From: Andy Chiu <andy.chiu@sifive.com>
To: linux-riscv@lists.infradead.org, palmer@dabbelt.com,
anup@brainfault.org, atishp@atishpatra.org,
kvm-riscv@lists.infradead.org, kvm@vger.kernel.org
Cc: vineetg@rivosinc.com, greentime.hu@sifive.com,
guoren@linux.alibaba.com, ShihPo Hung <shihpo.hung@sifive.com>,
Vincent Chen <vincent.chen@sifive.com>,
Andy Chiu <andy.chiu@sifive.com>,
Paul Walmsley <paul.walmsley@sifive.com>,
Albert Ou <aou@eecs.berkeley.edu>,
Conor Dooley <conor.dooley@microchip.com>,
Alexandre Ghiti <alexandre.ghiti@canonical.com>,
Masahiro Yamada <masahiroy@kernel.org>,
Guo Ren <guoren@kernel.org>
Subject: [PATCH -next v16 16/20] riscv: prevent stack corruption by reserving task_pt_regs(p) early
Date: Thu, 23 Mar 2023 14:59:20 +0000 [thread overview]
Message-ID: <20230323145924.4194-17-andy.chiu@sifive.com> (raw)
In-Reply-To: <20230323145924.4194-1-andy.chiu@sifive.com>
From: Greentime Hu <greentime.hu@sifive.com>
Early function calls, such as setup_vm(), relocate_enable_mmu(),
soc_early_init() etc, are free to operate on stack. However,
PT_SIZE_ON_STACK bytes at the head of the kernel stack are purposedly
reserved for the placement of per-task register context pointed by
task_pt_regs(p). Those functions may corrupt task_pt_regs if we overlap
the $sp with it. In fact, we had accidentally corrupted sstatus.VS in some
tests, treating the kernel to save V context before V was actually
allocated, resulting in a kernel panic.
Thus, we should skip PT_SIZE_ON_STACK for $sp before making C function
calls from the top-level assembly.
Co-developed-by: ShihPo Hung <shihpo.hung@sifive.com>
Signed-off-by: ShihPo Hung <shihpo.hung@sifive.com>
Co-developed-by: Vincent Chen <vincent.chen@sifive.com>
Signed-off-by: Vincent Chen <vincent.chen@sifive.com>
Signed-off-by: Greentime Hu <greentime.hu@sifive.com>
Signed-off-by: Andy Chiu <andy.chiu@sifive.com>
Reviewed-by: Conor Dooley <conor.dooley@microchip.com>
---
arch/riscv/kernel/head.S | 2 ++
1 file changed, 2 insertions(+)
diff --git a/arch/riscv/kernel/head.S b/arch/riscv/kernel/head.S
index e16bb2185d55..11c3b94c4534 100644
--- a/arch/riscv/kernel/head.S
+++ b/arch/riscv/kernel/head.S
@@ -301,6 +301,7 @@ clear_bss_done:
la tp, init_task
la sp, init_thread_union + THREAD_SIZE
XIP_FIXUP_OFFSET sp
+ addi sp, sp, -PT_SIZE_ON_STACK
#ifdef CONFIG_BUILTIN_DTB
la a0, __dtb_start
XIP_FIXUP_OFFSET a0
@@ -318,6 +319,7 @@ clear_bss_done:
/* Restore C environment */
la tp, init_task
la sp, init_thread_union + THREAD_SIZE
+ addi sp, sp, -PT_SIZE_ON_STACK
#ifdef CONFIG_KASAN
call kasan_early_init
--
2.17.1
_______________________________________________
linux-riscv mailing list
linux-riscv@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-riscv
WARNING: multiple messages have this Message-ID (diff)
From: Andy Chiu <andy.chiu@sifive.com>
To: linux-riscv@lists.infradead.org, palmer@dabbelt.com,
anup@brainfault.org, atishp@atishpatra.org,
kvm-riscv@lists.infradead.org, kvm@vger.kernel.org
Cc: vineetg@rivosinc.com, greentime.hu@sifive.com,
guoren@linux.alibaba.com, ShihPo Hung <shihpo.hung@sifive.com>,
