| Message ID | 20240329044459.3990638-1-debug@rivosinc.com |
|---|---|
| Headers | show |
| Series | riscv control-flow integrity for usermode | expand |
On Thu, Mar 28, 2024 at 9:46 PM Deepak Gupta <debug@rivosinc.com> wrote: > > pte_mkwrite creates PTEs with WRITE encodings for underlying arch. Underlying > arch can have two types of writeable mappings. One that can be written using > regular store instructions. Another one that can only be written using specialized > store instructions (like shadow stack stores). pte_mkwrite can select write PTE > encoding based on VMA range. > > On riscv, presence of only VM_WRITE in vma->vm_flags means it's a shadow stack. > > Signed-off-by: Deepak Gupta <debug@rivosinc.com> > > rebase with a30f0ca0fa31cdb2ac3d24b7b5be9e3ae75f4175 > hmm.. Note to self: Missed removing this lingering commit message. Will remove it in the next version.
On 3/29/24 9:44 AM, Deepak Gupta wrote: > Adds kselftest for RISC-V control flow integrity implementation for user > mode. There is not a lot going on in kernel for enabling landing pad for > user mode. Thus kselftest simply enables landing pad for the binary and > a signal handler is registered for SIGSEGV. Any control flow violation are > reported as SIGSEGV with si_code = SEGV_CPERR. Test will fail on recieving > any SEGV_CPERR. Shadow stack part has more changes in kernel and thus there > are separate tests for that > - enable and disable > - Exercise `map_shadow_stack` syscall > - `fork` test to make sure COW works for shadow stack pages > - gup tests > As of today kernel uses FOLL_FORCE when access happens to memory via > /proc/<pid>/mem. Not breaking that for shadow stack > - signal test. Make sure signal delivery results in token creation on > shadow stack and consumes (and verifies) token on sigreturn > - shadow stack protection test. attempts to write using regular store > instruction on shadow stack memory must result in access faults > > Signed-off-by: Deepak Gupta <debug@rivosinc.com> > --- > tools/testing/selftests/riscv/Makefile | 2 +- > tools/testing/selftests/riscv/cfi/Makefile | 10 + > .../testing/selftests/riscv/cfi/cfi_rv_test.h | 85 ++++ > .../selftests/riscv/cfi/riscv_cfi_test.c | 91 +++++ > .../testing/selftests/riscv/cfi/shadowstack.c | 376 ++++++++++++++++++ > .../testing/selftests/riscv/cfi/shadowstack.h | 39 ++ Please add generated binaries in the .gitignore files. > 6 files changed, 602 insertions(+), 1 deletion(-) > create mode 100644 tools/testing/selftests/riscv/cfi/Makefile > create mode 100644 tools/testing/selftests/riscv/cfi/cfi_rv_test.h > create mode 100644 tools/testing/selftests/riscv/cfi/riscv_cfi_test.c > create mode 100644 tools/testing/selftests/riscv/cfi/shadowstack.c > create mode 100644 tools/testing/selftests/riscv/cfi/shadowstack.h > > diff --git a/tools/testing/selftests/riscv/Makefile b/tools/testing/selftests/riscv/Makefile > index 4a9ff515a3a0..867e5875b7ce 100644 > --- a/tools/testing/selftests/riscv/Makefile > +++ b/tools/testing/selftests/riscv/Makefile > @@ -5,7 +5,7 @@ > ARCH ?= $(shell uname -m 2>/dev/null || echo not) > > ifneq (,$(filter $(ARCH),riscv)) > -RISCV_SUBTARGETS ?= hwprobe vector mm > +RISCV_SUBTARGETS ?= hwprobe vector mm cfi > else > RISCV_SUBTARGETS := > endif > diff --git a/tools/testing/selftests/riscv/cfi/Makefile b/tools/testing/selftests/riscv/cfi/Makefile > new file mode 100644 > index 000000000000..77f12157fa29 > --- /dev/null > +++ b/tools/testing/selftests/riscv/cfi/Makefile > @@ -0,0 +1,10 @@ > +CFLAGS += -I$(top_srcdir)/tools/include > + > +CFLAGS += -march=rv64gc_zicfilp_zicfiss > + > +TEST_GEN_PROGS := cfitests > + > +include ../../lib.mk > + > +$(OUTPUT)/cfitests: riscv_cfi_test.c shadowstack.c > + $(CC) -static -o$@ $(CFLAGS) $(LDFLAGS) $^ > diff --git a/tools/testing/selftests/riscv/cfi/cfi_rv_test.h b/tools/testing/selftests/riscv/cfi/cfi_rv_test.h > new file mode 100644 > index 000000000000..27267a2e1008 > --- /dev/null > +++ b/tools/testing/selftests/riscv/cfi/cfi_rv_test.h > @@ -0,0 +1,85 @@ > +/* SPDX-License-Identifier: GPL-2.0-only */ > + > +#ifndef SELFTEST_RISCV_CFI_H > +#define SELFTEST_RISCV_CFI_H > +#include <stddef.h> > +#include <sys/types.h> > +#include "shadowstack.h" > + > +#define RISCV_CFI_SELFTEST_COUNT RISCV_SHADOW_STACK_TESTS > + > +#define CHILD_EXIT_CODE_SSWRITE 10 > +#define CHILD_EXIT_CODE_SIG_TEST 11 > + > +#define BAD_POINTER (NULL) > + > +#define my_syscall5(num, arg1, arg2, arg3, arg4, arg5) \ > +({ \ > + register long _num __asm__ ("a7") = (num); \ > + register long _arg1 __asm__ ("a0") = (long)(arg1); \ > + register long _arg2 __asm__ ("a1") = (long)(arg2); \ > + register long _arg3 __asm__ ("a2") = (long)(arg3); \ > + register long _arg4 __asm__ ("a3") = (long)(arg4); \ > + register long _arg5 __asm__ ("a4") = (long)(arg5); \ > + \ > + __asm__ volatile ( \ > + "ecall\n" \ > + : "+r"(_arg1) \ > + : "r"(_arg2), "r"(_arg3), "r"(_arg4), "r"(_arg5), \ > + "r"(_num) \ > + : "memory", "cc" \ > + ); \ > + _arg1; \ > +}) > + > +#define my_syscall3(num, arg1, arg2, arg3) \ > +({ \ > + register long _num __asm__ ("a7") = (num); \ > + register long _arg1 __asm__ ("a0") = (long)(arg1); \ > + register long _arg2 __asm__ ("a1") = (long)(arg2); \ > + register long _arg3 __asm__ ("a2") = (long)(arg3); \ > + \ > + __asm__ volatile ( \ > + "ecall\n" \ > + : "+r"(_arg1) \ > + : "r"(_arg2), "r"(_arg3), \ > + "r"(_num) \ > + : "memory", "cc" \ > + ); \ > + _arg1; \ > +}) > + > +#ifndef __NR_prctl > +#define __NR_prctl 167 > +#endif > + > +#ifndef __NR_map_shadow_stack > +#define __NR_map_shadow_stack 453 > +#endif > + > +#define CSR_SSP 0x011 > + > +#ifdef __ASSEMBLY__ > +#define __ASM_STR(x) x > +#else > +#define __ASM_STR(x) #x > +#endif > + > +#define csr_read(csr) \ > +({ \ > + register unsigned long __v; \ > + __asm__ __volatile__ ("csrr %0, " __ASM_STR(csr) \ > + : "=r" (__v) : \ > + : "memory"); \ > + __v; \ > +}) > + > +#define csr_write(csr, val) \ > +({ \ > + unsigned long __v = (unsigned long) (val); \ > + __asm__ __volatile__ ("csrw " __ASM_STR(csr) ", %0" \ > + : : "rK" (__v) \ > + : "memory"); \ > +}) > + > +#endif > diff --git a/tools/testing/selftests/riscv/cfi/riscv_cfi_test.c b/tools/testing/selftests/riscv/cfi/riscv_cfi_test.c > new file mode 100644 > index 000000000000..c116ae4bb358 > --- /dev/null > +++ b/tools/testing/selftests/riscv/cfi/riscv_cfi_test.c > @@ -0,0 +1,91 @@ > +// SPDX-License-Identifier: GPL-2.0-only > + > +#include "../../kselftest.h" > +#include <signal.h> > +#include <asm/ucontext.h> > +#include <linux/prctl.h> > +#include "cfi_rv_test.h" > + > +/* do not optimize cfi related test functions */ > +#pragma GCC push_options > +#pragma GCC optimize("O0") > + > +#define SEGV_CPERR 10 /* control protection fault */ > + > +void sigsegv_handler(int signum, siginfo_t *si, void *uc) > +{ > + struct ucontext *ctx = (struct ucontext *) uc; > + > + if (si->si_code == SEGV_CPERR) { > + printf("Control flow violation happened somewhere\n"); > + printf("pc where violation happened %lx\n", ctx->uc_mcontext.gregs[0]); > + exit(-1); > + } > + > + /* null pointer deref */ > + if (si->si_addr == BAD_POINTER) > + exit(CHILD_EXIT_CODE_NULL_PTR_DEREF); > + > + /* shadow stack write case */ > + exit(CHILD_EXIT_CODE_SSWRITE); > +} > + > +int lpad_enable(void) > +{ > + int ret = 0; > + > + ret = my_syscall5(__NR_prctl, PR_SET_INDIR_BR_LP_STATUS, PR_INDIR_BR_LP_ENABLE, 0, 0, 0); > + > + return ret; > +} > + > +bool register_signal_handler(void) > +{ > + struct sigaction sa = {}; > + > + sa.sa_sigaction = sigsegv_handler; > + sa.sa_flags = SA_SIGINFO; > + if (sigaction(SIGSEGV, &sa, NULL)) { > + printf("registering signal handler for landing pad violation failed\n"); > + return false; > + } > + > + return true; > +} > + > +int main(int argc, char *argv[]) > +{ > + int ret = 0; > + unsigned long lpad_status = 0; > + > + ksft_print_header(); > + > + ksft_set_plan(RISCV_CFI_SELFTEST_COUNT); > + > + ksft_print_msg("starting risc-v tests\n"); > + > + /* > + * Landing pad test. Not a lot of kernel changes to support landing > + * pad for user mode except lighting up a bit in senvcfg via a prctl > + * Enable landing pad through out the execution of test binary > + */ > + ret = my_syscall5(__NR_prctl, PR_GET_INDIR_BR_LP_STATUS, &lpad_status, 0, 0, 0); > + if (ret) > + ksft_exit_skip("Get landing pad status failed with %d\n", ret); > + > + ret = lpad_enable(); > + > + if (ret) > + ksft_exit_skip("Enabling landing pad failed with %d\n", ret); > + > + if (!register_signal_handler()) > + ksft_exit_skip("registering signal handler for SIGSEGV failed\n"); > + > + ksft_print_msg("landing pad enabled for binary\n"); > + ksft_print_msg("starting risc-v shadow stack tests\n"); > + execute_shadow_stack_tests(); > + > + ksft_finished(); > +} > + > +#pragma GCC pop_options > diff --git a/tools/testing/selftests/riscv/cfi/shadowstack.c b/tools/testing/selftests/riscv/cfi/shadowstack.c > new file mode 100644 > index 000000000000..126654801bed > --- /dev/null > +++ b/tools/testing/selftests/riscv/cfi/shadowstack.c > @@ -0,0 +1,376 @@ > +// SPDX-License-Identifier: GPL-2.0-only > + > +#include "../../kselftest.h" > +#include <sys/wait.h> > +#include <signal.h> > +#include <fcntl.h> > +#include <unistd.h> > +#include <sys/mman.h> > +#include "shadowstack.h" > +#include "cfi_rv_test.h" > + > +/* do not optimize shadow stack related test functions */ > +#pragma GCC push_options > +#pragma GCC optimize("O0") > + > +void zar(void) > +{ > + unsigned long ssp = 0, swaped_val = 0; > + > + ssp = csr_read(CSR_SSP); > + printf("inside %s and shadow stack ptr is %lx\n", __func__, ssp); > +} > + > +void bar(void) > +{ > + printf("inside %s\n", __func__); > + zar(); > +} > + > +void foo(void) > +{ > + printf("inside %s\n", __func__); > + bar(); > +} > + > +void zar_child(void) > +{ > + unsigned long ssp = 0; > + > + ssp = csr_read(CSR_SSP); > + printf("inside %s and shadow stack ptr is %lx\n", __func__, ssp); > +} > + > +void bar_child(void) > +{ > + printf("inside %s\n", __func__); > + zar_child(); > +} > + > +void foo_child(void) > +{ > + printf("inside %s\n", __func__); > + bar_child(); > +} > + > +typedef void (call_func_ptr)(void); > +/* > + * call couple of functions to test push pop. > + */ > +int shadow_stack_call_tests(call_func_ptr fn_ptr, bool parent) > +{ > + if (parent) > + printf("call test for parent\n"); > + else > + printf("call test for child\n"); > + > + (fn_ptr)(); > + > + return 0; > +} > + > +bool enable_disable_check(unsigned long test_num, void *ctx) > +{ > + int ret = 0; > + > + if (!my_syscall5(__NR_prctl, PR_SET_SHADOW_STACK_STATUS, PR_SHADOW_STACK_ENABLE, 0, 0, 0)) { > + printf("Shadow stack was enabled\n"); > + shadow_stack_call_tests(&foo, true); > + > + ret = my_syscall5(__NR_prctl, PR_SET_SHADOW_STACK_STATUS, 0, 0, 0, 0); > + if (ret) > + ksft_test_result_fail("shadow stack disable failed\n"); > + } else { > + ksft_test_result_fail("shadow stack enable failed\n"); > + ret = -EINVAL; > + } > + > + return ret ? false : true; > +} > + > +/* forks a thread, and ensure shadow stacks fork out */ > +bool shadow_stack_fork_test(unsigned long test_num, void *ctx) > +{ > + int pid = 0, child_status = 0, parent_pid = 0; > + > + printf("exercising shadow stack fork test\n"); > + > + if (my_syscall5(__NR_prctl, PR_SET_SHADOW_STACK_STATUS, PR_SHADOW_STACK_ENABLE, 0, 0, 0)) { > + printf("shadow stack enable prctl failed\n"); > + return false; > + } > + > + parent_pid = getpid(); > + pid = fork(); > + > + if (pid) { > + printf("Parent pid %d and child pid %d\n", parent_pid, pid); > + shadow_stack_call_tests(&foo, true); > + } else > + shadow_stack_call_tests(&foo_child, false); > + > + if (pid) { > + printf("waiting on child to finish\n"); > + wait(&child_status); > + } else { > + /* exit child gracefully */ > + exit(0); > + } > + > + if (pid && WIFSIGNALED(child_status)) { > + printf("child faulted"); > + return false; > + } > + > + /* disable shadow stack again */ > + if (my_syscall5(__NR_prctl, PR_SET_SHADOW_STACK_STATUS, 0, 0, 0, 0)) { > + printf("shadow stack disable prctl failed\n"); > + return false; > + } > + > + return true; > +} > + > +/* exercise `map_shadow_stack`, pivot to it and call some functions to ensure it works */ > +#define SHADOW_STACK_ALLOC_SIZE 4096 > +bool shadow_stack_map_test(unsigned long test_num, void *ctx) > +{ > + unsigned long shdw_addr; > + int ret = 0; > + > + shdw_addr = my_syscall3(__NR_map_shadow_stack, NULL, SHADOW_STACK_ALLOC_SIZE, 0); > + > + if (((long) shdw_addr) <= 0) { > + printf("map_shadow_stack failed with error code %d\n", (int) shdw_addr); > + return false; > + } > + > + ret = munmap((void *) shdw_addr, SHADOW_STACK_ALLOC_SIZE); > + > + if (ret) { > + printf("munmap failed with error code %d\n", ret); > + return false; > + } > + > + return true; > +} > + > +/* > + * shadow stack protection tests. map a shadow stack and > + * validate all memory protections work on it > + */ > +bool shadow_stack_protection_test(unsigned long test_num, void *ctx) > +{ > + unsigned long shdw_addr; > + unsigned long *write_addr = NULL; > + int ret = 0, pid = 0, child_status = 0; > + > + shdw_addr = my_syscall3(__NR_map_shadow_stack, NULL, SHADOW_STACK_ALLOC_SIZE, 0); > + > + if (((long) shdw_addr) <= 0) { > + printf("map_shadow_stack failed with error code %d\n", (int) shdw_addr); > + return false; > + } > + > + write_addr = (unsigned long *) shdw_addr; > + pid = fork(); > + > + /* no child was created, return false */ > + if (pid == -1) > + return false; > + > + /* > + * try to perform a store from child on shadow stack memory > + * it should result in SIGSEGV > + */ > + if (!pid) { > + /* below write must lead to SIGSEGV */ > + *write_addr = 0xdeadbeef; > + } else { > + wait(&child_status); > + } > + > + /* test fail, if 0xdeadbeef present on shadow stack address */ > + if (*write_addr == 0xdeadbeef) { > + printf("write suceeded\n"); > + return false; > + } > + > + /* if child reached here, then fail */ > + if (!pid) { > + printf("child reached unreachable state\n"); > + return false; > + } > + > + /* if child exited via signal handler but not for write on ss */ > + if (WIFEXITED(child_status) && > + WEXITSTATUS(child_status) != CHILD_EXIT_CODE_SSWRITE) { > + printf("child wasn't signaled for write on shadow stack\n"); > + return false; > + } > + > + ret = munmap(write_addr, SHADOW_STACK_ALLOC_SIZE); > + if (ret) { > + printf("munmap failed with error code %d\n", ret); > + return false; > + } > + > + return true; > +} > + > +#define SS_MAGIC_WRITE_VAL 0xbeefdead > + > +int gup_tests(int mem_fd, unsigned long *shdw_addr) > +{ > + unsigned long val = 0; > + > + lseek(mem_fd, (unsigned long)shdw_addr, SEEK_SET); > + if (read(mem_fd, &val, sizeof(val)) < 0) { > + printf("reading shadow stack mem via gup failed\n"); > + return 1; > + } > + > + val = SS_MAGIC_WRITE_VAL; > + lseek(mem_fd, (unsigned long)shdw_addr, SEEK_SET); > + if (write(mem_fd, &val, sizeof(val)) < 0) { > + printf("writing shadow stack mem via gup failed\n"); > + return 1; > + } > + > + if (*shdw_addr != SS_MAGIC_WRITE_VAL) { > + printf("GUP write to shadow stack memory didn't happen\n"); > + return 1; > + } > + > + return 0; > +} > + > +bool shadow_stack_gup_tests(unsigned long test_num, void *ctx) > +{ > + unsigned long shdw_addr = 0; > + unsigned long *write_addr = NULL; > + int fd = 0; > + bool ret = false; > + > + shdw_addr = my_syscall3(__NR_map_shadow_stack, NULL, SHADOW_STACK_ALLOC_SIZE, 0); > + > + if (((long) shdw_addr) <= 0) { > + printf("map_shadow_stack failed with error code %d\n", (int) shdw_addr); > + return false; > + } > + > + write_addr = (unsigned long *) shdw_addr; > + > + fd = open("/proc/self/mem", O_RDWR); > + if (fd == -1) > + return false; > + > + if (gup_tests(fd, write_addr)) { > + printf("gup tests failed\n"); > + goto out; > + } > + > + ret = true; > +out: > + if (shdw_addr && munmap(write_addr, SHADOW_STACK_ALLOC_SIZE)) { > + printf("munmap failed with error code %d\n", ret); > + ret = false; > + } > + > + return ret; > +} > + > +volatile bool break_loop; > + > +void sigusr1_handler(int signo) > +{ > + printf("In sigusr1 handler\n"); > + break_loop = true; > +} > + > +bool sigusr1_signal_test(void) > +{ > + if (signal(SIGUSR1, sigusr1_handler) == SIG_ERR) { > + printf("registerting sigusr1 handler failed\n"); > + return false; > + } > + > + return true; > +} > +/* > + * shadow stack signal test. shadow stack must be enabled. > + * register a signal, fork another thread which is waiting > + * on signal. Send a signal from parent to child, verify > + * that