_SSP properly, shadow stack pivoting is not possible. Since >> + * CSR_SSP is writeable by user mode, it itself can setup a shadow stack token subsequent >> + * to allocation. Although in order to provide portablity with other architecture (because >> + * `map_shadow_stack` is arch agnostic syscall), RISC-V will follow expectation of a token >> + * flag in flags and if provided in flags, setup a token at the base. >> + */ >> + >> + /* If there isn't space for a token */ >> + if (set_tok && size < SHSTK_ENTRY_SIZE) >> + return -ENOSPC; >> + >> + if (addr && (addr & (PAGE_SIZE - 1))) >> + return -EINVAL; >> + >> + aligned_size = PAGE_ALIGN(size); >> + if (aligned_size < size) >> + return -EOVERFLOW; >> + >> + return allocate_shadow_stack(addr, aligned_size, size, set_tok); >> +} >> >> -- >> 2.34.1 >>