From: Deepak Gupta <debug@rivosinc.com>
To: qemu-riscv@nongnu.org, qemu-devel@nongnu.org
Cc: palmer@dabbelt.com, Alistair.Francis@wdc.com, bmeng.cn@gmail.com,
liwei1518@gmail.com, dbarboza@ventanamicro.com,
zhiwei_liu@linux.alibaba.com, jim.shu@sifive.com,
kito.cheng@sifive.com, Deepak Gupta <debug@rivosinc.com>
Subject: [PATCH v15 14/21] target/riscv: disallow probe accesses to shadow stack
Date: Thu, 3 Oct 2024 11:33:35 -0700 [thread overview]
Message-ID: <20241003183342.679249-15-debug@rivosinc.com> (raw)
In-Reply-To: <20241003183342.679249-1-debug@rivosinc.com>
`check_zicbom_access` (`cbo.clean/flush/inval`) may probe shadow stack
memory and must always raise store/AMO access fault because it has store
semantics.
For non-shadow stack memory even though `cbo.clean/flush/inval` have
store semantics, it will not fault if read is allowed (probably to follow
`clflush` on x86). Although if read is not allowed, eventually
`probe_write` will do store page (or access) fault (if permissions don't
allow it).
cbo operations on shadow stack memory must always raise store access fault.
Thus extending `get_physical_address` to recieve `probe` parameter as well.
Signed-off-by: Deepak Gupta <debug@rivosinc.com>
---
target/riscv/cpu_helper.c | 22 +++++++++++++---------
1 file changed, 13 insertions(+), 9 deletions(-)
diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
index 5580f5f3f3..ab46f694b5 100644
--- a/target/riscv/cpu_helper.c
+++ b/target/riscv/cpu_helper.c
@@ -884,7 +884,7 @@ static int get_physical_address(CPURISCVState *env, hwaddr *physical,
target_ulong *fault_pte_addr,
int access_type, int mmu_idx,
bool first_stage, bool two_stage,
- bool is_debug)
+ bool is_debug, bool is_probe)
{
/*
* NOTE: the env->pc value visible here will not be
@@ -1030,7 +1030,7 @@ restart:
int vbase_ret = get_physical_address(env, &vbase, &vbase_prot,
base, NULL, MMU_DATA_LOAD,
MMUIdx_U, false, true,
- is_debug);
+ is_debug, false);
if (vbase_ret != TRANSLATE_SUCCESS) {
if (fault_pte_addr) {
@@ -1117,8 +1117,11 @@ restart:
/* if bcfi enabled, PTE_W is not reserved and shadow stack page */
if (cpu_get_bcfien(env) && first_stage) {
sstack_page = true;
- /* if ss index, read and write allowed. else only read allowed */
- rwx = is_sstack_idx ? PTE_R | PTE_W : PTE_R;
+ /*
+ * if ss index, read and write allowed. else if not a probe
+ * then only read allowed
+ */
+ rwx = is_sstack_idx ? (PTE_R | PTE_W) : (is_probe ? rwx : PTE_R);
break;
}
return TRANSLATE_FAIL;
@@ -1327,13 +1330,13 @@ hwaddr riscv_cpu_get_phys_page_debug(CPUState *cs, vaddr addr)
int mmu_idx = riscv_env_mmu_index(&cpu->env, false);
if (get_physical_address(env, &phys_addr, &prot, addr, NULL, 0, mmu_idx,
- true, env->virt_enabled, true)) {
+ true, env->virt_enabled, true, false)) {
return -1;
}
if (env->virt_enabled) {
if (get_physical_address(env, &phys_addr, &prot, phys_addr, NULL,
- 0, MMUIdx_U, false, true, true)) {
+ 0, MMUIdx_U, false, true, true, false)) {
return -1;
}
}
@@ -1447,7 +1450,7 @@ bool riscv_cpu_tlb_fill(CPUState *cs, vaddr address, int size,
/* Two stage lookup */
ret = get_physical_address(env, &pa, &prot, address,
&env->guest_phys_fault_addr, access_type,
- mmu_idx, true, true, false);
+ mmu_idx, true, true, false, probe);
/*
* A G-stage exception may be triggered during two state lookup.