signal was received by child. If not test fails > + */ > +bool shadow_stack_signal_test(unsigned long test_num, void *ctx) > +{ > + int pid = 0, child_status = 0; > + unsigned long ssp = 0; > + > + if (my_syscall5(__NR_prctl, PR_SET_SHADOW_STACK_STATUS, PR_SHADOW_STACK_ENABLE, 0, 0, 0)) { > + printf("shadow stack enable prctl failed\n"); > + return false; > + } > + > + pid = fork(); > + > + if (pid == -1) { > + printf("signal test: fork failed\n"); > + goto out; > + } > + > + if (pid == 0) { > + /* this should be caught by signal handler and do an exit */ > + if (!sigusr1_signal_test()) { > + printf("sigusr1_signal_test failed\n"); > + exit(-1); > + } > + > + while (!break_loop) > + sleep(1); > + > + exit(11); > + /* child shouldn't go beyond here */ > + } > + /* send SIGUSR1 to child */ > + kill(pid, SIGUSR1); > + wait(&child_status); > + > +out: > + if (my_syscall5(__NR_prctl, PR_SET_SHADOW_STACK_STATUS, 0, 0, 0, 0)) { > + printf("shadow stack disable prctl failed\n"); > + return false; > + } > + > + return (WIFEXITED(child_status) && > + WEXITSTATUS(child_status) == 11); > +} > + > +int execute_shadow_stack_tests(void) > +{ > + int ret = 0; > + unsigned long test_count = 0; > + unsigned long shstk_status = 0; > + > + printf("Executing RISC-V shadow stack self tests\n"); > + > + ret = my_syscall5(__NR_prctl, PR_GET_SHADOW_STACK_STATUS, &shstk_status, 0, 0, 0); > + > + if (ret != 0) > + ksft_exit_skip("Get shadow stack status failed with %d\n", ret); > + > + /* > + * If we are here that means get shadow stack status succeeded and > + * thus shadow stack support is baked in the kernel. > + */ > + while (test_count < ARRAY_SIZE(shstk_tests)) { > + ksft_test_result((*shstk_tests[test_count].t_func)(test_count, NULL), > + shstk_tests[test_count].name); > + test_count++; > + } > + > + return 0; > +} > + > +#pragma GCC pop_options > diff --git a/tools/testing/selftests/riscv/cfi/shadowstack.h b/tools/testing/selftests/riscv/cfi/shadowstack.h > new file mode 100644 > index 000000000000..92cb0752238d > --- /dev/null > +++ b/tools/testing/selftests/riscv/cfi/shadowstack.h > @@ -0,0 +1,39 @@ > +/* SPDX-License-Identifier: GPL-2.0-only */ > + > +#ifndef SELFTEST_SHADOWSTACK_TEST_H > +#define SELFTEST_SHADOWSTACK_TEST_H > +#include <stddef.h> > +#include <linux/prctl.h> > + > +/* > + * a cfi test returns true for success or false for fail > + * takes a number for test number to index into array and void pointer. > + */ > +typedef bool (*shstk_test_func)(unsigned long test_num, void *); > + > +struct shadow_stack_tests { > + char *name; > + shstk_test_func t_func; > +}; > + > +bool enable_disable_check(unsigned long test_num, void *ctx); > +bool shadow_stack_fork_test(unsigned long test_num, void *ctx); > +bool shadow_stack_map_test(unsigned long test_num, void *ctx); > +bool shadow_stack_protection_test(unsigned long test_num, void *ctx); > +bool shadow_stack_gup_tests(unsigned long test_num, void *ctx); > +bool shadow_stack_signal_test(unsigned long test_num, void *ctx); > + > +static struct shadow_stack_tests shstk_tests[] = { > + { "enable disable\n", enable_disable_check }, > + { "shstk fork test\n", shadow_stack_fork_test }, > + { "map shadow stack syscall\n", shadow_stack_map_test }, > + { "shadow stack gup tests\n", shadow_stack_gup_tests }, > + { "shadow stack signal tests\n", shadow_stack_signal_test}, > + { "memory protections of shadow stack memory\n", shadow_stack_protection_test } > +}; > + > +#define RISCV_SHADOW_STACK_TESTS ARRAY_SIZE(shstk_tests) > + > +int execute_shadow_stack_tests(void); > + > +#endif
