This adds support for STACKLEAK gcc plugin to ricv by implementing
stackleak_check_alloca, based heavily on the arm64 version, and adding
the two helpers used by the stackleak common code:
current_top_of_stack() and on_thread_stack(). This also adds the missing
helper functions for riscv, on_stack() and on_task_stack().
Additionally, this disables the plugin for EFI stub code for riscv.
Signed-off-by: Dao Lu <[email protected]>
---
arch/riscv/Kconfig | 1 +
arch/riscv/include/asm/processor.h | 18 ++++++++++++++++++
arch/riscv/include/asm/stacktrace.h | 27 +++++++++++++++++++++++++++
arch/riscv/kernel/entry.S | 3 +++
drivers/firmware/efi/libstub/Makefile | 2 +-
5 files changed, 50 insertions(+), 1 deletion(-)
diff --git a/arch/riscv/Kconfig b/arch/riscv/Kconfig
index c22f58155948..22aa146acd25 100644
--- a/arch/riscv/Kconfig
+++ b/arch/riscv/Kconfig
@@ -80,6 +80,7 @@ config RISCV
select HAVE_ARCH_MMAP_RND_BITS if MMU
select HAVE_ARCH_MMAP_RND_COMPAT_BITS if COMPAT
select HAVE_ARCH_SECCOMP_FILTER
+ select HAVE_ARCH_STACKLEAK
select HAVE_ARCH_TRACEHOOK
select HAVE_ARCH_TRANSPARENT_HUGEPAGE if 64BIT && MMU
select ARCH_ENABLE_THP_MIGRATION if TRANSPARENT_HUGEPAGE
diff --git a/arch/riscv/include/asm/processor.h b/arch/riscv/include/asm/processor.h
index 21c8072dce17..3a7505ab7f58 100644
--- a/arch/riscv/include/asm/processor.h
+++ b/arch/riscv/include/asm/processor.h
@@ -85,6 +85,24 @@ int riscv_of_parent_hartid(struct device_node *node);
extern void riscv_fill_hwcap(void);
extern int arch_dup_task_struct(struct task_struct *dst, struct task_struct *src);
+/*
+ * For CONFIG_GCC_PLUGIN_STACKLEAK
+ *
+ * These need to be macros because otherwise we get stuck in a nightmare
+ * of header definitions for the use of task_stack_page.
+ */
+
+struct stack_info {
+ unsigned long low;
+ unsigned long high;
+};
+
+/*
+ * The top of the current task's task stack
+ */
+#define current_top_of_stack() ((unsigned long)current->stack + THREAD_SIZE)
+#define on_thread_stack() (on_task_stack(current, current_stack_pointer, 1, NULL))
+
#endif /* __ASSEMBLY__ */
#endif /* _ASM_RISCV_PROCESSOR_H */
diff --git a/arch/riscv/include/asm/stacktrace.h b/arch/riscv/include/asm/stacktrace.h
index 3450c1912afd..afb66b677b6a 100644
--- a/arch/riscv/include/asm/stacktrace.h
+++ b/arch/riscv/include/asm/stacktrace.h
@@ -16,4 +16,31 @@ extern void notrace walk_stackframe(struct task_struct *task, struct pt_regs *re
extern void dump_backtrace(struct pt_regs *regs, struct task_struct *task,
const char *loglvl);
+static inline bool on_stack(unsigned long sp, unsigned long size,
+ unsigned long low, unsigned long high,
+ struct stack_info *info)
+{
+ if (!low)
+ return false;
+
+ if (sp < low || sp + size < sp || sp + size > high)
+ return false;
+
+ if (info) {
+ info->low = low;
+ info->high = high;
+ }
+ return true;
+}
+
+static inline bool on_task_stack(const struct task_struct *tsk,
+ unsigned long sp, unsigned long size,
+ struct stack_info *info)
+{
+ unsigned long low = (unsigned long)task_stack_page(tsk);
+ unsigned long high = low + THREAD_SIZE;
+
+ return on_stack(sp, size, low, high, info);
+}
+
#endif /* _ASM_RISCV_STACKTRACE_H */
diff --git a/arch/riscv/kernel/entry.S b/arch/riscv/kernel/entry.S
index 2e5b88ca11ce..65d441cb560f 100644
--- a/arch/riscv/kernel/entry.S
+++ b/arch/riscv/kernel/entry.S
@@ -264,6 +264,9 @@ ret_from_exception:
bnez s0, resume_kernel
resume_userspace:
+#ifdef CONFIG_GCC_PLUGIN_STACKLEAK
+ call stackleak_erase
+#endif
/* Interrupts must be disabled here so flags are checked atomically */
REG_L s0, TASK_TI_FLAGS(tp) /* current_thread_info->flags */
andi s1, s0, _TIF_WORK_MASK
diff --git a/drivers/firmware/efi/libstub/Makefile b/drivers/firmware/efi/libstub/Makefile
index d0537573501e..5e1fc4f82883 100644
--- a/drivers/firmware/efi/libstub/Makefile
+++ b/drivers/firmware/efi/libstub/Makefile
@@ -25,7 +25,7 @@ cflags-$(CONFIG_ARM) := $(subst $(CC_FLAGS_FTRACE),,$(KBUILD_CFLAGS)) \
-fno-builtin -fpic \
$(call cc-option,-mno-single-pic-base)
cflags-$(CONFIG_RISCV) := $(subst $(CC_FLAGS_FTRACE),,$(KBUILD_CFLAGS)) \
- -fpic
+ -fpic $(DISABLE_STACKLEAK_PLUGIN)
cflags-$(CONFIG_EFI_GENERIC_STUB) += -I$(srctree)/scripts/dtc/libfdt
--
2.25.1
On Wed, Jun 15, 2022 at 02:38:29PM -0700, Dao Lu wrote:
> This adds support for STACKLEAK gcc plugin to ricv by implementing
typo: riscv
> stackleak_check_alloca, based heavily on the arm64 version, and adding
stackleak_check_alloca does not exist. Was this maybe from an older
commit log?
