Add support for RISC-V #172
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
jvoisin
approved these changes
Jan 7, 2025
|
Hello @bcoles, Cool, thanks for your work and interest to this project! Some thoughts for the beginning:
|
No, we don't need all three. I have replaced these with one:
I thought the included defconf files were supposed to represent the mainline defaults. The other defconf files in the repository certainly do not pass - they result in multiple failures. Perhaps I misunderstand. Can you elaborate? |
I mean For example, It's the first thing that we need to fix in this pull request:
After this work, our Thank you! |
|
Thanks.
That makes sense. I have implemented these changes.
I have implemented these changes for Output: |
|
As for the checks, KSPP Recommended Settings does not currently have recommendations for RISC-V, but some of the existing recommendations for other architectures are likely to be applicable. These may need to be assessed individually. For example:
Do you have a suggestion for the |
Sure, I can add config files for a few distros. Unfortunately https://github.com/oracle/kconfigs does not have KConfig files for RISC-V systems. Is there a better approach than pulling the config from |
I've added OpenSUSE to the I've added a |
|
Hi @bcoles ! First of all, thanks for showing the autodetect bug on Debian. I've fixed it: Could you check that the latest |
|
And thanks for your fixes.
Yes, I think, this is the second step. KSPP recommendations in the beginning contain a lot of settings that are universal for all microarchitectures. So we need to take those checks which are applicable to RISC-V. We can still use the For other recommendations that can't be satisfied on RISC-V, we need to add In other words, please try to enable all known hardening features in RISC-V kernel using By the way, could you please use Linux kernel v6.10 to be consistent with the |
The The |
I have added a 6.10 defconfig. Are the other defconfigs in this PR (versions 4.20, 5.0, 5.17, and 6.0 - 6.9) of use or should I remove them? As this PR may take a while to merge, can we merge the changes to |
Done, with
Kernel Configs I have updated all RISC-V kernel config checks. All kernel configuration options which are not supported by RISC-V should now be excluded by an
No RISC-V kernel configs support these options going back as far as 4.20 kernel, so these options will never realistically be enabled, and thus these checks should always pass. Leaving these checks enabled for all architectures should cause no harm. Cmdline I have updated RISC-V cmdline checks. RISC-V does not have any unique cmdline options with obvious security impact. RISC-V does support Sysctl I have perused the Example output on
Example output on
Example output on
|
|
Hi @bcoles, Excuse me for the delay, I was travelling. Now I've returned and going to spend some weekends on your pull request and this feature I'll return with comments / additional commits to this branch. Thanks! |
|
Hello @bcoles, I've installed the RISC-V virtual machine in QEMU: Arch detection from kconfig on your branch works fine: Arch detection from sysctl also works fine: Cool!
I think it's fine to have previous versions of RISC-V configs as well. The CI script will test the tool on them.
Unfortunately, merging RISC-V kconfig files separately without the main functionality will break the CI. Currently, I'm going to focus on your pull request before any other feature. So, I hope, merging it will not take that long. Could you please rebase this branch onto the current master and give me an ability to add commits to this branch? Thank you again! |
Rebased. You should have permissions. |
|
I've added a13xp0p0v/kernel-build-containers@76fc401 It is useful for this work. |
From Linux v6.6, kernel_hardening_checker/config_files/defconfigs/ contains ARM64 defconfigs made with clang.
|
Hello @bcoles,
I think this feature will be finished soon. |
This is needed to avoid the error in `make O=../out/ menuconfig`.
This option disappears if COMPAT is not set.
|
Hello @bcoles, I've finished this big work.
Thank you for initializing this task :) During this work I also:
Cool! |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR adds support for RISC-V. Fixes #56.
generate defconfig
The provided kernel config files were generated using the RISC-V toolchain (gcc):
git checkout v6.10 PATH="/home/user/Desktop/riscv/bin:$PATH" ARCH=riscv CROSS_COMPILE=riscv64-unknown-linux-gnu- make defconfig mv .config ../kernel-hardening-checker/kernel_hardening_checker/config_files/defconfigs/riscv_defconfig_6.10.config(I can also provide configs built with
muslif that would be of any use.)detect_arch_by_kconfig()
Kernel configs for both 32-bit and 64-bit RISC-V systems use
CONFIG_RISCV_*.detect_arch_by_kconfig()uses"RISCV"for architecture detection, ignoring bit-width.detect_arch_by_sysctl()
I examined multiple Linux RISC-V systems, many of which did not populate the
kernel.archsysctl.detect_arch_by_sysctl()usesriscv32andriscv64for 32-bit and 64-bit respectively.uname -mprovides the same values. Perhaps a newdetect_arch_by_uname()function should be added as a fallback.Example Output
Example output on
debian-20240128-convert_riscv64-virtin Qemu:Output: