From patchwork Tue Aug 20 00:01:25 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Deepak Gupta X-Patchwork-Id: 13769214 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id B9869C52D7C for ; Tue, 20 Aug 2024 00:05:54 +0000 (UTC) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1sgCKd-0001rj-My; Mon, 19 Aug 2024 20:02:39 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1sgCKS-00012E-AQ for qemu-devel@nongnu.org; Mon, 19 Aug 2024 20:02:30 -0400 Received: from mail-pl1-x633.google.com ([2607:f8b0:4864:20::633]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.90_1) (envelope-from ) id 1sgCK4-0001E2-3l for qemu-devel@nongnu.org; Mon, 19 Aug 2024 20:02:10 -0400 Received: by mail-pl1-x633.google.com with SMTP id d9443c01a7336-201ee6b084bso40465555ad.2 for ; Mon, 19 Aug 2024 17:01:51 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rivosinc-com.20230601.gappssmtp.com; s=20230601; t=1724112111; x=1724716911; darn=nongnu.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=Ru/49Vikixr5VNQYdOfBa6ZZ1i1jB69+7Hk5QoNx/og=; b=PRu1LURd0OZCT3AN6+GrYHBXVOBQcUnFE7bUSvHNdWa5Ne8gypoK4/vFy0OowyuIG8 1gTT21NgmyR/QEPwKlPNgbytB6cVEZt482wNVqpRtI2Dh7J4y0eCl2OK3ca6VqCLgyfg oR+SKPgFCojqEY+3TxeGCNDdtpWkUvnsBB8ubjnAwzSRUH62hfaamxwI8xBx2p4dOmfd YM7CqBPcOVWi2zlcNdCztXpBBNgc/CRb3wpLvJ5P8+JhYyDdjoGjr4A/7GyPJUC+q6BN WtuVjr3UXFqR8SDtJVR+hJw9Wm4UDDPRHr7G4dmtUV1HFsijmaDMvLblo0D71Gs9cD62 d9LA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1724112111; x=1724716911; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=Ru/49Vikixr5VNQYdOfBa6ZZ1i1jB69+7Hk5QoNx/og=; b=LwFz63w9yzQGEaeQhFBsYHSsNLzgGqlwivzNpSwPxSSfWZb3GSVZGhtDN2yfJhJXOT 6cjnQWUz+zf4l5pVdgyqwjThm7MDxO2QUkObIjflFxcrru4DmfzM6lUUmfhEHkDnn2PK y5hQ40quJnyNYiySMBb08Rey6qdTjAbCcz3+FKl5aaN0ZzNbCzFAhPSgE6xBGzH8j9r2 +JkokP0hRkkbalh2xleSegAKldFx19DgKzIqEw9OzmT/FQxnL7+GWycNUeYaDAAbzbLL lRLljEImt1T5b1pQozOVt89uWvIw+Ho8p+GWrYxHZcnWNzD+zVdmCVcFQdplzbaI+2AV yzPw== X-Forwarded-Encrypted: i=1; AJvYcCUdP5vz7355kc3xWm3r2GtzgQUugwduqTqSy4Min5WMenktCLptebCDtzvMi20clzQzTUZpYUaLTTHBbWqPVbymOeI9HOc= X-Gm-Message-State: AOJu0YzNwG3CddNH10E00H5Rjy9JOeioI1MzhVsh8HM6zZmaPqCO4y9v dJe86UQq6GnJJ+GKmitZy3FqigAl2jm1GculpuB0alzrNRNl0WX+U34B71UrkuI= X-Google-Smtp-Source: AGHT+IGkoUVRfQoJTFMRRREwUU4pn2NNnkz6h6sQXkwN1j/PKit/W0tp0MoeSXAh9G4awchKWpO6zw== X-Received: by 2002:a17:902:da88:b0:1fb:5a07:797f with SMTP id d9443c01a7336-20203e554bcmr158918675ad.4.1724112108907; Mon, 19 Aug 2024 17:01:48 -0700 (PDT) Received: from debug.ba.rivosinc.com ([64.71.180.162]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-201f038a779sm67477445ad.188.2024.08.19.17.01.47 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 19 Aug 2024 17:01:48 -0700 (PDT) From: Deepak Gupta To: qemu-riscv@nongnu.org, qemu-devel@nongnu.org Cc: palmer@dabbelt.com, Alistair.Francis@wdc.com, bmeng.cn@gmail.com, liwei1518@gmail.com, dbarboza@ventanamicro.com, zhiwei_liu@linux.alibaba.com, jim.shu@sifive.com, andy.chiu@sifive.com, kito.cheng@sifive.com, Deepak Gupta , Richard Henderson Subject: [PATCH v5 11/15] target/riscv: mmu changes for zicfiss shadow stack protection Date: Mon, 19 Aug 2024 17:01:25 -0700 Message-ID: <20240820000129.3522346-12-debug@rivosinc.com> X-Mailer: git-send-email 2.45.0 In-Reply-To: <20240820000129.3522346-1-debug@rivosinc.com> References: <20240820000129.3522346-1-debug@rivosinc.com> MIME-Version: 1.0 Received-SPF: pass client-ip=2607:f8b0:4864:20::633; envelope-from=debug@rivosinc.com; helo=mail-pl1-x633.google.com X-Spam_score_int: -18 X-Spam_score: -1.9 X-Spam_bar: - X-Spam_report: (-1.9 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+qemu-devel=archiver.kernel.org@nongnu.org Sender: qemu-devel-bounces+qemu-devel=archiver.kernel.org@nongnu.org zicfiss protects shadow stack using new page table encodings PTE.W=0, PTE.R=0 and PTE.X=0. This encoding is