Support Zicfiss (shadow stack access) with CFI extension v0.4.0 #1560

SuHo-llrr · 2024-01-09T05:54:09Z

We implement the following task for support Zicfiss and reference from document cfi v0.4.0

Add EXT_ZICFISS for enable Zicfiss with zicfiss extension name
Add new software exception with tval 3 for shadow stack
Implement sspush_x1/sspush_x5/sspopchk_x1/sspopchk_x5/ssrdp/ssamoswap_w/ssamoswap_d
Implement c_sspush_x1/c_sspopchk_x5 in c_lui.h which has same encoding
Add new special access type shstk in xlate_flags_t for checking special read/write permission in SS(Shadow Stack) Page.
Add new shstk_load/shstk_store to enable shstk flag
Allow special PTE (R=0, W=1, X=0) of SS page when LOAD/STORE with shstk type
Set menvcfg.SSE and senvcfg.SSE bit on when extension enable

The Implement above requires the combination of the two patches below

riscv-pk parsing .note.gnu.property [riscv-pk] (Enable shadow stack from .note.gnu.property riscv-pk#310)
Compiler should emit .note.gnu.property section llvm-project

Some tasks require discussion:

Should we need the new PROT_SHSTK protection flag? (or use PROT_WRITE ?)

aswaterman · 2024-01-09T06:41:06Z

Sorry for the misfire; my previous (deleted) comment was directed at pk.

@ved-rivos please review.

disasm/disasm.cc

riscv/insns/c_lui.h

riscv/insns/c_sspopchk_x5.h

ved-rivos · 2024-01-09T15:35:36Z

riscv/insns/c_sspush_x1.h

+  throw trap_illegal_instruction(insn.bits());
+else if (prev_prv == PRV_U && STATE.v && !get_field(STATE.senvcfg->read(), SENVCFG_SSE))
+  throw trap_illegal_instruction(insn.bits());
+


See comments in c_sspopchk_x5.h

I think I can implement the following code.
After checking xSSE, we can do mop/cmop or Zicfiss

if (prv == PRV_M) xSSE = 0; else if (prv == PRV_S || prv == PRV_HS) xSSE = get_field(STATE.menvcfg->read(), MENVCFG_SSE); else if (p->extension_enabled('S')) xSSE = get_field(STATE.senvcfg->read(), SENVCFG_SSE); else xSSE = false; // For VS-mode if (prv == PRV_S && STATE.v) xSSE &= get_field(STATE.henvcfg->read(), HENVCFG_SSE); if (!xSSE) { #include "c_mop_N.h" } else { do somthing }

For instructions other than ssrdp the following suffices

if (xSSE) { do somthing }

For ssrdp, we would include the mop_N.h as you suggested

riscv/insns/c_sspush_x1.h

riscv/insns/ssamoswap_d.h

ved-rivos · 2024-01-09T15:39:52Z

riscv/insns/ssamoswap_d.h

+else if (prev_prv == PRV_U && STATE.v && !get_field(STATE.senvcfg->read(), SENVCFG_SSE))
+  throw trap_illegal_instruction(insn.bits());
+else
+  WRITE_RD(MMU.amo<uint64_t>(RS1, [&](uint64_t UNUSED lhs) { return RS2; }));


How does this code indicate to MMU that the amo should be performed using shadow stack load and stores?

Sorry, I missed implementing SS AMO. like following and we can use ss_load/ss_store
WRITE_RD(MMU.ss_amo<uint64_t>(RS1, [&](uint64_t UNUSED lhs) { return RS2; }));

it may suffice to be just since there is only one amo operation - so we could call this ssamoswap

riscv/insns/ssamoswap_w.h

riscv/insns/sspopchk_x1.h

riscv/insns/sspopchk_x5.h

riscv/insns/sspush_x1.h

riscv/insns/sspush_x5.h

ved-rivos · 2024-01-09T15:42:05Z

riscv/insns/ssrdp.h

+require_extension(EXT_ZICFISS);
+
+reg_t ssp = STATE.ssp->read();
+


Need to qualify by xSSE. When xSSE is 0, the instruction reverts to being a zimop.

