From: Deepak Gupta <debug@rivosinc.com>
To: qemu-riscv@nongnu.org, qemu-devel@nongnu.org
Cc: palmer@dabbelt.com, Alistair.Francis@wdc.com, bmeng.cn@gmail.com,
liwei1518@gmail.com, dbarboza@ventanamicro.com,
zhiwei_liu@linux.alibaba.com, jim.shu@sifive.com,
kito.cheng@sifive.com, Deepak Gupta <debug@rivosinc.com>,
Richard Henderson <richard.henderson@linaro.org>
Subject: [PATCH v15 13/21] target/riscv: mmu changes for zicfiss shadow stack protection
Date: Thu, 3 Oct 2024 11:33:34 -0700 [thread overview]
Message-ID: <20241003183342.679249-14-debug@rivosinc.com> (raw)
In-Reply-To: <20241003183342.679249-1-debug@rivosinc.com>
zicfiss protects shadow stack using new page table encodings PTE.W=1,
PTE.R=0 and PTE.X=0. This encoding is reserved if zicfiss is not
implemented or if shadow stack are not enabled.
Loads on shadow stack memory are allowed while stores to shadow stack
memory leads to access faults. Shadow stack accesses to RO memory
leads to store page fault.
To implement special nature of shadow stack memory where only selected
stores (shadow stack stores from sspush) have to be allowed while rest
of regular stores disallowed, new MMU TLB index is created for shadow
stack.
Signed-off-by: Deepak Gupta <debug@rivosinc.com>
Suggested-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
---
target/riscv/cpu_helper.c | 46 +++++++++++++++++++++++++++++++++------
target/riscv/internals.h | 3 +++
2 files changed, 42 insertions(+), 7 deletions(-)
diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
index 93d199748e..5580f5f3f3 100644
--- a/target/riscv/cpu_helper.c
+++ b/target/riscv/cpu_helper.c
@@ -898,6 +898,8 @@ static int get_physical_address(CPURISCVState *env, hwaddr *physical,
hwaddr ppn;
int napot_bits = 0;
target_ulong napot_mask;
+ bool is_sstack_idx = ((mmu_idx & MMU_IDX_SS_WRITE) == MMU_IDX_SS_WRITE);
+ bool sstack_page = false;
/*
* Check if we should use the background registers for the two
@@ -1106,21 +1108,40 @@ restart:
return TRANSLATE_FAIL;
}
+ target_ulong rwx = pte & (PTE_R | PTE_W | PTE_X);
/* Check for reserved combinations of RWX flags. */
- switch (pte & (PTE_R | PTE_W | PTE_X)) {
- case PTE_W:
+ switch (rwx) {
case PTE_W | PTE_X:
return TRANSLATE_FAIL;
+ case PTE_W:
+ /* if bcfi enabled, PTE_W is not reserved and shadow stack page */
+ if (cpu_get_bcfien(env) && first_stage) {
+ sstack_page = true;
+ /* if ss index, read and write allowed. else only read allowed */
+ rwx = is_sstack_idx ? PTE_R | PTE_W : PTE_R;
+ break;
+ }
+ return TRANSLATE_FAIL;
+ case PTE_R:
+ /*
+ * no matter what's the `access_type`, shadow stack access to readonly
+ * memory are always store page faults. During unwind, loads will be
+ * promoted as store fault.
+ */
+ if (is_sstack_idx) {
+ return TRANSLATE_FAIL;
+ }
+ break;
}
int prot = 0;
- if (pte & PTE_R) {
+ if (rwx & PTE_R) {
prot |= PAGE_READ;
}
- if (pte & PTE_W) {
+ if (rwx & PTE_W) {
prot |= PAGE_WRITE;
}
- if (pte & PTE_X) {
+ if (rwx & PTE_X) {
bool mxr = false;
/*
@@ -1164,8 +1185,11 @@ restart:
}
if (!((prot >> access_type) & 1)) {
- /* Access check failed */
- return TRANSLATE_FAIL;
+ /*
+ * Access check failed, access check failures for shadow stack are
+ * access faults.
