Merge #1

1: Initial design of Morello compartments library r=ltratt a=0152la



Co-authored-by: Andrei Lascu <[email protected]>

.buildbot.sh

@@ -0,0 +1,40 @@
+#!/bin/bash
+
+set -e
+
+build_dir="$(pwd)/build"
+src_dir="$(pwd)"
+cheri_dir="/home/buildbot/cheri/output"
+
+# Build project locally
+export CC=$cheri_dir/morello-sdk/bin/clang
+export CFLAGS="--config cheribsd-morello-hybrid.cfg"
+export ASMFLAGS="--config cheribsd-morello-hybrid.cfg"
+
+cmake \
+        -G Ninja \
+        -DCMAKE_BUILD_TYPE=DEBUG \
+        -DLLVM_DIR=$cheri_dir/morello-sdk/lib/cmake/llvm \
+        -DClang_DIR=$cheri_dir/morello-sdk/lib/cmake/clang \
+        -B $build_dir \
+        -S $src_dir
+cmake --build $build_dir
+
+# Set arguments for Morello hybrid instance
+export SSHPORT=10086
+export PYTHONPATH="/home/buildbot/build/test-scripts"
+
+args=(
+    --architecture morello-hybrid
+    # Qemu System to use
+    --qemu-cmd $cheri_dir/morello-sdk/bin/qemu-system-morello
+    --bios edk2-aarch64-code.fd
+    --disk-image $cheri_dir/cheribsd-morello-hybrid.img
+    # Required build-dir in CheriBSD
+    --build-dir .
+    --ssh-port $SSHPORT
+    --ssh-key $HOME/.ssh/id_ed25519.pub
+    )
+
+# Spawn CHERI QEMU instance, then execute `ctest`
+python3 $src_dir/.run_cheri_qemu_and_test.py "${args[@]}"

.gitignore

@@ -0,0 +1,6 @@
+build/
+
+**/*.swp
+
+build.sh
+up.sh

.run_cheri_qemu_and_test.py

@@ -0,0 +1,34 @@
+#!/usr/bin/env python3
+
+# Adapted from
+# https://github.com/capablevms/cheri-examples/blob/master/tests/run_cheri_examples.py
+
+import argparse
+import importlib.util
+import os
+import subprocess
+import sys
+
+from pathlib import Path
+
+# Emulate `sys.path` from path of module `run_tests_common` (found via
+# environment variable `PYTHONPATH`), as required by the CHERI testing
+# infrastructure which we are using to simplify booting a QEMU instance
+test_scripts_dir = str(Path(importlib.util.find_spec("run_tests_common").origin).parent.absolute())
+sys.path = sys.path[sys.path.index(test_scripts_dir):]
+
+from run_tests_common import boot_cheribsd, run_tests_main
+
+def run_tests(qemu: boot_cheribsd.QemuCheriBSDInstance, args: argparse.Namespace) -> bool:
+    if args.sysroot_dir is not None:
+        boot_cheribsd.set_ld_library_path_with_sysroot(qemu)
+    boot_cheribsd.info("Running tests for cheri-morello-compartmentalisation")
+
+    # Run command on host to test the executed client
+    os.chdir(f"{args.build_dir}/build")
+    subprocess.run(["/usr/bin/ctest", "-V"], check=True)
+    return True
+
+if __name__ == '__main__':
+    # This call has the side-effect of booting a QEMU instance
+    run_tests_main(test_function=run_tests, need_ssh=True, should_mount_builddir=False)

CMakeLists.txt

@@ -0,0 +1,24 @@
+cmake_minimum_required(VERSION 3.16)
+project(CheriMorelloCompartments LANGUAGES C ASM)
+
+set(INCLUDE_DIR ${CMAKE_SOURCE_DIR}/include)
+set(SRC_DIR ${CMAKE_SOURCE_DIR}/src)
+set(TEST_DIR ${CMAKE_SOURCE_DIR}/tests)
+
+# Setup
+include_directories("${INCLUDE_DIR}")
+
+find_package(Clang REQUIRED)
+find_package(LLVM REQUIRED CONFIG)
+
+# Building
+add_subdirectory(${SRC_DIR})
+
+# Testing
+if (CMAKE_PROJECT_NAME STREQUAL PROJECT_NAME)
+    include(CTest)
+endif()
+
+if (CMAKE_PROJECT_NAME STREQUAL PROJECT_NAME AND BUILD_TESTING)
+    add_subdirectory(${TEST_DIR})
+endif()

COPYRIGHT

@@ -0,0 +1,17 @@
+Except as otherwise noted (below and/or in individual files), this project is
+licensed under the Apache License, Version 2.0 <LICENSE-APACHE>
+<http://www.apache.org/licenses/LICENSE-2.0> or the MIT license <LICENSE-MIT>
+<http://opensource.org/licenses/MIT>, at your option.
+
+Copyright is retained by contributors and/or the organisations they
+represent(ed) -- this project does not require copyright assignment. Please see
+version control history for a full list of contributors. Note that some files
+may include explicit copyright and/or licensing notices.
+
+The following contributors wish to explicitly make it known that the copyright
+of their contributions is retained by an organisation:
+
+    Jacob Bramley <[email protected]>:
+      copyright retained by Arm Limited
+    Laurence Tratt <[email protected]>:
+      copyright retained by King's College London

LICENSE-APACHE

@@ -0,0 +1,10 @@
+Licensed under the Apache License, Version 2.0 (the "License"); you may not use
+this file except in compliance with the License.  You may obtain a copy of the
+License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software distributed
+under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR
+CONDITIONS OF ANY KIND, either express or implied.  See the License for the
+specific language governing permissions and limitations under the License.

