From patchwork Thu Jan 25 06:21:25 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Deepak Gupta X-Patchwork-Id: 13530070 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id 7440AC47258 for ; Thu, 25 Jan 2024 06:28:05 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id D632F6B0078; Thu, 25 Jan 2024 01:28:04 -0500 (EST) Received: by kanga.kvack.org (Postfix, from userid 40) id CED226B007B; Thu, 25 Jan 2024 01:28:04 -0500 (EST) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id B66386B007D; Thu, 25 Jan 2024 01:28:04 -0500 (EST) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0010.hostedemail.com [216.40.44.10]) by kanga.kvack.org (Postfix) with ESMTP id 9F9F46B0078 for ; Thu, 25 Jan 2024 01:28:04 -0500 (EST) Received: from smtpin29.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay10.hostedemail.com (Postfix) with ESMTP id 158ABC032C for ; Thu, 25 Jan 2024 06:28:04 +0000 (UTC) X-FDA: 81716853288.29.7E1E01F Received: from mail-pj1-f47.google.com (mail-pj1-f47.google.com [209.85.216.47]) by imf07.hostedemail.com (Postfix) with ESMTP id 3F7CC4000E for ; Thu, 25 Jan 2024 06:28:02 +0000 (UTC) Authentication-Results: imf07.hostedemail.com; dkim=pass header.d=rivosinc-com.20230601.gappssmtp.com header.s=20230601 header.b=GT5hS77G; dmarc=none; spf=pass (imf07.hostedemail.com: domain of debug@rivosinc.com designates 209.85.216.47 as permitted sender) smtp.mailfrom=debug@rivosinc.com ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1706164082; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-transfer-encoding:content-transfer-encoding: in-reply-to:references:dkim-signature; bh=QXTHyjxL8kR5Po7d+GYATRHdwro/16lDMpxqrKjx/Ag=; b=J2qXSJIGGHHB6vvxXKVbteKfLH1bvCLx+TTrqTCvsPu4Vp8fr535MxsAcNTCW15Jo9JDau fN715d34CAyZZmZfpirE1y3UsPw5QpSPLnJCkj1QKGzHCIetydXS7Eap5ZD+jawcXx2iEn db3/FOKCJvDPNuFvwUm/gFHIXEyKOIY= ARC-Authentication-Results: i=1; imf07.hostedemail.com; dkim=pass header.d=rivosinc-com.20230601.gappssmtp.com header.s=20230601 header.b=GT5hS77G; dmarc=none; spf=pass (imf07.hostedemail.com: domain of debug@rivosinc.com designates 209.85.216.47 as permitted sender) smtp.mailfrom=debug@rivosinc.com ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1706164082; a=rsa-sha256; cv=none; b=cQY3ACngOURN3XHYDFaVDHhRWUb47ayLu57OgpH4nSehfPITcI0Gfk01fU9ZD1nfodNHDN seoiEK+TGzGvkqW20ec5Gy60GE40mpKalO6ciLOgEhFbMjyWRg1iuUKKqIuYt6bwA9Mkff zUQotOvxlqK3j7bDvL6yO7X9F7NUEKY= Received: by mail-pj1-f47.google.com with SMTP id 98e67ed59e1d1-2906dffd8ddso3977757a91.3 for ; Wed, 24 Jan 2024 22:28:01 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rivosinc-com.20230601.gappssmtp.com; s=20230601; t=1706164081; x=1706768881; darn=kvack.