+ */
+ return sstack_page ? TRANSLATE_PMP_FAIL : TRANSLATE_FAIL;
}
target_ulong updated_pte = pte;
@@ -1352,9 +1376,17 @@ void riscv_cpu_do_unaligned_access(CPUState *cs, vaddr addr,
break;
case MMU_DATA_LOAD:
cs->exception_index = RISCV_EXCP_LOAD_ADDR_MIS;
+ /* shadow stack mis aligned accesses are access faults */
+ if (mmu_idx & MMU_IDX_SS_WRITE) {
+ cs->exception_index = RISCV_EXCP_LOAD_ACCESS_FAULT;
+ }
break;
case MMU_DATA_STORE:
cs->exception_index = RISCV_EXCP_STORE_AMO_ADDR_MIS;
+ /* shadow stack mis aligned accesses are access faults */
+ if (mmu_idx & MMU_IDX_SS_WRITE) {
+ cs->exception_index = RISCV_EXCP_STORE_AMO_ACCESS_FAULT;
+ }
break;
default:
g_assert_not_reached();
diff --git a/target/riscv/internals.h b/target/riscv/internals.h
index 0ac17bc5ad..ddbdee885b 100644
--- a/target/riscv/internals.h
+++ b/target/riscv/internals.h
@@ -30,12 +30,15 @@
* - U+2STAGE 0b100
* - S+2STAGE 0b101
* - S+SUM+2STAGE 0b110
+ * - Shadow stack+U 0b1000
+ * - Shadow stack+S 0b1001
*/
#define MMUIdx_U 0
#define MMUIdx_S 1
#define MMUIdx_S_SUM 2
#define MMUIdx_M 3
#define MMU_2STAGE_BIT (1 << 2)
+#define MMU_IDX_SS_WRITE (1 << 3)
static inline int mmuidx_priv(int mmu_idx)
{
--
2.45.0
next prev parent reply other threads:[~2024-10-03 18:36 UTC|newest]
Thread overview: 23+ messages / expand[flat|nested] mbox.gz Atom feed top
2024-10-03 18:33 [PATCH v15 00/21] riscv support for control flow integrity extensions Deepak Gupta
2024-10-03 18:33 ` [PATCH v15 01/21] target/riscv: expose *envcfg csr and priv to qemu-user as well Deepak Gupta
2024-10-03 18:33 ` [PATCH v15 02/21] target/riscv: Add zicfilp extension Deepak Gupta
2024-10-03 18:33 ` [PATCH v15 03/21] target/riscv: Introduce elp state and enabling controls for zicfilp Deepak Gupta
2024-10-03 18:33 ` [PATCH v15 04/21] target/riscv: save and restore elp state on priv transitions Deepak Gupta
2024-10-03 18:33 ` [PATCH v15 05/21] target/riscv: additional code information for sw check Deepak Gupta
2024-10-03 18:33 ` [PATCH v15 06/21] target/riscv: tracking indirect branches (fcfi) for zicfilp Deepak Gupta
2024-10-03 18:33 ` [PATCH v15 07/21] target/riscv: zicfilp `lpad` impl and branch tracking Deepak Gupta
2024-10-03 18:33 ` [PATCH v15 08/21] disas/riscv: enable `lpad` disassembly Deepak Gupta
2024-10-03 18:33 ` [PATCH v15 09/21] target/riscv: Expose zicfilp extension as a cpu property Deepak Gupta
2024-10-03 18:33 ` [PATCH v15 10/21] target/riscv: Add zicfiss extension Deepak Gupta
2024-10-03 18:33 ` [PATCH v15 11/21] target/riscv: introduce ssp and enabling controls for zicfiss Deepak Gupta
2024-10-03 18:33 ` [PATCH v15 12/21] target/riscv: tb flag for shadow stack instructions Deepak Gupta
2024-10-03 18:33 ` Deepak Gupta [this message]
2024-10-03 18:33 ` [PATCH v15 14/21] target/riscv: disallow probe accesses to shadow stack Deepak Gupta
2024-10-04 0:36 ` Deepak Gupta
2024-10-03 18:33 ` [PATCH v15 15/21] target/riscv: AMO operations always raise store/AMO fault Deepak Gupta
2024-10-03 18:33 ` [PATCH v15 16/21] target/riscv: update `decode_save_opc` to store extra word2 Deepak Gupta
2024-10-03 18:33 ` [PATCH v15 17/21] target/riscv: implement zicfiss instructions Deepak Gupta
2024-10-03 18:33 ` [PATCH v15 18/21] target/riscv: compressed encodings for sspush and sspopchk Deepak Gupta
2024-10-03 18:33 ` [PATCH v15 19/21] disas/riscv: enable disassembly for zicfiss instructions Deepak Gupta
2024-10-03 18:33 ` [PATCH v15 20/21] disas/riscv: enable disassembly for compressed sspush/sspopchk Deepak Gupta
2024-10-03 18:33 ` [PATCH v15 21/21] target/riscv: Expose zicfiss extension as a cpu property Deepak Gupta
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20241003183342.679249-14-debug@rivosinc.com \
--to=debug@rivosinc.com \
--cc=Alistair.Francis@wdc.com \
--cc=bmeng.cn@gmail.com \
--cc=dbarboza@ventanamicro.com \
--cc=jim.shu@sifive.com \
--cc=kito.cheng@sifive.com \
--cc=liwei1518@gmail.com \
--cc=palmer@dabbelt.com \
--cc=qemu-devel@nongnu.org \
--cc=qemu-riscv@nongnu.org \
--cc=richard.henderson@linaro.org \
--cc=zhiwei_liu@linux.alibaba.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).