From patchwork Thu Jul 25 23:45:50 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Deepak Gupta X-Patchwork-Id: 13742222 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 591EEC3DA70 for ; Thu, 25 Jul 2024 23:48:07 +0000 (UTC) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1sX8AL-0008DP-Fj; Thu, 25 Jul 2024 19:46:34 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1sX8AH-00083i-Pc for qemu-devel@nongnu.org; Thu, 25 Jul 2024 19:46:29 -0400 Received: from mail-oi1-x231.google.com ([2607:f8b0:4864:20::231]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.90_1) (envelope-from ) id 1sX8AE-0005IZ-7l for qemu-devel@nongnu.org; Thu, 25 Jul 2024 19:46:29 -0400 Received: by mail-oi1-x231.google.com with SMTP id 5614622812f47-3dab2bb288aso250929b6e.3 for ; Thu, 25 Jul 2024 16:46:25 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rivosinc-com.20230601.gappssmtp.com; s=20230601; t=1721951185; x=1722555985; darn=nongnu.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=/xTvsa+ViAqHINj5oJb/iz6qO9j2BBr+FG4wAjwt7ac=; b=QbImNRWQF92iN1dy1qoYRcJ2E+ZWuvACA2fiZwaNL8e55mN5uq8lt1x7SJiRAKJdPj //MBSC1gE3p2m1EwPiOt8+kZHV8UfyWGpsch/jA/JmHwMeHgEX/egv1FnwymCv78jlTe l6eqJN08T3qrEK+j7rbgFjIB+dw6iwmWm5LrN4efF/KMrxaKqwQeUEP/g0n628XWZRgU RjPBKgfdmEEJF3NcK3kzhrGsCkpdwjGu9NShhmto10Uxos82fpgA+VHOOBf0V91pKiIs Jsc5f2lhvFWFHsPZrlGtacVKyoT/9N9NYUHrIv3nqv2Q3DhOBplQzdXwnAEKsAGVDu1i mZZw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1721951185; x=1722555985; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=/xTvsa+ViAqHINj5oJb/iz6qO9j2BBr+FG4wAjwt7ac=; b=Nvq1f6jLK888XEJjdvXDso2A07yOEZt7f6Xav9aq19ywS7EMxtkMe9ZhR2m5bEmpoI utphg4KZ6Q/fNY0xXSRdv/SpJ78vN2LzZ/TCHGEvfS0L+8SLknatJVi/CTH2c2tNA5b9 vHLIl0YUUXxaAlZvTOVqjOT/MgwSfhqGr7zjWpVy7uTK7iF6HsIIOLephXp63YD1pQjD q1E4cHnt4yBjtlgPx7JBEg5+EsNhfju6JNXlOW3m4dM8OgVNcoPL6RF2zk1D7zfXxT0K fMdQCFMNEgTKBF4nAXLBcDQbeRAmb/gj4UWw3QkL+pwBJCFaERFgwR5yC1UsOs1bTKgl QY7A== X-Forwarded-Encrypted: i=1; AJvYcCVWD/IvCtR/OeRcMioHRcFBaav6axlsioaD257Ic31NFjfnm1lIz0HZbilS2fpobrYSixUJgiDbtpoY4GF0qj8b+w+4kHQ= X-Gm-Message-State: AOJu0YyIXObaqnBqUsMSgcbFtn/LKHOWn/Uc5rKBc4/CeHX1aOpZvBp8 9IojBoWBdJyCOBpravFj8F/dO//iMlksW2F3d8lDn3qwrgB8VX7SYvPV+3EieOo= X-Google-Smtp-Source: AGHT+IF9c6DrFoS7puuzom5O4/8UPSBG6KAlBvIUwJ9SzEuALplCBJGnoVj5PaX4B08eEeiBXHubnA== X-Received: by 2002:a05:6808:144c:b0:3db:1576:70f4 with SMTP id 5614622812f47-3db157671d5mr4629964b6e.16.1721951185008; Thu, 25 Jul 2024 16:46:25 -0700 (PDT) Received: from debug.ba.rivosinc.com ([64.71.180.162]) by smtp.gmail.com with ESMTPSA id d2e1a72fcca58-70ead8128d0sm1647565b3a.118.2024.07.25.16.46.23 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 25 Jul 2024 16:46:24 -0700 (PDT) From: Deepak Gupta To: qemu-riscv@nongnu.org, qemu-devel@nongnu.org, jim.shu@sifive.com, andy.chiu@sifive.com, jesse.huang@sifive.com, kito.cheng@sifive.com Cc: palmer@dabbelt.com, Alistair.Francis@wdc.com, laurent@vivier.eu, bmeng.cn@gmail.com, liwei1518@gmail.com, dbarboza@ventanamicro.com, zhiwei_liu@linux.alibaba.com, Deepak Gupta Subject: [PATCH 01/24] target/riscv: Add zicfilp extension Date: Thu, 25 Jul 2024 16:45:50 -0700 Message-ID: <20240725234614.3850142-2-debug@rivosinc.com> X-Mailer: git-send-email 2.44.0 In-Reply-To: <20240725234614.3850142-1-debug@rivosinc.com> References: <20240725234614.3850142-1-debug@rivosinc.com> MIME-Version: 1.0 Received-SPF: pass client-ip=2607:f8b0:4864:20::231; envelope-from=debug@rivosinc.com; helo=mail-oi1-x231.google.com X-Spam_score_int: -18 X-Spam_score: -1.9 X-Spam_bar: - X-Spam_report: (-1.9 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=unavailable autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+qemu-devel=archiver.kernel.org@nongnu.org Sender: qemu-devel-bounces+qemu-devel=archiver.kernel.org@nongnu.org zicfilp [1] riscv cpu extension enables forward control flow integrity. If enabled, all indirect calls must land on a landing pad instruction. This patch sets up space for zicfilp extension in cpuconfig. zicfilp is dependend on zicsr. [1] - https://github.com/riscv/riscv-cfi Signed-off-by: Deepak Gupta Co-developed-by: Jim Shu Co-developed-by: Andy Chiu --- target/riscv/cpu.c | 2 ++ target/riscv/cpu_cfg.h | 1 + target/riscv/tcg/tcg-cpu.c | 5 +++++ 3 files changed, 8 insertions(+) diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c index 33ef4eb795..5dfb3f39ab 100644 --- a/target/riscv/cpu.c +++ b/target/riscv/cpu.c @@ -106,6 +106,7 @@ const RISCVIsaExtData isa_edata_arr[] = { ISA_EXT_DATA_ENTRY(ziccif, PRIV_VERSION_1_11_0, has_priv_1_11), ISA_EXT_DATA_ENTRY(zicclsm, PRIV_VERSION_1_11_0, has_priv_1_11), ISA_EXT_DATA_ENTRY(ziccrse, PRIV_VERSION_1_11_0, has_priv_1_11), + ISA_EXT_DATA_ENTRY(zicfilp, PRIV_VERSION_1_12_0, ext_zicfilp), ISA_EXT_DATA_ENTRY(zicond, PRIV_VERSION_1_12_0, ext_zicond), ISA_EXT_DATA_ENTRY(zicntr, PRIV_VERSION_1_12_0, ext_zicntr), ISA_EXT_DATA_ENTRY(zicsr, PRIV_VERSION_1_10_0, ext_zicsr), @@ -1472,6 +1473,7 @@ const RISCVCPUMultiExtConfig riscv_cpu_extensions[] = { /* Defaults for standard extensions */ MULTI_EXT_CFG_BOOL("sscofpmf", ext_sscofpmf, false), MULTI_EXT_CFG_BOOL("zifencei", ext_zifencei, true), + MULTI_EXT_CFG_BOOL("zicfilp", ext_zicfilp, false), MULTI_EXT_CFG_BOOL("zicsr", ext_zicsr, true), MULTI_EXT_CFG_BOOL("zihintntl", ext_zihintntl, true), MULTI_EXT_CFG_BOOL("zihintpause", ext_zihintpause, true), diff --git a/target/riscv/cpu_cfg.h b/target/riscv/cpu_cfg.h index 120905a254..88d5defbb5 100644 --- a/target/riscv/cpu_cfg.h +++ b/target/riscv/cpu_cfg.h @@ -67,6 +67,7 @@ struct RISCVCPUConfig { bool ext_zicbom; bool ext_zicbop; bool ext_zicboz; + bool ext_zicfilp; bool ext_zicond; bool ext_zihintntl; bool ext_zihintpause; diff --git a/target/riscv/tcg/tcg-cpu.c b/target/riscv/tcg/tcg-cpu.c index b8814ab753..ed19586c9d 100644 --- a/target/riscv/tcg/tcg-cpu.c +++ b/target/riscv/tcg/tcg-cpu.c @@ -623,6 +623,11 @@ void riscv_cpu_validate_set_extensions(RISCVCPU *cpu, Error **errp) cpu->pmu_avail_ctrs = 0; } + if (cpu->cfg.ext_zicfilp && !cpu->cfg.ext_zicsr) { + error_setg(errp, "zicfilp extension requires zicsr extension"); + return; + } + /* * Disable isa extensions based on priv spec after we * validated and set everything we need. From patchwork Thu Jul 25 23:45:51 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Deepak Gupta X-Patchwork-Id: 13742218 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 93833C3DA70 for ; Thu, 25 Jul 2024 23:47:34 +0000 (UTC) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1sX8AN-0008Kc-5h; Thu, 25 Jul 2024 19:46:35 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1sX8AI-00085F-7s for qemu-devel@nongnu.org; Thu, 25 Jul 2024 19:46:30 -0400 Received: from mail-oi1-x231.google.com ([2607:f8b0:4864:20::231]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.90_1) (envelope-from ) id 1sX8AF-0005Ir-PU for qemu-devel@nongnu.org; Thu, 25 Jul 2024 19:46:29 -0400 Received: by mail-oi1-x231.google.com with SMTP id 5614622812f47-3db157d3bb9so239418b6e.2 for ; Thu, 25 Jul 2024 16:46:27 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rivosinc-com.20230601.gappssmtp.com; s=20230601; t=1721951186; x=1722555986; darn=nongnu.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=WXmmy9sQ6FdCwxmbQ1lXp5QB1YPROEJt1Bgbzc7d8Dg=; b=LZONunHW+RZGkjLLWk+hamP4hLhSri3vWJW98qnTPJrm88HilnG9909Y7nz/4WnQZr a1GgBryWRtpjIUwptoKtSv8mr4zUdbXyidEJtx+32vjP1zBghhQ2vGyqq3G6outJ7//E gHYMIjhXuBq55DRYH0hth1MJBNtGrVQ71JPsEOyWoyptTFFZHLIoGd6xwFKMgxdeQYvA 4BGrzBPvEPnZqloX/XitZLO/dQ3pJvx56UHCqGrbAqxORa9CdtZlCeZ+ywuZruPUYpDK CKyd+T3OzuuebJJEnGyNt8YL6hQHc+7UvUmBiUznEpyWBTAS3zveZkd/hOH0bTrmB+fz h+/g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1721951186; x=1722555986; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=WXmmy9sQ6FdCwxmbQ1lXp5QB1YPROEJt1Bgbzc7d8Dg=; b=R4OI0iuTQUu4fzWElKjtJ+do9W4SWTfspNRXgBRdCbrIDsufj0pGI/QOxLee2dNqPV 3JfOoK7sbJMYXu4p/eSve7J1Q2gPQR+raRE1IXKbENIdeyMnIx8Z5j+4S02pM6D+S/z6 xXGRNiBcae44/WhJ6lu0rOV1DzbF+B90qkbIhP2CGm/GsvZVBnfYFiSdYfM3KQffMRjU zZEG8ofqQQWA3HqEBc5SqzYM20mprotZt5kIS2wT1rSUW1r0UfiBFgMYfhnSsOT81gaR MgY2JwfaSN35UV77EO/Bni0LvHGQbQSrscCn/Dhzb3WEgbM7+zFshKBgZ3C5fwZ+TByk fPbQ== X-Forwarded-Encrypted: i=1; AJvYcCVtaBJ/KhkR5bZ7uClmBHMEtTsDG5R93PqFXbp7ht0SDqDyXlnB4g5y4YVovU3LVwSPobMjQldrfTKJ1aLDuuKxkPzpzdI= X-Gm-Message-State: AOJu0YyZXA7g3e5aCTy+dto2ilOlxob7lkj6qpgkbivydLgmz3kJdLQi qePnwQd1keai5D7prw2YpDanxnoyRgbtqE3SU5ShXWBh2OER0SXutKwzA1KYCCk= X-Google-Smtp-Source: AGHT+IHTcTV049RgkkheDTV4ydvBUYxsIoXRmfn7ShZIbpMd59GBBzcSEwkAxSaqQT5nyf2pidtgzw== X-Received: by 2002:a05:6808:e8e:b0:3d9:dd93:9902 with SMTP id 5614622812f47-3db140e7badmr3649863b6e.14.1721951186239; Thu, 25 Jul 2024 16:46:26 -0700 (PDT) Received: from debug.ba.rivosinc.com ([64.71.180.162]) by smtp.gmail.com with ESMTPSA id d2e1a72fcca58-70ead8128d0sm1647565b3a.118.2024.07.25.16.46.25 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 25 Jul 2024 16:46:25 -0700 (PDT) From: Deepak Gupta To: qemu-riscv@nongnu.org, qemu-devel@nongnu.org, jim.shu@sifive.com, andy.chiu@sifive.com, jesse.huang@sifive.com, kito.cheng@sifive.com Cc: palmer@dabbelt.com, Alistair.Francis@wdc.com, laurent@vivier.eu, bmeng.cn@gmail.com, liwei1518@gmail.com, dbarboza@ventanamicro.com, zhiwei_liu@linux.alibaba.com, Deepak Gupta Subject: [PATCH 02/24] target/riscv: Introduce elp state and enabling controls for zicfilp Date: Thu, 25 Jul 2024 16:45:51 -0700 Message-ID: <20240725234614.3850142-3-debug@rivosinc.com> X-Mailer: git-send-email 2.44.0 In-Reply-To: <20240725234614.3850142-1-debug@rivosinc.com> References: <20240725234614.3850142-1-debug@rivosinc.com> MIME-Version: 1.0 Received-SPF: pass client-ip=2607:f8b0:4864:20::231; envelope-from=debug@rivosinc.com; helo=mail-oi1-x231.google.com X-Spam_score_int: -18 X-Spam_score: -1.9 X-Spam_bar: - X-Spam_report: (-1.9 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=unavailable autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+qemu-devel=archiver.kernel.org@nongnu.org Sender: qemu-devel-bounces+qemu-devel=archiver.kernel.org@nongnu.org zicfilp introduces a new state elp ("expected landing pad") in cpu. During normal execution, elp is idle (NO_LP_EXPECTED) i.e not expecting landing pad. On an indirect call, elp moves LP_EXPECTED. When elp is LP_EXPECTED, only a subsquent landing pad instruction can set state back to NO_LP_EXPECTED. On reset, elp is set to NO_LP_EXPECTED. zicfilp is enabled via bit2 in *envcfg CSRs. Enabling control for M-mode is in mseccfg CSR at bit position 10. On trap, elp state is saved away in *status. Signed-off-by: Deepak Gupta Co-developed-by: Jim Shu Co-developed-by: Andy Chiu --- target/riscv/cpu.c | 3 +++ target/riscv/cpu.h | 2 ++ target/riscv/cpu_bits.h | 12 ++++++++++++ target/riscv/csr.c | 31 +++++++++++++++++++++++++++++++ target/riscv/pmp.c | 5 +++++ target/riscv/pmp.h | 3 ++- 6 files changed, 55 insertions(+), 1 deletion(-) diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c index 5dfb3f39ab..82fa85a8d6 100644 --- a/target/riscv/cpu.c +++ b/target/riscv/cpu.c @@ -994,6 +994,9 @@ static void riscv_cpu_reset_hold(Object *obj, ResetType type) /* mmte is supposed to have pm.current hardwired to 1 */ env->mmte |= (EXT_STATUS_INITIAL | MMTE_M_PM_CURRENT); + /* on reset elp is set to NO_LP_EXPECTED */ + env->elp = NO_LP_EXPECTED; + /* * Bits 10, 6, 2 and 12 of mideleg are read only 1 when the Hypervisor * extension is enabled. diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h index 87742047ce..ae436a3179 100644 --- a/target/riscv/cpu.h +++ b/target/riscv/cpu.h @@ -222,6 +222,8 @@ struct CPUArchState { target_ulong jvt; + /* elp state for zicfilp extension */ + cfi_elp elp; #ifdef CONFIG_USER_ONLY uint32_t elf_flags; #endif diff --git a/target/riscv/cpu_bits.h b/target/riscv/cpu_bits.h index c257c5ed7d..127f2179dc 100644 --- a/target/riscv/cpu_bits.h +++ b/target/riscv/cpu_bits.h @@ -545,6 +545,8 @@ #define MSTATUS_TVM 0x00100000 /* since: priv-1.10 */ #define MSTATUS_TW 0x00200000 /* since: priv-1.10 */ #define MSTATUS_TSR 0x00400000 /* since: priv-1.10 */ +#define MSTATUS_SPELP 0x00800000 /* zicfilp */ +#define MSTATUS_MPELP 0x020000000000 /* zicfilp */ #define MSTATUS_GVA 0x4000000000ULL #define MSTATUS_MPV 0x8000000000ULL @@ -575,12 +577,19 @@ typedef enum { #define SSTATUS_XS 0x00018000 #define SSTATUS_SUM 0x00040000 /* since: priv-1.10 */ #define SSTATUS_MXR 0x00080000 +#define SSTATUS_SPELP MSTATUS_SPELP /* zicfilp */ #define SSTATUS64_UXL 0x0000000300000000ULL #define SSTATUS32_SD 0x80000000 #define SSTATUS64_SD 0x8000000000000000ULL +/* enum for branch tracking state in cpu/hart */ +typedef enum { + NO_LP_EXPECTED = 0, + LP_EXPECTED = 1, +} cfi_elp; + /* hstatus CSR bits */ #define HSTATUS_VSBE 0x00000020 #define HSTATUS_GVA 0x00000040 @@ -747,6 +756,7 @@ typedef enum RISCVException { /* Execution environment configuration bits */ #define MENVCFG_FIOM BIT(0) +#define MENVCFG_LPE BIT(2) /* zicfilp */ #define MENVCFG_CBIE (3UL << 4) #define MENVCFG_CBCFE BIT(6) #define MENVCFG_CBZE BIT(7) @@ -760,11 +770,13 @@ typedef enum RISCVException { #define MENVCFGH_STCE BIT(31) #define SENVCFG_FIOM MENVCFG_FIOM +#define SENVCFG_LPE MENVCFG_LPE #define SENVCFG_CBIE MENVCFG_CBIE #define SENVCFG_CBCFE MENVCFG_CBCFE #define SENVCFG_CBZE MENVCFG_CBZE #define HENVCFG_FIOM MENVCFG_FIOM +#define HENVCFG_LPE MENVCFG_LPE #define HENVCFG_CBIE MENVCFG_CBIE #define HENVCFG_CBCFE MENVCFG_CBCFE #define HENVCFG_CBZE MENVCFG_CBZE diff --git a/target/riscv/csr.c b/target/riscv/csr.c index 432c59dc66..5771a14848 100644 --- a/target/riscv/csr.c +++ b/target/riscv/csr.c @@ -1400,6 +1400,11 @@ static RISCVException write_mstatus(CPURISCVState *env, int csrno, } } + /* If cfi lp extension is available, then apply cfi lp mask */ + if (env_archcpu(env)->cfg.ext_zicfilp) { + mask |= (MSTATUS_MPELP | MSTATUS_SPELP); + } + mstatus = (mstatus & ~mask) | (val & mask); env->mstatus = mstatus; @@ -2101,6 +2106,10 @@ static RISCVException write_menvcfg(CPURISCVState *env, int csrno, mask |= (cfg->ext_svpbmt ? MENVCFG_PBMTE : 0) | (cfg->ext_sstc ? MENVCFG_STCE : 0) | (cfg->ext_svadu ? MENVCFG_ADUE : 0); + + if (env_archcpu(env)->cfg.ext_zicfilp) { + mask |= MENVCFG_LPE; + } } env->menvcfg = (env->menvcfg & ~mask) | (val & mask); @@ -2153,6 +2162,10 @@ static RISCVException write_senvcfg(CPURISCVState *env, int csrno, return ret; } + if (env_archcpu(env)->cfg.ext_zicfilp) { + mask |= SENVCFG_LPE; + } + env->senvcfg = (env->senvcfg & ~mask) | (val & mask); return RISCV_EXCP_NONE; } @@ -2190,6 +2203,10 @@ static RISCVException write_henvcfg(CPURISCVState *env, int csrno, if (riscv_cpu_mxl(env) == MXL_RV64) { mask |= env->menvcfg & (HENVCFG_PBMTE | HENVCFG_STCE | HENVCFG_ADUE); + + if (env_archcpu(env)->cfg.ext_zicfilp) { + mask |= HENVCFG_LPE; + } } env->henvcfg = (env->henvcfg & ~mask) | (val & mask); @@ -2654,6 +2671,10 @@ static RISCVException read_sstatus_i128(CPURISCVState *env, int csrno, mask |= SSTATUS64_UXL; } + if (env_archcpu(env)->cfg.ext_zicfilp) { + mask |= SSTATUS_SPELP; + } + *val = int128_make128(sstatus, add_status_sd(MXL_RV128, sstatus)); return RISCV_EXCP_NONE; } @@ -2665,6 +2686,11 @@ static RISCVException read_sstatus(CPURISCVState *env, int csrno, if (env->xl != MXL_RV32 || env->debugger) { mask |= SSTATUS64_UXL; } + + if (env_archcpu(env)->cfg.ext_zicfilp) { + mask |= SSTATUS_SPELP; + } + /* TODO: Use SXL not MXL. */ *val = add_status_sd(riscv_cpu_mxl(env), env->mstatus & mask); return RISCV_EXCP_NONE; @@ -2680,6 +2706,11 @@ static RISCVException write_sstatus(CPURISCVState *env, int csrno, mask |= SSTATUS64_UXL; } } + + if (env_archcpu(env)->cfg.ext_zicfilp) { + mask |= SSTATUS_SPELP; + } + target_ulong newval = (env->mstatus & ~mask) | (val & mask); return write_mstatus(env, CSR_MSTATUS, newval); } diff --git a/target/riscv/pmp.c b/target/riscv/pmp.c index 9eea397e72..1111d08d08 100644 --- a/target/riscv/pmp.c +++ b/target/riscv/pmp.c @@ -598,6 +598,11 @@ void mseccfg_csr_write(CPURISCVState *env, target_ulong val) val &= ~(MSECCFG_MMWP | MSECCFG_MML | MSECCFG_RLB); } + /* M-mode forward cfi to be enabled if cfi extension is implemented */ + if (env_archcpu(env)->cfg.ext_zicfilp) { + val |= (val & MSECCFG_MLPE); + } + env->mseccfg = val; } diff --git a/target/riscv/pmp.h b/target/riscv/pmp.h index f5c10ce85c..e0530a17a3 100644 --- a/target/riscv/pmp.h +++ b/target/riscv/pmp.h @@ -44,7 +44,8 @@ typedef enum { MSECCFG_MMWP = 1 << 1, MSECCFG_RLB = 1 << 2, MSECCFG_USEED = 1 << 8, - MSECCFG_SSEED = 1 << 9 + MSECCFG_SSEED = 1 << 9, + MSECCFG_MLPE = 1 << 10, } mseccfg_field_t; typedef struct { From patchwork Thu Jul 25 23:45:52 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Deepak Gupta X-Patchwork-Id: 13742217 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 060C1C3DA49 for ; Thu, 25 Jul 2024 23:47:26 +0000 (UTC) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1sX8AR-0008Tj-Qe; Thu, 25 Jul 2024 19:46:39 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1sX8AJ-00088Q-N4 for qemu-devel@nongnu.org; Thu, 25 Jul 2024 19:46:32 -0400 Received: from mail-pf1-x42b.google.com ([2607:f8b0:4864:20::42b]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.90_1) (envelope-from ) id 1sX8AH-0005JC-Cm for qemu-devel@nongnu.org; Thu, 25 Jul 2024 19:46:31 -0400 Received: by mail-pf1-x42b.google.com with SMTP id d2e1a72fcca58-70d18112b60so270759b3a.1 for ; Thu, 25 Jul 2024 16:46:28 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rivosinc-com.20230601.gappssmtp.com; s=20230601; t=1721951188; x=1722555988; darn=nongnu.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=N5/LzlqpvA6Qpq2davUTlla9GHONddj7cGNIIGXRrAY=; b=EGnfzez8FAtSF/LvNq0mN8nIta792KkZM6ygxMk1I7EZ4iYT3Er8lR4DK8IAC1IgM4 s1U1GTpbP2Ro1gnL9v+xVIYR0QUsb1s7H9zl6Zm+N2oCTuU53m/aMpBxLmVwVBEUOBUn sHAJbKa3XzFdmpafeQzX/w/x51515xvOr9HDxw7begJN42A2Apf8pejviDQOT0FW6cFy nRaMyByZ1djGbEmV55vvtpWUW6p1CymOjp2l245Txg7CPPO8MrHqqAxMmJFc4/JUszNZ ZwZOXefQTd8tnPMhHneI2SY50DiFnjfOHf+KX+J6mojMsOUWSq3PFWC5281bDCMSkpmx KhNA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1721951188; x=1722555988; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=N5/LzlqpvA6Qpq2davUTlla9GHONddj7cGNIIGXRrAY=; b=Wz5bFcA1whmPtTM0+hjE/jwlVsnpRdZLJdVaYXp8tPRbrFpDyZwq3uKGzehR0RIVjT z/OTwCkC3GK9+6N9ZNX8WQcUdWUrhG/tgLtFzeQKxe8VcBJA9ZPBMHlsFjgBAHEM4Gs9 rl37rvyYshnaCYArPcWETEbW/TirMHY7uCs/1o6t/jxXQpTMHvLd+DhTQS16+u+9m2Q5 l6TCiJG4surYUKxgiVJwk+5ZH3TBXyI6sgcEH1uTgbWsqGnq7VPVrS52hDPHGkdola4C wGuxVqKiZuSNfQIhNdzm6PqmDNRa5VLMBUoKN6hLfJGAfksRWYCTkkZOcqdZ5yUg/fm+ nE8A== X-Forwarded-Encrypted: i=1; AJvYcCUlB2zRY7AkyHYwJjAu05saOVfApHnedNAm2jqO7tJ8luczoIjzeXplddH427MRozEUZJ1pbnO5E4ctpBfFowZrSggvLp0= X-Gm-Message-State: AOJu0Yydzi2LQxrSu6au/xI+ursESVq/hnWBbj91j+GyRGl2BkZp/nAq 7QerCBw4o63CIXmhU7HU3ltRAVFhzcVsYpZdV+uce5kk798rKkHsYqywVCPQWNk= X-Google-Smtp-Source: AGHT+IFBqhysi68bLUQV086iTm3yE5nlNw7zltSHSJVZBu+v32rdNAuL3GnW3+EAxDzW3uoRIzh83A== X-Received: by 2002:aa7:88cd:0:b0:70e:aa44:39df with SMTP id d2e1a72fcca58-70eaa443bb0mr7472375b3a.1.1721951187577; Thu, 25 Jul 2024 16:46:27 -0700 (PDT) Received: from debug.ba.rivosinc.com ([64.71.180.162]) by smtp.gmail.com with ESMTPSA id d2e1a72fcca58-70ead8128d0sm1647565b3a.118.2024.07.25.16.46.26 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 25 Jul 2024 16:46:27 -0700 (PDT) From: Deepak Gupta To: qemu-riscv@nongnu.org, qemu-devel@nongnu.org, jim.shu@sifive.com, andy.chiu@sifive.com, jesse.huang@sifive.com, kito.cheng@sifive.com Cc: palmer@dabbelt.com, Alistair.Francis@wdc.com, laurent@vivier.eu, bmeng.cn@gmail.com, liwei1518@gmail.com, dbarboza@ventanamicro.com, zhiwei_liu@linux.alibaba.com, Deepak Gupta Subject: [PATCH 03/24] target/riscv: save and restore elp state on priv transitions Date: Thu, 25 Jul 2024 16:45:52 -0700 Message-ID: <20240725234614.3850142-4-debug@rivosinc.com> X-Mailer: git-send-email 2.44.0 In-Reply-To: <20240725234614.3850142-1-debug@rivosinc.com> References: <20240725234614.3850142-1-debug@rivosinc.com> MIME-Version: 1.0 Received-SPF: pass client-ip=2607:f8b0:4864:20::42b; envelope-from=debug@rivosinc.com; helo=mail-pf1-x42b.google.com X-Spam_score_int: -18 X-Spam_score: -1.9 X-Spam_bar: - X-Spam_report: (-1.9 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=unavailable autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+qemu-devel=archiver.kernel.org@nongnu.org Sender: qemu-devel-bounces+qemu-devel=archiver.kernel.org@nongnu.org elp state is recorded in *status on trap entry (less privilege to higher privilege) and restored in elp from *status on trap exit (higher to less privilege). Additionally this patch introduces a forward cfi helper function to determine if current privilege has forward cfi is enabled or not based on *envcfg (for U, VU, S, VU, HS) or mseccfg csr (for M). For qemu-user, a new field `ufcfien` is introduced which is by default set to false and helper function returns value deposited in `ufcfien` for qemu-user. Signed-off-by: Deepak Gupta Co-developed-by: Jim Shu Co-developed-by: Andy Chiu --- target/riscv/cpu.c | 5 ++++ target/riscv/cpu.h | 2 ++ target/riscv/cpu_helper.c | 58 +++++++++++++++++++++++++++++++++++++++ target/riscv/op_helper.c | 18 ++++++++++++ 4 files changed, 83 insertions(+) diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c index 82fa85a8d6..e1526c7ab5 100644 --- a/target/riscv/cpu.c +++ b/target/riscv/cpu.c @@ -1022,6 +1022,11 @@ static void riscv_cpu_reset_hold(Object *obj, ResetType type) env->load_res = -1; set_default_nan_mode(1, &env->fp_status); +#ifdef CONFIG_USER_ONLY + /* qemu-user for riscv, fcfi is off by default */ + env->ufcfien = false; +#endif + #ifndef