linux-arch.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: Deepak Gupta <debug@rivosinc.com>
To: paul.walmsley@sifive.com, rick.p.edgecombe@intel.com,
	broonie@kernel.org, Szabolcs.Nagy@arm.com, kito.cheng@sifive.com,
	keescook@chromium.org, ajones@ventanamicro.com,
	conor.dooley@microchip.com, cleger@rivosinc.com,
	atishp@atishpatra.org, alex@ghiti.fr, bjorn@rivosinc.com,
	alexghiti@rivosinc.com, samuel.holland@sifive.com,
	conor@kernel.org
Cc: linux-doc@vger.kernel.org, linux-riscv@lists.infradead.org,
	linux-kernel@vger.kernel.org, devicetree@vger.kernel.org,
	linux-mm@kvack.org, linux-arch@vger.kernel.org,
	linux-kselftest@vger.kernel.org, corbet@lwn.net,
	palmer@dabbelt.com, aou@eecs.berkeley.edu, robh+dt@kernel.org,
	krzysztof.kozlowski+dt@linaro.org, oleg@redhat.com,
	akpm@linux-foundation.org, arnd@arndb.de, ebiederm@xmission.com,
	Liam.Howlett@oracle.com, vbabka@suse.cz, lstoakes@gmail.com,
	shuah@kernel.org, brauner@kernel.org, debug@rivosinc.com,
	andy.chiu@sifive.com, jerry.shih@sifive.com,
	hankuan.chen@sifive.com, greentime.hu@sifive.com,
	evan@rivosinc.com, xiao.w.wang@intel.com, charlie@rivosinc.com,
	apatel@ventanamicro.com, mchitale@ventanamicro.com,
	dbarboza@ventanamicro.com, sameo@rivosinc.com,
	shikemeng@huaweicloud.com, willy@infradead.org,
	vincent.chen@sifive.com, guoren@kernel.org,
	samitolvanen@google.com, songshuaishuai@tinylab.org,
	gerg@kernel.org, heiko@sntech.de, bhe@redhat.com,
	jeeheng.sia@starfivetech.com, cyy@cyyself.name,
	maskray@google.com, ancientmodern4@gmail.com,
	mathis.salmen@matsal.de, cuiyunhui@bytedance.com,
	bgray@linux.ibm.com, mpe@ellerman.id.au, baruch@tkos.co.il,
	alx@kernel.org, david@redhat.com, catalin.marinas@arm.com,
	revest@chromium.org, josh@joshtriplett.org, shr@devkernel.io,
	deller@gmx.de, omosnace@redhat.com, ojeda@kernel.org,
	jhubbard@nvidia.com
Subject: [PATCH v3 23/29] riscv signal: Save and restore of shadow stack for signal
Date: Wed,  3 Apr 2024 16:35:11 -0700	[thread overview]
Message-ID: <20240403234054.2020347-24-debug@rivosinc.com> (raw)
In-Reply-To: <20240403234054.2020347-1-debug@rivosinc.com>

Save shadow stack pointer in sigcontext structure while delivering signal.
Restore shadow stack pointer from sigcontext on sigreturn.

As part of save operation, kernel uses `ssamoswap` to save snapshot of
current shadow stack on shadow stack itself (can be called as a save
token). During restore on sigreturn, kernel retrieves token from top of
shadow stack and validates it. This allows that user mode can't arbitrary
pivot to any shadow stack address without having a token and thus provide
strong security assurance between signaly delivery and sigreturn window.

Signed-off-by: Deepak Gupta <debug@rivosinc.com>
---
 arch/riscv/include/asm/usercfi.h | 19 +++++++++++
 arch/riscv/kernel/signal.c       | 45 +++++++++++++++++++++++++
 arch/riscv/kernel/usercfi.c      | 57 ++++++++++++++++++++++++++++++++
 3 files changed, 121 insertions(+)

