From patchwork Wed Apr 3 23:34:48 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Deepak Gupta X-Patchwork-Id: 13616764 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id 4DB5DCD128A for ; Wed, 3 Apr 2024 23:41:34 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 5FEFA6B0095; Wed, 3 Apr 2024 19:41:34 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id 5ADCF6B0099; Wed, 3 Apr 2024 19:41:34 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 44E6E6B009A; Wed, 3 Apr 2024 19:41:34 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0017.hostedemail.com [216.40.44.17]) by kanga.kvack.org (Postfix) with ESMTP id 293026B0095 for ; Wed, 3 Apr 2024 19:41:34 -0400 (EDT) Received: from smtpin06.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay04.hostedemail.com (Postfix) with ESMTP id BAE2B1A0476 for ; Wed, 3 Apr 2024 23:41:33 +0000 (UTC) X-FDA: 81969844866.06.2A28DD2 Received: from mail-pl1-f173.google.com (mail-pl1-f173.google.com [209.85.214.173]) by imf12.hostedemail.com (Postfix) with ESMTP id 0DEBB4000F for ; Wed, 3 Apr 2024 23:41:31 +0000 (UTC) Authentication-Results: imf12.hostedemail.com; dkim=pass header.d=rivosinc-com.20230601.gappssmtp.com header.s=20230601 header.b=GZw6l6IK; dmarc=none; spf=pass (imf12.hostedemail.com: domain of debug@rivosinc.com designates 209.85.214.173 as permitted sender) smtp.mailfrom=debug@rivosinc.com ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1712187692; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-transfer-encoding:content-transfer-encoding: in-reply-to:references:dkim-signature; bh=Rv0B5ns63COKymo1kiAr4r2DGtjIZSKU8HdFj+0IH40=; b=XpbuVLrpJfGhky+yAV8XYOiCYau1cRlt49efqeECHGKqt8QFIpa9xn74J1zSN4LBG4h3cG yHDsTb51rKidk88bkeWIr1Y1dr7ddTSEJcEBbesPb5wy1Oqdd2RU4/0uvVrnQ1tQdJfOd5 hyu0yE4EoArYh6/J/wkrwbmE1dLInns= ARC-Authentication-Results: i=1; imf12.hostedemail.com; dkim=pass header.d=rivosinc-com.20230601.gappssmtp.com header.s=20230601 header.b=GZw6l6IK; dmarc=none; spf=pass (imf12.hostedemail.com: domain of debug@rivosinc.com designates 209.85.214.173 as permitted sender) smtp.mailfrom=debug@rivosinc.com ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1712187692; a=rsa-sha256; cv=none; b=khuLVy3kDVtDK5eJYbvjubwncIRtp4Nya66qIwjHex/yBwRfOMgy3IOY1U9z9Cm0ip3hQm y3FGp6lX9iQQHS8KUYNtQ2xWGROpZhvY3AKY2g115oFQXhPuruhKa51cl7zXin5XUIh1PH U16nclTEXlY5xmVZWmzby7Gq8+sc9K4= Received: by mail-pl1-f173.google.com with SMTP id d9443c01a7336-1e24c889618so3315425ad.2 for ; Wed, 03 Apr 2024 16:41:31 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rivosinc-com.20230601.gappssmtp.com; s=20230601; t=1712187691; x=1712792491; darn=kvack.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=Rv0B5ns63COKymo1kiAr4r2DGtjIZSKU8HdFj+0IH40=; b=GZw6l6IKf9qUQa/vxxzyFa4cLb9q6pQRJfYPKaNQPQ6cEo/q1k3mZ7gxqzJn4a2UEa yNudzo+PsvWzPFqVx8+9D1k8XODXSSLV2FriiL7D+mZnwSp8wkSqT08TNBghFj1rqQ6Z STluRujWwQYRncl7664LygHO+T8bjdCy6HkbRTaLOXY32mzaZcpNRR52lJlvXihUlF9U 2wzYekBAPO5u1IFltIn4KiuR4fK3nmUFKiu/2xS8twF4sb4bB+U5MjfndbNqnpV7iSiP SFoM6UF58+EFmNSalo1yKBLyQ2OxUUjSqUBJu8Hku3hTGANsvP7td7QVmD2VALYZomzK wj8Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1712187691; x=1712792491; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=Rv0B5ns63COKymo1kiAr4r2DGtjIZSKU8HdFj+0IH40=; b=iYIucI8uf6EKNA5q8Wt+aCEMIeMPHTggAgf/be8d+x/SQvWKeP1B0nM4SuSY9oXN7T