CONFIG_USER_ONLY if (cpu->cfg.debug) { riscv_trigger_reset_hold(env); diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h index ae436a3179..8c7841fc08 100644 --- a/target/riscv/cpu.h +++ b/target/riscv/cpu.h @@ -226,6 +226,7 @@ struct CPUArchState { cfi_elp elp; #ifdef CONFIG_USER_ONLY uint32_t elf_flags; + bool ufcfien; #endif #ifndef CONFIG_USER_ONLY @@ -530,6 +531,7 @@ void riscv_cpu_set_geilen(CPURISCVState *env, target_ulong geilen); bool riscv_cpu_vector_enabled(CPURISCVState *env); void riscv_cpu_set_virt_enabled(CPURISCVState *env, bool enable); int riscv_env_mmu_index(CPURISCVState *env, bool ifetch); +bool cpu_get_fcfien(CPURISCVState *env); G_NORETURN void riscv_cpu_do_unaligned_access(CPUState *cs, vaddr addr, MMUAccessType access_type, int mmu_idx, uintptr_t retaddr); diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c index 6709622dd3..fb4b6066d3 100644 --- a/target/riscv/cpu_helper.c +++ b/target/riscv/cpu_helper.c @@ -33,6 +33,7 @@ #include "cpu_bits.h" #include "debug.h" #include "tcg/oversized-guest.h" +#include "pmp.h" int riscv_env_mmu_index(CPURISCVState *env, bool ifetch) { @@ -63,6 +64,35 @@ int riscv_env_mmu_index(CPURISCVState *env, bool ifetch) #endif } +bool cpu_get_fcfien(CPURISCVState *env) +{ +#ifdef CONFIG_USER_ONLY + return env->ufcfien; +#else + /* no cfi extension, return false */ + if (!env_archcpu(env)->cfg.ext_zicfilp) { + return false; + } + + switch (env->priv) { + case PRV_U: + if (riscv_has_ext(env, RVS)) { + return (env->senvcfg & MENVCFG_LPE) ? true : false; + } + return (env->menvcfg & MENVCFG_LPE) ? true : false; + case PRV_S: + if (env->virt_enabled) { + return (env->henvcfg & HENVCFG_LPE) ? true : false; + } + return (env->menvcfg & MENVCFG_LPE) ? true : false; + case PRV_M: + return (env->mseccfg & MSECCFG_MLPE) ? true : false; + default: + g_assert_not_reached(); + } +#endif +} + void cpu_get_tb_cpu_state(CPURISCVState *env, vaddr *pc, uint64_t *cs_base, uint32_t *pflags) { @@ -546,6 +576,15 @@ void riscv_cpu_swap_hypervisor_regs(CPURISCVState *env) } bool current_virt = env->virt_enabled; + /* + * If zicfilp extension available and henvcfg.LPE = 1, + * then apply SPELP mask on mstatus + */ + if (env_archcpu(env)->cfg.ext_zicfilp && + get_field(env->henvcfg, HENVCFG_LPE)) { + mstatus_mask |= SSTATUS_SPELP; + } + g_assert(riscv_has_ext(env, RVH)); if (current_virt) { @@ -1754,6 +1793,11 @@ void riscv_cpu_do_interrupt(CPUState *cs) if (env->priv <= PRV_S && cause < 64 && (((deleg >> cause) & 1) || s_injected || vs_injected)) { /* handle the trap in S-mode */ + /* save elp status */ + if (cpu_get_fcfien(env)) { + env->mstatus = set_field(env->mstatus, MSTATUS_SPELP, env->elp); + } + if (riscv_has_ext(env, RVH)) { uint64_t hdeleg = async ? env->hideleg : env->hedeleg; @@ -1802,6 +1846,11 @@ void riscv_cpu_do_interrupt(CPUState *cs) riscv_cpu_set_mode(env, PRV_S); } else { /* handle the trap in M-mode */ + /* save elp status */ + if (cpu_get_fcfien(env)) { + env->mstatus = set_field(env->mstatus, MSTATUS_MPELP, env->elp); + } + if (riscv_has_ext(env, RVH)) { if (env->virt_enabled) { riscv_cpu_swap_hypervisor_regs(env); @@ -1833,6 +1882,15 @@ void riscv_cpu_do_interrupt(CPUState *cs) riscv_cpu_set_mode(env, PRV_M); } + /* + * Interrupt/exception/trap delivery is asynchronous event and as per + * Zisslpcfi spec CPU should clear up the ELP state. If cfi extension is + * available, clear ELP state. + */ + + if (cpu->cfg.ext_zicfilp) { + env->elp = NO_LP_EXPECTED; + } /* * NOTE: it is not necessary to yield load reservations here. It is only * necessary for an SC from "another hart" to cause a load reservation diff --git a/target/riscv/op_helper.c b/target/riscv/op_helper.c index 2baf5bc3ca..488116cc2e 100644 --- a/target/riscv/op_helper.c +++ b/target/riscv/op_helper.c @@ -313,6 +313,15 @@ target_ulong helper_sret(CPURISCVState *env) riscv_cpu_set_mode(env, prev_priv); + /* + * If forward cfi enabled for new priv, restore elp status + * and clear spelp in mstatus + */ + if (cpu_get_fcfien(env)) { + env->elp = get_field(env->mstatus, MSTATUS_SPELP); + env->mstatus = set_field(env->mstatus, MSTATUS_SPELP, 0); + } + return retpc; } @@ -357,6 +366,15 @@ target_ulong helper_mret(CPURISCVState *env) riscv_cpu_set_virt_enabled(env, prev_virt); } + /* + * If forward cfi enabled for new priv, restore elp status + * and clear mpelp in mstatus + */ + if (cpu_get_fcfien(env)) { + env->elp = get_field(env->mstatus, MSTATUS_MPELP); + env->mstatus = set_field(env->mstatus, MSTATUS_MPELP, 0); + } + return retpc; } From patchwork Thu Jul 25 23:45:53 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Deepak Gupta X-Patchwork-Id: 13742219 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 3C1C3C3DA49 for ; Thu, 25 Jul 2024 23:47:35 +0000 (UTC) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1sX8AV-0000Ot-0s; Thu, 25 Jul 2024 19:46:43 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1sX8AK-0008Ba-Rj for qemu-devel@nongnu.org; Thu, 25 Jul 2024 19:46:32 -0400 Received: from mail-pf1-x42a.google.com ([2607:f8b0:4864:20::42a]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.90_1) (envelope-from ) id 1sX8AI-0005JW-Am for qemu-devel@nongnu.org; Thu, 25 Jul 2024 19:46:32 -0400 Received: by mail-pf1-x42a.google.com with SMTP id d2e1a72fcca58-70d333d57cdso351582b3a.3 for ; Thu, 25 Jul 2024 16:46:29 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rivosinc-com.20230601.gappssmtp.com; s=20230601; t=1721951189; x=1722555989; darn=nongnu.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=7bXtglqSyDHmhS5ymxp0JdF77BUhuOGby1CsDo/HdPw=; b=ZIodFY7P//V0NkiByheexHRgEHWnZ3aI7h/LgznjjGoUJbMl9p7ecT9JP/7w61eih7 ImLS+bTAYZ9Gdc/S92fiqmFk28+xbAasZxd+/IxoCVDAoSda3ghC/w25RVc0oKOJKYAZ Q61CLOVVNVvrmGiLkUeHSIcFp5yPhAqrq3/aGslGEaEE7HePqVS55kAy7hLdJ5db6Wca rKN9Itu3dSPY0pS+IBDPnsbscw2t6n9xZUP5jshQpeINrAVorekqxLpiQQ7RhUQfTkjH zEAwPwD3NzupOrBUn5x4eiGA4IPc95Fd43WKqopYT5SIDqhX4zeg58wNjBxkaIDuk2XQ MSgg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1721951189; x=1722555989; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=7bXtglqSyDHmhS5ymxp0JdF77BUhuOGby1CsDo/HdPw=; b=eA/619w4iOjpTtyhhA4tyqEP+KUzRdCvXNeta9ybpDcQ847taw7SQ0E5s4Zv8RGSth LUqd63BUaw4R0bYMG5o6WaIZEVd7qw32qxDwdqY6B0658HxC6eVwKX5zFLAL/Zb1Dych 3z3w07rWiGQo6c8o7U9SRiOYHMW037++cGQ89qt6oyHDeLGtO9iciNhURpVlS1e5KAuQ aINVLUYMGhIsS4jtx7tZIS71N6cKDY2Kqs/HNPoHuRMkt2KmXFGtUboaIT7uk4MjjvxT TJ3KCY2j350dXD87ZQ2JL4ornpKirmHH+B6vDYy+lnVEBKEA/w3+5tebdK0NslXzQhOk Fe7Q== X-Forwarded-Encrypted: i=1; AJvYcCVYu7gbIQQAeLjyN7djjdpXtObMzYqViCJPn6fSW2gKf3Zh2TBQV37mBegqpxyn10HckJM/wWHabiRasfzKwzhLaLIQbwo= X-Gm-Message-State: AOJu0YwS0flcGum3IZruEa0hsCA9g8c7jVR9zVfc0vZpVIVrvAbenJaz FgTL5+Ow1zfYtSu9BBRJm+zJ2jcKafX95FHUgEIl5D+QGd2Z/zje/zVDXcnkDCk= X-Google-Smtp-Source: AGHT+IH79Iancu76ub8oB4UGBzx/GrcnI0TlRmEG7QLhNoNsEo92RT8t+YbwYSi3/bGkdSZQNbSrDw== X-Received: by 2002:a05:6a00:2d8c:b0:70e:8070:f9d0 with SMTP id d2e1a72fcca58-70eae8d5c8amr4597113b3a.9.1721951188849; Thu, 25 Jul 2024 16:46:28 -0700 (PDT) Received: from debug.ba.rivosinc.com ([64.71.180.162]) by smtp.gmail.com with ESMTPSA id d2e1a72fcca58-70ead8128d0sm1647565b3a.118.2024.07.25.16.46.27 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 25 Jul 2024 16:46:28 -0700 (PDT) From: Deepak Gupta To: qemu-riscv@nongnu.org, qemu-devel@nongnu.org, jim.shu@sifive.com, andy.chiu@sifive.com, jesse.huang@sifive.com, kito.cheng@sifive.com Cc: palmer@dabbelt.com, Alistair.Francis@wdc.com, laurent@vivier.eu, bmeng.cn@gmail.com, liwei1518@gmail.com, dbarboza@ventanamicro.com, zhiwei_liu@linux.alibaba.com, Deepak Gupta Subject: [PATCH 04/24] target/riscv: additional code information for sw check Date: Thu, 25 Jul 2024 16:45:53 -0700 Message-ID: <20240725234614.3850142-5-debug@rivosinc.com> X-Mailer: git-send-email 2.44.0 In-Reply-To: <20240725234614.3850142-1-debug@rivosinc.com> References: <20240725234614.3850142-1-debug@rivosinc.com> MIME-Version: 1.0 Received-SPF: pass client-ip=2607:f8b0:4864:20::42a; envelope-from=debug@rivosinc.com; helo=mail-pf1-x42a.google.com X-Spam_score_int: -18 X-Spam_score: -1.9 X-Spam_bar: - X-Spam_report: (-1.9 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+qemu-devel=archiver.kernel.org@nongnu.org Sender: qemu-devel-bounces+qemu-devel=archiver.kernel.org@nongnu.org sw check exception support was recently added. This patch further augments sw check exception by providing support for additional code which is provided in *tval. Adds `sw_check_code` field in cpuarchstate. Whenever sw check exception is raised *tval gets the value deposited in `sw_check_code`. Signed-off-by: Deepak Gupta --- target/riscv/cpu.h | 2 ++ target/riscv/cpu_helper.c | 2 ++ target/riscv/csr.c | 1 + 3 files changed, 5 insertions(+) diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h index 8c7841fc08..12334f9540 100644 --- a/target/riscv/cpu.h +++ b/target/riscv/cpu.h @@ -224,6 +224,8 @@ struct CPUArchState { /* elp state for zicfilp extension */ cfi_elp elp; + /* sw check code for sw check exception */ + target_ulong sw_check_code; #ifdef CONFIG_USER_ONLY uint32_t elf_flags; bool ufcfien; diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c index fb4b6066d3..41bc73ad60 100644 --- a/target/riscv/cpu_helper.c +++ b/target/riscv/cpu_helper.c @@ -1762,6 +1762,8 @@ void riscv_cpu_do_interrupt(CPUState *cs) cs->watchpoint_hit = NULL; } break; + case RISCV_EXCP_SW_CHECK: + tval = env->sw_check_code; default: break; } diff --git a/target/riscv/csr.c b/target/riscv/csr.c index 5771a14848..a5a969a377 100644 --- a/target/riscv/csr.c +++ b/target/riscv/csr.c @@ -1179,6 +1179,7 @@ static const uint64_t all_ints = M_MODE_INTERRUPTS | S_MODE_INTERRUPTS | (1ULL << (RISCV_EXCP_INST_PAGE_FAULT)) | \ (1ULL << (RISCV_EXCP_LOAD_PAGE_FAULT)) | \ (1ULL << (RISCV_EXCP_STORE_PAGE_FAULT)) | \ + (1ULL << (RISCV_EXCP_SW_CHECK)) | \ (1ULL << (RISCV_EXCP_INST_GUEST_PAGE_FAULT)) | \ (1ULL << (RISCV_EXCP_LOAD_GUEST_ACCESS_FAULT)) | \ (1ULL << (RISCV_EXCP_VIRT_INSTRUCTION_FAULT)) | \ From patchwork Thu Jul 25 23:45:54 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Deepak Gupta X-Patchwork-Id: 13742225 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id A60B1C3DA7F for ; Thu, 25 Jul 2024 23:48:39 +0000 (UTC) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1sX8AZ-0000j6-Gq; Thu, 25 Jul 2024 19:46:47 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1sX8AL-0008FM-M0 for qemu-devel@nongnu.org; Thu, 25 Jul 2024 19:46:34 -0400 Received: from mail-pf1-x434.google.com ([2607:f8b0:4864:20::434]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.90_1) (envelope-from ) id 1sX8AJ-0005KD-M6 for qemu-devel@nongnu.org; Thu, 25 Jul 2024 19:46:33 -0400 Received: by mail-pf1-x434.google.com with SMTP id d2e1a72fcca58-70cec4aa1e4so285465b3a.1 for ; Thu, 25 Jul 2024 16:46:31 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rivosinc-com.20230601.gappssmtp.com; s=20230601; t=1721951190; x=1722555990; darn=nongnu.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=m/goruj9R/Ogq//f42WS9QY23H4aITjhBZuc+jiaohE=; b=X0/wSbEFAtreRllyxUrllTksFWkiVa1XCbr+hbBHKQtCRtO9QiDK6a63p/9VqbiTtS 6ibD+Fz5gvzLhkgLDqMcPRo5HRPKWV/Cz0+Gx6eVnvnGyCzm93ocWKPI9P4Ud0T15ypu KTNs3EYdwkRzQFZG4SScfVVyTttmt5TcABa2sI5Tx/7ZXZz7jI53ayyDFjcSIWUWT7UZ WUgAGQtrpPthj4EuctO9K5+shk1yVCDgCW2nHtOGBm1TO1204x17HLmBGk5zCj+cuDhG BRVuDzMDFqfznjtXJtksHMvVAk55N5rJT2egmZ1eFzpjlD+qJKDPDtca+GJgk0l81L4n X89A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1721951190; x=1722555990; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=m/goruj9R/Ogq//f42WS9QY23H4aITjhBZuc+jiaohE=; b=pcLggUzaMeMmO2iBvcG/BAWCQiYyLrxu6GeoZHi80dBxEtE8NEv8+n2CjlF1MN1gdt wkzSXO7GIgxMd24PIWIarPDf7yRqrkaFA8r07PmpV/aaOCfuZERCEVXfvCszbqEcQzsk cmtDhECKCh0YcXyT9BlV3K33g+4iLFtm+FlkYwHXJWBjNRYHChuWlx3vK75RW3EJjv0v 26dOjSx2ToR8KQCUevRrRuDMo2ETbQwF2PQ5+WPQro5ZNzo4VABoBKd/WsyruRHThV8C z/Gqs9O3c3NWMTRknfG2NQx4HC2k8dDq8Wf+bZi6LQYYwwORl4s2rVnm0BhEnrXjx2YV hNVA== X-Forwarded-Encrypted: i=1; AJvYcCX82PpDnn8Yg+er/oRizdQECMCPLIbdz5LAMklfN/i52y8bs/4gFdRc0YtA7Ups4N2jMuXn38ch+oh3SiSb8H/AoH6cSG0= X-Gm-Message-State: AOJu0YwZKT59UQNwG0nLVufuJYcHIrIlUSWLC7hgbKcsYBBWPM/yzWkt 9SVbJe1VTH2rNykKjQ1LUg7lchTacsa7w7DSaYuoc7DQ90tc8gc22bWjTF0jXUs= X-Google-Smtp-Source: AGHT+IGfQm+O8uaU0ELFfLH82LWTnWcfL3IiMxkkzETsQqT+W3hOgWu9PrFLOwdfzLUB+tvUEveKhg== X-Received: by 2002:a05:6a00:2ea2:b0:706:5dab:83c5 with SMTP id d2e1a72fcca58-70eaa79d3e9mr5974158b3a.0.1721951190115; Thu, 25 Jul 2024 16:46:30 -0700 (PDT) Received: from debug.ba.rivosinc.com ([64.71.180.162]) by smtp.gmail.com with ESMTPSA id d2e1a72fcca58-70ead8128d0sm1647565b3a.118.2024.07.25.16.46.29 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 25 Jul 2024 16:46:29 -0700 (PDT) From: Deepak Gupta To: qemu-riscv@nongnu.org, qemu-devel@nongnu.org, jim.shu@sifive.com, andy.chiu@sifive.com, jesse.huang@sifive.com, kito.cheng@sifive.com Cc: palmer@dabbelt.com, Alistair.Francis@wdc.com, laurent@vivier.eu, bmeng.cn@gmail.com, liwei1518@gmail.com, dbarboza@ventanamicro.com, zhiwei_liu@linux.alibaba.com, Deepak Gupta Subject: [PATCH 05/24] target/riscv: tracking indirect branches (fcfi) for zicfilp Date: Thu, 25 Jul 2024 16:45:54 -0700 Message-ID: <20240725234614.3850142-6-debug@rivosinc.com> X-Mailer: git-send-email 2.44.0 In-Reply-To: <20240725234614.3850142-1-debug@rivosinc.com> References: <20240725234614.3850142-1-debug@rivosinc.com> MIME-Version: 1.0 Received-SPF: pass client-ip=2607:f8b0:4864:20::434; envelope-from=debug@rivosinc.com; helo=mail-pf1-x434.google.com X-Spam_score_int: -18 X-Spam_score: -1.9 X-Spam_bar: - X-Spam_report: (-1.9 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+qemu-devel=archiver.kernel.org@nongnu.org Sender: qemu-devel-bounces+qemu-devel=archiver.kernel.org@nongnu.org zicfilp protects forward control flow (if enabled) by enforcing all indirect call and jmp must land on a landing pad instruction `lpad`. If target of an indirect call or jmp is not `lpad` then cpu/hart must raise a sw check exception with tval = 2. This patch implements the mechanism using TCG. Target architecture branch instruction must define the end of a TB. Using this property, during translation of branch instruction, TB flag = FCFI_LP_EXPECTED can be set. Translation of target TB can check if FCFI_LP_EXPECTED flag is set and a flag (fcfi_lp_expected) can be set in DisasContext. If `lpad` gets translated, fcfi_lp_expected flag in DisasContext can be cleared. Else it'll fault. This patch also also adds flag for forward cfi in DisasContext. Signed-off-by: Deepak Gupta Co-developed-by: Jim Shu Co-developed-by: Andy Chiu --- target/riscv/cpu.h | 2 ++ target/riscv/cpu_bits.h | 3 +++ target/riscv/cpu_helper.c | 12 ++++++++++ target/riscv/translate.c | 48 +++++++++++++++++++++++++++++++++++++++ 4 files changed, 65 insertions(+) diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h index 12334f9540..7fed5d2750 100644 --- a/target/riscv/cpu.h +++ b/target/riscv/cpu.h @@ -606,6 +606,8 @@ FIELD(TB_FLAGS, ITRIGGER, 22, 1) FIELD(TB_FLAGS, VIRT_ENABLED, 23, 1) FIELD(TB_FLAGS, PRIV, 24, 2) FIELD(TB_FLAGS, AXL, 26, 2) +/* zicfilp needs a TB flag to track indirect branches */ +FIELD(TB_FLAGS, FCFI_LP_EXPECTED, 28, 1) #ifdef TARGET_RISCV32 #define riscv_cpu_mxl(env) ((void)(env), MXL_RV32) diff --git a/target/riscv/cpu_bits.h b/target/riscv/cpu_bits.h index 127f2179dc..477e24feaf 100644 --- a/target/riscv/cpu_bits.h +++ b/target/riscv/cpu_bits.h @@ -691,6 +691,9 @@ typedef enum RISCVException { RISCV_EXCP_SEMIHOST = 0x3f, } RISCVException; +/* zicfilp defines lp violation results in sw check with tval = 2*/ +#define RISCV_EXCP_SW_CHECK_FCFI_TVAL 2 + #define RISCV_EXCP_INT_FLAG 0x80000000 #define RISCV_EXCP_INT_MASK 0x7fffffff diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c index 41bc73ad60..2cb1d45467 100644 --- a/target/riscv/cpu_helper.c +++ b/target/riscv/cpu_helper.c @@ -134,6 +134,18 @@ void cpu_get_tb_cpu_state(CPURISCVState *env, vaddr *pc, flags = FIELD_DP32(flags, TB_FLAGS, VILL, 1); } + if (cpu_get_fcfien(env)) { + /* + * For Forward CFI, only the expectation of a lpcll at + * the start of the block is tracked (which can only happen + * when FCFI is enabled for the current processor mode). A jump + * or call at the end of the previous TB will have updated + * env->elp to indicate the expectation. + */ + flags = FIELD_DP32(flags, TB_FLAGS, FCFI_LP_EXPECTED, + env->elp != NO_LP_EXPECTED); + } + #ifdef CONFIG_USER_ONLY fs = EXT_STATUS_DIRTY; vs = EXT_STATUS_DIRTY; diff --git a/target/riscv/translate.c b/target/riscv/translate.c index acba90f170..c746d7df08 100644 --- a/target/riscv/translate.c +++ b/target/riscv/translate.c @@ -20,6 +20,7 @@ #include "qemu/log.h" #include "cpu.h" #include "tcg/tcg-op.h" +#include "tcg/tcg-temp-internal.h" #include "exec/exec-all.h" #include "exec/helper-proto.h" #include "exec/helper-gen.h" @@ -44,6 +45,7 @@ static TCGv load_val; /* globals for PM CSRs */ static TCGv pm_mask; static TCGv pm_base; +static TCGOp *cfi_lp_check; /* * If an operation is being performed on less than TARGET_LONG_BITS, @@ -116,6 +118,9 @@ typedef struct DisasContext { bool frm_valid; bool insn_start_updated; const GPtrArray *decoders; + /* zicfilp extension. cfi enabled or not. lp expected or not */ + bool fcfi_enabled; + bool fcfi_lp_expected; } DisasContext; static inline bool has_ext(DisasContext *ctx, uint32_t ext) @@ -1238,6 +1243,8 @@ static void riscv_tr_init_disas_context(DisasContextBase *dcbase, CPUState *cs) ctx->pm_base_enabled = FIELD_EX32(tb_flags, TB_FLAGS, PM_BASE_ENABLED); ctx->ztso = cpu->cfg.ext_ztso; ctx->itrigger = FIELD_EX32(tb_flags, TB_FLAGS, ITRIGGER); + ctx->fcfi_lp_expected = FIELD_EX32(tb_flags, TB_FLAGS, FCFI_LP_EXPECTED); + ctx->fcfi_enabled = cpu_get_fcfien(env) && ctx->fcfi_lp_expected; ctx->zero = tcg_constant_tl(0); ctx->virt_inst_excp = false; ctx->decoders = cpu->decoders; @@ -1245,6 +1252,39 @@ static void riscv_tr_init_disas_context(DisasContextBase *dcbase, CPUState *cs) static void riscv_tr_tb_start(DisasContextBase *db, CPUState *cpu) { + DisasContext *ctx = container_of(db, DisasContext, base); + + if (ctx->fcfi_lp_expected) { + /* + * Since we can't look ahead to confirm that the first + * instruction is a legal landing pad instruction, emit + * compare-and-branch sequence that will be fixed-up in + * riscv_tr_tb_stop() to either statically hit or skip an + * illegal instruction exception depending on whether the + * flag was lowered by translation of a CJLP or JLP as + * the first instruction in the block. + */ + TCGv_i32 immediate; + TCGLabel *l; + l = gen_new_label(); + immediate = tcg_temp_new_i32(); + tcg_gen_movi_i32(immediate, 0); + cfi_lp_check = tcg_last_op(); + tcg_gen_brcondi_i32(TCG_COND_EQ, immediate, 0, l); + tcg_temp_free_i32(immediate); + tcg_gen_st_tl( + tcg_constant_tl(RISCV_EXCP_SW_CHECK_FCFI_TVAL), + tcg_env, offsetof(CPURISCVState, sw_check_code)); + generate_exception(ctx, RISCV_EXCP_SW_CHECK); + gen_set_label(l); + /* + * Despite the use of gen_exception_illegal(), the rest of + * the TB needs to be generated. The TCG optimizer will + * clean things up depending on which path ends up being + * active. + */ + ctx->base.is_jmp = DISAS_NEXT; + } } static void riscv_tr_insn_start(DisasContextBase *dcbase, CPUState *cpu) @@ -1303,6 +1343,14 @@ static void riscv_tr_tb_stop(DisasContextBase *dcbase, CPUState *cpu) default: g_assert_not_reached(); } + + if (ctx->fcfi_lp_expected) { + /* + * If the "lp expected" flag is still up, the block needs to take an + * illegal instruction exception. + */ + tcg_set_insn_param(cfi_lp_check, 1, tcgv_i32_arg(tcg_constant_i32(1))); + } } static const TranslatorOps riscv_tr_ops = { From patchwork Thu Jul 25 23:45:55 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Deepak Gupta X-Patchwork-Id: 13742221 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id DB231C3DA70 for ; Thu, 25 Jul 2024 23:47:57 +0000 (UTC) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1sX8AV-0000Ov-1l; Thu, 25 Jul 2024 19:46:43 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1sX8AO-0008RG-LI for qemu-devel@nongnu.org; Thu, 25 Jul 2024 19:46:36 -0400 Received: from mail-oi1-x235.google.com ([2607:f8b0:4864:20::235]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.90_1) (envelope-from ) id 1sX8AL-0005Kp-MN for qemu-devel@nongnu.org; Thu, 25 Jul 2024 19:46:36 -0400 Received: by mail-oi1-x235.google.com with SMTP id 5614622812f47-3db14339fb0so258250b6e.2 for ; Thu, 25 Jul 2024 16:46:33 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rivosinc-com.20230601.gappssmtp.com; s=20230601; t=1721951191; x=1722555991; darn=nongnu.