diff --git a/arch/riscv/include/asm/usercfi.h b/arch/riscv/include/asm/usercfi.h
index 8accdc8ec164..507a27d5f53c 100644
--- a/arch/riscv/include/asm/usercfi.h
+++ b/arch/riscv/include/asm/usercfi.h
@@ -8,6 +8,7 @@
 #ifndef __ASSEMBLY__
 #include <linux/types.h>
 #include <linux/prctl.h>
+#include <linux/errno.h>
 
 struct task_struct;
 struct kernel_clone_args;
@@ -35,6 +36,9 @@ void set_shstk_status(struct task_struct *task, bool enable);
 bool is_indir_lp_enabled(struct task_struct *task);
 bool is_indir_lp_locked(struct task_struct *task);
 void set_indir_lp_status(struct task_struct *task, bool enable);
+unsigned long get_active_shstk(struct task_struct *task);
+int restore_user_shstk(struct task_struct *tsk, unsigned long shstk_ptr);
+int save_user_shstk(struct task_struct *tsk, unsigned long *saved_shstk_ptr);
 
 #define PR_SHADOW_STACK_SUPPORTED_STATUS_MASK (PR_SHADOW_STACK_ENABLE)
 
@@ -77,6 +81,16 @@ static inline void set_shstk_status(struct task_struct *task, bool enable)
 
 }
 
+static inline int restore_user_shstk(struct task_struct *tsk, unsigned long shstk_ptr)
+{
+	return -EINVAL;
+}
+
+static inline int save_user_shstk(struct task_struct *tsk, unsigned long *saved_shstk_ptr)
+{
+	return -EINVAL;
+}
+
 static inline bool is_indir_lp_enabled(struct task_struct *task)
 {
 	return false;
@@ -92,6 +106,11 @@ static inline void set_indir_lp_status(struct task_struct *task, bool enable)
 
 }
 
+static inline unsigned long get_active_shstk(struct task_struct *task)
+{
+	return 0;
+}
+
 #endif /* CONFIG_RISCV_USER_CFI */
 
 #endif /* __ASSEMBLY__ */
diff --git a/arch/riscv/kernel/signal.c b/arch/riscv/kernel/signal.c
index 501e66debf69..428a886ab6ef 100644
--- a/arch/riscv/kernel/signal.c
+++ b/arch/riscv/kernel/signal.c
@@ -22,6 +22,7 @@
 #include <asm/vector.h>
 #include <asm/csr.h>
 #include <asm/cacheflush.h>
+#include <asm/usercfi.h>
 
 unsigned long signal_minsigstksz __ro_after_init;
 
@@ -232,6 +233,7 @@ SYSCALL_DEFINE0(rt_sigreturn)
 	struct pt_regs *regs = current_pt_regs();
 	struct rt_sigframe __user *frame;
 	struct task_struct *task;
+	unsigned long ss_ptr = 0;
 	sigset_t set;
 	size_t frame_size = get_rt_frame_size(false);
 
@@ -254,6 +256,26 @@ SYSCALL_DEFINE0(rt_sigreturn)
 	if (restore_altstack(&frame->uc.uc_stack))
 		goto badframe;
 
+	/*
+	 * Restore shadow stack as a form of token stored on shadow stack itself as a safe
+	 * way to restore.
+	 * A token on shadow gives following properties
+	 *	- Safe save and restore for shadow stack switching. Any save of shadow stack
+	 *	  must have had saved a token on shadow stack. Similarly any restore of shadow
+	 *	  stack must check the token before restore. Since writing to shadow stack with
+	 *	  address of shadow stack itself is not easily allowed. A restore without a save
+	 *	  is quite difficult for an attacker to perform.
+	 *	- A natural break. A token in shadow stack provides a natural break in shadow stack
+	 *	  So a single linear range can be bucketed into different shadow stack segments.
+	 *	  sspopchk will detect the condition and fault to kernel as sw check exception.
+	 */
+	if (__copy_from_user(&ss_ptr, &frame->uc.uc_mcontext.sc_cfi_state.ss_ptr,
+						 sizeof(unsigned long)))
+		goto badframe;
+
+	if (is_shstk_enabled(current) && restore_user_shstk(current, ss_ptr))
+		goto badframe;
+
 	regs->cause = -1UL;
 
