| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-Id: <20250724-riscv_kcfi-v1-8-04b8fa44c98c@rivosinc.com>
Date: Thu, 24 Jul 2025 16:37:01 -0700
From: Deepak Gupta <debug@...osinc.com>
To: Paul Walmsley <paul.walmsley@...ive.com>,
Palmer Dabbelt <palmer@...belt.com>, Albert Ou <aou@...s.berkeley.edu>,
Alexandre Ghiti <alex@...ti.fr>, Masahiro Yamada <masahiroy@...nel.org>,
Nathan Chancellor <nathan@...nel.org>,
Nicolas Schier <nicolas.schier@...ux.dev>,
Andrew Morton <akpm@...ux-foundation.org>,
David Hildenbrand <david@...hat.com>,
Lorenzo Stoakes <lorenzo.stoakes@...cle.com>,
"Liam R. Howlett" <Liam.Howlett@...cle.com>,
Vlastimil Babka <vbabka@...e.cz>, Mike Rapoport <rppt@...nel.org>,
Suren Baghdasaryan <surenb@...gle.com>, Michal Hocko <mhocko@...e.com>,
Nick Desaulniers <nick.desaulniers+lkml@...il.com>,
Bill Wendling <morbo@...gle.com>, Monk Chiang <monk.chiang@...ive.com>,
Kito Cheng <kito.cheng@...ive.com>, Justin Stitt <justinstitt@...gle.com>
Cc: linux-riscv@...ts.infradead.org, linux-kernel@...r.kernel.org,
linux-kbuild@...r.kernel.org, linux-mm@...ck.org, llvm@...ts.linux.dev,
rick.p.edgecombe@...el.com, broonie@...nel.org, cleger@...osinc.com,
samitolvanen@...gle.com, apatel@...tanamicro.com, ajones@...tanamicro.com,
conor.dooley@...rochip.com, charlie@...osinc.com, samuel.holland@...ive.com,
bjorn@...osinc.com, fweimer@...hat.com, jeffreyalaw@...il.com,
heinrich.schuchardt@...onical.com, andrew@...ive.com, ved@...osinc.com,
Deepak Gupta <debug@...osinc.com>
Subject: [PATCH 08/11] riscv/mm: prepare shadow stack for init task
With CONFIG_SHADOW_CALL_STACK, shadow call stack goes into data section.
CONFIG_ARCH_HAS_KERNEL_SHADOW_STACK indicates hardware assisted shadow
stack are used. Hardware assisted shadow stack on riscv uses PTE.R=0, PTE.W=1
& PTE.X=0 encodings. Without CONFIG_ARCH_HAS_KERNEL_SHADOW_STACK, shadow stack
for init is placed in data section and thus regular read/write encodings are
applied to it. Although with CONFIG_ARCH_HAS_KERNEL_SHADOW_STACK, they need to
go into different section. This change places it into `.shadowstack` section.
As part of this change early boot code (`setup_vm`), applies appropriate
PTE encodings to shadow call stack for init placed in `.shadowstack`
section.
Signed-off-by: Deepak Gupta <debug@...osinc.com>
---
arch/riscv/include/asm/pgtable.h | 4 ++++
arch/riscv/include/asm/sections.h | 22 ++++++++++++++++++++++
arch/riscv/include/asm/thread_info.h | 10 ++++++++--
arch/riscv/kernel/vmlinux.lds.S | 12 ++++++++++++
arch/riscv/mm/init.c | 29 ++++++++++++++++++++++-------
5 files changed, 68 insertions(+), 9 deletions(-)
diff --git a/arch/riscv/include/asm/pgtable.h b/arch/riscv/include/asm/pgtable.h
index f04f3da881c9..bb80667d3c13 100644
--- a/arch/riscv/include/asm/pgtable.h
+++ b/arch/riscv/include/asm/pgtable.h
@@ -202,6 +202,10 @@ extern struct pt_alloc_ops pt_ops __meminitdata;
#define PAGE_KERNEL_READ_EXEC __pgprot((_PAGE_KERNEL & ~_PAGE_WRITE) \
| _PAGE_EXEC)
+#ifdef CONFIG_ARCH_HAS_KERNEL_SHADOW_STACK
+#define PAGE_KERNEL_SHADOWSTACK __pgprot(_PAGE_KERNEL & ~(_PAGE_READ | _PAGE_EXEC))
+#endif
+
#define PAGE_TABLE __pgprot(_PAGE_TABLE)
#define _PAGE_IOREMAP ((_PAGE_KERNEL & ~_PAGE_MTMASK) | _PAGE_IO)
diff --git a/arch/riscv/include/asm/sections.h b/arch/riscv/include/asm/sections.h
index a393d5035c54..ae7c6fcbaaeb 100644
--- a/arch/riscv/include/asm/sections.h
+++ b/arch/riscv/include/asm/sections.h
@@ -14,6 +14,10 @@ extern char __init_data_begin[], __init_data_end[];
extern char __init_text_begin[], __init_text_end[];
extern char __alt_start[], __alt_end[];
extern char __exittext_begin[], __exittext_end[];
+#ifdef CONFIG_ARCH_HAS_KERNEL_SHADOW_STACK
+extern char __init_shstk_start[], __init_shstk_end[];
+#endif
+extern char __end_srodata[];
static inline bool is_va_kernel_text(uintptr_t va)
{
