From patchwork Mon Feb 13 04:53:33 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Deepak Gupta X-Patchwork-Id: 56027 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:adf:eb09:0:0:0:0:0 with SMTP id s9csp2175303wrn; Sun, 12 Feb 2023 20:55:28 -0800 (PST) X-Google-Smtp-Source: AK7set//pNqIB/Oz72+9hPyJq4OybO2jW0AWRRcNCcMJzGd519Zz3/zdmhcGlXUHuWKoq7aj3PPS X-Received: by 2002:a17:90b:4a0d:b0:230:c723:f37d with SMTP id kk13-20020a17090b4a0d00b00230c723f37dmr25454190pjb.40.1676264128285; Sun, 12 Feb 2023 20:55:28 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1676264128; cv=none; d=google.com; s=arc-20160816; b=NZyVA0Kuuuw0SrAdEXQdPISEOet1qJ+NRA/xt5zeaXHb4XaqTVyIGiKMKV6r0+g9Bx VelLqIgNGjmh019hYyN+cTnUVSPj7E0zXr4bEKF/uDjO+MttDlGXVDunOcBWZ6TxPsuQ P5Qk/TdE1U9fEUBnnA7k/+nhuC6DySVXfpvTbB5IpuWU2hRLRyVWShPHQaLlIx3wUlbf 2s3G8yLB90zSqFGdDHT8OG1L/konvcaSrLyB6luDrUeC/TSUc8GaLhuCOayPECIpIj5t oM4yOZ6W/OKWaU0sF/LNEb8mxt0wt9lgm5XajX3zseUY5JAagTmzmIGzwYtHPZQMlCMW v4Ug== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :references:in-reply-to:message-id:date:subject:cc:to:from :dkim-signature; bh=iPcTKWGDPVSnaGv0xj2Ptv0rfddqsVuLBZ9aJFRMto4=; b=mdF07LawK2myMbUayS4f2sNH0FdXPwgWeNCN7XqHZ97LEq/0GIzMTPRVInBLSMFFS0 G9qv6Z7eV/92aumXgXuYOg5iBNd7frcEnWHE74Ee0yAov+scmvuYp2Hg2zQ5DasW77w4 VRgkBBrAuMayXrjyuCWT9e0Tc6nZKf8t4S4jBL5HYChP/SCJVhn3XHcfpO23xfigFhrd ZppqNcrcg0CsmwNTeV6X4MdhDZj/y6XALrjseRZ827KdvgqVfirR23E8plrXKfjzbSxj WYF/xRq5kniT7uggCMDWlrfrhsPtrmPmPke6vwMdHnMighZcMHwYL0VjwR6kIk5PTvFA Syig== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@rivosinc-com.20210112.gappssmtp.com header.s=20210112 header.b=ubuWRUQI; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id bw20-20020a17090af61400b002300a60ef5esi13307078pjb.182.2023.02.12.20.55.16; Sun, 12 Feb 2023 20:55:28 -0800 (PST) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=pass header.i=@rivosinc-com.20210112.gappssmtp.com header.s=20210112 header.b=ubuWRUQI; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229779AbjBMEyR (ORCPT + 99 others); Sun, 12 Feb 2023 23:54:17 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:51168 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229698AbjBMEyJ (ORCPT ); Sun, 12 Feb 2023 23:54:09 -0500 Received: from mail-pj1-x102e.google.com (mail-pj1-x102e.google.com [IPv6:2607:f8b0:4864:20::102e]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 7F3A946B5 for ; Sun, 12 Feb 2023 20:54:08 -0800 (PST) Received: by mail-pj1-x102e.google.com with SMTP id rm7-20020a17090b3ec700b0022c05558d22so10977622pjb.5 for ; Sun, 12 Feb 2023 20:54:08 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rivosinc-com.20210112.gappssmtp.com; s=20210112; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=iPcTKWGDPVSnaGv0xj2Ptv0rfddqsVuLBZ9aJFRMto4=; b=ubuWRUQI6DO7BXFrAM9O2TncXqmRilKXfzowXV5xcve/F4+hWvI8bU1bI5sCYwrNov xWzsT6/qXeY2wz5ryX3qVeyqTsqVrRn/s3UW2DoOrYNf3MiUDDNou9CMk6L1/oz6H6WB dU9WOxrHlhzoqkkzZ3zk/+UppeNZ3tzBybM7gU1o59qToIXc3KlDQVgPX9EVQHkcfv8P pLfafwQFE3MEzcXXtOJWy7Ic+zdkXeZoKdOzIMMSnWK/NlAKj/jwFBpv0hi/KY5NiGY8 s+1hNqY4Wfbk6uEa34IyNOF/CuCjhHIbS4gNTmG0iU8hA3c/pOm7STbsvA06gX1ZwHSz