From patchwork Fri Mar 29 04:44:32 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Deepak Gupta X-Patchwork-Id: 13610044 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id E7A0CCD1283 for ; Fri, 29 Mar 2024 04:45:11 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 6429F6B007B; Fri, 29 Mar 2024 00:45:11 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id 5F1FA6B0087; Fri, 29 Mar 2024 00:45:11 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 4920E6B0088; Fri, 29 Mar 2024 00:45:11 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0010.hostedemail.com [216.40.44.10]) by kanga.kvack.org (Postfix) with ESMTP id 2EC196B007B for ; Fri, 29 Mar 2024 00:45:11 -0400 (EDT) Received: from smtpin02.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay08.hostedemail.com (Postfix) with ESMTP id AFF7D1410CC for ; Fri, 29 Mar 2024 04:45:10 +0000 (UTC) X-FDA: 81948837180.02.BBFDC22 Received: from mail-oa1-f48.google.com (mail-oa1-f48.google.com [209.85.160.48]) by imf20.hostedemail.com (Postfix) with ESMTP id 0793D1C0012 for ; Fri, 29 Mar 2024 04:45:08 +0000 (UTC) Authentication-Results: imf20.hostedemail.com; dkim=pass header.d=rivosinc-com.20230601.gappssmtp.com header.s=20230601 header.b=0QonHQV1; spf=pass (imf20.hostedemail.com: domain of debug@rivosinc.com designates 209.85.160.48 as permitted sender) smtp.mailfrom=debug@rivosinc.com; dmarc=none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1711687509; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-transfer-encoding:content-transfer-encoding: in-reply-to:references:dkim-signature; bh=EqtDO42QHAr23qi0CzfGPQCsTN5H+bnmkZbW5sqZyb4=; b=QVvTbGQBG2Y6OcxNNInLWbp3Cr9BjnG4J474oH9aKL8sX8JpCMtqBPIPJxj5JaU537NKlZ sNkHv1FXyMr8EzmkURhdeWd1qBQfL0eJgL5KamlA+YnrUp7G11DJTI4K4n7Td5G56lkfsS XvEKk+Mt/KDOyPWf/S548cavQjTO7vo= ARC-Authentication-Results: i=1; imf20.hostedemail.com; dkim=pass header.d=rivosinc-com.20230601.gappssmtp.com header.s=20230601 header.b=0QonHQV1; spf=pass (imf20.hostedemail.com: domain of debug@rivosinc.com designates 209.85.160.48 as permitted sender) smtp.mailfrom=debug@rivosinc.com; dmarc=none ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1711687509; a=rsa-sha256; cv=none; b=HOhT53Y9IBHNcqOQyh4rmjoPNWc5n5Ra05p/eKpoF3MgatQ2VF4VONlubYCWiR7mYhMCnU 8QkSI5VXGI4eA0QbHRI6ae+J+dYs+VZxkCzig7myt3ctkQYMXKJB/jDFuXUxSCq+XXeZvY /jsPNhihxDcqdLgqXcvugzylujxsZDs= Received: by mail-oa1-f48.google.com with SMTP id 586e51a60fabf-221e1910c3bso927783fac.1 for ; Thu, 28 Mar 2024 21:45:08 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rivosinc-com.20230601.gappssmtp.com; s=20230601; t=1711687508; x=1712292308; darn=kvack.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=EqtDO42QHAr23qi0CzfGPQCsTN5H+bnmkZbW5sqZyb4=; b=0QonHQV1DSaLxnp01JR4Ea5kMdIDa0WZ6MYMqJzpO4nvCNEG5OAR2uJ5+U5NnxP2Hc 5LMQYbCT62ihfIZJvoSS68kNBbBGUXksOOpN6lIsY5NUvpKuq/frs+SLJwR3NzM0WVV1 W1fUkHyQCM7Cf11dT+HqJg87qFuv7HHyeY1l04vpVoUA5FSJeoP5c16KSph9cRTK/kac DG8IVFyzqMxiHoswBKCiYEx+wcK0u1sdArU3IOVP5ysLa0T5kayoF94AGazAy1USh35V pFrLrnChvBfaKKhOWBG/Px9gP6fWEAq9Ld0cXynY+wJi848YMC4LC3E9SZoGUeCRf9zX