> the two helpers used by the stackleak common code:
> current_top_of_stack() and on_thread_stack(). This also adds the missing
> helper functions for riscv, on_stack() and on_task_stack().
> Additionally, this disables the plugin for EFI stub code for riscv.
I can't speak to the arch-specific bits here, but if this passes the
current LKDTM tests, then that should be a good indication that it's
working. :)
>
> Signed-off-by: Dao Lu <[email protected]>
> ---
> arch/riscv/Kconfig | 1 +
> arch/riscv/include/asm/processor.h | 18 ++++++++++++++++++
> arch/riscv/include/asm/stacktrace.h | 27 +++++++++++++++++++++++++++
> arch/riscv/kernel/entry.S | 3 +++
> drivers/firmware/efi/libstub/Makefile | 2 +-
> 5 files changed, 50 insertions(+), 1 deletion(-)
>
> diff --git a/arch/riscv/Kconfig b/arch/riscv/Kconfig
> index c22f58155948..22aa146acd25 100644
> --- a/arch/riscv/Kconfig
> +++ b/arch/riscv/Kconfig
> @@ -80,6 +80,7 @@ config RISCV
> select HAVE_ARCH_MMAP_RND_BITS if MMU
> select HAVE_ARCH_MMAP_RND_COMPAT_BITS if COMPAT
> select HAVE_ARCH_SECCOMP_FILTER
> + select HAVE_ARCH_STACKLEAK
> select HAVE_ARCH_TRACEHOOK
> select HAVE_ARCH_TRANSPARENT_HUGEPAGE if 64BIT && MMU
> select ARCH_ENABLE_THP_MIGRATION if TRANSPARENT_HUGEPAGE
> diff --git a/arch/riscv/include/asm/processor.h b/arch/riscv/include/asm/processor.h
> index 21c8072dce17..3a7505ab7f58 100644
> --- a/arch/riscv/include/asm/processor.h
> +++ b/arch/riscv/include/asm/processor.h
> @@ -85,6 +85,24 @@ int riscv_of_parent_hartid(struct device_node *node);
> extern void riscv_fill_hwcap(void);
> extern int arch_dup_task_struct(struct task_struct *dst, struct task_struct *src);
>
> +/*
> + * For CONFIG_GCC_PLUGIN_STACKLEAK
> + *
> + * These need to be macros because otherwise we get stuck in a nightmare
> + * of header definitions for the use of task_stack_page.
