| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-Id: <ab343d4b-d8b0-47fc-8040-83313a3d735e@app.fastmail.com>
Date: Thu, 25 Jan 2024 02:29:01 -0500
From: "Stefan O'Rear" <sorear@...tmail.com>
To: debug <debug@...osinc.com>, rick.p.edgecombe@...el.com,
broonie@...nel.org, Szabolcs.Nagy@....com,
"kito.cheng@...ive.com" <kito.cheng@...ive.com>,
"Kees Cook" <keescook@...omium.org>,
"Andrew Jones" <ajones@...tanamicro.com>, paul.walmsley@...ive.com,
"Palmer Dabbelt" <palmer@...belt.com>,
"Conor Dooley" <conor.dooley@...rochip.com>, cleger@...osinc.com,
"Atish Patra" <atishp@...shpatra.org>, "Alexandre Ghiti" <alex@...ti.fr>,
Björn Töpel <bjorn@...osinc.com>,
"Alexandre Ghiti" <alexghiti@...osinc.com>
Cc: "Jonathan Corbet" <corbet@....net>, "Albert Ou" <aou@...s.berkeley.edu>,
oleg@...hat.com, akpm@...ux-foundation.org, arnd@...db.de,
"Eric W. Biederman" <ebiederm@...ssion.com>, shuah@...nel.org,
"Christian Brauner" <brauner@...nel.org>, guoren <guoren@...nel.org>,
samitolvanen@...gle.com, "Evan Green" <evan@...osinc.com>,
xiao.w.wang@...el.com, "Anup Patel" <apatel@...tanamicro.com>,
mchitale@...tanamicro.com, waylingii@...il.com, greentime.hu@...ive.com,
"Heiko Stuebner" <heiko@...ech.de>, "Jisheng Zhang" <jszhang@...nel.org>,
shikemeng@...weicloud.com, david@...hat.com,
"Charlie Jenkins" <charlie@...osinc.com>, panqinglin2020@...as.ac.cn,
willy@...radead.org, "Vincent Chen" <vincent.chen@...ive.com>,
"Andy Chiu" <andy.chiu@...ive.com>, "Greg Ungerer" <gerg@...nel.org>,
jeeheng.sia@...rfivetech.com, mason.huo@...rfivetech.com,
ancientmodern4@...il.com, mathis.salmen@...sal.de,
cuiyunhui@...edance.com, bhe@...hat.com, chenjiahao16@...wei.com,
ruscur@...sell.cc, bgray@...ux.ibm.com, alx@...nel.org,
baruch@...s.co.il, zhangqing@...ngson.cn,
"Catalin Marinas" <catalin.marinas@....com>, revest@...omium.org,
josh@...htriplett.org, joey.gouly@....com, shr@...kernel.io,
omosnace@...hat.com, ojeda@...nel.org, jhubbard@...dia.com,
linux-doc@...r.kernel.org, linux-riscv@...ts.infradead.org,
linux-kernel@...r.kernel.org, linux-mm@...ck.org,
linux-arch@...r.kernel.org, linux-kselftest@...r.kernel.org
Subject: Re: [RFC PATCH v1 07/28] riscv: kernel handling on trap entry/exit for user
cfi
On Thu, Jan 25, 2024, at 1:21 AM, debug@...osinc.com wrote:
> From: Deepak Gupta <debug@...osinc.com>
>
> Carves out space in arch specific thread struct for cfi status and shadow stack
> in usermode on riscv.
>
> This patch does following
> - defines a new structure cfi_status with status bit for cfi feature
> - defines shadow stack pointer, base and size in cfi_status structure
> - defines offsets to new member fields in thread in asm-offsets.c
> - Saves and restore shadow stack pointer on trap entry (U --> S) and exit
> (S --> U)
>
> Signed-off-by: Deepak Gupta <debug@...osinc.com>
> ---
> arch/riscv/include/asm/processor.h | 1 +
> arch/riscv/include/asm/thread_info.h | 3 +++
> arch/riscv/include/asm/usercfi.h | 24 ++++++++++++++++++++++++
> arch/riscv/kernel/asm-offsets.c | 5 ++++-
> arch/riscv/kernel/entry.S | 25 +++++++++++++++++++++++++
> 5 files changed, 57 insertions(+), 1 deletion(-)
> create mode 100644 arch/riscv/include/asm/usercfi.h
>
> diff --git a/arch/riscv/include/asm/processor.h
> b/arch/riscv/include/asm/processor.h
> index ee2f51787ff8..d4dc298880fc 100644
> --- a/arch/riscv/include/asm/processor.h
> +++ b/arch/riscv/include/asm/processor.h
> @@ -14,6 +14,7 @@
>
> #include <asm/ptrace.h>
> #include <asm/hwcap.h>
> +#include <asm/usercfi.h>
>
> #ifdef CONFIG_64BIT
> #define DEFAULT_MAP_WINDOW (UL(1) << (MMAP_VA_BITS - 1))
> diff --git a/arch/riscv/include/asm/thread_info.h
> b/arch/riscv/include/asm/thread_info.h
> index 320bc899a63b..6a2acecec546 100644
> --- a/arch/riscv/include/asm/thread_info.h
> +++ b/arch/riscv/include/asm/thread_info.h
> @@ -58,6 +58,9 @@ struct thread_info {
> int cpu;
> unsigned long syscall_work; /* SYSCALL_WORK_ flags */
> unsigned long envcfg;
> +#ifdef CONFIG_RISCV_USER_CFI
> + struct cfi_status user_cfi_state;
> +#endif
> #ifdef CONFIG_SHADOW_CALL_STACK
> void *scs_base;
> void *scs_sp;
> diff --git a/arch/riscv/include/asm/usercfi.h
> b/arch/riscv/include/asm/usercfi.h
> new file mode 100644
> index 000000000000..080d7077d12c
> --- /dev/null
> +++ b/arch/riscv/include/asm/usercfi.h
> @@ -0,0 +1,24 @@
> +/* SPDX-License-Identifier: GPL-2.0
> + * Copyright (C) 2023 Rivos, Inc.
