Skip to content

Commit d30c168

Browse files
deepak0414Paul Walmsley
deepak0414
authored and
Paul Walmsley
committed
kselftest/riscv: add kselftest for user mode CFI
Add a kselftest for RISC-V control flow integrity implementation for user mode. There is not a lot going on in the kernel to enable landing pad for user mode. CFI selftests are intended to be compiled with a zicfilp and zicfiss enabled compiler. This kselftest simply checks if landing pads and shadow stacks for the process are enabled or not and executes ptrace selftests on CFI. The selftest then registers a SIGSEGV signal handler. Any control flow violations are reported as SIGSEGV with si_code = SEGV_CPERR. The test will fail on receiving any SEGV_CPERR. The shadow stack part has more changes in the kernel, and thus there are separate tests for that. - Exercise 'map_shadow_stack' syscall - 'fork' test to make sure COW works for shadow stack pages - gup tests Kernel uses FOLL_FORCE when access happens to memory via /proc/<pid>/mem. Not breaking that for shadow stack. - signal test. Make sure signal delivery results in token creation on shadow stack and consumes (and verifies) token on sigreturn - shadow stack protection test. attempts to write using regular store instruction on shadow stack memory must result in access faults - ptrace test: adds landing pad violation, clears ELP and continues In case the toolchain doesn't support the CFI extension, the CFI kselftest won't be built. Test output =========== """ TAP version 13 1..5 This is to ensure shadow stack is indeed enabled and working This is to ensure shadow stack is indeed enabled and working ok 1 shstk fork test ok 2 map shadow stack syscall ok 3 shadow stack gup tests ok 4 shadow stack signal tests ok 5 memory protections of shadow stack memory """ Suggested-by: Charlie Jenkins <charlie@rivosinc.com> Signed-off-by: Charlie Jenkins <charlie@rivosinc.com> Signed-off-by: Deepak Gupta <debug@rivosinc.com> Tested-by: Andreas Korb <andreas.korb@aisec.fraunhofer.de> # QEMU, custom CVA6 Tested-by: Valentin Haudiquet <valentin.haudiquet@canonical.com> Link: https://patch.msgid.link/20251112-v5_user_cfi_series-v23-28-b55691eacf4f@rivosinc.com [pjw@kernel.org: updated to apply; cleaned up patch description, code comments] Signed-off-by: Paul Walmsley <pjw@kernel.org>
1 parent c8350aa commit d30c168

7 files changed

Lines changed: 693 additions & 1 deletion

File tree

‎tools/testing/selftests/riscv/Makefile‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@
55
ARCH ?= $(shell uname -m 2>/dev/null || echo not)
66

77
ifneq (,$(filter $(ARCH),riscv))
8-
RISCV_SUBTARGETS ?= abi hwprobe mm sigreturn vector
8+
RISCV_SUBTARGETS ?= abi hwprobe mm sigreturn vector cfi
99
else
1010
RISCV_SUBTARGETS :=
1111
endif

‎tools/testing/selftests/riscv/cfi/.gitignore‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
cfitests
2+
shadowstack

‎tools/testing/selftests/riscv/cfi/Makefile‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
CFLAGS += $(KHDR_INCLUDES)
2+
CFLAGS += -I$(top_srcdir)/tools/include
3+
4+
CFLAGS += -march=rv64gc_zicfilp_zicfiss -fcf-protection=full
5+
6+
# Check for zicfi* extensions needs cross compiler
7+
# which is not set until lib.mk is included
8+
ifeq ($(LLVM)$(CC),cc)
9+
CC := $(CROSS_COMPILE)gcc
10+
endif
11+
12+
13+
ifeq ($(shell $(CC) $(CFLAGS) -nostdlib -xc /dev/null -o /dev/null > /dev/null 2>&1; echo $$?),0)
14+
TEST_GEN_PROGS := cfitests
15+
16+
$(OUTPUT)/cfitests: cfitests.c shadowstack.c
17+
$(CC) -o$@ $(CFLAGS) $(LDFLAGS) $^
18+
else
19+
20+
$(shell echo "Toolchain doesn't support CFI, skipping CFI kselftest." >&2)
21+
endif
22+
23+
include ../../lib.mk