Add check implementation

riscv/mmu.cc

riscv/mmu.h

ved-rivos · 2024-01-09T16:08:45Z

riscv/mmu.cc

@@ -531,18 +531,26 @@ reg_t mmu_t::walk(mem_access_info_t access_info)
      base = ppn << PGSHIFT;
    } else if ((pte & PTE_U) ? s_mode && (type == FETCH || !sum) : !s_mode) {
      break;
-    } else if (!(pte & PTE_V) || (!(pte & PTE_R) && (pte & PTE_W))) {
+    } else if (!(pte & PTE_V) || (!(pte & PTE_R) && (pte & PTE_W) && !access_info.flags.shstk)) {


Various aspects are missing:
All of below should be based on effective privilege of the memory access and not current privilege.
2. If virtual memory system is Bare then ss load and store cause SAMO access-fault
3. SS load and store cause SAMO access fault on access to RW, RWX, X, RX pages
4. SS load and store cause SAMO page fault on access to RO, invalid, and malformed PTEs
5. Non-SS store to SS pages cause SAMO access fault
6. Instruction fetches to SS pages cause instruction access fault

SS encodings in PTEs stay reserved if SS extension is not active.

Thank you for explaining the rule in such detail.
The rules for checking the PTE rule are a bit confusing, and I want to separate each action independently.

Directly check at the end whether the SS page is VW permission. like following code.

else if (check_ss && ((pte & vw) != vw)) { // ss load/store page with R=0, W=1, X=0 and valid break;

After this, check the PTE permission of the SS page for invalidity.

if (check_ss) { if (!(invalid_pte & PTE_V)) throw trap_store_page_fault(virt, addr, 0, 0); else if (invalid_pte & PTE_W || invalid_pte & PTE_X) throw trap_store_access_fault(virt, addr, 0, 0); else throw trap_store_page_fault(virt, addr, 0, 0); }

I think we could do this:

+ bool ss_access = access_info.ss_access; + + if (ss_access) { + if (vm.levels == 0) + throw trap_store_access_fault(virt, addr, 0, 0); + type = STORE; + } + if (vm.levels == 0) return s2xlate(addr, addr & ((reg_t(2) << (proc->xlen-1))-1), type, type, virt, hlvx, false) & ~page_mask; // zero-extend from xlen @@ -516,6 +524,7 @@ reg_t mmu_t::walk(mem_access_info_t access_info) reg_t ppn = (pte & ~reg_t(PTE_ATTR)) >> PTE_PPN_SHIFT; bool pbmte = virt ? (proc->get_state()->henvcfg->read() & HENVCFG_PBMTE) : (proc->get_state()->menvcfg->read() & MENVCFG_PBMTE); bool hade = virt ? (proc->get_state()->henvcfg->read() & HENVCFG_ADUE) : (proc->get_state()->menvcfg->read() & MENVCFG_ADUE); + bool sse = virt ? (proc->get_state()->henvcfg->read() & HENVCFG_SSE) : (proc->get_state()->menvcfg->read() & MENVCFG_SSE); if (pte & PTE_RSVD) { break; @@ -531,11 +540,21 @@ reg_t mmu_t::walk(mem_access_info_t access_info) base = ppn << PGSHIFT; } else if ((pte & PTE_U) ? s_mode && (type == FETCH || !sum) : !s_mode) { break; - } else if (!(pte & PTE_V) || (!(pte & PTE_R) && (pte & PTE_W))) { + } else if (!(pte & PTE_V) || + (!(pte & PTE_R) && (pte & PTE_W) && ((!sse && !(pte & PTE_X)) || (pte & PTE_X)))) { break; + } else if ((!(pte & PTE_R) && (pte & PTE_W) && !(pte & PTE_X)) && (type == STORE && !ss_access)) { + // non-shadow-stack stores to shadow stack pages cause store access-fault + throw trap_store_access_fault(virt, addr, 0, 0); + } else if ((!(pte & PTE_R) && (pte & PTE_W) && !(pte & PTE_X)) && type == FETCH) { + // fetch from shadow stack pages cause instruction access-fault + throw trap_instruction_access_fault(virt, addr, 0, 0); + } else if ((((pte & PTE_R) && (pte & PTE_W)) || (pte & PTE_X)) && ss_access) { + // shadow stack access cause store access fault if xwr!=010 and xwr!=001 + throw trap_store_access_fault(virt, addr, 0, 0); } else if (type == FETCH || hlvx ? !(pte & PTE_X) : type == LOAD ? !(pte & PTE_R) && !(mxr && (pte & PTE_X)) : - !((pte & PTE_R) && (pte & PTE_W))) { +

