Support CHERI extension

[ivmai]

The purpose of this is not only support the protected mode but also better test bdwgc.

The patches in https://github.com/capablevms/bdwgc (master) should be useful.

Related issue: #461

[ivmai]

Current status: I've done a lot of refactoring to simplify porting to CHERI, and backported some changes from https://github.com/capablevms/bdwgc/ (see c29365b). Still many CHERI-specific changes to be backported.

[ivmai]

And below is the list of code places worth attention during enabling of CHERI in master:

• headers.c: GC_prev_block: resolve TODO (in a similar way as for GC_next_block but some other changes are needed to avoid assertion violation)
• include/gc/gc.h: GC_ADDR_LT: compare addr part only?
• include/gc/gc.h: GC_HIDE_POINTER, GC_HIDE_NZ_POINTER (and the reveal ops)
• include/gc/gc_tiny_fl.h: GC_TINY_FREELISTS (is the current value OK?)
• include/private/dbg_mlc.h: GC_FREED_MEM_MARKER, START_FLAG, END_FLAG
• include/private/gcconfig.h: PTR_ALIGN_DOWN, PTR_ALIGN_UP: use cheri_align_down/up, include cheriintrin.h
• include/private/gcconfig.h: FIXUP_POINTER
• include/private/gc_priv.h: CPTR_CLEAR_FLAGS, CPTR_SET_FLAGS
• tests/gctest.c: check_heap_stats: increase max_heap_sz if CPP_PTRSZ > 64
• pointers comparison for equality: e.g. in get_block_ending_at, GC_add_to_fl (should we compare addr part only?)

[ivmai]

A number of changes are not ported yet (as of commit 7f1503d), here's a diff:

diff --git a/.buildbot.sh b/.buildbot.sh
new file mode 100755
index 00000000..7d432e28
--- /dev/null
+++ b/.buildbot.sh
+    BUILD_OPTS="-DCMAKE_BUILD_TYPE=Debug \
+                -DCMAKE_INSTALL_PREFIX=${INSTALL_DIR} \
+                -Denable_gcj_support=OFF \
+                -Denable_threads=OFF \
+                -Denable_dynamic_loading=${DYNAMIC_LIBTEST}"
diff --git a/allchblk.c b/allchblk.c
index a5a356f5..56b0c036 100644
--- a/allchblk.c
+++ b/allchblk.c
@@ -540,6 +540,11 @@ GC_INNER void GC_merge_unmapped(void)
         /* Coalesce with successor, if possible */
           if (0 != nexthdr && HBLK_IS_FREE(nexthdr)
               && (signed_word) (size + (nextsize = nexthdr->hb_sz)) > 0
+#           if defined(__CHERI_PURE_CAPABILITY__)
+              /* CVMFIXME : coalesce with super-capability */
+              && (cheri_base_get(h) <= cheri_address_get(next))
+              && (cheri_base_get(h) + cheri_length_get(h)) >= (cheri_address_get(next) + nextsize)
+#           endif
                  /* no pot. overflow */) {
             /* Note that we usually try to avoid adjacent free blocks   */
             /* that are either both mapped or both unmapped.  But that  */
@@ -978,6 +984,14 @@ GC_INNER void GC_freehblk(struct hblk *hbp)
     /* Coalesce with successor, if possible */
       if(0 != nexthdr && HBLK_IS_FREE(nexthdr) && IS_MAPPED(nexthdr)
          && (signed_word)(hhdr -> hb_sz + nexthdr -> hb_sz) > 0
+#     if defined(__CHERI_PURE_CAPABILITY__)
+         /* CVMFIXME : coalesce with super-capability */
+         /* Bounds of capability should span entire coalesced memory */
+         /* Bounds being larger than blk-size is OK; bounded by the imprecision */
+         /* of original capability obtained from system memory */
+         && (cheri_base_get(hbp) <= cheri_address_get(next))
+         && (cheri_base_get(hbp) + cheri_length_get(hbp)) >= (cheri_address_get(next) + nexthdr->hb_sz)
+#     endif
          /* no overflow */) {
         GC_remove_from_fl(nexthdr);
         hhdr -> hb_sz += nexthdr -> hb_sz;
@@ -987,7 +1001,12 @@ GC_INNER void GC_freehblk(struct hblk *hbp)
       if (prev /* != NULL */) { /* CPPCHECK */
         prevhdr = HDR(prev);
         if (IS_MAPPED(prevhdr)
-            && (signed_word)(hhdr -> hb_sz + prevhdr -> hb_sz) > 0) {
+            && (signed_word)(hhdr -> hb_sz + prevhdr -> hb_sz) > 0
+#       if defined(__CHERI_PURE_CAPABILITY__)
+            /* CVMFIXME : coalesce with super-capability */
+            && (cheri_base_get(hbp) <= cheri_address_get(prev))
+#       endif
+            /* no overflow */ ) {
           GC_remove_from_fl(prevhdr);
           prevhdr -> hb_sz += hhdr -> hb_sz;
 #         ifdef USE_MUNMAP
diff --git a/dyn_load.c b/dyn_load.c
index 2289b68c..a833d94d 100644
--- a/dyn_load.c
+++ b/dyn_load.c
@@ -499,8 +502,17 @@ STATIC int GC_register_dynlib_callback(struct dl_phdr_info * info,
       GC_has_static_roots_func callback = GC_has_static_roots;
       if ((p->p_flags & PF_W) == 0) continue;
 