reserved if zicfiss is not implemented or if shadow stack are not enabled. Loads on shadow stack memory are allowed while stores to shadow stack memory leads to access faults. Shadow stack accesses to RO memory leads to store page fault. To implement special nature of shadow stack memory where only selected stores (shadow stack stores from sspush) have to be allowed while rest of regular stores disallowed, new MMU TLB index is created for shadow stack. Signed-off-by: Deepak Gupta Suggested-by: Richard Henderson --- target/riscv/cpu_helper.c | 42 +++++++++++++++++++++++++++++++++------ target/riscv/internals.h | 3 +++ 2 files changed, 39 insertions(+), 6 deletions(-) diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c index d3115da28d..f74a1216b1 100644 --- a/target/riscv/cpu_helper.c +++ b/target/riscv/cpu_helper.c @@ -894,6 +894,8 @@ static int get_physical_address(CPURISCVState *env, hwaddr *physical, hwaddr ppn; int napot_bits = 0; target_ulong napot_mask; + bool is_sstack_idx = ((mmu_idx & MMU_IDX_SS_WRITE) == MMU_IDX_SS_WRITE); + bool sstack_page = false; /* * Check if we should use the background registers for the two @@ -1102,21 +1104,36 @@ restart: return TRANSLATE_FAIL; } + target_ulong rwx = pte & (PTE_R | PTE_W | PTE_X); /* Check for reserved combinations of RWX flags. */ - switch (pte & (PTE_R | PTE_W | PTE_X)) { - case PTE_W: + switch (rwx) { case PTE_W | PTE_X: return TRANSLATE_FAIL; + case PTE_W: + /* if bcfi enabled, PTE_W is not reserved and shadow stack page */ + if (cpu_get_bcfien(env) && first_stage) { + sstack_page = true; + /* if ss index, read and write allowed. else only read allowed */ + rwx = is_sstack_idx ? PTE_R | PTE_W : PTE_R; + break; + } + return TRANSLATE_FAIL; + case PTE_R: + /* shadow stack writes to readonly memory are page faults */ + if (is_sstack_idx && access_type == MMU_DATA_STORE) { + return TRANSLATE_FAIL; + } + break; } int prot = 0; - if (pte & PTE_R) { + if (rwx & PTE_R) { prot |= PAGE_READ; } - if (pte & PTE_W) { + if (rwx & PTE_W) { prot |= PAGE_WRITE; } - if (pte & PTE_X) { + if (rwx & PTE_X) { bool mxr = false; /* @@ -1161,7 +1178,7 @@ restart: if (!((prot >> access_type) & 1)) { /* Access check failed */ - return TRANSLATE_FAIL; + return sstack_page ? TRANSLATE_PMP_FAIL : TRANSLATE_FAIL; } target_ulong updated_pte = pte; @@ -1348,9 +1365,17 @@ void riscv_cpu_do_unaligned_access(CPUState *cs, vaddr addr, break; case MMU_DATA_LOAD: cs->exception_index = RISCV_EXCP_LOAD_ADDR_MIS; + /* shadow stack mis aligned accesses are access faults */ + if (mmu_idx & MMU_IDX_SS_WRITE) { + cs->exception_index = RISCV_EXCP_LOAD_ACCESS_FAULT; + } break; case MMU_DATA_STORE: cs->exception_index = RISCV_EXCP_STORE_AMO_ADDR_MIS; + /* shadow stack mis aligned accesses are access faults */ + if (mmu_idx & MMU_IDX_SS_WRITE) { + cs->exception_index = RISCV_EXCP_STORE_AMO_ACCESS_FAULT; + } break; default: g_assert_not_reached(); @@ -1406,6 +1431,11 @@ bool riscv_cpu_tlb_fill(CPUState *cs, vaddr address, int size, qemu_log_mask(CPU_LOG_MMU, "%s ad %" VADDR_PRIx " rw %d mmu_idx %d\n", __func__, address, access_type, mmu_idx); + /* If shadow stack instruction initiated this access, treat it as store */ + if (mmu_idx & MMU_IDX_SS_WRITE) { + access_type = MMU_DATA_STORE; + } + pmu_tlb_fill_incr_ctr(cpu, access_type); if (two_stage_lookup) { /* Two stage lookup */ diff --git a/target/riscv/internals.h b/target/riscv/internals.h index 0ac17bc5ad..ddbdee885b 100644 --- a/target/riscv/internals.h +++ b/target/riscv/internals.h @@ -30,12 +30,15 @@ * - U+2STAGE 0b100 * - S+2STAGE 0b101 * - S+SUM+2STAGE 0b110 + * - Shadow stack+U 0b1000 + * - Shadow stack+S 0b1001 */ #define MMUIdx_U 0 #define MMUIdx_S 1 #define MMUIdx_S_SUM 2 #define MMUIdx_M 3 #define MMU_2STAGE_BIT (1 << 2) +#define MMU_IDX_SS_WRITE (1 << 3) static inline int mmuidx_priv(int mmu_idx) {