Messages in this thread Patch in this message | ![/](/images/icornerl.gif) | | From | Deepak Gupta <> | Subject | [RFC PATCH 11/12] riscv: Kconfig & Makefile for riscv kernel control flow integrity | Date | Mon, 8 Apr 2024 23:10:42 -0700 |
| |
Defines `CONFIG_RISCV_KERNEL_CFI` and selects SHADOW_CALL_STACK and DYNAMIC_SCS both so that zicfiss can be wired up.
Makefile checks if CONFIG_RISCV_KERNEL_CFI is enabled, then light up zicfiss and zicfilp compiler flags.
Signed-off-by: Deepak Gupta <debug@rivosinc.com> --- arch/riscv/Kconfig | 36 +++++++++++++++++++++++++++++++++++- arch/riscv/Makefile | 6 ++++++ 2 files changed, 41 insertions(+), 1 deletion(-)
diff --git a/arch/riscv/Kconfig b/arch/riscv/Kconfig index be09c8836d56..5276598bb773 100644 --- a/arch/riscv/Kconfig +++ b/arch/riscv/Kconfig @@ -193,7 +193,7 @@ config GCC_SUPPORTS_DYNAMIC_FTRACE depends on $(cc-option,-fpatchable-function-entry=8) config HAVE_SHADOW_CALL_STACK - def_bool $(cc-option,-fsanitize=shadow-call-stack) + def_bool $(cc-option,-fsanitize=shadow-call-stack) || $(cc-option,-mabi=lp64 -march=rv64ima_zicfilp_zicfiss) # https://github.com/riscv-non-isa/riscv-elf-psabi-doc/commit/a484e843e6eeb51f0cb7b8819e50da6d2444d769 depends on $(ld-option,--no-relax-gp) @@ -211,6 +211,30 @@ config ARCH_HAS_BROKEN_DWARF5 # https://github.com/llvm/llvm-project/commit/7ffabb61a5569444b5ac9322e22e5471cc5e4a77 depends on LD_IS_LLD && LLD_VERSION < 180000 +config RISCV_KERNEL_CFI + def_bool n + bool "hw assisted riscv kernel control flow integrity (kcfi)" + depends on 64BIT && $(cc-option,-mabi=lp64 -march=rv64ima_zicfilp_zicfiss) + select ARCH_SUPPORTS_SHADOW_CALL_STACK + select SHADOW_CALL_STACK + select DYNAMIC_SCS + help + Provides CPU assisted control flow integrity to for riscv kernel. + Control flow integrity is provided by implementing shadow stack for + backward edge and indirect branch tracking for forward edge. Shadow + stack protection is a hardware feature that detects function return + address corruption. This helps mitigate ROP attacks. RISCV_KERNEL_CFI + selects CONFIG_SHADOW_CALL_STACK which uses software based shadow + stack but is unprotected against stray writes. Selecting RISCV_KERNEL_CFI + will select CONFIG_DYNAMIC_SCS and will enable hardware assisted shadow + stack protection against stray writes. + Indirect branch tracking enforces that all indirect branches must land + on a landing pad instruction else CPU will fault. This enables forward + control flow (call/jmp) protection in kernel and restricts all indirect + call or jump in kernel to a landing pad instruction which mostly likely + will be start of the function. + default n + config ARCH_MMAP_RND_BITS_MIN default 18 if 64BIT default 8 @@ -639,6 +663,16 @@ config RISCV_ISA_ZICBOZ If you don't know what to do here, say Y. +config TOOLCHAIN_HAS_ZICFILP + bool + default y + depends on 64BIT && $(cc-option,-mabi=lp64 -march=rv64ima_zicfilp) + +config TOOLCHAIN_HAS_ZICFISS + bool + default y + depends on 64BIT && $(cc-option,-mabi=lp64 -march=rv64ima_zicfiss) + config TOOLCHAIN_HAS_ZIHINTPAUSE bool default y diff --git a/arch/riscv/Makefile b/arch/riscv/Makefile index 5b3115a19852..ae156e37e886 100644 --- a/arch/riscv/Makefile +++ b/arch/riscv/Makefile @@ -58,8 +58,10 @@ else ifeq ($(CONFIG_LTO_CLANG),y) endif ifeq ($(CONFIG_SHADOW_CALL_STACK),y) +ifndef CONFIG_DYNAMIC_SCS KBUILD_LDFLAGS += --no-relax-gp endif +endif # ISA string setting riscv-march-$(CONFIG_ARCH_RV32I) := rv32ima @@ -78,6 +80,10 @@ endif # Check if the toolchain supports Zihintpause extension riscv-march-$(CONFIG_TOOLCHAIN_HAS_ZIHINTPAUSE) := $(riscv-march-y)_zihintpause +ifeq ($(CONFIG_RISCV_KERNEL_CFI),y) +riscv-march-$(CONFIG_TOOLCHAIN_HAS_ZICFILP) := $(riscv-march-y)_zicfilp +riscv-march-$(CONFIG_TOOLCHAIN_HAS_ZICFISS) := $(riscv-march-y)_zicfiss +endif # Remove F,D,V from isa string for all. Keep extensions between "fd" and "v" by # matching non-v and non-multi-letter extensions out with the filter ([^v_]*) KBUILD_CFLAGS += -march=$(shell echo $(riscv-march-y) | sed -E 's/(rv32ima|rv64ima)fd([^v_]*)v?/\1\2/') -- 2.43.2
| ![\](/images/icornerr.gif) |