EvDg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1711687508; x=1712292308; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=EqtDO42QHAr23qi0CzfGPQCsTN5H+bnmkZbW5sqZyb4=; b=ggzblL3q1kSzoAvOFM+vABnDdZPCiGNGLwOvVLKQXs8svn3i4egDQCb5uyTRAaydYt /HHPUzf8p4BsDMfSSpjMaBGxOESVjJ1RMjkJdstaYxJEXP2gXRLMk+AUoPgbRzTsVgPZ LYEl9e6FQ5S07UXFspXW3UvlPC0YLPLIBY934YEMRW2s1ZCZd3+YjDG7MF7xbEf1gutN EZYn8jq0ARsu563ZE9fmVh5SGdQpjRREpc02o5ZZBzvN91cxBEGfOiuYOLJ9N3GNReFB JYFKv5wnmfNoNMXCb6r8SQTw7deW8cbS1LEA2bvmuVgYdSdVb+4tdAdZYThEUOBrcQ67 +kqQ== X-Forwarded-Encrypted: i=1; AJvYcCWhMTMcG7ffNpSyXB4m714tOWv6lU4vRrnRjsXepBrj7LVd3QSVSJSsuwpAQsiQa8iL/Syuw+50Pf5kvNAy9YB+Kq8= X-Gm-Message-State: AOJu0Yy6tsYYfQZVfaXqdsWgcbZSST1Xj/99DYeph1UczqHman0twMqz 2KjcxTkQsYdN7C5T0iSR9GiQgfB3d7uVtRCNZHFrOPuBB8LjiaZwqQNO8PKV52A= X-Google-Smtp-Source: AGHT+IGk8Phd46dcfosR9Oo5hXv/PvR5tBNwvT90McPidSgaKVOwDwxJqZMjb6jIVw0g1/5CoCMZaA== X-Received: by 2002:a05:6870:328a:b0:22a:f03:8259 with SMTP id q10-20020a056870328a00b0022a0f038259mr1171868oac.41.1711687507664; Thu, 28 Mar 2024 21:45:07 -0700 (PDT) Received: from debug.ba.rivosinc.com ([64.71.180.162]) by smtp.gmail.com with ESMTPSA id i18-20020aa78b52000000b006ea7e972947sm2217120pfd.130.2024.03.28.21.45.04 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 28 Mar 2024 21:45:07 -0700 (PDT) From: Deepak Gupta To: paul.walmsley@sifive.com, rick.p.edgecombe@intel.com, broonie@kernel.org, Szabolcs.Nagy@arm.com, kito.cheng@sifive.com, keescook@chromium.org, ajones@ventanamicro.com, conor.dooley@microchip.com, cleger@rivosinc.com, atishp@atishpatra.org, alex@ghiti.fr, bjorn@rivosinc.com, alexghiti@rivosinc.com, samuel.holland@sifive.com, palmer@sifive.com, conor@kernel.org, linux-doc@vger.kernel.org, linux-riscv@lists.infradead.org, linux-kernel@vger.kernel.org, devicetree@vger.kernel.org, linux-mm@kvack.org, linux-arch@vger.kernel.org, linux-kselftest@vger.kernel.org Cc: corbet@lwn.net, tech-j-ext@lists.risc-v.org, palmer@dabbelt.com, aou@eecs.berkeley.edu, robh+dt@kernel.org, krzysztof.kozlowski+dt@linaro.org, oleg@redhat.com, akpm@linux-foundation.org, arnd@arndb.de, ebiederm@xmission.com, Liam.Howlett@oracle.com, vbabka@suse.cz, lstoakes@gmail.com, shuah@kernel.org, brauner@kernel.org, debug@rivosinc.com, andy.chiu@sifive.com, jerry.shih@sifive.com, hankuan.chen@sifive.com, greentime.hu@sifive.com, evan@rivosinc.com, xiao.w.wang@intel.com, charlie@rivosinc.com, apatel@ventanamicro.com, mchitale@ventanamicro.com, dbarboza@ventanamicro.com, sameo@rivosinc.com, shikemeng@huaweicloud.com, willy@infradead.org, vincent.chen@sifive.com, guoren@kernel.org, samitolvanen@google.com, songshuaishuai@tinylab.org, gerg@kernel.org, heiko@sntech.de, bhe@redhat.com, jeeheng.sia@starfivetech.com, cyy@cyyself.name, maskray@google.com, ancientmodern4@gmail.com, mathis.salmen@matsal.de, cuiyunhui@bytedance.com, bgray@linux.ibm.com, mpe@ellerman.id.au, baruch@tkos.co.il, alx@kernel.org, david@redhat.com, catalin.marinas@arm.com, revest@chromium.org, josh@joshtriplett.org, shr@devkernel.io, deller@gmx.de, omosnace@redhat.com, ojeda@kernel.org, jhubbard@nvidia.com Subject: [PATCH v2 00/27] riscv control-flow integrity for usermode Date: Thu, 28 Mar 2024 21:44:32 -0700 Message-Id: <20240329044459.3990638-1-debug@rivosinc.com> X-Mailer: git-send-email 2.34.1 MIME-Version: 