Vincent Chen <vincent.chen@sifive.com>,
Andy Chiu <andy.chiu@sifive.com>,
Paul Walmsley <paul.walmsley@sifive.com>,
Albert Ou <aou@eecs.berkeley.edu>,
Conor Dooley <conor.dooley@microchip.com>,
Alexandre Ghiti <alexandre.ghiti@canonical.com>,
Masahiro Yamada <masahiroy@kernel.org>,
Guo Ren <guoren@kernel.org>
Subject: [PATCH -next v16 16/20] riscv: prevent stack corruption by reserving task_pt_regs(p) early
Date: Thu, 23 Mar 2023 14:59:20 +0000 [thread overview]
Message-ID: <20230323145924.4194-17-andy.chiu@sifive.com> (raw)
In-Reply-To: <20230323145924.4194-1-andy.chiu@sifive.com>
From: Greentime Hu <greentime.hu@sifive.com>
Early function calls, such as setup_vm(), relocate_enable_mmu(),
soc_early_init() etc, are free to operate on stack. However,
PT_SIZE_ON_STACK bytes at the head of the kernel stack are purposedly
reserved for the placement of per-task register context pointed by
task_pt_regs(p). Those functions may corrupt task_pt_regs if we overlap
the $sp with it. In fact, we had accidentally corrupted sstatus.VS in some
tests, treating the kernel to save V context before V was actually
allocated, resulting in a kernel panic.
Thus, we should skip PT_SIZE_ON_STACK for $sp before making C function
calls from the top-level assembly.
Co-developed-by: ShihPo Hung <shihpo.hung@sifive.com>
Signed-off-by: ShihPo Hung <shihpo.hung@sifive.com>
Co-developed-by: Vincent Chen <vincent.chen@sifive.com>
Signed-off-by: Vincent Chen <vincent.chen@sifive.com>
Signed-off-by: Greentime Hu <greentime.hu@sifive.com>
Signed-off-by: Andy Chiu <andy.chiu@sifive.com>
Reviewed-by: Conor Dooley <conor.dooley@microchip.com>
---
arch/riscv/kernel/head.S | 2 ++
1 file changed, 2 insertions(+)
diff --git a/arch/riscv/kernel/head.S b/arch/riscv/kernel/head.S
index e16bb2185d55..11c3b94c4534 100644
--- a/arch/riscv/kernel/head.S
+++ b/arch/riscv/kernel/head.S
@@ -301,6 +301,7 @@ clear_bss_done:
la tp, init_task
la sp, init_thread_union + THREAD_SIZE
XIP_FIXUP_OFFSET sp
+ addi sp, sp, -PT_SIZE_ON_STACK
#ifdef CONFIG_BUILTIN_DTB
la a0, __dtb_start
XIP_FIXUP_OFFSET a0
@@ -318,6 +319,7 @@ clear_bss_done:
/* Restore C environment */
la tp, init_task
la sp, init_thread_union + THREAD_SIZE
+ addi sp, sp, -PT_SIZE_ON_STACK
#ifdef CONFIG_KASAN
call kasan_early_init
--
2.17.1
next prev parent reply other threads:[~2023-03-23 15:01 UTC|newest]
Thread overview: 50+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-03-23 14:59 [PATCH -next v16 00/20] riscv: Add vector ISA support Andy Chiu
2023-03-23 14:59 ` Andy Chiu
2023-03-23 14:59 ` [PATCH -next v16 01/20] riscv: Rename __switch_to_aux() -> fpu Andy Chiu
2023-03-23 14:59 ` Andy Chiu
2023-03-23 14:59 ` [PATCH -next v16 02/20] riscv: Extending cpufeature.c to detect V-extension Andy Chiu
2023-03-23 14:59 ` Andy Chiu
2023-03-23 14:59 ` [PATCH -next v16 03/20] riscv: Add new csr defines related to vector extension Andy Chiu
2023-03-23 14:59 ` Andy Chiu
2023-03-23 14:59 ` [PATCH -next v16 04/20] riscv: Clear vector regfile on bootup Andy Chiu
2023-03-23 14:59 ` Andy Chiu
2023-03-23 14:59 ` [PATCH -next v16 05/20] riscv: Disable Vector Instructions for kernel itself Andy Chiu