+#     if !defined(__CHERI_PURE_CAPABILITY__)
         start = (ptr_t)p->p_vaddr + info->dlpi_addr;
         end = start + p->p_memsz;
+#     else
+        start = cheri_align_up(info->dlpi_addr + (vaddr_t)p->p_vaddr, sizeof(ptr_t));
+        end = cheri_align_down(start + p->p_memsz, sizeof(ptr_t));
+        if (!SPANNING_CAPABILITY( info->dlpi_addr, start, end)) continue;
+
+	start = cheri_bounds_set( start, (size_t)(end - start));
+#     endif /* __CHERI_PURE_CAPABILITY__  */
+
       if (callback != 0 && !callback(info->dlpi_name, start, p->p_memsz))
         continue;
 #     ifdef PT_GNU_RELRO
diff --git a/include/private/gc_priv.h b/include/private/gc_priv.h
index c93710be..18d7a321 100644
--- a/include/private/gc_priv.h
+++ b/include/private/gc_priv.h
@@ -2103,6 +2132,26 @@ GC_INNER void GC_with_callee_saves_pushed(void (*fn)(ptr_t, void *),
           LOAD_TAGGED_VALUE(v, tag, p); \
           if (tag != 0) continue; \
         }
+#elif defined(__CHERI_PURE_CAPABILITY__)
+  /* Load value, check tag and permissions of the target memory.   */
+# define LOAD_WORD_OR_CONTINUE(v, p) \
+        { \
+            v = *(void **)(p);                                               \
+            if (!cheri_tag_get(v)) continue;                                 \
+            size_t in_bounds = (v >= (word)cheri_base_get(v))                \
+                                && (v < (word)cheri_base_get(v)              \
+                                        + (word)cheri_length_get(v));        \
+            size_t has_rwx = cheri_perms_get(v) & (CHERI_PERM_LOAD           \
+                                                   | CHERI_PERM_STORE        \
+                                                   | CHERI_PERM_EXECUTE);    \
+            if (!in_bounds || !has_rwx) continue;                            \
+        }
+
+# define SPANNING_CAPABILITY(cap, start, end) \
+      (cheri_tag_get((cap)) \
+        && cheri_base_get((cap)) <= (start)    \
+        && (cheri_base_get((cap)) + cheri_length_get((cap))) >= (end) \
+        && (cheri_perms_get((cap)) & (CHERI_PERM_LOAD|CHERI_PERM_LOAD_CAP)) != 0)
 #else
 # define LOAD_WORD_OR_CONTINUE(v, p) (void)(v = *(word *)(p))
 #endif /* !E2K */
diff --git a/mark.c b/mark.c
index ae8f314f..69133827 100644
--- a/mark.c
+++ b/mark.c
@@ -548,7 +548,12 @@ GC_INNER mse * GC_mark_from(mse *mark_stack_top, mse *mark_stack,
 {
   signed_word credit = HBLKSIZE;  /* Remaining credit for marking work. */
   ptr_t current_p;      /* Pointer to current candidate ptr.            */
+# if defined(__CHERI_PURE_CAPABILITY__)
+  void **current;       /* Candidate pointer.                           */
+  word has_rwx;         /* permissions on capability                    */
+# else
   word current;         /* Candidate pointer.                           */
+# endif
   ptr_t limit = 0;      /* (Incl) limit of current candidate range.     */
   word descr;
   ptr_t greatest_ha = (ptr_t)GC_greatest_plausible_heap_addr;
@@ -728,16 +733,17 @@ GC_INNER mse * GC_mark_from(mse *mark_stack_top, mse *mark_stack,
 #     define PREF_DIST 4
 
