Linux kernel mirror (for testing)
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel
os
linux
arch/riscv: compile vdso with landing pad and shadow stack note
User mode tasks compiled with Zicfilp may call indirectly into the
vdso (like hwprobe indirect calls). Add support for compiling landing
pads into the vdso. Landing pad instructions in the vdso will be
no-ops for tasks which have not enabled landing pads. Furthermore, add
support for the C sources of the vdso to be compiled with shadow stack
and landing pads enabled as well.
Landing pad and shadow stack instructions are emitted only when the
VDSO_CFI cflags option is defined during compile.
Signed-off-by: Jim Shu <jim.shu@sifive.com>
Reviewed-by: Zong Li <zong.li@sifive.com>
Signed-off-by: Deepak Gupta <debug@rivosinc.com>
Tested-by: Andreas Korb <andreas.korb@aisec.fraunhofer.de> # QEMU, custom CVA6
Tested-by: Valentin Haudiquet <valentin.haudiquet@canonical.com>
Link: https://patch.msgid.link/20251112-v5_user_cfi_series-v23-23-b55691eacf4f@rivosinc.com
[pjw@kernel.org: cleaned up patch description, issues reported by checkpatch]
Signed-off-by: Paul Walmsley <pjw@kernel.org>
authored by
Jim Shu
and committed by
Paul Walmsley
37f57bd3
41213bf2
+81
-3
+4
-1
arch/riscv/Makefile
+4
-1
arch/riscv/Makefile
···
81
81
# Check if the toolchain supports Zabha
82
82
riscv-march-$(CONFIG_TOOLCHAIN_HAS_ZABHA) := $(riscv-march-y)_zabha
83
83
84
+
KBUILD_BASE_ISA = -march=$(shell echo $(riscv-march-y) | sed -E 's/(rv32ima|rv64ima)fd([^v_]*)v?/\1\2/')
85
+
export KBUILD_BASE_ISA
86
+
84
87
# Remove F,D,V from isa string for all. Keep extensions between "fd" and "v" by
85
88
# matching non-v and non-multi-letter extensions out with the filter ([^v_]*)
86
-
KBUILD_CFLAGS += -march=$(shell echo $(riscv-march-y) | sed -E 's/(rv32ima|rv64ima)fd([^v_]*)v?/\1\2/')
89
+
KBUILD_CFLAGS += $(KBUILD_BASE_ISA)
87
90
88
91
KBUILD_AFLAGS += -march=$(riscv-march-y)
89
92
+44
arch/riscv/include/asm/assembler.h
+44
arch/riscv/include/asm/assembler.h
···
80
80
.endm
81
81
82
82
#endif /* __ASM_ASSEMBLER_H */
83
+
84
+
#if defined(VDSO_CFI) && (__riscv_xlen == 64)
85
+
.macro vdso_lpad, label = 0
86
+
lpad \label
87
+
.endm
88
+
#else
89
+
.macro vdso_lpad, label = 0
90
+
.endm
91
+
#endif
92
+
93
+
/*
94
+
* This macro emits a program property note section identifying
95
+
* architecture features which require special handling, mainly for
96
+
* use in assembly files included in the VDSO.
97
+
*/
98
+
#define NT_GNU_PROPERTY_TYPE_0 5
99
+
#define GNU_PROPERTY_RISCV_FEATURE_1_AND 0xc0000000
100
+
101
+
#define GNU_PROPERTY_RISCV_FEATURE_1_ZICFILP BIT(0)
102
+
#define GNU_PROPERTY_RISCV_FEATURE_1_ZICFISS BIT(1)
103
+
104
+
#if defined(VDSO_CFI) && (__riscv_xlen == 64)
105
+
#define GNU_PROPERTY_RISCV_FEATURE_1_DEFAULT \
106
+
(GNU_PROPERTY_RISCV_FEATURE_1_ZICFILP | GNU_PROPERTY_RISCV_FEATURE_1_ZICFISS)
107
+
#endif
108
+
109
+
#ifdef GNU_PROPERTY_RISCV_FEATURE_1_DEFAULT
110
+
.macro emit_riscv_feature_1_and, feat = GNU_PROPERTY_RISCV_FEATURE_1_DEFAULT
111
+
.pushsection .note.gnu.property, "a"
112
+
.p2align 3
113
+
.word 4
114
+
.word 16
115
+
.word NT_GNU_PROPERTY_TYPE_0
116
+
.asciz "GNU"
117
+
.word GNU_PROPERTY_RISCV_FEATURE_1_AND
118
+
.word 4
119
+
.word \feat
120
+
.word 0
121
+
.popsection
122
+
.endm
123
+
#else
124
+
.macro emit_riscv_feature_1_and, feat = 0
125
+
.endm
126
+
#endif
+10
-1
arch/riscv/kernel/vdso/Makefile
+10
-1
arch/riscv/kernel/vdso/Makefile
···
17
17
vdso-syms += getrandom
18
18
endif
19
19
20
+
ifdef VDSO_CFI_BUILD
21
+
CFI_MARCH = _zicfilp_zicfiss
22
+
CFI_FULL = -fcf-protection=full
23
+
endif
24
+
20
25
# Files to link into the vdso
21
26
obj-vdso = $(patsubst %, %.o, $(vdso-syms)) note.o
22
27
···
32
27
ccflags-y := -fno-stack-protector
33
28
ccflags-y += -DDISABLE_BRANCH_PROFILING
34
29
ccflags-y += -fno-builtin
30
+
ccflags-y += $(KBUILD_BASE_ISA)$(CFI_MARCH)
31
+
ccflags-y += $(CFI_FULL)
32
+
asflags-y += $(KBUILD_BASE_ISA)$(CFI_MARCH)
33
+
asflags-y += $(CFI_FULL)
35
34
36
35
ifneq ($(c-gettimeofday-y),)
37
36
CFLAGS_vgettimeofday.o += -fPIC -include $(c-gettimeofday-y)