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=iy2RtCvQM5Izk8U1ElO9Cl5d6+0t6yQiX5e7wEg0d5I=; b=bFdND8Ih4Ovl/pQtI9rP/b9vjTpmhxGlb0/UWb5UuInj6QOImIqN6eFbZxPzNneD2h M4c3iFYv2Xybq1v3F5aXcYuhYz8luR1tdTg18+vkSx0yQVBotISn36t4D3ZAw/aOKq7Y xtOAqeNhFugSb629jdmMab6PmOMVYl9vXz0qI1gawyBAJf7X/cvZD3KNWHD6oI3iRDt8 6vA/SYkqfSRlu+gIptUvmkHWj8e3BzHH+ePQhS6mfvl4y2w8Ucvd2kibX2Mm0yP/h5Pc Dy7sSkfMvoXvpGWDVkP0d/k0IKsY0W9mKUCca4X75XF/yEHEh0ClRJFYe9j3wxVgWlUR a2dw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1721951191; x=1722555991; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=iy2RtCvQM5Izk8U1ElO9Cl5d6+0t6yQiX5e7wEg0d5I=; b=OUI2g98G8QzLAp4+rwx+3fgb9NGvXG8Qrc/FJ1uG7zqW6Wlm+85j5iVezfg6Y4ea7c OV8lS5O9rcn0J0IkBzEaUO8mlEKxK67G01O0z2yEnFlkMflUuRQoLi24e0bXHNiqFDXh WHPWdWtwT7JZ9IQdmntdOQSNGe5dt3QLlzftpFX3IG4rERgFQ40QNcj2+buQtRqstIEH PTYmD87j/cKhXtir1i8kCVuqfA1k43MCCafk2KJ2HDnXvCNMXyPNp6yY71twP6D1waNJ hXFeuzBv6J8srzLNw8FggxtxSIE5KJ+RbeXkU4fCeoP97pJqO05d6j5f8y+g3t9SE82U 1k6g== X-Forwarded-Encrypted: i=1; AJvYcCWA6IN2/clLM7A01f0h+jVMWk1FA2IpEjKxzX1BCIEtXHguwMA9mAkT8C+0UsaO1mm13mTw1LlGUOc3Ydaw7w1XYVr4uFk= X-Gm-Message-State: AOJu0Yy2N12S1zNCqNC6LivEAllkYBvjJt5z1WVfmo/IJEuGHwtXoddj 9Cfhu6mQkfypLIKUlfXEAVPvm1Unf3vTmGZGCX0wW2sZttDQsyYMp0mfKQsC3XQ= X-Google-Smtp-Source: AGHT+IHH+LRvZy2lO44+sB35EQn3Ae71JOHLStYRA2w8mljFOucWrzbONIZeFaZDji1rdvec+EWxvw== X-Received: by 2002:a05:6808:2190:b0:3d9:28cc:5329 with SMTP id 5614622812f47-3db10f192c6mr5392527b6e.17.1721951191390; Thu, 25 Jul 2024 16:46:31 -0700 (PDT) Received: from debug.ba.rivosinc.com ([64.71.180.162]) by smtp.gmail.com with ESMTPSA id d2e1a72fcca58-70ead8128d0sm1647565b3a.118.2024.07.25.16.46.30 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 25 Jul 2024 16:46:31 -0700 (PDT) From: Deepak Gupta To: qemu-riscv@nongnu.org, qemu-devel@nongnu.org, jim.shu@sifive.com, andy.chiu@sifive.com, jesse.huang@sifive.com, kito.cheng@sifive.com Cc: palmer@dabbelt.com, Alistair.Francis@wdc.com, laurent@vivier.eu, bmeng.cn@gmail.com, liwei1518@gmail.com, dbarboza@ventanamicro.com, zhiwei_liu@linux.alibaba.com, Deepak Gupta Subject: [PATCH 06/24] target/riscv: zicfilp `lpad` impl and branch tracking Date: Thu, 25 Jul 2024 16:45:55 -0700 Message-ID: <20240725234614.3850142-7-debug@rivosinc.com> X-Mailer: git-send-email 2.44.0 In-Reply-To: <20240725234614.3850142-1-debug@rivosinc.com> References: <20240725234614.3850142-1-debug@rivosinc.com> MIME-Version: 1.0 Received-SPF: pass client-ip=2607:f8b0:4864:20::235; envelope-from=debug@rivosinc.com; helo=mail-oi1-x235.google.com X-Spam_score_int: -18 X-Spam_score: -1.9 X-Spam_bar: - X-Spam_report: (-1.9 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=unavailable autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+qemu-devel=archiver.kernel.org@nongnu.org Sender: qemu-devel-bounces+qemu-devel=archiver.kernel.org@nongnu.org Implements setting lp expected when `jalr` is encountered and implements `lpad` instruction of zicfilp. `lpad` instruction is taken out of auipc x0, . This is an existing HINTNOP space. If `lpad` is target of an indirect branch, cpu checks for 20 bit value in x7 upper with 20 bit value embedded in `lpad`. If they don't match, cpu raises a sw check exception with tval = 2. Signed-off-by: Deepak Gupta Co-developed-by: Jim Shu Co-developed-by: Andy Chiu --- target/riscv/cpu_user.h | 1 + target/riscv/helper.h | 4 ++ target/riscv/insn32.decode | 6 ++- target/riscv/insn_trans/trans_rvi.c.inc | 51 +++++++++++++++++++++++++ target/riscv/op_helper.c | 32 ++++++++++++++++ 5 files changed, 93 insertions(+), 1 deletion(-) diff --git a/target/riscv/cpu_user.h b/target/riscv/cpu_user.h index 02afad608b..e6927ff847 100644 --- a/target/riscv/cpu_user.h +++ b/target/riscv/cpu_user.h @@ -15,5 +15,6 @@ #define xA6 16 #define xA7 17 /* syscall number for RVI ABI */ #define xT0 5 /* syscall number for RVE ABI */ +#define xT2 7 #endif diff --git a/target/riscv/helper.h b/target/riscv/helper.h index 451261ce5a..ab55bbbf73 100644 --- a/target/riscv/helper.h +++ b/target/riscv/helper.h @@ -121,6 +121,10 @@ DEF_HELPER_2(cbo_clean_flush, void, env, tl) DEF_HELPER_2(cbo_inval, void, env, tl) DEF_HELPER_2(cbo_zero, void, env, tl) +/* Forward CFI label checking */ +DEF_HELPER_2(cfi_jalr, void, env, int) +DEF_HELPER_2(cfi_check_landing_pad, void, env, int) + /* Special functions */ DEF_HELPER_2(csrr, tl, env, int) DEF_HELPER_3(csrw, void, env, int, tl) diff --git a/target/riscv/insn32.decode b/target/riscv/insn32.decode index c45b8fa1d8..c963c59c8e 100644 --- a/target/riscv/insn32.decode +++ b/target/riscv/insn32.decode @@ -40,6 +40,7 @@ %imm_z6 26:1 15:5 %imm_mop5 30:1 26:2 20:2 %imm_mop3 30:1 26:2 +%imm_cfi20 12:20 # Argument sets: &empty @@ -123,7 +124,10 @@ sfence_vm 0001000 00100 ..... 000 00000 1110011 @sfence_vm # *** RV32I Base Instruction Set *** lui .................... ..... 0110111 @u -auipc .................... ..... 0010111 @u +{ + lpad .................... 00000 0010111 %imm_cfi20 + auipc .................... ..... 0010111 @u +} jal .................... ..... 1101111 @j jalr ............ ..... 000 ..... 1100111 @i beq ....... ..... ..... 000 ..... 1100011 @b diff --git a/target/riscv/insn_trans/trans_rvi.c.inc b/target/riscv/insn_trans/trans_rvi.c.inc index 98e3806d5e..ee868c5fcb 100644 --- a/target/riscv/insn_trans/trans_rvi.c.inc +++ b/target/riscv/insn_trans/trans_rvi.c.inc @@ -36,6 +36,44 @@ static bool trans_lui(DisasContext *ctx, arg_lui *a) return true; } +static bool trans_lpad(DisasContext *ctx, arg_lpad *a) +{ + /* zicfilp only supported on 32bit and 64bit */ + if (get_xl(ctx) != MXL_RV32 && get_xl(ctx) != MXL_RV64) { + return false; + } + + /* forward cfi not enabled, return false */ + if (!ctx->fcfi_enabled) { + return false; + } + + /* + * If this is the first instruction of the TB, let the translator + * know the landing pad requirement was satisfied. No need to bother + * checking for CFI feature or enablement. + */ + + if (ctx->base.pc_next == ctx->base.pc_first) { + ctx->fcfi_lp_expected = false; + /* PC must be 4 byte aligned */ + if (ctx->fcfi_enabled && ((ctx->base.pc_next) & 0x3)) { + /* + * misaligned, according to spec we should raise sw check exception + */ + tcg_gen_st_tl( + tcg_constant_tl(RISCV_EXCP_SW_CHECK_FCFI_TVAL), + tcg_env, offsetof(CPURISCVState, sw_check_code)); + generate_exception(ctx, RISCV_EXCP_SW_CHECK); + return true; + } + } + + /* use helper to do label check */ + gen_helper_cfi_check_landing_pad(tcg_env, tcg_constant_i32(a->imm_cfi20)); + return true; +} + static bool trans_auipc(DisasContext *ctx, arg_auipc *a) { TCGv target_pc = dest_gpr(ctx, a->rd); @@ -75,6 +113,19 @@ static bool trans_jalr(DisasContext *ctx, arg_jalr *a) gen_set_gpr(ctx, a->rd, succ_pc); tcg_gen_mov_tl(cpu_pc, target_pc); + if (ctx->cfg_ptr->ext_zicfilp) { + /* + * Rely on a helper to check the forward CFI enable for the + * current process mode. The alternatives would be (1) include + * "fcfi enabled" in the cflags or (2) maintain a "fcfi + * currently enabled" in tcg_env and emit TCG code to access + * and test it. + */ + if (a->rs1 != xRA && a->rs1 != xT0 && a->rs1 != xT2) { + gen_helper_cfi_jalr(tcg_env, tcg_constant_i32(LP_EXPECTED)); + } + } + lookup_and_goto_ptr(ctx); if (misaligned) { diff --git a/target/riscv/op_helper.c b/target/riscv/op_helper.c index 488116cc2e..2d152f0a00 100644 --- a/target/riscv/op_helper.c +++ b/target/riscv/op_helper.c @@ -259,6 +259,38 @@ void helper_cbo_inval(CPURISCVState *env, target_ulong address) /* We don't emulate the cache-hierarchy, so we're done. */ } +void helper_cfi_jalr(CPURISCVState *env, int elp) +{ + /* + * The translation routine doesn't know if forward CFI is enabled + * in the current processor mode or not. It's not worth burning a + * cflags bit to encode this, or tracking the current-mode-fcfi + * enable in a dedicated member of 'env'. Just come out to a helper + * for jump/call on a core with CFI. + */ + if (cpu_get_fcfien(env)) { + env->elp = elp; + } +} + +void helper_cfi_check_landing_pad(CPURISCVState *env, int lbl) +{ + if ((env->elp == LP_EXPECTED) && cpu_get_fcfien(env)) { + /* + * Check for the 20bit label match. We already checked 4 byte + * alignment in tcg + * High 20bits (b31:12) in x7/t2 hold label. We need drop bits + * greater than 31 and then shift 12 right + */ + if (lbl && (lbl != ((env->gpr[xT2] & 0xFFFFFFFF) >> 12))) { + env->sw_check_code = RISCV_EXCP_SW_CHECK_FCFI_TVAL; + riscv_raise_exception(env, RISCV_EXCP_SW_CHECK, GETPC()); + } + + env->elp = NO_LP_EXPECTED; + } +} + #ifndef CONFIG_USER_ONLY target_ulong helper_sret(CPURISCVState *env) From patchwork Thu Jul 25 23:45:56 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Deepak Gupta X-Patchwork-Id: 13742235 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id E7B6DC3DA70 for ; Thu, 25 Jul 2024 23:49:38 +0000 (UTC) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1sX8Ac-0000wC-Oh; Thu, 25 Jul 2024 19:46:51 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1sX8AP-0008Vo-QJ for qemu-devel@nongnu.org; Thu, 25 Jul 2024 19:46:39 -0400 Received: from mail-pf1-x42b.google.com ([2607:f8b0:4864:20::42b]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.90_1) (envelope-from ) id 1sX8AM-0005Ku-QQ for qemu-devel@nongnu.org; Thu, 25 Jul 2024 19:46:37 -0400 Received: by mail-pf1-x42b.google.com with SMTP id d2e1a72fcca58-70aec66c936so380633b3a.0 for ; Thu, 25 Jul 2024 16:46:33 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rivosinc-com.20230601.gappssmtp.com; s=20230601; t=1721951193; x=1722555993; darn=nongnu.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=/UP7ynvstNXIegRQLD30QchsVizfwdQm7R8eXCoJJ2Q=; b=PIcYKrHx4a9mSC6NzUYChaRHK+V615be9sDS+YwxNw9hHGba9Ds7GXoFDRdTHt184F gtW9vE7RXaOBbU8A1I1yWy1PkAHfv3j+Tf4G9eGOB0StL6YJz8NCUpjlN+13qJAMiWmi HDIF5pxxXiZX5yP29EuLg7gFyo8g2HEzrkNazrMhGa386uFE7xxXQ0/EtOyhVb7LIeIr Rjbxq+dHprl2QHuajoRqBxq/9hzEt+bU2og447BOAxsTTD/dtTPw781/7wVYy8fkqGvm gMnzjgDhNK6SOX8dRpA4R8kxSkxUq58lofFgrMi6Gj2Z8B4jzNdFQbaFukubS6hmhGpw DVzQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1721951193; x=1722555993; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=/UP7ynvstNXIegRQLD30QchsVizfwdQm7R8eXCoJJ2Q=; b=uIpCo6C95z8yKluK9Kqp/GQ96RUw5istjm3BCreg+H2JKyIHV4Qh271BQ+Fbi2Af9a mDhw+QNtUrhgc3J2ccvXIfxlI6purfxotTOODzSly6FxZNSyS47ES6lodvEKKndc+cvW QWJl4GFiQCIQfTgrwUCq/JF9MVQUlj86DMFK3j1yRedZBkdHhVwgi88O1RdJZpbtMzMQ Sfht8mG49NSts5KLMHN8CYYPgbRKGqtgyn/3SaswUcwNyU38x2f0XczgMs0WSNWEK1if 4YlxCtQTLAbat6WBEiNg42Vpz5C/QVjUtef5sh14oBkL1lGp/KtHbpqIt3A2ks4ja9Od rxqw== X-Forwarded-Encrypted: i=1; AJvYcCX5eY53S+BIEm969mjHqpqvV1fgOofbrisZYzXTLOaC2al9B0VFy79Je1vI/vf9gU13VqbZB3aPSBW5k5VA1tS4B2kR7yI= X-Gm-Message-State: AOJu0Yx7YUZsYIIz8xYGT13YjM2gjj97NpUhIefH4EGs6Q3pM20ydaoa USkeFHGXuAvkli/N+WsFg/kaJtLRqz0tWdMhS+hVotSc5dn4ZpoML+0lL/ydx2w= X-Google-Smtp-Source: AGHT+IG9tjIJW2An1IFrQRcmsB1xj/VR7s0Az3n9xfJkFEZnLR67WBu453w18sm2RuIkSC6579E1ng== X-Received: by 2002:a05:6a00:a87:b0:70d:34aa:6d51 with SMTP id d2e1a72fcca58-70eaa831ac0mr5363753b3a.6.1721951192629; Thu, 25 Jul 2024 16:46:32 -0700 (PDT) Received: from debug.ba.rivosinc.com ([64.71.180.162]) by smtp.gmail.com with ESMTPSA id d2e1a72fcca58-70ead8128d0sm1647565b3a.118.2024.07.25.16.46.31 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 25 Jul 2024 16:46:32 -0700 (PDT) From: Deepak Gupta To: qemu-riscv@nongnu.org, qemu-devel@nongnu.org, jim.shu@sifive.com, andy.chiu@sifive.com, jesse.huang@sifive.com, kito.cheng@sifive.com Cc: palmer@dabbelt.com, Alistair.Francis@wdc.com, laurent@vivier.eu, bmeng.cn@gmail.com, liwei1518@gmail.com, dbarboza@ventanamicro.com, zhiwei_liu@linux.alibaba.com, Deepak Gupta Subject: [PATCH 07/24] disas/riscv: enabled `lpad` disassembly Date: Thu, 25 Jul 2024 16:45:56 -0700 Message-ID: <20240725234614.3850142-8-debug@rivosinc.com> X-Mailer: git-send-email 2.44.0 In-Reply-To: <20240725234614.3850142-1-debug@rivosinc.com> References: <20240725234614.3850142-1-debug@rivosinc.com> MIME-Version: 1.0 Received-SPF: pass client-ip=2607:f8b0:4864:20::42b; envelope-from=debug@rivosinc.com; helo=mail-pf1-x42b.google.com X-Spam_score_int: -18 X-Spam_score: -1.9 X-Spam_bar: - X-Spam_report: (-1.9 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=unavailable autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+qemu-devel=archiver.kernel.org@nongnu.org Sender: qemu-devel-bounces+qemu-devel=archiver.kernel.org@nongnu.org Signed-off-by: Deepak Gupta Co-developed-by: Jim Shu Co-developed-by: Andy Chiu --- disas/riscv.c | 18 +++++++++++++++++- disas/riscv.h | 2 ++ 2 files changed, 19 insertions(+), 1 deletion(-) diff --git a/disas/riscv.c b/disas/riscv.c index c8364c2b07..c7c92acef7 100644 --- a/disas/riscv.c +++ b/disas/riscv.c @@ -974,6 +974,7 @@ typedef enum { rv_op_amomaxu_h = 943, rv_op_amocas_b = 944, rv_op_amocas_h = 945, + rv_op_lpad = 946, } rv_op; /* register names */ @@ -2232,6 +2233,7 @@ const rv_opcode_data rvi_opcode_data[] = { { "amomaxu.h", rv_codec_r_a, rv_fmt_aqrl_rd_rs2_rs1, NULL, 0, 0, 0 }, { "amocas.b", rv_codec_r_a, rv_fmt_aqrl_rd_rs2_rs1, NULL, 0, 0, 0 }, { "amocas.h", rv_codec_r_a, rv_fmt_aqrl_rd_rs2_rs1, NULL, 0, 0, 0 }, + { "lpad", rv_codec_lp, rv_fmt_imm, NULL, 0, 0, 0 }, }; /* CSR names */ @@ -2925,7 +2927,13 @@ static void decode_inst_opcode(rv_decode *dec, rv_isa isa) case 7: op = rv_op_andi; break; } break; - case 5: op = rv_op_auipc; break; + case 5: + op = rv_op_auipc; + if (dec->cfg->ext_zicfilp && + (((inst >> 7) & 0b11111) == 0b00000)) { + op = rv_op_lpad; + } + break; case 6: switch ((inst >> 12) & 0b111) { case 0: op = rv_op_addiw; break; @@ -4482,6 +4490,11 @@ static uint32_t operand_tbl_index(rv_inst inst) return ((inst << 54) >> 56); } +static uint32_t operand_lpl(rv_inst inst) +{ + return inst >> 12; +} + /* decode operands */ static void decode_inst_operands(rv_decode *dec, rv_isa isa) @@ -4869,6 +4882,9 @@ static void decode_inst_operands(rv_decode *dec, rv_isa isa) dec->imm = sextract32(operand_rs2(inst), 0, 5); dec->imm1 = operand_imm2(inst); break; + case rv_codec_lp: + dec->imm = operand_lpl(inst); + break; }; } diff --git a/disas/riscv.h b/disas/riscv.h index 16a08e4895..1182457aff 100644 --- a/disas/riscv.h +++ b/disas/riscv.h @@ -166,6 +166,7 @@ typedef enum { rv_codec_r2_immhl, rv_codec_r2_imm2_imm5, rv_codec_fli, + rv_codec_lp, } rv_codec; /* structures */ @@ -228,6 +229,7 @@ enum { #define rv_fmt_rs1_rs2 "O\t1,2" #define rv_fmt_rd_imm "O\t0,i" #define rv_fmt_rd_uimm "O\t0,Ui" +#define rv_fmt_imm "O\ti" #define rv_fmt_rd_offset "O\t0,o" #define rv_fmt_rd_uoffset "O\t0,Uo" #define rv_fmt_rd_rs1_rs2 "O\t0,1,2" From patchwork Thu Jul 25 23:45:57 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Deepak Gupta X-Patchwork-Id: 13742239 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 3C0F9C3DA70 for ; Thu, 25 Jul 2024 23:50:26 +0000 (UTC) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1sX8AZ-0000jn-KJ; Thu, 25 Jul 2024 19:46:47 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1sX8AQ-00005H-2s for qemu-devel@nongnu.org; Thu, 25 Jul 2024 19:46:39 -0400 Received: from mail-pf1-x432.google.com ([2607:f8b0:4864:20::432]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.90_1) (envelope-from ) id 1sX8AN-0005LJ-F8 for qemu-devel@nongnu.org; Thu, 25 Jul 2024 19:46:37 -0400 Received: by mail-pf1-x432.google.com with SMTP id d2e1a72fcca58-70eb73a9f14so301642b3a.2 for ; Thu, 25 Jul 2024 16:46:35 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rivosinc-com.20230601.gappssmtp.com; s=20230601; t=1721951194; x=1722555994; darn=nongnu.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=k622JqYymJR6YovQS6GBPxe8YFj6SVEYXb2hrEdnpy0=; b=ssX27QBWv1EcvDr569E8HIWIgoa2bWV+prhTZSfhxJ2JIisZjOvUwNR8WHLyARDnd8 wLYsPokYkhXesFV4H2vzdI+Tz9u3OPJ3UFB/910Qjqy72B2h5f43lvNVPdBGE+JL3G6w Vhq2DgMWIKUCrXjN+AwSoHqyWtYY7EF9Ty6W4JJ2Fu2bWGylS5+rB3bqoialIUt2dsUA 8MxnjzVUqE+y+J5iK28g+/CEz9cBqBMmAO89s5l9/VCvjh0s6lHg3Cpp5XHhz8OP0jV2 mDXZt3ftGQvU0yKNITq+KNU/b9LqeCw11mWZtT5fOkIDawbreiFTc0OVsAeWeqOl8I/x Iu2w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1721951194; x=1722555994; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=k622JqYymJR6YovQS6GBPxe8YFj6SVEYXb2hrEdnpy0=; b=ddVkOTidaLANQc74QnqAuCwP9PVVTVrvmW/gGIdiqbGIYj7uQsTyMrNtK87tDMOYMD 2XFbsCAtt8AOc4reZoJ5rbRScSUJqo1Wi4gQJKBfoD0QVfPpH+9W4MIv644butYGlu1D vQ3dvshUzeB7w+IRTFz6mJXdsEHge2kKAwD5DqqHyoDEUhXVtD2RSQZ81j9nxsPTDm6A tux0WB3UE9tkVP4cdt3zAU2dxcinE8G/ofgxbDMpxgquWrxSmYizIgjDq+nwJnQnQ3aP rwajLu+QWbV81vLpz1oh+lBaftM+XvvOn2X6RyOZ3oMjtCr5JLYIb58SCgLGO2ebzydX uWeQ== X-Forwarded-Encrypted: i=1; AJvYcCUT9p596ErP4YMDGxtncQKQZfltD24Mfu/SIYYmfyZrs1LfFHw9yCv4mTNaEcZxjqgvbaquWLHModZLe7CgGaVLyM4DK+Q= X-Gm-Message-State: AOJu0YzkJOHyQno/5G6tqMaIiPX11PQe2wtKPH38pL1jw+10C7doOb0h r68QadpGZ9m0A2IPrSmQdpBMsUgdsl3o8njsz/t61349I0xV/G8DTBOupTad2FM= X-Google-Smtp-Source: AGHT+IEvtpHaRjG9vqci9o+djDXEMZUe2E28G56G9bBW4+u6HXW7p7I30OaVN2eqvYQFcTAZFxpyTQ== X-Received: by 2002:a05:6a00:1ac7:b0:705:97b3:4605 with SMTP id d2e1a72fcca58-70eae98fd23mr4511273b3a.25.1721951193897; Thu, 25 Jul 2024 16:46:33 -0700 (PDT) Received: from debug.ba.rivosinc.com ([64.71.180.162]) by smtp.gmail.com with ESMTPSA id d2e1a72fcca58-70ead8128d0sm1647565b3a.118.2024.07.25.16.46.32 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 25 Jul 2024 16:46:33 -0700 (PDT) From: Deepak Gupta To: qemu-riscv@nongnu.org, qemu-devel@nongnu.org, jim.shu@sifive.com, andy.chiu@sifive.com, jesse.huang@sifive.com, kito.cheng@sifive.com Cc: palmer@dabbelt.com, Alistair.Francis@wdc.com, laurent@vivier.eu, bmeng.cn@gmail.com, liwei1518@gmail.com, dbarboza@ventanamicro.com, zhiwei_liu@linux.alibaba.com, Deepak Gupta Subject: [PATCH 08/24] linux-user/syscall: introduce prctl for indirect branch tracking Date: Thu, 25 Jul 2024 16:45:57 -0700 Message-ID: <20240725234614.3850142-9-debug@rivosinc.com> X-Mailer: git-send-email 2.44.0 In-Reply-To: <20240725234614.3850142-1-debug@rivosinc.com> References: <20240725234614.3850142-1-debug@rivosinc.com> MIME-Version: 1.0 Received-SPF: pass client-ip=2607:f8b0:4864:20::432; envelope-from=debug@rivosinc.com; helo=mail-pf1-x432.google.com X-Spam_score_int: -18 X-Spam_score: -1.9 X-Spam_bar: - X-Spam_report: (-1.9 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+qemu-devel=archiver.kernel.org@nongnu.org Sender: qemu-devel-bounces+qemu-devel=archiver.kernel.org@nongnu.org Each application enables indirect branch tracking (forward cfi) for itself via prctl. Adding branch tracking prctl in linux-user/syscall. Using same prctl code as proposed in cfi patches in kernel mailing list [1] [1] - https://lore.kernel.org/all/20240403234054.2020347-1-debug@rivosinc.com/ Signed-off-by: Deepak Gupta Co-developed-by: Jim Shu Co-developed-by: Andy Chiu Co-developed-by: Jesse Huang --- linux-user/syscall.c | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) diff --git a/linux-user/syscall.c b/linux-user/syscall.c index b8c278b91d..ec157c1088 100644 --- a/linux-user/syscall.c +++ b/linux-user/syscall.c @@ -6295,6 +6295,17 @@ abi_long do_arch_prctl(CPUX86State *env, int code, abi_ulong addr) # define PR_SME_VL_INHERIT (1 << 17) #endif +#ifndef PR_GET_INDIR_BR_LP_STATUS +# define PR_GET_INDIR_BR_LP_STATUS 74 +#endif +#ifndef PR_SET_INDIR_BR_LP_STATUS +# define PR_SET_INDIR_BR_LP_STATUS 75 +# define PR_INDIR_BR_LP_ENABLE (1UL << 0) +#endif +#ifndef PR_LOCK_INDIR_BR_LP_STATUS +# define PR_LOCK_INDIR_BR_LP_STATUS 76 +#endif + #include "target_prctl.h" static abi_long do_prctl_inval0(CPUArchState *env) @@ -6477,6 +6488,14 @@ static abi_long do_prctl(CPUArchState *env, abi_long option, abi_long arg2, case PR_SET_TSC: /* Disable to prevent the target disabling stuff we need. */ return -TARGET_EINVAL; + case PR_GET_INDIR_BR_LP_STATUS: + case PR_SET_INDIR_BR_LP_STATUS: + case PR_LOCK_INDIR_BR_LP_STATUS: +#ifndef do_prctl_cfi + return do_prctl_inval1(env, arg2); +#else + return do_prctl_cfi(env, option, arg2); +#endif default: qemu_log_mask(LOG_UNIMP, "Unsupported prctl: " TARGET_ABI_FMT_ld "\n", From patchwork Thu Jul 25 23:45:58 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Deepak Gupta X-Patchwork-Id: 13742237 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 77E3FC3DA7F for ; Thu, 25 Jul 2024 23:49:43 +0000 (UTC) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1sX8Ab-0000py-6i; Thu, 25 Jul 2024 19:46:49 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1sX8AQ-00005g-6C for qemu-devel@nongnu.org; Thu, 25 Jul 2024 19:46:39 -0400 Received: from mail-ot1-x329.google.com ([2607:f8b0:4864:20::329]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.90_1) (envelope-from ) id 1sX8AO-0005LY-Gp for qemu-devel@nongnu.org; Thu, 25 Jul 2024 19:46:37 -0400 Received: by mail-ot1-x329.google.com with SMTP id 46e09a7af769-70938328a0aso212303a34.1 for ; Thu, 25 Jul 2024 16:46:36 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rivosinc-com.20230601.gappssmtp.com; s=20230601; t=1721951195; x=1722555995; darn=nongnu.