 	return regs->a0;
@@ -323,6 +345,7 @@ static int setup_rt_frame(struct ksignal *ksig, sigset_t *set,
 	struct rt_sigframe __user *frame;
 	long err = 0;
 	unsigned long __maybe_unused addr;
+	unsigned long ss_ptr = 0;
 	size_t frame_size = get_rt_frame_size(false);
 
 	frame = get_sigframe(ksig, regs, frame_size);
@@ -334,6 +357,23 @@ static int setup_rt_frame(struct ksignal *ksig, sigset_t *set,
 	/* Create the ucontext. */
 	err |= __put_user(0, &frame->uc.uc_flags);
 	err |= __put_user(NULL, &frame->uc.uc_link);
+	/*
+	 * Save a pointer to shadow stack itself on shadow stack as a form of token.
+	 * A token on shadow gives following properties
+	 *	- Safe save and restore for shadow stack switching. Any save of shadow stack
+	 *	  must have had saved a token on shadow stack. Similarly any restore of shadow
+	 *	  stack must check the token before restore. Since writing to shadow stack with
+	 *	  address of shadow stack itself is not easily allowed. A restore without a save
+	 *	  is quite difficult for an attacker to perform.
+	 *	- A natural break. A token in shadow stack provides a natural break in shadow stack
+	 *	  So a single linear range can be bucketed into different shadow stack segments. Any
+	 *	  sspopchk will detect the condition and fault to kernel as sw check exception.
+	 */
+	if (is_shstk_enabled(current)) {
+		err |= save_user_shstk(current, &ss_ptr);
+		err |= __put_user(ss_ptr, &frame->uc.uc_mcontext.sc_cfi_state.ss_ptr);
+	}
+
 	err |= __save_altstack(&frame->uc.uc_stack, regs->sp);
 	err |= setup_sigcontext(frame, regs);
 	err |= __copy_to_user(&frame->uc.uc_sigmask, set, sizeof(*set));
@@ -344,6 +384,11 @@ static int setup_rt_frame(struct ksignal *ksig, sigset_t *set,
 #ifdef CONFIG_MMU
 	regs->ra = (unsigned long)VDSO_SYMBOL(
 		current->mm->context.vdso, rt_sigreturn);
+
+	/* if bcfi is enabled x1 (ra) and x5 (t0) must match. not sure if we need this? */
+	if (is_shstk_enabled(current))
+		regs->t0 = regs->ra;
+
 #else
 	/*
 	 * For the nommu case we don't have a VDSO.  Instead we push two
diff --git a/arch/riscv/kernel/usercfi.c b/arch/riscv/kernel/usercfi.c
index 13920b9d86f3..db5b32500050 100644
--- a/arch/riscv/kernel/usercfi.c
+++ b/arch/riscv/kernel/usercfi.c
@@ -52,6 +52,11 @@ void set_active_shstk(struct task_struct *task, unsigned long shstk_addr)
 	task->thread_info.user_cfi_state.user_shdw_stk = shstk_addr;
 }
 
+unsigned long get_active_shstk(struct task_struct *task)
+{
+	return task->thread_info.user_cfi_state.user_shdw_stk;
+}
+
 void set_shstk_status(struct task_struct *task, bool enable)
 {
 	task->thread_info.user_cfi_state.ubcfi_en = enable ? 1 : 0;
@@ -168,6 +173,58 @@ static int create_rstor_token(unsigned long ssp, unsigned long *token_addr)
 	return 0;
 }
 