1.0 X-Rspamd-Queue-Id: 0793D1C0012 X-Rspam-User: X-Stat-Signature: iferorbnthmehih6mk949ymo59q9msgb X-Rspamd-Server: rspam01 X-HE-Tag: 1711687508-266277 X-HE-Meta: U2FsdGVkX18bWgTNvYAeku0OLXk9h35IwnSO6z6Dk3p2SRw3Ff0V0Wen2nu30vHJFTDywUykYQSL3AI4SvAI7eqWtZ94uY0H5aOeJhb441mCHusDORzXseCDSE2r0h0WdJrYS80OHpJLLRyFeAjCS3owzD42PuJm29HC58tZeMeOkU2jE0dyHmFWLlv+A7BqKG37eW5YTiWKSlvQxkD1DV5WwIWqJlmvaHPqTdmycQFExsfScbWzHHiqqe3IgqKChfXIpE10cxQAc58QazpyC2ol8C3lJeO2XRipwufOEz1pM7bRBANOB9Ch093epcij4vF37+I9E5J4CsPYY/D4hefXi6BByVIsUcIlQZoqJPEmIL9lFHRbWBYUk/3sGposPbQ6H9qSBImMGfaocjJRNrlRFvACpdexesfk2b999fNmZwZOnMoAMvlKStCS+UkSxfjMCO5PjXprxBhn6mKKSxBiHcQlrw1ZLQFzddaJWHps6jpdfqr0koR2/AduysuxpLKFBjfLi3ODMNsqA1qQZEv+33As/BZwfNuCc02b+6ZCbqSDtqhGFSMb9mCxEBlqs9HFc3v42u255myfDAuoghskwaU5fwZL3li+vIHUlg5ufAwQUVwgWf+CqthIb58S1RDsknhVRVfrRtLvam9fXRFeC9QX7MLYuzR/IM1lDSAO3qqj+p1cIYDl1zk1ZgvtVYJcaJkPoxUFr8T3YDMGJ0uJooMFXHSkAQFYi1UAenq0gpRAoGraDDQBdYrTJITLTUCvvOJmiP+dQmcwkRi5I7CsBtIsQOjBrMuY/BOSrRkxNc+qJASOpPWw+ywt4U7SRMqTTys+pfaktaXG71sUGZeAcZgZ7mEnRmS/5VwPXtE0AtxUd5RQ2W9dnfiBeGJRBpisQzM8jKvmrZs2Z2zjI5EIgW434nYz90Na1xl2t3CrzSaaamHlZAzvrWJrEtm+V/TvF167SsX54egzHw2 xzZ5LbKL O7InpiEtmrR7ufXAmT95PCL0Kx8Tdm0FUZwrmunjxpVRgldU6DQjF0OYPWU+g7NoZx31a0rsV6fs9AlLVSVEoyKx7S8Xj52wl+TXR1oQQGjHDiXqBoWJGNDTya1DzLyeT1dMUWJbDG00IDi5OqFK4QFktlw+sYGLOBn6gMYwLdRTX99EoQktrQFIXZVW7tOaI/Bp4Wu55cy3tAifvmAkox+pdmK447SgMjwxn0uMJdCt7lbM= X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: List-Subscribe: List-Unsubscribe: I had sent RFC patchset early this year (January) [7] to enable CPU assisted control-flow integrity for usermode on riscv. Since then I've been able to do more testing of the changes. As part of testing effort, compiled a rootfs with shadow stack and landing pad enabled (libraries and binaries) and booted to shell. As part of long running tests, I have been able to run some spec 2006 benchmarks [8] (here link is provided only for list of benchmarks that were tested for long running tests, excel sheet provided here actually is for some static stats like code size growth on spec binaries). Thus converting from RFC to regular patchset. Securing control-flow integrity for usermode requires following - Securing forward control flow : All callsites must reach reach a target that they actually intend to reach. - Securing backward control flow : All function returns must return to location where they were called from. This patch series use riscv cpu extension `zicfilp` [2] to secure forward control flow and `zicfiss` [2] to secure backward control flow. `zicfilp` enforces that all indirect calls or jmps must land on a landing pad instr and label embedded in landing pad instr must match a value programmed in `x7` register (at callsite via compiler). `zicfiss` introduces shadow stack which can only be writeable via shadow stack instructions (sspush and ssamoswap) and thus can't be tampered with via inadvertent stores. More details about extension can be read from [2] and there are details in documentation as well (in this patch series). Using config `CONFIG_RISCV_USER_CFI`, kernel support for riscv control flow integrity for user mode programs can be compiled in the kernel. Enabling of