From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id 14322C71135 for ; Mon, 16 Jun 2025 07:31:47 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id A54F06B008A; Mon, 16 Jun 2025 03:31:46 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id A04F16B0092; Mon, 16 Jun 2025 03:31:46 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 8CCBA6B0093; Mon, 16 Jun 2025 03:31:46 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0016.hostedemail.com [216.40.44.16]) by kanga.kvack.org (Postfix) with ESMTP id 70A706B008A for ; Mon, 16 Jun 2025 03:31:46 -0400 (EDT) Received: from smtpin26.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay06.hostedemail.com (Postfix) with ESMTP id F3568101150 for ; Mon, 16 Jun 2025 07:31:45 +0000 (UTC) X-FDA: 83560444170.26.C2BFFC6 Received: from mail-il1-f178.google.com (mail-il1-f178.google.com [209.85.166.178]) by imf27.hostedemail.com (Postfix) with ESMTP id 12A4F40007 for ; Mon, 16 Jun 2025 07:31:43 +0000 (UTC) Authentication-Results: imf27.hostedemail.com; dkim=pass header.d=sifive.com header.s=google header.b=D34+D88F; spf=pass (imf27.hostedemail.com: domain of zong.li@sifive.com designates 209.85.166.178 as permitted sender) smtp.mailfrom=zong.li@sifive.com; dmarc=pass (policy=reject) header.from=sifive.com ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1750059104; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=EQxXH/0dmAKUHVoHoL5MncVmJUg8FbHf/SfAogCBA2o=; b=ehm0FjAGQvsXFjDdNWbw0k52mLg46VjOXQMxTdU204MKl1MagTeXbEyAyH8VA4Huayfj6i IJChgC1NxFVDJMFGEpE8NxYe+twkKvLAjupzFGJw4B7rQw9zPnnKaFZjVtSBlQ2Q6+KFsg llWZr36ET3awEfdIm4JZ0WqSadHXX8A= ARC-Authentication-Results: i=1; imf27.hostedemail.com; dkim=pass header.d=sifive.com header.s=google header.b=D34+D88F; spf=pass (imf27.hostedemail.com: domain of zong.li@sifive.com designates 209.85.166.178 as permitted sender) smtp.mailfrom=zong.li@sifive.com; dmarc=pass (policy=reject) header.from=sifive.com ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1750059104; a=rsa-sha256; cv=none; b=RVUmwUBVBCFwf+CYtyf/a6jInnW6LLpczUUF+up77gJTzuDUKh45AA+LyQs7ub06UkCssr U3QBfSmWaQwEgLIvQUPB58Yrl2/YE9vVATVGMEqny4gXK6uNhze6R5G8aOytcUToC+6liD HCqHFLZ5gATlkO9kZmhvRbuJW/8QOf8= Received: by mail-il1-f178.google.com with SMTP id e9e14a558f8ab-3dc8265b9b5so39526335ab.1 for ; Mon, 16 Jun 2025 00:31:43 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sifive.com; s=google; t=1750059103; x=1750663903; darn=kvack.org; h=content-transfer-encoding:cc:to:subject:message-id:date:from :in-reply-to:references:mime-version:from:to:cc:subject:date :message-id:reply-to; bh=EQxXH/0dmAKUHVoHoL5MncVmJUg8FbHf/SfAogCBA2o=; b=D34+D88FTPMxkyZAdCYGqTm1J6zNC1shgYud1gBLPpN7iVa7pp3QuXw5g7137oMRWB t36L7ildQbTxbDswVBl2Le55aWbLq14sTyZYcvrAFgfhJJtc8RtitQht/um4dXzWRXBE CMUtmRA8zKK9pxVj6scXAwXAi9ttkBSbiVcCG52QbGnOyIP0LdsaeYOsmY2fKfaPOP0M fsAO3M1GVK/ft45T751Mzf5WBZ39eFUlUioRjlYkDe0nlgbCEHiGcIlBgiPyDCsq3rlp 