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=QXTHyjxL8kR5Po7d+GYATRHdwro/16lDMpxqrKjx/Ag=; b=GT5hS77G/fkp9JGoQacbRyaDxwNjpXMnWeOGOoF0834ZTzVj+oFMmwpztt5codXf8S LT5ZA4FdhcfnLOdLCBwN6yQmcr9ikGpsKaHT14K/CiAQfwe3IPCW4gWWTxBGK5cRT23h qpOC+7r4tX3fDS7wP1wcm8H/Vii28hHgSXxvWnVJistvv7KoN1juJvb964N0H5kRLdFs 9H+QJ6aEikEKdpuX14UNndaHUGjhvGbWVmhuVGxK80DfBHNcYLq+0i+Ii6l4aV4vz395 ZpYLcLucy7mOGmLADkNuNqin/uEk8ImQ02H8SWIaNF7flw8VIrHMzdkXn3A85beQZeoT RLYw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1706164081; x=1706768881; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=QXTHyjxL8kR5Po7d+GYATRHdwro/16lDMpxqrKjx/Ag=; b=WoBY/NMyowbo9HsqR4mMWkXyFmuzpQbvQcYJ4Cl4FVaQ24+gDcPDDWXmXML1eq+lti sSfQCGObjZs5p4VqvfuVaVujDXXFcPnmjRjhOPLMcuc3VxMmoiNu2vPoGNYAaa2cSv0Z LaPNN5/25y+Qrwdj3Wde7Dp9UbEABFSTgpOOQWGyz75ZSO/arSOUkCXjjc18B9+KlzAh luSf72Z8KKwfP/pKeYzECWyP/XOlZaKUc0mvhKEDSFm5ewpXVjylbiP3Rs80pgOsvA3w 8FIMIu/qKRLa2s6Y40d0ZJLdgtJ7BVxUItnGTv4OuGhfn5PDuhkJJVP7A5nl5JWaeZlZ KkgA== X-Gm-Message-State: AOJu0Yw+xxu5zapQD3pcqoJOIIQ3x1QEYIOhixz1IniXARxlxev2erD2 drjOgzqQGfxsxjDM8iZe0frvVPV66MpxPcPSuM175V7ux1rK5MdZsKPh3JJPmY0= X-Google-Smtp-Source: AGHT+IHI/WMAhl2PB+/aXrDdR8LPiiPrRqLK2yfdwW0qIQIbS5kaetCk3DdXJz5Rd4D4N6P34jxx3A== X-Received: by 2002:a05:6a20:938f:b0:19b:211a:e62d with SMTP id x15-20020a056a20938f00b0019b211ae62dmr712796pzh.25.1706164080770; Wed, 24 Jan 2024 22:28:00 -0800 (PST) Received: from debug.ba.rivosinc.com ([64.71.180.162]) by smtp.gmail.com with ESMTPSA id t19-20020a056a00139300b006dd870b51b8sm3201139pfg.126.2024.01.24.22.27.57 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 24 Jan 2024 22:28:00 -0800 (PST) From: debug@rivosinc.com To: rick.p.edgecombe@intel.com, broonie@kernel.org, Szabolcs.Nagy@arm.com, kito.cheng@sifive.com, keescook@chromium.org, ajones@ventanamicro.com, paul.walmsley@sifive.com, palmer@dabbelt.com, conor.dooley@microchip.com, cleger@rivosinc.com, atishp@atishpatra.org, alex@ghiti.fr, bjorn@rivosinc.com, alexghiti@rivosinc.com Cc: corbet@lwn.net, aou@eecs.berkeley.edu, oleg@redhat.com, akpm@linux-foundation.org, arnd@arndb.de, ebiederm@xmission.com, shuah@kernel.org, brauner@kernel.org, debug@rivosinc.com, guoren@kernel.org, samitolvanen@google.com, evan@rivosinc.com, xiao.w.wang@intel.com, apatel@ventanamicro.com, mchitale@ventanamicro.com, waylingii@gmail.com, greentime.hu@sifive.com, heiko@sntech.de, jszhang@kernel.org, shikemeng@huaweicloud.com, david@redhat.com, charlie@rivosinc.com, panqinglin2020@iscas.ac.cn, willy@infradead.org, vincent.chen@sifive.com, andy.chiu@sifive.com, gerg@kernel.org, jeeheng.sia@starfivetech.com, mason.huo@starfivetech.com, ancientmodern4@gmail.com, mathis.salmen@matsal.de, cuiyunhui@bytedance.com, bhe@redhat.com, chenjiahao16@huawei.com, ruscur@russell.cc, bgray@linux.ibm.com, alx@kernel.org, baruch@tkos.co.il, zhangqing@loongson.cn, catalin.marinas@arm.com, revest@chromium.org, josh@joshtriplett.org, joey.gouly@arm.com, shr@devkernel.io, omosnace@redhat.com, ojeda@kernel.org, jhubbard@nvidia.com, linux-doc@vger.kernel.org, linux-riscv@lists.infradead.org, linux-kernel@vger.kernel.org, linux-mm@kvack.org, linux-arch@vger.kernel.org, linux-kselftest@vger.kernel.org Subject: [RFC PATCH v1 00/28] riscv control-flow integrity for usermode Date: Wed, 24 Jan 2024 22:21:25 -0800 Message-ID: <20240125062739.1339782-1-debug@rivosinc.com> X-Mailer: git-send-email 2.43.0 MIME-Version: 1.0 X-Rspamd-Queue-Id: 3F7CC4000E X-Rspam-User: X-Rspamd-Server: rspam04 X-Stat-Signature: be8qusu5zcpp6zwh8ye68k5ybk88jj4t X-HE-Tag: 1706164082-450097 X-HE-Meta: U2FsdGVkX19BpzFH7qttaCi2ps8qCXoyu9+gRLiiHy1pdv97aqqgIfGxznCH5dO04jA3XyB3UoFVfxU+ocO6TLUitWzaZNLqhcgedRohVqFh3U6VhvgzKlW4o1Sr2Tk9TFFOgomqyEPlWvdUwn9wgcdkRkL2CyaSWvoetuthryS1LqhuD/epjjG/RSJypVDedNRE5zDQO2iWoCyY/Pwl/aefptT/8JfaAvZS7zPmF5XKTfegIGjPs4VwYAJ+DW3QME1K08XCXmsZ4z9F5mSwllQ6LnxF4DyM/oe6LwWkK8t6FXb5QrpBN7T4MBhp95LV2a5XRgZAVML6kt4dVWTMIDpSHUebqDcL7bykfqbaZkfaL/1pdoqfQpgTIf6VWHR+5ng9ydh8pBFdSvCTUClcVif3HVad2nsAkoqV6q3VZH9AriSiA2u8FoIJYaB5H3AMskVWnbUA8vHUYraUTFeHh3m/U0qwYdjmfxKcd+4mIAcSFyC5te4+7EfHSQPBjyDwBduJaF7BwTnHOayQufdrlT8KPGmtQoiDk9Mk3omwbGxsiTkrUAA11gbgQL8eaF6MCWoBZ/4EVLNS8Xn1tUE1rwhCiE6SYWlFBnv6Is49I+cN6la5o0uXLT0P+jYf4s+AOk6xDIEsd0XhNsV6OhBEVRDIk+DKZWW+7j1PxduehqQjZrg4BqNzMrn6nnIfnb2AtjjRTA60v+HxFvVNl6sVQc0S1jRm4kyZXo3Iw9haZHsrgOXFoa1Uxbx6HIVrMrPzJBb5ygkzq3rEIjDoVkFjFt0m0SBryS//Ika3mvzRVLbLp6+cG/9ZABDrEklQMBubu8vpMBYTwrFBokPgYTUjhwlbrqloWG7jB/WiEpAKvLj3XqktCBffG3ocXccq7E3w8P99CfqaboKF4VZyAfLpEy14CM+vV0PRo/FBLHK4nvH0wcGQOAFYs3XKcPXQzD4MFloi7QMdf7AcOHbW7PB gLz+oME9 z4ORjf9XQx2EwxabbqPlVE9mrVpGoyxZeAWoit86qUZmTgWin+aBWk9dB4CLsiyTSTxlKiTbn6VLoRkudJZ9LHTeWevvFOOxg1CYwRyTY40AFNpvxn26WTq3EQc4Re4zc334Q5kDbBwk8/xsaaMRJcSqMVfmfqPOiS7o8ZtrBv4xHYL7oDYgQ5HHLDbhbXyOAtkCT6T4k1PQHI/xTdrl/Pw7PGNHsxGNMdmxGUneYpdHU1NY0ssuqra+61VBqAMXMBD2eJvnGuyQwu3Qr+3E8ta1BIUFh4Ma8b/OVATe2pb4Un6bg6iBUznxyjJtpk/sUIbOGWmfvvX5tYXgGQcM6Z74E8Ekh0vhw6r/xsfFbLylBjr0dz8KymkEaAXgFkjvCw4LOZgxVyry9uCUkSeNUjowv2eGsL72mHKFAl2kXGb2HuetWMDDgxPbNNisheHOOFWaBFQXT4RfXfDexUO1n5kIJvp69T2iSbYZfGfCj1VdVyjrF+wkJ2RUA8940OqaVsidivocpTIA5B0cBrkrEtdJTciow10XwWXGN2k0XEZ5QVUy3+/zkM7ALma23YkwiP2abo6iUiR96Xk0EewLfkTm4f6MgI9RSEUr0e+F5inoKdK80shVatRIiShwUlew3PxxO X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: List-Subscribe: List-Unsubscribe: From: Deepak Gupta It's been almost an year since I posted my last patch series [1] to enable CPU assisted control-flow integrity for usermode on riscv. A lot has changed since then and so has the patches. It's been a while and since this is a reboot of series, starting with RFC and v1. Securing control-flow integrity for usermode requires following - Securing forward control flow : All callsites must reach reach a target that they actually intend to reach. - Securing backward control flow : All function returns must return to location where they were called from. This patch series use riscv cpu extension `zicfilp` [2] to secure forward control flow and `zicfiss` [2] to secure backward control flow. `zicfilp` enforces that all indirect calls or jmps must land on a landing pad instr and label embedded in landing pad instr must match a value programmed in `x7` register (at callsite via compiler). `zicfiss` introduces shadow stack which can only be writeable via shadow stack instructions (sspush and ssamoswap) and thus can't be tampered with via inadvertent stores. More details about extension can be read from [2] and there are details in documentation as well (in this patch series). Using config `CONFIG_RISCV_USER_CFI`, kernel support for riscv control flow integrity for user