[RFC PATCH v1 28/28] kselftest/riscv: kselftest for user mode cfi

From: Deepak Gupta Adds kselftest for RISC-V control flow integrity implementation for user mode. There is not a lot going on in kernel for enabling landing pad for user mode. Thus kselftest simply enables landing pad for the binary and a signal handler is registered for SIGSEGV. Any control flow

[RFC PATCH v1 27/28] riscv: Documentation for shadow stack on riscv

From: Deepak Gupta Adding documentation on shadow stack for user mode on riscv and kernel interfaces exposed so that user tasks can enable it. Signed-off-by: Deepak Gupta --- Documentation/arch/riscv/zicfiss.rst | 169 +++ 1 file changed, 169 insertions(+) create mode

[RFC PATCH v1 26/28] riscv: Documentation for landing pad / indirect branch tracking

From: Deepak Gupta Adding documentation on landing pad aka indirect branch tracking on riscv and kernel interfaces exposed so that user tasks can enable it. Signed-off-by: Deepak Gupta --- Documentation/arch/riscv/zicfilp.rst | 104 +++ 1 file changed, 104 insertions(+)

[RFC PATCH v1 25/28] riscv/ptrace: riscv cfi status and state via ptrace and in core files

From: Deepak Gupta Expose a new register type NT_RISCV_USER_CFI for risc-v cfi status and state. Intentionally both landing pad and shadow stack status and state are rolled into cfi state. Creating two different NT_RISCV_USER_XXX would not be useful and wastage of a note type. Enabling or disabli

[RFC PATCH v1 24/28] riscv: select config for shadow stack and landing pad instr support

From: Deepak Gupta This patch selects config shadow stack support and landing pad instr support. Shadow stack support and landing instr support is hidden behind `CONFIG_RISCV_USER_CFI`. Selecting `CONFIG_RISCV_USER_CFI` wires up path to enumerate CPU support and if cpu support exists, kernel will

[RFC PATCH v1 23/28] riscv signal: Save and restore of shadow stack for signal

From: Deepak Gupta Save shadow stack pointer in sigcontext structure while delivering signal. Restore shadow stack pointer from sigcontext on sigreturn. Signed-off-by: Deepak Gupta --- arch/riscv/include/asm/usercfi.h | 18 arch/riscv/kernel/signal.c | 45 +++

[RFC PATCH v1 22/28] riscv sigcontext: adding cfi state field in sigcontext

From: Deepak Gupta Shadow stack needs to be saved and restored on signal delivery and signal return. sigcontext embedded in ucontext is extendible. Adding cfi state in there which can be used to save cfi state before signal delivery and restore cfi state on sigreturn Signed-off-by: Deepak Gupta

[RFC PATCH v1 21/28] riscv/traps: Introduce software check exception

From: Deepak Gupta zicfiss / zicfilp introduces a new exception to priv isa `software check exception` with cause code = 18. This patch implements software check exception. Additionally it implements a cfi violation handler which checks for code in xtval If xtval=2, it means that sw check excep

[RFC PATCH v1 20/28] riscv: Implements arch argnostic indirect branch tracking prctls

From: Deepak Gupta prctls implemented are PR_SET_INDIR_BR_LP_STATUS / PR_GET_INDIR_BR_LP_STATUS and PR_LOCK_INDIR_BR_LP_STATUS. Signed-off-by: Deepak Gupta --- arch/riscv/include/asm/usercfi.h | 17 +++- arch/riscv/kernel/usercfi.c | 74 2 files change

[RFC PATCH v1 19/28] riscv: Implements arch agnostic shadow stack prctls

From: Deepak Gupta Implement architecture agnostic prctls() interface for setting and getting shadow stack status. prctls implemented are PR_GET_SHADOW_STACK_STATUS, PR_SET_SHADOW_STACK_STATUS and PR_LOCK_SHADOW_STACK_STATUS. As part of PR_SET_SHADOW_STACK_STATUS/PR_GET_SHADOW_STACK_STATUS, onl

[RFC PATCH v1 18/28] prctl: arch-agnostic prtcl for indirect branch tracking

From: Deepak Gupta Three architectures (x86, aarch64, riscv) have support for indirect branch tracking feature in a very similar fashion. On a very high level, indirect branch tracking is a CPU feature where CPU tracks branches which uses memory operand to perform control transfer in program. As

[RFC PATCH v1 17/28] prctl: arch-agnostic prctl for shadow stack

From: Mark Brown Three architectures (x86, aarch64, riscv) have announced support for shadow stacks with fairly similar functionality. While x86 is using arch_prctl() to control the functionality neither arm64 nor riscv uses that interface so this patch adds arch-agnostic prctl() support to get

[RFC PATCH v1 16/28] riscv/shstk: If needed allocate a new shadow stack on clone

From: Deepak Gupta Userspace specifies VM_CLONE to share address space and spawn new thread. `clone` allow userspace to specify a new stack for new thread. However there is no way to specify new shadow stack base address without changing API. This patch allocates a new shadow stack whenever VM_CL

[RFC PATCH v1 15/28] riscv/mm: Implement map_shadow_stack() syscall

From: Deepak Gupta As discussed extensively in the changelog for the addition of this syscall on x86 ("x86/shstk: Introduce map_shadow_stack syscall") the existing mmap() and madvise() syscalls do not map entirely well onto the security requirements for guarded control stacks since they lead to w

[RFC PATCH v1 14/28] riscv mmu: write protect and shadow stack

From: Deepak Gupta `fork` implements copy on write (COW) by making pages readonly in child and parent both. ptep_set_wrprotect and pte_wrprotect clears _PAGE_WRITE in PTE. Assumption is that page is readable and on fault copy on write happens. To implement COW on such pages, clearing up W bit m