TN/A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=iPcTKWGDPVSnaGv0xj2Ptv0rfddqsVuLBZ9aJFRMto4=; b=zMNfz23FZXYgWzGJMKfNOZYvI7nlfwFphKhQbKi95iwvZDC6iI8tMH6EyIdfXf9j/U 4AnrA/aeglK03OKIq8Bs6DuIFh7nFzFqxwPUnUq8i6GM7q++4EexTmm5bgMbsq0Kw+yr cRtoihia9CdV5BZaQwub5Cn9brggqr98nu9T7/woToPrhu3cCsgATPtFxyAuakfvh1Qr PupURzAROlqr6xxZvxJ5cOvKHd7p7ucw3YQMIE5nGfTt8QSQu+kWfO/Znb/2o+S+Pmnr EI1WCc0oFjEG8ERi/o/hSK63875cp2/1U4MyfuqgKavp/+sagEPG/+vylNDTnXF4WjhY pTMA== X-Gm-Message-State: AO0yUKXxPQmvHWooPf+yV5nLCKm7ezRK3M2GQa10YU3ISJxf5dVpICe0 HYFl5FudeMhpKurz82SYi4L1MtsbYr52wgO/ X-Received: by 2002:a17:903:22c9:b0:198:fded:3b69 with SMTP id y9-20020a17090322c900b00198fded3b69mr25993049plg.53.1676264047642; Sun, 12 Feb 2023 20:54:07 -0800 (PST) Received: from debug.ba.rivosinc.com ([66.220.2.162]) by smtp.gmail.com with ESMTPSA id e5-20020a170902784500b00189e7cb8b89sm7078303pln.127.2023.02.12.20.54.06 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 12 Feb 2023 20:54:07 -0800 (PST) From: Deepak Gupta To: linux-kernel@vger.kernel.org, linux-riscv@lists.infradead.org, Paul Walmsley , Palmer Dabbelt , Albert Ou Cc: Deepak Gupta Subject: [PATCH v1 RFC Zisslpcfi 04/20] riscv: kernel enabling user code for shadow stack and landing pad Date: Sun, 12 Feb 2023 20:53:33 -0800 Message-Id: <20230213045351.3945824-5-debug@rivosinc.com> X-Mailer: git-send-email 2.25.1 In-Reply-To: <20230213045351.3945824-1-debug@rivosinc.com> References: <20230213045351.3945824-1-debug@rivosinc.com> MIME-Version: 1.0 X-Spam-Status: No, score=-1.9 required=5.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,RCVD_IN_DNSWL_NONE,SPF_HELO_NONE,SPF_PASS autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= X-GMAIL-THRID: =?utf-8?q?1757690334332925086?= X-GMAIL-MSGID: =?utf-8?q?1757690334332925086?= Enables architectural support for shadow stack and landing pad instr for user mode on riscv. This patch does following - Defines a new structure cfi_status - Includes cfi_status in thread_info - Defines offsets to new member fields in thread_info in asm-offsets.c - Saves and restore cfi state on trap entry (U --> S) and exit (S --> U) Signed-off-by: Deepak Gupta --- arch/riscv/include/asm/processor.h | 11 ++++++++ arch/riscv/include/asm/thread_info.h | 5 ++++ arch/riscv/kernel/asm-offsets.c | 5 ++++ arch/riscv/kernel/entry.S | 40 ++++++++++++++++++++++++++++ 4 files changed, 61 insertions(+) diff --git a/arch/riscv/include/asm/processor.h b/arch/riscv/include/asm/processor.h index bdebce2cc323..f065309927b1 100644 --- a/arch/riscv/include/asm/processor.h +++ b/arch/riscv/include/asm/processor.h @@ -41,6 +41,17 @@ struct thread_struct { unsigned long bad_cause; }; +#if defined(CONFIG_USER_SHADOW_STACK) || defined(CONFIG_USER_INDIRECT_BR_LP) +struct cfi_status { + unsigned int ufcfi_en : 1; /* Enable for forward cfi. Note that ELP goes in sstatus */ + unsigned int ubcfi_en : 1; /* Enable for backward cfi. */ + unsigned int rsvd1 : 30; + unsigned int lp_label; /* saved label value (25bit) */ + long user_shdw_stk; /* Current user shadow stack pointer */ + long shdw_stk_base; /* Base address of shadow stack */ +}; +#endif + /* Whitelist the fstate from the task_struct for hardened usercopy */ static inline void arch_thread_struct_whitelist(unsigned long *offset, unsigned