mode programs can be compiled in the kernel. Enabling of control flow integrity for user programs is left to user runtime (specifically expected from dynamic loader). There has been a lot of earlier discussion on the enabling topic around x86 shadow stack enabling [3, 4, 5] and overall consensus had been to let dynamic loader (or usermode) to decide for enabling the feature. This patch series introduces arch agnostic `prctls` to enable shadow stack and indirect branch tracking. And implements them on riscv. arm64 is expected to implement shadow stack part of these arch agnostic `prctls` [6] Changes since last time *********************** Spec changes ------------ - Forward cfi spec has become much simpler. `lpad` instruction is pseudo for `auipc rd, <20bit_imm>`. `lpad` checks x7 against 20bit embedded in instr. Thus label width is 20bit. - Shadow stack management instructions are reduced to sspush - to push x1/x5 on shadow stack sspopchk - pops from shadow stack and comapres with x1/x5. ssamoswap - atomically swap value on shadow stack. rdssp - reads current shadow stack pointer - Shadow stack accesses on readonly memory always raise AMO/store page fault. `sspopchk` is load but if underlying page is readonly, it'll raise a store page fault. It simplifies hardware and kernel for COW handling for shadow stack pages. - riscv defines a new exception type `software check exception` and control flow violations raise software check exception. - enabling controls for shadow stack and landing are in xenvcfg CSR and controls lower privilege mode enabling. As an example senvcfg controls enabling for U and menvcfg controls enabling for S mode. core mm shadow stack enabling ----------------------------- Shadow stack for x86 usermode are now in mainline and thus this patch series builds on top of that for arch-agnostic mm related changes. Big thanks and shout out to Rick Edgecombe for that. selftests --------- Created some minimal selftests to test the patch series. [1] - https://lore.kernel.org/lkml/20230213045351.3945824-1-debug@rivosinc.com/ [2] - https://github.com/riscv/riscv-cfi [3] - https://lore.kernel.org/lkml/ZWHcBq0bJ+15eeKs@finisterre.sirena.org.uk/T/#mb121cd8b33d564e64234595a0ec52211479cf474 [4] - https://lore.kernel.org/all/20220130211838.8382-1-rick.p.edgecombe@intel.com/ [5] - https://lore.kernel.org/lkml/CAHk-=wgP5mk3poVeejw16Asbid0ghDt4okHnWaWKLBkRhQntRA@mail.gmail.com/ [6] - https://lore.kernel.org/linux-mm/20231122-arm64-gcs-v7-2-201c483bd775@kernel.org/ Deepak Gupta (27): riscv: abstract envcfg CSR riscv: envcfg save and restore on trap entry/exit riscv: define default value for envcfg riscv/Kconfig: enable HAVE_EXIT_THREAD for riscv riscv: zicfiss/zicfilp enumeration riscv: zicfiss/zicfilp extension csr and bit definitions riscv: kernel handling on trap entry/exit for user cfi mm: Define VM_SHADOW_STACK for RISC-V mm: abstract shadow stack vma behind `arch_is_shadow_stack` riscv/mm : Introducing new protection flag "PROT_SHADOWSTACK" riscv: Implementing "PROT_SHADOWSTACK" on riscv riscv mm: manufacture shadow stack pte riscv