 #     if !defined(SMALL_CONFIG) && !defined(USE_PTR_HWTAG)
+#       if !defined(__CHERI_PURE_CAPABILITY__)
           word deferred;
   
@@ -763,6 +769,50 @@ GC_INNER mse * GC_mark_from(mse *mark_stack_top, mse *mark_stack,
             }
             if ((word)current_p > (word)limit) goto next_object;
           }
+#       else   /* !defined(__CHERI_PURE_CAPABILITY__) */  // it is better to avoid code duplication
+          void **deferred;
+  
+          /* Check each pointer for validity before dereferencing         */
+          /* to prevent capability exceptions.                            */
+          /* Utilise the pointer meta-data to speed-up the loop.          */
+          /* If the loop is below the pointer bounds, skip the rest of    */
+          /* marking for that chunk.                                      */
+          /* If the *limit* capability restricts us to reading fewer than */
+          /* sizeof(ptr_t),                                               */
+          /*  a. there can't possibly be a pointer at limit's pointer     */
+          /*  b. reading at that location will raise a capability         */
+          /*     exception                                                */
+          if (cheri_address_get(limit) + sizeof(ptr_t) - 1
+                >= (cheri_base_get(limit) + cheri_length_get(limit))) {
+            /* Decrement limit so that it's within current_p's bounds */
+            limit = cheri_address_set( current_p, ((cheri_base_get(limit)
+                                      + cheri_length_get(limit) - sizeof(ptr_t))
+                                      & ~(sizeof(ptr_t)-1)));
+            if ((word)current_p > (word)limit) goto next_object;
+          }
+          for(;;) {
+            GC_ASSERT((word)limit >= (word)current_p);
+            if (cheri_address_get(limit) < cheri_base_get(limit)) goto next_object;
+
+            has_rwx = cheri_perms_get(limit) & (CHERI_PERM_LOAD
+                                                | CHERI_PERM_STORE
+                                                | CHERI_PERM_EXECUTE);
+            if ((cheri_tag_get(limit) == 0) || !has_rwx) {
+              limit -= ALIGNMENT;
+            } else {
+              deferred = *(void **)limit;
+              FIXUP_POINTER(deferred);
+              limit -= ALIGNMENT;
+              has_rwx = cheri_perms_get(deferred) & (CHERI_PERM_LOAD
+                                                     | CHERI_PERM_STORE
+                                                     | CHERI_PERM_EXECUTE);
+              if (((cheri_tag_get(deferred) != 0) && has_rwx)
+                    && (deferred >= (word)least_ha && deferred < (word)greatest_ha))
+                break;
+            }
+            if ((word)current_p > (word)limit) goto next_object;
+          }
+#       endif   // defined(__CHERI_PURE_CAPABILITY__)
 #     endif
 
       for (; (word)current_p <= (word)limit; current_p += ALIGNMENT) {
@@ -1502,7 +1557,13 @@ GC_API void GC_CALL GC_print_trace(word gc_no)
 GC_ATTR_NO_SANITIZE_ADDR GC_ATTR_NO_SANITIZE_MEMORY GC_ATTR_NO_SANITIZE_THREAD
 GC_API void GC_CALL GC_push_all_eager(void *bottom, void *top)
 {
+# if defined(__CHERI_PURE_CAPABILITY__)
+    REGISTER void ** current_p; // it is better to use ptr_t instead of void**
+# else
     REGISTER ptr_t current_p;
+# endif
     REGISTER word *lim;
     REGISTER ptr_t greatest_ha = (ptr_t)GC_greatest_plausible_heap_addr;
     REGISTER ptr_t least_ha = (ptr_t)GC_least_plausible_heap_addr;
@@ -1512,6 +1573,18 @@ GC_API void GC_CALL GC_push_all_eager(void *bottom, void *top)
     if (top == 0) return;
 
