[PATCH] riscv: enable mseal sysmap for RV64

[Jeff Xu]

Hi Jisheng

It seems mm maintainers might prefer arch change reviewed by arch
maintainer and goes to arch tree, according to discussion in [1], I
don't have an opinion on this,  adding mm maintainers as FYI.

On Sat, Apr 26, 2025 at 7:16 AM Jisheng Zhang <jszhang at kernel.org> wrote:
>
> Provide support for CONFIG_MSEAL_SYSTEM_MAPPINGS for RV64, covering the
> vdso, vvar.
>
> Passed sysmap_is_sealed and mseal_test self tests.
> Passed booting a buildroot rootfs image and a cli debian rootfs image.
>
mm maintainers like to get confirmation that the arch doesn't rely on
remapping the VDSO, VVAR, or any other special mappings, see
discussion in [2]

> Signed-off-by: Jisheng Zhang <jszhang at kernel.org>
> Cc: Jeff Xu <jeffxu at chromium.org>
> ---
>  arch/riscv/Kconfig       | 1 +
>  arch/riscv/kernel/vdso.c | 2 +-
>  2 files changed, 2 insertions(+), 1 deletion(-)

Please consider updating document as part of your patch:
features/core/mseal_sys_mappings/arch-support.txt
Documentation/userspace-api/mseal.rst

Sample change in [3]

>
> diff --git a/arch/riscv/Kconfig b/arch/riscv/Kconfig
> index bbec87b79309..3cb0b05eef62 100644
> --- a/arch/riscv/Kconfig
> +++ b/arch/riscv/Kconfig
> @@ -70,6 +70,7 @@ config RISCV
>         # LLD >= 14: https://github.com/llvm/llvm-project/issues/50505
>         select ARCH_SUPPORTS_LTO_CLANG if LLD_VERSION >= 140000
>         select ARCH_SUPPORTS_LTO_CLANG_THIN if LLD_VERSION >= 140000
> +       select ARCH_SUPPORTS_MSEAL_SYSTEM_MAPPINGS if 64BIT && MMU
The "if 64BIT && MMU" are not needed here.

MMU is not checked by MSEAL_SYSTEM_MAPPINGS, which we should,  this
can go to security/Kconfig separately. If you'd like, please submit a
fix to mm tree directly.

[1] https://lore.kernel.org/all/7EB087B72C4FBDD3+20250417132410.404043-1-wangyuli@uniontech.com/,
[2] https://lore.kernel.org/all/3de559d6-be19-44bc-ba8f-4c52d4bca684@lucifer.local/
[3] https://lore.kernel.org/all/648AB3031B5618C0+20250415153903.570662-1-wangyuli@uniontech.com/

Thanks
-Jeff

>         select ARCH_SUPPORTS_PAGE_TABLE_CHECK if MMU
>         select ARCH_SUPPORTS_PER_VMA_LOCK if MMU
>         select ARCH_SUPPORTS_RT
> diff --git a/arch/riscv/kernel/vdso.c b/arch/riscv/kernel/vdso.c
> index cc2895d1fbc2..3a8e038b10a2 100644
> --- a/arch/riscv/kernel/vdso.c
> +++ b/arch/riscv/kernel/vdso.c
> @@ -136,7 +136,7 @@ static int __setup_additional_pages(struct mm_struct *mm,
>
>         ret =
>            _install_special_mapping(mm, vdso_base, vdso_text_len,
> -               (VM_READ | VM_EXEC | VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC),
> +               (VM_READ | VM_EXEC | VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC | VM_SEALED_SYSMAP),
>                 vdso_info->cm);
>
>         if (IS_ERR(ret))
> --
> 2.47.2
>