5KD8YpNY7CDXjPZ2/w/gtcU8bC+1Sby9HrJxnj0ZZ3XMk1i4Qf5ptU1eoSNB3h4niax/ q3yA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1750059103; x=1750663903; h=content-transfer-encoding:cc:to:subject:message-id:date:from :in-reply-to:references:mime-version:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=EQxXH/0dmAKUHVoHoL5MncVmJUg8FbHf/SfAogCBA2o=; b=KIraY4jiSRjlQ+eYCQ/+2P/t2Cq4XFN+ul+NjHTQEg9EUftJbvHA5yUr4XsjpJjBBv Jo599//tWbMNtD8D01EsYmQF4ZwBz7v2T53Sp8MPXOAYP8+RkUfdZD8y0IItcVlnxDgm PYwTTmpz9j/a9l3ibGaTBBZ3ZavmplHAxN6+xPlfCV0jPagH0wZoh7LM0qJgO+2kIMK2 TkhZuBUYZMigummWWWZCdGTSzzFYYgqK3lhWH/LgJpOv4F1dKJIutn2DfuKn7SjBibVG WhQPEdGRf2RFmEkxku5BFTzBGtEG6yM6s5nCYwE3YWD4eHYxWcZNLbO4MvoJCKJuSUbt +EpA== X-Forwarded-Encrypted: i=1; AJvYcCV9DQArPrgtl+eIrahcogVcmADl/LN8cFrPfcj9M8yWpM/cBEjyhrQ+3LPioiRCLGU0oN/9Ktctig==@kvack.org X-Gm-Message-State: AOJu0YyuxZQWM1aXfBZCZaqncuEm6Y0qMg07aQercBuuBqtSd1J3fXJD ADcDynxypG0AR/ubeyWjsBBNBgFOsP3AlAYHZF5bG1ooRWpi0MY9XkN7E0UoGx76Np9hv+nf2KT rznJ7TwrJ3VRAXFgi9wIiTltfrv8qbydmyf9aONMmow== X-Gm-Gg: ASbGncuvw0xd0fehBbPSIqvUAIZC2T2GtJxIw7PcMSfIDeYV2wOwtOrRbZSn+TD+Kss RLfPfUSUIy3CcOzyMIUgWC5FSHZWfgSl2pNCkfxyuDKF2cRL2HSv0XU89chp3Qs/5Hv8vlG4Fzg iv55ZjA43kHzMml/HV6gBYclE6yLcFLcjW6DMJ0JbdY2pdeA== X-Google-Smtp-Source: AGHT+IEjHI16GxKyLasfzKkpzXfv5K8fdxEJHSmO2c+vsZ5EW3jLub+wreQ1LSFrfqb50SzP3xXNNY/tkYcEG9qkkXQ= X-Received: by 2002:a05:6e02:1445:b0:3dc:87c7:a5b5 with SMTP id e9e14a558f8ab-3de07c2710fmr92538565ab.3.1750059102855; Mon, 16 Jun 2025 00:31:42 -0700 (PDT) MIME-Version: 1.0 References: <20250604-v5_user_cfi_series-v17-0-4565c2cf869f@rivosinc.com> <20250604-v5_user_cfi_series-v17-15-4565c2cf869f@rivosinc.com> In-Reply-To: <20250604-v5_user_cfi_series-v17-15-4565c2cf869f@rivosinc.com> From: Zong Li Date: Mon, 16 Jun 2025 15:31:31 +0800 X-Gm-Features: AX0GCFv07zIy78CxiGqhmmuXUJ1bc3WRbaeMC8WS8lGUU29aYh3F-BEq_8IQZZA Message-ID: Subject: Re: [PATCH v17 15/27] riscv/traps: Introduce software check exception and uprobe handling To: Deepak Gupta Cc: Thomas Gleixner , Ingo Molnar , Borislav Petkov , Dave Hansen , x86@kernel.org, "H. Peter Anvin" , Andrew Morton , "Liam R. Howlett" , Vlastimil Babka , Lorenzo Stoakes , Paul Walmsley , Palmer Dabbelt , Albert Ou , Conor Dooley , Rob Herring , Krzysztof Kozlowski , Arnd Bergmann , Christian Brauner , Peter Zijlstra , Oleg Nesterov , Eric Biederman , Kees Cook , Jonathan Corbet , Shuah Khan , Jann Horn , Conor Dooley , Miguel Ojeda , Alex Gaynor , Boqun Feng , Gary Guo , =?UTF-8?Q?Bj=C3=B6rn_Roy_Baron?