Skip to content

Commit c1be633

Browse files
nwfnwf
committed
Shared objects might want LoadGlobal permission
1 parent 9f70a79 commit c1be633

File tree

9 files changed

+162
-88
lines changed

9 files changed

+162
-88
lines changed

‎sdk/core/allocator/alloc.h‎

Lines changed: 10 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1025,7 +1025,8 @@ class MState
10251025
*/
10261026
[[nodiscard]] __always_inline auto hazard_list_begin()
10271027
{
1028-
auto *lockWord{SHARED_OBJECT(uint32_t, allocator_epoch)};
1028+
auto *lockWord{SHARED_OBJECT_WITH_DATA_PERMISSIONS(
1029+
uint32_t, allocator_epoch, true, true)};
10291030
uint32_t epoch = *lockWord >> 16;
10301031
Debug::Invariant(
10311032
(epoch & 1) == 0,
@@ -1275,9 +1276,14 @@ class MState
12751276
bool hazard_pointer_check(Capability<void> allocation)
12761277
{
12771278
// It is now safe to walk the hazard list.
1278-
Capability<void *> hazards =
1279-
const_cast<void **>(SHARED_OBJECT_WITH_PERMISSIONS(
1280-
void *, allocator_hazard_pointers, true, false, true, false));
1279+
Capability<void *> hazards = const_cast<void **>(
1280+
SHARED_OBJECT_WITH_PERMISSIONS(void *,
1281+
allocator_hazard_pointers,
1282+
true,
1283+
false,
1284+
true,
1285+
false,
1286+
false));
12811287
size_t pointers = hazards.length() / sizeof(void *);
12821288
for (size_t i = 0; i < pointers; i++)
12831289
{

‎sdk/core/allocator/main.cc‎

Lines changed: 10 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -99,9 +99,13 @@ namespace
9999
Capability m{tbase.cast<MState>()};
100100

101101
size_t hazardQuarantineSize =
102-
Capability{
103-
SHARED_OBJECT_WITH_PERMISSIONS(
104-
void *, allocator_hazard_pointers, true, false, true, false)}
102+
Capability{SHARED_OBJECT_WITH_PERMISSIONS(void *,
103+
allocator_hazard_pointers,
104+
true,
105+
false,
106+
true,
107+
false,
108+
false)}
105109
.length();
106110

107111
m.bounds() = sizeof(*m);
@@ -128,13 +132,15 @@ namespace
128132
{
129133
if (gm == nullptr)
130134
{
135+
// Access without LoadGlobal to help ensure we don't break isolation
131136
Capability heap = const_cast<void *>(
132137
MMIO_CAPABILITY_WITH_PERMISSIONS(void,
133138
heap,
134139
/*load*/ true,
135140
/*store*/ true,
136141
/*capabilities*/ true,
137-
/*loadMutable*/ true));
142+
/*loadMutable*/ true,
143+
/*loadGlobal*/ false));
138144

139145
revoker.init();
140146
gm = mstate_init(heap, heap.bounds());

‎sdk/core/loader/types.h‎

Lines changed: 15 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -875,12 +875,18 @@ namespace loader
875875
*/
876876
static constexpr size_t PermitLoadMutable = (1UL << 28);
877877

878+
/**
879+
* Bit in `sizeAndPermissions` indicating that this import has
880+
* load-global permission.
881+
*/
882+
static constexpr size_t PermitLoadGlobal = (1UL << 27);
883+
878884
/**
879885
* Mask for the used permissions.
880886
*/
881-
static constexpr size_t PermissionsMask = PermitLoad | PermitStore |
882-
PermitLoadStoreCapabilities |
883-
PermitLoadMutable;
887+
static constexpr size_t PermissionsMask =
888+
PermitLoad | PermitStore | PermitLoadStoreCapabilities |
889+
PermitLoadMutable | PermitLoadGlobal;
884890

885891
/**
886892
* Mask for the space reserved for permissions.
@@ -959,7 +965,8 @@ namespace loader
959965
Permission::Load,
960966
Permission::Store,
961967
Permission::LoadStoreCapability,
962-
Permission::LoadMutable};
968+
Permission::LoadMutable,
969+
Permission::LoadGlobal};
963970
CHERI::PermissionSet p{DefaultPermissions};
964971
if ((sizeAndPermissions & PermitLoad) == 0)
965972
{
@@ -977,6 +984,10 @@ namespace loader
977984
{
978985
p = p.without(Permission::LoadMutable);
979986
}
987+
if ((sizeAndPermissions & PermitLoadGlobal) == 0)
988+
{
989+
p = p.without(Permission::LoadGlobal);
990+
}
980991
return p;
981992
}
982993
};