This should also be added to pmp_ok:

if (ss_access) type = STORE;

Thanks for your narrow down rule.
I add some more detailed descriptions and remove the STORE check in the end

else if (type == FETCH || hlvx ? !(pte & PTE_X) : type == LOAD && !(pte & PTE_R) && !(mxr && (pte & PTE_X))) {

riscv/mmu.h

scottj97

I have not done a thorough review but I did notice one issue.

riscv/processor.cc

ved-rivos · 2024-03-21T21:29:51Z

@SuHo-llrr - would it be possible to update this PR to use designated initializers?
may also need a rebase to address conflicts.

SuHo-llrr · 2024-03-22T06:14:23Z

@SuHo-llrr - would it be possible to update this PR to use designated initializers? may also need a rebase to address conflicts.
@ved-rivos
I finished using designated initializers and rebased the code.

SuHo-llrr · 2024-03-22T06:16:12Z

@scottj97 I already changed the code for your request. Thanks

SuHo-llrr · 2024-03-28T15:25:59Z

@ved-rivos @scottj97
I already rebased this patch. Do you have any other suggestions?

SuHo-llrr · 2024-04-17T00:01:36Z

@aswaterman
It's been a few weeks since this patch was updated, do you have any suggestions? Thank you very much!

aswaterman · 2024-04-17T02:52:59Z

I won't step in to override the other reviewers. If @ved-rivos thinks it is done, I can take a look next week, giving others a chance to perform their review.

ved-rivos · 2024-04-17T22:12:50Z

@aswaterman - I have reviewed and tested this (minus the last update to use designated initializers). This looks good to me.

riscv/processor.cc

aswaterman

LGTM once my comments are addressed. Thanks for your patience, @SuHo-llrr!

riscv/processor.cc

aswaterman

LGTM after my last nit is addressed

1. Add EXT_ZICFISS for enable Zicfiss with zicfiss extension name. 2. Add new software exception with tval 3 for shadow stack. 3. Implement sspush_x1/sspush_x5/sspopchk_x1/sspopchk_x5/ssrdp/ssamoswap_w/ssamoswap_d. 4. Implement c_sspush_x1/c_sspopchk_x5 in c_lui.h which has same encoding. 5. Add new special access type ss_access in xlate_flags_t for checking special read/write permission in SS(Shadow Stack) page. 6. Add new ss_load/ss_store/ssamoswap to enable ss_access flag. 7. Check special pte(xwr=010) of SS page.

SuHo-llrr · 2024-04-28T15:12:18Z

Hi @aswaterman,
excuse me, do you know how to proceed with this PR? it’s block with a changed request, but I couldn't get approved.

Feedback has been addressed

aswaterman · 2024-05-02T00:14:57Z

@SuHo-llrr I just noticed that you manually modified encoding.h. In the future, please do not do that: it is an auto-generated file (whose source is https://github.com/riscv/riscv-opcodes). No need to take any immediate action, though; I will fix it up.

SuHo-llrr · 2024-05-02T02:24:43Z

@aswaterman
Thank you for correcting my mistake of forgetting to update the riscv-opcodes.

aswaterman · 2024-05-02T04:39:02Z

No problem at all: we should have caught this during review. And no harm was done. Thank you!