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=hFgFtJisZmDduK/TVKWagBehgT0Nl+9kjWGTzeVvu0Q=; b=xj706uYh9ZCe2IEFcIETPrOvpjR7MDL0latOS4E1pSF6IqQN5G2jQBLsvq+ODFqFsc PEsEoiNmCsQnlUJHgFxXnjsnkHyvVg/kdY4fg83kt/94ZvRJ8kqf5B0ciV54fd1MSJ0J T0+uOGzqKp5bhl1jb4ZQonhIqf4TCm+Fg1VMhAymnjLw18ZjNesC6FIKnT5L5uBGRmEZ 2+HzT/2jEQc7Pycux+eFc9hF46aYK57Kd24IFD9JF8TsRaEGnQ/m1qz5rvTNoSAiv7G8 YuUgYW9ifpEuPwEG1cnH6EET3MSKT0c2PZK+e0tPIkk2v7JbaHDT+9WUdUZ4W86+BPWA oxZQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1721951195; x=1722555995; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=hFgFtJisZmDduK/TVKWagBehgT0Nl+9kjWGTzeVvu0Q=; b=e8J2ttyAlehtOX7fgbY8njY6qZ5cTxYZXfZOnjuqEzAZx4ykDuZENJUOoizIZp2Yd8 QinZgz3zdMYOsiIicHxuHjgDvU44m7g++B167199Q1WpWt29uXZrH43S6wR1oALJnP7k f2UEZVSqAN7A3X2HoNjov999ARxslHkUgccPqPa+d2GhWaU2KfDtCIKGigsBiCiq/Wks 3Ma5c43pcG1ugmNBfVyXUJ8u4qAoaetYSI6p6HKv7CD3ulhxDTpnneufbXKRJqvDFV/F hkcJ0U8oNX1g0xdRSyzfDoNEQ1e2+nN52PjaX6DJKglnPZQcymTvJ4R5i8QKJXzQVs1X vbFg== X-Forwarded-Encrypted: i=1; AJvYcCXlKj6lmZO4KSM1rQToEiz/W3XuvHk1Ffz7nRIXuYB/NXOT7ry4cu6SNo/8veRDYSPI2TCjsfewa755MAG/emFBI5Tgm2I= X-Gm-Message-State: AOJu0YyXYyxiHpxBRTHKLajglw2Dycq+Sk0HyYaw4OgYN+oUA49LJKy/ WzWlS5qW4WMIzxYAFIEkCAY6nKmRGrdoE6AvmMw2i1Rdt0wLhh6E+U0Ts15V9HM= X-Google-Smtp-Source: AGHT+IFbvynicoEyXFBjazSX2AbqmrA7N2ek8na4f8LxgVxjG3lJzvKH7r5eWOM2ZBLpc9vAC90DXg== X-Received: by 2002:a05:6870:89a3:b0:261:1046:66fc with SMTP id 586e51a60fabf-266cc0efd61mr4010498fac.4.1721951195155; Thu, 25 Jul 2024 16:46:35 -0700 (PDT) Received: from debug.ba.rivosinc.com ([64.71.180.162]) by smtp.gmail.com with ESMTPSA id d2e1a72fcca58-70ead8128d0sm1647565b3a.118.2024.07.25.16.46.34 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 25 Jul 2024 16:46:34 -0700 (PDT) From: Deepak Gupta To: qemu-riscv@nongnu.org, qemu-devel@nongnu.org, jim.shu@sifive.com, andy.chiu@sifive.com, jesse.huang@sifive.com, kito.cheng@sifive.com Cc: palmer@dabbelt.com, Alistair.Francis@wdc.com, laurent@vivier.eu, bmeng.cn@gmail.com, liwei1518@gmail.com, dbarboza@ventanamicro.com, zhiwei_liu@linux.alibaba.com, Deepak Gupta Subject: [PATCH 09/24] linux-user/riscv: implement indirect branch tracking prctls Date: Thu, 25 Jul 2024 16:45:58 -0700 Message-ID: <20240725234614.3850142-10-debug@rivosinc.com> X-Mailer: git-send-email 2.44.0 In-Reply-To: <20240725234614.3850142-1-debug@rivosinc.com> References: <20240725234614.3850142-1-debug@rivosinc.com> MIME-Version: 1.0 Received-SPF: pass client-ip=2607:f8b0:4864:20::329; envelope-from=debug@rivosinc.com; helo=mail-ot1-x329.google.com X-Spam_score_int: -18 X-Spam_score: -1.9 X-Spam_bar: - X-Spam_report: (-1.9 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+qemu-devel=archiver.kernel.org@nongnu.org Sender: qemu-devel-bounces+qemu-devel=archiver.kernel.org@nongnu.org Implements indirect branch tracking prctls for riscv. Setting and clearing branch tracking prctl simply turns on/off `ufcfien` field in `env`. tb flush is needed because branch tracking itself leverages tb creation logic. locking branch tracking (forward cfi) is not implemented yet (no need yet) but added for completeness (kernel patches have this prctl) Signed-off-by: Deepak Gupta Co-developed-by: Jesse Huang Co-developed-by: Jim Shu Co-developed-by: Andy Chiu --- linux-user/riscv/target_prctl.h | 43 +++++++++++++++++++++++++++++++++ 1 file changed, 43 insertions(+) diff --git a/linux-user/riscv/target_prctl.h b/linux-user/riscv/target_prctl.h index eb53b31ad5..d7f9f954c9 100644 --- a/linux-user/riscv/target_prctl.h +++ b/linux-user/riscv/target_prctl.h @@ -1 +1,44 @@ /* No special prctl support required. */ +#ifndef RISCV_TARGET_PRCTL_H +#define RISCV_TARGET_PRCTL_H + +/* + * -TARGET_EINVAL: Unsupported/Invalid flag for this architecture + * -TARGET_EACCES: try to set an already set CFI feature + * -TARGET_ENOENT: CFI feature is not supported by CPU + */ +static abi_long do_prctl_cfi(CPUArchState *env, + abi_long option, abi_long flag) +{ + if (env_archcpu(env)->cfg.ext_zicfilp) { + + switch (option) { + case PR_GET_INDIR_BR_LP_STATUS: + abi_ulong fcfi_status = 0; + /* indirect branch tracking is enabled on the task or not */ + fcfi_status |= (env->ufcfien ? PR_INDIR_BR_LP_ENABLE : 0); + return copy_to_user(flag, &fcfi_status, sizeof(fcfi_status)) ? \ + -EFAULT : 0; + + case PR_SET_INDIR_BR_LP_STATUS: + /* if any other bit is set, its invalid param */ + if (flag & ~PR_INDIR_BR_LP_ENABLE) { + return -TARGET_EINVAL; + } + /* set or clear branch tracking */ + env->ufcfien = (flag & PR_INDIR_BR_LP_ENABLE); + tb_flush(env_cpu(env)); + return 0; + + /* locking not implemented (also not needed for qemu-user) yet */ + case PR_LOCK_INDIR_BR_LP_STATUS: + return -TARGET_EINVAL; + } + } + + return -TARGET_ENOENT; +} + +#define do_prctl_cfi do_prctl_cfi + +#endif From patchwork Thu Jul 25 23:45:59 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Deepak Gupta X-Patchwork-Id: 13742229 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 66B4EC3DA70 for ; Thu, 25 Jul 2024 23:49:03 +0000 (UTC) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1sX8Ae-00013k-BX; Thu, 25 Jul 2024 19:46:52 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1sX8AR-0000Bv-OY for qemu-devel@nongnu.org; Thu, 25 Jul 2024 19:46:39 -0400 Received: from mail-pf1-x42d.google.com ([2607:f8b0:4864:20::42d]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.90_1) (envelope-from ) id 1sX8AP-0005Lv-SB for qemu-devel@nongnu.org; Thu, 25 Jul 2024 19:46:39 -0400 Received: by mail-pf1-x42d.google.com with SMTP id d2e1a72fcca58-70d333d57cdso351644b3a.3 for ; Thu, 25 Jul 2024 16:46:37 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rivosinc-com.20230601.gappssmtp.com; s=20230601; t=1721951196; x=1722555996; darn=nongnu.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=XpTED6uOZV4AODyPSsvTHdTqj2NIb+fx5aC8tDZo5rs=; b=TwTqwSkZ9R1GCqBM5jrwoBL5WUoVd2OyA06dvOQh5+5PPFC8BwQSK/ll98PPGT8o1F wusVhFpqqdQN/5uvYicMklaRJ+WlnvNWJNGX7jQOskKpj9C5WdH4pl7stUaAM7hhYJ+P h4ssgFjARCX+tsc1s6e1kAA0QhWMQ/hP9NLAgVR7Y7HOovkA6cms0eeUsUZm10iGZxHD E+fC3tHs/f12vLxdtauhjacatmDZeJ1bh2RFsE8CJ1H+lsLGkXswCq24gT6D5UH0YVTN Ayc6bmfGVUaH34pMwqZg2yNaimPuklVG9pok4C4bhhygd/FdL2iHWiO03ieg5pdrCY20 +Q+w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1721951196; x=1722555996; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=XpTED6uOZV4AODyPSsvTHdTqj2NIb+fx5aC8tDZo5rs=; b=n6ac7Bn0j+sRRtd5BL/PavYrd+VXKzOiHkVMe1DrMlAJitxg7w/8cEd/aK07LuDK+8 Pu9d68cF9Z2CibvVzVjjaiV1Hz3HOsDKxk0v6WPkmX0TYkBondt8anqpAM/GaI2qQUpY lYQpR8oHLDeCHewOzO+VjpL9C7adoSzEeL25u6ZCV5p3k4FUEO/Z1o9g7+YDWaywRJxr rNKccYKKoFSCv4B6tHGDFEhWZ55vWwWiRCbUqNBtJCaySpZ7WitUxpmtAjn8Vi7RRtLx VzHMwWinY0EsFi4L03Exe7KDDIAOnAze400neC7gLsDhoR+ZsPxfuUqaKR3s2z+p307f Eb/g== X-Forwarded-Encrypted: i=1; AJvYcCUKpR2e7dpL1r7DtSgjHNqvtOnVmqSf+mY1VDwRPLta3OSvo+NDNTkAoDR5wZHjKxYNQkP5zjGXhxWEyW/fze9j60W2QmQ= X-Gm-Message-State: AOJu0YxpQnQj6XQCKMimnrWPzzDtWDfJOulk2/4CfKMuZXb7hZ3BAsFo 6EJwD2IMYj6JoCKRP8YVhSwU8nTqQMRvJ/aO0qdRCDkK0VmCqAm2mdZP2zk2UTY= X-Google-Smtp-Source: AGHT+IFI0J2JekyB983Um2t6CxnIQhKGi57Sap+WgRpr4QXi3k+FAZtMU7q1m/NG/gWxcK6i7wDk/Q== X-Received: by 2002:a05:6a00:8597:b0:70a:f3de:3f2 with SMTP id d2e1a72fcca58-70eae8520d5mr4121007b3a.3.1721951196414; Thu, 25 Jul 2024 16:46:36 -0700 (PDT) Received: from debug.ba.rivosinc.com ([64.71.180.162]) by smtp.gmail.com with ESMTPSA id d2e1a72fcca58-70ead8128d0sm1647565b3a.118.2024.07.25.16.46.35 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 25 Jul 2024 16:46:36 -0700 (PDT) From: Deepak Gupta To: qemu-riscv@nongnu.org, qemu-devel@nongnu.org, jim.shu@sifive.com, andy.chiu@sifive.com, jesse.huang@sifive.com, kito.cheng@sifive.com Cc: palmer@dabbelt.com, Alistair.Francis@wdc.com, laurent@vivier.eu, bmeng.cn@gmail.com, liwei1518@gmail.com, dbarboza@ventanamicro.com, zhiwei_liu@linux.alibaba.com, Deepak Gupta Subject: [PATCH 10/24] target/riscv: Add zicfiss extension Date: Thu, 25 Jul 2024 16:45:59 -0700 Message-ID: <20240725234614.3850142-11-debug@rivosinc.com> X-Mailer: git-send-email 2.44.0 In-Reply-To: <20240725234614.3850142-1-debug@rivosinc.com> References: <20240725234614.3850142-1-debug@rivosinc.com> MIME-Version: 1.0 Received-SPF: pass client-ip=2607:f8b0:4864:20::42d; envelope-from=debug@rivosinc.com; helo=mail-pf1-x42d.google.com X-Spam_score_int: -18 X-Spam_score: -1.9 X-Spam_bar: - X-Spam_report: (-1.9 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+qemu-devel=archiver.kernel.org@nongnu.org Sender: qemu-devel-bounces+qemu-devel=archiver.kernel.org@nongnu.org zicfiss [1] riscv cpu extension enables backward control flow integrity. This patch sets up space for zicfiss extension in cpuconfig. And imple- ments dependency on zicsr, zimop and zcmop extensions. [1] - https://github.com/riscv/riscv-cfi Signed-off-by: Deepak Gupta Co-developed-by: Jim Shu Co-developed-by: Andy Chiu --- target/riscv/cpu.c | 2 ++ target/riscv/cpu_cfg.h | 1 + target/riscv/tcg/tcg-cpu.c | 15 +++++++++++++++ 3 files changed, 18 insertions(+) diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c index e1526c7ab5..54fcf380ff 100644 --- a/target/riscv/cpu.c +++ b/target/riscv/cpu.c @@ -107,6 +107,7 @@ const RISCVIsaExtData isa_edata_arr[] = { ISA_EXT_DATA_ENTRY(zicclsm, PRIV_VERSION_1_11_0, has_priv_1_11), ISA_EXT_DATA_ENTRY(ziccrse, PRIV_VERSION_1_11_0, has_priv_1_11), ISA_EXT_DATA_ENTRY(zicfilp, PRIV_VERSION_1_12_0, ext_zicfilp), + ISA_EXT_DATA_ENTRY(zicfiss, PRIV_VERSION_1_13_0, ext_zicfiss), ISA_EXT_DATA_ENTRY(zicond, PRIV_VERSION_1_12_0, ext_zicond), ISA_EXT_DATA_ENTRY(zicntr, PRIV_VERSION_1_12_0, ext_zicntr), ISA_EXT_DATA_ENTRY(zicsr, PRIV_VERSION_1_10_0, ext_zicsr), @@ -1482,6 +1483,7 @@ const RISCVCPUMultiExtConfig riscv_cpu_extensions[] = { MULTI_EXT_CFG_BOOL("sscofpmf", ext_sscofpmf, false), MULTI_EXT_CFG_BOOL("zifencei", ext_zifencei, true), MULTI_EXT_CFG_BOOL("zicfilp", ext_zicfilp, false), + MULTI_EXT_CFG_BOOL("zicfiss", ext_zicfiss, false), MULTI_EXT_CFG_BOOL("zicsr", ext_zicsr, true), MULTI_EXT_CFG_BOOL("zihintntl", ext_zihintntl, true), MULTI_EXT_CFG_BOOL("zihintpause", ext_zihintpause, true), diff --git a/target/riscv/cpu_cfg.h b/target/riscv/cpu_cfg.h index 88d5defbb5..2499f38407 100644 --- a/target/riscv/cpu_cfg.h +++ b/target/riscv/cpu_cfg.h @@ -68,6 +68,7 @@ struct RISCVCPUConfig { bool ext_zicbop; bool ext_zicboz; bool ext_zicfilp; + bool ext_zicfiss; bool ext_zicond; bool ext_zihintntl; bool ext_zihintpause; diff --git a/target/riscv/tcg/tcg-cpu.c b/target/riscv/tcg/tcg-cpu.c index ed19586c9d..4fd2fd7a28 100644 --- a/target/riscv/tcg/tcg-cpu.c +++ b/target/riscv/tcg/tcg-cpu.c @@ -618,6 +618,21 @@ void riscv_cpu_validate_set_extensions(RISCVCPU *cpu, Error **errp) cpu->cfg.ext_zihpm = false; } + if (cpu->cfg.ext_zicfiss) { + if (!cpu->cfg.ext_zicsr) { + error_setg(errp, "zicfiss extension requires zicsr extension"); + return; + } + if (!cpu->cfg.ext_zimop) { + error_setg(errp, "zicfiss extension requires zimop extension"); + return; + } + if (cpu->cfg.ext_zca && !cpu->cfg.ext_zcmop) { + error_setg(errp, "zicfiss with zca requires zcmop extension"); + return; + } + } + if (!cpu->cfg.ext_zihpm) { cpu->cfg.pmu_mask = 0; cpu->pmu_avail_ctrs = 0; From patchwork Thu Jul 25 23:46:00 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Deepak Gupta X-Patchwork-Id: 13742227 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 00AF0C3DA49 for ; Thu, 25 Jul 2024 23:48:47 +0000 (UTC) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1sX8Ae-000134-8R; Thu, 25 Jul 2024 19:46:52 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1sX8AT-0000Ho-2Y for qemu-devel@nongnu.org; Thu, 25 Jul 2024 19:46:41 -0400 Received: from mail-oi1-x22f.google.com ([2607:f8b0:4864:20::22f]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.90_1) (envelope-from ) id 1sX8AR-0005MO-1G for qemu-devel@nongnu.org; Thu, 25 Jul 2024 19:46:40 -0400 Received: by mail-oi1-x22f.google.com with SMTP id 5614622812f47-3db16b2c1d2so285336b6e.2 for ; Thu, 25 Jul 2024 16:46:38 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rivosinc-com.20230601.gappssmtp.com; s=20230601; t=1721951198; x=1722555998; darn=nongnu.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=UB4g4AW4kPdAduQAIH9J9HggkXdBpq+4KbcMBQUEh2k=; b=w+wD26wUCstzF/Q6AOS7zYgFhCVt1k7bh3qvL1OqWBdFA1Npfu+CxRiWg4j6iKRo++ yZmT8ZAvW6j9nKOlXwlKy85dOkWNUwOFg037YrZmJPbQpUdVywG3APCJ0Z/scE+r2qSQ mpScFayQs5eTkuIpGxxhaGJD3wlcpuiwwB0QEea5UjqgvvE+jhzhlMIf1HleGzLzeGca em+Ud+LpRg3AqyjJy0VHvKmofq5fBST0Ui61iBk/mbI3TteakJ7XsVWVz3S0k5JcPoQ9 8Thwi+J7HrS4g3SE3LYakNUvOw/i0cMzIzClRJPxkd2jo2XpMBNkq5gtjRq6clPvBsE3 atpw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1721951198; x=1722555998; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=UB4g4AW4kPdAduQAIH9J9HggkXdBpq+4KbcMBQUEh2k=; b=vs2y06PQXAX/WcDmIfxc+lEMvQanutIVw2ygRXuPXqwNJMsOYWHDhq+5+NwIxIq3I6 G/f9FfHPR4imiU9MPQ+17djTHjQreOIIdJay/z0Y8PBg1l3+F7+1KM7imH7LFQLEAHLF j8PGeTVS3v1gSFS9F7XKdXyJay0dXVZU7xBGHSr0t7KOdajYH1a9nbvVDG/TtOONWiRY c4kwzhQjHoQrx5IRRHCrjhG5rPWqnoHQ11vD0z2gAk0sEf/iSriZv+jr+B2X/Em6uMp+ V4yZ4lKiJ2f8BHytqeQRxUdk0o+McoUirRKJLpqz8CDZW0c4zVwfw4tdXsSTEOBMUsV/ PFVg== X-Forwarded-Encrypted: i=1; AJvYcCX0cNsLFZwQ5QgbCh/yUfN5DX4a/JJ1u87c0CXe5OoHRFHTrD4Pk9zck4umpZjanV9qeQFdPk2k9kX3Tiy1NH+yeur8IPE= X-Gm-Message-State: AOJu0Yx/d+CVYJ1YekYsip0bseVFt6EVHAfSQCCR07qls21Qpj297gHg ztYepkhtdayV+PVWTzTmBxSOqvObXY5Z3d0qcsq5y0lVwiAeV0OGfrLWJVCxpLk= X-Google-Smtp-Source: AGHT+IE1Hi9ElTtv7eBYMfp18apafSPbP9Y1/hsRXo6JEsOuX488c99zlLXxWfSWxsbXp9aLu1rerg== X-Received: by 2002:a05:6808:1703:b0:3db:160b:d5e7 with SMTP id 5614622812f47-3db160bd969mr3201226b6e.22.1721951197708; Thu, 25 Jul 2024 16:46:37 -0700 (PDT) Received: from debug.ba.rivosinc.com ([64.71.180.162]) by smtp.gmail.com with ESMTPSA id d2e1a72fcca58-70ead8128d0sm1647565b3a.118.2024.07.25.16.46.36 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 25 Jul 2024 16:46:37 -0700 (PDT) From: Deepak Gupta To: qemu-riscv@nongnu.org, qemu-devel@nongnu.org, jim.shu@sifive.com, andy.chiu@sifive.com, jesse.huang@sifive.com, kito.cheng@sifive.com Cc: palmer@dabbelt.com, Alistair.Francis@wdc.com, laurent@vivier.eu, bmeng.cn@gmail.com, liwei1518@gmail.com, dbarboza@ventanamicro.com, zhiwei_liu@linux.alibaba.com, Deepak Gupta Subject: [PATCH 11/24] target/riscv: introduce ssp and enabling controls for zicfiss Date: Thu, 25 Jul 2024 16:46:00 -0700 Message-ID: <20240725234614.3850142-12-debug@rivosinc.com> X-Mailer: git-send-email 2.44.0 In-Reply-To: <20240725234614.3850142-1-debug@rivosinc.com> References: <20240725234614.3850142-1-debug@rivosinc.com> MIME-Version: 1.0 Received-SPF: pass client-ip=2607:f8b0:4864:20::22f; envelope-from=debug@rivosinc.com; helo=mail-oi1-x22f.google.com X-Spam_score_int: -18 X-Spam_score: -1.9 X-Spam_bar: - X-Spam_report: (-1.9 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+qemu-devel=archiver.kernel.org@nongnu.org Sender: qemu-devel-bounces+qemu-devel=archiver.kernel.org@nongnu.org zicfiss introduces a new state ssp ("shadow stack register") in cpu. ssp is expressed as a new unprivileged csr (CSR_SSP=0x11) and holds virtual address for shadow stack as programmed by software. Shadow stack (for each mode) is enabled via bit3 in *envcfg CSRs. Shadow stack can be enabled for a mode only if it's higher privileged mode had it enabled for itself. M mode doesn't need enabling control, it's always available if extension is available on cpu. Signed-off-by: Deepak Gupta Co-developed-by: Jim Shu Co-developed-by: Andy Chiu --- target/riscv/cpu.c | 3 ++ target/riscv/cpu.h | 2 ++ target/riscv/cpu_bits.h | 6 ++++ target/riscv/csr.c | 74 +++++++++++++++++++++++++++++++++++++++++ 4 files changed, 85 insertions(+) diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c index 54fcf380ff..6b50ae0e45 100644 --- a/target/riscv/cpu.c +++ b/target/riscv/cpu.c @@ -998,6 +998,9 @@ static void riscv_cpu_reset_hold(Object *obj, ResetType type) /* on reset elp is set to NO_LP_EXPECTED */ env->elp = NO_LP_EXPECTED; + /* on reset ssp is set to 0 */ + env->ssp = 0; + /* * Bits 10, 6, 2 and 12 of mideleg are read only 1 when the Hypervisor * extension is enabled. diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h index 7fed5d2750..81283a1d76 100644 --- a/target/riscv/cpu.h +++ b/target/riscv/cpu.h @@ -224,6 +224,8 @@ struct CPUArchState { /* elp state for zicfilp extension */ cfi_elp elp; + /* shadow stack register for zicfiss extension */ + target_ulong ssp; /* sw check code for sw check exception */ target_ulong sw_check_code; #ifdef CONFIG_USER_ONLY diff --git a/target/riscv/cpu_bits.h b/target/riscv/cpu_bits.h index 477e24feaf..589326e516 100644 --- a/target/riscv/cpu_bits.h +++ b/target/riscv/cpu_bits.h @@ -34,6 +34,9 @@ /* Control and Status Registers */ +/* zicfiss user ssp csr */ +#define CSR_SSP 0x011 + /* User Trap Setup */ #define CSR_USTATUS 0x000 #define CSR_UIE 0x004 @@ -760,6 +763,7 @@ typedef enum RISCVException { /* Execution environment configuration bits */ #define MENVCFG_FIOM BIT(0) #define MENVCFG_LPE BIT(2) /* zicfilp */ +#define MENVCFG_SSE BIT(3) /* zicfiss */ #define MENVCFG_CBIE (3UL << 4) #define MENVCFG_CBCFE BIT(6) #define MENVCFG_CBZE BIT(7) @@ -774,12 +778,14 @@ typedef enum RISCVException { #define SENVCFG_FIOM MENVCFG_FIOM #define SENVCFG_LPE MENVCFG_LPE +#define SENVCFG_SSE MENVCFG_SSE #define SENVCFG_CBIE MENVCFG_CBIE #define SENVCFG_CBCFE MENVCFG_CBCFE #define SENVCFG_CBZE MENVCFG_CBZE #define HENVCFG_FIOM MENVCFG_FIOM #define HENVCFG_LPE MENVCFG_LPE +#define HENVCFG_SSE MENVCFG_SSE #define HENVCFG_CBIE MENVCFG_CBIE #define HENVCFG_CBCFE MENVCFG_CBCFE #define HENVCFG_CBZE MENVCFG_CBZE diff --git a/target/riscv/csr.c b/target/riscv/csr.c index a5a969a377..d72d6289fb 100644 --- a/target/riscv/csr.c +++ b/target/riscv/csr.c @@ -185,6 +185,47 @@ static RISCVException zcmt(CPURISCVState *env, int csrno) return RISCV_EXCP_NONE; } +static RISCVException cfi_ss(CPURISCVState *env, int csrno) +{ + /* no cfi extension, access to csr is illegal */ + if (!env_archcpu(env)->cfg.ext_zicfiss) { + return RISCV_EXCP_ILLEGAL_INST; + } + /* + * CONFIG_USER_MODE always allow access for now. Better for user mode only + * functionality + */ +#if !defined(CONFIG_USER_ONLY) + if (env->debugger) { + return RISCV_EXCP_NONE; + } + /* current priv not M */ + if (env->priv != PRV_M) { + /* menvcfg says no shadow stack enable */ + if (!get_field(env->menvcfg, MENVCFG_SSE)) { + return RISCV_EXCP_ILLEGAL_INST; + } + + /* V = 1 and henvcfg says no shadow stack enable */ + if (env->virt_enabled && + !get_field(env->henvcfg, HENVCFG_SSE)) { + return RISCV_EXCP_VIRT_INSTRUCTION_FAULT; + } + + /* + * SSP are not accessible to U mode if disabled via senvcfg + * CSR + */ + if ((env->priv == PRV_U) && + (!get_field(env->senvcfg, SENVCFG_SSE))) { + return RISCV_EXCP_ILLEGAL_INST; + } + } +#endif + + return RISCV_EXCP_NONE; +} + #if !defined(CONFIG_USER_ONLY) static RISCVException mctr(CPURISCVState *env, int csrno) { @@ -596,6 +637,19 @@ static RISCVException seed(CPURISCVState *env, int csrno) #endif } +/* zicfiss CSR_SSP read and write */ +static int read_ssp(CPURISCVState *env, int csrno, target_ulong *val) +{ + *val = env->ssp; + return RISCV_EXCP_NONE; +} + +static int write_ssp(CPURISCVState *env, int csrno, target_ulong val) +{ + env->ssp = val; + return RISCV_EXCP_NONE; +} + /* User Floating-Point CSRs */ static RISCVException read_fflags(CPURISCVState *env, int csrno, target_ulong *val) @@ -2111,6 +2165,10 @@ static RISCVException write_menvcfg(CPURISCVState *env, int csrno, if (env_archcpu(env)->cfg.ext_zicfilp) { mask |= MENVCFG_LPE; } + + if (env_archcpu(env)->cfg.ext_zicfiss) { + mask |= MENVCFG_SSE; + } } env->menvcfg = (env->menvcfg & ~mask) | (val & mask); @@ -2167,6 +2225,13 @@ static RISCVException write_senvcfg(CPURISCVState *env, int csrno, mask |= SENVCFG_LPE; } + /* Higher mode SSE must be ON for next-less mode SSE to be ON */ + if (env_archcpu(env)->cfg.ext_zicfiss && + get_field(env->menvcfg, MENVCFG_SSE) && + (env->virt_enabled ? get_field(env->henvcfg, HENVCFG_SSE) : true)) { + mask |= SENVCFG_SSE; + } + env->senvcfg = (env->senvcfg & ~mask) | (val & mask); return RISCV_EXCP_NONE; } @@ -2208,6 +2273,12 @@ static RISCVException write_henvcfg(CPURISCVState *env, int csrno, if (env_archcpu(env)->cfg.ext_zicfilp) { mask |= HENVCFG_LPE; } + + /* H can light up SSE for VS only if HS had it from menvcfg */ + if (env_archcpu(env)->cfg.ext_zicfiss && + get_field(env->menvcfg, MENVCFG_SSE)) { + mask |= HENVCFG_SSE; + } } env->henvcfg = (env->henvcfg & ~mask) | (val & mask); @@ -4663,6 +4734,9 @@ riscv_csr_operations csr_ops[CSR_TABLE_SIZE] = { /* Zcmt Extension */ [CSR_JVT] = {"jvt", zcmt, read_jvt, write_jvt}, + /* zicfiss Extension, shadow stack register */ + [CSR_SSP] = { "ssp", cfi_ss, read_ssp, write_ssp }, + #if !defined(CONFIG_USER_ONLY) /* Machine Timers and Counters */ [CSR_MCYCLE] = { "mcycle", any, read_hpmcounter, From patchwork Thu Jul 25 23:46:01 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Deepak Gupta X-Patchwork-Id: 13742226 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 3D32AC3DA70 for ; Thu, 25 Jul 2024 23:48:42 +0000 (UTC) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1sX8Aa-0000om-UL; Thu, 25 Jul 2024 19:46:48 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1sX8AU-0000Pf-Ks for qemu-devel@nongnu.org; Thu, 25 Jul 2024 19:46:42 -0400 Received: from mail-oi1-x230.google.com ([2607:f8b0:4864:20::230]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.90_1) (envelope-from ) id 1sX8AS-0005Mh-ON for qemu-devel@nongnu.org; Thu, 25 Jul 2024 19:46:42 -0400 Received: by mail-oi1-x230.google.com with SMTP id 5614622812f47-3db12a2f530so248432b6e.1 for ; Thu, 25 Jul 2024 16:46:40 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rivosinc-com.20230601.gappssmtp.com; s=20230601; t=1721951199; x=1722555999; darn=nongnu.