Skip to content

Commit 08d0ce3

Browse files
samitolvanenpalmer-dabbelt
samitolvanen
authored and
palmer-dabbelt
committed
riscv: Implement syscall wrappers
Commit f0bddf5 ("riscv: entry: Convert to generic entry") moved syscall handling to C code, which exposed function pointer type mismatches that trip fine-grained forward-edge Control-Flow Integrity (CFI) checks as syscall handlers are all called through the same syscall_t pointer type. To fix the type mismatches, implement pt_regs based syscall wrappers similarly to x86 and arm64. This patch is based on arm64 syscall wrappers added in commit 4378a7d ("arm64: implement syscall wrappers"), where the main goal was to minimize the risk of userspace-controlled values being used under speculation. This may be a concern for riscv in future as well. Following other architectures, the syscall wrappers generate three functions for each syscall; __riscv_<compat_>sys_<name> takes a pt_regs pointer and extracts arguments from registers, __se_<compat_>sys_<name> is a sign-extension wrapper that casts the long arguments to the correct types for the real syscall implementation, which is named __do_<compat_>sys_<name>. Reviewed-by: Kees Cook <keescook@chromium.org> Tested-by: Nathan Chancellor <nathan@kernel.org> Signed-off-by: Sami Tolvanen <samitolvanen@google.com> Link: https://lore.kernel.org/r/20230710183544.999540-9-samitolvanen@google.com Signed-off-by: Palmer Dabbelt <palmer@rivosinc.com>
1 parent 06c2afb commit 08d0ce3

File tree

6 files changed

+108
-7
lines changed

6 files changed

+108
-7
lines changed

‎arch/riscv/Kconfig

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -35,6 +35,7 @@ config RISCV
3535
select ARCH_HAS_SET_MEMORY if MMU
3636
select ARCH_HAS_STRICT_KERNEL_RWX if MMU && !XIP_KERNEL
3737
select ARCH_HAS_STRICT_MODULE_RWX if MMU && !XIP_KERNEL
38+
select ARCH_HAS_SYSCALL_WRAPPER
3839
select ARCH_HAS_TICK_BROADCAST if GENERIC_CLOCKEVENTS_BROADCAST
3940
select ARCH_HAS_UBSAN_SANITIZE_ALL
4041
select ARCH_HAS_VDSO_DATA

‎arch/riscv/include/asm/syscall.h

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -75,7 +75,7 @@ static inline int syscall_get_arch(struct task_struct *task)
7575
#endif
7676
}
7777

78-
typedef long (*syscall_t)(ulong, ulong, ulong, ulong, ulong, ulong, ulong);
78+
typedef long (*syscall_t)(const struct pt_regs *);
7979
static inline void syscall_handler(struct pt_regs *regs, ulong syscall)
8080
{
8181
syscall_t fn;
@@ -87,8 +87,7 @@ static inline void syscall_handler(struct pt_regs *regs, ulong syscall)
8787
#endif
8888
fn = sys_call_table[syscall];
8989

90-
regs->a0 = fn(regs->orig_a0, regs->a1, regs->a2,
91-
regs->a3, regs->a4, regs->a5, regs->a6);
90+
regs->a0 = fn(regs);
9291
}
9392

9493
static inline bool arch_syscall_is_vdso_sigreturn(struct pt_regs *regs)