‎sdk/include/compartment-macros.h‎

Lines changed: 39 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,8 @@
1717
permitLoad, \
1818
permitStore, \
1919
permitLoadStoreCapabilities, \
20-
permitLoadMutable) \
20+
permitLoadMutable, \
21+
permitLoadGlobal) \
2122
({ \
2223
type *ret; /* NOLINT(bugprone-macro-parentheses) */ \
2324
__asm(".ifndef " mangledName "\n" \
@@ -39,7 +40,8 @@
3940
: "i"(((permitLoad) ? (1 << 31) : 0) + \
4041
((permitStore) ? (1 << 30) : 0) + \
4142
((permitLoadStoreCapabilities) ? (1 << 29) : 0) + \
42-
((permitLoadMutable) ? (1 << 28) : 0))); \
43+
((permitLoadMutable) ? (1 << 28) : 0) + \
44+
((permitLoadGlobal) ? (1 << 27) : 0))); \
4345
ret; \
4446
})
4547

@@ -52,15 +54,17 @@
5254
permitLoad, \
5355
permitStore, \
5456
permitLoadStoreCapabilities, \
55-
permitLoadMutable) \
57+
permitLoadMutable, \
58+
permitLoadGlobal) \
5659
IMPORT_CAPABILITY_WITH_PERMISSIONS_HELPER(type, \
5760
name, \
5861
__export_mem_, \
5962
mangledName, \
6063
permitLoad, \
6164
permitStore, \
6265
permitLoadStoreCapabilities, \
63-
permitLoadMutable)
66+
permitLoadMutable, \
67+
permitLoadGlobal)
6468

6569
/**
6670
* Provide a capability of the type `volatile type *` referring to the MMIO
@@ -76,16 +80,19 @@
7680
permitLoad, \
7781
permitStore, \
7882
permitLoadStoreCapabilities, \
79-
permitLoadMutable) \
83+
permitLoadMutable, \
84+
permitLoadGlobal) \
8085
MMIO_CAPABILITY_WITH_PERMISSIONS_HELPER( \
8186
volatile type, /* NOLINT(bugprone-macro-parentheses) */ \
8287
name, \
8388
"__import_mem_" #name "_" #permitLoad "_" #permitStore \
84-
"_" #permitLoadStoreCapabilities "_" #permitLoadMutable, \
89+
"_" #permitLoadStoreCapabilities "_" #permitLoadMutable \
90+
"_" #permitLoadGlobal, \
8591
permitLoad, \
8692
permitStore, \
8793
permitLoadStoreCapabilities, \
88-
permitLoadMutable)
94+
permitLoadMutable, \
95+
permitLoadGlobal)
8996

9097
/**
9198
* Provide a capability of the type `volatile type *` referring to the MMIO
@@ -97,7 +104,8 @@
97104
* MMIO_CAPABILITY_WITH_PERMISSIONS.
98105
*/
99106
#define MMIO_CAPABILITY(type, name) \
100-
MMIO_CAPABILITY_WITH_PERMISSIONS(type, name, true, true, false, false)
107+
MMIO_CAPABILITY_WITH_PERMISSIONS( \
108+
type, name, true, true, false, false, false)
101109

102110
/**
103111
* Provide a capability of the type `type *` referring to the pre-shared object
@@ -113,29 +121,46 @@
113121
permitLoad, \
114122
permitStore, \
115123
permitLoadStoreCapabilities, \
116-
permitLoadMutable) \
124+
permitLoadMutable, \
125+
permitLoadGlobal) \
117126
IMPORT_CAPABILITY_WITH_PERMISSIONS_HELPER( \
118127
type, /* NOLINT(bugprone-macro-parentheses) */ \
119128
name, \
120129
__cheriot_shared_object_, \
121130
"__import_cheriot_shared_object_" #name "_" #permitLoad "_" #permitStore \
122-
"_" #permitLoadStoreCapabilities "_" #permitLoadMutable, \
131+
"_" #permitLoadStoreCapabilities "_" #permitLoadMutable \
132+
"_" #permitLoadGlobal, \
123133
permitLoad, \
124134
permitStore, \
125135
permitLoadStoreCapabilities, \
126-
permitLoadMutable)
136+
permitLoadMutable, \
137+
permitLoadGlobal)
127138

