[PATCH v14 09/20] target/riscv: Expose zicfilp extension as a cpu property

Signed-off-by: Deepak Gupta Reviewed-by: Alistair Francis --- target/riscv/cpu.c | 1 + 1 file changed, 1 insertion(+) diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c index a0490e29f9..b4b578003f 100644 --- a/target/riscv/cpu.c +++ b/target/riscv/cpu.c @@ -1495,6 +1495,7 @@ const

[PATCH v14 18/20] disas/riscv: enable disassembly for zicfiss instructions

Enable disassembly for sspush, sspopchk, ssrdp & ssamoswap. Disasembly is only enabled if zimop and zicfiss ext is set to true. Signed-off-by: Deepak Gupta Acked-by: Alistair Francis --- disas/riscv.c | 40 +++- disas/riscv.h | 1 + 2 files changed

[PATCH v14 17/20] target/riscv: compressed encodings for sspush and sspopchk

sspush/sspopchk have compressed encodings carved out of zcmops. compressed sspush is designated as c.mop.1 while compressed sspopchk is designated as c.mop.5. Note that c.sspush x1 exists while c.sspush x5 doesn't. Similarly c.sspopchk x5 exists while c.sspopchk x1 doesn't. Signed-off-

[PATCH v14 11/20] target/riscv: introduce ssp and enabling controls for zicfiss

t. Adds ssp to migration state as well. Signed-off-by: Deepak Gupta Co-developed-by: Jim Shu Co-developed-by: Andy Chiu Reviewed-by: Richard Henderson Reviewed-by: Alistair Francis --- target/riscv/cpu.c| 2 ++ target/riscv/cpu.h| 3 +++ target/riscv/cpu_bits.h | 6 +

[PATCH v14 01/20] target/riscv: expose *envcfg csr and priv to qemu-user as well

need arises then `henvcfg` could be exposed as well. Relevant discussion: https://lore.kernel.org/all/cakmqykotvwpfep2mstqvdumjerkh+bqcckeq4hanydfpdwk...@mail.gmail.com/ Signed-off-by: Deepak Gupta Suggested-by: Richard Henderson Reviewed-by: Richard Henderson Reviewed-by: Alistair Fr

[PATCH v14 07/20] target/riscv: zicfilp `lpad` impl and branch tracking

`lpad`. If they don't match, cpu raises a sw check exception with tval = 2. Signed-off-by: Deepak Gupta Co-developed-by: Jim Shu Co-developed-by: Andy Chiu Reviewed-by: Richard Henderson Reviewed-by: Alistair Francis --- target/riscv/cpu_user.h | 1 + target/riscv/i

[PATCH v14 05/20] target/riscv: additional code information for sw check

`. Signed-off-by: Deepak Gupta Reviewed-by: Richard Henderson Reviewed-by: Alistair Francis --- target/riscv/cpu.h| 2 ++ target/riscv/cpu_helper.c | 3 +++ target/riscv/csr.c| 1 + 3 files changed, 6 insertions(+) diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h index

[PATCH v14 20/20] target/riscv: Expose zicfiss extension as a cpu property

Signed-off-by: Deepak Gupta Reviewed-by: Alistair Francis --- target/riscv/cpu.c | 1 + 1 file changed, 1 insertion(+) diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c index 4172774087..3e72df6ef8 100644 --- a/target/riscv/cpu.c +++ b/target/riscv/cpu.c @@ -1499,6 +1499,7 @@ const

[PATCH v14 13/20] target/riscv: mmu changes for zicfiss shadow stack protection

accesses to RO memory leads to store page fault. To implement special nature of shadow stack memory where only selected stores (shadow stack stores from sspush) have to be allowed while rest of regular stores disallowed, new MMU TLB index is created for shadow stack. Signed-off-by: Deepak Gupta

[PATCH v14 06/20] target/riscv: tracking indirect branches (fcfi) for zicfilp

`lpad` gets translated, fcfi_lp_expected flag in DisasContext can be cleared. Else it'll fault. Signed-off-by: Deepak Gupta Co-developed-by: Jim Shu Co-developed-by: Andy Chiu Suggested-by: Richard Henderson Reviewed-by: Richard Henderson Reviewed-by: Alistair Francis --- target/riscv/

[PATCH v14 03/20] target/riscv: Introduce elp state and enabling controls for zicfilp

te back to NO_LP_EXPECTED. On reset, elp is set to NO_LP_EXPECTED. zicfilp is enabled via bit2 in *envcfg CSRs. Enabling control for M-mode is in mseccfg CSR at bit position 10. On trap, elp state is saved away in *status. Adds elp to the migration state as well. Signed-off-by: Deepak Gupta Co-developed-by: J

[PATCH v14 04/20] target/riscv: save and restore elp state on priv transitions

on *envcfg (for U, VU, S, VU, HS) or mseccfg csr (for M). Signed-off-by: Deepak Gupta Co-developed-by: Jim Shu Co-developed-by: Andy Chiu Reviewed-by: Richard Henderson --- target/riscv/cpu.h| 1 + target/riscv/cpu_helper.c | 54 +++ target/riscv