‎arch/riscv/include/asm/syscall_wrapper.h

Lines changed: 87 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,87 @@
1+
/* SPDX-License-Identifier: GPL-2.0 */
2+
/*
3+
* syscall_wrapper.h - riscv specific wrappers to syscall definitions
4+
*
5+
* Based on arch/arm64/include/syscall_wrapper.h
6+
*/
7+
8+
#ifndef __ASM_SYSCALL_WRAPPER_H
9+
#define __ASM_SYSCALL_WRAPPER_H
10+
11+
#include <asm/ptrace.h>
12+
13+
asmlinkage long __riscv_sys_ni_syscall(const struct pt_regs *);
14+
15+
#define SC_RISCV_REGS_TO_ARGS(x, ...) \
16+
__MAP(x,__SC_ARGS \
17+
,,regs->orig_a0,,regs->a1,,regs->a2 \
18+
,,regs->a3,,regs->a4,,regs->a5,,regs->a6)
19+
20+
#ifdef CONFIG_COMPAT
21+
22+
#define COMPAT_SYSCALL_DEFINEx(x, name, ...) \
23+
asmlinkage long __riscv_compat_sys##name(const struct pt_regs *regs); \
24+
ALLOW_ERROR_INJECTION(__riscv_compat_sys##name, ERRNO); \
25+
static long __se_compat_sys##name(__MAP(x,__SC_LONG,__VA_ARGS__)); \
26+
static inline long __do_compat_sys##name(__MAP(x,__SC_DECL,__VA_ARGS__)); \
27+
asmlinkage long __riscv_compat_sys##name(const struct pt_regs *regs) \
28+
{ \
29+
return __se_compat_sys##name(SC_RISCV_REGS_TO_ARGS(x,__VA_ARGS__)); \
30+
} \
31+
static long __se_compat_sys##name(__MAP(x,__SC_LONG,__VA_ARGS__)) \
32+
{ \
33+
return __do_compat_sys##name(__MAP(x,__SC_DELOUSE,__VA_ARGS__)); \
34+
} \
35+
static inline long __do_compat_sys##name(__MAP(x,__SC_DECL,__VA_ARGS__))
36+
37+
#define COMPAT_SYSCALL_DEFINE0(sname) \
38+
asmlinkage long __riscv_compat_sys_##sname(const struct pt_regs *__unused); \
39+
ALLOW_ERROR_INJECTION(__riscv_compat_sys_##sname, ERRNO); \
40+
asmlinkage long __riscv_compat_sys_##sname(const struct pt_regs *__unused)
41+
42+
#define COND_SYSCALL_COMPAT(name) \
43+
asmlinkage long __weak __riscv_compat_sys_##name(const struct pt_regs *regs); \
44+
asmlinkage long __weak __riscv_compat_sys_##name(const struct pt_regs *regs) \
45+
{ \
46+
return sys_ni_syscall(); \
47+
}
48+
49+
#define COMPAT_SYS_NI(name) \
50+
SYSCALL_ALIAS(__riscv_compat_sys_##name, sys_ni_posix_timers);
51+
52+
#endif /* CONFIG_COMPAT */
53+
54+
#define __SYSCALL_DEFINEx(x, name, ...) \
55+
asmlinkage long __riscv_sys##name(const struct pt_regs *regs); \
56+
ALLOW_ERROR_INJECTION(__riscv_sys##name, ERRNO); \
57+
static long __se_sys##name(__MAP(x,__SC_LONG,__VA_ARGS__)); \
58+
static inline long __do_sys##name(__MAP(x,__SC_DECL,__VA_ARGS__)); \
59+
asmlinkage long __riscv_sys##name(const struct pt_regs *regs) \
60+
{ \
61+
return __se_sys##name(SC_RISCV_REGS_TO_ARGS(x,__VA_ARGS__)); \
62+
} \
63+
static long __se_sys##name(__MAP(x,__SC_LONG,__VA_ARGS__)) \
64+
{ \
65+
long ret = __do_sys##name(__MAP(x,__SC_CAST,__VA_ARGS__)); \
66+
__MAP(x,__SC_TEST,__VA_ARGS__); \
67+
__PROTECT(x, ret,__MAP(x,__SC_ARGS,__VA_ARGS__)); \
68+
return ret; \
69+
} \
70+
static inline long __do_sys##name(__MAP(x,__SC_DECL,__VA_ARGS__))
71+
72+
#define SYSCALL_DEFINE0(sname) \
73+
SYSCALL_METADATA(_##sname, 0); \
74+
asmlinkage long __riscv_sys_##sname(const struct pt_regs *__unused); \
75+
ALLOW_ERROR_INJECTION(__riscv_sys_##sname, ERRNO); \
76+
asmlinkage long __riscv_sys_##sname(const struct pt_regs *__unused)
77+
78+
#define COND_SYSCALL(name) \
79+
asmlinkage long __weak __riscv_sys_##name(const struct pt_regs *regs); \
80+
asmlinkage long __weak __riscv_sys_##name(const struct pt_regs *regs) \
81+
{ \
82+
return sys_ni_syscall(); \
83+
}
84+
85+
#define SYS_NI(name) SYSCALL_ALIAS(__riscv_sys_##name, sys_ni_posix_timers);
86+
87+
#endif /* __ASM_SYSCALL_WRAPPER_H */

‎arch/riscv/kernel/compat_syscall_table.c

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -9,11 +9,15 @@
99
#include <asm/syscall.h>
1010

1111
#undef __SYSCALL
12-
#define __SYSCALL(nr, call) [nr] = (call),
12+
#define __SYSCALL(nr, call) asmlinkage long __riscv_##call(const struct pt_regs *);
13+
#include <asm/unistd.h>
14+
15+
#undef __SYSCALL
16+
#define __SYSCALL(nr, call) [nr] = __riscv_##call,
1317

1418
asmlinkage long compat_sys_rt_sigreturn(void);
1519

1620
void * const compat_sys_call_table[__NR_syscalls] = {
17-
[0 ... __NR_syscalls - 1] = sys_ni_syscall,
21+
[0 ... __NR_syscalls - 1] = __riscv_sys_ni_syscall,
1822
#include <asm/unistd.h>
1923
};

‎arch/riscv/kernel/sys_riscv.c

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -335,3 +335,9 @@ SYSCALL_DEFINE5(riscv_hwprobe, struct riscv_hwprobe __user *, pairs,
335335
return do_riscv_hwprobe(pairs, pair_count, cpu_count,
336336
cpus, flags);
337337
}
338+
339+
/* Not defined using SYSCALL_DEFINE0 to avoid error injection */
340+
asmlinkage long __riscv_sys_ni_syscall(const struct pt_regs *__unused)
341+
{
342+
return -ENOSYS;
343+
}

‎arch/riscv/kernel/syscall_table.c

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -10,9 +10,13 @@
1010
#include <asm/syscall.h>
1111

1212
#undef __SYSCALL
13-
#define __SYSCALL(nr, call) [nr] = (call),
13+
#define __SYSCALL(nr, call) asmlinkage long __riscv_##call(const struct pt_regs *);
14+
#include <asm/unistd.h>
15+
16+
#undef __SYSCALL
17+
#define __SYSCALL(nr, call) [nr] = __riscv_##call,
1418

1519
void * const sys_call_table[__NR_syscalls] = {
16-
[0 ... __NR_syscalls - 1] = sys_ni_syscall,
20+
[0 ... __NR_syscalls - 1] = __riscv_sys_ni_syscall,
1721
#include <asm/unistd.h>
1822
};

0 commit comments

Comments
 (0)