[PATCH v16 00/20] riscv support for control flow integrity extensions

Deepak Gupta posted 20 patches 1 month ago
disas/riscv.c                                 |  77 +++++++-
disas/riscv.h                                 |   4 +
target/riscv/cpu.c                            |  14 ++
target/riscv/cpu.h                            |  31 ++-
target/riscv/cpu_bits.h                       |  17 ++
target/riscv/cpu_cfg.h                        |   2 +
target/riscv/cpu_helper.c                     | 184 ++++++++++++++++--
target/riscv/cpu_user.h                       |   1 +
target/riscv/csr.c                            |  84 ++++++++
target/riscv/insn16.decode                    |   4 +
target/riscv/insn32.decode                    |  26 ++-
.../riscv/insn_trans/trans_privileged.c.inc   |   8 +-
target/riscv/insn_trans/trans_rva.c.inc       |   4 +-
target/riscv/insn_trans/trans_rvd.c.inc       |   4 +-
target/riscv/insn_trans/trans_rvf.c.inc       |   4 +-
target/riscv/insn_trans/trans_rvh.c.inc       |   8 +-
target/riscv/insn_trans/trans_rvi.c.inc       |  61 +++++-
target/riscv/insn_trans/trans_rvvk.c.inc      |  10 +-
target/riscv/insn_trans/trans_rvzacas.c.inc   |   4 +-
target/riscv/insn_trans/trans_rvzfh.c.inc     |   4 +-
target/riscv/insn_trans/trans_rvzicfiss.c.inc | 114 +++++++++++
target/riscv/insn_trans/trans_svinval.c.inc   |   6 +-
target/riscv/internals.h                      |   3 +
target/riscv/machine.c                        |  38 ++++
target/riscv/op_helper.c                      |  17 ++
target/riscv/pmp.c                            |   5 +
target/riscv/pmp.h                            |   3 +-
target/riscv/tcg/tcg-cpu.c                    |  29 +++
target/riscv/translate.c                      |  44 ++++-
29 files changed, 749 insertions(+), 61 deletions(-)
create mode 100644 target/riscv/insn_trans/trans_rvzicfiss.c.inc
[PATCH v16 00/20] riscv support for control flow integrity extensions
Posted by Deepak Gupta 1 month ago
v16 for riscv zicfilp and zicfiss extensions support in qemu.

Following change in this version:
cache block operations of clean, flush and inval have store semantics.
These operations on shadow stack must look like regular stores and must
always raise store/AMO access fault. However with current logic,
`probe_access_flags` will succeed because it will be seen as a load.
In order to prevent that `get_physical_address` must receive `probe`
parameter. Depending on that parameter, `get_physical_address` can return
TRANSLATE_PMP_FAIL.

In v15, this was created as a new commit so that we could review and discuss
it out. In this version, I've squashed it with "mmu changes for zicfiss shadow
stack protection".

zicfilp and zicfiss spec pdf
----------------------------
https://github.com/riscv/riscv-cfi/releases/download/v1.0/riscv-cfi.pdf

github sources to spec
https://github.com/riscv/riscv-cfi


Links for previous versions
[1] - v1 https://lists.nongnu.org/archive/html/qemu-devel/2024-07/msg06017.html
[2] - v2 https://lore.kernel.org/all/ed23bcbc-fdc4-4492-803c-daa95880375a@linaro.org/T/
[3] - v3 https://lists.nongnu.org/archive/html/qemu-devel/2024-08/msg01005.html
[4] - v4 https://lore.kernel.org/all/20240816010711.3055425-6-debug@rivosinc.com/T/
[5] - v5
+https://lore.kernel.org/all/20240820000129.3522346-1-debug@rivosinc.com/T/#m7b9cc847e739ec86f9569a3ca9f3d9377b01e21
[6] - v6 https://mail.gnu.org/archive/html/qemu-riscv/2024-08/msg00418.html
[7] - v7 https://lore.kernel.org/all/20240822082504.3979610-1-debug@rivosinc.com/
[8] - v8 https://lore.kernel.org/all/20240823190140.4156920-1-debug@rivosinc.com/T/
[9] - v9 https://lore.kernel.org/all/20240826152949.294506-1-debug@rivosinc.com/
[10]- v10 https://lore.kernel.org/all/20240827231906.553327-1-debug@rivosinc.com/
[11]- v11 https://lore.kernel.org/all/20240828174739.714313-1-debug@rivosinc.com/
[12]- v12 https://lore.kernel.org/all/20240829233425.1005029-1-debug@rivosinc.com/
[13]- v14 https://lore.kernel.org/all/20240912235320.3768582-1-debug@rivosinc.com/
[14]- v15 https://lore.kernel.org/all/20241003183342.679249-1-debug@rivosinc.com/