mmu: teach pte_mkwrite to manufacture shadow stack PTEs riscv mmu: write protect and shadow stack riscv/mm: Implement map_shadow_stack() syscall riscv/shstk: If needed allocate a new shadow stack on clone prctl: arch-agnostic prtcl for indirect branch tracking riscv: Implements arch agnostic shadow stack prctls riscv: Implements arch argnostic indirect branch tracking prctls riscv/traps: Introduce software check exception riscv sigcontext: adding cfi state field in sigcontext riscv signal: Save and restore of shadow stack for signal riscv: select config for shadow stack and landing pad instr support riscv/ptrace: riscv cfi status and state via ptrace and in core files riscv: Documentation for landing pad / indirect branch tracking riscv: Documentation for shadow stack on riscv kselftest/riscv: kselftest for user mode cfi Mark Brown (1): prctl: arch-agnostic prctl for shadow stack Documentation/arch/riscv/zicfilp.rst | 104 ++++ Documentation/arch/riscv/zicfiss.rst | 169 ++++++ arch/riscv/Kconfig | 16 + arch/riscv/include/asm/asm-prototypes.h | 1 + arch/riscv/include/asm/cpufeature.h | 18 + arch/riscv/include/asm/csr.h | 20 + arch/riscv/include/asm/hwcap.h | 2 + arch/riscv/include/asm/mman.h | 42 ++ arch/riscv/include/asm/pgtable.h | 32 +- arch/riscv/include/asm/processor.h | 2 + arch/riscv/include/asm/thread_info.h | 4 + arch/riscv/include/asm/usercfi.h | 106 ++++ arch/riscv/include/uapi/asm/ptrace.h | 18 + arch/riscv/include/uapi/asm/sigcontext.h | 5 + arch/riscv/kernel/Makefile | 2 + arch/riscv/kernel/asm-offsets.c | 6 +- arch/riscv/kernel/cpufeature.c | 4 +- arch/riscv/kernel/entry.S | 32 ++ arch/riscv/kernel/process.c | 16 + arch/riscv/kernel/ptrace.c | 83 +++ arch/riscv/kernel/signal.c | 45 ++ arch/riscv/kernel/sys_riscv.c | 19 + arch/riscv/kernel/traps.c | 38 ++ arch/riscv/kernel/usercfi.c | 497 ++++++++++++++++++ arch/riscv/mm/init.c | 2 +- arch/riscv/mm/pgtable.c | 21 + include/linux/mm.h | 35 +- include/uapi/asm-generic/mman.h | 1 + include/uapi/linux/elf.h | 1 + include/uapi/linux/prctl.h | 49 ++ kernel/sys.c | 60 +++ mm/gup.c | 5 +- mm/internal.h | 2 +- mm/mmap.c | 1 + tools/testing/selftests/riscv/Makefile | 2 +- tools/testing/selftests/riscv/cfi/Makefile | 10 + .../testing/selftests/riscv/cfi/cfi_rv_test.h | 85 +++ .../selftests/riscv/cfi/riscv_cfi_test.c | 91 ++++ .../testing/selftests/riscv/cfi/shadowstack.c | 376 +++++++++++++ .../testing/selftests/riscv/cfi/shadowstack.h | 39 ++ 40 files changed, 2050 insertions(+), 11 deletions(-) create mode 100644 Documentation/arch/riscv/zicfilp.rst create mode 100644 Documentation/arch/riscv/zicfiss.rst create mode 100644 arch/riscv/include/asm/mman.h create mode 100644 arch/riscv/include/asm/usercfi.h create mode 100644 arch/riscv/kernel/usercfi.c create mode 100644 tools/testing/selftests/riscv/cfi/Makefile create mode 100644 tools/testing/selftests/riscv/cfi/cfi_rv_test.h create mode 100644 tools/testing/selftests/riscv/cfi/riscv_cfi_test.c create mode 100644 tools/testing/selftests/riscv/cfi/shadowstack.c create mode 100644 tools/testing/selftests/riscv/cfi/shadowstack.h