From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id ADA7FC28B2F for ; Fri, 14 Mar 2025 08:28:31 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 3950A280005; Fri, 14 Mar 2025 04:28:31 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id 31BCE280001; Fri, 14 Mar 2025 04:28:31 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 16F92280005; Fri, 14 Mar 2025 04:28:31 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0017.hostedemail.com [216.40.44.17]) by kanga.kvack.org (Postfix) with ESMTP id E86A7280001 for ; Fri, 14 Mar 2025 04:28:30 -0400 (EDT) Received: from smtpin03.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay02.hostedemail.com (Postfix) with ESMTP id 7B151120CCD for ; Fri, 14 Mar 2025 08:28:30 +0000 (UTC) X-FDA: 83219479980.03.C8624BE Received: from mail-io1-f47.google.com (mail-io1-f47.google.com [209.85.166.47]) by imf25.hostedemail.com (Postfix) with ESMTP id 9B9E1A0005 for ; Fri, 14 Mar 2025 08:28:28 +0000 (UTC) Authentication-Results: imf25.hostedemail.com; dkim=pass header.d=sifive.com header.s=google header.b="EiJU/GS1"; dmarc=pass (policy=reject) header.from=sifive.com; spf=pass (imf25.hostedemail.com: domain of zong.li@sifive.com designates 209.85.166.47 as permitted sender) smtp.mailfrom=zong.li@sifive.com ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1741940908; a=rsa-sha256; cv=none; b=QLaCEqrF6NWUtfEVPA68NmSKtL4MlfOvGYpajpJTMIaUS/cAo6PxcIfO34tyuL7jEB2/2B zJpsoRCTj4b6vFHkW4WphusDzYaRnXO7oaDa1UjYld2r0YOk2un0au8kUpnix9T1430444 DkDbmf1afk99k9B6pno0K6KtnTUFSn0= ARC-Authentication-Results: i=1; imf25.hostedemail.com; dkim=pass header.d=sifive.com header.s=google header.b="EiJU/GS1"; dmarc=pass (policy=reject) header.from=sifive.com; spf=pass (imf25.hostedemail.com: domain of zong.li@sifive.com designates 209.85.166.47 as permitted sender) smtp.mailfrom=zong.li@sifive.com ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1741940908; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=wfQM28N9JPXsaVfg+1fZcj0o7z6iPxTVilM1OHygPAA=; b=lIwIbvJINwQ3EXsq8LYk5wQX5dAXP/jlw3V7aA9Z4dMAHOQqf6H7ZdlrwxeWYCs0QRCfpT hzZdHVFH69882JAG//JBmNglDe2I3DpzwkTqCdmgiL1PnVsw611TLcqD/OGLUm8zgjMpQt EFqa4mKSewYwvSHwYhEFIn3sq2Iucnc= Received: by mail-io1-f47.google.com with SMTP id ca18e2360f4ac-85b40c7d608so172083539f.3 for ; Fri, 14 Mar 2025 01:28:28 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sifive.com; s=google; t=1741940908; x=1742545708; darn=kvack.org; h=content-transfer-encoding:cc:to:subject:message-id:date:from :in-reply-to:references:mime-version:from:to:cc:subject:date :message-id:reply-to; bh=wfQM28N9JPXsaVfg+1fZcj0o7z6iPxTVilM1OHygPAA=; b=EiJU/GS1RS/VUuU8IiXg2cqzPxaDxczYgRldOWGLVMbvG324pwdWzMrTJqIf9EhIni qWbW4O6uyXWWmOXrB1Tm1ewNXL+DrveYZNSMZCyL2D5kL14W2Bb1gXbhX8ZvgWOEdZg4 eNb9UBJ4M+rrx/jrBae6vIhmmAHzsDBcMPY7KThrtiyAieo1FFvttdGzIa30e6kba/Ip BBzvRJpMie3ehCKPw9zMCabFhzcankRh3YemF4q4WcBLddZaKwNq1KjFXzvg7iJ7MS4w ibrq88KGNwiGZ+IRFZbnTQI1ljqI21DiXnvzjikjfle5pX+DnwFgRs3lDb6/JfglUnAi +cPw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1741940908; x=1742545708; h=content-transfer-encoding:cc:to:subject:message-id:date:from :in-reply-to:references:mime-version:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=wfQM28N9JPXsaVfg+1fZcj0o7z6iPxTVilM1OHygPAA=; b=EHZBY7oPRRRmhHJG8cRAMJm3jNAgJbZW0p0X3ycQz5f4v/3mZ0cpBB1R/B4haMAk7i cuxAx/apOdT0s3vyWQBI6pLilU8DkIvVFmOhrAkB1Q1oGJcHCJRFVcmHAEOPylHbqIpB rZLmo3zJMqJ749sd2fiI1kKlDGRb2lPOpV9DN8KgG98sjXEPhhK+melhLPfiaHnwpc+5 NzcAklZBvQdmsKNptX0ruY+oTxDII7SJU03va+KOSYRh10Ultcymrj6Hanlh/GJz3et9 DhKaldFMg3V/GW+rqyXAdW+1COjyVnoV+wy0fcYNkQV59EDXV4CkNE+axPwLz4opUzoP viXg== X-Forwarded-Encrypted: i=1; AJvYcCUQaOYcghW5EpsuSp/kKBTUMugN8Prq0NIX3lNq1xNTsjRjHm4VAnMWIqGGhi+lDGGms9VF0vGgfw==@kvack.org X-Gm-Message-State: AOJu0YygYU4IEJN+lkD6jjB0/wy1XO9PNL3uHjYu9qql8/B43cFO3Mux vUggnnkbViNbd/usFN3oaSE7uzS1guSCSHq7Zrtx8OTrabAU4cIUTdEcDA0HiY5b976rTSQMfL2 I/RcH5LN7F+Edw54FgZAo/ZVpqdRO91NDTrQVyA== X-Gm-Gg: ASbGncv+GgQXj2FocvgaFlEBqdve40g5phihtoBbUpgn08y7EFASGjhJx2rKjg+aNBK oyDE+TOtm7qx09TESNIIxXws0uLdm8lsvLe/NxSeFjAM+aBsIgMn+9sNxsfxGc8fOeTZ08RcD9G vMsBahX35j3kaFvWM5CS8bct47gI3Ykxu9y84IjA== X-Google-Smtp-Source: AGHT+IEus2eidY5ho/u8kwK0lJdtjoMJ6hhBelcGc2gZ6mBgkM87bHEv8OtdPq4kzNbtkzqAYGzl75buC/L6OC0Zx7w= X-Received: by 2002:a05:6e02:338b:b0:3d4:3fed:81f7 with SMTP id e9e14a558f8ab-3d483a76c70mr14609815ab.19.1741940907731; Fri, 14 Mar 2025 01:28:27 -0700 (PDT) MIME-Version: 1.0 References: <20250310-v5_user_cfi_series-v11-0-86b36cbfb910@rivosinc.com> <20250310-v5_user_cfi_series-v11-5-86b36cbfb910@rivosinc.com> In-Reply-To: <20250310-v5_user_cfi_series-v11-5-86b36cbfb910@rivosinc.com> From: Zong Li Date: Fri, 14 Mar 2025 16:28:16 +0800 X-Gm-Features: AQ5f1JpDAK-Wh3zbs_fniZz3O3lKSiSx95v5vbF1bDBIyMbqDELLA2snuSUHWWE Message-ID: Subject: Re: [PATCH v11 05/27] riscv: usercfi state for task and save/restore of CSR_SSP on trap entry/exit To: Deepak Gupta Cc: Thomas Gleixner , Ingo Molnar , Borislav Petkov , Dave Hansen , x86@kernel.org, "H. Peter Anvin" , Andrew Morton , "Liam R. Howlett" , Vlastimil Babka , Lorenzo Stoakes , Paul Walmsley , Palmer Dabbelt , Albert Ou , Conor Dooley , Rob Herring , Krzysztof Kozlowski , Arnd Bergmann , Christian Brauner , Peter Zijlstra , Oleg Nesterov , Eric Biederman , Kees Cook , Jonathan Corbet , Shuah Khan , Jann Horn , Conor Dooley , linux-kernel@vger.kernel.org, linux-fsdevel@vger.kernel.org, linux-mm@kvack.org, linux-riscv@lists.infradead.org, devicetree@vger.kernel.org, linux-arch@vger.kernel.org, linux-doc@vger.kernel.org, linux-kselftest@vger.kernel.org, alistair.francis@wdc.com, richard.henderson@linaro.org, jim.shu@sifive.com, andybnac@gmail.com, kito.cheng@sifive.com, charlie@rivosinc.com, atishp@rivosinc.com, evan@rivosinc.com, cleger@rivosinc.com, alexghiti@rivosinc.com, samitolvanen@google.com, broonie@kernel.org, rick.p.edgecombe@intel.com Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable X-Stat-Signature: i91544hsdhbbxywxitwe9kq1inxh7s3o X-Rspamd-Server: rspam12 X-Rspamd-Queue-Id: 9B9E1A0005 X-Rspam-User: X-HE-Tag: 1741940908-768308 X-HE-Meta: U2FsdGVkX1/xEzls9gA3Pu8OaG/OI9IvOTzzp2atvcs1iL3rIUSf26eK5bREBAB4MTkk0kSGV8cKy/QepWXJYMOxXWyJOGIH11YX+ilDwL5i1AqQtvQriYebF0p96jtaHj5uHqrnHVyPEPb6xh7Rdv2LmiiqHBg94wpY372D+zF8nSso5ciKgBYjYFmbiqNWuwPy4gKlRy27Xj/tPC67yThMiu84hivhulqIE1dCZQFtCpf3EX+ffTD0W2PSPDQ6MX6aXippE/1Ei/4C1e11wyMTXJnUoczffNyD+3WTjFCoekhFpJQqDL6qx8TCdZbOAph+3BOcIglSxD+woNOkpOe2vR+Yuwij37USDTYPCMCaKtC71M1jI/pKnECu41wo9/Rn1mrXWa3s/tP2hN2rqFGtHnSkDKDr4wt0YvfPOUJCbtUeFK5AH3u4DRIvdm5adZwmp4AxczAO89MLo6az+e9P3vdgaHdZdJ/P0+lxIoSZylCksxMV/JmuQGK5WEFNy5s8K+jYg65sSeBWaGazix0Ov7zNFCdK10LAegPdJGx1HMwucogItPtMWuVJUlhTK99xKAshh/7X0PaQTkMQU/tWNoH2vYistTTdm/eKS34N4EvWtOcdRwOWXNPGu1/3QBIqfm3Yojxwc8iWmm91VDoq1Jm9Ysav3ZAhmppD04DjlA+5B/T8eJ7kVaBxmWl11MdOrkxHQNFDZvaCWAbgW24Wkkah1ETvkJCzaQgo3GmPnS5Xkt0u2mlg+jRlj7h7+88LnHJ57jjGXEa9yesdyThJKZRH7EzXLcxPHQCGcBp1OyDjjBkDR+dTLnVhyXkLtVHKGOFFW6pSWQ8/f4nhNX0TWiCn9Yj4gfQDqm3IRUjMcchiYzL29KNSGfxZVKvWaRksXD5kM5gkGMJC1P7woz4iN67q9ai7lm+dp8lCB9JPTLAvQLu3rcKYnuQtBU1KsvU7ttPF2scN+wO9RHz +/3Ve3RV 6f1XtohTtAkkvegVPp6SsSukIupRQ4QgRzVO0LZ6VVWGZzCSN5x7EG1WoN0R/nM35YuFYMHyH644OmPOVjpLECBZBkiFWOJo019uAf/mCob/5R3SYfydXCiTqqlXC4Jvx/V2hb2t6eIjxqli+e314LA7cMZ/8gGK6N7wLAwvVizlcavYJoNPP4LQfuMM/HotDwoBCZMfulPyUOlDApzdYzMaRgYrPFlRtGettXDJLKQ7i5buPasYzEjEVTckmV0YVHInc9ksPMx6Lx3tDil5Q54tklmBPvNo8ba01WZfER5Q5GpEKrW8wUS9V5yaFgN7yVe2IM/GzqN6gAe3n1GIYIbZr3MzYcrof/vEUf1bB7ZLJI+DbUlqDMrnLDgPHy4M5SaGmChENPmPvg/VXoyWOi7gcRklwTnSqfcXLuQ5oEITyO4dRCIbF5Zf45/pwxv4/ZT+5VIVmZRocaeoFHUIvy7JIFiRP+gl9hgqYMkNGwCIDaWo= X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: List-Subscribe: List-Unsubscribe: On Mon, Mar 10, 2025 at 11:42=E2=80=AFPM Deepak Gupta = wrote: > > Carves out space in arch specific thread struct for cfi status and shadow > stack in usermode on riscv. > > This