---
v16:
   - Squashed changes with respect to "disallow probe access" to shadow stack
     from cbo.clean/flush/inval flows with "shadow stack mmu" changes 
v15:
   - Extended `get_physical_address` to take `probe` parameter. This is to ensure
     that cbo.clean/flush/inval accesses to shadow stack always lead to store/AMO
     access fault

v14:
   - Rebased on https://github.com/alistair23/qemu/blob/riscv-to-apply.next
v13:
   - Fixed bug(s) reported by richard that
         - shadow stack doesn't exist in M-mode
         - shadow stack is not available in M + U only config
   - updated commit messages with removal of `ufcfien` and `ubcfien` mentions
v12
   - Moved ssamoswap to trans_rvzicfiss.
   - Fixed bcfi_enabled in disascontext to rely only on tb flag
   - added comment on why PMP_TRANSLATE_FAIL for stores on shadow stack page

v11:
   - default *envcfg and priv for qemu-user are handled in `riscv_cpu_reset_hold`
v10:
   - Exposed *envcfg CSR and priv to qemu-user as well and removed special
     state management for *envcfg related feature enabling for qemu-user
   - Exposing zicfilp and zicfiss as different patch
v9:
   - fix switch case fallthrough for sw_check excp in patch 4
v8:
   - fixed up `gen_cmpxchg` to store extra word2 during compile to raise storeAMO always
v7:
   - Updated decode_save_opc to take extra argument of excp_uw2 and
     updated callsites
   - added a helper for promoting load faults to store faults
   - Removed stale comments and edited existed comments
v6:
   - Added support extra store word 2 for tcg compile and extraction during unwind
   - Using extra word, AMO instructions and shadow stack instructions can raise store fault
   - some alignment and cosmetic changes
   - added vmstate migration support for elp and ssp cpu state
v5:
   - Simplified elp tracking and lpad implementation as per suggestion by richard
   - Simplified shadow stack mmu checks as per suggestion by richard
   - Converged zicfiss compressed and non-comressed instructions to same translation
   - Removed trace hooks. Don't need for upstream.

v4:
   - elp state in cpu is true/false instead of enum and elp cleared
     unconditionally on trap entry. elp in *status cleared unconditionally on
     trap return.
   - Moved logic for branch tracking in instruction translation from tb_start.
   - fixed zicfiss dependency on 'A'
   - `cpu_get_fcfien/bcfien` helpers checks fixed to check for extension first.
   - removed trace hook enums. Instead added dedicated trace helpers wherever needed.
   - fixed/simplified instruction format in decoder for lpad, sspush, sspopchk
   - simplified tlb index logic for shadow stack instructions. Removed SUM TB_FLAG
   - access to ssp CSR is gated on `cpu_get_bcfien` instead of duplicated logic
   - removed vDSO related changes for now.
v3:
   - Removed prctl specific patches because they need to be upstream
     in kernel first.
   - As suggested by Richard, added TB flag if fcfi enabled
   - Re-worked translation for landing pad and shadow stack instructions
     to not require helper.
   - tcg helpers only for cfi violation cases so that trace hooks can be
     placed.
   - Style changes.
   - fixes assert condition in accel/tcg

v2:
   - added missed file (in v1) for shadow stack instructions implementation.