= , Benno Lossin , Andreas Hindborg , Alice Ryhl , Trevor Gross , linux-kernel@vger.kernel.org, linux-fsdevel@vger.kernel.org, linux-mm@kvack.org, linux-riscv@lists.infradead.org, devicetree@vger.kernel.org, linux-arch@vger.kernel.org, linux-doc@vger.kernel.org, linux-kselftest@vger.kernel.org, alistair.francis@wdc.com, richard.henderson@linaro.org, jim.shu@sifive.com, andybnac@gmail.com, kito.cheng@sifive.com, charlie@rivosinc.com, atishp@rivosinc.com, evan@rivosinc.com, cleger@rivosinc.com, alexghiti@rivosinc.com, samitolvanen@google.com, broonie@kernel.org, rick.p.edgecombe@intel.com, rust-for-linux@vger.kernel.org Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable X-Stat-Signature: addzn1p5mx54steo1p8ugm5787kcqcty X-Rspamd-Queue-Id: 12A4F40007 X-Rspam-User: X-Rspamd-Server: rspam09 X-HE-Tag: 1750059103-424316 X-HE-Meta: U2FsdGVkX19i6HqdYxjSlfwtzh8weQRa2isaYFdHNeVZZdZFf5gD3UWcxybPhpOweA7IEJiw2mA4afETFdd5wiT9Tt54/qseAN4T5+/w/70vBK238uo9JuAO9LV4NT4QpLYxwne49cqB8T1jeG8pBrb8Loctnq6FsQqfYedjWypcssF9dQ1qPm7HNWXVcD78bDIqX6baGuqF6Si6rrZimQglyttsMOKm5zx0lRGDC/7yT8UY39jhQyQgehsaojexBITJOWfDkYDqMwk9akRM7PacQ8/AffG/cnJeExBxwnkFFXblv1+6dEGk4dCoVMDEfMsMBoi3SKXwwg/M62cl0Th+Wi/EOs0XFgYhEawCn7spZJ7U4+ZIaaZWvpz7G2upg93MNmqjyHHsRX3lJCkYKz6QI0RH/WRz5DDezF8QmkAElm5X98U8pt4b8b7NRHVdtwVqRYmTTGUFvaIxpjG2fAtZNShw7mI5Hix0xJ4Vjerar50d2iipYjzXteIk6lNJEdBc4L29ExbRJfBwgejVCKSo84r2Jiuy5R0Br+CKUHBNksnSs/Pno+J7kMmI/Ka/FLzLX7JH33u0P9+KmYBw89n3yetJUIZwYY61NN8O0LcEwhA0pyBhJo1qh7IoaVuRyty2p0pVEegfQubkO8Ihcz2iTf+PHgFZAZJJqn1sKJK4eKXloOreHyXxUNPP5Urc1fZYVbI6MCH4N9X2XSMs1ozqd3rVZZ+s6EYUqe3Zb7PdCqVpdBwOXl0DYfoMyxVFvKXlwUr0VCdgTw8915vZIaKSehYmv3B93QKbYkA1CLw3rEhxR0U6i7BDZxvWqhpSi+IjDwI4QeaRpDjhf+ZJ2uqjP3Gf23gxE0wk88+Vp6ufw4umtofGkL42O/ICR5DpBgMaBd+Q2UhrN63DKC0MakIjQQWhqgIyFSS3edJwcuRiceOIMj7rCH9mvchrrrF2ldikPsEBvAVrpQMtIl1 TEvBL/M+ b7Vuh7xssPTCcmFkjI5WTXIW8sSMxleU+kSNWnSsVPf4WlSyXBGW0gOl764gb/Vl+RIhY+UDyV946WDJYb6tXltxCe0NfOhs/QyM+Rvk3Yn9deEcsrIQS8ar+khQ77BLCDwa0QyDZvu/6KOMkQ3+dxkWW9jDrRvtHIHIvGgQGGQ8m9x1rLTmgVDtXCF3fUdvy+wbYkdcvhuaqzvUcY6BLbylvnEw5mafsni09Dua2mxcWerim3osQUuksiuLJPu5CCSRKqsEmMP0TsCtN1Qk6bhxd7m79xJfGM4lhGHv0Rodrs1royXzBrgm51mR9XKFflWmqg9/gX/UmuALGNR4dEJ77BxrvPbNddk6wizuigyaJKxH3oqCnL63sk0lgkbvxjO10 X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: List-Subscribe: List-Unsubscribe: On Thu, Jun 5, 2025 at 1:17=E2=80=AFAM Deepak Gupta wr= ote: > > zicfiss / zicfilp introduces a new exception to priv isa `software check > exception` with cause code =3D 18. This patch implements software check > exception. > > Additionally it implements a cfi violation handler which checks for code > in xtval. If xtval=3D2, it means that sw check exception happened because= of > an indirect branch not landing on 4 byte aligned PC or not landing on > `lpad` instruction or label value embedded in `lpad` not matching label > value setup in `x7`. If xtval=3D3, it means that sw check exception happe= ned > because of mismatch between link register (x1 or x5) and top of shadow > stack (on execution of `sspopchk`). > > In case of cfi violation, SIGSEGV is raised with code=3DSEGV_CPERR. > SEGV_CPERR was introduced by x86 shadow stack patches. > > To keep uprobes working, handle the uprobe event first before reporting > the CFI violation in software-check exception handler. Because when the > landing pad is activated, if the uprobe point