| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <20240125062739.1339782-8-debug@rivosinc.com>
Date: Wed, 24 Jan 2024 22:21:32 -0800
From: debug@...osinc.com
To: rick.p.edgecombe@...el.com,
broonie@...nel.org,
Szabolcs.Nagy@....com,
kito.cheng@...ive.com,
keescook@...omium.org,
ajones@...tanamicro.com,
paul.walmsley@...ive.com,
palmer@...belt.com,
conor.dooley@...rochip.com,
cleger@...osinc.com,
atishp@...shpatra.org,
alex@...ti.fr,
bjorn@...osinc.com,
alexghiti@...osinc.com
Cc: corbet@....net,
aou@...s.berkeley.edu,
oleg@...hat.com,
akpm@...ux-foundation.org,
arnd@...db.de,
ebiederm@...ssion.com,
shuah@...nel.org,
brauner@...nel.org,
debug@...osinc.com,
guoren@...nel.org,
samitolvanen@...gle.com,
evan@...osinc.com,
xiao.w.wang@...el.com,
apatel@...tanamicro.com,
mchitale@...tanamicro.com,
waylingii@...il.com,
greentime.hu@...ive.com,
heiko@...ech.de,
jszhang@...nel.org,
shikemeng@...weicloud.com,
david@...hat.com,
charlie@...osinc.com,
panqinglin2020@...as.ac.cn,
willy@...radead.org,
vincent.chen@...ive.com,
andy.chiu@...ive.com,
gerg@...nel.org,
jeeheng.sia@...rfivetech.com,
mason.huo@...rfivetech.com,
ancientmodern4@...il.com,
mathis.salmen@...sal.de,
cuiyunhui@...edance.com,
bhe@...hat.com,
chenjiahao16@...wei.com,
ruscur@...sell.cc,
bgray@...ux.ibm.com,
alx@...nel.org,
baruch@...s.co.il,
zhangqing@...ngson.cn,
catalin.marinas@....com,
revest@...omium.org,
josh@...htriplett.org,
joey.gouly@....com,
shr@...kernel.io,
omosnace@...hat.com,
ojeda@...nel.org,
jhubbard@...dia.com,
linux-doc@...r.kernel.org,
linux-riscv@...ts.infradead.org,
linux-kernel@...r.kernel.org,
linux-mm@...ck.org,
linux-arch@...r.kernel.org,
linux-kselftest@...r.kernel.org
Subject: [RFC PATCH v1 07/28] riscv: kernel handling on trap entry/exit for user cfi
From: Deepak Gupta <debug@...osinc.com>
Carves out space in arch specific thread struct for cfi status and shadow stack
in usermode on riscv.
This patch does following
- defines a new structure cfi_status with status bit for cfi feature
- defines shadow stack pointer, base and size in cfi_status structure
- defines offsets to new member fields in thread in asm-offsets.c
- Saves and restore shadow stack pointer on trap entry (U --> S) and exit
(S --> U)
Signed-off-by: Deepak Gupta <debug@...osinc.com>
---
arch/riscv/include/asm/processor.h | 1 +
arch/riscv/include/asm/thread_info.h | 3 +++
arch/riscv/include/asm/usercfi.h | 24 ++++++++++++++++++++++++
arch/riscv/kernel/asm-offsets.c | 5 ++++-
arch/riscv/kernel/entry.S | 25 +++++++++++++++++++++++++
5 files changed, 57 insertions(+), 1 deletion(-)
create mode 100644 arch/riscv/include/asm/usercfi.h
diff --git a/arch/riscv/include/asm/processor.h b/arch/riscv/include/asm/processor.h
index ee2f51787ff8..d4dc298880fc 100644
--- a/arch/riscv/include/asm/processor.h
+++ b/arch/riscv/include/asm/processor.h
@@ -14,6 +14,7 @@
#include <asm/ptrace.h>
#include <asm/hwcap.h>
+#include <asm/usercfi.h>
#ifdef CONFIG_64BIT
#define DEFAULT_MAP_WINDOW (UL(1) << (MMAP_VA_BITS - 1))
diff --git a/arch/riscv/include/asm/thread_info.h b/arch/riscv/include/asm/thread_info.h
index 320bc899a63b..6a2acecec546 100644
--- a/arch/riscv/include/asm/thread_info.h
+++ b/arch/riscv/include/asm/thread_info.h
@@ -58,6 +58,9 @@ struct thread_info {
int cpu;
unsigned long syscall_work; /* SYSCALL_WORK_ flags */
unsigned long envcfg;
+#ifdef CONFIG_RISCV_USER_CFI
+ struct cfi_status user_cfi_state;
+#endif
#ifdef CONFIG_SHADOW_CALL_STACK
void *scs_base;
void *scs_sp;
diff --git a/arch/riscv/include/asm/usercfi.h b/arch/riscv/include/asm/usercfi.h
new file mode 100644
index 000000000000..080d7077d12c
--- /dev/null
+++ b/arch/riscv/include/asm/usercfi.h
@@ -0,0 +1,24 @@
+/* SPDX-License-Identifier: GPL-2.0
+ * Copyright (C) 2023 Rivos, Inc.