Deepak Gupta (20):
  target/riscv: expose *envcfg csr and priv to qemu-user as well
  target/riscv: Add zicfilp extension
  target/riscv: Introduce elp state and enabling controls for zicfilp
  target/riscv: save and restore elp state on priv transitions
  target/riscv: additional code information for sw check
  target/riscv: tracking indirect branches (fcfi) for zicfilp
  target/riscv: zicfilp `lpad` impl and branch tracking
  disas/riscv: enable `lpad` disassembly
  target/riscv: Expose zicfilp extension as a cpu property
  target/riscv: Add zicfiss extension
  target/riscv: introduce ssp and enabling controls for zicfiss
  target/riscv: tb flag for shadow stack  instructions
  target/riscv: mmu changes for zicfiss shadow stack protection
  target/riscv: AMO operations always raise store/AMO fault
  target/riscv: update `decode_save_opc` to store extra word2
  target/riscv: implement zicfiss instructions
  target/riscv: compressed encodings for sspush and sspopchk
  disas/riscv: enable disassembly for zicfiss instructions
  disas/riscv: enable disassembly for compressed sspush/sspopchk
  target/riscv: Expose zicfiss extension as a cpu property

 disas/riscv.c                                 |  77 +++++++-
 disas/riscv.h                                 |   4 +
 target/riscv/cpu.c                            |  14 ++
 target/riscv/cpu.h                            |  31 ++-
 target/riscv/cpu_bits.h                       |  17 ++
 target/riscv/cpu_cfg.h                        |   2 +
 target/riscv/cpu_helper.c                     | 184 ++++++++++++++++--
 target/riscv/cpu_user.h                       |   1 +
 target/riscv/csr.c                            |  84 ++++++++
 target/riscv/insn16.decode                    |   4 +
 target/riscv/insn32.decode                    |  26 ++-
 .../riscv/insn_trans/trans_privileged.c.inc   |   8 +-
 target/riscv/insn_trans/trans_rva.c.inc       |   4 +-
 target/riscv/insn_trans/trans_rvd.c.inc       |   4 +-
 target/riscv/insn_trans/trans_rvf.c.inc       |   4 +-
 target/riscv/insn_trans/trans_rvh.c.inc       |   8 +-
 target/riscv/insn_trans/trans_rvi.c.inc       |  61 +++++-
 target/riscv/insn_trans/trans_rvvk.c.inc      |  10 +-
 target/riscv/insn_trans/trans_rvzacas.c.inc   |   4 +-
 target/riscv/insn_trans/trans_rvzfh.c.inc     |   4 +-
 target/riscv/insn_trans/trans_rvzicfiss.c.inc | 114 +++++++++++
 target/riscv/insn_trans/trans_svinval.c.inc   |   6 +-
 target/riscv/internals.h                      |   3 +
 target/riscv/machine.c                        |  38 ++++
 target/riscv/op_helper.c                      |  17 ++
 target/riscv/pmp.c                            |   5 +
 target/riscv/pmp.h                            |   3 +-
 target/riscv/tcg/tcg-cpu.c                    |  29 +++
 target/riscv/translate.c                      |  44 ++++-
 29 files changed, 749 insertions(+), 61 deletions(-)
 create mode 100644 target/riscv/insn_trans/trans_rvzicfiss.c.inc

-- 
2.45.0
Re: [PATCH v16 00/20] riscv support for control flow integrity extensions
Posted by Alistair Francis 2 weeks ago
On Wed, Oct 9, 2024 at 8:52 AM Deepak Gupta <debug@rivosinc.com> wrote:
>
> v16 for riscv zicfilp and zicfiss extensions support in qemu.
>
> Following change in this version:
> cache block operations of clean, flush and inval have store semantics.
> These operations on shadow stack must look like regular stores and must
> always raise store/AMO access fault. However with current logic,
> `probe_access_flags` will succeed because it will be seen as a load.
> In order to prevent that `get_physical_address` must receive `probe`
> parameter. Depending on that parameter, `get_physical_address` can return
> TRANSLATE_PMP_FAIL.
>
> In v15, this was created as a new commit so that we could review and discuss
> it out. In this version, I've squashed it with "mmu changes for zicfiss shadow
> stack protection".
>
> zicfilp and zicfiss spec pdf
> ----------------------------
> https://github.com/riscv/riscv-cfi/releases/download/v1.0/riscv-cfi.pdf
>
> github sources to spec
> https://github.com/riscv/riscv-cfi

Thanks!