is set at the lpad > instruction at the beginning of a function, the system triggers a softwar= e > -check exception instead of an ebreak exception due to the exception > priority, then uprobe can't work successfully. > > Co-developed-by: Zong Li > Reviewed-by: Zong Li > Signed-off-by: Zong Li > Signed-off-by: Deepak Gupta > --- > arch/riscv/include/asm/asm-prototypes.h | 1 + > arch/riscv/include/asm/entry-common.h | 2 ++ > arch/riscv/kernel/entry.S | 3 ++ > arch/riscv/kernel/traps.c | 51 +++++++++++++++++++++++++++= ++++++ > 4 files changed, 57 insertions(+) > > diff --git a/arch/riscv/include/asm/asm-prototypes.h b/arch/riscv/include= /asm/asm-prototypes.h > index cd627ec289f1..5a27cefd7805 100644 > --- a/arch/riscv/include/asm/asm-prototypes.h > +++ b/arch/riscv/include/asm/asm-prototypes.h > @@ -51,6 +51,7 @@ DECLARE_DO_ERROR_INFO(do_trap_ecall_u); > DECLARE_DO_ERROR_INFO(do_trap_ecall_s); > DECLARE_DO_ERROR_INFO(do_trap_ecall_m); > DECLARE_DO_ERROR_INFO(do_trap_break); > +DECLARE_DO_ERROR_INFO(do_trap_software_check); > > asmlinkage void handle_bad_stack(struct pt_regs *regs); > asmlinkage void do_page_fault(struct pt_regs *regs); > diff --git a/arch/riscv/include/asm/entry-common.h b/arch/riscv/include/a= sm/entry-common.h > index b28ccc6cdeea..34ed149af5d1 100644 > --- a/arch/riscv/include/asm/entry-common.h > +++ b/arch/riscv/include/asm/entry-common.h > @@ -40,4 +40,6 @@ static inline int handle_misaligned_store(struct pt_reg= s *regs) > } > #endif > > +bool handle_user_cfi_violation(struct pt_regs *regs); > + > #endif /* _ASM_RISCV_ENTRY_COMMON_H */ > diff --git a/arch/riscv/kernel/entry.S b/arch/riscv/kernel/entry.S > index 978115567bca..8d25837a9384 100644 > --- a/arch/riscv/kernel/entry.S > +++ b/arch/riscv/kernel/entry.S > @@ -474,6 +474,9 @@ SYM_DATA_START_LOCAL(excp_vect_table) > RISCV_PTR do_page_fault /* load page fault */ > RISCV_PTR do_trap_unknown > RISCV_PTR do_page_fault /* store page fault */ > + RISCV_PTR do_trap_unknown /* cause=3D16 */ > + RISCV_PTR do_trap_unknown /* cause=3D17 */ > + RISCV_PTR do_trap_software_check /* cause=3D18 is sw check except= ion */ > SYM_DATA_END_LABEL(excp_vect_table, SYM_L_LOCAL, excp_vect_table_end) > > #ifndef CONFIG_MMU > diff --git a/arch/riscv/kernel/traps.c b/arch/riscv/kernel/traps.c > index 8ff8e8b36524..64388370e1ad 100644 > --- a/arch/riscv/kernel/traps.c > +++ b/arch/riscv/kernel/traps.c > @@ -354,6 +354,57 @@ void do_trap_ecall_u(struct pt_regs *regs) > > } > > +#define CFI_TVAL_FCFI_CODE 2 > +#define CFI_TVAL_BCFI_CODE 3 > +/* handle cfi violations */ > +bool handle_user_cfi_violation(struct pt_regs *regs) > +{ > + unsigned long tval =3D csr_read(CSR_TVAL); > + bool is_fcfi =3D (tval =3D=3D CFI_TVAL_FCFI_CODE && cpu_supports_= indirect_br_lp_instr()); > + bool is_bcfi =3D (tval =3D=3D CFI_TVAL_BCFI_CODE && cpu_supports_= shadow_stack()); > + > + /* > + * Handle uprobe event first. The probe point can be