control flow integrity for user programs is left to user runtime (specifically expected from dynamic loader). There has been a lot of earlier discussion on the enabling topic around x86 shadow stack enabling [3, 4, 5] and overall consensus had been to let dynamic loader (or usermode) to decide for enabling the feature. This patch series introduces arch agnostic `prctls` to enable shadow stack and indirect branch tracking. And implements them on riscv. arm64 is expected to implement shadow stack part of these arch agnostic `prctls` [6] Changes since last time *********************** Spec changes ------------ - Forward cfi spec has become much simpler. `lpad` instruction is pseudo for `auipc rd, <20bit_imm>`. `lpad` checks x7 against 20bit embedded in instr. Thus label width is 20bit. - Shadow stack management instructions are reduced to sspush - to push x1/x5 on shadow stack sspopchk - pops from shadow stack and comapres with x1/x5. ssamoswap - atomically swap value on shadow stack. rdssp - reads current shadow stack pointer - Shadow stack accesses on readonly memory always raise AMO/store page fault. `sspopchk` is load but if underlying page is readonly, it'll raise a store page fault. It simplifies hardware and kernel for COW handling for shadow stack pages. - riscv defines a new exception type `software check exception` and control flow violations raise software check exception. - enabling controls for shadow stack and landing are in xenvcfg CSR and controls lower privilege mode enabling. As an example senvcfg controls enabling for U and menvcfg controls enabling for S mode. core mm shadow stack enabling ----------------------------- Shadow stack for x86 usermode are now in mainline and thus this patch series builds on top of that for arch-agnostic mm related changes. Big thanks and shout out to Rick Edgecombe for that. selftests --------- Created some minimal selftests to test the patch series. [1] - https://lore.kernel.org/lkml/20230213045351.3945824-1-debug@rivosinc.com/ [2] - https://github.com/riscv/riscv-cfi [3] - https://lore.kernel.org/lkml/ZWHcBq0bJ+15eeKs@finisterre.sirena.org.uk/T/#mb121cd8b33d564e64234595a0ec52211479cf474 [4] - https://lore.kernel.org/all/20220130211838.8382-1-rick.p.edgecombe@intel.com/ [5] - https://lore.kernel.org/lkml/CAHk-=wgP5mk3poVeejw16Asbid0ghDt4okHnWaWKLBkRhQntRA@mail.gmail.com/ [6] - https://lore.kernel.org/linux-mm/20231122-arm64-gcs-v7-2-201c483bd775@kernel.org/ [7] - https://lore.kernel.org/lkml/20240125062739.1339782-1-debug@rivosinc.com/ [8] - https://docs.google.com/spreadsheets/d/1_cHGH4ctNVvFRiS7hW9dEGKtXLAJ3aX4Z_iTSa3Tw2U/edit#gid=0 Deepak Gupta (26): riscv: envcfg save and restore on task switching riscv: define default value for envcfg riscv/Kconfig: enable HAVE_EXIT_THREAD for riscv riscv: zicfiss/zicfilp enumeration riscv: zicfiss/zicfilp extension csr and bit definitions riscv: usercfi state for task and save/restore of CSR_SSP on trap entry/exit mm: Define VM_SHADOW_STACK for RISC-V mm: abstract shadow stack vma behind `arch_is_shadow_stack` riscv/mm : ensure PROT_WRITE leads to VM_READ | VM_WRITE riscv mm: manufacture shadow stack pte riscv mmu: teach pte_mkwrite to manufacture shadow