g5bWWJyIDr1o9XuZ/n3/Xp85K5ObiCMfcd2Xv60cKg8nSBrrljbyEenCyMXU18BFiiaT 0DH1HhrVxk7P5YC3jjNhkgP9QZc8GMb5/nWz7yD1NPBHUxqvyAfloiu3JB2PlAhnwcwf x0WDj+AUtZtlC5GSt8AURtmc6K33pxLVZ01Ejy1U+oVGmh4nD/lxzMWoOAI3olVgDul2 LBytQSxxjoPbP0BbfZhIhltDnGwqLbOq3f9vvqXuz7qrAPFmNj9CRibs6gMd6XgtHQfE UVSw== X-Forwarded-Encrypted: i=1; AJvYcCXqlBBFN+jrtkcPC7XuklvXzvPAMaqehFUF561NBfRckm8fPWSo9i/y+lp0y/1NAt1K9vDE2lTV/XiJkw4pIzMoX6U= X-Gm-Message-State: AOJu0YwtQgp52Ao3pf+8P5+2+TbZ+/93guY3E650/jZOXNKz/mmwlri/ HzYjEtVd1FCNhvLvCoudW0i8eK/3bD2eRhEa5AYJNG3sqVVlIgfHHxt7TTZvkiE= X-Google-Smtp-Source: AGHT+IG0BMforFKG/Z+mj8l+gwmdkHRGf0wkX6Dm3/AG2fDf6ErYVT/6uGhIGHy46uRoq1WTT9/6ig== X-Received: by 2002:a17:902:c402:b0:1dd:c953:cfa0 with SMTP id k2-20020a170902c40200b001ddc953cfa0mr1051389plk.48.1712187690540; Wed, 03 Apr 2024 16:41:30 -0700 (PDT) Received: from debug.ba.rivosinc.com ([64.71.180.162]) by smtp.gmail.com with ESMTPSA id b18-20020a170902d51200b001deeac592absm13899117plg.180.2024.04.03.16.41.28 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 03 Apr 2024 16:41:30 -0700 (PDT) From: Deepak Gupta To: paul.walmsley@sifive.com, rick.p.edgecombe@intel.com, broonie@kernel.org, Szabolcs.Nagy@arm.com, kito.cheng@sifive.com, keescook@chromium.org, ajones@ventanamicro.com, conor.dooley@microchip.com, cleger@rivosinc.com, atishp@atishpatra.org, alex@ghiti.fr, bjorn@rivosinc.com, alexghiti@rivosinc.com, samuel.holland@sifive.com, conor@kernel.org Cc: linux-doc@vger.kernel.org, linux-riscv@lists.infradead.org, linux-kernel@vger.kernel.org, devicetree@vger.kernel.org, linux-mm@kvack.org, linux-arch@vger.kernel.org, linux-kselftest@vger.kernel.org, corbet@lwn.net, palmer@dabbelt.com, aou@eecs.berkeley.edu, robh+dt@kernel.org, krzysztof.kozlowski+dt@linaro.org, oleg@redhat.com, akpm@linux-foundation.org, arnd@arndb.de, ebiederm@xmission.com, Liam.Howlett@oracle.com, vbabka@suse.cz, lstoakes@gmail.com, shuah@kernel.org, brauner@kernel.org, debug@rivosinc.com, andy.chiu@sifive.com, jerry.shih@sifive.com, hankuan.chen@sifive.com, greentime.hu@sifive.com, evan@rivosinc.com, xiao.w.wang@intel.com, charlie@rivosinc.com, apatel@ventanamicro.com, mchitale@ventanamicro.com, dbarboza@ventanamicro.com, sameo@rivosinc.com, shikemeng@huaweicloud.com, willy@infradead.org, vincent.chen@sifive.com, guoren@kernel.org, samitolvanen@google.com, songshuaishuai@tinylab.org, gerg@kernel.org, heiko@sntech.de, bhe@redhat.com, jeeheng.sia@starfivetech.com, cyy@cyyself.name, maskray@google.com, ancientmodern4@gmail.com, mathis.salmen@matsal.de, cuiyunhui@bytedance.com, bgray@linux.ibm.com, mpe@ellerman.id.au, baruch@tkos.co.il, alx@kernel.org, david@redhat.com, catalin.marinas@arm.com, revest@chromium.org, josh@joshtriplett.org, shr@devkernel.io, deller@gmx.de, omosnace@redhat.com, ojeda@kernel.org, jhubbard@nvidia.com Subject: [PATCH v3 00/29] riscv control-flow integrity for usermode Date: Wed, 3 Apr 2024 16:34:48 -0700 Message-ID: <20240403234054.2020347-1-debug@rivosinc.com> X-Mailer: git-send-email 2.43.2 MIME-Version: 1.0 X-Rspam-User: X-Rspamd-Server: rspam12 X-Rspamd-Queue-Id: 0DEBB4000F X-Stat-Signature: hh5nhtsjnze1jprcxtn3beoonehs7o3k X-HE-Tag: 1712187691-892786 X-HE-Meta: U2FsdGVkX1/XueBBneDzviffvm+4vUVtWVvfTaCGUXkxN49BcQ5/1QPX4SCeZgcoVxk6aZBT8V10R3lyOhIZLSrypZofufT9jb2Bnd186pc45a5s3d1EX0wtnUzYDRdKgblzeRNcs5oRF0XhS0IN4bICQPxw7w7zmrRaCKRTxBcj3Yhr2aykPNkp7DWyNWXA2xFrJkY2DF0I98QmE+/evI1DH2iFWU/6wAmnRd0dv5lP5oHESc8drqln21JBzP8XDknpc3OINkRXJLEeQHAXL3Nc8QUWhAPWGD8Wxk7Qn3Fx9prhupGxdWqMVAtQnk4mf1O3E8Q6vDapM4xx9kjQ1hwEXjjGIAhZrpxXe9Xr8KC1VvUgthGJKwJhcCmAtgVhiZZL5rTLLa/dmvKO8LnD7cLx6zvkaCObUQUMm7Blen+XPMwHbqbJJsZM47032psQs5KYCDPAwF5IwPcqOht4YHcMcBQu6m3b+EqOkROQ5huB4QoKj06aMo0eD16LI4gdSxdzmXokf2bzoOMUSc9CFmwbgE9tvki38XweZckGa0WGFvfWHveuCIYemL55I+ebcldvaTXhcbcu/g9exhkkap53uc+thOmuF85cVkcS/crj59QROUUX5dWM5J9APBxYWu37mdOWFNDJ3K0ArJ84F/VwBkKk9Uh6XtnN7zPcZRolO0Ghs+HLZLCyFDYpxfCcXXkWcqEJwSYkxn70FQesPyJSjoEND+Lt86lMjxrXHiki73Z2WjhF/9rWUurJ2f9DFdHoCjxLY4bkqYM1Mte0MtaGObKi33wmjMaShpDXs4TpsKM3A0WEuzl3qhTO+CblE9qTUgwyFUxE0tlK7aEqZIoQWzbphx7fACVY04zDV3+ZpFuZnC5bF1OQPNn0TvZecsnOlw84+zmxgexdIKaCQiw5eaB3vL1Dlg+mNuzJaNrshh0oIG4pdh6UMw4lx9q20SqRr9c3iZXoJTWxSOo 5nQ11jFh A8Z85Q9Y3+XjZmni3UfjCtHshAyl1X1PvgjRCZoSrdW5Xt8/zKjef7YrwnV9orx0UdxQHi3dNgEZvDbyJ1L7AdtlbkZE2sTv6/4w8vLoxOrOcR/3252f77vd+2VC5BC1Ilm6a/Ju8Poqxu93VwrVJnbqdZDprYCwT8rTHOKGtMEOJ3XwGyH+cbA3svxF+JjM+vV6ySNxFDjImVK13cnxCNHKJaEYzhktKmPlX2y2NEfU3Xpk= X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: List-Subscribe: List-Unsubscribe: Sending out v3 for cpu assisted riscv user mode control flow integrity. v2 [9] was sent a week ago for this riscv usermode control flow integrity enabling. RFC patchset was (v1) early this year (January) [7]. changes in v3 -------------- envcfg: logic to pick up base envcfg had a bug where `ENVCFG_CBZE` could have been picked on per task basis, even though CPU didn't implement it. Fixed in this series. dt-bindings: As suggested, split into separate commit. fixed the messaging that spec is in public review arch_is_shadow_stack change: arch_is_shadow_stack changed to vma_is_shadow_stack hwprobe: zicfiss / zicfilp if present will get enumerated in hwprobe selftests: As suggested, added object and binary filenames to .gitignore Selftest binary anyways need to be compiled with cfi enabled compiler which will make sure that landing pad and shadow stack are enabled. Thus removed separate enable/disable tests. Cleaned up tests a bit. changes in v2 --------------- As part of testing effort, compiled a rootfs with shadow stack and landing pad enabled (libraries and binaries) and booted to shell. As part of long running tests, I have been able to run some spec 2006 benchmarks [8] (here link is provided only for list of benchmarks that were tested for long running tests, excel sheet provided here actually is for some static stats like code size growth on spec binaries). Thus converting from RFC to regular patchset. Securing control-flow integrity for usermode requires following - Securing forward control flow : All callsites must reach reach a target that they actually intend to reach. - Securing backward control flow : All function returns must return to location where they were called from. This patch series use riscv cpu extension `zicfilp` [2] to secure forward control flow and `zicfiss` [2] to secure backward control flow. `zicfilp` enforces that all indirect calls or jmps must land on a landing pad instr and label