a valid targ= et > + * of indirect jumps or calls, in this case, forward cfi violatio= n > + * will be triggered instead of breakpoint exception. > + */ > + if (is_fcfi && probe_breakpoint_handler(regs)) > + return true; Hi Deepak, Sorry for missing something earlier. I think we would like to clear sstatus.SPELP in the uprobe handling case. For example: diff --git a/arch/riscv/kernel/traps.c b/arch/riscv/kernel/traps.c index c2ea999c1167..e8492bb57e09 100644 --- a/arch/riscv/kernel/traps.c +++ b/arch/riscv/kernel/traps.c @@ -349,8 +349,10 @@ bool handle_user_cfi_violation(struct pt_regs *regs) bool is_fcfi =3D (tval =3D=3D CFI_TVAL_FCFI_CODE && cpu_supports_indirect_br_lp_instr()); bool is_bcfi =3D (tval =3D=3D CFI_TVAL_BCFI_CODE && cpu_supports_shadow_stack()); - if (is_fcfi && probe_breakpoint_handler(regs)) + if (is_fcfi && probe_breakpoint_handler(regs)) { + regs->status =3D regs->status & ~SR_ELP; return true; + } if (is_fcfi || is_bcfi) { do_trap_error(regs, SIGSEGV, SEGV_CPERR, regs->epc, When a user mode CFI violation occurs, the ELP state should be 1, and the system traps into supervisor mode. During this trap, sstatus.SPELP is set to 1, and the ELP state is reset to 0. If we don=E2=80=99t clear sstatus.SPELP, the ELP state will become 1 again after executing the sret instruction. As a result, the system might trigger another forward CFI violation upon executing the next instruction in the user program, unless it happens to be a lpad instruction. The previous patch was tested on QEMU, but QEMU does not set the sstatus.SPELP bit to 1 when a forward CFI violation occurs. Therefore, I suspect that QEMU might also require some fixes. Thanks > + > + if (is_fcfi || is_bcfi) { > + do_trap_error(regs, SIGSEGV, SEGV_CPERR, regs->epc, > + "Oops - control flow violation"); > + return true; > + } > + > + return false; > +} > + > +/* > + * software check exception is defined with risc-v cfi spec. Software ch= eck > + * exception is raised when:- > + * a) An indirect branch doesn't land on 4 byte aligned PC or `lpad` > + * instruction or `label` value programmed in `lpad` instr doesn't > + * match with value setup in `x7`. reported code in `xtval` is 2. > + * b) `sspopchk` instruction finds a mismatch between top of shadow stac= k (ssp) > + * and x1/x5. reported code in `xtval` is 3. > + */ > +asmlinkage __visible __trap_section void do_trap_software_check(struct p= t_regs *regs) > +{ > + if (user_mode(regs)) { > + irqentry_enter_from_user_mode(regs); > + > + /* not a cfi violation, then merge into flow of unknown t= rap handler */ > + if (!handle_user_cfi_violation(regs)) > + do_trap_unknown(regs); > + > + irqentry_exit_to_user_mode(regs); > + } else { > + /* sw check exception coming from kernel is a bug in kern= el */ > + die(regs, "Kernel BUG"); > + } > +} > + > #ifdef CONFIG_MMU > asmlinkage __visible noinstr void do_page_fault(struct pt_regs *regs) > { > > -- > 2.43.0 >