@@ -31,4 +35,22 @@ static inline bool is_va_kernel_lm_alias_text(uintptr_t va)
return va >= start && va < end;
}
+#ifdef CONFIG_ARCH_HAS_KERNEL_SHADOW_STACK
+static inline bool is_va_init_shadow_stack_early(uintptr_t va)
+{
+ uintptr_t start = (uintptr_t)(kernel_mapping_pa_to_va(__init_shstk_start));
+ uintptr_t end = (uintptr_t)(kernel_mapping_pa_to_va(__init_shstk_end));
+
+ return va >= start && va < end;
+}
+
+static inline bool is_va_init_shadow_stack(uintptr_t va)
+{
+ uintptr_t start = (uintptr_t)(__init_shstk_start);
+ uintptr_t end = (uintptr_t)(__init_shstk_end);
+
+ return va >= start && va < end;
+}
+#endif
+
#endif /* __ASM_SECTIONS_H */
diff --git a/arch/riscv/include/asm/thread_info.h b/arch/riscv/include/asm/thread_info.h
index e066f41176ca..5bcc62cf5a0a 100644
--- a/arch/riscv/include/asm/thread_info.h
+++ b/arch/riscv/include/asm/thread_info.h
@@ -79,12 +79,18 @@ struct thread_info {
};
#ifdef CONFIG_SHADOW_CALL_STACK
+#ifdef CONFIG_ARCH_HAS_KERNEL_SHADOW_STACK
#define INIT_SCS \
- .scs_base = init_shadow_call_stack, \
+ .scs_base = init_shadow_call_stack, \
+ .scs_sp = &init_shadow_call_stack[SCS_SIZE / sizeof(long)],
+#else
+#define INIT_SCS \
+ .scs_base = init_shadow_call_stack, \
.scs_sp = init_shadow_call_stack,
+#endif /* CONFIG_ARCH_HAS_KERNEL_SHADOW_STACK */
#else
#define INIT_SCS
-#endif
+#endif /* CONFIG_SHADOW_CALL_STACK */
/*
* macros/functions for gaining access to the thread information structure
diff --git a/arch/riscv/kernel/vmlinux.lds.S b/arch/riscv/kernel/vmlinux.lds.S
index 61bd5ba6680a..e65c0c099ed0 100644
--- a/arch/riscv/kernel/vmlinux.lds.S
+++ b/arch/riscv/kernel/vmlinux.lds.S
@@ -129,6 +129,18 @@ SECTIONS
*(.srodata*)
}
+ . = ALIGN(SECTION_ALIGN);
+ __end_srodata = .;
+
+#ifdef CONFIG_ARCH_HAS_KERNEL_SHADOW_STACK
+ .shadowstack : AT(ADDR(.shadowstack) - LOAD_OFFSET){
+ __init_shstk_start = .;
+ KEEP(*(.shadowstack..init))
+ . = __init_shstk_start + PAGE_SIZE;
+ __init_shstk_end = .;
+ }
+#endif
+
. = ALIGN(SECTION_ALIGN);
_data = .;
diff --git a/arch/riscv/mm/init.c b/arch/riscv/mm/init.c
index 1af3c0bc6abe..dba1cf3f8dfc 100644
--- a/arch/riscv/mm/init.c
+++ b/arch/riscv/mm/init.c
@@ -794,14 +794,22 @@ static __meminit pgprot_t pgprot_from_va(uintptr_t va)
if (IS_ENABLED(CONFIG_64BIT) && is_va_kernel_lm_alias_text(va))
return PAGE_KERNEL_READ;
+#ifdef CONFIG_ARCH_HAS_KERNEL_SHADOW_STACK
+ /* If init task's shadow stack va, return write only page protections */
+ if (IS_ENABLED(CONFIG_64BIT) && is_va_init_shadow_stack(va)) {
+ pr_info("Shadow stack protections are being applied to for init\n");
+ return PAGE_KERNEL_SHADOWSTACK;
+ }
+#endif
+
return PAGE_KERNEL;
}
void mark_rodata_ro(void)
{
- set_kernel_memory(__start_rodata, _data, set_memory_ro);
+ set_kernel_memory(__start_rodata, __end_srodata, set_memory_ro);
if (IS_ENABLED(CONFIG_64BIT))
- set_kernel_memory(lm_alias(__start_rodata), lm_alias(_data),
+ set_kernel_memory(lm_alias(__start_rodata), lm_alias(__end_srodata),
set_memory_ro);
}
#else
@@ -959,14 +967,21 @@ static void __init create_kernel_page_table(pgd_t *pgdir,
static void __init create_kernel_page_table(pgd_t *pgdir, bool early)
{
uintptr_t va, end_va;
+ pgprot_t prot;
end_va = kernel_map.virt_addr + kernel_map.size;
- for (va = kernel_map.virt_addr; va < end_va; va += PMD_SIZE)
+ for (va = kernel_map.virt_addr; va < end_va; va += PMD_SIZE) {
+ prot = PAGE_KERNEL_EXEC;
+#ifdef CONFIG_ARCH_HAS_KERNEL_SHADOW_STACK
+ if (early && is_va_init_shadow_stack_early(va))
+ prot = PAGE_KERNEL_SHADOWSTACK;
+#endif
create_pgd_mapping(pgdir, va,
- kernel_map.phys_addr + (va - kernel_map.virt_addr),
- PMD_SIZE,
- early ?
- PAGE_KERNEL_EXEC : pgprot_from_va(va));
+ kernel_map.phys_addr + (va - kernel_map.virt_addr),
+ PMD_SIZE,
+ early ?
+ prot : pgprot_from_va(va));
+ }
}
#endif
--
2.43.0
Powered by blists - more mailing lists