On Fri, Mar 29, 2024 at 12:50 PM Muhammad Usama Anjum <usama.anjum@collabora.com> wrote: > > On 3/29/24 9:44 AM, Deepak Gupta wrote: > > Adds kselftest for RISC-V control flow integrity implementation for user > > mode. There is not a lot going on in kernel for enabling landing pad for > > user mode. Thus kselftest simply enables landing pad for the binary and > > a signal handler is registered for SIGSEGV. Any control flow violation are > > reported as SIGSEGV with si_code = SEGV_CPERR. Test will fail on recieving > > any SEGV_CPERR. Shadow stack part has more changes in kernel and thus there > > are separate tests for that > > - enable and disable > > - Exercise `map_shadow_stack` syscall > > - `fork` test to make sure COW works for shadow stack pages > > - gup tests > > As of today kernel uses FOLL_FORCE when access happens to memory via > > /proc/<pid>/mem. Not breaking that for shadow stack > > - signal test. Make sure signal delivery results in token creation on > > shadow stack and consumes (and verifies) token on sigreturn > > - shadow stack protection test. attempts to write using regular store > > instruction on shadow stack memory must result in access faults > > > > Signed-off-by: Deepak Gupta <debug@rivosinc.com> > > --- > > tools/testing/selftests/riscv/Makefile | 2 +- > > tools/testing/selftests/riscv/cfi/Makefile | 10 + > > .../testing/selftests/riscv/cfi/cfi_rv_test.h | 85 ++++ > > .../selftests/riscv/cfi/riscv_cfi_test.c | 91 +++++ > > .../testing/selftests/riscv/cfi/shadowstack.c | 376 ++++++++++++++++++ > > .../testing/selftests/riscv/cfi/shadowstack.h | 39 ++ > Please add generated binaries in the .gitignore files. hmm... I don't see binary as part of the patch. Which file are you referring to here being binary? >
On 3/30/24 1:02 AM, Deepak Gupta wrote: > On Fri, Mar 29, 2024 at 12:50 PM Muhammad Usama Anjum > <usama.anjum@collabora.com> wrote: >> >> On 3/29/24 9:44 AM, Deepak Gupta wrote: >>> Adds kselftest for RISC-V control flow integrity implementation for user >>> mode. There is not a lot going on in kernel for enabling landing pad for >>> user mode. Thus kselftest simply enables landing pad for the binary and >>> a signal handler is registered for SIGSEGV. Any control flow violation are >>> reported as SIGSEGV with si_code = SEGV_CPERR. Test will fail on recieving >>> any SEGV_CPERR. Shadow stack part has more changes in kernel and thus there >>> are separate tests for that >>> - enable and disable >>> - Exercise `map_shadow_stack` syscall >>> - `fork` test to make sure COW works for shadow stack pages >>> - gup tests >>> As of today kernel uses FOLL_FORCE when access happens to memory via >>> /proc/<pid>/mem. Not breaking that for shadow stack >>> - signal test. Make sure signal delivery results in token creation on >>> shadow stack and consumes (and verifies) token on sigreturn >>> - shadow stack protection test. attempts to write using regular store >>> instruction on shadow stack memory must result in access faults >>> >>> Signed-off-by: Deepak Gupta <debug@rivosinc.com> >>> --- >>> tools/testing/selftests/riscv/Makefile | 2 +- >>> tools/testing/selftests/riscv/cfi/Makefile | 10 + >>> .../testing/selftests/riscv/cfi/cfi_rv_test.h | 85 ++++ >>> .../selftests/riscv/cfi/riscv_cfi_test.c | 91 +++++ >>> .../testing/selftests/riscv/cfi/shadowstack.c | 376 ++++++++++++++++++ >>> .../testing/selftests/riscv/cfi/shadowstack.h | 39 ++ >> Please add generated binaries in the .gitignore files. > > hmm... > I don't see binary as part of the patch. Which file are you referring > to here being binary? shadowstack would be generated by the build. Create a .gitignore file and add it there. For example, look at tools/testing/selftests/riscv/vector/.gitignore to understand. > >> >
On Mon, Apr 1, 2024 at 2:48 AM Muhammad Usama Anjum <usama.anjum@collabora.com> wrote: > > >>> Signed-off-by: Deepak Gupta <debug@rivosinc.com> > >>> --- > >>> tools/testing/selftests/riscv/Makefile | 2 +- > >>> tools/testing/selftests/riscv/cfi/Makefile | 10 + > >>> .../testing/selftests/riscv/cfi/cfi_rv_test.h | 85 ++++ > >>> .../selftests/riscv/cfi/riscv_cfi_test.c | 91 +++++ > >>> .../testing/selftests/riscv/cfi/shadowstack.c | 376 ++++++++++++++++++ > >>> .../testing/selftests/riscv/cfi/shadowstack.h | 39 ++ > >> Please add generated binaries in the .gitignore files. > > > > hmm... > > I don't see binary as part of the patch. Which file are you referring > > to here being binary? > shadowstack would be generated by the build. Create a .gitignore file and > add it there. For example, look at > tools/testing/selftests/riscv/vector/.gitignore to understand. It's `shadowstack.c` (a C source file) and not a binary file.