[PATCH v14 15/20] target/riscv: update `decode_save_opc` to store extra word2

/qemu/-/issues/594 Signed-off-by: Deepak Gupta Reviewed-by: Richard Henderson Reviewed-by: Alistair Francis --- target/riscv/insn_trans/trans_privileged.c.inc | 8 target/riscv/insn_trans/trans_rva.c.inc| 4 ++-- target/riscv/insn_trans/trans_rvd.c.inc| 4

[PATCH v14 19/20] disas/riscv: enable disassembly for compressed sspush/sspopchk

sspush and sspopchk have equivalent compressed encoding taken from zcmop. cmop.1 is sspush x1 while cmop.5 is sspopchk x5. Due to unusual encoding for both rs1 and rs2 from space bitfield, this required a new codec. Signed-off-by: Deepak Gupta Acked-by: Alistair Francis --- disas/riscv.c | 19

[PATCH v14 10/20] target/riscv: Add zicfiss extension

zicfiss [1] riscv cpu extension enables backward control flow integrity. This patch sets up space for zicfiss extension in cpuconfig. And imple- ments dependency on A, zicsr, zimop and zcmop extensions. [1] - https://github.com/riscv/riscv-cfi Signed-off-by: Deepak Gupta Co-developed-by: Jim

[PATCH v14 08/20] disas/riscv: enable `lpad` disassembly

Signed-off-by: Deepak Gupta Co-developed-by: Jim Shu Co-developed-by: Andy Chiu Reviewed-by: Richard Henderson Reviewed-by: Alistair Francis --- disas/riscv.c | 18 +- disas/riscv.h | 2 ++ 2 files changed, 19 insertions(+), 1 deletion(-) diff --git a/disas/riscv.c b/disas

[PATCH v14 14/20] target/riscv: AMO operations always raise store/AMO fault

This patch adds one more word for tcg compile which can be obtained during unwind time to determine fault type for original operation (example AMO). Depending on that, fault can be promoted to store/AMO fault. Signed-off-by: Deepak Gupta Suggested-by: Richard Henderson Reviewed-by: Richard

[PATCH v14 16/20] target/riscv: implement zicfiss instructions

stack atomically sspopchk/sspush/ssrdp default to zimop if zimop implemented and SSE=0 If SSE=0, ssamoswap is illegal instruction exception. This patch implements shadow stack operations for qemu-user and shadow stack is not protected. Signed-off-by: Deepak Gupta Co-developed-by: Jim Shu Co

[PATCH v14 12/20] target/riscv: tb flag for shadow stack instructions

enabled or not. Signed-off-by: Deepak Gupta Co-developed-by: Jim Shu Co-developed-by: Andy Chiu Reviewed-by: Richard Henderson Reviewed-by: Alistair Francis --- target/riscv/cpu.h| 2 ++ target/riscv/cpu_helper.c | 4 target/riscv/translate.c | 3 +++ 3 files changed, 9 insertions

[PATCH v14 00/20] riscv support for control flow integrity extensions

- fixes assert condition in accel/tcg v2: - added missed file (in v1) for shadow stack instructions implementation. Deepak Gupta (20): target/riscv: expose *envcfg csr and priv to qemu-user as well target/riscv: Add zicfilp extension target/riscv: Introduce elp state and enabling contr

[PATCH v14 02/20] target/riscv: Add zicfilp extension

: Deepak Gupta Co-developed-by: Jim Shu Co-developed-by: Andy Chiu Reviewed-by: Alistair Francis --- target/riscv/cpu.c | 1 + target/riscv/cpu_cfg.h | 1 + target/riscv/tcg/tcg-cpu.c | 5 + 3 files changed, 7 insertions(+) diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c index

[PATCH v13 00/20] riscv support for control flow integrity extensions

ons to not require helper. - tcg helpers only for cfi violation cases so that trace hooks can be placed. - Style changes. - fixes assert condition in accel/tcg v2: - added missed file (in v1) for shadow stack instructions implementation. Deepak Gupta (20): target/riscv:

[PATCH v13 07/20] target/riscv: zicfilp `lpad` impl and branch tracking

`lpad`. If they don't match, cpu raises a sw check exception with tval = 2. Signed-off-by: Deepak Gupta Co-developed-by: Jim Shu Co-developed-by: Andy Chiu Reviewed-by: Richard Henderson Reviewed-by: Alistair Francis --- target/riscv/cpu_user.h | 1 + target/riscv/i

[PATCH v13 05/20] target/riscv: additional code information for sw check

`. Signed-off-by: Deepak Gupta Reviewed-by: Richard Henderson Reviewed-by: Alistair Francis --- target/riscv/cpu.h| 2 ++ target/riscv/cpu_helper.c | 3 +++ target/riscv/csr.c| 1 + 3 files changed, 6 insertions(+) diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h index

[PATCH v13 02/20] target/riscv: Add zicfilp extension

: Deepak Gupta Co-developed-by: Jim Shu Co-developed-by: Andy Chiu Reviewed-by: Alistair Francis --- target/riscv/cpu.c | 1 + target/riscv/cpu_cfg.h | 1 + target/riscv/tcg/tcg-cpu.c | 5 + 3 files changed, 7 insertions(+) diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c index

[PATCH v13 19/20] disas/riscv: enable disassembly for compressed sspush/sspopchk

sspush and sspopchk have equivalent compressed encoding taken from zcmop. cmop.1 is sspush x1 while cmop.5 is sspopchk x5. Due to unusual encoding for both rs1 and rs2 from space bitfield, this required a new codec. Signed-off-by: Deepak Gupta Acked-by: Alistair Francis --- disas/riscv.c | 19

[PATCH v13 08/20] disas/riscv: enable `lpad` disassembly

Signed-off-by: Deepak Gupta Co-developed-by: Jim Shu Co-developed-by: Andy Chiu Reviewed-by: Richard Henderson Reviewed-by: Alistair Francis --- disas/riscv.c | 18 +- disas/riscv.h | 2 ++ 2 files changed, 19 insertions(+), 1 deletion(-) diff --git a/disas/riscv.c b/disas

[PATCH v13 16/20] target/riscv: implement zicfiss instructions

stack atomically sspopchk/sspush/ssrdp default to zimop if zimop implemented and SSE=0 If SSE=0, ssamoswap is illegal instruction exception. This patch implements shadow stack operations for qemu-user and shadow stack is not protected. Signed-off-by: Deepak Gupta Co-developed-by: Jim Shu Co

[PATCH v13 06/20] target/riscv: tracking indirect branches (fcfi) for zicfilp

`lpad` gets translated, fcfi_lp_expected flag in DisasContext can be cleared. Else it'll fault. Signed-off-by: Deepak Gupta Co-developed-by: Jim Shu Co-developed-by: Andy Chiu Suggested-by: Richard Henderson Reviewed-by: Richard Henderson Reviewed-by: Alistair Francis --- target/riscv/

[PATCH v13 20/20] target/riscv: Expose zicfiss extension as a cpu property

Signed-off-by: Deepak Gupta Reviewed-by: Alistair Francis --- target/riscv/cpu.c | 1 + 1 file changed, 1 insertion(+) diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c index c5ebcefeb5..2592465e24 100644 --- a/target/riscv/cpu.c +++ b/target/riscv/cpu.c @@ -1485,6 +1485,7 @@ const

[PATCH v13 10/20] target/riscv: Add zicfiss extension

zicfiss [1] riscv cpu extension enables backward control flow integrity. This patch sets up space for zicfiss extension in cpuconfig. And imple- ments dependency on A, zicsr, zimop and zcmop extensions. [1] - https://github.com/riscv/riscv-cfi Signed-off-by: Deepak Gupta Co-developed-by: Jim

[PATCH v13 03/20] target/riscv: Introduce elp state and enabling controls for zicfilp

te back to NO_LP_EXPECTED. On reset, elp is set to NO_LP_EXPECTED. zicfilp is enabled via bit2 in *envcfg CSRs. Enabling control for M-mode is in mseccfg CSR at bit position 10. On trap, elp state is saved away in *status. Adds elp to the migration state as well. Signed-off-by: Deepak Gupta Co-developed-by: J

[PATCH v13 12/20] target/riscv: tb flag for shadow stack instructions

enabled or not. Signed-off-by: Deepak Gupta Co-developed-by: Jim Shu Co-developed-by: Andy Chiu Reviewed-by: Richard Henderson Reviewed-by: Alistair Francis --- target/riscv/cpu.h| 2 ++ target/riscv/cpu_helper.c | 4 target/riscv/translate.c | 3 +++ 3 files changed, 9 insertions

[PATCH v13 18/20] disas/riscv: enable disassembly for zicfiss instructions

Enable disassembly for sspush, sspopchk, ssrdp & ssamoswap. Disasembly is only enabled if zimop and zicfiss ext is set to true. Signed-off-by: Deepak Gupta Acked-by: Alistair Francis --- disas/riscv.c | 40 +++- disas/riscv.h | 1 + 2 files changed

[PATCH v13 11/20] target/riscv: introduce ssp and enabling controls for zicfiss

t. Adds ssp to migration state as well. Signed-off-by: Deepak Gupta Co-developed-by: Jim Shu Co-developed-by: Andy Chiu Reviewed-by: Richard Henderson Reviewed-by: Alistair Francis --- target/riscv/cpu.c| 2 ++ target/riscv/cpu.h| 3 +++ target/riscv/cpu_bits.h | 6 +

[PATCH v13 14/20] target/riscv: AMO operations always raise store/AMO fault

This patch adds one more word for tcg compile which can be obtained during unwind time to determine fault type for original operation (example AMO). Depending on that, fault can be promoted to store/AMO fault. Signed-off-by: Deepak Gupta Suggested-by: Richard Henderson Reviewed-by: Richard

[PATCH v13 09/20] target/riscv: Expose zicfilp extension as a cpu property

Signed-off-by: Deepak Gupta Reviewed-by: Alistair Francis --- target/riscv/cpu.c | 1 + 1 file changed, 1 insertion(+) diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c index 55754cb374..c9aeffee4e 100644 --- a/target/riscv/cpu.c +++ b/target/riscv/cpu.c @@ -1481,6 +1481,7 @@ const

[PATCH v13 01/20] target/riscv: expose *envcfg csr and priv to qemu-user as well

need arises then `henvcfg` could be exposed as well. Relevant discussion: https://lore.kernel.org/all/cakmqykotvwpfep2mstqvdumjerkh+bqcckeq4hanydfpdwk...@mail.gmail.com/ Signed-off-by: Deepak Gupta Suggested-by: Richard Henderson Reviewed-by: Richard Henderson Reviewed-by: Alistair Fr

[PATCH v13 04/20] target/riscv: save and restore elp state on priv transitions

on *envcfg (for U, VU, S, VU, HS) or mseccfg csr (for M). Signed-off-by: Deepak Gupta Co-developed-by: Jim Shu Co-developed-by: Andy Chiu Reviewed-by: Richard Henderson --- target/riscv/cpu.h| 1 + target/riscv/cpu_helper.c | 54 +++ target/riscv

[PATCH v13 13/20] target/riscv: mmu changes for zicfiss shadow stack protection

accesses to RO memory leads to store page fault. To implement special nature of shadow stack memory where only selected stores (shadow stack stores from sspush) have to be allowed while rest of regular stores disallowed, new MMU TLB index is created for shadow stack. Signed-off-by: Deepak Gupta

[PATCH v13 15/20] target/riscv: update `decode_save_opc` to store extra word2

/qemu/-/issues/594 Signed-off-by: Deepak Gupta Reviewed-by: Richard Henderson Reviewed-by: Alistair Francis --- target/riscv/insn_trans/trans_privileged.c.inc | 8 target/riscv/insn_trans/trans_rva.c.inc| 4 ++-- target/riscv/insn_trans/trans_rvd.c.inc| 4

[PATCH v13 17/20] target/riscv: compressed encodings for sspush and sspopchk

sspush/sspopchk have compressed encodings carved out of zcmops. compressed sspush is designated as c.mop.1 while compressed sspopchk is designated as c.mop.5. Note that c.sspush x1 exists while c.sspush x5 doesn't. Similarly c.sspopchk x5 exists while c.sspopchk x1 doesn't. Signed-off-

Re: [PATCH v12 11/20] target/riscv: introduce ssp and enabling controls for zicfiss

On Thu, Aug 29, 2024 at 10:56:41PM -0700, Deepak Gupta wrote: On Fri, Aug 30, 2024 at 03:20:04PM +1000, Richard Henderson wrote: On 8/30/24 09:34, Deepak Gupta wrote: +bool cpu_get_bcfien(CPURISCVState *env) It occurs to me that a better name would be "cpu_get_sspen". The backw

Re: [PATCH v12 11/20] target/riscv: introduce ssp and enabling controls for zicfiss

On Fri, Aug 30, 2024 at 03:20:04PM +1000, Richard Henderson wrote: On 8/30/24 09:34, Deepak Gupta wrote: +bool cpu_get_bcfien(CPURISCVState *env) It occurs to me that a better name would be "cpu_get_sspen". The backward cfi is merely a consequence of the shadow stack. Want me

[PATCH v12 16/20] target/riscv: implement zicfiss instructions

stack atomically sspopchk/sspush/ssrdp default to zimop if zimop implemented and SSE=0 If SSE=0, ssamoswap is illegal instruction exception. This patch implements shadow stack operations for qemu-user and shadow stack is not protected. Signed-off-by: Deepak Gupta Co-developed-by: Jim Shu Co

[PATCH v12 08/20] disas/riscv: enable `lpad` disassembly

Signed-off-by: Deepak Gupta Co-developed-by: Jim Shu Co-developed-by: Andy Chiu Reviewed-by: Richard Henderson Reviewed-by: Alistair Francis --- disas/riscv.c | 18 +- disas/riscv.h | 2 ++ 2 files changed, 19 insertions(+), 1 deletion(-) diff --git a/disas/riscv.c b/disas

[PATCH v12 15/20] target/riscv: update `decode_save_opc` to store extra word2

/qemu/-/issues/594 Signed-off-by: Deepak Gupta Reviewed-by: Richard Henderson Reviewed-by: Alistair Francis --- target/riscv/insn_trans/trans_privileged.c.inc | 8 target/riscv/insn_trans/trans_rva.c.inc| 4 ++-- target/riscv/insn_trans/trans_rvd.c.inc| 4

[PATCH v12 17/20] target/riscv: compressed encodings for sspush and sspopchk

sspush/sspopchk have compressed encodings carved out of zcmops. compressed sspush is designated as c.mop.1 while compressed sspopchk is designated as c.mop.5. Note that c.sspush x1 exists while c.sspush x5 doesn't. Similarly c.sspopchk x5 exists while c.sspopchk x1 doesn't. Signed-off-

[PATCH v12 05/20] target/riscv: additional code information for sw check

`. Signed-off-by: Deepak Gupta Reviewed-by: Richard Henderson Reviewed-by: Alistair Francis --- target/riscv/cpu.h| 2 ++ target/riscv/cpu_helper.c | 3 +++ target/riscv/csr.c| 1 + 3 files changed, 6 insertions(+) diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h index

[PATCH v12 10/20] target/riscv: Add zicfiss extension

zicfiss [1] riscv cpu extension enables backward control flow integrity. This patch sets up space for zicfiss extension in cpuconfig. And imple- ments dependency on A, zicsr, zimop and zcmop extensions. [1] - https://github.com/riscv/riscv-cfi Signed-off-by: Deepak Gupta Co-developed-by: Jim

