279 lines
9.5 KiB
Plaintext
279 lines
9.5 KiB
Plaintext
Application Data Integrity (ADI)
|
|
================================
|
|
|
|
SPARC M7 processor adds the Application Data Integrity (ADI) feature.
|
|
ADI allows a task to set version tags on any subset of its address
|
|
space. Once ADI is enabled and version tags are set for ranges of
|
|
address space of a task, the processor will compare the tag in pointers
|
|
to memory in these ranges to the version set by the application
|
|
previously. Access to memory is granted only if the tag in given pointer
|
|
matches the tag set by the application. In case of mismatch, processor
|
|
raises an exception.
|
|
|
|
Following steps must be taken by a task to enable ADI fully:
|
|
|
|
1. Set the user mode PSTATE.mcde bit. This acts as master switch for
|
|
the task's entire address space to enable/disable ADI for the task.
|
|
|
|
2. Set TTE.mcd bit on any TLB entries that correspond to the range of
|
|
addresses ADI is being enabled on. MMU checks the version tag only
|
|
on the pages that have TTE.mcd bit set.
|
|
|
|
3. Set the version tag for virtual addresses using stxa instruction
|
|
and one of the MCD specific ASIs. Each stxa instruction sets the
|
|
given tag for one ADI block size number of bytes. This step must
|
|
be repeated for entire page to set tags for entire page.
|
|
|
|
ADI block size for the platform is provided by the hypervisor to kernel
|
|
in machine description tables. Hypervisor also provides the number of
|
|
top bits in the virtual address that specify the version tag. Once
|
|
version tag has been set for a memory location, the tag is stored in the
|
|
physical memory and the same tag must be present in the ADI version tag
|
|
bits of the virtual address being presented to the MMU. For example on
|
|
SPARC M7 processor, MMU uses bits 63-60 for version tags and ADI block
|
|
size is same as cacheline size which is 64 bytes. A task that sets ADI
|
|
version to, say 10, on a range of memory, must access that memory using
|
|
virtual addresses that contain 0xa in bits 63-60.
|
|
|
|
ADI is enabled on a set of pages using mprotect() with PROT_ADI flag.
|
|
When ADI is enabled on a set of pages by a task for the first time,
|
|
kernel sets the PSTATE.mcde bit fot the task. Version tags for memory
|
|
addresses are set with an stxa instruction on the addresses using
|
|
ASI_MCD_PRIMARY or ASI_MCD_ST_BLKINIT_PRIMARY. ADI block size is
|
|
provided by the hypervisor to the kernel. Kernel returns the value of
|
|
ADI block size to userspace using auxiliary vector along with other ADI
|
|
info. Following auxiliary vectors are provided by the kernel:
|
|
|
|
AT_ADI_BLKSZ ADI block size. This is the granularity and
|
|
alignment, in bytes, of ADI versioning.
|
|
AT_ADI_NBITS Number of ADI version bits in the VA
|
|
|
|
|
|
IMPORTANT NOTES:
|
|
|
|
- Version tag values of 0x0 and 0xf are reserved. These values match any
|
|
tag in virtual address and never generate a mismatch exception.
|
|
|
|
- Version tags are set on virtual addresses from userspace even though
|
|
tags are stored in physical memory. Tags are set on a physical page
|
|
after it has been allocated to a task and a pte has been created for
|
|
it.
|
|
|
|
- When a task frees a memory page it had set version tags on, the page
|
|
goes back to free page pool. When this page is re-allocated to a task,
|
|
kernel clears the page using block initialization ASI which clears the
|
|
version tags as well for the page. If a page allocated to a task is
|
|
freed and allocated back to the same task, old version tags set by the
|
|
task on that page will no longer be present.
|
|
|
|
- ADI tag mismatches are not detected for non-faulting loads.
|
|
|
|
- Kernel does not set any tags for user pages and it is entirely a
|
|
task's responsibility to set any version tags. Kernel does ensure the
|
|
version tags are preserved if a page is swapped out to the disk and
|
|
swapped back in. It also preserves that version tags if a page is
|
|
migrated.