@@ -1470,7 +1473,7 @@ bool riscv_cpu_tlb_fill(CPUState *cs, vaddr address, int size,
ret = get_physical_address(env, &pa, &prot2, im_address, NULL,
access_type, MMUIdx_U, false, true,
- false);
+ false, probe);
qemu_log_mask(CPU_LOG_MMU,
"%s 2nd-stage address=%" VADDR_PRIx
@@ -1507,7 +1510,8 @@ bool riscv_cpu_tlb_fill(CPUState *cs, vaddr address, int size,
} else {
/* Single stage lookup */
ret = get_physical_address(env, &pa, &prot, address, NULL,
- access_type, mmu_idx, true, false, false);
+ access_type, mmu_idx, true, false, false,
+ probe);
qemu_log_mask(CPU_LOG_MMU,
"%s address=%" VADDR_PRIx " ret %d physical "
--
2.45.0
next prev parent reply other threads:[~2024-10-03 18:37 UTC|newest]
Thread overview: 23+ messages / expand[flat|nested] mbox.gz Atom feed top
2024-10-03 18:33 [PATCH v15 00/21] riscv support for control flow integrity extensions Deepak Gupta
2024-10-03 18:33 ` [PATCH v15 01/21] target/riscv: expose *envcfg csr and priv to qemu-user as well Deepak Gupta
2024-10-03 18:33 ` [PATCH v15 02/21] target/riscv: Add zicfilp extension Deepak Gupta
2024-10-03 18:33 ` [PATCH v15 03/21] target/riscv: Introduce elp state and enabling controls for zicfilp Deepak Gupta
2024-10-03 18:33 ` [PATCH v15 04/21] target/riscv: save and restore elp state on priv transitions Deepak Gupta
2024-10-03 18:33 ` [PATCH v15 05/21] target/riscv: additional code information for sw check Deepak Gupta
2024-10-03 18:33 ` [PATCH v15 06/21] target/riscv: tracking indirect branches (fcfi) for zicfilp Deepak Gupta
2024-10-03 18:33 ` [PATCH v15 07/21] target/riscv: zicfilp `lpad` impl and branch tracking Deepak Gupta
2024-10-03 18:33 ` [PATCH v15 08/21] disas/riscv: enable `lpad` disassembly Deepak Gupta
2024-10-03 18:33 ` [PATCH v15 09/21] target/riscv: Expose zicfilp extension as a cpu property Deepak Gupta
2024-10-03 18:33 ` [PATCH v15 10/21] target/riscv: Add zicfiss extension Deepak Gupta
2024-10-03 18:33 ` [PATCH v15 11/21] target/riscv: introduce ssp and enabling controls for zicfiss Deepak Gupta
2024-10-03 18:33 ` [PATCH v15 12/21] target/riscv: tb flag for shadow stack instructions Deepak Gupta
2024-10-03 18:33 ` [PATCH v15 13/21] target/riscv: mmu changes for zicfiss shadow stack protection Deepak Gupta
2024-10-03 18:33 ` Deepak Gupta [this message]
2024-10-04 0:36 ` [PATCH v15 14/21] target/riscv: disallow probe accesses to shadow stack Deepak Gupta
2024-10-03 18:33 ` [PATCH v15 15/21] target/riscv: AMO operations always raise store/AMO fault Deepak Gupta
2024-10-03 18:33 ` [PATCH v15 16/21] target/riscv: update `decode_save_opc` to store extra word2 Deepak Gupta
2024-10-03 18:33 ` [PATCH v15 17/21] target/riscv: implement zicfiss instructions Deepak Gupta
2024-10-03 18:33 ` [PATCH v15 18/21] target/riscv: compressed encodings for sspush and sspopchk Deepak Gupta
2024-10-03 18:33 ` [PATCH v15 19/21] disas/riscv: enable disassembly for zicfiss instructions Deepak Gupta
2024-10-03 18:33 ` [PATCH v15 20/21] disas/riscv: enable disassembly for compressed sspush/sspopchk Deepak Gupta
2024-10-03 18:33 ` [PATCH v15 21/21] target/riscv: Expose zicfiss extension as a cpu property Deepak Gupta
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20241003183342.679249-15-debug@rivosinc.com \
--to=debug@rivosinc.com \
--cc=Alistair.Francis@wdc.com \
--cc=bmeng.cn@gmail.com \
--cc=dbarboza@ventanamicro.com \
--cc=jim.shu@sifive.com \
--cc=kito.cheng@sifive.com \
--cc=liwei1518@gmail.com \
--cc=palmer@dabbelt.com \
--cc=qemu-devel@nongnu.org \
--cc=qemu-riscv@nongnu.org \
--cc=zhiwei_liu@linux.alibaba.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.