On Mon, Apr 1, 2024 at 10:34 AM Deepak Gupta <debug@rivosinc.com> wrote: > > On Mon, Apr 1, 2024 at 2:48 AM Muhammad Usama Anjum > <usama.anjum@collabora.com> wrote: > > > > >>> Signed-off-by: Deepak Gupta <debug@rivosinc.com> > > >>> --- > > >>> tools/testing/selftests/riscv/Makefile | 2 +- > > >>> tools/testing/selftests/riscv/cfi/Makefile | 10 + > > >>> .../testing/selftests/riscv/cfi/cfi_rv_test.h | 85 ++++ > > >>> .../selftests/riscv/cfi/riscv_cfi_test.c | 91 +++++ > > >>> .../testing/selftests/riscv/cfi/shadowstack.c | 376 ++++++++++++++++++ > > >>> .../testing/selftests/riscv/cfi/shadowstack.h | 39 ++ > > >> Please add generated binaries in the .gitignore files. > > > > > > hmm... > > > I don't see binary as part of the patch. Which file are you referring > > > to here being binary? > > shadowstack would be generated by the build. Create a .gitignore file and > > add it there. For example, look at > > tools/testing/selftests/riscv/vector/.gitignore to understand. > > It's `shadowstack.c` (a C source file) and not a binary file. Nevermind. I think what you want me to do is add a rule in `.gitignore`. I was thinking otherwise (that somehow you're seeing a binary file in patch set). Thanks. Will do that in the next iteration.
I had sent RFC patchset early this year (January) [7] to enable CPU assisted control-flow integrity for usermode on riscv. Since then I've been able to do more testing of the changes. As part of testing effort, compiled a rootfs with shadow stack and landing pad enabled (libraries and binaries) and booted to shell. As part of long running tests, I have been able to run some spec 2006 benchmarks [8] (here link is provided only for list of benchmarks that were tested for long running tests, excel sheet provided here actually is for some static stats like code size growth on spec binaries). Thus converting from RFC to regular patchset. Securing control-flow integrity for usermode requires following - Securing forward control flow : All callsites must reach reach a target that they actually intend to reach. - Securing backward control flow : All function returns must return to location where they were called from. This patch series use riscv cpu extension `zicfilp` [2] to secure forward control flow and `zicfiss` [2] to secure backward control flow. `zicfilp` enforces that all indirect calls or jmps must land on a landing pad instr and label embedded in landing pad instr must match a value programmed in `x7` register (at callsite via compiler). `zicfiss` introduces shadow stack which can only be writeable via shadow stack instructions (sspush and ssamoswap) and thus can't be tampered with via inadvertent stores. More details about extension can be read from [2] and there are details in documentation as well (in this patch series). Using config `CONFIG_RISCV_USER_CFI`, kernel support for riscv control flow integrity for user mode programs can be compiled in the kernel. Enabling of control flow integrity for user programs is left to user runtime (specifically expected from dynamic loader). There has been a lot of earlier discussion on the enabling topic around x86 shadow stack enabling [3, 4, 5] and overall consensus had been to let dynamic loader (or usermode) to decide for enabling the feature. This patch series introduces arch agnostic `prctls` to enable shadow stack and indirect branch tracking. And implements them on riscv. arm64 is expected to implement shadow stack part of these arch agnostic `prctls` [6] Changes since last time *********************** Spec changes ------------ - Forward cfi spec has become much simpler. `lpad` instruction is pseudo for `auipc rd, <20bit_imm>`. `lpad` checks x7 against 20bit embedded in instr. Thus label width is 20bit. - Shadow stack management instructions are reduced to sspush - to push x1/x5 on shadow stack sspopchk - pops from shadow stack and comapres with x1/x5. ssamoswap - atomically swap value on shadow stack. rdssp - reads current shadow stack pointer - Shadow stack accesses on readonly memory always raise AMO/store page fault. `sspopchk` is load but if underlying page is readonly, it'll raise a store page fault. It simplifies hardware and kernel for COW handling for shadow stack pages. - riscv defines a new exception type `software check exception` and control flow violations raise software check exception. - enabling controls for shadow stack and landing are in xenvcfg CSR and controls lower privilege mode enabling. As an example senvcfg controls enabling for U and menvcfg controls enabling for S mode. core mm shadow stack enabling ----------------------------- Shadow stack for x86 usermode are now in mainline and thus