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=tUR8T2K29APrsJptEPEdK1z5i2IWbR5BdkNAdCNK1kM=; b=H1qvPFVrtuCZFvs6pxxDvTNbG4hh6mHFJY7OhGUvHwiJ06wQoqopaCN1pgxUlJjLis sknwFrOHOKvPG00MIoM55U109DU5A3mfuNuUaHiErDCsbM8wQZfT0wgvJgS1WU4lQbEn wDB4zGHR6bKY8C2w+9H6tseOW9typ0B0kVZIbiMIVa95tpFalsxXXFl2GEWEOalh/t1S HqoIHTslTxd4sVz+4SqqyXj/j4Kb6Alc1A+49oFZP6Q41pyY57bzexBSgOKmtdPy2K6r WXQSrdmNw4JWhij6HhG8qq4NRLAfKp9LeQkr7QY5ETJDPQ4oQG4P+MryyD2uNdIXRE0E +CbQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1721951199; x=1722555999; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=tUR8T2K29APrsJptEPEdK1z5i2IWbR5BdkNAdCNK1kM=; b=ORUYqsSFcKzv5cw7iUb1TKlzJW2qtSnpPvPwhBqmqJ9Qr+4tzN1+rlwvmu4p6RYC36 CAYhddc2Tc7o8YzH99c0UNz6FAvWFTfoGXiqDHt0/zRGfQh40EKITp4PWyo1ok4R4z4K C/6lURxSfrIpLxpVYGONhwOtl7VmdIwtO+V681fdQtsNLFZF0475/D2/931YQjU7XMeb Bj1NvfD+gFHTrcp58URsD0Zg69u6i3uFRl4V7Lt2aT7johJjrVhK9U57iR1gfhtJlbBJ Dp4ACA3tXn8eFpiWO/VuVqWnpB0Fof0rAmLxeFRXGn6jWUmBSbNJqBJCxAN9Kr+BmpYf 4H0g== X-Forwarded-Encrypted: i=1; AJvYcCVXTr2sQXL8BmNSzBF5ZE+KxENP9+vghv06AY2hpMBFtmia7e7tR9a53PPGLZGcRcZoOMBcZZFsaJrOOktbtB1zyH8JFVc= X-Gm-Message-State: AOJu0YyGCxUIoWYBwLyyMkNRrePzSYw8y62jE+ZFUvXHYMFbnjBIyIDD UFwO3UvY2lmuBK54sUShj7dxmbJKvNe8Xnn/xaT+8Erk9fwKsmqALXrAgQXJ/40= X-Google-Smtp-Source: AGHT+IFoVeZ422tEPy+Fq939E8LOKAOTohfUKg/8ajvaM8rVyKLa0tU1d1fIS36XibaSRiuEzvtXjA== X-Received: by 2002:a05:6808:2190:b0:3da:e2b1:10d2 with SMTP id 5614622812f47-3db10ed0c45mr5577575b6e.2.1721951199301; Thu, 25 Jul 2024 16:46:39 -0700 (PDT) Received: from debug.ba.rivosinc.com ([64.71.180.162]) by smtp.gmail.com with ESMTPSA id d2e1a72fcca58-70ead8128d0sm1647565b3a.118.2024.07.25.16.46.37 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 25 Jul 2024 16:46:38 -0700 (PDT) From: Deepak Gupta To: qemu-riscv@nongnu.org, qemu-devel@nongnu.org, jim.shu@sifive.com, andy.chiu@sifive.com, jesse.huang@sifive.com, kito.cheng@sifive.com Cc: palmer@dabbelt.com, Alistair.Francis@wdc.com, laurent@vivier.eu, bmeng.cn@gmail.com, liwei1518@gmail.com, dbarboza@ventanamicro.com, zhiwei_liu@linux.alibaba.com, Deepak Gupta Subject: [PATCH 12/24] target/riscv: tb flag for shadow stack instructions Date: Thu, 25 Jul 2024 16:46:01 -0700 Message-ID: <20240725234614.3850142-13-debug@rivosinc.com> X-Mailer: git-send-email 2.44.0 In-Reply-To: <20240725234614.3850142-1-debug@rivosinc.com> References: <20240725234614.3850142-1-debug@rivosinc.com> MIME-Version: 1.0 Received-SPF: pass client-ip=2607:f8b0:4864:20::230; envelope-from=debug@rivosinc.com; helo=mail-oi1-x230.google.com X-Spam_score_int: -18 X-Spam_score: -1.9 X-Spam_bar: - X-Spam_report: (-1.9 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+qemu-devel=archiver.kernel.org@nongnu.org Sender: qemu-devel-bounces+qemu-devel=archiver.kernel.org@nongnu.org Shadow stack instructions can be decoded as zimop / zcmop or shadow stack instructions depending on whether shadow stack are enabled at current privilege. This requires a TB flag so that correct TB generation and correct TB lookup happens. `DisasContext` gets a field indicating whether bcfi is enabled or not. This patch also implements helper bcfi function which determines if bcfi is enabled at current privilege or not. qemu-user also gets field `ubcfien` indicating whether qemu user has shadow stack enabled or not. Signed-off-by: Deepak Gupta Co-developed-by: Jim Shu Co-developed-by: Andy Chiu --- target/riscv/cpu.c | 2 ++ target/riscv/cpu.h | 4 ++++ target/riscv/cpu_helper.c | 30 ++++++++++++++++++++++++++++++ target/riscv/translate.c | 4 ++++ 4 files changed, 40 insertions(+) diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c index 6b50ae0e45..e1ff246c24 100644 --- a/target/riscv/cpu.c +++ b/target/riscv/cpu.c @@ -1029,6 +1029,8 @@ static void riscv_cpu_reset_hold(Object *obj, ResetType type) #ifdef CONFIG_USER_ONLY /* qemu-user for riscv, fcfi is off by default */ env->ufcfien = false; + /* qemu-user for riscv, bcfi is off by default */ + env->ubcfien = false; #endif #ifndef CONFIG_USER_ONLY diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h index 81283a1d76..0e0a9d2be1 100644 --- a/target/riscv/cpu.h +++ b/target/riscv/cpu.h @@ -231,6 +231,7 @@ struct CPUArchState { #ifdef CONFIG_USER_ONLY uint32_t elf_flags; bool ufcfien; + bool ubcfien; #endif #ifndef CONFIG_USER_ONLY @@ -536,6 +537,7 @@ bool riscv_cpu_vector_enabled(CPURISCVState *env); void riscv_cpu_set_virt_enabled(CPURISCVState *env, bool enable); int riscv_env_mmu_index(CPURISCVState *env, bool ifetch); bool cpu_get_fcfien(CPURISCVState *env); +bool cpu_get_bcfien(CPURISCVState *env); G_NORETURN void riscv_cpu_do_unaligned_access(CPUState *cs, vaddr addr, MMUAccessType access_type, int mmu_idx, uintptr_t retaddr); @@ -610,6 +612,8 @@ FIELD(TB_FLAGS, PRIV, 24, 2) FIELD(TB_FLAGS, AXL, 26, 2) /* zicfilp needs a TB flag to track indirect branches */ FIELD(TB_FLAGS, FCFI_LP_EXPECTED, 28, 1) +/* zicfiss needs a TB flag so that correct TB is located based on tb flags */ +FIELD(TB_FLAGS, BCFI_ENABLED, 29, 1) #ifdef TARGET_RISCV32 #define riscv_cpu_mxl(env) ((void)(env), MXL_RV32) diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c index 2cb1d45467..ce68f5af72 100644 --- a/target/riscv/cpu_helper.c +++ b/target/riscv/cpu_helper.c @@ -93,6 +93,32 @@ bool cpu_get_fcfien(CPURISCVState *env) #endif } +bool cpu_get_bcfien(CPURISCVState *env) +{ +#ifdef CONFIG_USER_ONLY + return env->ubcfien; +#else + /* no cfi extension, return false */ + if (!env_archcpu(env)->cfg.ext_zicfiss) { + return false; + } + + switch (env->priv) { + case PRV_U: + return (env->senvcfg & SENVCFG_SSE) ? true : false; + case PRV_S: + if (env->virt_enabled) { + return (env->henvcfg & HENVCFG_SSE) ? true : false; + } + return (env->menvcfg & MENVCFG_SSE) ? true : false; + case PRV_M: /* M-mode shadow stack is always on if hart implements */ + return true; + default: + g_assert_not_reached(); + } +#endif +} + void cpu_get_tb_cpu_state(CPURISCVState *env, vaddr *pc, uint64_t *cs_base, uint32_t *pflags) { @@ -146,6 +172,10 @@ void cpu_get_tb_cpu_state(CPURISCVState *env, vaddr *pc, env->elp != NO_LP_EXPECTED); } + if (cpu_get_bcfien(env)) { + flags = FIELD_DP32(flags, TB_FLAGS, BCFI_ENABLED, 1); + } + #ifdef CONFIG_USER_ONLY fs = EXT_STATUS_DIRTY; vs = EXT_STATUS_DIRTY; diff --git a/target/riscv/translate.c b/target/riscv/translate.c index c746d7df08..34c9bf093d 100644 --- a/target/riscv/translate.c +++ b/target/riscv/translate.c @@ -121,6 +121,8 @@ typedef struct DisasContext { /* zicfilp extension. cfi enabled or not. lp expected or not */ bool fcfi_enabled; bool fcfi_lp_expected; + /* zicfiss extension, if shadow stack was enabled during TB gen */ + bool bcfi_enabled; } DisasContext; static inline bool has_ext(DisasContext *ctx, uint32_t ext) @@ -1243,6 +1245,8 @@ static void riscv_tr_init_disas_context(DisasContextBase *dcbase, CPUState *cs) ctx->pm_base_enabled = FIELD_EX32(tb_flags, TB_FLAGS, PM_BASE_ENABLED); ctx->ztso = cpu->cfg.ext_ztso; ctx->itrigger = FIELD_EX32(tb_flags, TB_FLAGS, ITRIGGER); + ctx->bcfi_enabled = cpu_get_bcfien(env) && + FIELD_EX32(tb_flags, TB_FLAGS, BCFI_ENABLED); ctx->fcfi_lp_expected = FIELD_EX32(tb_flags, TB_FLAGS, FCFI_LP_EXPECTED); ctx->fcfi_enabled = cpu_get_fcfien(env) && ctx->fcfi_lp_expected; ctx->zero = tcg_constant_tl(0); From patchwork Thu Jul 25 23:46:02 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Deepak Gupta X-Patchwork-Id: 13742238 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id AD85DC3DA70 for ; Thu, 25 Jul 2024 23:50:19 +0000 (UTC) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1sX8Ag-0001CX-FG; Thu, 25 Jul 2024 19:46:54 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1sX8AX-0000ZZ-6O for qemu-devel@nongnu.org; Thu, 25 Jul 2024 19:46:45 -0400 Received: from mail-pf1-x433.google.com ([2607:f8b0:4864:20::433]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.90_1) (envelope-from ) id 1sX8AU-0005N9-33 for qemu-devel@nongnu.org; Thu, 25 Jul 2024 19:46:44 -0400 Received: by mail-pf1-x433.google.com with SMTP id d2e1a72fcca58-70d199fb3dfso373260b3a.3 for ; Thu, 25 Jul 2024 16:46:41 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rivosinc-com.20230601.gappssmtp.com; s=20230601; t=1721951201; x=1722556001; darn=nongnu.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=TyEh2IGT2rrT4mUEjjkYvKQHUbPYvHm8L55gDTTMtGA=; b=uTFXV0huUyloOYgO4FkLC9AoXpY6Il4saILDqUx7NB8aS+qC2DbsOx7B3RJTaA7N7d dOfM2wiq1nrg6NRXdKYsvF5phswLhHY1JZdR4S6YMYEL9LH+eJYnnJjASuV951NzuZnR o6+gDjlcadOu7GGtWtBbt5WVuVqtwFhW65i8QWe4NuSCvA8vLJdS/mR+eQGbIe0jnWUG Sz1uoJuItquekb1CE+4DN5g5XMH6+xO2KM1SemqWOYMHF/xc0s50UufinYDdtHHWVSPJ PKkqq5nmTidNOkiF+bBw8Xb892fTwYbON+qnVBVXuSFGmJf5PrVKc12p18bX1wn0te3X R/Aw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1721951201; x=1722556001; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=TyEh2IGT2rrT4mUEjjkYvKQHUbPYvHm8L55gDTTMtGA=; b=v/YQHPuNbHM+/9AjghsKCwRxABBCiYdDMZ0T+3+rYOY8AEH/ESLqrEBRINFuTI4Ol7 FCueFahrWZfKLVvywI33axUFZUNsm1zjQSKn3s0ZRkjmui1mz6IWw1fkHdJbVJZfYxpM YuEnsqzwGGTzjd1RQ5Wy5MWR45tC28lCDCh7T3gyR4q8y8aE1oF0usJ9ViA36EivZYC4 96qH7lkmgU3wCC0/S79zcKtmHMgiF0zccB4IgGAiESM2L/Dob4vw2k9DQbP8dxiZFL4h /E7qkKFXvX3bA+QxHhiHQtqkxFo/pzQRvgAqWkFOzfFDMBTYCyNT1K3pKTJfFbsJLyU3 /Llw== X-Forwarded-Encrypted: i=1; AJvYcCVN1lDED8eVUyl437p19kts4cETuU8v6zcxvwge5vhWi+yhNvVoNR3WCuj5l3hX3OrNH2kBPeVPbhQ/fgxmwJprw0uQw/Q= X-Gm-Message-State: AOJu0YxqqUyIGrzydAC+jKapm2i5KmyhXOC+h0vm84Kyw4p90kgozzou p9NFh2wtTq/JrJbCV2cL3snLCE7RT5qU5FAYWw1C14BAVvh8DlirXRE76Y0bovg= X-Google-Smtp-Source: AGHT+IHjqrnOK6vx4PkOKSkD1WebI4DqdnjLhiqY1g+NrHDWANqzdrAa2Af0sb0lZjniLUOk8+e2Ug== X-Received: by 2002:a05:6a00:2355:b0:706:8a67:c395 with SMTP id d2e1a72fcca58-70eaa89bc8amr5304137b3a.6.1721951200594; Thu, 25 Jul 2024 16:46:40 -0700 (PDT) Received: from debug.ba.rivosinc.com ([64.71.180.162]) by smtp.gmail.com with ESMTPSA id d2e1a72fcca58-70ead8128d0sm1647565b3a.118.2024.07.25.16.46.39 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 25 Jul 2024 16:46:40 -0700 (PDT) From: Deepak Gupta To: qemu-riscv@nongnu.org, qemu-devel@nongnu.org, jim.shu@sifive.com, andy.chiu@sifive.com, jesse.huang@sifive.com, kito.cheng@sifive.com Cc: palmer@dabbelt.com, Alistair.Francis@wdc.com, laurent@vivier.eu, bmeng.cn@gmail.com, liwei1518@gmail.com, dbarboza@ventanamicro.com, zhiwei_liu@linux.alibaba.com, Deepak Gupta Subject: [PATCH 13/24] target/riscv: implement zicfiss instructions Date: Thu, 25 Jul 2024 16:46:02 -0700 Message-ID: <20240725234614.3850142-14-debug@rivosinc.com> X-Mailer: git-send-email 2.44.0 In-Reply-To: <20240725234614.3850142-1-debug@rivosinc.com> References: <20240725234614.3850142-1-debug@rivosinc.com> MIME-Version: 1.0 Received-SPF: pass client-ip=2607:f8b0:4864:20::433; envelope-from=debug@rivosinc.com; helo=mail-pf1-x433.google.com X-Spam_score_int: -18 X-Spam_score: -1.9 X-Spam_bar: - X-Spam_report: (-1.9 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+qemu-devel=archiver.kernel.org@nongnu.org Sender: qemu-devel-bounces+qemu-devel=archiver.kernel.org@nongnu.org zicfiss has following instructions - sspopchk: pops a value from shadow stack and compares with x1/x5. If they dont match, reports a sw check exception with tval = 3. - sspush: pushes value in x1/x5 on shadow stack - ssrdp: reads current shadow stack - ssamoswap: swaps contents of shadow stack atomically sspopchk/sspush/ssrdp default to zimop if zimop implemented and SSE=0 If SSE=0, ssamoswap is illegal instruction exception. This patch implements shadow stack operations for qemu-user and shadow stack is not protected. Signed-off-by: Deepak Gupta Co-developed-by: Jim Shu Co-developed-by: Andy Chiu --- target/riscv/cpu_bits.h | 2 ++ target/riscv/helper.h | 2 ++ target/riscv/insn32.decode | 17 +++++++-- target/riscv/insn_trans/trans_rva.c.inc | 47 +++++++++++++++++++++++++ target/riscv/op_helper.c | 9 +++++ target/riscv/translate.c | 1 + 6 files changed, 76 insertions(+), 2 deletions(-) diff --git a/target/riscv/cpu_bits.h b/target/riscv/cpu_bits.h index 589326e516..8e179d6965 100644 --- a/target/riscv/cpu_bits.h +++ b/target/riscv/cpu_bits.h @@ -696,6 +696,8 @@ typedef enum RISCVException { /* zicfilp defines lp violation results in sw check with tval = 2*/ #define RISCV_EXCP_SW_CHECK_FCFI_TVAL 2 +/* zicfiss defines ss violation results in sw check with tval = 3*/ +#define RISCV_EXCP_SW_CHECK_BCFI_TVAL 3 #define RISCV_EXCP_INT_FLAG 0x80000000 #define RISCV_EXCP_INT_MASK 0x7fffffff diff --git a/target/riscv/helper.h b/target/riscv/helper.h index ab55bbbf73..4efb7ba4df 100644 --- a/target/riscv/helper.h +++ b/target/riscv/helper.h @@ -124,6 +124,8 @@ DEF_HELPER_2(cbo_zero, void, env, tl) /* Forward CFI label checking */ DEF_HELPER_2(cfi_jalr, void, env, int) DEF_HELPER_2(cfi_check_landing_pad, void, env, int) +/* helper for sschk mismatch (zicfiss) */ +DEF_HELPER_3(sschk_mismatch, void, env, tl, tl) /* Special functions */ DEF_HELPER_2(csrr, tl, env, int) diff --git a/target/riscv/insn32.decode b/target/riscv/insn32.decode index c963c59c8e..c59c992ce2 100644 --- a/target/riscv/insn32.decode +++ b/target/riscv/insn32.decode @@ -65,8 +65,10 @@ # Formats 32: @r ....... ..... ..... ... ..... ....... &r %rs2 %rs1 %rd @i ............ ..... ... ..... ....... &i imm=%imm_i %rs1 %rd +@ss_pop ............ ..... ... ..... ....... &i imm=0 %rs1 rd=0 @b ....... ..... ..... ... ..... ....... &b imm=%imm_b %rs2 %rs1 @s ....... ..... ..... ... ..... ....... &s imm=%imm_s %rs2 %rs1 +@ss_push ....... ..... ..... ... ..... ....... &s imm=0 %rs2 rs1=0 @u .................... ..... ....... &u imm=%imm_u %rd @j .................... ..... ....... &j imm=%imm_j %rd @@ -247,6 +249,7 @@ remud 0000001 ..... ..... 111 ..... 1111011 @r lr_w 00010 . . 00000 ..... 010 ..... 0101111 @atom_ld sc_w 00011 . . ..... ..... 010 ..... 0101111 @atom_st amoswap_w 00001 . . ..... ..... 010 ..... 0101111 @atom_st +ssamoswap_w 01001 . . ..... ..... 010 ..... 0101111 @atom_st amoadd_w 00000 . . ..... ..... 010 ..... 0101111 @atom_st amoxor_w 00100 . . ..... ..... 010 ..... 0101111 @atom_st amoand_w 01100 . . ..... ..... 010 ..... 0101111 @atom_st @@ -260,6 +263,7 @@ amomaxu_w 11100 . . ..... ..... 010 ..... 0101111 @atom_st lr_d 00010 . . 00000 ..... 011 ..... 0101111 @atom_ld sc_d 00011 . . ..... ..... 011 ..... 0101111 @atom_st amoswap_d 00001 . . ..... ..... 011 ..... 0101111 @atom_st +ssamoswap_d 01001 . . ..... ..... 011 ..... 0101111 @atom_st amoadd_d 00000 . . ..... ..... 011 ..... 0101111 @atom_st amoxor_d 00100 . . ..... ..... 011 ..... 0101111 @atom_st amoand_d 01100 . . ..... ..... 011 ..... 0101111 @atom_st @@ -1023,8 +1027,17 @@ amocas_d 00101 . . ..... ..... 011 ..... 0101111 @atom_st amocas_q 00101 . . ..... ..... 100 ..... 0101111 @atom_st # *** Zimop may-be-operation extension *** -mop_r_n 1 . 00 .. 0111 .. ..... 100 ..... 1110011 @mop5 -mop_rr_n 1 . 00 .. 1 ..... ..... 100 ..... 1110011 @mop3 +{ + # zicfiss instructions carved out of mop.r + ssrdp 1100110 11100 00000 100 ..... 1110011 %rd + sspopchk 1100110 11100 ..... 100 00000 1110011 @ss_pop + mop_r_n 1 . 00 .. 0111 .. ..... 100 ..... 1110011 @mop5 +} +{ + # zicfiss instruction carved out of mop.rr + sspush 1100111 ..... 00000 100 00000 1110011 @ss_push + mop_rr_n 1 . 00 .. 1 ..... ..... 100 ..... 1110011 @mop3 +} # *** Zabhb Standard Extension *** amoswap_b 00001 . . ..... ..... 000 ..... 0101111 @atom_st diff --git a/target/riscv/insn_trans/trans_rva.c.inc b/target/riscv/insn_trans/trans_rva.c.inc index 39bbf60f3c..db6c03f6a8 100644 --- a/target/riscv/insn_trans/trans_rva.c.inc +++ b/target/riscv/insn_trans/trans_rva.c.inc @@ -18,6 +18,8 @@ * this program. If not, see . */ +#include "exec/memop.h" + #define REQUIRE_A_OR_ZAAMO(ctx) do { \ if (!ctx->cfg_ptr->ext_zaamo && !has_ext(ctx, RVA)) { \ return false; \ @@ -114,6 +116,28 @@ static bool trans_amoswap_w(DisasContext *ctx, arg_amoswap_w *a) return gen_amo(ctx, a, &tcg_gen_atomic_xchg_tl, MO_TESL); } +static bool trans_ssamoswap_w(DisasContext *ctx, arg_amoswap_w *a) +{ + REQUIRE_A_OR_ZAAMO(ctx); + /* default for qemu-user, use regular RW memory and thus mmu_idx=0 */ + int ss_mmu_idx = 0; + + /* back cfi was not enabled, return false */ + if (!ctx->bcfi_enabled) { + return false; + } + + TCGv dest = dest_gpr(ctx, a->rd); + TCGv src1, src2 = get_gpr(ctx, a->rs2, EXT_NONE); + + decode_save_opc(ctx); + src1 = get_address(ctx, a->rs1, 0); + + tcg_gen_atomic_xchg_tl(dest, src1, src2, ss_mmu_idx, (MO_ALIGN | MO_TESL)); + gen_set_gpr(ctx, a->rd, dest); + return true; +} + static bool trans_amoadd_w(DisasContext *ctx, arg_amoadd_w *a) { REQUIRE_A_OR_ZAAMO(ctx); @@ -183,6 +207,29 @@ static bool trans_amoswap_d(DisasContext *ctx, arg_amoswap_d *a) return gen_amo(ctx, a, &tcg_gen_atomic_xchg_tl, MO_TEUQ); } +static bool trans_ssamoswap_d(DisasContext *ctx, arg_amoswap_w *a) +{ + REQUIRE_64BIT(ctx); + REQUIRE_A_OR_ZAAMO(ctx); + /* default for qemu-user, use regular RW memory and thus mmu_idx=0 */ + int ss_mmu_idx = 0; + + /* back cfi was not enabled, return false */ + if (!ctx->bcfi_enabled) { + return false; + } + + TCGv dest = dest_gpr(ctx, a->rd); + TCGv src1, src2 = get_gpr(ctx, a->rs2, EXT_NONE); + + decode_save_opc(ctx); + src1 = get_address(ctx, a->rs1, 0); + + tcg_gen_atomic_xchg_tl(dest, src1, src2, ss_mmu_idx, (MO_ALIGN | MO_TESQ)); + gen_set_gpr(ctx, a->rd, dest); + return true; +} + static bool trans_amoadd_d(DisasContext *ctx, arg_amoadd_d *a) { REQUIRE_64BIT(ctx); diff --git a/target/riscv/op_helper.c b/target/riscv/op_helper.c index 2d152f0a00..54baa3a966 100644 --- a/target/riscv/op_helper.c +++ b/target/riscv/op_helper.c @@ -291,6 +291,15 @@ void helper_cfi_check_landing_pad(CPURISCVState *env, int lbl) } } +void helper_sschk_mismatch(CPURISCVState *env, target_ulong rs1, + target_ulong ssra) +{ + if (rs1 != ssra) { + env->sw_check_code = RISCV_EXCP_SW_CHECK_BCFI_TVAL; + riscv_raise_exception(env, RISCV_EXCP_SW_CHECK, GETPC()); + } +} + #ifndef CONFIG_USER_ONLY target_ulong helper_sret(CPURISCVState *env) diff --git a/target/riscv/translate.c b/target/riscv/translate.c index 34c9bf093d..9152a963ee 100644 --- a/target/riscv/translate.c +++ b/target/riscv/translate.c @@ -1143,6 +1143,7 @@ static uint32_t opcode_at(DisasContextBase *dcbase, target_ulong pc) #include "insn_trans/trans_rvzawrs.c.inc" #include "insn_trans/trans_rvzicbo.c.inc" #include "insn_trans/trans_rvzimop.c.inc" +#include "insn_trans/trans_rvzicfiss.c.inc" #include "insn_trans/trans_rvzfa.c.inc" #include "insn_trans/trans_rvzfh.c.inc" #include "insn_trans/trans_rvk.c.inc" From patchwork Thu Jul 25 23:46:03 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Deepak Gupta X-Patchwork-Id: 13742230 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id F1D81C3DA49 for ; Thu, 25 Jul 2024 23:49:21 +0000 (UTC) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1sX8Af-00018m-Fj; Thu, 25 Jul 2024 19:46:53 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1sX8AX-0000a7-9v for qemu-devel@nongnu.org; Thu, 25 Jul 2024 19:46:45 -0400 Received: from mail-il1-x129.google.com ([2607:f8b0:4864:20::129]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.90_1) (envelope-from ) id 1sX8AV-0005NR-5X for qemu-devel@nongnu.org; Thu, 25 Jul 2024 19:46:44 -0400 Received: by mail-il1-x129.google.com with SMTP id e9e14a558f8ab-381f24d6bc4so4098725ab.2 for ; Thu, 25 Jul 2024 16:46:42 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rivosinc-com.20230601.gappssmtp.com; s=20230601; t=1721951202; x=1722556002; darn=nongnu.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=uj9qOhBpCT9W/nbC5avAHQrsYFSH2V3flkgQB5x2ClI=; b=RHWukBa5KReBnH/1nZxlBJ+n/1PQ/B7nQCNbiSTmP4ZVSBX9Tv6D3NmHfMeDGS6Ynr C82ms7PvNOOdKeZkGWAqde5WxYaJxKTZTPWp9lNb2k/g8n3MR0HoK+gUcbRArtS7xqxJ EU9I2fUOQzdi5F4mxG4ZMYYjSERjZ9MeAslA361gbS9zwkwR4Jl+DDKx6dQhSKUUGnPs nn2YwNxE0f/WEb3/q8nCROmlnbCPLJCS6WRbhYX3lgnwN7YDwXkPKnVsldnGnY1dLqsC qeIXKkazDdiZGhEUTcduFJB5a+23PFEGwRbq9IPXlGRbjoNIDTOOTElbEtQ+4hW3ZvMQ +sDQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1721951202; x=1722556002; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=uj9qOhBpCT9W/nbC5avAHQrsYFSH2V3flkgQB5x2ClI=; b=c3Nzsk6nkzuzldDLjHtz1CtN0PoHe0PFqOPmgLd76TO7glQ3oxDijkOOX3oy0W/tZE RAVh5XObbUb68Z6wFENxt0fMToaesNy510B39Wl5TYryhMVP1qP2zhrE32hh4de5kWi9 jwpdMWRs4AVcbc4syjoEI5wpRm3L2DaJu4qL1ROIrlFgAfjwWtkoRvtNi167t7yZOuUM bY1RXPu8pjJXOArrD4WA0fl5mHd/sT/AC3rok0ZQaJs+ePIzM3ZlDFOA1/UEviwhfwj1 XEhi2pkFU6r+8m5Ry5eBTsanqY6WC1cJUY5nY5ANT4OXd7/tVBWPZF+Na5WOOh5gLti7 gavw== X-Forwarded-Encrypted: i=1; AJvYcCXhH73h2mgaL8DKx54kIps9x7DIDsP/s99IeZSJPDx6Ch6xRbuTtL3SaqM2zS8ToPfj116AE7PIRHx09UJds6HLjpRUBRE= X-Gm-Message-State: AOJu0YysLFezAJvZ1C9XAXLV4zoIBW4dYOtIAwNKCC2ohlpBLRS9uCl7 0WXkn6dUGC9ref4MGX0vYZike9wIGT/HafiFXe83RVsyrx3fM/1XuuHdTsAUBBk= X-Google-Smtp-Source: AGHT+IFZF2Y150hG36srXsae5j+LoDyBCvqWbbzlzdW4nMtoZOcidZNSbXQSx6jPlXjLHZFJuh7B3A== X-Received: by 2002:a05:6e02:13af:b0:398:b11a:4286 with SMTP id e9e14a558f8ab-39a23fae551mr44546515ab.14.1721951201901; Thu, 25 Jul 2024 16:46:41 -0700 (PDT) Received: from debug.ba.rivosinc.com ([64.71.180.162]) by smtp.gmail.com with ESMTPSA id d2e1a72fcca58-70ead8128d0sm1647565b3a.118.2024.07.25.16.46.40 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 25 Jul 2024 16:46:41 -0700 (PDT) From: Deepak Gupta To: qemu-riscv@nongnu.org, qemu-devel@nongnu.org, jim.shu@sifive.com, andy.chiu@sifive.com, jesse.huang@sifive.com, kito.cheng@sifive.com Cc: palmer@dabbelt.com, Alistair.Francis@wdc.com, laurent@vivier.eu, bmeng.cn@gmail.com, liwei1518@gmail.com, dbarboza@ventanamicro.com, zhiwei_liu@linux.alibaba.com, Deepak Gupta Subject: [PATCH 14/24] target/riscv: compressed encodings for sspush and sspopchk Date: Thu, 25 Jul 2024 16:46:03 -0700 Message-ID: <20240725234614.3850142-15-debug@rivosinc.com> X-Mailer: git-send-email 2.44.0 In-Reply-To: <20240725234614.3850142-1-debug@rivosinc.com> References: <20240725234614.3850142-1-debug@rivosinc.com> MIME-Version: 1.0 Received-SPF: pass client-ip=2607:f8b0:4864:20::129; envelope-from=debug@rivosinc.com; helo=mail-il1-x129.google.com X-Spam_score_int: -18 X-Spam_score: -1.9 X-Spam_bar: - X-Spam_report: (-1.9 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+qemu-devel=archiver.kernel.org@nongnu.org Sender: qemu-devel-bounces+qemu-devel=archiver.kernel.org@nongnu.org sspush/sspopchk have compressed encodings carved out of zcmops. compressed sspush is designated as c.mop.1 while compressed sspopchk is designated as c.mop.5. Note that c.sspush x1 exists while c.sspush x5 doesn't. Similarly c.sspopchk x5 exists while c.sspopchk x1 doesn't. Signed-off-by: Deepak Gupta Co-developed-by: Jim Shu Co-developed-by: Andy Chiu --- target/riscv/insn16.decode | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/target/riscv/insn16.decode b/target/riscv/insn16.decode index 3953bcf82d..d9fb74fef6 100644 --- a/target/riscv/insn16.decode +++ b/target/riscv/insn16.decode @@ -69,10 +69,12 @@ # Formats 16: @cr .... ..... ..... .. &r rs2=%rs2_5 rs1=%rd %rd @ci ... . ..... ..... .. &i imm=%imm_ci rs1=%rd %rd +@c_sspop ... . ..... ..... .. &i imm=0 rs1=5 rd=0 @cl_q ... . ..... ..... .. &i imm=%uimm_cl_q rs1=%rs1_3 rd=%rs2_3 @cl_d ... ... ... .. ... .. &i imm=%uimm_cl_d rs1=%rs1_3 rd=%rs2_3 @cl_w ... ... ... .. ... .. &i imm=%uimm_cl_w rs1=%rs1_3 rd=%rs2_3 @cs_2 ... ... ... .. ... .. &r rs2=%rs2_3 rs1=%rs1_3 rd=%rs1_3 +@c_sspush ... ... ... .. ... .. &s imm=0 rs1=0 rs2=1 @cs_q ... ... ... .. ... .. &s imm=%uimm_cl_q rs1=%rs1_3 rs2=%rs2_3 @cs_d ... ... ... .. ... .. &s imm=%uimm_cl_d rs1=%rs1_3 rs2=%rs2_3 @cs_w ... ... ... .. ... .. &s imm=%uimm_cl_w rs1=%rs1_3 rs2=%rs2_3 @@ -140,6 +142,8 @@ sw 110 ... ... .. ... 