     /* Check all pointers in range and push if they appear to be valid. */
+# if defined(__CHERI_PURE_CAPABILITY__)
+    lim = t - 1;
+    if ((intptr_t)lim >= (cheri_base_get(b) + cheri_length_get(b)))
+      lim = cheri_base_get(b) + cheri_length_get(b) - sizeof(ptr_t);
+
+    for (current_p = b; (word)current_p <= (word)lim; current_p++) {
+      REGISTER void *q = *current_p;
+
+      LOAD_WORD_OR_CONTINUE(q, current_p);
+      GC_PUSH_ONE_STACK(q, current_p);
+    }
+# else
     lim = (word *)(((word)top) & ~(ALIGNMENT-1)) - 1;
     for (current_p = (ptr_t)(((word)bottom + ALIGNMENT-1) & ~(ALIGNMENT-1));
          (word)current_p <= (word)lim; current_p += ALIGNMENT) {
@@ -1520,6 +1593,7 @@ GC_API void GC_CALL GC_push_all_eager(void *bottom, void *top)
       LOAD_WORD_OR_CONTINUE(q, current_p);
       GC_PUSH_ONE_STACK(q, current_p);
     }
+# endif
 #   undef GC_greatest_plausible_heap_addr
 #   undef GC_least_plausible_heap_addr
 }
diff --git a/os_dep.c b/os_dep.c
index 16e0ffd8..86ba0f93 100644
--- a/os_dep.c
+++ b/os_dep.c
@@ -90,6 +90,10 @@
 # include "mm/PCR_MM.h"
 #endif
 
+#if defined(__CHERI_PURE_CAPABILITY__)
+# include <link.h>
+#endif
+
 #if !defined(NO_EXECUTE_PERMISSION)
   STATIC GC_bool GC_pages_executable = TRUE;
 #else
@@ -1035,8 +1043,15 @@ GC_INNER size_t GC_page_size = 0;
 
     void * GC_find_limit(void * p, int up)
     {
+#     if defined(__CHERI_PURE_CAPABILITY__)
+        vaddr_t bound = up ? cheri_base_get(p) + cheri_length_get(p)
+                             : cheri_address_set(p, cheri_base_get(p));
+        return GC_find_limit_with_bound((ptr_t)p, (GC_bool)up,
+                                        cheri_address_set(p, bound));
+#     else
         return GC_find_limit_with_bound((ptr_t)p, (GC_bool)up,
                                         up ? (ptr_t)GC_WORD_MAX : 0);
+#     endif
     }
 # endif /* NEED_FIND_LIMIT || USE_PROC_FOR_LIBRARIES */
 