+/*
+ * Save user shadow stack pointer on shadow stack itself and return pointer to saved location
+ * returns -EFAULT if operation was unsuccessful
+ */
+int save_user_shstk(struct task_struct *tsk, unsigned long *saved_shstk_ptr)
+{
+	unsigned long ss_ptr = 0;
+	unsigned long token_loc = 0;
+	int ret = 0;
+
+	if (saved_shstk_ptr == NULL)
+		return -EINVAL;
+
+	ss_ptr = get_active_shstk(tsk);
+	ret = create_rstor_token(ss_ptr, &token_loc);
+
+	if (!ret) {
+		*saved_shstk_ptr = token_loc;
+		set_active_shstk(tsk, token_loc);
+	}
+
+	return ret;
+}
+
+/*
+ * Restores user shadow stack pointer from token on shadow stack for task `tsk`
+ * returns -EFAULT if operation was unsuccessful
+ */
+int restore_user_shstk(struct task_struct *tsk, unsigned long shstk_ptr)
+{
+	unsigned long token = 0;
+
+	token = amo_user_shstk((unsigned long __user *)shstk_ptr, 0);
+
+	if (token == -1)
+		return -EFAULT;
+
+	/* invalid token, return EINVAL */
+	if ((token - shstk_ptr) != SHSTK_ENTRY_SIZE) {
+		pr_info_ratelimited(
+				"%s[%d]: bad restore token in %s: pc=%p sp=%p, token=%p, shstk_ptr=%p\n",
+				tsk->comm, task_pid_nr(tsk), __func__,
+				(void *)(task_pt_regs(tsk)->epc), (void *)(task_pt_regs(tsk)->sp),
+				(void *)token, (void *)shstk_ptr);
+		return -EINVAL;
+	}
+
+	/* all checks passed, set active shstk and return success */
+	set_active_shstk(tsk, token);
+	return 0;
+}
+
 static unsigned long allocate_shadow_stack(unsigned long addr, unsigned long size,
 				unsigned long token_offset,
 				bool set_tok)
-- 
2.43.2


  parent reply	other threads:[~2024-04-03 23:42 UTC|newest]