long *size) diff --git a/arch/riscv/include/asm/thread_info.h b/arch/riscv/include/asm/thread_info.h index 67322f878e0d..f74b8bd55d5b 100644 --- a/arch/riscv/include/asm/thread_info.h +++ b/arch/riscv/include/asm/thread_info.h @@ -65,6 +65,11 @@ struct thread_info { */ long kernel_sp; /* Kernel stack pointer */ long user_sp; /* User stack pointer */ +#if defined(CONFIG_USER_SHADOW_STACK) || defined(CONFIG_USER_INDIRECT_BR_LP) + /* cfi_state only if config is defined */ + /* state of user cfi state. note this includes LPLR and SSP as well */ + struct cfi_status user_cfi_state; +#endif int cpu; }; diff --git a/arch/riscv/kernel/asm-offsets.c b/arch/riscv/kernel/asm-offsets.c index df9444397908..340e6413cf3c 100644 --- a/arch/riscv/kernel/asm-offsets.c +++ b/arch/riscv/kernel/asm-offsets.c @@ -38,6 +38,11 @@ void asm_offsets(void) OFFSET(TASK_TI_KERNEL_SP, task_struct, thread_info.kernel_sp); OFFSET(TASK_TI_USER_SP, task_struct, thread_info.user_sp); +#if defined(CONFIG_USER_SHADOW_STACK) || defined(CONFIG_USER_INDIRECT_BR_LP) + OFFSET(TASK_TI_USER_CFI_STATUS, task_struct, thread_info.user_cfi_state); + OFFSET(TASK_TI_USER_LPLR, task_struct, thread_info.user_cfi_state.lp_label); + OFFSET(TASK_TI_USER_SSP, task_struct, thread_info.user_cfi_state.user_shdw_stk); +#endif OFFSET(TASK_THREAD_F0, task_struct, thread.fstate.f[0]); OFFSET(TASK_THREAD_F1, task_struct, thread.fstate.f[1]); OFFSET(TASK_THREAD_F2, task_struct, thread.fstate.f[2]); diff --git a/arch/riscv/kernel/entry.S b/arch/riscv/kernel/entry.S index 99d38fdf8b18..f283130c81ec 100644 --- a/arch/riscv/kernel/entry.S +++ b/arch/riscv/kernel/entry.S @@ -73,6 +73,31 @@ _save_context: REG_S x30, PT_T5(sp) REG_S x31, PT_T6(sp) +#if defined(CONFIG_USER_SHADOW_STACK) || defined(CONFIG_USER_INDIRECT_BR_LP) + /* + * If U --> S, CSR_SCRATCH should be holding U TP + * If S --> S, CSR_SCRATCH should be holding S TP + * s2 == tp means, previous mode was S + * else previous mode U + * we need to save cfi status only when previous mode was U + */ + csrr s2, CSR_SCRATCH + xor s2, s2, tp + beqz s2, skip_bcfi_save + /* load cfi status word */ + lw s2, TASK_TI_USER_CFI_STATUS(tp) + andi s3, s2, 1 + beqz s3, skip_fcfi_save + /* fcfi is enabled, capture ELP and LPLR state and record it */ + csrr s3, CSR_LPLR /* record label register */ + sw s3, TASK_TI_USER_LPLR(tp) /* save it back in thread_info structure */ +skip_fcfi_save: + andi s3, s2, 2 + beqz s3, skip_bcfi_save + csrr s3, CSR_SSP + REG_S s3, TASK_TI_USER_SSP(tp) /* save user ssp in thread_info */ +skip_bcfi_save: +#endif /* * Disable user-mode memory access as it should only be set in the * actual user copy routines. @@ -283,6 +308,21 @@ resume_userspace: */ csrw CSR_SCRATCH, tp +#if defined(CONFIG_USER_SHADOW_STACK) || defined(CONFIG_USER_INDIRECT_BR_LP) + lw s2, TASK_TI_USER_CFI_STATUS(tp) + andi s3, s2, 1 + beqz s3, skip_fcfi_resume + xor s3, s3, s3 + lw s3, TASK_TI_USER_LPLR(tp) + csrw CSR_LPLR, s3 +skip_fcfi_resume: + andi s3, s2, 2 + beqz s3, skip_bcfi_resume + REG_L s3, TASK_TI_USER_SSP(tp) /* save user ssp in thread_info */ + csrw CSR_SSP, s3 +skip_bcfi_resume: +#endif + restore_all: #ifdef CONFIG_TRACE_IRQFLAGS REG_L s1, PT_STATUS(sp)