128139
/**
129140
* Provide a capability of the type `type *` referring to the pre-shared object
130141
* with `name` as its name. This macro can be used only in code (it cannot be
131142
* used to initialise a global).
132143
*
133144
* Pre-shared object capabilities produced by this macro have load, store,
134-
* load-mutable, and load/store-capability permissions. To define a reduced
135-
* set of permissions use `SHARED_OBJECT_WITH_PERMISSIONS`.
145+
* load-mutable, load-global, and load/store-capability permissions. To define
146+
* a reduced set of permissions use `SHARED_OBJECT_WITH_PERMISSIONS`.
136147
*/
137148
#define SHARED_OBJECT(type, name) \
138-
SHARED_OBJECT_WITH_PERMISSIONS(type, name, true, true, true, true)
149+
SHARED_OBJECT_WITH_PERMISSIONS(type, name, true, true, true, true, true)
150+
151+
/**
152+
* Provide a capability of the type `type *` referring to the pre-shared object
153+
* with `name` as its name. This macro can be used only in code (it cannot be
154+
* used to initialise a global).
155+
*
156+
* Pre-shared object capabilities produced by this macro have the indicated load
157+
* and store permission, but no load/store-capability permissions (and,
158+
* therefore, no load-mutable or load-global permissions).
159+
*/
160+
#define SHARED_OBJECT_WITH_DATA_PERMISSIONS( \
161+
type, name, permitLoad, permitStore) \
162+
SHARED_OBJECT_WITH_PERMISSIONS( \
163+
type, name, permitLoad, permitStore, false, false, false)
139164

140165
/**
141166
* Macro to test whether a device with a specific name exists in the board

‎sdk/lib/compartment_helpers/claim_fast.cc‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -10,9 +10,9 @@
1010
int heap_claim_ephemeral(Timeout *timeout, const void *ptr, const void *ptr2)
1111
{
1212
void **hazards = switcher_thread_hazard_slots();
13-
auto *epochCounter{const_cast<
14-
cheriot::atomic<uint32_t> *>(SHARED_OBJECT_WITH_PERMISSIONS(
15-
cheriot::atomic<uint32_t>, allocator_epoch, true, false, false, false))};
13+
auto *epochCounter{const_cast<cheriot::atomic<uint32_t> *>(
14+
SHARED_OBJECT_WITH_DATA_PERMISSIONS(
15+
cheriot::atomic<uint32_t>, allocator_epoch, true, false))};
1616
uint32_t epoch = epochCounter->load();
1717
int values = 2;
1818
// Skip processing pointers that don't refer to heap memory.

‎tests.extra/regress-double_ref_shared/top1.cc‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,8 +2,7 @@
22

33
void top1()
44
{
5-
auto ref1 =
6-
SHARED_OBJECT_WITH_PERMISSIONS(struct Foo, foo, true, true, false, false);
5+
auto ref1 = SHARED_OBJECT_WITH_DATA_PERMISSIONS(Foo, foo, true, true);
76

87
ref1->bar = 1;
98
}

‎tests.extra/regress-double_ref_shared/top2.cc‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -6,8 +6,7 @@ using Debug = ConditionalDebug<true, "top2">;
66

77
void top2()
88
{
9-
auto ref2 = SHARED_OBJECT_WITH_PERMISSIONS(
10-
struct Foo, foo, true, false, false, false);
9+
auto ref2 = SHARED_OBJECT_WITH_DATA_PERMISSIONS(Foo, foo, true, false);
1110

1211
Debug::log("ref2: {}", ref2->bar);
1312
}

‎tests/misc-test.cc‎

Lines changed: 12 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -381,22 +381,30 @@ int test_misc()
381381
Permission::Load,
382382
Permission::Store,
383383
Permission::LoadStoreCapability,
384-
Permission::LoadMutable});
384+
Permission::LoadMutable,
385+
Permission::LoadGlobal});
385386
check_shared_object(
386387
"exampleK",
387-
SHARED_OBJECT_WITH_PERMISSIONS(void, exampleK, true, true, false, false),
388+
SHARED_OBJECT_WITH_PERMISSIONS(
389+
void, exampleK, true, true, false, false, false),
388390
1024,
389391
{Permission::Global, Permission::Load, Permission::Store});
390392
check_shared_object(
391393
"test_word",
392-
SHARED_OBJECT_WITH_PERMISSIONS(void, test_word, true, false, true, false),
394+
SHARED_OBJECT_WITH_PERMISSIONS(
395+
void, test_word, true, false, true, false, false),
393396
4,
394397
{Permission::Global, Permission::Load, Permission::LoadStoreCapability});
395398
check_shared_object("test_word",
396399
SHARED_OBJECT_WITH_PERMISSIONS(
397-
void, test_word, true, false, false, false),
400+
void, test_word, true, false, false, false, false),
398401
4,
399402
{Permission::Global, Permission::Load});
403+
check_shared_object(
404+
"test_word data",
405+
SHARED_OBJECT_WITH_DATA_PERMISSIONS(void, test_word, true, false),
406+
4,
407+
{Permission::Global, Permission::Load});
400408
check_odd_memcmp();
401409
TEST_EQUAL(strnlen(*volatileString, 3),
402410
3,

0 commit comments

Comments
 (0)