Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add 4-byte alignment check on pc in JAL/JALR instructions #97

Merged
merged 3 commits into from
Jan 8, 2025
Merged

Add 4-byte alignment check on pc in JAL/JALR instructions #97

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
37bcc7b
Add 4-byte alignment check on pc in JAL/JALR instructions
mininny Dec 10, 2024
a54b6ca
Fix imm in JAL instruction test to be 4-byte aligned
mininny Dec 10, 2024
83efd3a
Add solidity test for revert case
mininny Dec 16, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 12 additions & 2 deletions rvgo/fast/vm.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -833,13 +833,23 @@ func (inst *InstrumentedState) riscvStep() (outErr error) {
imm := parseImmTypeJ(instr)
rdValue := add64(pc, toU64(4))
setRegister(rd, rdValue)
setPC(add64(pc, signExtend64(shl64(toU64(1), imm), toU64(20)))) // signed offset in multiples of 2 bytes (last bit is there, but ignored)

newPC := add64(pc, signExtend64(shl64(toU64(1), imm), toU64(20)))
if newPC&3 != 0 { // quick target alignment check
revertWithCode(riscv.ErrNotAlignedAddr, fmt.Errorf("pc %d not aligned with 4 bytes", newPC))
}
setPC(newPC) // signed offset in multiples of 2 bytes (last bit is there, but ignored)
case 0x67: // 110_0111: JALR = Jump and link register
rs1Value := getRegister(rs1)
imm := parseImmTypeI(instr)
rdValue := add64(pc, toU64(4))
setRegister(rd, rdValue)
setPC(and64(add64(rs1Value, signExtend64(imm, toU64(11))), xor64(u64Mask(), toU64(1)))) // least significant bit is set to 0

newPC := and64(add64(rs1Value, signExtend64(imm, toU64(11))), xor64(u64Mask(), toU64(1)))
if newPC&3 != 0 { // quick addr alignment check
revertWithCode(riscv.ErrNotAlignedAddr, fmt.Errorf("pc %d not aligned with 4 bytes", newPC))
}
setPC(newPC) // least significant bit is set to 0
case 0x73: // 111_0011: environment things
switch funct3 {
case 0: // 000 = ECALL/EBREAK
Expand Down
14 changes: 12 additions & 2 deletions rvgo/slow/vm.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1006,13 +1006,23 @@ func Step(calldata []byte, po PreimageOracle) (stateHash common.Hash, outErr err
imm := parseImmTypeJ(instr)
rdValue := add64(pc, toU64(4))
setRegister(rd, rdValue)
setPC(add64(pc, signExtend64(shl64(toU64(1), imm), toU64(20)))) // signed offset in multiples of 2 bytes (last bit is there, but ignored)

newPC := add64(pc, signExtend64(shl64(toU64(1), imm), toU64(20)))
if and64(newPC, toU64(3)) != (U64{}) { // quick target alignment check
revertWithCode(riscv.ErrNotAlignedAddr, fmt.Errorf("pc %d not aligned with 4 bytes", newPC))
}
setPC(newPC) // signed offset in multiples of 2 bytes (last bit is there, but ignored)
case 0x67: // 110_0111: JALR = Jump and link register
rs1Value := getRegister(rs1)
imm := parseImmTypeI(instr)
rdValue := add64(pc, toU64(4))
setRegister(rd, rdValue)
setPC(and64(add64(rs1Value, signExtend64(imm, toU64(11))), xor64(u64Mask(), toU64(1)))) // least significant bit is set to 0

newPC := and64(add64(rs1Value, signExtend64(imm, toU64(11))), xor64(u64Mask(), toU64(1)))
if and64(newPC, toU64(3)) != (U64{}) { // quick target alignment check
revertWithCode(riscv.ErrNotAlignedAddr, fmt.Errorf("pc %d not aligned with 4 bytes", newPC))
}
setPC(newPC) // least significant bit is set to 0
case 0x73: // 111_0011: environment things
switch funct3.val() {
case 0: // 000 = ECALL/EBREAK
Expand Down
17 changes: 14 additions & 3 deletions rvsol/src/RISCV.sol
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1496,7 +1496,13 @@ contract RISCV is IBigStepper {
let imm := parseImmTypeJ(instr)
let rdValue := add64(_pc, toU64(4))
setRegister(rd, rdValue)
setPC(add64(_pc, signExtend64(shl64(toU64(1), imm), toU64(20)))) // signed offset in multiples of 2

let newPC := add64(_pc, signExtend64(shl64(toU64(1), imm), toU64(20)))
if and64(newPC, toU64(3)) {
// quick target alignment check
revertWithCode(0xbad10ad0) // target not aligned with 4 bytes
}
setPC(newPC) // signed offset in multiples of 2
// bytes (last bit is there, but ignored)
}
case 0x67 {
Expand All @@ -1505,8 +1511,13 @@ contract RISCV is IBigStepper {
let imm := parseImmTypeI(instr)
let rdValue := add64(_pc, toU64(4))
setRegister(rd, rdValue)
setPC(and64(add64(rs1Value, signExtend64(imm, toU64(11))), xor64(u64Mask(), toU64(1)))) // least
// significant bit is set to 0

let newPC := and64(add64(rs1Value, signExtend64(imm, toU64(11))), xor64(u64Mask(), toU64(1)))
if and64(newPC, toU64(3)) {
// quick target alignment check
revertWithCode(0xbad10ad0) // target not aligned with 4 bytes
}
setPC(newPC) // least significant bit is set to 0
}
case 0x73 {
// 111_0011: environment things
Expand Down
13 changes: 12 additions & 1 deletion rvsol/test/RISCV.t.sol
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2246,7 +2246,7 @@ contract RISCV_Test is CommonTest {
/* J Type instructions */

function test_jal_succeeds() public {
uint32 imm = 0xbef054ae;
uint32 imm = 0xbef054ac;
uint32 insn = encodeJType(0x6f, 5, imm); // jal x5, imm
(State memory state, bytes memory proof) = constructRISCVState(0, insn);
bytes memory encodedState = encodeState(state);
Expand Down Expand Up @@ -2460,6 +2460,17 @@ contract RISCV_Test is CommonTest {
riscv.step(encodedState, proof, 0);
}

function test_revert_unaligned_jal_instruction() public {
// 0xbef054ae % 4 != 0
uint32 imm = 0xbef054ae;
uint32 insn = encodeJType(0x6f, 5, imm); // jal x5, imm
(State memory state, bytes memory proof) = constructRISCVState(0, insn);
bytes memory encodedState = encodeState(state);

vm.expectRevert(hex"00000000000000000000000000000000000000000000000000000000bad10ad0");
riscv.step(encodedState, proof, 0);
}

/* Helper methods */

function encodeState(State memory state) internal pure returns (bytes memory) {
Expand Down
Loading