From: Palmer Dabbelt <palmer@dabbelt.com>
To: Conor.Dooley@microchip.com
Cc: guoren@kernel.org, oleg@redhat.com, vgupta@kernel.org,
linux@armlinux.org.uk, monstr@monstr.eu, dinguyen@kernel.org,
davem@davemloft.net, Arnd Bergmann <arnd@arndb.de>,
shorne@gmail.com, Paul Walmsley <paul.walmsley@sifive.com>,
aou@eecs.berkeley.edu, ardb@kernel.org, heiko@sntech.de,
daolu@rivosinc.com, linux-arch@vger.kernel.org,
linux-kernel@vger.kernel.org, linux-riscv@lists.infradead.org,
linux-arm-kernel@lists.infradead.org,
linux-snps-arc@lists.infradead.org, sparclinux@vger.kernel.org,
openrisc@lists.librecores.org, xianting.tian@linux.alibaba.com,
linux-efi@vger.kernel.org
Subject: Re: [PATCH] RISC-V: Add STACKLEAK erasing the kernel stack at the end of syscalls
Date: Thu, 06 Oct 2022 19:31:01 -0700 (PDT) [thread overview]
Message-ID: <mhng-8c3bb2e7-e84e-4aaa-bce8-3e8054255a2c@palmer-ri-x1c9> (raw)
In-Reply-To: <6c48657c-04df-132d-6167-49ed293dea44@microchip.com>
On Tue, 06 Sep 2022 10:35:10 PDT (-0700), Conor.Dooley@microchip.com wrote:
> On 03/09/2022 17:23, guoren@kernel.org wrote:
>> EXTERNAL EMAIL: Do not click links or open attachments unless you know the content is safe
>>
>> From: Xianting Tian <xianting.tian@linux.alibaba.com>
>>
>> This adds support for the STACKLEAK gcc plugin to RISC-V and disables
>> the plugin in EFI stub code, which is out of scope for the protection.
>>
>> For the benefits of STACKLEAK feature, please check the commit
>> afaef01c0015 ("x86/entry: Add STACKLEAK erasing the kernel stack at the end of syscalls")
>>
>> Performance impact (tested on qemu env with 1 riscv64 hart, 1GB mem)
>> hackbench -s 512 -l 200 -g 15 -f 25 -P
>> 2.0% slowdown
>>
>> Signed-off-by: Xianting Tian <xianting.tian@linux.alibaba.com>
>
> What changed since Xianting posted it himself a week ago:
> https://lore.kernel.org/linux-riscv/20220828135407.3897717-1-xianting.tian@linux.alibaba.com/
>
> There's an older patch from Du Lao adding STACKLEAK too:
> https://lore.kernel.org/linux-riscv/20220615213834.3116135-1-daolu@rivosinc.com/
>
> But since there's been no activity there since June...
Looks like the only issues were some commit log wording stuff, and that
there's a test suite that should be run. It's not clear from the
commits that anyone has done that, I'm fine with the patch if it passes
the tests but don't really know how to run them.
Has anyone run the tests?
>
>> ---
>> arch/riscv/Kconfig | 1 +
>> arch/riscv/include/asm/processor.h | 4 ++++
>> arch/riscv/kernel/entry.S | 3 +++
>> drivers/firmware/efi/libstub/Makefile | 2 +-
>> 4 files changed, 9 insertions(+), 1 deletion(-)
>>
>> diff --git a/arch/riscv/Kconfig b/arch/riscv/Kconfig
>> index ed66c31e4655..61fd0dad4463 100644
>> --- a/arch/riscv/Kconfig
>> +++ b/arch/riscv/Kconfig
>> @@ -85,6 +85,7 @@ config RISCV
>> select ARCH_ENABLE_THP_MIGRATION if TRANSPARENT_HUGEPAGE
>> select HAVE_ARCH_THREAD_STRUCT_WHITELIST
>> select HAVE_ARCH_VMAP_STACK if MMU && 64BIT
>> + select HAVE_ARCH_STACKLEAK
>> select HAVE_ASM_MODVERSIONS
>> select HAVE_CONTEXT_TRACKING_USER
>> select HAVE_DEBUG_KMEMLEAK
>> diff --git a/drivers/firmware/efi/libstub/Makefile b/drivers/firmware/efi/libstub/Makefile
>> index d0537573501e..5e1fc4f82883 100644
>> --- a/drivers/firmware/efi/libstub/Makefile
>> +++ b/drivers/firmware/efi/libstub/Makefile
>> @@ -25,7 +25,7 @@ cflags-$(CONFIG_ARM) := $(subst $(CC_FLAGS_FTRACE),,$(KBUILD_CFLAGS)) \
>> -fno-builtin -fpic \
>> $(call cc-option,-mno-single-pic-base)
>> cflags-$(CONFIG_RISCV) := $(subst $(CC_FLAGS_FTRACE),,$(KBUILD_CFLAGS)) \
>> - -fpic
>> + -fpic $(DISABLE_STACKLEAK_PLUGIN)
>>
>> cflags-$(CONFIG_EFI_GENERIC_STUB) += -I$(srctree)/scripts/dtc/libfdt
>>
>> --
>> 2.17.1
>>
>>
>> _______________________________________________
>> linux-riscv mailing list
>> linux-riscv@lists.infradead.org
>> http://lists.infradead.org/mailman/listinfo/linux-riscv
>
_______________________________________________
linux-riscv mailing list
linux-riscv@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-riscv
next prev parent reply other threads:[~2022-10-07 2:31 UTC|newest]
Thread overview: 11+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-09-03 16:23 [PATCH V2 0/3] arch: Cleanup ptrace_disable guoren
2022-08-28 13:54 ` [PATCH] RISC-V: Add STACKLEAK erasing the kernel stack at the end of syscalls Xianting Tian
2022-09-03 16:23 ` guoren
2022-09-06 17:35 ` Conor.Dooley
2022-09-07 1:51 ` Guo Ren
2022-10-07 2:31 ` Palmer Dabbelt [this message]
2022-10-07 11:29 ` Mark Rutland
2022-10-08 0:00 ` Guo Ren
2022-09-03 16:23 ` [PATCH V2 1/3] riscv: ptrace: Remove duplicate operation guoren
2022-09-03 16:23 ` [PATCH V2 2/3] openrisc: " guoren
2022-09-03 16:23 ` [PATCH V2 3/3] arch: ptrace: Cleanup ptrace_disable guoren
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=mhng-8c3bb2e7-e84e-4aaa-bce8-3e8054255a2c@palmer-ri-x1c9 \
--to=palmer@dabbelt.com \
--cc=Conor.Dooley@microchip.com \
--cc=aou@eecs.berkeley.edu \
--cc=ardb@kernel.org \
--cc=arnd@arndb.de \
--cc=daolu@rivosinc.com \
--cc=davem@davemloft.net \
--cc=dinguyen@kernel.org \
--cc=guoren@kernel.org \
--cc=heiko@sntech.de \
--cc=linux-arch@vger.kernel.org \
--cc=linux-arm-kernel@lists.infradead.org \
--cc=linux-efi@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-riscv@lists.infradead.org \
--cc=linux-snps-arc@lists.infradead.org \
--cc=linux@armlinux.org.uk \
--cc=monstr@monstr.eu \
--cc=oleg@redhat.com \
--cc=openrisc@lists.librecores.org \
--cc=paul.walmsley@sifive.com \
--cc=shorne@gmail.com \
--cc=sparclinux@vger.kernel.org \
--cc=vgupta@kernel.org \
--cc=xianting.tian@linux.alibaba.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).