Applied to riscv-to-apply.next

Alistair

>
>
> Links for previous versions
> [1] - v1 https://lists.nongnu.org/archive/html/qemu-devel/2024-07/msg06017.html
> [2] - v2 https://lore.kernel.org/all/ed23bcbc-fdc4-4492-803c-daa95880375a@linaro.org/T/
> [3] - v3 https://lists.nongnu.org/archive/html/qemu-devel/2024-08/msg01005.html
> [4] - v4 https://lore.kernel.org/all/20240816010711.3055425-6-debug@rivosinc.com/T/
> [5] - v5
> +https://lore.kernel.org/all/20240820000129.3522346-1-debug@rivosinc.com/T/#m7b9cc847e739ec86f9569a3ca9f3d9377b01e21
> [6] - v6 https://mail.gnu.org/archive/html/qemu-riscv/2024-08/msg00418.html
> [7] - v7 https://lore.kernel.org/all/20240822082504.3979610-1-debug@rivosinc.com/
> [8] - v8 https://lore.kernel.org/all/20240823190140.4156920-1-debug@rivosinc.com/T/
> [9] - v9 https://lore.kernel.org/all/20240826152949.294506-1-debug@rivosinc.com/
> [10]- v10 https://lore.kernel.org/all/20240827231906.553327-1-debug@rivosinc.com/
> [11]- v11 https://lore.kernel.org/all/20240828174739.714313-1-debug@rivosinc.com/
> [12]- v12 https://lore.kernel.org/all/20240829233425.1005029-1-debug@rivosinc.com/
> [13]- v14 https://lore.kernel.org/all/20240912235320.3768582-1-debug@rivosinc.com/
> [14]- v15 https://lore.kernel.org/all/20241003183342.679249-1-debug@rivosinc.com/
>
> ---
> v16:
>    - Squashed changes with respect to "disallow probe access" to shadow stack
>      from cbo.clean/flush/inval flows with "shadow stack mmu" changes
> v15:
>    - Extended `get_physical_address` to take `probe` parameter. This is to ensure
>      that cbo.clean/flush/inval accesses to shadow stack always lead to store/AMO
>      access fault
>
> v14:
>    - Rebased on https://github.com/alistair23/qemu/blob/riscv-to-apply.next
> v13:
>    - Fixed bug(s) reported by richard that
>          - shadow stack doesn't exist in M-mode
>          - shadow stack is not available in M + U only config
>    - updated commit messages with removal of `ufcfien` and `ubcfien` mentions
> v12
>    - Moved ssamoswap to trans_rvzicfiss.
>    - Fixed bcfi_enabled in disascontext to rely only on tb flag
>    - added comment on why PMP_TRANSLATE_FAIL for stores on shadow stack page
>
> v11:
>    - default *envcfg and priv for qemu-user are handled in `riscv_cpu_reset_hold`
> v10:
>    - Exposed *envcfg CSR and priv to qemu-user as well and removed special
>      state management for *envcfg related feature enabling for qemu-user
>    - Exposing zicfilp and zicfiss as different patch
> v9:
>    - fix switch case fallthrough for sw_check excp in patch 4
> v8:
>    - fixed up `gen_cmpxchg` to store extra word2 during compile to raise storeAMO always
> v7:
>    - Updated decode_save_opc to take extra argument of excp_uw2 and
>      updated callsites
>    - added a helper for promoting load faults to store faults
>    - Removed stale comments and edited existed comments
> v6:
>    - Added support extra store word 2 for tcg compile and extraction during unwind
>    - Using extra word, AMO instructions and shadow stack instructions can raise store fault
>    - some alignment and cosmetic changes
>    - added vmstate migration support for elp and ssp cpu state
> v5:
>    - Simplified elp tracking and lpad implementation as per suggestion by richard
>    - Simplified shadow stack mmu checks as per suggestion by richard
>    - Converged zicfiss compressed and non-comressed instructions to same translation
>    - Removed trace hooks. Don't need for upstream.
>
> v4:
>    - elp state in cpu is true/false instead of enum and elp cleared
>      unconditionally on trap entry. elp in *status cleared unconditionally on
>      trap return.
>    - Moved logic for branch tracking in instruction translation from tb_start.
>    - fixed zicfiss dependency on 'A'
>    - `cpu_get_fcfien/bcfien` helpers checks fixed to check for extension first.
>    - removed trace hook enums. Instead added dedicated trace helpers wherever needed.