+ * Deepak Gupta <debug@...osinc.com>
+ */
+#ifndef _ASM_RISCV_USERCFI_H
+#define _ASM_RISCV_USERCFI_H
+
+#ifndef __ASSEMBLY__
+#include <linux/types.h>
+
+#ifdef CONFIG_RISCV_USER_CFI
+struct cfi_status {
+ unsigned long ubcfi_en : 1; /* Enable for backward cfi. */
+ unsigned long rsvd : ((sizeof(unsigned long)*8) - 1);
+ unsigned long user_shdw_stk; /* Current user shadow stack pointer */
+ unsigned long shdw_stk_base; /* Base address of shadow stack */
+ unsigned long shdw_stk_size; /* size of shadow stack */
+};
+
+#endif /* CONFIG_RISCV_USER_CFI */
+
+#endif /* __ASSEMBLY__ */
+
+#endif /* _ASM_RISCV_USERCFI_H */
diff --git a/arch/riscv/kernel/asm-offsets.c b/arch/riscv/kernel/asm-offsets.c
index cdd8f095c30c..5e1f412e96ba 100644
--- a/arch/riscv/kernel/asm-offsets.c
+++ b/arch/riscv/kernel/asm-offsets.c
@@ -43,8 +43,11 @@ void asm_offsets(void)
#ifdef CONFIG_SHADOW_CALL_STACK
OFFSET(TASK_TI_SCS_SP, task_struct, thread_info.scs_sp);
#endif
-
OFFSET(TASK_TI_CPU_NUM, task_struct, thread_info.cpu);
+#ifdef CONFIG_RISCV_USER_CFI
+ OFFSET(TASK_TI_CFI_STATUS, task_struct, thread_info.user_cfi_state);
+ OFFSET(TASK_TI_USER_SSP, task_struct, thread_info.user_cfi_state.user_shdw_stk);
+#endif
OFFSET(TASK_THREAD_F0, task_struct, thread.fstate.f[0]);
OFFSET(TASK_THREAD_F1, task_struct, thread.fstate.f[1]);
OFFSET(TASK_THREAD_F2, task_struct, thread.fstate.f[2]);
diff --git a/arch/riscv/kernel/entry.S b/arch/riscv/kernel/entry.S
index 63c3855ba80d..410659e2eadb 100644
--- a/arch/riscv/kernel/entry.S
+++ b/arch/riscv/kernel/entry.S
@@ -49,6 +49,21 @@ SYM_CODE_START(handle_exception)
REG_S x5, PT_T0(sp)
save_from_x6_to_x31
+#ifdef CONFIG_RISCV_USER_CFI
+ /*
+ * we need to save cfi status only when previous mode was U
+ */
+ csrr s2, CSR_STATUS
+ andi s2, s2, SR_SPP
+ bnez s2, skip_bcfi_save
+ /* load cfi status word */
+ lw s3, TASK_TI_CFI_STATUS(tp)
+ andi s3, s3, 1
+ beqz s3, skip_bcfi_save
+ csrr s3, CSR_SSP
+ REG_S s3, TASK_TI_USER_SSP(tp) /* save user ssp in thread_info */
+skip_bcfi_save:
+#endif
/*
* Disable user-mode memory access as it should only be set in the
* actual user copy routines.
@@ -141,6 +156,16 @@ SYM_CODE_START_NOALIGN(ret_from_exception)
* structures again.
*/
csrw CSR_SCRATCH, tp
+
+#ifdef CONFIG_RISCV_USER_CFI
+ lw s3, TASK_TI_CFI_STATUS(tp)
+ andi s3, s3, 1
+ beqz s3, skip_bcfi_resume
+ REG_L s3, TASK_TI_USER_SSP(tp) /* restore user ssp from thread struct */
+ csrw CSR_SSP, s3
+skip_bcfi_resume:
+#endif
+
1:
REG_L a0, PT_STATUS(sp)
/*
--
2.43.0
Powered by blists - more mailing lists