[PATCH v12 20/20] target/riscv: Expose zicfiss extension as a cpu property

Signed-off-by: Deepak Gupta Reviewed-by: Alistair Francis --- target/riscv/cpu.c | 1 + 1 file changed, 1 insertion(+) diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c index c5ebcefeb5..2592465e24 100644 --- a/target/riscv/cpu.c +++ b/target/riscv/cpu.c @@ -1485,6 +1485,7 @@ const

[PATCH v12 00/20] riscv support for control flow integrity extensions

nd shadow stack instructions to not require helper. - tcg helpers only for cfi violation cases so that trace hooks can be placed. - Style changes. - fixes assert condition in accel/tcg v2: - added missed file (in v1) for shadow stack instructions implementation. Deepak Gupta (20):

[PATCH v12 14/20] target/riscv: AMO operations always raise store/AMO fault

This patch adds one more word for tcg compile which can be obtained during unwind time to determine fault type for original operation (example AMO). Depending on that, fault can be promoted to store/AMO fault. Signed-off-by: Deepak Gupta Suggested-by: Richard Henderson Reviewed-by: Richard

[PATCH v12 11/20] target/riscv: introduce ssp and enabling controls for zicfiss

not. qemu-user also gets field `ubcfien` indicating whether qemu user has shadow stack enabled or not. Adds ssp to migration state as well. Signed-off-by: Deepak Gupta Co-developed-by: Jim Shu Co-developed-by: Andy Chiu Reviewed-by: Richard Henderson Reviewed-by: Alistair Francis --- targe

[PATCH v12 09/20] target/riscv: Expose zicfilp extension as a cpu property

Signed-off-by: Deepak Gupta Reviewed-by: Alistair Francis --- target/riscv/cpu.c | 1 + 1 file changed, 1 insertion(+) diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c index 55754cb374..c9aeffee4e 100644 --- a/target/riscv/cpu.c +++ b/target/riscv/cpu.c @@ -1481,6 +1481,7 @@ const

[PATCH v12 18/20] disas/riscv: enable disassembly for zicfiss instructions

Enable disassembly for sspush, sspopchk, ssrdp & ssamoswap. Disasembly is only enabled if zimop and zicfiss ext is set to true. Signed-off-by: Deepak Gupta Acked-by: Alistair Francis --- disas/riscv.c | 40 +++- disas/riscv.h | 1 + 2 files changed

[PATCH v12 13/20] target/riscv: mmu changes for zicfiss shadow stack protection

accesses to RO memory leads to store page fault. To implement special nature of shadow stack memory where only selected stores (shadow stack stores from sspush) have to be allowed while rest of regular stores disallowed, new MMU TLB index is created for shadow stack. Signed-off-by: Deepak Gupta

[PATCH v12 12/20] target/riscv: tb flag for shadow stack instructions

enabled or not. Signed-off-by: Deepak Gupta Co-developed-by: Jim Shu Co-developed-by: Andy Chiu Reviewed-by: Richard Henderson Reviewed-by: Alistair Francis --- target/riscv/cpu.h| 2 ++ target/riscv/cpu_helper.c | 4 target/riscv/translate.c | 3 +++ 3 files changed, 9 insertions

[PATCH v12 01/20] target/riscv: expose *envcfg csr and priv to qemu-user as well

need arises then `henvcfg` could be exposed as well. Relevant discussion: https://lore.kernel.org/all/cakmqykotvwpfep2mstqvdumjerkh+bqcckeq4hanydfpdwk...@mail.gmail.com/ Signed-off-by: Deepak Gupta Suggested-by: Richard Henderson Reviewed-by: Alistair Francis --- target/riscv/cpu.c | 5 + t

[PATCH v12 19/20] disas/riscv: enable disassembly for compressed sspush/sspopchk

sspush and sspopchk have equivalent compressed encoding taken from zcmop. cmop.1 is sspush x1 while cmop.5 is sspopchk x5. Due to unusual encoding for both rs1 and rs2 from space bitfield, this required a new codec. Signed-off-by: Deepak Gupta Acked-by: Alistair Francis --- disas/riscv.c | 19

[PATCH v12 02/20] target/riscv: Add zicfilp extension

: Deepak Gupta Co-developed-by: Jim Shu Co-developed-by: Andy Chiu Reviewed-by: Alistair Francis --- target/riscv/cpu.c | 1 + target/riscv/cpu_cfg.h | 1 + target/riscv/tcg/tcg-cpu.c | 5 + 3 files changed, 7 insertions(+) diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c index

[PATCH v12 06/20] target/riscv: tracking indirect branches (fcfi) for zicfilp

`lpad` gets translated, fcfi_lp_expected flag in DisasContext can be cleared. Else it'll fault. Signed-off-by: Deepak Gupta Co-developed-by: Jim Shu Co-developed-by: Andy Chiu Suggested-by: Richard Henderson Reviewed-by: Richard Henderson Reviewed-by: Alistair Francis --- target/riscv/