stack PTEs riscv mmu: write protect and shadow stack riscv/mm: Implement map_shadow_stack() syscall riscv/shstk: If needed allocate a new shadow stack on clone prctl: arch-agnostic prtcl for indirect branch tracking riscv: Implements arch agnostic shadow stack prctls riscv: Implements arch argnostic indirect branch tracking prctls riscv/kernel: update __show_regs to print shadow stack register riscv/traps: Introduce software check exception riscv sigcontext: adding cfi state field in sigcontext riscv signal: Save and restore of shadow stack for signal riscv/ptrace: riscv cfi status and state via ptrace and in core files riscv: create a config for shadow stack and landing pad instr support riscv: Documentation for landing pad / indirect branch tracking riscv: Documentation for shadow stack on riscv kselftest/riscv: kselftest for user mode cfi Mark Brown (1): prctl: arch-agnostic prctl for shadow stack Documentation/arch/riscv/zicfilp.rst | 104 ++++ Documentation/arch/riscv/zicfiss.rst | 169 ++++++ .../devicetree/bindings/riscv/extensions.yaml | 10 + arch/riscv/Kconfig | 19 + arch/riscv/include/asm/asm-prototypes.h | 1 + arch/riscv/include/asm/cpufeature.h | 13 + arch/riscv/include/asm/csr.h | 18 + arch/riscv/include/asm/hwcap.h | 2 + arch/riscv/include/asm/mman.h | 24 + arch/riscv/include/asm/pgtable.h | 32 +- arch/riscv/include/asm/processor.h | 2 + arch/riscv/include/asm/switch_to.h | 10 + arch/riscv/include/asm/thread_info.h | 4 + arch/riscv/include/asm/usercfi.h | 118 ++++ arch/riscv/include/uapi/asm/ptrace.h | 18 + arch/riscv/include/uapi/asm/sigcontext.h | 5 + arch/riscv/kernel/Makefile | 2 + arch/riscv/kernel/asm-offsets.c | 4 + arch/riscv/kernel/cpufeature.c | 2 + arch/riscv/kernel/entry.S | 29 + arch/riscv/kernel/process.c | 35 +- arch/riscv/kernel/ptrace.c | 83 +++ arch/riscv/kernel/signal.c | 45 ++ arch/riscv/kernel/sys_riscv.c | 11 + arch/riscv/kernel/traps.c | 38 ++ arch/riscv/kernel/usercfi.c | 510 ++++++++++++++++++ arch/riscv/mm/init.c | 2 +- arch/riscv/mm/pgtable.c | 21 + include/linux/mm.h | 35 +- include/uapi/asm-generic/mman.h | 1 + include/uapi/linux/elf.h | 1 + include/uapi/linux/prctl.h | 49 ++ kernel/sys.c | 60 +++ mm/gup.c | 5 +- mm/internal.h | 2 +- mm/mmap.c | 1 + tools/testing/selftests/riscv/Makefile | 2 +- tools/testing/selftests/riscv/cfi/Makefile | 10 + .../testing/selftests/riscv/cfi/cfi_rv_test.h | 85 +++ .../selftests/riscv/cfi/riscv_cfi_test.c | 91 ++++ .../testing/selftests/riscv/cfi/shadowstack.c | 376 +++++++++++++ .../testing/selftests/riscv/cfi/shadowstack.h | 39 ++ 42 files changed, 2077 insertions(+), 11 deletions(-) create mode 100644 Documentation/arch/riscv/zicfilp.rst create mode 100644 Documentation/arch/riscv/zicfiss.rst create mode 100644 arch/riscv/include/asm/mman.h create mode 100644 arch/riscv/include/asm/usercfi.h create mode 100644 arch/riscv/kernel/usercfi.c create mode 100644 tools/testing/selftests/riscv/cfi/Makefile create mode 100644 tools/testing/selftests/riscv/cfi/cfi_rv_test.h create mode 100644 tools/testing/selftests/riscv/cfi/riscv_cfi_test.c create mode 100644 tools/testing/selftests/riscv/cfi/shadowstack.c create mode 100644 tools/testing/selftests/riscv/cfi/shadowstack.h