00 @cs_w addi 000 . ..... ..... 01 @ci addi 010 . ..... ..... 01 @c_li { + sspush 011 0 00001 00000 01 @c_sspush # c.sspush x1 carving out of zcmops + sspopchk 011 0 00101 00000 01 @c_sspop # c.sspopchk x5 carving out of zcmops c_mop_n 011 0 0 n:3 1 00000 01 illegal 011 0 ----- 00000 01 # c.addi16sp and c.lui, RES nzimm=0 addi 011 . 00010 ..... 01 @c_addi16sp From patchwork Thu Jul 25 23:46:04 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Deepak Gupta X-Patchwork-Id: 13742240 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 356FBC3DA70 for ; Thu, 25 Jul 2024 23:50:37 +0000 (UTC) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1sX8Ag-0001C6-9e; Thu, 25 Jul 2024 19:46:54 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1sX8AY-0000gy-W4 for qemu-devel@nongnu.org; Thu, 25 Jul 2024 19:46:47 -0400 Received: from mail-ot1-x32b.google.com ([2607:f8b0:4864:20::32b]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.90_1) (envelope-from ) id 1sX8AW-0005Ng-V0 for qemu-devel@nongnu.org; Thu, 25 Jul 2024 19:46:46 -0400 Received: by mail-ot1-x32b.google.com with SMTP id 46e09a7af769-7037a208ff5so283185a34.0 for ; Thu, 25 Jul 2024 16:46:44 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rivosinc-com.20230601.gappssmtp.com; s=20230601; t=1721951203; x=1722556003; darn=nongnu.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=TEfM6wszBxNOPAb1bi7YlYVEQlyhfpgNlHnmktCCwL8=; b=SUIOkEDPizHl2dbSdTdHKlIahuk9p2CvLaiVy/nTO4ELIGjlMGT+9wu869OAD5nc0s utqpmUgOy09J8Ih94GyjeHPsuB0Haemj4WaZCqLThS2FzV9TEPlUL/V8Brr9oqWVTokH XuPQccVYSHbF0CEeBA2xHaHlrHD+51A39CT2TJz2IjXJ9o1xvG6Va65En3Vygk8jCj+j bgGqZDVcFyoUT42rFN3uzJVlhxyynMCxeq4BTujDQ+apg4pmy5QIIKSRBe8gUWA3HmCr hAqvjM5+uxF57yJoGZNzCxpoFJE3QeIK3ynDbqSs0mPA/oVOk0q0b5QOFr8LYSvZQXg2 S4DA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1721951203; x=1722556003; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=TEfM6wszBxNOPAb1bi7YlYVEQlyhfpgNlHnmktCCwL8=; b=xCK+yEI+RtwrYWmwc8XmKXBH8SGoanBZbwukLGxU7FouKN+f38yzTIjstsMmQWYpZJ fEa5iwDyjAz8kzcUupVyIqc1YSS7VHiozco7I7weaw+lteAyqBmBpCZyPP5UwnWGHhxa C1t3l4U8BW2b51zI7LiHKUMJuCtuyFpRvVq/Y5sNr0wvGRvGXe7nTOtyyofEKJ79vp/+ nz4JaRxcyOcUTotIBsIWyz0p3NwV6jPDQPTxYySUDxAuv7Z9c9eA3NszqHUdF+vET5D/ HozC+Fbyzc89STqR9lCfWtpXkFOa/BFDuz3i1HAe1UBKkSKBlL6hsUXhmkzznRou9UAZ oM/g== X-Forwarded-Encrypted: i=1; AJvYcCX2DhBVJDiGFTx1uoet/4xJ8t9vG8tcw2Vrqiurgxv7oIfUToFWg4/vrfSLKtEuWrLMQ8OSJ6toTMx9AfepU2CWiS8F/yg= X-Gm-Message-State: AOJu0YwznaAxAxrK4C+eT22u7rJ/HIZkkL6KrE/D/mmA+wrrpy6zVOqg d9G1/KHw4J/CwZEuMTEFQ2OhHqEwCVfYTHfXynTsMvnvOqrwWy4EDP8uTo9QK9o= X-Google-Smtp-Source: AGHT+IHjwr/fPfQtXZbxxrHongzM3Re79h+jtXNWHsMnsG/iH9n4njrPYNsFuc6evFSGjGbocGurZQ== X-Received: by 2002:a05:6830:6489:b0:708:29dc:d2fc with SMTP id 46e09a7af769-7093223d028mr4086777a34.19.1721951203243; Thu, 25 Jul 2024 16:46:43 -0700 (PDT) Received: from debug.ba.rivosinc.com ([64.71.180.162]) by smtp.gmail.com with ESMTPSA id d2e1a72fcca58-70ead8128d0sm1647565b3a.118.2024.07.25.16.46.42 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 25 Jul 2024 16:46:42 -0700 (PDT) From: Deepak Gupta To: qemu-riscv@nongnu.org, qemu-devel@nongnu.org, jim.shu@sifive.com, andy.chiu@sifive.com, jesse.huang@sifive.com, kito.cheng@sifive.com Cc: palmer@dabbelt.com, Alistair.Francis@wdc.com, laurent@vivier.eu, bmeng.cn@gmail.com, liwei1518@gmail.com, dbarboza@ventanamicro.com, zhiwei_liu@linux.alibaba.com, Deepak Gupta Subject: [PATCH 15/24] target/riscv: mmu changes for zicfiss shadow stack protection Date: Thu, 25 Jul 2024 16:46:04 -0700 Message-ID: <20240725234614.3850142-16-debug@rivosinc.com> X-Mailer: git-send-email 2.44.0 In-Reply-To: <20240725234614.3850142-1-debug@rivosinc.com> References: <20240725234614.3850142-1-debug@rivosinc.com> MIME-Version: 1.0 Received-SPF: pass client-ip=2607:f8b0:4864:20::32b; envelope-from=debug@rivosinc.com; helo=mail-ot1-x32b.google.com X-Spam_score_int: -18 X-Spam_score: -1.9 X-Spam_bar: - X-Spam_report: (-1.9 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=unavailable autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+qemu-devel=archiver.kernel.org@nongnu.org Sender: qemu-devel-bounces+qemu-devel=archiver.kernel.org@nongnu.org zicfiss protects shadow stack using new page table encodings PTE.W=0, PTE.R=0 and PTE.X=0. This encoding is reserved if zicfiss is not implemented or if shadow stack are not enabled. Loads on shadow stack memory are allowed while stores to shadow stack memory leads to access faults. Shadow stack accesses to RO memory leads to store page fault. To implement special nature of shadow stack memory where only selected stores (shadow stack stores from sspush) have to be allowed while rest of regular stores disallowed, new MMU TLB index is created for shadow stack. Signed-off-by: Deepak Gupta --- target/riscv/cpu_helper.c | 61 +++++++++++++++++++++++++++++++++++++-- target/riscv/internals.h | 3 ++ 2 files changed, 62 insertions(+), 2 deletions(-) diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c index ce68f5af72..7942587a56 100644 --- a/target/riscv/cpu_helper.c +++ b/target/riscv/cpu_helper.c @@ -819,6 +819,18 @@ void riscv_cpu_set_mode(CPURISCVState *env, target_ulong newpriv) env->load_res = -1; } +static bool legal_sstack_access(int access_type, bool sstack_inst, + bool sstack_attribute) +{ + /* + * Read/write/execution permissions are checked as usual. Shadow + * stack enforcement is just that (1) instruction type must match + * the attribute unless (2) a non-SS load to an SS region. + */ + return (sstack_inst == sstack_attribute) || + ((access_type == MMU_DATA_LOAD) && sstack_attribute); +} + /* * get_physical_address_pmp - check PMP permission for this physical address * @@ -896,6 +908,8 @@ static int get_physical_address(CPURISCVState *env, hwaddr *physical, hwaddr ppn; int napot_bits = 0; target_ulong napot_mask; + bool is_sstack_insn = ((mmu_idx & MMU_IDX_SS_ACCESS) == MMU_IDX_SS_ACCESS); + bool sstack_page = false; /* * Check if we should use the background registers for the two @@ -1104,15 +1118,45 @@ restart: return TRANSLATE_FAIL; } + /* + * When backward CFI is enabled, the R=0, W=1, X=0 reserved encoding + * is used to mark Shadow Stack (SS) pages. If back CFI enabled, allow + * normal loads on SS pages, regular stores raise store access fault + * and avoid hitting the reserved-encoding case. Only shadow stack + * stores are allowed on SS pages. Shadow stack loads and stores on + * regular memory (non-SS) raise load and store/AMO access fault. + * Second stage translations don't participate in Shadow Stack. + */ + sstack_page = (cpu_get_bcfien(env) && first_stage && + ((pte & (PTE_R | PTE_W | PTE_X)) == PTE_W)); + /* Check for reserved combinations of RWX flags. */ switch (pte & (PTE_R | PTE_W | PTE_X)) { - case PTE_W: case PTE_W | PTE_X: + case PTE_W: + if (sstack_page) { /* if shadow stack page, PTE_W is not reserved */ + break; + } return TRANSLATE_FAIL; } + /* Illegal combo of instruction type and page attribute */ + if (!legal_sstack_access(access_type, is_sstack_insn, + sstack_page)) { + /* shadow stack instruction and RO page then it's a page fault */ + if (is_sstack_insn && ((pte & (PTE_R | PTE_W | PTE_X)) == PTE_R)) { + return TRANSLATE_FAIL; + } + /* In all other cases it's an access fault, so raise PMP_FAIL */ + return TRANSLATE_PMP_FAIL; + } + int prot = 0; - if (pte & PTE_R) { + /* + * If PTE has read bit in it or it's shadow stack page, + * then reads allowed + */ + if ((pte & PTE_R) || sstack_page) { prot |= PAGE_READ; } if (pte & PTE_W) { @@ -1350,9 +1394,17 @@ void riscv_cpu_do_unaligned_access(CPUState *cs, vaddr addr, break; case MMU_DATA_LOAD: cs->exception_index = RISCV_EXCP_LOAD_ADDR_MIS; + /* shadow stack mis aligned accesses are access faults */ + if (mmu_idx & MMU_IDX_SS_ACCESS) { + cs->exception_index = RISCV_EXCP_LOAD_ACCESS_FAULT; + } break; case MMU_DATA_STORE: cs->exception_index = RISCV_EXCP_STORE_AMO_ADDR_MIS; + /* shadow stack mis aligned accesses are access faults */ + if (mmu_idx & MMU_IDX_SS_ACCESS) { + cs->exception_index = RISCV_EXCP_STORE_AMO_ACCESS_FAULT; + } break; default: g_assert_not_reached(); @@ -1408,6 +1460,11 @@ bool riscv_cpu_tlb_fill(CPUState *cs, vaddr address, int size, qemu_log_mask(CPU_LOG_MMU, "%s ad %" VADDR_PRIx " rw %d mmu_idx %d\n", __func__, address, access_type, mmu_idx); + /* If shadow stack instruction initiated this access, treat it as store */ + if (mmu_idx & MMU_IDX_SS_ACCESS) { + access_type = MMU_DATA_STORE; + } + pmu_tlb_fill_incr_ctr(cpu, access_type); if (two_stage_lookup) { /* Two stage lookup */ diff --git a/target/riscv/internals.h b/target/riscv/internals.h index 0ac17bc5ad..dad0657c80 100644 --- a/target/riscv/internals.h +++ b/target/riscv/internals.h @@ -30,12 +30,15 @@ * - U+2STAGE 0b100 * - S+2STAGE 0b101 * - S+SUM+2STAGE 0b110 + * - Shadow stack+U 0b1000 + * - Shadow stack+S 0b1001 */ #define MMUIdx_U 0 #define MMUIdx_S 1 #define MMUIdx_S_SUM 2 #define MMUIdx_M 3 #define MMU_2STAGE_BIT (1 << 2) +#define MMU_IDX_SS_ACCESS (1 << 3) static inline int mmuidx_priv(int mmu_idx) { From patchwork Thu Jul 25 23:46:05 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Deepak Gupta X-Patchwork-Id: 13742228 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 32DE2C3DA70 for ; Thu, 25 Jul 2024 23:48:57 +0000 (UTC) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1sX8Ac-0000vf-Mv; Thu, 25 Jul 2024 19:46:50 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1sX8Aa-0000m8-7L for qemu-devel@nongnu.org; Thu, 25 Jul 2024 19:46:48 -0400 Received: from mail-pf1-x42a.google.com ([2607:f8b0:4864:20::42a]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.90_1) (envelope-from ) id 1sX8AX-0005OG-Uq for qemu-devel@nongnu.org; Thu, 25 Jul 2024 19:46:47 -0400 Received: by mail-pf1-x42a.google.com with SMTP id d2e1a72fcca58-70d23caf8ddso378212b3a.0 for ; Thu, 25 Jul 2024 16:46:45 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rivosinc-com.20230601.gappssmtp.com; s=20230601; t=1721951205; x=1722556005; darn=nongnu.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=wy4f3pBGr8WQhxgyF2AP1zi0eDNpe0O/D4C+yvhRH7Q=; b=xKRTch5gGJVa5NuhOPaeNeBK9VWEiu6/BU/Kyqrq8GyTgzCOOZBmXawe4bpLdBHPF7 eJhDSG27tQv6OCMT3ElQqZR9Y+2AuJOY10o4OV3hsG8LbTaX7Fa9u7jee/zMCg3q5czh u3GUgPQGwnaigscHnQdj+30aw4pDXobjBVucn09gmg2IKTxXzqrrHYwO3YsS/wO53HMp lbHzaNvxe6MUCn0QggUCHiYCCuL6SHPIxlHKwmK0J1MgJkBQwe7fHkZH+eCjmSgdKolq U7U59blavpQe3SGwPi+XS6H/LX0CAZybsqri+Nl7s2dEqStqfy17GwsZAXrZAJ/CRIML q8JQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1721951205; x=1722556005; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=wy4f3pBGr8WQhxgyF2AP1zi0eDNpe0O/D4C+yvhRH7Q=; b=OwMZLmHknTYtiaw+MTH3eArZO2dosinxZVBrTCc6CeTFPF8UAtM2L792jlBpN8FTuo 0OKhwUTs6y2Tph6i4BEt6IHPCs34QQPwyeVe1T1NwgdJOoHoShsTl4i5mHmDmURIoZ1c b9oMfXD+0YEIyPnJfkLNiYVDwW39NnYW+bqJdbusFSaWYQmMQVw3SnC450NqSk+Ky0Ak 5R59nHetS3r/LekTVaOD0PRHyBmjFn0PkN7Ex8vPMShlglgwgN6YBYJwugJjHMDnGW9w IBIJf/LNJpyD9KcNHv8Q1w6YfCfTso/67cqzJEfndWkemKPpBI2yXt5v5JDfsKgbD1QH k6aw== X-Forwarded-Encrypted: i=1; AJvYcCXSJoMCDgfIRHQmEkG7iNlQB87yG2L5N4arkJmcoiOgfv+IKZaPBK8M9F4HrDFibCYV+CwdBuRZ6PoF+gQx12Sc9E4VSjE= X-Gm-Message-State: AOJu0YwusBdk8IDSpz603yApXJxBwCK83EBxnW23DX+wRLmbQsOh+9eE mxQwdonoDOfHKYl2gRs4PggGEj2R72ua7j5DhJsjepbi5F80Ow1mX3+5c1Ryi7U= X-Google-Smtp-Source: AGHT+IHbnbaPJYWuraVbzSGWArke8EI3kx7BS8Q4NKy8d3SiXcfWKEUrQzYpBFlC5hobXn8N+L9w0w== X-Received: by 2002:a05:6a00:80a:b0:70c:f1fa:d7a3 with SMTP id d2e1a72fcca58-70eae8eb0cfmr4108411b3a.12.1721951204543; Thu, 25 Jul 2024 16:46:44 -0700 (PDT) Received: from debug.ba.rivosinc.com ([64.71.180.162]) by smtp.gmail.com with ESMTPSA id d2e1a72fcca58-70ead8128d0sm1647565b3a.118.2024.07.25.16.46.43 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 25 Jul 2024 16:46:44 -0700 (PDT) From: Deepak Gupta To: qemu-riscv@nongnu.org, qemu-devel@nongnu.org, jim.shu@sifive.com, andy.chiu@sifive.com, jesse.huang@sifive.com, kito.cheng@sifive.com Cc: palmer@dabbelt.com, Alistair.Francis@wdc.com, laurent@vivier.eu, bmeng.cn@gmail.com, liwei1518@gmail.com, dbarboza@ventanamicro.com, zhiwei_liu@linux.alibaba.com, Deepak Gupta Subject: [PATCH 16/24] target/riscv: shadow stack mmu index for shadow stack instructions Date: Thu, 25 Jul 2024 16:46:05 -0700 Message-ID: <20240725234614.3850142-17-debug@rivosinc.com> X-Mailer: git-send-email 2.44.0 In-Reply-To: <20240725234614.3850142-1-debug@rivosinc.com> References: <20240725234614.3850142-1-debug@rivosinc.com> MIME-Version: 1.0 Received-SPF: pass client-ip=2607:f8b0:4864:20::42a; envelope-from=debug@rivosinc.com; helo=mail-pf1-x42a.google.com X-Spam_score_int: -18 X-Spam_score: -1.9 X-Spam_bar: - X-Spam_report: (-1.9 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+qemu-devel=archiver.kernel.org@nongnu.org Sender: qemu-devel-bounces+qemu-devel=archiver.kernel.org@nongnu.org Shadow stack instructions shadow stack mmu index for load/stores. `MMU_IDX_SS_ACCESS` at bit positon 3 is used as shadow stack index. Shadow stack mmu index depend on privilege and SUM bit. If shadow stack accesses happening in user mode, shadow stack mmu index = 0b1000. If shaodw stack access happening in supervisor mode mmu index = 0b1001. If shadow stack access happening in supervisor mode with SUM=1 then mmu index = 0b1010 Signed-off-by: Deepak Gupta --- target/riscv/cpu.h | 13 +++++++++++++ target/riscv/cpu_helper.c | 3 +++ target/riscv/insn_trans/trans_rva.c.inc | 8 ++++++++ target/riscv/internals.h | 1 + target/riscv/translate.c | 25 +++++++++++++++++++++++++ 5 files changed, 50 insertions(+) diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h index 0e0a9d2be1..82475490ab 100644 --- a/target/riscv/cpu.h +++ b/target/riscv/cpu.h @@ -614,6 +614,19 @@ FIELD(TB_FLAGS, AXL, 26, 2) FIELD(TB_FLAGS, FCFI_LP_EXPECTED, 28, 1) /* zicfiss needs a TB flag so that correct TB is located based on tb flags */ FIELD(TB_FLAGS, BCFI_ENABLED, 29, 1) +/* + * zicfiss shadow stack is special memory on which regular stores aren't + * allowed but shadow stack stores are allowed. Shadow stack stores can + * happen as `sspush` or `ssamoswap` instructions. `sspush` implicitly + * takes shadow stack address from CSR_SSP. But `ssamoswap` takes address + * from encoded input register and it will be used by supervisor software + * to access (read/write) user shadow stack for setting up rt_frame during + * signal delivery. Supervisor software will do so by setting SUM=1. Thus + * a TB flag is needed if SUM was 1 during TB generation to correctly + * reflect memory permissions to access shadow stack user memory from + * supervisor mode. + */ +FIELD(TB_FLAGS, SUM, 30, 1) #ifdef TARGET_RISCV32 #define riscv_cpu_mxl(env) ((void)(env), MXL_RV32) diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c index 7942587a56..b2bb1e4293 100644 --- a/target/riscv/cpu_helper.c +++ b/target/riscv/cpu_helper.c @@ -180,6 +180,9 @@ void cpu_get_tb_cpu_state(CPURISCVState *env, vaddr *pc, fs = EXT_STATUS_DIRTY; vs = EXT_STATUS_DIRTY; #else + flags = FIELD_DP32(flags, TB_FLAGS, SUM, + ((env->mstatus & MSTATUS_SUM) == MSTATUS_SUM)); + flags = FIELD_DP32(flags, TB_FLAGS, PRIV, env->priv); flags |= riscv_env_mmu_index(env, 0); diff --git a/target/riscv/insn_trans/trans_rva.c.inc b/target/riscv/insn_trans/trans_rva.c.inc index db6c03f6a8..68b71339a3 100644 --- a/target/riscv/insn_trans/trans_rva.c.inc +++ b/target/riscv/insn_trans/trans_rva.c.inc @@ -132,6 +132,10 @@ static bool trans_ssamoswap_w(DisasContext *ctx, arg_amoswap_w *a) decode_save_opc(ctx); src1 = get_address(ctx, a->rs1, 0); +#ifndef CONFIG_USER_ONLY + /* Shadow stack access and thus index is SS TLB index */ + ss_mmu_idx = get_ss_index(ctx); +#endif tcg_gen_atomic_xchg_tl(dest, src1, src2, ss_mmu_idx, (MO_ALIGN | MO_TESL)); gen_set_gpr(ctx, a->rd, dest); @@ -224,6 +228,10 @@ static bool trans_ssamoswap_d(DisasContext *ctx, arg_amoswap_w *a) decode_save_opc(ctx); src1 = get_address(ctx, a->rs1, 0); +#ifndef CONFIG_USER_ONLY + /* Shadow stack access and thus index is SS TLB index */ + ss_mmu_idx = get_ss_index(ctx); +#endif tcg_gen_atomic_xchg_tl(dest, src1, src2, ss_mmu_idx, (MO_ALIGN | MO_TESQ)); gen_set_gpr(ctx, a->rd, dest); diff --git a/target/riscv/internals.h b/target/riscv/internals.h index dad0657c80..5147d6bf90 100644 --- a/target/riscv/internals.h +++ b/target/riscv/internals.h @@ -32,6 +32,7 @@ * - S+SUM+2STAGE 0b110 * - Shadow stack+U 0b1000 * - Shadow stack+S 0b1001 + * - Shadow stack+SUM 0b1010 */ #define MMUIdx_U 0 #define MMUIdx_S 1 diff --git a/target/riscv/translate.c b/target/riscv/translate.c index 9152a963ee..ad0f841807 100644 --- a/target/riscv/translate.c +++ b/target/riscv/translate.c @@ -123,6 +123,8 @@ typedef struct DisasContext { bool fcfi_lp_expected; /* zicfiss extension, if shadow stack was enabled during TB gen */ bool bcfi_enabled; + /* SUM was on during tb translation? */ + bool sum; } DisasContext; static inline bool has_ext(DisasContext *ctx, uint32_t ext) @@ -1128,6 +1130,29 @@ static uint32_t opcode_at(DisasContextBase *dcbase, target_ulong pc) return translator_ldl(env, &ctx->base, pc); } +#ifndef CONFIG_USER_ONLY +static unsigned int get_ss_index(DisasContext *ctx) +{ + int ss_mmu_idx = MMU_IDX_SS_ACCESS; + + /* + * If priv mode is S then a separate index for supervisor + * shadow stack accesses + */ + if (ctx->priv == PRV_S) { + ss_mmu_idx |= MMUIdx_S; + } + + /* If SUM was set, SS index should have S cleared */ + if (ctx->sum) { + ss_mmu_idx &= ~(MMUIdx_S); + ss_mmu_idx |= MMUIdx_S_SUM; + } + + return ss_mmu_idx; +} +#endif + /* Include insn module translation function */ #include "insn_trans/trans_rvi.c.inc" #include "insn_trans/trans_rvm.c.inc" From patchwork Thu Jul 25 23:46:06 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Deepak Gupta X-Patchwork-Id: 13742233 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 4C622C52CD8 for ; Thu, 25 Jul 2024 23:49:29 +0000 (UTC) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1sX8Af-00018h-Ff; Thu, 25 Jul 2024 19:46:53 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1sX8Ab-0000qO-6X for qemu-devel@nongnu.org; Thu, 25 Jul 2024 19:46:49 -0400 Received: from mail-pf1-x42d.google.com ([2607:f8b0:4864:20::42d]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.90_1) (envelope-from ) id 1sX8AZ-0005OZ-Cs for qemu-devel@nongnu.org; Thu, 25 Jul 2024 19:46:48 -0400 Received: by mail-pf1-x42d.google.com with SMTP id d2e1a72fcca58-70d23caf8ddso378224b3a.0 for ; Thu, 25 Jul 2024 16:46:46 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rivosinc-com.20230601.gappssmtp.com; s=20230601; t=1721951206; x=1722556006; darn=nongnu.