On 10/30/20 3:25 PM, Andrew Waterman wrote:
Yes, I overstated a bit. But embedded address maps vary quite a bit more than Linux address maps.
On Fri, Oct 30, 2020 at 2:46 PM Bill Huffman <huffman@...
On 10/30/20 2:32 PM, Andrew Waterman wrote:
On Fri, Oct 30, 2020 at 8:19 AM Xinhaoqu (Freddie) <xinhaoqu@...
I’m not sure the sstatus.SUM bit is providing the equivalent of LDTR/STTR. The pair of load/store instructions lower their privilege level so that if they
end up access privileged locations, they will fault. On the other hand, when status.SUM==1, even if the page is marked as “User”, supervisor code can still access it.
From section 220.127.116.11 in the Privileged ISA spec:
The SUM (permit Supervisor User Memory access) bit modifies the privilege with which S-mode
loads and stores access virtual memory. When SUM=0, S-mode memory accesses to pages that are
accessible by U-mode (U=1 in Figure 4.17) will fault. When SUM=1, these accesses are permitted.
SUM has no effect when page-based virtual memory is not in effect. Note that, while SUM is
ordinarily ignored when not executing in S-mode, it is in effect when MPRV=1 and MPP=S. SUM
is hardwired to 0 if S-mode is not supported.
There is nothing mentioning what would happen if load/store instructions in S-mode attempt locations that require privilege. That means to me they are permitted
when sstatus.SUM==1. This behaviour is fine in itself, but doesn’t match what the LDTR/STTR instructions do. I think sstatus.SUM’s equivalent is PSTATE.PAN, not LDTR/STTR. In other words, LDTR/STTR has no equivalent in RISC-V, AFAIK.
Right. SUM can be used to solve the same problem as LDTR/STTR, but it is not equivalent. To avoid the concern you describe, the Linux kernel first performs a bounds check to guarantee the address is in the user process' VA range. Then, it engages SUM
and performs the unprivileged access.
That's, of course, a very Linux centric answer. With more general address maps - or a "bare MMU" - the problem is harder to solve. Do you have an expectation for that case?
It's not especially Linux-centric; it's more conventional-OS-with-paging-centric.
mstatus.MPRV handles the situation adequately for PMP-based protection in M/U systems.
S-mode with general address maps is not adequately addressed here, but at least at the moment, that strikes me as a bit too hypothetical of a problem. If we did need to solve it, an S-mode MPRV feature would also suffice.
I have wondered whether we'd want a state bit, maybe in the security register, that said sstatus.sum meant data accesses were made as user rather than as either user or supervisor.
Or maybe the HLV*/HSV* instructions might be used more broadly for privilege control, not only with hypervisors.
On Behalf Of Andrew Waterman
Sent: Friday, October 30, 2020 9:50 AM
To: Andrea Mondelli <andrea.mondelli@...>
Subject: Re: [RISC-V] [tech-privileged] Access unprivileged regions from OS
quoting the arm manual, "sometimes the OS does need to access unprivileged regions, for example, to write to a buffer owned by an application. To support this, the instruction set provides the LDTR and STTR instructions."
According to the Volume II: RISC-V Privileged Architectures Chapter 7, In RISCV we don't have any similar privileged instruction to do it.
There is an alternative way to have the same behavior? I was thinking other examples like checking user parameters when syscall are called.
Yeah. Set the sstatus.SUM bit, then use regular load and store instructions to access user memory, then clear sstatus.SUM.
thanks in advance