|
|
|
|
- ADI works for any size pages. A userspace task need not be aware of
|
|
page size when using ADI. It can simply select a virtual address
|
|
range, enable ADI on the range using mprotect() and set version tags
|
|
for the entire range. mprotect() ensures range is aligned to page size
|
|
and is a multiple of page size.
|
|
|
|
- ADI tags can only be set on writable memory. For example, ADI tags can
|
|
not be set on read-only mappings.
|
|
|
|
|
|
|
|
ADI related traps
|
|
-----------------
|
|
|
|
With ADI enabled, following new traps may occur:
|
|
|
|
Disrupting memory corruption
|
|
|
|
When a store accesses a memory localtion that has TTE.mcd=1,
|
|
the task is running with ADI enabled (PSTATE.mcde=1), and the ADI
|
|
tag in the address used (bits 63:60) does not match the tag set on
|
|
the corresponding cacheline, a memory corruption trap occurs. By
|
|
default, it is a disrupting trap and is sent to the hypervisor
|
|
first. Hypervisor creates a sun4v error report and sends a
|
|
resumable error (TT=0x7e) trap to the kernel. The kernel sends
|
|
a SIGSEGV to the task that resulted in this trap with the following
|
|
info:
|
|
|
|
siginfo.si_signo = SIGSEGV;
|
|
siginfo.errno = 0;
|
|
siginfo.si_code = SEGV_ADIDERR;
|
|
siginfo.si_addr = addr; /* PC where first mismatch occurred */
|
|
siginfo.si_trapno = 0;
|
|
|
|
|
|
Precise memory corruption
|
|
|
|
When a store accesses a memory location that has TTE.mcd=1,
|
|
the task is running with ADI enabled (PSTATE.mcde=1), and the ADI
|
|
tag in the address used (bits 63:60) does not match the tag set on
|
|
the corresponding cacheline, a memory corruption trap occurs. If
|
|
MCD precise exception is enabled (MCDPERR=1), a precise
|
|
exception is sent to the kernel with TT=0x1a. The kernel sends
|
|
a SIGSEGV to the task that resulted in this trap with the following
|
|
info:
|
|
|
|
siginfo.si_signo = SIGSEGV;
|
|
siginfo.errno = 0;
|
|
siginfo.si_code = SEGV_ADIPERR;
|
|
siginfo.si_addr = addr; /* address that caused trap */
|
|
siginfo.si_trapno = 0;
|
|
|
|
NOTE: ADI tag mismatch on a load always results in precise trap.
|
|
|
|
|
|
MCD disabled
|
|
|
|
When a task has not enabled ADI and attempts to set ADI version
|
|
on a memory address, processor sends an MCD disabled trap. This
|
|
trap is handled by hypervisor first and the hypervisor vectors this
|
|
trap through to the kernel as Data Access Exception trap with
|
|
fault type set to 0xa (invalid ASI). When this occurs, the kernel
|
|
sends the task SIGSEGV signal with following info:
|
|
|
|
siginfo.si_signo = SIGSEGV;
|
|
siginfo.errno = 0;
|
|
siginfo.si_code = SEGV_ACCADI;
|
|
siginfo.si_addr = addr; /* address that caused trap */
|
|
siginfo.si_trapno = 0;
|
|
|
|
|
|
Sample program to use ADI
|
|
-------------------------
|
|
|
|
Following sample program is meant to illustrate how to use the ADI
|
|
functionality.