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=266neMCz6T2Ay7h8fQ0tNZU+3Glrf37EuuzFIpKJGMw=; b=V40ovafz2wZW7akzOmpRyHCleewJ91KSgIJRblUXFYMDWVi02hGh7AR8K5kRkR/q93 mr4OM3L3bIGfpc+wYmbiRUrlwY456UA1ed3sXMnhX7XgF+AHtqjMGAXWCnOq7oT8rbBa iRcm13Sk/Z+JiY80PONbStuHtoyAJeN90JxDf4nJ9KKG4tVte0KSvdXTQlkN4zF3mkKm fOL/wEElNs1aieieuzUE1B/Y8aVvETRaFzBDKU9W8Nt53zOpLvNnUOHeRkt0+LTh2DeW XLMW+lSO/Izix0Nn+5Ufr+eXd4JlQQzHqDK1nmXY4Im1o344BTxx9BMug7k8vqbhisZ6 /1FA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1721951206; x=1722556006; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=266neMCz6T2Ay7h8fQ0tNZU+3Glrf37EuuzFIpKJGMw=; b=tNTTd+q6jgdWWIfiQdFYe+cFuUn1lquy7fssprGtgv9VQa5KlWgEPnzCyC56GjJqcN 6KQkX5Pph1lESP3aJ749/V0vXUeprZCddQmD0VTF0Oy6hRbqf0loc5YK6b+hTQ8+s1rO eqQxR68G7CMKEWKwVW3TOykQRS7/kC3vVVaZ8iOFeLS5OlvAROuo7lGBsLGS9ww60AJD CJL6cKfFMyplh8tHV8L3yRCDGW0wcqSmAbZs3bG4OkbJXqijcqrVQP3mUG3vjOUvZqsx Xk9CRMEpqS36D8FE4l/+RpGY6lhj68E4oSTMEmAzpPQP6ZLs3IZi3rUFGlxoppOgtJFY oyYQ== X-Forwarded-Encrypted: i=1; AJvYcCVajzvoGRFdv5//eUYXjTb7RYFP1DUGePsXz0/r/DHXebVJrqAxdV73RHQwlU25Cl6D/w54Vw/d/1BY+Uy8iAmVwOCXhl8= X-Gm-Message-State: AOJu0YworJgMSG89qgP2yYTrkciw9bHABGqseot3eY7+7aVub2gdWEnK JQ1+O7BizPH4sisgnrStjaUZrtcUHdcwScsFw4l/le/iZvCHc6TWHufq7+7PM5k= X-Google-Smtp-Source: AGHT+IGR+8jNZStWg61YEuAhAHicYqabmloH5slM50NZuNqDWNNWS20+SNGQsneM0/ca3rQERQzNdA== X-Received: by 2002:a05:6a00:21d2:b0:706:5d85:61a5 with SMTP id d2e1a72fcca58-70eae8e4676mr4146460b3a.8.1721951205860; Thu, 25 Jul 2024 16:46:45 -0700 (PDT) Received: from debug.ba.rivosinc.com ([64.71.180.162]) by smtp.gmail.com with ESMTPSA id d2e1a72fcca58-70ead8128d0sm1647565b3a.118.2024.07.25.16.46.44 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 25 Jul 2024 16:46:45 -0700 (PDT) From: Deepak Gupta To: qemu-riscv@nongnu.org, qemu-devel@nongnu.org, jim.shu@sifive.com, andy.chiu@sifive.com, jesse.huang@sifive.com, kito.cheng@sifive.com Cc: palmer@dabbelt.com, Alistair.Francis@wdc.com, laurent@vivier.eu, bmeng.cn@gmail.com, liwei1518@gmail.com, dbarboza@ventanamicro.com, zhiwei_liu@linux.alibaba.com, Deepak Gupta Subject: [PATCH 17/24] linux-user/syscall: introduce prctl for shadow stack enable/disable Date: Thu, 25 Jul 2024 16:46:06 -0700 Message-ID: <20240725234614.3850142-18-debug@rivosinc.com> X-Mailer: git-send-email 2.44.0 In-Reply-To: <20240725234614.3850142-1-debug@rivosinc.com> References: <20240725234614.3850142-1-debug@rivosinc.com> MIME-Version: 1.0 Received-SPF: pass client-ip=2607:f8b0:4864:20::42d; envelope-from=debug@rivosinc.com; helo=mail-pf1-x42d.google.com X-Spam_score_int: -18 X-Spam_score: -1.9 X-Spam_bar: - X-Spam_report: (-1.9 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+qemu-devel=archiver.kernel.org@nongnu.org Sender: qemu-devel-bounces+qemu-devel=archiver.kernel.org@nongnu.org Each application enables shadow stack for itself via prctl. Using prctl codes as proposed in riscv cfi patches on kernel mailing list [1] [1] - https://lore.kernel.org/all/20240403234054.2020347-1-debug@rivosinc.com/ Signed-off-by: Deepak Gupta Co-developed-by: Jim Shu Co-developed-by: Andy Chiu Co-developed-by: Jesse Huang --- linux-user/syscall.c | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/linux-user/syscall.c b/linux-user/syscall.c index ec157c1088..f879be7cfe 100644 --- a/linux-user/syscall.c +++ b/linux-user/syscall.c @@ -6295,6 +6295,18 @@ abi_long do_arch_prctl(CPUX86State *env, int code, abi_ulong addr) # define PR_SME_VL_INHERIT (1 << 17) #endif +#ifndef PR_GET_SHADOW_STACK_STATUS +# define PR_GET_SHADOW_STACK_STATUS 71 +#endif +#ifndef PR_SET_SHADOW_STACK_STATUS +# define PR_SET_SHADOW_STACK_STATUS 72 +# define PR_SHADOW_STACK_ENABLE (1UL << 0) +# define PR_SHADOW_STACK_WRITE (1UL << 1) +# define PR_SHADOW_STACK_PUSH (1UL << 2) +#endif +#ifndef PR_LOCK_SHADOW_STACK_STATUS +# define PR_LOCK_SHADOW_STACK_STATUS 73 +#endif #ifndef PR_GET_INDIR_BR_LP_STATUS # define PR_GET_INDIR_BR_LP_STATUS 74 #endif @@ -6488,6 +6500,9 @@ static abi_long do_prctl(CPUArchState *env, abi_long option, abi_long arg2, case PR_SET_TSC: /* Disable to prevent the target disabling stuff we need. */ return -TARGET_EINVAL; + case PR_GET_SHADOW_STACK_STATUS: + case PR_SET_SHADOW_STACK_STATUS: + case PR_LOCK_SHADOW_STACK_STATUS: case PR_GET_INDIR_BR_LP_STATUS: case PR_SET_INDIR_BR_LP_STATUS: case PR_LOCK_INDIR_BR_LP_STATUS: From patchwork Thu Jul 25 23:46:07 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Deepak Gupta X-Patchwork-Id: 13742241 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 1F438C3DA49 for ; Thu, 25 Jul 2024 23:50:37 +0000 (UTC) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1sX8Ai-0001K9-2e; Thu, 25 Jul 2024 19:46:56 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1sX8Ac-0000vu-KH for qemu-devel@nongnu.org; Thu, 25 Jul 2024 19:46:50 -0400 Received: from mail-il1-x12b.google.com ([2607:f8b0:4864:20::12b]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.90_1) (envelope-from ) id 1sX8Aa-0005P3-Mf for qemu-devel@nongnu.org; Thu, 25 Jul 2024 19:46:50 -0400 Received: by mail-il1-x12b.google.com with SMTP id e9e14a558f8ab-396eb81a1cfso4662425ab.2 for ; Thu, 25 Jul 2024 16:46:48 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rivosinc-com.20230601.gappssmtp.com; s=20230601; t=1721951207; x=1722556007; darn=nongnu.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=U1RafRXULaoeGB+gXsUlffAxqhChP6/g1AGQdC0LRV0=; b=26/NHMHNVKWjvOi0FcWMOY3yGlWGPjC0bf4CgWBl9GclR5uu+drvebaCA9BWQ9rdmi pB9bxyqTbz6dssu6sT7xnE80zS2CjNC7VqrfZeIEjO2jGi36k/xr5ftzcii9vKrWo/DM 8ThAMVe8FPdnRd0sjq3VLHxOnIERmkb/K34iF5xl9nHpUqt1ApR+LITSdXpTLaOuZ0Z4 wuBjiWeNZK4GzsMFrj0t5avJuqirgXsIUKQ84K+INlqKE9FTVf/4L2Aw2ggWTSAMIPGb bCIXSkw02mWKYghSpLQEkUtdkTF35Q7jJQmnqp89EQgDs6DCF84YoxH6H6Ng6ODCDkyY FCMQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1721951207; x=1722556007; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=U1RafRXULaoeGB+gXsUlffAxqhChP6/g1AGQdC0LRV0=; b=BbUNrjJ9C7DQTf1tLnb9WcWzz8QyCQfDbQgxo6y3Fb2AE9oujh5VUQaqi5it93/VFx 3MuLr43BWZxgm7hxIv53VeJuDP8xf9L5yf8gpE2FfTgzACs9FVufxxv6vlQ7GvsbzfHe 0Nli37c36LXVNcKoCg4Nub6iTkpyWy+MeukapFSJufLf+z9SbJk4Co7B9vB/zQfHJ9Ge b//8MTpy8vAE3QrNLaBtJ0mDI8ZZxpGGZZE80R9jQ66uYWQGoPOITtDHXwRfte8S0n0j 8ZGXqTaTh/UgD5lBkjumcPo3tC3Ouzr3lC3RtrBP62TBDtFCeV5F7RSy0VsqezKuRDoX WBLw== X-Forwarded-Encrypted: i=1; AJvYcCXUZQeMHctZv8BH5is2kAlbDyfzRTxjf1pZft99g/muqtoAUhSuHukaahrw263Fe558H/x4+GmRG6g43vBDX5RltWuNdiY= X-Gm-Message-State: AOJu0YyUZ53WuIUjqd10JJZMPB0+Qfba1DxyQFlsRsI1BDcPrdoBjadw vhIX+6+/PegHJAWcfEYmt7MBFsM/tWzpTxPUAJYIcXySFEzKQxysDv+ok8tprtE= X-Google-Smtp-Source: AGHT+IGy9MqWIDoryJ9a1TUhuvKpi76++J/YXW9VofOVUL5C6siHdDEm9/l6rf1Bb14RQ6thdTsBTA== X-Received: by 2002:a05:6e02:12e2:b0:396:b0d:8018 with SMTP id e9e14a558f8ab-39a217e0d7amr59304055ab.6.1721951207117; Thu, 25 Jul 2024 16:46:47 -0700 (PDT) Received: from debug.ba.rivosinc.com ([64.71.180.162]) by smtp.gmail.com with ESMTPSA id d2e1a72fcca58-70ead8128d0sm1647565b3a.118.2024.07.25.16.46.46 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 25 Jul 2024 16:46:46 -0700 (PDT) From: Deepak Gupta To: qemu-riscv@nongnu.org, qemu-devel@nongnu.org, jim.shu@sifive.com, andy.chiu@sifive.com, jesse.huang@sifive.com, kito.cheng@sifive.com Cc: palmer@dabbelt.com, Alistair.Francis@wdc.com, laurent@vivier.eu, bmeng.cn@gmail.com, liwei1518@gmail.com, dbarboza@ventanamicro.com, zhiwei_liu@linux.alibaba.com, Deepak Gupta Subject: [PATCH 18/24] linux-user/riscv: setup/teardown zicfiss shadow stack for qemu-user Date: Thu, 25 Jul 2024 16:46:07 -0700 Message-ID: <20240725234614.3850142-19-debug@rivosinc.com> X-Mailer: git-send-email 2.44.0 In-Reply-To: <20240725234614.3850142-1-debug@rivosinc.com> References: <20240725234614.3850142-1-debug@rivosinc.com> MIME-Version: 1.0 Received-SPF: pass client-ip=2607:f8b0:4864:20::12b; envelope-from=debug@rivosinc.com; helo=mail-il1-x12b.google.com X-Spam_score_int: -18 X-Spam_score: -1.9 X-Spam_bar: - X-Spam_report: (-1.9 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+qemu-devel=archiver.kernel.org@nongnu.org Sender: qemu-devel-bounces+qemu-devel=archiver.kernel.org@nongnu.org Implements shadow stack related prctls for qemu-user on riscv. Allocates shadow stack from host memory using `target_mmap` and tears down when user issues prctl to disable using `target_munmap`. Signed-off-by: Deepak Gupta Co-developed-by: Jesse Huang Co-developed-by: Jim Shu Co-developed-by: Andy Chiu --- linux-user/riscv/cpu_loop.c | 50 +++++++++++++++++++++++++++++++++ linux-user/riscv/target_cpu.h | 7 +++++ linux-user/riscv/target_prctl.h | 27 ++++++++++++++++++ target/riscv/cpu.c | 4 +++ target/riscv/cpu.h | 1 + 5 files changed, 89 insertions(+) diff --git a/linux-user/riscv/cpu_loop.c b/linux-user/riscv/cpu_loop.c index 52c49c2e42..22670b68e0 100644 --- a/linux-user/riscv/cpu_loop.c +++ b/linux-user/riscv/cpu_loop.c @@ -25,6 +25,7 @@ #include "signal-common.h" #include "elf.h" #include "semihosting/common-semi.h" +#include "user-mmap.h" void cpu_loop(CPURISCVState *env) { @@ -94,6 +95,55 @@ void cpu_loop(CPURISCVState *env) } } +#define ZICFISS_GUARD_SIZE (2UL * TARGET_PAGE_SIZE) +#define ZICFISS_STACK_SIZE (16UL * TARGET_PAGE_SIZE) +#define ZICFISS_THREAD_SIZE (ZICFISS_STACK_SIZE + ZICFISS_GUARD_SIZE) + +void zicfiss_shadow_stack_alloc(CPUArchState *env) +{ + uintptr_t new_base; + + /* SS page should be surrounded by two guard pages */ + new_base = (uintptr_t) target_mmap(0, ZICFISS_THREAD_SIZE, PROT_NONE, + MAP_PRIVATE | MAP_ANONYMOUS, -1, 0); + if ((intptr_t)new_base == -1) { + perror("shadow stack alloc failure"); + exit(EXIT_FAILURE); + } + new_base += TARGET_PAGE_SIZE; + int ret = mprotect((void *)new_base, ZICFISS_STACK_SIZE, + PROT_READ | PROT_WRITE); + if (ret == -1) { + perror("shadow stack mprotect failure"); + exit(EXIT_FAILURE); + } + + env->ssp_base = new_base; + env->ssp = new_base + ZICFISS_STACK_SIZE; +} + +void zicfiss_shadow_stack_release(CPUArchState *env) +{ + abi_ulong mmap_base; + + if (env->ssp == 0) { + perror("release empty shadow stack"); + exit(EXIT_FAILURE); + } + + /* It should match shadow stack allocation. */ + mmap_base = env->ssp_base - TARGET_PAGE_SIZE; + + int ret = target_munmap(mmap_base, ZICFISS_THREAD_SIZE); + if (ret == -1) { + perror("shadow stack release failure"); + exit(EXIT_FAILURE); + } + + env->ssp_base = 0; + env->ssp = 0; +} + void target_cpu_copy_regs(CPUArchState *env, struct target_pt_regs *regs) { CPUState *cpu = env_cpu(env); diff --git a/linux-user/riscv/target_cpu.h b/linux-user/riscv/target_cpu.h index 9c642367a3..bba54d93eb 100644 --- a/linux-user/riscv/target_cpu.h +++ b/linux-user/riscv/target_cpu.h @@ -1,6 +1,9 @@ #ifndef RISCV_TARGET_CPU_H #define RISCV_TARGET_CPU_H +extern void zicfiss_shadow_stack_alloc(CPUArchState *env); +extern void zicfiss_shadow_stack_release(CPUArchState *env); + static inline void cpu_clone_regs_child(CPURISCVState *env, target_ulong newsp, unsigned flags) { @@ -9,6 +12,10 @@ static inline void cpu_clone_regs_child(CPURISCVState *env, target_ulong newsp, } env->gpr[xA0] = 0; + + if (flags & CLONE_VM) { + zicfiss_shadow_stack_alloc(env); + } } static inline void cpu_clone_regs_parent(CPURISCVState *env, unsigned flags) diff --git a/linux-user/riscv/target_prctl.h b/linux-user/riscv/target_prctl.h index d7f9f954c9..6293d61519 100644 --- a/linux-user/riscv/target_prctl.h +++ b/linux-user/riscv/target_prctl.h @@ -13,6 +13,33 @@ static abi_long do_prctl_cfi(CPUArchState *env, if (env_archcpu(env)->cfg.ext_zicfilp) { switch (option) { + case PR_GET_SHADOW_STACK_STATUS: + abi_ulong bcfi_status = 0; + /* indirect branch tracking is enabled on the task or not */ + bcfi_status |= (env->ubcfien ? PR_INDIR_BR_LP_ENABLE : 0); + return copy_to_user(flag, &bcfi_status, sizeof(bcfi_status)) ? \ + -EFAULT : 0; + + case PR_SET_SHADOW_STACK_STATUS: + /* if any other bit is set, its invalid param */ + if (flag & ~PR_SHADOW_STACK_ENABLE) { + return -TARGET_EINVAL; + } + + if ((flag & PR_SHADOW_STACK_ENABLE) + && (env->ssp == 0 && !env->ubcfien)) { + zicfiss_shadow_stack_alloc(env); + } else { + zicfiss_shadow_stack_release(env); + } + env->ubcfien = (flag & PR_SHADOW_STACK_ENABLE); + tb_flush(env_cpu(env)); + return 0; + + /* locking not implemented (also not needed for qemu-user) yet */ + case PR_LOCK_SHADOW_STACK_STATUS: + return -TARGET_EINVAL; + case PR_GET_INDIR_BR_LP_STATUS: abi_ulong fcfi_status = 0; /* indirect branch tracking is enabled on the task or not */ diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c index e1ff246c24..5a34eee10c 100644 --- a/target/riscv/cpu.c +++ b/target/riscv/cpu.c @@ -1001,6 +1001,10 @@ static void riscv_cpu_reset_hold(Object *obj, ResetType type) /* on reset ssp is set to 0 */ env->ssp = 0; +#ifdef CONFIG_USER_ONLY + env->ssp_base = 0; +#endif + /* * Bits 10, 6, 2 and 12 of mideleg are read only 1 when the Hypervisor * extension is enabled. diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h index 82475490ab..af89fc1268 100644 --- a/target/riscv/cpu.h +++ b/target/riscv/cpu.h @@ -232,6 +232,7 @@ struct CPUArchState { uint32_t elf_flags; bool ufcfien; bool ubcfien; + target_ulong ssp_base; #endif #ifndef CONFIG_USER_ONLY From patchwork Thu Jul 25 23:46:08 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Deepak Gupta X-Patchwork-Id: 13742223 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 9D906C3DA70 for ; Thu, 25 Jul 2024 23:48:30 +0000 (UTC) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1sX8Aj-0001PC-Ao; Thu, 25 Jul 2024 19:46:57 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1sX8Ae-00013g-7r for qemu-devel@nongnu.org; Thu, 25 Jul 2024 19:46:52 -0400 Received: from mail-oa1-x2f.google.com ([2001:4860:4864:20::2f]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.90_1) (envelope-from ) id 1sX8Ac-0005PY-Gv for qemu-devel@nongnu.org; Thu, 25 Jul 2024 19:46:51 -0400 Received: by mail-oa1-x2f.google.com with SMTP id 586e51a60fabf-260e5b2dfb5so464803fac.3 for ; Thu, 25 Jul 2024 16:46:50 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rivosinc-com.20230601.gappssmtp.com; s=20230601; t=1721951208; x=1722556008; darn=nongnu.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=bfd/g3qnKmKlalH95hAzpJLDLKpqsukOO1ZJ1hRrjxo=; b=ARCvJmLiRApP+wSj0mfgosuQ73l9oFBCg/aWAgtn+5f6nLUiJfjEo8fG5JSCdEtSJd BGnOpqF96ku0Qh63tM9tMMK9ucHOG+/dj4lWS5kmTd+1xqiebhO7SibdgmdEb57evjOu sjdb341P9gS54hgFhAdH3SxNpXqycoiHNLLJbtGFFx01F/kszaHBlAL9wKF3bp2P1EEn zR0QH2tQ7NdWjtoKQJv402CaCcpBvaQ/VFVqzFuuw6g8foxDVBf42gsG/toFb32cpwIm +rjgBr1TupUoDMeyIFggQnOgXczIBOyAi8+nVWWGQJVjqVMVI3aS+LFS1zFn1ApLuRJ4 bxgA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1721951208; x=1722556008; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=bfd/g3qnKmKlalH95hAzpJLDLKpqsukOO1ZJ1hRrjxo=; b=rfRtloZwfP0l7IohnXrxama7Xgu71Ty4uxlT5MnbIlDyqCrjJ++LrnRdjhV+hvrEo/ rGr9LYyfrUf6tk483ilc7mKBzr5rznnWpO7Sfzn4BhnKZ32yxQGqWH4a/Nv/1yd4UHRy Fk5RPt410Pqs95KgBX20YdZtwmpc/zKx3LYDaHTFSIwDtb2EBiSnssBHzI808ZzhGG3L XZovc6AzoS4q/4p/H2FNDJLs4x6bBPqCoDfNETVg8QAKF/aTo54EczoXyMV2YFwBdves fDdhIIxJYa3O3EtqCGSVVCgaNFIzD+lKT01mldCTcTqbtRPXrjW9W2oZ7qempiJT5tbf RHeA== X-Forwarded-Encrypted: i=1; AJvYcCXFr73EKPQm+2XrVhNNT8F9cs8BfuaDUHWyxCeea+VVNNDfuSNpnzrFCCnLe944JIW0QKh+z92C88hA@nongnu.org X-Gm-Message-State: AOJu0YxdAcYpHoBMXPJnVSEGt5GrSRQFr8n8lzPaGbeCLxEs5ty9PSkU n7KWn6yQ7CzzjgaVe6TZUEcmc2SmljqwT4hs2lq2ds9xUmJ2OSxVsCU4casNr7U= X-Google-Smtp-Source: AGHT+IHoXVmXn+LxEPotC1APjvprE04G0CZCFolUXKcmTkKy7NvW7OomvTOR17WDsedu+o8GogGY/Q== X-Received: by 2002:a05:6871:796:b0:260:e678:b657 with SMTP id 586e51a60fabf-264a0ca319emr5377055fac.7.1721951208489; Thu, 25 Jul 2024 16:46:48 -0700 (PDT) Received: from debug.ba.rivosinc.com ([64.71.180.162]) by smtp.gmail.com with ESMTPSA id d2e1a72fcca58-70ead8128d0sm1647565b3a.118.2024.07.25.16.46.47 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 25 Jul 2024 16:46:48 -0700 (PDT) From: Deepak Gupta To: qemu-riscv@nongnu.org, qemu-devel@nongnu.org, jim.shu@sifive.com, andy.chiu@sifive.com, jesse.huang@sifive.com, kito.cheng@sifive.com Cc: palmer@dabbelt.com, Alistair.Francis@wdc.com, laurent@vivier.eu, bmeng.cn@gmail.com, liwei1518@gmail.com, dbarboza@ventanamicro.com, zhiwei_liu@linux.alibaba.com, Deepak Gupta Subject: [PATCH 19/24] disas/riscv: enable disassembly for zicfiss instructions Date: Thu, 25 Jul 2024 16:46:08 -0700 Message-ID: <20240725234614.3850142-20-debug@rivosinc.com> X-Mailer: git-send-email 2.44.0 In-Reply-To: <20240725234614.3850142-1-debug@rivosinc.com> References: <20240725234614.3850142-1-debug@rivosinc.com> MIME-Version: 1.0 Received-SPF: pass client-ip=2001:4860:4864:20::2f; envelope-from=debug@rivosinc.com; helo=mail-oa1-x2f.google.com X-Spam_score_int: -18 X-Spam_score: -1.9 X-Spam_bar: - X-Spam_report: (-1.9 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+qemu-devel=archiver.kernel.org@nongnu.org Sender: qemu-devel-bounces+qemu-devel=archiver.kernel.org@nongnu.org Enable disassembly for sspush, sspopchk, ssrdp & ssamoswap. Disasembly is only enabled if zimop and zicfiss ext is set to true. Signed-off-by: Deepak Gupta --- disas/riscv.c | 34 ++++++++++++++++++++++++++++++++++ disas/riscv.h | 1 + 2 files changed, 35 insertions(+) diff --git a/disas/riscv.c b/disas/riscv.c index c7c92acef7..c4e47fbc78 100644 --- a/disas/riscv.c +++ b/disas/riscv.c @@ -975,6 +975,11 @@ typedef enum { rv_op_amocas_b = 944, rv_op_amocas_h = 945, rv_op_lpad = 946, + rv_op_sspush = 947, + rv_op_sspopchk = 948, + rv_op_ssrdp = 949, + rv_op_ssamoswap_w = 950, + rv_op_ssamoswap_d = 951, } rv_op; /* register names */ @@ -2234,6 +2239,11 @@ const rv_opcode_data rvi_opcode_data[] = { { "amocas.b", rv_codec_r_a, rv_fmt_aqrl_rd_rs2_rs1, NULL, 0, 0, 0 }, { "amocas.h", rv_codec_r_a, rv_fmt_aqrl_rd_rs2_rs1, NULL, 0, 0, 0 }, { "lpad", rv_codec_lp, rv_fmt_imm, NULL, 0, 0, 0 }, + { "sspush", rv_codec_r, rv_fmt_rs2, NULL, 0, 0, 0 }, + { "sspopchk", rv_codec_r, rv_fmt_rs1, NULL, 0, 0, 0 }, + { "ssrdp", rv_codec_r, rv_fmt_rd, NULL, 0, 0, 0 }, + { "ssamoswap.w", rv_codec_r_a, rv_fmt_aqrl_rd_rs2_rs1, NULL, 0, 0, 0 }, + { "ssamoswap.d", rv_codec_r_a, rv_fmt_aqrl_rd_rs2_rs1, NULL, 0, 0, 0 }, }; /* CSR names */ @@ -2251,6 +2261,7 @@ static const char *csr_name(int csrno) case 0x0009: return "vxsat"; case 0x000a: return "vxrm"; case 0x000f: return "vcsr"; + case 0x0011: return "ssp"; case 0x0015: return "seed"; case 0x0017: return "jvt"; case 0x0040: return "uscratch"; @@ -3077,6 +3088,8 @@ static void decode_inst_opcode(rv_decode *dec, rv_isa isa) case 66: op = rv_op_amoor_w; break; case 67: op = rv_op_amoor_d; break; case 68: op = rv_op_amoor_q; break; + case 74: op = rv_op_ssamoswap_w; break; + case 75: op = rv_op_ssamoswap_d; break; case 96: op = rv_op_amoand_b; break; case 97: op = rv_op_amoand_h; break; case 98: op = rv_op_amoand_w; break; @@ -4036,11 +4049,32 @@ static void decode_inst_opcode(rv_decode *dec, rv_isa isa) extract32(inst, 26, 2)), 4, 1, extract32(inst, 30, 1)); op = rv_mop_r_0 + imm_mop5; + /* if zicfiss enabled and mop5 is shadow stack */ + if (dec->cfg->ext_zicfiss && + ((imm_mop5 & 0b11100) == 0b11100)) { + /* rs1=0 means ssrdp */ + if ((inst & (0b011111 << 15)) == 0) { + op = rv_op_ssrdp; + } + /* rd=0 means sspopchk */ + if ((inst & (0b011111 << 7)) == 0) { + op = rv_op_sspopchk; + } + } } else if ((extract32(inst, 25, 7) & 0b1011001) == 0b1000001) { imm_mop3 = deposit32(extract32(inst, 26, 2), 2, 1, extract32(inst, 30, 1)); op = rv_mop_rr_0 + imm_mop3; + /* if zicfiss enabled and mop3 is shadow stack */ + if (dec->cfg->ext_zicfiss && + ((imm_mop3 & 0b111) == 0b111)) { + /* rs1=0 and rd=0 means sspush */ + if (((inst & (0b011111 << 15)) == 0) && + ((inst & (0b011111 << 7)) == 0)) { + op = rv_op_sspush; + } + } } } break; diff --git a/disas/riscv.h b/disas/riscv.h index 1182457aff..4895c5a301 100644 --- a/disas/riscv.h +++ b/disas/riscv.h @@ -224,6 +224,7 @@ enum { #define rv_fmt_none "O\t" #define rv_fmt_rs1 "O\t1" +#define rv_fmt_rs2 "O\t2" #define rv_fmt_offset "O\to" #define rv_fmt_pred_succ "O\tp,s" #define rv_fmt_rs1_rs2 "O\t1,2" From patchwork Thu Jul 25 23:46:09 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Deepak Gupta X-Patchwork-Id: 13742234 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 0966DC3DA49 for ; Thu, 25 Jul 2024 23:49:35 +0000 (UTC) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1sX8Ah-0001FS-3v; Thu, 25 Jul 2024 19:46:55 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1sX8Af-00019h-KZ for qemu-devel@nongnu.org; Thu, 25 Jul 2024 19:46:53 -0400 Received: from mail-pf1-x431.google.com ([2607:f8b0:4864:20::431]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.90_1) (envelope-from ) id 1sX8Ad-0005Pl-5Q for qemu-devel@nongnu.org; Thu, 25 Jul 2024 19:46:53 -0400 Received: by mail-pf1-x431.google.com with SMTP id d2e1a72fcca58-70d23caf8ddso378280b3a.0 for ; Thu, 25 Jul 2024 16:46:50 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rivosinc-com.20230601.gappssmtp.com; s=20230601; t=1721951210; x=1722556010; darn=nongnu.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=GwN8KazdAM6rfbJ9pEQTaPAvCowqMjvonYMvwP9Ekyo=; b=xgAVFoxfHNs8ASLmZW6XmTXCxHvUAAh/3Y3DBlz6gqj/KRDeCQQ8bd2eJOik3gZjzc aBuPP+j3bdJVzoPPKFjsurmIA4mCAPweMQ50f6ENVr/UIgDHvYDlJtflgU+qU5u6vQiV xmnenmN3xljMFLkaWUiSAtSqCxWa0Q6AlaahEH5p8Ktqosp9oqxqG95om3kAmiJQoYAc yOq4dwCHjL9hj+yc3xWEqzpZwlJ/aiKK9RsY5OdpjohVX1IjJW5qQO3u+GBU9wpNvY5K hWWTbezFBjbkL78ctdSufLvZ8mDzbDo6nN2k8Rh09Ml5foMijpm5FA79GrhUwKrDp+52 qAhQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1721951210; x=1722556010; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=GwN8KazdAM6rfbJ9pEQTaPAvCowqMjvonYMvwP9Ekyo=; b=r2B0zMRItUEvnhF3PNMGm+TxJj5eqVNDVxKniPNMV9r93oCiRwe6b+4JLLG4zckHSH qKAETLMBG/FSapbaSEgQeJcGv7B0QDvYgQtetHrSmVoxwBLF1HCXSbhuZOFO1416kYd1 W/Nm4GWvjkboeLIfhAkcWTQpY8nEdYmXIriVv632TI9Kb4WV09AIJ+lUq1RjwUEwD8WO mIAF5RD0M6ZFmTRYvLbKdmz+7Ad/0Cta5YHt/DijJ3MexpCeMs8RESjYMVALu1+rzuOP DJi1qhrv8AXOHsHVgZX0RpPuqcKirHRrQGk1gJ4z3d5GgBEzyTC10OZgTV53XcOXZBRz LZmw== X-Forwarded-Encrypted: i=1; AJvYcCWDvh4lFx49LximuXWz1Gk8vbAjATj9jyyI3QphzuN2BBOS1JlOkjD9VHGz9srHJ8z8bvP69MPfAqy7UVuYpsgJ+habwrM= X-Gm-Message-State: AOJu0Yz95GozraRUjD8wiT5KvZNFg3nF18DZ+c+JcdkuIYDy0LL1Br0I 75ODxXWrrM97ozlyC6hdtrK5qgISfOr8aDkQg1XIz7QvEt1fk7EXUwm3ygOZeqk= X-Google-Smtp-Source: AGHT+IES+dr0cC4JL8Vqey3P4tDsQhYuxN7PAHfKAhu2NHHf8Jneip3Z4jfxP1qjPKJbed5cNBw12g== X-Received: by 2002:a05:6a00:6f02:b0:70a:f3de:3ff with SMTP id d2e1a72fcca58-70eae90574fmr4036598b3a.14.1721951209759; Thu, 25 Jul 2024 16:46:49 -0700 (PDT) Received: from debug.ba.rivosinc.com ([64.71.180.162]) by smtp.gmail.com with ESMTPSA id d2e1a72fcca58-70ead8128d0sm1647565b3a.118.2024.07.25.16.46.48 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 25 Jul 2024 16:46:49 -0700 (PDT) From: Deepak Gupta To: qemu-riscv@nongnu.org, qemu-devel@nongnu.org, jim.shu@sifive.com, andy.chiu@sifive.com, jesse.huang@sifive.com, kito.cheng@sifive.com Cc: palmer@dabbelt.com, Alistair.Francis@wdc.com, laurent@vivier.eu, bmeng.cn@gmail.com, liwei1518@gmail.com, dbarboza@ventanamicro.com, zhiwei_liu@linux.alibaba.com, Deepak Gupta Subject: [PATCH 20/24] disas/riscv: enable disassembly for compressed sspush/sspopchk Date: Thu, 25 Jul 2024 16:46:09 -0700 Message-ID: <20240725234614.3850142-21-debug@rivosinc.com> X-Mailer: git-send-email 2.44.0 In-Reply-To: <20240725234614.3850142-1-debug@rivosinc.com> References: <20240725234614.3850142-1-debug@rivosinc.com> MIME-Version: 1.0 Received-SPF: pass client-ip=2607:f8b0:4864:20::431; envelope-from=debug@rivosinc.com; helo=mail-pf1-x431.google.com X-Spam_score_int: -18 X-Spam_score: -1.9 X-Spam_bar: - X-Spam_report: (-1.9 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+qemu-devel=archiver.kernel.org@nongnu.org Sender: qemu-devel-bounces+qemu-devel=archiver.kernel.org@nongnu.org sspush and sspopchk have equivalent compressed encoding taken from zcmop. cmop.1 is sspush x1 while cmop.5 is sspopchk x5. Due to unusual encoding for both rs1 and rs2 from space bitfield, this required a new codec. Signed-off-by: Deepak Gupta --- disas/riscv.c | 19 ++++++++++++++++++- disas/riscv.h | 1 + 2 files changed, 19 insertions(+), 1 deletion(-) diff --git a/disas/riscv.c b/disas/riscv.c index c4e47fbc78..82175e75ee 100644 --- a/disas/riscv.c +++ b/disas/riscv.c @@ -980,6 +980,8 @@ typedef enum { rv_op_ssrdp = 949, rv_op_ssamoswap_w = 950, rv_op_ssamoswap_d = 951, + rv_op_c_sspush = 952, + rv_op_c_sspopchk = 953, } rv_op; /* register names */ @@ -2244,6 +2246,10 @@ const rv_opcode_data rvi_opcode_data[] = { { "ssrdp", rv_codec_r, rv_fmt_rd, NULL, 0, 0, 0 }, { "ssamoswap.w", rv_codec_r_a, rv_fmt_aqrl_rd_rs2_rs1, NULL, 0, 0, 0 }, { "ssamoswap.d", rv_codec_r_a, rv_fmt_aqrl_rd_rs2_rs1, NULL, 0, 0, 0 }, + { "c.sspush", rv_codec_cmop_ss, rv_fmt_rs2, NULL, rv_op_sspush, + rv_op_sspush, 0 }, + { "c.sspopchk", rv_codec_cmop_ss, rv_fmt_rs1, NULL, rv_op_sspopchk, + rv_op_sspopchk, 0 }, }; /* CSR names */ @@ -2604,7 +2610,13 @@ static void decode_inst_opcode(rv_decode *dec, rv_isa isa) if (dec->cfg->ext_zcmop) { if ((((inst >> 2) & 0b111111) == 0b100000) && (((inst >> 11) & 0b11) == 0b0)) { - op = rv_c_mop_1 + ((inst >> 8) & 0b111); + unsigned int cmop_code = 0; + cmop_code = ((inst >> 8) & 0b111); + op = rv_c_mop_1 + cmop_code; + if (dec->cfg->ext_zicfiss) { + op = (cmop_code == 0) ? rv_op_c_sspush : op; + op = (cmop_code == 2) ? rv_op_c_sspopchk : op; + } break; } } @@ -4919,6 +4931,11 @@ static void decode_inst_operands(rv_decode *dec, rv_isa isa) case rv_codec_lp: dec->imm = operand_lpl(inst); break; + case rv_codec_cmop_ss: + dec->rd = rv_ireg_zero; + dec->rs1 = dec->rs2 = operand_crs1(inst); + dec->imm = 0; + break; }; } diff --git a/disas/riscv.h b/disas/riscv.h index 4895c5a301..6a3b371cd3 100644 --- a/disas/riscv.h +++ b/disas/riscv.h @@ -167,6 +167,7 @@ typedef enum { rv_codec_r2_imm2_imm5, rv_codec_fli, rv_codec_lp, + rv_codec_cmop_ss, } rv_codec; /* structures */ From patchwork Thu Jul 25 23:46:10 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Deepak Gupta X-Patchwork-Id: 13742231 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 4B749C3DA49 for ; Thu, 25 Jul 2024 23:49:26 +0000 (UTC) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1sX8Aj-0001OB-1J; Thu, 25 Jul 2024 19:46:57 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1sX8Ag-0001CJ-9O for qemu-devel@nongnu.org; Thu, 25 Jul 2024 19:46:54 -0400 Received: from mail-il1-x12c.google.com ([2607:f8b0:4864:20::12c]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.90_1) (envelope-from ) id 1sX8Ae-0005Q5-9V for qemu-devel@nongnu.org; Thu, 25 Jul 2024 19:46:54 -0400 Received: by mail-il1-x12c.google.com with SMTP id e9e14a558f8ab-399020cfbb7so4159615ab.0 for ; Thu, 25 Jul 2024 16:46:51 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rivosinc-com.20230601.gappssmtp.com; s=20230601; t=1721951211; x=1722556011; darn=nongnu.