Thread overview: 82+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2024-04-03 23:34 [PATCH v3 00/29] riscv control-flow integrity for usermode Deepak Gupta
2024-04-03 23:34 ` [PATCH v3 01/29] riscv: envcfg save and restore on task switching Deepak Gupta
2024-05-09  0:10   ` Charlie Jenkins
2024-05-09 19:00     ` Deepak Gupta
2024-04-03 23:34 ` [PATCH v3 02/29] riscv: define default value for envcfg for task Deepak Gupta
2024-05-10 22:33   ` Charlie Jenkins
2024-05-13 18:33     ` Deepak Gupta
2024-04-03 23:34 ` [PATCH v3 03/29] riscv/Kconfig: enable HAVE_EXIT_THREAD for riscv Deepak Gupta
2024-05-10 22:36   ` Charlie Jenkins
2024-04-03 23:34 ` [PATCH v3 04/29] riscv: zicfilp / zicfiss in dt-bindings (extensions.yaml) Deepak Gupta
2024-04-10 11:58   ` Rob Herring
2024-04-10 21:37     ` Deepak Gupta
2024-04-15 19:41       ` Rob Herring
2024-04-16 15:44         ` Deepak Gupta
2024-05-09 18:14           ` Conor Dooley
2024-05-09 18:46             ` Deepak Gupta
2024-05-09 20:32               ` Conor Dooley
2024-05-09 23:26                 ` Deepak Gupta
2024-04-03 23:34 ` [PATCH v3 05/29] riscv: zicfiss / zicfilp enumeration Deepak Gupta
2024-05-09  0:00   ` Andy Chiu
2024-05-09  0:07     ` Charlie Jenkins
2024-04-03 23:34 ` [PATCH v3 06/29] riscv: zicfiss / zicfilp extension csr and bit definitions Deepak Gupta
2024-05-10 22:37   ` Charlie Jenkins
2024-04-03 23:34 ` [PATCH v3 07/29] riscv: usercfi state for task and save/restore of CSR_SSP on trap entry/exit Deepak Gupta
2024-05-10 22:51   ` Charlie Jenkins
2024-04-03 23:34 ` [PATCH v3 08/29] mm: Define VM_SHADOW_STACK for RISC-V Deepak Gupta
2024-04-04 18:58   ` David Hildenbrand
2024-04-04 19:04     ` Mark Brown
2024-04-04 19:15       ` David Hildenbrand
2024-04-04 19:21         ` Deepak Gupta
2024-04-03 23:34 ` [PATCH v3 09/29] mm: abstract shadow stack vma behind `vma_is_shadow_stack` Deepak Gupta
2024-04-04 19:02   ` David Hildenbrand
2024-04-04 21:39     ` Deepak Gupta
2024-04-03 23:34 ` [PATCH v3 10/29] riscv/mm : ensure PROT_WRITE leads to VM_READ | VM_WRITE Deepak Gupta
2024-05-10 21:02   ` Charlie Jenkins
2024-05-13 17:47     ` Deepak Gupta
2024-05-13 18:36       ` Charlie Jenkins
2024-05-13 18:41         ` Deepak Gupta
2024-05-13 21:26           ` Charlie Jenkins
2024-05-12 16:24   ` Alexandre Ghiti
2024-05-13 18:29     ` Deepak Gupta
2024-04-03 23:34 ` [PATCH v3 11/29] riscv mm: manufacture shadow stack pte Deepak Gupta
2024-05-12 16:26   ` Alexandre Ghiti
2024-04-03 23:35 ` [PATCH v3 12/29] riscv mmu: teach pte_mkwrite to manufacture shadow stack PTEs Deepak Gupta
2024-05-12 16:28   ` Alexandre Ghiti
2024-05-13 17:33     ` Deepak Gupta
2024-04-03 23:35 ` [PATCH v3 13/29] riscv mmu: write protect and shadow stack Deepak Gupta
2024-05-12 16:31   ` Alexandre Ghiti
2024-05-13 17:32     ` Deepak Gupta
2024-05-23 14:59       ` Alexandre Ghiti
2024-05-24  7:16         ` Deepak Gupta
2024-04-03 23:35 ` [PATCH v3 14/29] riscv/mm: Implement map_shadow_stack() syscall Deepak Gupta
2024-05-12 16:50   ` Alexandre Ghiti
2024-05-13 17:25     ` Deepak Gupta
2024-04-03 23:35 ` [PATCH v3 15/29] riscv/shstk: If needed allocate a new shadow stack on clone Deepak Gupta
2024-05-12 17:05   ` Alexandre Ghiti
2024-05-13 17:10     ` Deepak Gupta
2024-04-03 23:35 ` [PATCH v3 16/29] prctl: arch-agnostic prctl for shadow stack Deepak Gupta
2024-04-03 23:35 ` [PATCH v3 17/29] prctl: arch-agnostic prctl for indirect branch tracking Deepak Gupta
2024-05-10 23:29   ` Charlie Jenkins
2024-05-13 18:31     ` Deepak Gupta
2024-04-03 23:35 ` [PATCH v3 18/29] riscv: Implements arch agnostic shadow stack prctls Deepak Gupta
2024-04-03 23:35 ` [PATCH v3 19/29] riscv: Implements arch agnostic indirect branch tracking prctls Deepak Gupta
2024-04-03 23:35 ` [PATCH v3 20/29] riscv/kernel: update __show_regs to print shadow stack register Deepak Gupta
2024-05-12 17:10   ` Alexandre Ghiti
2024-04-03 23:35 ` [PATCH v3 21/29] riscv/traps: Introduce software check exception Deepak Gupta
2024-04-03 23:35 ` [PATCH v3 22/29] riscv sigcontext: adding cfi state field in sigcontext Deepak Gupta
2024-05-24  9:46   ` Andy Chiu
2024-05-24 19:11     ` Deepak Gupta
2024-04-03 23:35 ` Deepak Gupta [this message]
2024-04-03 23:35 ` [PATCH v3 24/29] riscv/ptrace: riscv cfi status and state via ptrace and in core files Deepak Gupta
2024-04-03 23:35 ` [PATCH v3 25/29] riscv/hwprobe: zicfilp / zicfiss enumeration in hwprobe Deepak Gupta
2024-04-03 23:35 ` [PATCH v3 26/29] riscv: create a config for shadow stack and landing pad instr support Deepak Gupta
2024-04-03 23:35 ` [PATCH v3 27/29] riscv: Documentation for landing pad / indirect branch tracking Deepak Gupta
2024-05-10 20:30   ` Charlie Jenkins
2024-05-13 17:07     ` Deepak Gupta
2024-04-03 23:35 ` [PATCH v3 28/29] riscv: Documentation for shadow stack on riscv Deepak Gupta
2024-04-03 23:35 ` [PATCH v3 29/29] kselftest/riscv: kselftest for user mode cfi Deepak Gupta
2024-05-09 18:21   ` Charlie Jenkins
2024-05-09 19:16     ` Deepak Gupta
2024-05-10  1:20   ` Charlie Jenkins
2024-05-09  0:33 ` [PATCH v3 00/29] riscv control-flow integrity for usermode Charlie Jenkins

