[PATCH 12/12] riscv/cfi: Support ucontext under CFI

[Deepak Gupta]

On Fri, Jun 20, 2025 at 12:09:53AM +0800, Jesse Huang wrote:
>Yeah we can shrink it and in fact I did it at the beginning, I'm just
>uncertaining about
>the opinion of the kernel community on this, if kernel folks think it's
>okay to
>shrink it then not a problem at all.

In kernel, I don't see any arch specific definition for sigset_t

So riscv should be consuming the generic one.
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/include/uapi/asm-generic/signal.h#n63

typedef struct {
	unsigned long sig[_NSIG_WORDS];
} sigset_t;

_NSIG_WORDS should be `8`.

Unless I am missing something, it seems like as long as userspace is ok stealing
space, I believe kernel should be fine with it. 

>
>
>On Thu, Jun 19, 2025 at 3:57 PM Deepak Gupta <debug@rivosinc.com> wrote:
>
>> On Thu, Jun 19, 2025 at 02:59:40PM +0800, Jesse Huang wrote:
>> >On Thu, Jun 19, 2025 at 5:34 AM Deepak Gupta <debug@rivosinc.com> wrote:
>> >
>> >> On Wed, Jun 18, 2025 at 01:42:58AM -0700, Jesse Huang wrote:
>> >> >This patches only make the ucontext library work while CFI is enabled.
>> >> >enabled. All security checks are skipped and should be implemented if
>> >> >correspoding interface are landed into the kernel.
>> >> >SSP is stored in the unused t3 slot in the sigcontext structure to
>> avoid
>> >>
>> >> Question:
>> >>
>> >> Why can't we steal a 8 byte slot from `__glibc_reserved` under
>> ucontext_t?
>> >
>> >
>> >The __glibc_reserved field actually does not take any space
>>
>> aah thanks for that clarification.
>>
>> >
>> >#define _SIGSET_NWORDS (1024 / (8 * sizeof (unsigned long int)))
>> >
>> >typedef struct
>> >{
>> >  unsigned long int __val[_SIGSET_NWORDS];
>> >} __sigset_t;
>> >
>> >typedef struct ucontext_t
>> >  {
>> >    unsigned long int  __uc_flags;
>> >    struct ucontext_t *uc_link;
>> >    stack_t            uc_stack;
>> >    sigset_t           uc_sigmask;
>> >    /* There's some padding here to allow sigset_t to be expanded in the
>> >       future.  Though this is unlikely, other architectures put
>> uc_sigmask
>> >       at the end of this structure and explicitly state it can be
>> >       expanded, so we didn't want to box ourselves in here.  */
>> >    char               __glibc_reserved[1024 / 8 - sizeof (sigset_t)];
>> >    /* We can't put uc_sigmask at the end of this structure because we
>> need
>> >       to be able to expand sigcontext in the future.  For example, the
>> >       vector ISA extension will almost certainly add ISA state.  We want
>> >       to ensure all user-visible ISA state can be saved and restored via
>> a
>> >       ucontext, so we're putting this at the end in order to allow for
>> >       infinite extensibility.  Since we know this will be extended and we
>> >       assume sigset_t won't be extended an extreme amount, we're
>> >       prioritizing this.  */
>> >    mcontext_t uc_mcontext;
>> >  } ucontext_t;
>> >
>> >Where  `1024 / 8 - sizeof(sigset_t)` evaluates to 0, unless we shrink the
>> >`_SIGSET_NWORDS`.
>>
>> Can we shrink it?
>> I see that it is differently defined for `arc`.
>> If it's not needed, then perhaps we can create space here.
>> And then as long as we have `ssp` pointer, we can simply use token
>> mechanism and we don't need to worry about two different cases (one where
>> single thread stack is used and one where two different threads are hosting
>> two different contexts)
>>