LICENSE-MIT

@@ -0,0 +1,17 @@
+Permission is hereby granted, free of charge, to any person obtaining a copy of
+this software and associated documentation files (the "Software"), to deal in
+the Software without restriction, including without limitation the rights to
+use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies
+of the Software, and to permit persons to whom the Software is furnished to do
+so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

bors.toml

@@ -0,0 +1,10 @@
+# Sourced from
+# https://github.com/capablevms/cheri-examples/blob/master/bors.toml
+status = ["buildbot/capablevms-test-script"]
+
+timeout_sec = 600 # 10 minutes
+
+# Have bors delete auto-merged branches
+delete_merged_branches = true
+
+cut_body_after = ""

include/comps_offsets.h

@@ -0,0 +1,6 @@
+#define COMP_SIZE 48
+#define COMP_OFFSET_DDC 0
+#define COMP_OFFSET_PCC 16
+#define COMP_OFFSET_STK_ADDR 32
+
+#define MAX_COMP_COUNT 2

src/CMakeLists.txt

@@ -0,0 +1,4 @@
+add_library(morello-compartments STATIC
+    ${SRC_DIR}/manager.S
+    ${SRC_DIR}/switcher.S
+    )

src/manager.S

@@ -0,0 +1,131 @@
+.data
+
+comps_cnt:     .dword 0
+comps_addr:    .dword 0
+switcher_caps: .dword 0
+
+.text
+.balign 4
+
+#include "comps_offsets.h"
+
+// Variables
+.global comps_cnt
+.global comps_addr
+.global switcher_caps
+
+// Functions
+.global init_compartments
+.global add_compartment
+.global del_compartment
+
+/**
+ * Sets up memory for compartments
+ *
+ * Initializes required memory for compartments. This involves allocating a
+ * memory region for use by switcher code, to contain required capabilities,
+ * and deriving appropriate PCC/DDC values containing the executable switcher
+ * code, and the aforementioned memory region, respectively.
+ *
+ * @return Pointer to newly allocated memory region
+ */
+.type init_compartments, "function"
+init_compartments:
+    // Compute size of required memory, equivalent to `length` parameter of
+    // `mmap`
+    mov       x1, #(32 + (COMP_SIZE * MAX_COMP_COUNT))
+
+    // Store length and `lr` on stack, as we'll need them later
+    stp       x1, lr, [sp, #-16]!
+
+    // Allocate memory for switcher
+    mov       x0, xzr    // address
+                         // length - already stored in `x1`
+    mov       w2, #3     // prot == PROT_READ | PROT_WRITE
+    mov       w3, #4098  // flags == MAP_PRIVATE | MAP_ANONYMOUS
+    mov       w4, #-1    // fd
+    mov       w5, wzr    // offset
+    bl        mmap
+
+    // Restore length and `lr`
+    ldp       x1, lr, [sp], #16
+
+    // Save pointer to new allocated memory in `switcher_caps`
+    adr       x2, switcher_caps
+    str       x0, [x2]
+
+    // Derive DDC for switcher
+    cvtp      c2, x0
+    scbnds    c2, c2, x1
+
+    // Derive PCC for `switch_compartments` and friends
+    adr       x3, switcher_entry
+    adr       x4, switch_compartment_end
+    sub       x4, x4, x3
+    cvtp      c3, x3
+    scbndse   c3, c3, x4
+
+    // Store (DDC, PCC) at `switcher_caps` (saved in `x0`)
+    mov       x1, x0
+    stp       c2, c3, [x1], #32
+
+    // Save start address for compartment capabilities in `comps_addr`
+    adr       x2, comps_addr
+    str       x1, [x2]
+
+    ret
+
+/**
+ * Function to add information for a compartment
+ *
+ * @param x0 Compartment memory size
+ * @param x1 Compartment executable function
+ *
+ * @return Pointer to newly allocated memory region
+ */
+.type add_compartment, "function"
+add_compartment:
+    // Store inputs and `lr` so we can call `mmap`
+    stp       x0, x1, [sp, #-32]!
+    str       lr, [sp, #16]
+    mov       x1, x0
+
+    // Allocate memory for new compartment
+    mov       x0, xzr    // address
+                         // length - already stored in `x1`
+    mov       w2, #3     // prot == PROT_READ | PROT_WRITE
+    mov       w3, #4098  // flags == MAP_PRIVATE | MAP_ANONYMOUS
+    mov       w4, #-1    // fd
+    mov       w5, wzr    // offset
+    bl        mmap
+
+    // Restore memory size and function address
+    ldp       x1, x2, [sp], #32
+    ldr       lr, [sp, #-16]
+
+    // Derive compartment DDC
+    cvtp      c0, x0
+    scbnds    c0, c0, x1
+
+    // Derive compartment PCC
+    cvtp      c1, x2
+    mov       x2, #320 // TODO dynamic value
+    scbndse   c1, c1, x2
+
+    // Store new PCC and DDC
+    ldr       x2, comps_addr
+    ldr       x3, comps_cnt
+    mov       x4, #COMP_SIZE
+    madd      x2, x3, x4, x2
+    stp       c0, c1, [x2]
+
+    // Increment counter
+    adr       x4, comps_cnt
+    add       x3, x3, #1
+    str       x3, [x4]
+
+    // Check we have not exceeded max number of compartments
+    cmp       x3, #MAX_COMP_COUNT
+    b.gt      abort
+
+    ret