[PATCH v12 04/20] target/riscv: save and restore elp state on priv transitions

on *envcfg (for U, VU, S, VU, HS) or mseccfg csr (for M). For qemu-user, a new field `ufcfien` is introduced which is by default set to false and helper function returns value deposited in `ufcfien` for qemu-user. Signed-off-by: Deepak Gupta Co-developed-by: Jim Shu Co-developed-by: Andy Chiu

[PATCH v12 07/20] target/riscv: zicfilp `lpad` impl and branch tracking

`lpad`. If they don't match, cpu raises a sw check exception with tval = 2. Signed-off-by: Deepak Gupta Co-developed-by: Jim Shu Co-developed-by: Andy Chiu Reviewed-by: Richard Henderson Reviewed-by: Alistair Francis --- target/riscv/cpu_user.h | 1 + target/riscv/i

[PATCH v12 03/20] target/riscv: Introduce elp state and enabling controls for zicfilp

te back to NO_LP_EXPECTED. On reset, elp is set to NO_LP_EXPECTED. zicfilp is enabled via bit2 in *envcfg CSRs. Enabling control for M-mode is in mseccfg CSR at bit position 10. On trap, elp state is saved away in *status. Adds elp to the migration state as well. Signed-off-by: Deepak Gupta Co-developed-by: J

Re: [PATCH v11 13/20] target/riscv: mmu changes for zicfiss shadow stack protection

On Thu, Aug 29, 2024 at 10:03:04AM +1000, Alistair Francis wrote: On Thu, Aug 29, 2024 at 9:45 AM Deepak Gupta wrote: On Thu, Aug 29, 2024 at 09:29:49AM +1000, Alistair Francis wrote: >On Thu, Aug 29, 2024 at 3:49 AM Deepak Gupta wrote: >> >> prot |= PAGE_WRITE; >&

Re: [PATCH v11 16/20] target/riscv: implement zicfiss instructions

On Thu, Aug 29, 2024 at 10:07:15AM +1000, Alistair Francis wrote: On Thu, Aug 29, 2024 at 10:06 AM Deepak Gupta wrote: On Thu, Aug 29, 2024 at 10:01:30AM +1000, Alistair Francis wrote: >On Thu, Aug 29, 2024 at 3:53 AM Deepak Gupta wrote: >> >> zicfiss has followi

Re: [PATCH v11 16/20] target/riscv: implement zicfiss instructions

On Thu, Aug 29, 2024 at 10:01:30AM +1000, Alistair Francis wrote: On Thu, Aug 29, 2024 at 3:53 AM Deepak Gupta wrote: zicfiss has following instructions - sspopchk: pops a value from shadow stack and compares with x1/x5. If they dont match, reports a sw check exception with tval = 3

Re: [PATCH v11 13/20] target/riscv: mmu changes for zicfiss shadow stack protection

On Thu, Aug 29, 2024 at 09:29:49AM +1000, Alistair Francis wrote: On Thu, Aug 29, 2024 at 3:49 AM Deepak Gupta wrote: zicfiss protects shadow stack using new page table encodings PTE.W=1, PTE.R=0 and PTE.X=0. This encoding is reserved if zicfiss is not implemented or if shadow stack are not

[PATCH v11 11/20] target/riscv: introduce ssp and enabling controls for zicfiss

not. qemu-user also gets field `ubcfien` indicating whether qemu user has shadow stack enabled or not. Adds ssp to migration state as well. Signed-off-by: Deepak Gupta Co-developed-by: Jim Shu Co-developed-by: Andy Chiu Reviewed-by: Richard Henderson --- target/riscv/cpu.c| 2 ++ targe

[PATCH v11 10/20] target/riscv: Add zicfiss extension

zicfiss [1] riscv cpu extension enables backward control flow integrity. This patch sets up space for zicfiss extension in cpuconfig. And imple- ments dependency on A, zicsr, zimop and zcmop extensions. [1] - https://github.com/riscv/riscv-cfi Signed-off-by: Deepak Gupta Co-developed-by: Jim

Re: [PATCH v11 00/20] riscv support for control flow integrity extensions

On Wed, Aug 28, 2024 at 10:47:18AM -0700, Deepak Gupta wrote: v11 for riscv zicfilp and zicfiss extensions support in qemu. Sorry once again, some problem in my work-flow and it missed picked up below " zicfilp and zicfiss spec pdf https://github.com/riscv/riscv-cfi/releases/download

[PATCH v11 12/20] target/riscv: tb flag for shadow stack instructions

enabled or not. Signed-off-by: Deepak Gupta Co-developed-by: Jim Shu Co-developed-by: Andy Chiu Reviewed-by: Richard Henderson Reviewed-by: Alistair Francis --- target/riscv/cpu.h| 2 ++ target/riscv/cpu_helper.c | 4 target/riscv/translate.c | 4 3 files changed, 10

[PATCH v11 15/20] target/riscv: update `decode_save_opc` to store extra word2

Extra word 2 is stored during tcg compile and `decode_save_opc` needs additional argument in order to pass the value. This will be used during unwind to get extra information about instruction like how to massage exceptions. Updated all callsites as well. Signed-off-by: Deepak Gupta Reviewed-by