‎tools/testing/selftests/riscv/cfi/cfi_rv_test.h‎

Lines changed: 82 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,82 @@
1+
/* SPDX-License-Identifier: GPL-2.0-only */
2+
3+
#ifndef SELFTEST_RISCV_CFI_H
4+
#define SELFTEST_RISCV_CFI_H
5+
#include <stddef.h>
6+
#include <sys/types.h>
7+
#include "shadowstack.h"
8+
9+
#define CHILD_EXIT_CODE_SSWRITE 10
10+
#define CHILD_EXIT_CODE_SIG_TEST 11
11+
12+
#define my_syscall5(num, arg1, arg2, arg3, arg4, arg5) \
13+
({ \
14+
register long _num __asm__ ("a7") = (num); \
15+
register long _arg1 __asm__ ("a0") = (long)(arg1); \
16+
register long _arg2 __asm__ ("a1") = (long)(arg2); \
17+
register long _arg3 __asm__ ("a2") = (long)(arg3); \
18+
register long _arg4 __asm__ ("a3") = (long)(arg4); \
19+
register long _arg5 __asm__ ("a4") = (long)(arg5); \
20+
\
21+
__asm__ volatile( \
22+
"ecall\n" \
23+
: "+r" \
24+
(_arg1) \
25+
: "r"(_arg2), "r"(_arg3), "r"(_arg4), "r"(_arg5), \
26+
"r"(_num) \
27+
: "memory", "cc" \
28+
); \
29+
_arg1; \
30+
})
31+
32+
#define my_syscall3(num, arg1, arg2, arg3) \
33+
({ \
34+
register long _num __asm__ ("a7") = (num); \
35+
register long _arg1 __asm__ ("a0") = (long)(arg1); \
36+
register long _arg2 __asm__ ("a1") = (long)(arg2); \
37+
register long _arg3 __asm__ ("a2") = (long)(arg3); \
38+
\
39+
__asm__ volatile( \
40+
"ecall\n" \
41+
: "+r" (_arg1) \
42+
: "r"(_arg2), "r"(_arg3), \
43+
"r"(_num) \
44+
: "memory", "cc" \
45+
); \
46+
_arg1; \
47+
})
48+
49+
#ifndef __NR_prctl
50+
#define __NR_prctl 167
51+
#endif
52+
53+
#ifndef __NR_map_shadow_stack
54+
#define __NR_map_shadow_stack 453
55+
#endif
56+
57+
#define CSR_SSP 0x011
58+
59+
#ifdef __ASSEMBLY__
60+
#define __ASM_STR(x) x
61+
#else
62+
#define __ASM_STR(x) #x
63+
#endif
64+
65+
#define csr_read(csr) \
66+
({ \
67+
register unsigned long __v; \
68+
__asm__ __volatile__ ("csrr %0, " __ASM_STR(csr) \
69+
: "=r" (__v) : \
70+
: "memory"); \
71+
__v; \
72+
})
73+
74+
#define csr_write(csr, val) \
75+
({ \
76+
unsigned long __v = (unsigned long)(val); \
77+
__asm__ __volatile__ ("csrw " __ASM_STR(csr) ", %0" \
78+
: : "rK" (__v) \
79+
: "memory"); \
80+
})
81+
82+
#endif