> + */
> +
> +struct stack_info {
> + unsigned long low;
> + unsigned long high;
> +};
> +
> +/*
> + * The top of the current task's task stack
> + */
> +#define current_top_of_stack() ((unsigned long)current->stack + THREAD_SIZE)
> +#define on_thread_stack() (on_task_stack(current, current_stack_pointer, 1, NULL))
> +
> #endif /* __ASSEMBLY__ */
>
> #endif /* _ASM_RISCV_PROCESSOR_H */
> diff --git a/arch/riscv/include/asm/stacktrace.h b/arch/riscv/include/asm/stacktrace.h
> index 3450c1912afd..afb66b677b6a 100644
> --- a/arch/riscv/include/asm/stacktrace.h
> +++ b/arch/riscv/include/asm/stacktrace.h
> @@ -16,4 +16,31 @@ extern void notrace walk_stackframe(struct task_struct *task, struct pt_regs *re
> extern void dump_backtrace(struct pt_regs *regs, struct task_struct *task,
> const char *loglvl);
>
> +static inline bool on_stack(unsigned long sp, unsigned long size,
> + unsigned long low, unsigned long high,
> + struct stack_info *info)
> +{
> + if (!low)
> + return false;
> +
> + if (sp < low || sp + size < sp || sp + size > high)
> + return false;
> +
> + if (info) {
> + info->low = low;
> + info->high = high;
> + }
> + return true;
> +}
> +
> +static inline bool on_task_stack(const struct task_struct *tsk,
> + unsigned long sp, unsigned long size,
> + struct stack_info *info)
> +{
> + unsigned long low = (unsigned long)task_stack_page(tsk);
> + unsigned long high = low + THREAD_SIZE;
> +
> + return on_stack(sp, size, low, high, info);
> +}
> +
> #endif /* _ASM_RISCV_STACKTRACE_H */
> diff --git a/arch/riscv/kernel/entry.S b/arch/riscv/kernel/entry.S
> index 2e5b88ca11ce..65d441cb560f 100644
> --- a/arch/riscv/kernel/entry.S
> +++ b/arch/riscv/kernel/entry.S
> @@ -264,6 +264,9 @@ ret_from_exception:
> bnez s0, resume_kernel
>
> resume_userspace:
> +#ifdef CONFIG_GCC_PLUGIN_STACKLEAK
> + call stackleak_erase
> +#endif
> /* Interrupts must be disabled here so flags are checked atomically */
> REG_L s0, TASK_TI_FLAGS(tp) /* current_thread_info->flags */
> andi s1, s0, _TIF_WORK_MASK
> diff --git a/drivers/firmware/efi/libstub/Makefile b/drivers/firmware/efi/libstub/Makefile
> index d0537573501e..5e1fc4f82883 100644
> --- a/drivers/firmware/efi/libstub/Makefile
> +++ b/drivers/firmware/efi/libstub/Makefile
> @@ -25,7 +25,7 @@ cflags-$(CONFIG_ARM) := $(subst $(CC_FLAGS_FTRACE),,$(KBUILD_CFLAGS)) \
> -fno-builtin -fpic \
> $(call cc-option,-mno-single-pic-base)
> cflags-$(CONFIG_RISCV) := $(subst $(CC_FLAGS_FTRACE),,$(KBUILD_CFLAGS)) \
> - -fpic
> + -fpic $(DISABLE_STACKLEAK_PLUGIN)
>
> cflags-$(CONFIG_EFI_GENERIC_STUB) += -I$(srctree)/scripts/dtc/libfdt
>
> --
> 2.25.1
>
--
Kees Cook
Thanks Kees.
> stackleak_check_alloca does not exist. Was this maybe from an older
commit log?
Yeah it was from an older version and was later removed, I will take it away
from the commit message in the next version.
Thanks,
Dao
On Wed, Jun 15, 2022 at 10:36 PM Kees Cook <[email protected]> wrote:
>
> On Wed, Jun 15, 2022 at 02:38:29PM -0700, Dao Lu wrote:
> > This adds support for STACKLEAK gcc plugin to ricv by implementing
>
> typo: riscv
>
> > stackleak_check_alloca, based heavily on the arm64 version, and adding
>
> stackleak_check_alloca does not exist. Was this maybe from an older
> commit log?
>
> > the two helpers used by the stackleak common code:
> > current_top_of_stack() and on_thread_stack(). This also adds the missing
> > helper functions for riscv, on_stack() and on_task_stack().
> > Additionally, this disables the plugin for EFI stub code for riscv.
>
> I can't speak to the arch-specific bits here, but if this passes the
> current LKDTM tests, then that should be a good indication that it's
> working. :)
>
> >
> > Signed-off-by: Dao Lu <[email protected]>
> > ---
> > arch/riscv/Kconfig | 1 +
> > arch/riscv/include/asm/processor.h | 18 ++++++++++++++++++
> > arch/riscv/include/asm/stacktrace.h | 27 +++++++++++++++++++++++++++
> > arch/riscv/kernel/entry.S | 3 +++
> > drivers/firmware/efi/libstub/Makefile | 2 +-
> > 5 files changed, 50 insertions(+), 1 deletion(-)
> >
> > diff --git a/arch/riscv/Kconfig b/arch/riscv/Kconfig
> > index c22f58155948..22aa146acd25 100644
> > --- a/arch/riscv/Kconfig
> > +++ b/arch/riscv/Kconfig
> > @@ -80,6 +80,7 @@ config RISCV
> > select HAVE_ARCH_MMAP_RND_BITS if MMU
> > select HAVE_ARCH_MMAP_RND_COMPAT_BITS if COMPAT
> > select HAVE_ARCH_SECCOMP_FILTER
> > + select HAVE_ARCH_STACKLEAK
> > select HAVE_ARCH_TRACEHOOK
> > select HAVE_ARCH_TRANSPARENT_HUGEPAGE if 64BIT && MMU
> > select ARCH_ENABLE_THP_MIGRATION if TRANSPARENT_HUGEPAGE
> > diff --git a/arch/riscv/include/asm/processor.h b/arch/riscv/include/asm/processor.h
> > index 21c8072dce17..3a7505ab7f58 100644
> > --- a/arch/riscv/include/asm/processor.h
> > +++ b/arch/riscv/include/asm/processor.h
> > @@ -85,6 +85,24 @@ int riscv_of_parent_hartid(struct device_node *node);
> > extern void riscv_fill_hwcap(void);
> > extern int arch_dup_task_struct(struct task_struct *dst, struct task_struct *src);
> >
> > +/*
> > + * For CONFIG_GCC_PLUGIN_STACKLEAK
> > + *
> > + * These need to be macros because otherwise we get stuck in a nightmare
> > + * of header definitions for the use of task_stack_page.