this patch series builds on top of that for arch-agnostic mm related changes. Big thanks and shout out to Rick Edgecombe for that. selftests --------- Created some minimal selftests to test the patch series. [1] - https://lore.kernel.org/lkml/20230213045351.3945824-1-debug@rivosinc.com/ [2] - https://github.com/riscv/riscv-cfi [3] - https://lore.kernel.org/lkml/ZWHcBq0bJ+15eeKs@finisterre.sirena.org.uk/T/#mb121cd8b33d564e64234595a0ec52211479cf474 [4] - https://lore.kernel.org/all/20220130211838.8382-1-rick.p.edgecombe@intel.com/ [5] - https://lore.kernel.org/lkml/CAHk-=wgP5mk3poVeejw16Asbid0ghDt4okHnWaWKLBkRhQntRA@mail.gmail.com/ [6] - https://lore.kernel.org/linux-mm/20231122-arm64-gcs-v7-2-201c483bd775@kernel.org/ [7] - https://lore.kernel.org/lkml/20240125062739.1339782-1-debug@rivosinc.com/ [8] - https://docs.google.com/spreadsheets/d/1_cHGH4ctNVvFRiS7hW9dEGKtXLAJ3aX4Z_iTSa3Tw2U/edit#gid=0 Deepak Gupta (26): riscv: envcfg save and restore on task switching riscv: define default value for envcfg riscv/Kconfig: enable HAVE_EXIT_THREAD for riscv riscv: zicfiss/zicfilp enumeration riscv: zicfiss/zicfilp extension csr and bit definitions riscv: usercfi state for task and save/restore of CSR_SSP on trap entry/exit mm: Define VM_SHADOW_STACK for RISC-V mm: abstract shadow stack vma behind `arch_is_shadow_stack` riscv/mm : ensure PROT_WRITE leads to VM_READ | VM_WRITE riscv mm: manufacture shadow stack pte riscv mmu: teach pte_mkwrite to manufacture shadow stack PTEs riscv mmu: write protect and shadow stack riscv/mm: Implement map_shadow_stack() syscall riscv/shstk: If needed allocate a new shadow stack on clone prctl: arch-agnostic prtcl for indirect branch tracking riscv: Implements arch agnostic shadow stack prctls riscv: Implements arch argnostic indirect branch tracking prctls riscv/kernel: update __show_regs to print shadow stack register riscv/traps: Introduce software check exception riscv sigcontext: adding cfi state field in sigcontext riscv signal: Save and restore of shadow stack for signal riscv/ptrace: riscv cfi status and state via ptrace and in core files riscv: create a config for shadow stack and landing pad instr support riscv: Documentation for landing pad / indirect branch tracking riscv: Documentation for shadow stack on riscv kselftest/riscv: kselftest for user mode cfi Mark Brown (1): prctl: arch-agnostic prctl for shadow stack Documentation/arch/riscv/zicfilp.rst | 104 ++++ Documentation/arch/riscv/zicfiss.rst | 169 ++++++ .../devicetree/bindings/riscv/extensions.yaml | 10 + arch/riscv/Kconfig | 19 + arch/riscv/include/asm/asm-prototypes.h | 1 + arch/riscv/include/asm/cpufeature.h | 13 + arch/riscv/include/asm/csr.h | 18 + arch/riscv/include/asm/hwcap.h | 2 + arch/riscv/include/asm/mman.h | 24 + arch/riscv/include/asm/pgtable.h | 32 +- arch/riscv/include/asm/processor.h | 2 + arch/riscv/include/asm/switch_to.h | 10 + arch/riscv/include/asm/thread_info.h | 4 + arch/riscv/include/asm/usercfi.h | 118 ++++ arch/riscv/include/uapi/asm/ptrace.h | 18 + arch/riscv/include/uapi/asm/sigcontext.h | 5 + arch/riscv/kernel/Makefile | 2 + arch/riscv/kernel/asm-offsets.c | 4 + arch/riscv/kernel/cpufeature.c | 2 + arch/riscv/kernel/entry.S | 29 + arch/riscv/kernel/process.c | 35 +- arch/riscv/kernel/ptrace.c | 83 +++ arch/riscv/kernel/signal.c | 45 ++ arch/riscv/kernel/sys_riscv.c | 11 + arch/riscv/kernel/traps.c | 38 ++ arch/riscv/kernel/usercfi.c | 510 ++++++++++++++++++ arch/riscv/mm/init.c | 2 +- arch/riscv/mm/pgtable.c | 21 + include/linux/mm.h | 35 +- include/uapi/asm-generic/mman.h | 1 + include/uapi/linux/elf.h | 1 + include/uapi/linux/prctl.h | 49 ++ kernel/sys.c | 60 +++ mm/gup.c | 5 +- mm/internal.h | 2 +- mm/mmap.c | 1 + tools/testing/selftests/riscv/Makefile | 2 +- tools/testing/selftests/riscv/cfi/Makefile | 10 + .../testing/selftests/riscv/cfi/cfi_rv_test.h | 85 +++ .../selftests/riscv/cfi/riscv_cfi_test.c | 91 ++++ .../testing/selftests/riscv/cfi/shadowstack.c | 376 +++++++++++++ .../testing/selftests/riscv/cfi/shadowstack.h | 39 ++ 42 files changed, 2077 insertions(+), 11 deletions(-) create mode 100644 Documentation/arch/riscv/zicfilp.rst create mode 100644 Documentation/arch/riscv/zicfiss.rst create mode 100644 arch/riscv/include/asm/mman.h create mode 100644 arch/riscv/include/asm/usercfi.h create mode 100644 arch/riscv/kernel/usercfi.c create mode 100644 tools/testing/selftests/riscv/cfi/Makefile create mode 100644 tools/testing/selftests/riscv/cfi/cfi_rv_test.h create mode 100644 tools/testing/selftests/riscv/cfi/riscv_cfi_test.c create mode 100644 tools/testing/selftests/riscv/cfi/shadowstack.c create mode 100644 tools/testing/selftests/riscv/cfi/shadowstack.h