[RFC PATCH v1 13/28] riscv mmu: teach pte_mkwrite to manufacture shadow stack PTEs

From: Deepak Gupta pte_mkwrite creates PTEs with WRITE encodings for underlying arch. Underlying arch can have two types of writeable mappings. One that can be written using regular store instructions. Another one that can only be written using specialized store instructions (like shadow stack s

[RFC PATCH v1 12/28] riscv mm: manufacture shadow stack pte

From: Deepak Gupta This patch implements creating shadow stack pte (on riscv). Creating shadow stack PTE on riscv means that clearing RWX and then setting W=1. Signed-off-by: Deepak Gupta --- arch/riscv/include/asm/pgtable.h | 12 1 file changed, 12 insertions(+) diff --git a/arc

[RFC PATCH v1 11/28] riscv: Implementing "PROT_SHADOWSTACK" on riscv

From: Deepak Gupta This patch implements new risc-v specific protection flag `PROT_SHADOWSTACK` (only for kernel) on riscv. `PROT_SHADOWSTACK` protection flag is only limited to kernel and not exposed to userspace. Shadow stack is a security construct to prevent against ROP attacks. `map_shadow

[RFC PATCH v1 10/28] riscv/mm : Introducing new protection flag "PROT_SHADOWSTACK"

From: Deepak Gupta x86 and arm64 are using VM_SHADOW_STACK (which actually is VM_HIGH_ARCH_5) vma flag and thus restrict it to 64bit implementation only. RISC-V is choosing to encode presence of only VM_WRITE in vma flags as shadow stack vma. This allows 32bit RISC-V ecosystem leverage shadow st

[RFC PATCH v1 09/28] mm: abstract shadow stack vma behind `arch_is_shadow_stack`

From: Deepak Gupta x86 has used VM_SHADOW_STACK (alias to VM_HIGH_ARCH_5) to encode shadow stack VMA. VM_SHADOW_STACK is thus not possible on 32bit. Some arches may need a way to encode shadow stack on 32bit and 64bit both and they may encode this information differently in VMAs. This patch chan

[RFC PATCH v1 08/28] mm: Define VM_SHADOW_STACK for RISC-V

From: Deepak Gupta VM_SHADOW_STACK is defined by x86 as vm flag to mark a shadow stack vma. x86 uses VM_HIGH_ARCH_5 bit but that limits shadow stack vma to 64bit only. arm64 follows same path https://lore.kernel.org/lkml/20231009-arm64-gcs-v6-12-78e55deaa...@kernel.org/#r On RISC-V, write-only

[RFC PATCH v1 07/28] riscv: kernel handling on trap entry/exit for user cfi

From: Deepak Gupta Carves out space in arch specific thread struct for cfi status and shadow stack in usermode on riscv. This patch does following - defines a new structure cfi_status with status bit for cfi feature - defines shadow stack pointer, base and size in cfi_status structure - defines

[RFC PATCH v1 06/28] riscv: zicfiss/zicfilp extension csr and bit definitions

From: Deepak Gupta zicfiss and zicfilp extension gets enabled via b3 and b2 in xenvcfg CSR. menvcfg controls enabling for S/HS mode. henvcfg control enabling for VS while senvcfg controls enabling for U/VU mode. zicfilp extension extends xstatus CSR to hold `expected landing pad` bit. A trap or

[RFC PATCH v1 05/28] riscv: zicfiss/zicfilp enumeration

From: Deepak Gupta This patch adds support for detecting zicfiss and zicfilp. zicfiss and zicfilp stands for unprivleged integer spec extension for shadow stack and branch tracking on indirect branches, respectively. This patch looks for zicfiss and zicfilp in device tree and accordinlgy lights

[RFC PATCH v1 04/28] riscv/Kconfig: enable HAVE_EXIT_THREAD for riscv

From: Deepak Gupta riscv will need an implementation for exit_thread to clean up shadow stack when thread exits. If current thread had shadow stack enabled, shadow stack is allocated by default for any new thread. Signed-off-by: Deepak Gupta --- arch/riscv/Kconfig | 1 + arch/riscv/ke

[RFC PATCH v1 03/28] riscv: define default value for envcfg

From: Deepak Gupta Defines a base default value for envcfg per task. By default all tasks should have cache zeroing capability. Any future capabilities can be turned on. Signed-off-by: Deepak Gupta --- arch/riscv/include/asm/csr.h | 2 ++ arch/riscv/kernel/process.c | 1 + 2 files changed, 3

[RFC PATCH v1 02/28] riscv: envcfg save and restore on trap entry/exit

From: Deepak Gupta envcfg CSR defines enabling bits for cache management instructions and soon will control enabling for control flow integrity and pointer masking features. Control flow integrity enabling for forward cfi and backward cfi is controlled via envcfg and thus need to be enabled on p

[RFC PATCH v1 01/28] riscv: abstract envcfg CSR

From: Deepak Gupta This patch abstracts envcfg CSR in kernel (as is done for other homonyn CSRs). CSR_ENVCFG is used as alias for CSR_SENVCFG or CSR_MENVCFG depending on how kernel is compiled. Additionally it changes CBZE enabling to start using CSR_ENVCFG instead of CSR_SENVCFG. Signed-off-by

[RFC PATCH v1 00/28] riscv control-flow integrity for usermode

From: Deepak Gupta It's been almost an year since I posted my last patch series [1] to enable CPU assisted control-flow integrity for usermode on riscv. A lot has changed since then and so has the patches. It's been a while and since this is a reboot of series, starting with RFC and v1. Securing