|
|
|
|
#include <unistd.h>
|
|
#include <stdio.h>
|
|
#include <stdlib.h>
|
|
#include <elf.h>
|
|
#include <sys/ipc.h>
|
|
#include <sys/shm.h>
|
|
#include <sys/mman.h>
|
|
#include <asm/asi.h>
|
|
|
|
#ifndef AT_ADI_BLKSZ
|
|
#define AT_ADI_BLKSZ 48
|
|
#endif
|
|
#ifndef AT_ADI_NBITS
|
|
#define AT_ADI_NBITS 49
|
|
#endif
|
|
|
|
#ifndef PROT_ADI
|
|
#define PROT_ADI 0x10
|
|
#endif
|
|
|
|
#define BUFFER_SIZE 32*1024*1024UL
|
|
|
|
main(int argc, char* argv[], char* envp[])
|
|
{
|
|
unsigned long i, mcde, adi_blksz, adi_nbits;
|
|
char *shmaddr, *tmp_addr, *end, *veraddr, *clraddr;
|
|
int shmid, version;
|
|
Elf64_auxv_t *auxv;
|
|
|
|
adi_blksz = 0;
|
|
|
|
while(*envp++ != NULL);
|
|
for (auxv = (Elf64_auxv_t *)envp; auxv->a_type != AT_NULL; auxv++) {
|
|
switch (auxv->a_type) {
|
|
case AT_ADI_BLKSZ:
|
|
adi_blksz = auxv->a_un.a_val;
|
|
break;
|
|
case AT_ADI_NBITS:
|
|
adi_nbits = auxv->a_un.a_val;
|
|
break;
|
|
}
|
|
}
|
|
if (adi_blksz == 0) {
|
|
fprintf(stderr, "Oops! ADI is not supported\n");
|
|
exit(1);
|
|
}
|
|
|
|
printf("ADI capabilities:\n");
|
|
printf("\tBlock size = %ld\n", adi_blksz);
|
|
printf("\tNumber of bits = %ld\n", adi_nbits);
|
|
|
|
if ((shmid = shmget(2, BUFFER_SIZE,
|
|
IPC_CREAT | SHM_R | SHM_W)) < 0) {
|
|
perror("shmget failed");
|
|
exit(1);
|
|
}
|
|
|
|
shmaddr = shmat(shmid, NULL, 0);
|
|
if (shmaddr == (char *)-1) {
|
|
perror("shm attach failed");
|
|
shmctl(shmid, IPC_RMID, NULL);
|
|
exit(1);
|
|
}
|
|
|
|
if (mprotect(shmaddr, BUFFER_SIZE, PROT_READ|PROT_WRITE|PROT_ADI)) {
|
|
perror("mprotect failed");
|
|
goto err_out;
|
|
}
|
|
|
|
/* Set the ADI version tag on the shm segment
|
|
*/
|
|
version = 10;
|
|
tmp_addr = shmaddr;
|
|
end = shmaddr + BUFFER_SIZE;
|
|
while (tmp_addr < end) {
|
|
asm volatile(
|
|
"stxa %1, [%0]0x90\n\t"
|
|
:
|
|
: "r" (tmp_addr), "r" (version));
|
|
tmp_addr += adi_blksz;
|
|
}
|
|
asm volatile("membar #Sync\n\t");
|
|
|
|
/* Create a versioned address from the normal address by placing
|
|
* version tag in the upper adi_nbits bits
|
|
*/
|
|
tmp_addr = (void *) ((unsigned long)shmaddr << adi_nbits);
|
|
tmp_addr = (void *) ((unsigned long)tmp_addr >> adi_nbits);
|
|
veraddr = (void *) (((unsigned long)version << (64-adi_nbits))
|
|
| (unsigned long)tmp_addr);
|
|
|
|
printf("Starting the writes:\n");
|
|
for (i = 0; i < BUFFER_SIZE; i++) {
|
|
veraddr[i] = (char)(i);
|
|
if (!(i % (1024 * 1024)))
|
|
printf(".");
|
|
}
|
|
printf("\n");
|
|
|
|
printf("Verifying data...");
|
|
fflush(stdout);
|
|
for (i = 0; i < BUFFER_SIZE; i++)
|
|
if (veraddr[i] != (char)i)
|
|
printf("\nIndex %lu mismatched\n", i);
|
|
printf("Done.\n");
|
|
|
|
/* Disable ADI and clean up
|
|
*/
|
|
if (mprotect(shmaddr, BUFFER_SIZE, PROT_READ|PROT_WRITE)) {
|
|
perror("mprotect failed");
|
|
goto err_out;
|
|
}
|
|
|
|
if (shmdt((const void *)shmaddr) != 0)
|
|
perror("Detach failure");
|
|
shmctl(shmid, IPC_RMID, NULL);
|
|
|
|
exit(0);
|
|
|
|
err_out:
|
|
if (shmdt((const void *)shmaddr) != 0)
|
|
perror("Detach failure");
|
|
shmctl(shmid, IPC_RMID, NULL);
|
|
exit(1);
|
|
}
|