@@ -2035,6 +2050,7 @@ void GC_register_data_segments(void)
 /* For now we don't assume that there is always an empty page after     */
 /* etext.  But in some cases there actually seems to be slightly more.  */
 /* This also deals with holes between read-only data and writable data. */
+# if !defined(__CHERI_PURE_CAPABILITY__)
     GC_INNER ptr_t GC_FreeBSDGetDataStart(size_t max_page_size,
                                           ptr_t etext_addr)
     {
@@ -2056,8 +2072,88 @@ void GC_register_data_segments(void)
           /* As above, we go to plan B    */
           result = (ptr_t)GC_find_limit(DATAEND, FALSE);
       }
     return result;
     }
+# else  /* !defined(__CHERI_PURE_CAPABILITY__) */
+    /* The CheriBSD LLVM compiler declares `etext`, `edata` and `end` as */
+    /* typeless variables. If bdwgc is statically linked with the main   */
+    /* executable, these capabilities are compiled with read-only        */
+    /* permissions and bounds that span the .data and .bss sections.     */
+    /*                                                                   */
+    /* If bdwgc is compiled as a shared library, these symbols are       */
+    /* compiled with zero bounds and cannot be dereferenced. Instead,    */
+    /* read-only capability returned by the loader is utilised           */
+    struct scan_bounds {
+        vaddr_t start;
+        vaddr_t end;
+        ptr_t  ld_cap;
+    };
+
+    STATIC int GC_ld_cap_search(struct dl_phdr_info *info, size_t size, void *data)
+    {
+      struct scan_bounds *region = (struct scan_bounds *)data;
+      ptr_t load_addr = info->dlpi_addr;
+
+      if (!region || !SPANNING_CAPABILITY(load_addr,
+             region->start, region->end)) {
+        return 0;
+      }
+
+      region->ld_cap = cheri_bounds_set(
+                                    cheri_address_set(load_addr, region->start),
+                                    (size_t)(region->end - region->start));
+      return 1;
+
+    }
+
+    GC_INNER ptr_t GC_derive_cap_from_ldr(ptr_t range_start, ptr_t range_end)
+    {
+      vaddr_t scan_start = cheri_address_get(range_start);
+      vaddr_t scan_end = cheri_address_get(range_end);
+      /* If symbols already span required range, return it. */
+      if (SPANNING_CAPABILITY(range_start, scan_start, scan_end)) {
+        return range_start;
+      } else if (SPANNING_CAPABILITY(range_end, scan_start, scan_end)) {
+        return range_end;
+      }
+
+      /* Fall-back option : derive .data + .bss end pointer from */
+      /* read-only capability provided by loader */
+      struct scan_bounds region = { .start = scan_start,
+                                    .end = scan_end,
+                                    .ld_cap = NULL };
+      if (!dl_iterate_phdr(GC_ld_cap_search, (void *)&region)) {
+        ABORT("Cannot find static roots for capability system");
+      }
+      return region.ld_cap;
+    }
+
+    GC_INNER ptr_t GC_FreeBSDGetDataStart(size_t max_page_size,
+                                          ptr_t etext_addr)
+    {
+      volatile ptr_t cap_next_page = NULL;
+      ptr_t text_end = cheri_align_up(etext_addr, sizeof(ptr_t));
+      text_end = GC_derive_cap_from_ldr(text_end, DATAEND);
+      /* etext rounded to word boundary       */
+      volatile vaddr_t next_page = cheri_align_up(text_end, max_page_size);
+      volatile ptr_t result = text_end;
+      GC_setup_temporary_fault_handler();
+      if (SETJMP(GC_jmp_buf) == 0) {
+          /* Try reading at the address.                          */
+          /* This should happen before there is another thread.   */
+          for (; next_page < (word)DATAEND; next_page += (word)max_page_size) {
+              cap_next_page = cheri_address_set(text_end, next_page);
+              GC_noop1((word)(*cap_next_page));
+          }
+          GC_reset_fault_handler();
+      } else {
+          GC_reset_fault_handler();
+          /* As above, we go to plan B    */
+          result = (ptr_t)GC_find_limit(cheri_address_set(text_end,DATAEND), FALSE);
+      }
+      return(result);
     }
+# endif  /* !defined(__CHERI_PURE_CAPABILITY__) */
 #endif /* DATASTART_USES_BSDGETDATASTART */
 

[ivmai]

As of commit e1fb227, bdwgc could be built using:

./configure --disable-dynamic-loading --enable-cplusplus --enable-gc-assertions --enable-werror
make check CFLAGS_EXTRA="-Wno-cheri-capability-misuse -Wno-capability-to-integer-cast"

All tests fail currently, because of missing some patches from https://github.com/capablevms/bdwgc

[ivmai]

Note: some suppressed warnings could be eliminated by modifying GC_CAST_AWAY_CONST_PVOID() and CAST_THRU_UINTPTR() - remove intermediate GC_uintptr_t if __CHERI_PURE_CAPABILITY__.

[ivmai]

As of commit 5d619ee, bdwgc could be built using:

./autogen.sh
./configure --enable-cplusplus --enable-gc-assertions --enable-werror
make check

Or, using make -f Makefile.direct check or using cmake.
All tests fail currently (as noted above).

[ivmai]

As of commit 5d619ee, bdwgc could be built using:

./autogen.sh
./configure --enable-cplusplus --enable-gc-assertions --enable-werror
make check

Or, using make -f Makefile.direct check or using cmake.
All tests fail currently (as noted above).

[ivmai]

GCJ support is not working because it expects granule to be at least twice bigger than pointer currently. Should be fixed by #652.
For now, please pass -Denable_gcj_support=OFF to cmake (or --disable-gcj-support to configure).