[PATCH v11 04/20] target/riscv: save and restore elp state on priv transitions

on *envcfg (for U, VU, S, VU, HS) or mseccfg csr (for M). For qemu-user, a new field `ufcfien` is introduced which is by default set to false and helper function returns value deposited in `ufcfien` for qemu-user. Signed-off-by: Deepak Gupta Co-developed-by: Jim Shu Co-developed-by: Andy Chiu

[PATCH v11 06/20] target/riscv: tracking indirect branches (fcfi) for zicfilp

`lpad` gets translated, fcfi_lp_expected flag in DisasContext can be cleared. Else it'll fault. Signed-off-by: Deepak Gupta Co-developed-by: Jim Shu Co-developed-by: Andy Chiu Suggested-by: Richard Henderson Reviewed-by: Richard Henderson Reviewed-by: Alistair Francis --- target/riscv/

[PATCH v11 09/20] target/riscv: Expose zicfilp extension as a cpu property

Signed-off-by: Deepak Gupta Reviewed-by: Alistair Francis --- target/riscv/cpu.c | 1 + 1 file changed, 1 insertion(+) diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c index 55754cb374..c9aeffee4e 100644 --- a/target/riscv/cpu.c +++ b/target/riscv/cpu.c @@ -1481,6 +1481,7 @@ const

[PATCH v11 20/20] target/riscv: Expose zicfiss extension as a cpu property

Signed-off-by: Deepak Gupta --- target/riscv/cpu.c | 1 + 1 file changed, 1 insertion(+) diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c index c5ebcefeb5..2592465e24 100644 --- a/target/riscv/cpu.c +++ b/target/riscv/cpu.c @@ -1485,6 +1485,7 @@ const RISCVCPUMultiExtConfig

[PATCH v11 08/20] disas/riscv: enable `lpad` disassembly

Signed-off-by: Deepak Gupta Co-developed-by: Jim Shu Co-developed-by: Andy Chiu Reviewed-by: Richard Henderson Reviewed-by: Alistair Francis --- disas/riscv.c | 18 +- disas/riscv.h | 2 ++ 2 files changed, 19 insertions(+), 1 deletion(-) diff --git a/disas/riscv.c b/disas

[PATCH v11 19/20] disas/riscv: enable disassembly for compressed sspush/sspopchk

sspush and sspopchk have equivalent compressed encoding taken from zcmop. cmop.1 is sspush x1 while cmop.5 is sspopchk x5. Due to unusual encoding for both rs1 and rs2 from space bitfield, this required a new codec. Signed-off-by: Deepak Gupta --- disas/riscv.c | 19 ++- disas

[PATCH v11 07/20] target/riscv: zicfilp `lpad` impl and branch tracking

`lpad`. If they don't match, cpu raises a sw check exception with tval = 2. Signed-off-by: Deepak Gupta Co-developed-by: Jim Shu Co-developed-by: Andy Chiu Reviewed-by: Richard Henderson Reviewed-by: Alistair Francis --- target/riscv/cpu_user.h | 1 + target/riscv/i

[PATCH v11 02/20] target/riscv: Add zicfilp extension

: Deepak Gupta Co-developed-by: Jim Shu Co-developed-by: Andy Chiu Reviewed-by: Alistair Francis --- target/riscv/cpu.c | 1 + target/riscv/cpu_cfg.h | 1 + target/riscv/tcg/tcg-cpu.c | 5 + 3 files changed, 7 insertions(+) diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c index

[PATCH v11 17/20] target/riscv: compressed encodings for sspush and sspopchk

sspush/sspopchk have compressed encodings carved out of zcmops. compressed sspush is designated as c.mop.1 while compressed sspopchk is designated as c.mop.5. Note that c.sspush x1 exists while c.sspush x5 doesn't. Similarly c.sspopchk x5 exists while c.sspopchk x1 doesn't. Signed-off-

[PATCH v11 00/20] riscv support for control flow integrity extensions

nd shadow stack instructions to not require helper. - tcg helpers only for cfi violation cases so that trace hooks can be placed. - Style changes. - fixes assert condition in accel/tcg v2: - added missed file (in v1) for shadow stack instructions implementation. Deepak Gupta (20):

[PATCH v11 16/20] target/riscv: implement zicfiss instructions

stack atomically sspopchk/sspush/ssrdp default to zimop if zimop implemented and SSE=0 If SSE=0, ssamoswap is illegal instruction exception. This patch implements shadow stack operations for qemu-user and shadow stack is not protected. Signed-off-by: Deepak Gupta Co-developed-by: Jim Shu Co

[PATCH v11 18/20] disas/riscv: enable disassembly for zicfiss instructions

Enable disassembly for sspush, sspopchk, ssrdp & ssamoswap. Disasembly is only enabled if zimop and zicfiss ext is set to true. Signed-off-by: Deepak Gupta --- disas/riscv.c | 40 +++- disas/riscv.h | 1 + 2 files changed, 40 insertions(+), 1 dele

[PATCH v11 14/20] target/riscv: AMO operations always raise store/AMO fault

This patch adds one more word for tcg compile which can be obtained during unwind time to determine fault type for original operation (example AMO). Depending on that, fault can be promoted to store/AMO fault. Signed-off-by: Deepak Gupta Suggested-by: Richard Henderson Reviewed-by: Richard

