[RFC PATCH 11/12] riscv: Kconfig & Makefile for riscv kernel control flow integrity

Deepak Gupta
2024-04-09T06:12:20Z

Defines `CONFIG_RISCV_KERNEL_CFI` and selects SHADOW_CALL_STACK
and DYNAMIC_SCS both so that zicfiss can be wired up.

Makefile checks if CONFIG_RISCV_KERNEL_CFI is enabled, then light
up zicfiss and zicfilp compiler flags.

Signed-off-by: Deepak Gupta <debug@rivosinc.com>
---
arch/riscv/Kconfig | 36 +++++++++++++++++++++++++++++++++++-
arch/riscv/Makefile | 6 ++++++
2 files changed, 41 insertions(+), 1 deletion(-)

diff --git a/arch/riscv/Kconfig b/arch/riscv/Kconfig
index be09c8836d56..5276598bb773 100644
--- a/arch/riscv/Kconfig
+++ b/arch/riscv/Kconfig
@@ -193,7 +193,7 @@ config GCC_SUPPORTS_DYNAMIC_FTRACE
depends on $(cc-option,-fpatchable-function-entry=8)

config HAVE_SHADOW_CALL_STACK
- def_bool $(cc-option,-fsanitize=shadow-call-stack)
+ def_bool $(cc-option,-fsanitize=shadow-call-stack) || $(cc-option,-mabi=lp64 -march=rv64ima_zicfilp_zicfiss)
# https://github.com/riscv-non-isa/riscv-elf-psabi-doc/commit/a484e843e6eeb51f0cb7b8819e50da6d2444d769
depends on $(ld-option,--no-relax-gp)

@@ -211,6 +211,30 @@ config ARCH_HAS_BROKEN_DWARF5
# https://github.com/llvm/llvm-project/commit/7ffabb61a5569444b5ac9322e22e5471cc5e4a77
depends on LD_IS_LLD && LLD_VERSION < 180000

+config RISCV_KERNEL_CFI
+ def_bool n
+ bool "hw assisted riscv kernel control flow integrity (kcfi)"
+ depends on 64BIT && $(cc-option,-mabi=lp64 -march=rv64ima_zicfilp_zicfiss)
+ select ARCH_SUPPORTS_SHADOW_CALL_STACK
+ select SHADOW_CALL_STACK
+ select DYNAMIC_SCS
+ help
+ Provides CPU assisted control flow integrity to for riscv kernel.
+ Control flow integrity is provided by implementing shadow stack for
+ backward edge and indirect branch tracking for forward edge. Shadow
+ stack protection is a hardware feature that detects function return
+ address corruption. This helps mitigate ROP attacks. RISCV_KERNEL_CFI
+ selects CONFIG_SHADOW_CALL_STACK which uses software based shadow
+ stack but is unprotected against stray writes. Selecting RISCV_KERNEL_CFI
+ will select CONFIG_DYNAMIC_SCS and will enable hardware assisted shadow
+ stack protection against stray writes.
+ Indirect branch tracking enforces that all indirect branches must land
+ on a landing pad instruction else CPU will fault. This enables forward
+ control flow (call/jmp) protection in kernel and restricts all indirect
+ call or jump in kernel to a landing pad instruction which mostly likely
+ will be start of the function.
+ default n
+
config ARCH_MMAP_RND_BITS_MIN
default 18 if 64BIT
default 8
@@ -639,6 +663,16 @@ config RISCV_ISA_ZICBOZ

If you don't know what to do here, say Y.

+config TOOLCHAIN_HAS_ZICFILP
+ bool
+ default y
+ depends on 64BIT && $(cc-option,-mabi=lp64 -march=rv64ima_zicfilp)
+
+config TOOLCHAIN_HAS_ZICFISS
+ bool
+ default y
+ depends on 64BIT && $(cc-option,-mabi=lp64 -march=rv64ima_zicfiss)
+
config TOOLCHAIN_HAS_ZIHINTPAUSE
bool
default y
diff --git a/arch/riscv/Makefile b/arch/riscv/Makefile
index 5b3115a19852..ae156e37e886 100644
--- a/arch/riscv/Makefile
+++ b/arch/riscv/Makefile
@@ -58,8 +58,10 @@ else ifeq ($(CONFIG_LTO_CLANG),y)
endif

ifeq ($(CONFIG_SHADOW_CALL_STACK),y)
+ifndef CONFIG_DYNAMIC_SCS
KBUILD_LDFLAGS += --no-relax-gp
endif
+endif

# ISA string setting
riscv-march-$(CONFIG_ARCH_RV32I) := rv32ima
@@ -78,6 +80,10 @@ endif
# Check if the toolchain supports Zihintpause extension
riscv-march-$(CONFIG_TOOLCHAIN_HAS_ZIHINTPAUSE) := $(riscv-march-y)_zihintpause

+ifeq ($(CONFIG_RISCV_KERNEL_CFI),y)
+riscv-march-$(CONFIG_TOOLCHAIN_HAS_ZICFILP) := $(riscv-march-y)_zicfilp
+riscv-march-$(CONFIG_TOOLCHAIN_HAS_ZICFISS) := $(riscv-march-y)_zicfiss
+endif
# Remove F,D,V from isa string for all. Keep extensions between "fd" and "v" by
# matching non-v and non-multi-letter extensions out with the filter ([^v_]*)
KBUILD_CFLAGS += -march=$(shell echo $(riscv-march-y) | sed -E 's/(rv32ima|rv64ima)fd([^v_]*)v?/\1\2/')
--
2.43.2