>    - fixed/simplified instruction format in decoder for lpad, sspush, sspopchk
>    - simplified tlb index logic for shadow stack instructions. Removed SUM TB_FLAG
>    - access to ssp CSR is gated on `cpu_get_bcfien` instead of duplicated logic
>    - removed vDSO related changes for now.
> v3:
>    - Removed prctl specific patches because they need to be upstream
>      in kernel first.
>    - As suggested by Richard, added TB flag if fcfi enabled
>    - Re-worked translation for landing pad and shadow stack instructions
>      to not require helper.
>    - tcg helpers only for cfi violation cases so that trace hooks can be
>      placed.
>    - Style changes.
>    - fixes assert condition in accel/tcg
>
> v2:
>    - added missed file (in v1) for shadow stack instructions implementation.
>
> Deepak Gupta (20):
>   target/riscv: expose *envcfg csr and priv to qemu-user as well
>   target/riscv: Add zicfilp extension
>   target/riscv: Introduce elp state and enabling controls for zicfilp
>   target/riscv: save and restore elp state on priv transitions
>   target/riscv: additional code information for sw check
>   target/riscv: tracking indirect branches (fcfi) for zicfilp
>   target/riscv: zicfilp `lpad` impl and branch tracking
>   disas/riscv: enable `lpad` disassembly
>   target/riscv: Expose zicfilp extension as a cpu property
>   target/riscv: Add zicfiss extension
>   target/riscv: introduce ssp and enabling controls for zicfiss
>   target/riscv: tb flag for shadow stack  instructions
>   target/riscv: mmu changes for zicfiss shadow stack protection
>   target/riscv: AMO operations always raise store/AMO fault
>   target/riscv: update `decode_save_opc` to store extra word2
>   target/riscv: implement zicfiss instructions
>   target/riscv: compressed encodings for sspush and sspopchk
>   disas/riscv: enable disassembly for zicfiss instructions
>   disas/riscv: enable disassembly for compressed sspush/sspopchk
>   target/riscv: Expose zicfiss extension as a cpu property
>
>  disas/riscv.c                                 |  77 +++++++-
>  disas/riscv.h                                 |   4 +
>  target/riscv/cpu.c                            |  14 ++
>  target/riscv/cpu.h                            |  31 ++-
>  target/riscv/cpu_bits.h                       |  17 ++
>  target/riscv/cpu_cfg.h                        |   2 +
>  target/riscv/cpu_helper.c                     | 184 ++++++++++++++++--
>  target/riscv/cpu_user.h                       |   1 +
>  target/riscv/csr.c                            |  84 ++++++++
>  target/riscv/insn16.decode                    |   4 +
>  target/riscv/insn32.decode                    |  26 ++-
>  .../riscv/insn_trans/trans_privileged.c.inc   |   8 +-
>  target/riscv/insn_trans/trans_rva.c.inc       |   4 +-
>  target/riscv/insn_trans/trans_rvd.c.inc       |   4 +-
>  target/riscv/insn_trans/trans_rvf.c.inc       |   4 +-
>  target/riscv/insn_trans/trans_rvh.c.inc       |   8 +-
>  target/riscv/insn_trans/trans_rvi.c.inc       |  61 +++++-
>  target/riscv/insn_trans/trans_rvvk.c.inc      |  10 +-
>  target/riscv/insn_trans/trans_rvzacas.c.inc   |   4 +-
>  target/riscv/insn_trans/trans_rvzfh.c.inc     |   4 +-
>  target/riscv/insn_trans/trans_rvzicfiss.c.inc | 114 +++++++++++
>  target/riscv/insn_trans/trans_svinval.c.inc   |   6 +-
>  target/riscv/internals.h                      |   3 +
>  target/riscv/machine.c                        |  38 ++++
>  target/riscv/op_helper.c                      |  17 ++
>  target/riscv/pmp.c                            |   5 +
>  target/riscv/pmp.h                            |   3 +-
>  target/riscv/tcg/tcg-cpu.c                    |  29 +++
>  target/riscv/translate.c                      |  44 ++++-
>  29 files changed, 749 insertions(+), 61 deletions(-)
>  create mode 100644 target/riscv/insn_trans/trans_rvzicfiss.c.inc
>
> --
> 2.45.0
>
>