‎tools/testing/selftests/riscv/cfi/cfitests.c‎

Lines changed: 173 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,173 @@
1+
// SPDX-License-Identifier: GPL-2.0-only
2+
3+
#include "../../kselftest.h"
4+
#include <sys/signal.h>
5+
#include <asm/ucontext.h>
6+
#include <linux/prctl.h>
7+
#include <errno.h>
8+
#include <linux/ptrace.h>
9+
#include <sys/wait.h>
10+
#include <linux/elf.h>
11+
#include <sys/uio.h>
12+
#include <asm-generic/unistd.h>
13+
14+
#include "cfi_rv_test.h"
15+
16+
/* do not optimize cfi related test functions */
17+
#pragma GCC push_options
18+
#pragma GCC optimize("O0")
19+
20+
void sigsegv_handler(int signum, siginfo_t *si, void *uc)
21+
{
22+
struct ucontext *ctx = (struct ucontext *)uc;
23+
24+
if (si->si_code == SEGV_CPERR) {
25+
ksft_print_msg("Control flow violation happened somewhere\n");
26+
ksft_print_msg("PC where violation happened %lx\n", ctx->uc_mcontext.gregs[0]);
27+
exit(-1);
28+
}
29+
30+
/* all other cases are expected to be of shadow stack write case */
31+
exit(CHILD_EXIT_CODE_SSWRITE);
32+
}
33+
34+
bool register_signal_handler(void)
35+
{
36+
struct sigaction sa = {};
37+
38+
sa.sa_sigaction = sigsegv_handler;
39+
sa.sa_flags = SA_SIGINFO;
40+
if (sigaction(SIGSEGV, &sa, NULL)) {
41+
ksft_print_msg("Registering signal handler for landing pad violation failed\n");
42+
return false;
43+
}
44+
45+
return true;
46+
}
47+
48+
long ptrace(int request, pid_t pid, void *addr, void *data);
49+
50+
bool cfi_ptrace_test(void)
51+
{
52+
pid_t pid;
53+
int status, ret = 0;
54+
unsigned long ptrace_test_num = 0, total_ptrace_tests = 2;
55+
56+
struct user_cfi_state cfi_reg;
57+
struct iovec iov;
58+
59+
pid = fork();
60+
61+
if (pid == -1) {
62+
ksft_exit_fail_msg("%s: fork failed\n", __func__);
63+
exit(1);
64+
}
65+
66+
if (pid == 0) {
67+
/* allow to be traced */
68+
ptrace(PTRACE_TRACEME, 0, NULL, NULL);
69+
raise(SIGSTOP);
70+
asm volatile ("la a5, 1f\n"
71+
"jalr a5\n"
72+
"nop\n"
73+
"nop\n"
74+
"1: nop\n"
75+
: : : "a5");
76+
exit(11);
77+
/* child shouldn't go beyond here */
78+
}
79+
80+
/* parent's code goes here */
81+
iov.iov_base = &cfi_reg;
82+
iov.iov_len = sizeof(cfi_reg);
83+
84+
while (ptrace_test_num < total_ptrace_tests) {
85+
memset(&cfi_reg, 0, sizeof(cfi_reg));
86+
waitpid(pid, &status, 0);
87+
if (WIFSTOPPED(status)) {
88+
errno = 0;
89+
ret = ptrace(PTRACE_GETREGSET, pid, (void *)NT_RISCV_USER_CFI, &iov);
90+
if (ret == -1 && errno)
91+
ksft_exit_fail_msg("%s: PTRACE_GETREGSET failed\n", __func__);
92+
} else {
93+
ksft_exit_fail_msg("%s: child didn't stop, failed\n", __func__);
94+
}
95+
96+
switch (ptrace_test_num) {
97+
#define CFI_ENABLE_MASK (PTRACE_CFI_LP_EN_STATE | \
98+
PTRACE_CFI_SS_EN_STATE | \
99+
PTRACE_CFI_SS_PTR_STATE)
100+
case 0:
101+
if ((cfi_reg.cfi_status.cfi_state & CFI_ENABLE_MASK) != CFI_ENABLE_MASK)
102+
ksft_exit_fail_msg("%s: ptrace_getregset failed, %llu\n", __func__,
103+
cfi_reg.cfi_status.cfi_state);
104+
if (!cfi_reg.shstk_ptr)
105+
ksft_exit_fail_msg("%s: NULL shadow stack pointer, test failed\n",
106+
__func__);
107+
break;
108+
case 1:
109+
if (!(cfi_reg.cfi_status.cfi_state & PTRACE_CFI_ELP_STATE))
110+
ksft_exit_fail_msg("%s: elp must have been set\n", __func__);
111+
/* clear elp state. not interested in anything else */
112+
cfi_reg.cfi_status.cfi_state = 0;
113+
114+
ret = ptrace(PTRACE_SETREGSET, pid, (void *)NT_RISCV_USER_CFI, &iov);
115+
if (ret == -1 && errno)
116+
ksft_exit_fail_msg("%s: PTRACE_GETREGSET failed\n", __func__);
117+
break;
118+
default:
119+
ksft_exit_fail_msg("%s: unreachable switch case\n", __func__);
120+
break;
121+
}
122+
ptrace(PTRACE_CONT, pid, NULL, NULL);
123+
ptrace_test_num++;
124+
}
125+
126+
waitpid(pid, &status, 0);
127+
if (WEXITSTATUS(status) != 11)
128+
ksft_print_msg("%s, bad return code from child\n", __func__);
129+
130+
ksft_print_msg("%s, ptrace test succeeded\n", __func__);
131+
return true;
132+
}
133+
134+
int main(int argc, char *argv[])
135+
{
136+
int ret = 0;
137+
unsigned long lpad_status = 0, ss_status = 0;
138+
139+
ksft_print_header();
140+
141+
ksft_print_msg("Starting risc-v tests\n");
142+
143+
/*
144+
* Landing pad test. Not a lot of kernel changes to support landing
145+
* pads for user mode except lighting up a bit in senvcfg via a prctl.
146+
* Enable landing pad support throughout the execution of the test binary.
147+
*/
148+
ret = my_syscall5(__NR_prctl, PR_GET_INDIR_BR_LP_STATUS, &lpad_status, 0, 0, 0);
149+
if (ret)
150+
ksft_exit_fail_msg("Get landing pad status failed with %d\n", ret);
151+
152+
if (!(lpad_status & PR_INDIR_BR_LP_ENABLE))
153+
ksft_exit_fail_msg("Landing pad is not enabled, should be enabled via glibc\n");
154+
155+
ret = my_syscall5(__NR_prctl, PR_GET_SHADOW_STACK_STATUS, &ss_status, 0, 0, 0);
156+
if (ret)
157+
ksft_exit_fail_msg("Get shadow stack failed with %d\n", ret);
158+
159+
if (!(ss_status & PR_SHADOW_STACK_ENABLE))
160+
ksft_exit_fail_msg("Shadow stack is not enabled, should be enabled via glibc\n");
161+
162+
if (!register_signal_handler())
163+
ksft_exit_fail_msg("Registering signal handler for SIGSEGV failed\n");
164+
165+
ksft_print_msg("Landing pad and shadow stack are enabled for binary\n");
166+
cfi_ptrace_test();
167+
168+
execute_shadow_stack_tests();
169+
170+
return 0;
171+
}
172+
173+
#pragma GCC pop_options

0 commit comments

Comments
 (0)