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20240403234054.2020347-24-debug@rivosinc.com \
    --to=debug@rivosinc.com \
    --cc=Liam.Howlett@oracle.com \
    --cc=Szabolcs.Nagy@arm.com \
    --cc=ajones@ventanamicro.com \
    --cc=akpm@linux-foundation.org \
    --cc=alex@ghiti.fr \
    --cc=alexghiti@rivosinc.com \
    --cc=alx@kernel.org \
    --cc=ancientmodern4@gmail.com \
    --cc=andy.chiu@sifive.com \
    --cc=aou@eecs.berkeley.edu \
    --cc=apatel@ventanamicro.com \
    --cc=arnd@arndb.de \
    --cc=atishp@atishpatra.org \
    --cc=baruch@tkos.co.il \
    --cc=bgray@linux.ibm.com \
    --cc=bhe@redhat.com \
    --cc=bjorn@rivosinc.com \
    --cc=brauner@kernel.org \
    --cc=broonie@kernel.org \
    --cc=catalin.marinas@arm.com \
    --cc=charlie@rivosinc.com \
    --cc=cleger@rivosinc.com \
    --cc=conor.dooley@microchip.com \
    --cc=conor@kernel.org \
    --cc=corbet@lwn.net \
    --cc=cuiyunhui@bytedance.com \
    --cc=cyy@cyyself.name \
    --cc=david@redhat.com \
    --cc=dbarboza@ventanamicro.com \
    --cc=deller@gmx.de \
    --cc=devicetree@vger.kernel.org \
    --cc=ebiederm@xmission.com \
    --cc=evan@rivosinc.com \
    --cc=gerg@kernel.org \
    --cc=greentime.hu@sifive.com \
    --cc=guoren@kernel.org \
    --cc=hankuan.chen@sifive.com \
    --cc=heiko@sntech.de \
    --cc=jeeheng.sia@starfivetech.com \
    --cc=jerry.shih@sifive.com \
    --cc=jhubbard@nvidia.com \
    --cc=josh@joshtriplett.org \
    --cc=keescook@chromium.org \
    --cc=kito.cheng@sifive.com \
    --cc=krzysztof.kozlowski+dt@linaro.org \
    --cc=linux-arch@vger.kernel.org \
    --cc=linux-doc@vger.kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=linux-kselftest@vger.kernel.org \
    --cc=linux-mm@kvack.org \
    --cc=linux-riscv@lists.infradead.org \
    --cc=lstoakes@gmail.com \
    --cc=maskray@google.com \
    --cc=mathis.salmen@matsal.de \
    --cc=mchitale@ventanamicro.com \
    --cc=mpe@ellerman.id.au \
    --cc=ojeda@kernel.org \
    --cc=oleg@redhat.com \
    --cc=omosnace@redhat.com \
    --cc=palmer@dabbelt.com \
    --cc=paul.walmsley@sifive.com \
    --cc=revest@chromium.org \
    --cc=rick.p.edgecombe@intel.com \
    --cc=robh+dt@kernel.org \
    --cc=sameo@rivosinc.com \
    --cc=samitolvanen@google.com \
    --cc=samuel.holland@sifive.com \
    --cc=shikemeng@huaweicloud.com \
    --cc=shr@devkernel.io \
    --cc=shuah@kernel.org \
    --cc=songshuaishuai@tinylab.org \
    --cc=vbabka@suse.cz \
    --cc=vincent.chen@sifive.com \
    --cc=willy@infradead.org \
    --cc=xiao.w.wang@intel.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).