[PATCH v11 05/20] target/riscv: additional code information for sw check

`. Signed-off-by: Deepak Gupta Reviewed-by: Richard Henderson Reviewed-by: Alistair Francis --- target/riscv/cpu.h| 2 ++ target/riscv/cpu_helper.c | 3 +++ target/riscv/csr.c| 1 + 3 files changed, 6 insertions(+) diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h index

[PATCH v11 03/20] target/riscv: Introduce elp state and enabling controls for zicfilp

te back to NO_LP_EXPECTED. On reset, elp is set to NO_LP_EXPECTED. zicfilp is enabled via bit2 in *envcfg CSRs. Enabling control for M-mode is in mseccfg CSR at bit position 10. On trap, elp state is saved away in *status. Adds elp to the migration state as well. Signed-off-by: Deepak Gupta Co-developed-by: J

[PATCH v11 13/20] target/riscv: mmu changes for zicfiss shadow stack protection

accesses to RO memory leads to store page fault. To implement special nature of shadow stack memory where only selected stores (shadow stack stores from sspush) have to be allowed while rest of regular stores disallowed, new MMU TLB index is created for shadow stack. Signed-off-by: Deepak Gupta

[PATCH v11 01/20] target/riscv: expose *envcfg csr and priv to qemu-user as well

need arises then `henvcfg` could be exposed as well. Relevant discussion: https://lore.kernel.org/all/cakmqykotvwpfep2mstqvdumjerkh+bqcckeq4hanydfpdwk...@mail.gmail.com/ Signed-off-by: Deepak Gupta Suggested-by: Richard Henderson Reviewed-by: Alistair Francis --- target/riscv/cpu.c | 5 + t

Re: [PATCH v10 02/21] linux-user/riscv: set priv for qemu-user and defaults for *envcfg

On Wed, Aug 28, 2024 at 10:10:44AM +1000, Alistair Francis wrote: On Wed, Aug 28, 2024 at 9:20 AM Deepak Gupta wrote: set priv to be PRV_U for qemu-user on riscv. And set default value for *envcfg CSR. Signed-off-by: Deepak Gupta You can probably just squash this with the previous patch

Re: [PATCH v10 00/21] riscv support for control flow integrity extensions

On Wed, Aug 28, 2024 at 10:02:42AM +1000, Alistair Francis wrote: On Wed, Aug 28, 2024 at 9:21 AM Deepak Gupta wrote: v10 for riscv zicfilp and zicfiss extensions support in qemu. Please specify the exact version of the spec you used https://github.com/riscv/riscv-cfi/releases/download

[PATCH v10 18/21] target/riscv: compressed encodings for sspush and sspopchk

sspush/sspopchk have compressed encodings carved out of zcmops. compressed sspush is designated as c.mop.1 while compressed sspopchk is designated as c.mop.5. Note that c.sspush x1 exists while c.sspush x5 doesn't. Similarly c.sspopchk x5 exists while c.sspopchk x1 doesn't. Signed-off-

[PATCH v10 16/21] target/riscv: update `decode_save_opc` to store extra word2

Extra word 2 is stored during tcg compile and `decode_save_opc` needs additional argument in order to pass the value. This will be used during unwind to get extra information about instruction like how to massage exceptions. Updated all callsites as well. Signed-off-by: Deepak Gupta Reviewed-by

[PATCH v10 12/21] target/riscv: introduce ssp and enabling controls for zicfiss

not. qemu-user also gets field `ubcfien` indicating whether qemu user has shadow stack enabled or not. Adds ssp to migration state as well. Signed-off-by: Deepak Gupta Co-developed-by: Jim Shu Co-developed-by: Andy Chiu Reviewed-by: Richard Henderson --- target/riscv/cpu.c| 3 +++ targe

[PATCH v10 14/21] target/riscv: mmu changes for zicfiss shadow stack protection

accesses to RO memory leads to store page fault. To implement special nature of shadow stack memory where only selected stores (shadow stack stores from sspush) have to be allowed while rest of regular stores disallowed, new MMU TLB index is created for shadow stack. Signed-off-by: Deepak Gupta

[PATCH v10 15/21] target/riscv: AMO operations always raise store/AMO fault

This patch adds one more word for tcg compile which can be obtained during unwind time to determine fault type for original operation (example AMO). Depending on that, fault can be promoted to store/AMO fault. Signed-off-by: Deepak Gupta Suggested-by: Richard Henderson Reviewed-by: Richard

[PATCH v10 19/21] disas/riscv: enable disassembly for zicfiss instructions

Enable disassembly for sspush, sspopchk, ssrdp & ssamoswap. Disasembly is only enabled if zimop and zicfiss ext is set to true. Signed-off-by: Deepak Gupta --- disas/riscv.c | 40 +++- disas/riscv.h | 1 + 2 files changed, 40 insertions(+), 1 dele

[PATCH v10 10/21] target/riscv: Expose zicfilp extension as a cpu property

Signed-off-by: Deepak Gupta --- target/riscv/cpu.c | 1 + 1 file changed, 1 insertion(+) diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c index 2d031e3e74..8e1f05e5b1 100644 --- a/target/riscv/cpu.c +++ b/target/riscv/cpu.c @@ -1476,6 +1476,7 @@ const RISCVCPUMultiExtConfig

  1   2   3   4   >