2023-03-23 14:59 ` Andy Chiu
2023-03-23 14:59 ` [PATCH -next v16 06/20] riscv: Introduce Vector enable/disable helpers Andy Chiu
2023-03-23 14:59 ` Andy Chiu
2023-03-23 14:59 ` [PATCH -next v16 07/20] riscv: Introduce riscv_v_vsize to record size of Vector context Andy Chiu
2023-03-23 14:59 ` Andy Chiu
2023-03-23 14:59 ` [PATCH -next v16 08/20] riscv: Introduce struct/helpers to save/restore per-task Vector state Andy Chiu
2023-03-23 14:59 ` Andy Chiu
2023-03-23 14:59 ` [PATCH -next v16 09/20] riscv: Add task switch support for vector Andy Chiu
2023-03-23 14:59 ` Andy Chiu
2023-03-23 14:59 ` [PATCH -next v16 10/20] riscv: Allocate user's vector context in the first-use trap Andy Chiu
2023-03-23 14:59 ` Andy Chiu
2023-03-23 14:59 ` [PATCH -next v16 11/20] riscv: Add ptrace vector support Andy Chiu
2023-03-23 14:59 ` Andy Chiu
2023-03-23 14:59 ` [PATCH -next v16 12/20] riscv: signal: check fp-reserved words unconditionally Andy Chiu
2023-03-23 14:59 ` Andy Chiu
2023-03-23 14:59 ` [PATCH -next v16 13/20] riscv: signal: Add sigcontext save/restore for vector Andy Chiu
2023-03-23 14:59 ` Andy Chiu
2023-03-23 14:59 ` [PATCH -next v16 14/20] riscv: signal: Report signal frame size to userspace via auxv Andy Chiu
2023-03-23 14:59 ` Andy Chiu
2023-03-23 14:59 ` [PATCH -next v16 15/20] riscv: signal: validate altstack to reflect Vector Andy Chiu
2023-03-23 14:59 ` Andy Chiu
2023-03-23 14:59 ` Andy Chiu [this message]
2023-03-23 14:59 ` [PATCH -next v16 16/20] riscv: prevent stack corruption by reserving task_pt_regs(p) early Andy Chiu
2023-03-23 14:59 ` [PATCH -next v16 17/20] riscv: kvm: Add V extension to KVM ISA Andy Chiu
2023-03-23 14:59 ` Andy Chiu
2023-03-23 14:59 ` [PATCH -next v16 18/20] riscv: KVM: Add vector lazy save/restore support Andy Chiu
2023-03-23 14:59 ` Andy Chiu
2023-03-23 14:59 ` [PATCH -next v16 19/20] riscv: detect assembler support for .option arch Andy Chiu
2023-03-23 14:59 ` Andy Chiu
2023-03-23 15:26 ` Conor Dooley
2023-03-23 15:26 ` Conor Dooley
2023-03-24 14:59 ` Nathan Chancellor
2023-03-24 14:59 ` Nathan Chancellor
2023-03-28 12:55 ` Andy Chiu
2023-03-28 12:55 ` Andy Chiu
2023-03-23 14:59 ` [PATCH -next v16 20/20] riscv: Enable Vector code to be built Andy Chiu
2023-03-23 14:59 ` Andy Chiu
2023-03-27 6:21 ` [PATCH -next v16 00/20] riscv: Add vector ISA support Björn Töpel
2023-03-27 6:21 ` Björn Töpel
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20230323145924.4194-17-andy.chiu@sifive.com \
--to=andy.chiu@sifive.com \
--cc=alexandre.ghiti@canonical.com \
--cc=anup@brainfault.org \
--cc=aou@eecs.berkeley.edu \
--cc=atishp@atishpatra.org \
--cc=conor.dooley@microchip.com \
--cc=greentime.hu@sifive.com \
--cc=guoren@kernel.org \
--cc=guoren@linux.alibaba.com \
--cc=kvm-riscv@lists.infradead.org \
--cc=kvm@vger.kernel.org \
--cc=linux-riscv@lists.infradead.org \
--cc=masahiroy@kernel.org \
--cc=palmer@dabbelt.com \
--cc=paul.walmsley@sifive.com \
--cc=shihpo.hung@sifive.com \
--cc=vincent.chen@sifive.com \
--cc=vineetg@rivosinc.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.