> > + */
> > +
> > +struct stack_info {
> > + unsigned long low;
> > + unsigned long high;
> > +};
> > +
> > +/*
> > + * The top of the current task's task stack
> > + */
> > +#define current_top_of_stack() ((unsigned long)current->stack + THREAD_SIZE)
> > +#define on_thread_stack() (on_task_stack(current, current_stack_pointer, 1, NULL))
> > +
> > #endif /* __ASSEMBLY__ */
> >
> > #endif /* _ASM_RISCV_PROCESSOR_H */
> > diff --git a/arch/riscv/include/asm/stacktrace.h b/arch/riscv/include/asm/stacktrace.h
> > index 3450c1912afd..afb66b677b6a 100644
> > --- a/arch/riscv/include/asm/stacktrace.h
> > +++ b/arch/riscv/include/asm/stacktrace.h
> > @@ -16,4 +16,31 @@ extern void notrace walk_stackframe(struct task_struct *task, struct pt_regs *re
> > extern void dump_backtrace(struct pt_regs *regs, struct task_struct *task,
> > const char *loglvl);
> >
> > +static inline bool on_stack(unsigned long sp, unsigned long size,
> > + unsigned long low, unsigned long high,
> > + struct stack_info *info)
> > +{
> > + if (!low)
> > + return false;
> > +
> > + if (sp < low || sp + size < sp || sp + size > high)
> > + return false;
> > +
> > + if (info) {
> > + info->low = low;
> > + info->high = high;
> > + }
> > + return true;
> > +}
> > +
> > +static inline bool on_task_stack(const struct task_struct *tsk,
> > + unsigned long sp, unsigned long size,
> > + struct stack_info *info)
> > +{
> > + unsigned long low = (unsigned long)task_stack_page(tsk);
> > + unsigned long high = low + THREAD_SIZE;
> > +
> > + return on_stack(sp, size, low, high, info);
> > +}
> > +
> > #endif /* _ASM_RISCV_STACKTRACE_H */
> > diff --git a/arch/riscv/kernel/entry.S b/arch/riscv/kernel/entry.S
> > index 2e5b88ca11ce..65d441cb560f 100644
> > --- a/arch/riscv/kernel/entry.S
> > +++ b/arch/riscv/kernel/entry.S
> > @@ -264,6 +264,9 @@ ret_from_exception:
> > bnez s0, resume_kernel
> >
> > resume_userspace:
> > +#ifdef CONFIG_GCC_PLUGIN_STACKLEAK
> > + call stackleak_erase
> > +#endif
> > /* Interrupts must be disabled here so flags are checked atomically */
> > REG_L s0, TASK_TI_FLAGS(tp) /* current_thread_info->flags */
> > andi s1, s0, _TIF_WORK_MASK
> > diff --git a/drivers/firmware/efi/libstub/Makefile b/drivers/firmware/efi/libstub/Makefile
> > index d0537573501e..5e1fc4f82883 100644
> > --- a/drivers/firmware/efi/libstub/Makefile
> > +++ b/drivers/firmware/efi/libstub/Makefile
> > @@ -25,7 +25,7 @@ cflags-$(CONFIG_ARM) := $(subst $(CC_FLAGS_FTRACE),,$(KBUILD_CFLAGS)) \
> > -fno-builtin -fpic \
> > $(call cc-option,-mno-single-pic-base)
> > cflags-$(CONFIG_RISCV) := $(subst $(CC_FLAGS_FTRACE),,$(KBUILD_CFLAGS)) \
> > - -fpic
> > + -fpic $(DISABLE_STACKLEAK_PLUGIN)
> >
> > cflags-$(CONFIG_EFI_GENERIC_STUB) += -I$(srctree)/scripts/dtc/libfdt
> >
> > --
> > 2.25.1
> >
>
> --
> Kees Cook