···
88
79
# The DSO images are built using a special linker script
89
80
# Make sure only to export the intended __vdso_xxx symbol offsets.
90
81
quiet_cmd_vdsold_and_check = VDSOLD $@
91
-
cmd_vdsold_and_check = $(LD) $(ld_flags) -T $(filter-out FORCE,$^) -o $@.tmp && \
82
+
cmd_vdsold_and_check = $(LD) $(CFI_FULL) $(ld_flags) -T $(filter-out FORCE,$^) -o $@.tmp && \
92
83
$(OBJCOPY) $(patsubst %, -G __vdso_%, $(vdso-syms)) $@.tmp $@ && \
93
84
rm $@.tmp && \
94
85
$(cmd_vdso_check)
+4
arch/riscv/kernel/vdso/flush_icache.S
+4
arch/riscv/kernel/vdso/flush_icache.S
···
5
5
6
6
#include <linux/linkage.h>
7
7
#include <asm/unistd.h>
8
+
#include <asm/assembler.h>
8
9
9
10
.text
10
11
/* int __vdso_flush_icache(void *start, void *end, unsigned long flags); */
11
12
SYM_FUNC_START(__vdso_flush_icache)
12
13
.cfi_startproc
14
+
vdso_lpad
13
15
#ifdef CONFIG_SMP
14
16
li a7, __NR_riscv_flush_icache
15
17
ecall
···
22
20
ret
23
21
.cfi_endproc
24
22
SYM_FUNC_END(__vdso_flush_icache)
23
+
24
+
emit_riscv_feature_1_and
+4
arch/riscv/kernel/vdso/getcpu.S
+4
arch/riscv/kernel/vdso/getcpu.S
···
5
5
6
6
#include <linux/linkage.h>
7
7
#include <asm/unistd.h>
8
+
#include <asm/assembler.h>
8
9
9
10
.text
10
11
/* int __vdso_getcpu(unsigned *cpu, unsigned *node, void *unused); */
11
12
SYM_FUNC_START(__vdso_getcpu)
12
13
.cfi_startproc
14
+
vdso_lpad
13
15
/* For now, just do the syscall. */
14
16
li a7, __NR_getcpu
15
17
ecall
16
18
ret
17
19
.cfi_endproc
18
20
SYM_FUNC_END(__vdso_getcpu)
21
+
22
+
emit_riscv_feature_1_and
+3
arch/riscv/kernel/vdso/note.S
+3
arch/riscv/kernel/vdso/note.S
+4
arch/riscv/kernel/vdso/rt_sigreturn.S
+4
arch/riscv/kernel/vdso/rt_sigreturn.S
···
5
5
6
6
#include <linux/linkage.h>
7
7
#include <asm/unistd.h>
8
+
#include <asm/assembler.h>
8
9
9
10
.text
10
11
SYM_FUNC_START(__vdso_rt_sigreturn)
11
12
.cfi_startproc
12
13
.cfi_signal_frame
14
+
vdso_lpad
13
15
li a7, __NR_rt_sigreturn
14
16
ecall
15
17
.cfi_endproc
16
18
SYM_FUNC_END(__vdso_rt_sigreturn)
19
+
20
+
emit_riscv_feature_1_and
+4
arch/riscv/kernel/vdso/sys_hwprobe.S
+4
arch/riscv/kernel/vdso/sys_hwprobe.S
···
3
3
4
4
#include <linux/linkage.h>
5
5
#include <asm/unistd.h>
6
+
#include <asm/assembler.h>
6
7
7
8
.text
8
9
SYM_FUNC_START(riscv_hwprobe)
9
10
.cfi_startproc
11
+
vdso_lpad
10
12
li a7, __NR_riscv_hwprobe
11
13
ecall
12
14
ret
13
15
14
16
.cfi_endproc
15
17
SYM_FUNC_END(riscv_hwprobe)
18
+
19
+
emit_riscv_feature_1_and
+4
-1
arch/riscv/kernel/vdso/vgetrandom-chacha.S
+4
-1
arch/riscv/kernel/vdso/vgetrandom-chacha.S
···
7
7
8
8
#include <asm/asm.h>
9
9
#include <linux/linkage.h>
10
+
#include <asm/assembler.h>
10
11
11
12
.text
12
13
···
75
74
#define _20 20, 20, 20, 20
76
75
#define _24 24, 24, 24, 24
77
76
#define _25 25, 25, 25, 25
78
-
77
+
vdso_lpad
79
78
/*
80
79
* The ABI requires s0-s9 saved.
81
80
* This does not violate the stack-less requirement: no sensitive data
···
248
247
249
248
ret
250
249
SYM_FUNC_END(__arch_chacha20_blocks_nostack)
250
+
251
+
emit_riscv_feature_1_and