patch does following > - defines a new structure cfi_status with status bit for cfi feature > - defines shadow stack pointer, base and size in cfi_status structure > - defines offsets to new member fields in thread in asm-offsets.c > - Saves and restore shadow stack pointer on trap entry (U --> S) and exit > (S --> U) > > Shadow stack save/restore is gated on feature availiblity and implemented > using alternative. CSR can be context switched in `switch_to` as well but > soon as kernel shadow stack support gets rolled in, shadow stack pointer > will need to be switched at trap entry/exit point (much like `sp`). It ca= n > be argued that kernel using shadow stack deployment scenario may not be a= s > prevalant as user mode using this feature. But even if there is some > minimal deployment of kernel shadow stack, that means that it needs to be > supported. And thus save/restore of shadow stack pointer in entry.S inste= ad > of in `switch_to.h`. > > Signed-off-by: Deepak Gupta > Reviewed-by: Charlie Jenkins > --- > arch/riscv/include/asm/processor.h | 1 + > arch/riscv/include/asm/thread_info.h | 3 +++ > arch/riscv/include/asm/usercfi.h | 24 ++++++++++++++++++++++++ > arch/riscv/kernel/asm-offsets.c | 4 ++++ > arch/riscv/kernel/entry.S | 26 ++++++++++++++++++++++++++ > 5 files changed, 58 insertions(+) > > diff --git a/arch/riscv/include/asm/processor.h b/arch/riscv/include/asm/= processor.h > index e3aba3336e63..d851bb5c6da0 100644 > --- a/arch/riscv/include/asm/processor.h > +++ b/arch/riscv/include/asm/processor.h > @@ -14,6 +14,7 @@ > > #include > #include > +#include > > #define arch_get_mmap_end(addr, len, flags) \ > ({ \ > diff --git a/arch/riscv/include/asm/thread_info.h b/arch/riscv/include/as= m/thread_info.h > index f5916a70879a..a0cfe00c2ca6 100644 > --- a/arch/riscv/include/asm/thread_info.h > +++ b/arch/riscv/include/asm/thread_info.h > @@ -62,6 +62,9 @@ struct thread_info { > long user_sp; /* User stack pointer */ > int cpu; > unsigned long syscall_work; /* SYSCALL_WORK_ flags */ > +#ifdef CONFIG_RISCV_USER_CFI > + struct cfi_status user_cfi_state; > +#endif > #ifdef CONFIG_SHADOW_CALL_STACK > void *scs_base; > void *scs_sp; > diff --git a/arch/riscv/include/asm/usercfi.h b/arch/riscv/include/asm/us= ercfi.h > new file mode 100644 > index 000000000000..5f2027c51917 > --- /dev/null > +++ b/arch/riscv/include/asm/usercfi.h > @@ -0,0 +1,24 @@ > +/* SPDX-License-Identifier: GPL-2.0 > + * Copyright (C) 2024 Rivos, Inc. > + * Deepak Gupta > + */ > +#ifndef _ASM_RISCV_USERCFI_H > +#define _ASM_RISCV_USERCFI_H > + > +#ifndef __ASSEMBLY__ > +#include > + > +#ifdef CONFIG_RISCV_USER_CFI > +struct cfi_status { > + unsigned long ubcfi_en : 1; /* Enable for backward cfi. */ > + unsigned long rsvd : ((sizeof(unsigned long) * 8) - 1); > + unsigned long user_shdw_stk; /* Current user shadow stack pointer= */ > + unsigned long shdw_stk_base; /* Base address of shadow stack */ > + unsigned long shdw_stk_size; /* size of shadow stack */ > +}; > + > +#endif /* CONFIG_RISCV_USER_CFI */ > + > +#endif /* __ASSEMBLY__ */ > + > +#endif /* _ASM_RISCV_USERCFI_H */ > diff --git a/arch/riscv/kernel/asm-offsets.c b/arch/riscv/kernel/asm-offs= ets.c > index e89455a6a0e5..0c188aaf3925 100644 > --- a/arch/riscv/kernel/asm-offsets.c > +++ b/arch/riscv/kernel/asm-offsets.c > @@ -50,6 +50,10 @@ void asm_offsets(void) > #endif > > OFFSET(TASK_TI_CPU_NUM, task_struct, thread_info.cpu); > +#ifdef CONFIG_RISCV_USER_CFI > + OFFSET(TASK_TI_CFI_STATUS, task_struct, thread_info.user_cfi_stat= e); > + OFFSET(TASK_TI_USER_SSP, task_struct, thread_info.user_cfi_state.= user_shdw_stk); > +#endif > OFFSET(TASK_THREAD_F0, task_struct, thread.fstate.f[0]); > OFFSET(TASK_THREAD_F1, task_struct, thread.fstate.f[1]); > OFFSET(TASK_THREAD_F2, task_struct, thread.fstate.f[2]); > diff --git a/arch/riscv/kernel/entry.S b/arch/riscv/kernel/entry.S > index 33a5a9f2a0d4..68c99124ea55 100644 > --- a/arch/riscv/kernel/entry.S > +++ b/arch/riscv/kernel/entry.S > @@ -147,6 +147,20 @@ SYM_CODE_START(handle_exception) > > REG_L s0, TASK_TI_USER_SP(tp) > csrrc s1, CSR_STATUS, t0 > + /* > + * If previous mode was U, capture shadow stack pointer and save = it away > + * Zero CSR_SSP at the same time for sanitization. > + */ > + ALTERNATIVE("nop; nop; nop; nop", > + __stringify( \ > + andi s2, s1, SR_SPP; \ > + bnez s2, skip_ssp_save; \ > + csrrw s2, CSR_SSP, x0; \ > + REG_S s2, TASK_TI_USER_SSP(tp); \ > + skip_ssp_save:), > + 0, > + RISCV_ISA_EXT_ZICFISS, > + CONFIG_RISCV_USER_CFI) > csrr s2, CSR_EPC > csrr s3, CSR_TVAL > csrr s4, CSR_CAUSE > @@ -236,6 +250,18 @@ SYM_CODE_START_NOALIGN(ret_from_exception) > * structures again. > */ > csrw CSR_SCRATCH, tp > + > + /* > + * Going back to U mode, restore shadow stack pointer > + */ > + ALTERNATIVE("nop; nop", > + __stringify( = \ > + REG_L s3, TASK_TI_USER_SSP(tp); \ > + csrw CSR_SSP, s3), > + 0, > + RISCV_ISA_EXT_ZICFISS, > + CONFIG_RISCV_USER_CFI) > + > 1: > #ifdef CONFIG_RISCV_ISA_V_PREEMPTIVE > move a0, sp > LGTM. Reviewed-by: Zong Li > -- > 2.34.1 > > > _______________________________________________ > linux-riscv mailing list > linux-riscv@lists.infradead.org > http://lists.infradead.org/mailman/listinfo/linux-riscv