embedded in landing pad instr must match a value programmed in `x7` register (at callsite via compiler). `zicfiss` introduces shadow stack which can only be writeable via shadow stack instructions (sspush and ssamoswap) and thus can't be tampered with via inadvertent stores. More details about extension can be read from [2] and there are details in documentation as well (in this patch series). Using config `CONFIG_RISCV_USER_CFI`, kernel support for riscv control flow integrity for user mode programs can be compiled in the kernel. Enabling of control flow integrity for user programs is left to user runtime (specifically expected from dynamic loader). There has been a lot of earlier discussion on the enabling topic around x86 shadow stack enabling [3, 4, 5] and overall consensus had been to let dynamic loader (or usermode) to decide for enabling the feature. This patch series introduces arch agnostic `prctls` to enable shadow stack and indirect branch tracking. And implements them on riscv. arm64 is expected to implement shadow stack part of these arch agnostic `prctls` [6] Changes since last time *********************** Spec changes ------------ - Forward cfi spec has become much simpler. `lpad` instruction is pseudo for `auipc rd, <20bit_imm>`. `lpad` checks x7 against 20bit embedded in instr. Thus label width is 20bit. - Shadow stack management instructions are reduced to sspush - to push x1/x5 on shadow stack sspopchk - pops from shadow stack and comapres with x1/x5. ssamoswap - atomically swap value on shadow stack. rdssp - reads current shadow stack pointer - Shadow stack accesses on readonly memory always raise AMO/store page fault. `sspopchk` is load but if underlying page is readonly, it'll raise a store page fault. It simplifies hardware and kernel for COW handling for shadow stack pages. - riscv defines a new exception type `software check exception` and control flow violations raise software check exception. - enabling controls for shadow stack and landing are in xenvcfg CSR and controls lower privilege mode enabling. As an example senvcfg controls enabling for U and menvcfg controls enabling for S mode. core mm shadow stack enabling ----------------------------- Shadow stack for x86 usermode are now in mainline and thus this patch series builds on top of that for arch-agnostic mm related changes. Big thanks and shout out to Rick Edgecombe for that. selftests --------- Created some minimal selftests to test the patch series. [1] - https://lore.kernel.org/lkml/20230213045351.3945824-1-debug@rivosinc.com/ [2] - https://github.com/riscv/riscv-cfi [3] - https://lore.kernel.org/lkml/ZWHcBq0bJ+15eeKs@finisterre.sirena.org.uk/T/#mb121cd8b33d564e64234595a0ec52211479cf474 [4] - https://lore.kernel.org/all/20220130211838.8382-1-rick.p.edgecombe@intel.com/ [5] - https://lore.kernel.org/lkml/CAHk-=wgP5mk3poVeejw16Asbid0ghDt4okHnWaWKLBkRhQntRA@mail.gmail.com/ [6] - https://lore.kernel.org/linux-mm/20231122-arm64-gcs-v7-2-201c483bd775@kernel.org/ [7] - https://lore.kernel.org/lkml/20240125062739.1339782-1-debug@rivosinc.com/ [8] - https://docs.google.com/spreadsheets/d/1_cHGH4ctNVvFRiS7hW9dEGKtXLAJ3aX4Z_iTSa3Tw2U/edit#gid=0 [9] - https://lore.kernel.org/lkml/20240329044459.3990638-1-debug@rivosinc.com/