> + * Deepak Gupta <debug@...osinc.com>
> + */
> +#ifndef _ASM_RISCV_USERCFI_H
> +#define _ASM_RISCV_USERCFI_H
> +
> +#ifndef __ASSEMBLY__
> +#include <linux/types.h>
> +
> +#ifdef CONFIG_RISCV_USER_CFI
> +struct cfi_status {
> + unsigned long ubcfi_en : 1; /* Enable for backward cfi. */
> + unsigned long rsvd : ((sizeof(unsigned long)*8) - 1);
> + unsigned long user_shdw_stk; /* Current user shadow stack pointer */
> + unsigned long shdw_stk_base; /* Base address of shadow stack */
> + unsigned long shdw_stk_size; /* size of shadow stack */
> +};
> +
> +#endif /* CONFIG_RISCV_USER_CFI */
> +
> +#endif /* __ASSEMBLY__ */
> +
> +#endif /* _ASM_RISCV_USERCFI_H */
> diff --git a/arch/riscv/kernel/asm-offsets.c
> b/arch/riscv/kernel/asm-offsets.c
> index cdd8f095c30c..5e1f412e96ba 100644
> --- a/arch/riscv/kernel/asm-offsets.c
> +++ b/arch/riscv/kernel/asm-offsets.c
> @@ -43,8 +43,11 @@ void asm_offsets(void)
> #ifdef CONFIG_SHADOW_CALL_STACK
> OFFSET(TASK_TI_SCS_SP, task_struct, thread_info.scs_sp);
> #endif
> -
> OFFSET(TASK_TI_CPU_NUM, task_struct, thread_info.cpu);
> +#ifdef CONFIG_RISCV_USER_CFI
> + OFFSET(TASK_TI_CFI_STATUS, task_struct, thread_info.user_cfi_state);
> + OFFSET(TASK_TI_USER_SSP, task_struct,
> thread_info.user_cfi_state.user_shdw_stk);
> +#endif
> OFFSET(TASK_THREAD_F0, task_struct, thread.fstate.f[0]);
> OFFSET(TASK_THREAD_F1, task_struct, thread.fstate.f[1]);
> OFFSET(TASK_THREAD_F2, task_struct, thread.fstate.f[2]);
> diff --git a/arch/riscv/kernel/entry.S b/arch/riscv/kernel/entry.S
> index 63c3855ba80d..410659e2eadb 100644
> --- a/arch/riscv/kernel/entry.S
> +++ b/arch/riscv/kernel/entry.S
> @@ -49,6 +49,21 @@ SYM_CODE_START(handle_exception)
> REG_S x5, PT_T0(sp)
> save_from_x6_to_x31
>
> +#ifdef CONFIG_RISCV_USER_CFI
> + /*
> + * we need to save cfi status only when previous mode was U
> + */
> + csrr s2, CSR_STATUS
> + andi s2, s2, SR_SPP
> + bnez s2, skip_bcfi_save
> + /* load cfi status word */
> + lw s3, TASK_TI_CFI_STATUS(tp)
> + andi s3, s3, 1
> + beqz s3, skip_bcfi_save
> + csrr s3, CSR_SSP
> + REG_S s3, TASK_TI_USER_SSP(tp) /* save user ssp in thread_info */
> +skip_bcfi_save:
> +#endif
> /*
> * Disable user-mode memory access as it should only be set in the
> * actual user copy routines.
> @@ -141,6 +156,16 @@ SYM_CODE_START_NOALIGN(ret_from_exception)
> * structures again.
> */
> csrw CSR_SCRATCH, tp
> +
> +#ifdef CONFIG_RISCV_USER_CFI
> + lw s3, TASK_TI_CFI_STATUS(tp)
> + andi s3, s3, 1
> + beqz s3, skip_bcfi_resume
> + REG_L s3, TASK_TI_USER_SSP(tp) /* restore user ssp from thread struct */
> + csrw CSR_SSP, s3
> +skip_bcfi_resume:
> +#endif
> +
We shouldn't need any of this in the entry/exit code, at least as long as
the kernel itself is not using Zicfiss. ssp can keep its value in the
kernel and swap it on task switches. Our entry/exit code is rather short
and I'd like to keep it that way.
-s
> 1:
> REG_L a0, PT_STATUS(sp)
> /*
> --
> 2.43.0
>
>
> _______________________________________________
> linux-riscv mailing list
> linux-riscv@...ts.infradead.org
> http://lists.infradead.org/mailman/listinfo/linux-riscv
Powered by blists - more mailing lists