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=E2gOjemeIxuisakJLMtv9C9tfaLcK041ldza0nSyRho=; b=WA3b8VuOxvl0/FQq+ALlmcBHaylTAwwDPzFFT1MDTJhBjMfowtTWRClBmzE1MWRY4e vFdmQGAs1Z6TlKccHN8ntpUuH4xYesUglXWf766RB5mo8QbKhjZ+F2tXF2ruxLgyW8dN n/ALwGbnNR5ZK2EdQkJ2as/mqzoy7blTWjLwqY9TSUlnz3BpDCBET2RovUkmPx1TNRuJ GBEoAa5QI9JX4ueBQ6UIBZgLlDYTgRQN8YPuNEBNexj9UA55+VYmrNdeCTEEPrSZr3q7 vYNZpk8PhZeILAETXpD0jXl2IOv6ZKkT1Pw9cof3iUc5I4kPxaUvthEvWqhdpgw8qVal t8Jw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1721951211; x=1722556011; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=E2gOjemeIxuisakJLMtv9C9tfaLcK041ldza0nSyRho=; b=DlrP7sUSWpA6NfcKnsuovbZPQ7DuEZkQfujJc11Tpubup7Nva+evVmaDrcKljmgsxF rx2u0n+7EsCSy0wZVQfM4uWHkMKfOuuxJ5FxV0gK3QCvn8WU5oVHTGurwl+PyP4YWPph sNU+uekQA1M5punB8B7FYVi75i8kFV3C/sEkpjboV3R2nMJBoxSEbrGEOqbYGneylC6k hPq9J3n6kMazhtykvB9oUEjnH0EJsGW7mx14n9kIVprg3rMsgk+rjxRR/v3K2SYtZhOy KJdfLxX7h/riaAuAr7AaqF4mA03gpzNbjJNgsmOEELY3DC8EevY5t0rWqZCCCFRhILAO dzUw== X-Forwarded-Encrypted: i=1; AJvYcCWK5N8T75CjCOjt+tn+TDhvBmVl6HLdm0yMzetq74Ui0tYldll1ASivjCOYhWQQbWRA1nUgCe3tu1QZXZnR6LF+LbNNlxU= X-Gm-Message-State: AOJu0YxZRvcFT1cI3NtP0xFh2Bq77jPbnFoSxVPNAoUvgjrQyF6yBFUy oRtp5sPFux89XhmIKKIZH8neHz0V0H5TmbKlF5HituPBwiG0K0PxU9W88O+QiGY= X-Google-Smtp-Source: AGHT+IFKMl9CngMXdlR/nZp8wDlvayNR5hml0yjYP6oF8/3MRSV5I7OwMWF9VQrnkKLJlB3PY35psw== X-Received: by 2002:a05:6e02:1d82:b0:380:fd76:3d9e with SMTP id e9e14a558f8ab-39a23ff33b4mr40732715ab.22.1721951211066; Thu, 25 Jul 2024 16:46:51 -0700 (PDT) Received: from debug.ba.rivosinc.com ([64.71.180.162]) by smtp.gmail.com with ESMTPSA id d2e1a72fcca58-70ead8128d0sm1647565b3a.118.2024.07.25.16.46.49 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 25 Jul 2024 16:46:50 -0700 (PDT) From: Deepak Gupta To: qemu-riscv@nongnu.org, qemu-devel@nongnu.org, jim.shu@sifive.com, andy.chiu@sifive.com, jesse.huang@sifive.com, kito.cheng@sifive.com Cc: palmer@dabbelt.com, Alistair.Francis@wdc.com, laurent@vivier.eu, bmeng.cn@gmail.com, liwei1518@gmail.com, dbarboza@ventanamicro.com, zhiwei_liu@linux.alibaba.com, Deepak Gupta Subject: [PATCH 21/24] target/riscv: add trace-hooks for each case of sw-check exception Date: Thu, 25 Jul 2024 16:46:10 -0700 Message-ID: <20240725234614.3850142-22-debug@rivosinc.com> X-Mailer: git-send-email 2.44.0 In-Reply-To: <20240725234614.3850142-1-debug@rivosinc.com> References: <20240725234614.3850142-1-debug@rivosinc.com> MIME-Version: 1.0 Received-SPF: pass client-ip=2607:f8b0:4864:20::12c; envelope-from=debug@rivosinc.com; helo=mail-il1-x12c.google.com X-Spam_score_int: -18 X-Spam_score: -1.9 X-Spam_bar: - X-Spam_report: (-1.9 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+qemu-devel=archiver.kernel.org@nongnu.org Sender: qemu-devel-bounces+qemu-devel=archiver.kernel.org@nongnu.org Violations to control flow rules setup by zicfilp and zicfiss lead to software check exceptions. To debug and fix such sw check issues in guest , add trace-hooks for each case. Signed-off-by: Jim Shu Signed-off-by: Deepak Gupta --- target/riscv/insn_trans/trans_rvi.c.inc | 1 + target/riscv/op_helper.c | 4 ++++ target/riscv/trace-events | 6 ++++++ target/riscv/translate.c | 2 ++ 4 files changed, 13 insertions(+) diff --git a/target/riscv/insn_trans/trans_rvi.c.inc b/target/riscv/insn_trans/trans_rvi.c.inc index ee868c5fcb..66b26cbe8b 100644 --- a/target/riscv/insn_trans/trans_rvi.c.inc +++ b/target/riscv/insn_trans/trans_rvi.c.inc @@ -65,6 +65,7 @@ static bool trans_lpad(DisasContext *ctx, arg_lpad *a) tcg_constant_tl(RISCV_EXCP_SW_CHECK_FCFI_TVAL), tcg_env, offsetof(CPURISCVState, sw_check_code)); generate_exception(ctx, RISCV_EXCP_SW_CHECK); + trace_zicfilp_unaligned_lpad_instr((uint64_t) ctx->base.pc_next); return true; } } diff --git a/target/riscv/op_helper.c b/target/riscv/op_helper.c index 54baa3a966..6a54c6c24d 100644 --- a/target/riscv/op_helper.c +++ b/target/riscv/op_helper.c @@ -24,6 +24,7 @@ #include "exec/exec-all.h" #include "exec/cpu_ldst.h" #include "exec/helper-proto.h" +#include "trace.h" /* Exceptions processing helpers */ G_NORETURN void riscv_raise_exception(CPURISCVState *env, @@ -283,6 +284,8 @@ void helper_cfi_check_landing_pad(CPURISCVState *env, int lbl) * greater than 31 and then shift 12 right */ if (lbl && (lbl != ((env->gpr[xT2] & 0xFFFFFFFF) >> 12))) { + trace_zicfilp_lpad_reg_mismatch(lbl, + (env->gpr[xT2] & 0xFFFFFFFF) >> 12); env->sw_check_code = RISCV_EXCP_SW_CHECK_FCFI_TVAL; riscv_raise_exception(env, RISCV_EXCP_SW_CHECK, GETPC()); } @@ -295,6 +298,7 @@ void helper_sschk_mismatch(CPURISCVState *env, target_ulong rs1, target_ulong ssra) { if (rs1 != ssra) { + trace_zicfiss_sspopchk_reg_mismatch((uint64_t)ssra, (uint64_t) rs1); env->sw_check_code = RISCV_EXCP_SW_CHECK_BCFI_TVAL; riscv_raise_exception(env, RISCV_EXCP_SW_CHECK, GETPC()); } diff --git a/target/riscv/trace-events b/target/riscv/trace-events index 49ec4d3b7d..842349ecb9 100644 --- a/target/riscv/trace-events +++ b/target/riscv/trace-events @@ -9,3 +9,9 @@ pmpaddr_csr_write(uint64_t mhartid, uint32_t addr_index, uint64_t val) "hart %" mseccfg_csr_read(uint64_t mhartid, uint64_t val) "hart %" PRIu64 ": read mseccfg, val: 0x%" PRIx64 mseccfg_csr_write(uint64_t mhartid, uint64_t val) "hart %" PRIu64 ": write mseccfg, val: 0x%" PRIx64 + +# zicfiss/lp +zicfiss_sspopchk_reg_mismatch(uint64_t ssra, uint64_t rs1) "shadow_stack_ra: 0x%" PRIx64 ", rs1: 0x%" PRIx64 +zicfilp_missing_lpad_instr(uint64_t pc_first) "pc_first: 0x%" PRIx64 +zicfilp_unaligned_lpad_instr(uint64_t pc_next) "pc_next: 0x%" PRIx64 +zicfilp_lpad_reg_mismatch(int lpad_label, int t2_label) "lpad_label: 0x%x, t2_label: 0x%x" diff --git a/target/riscv/translate.c b/target/riscv/translate.c index ad0f841807..958a1578d4 100644 --- a/target/riscv/translate.c +++ b/target/riscv/translate.c @@ -30,6 +30,7 @@ #include "semihosting/semihost.h" #include "internals.h" +#include "trace.h" #define HELPER_H "helper.h" #include "exec/helper-info.c.inc" @@ -1380,6 +1381,7 @@ static void riscv_tr_tb_stop(DisasContextBase *dcbase, CPUState *cpu) * illegal instruction exception. */ tcg_set_insn_param(cfi_lp_check, 1, tcgv_i32_arg(tcg_constant_i32(1))); + trace_zicfilp_missing_lpad_instr((uint64_t) ctx->base.pc_first); } } From patchwork Thu Jul 25 23:46:11 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Deepak Gupta X-Patchwork-Id: 13742232 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 5B55FC49EA1 for ; Thu, 25 Jul 2024 23:49:26 +0000 (UTC) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1sX8Al-0001ZW-Gy; Thu, 25 Jul 2024 19:46:59 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1sX8Ah-0001Fv-3N for qemu-devel@nongnu.org; Thu, 25 Jul 2024 19:46:55 -0400 Received: from mail-il1-x135.google.com ([2607:f8b0:4864:20::135]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.90_1) (envelope-from ) id 1sX8Af-0005QS-F8 for qemu-devel@nongnu.org; Thu, 25 Jul 2024 19:46:54 -0400 Received: by mail-il1-x135.google.com with SMTP id e9e14a558f8ab-396675b83afso5227885ab.0 for ; Thu, 25 Jul 2024 16:46:53 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rivosinc-com.20230601.gappssmtp.com; s=20230601; t=1721951212; x=1722556012; darn=nongnu.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=Pr/AcYF8z8+IP/7vhXiuKTgBOUJ+TMutbX74doKlSC0=; b=ntDSUzG6MmYG6OUg8KNM7WlxM2nia6knEiqj1ulzgwa1+AX/28E5NX/jjfUFFHxDM+ LCONJ/Ao44JhgcGkCakF4kEhynuGL6ChHJE/gf5WJhgduf66KDuoiT1QbTJUVwpO4ytJ tjToCrqnIKROnIFgMNn4gKdz8KtlJR1iSD0IQVOjZbKDasmb0n5vjlvDKGqTEV230Ftq 2ATCaC8qZGOiBxGRttcXUVWlm5KHkMXexn2U/+jzbw4KT9Xdc4F4ZjpHNTkLIjTaWWNU INVpPoszi2d+rxX/KvfgKb9jrgTtqmgBLSQPp0wKzfB1GrPoj2YF1PCsnQAYMsT1+MaR wK6A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1721951212; x=1722556012; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=Pr/AcYF8z8+IP/7vhXiuKTgBOUJ+TMutbX74doKlSC0=; b=ImCtXgzCuoA9Os22HV/yD6iRhVjxhZWfhs3X8DJkoj1oaQAsUNktN06rkBMjZTmwpl D+/ZUcxJXwDje2J6ll5uuCa6h26kXH8Z3JO/51eDXtKYvc3wyT8xMatzfTGWyGfdJ/Ta 85ua6V+mW2Myz5JMYK93MyVMww/36+T5Orl54K1DTKp3SnYPwp9jKGXaK/uSUKKvD8uY fbAOtSWvoBdhBaMhHqaXM/Sltn1pjRfH0huKjvh/C7qa5zoWGmEYwRnlhPT4Xw1xX3km VKn8lpHKYzHsCvTtYphWMdmUCUt3EBy15oEg6yLqEr0hVYO4J1R16O9rCgUC6WLY2T6B 8paA== X-Forwarded-Encrypted: i=1; AJvYcCXt/CEMIQPVSa/ObbG5RPOeunGx2ZweSEU8D4WrfCgNr2tQ+bX/3VlJ0tAnD1FeBd7UnIqTYbfOYUCg9aaZl7znVzyHfqk= X-Gm-Message-State: AOJu0Yz98rWqOTKj24b41Vpq5UN0Nfjo3dOyuL2cTkdEedEu366jT4Oy raDBaqsDstgmrONzKWkojc+CUrwQhhFEQH/SatLRXpktit+qGwr0rgU8IHAd/oc= X-Google-Smtp-Source: AGHT+IGcdW1SVlYT8aaYuRJ2NT56u847S4tWBxqF8BhuvmVsaEhXUSDkqYTW7Bh4Yox8c5xv4purew== X-Received: by 2002:a92:c562:0:b0:383:5520:cc48 with SMTP id e9e14a558f8ab-39a23aed069mr45058685ab.0.1721951212300; Thu, 25 Jul 2024 16:46:52 -0700 (PDT) Received: from debug.ba.rivosinc.com ([64.71.180.162]) by smtp.gmail.com with ESMTPSA id d2e1a72fcca58-70ead8128d0sm1647565b3a.118.2024.07.25.16.46.51 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 25 Jul 2024 16:46:52 -0700 (PDT) From: Deepak Gupta To: qemu-riscv@nongnu.org, qemu-devel@nongnu.org, jim.shu@sifive.com, andy.chiu@sifive.com, jesse.huang@sifive.com, kito.cheng@sifive.com Cc: palmer@dabbelt.com, Alistair.Francis@wdc.com, laurent@vivier.eu, bmeng.cn@gmail.com, liwei1518@gmail.com, dbarboza@ventanamicro.com, zhiwei_liu@linux.alibaba.com, Deepak Gupta Subject: [PATCH 22/24] linux-user: permit RISC-V CFI dynamic entry in VDSO Date: Thu, 25 Jul 2024 16:46:11 -0700 Message-ID: <20240725234614.3850142-23-debug@rivosinc.com> X-Mailer: git-send-email 2.44.0 In-Reply-To: <20240725234614.3850142-1-debug@rivosinc.com> References: <20240725234614.3850142-1-debug@rivosinc.com> MIME-Version: 1.0 Received-SPF: pass client-ip=2607:f8b0:4864:20::135; envelope-from=debug@rivosinc.com; helo=mail-il1-x135.google.com X-Spam_score_int: -18 X-Spam_score: -1.9 X-Spam_bar: - X-Spam_report: (-1.9 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+qemu-devel=archiver.kernel.org@nongnu.org Sender: qemu-devel-bounces+qemu-devel=archiver.kernel.org@nongnu.org RISC-V CFI use new processor-specific dynamic entry in ELF. Permit it in VDSO post-processing script. Signed-off-by: Jim Shu Signed-off-by: Deepak Gupta --- linux-user/gen-vdso-elfn.c.inc | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/linux-user/gen-vdso-elfn.c.inc b/linux-user/gen-vdso-elfn.c.inc index 95856eb839..59c818eb11 100644 --- a/linux-user/gen-vdso-elfn.c.inc +++ b/linux-user/gen-vdso-elfn.c.inc @@ -273,6 +273,13 @@ static void elfN(process)(FILE *outf, void *buf, bool need_bswap) errors++; break; + case PT_LOPROC + 2: + /* RISCV_ZICFILP_PLT: for RISC-V zicfilp extension */ + if (ehdr->e_machine == EM_RISCV) { + break; + } + goto do_default; + case PT_LOPROC + 3: if (ehdr->e_machine == EM_PPC64) { break; /* DT_PPC64_OPT: integer bitmask */ From patchwork Thu Jul 25 23:46:12 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Deepak Gupta X-Patchwork-Id: 13742224 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 9C139C3DA70 for ; Thu, 25 Jul 2024 23:48:36 +0000 (UTC) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1sX8Am-0001eg-QI; Thu, 25 Jul 2024 19:47:00 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1sX8Ai-0001OP-W2 for qemu-devel@nongnu.org; Thu, 25 Jul 2024 19:46:57 -0400 Received: from mail-ot1-x332.google.com ([2607:f8b0:4864:20::332]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.90_1) (envelope-from ) id 1sX8Ah-0005Qr-2R for qemu-devel@nongnu.org; Thu, 25 Jul 2024 19:46:56 -0400 Received: by mail-ot1-x332.google.com with SMTP id 46e09a7af769-7044c085338so246709a34.2 for ; Thu, 25 Jul 2024 16:46:54 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rivosinc-com.20230601.gappssmtp.com; s=20230601; t=1721951213; x=1722556013; darn=nongnu.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=hLdx4AZXHbpEMxw/S18/9QimvuhK4hPq7UuREWO1i7w=; b=iicy5b5Y0h2tdbI3oFkOgOxX5dcB/BJTzunDfeqZCSvnBkGwW4A5PuwRVdZNmIuASa urlT+owMBvQPcFFezq61oPQll4Vh+fTakgl2C61sq+B9FNYEJJ1MpEdnPzG0OQebvU18 MgYfz0orTz+z16R5Zu+fnI2yyHkPckI3by3fq0Z7/J27BAfnZTRcJutiPL5sIdZlhyKu AJfLSjnCI3guSf/M1BR9keryZ2nM01HuwsBDcLnoh0m0z81M2g2oxgRs0coRxxqtwZdD D6tLYxU+XYRjpS0CYBTdr1a8P9/CDobeYa2gdfxwlhL5+i81DYEtXKVqw+kZ4P71NQSf h4GQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1721951213; x=1722556013; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=hLdx4AZXHbpEMxw/S18/9QimvuhK4hPq7UuREWO1i7w=; b=rOzU2hVion2I36hibT4+U9or3PPlWXd6pYL5fTcQ7ErwfZdtOiq7tTscu/SfwZYb3T zwkMd4uppxQCJwbtQEQktyFHfZ7msKhBOw0X9Ps5m9+4qotEcffLuSBDRs7h5lcRlxa9 G5Sn1FhnKHQx2Cf1qZHAhWJy8tb2+dO0GxrnIKc8zsXgHt9DzU8rFqyvdtKk4XE2Q0JD L0FQyyEkcDn+2Tb3905fITs8uiByyuVsAoiYa2/QBVtPsKJIgYQZk7fXmGQmMf1/OdRo W9+rjIQqG/jhWhJBNWMx3w2DDvyAVr+YjxAAleuekKPjqDVlSSEdYY7S010nWZznbiOV BDng== X-Forwarded-Encrypted: i=1; AJvYcCV3Mro5yG+ZPO8OMGNAAS5OjF1ucZ92SFZcO3Lx3LMDT8Ch7gMXK9ybzCP1czBZDdKH0lz6LWi8kpztp0af0VQwuUJs2cw= X-Gm-Message-State: AOJu0Yw9tLScZ0UYK8fo9PTr8vag//Tfrq6Qlau/irYPGULjmJP6iebY uQGlaf0bkDb5EjNrU4K+TjKZnBkcCXNYRmwM7n3uEkxtCVmvUp2y+dAoa6L+zFQ= X-Google-Smtp-Source: AGHT+IHBqbzaE/MygE0CtW+tBZcsHjx9D7UsoT15uKwL8AL0fqgUxcff+xVuSnNUZP9cYqfeejzsyA== X-Received: by 2002:a05:6830:631a:b0:703:64c6:305b with SMTP id 46e09a7af769-70932117059mr5277601a34.2.1721951213574; Thu, 25 Jul 2024 16:46:53 -0700 (PDT) Received: from debug.ba.rivosinc.com ([64.71.180.162]) by smtp.gmail.com with ESMTPSA id d2e1a72fcca58-70ead8128d0sm1647565b3a.118.2024.07.25.16.46.52 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 25 Jul 2024 16:46:53 -0700 (PDT) From: Deepak Gupta To: qemu-riscv@nongnu.org, qemu-devel@nongnu.org, jim.shu@sifive.com, andy.chiu@sifive.com, jesse.huang@sifive.com, kito.cheng@sifive.com Cc: palmer@dabbelt.com, Alistair.Francis@wdc.com, laurent@vivier.eu, bmeng.cn@gmail.com, liwei1518@gmail.com, dbarboza@ventanamicro.com, zhiwei_liu@linux.alibaba.com, Deepak Gupta Subject: [PATCH 23/24] linux-user: Add RISC-V zicfilp support in VDSO Date: Thu, 25 Jul 2024 16:46:12 -0700 Message-ID: <20240725234614.3850142-24-debug@rivosinc.com> X-Mailer: git-send-email 2.44.0 In-Reply-To: <20240725234614.3850142-1-debug@rivosinc.com> References: <20240725234614.3850142-1-debug@rivosinc.com> MIME-Version: 1.0 Received-SPF: pass client-ip=2607:f8b0:4864:20::332; envelope-from=debug@rivosinc.com; helo=mail-ot1-x332.google.com X-Spam_score_int: -18 X-Spam_score: -1.9 X-Spam_bar: - X-Spam_report: (-1.9 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, LOTS_OF_MONEY=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+qemu-devel=archiver.kernel.org@nongnu.org Sender: qemu-devel-bounces+qemu-devel=archiver.kernel.org@nongnu.org Add zicfilp support in VDSO. VDSO functions need lpad instruction so that userspace could call this function when landing pad extension is enabled. This solution only works when toolchain always use landing pad label 1. Otherwise, If extension is not enabled, lpad instructions will be lui instructions with rd=x0 (which is nop). Prebuilt VDSO is still compatible with RISC-V core w/o zicfilp extension. Signed-off-by: Jim Shu Signed-off-by: Deepak Gupta --- linux-user/riscv/vdso-64.so | Bin 3944 -> 4128 bytes linux-user/riscv/vdso.S | 50 ++++++++++++++++++++++++++++++++++++ 2 files changed, 50 insertions(+) diff --git a/linux-user/riscv/vdso-64.so b/linux-user/riscv/vdso-64.so index ae49f5b043b5941b9d304a056c2b50c185f413b0..cd7f2fa7bdb811af6be2dcc3fb9601b66e3d1c81 100755 GIT binary patch delta 1345 zcmah}O=uHA6rRa8*`3W#v-vSWgUvy(QL#}%mV&j76iPuQBHAj2(ng|zmM)E!P>`g> ziy+eQP!K%yD2kv2Jb7q5_;(V#2zrPIp$E0T*_|nLFFu%g^L_K)%k2BfxBcts zwSKzU%uIMvDl|QN=xp4}g4*$}@d(n<~qepB*LP!3)Siz)SSu5ui{`}Ri4l{qVG z<))V_rE;ZO#UoHP&Zd{==Wom%v$EK`eUMXAv;*hV1Wm$<8dtCYs1tO{Mm~~-=ZGxa zjpj-e9%`|fX?zbQKeuJaBedlj?wn7H+zXnl z+6N3On@wEY6ZY=Tcmf7X)L-B&?+M^(KWxa1Nj(DZ`~!MYOa>phK%U8T zbfFM1nH*fK8zMQjS!g4|p|!;V8Z`BtS@y!IU|yFKn)JeIFwbQ2i_i|5tR_lP0~#_7 pnM$drU_4|p`G+?Pw?igvKsz+7r*-ESGZggRJRA2r@IJ6$-#>;G!0Z43 delta 1236 zcmZux&1(};5TBP#+z*pYV+<*_)IAj1YN_?B+bY<^rnX2aRgfZHEGbA2QZyn~#MXa6 z69zo>Q1McbLL?%ocu2)V4jv*F!CQ|xnnMLet@AeXqAU))otfYJy|4M$HK*Q{?-jj; zzFD!24I_@VKv0a~RwP*{I_d3w;EB@E*7O6Uf;7sa>HGB{XUh-Cou=~6m1b2gB-#DFx9A!2 zLL__`q}b;tKwVy%#A+&d0)Qt2<9$E(n(OP#|HVGj;Vb(!Jnn^O9`m|=HV73ypSJ_~ z{6VtH|v2)99wz{?bNB7jqeM)ifG;D@Xo~6$*{frvJ5_f9#bOCr+W3+&Ha4qi9He z`aFGZFXXa!K@5`_!U4;{c`Jrnfi7ItJ4G3v>4^@ll@B7dM5F9h@S~p4LQq9vBn42^ z6PgYw(n%q6kkCx1d)fjA=g8j=lUShHyjQ?)jZ>c0vk;|y1vK_lb*f|98QH&Nc9x~NiEBHO^ znyS~TI1+KqRtw@1d8*G+xEXP+8h24Gh(97jmTIbc5YN~{ri!eCOSWrHa-1h|({^L3 qZWX$;ijJCP(|ap?q2JVD+=;fE1#ar668QsJ{ X-Patchwork-Id: 13742236 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 550B4C3DA49 for ; Thu, 25 Jul 2024 23:49:40 +0000 (UTC) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1sX8Al-0001Yl-C2; Thu, 25 Jul 2024 19:46:59 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1sX8Aj-0001SJ-Sc for qemu-devel@nongnu.org; Thu, 25 Jul 2024 19:46:57 -0400 Received: from mail-pf1-x434.google.com ([2607:f8b0:4864:20::434]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.90_1) (envelope-from ) id 1sX8Ai-0005RN-BW for qemu-devel@nongnu.org; Thu, 25 Jul 2024 19:46:57 -0400 Received: by mail-pf1-x434.google.com with SMTP id d2e1a72fcca58-70aec66c936so380856b3a.0 for ; Thu, 25 Jul 2024 16:46:55 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rivosinc-com.20230601.gappssmtp.com; s=20230601; t=1721951215; x=1722556015; darn=nongnu.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=w3J0a7Kk8VH78Rf/KPYKxAa9BurTiYRdK3RsGWQBTas=; b=KDft8ywDUmfAdVLgDqkQFaXE2UIA0e/5k80nTz48axenhr2TKZ9jHjR6XS4Z+mIwik AtEHCqs9LY4HQcfZPjxE77CPXAwQw2w7Vv2g3uQk/3R9yIJq90E/XTL1LOSDAyCZhi44 GUwgZPlmIKTyDD42X0HXCcrNfFI9ItbseQ+OkW1J8H6mC+X4/ZmYzILgYrmWX25rgzPl 5l3NWgIi2m/ws+hP6P1YzWHDLDN4FxfaTYsifIgDmt56DVqme122tP3kptyg+6Xa39m1 Ga7Tv5U51+8emzguAzkkPf0UpxO5dyPsyZRTL4ZE6RLBxK3YhehsbI2z0dXacutbW5Hx uIBw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1721951215; x=1722556015; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=w3J0a7Kk8VH78Rf/KPYKxAa9BurTiYRdK3RsGWQBTas=; b=EEib/jEOyR2NgiMRJ2CZSfYxQeZT18rlq6pjcORq1PIcrIxM6uAGpFgtSVpojVffjX R++nUB3+eyQrjCNn6wF+gB9Bu6Z960umU8GY7RiILOETpdPLlX9sscYDpxNXRlrRUd7c xMO32f3BstuPSvBvV0Pzn0OfcUD2WB2eyLQR4ZM+xndU8zthCdmfy55Q1Xd+ousSGsdY tRKs0TrYBFMdjmqy4P5hjL7F7G19Xr7a/Nessf4wCo7vY6JxWdQRzwCv5z7Q+KDYkobm XqW+QHrUtcCKZuGhb+cSO7J5Ctf+C9GVqrmL3T6SDxMfZxUPeP0vA/Y3BfUQGewW21DD HSxw== X-Forwarded-Encrypted: i=1; AJvYcCVDpBKxb6hUdc2Lyy6xFag+yOfINk8FB5P/Kkqkp8dS5FnjXxpNl8hEHufmO4zrTvG5/6j+DrgAFQ+JNKcq91i2FeIQ23Y= X-Gm-Message-State: AOJu0YyeRV/1X3LYbe+5Fdd/xckX/efk07lnmALdv4IjFHDIDM8NHSFx XDzTjBl/Sd8XTQ8qdNp13YpBZrU4Mg658pp8XOZoN2JiDM0dwbgSwW8x6UiSiHk= X-Google-Smtp-Source: AGHT+IE6fe7ud2CzHt6R4CiQKeHUQrgDRpPpp6tLebVMZb6di1NmrdU/7LPVB4BVPsJCShBbFwyxlQ== X-Received: by 2002:a05:6a00:66e4:b0:706:3580:ac4c with SMTP id d2e1a72fcca58-70eaa887cc0mr5009740b3a.17.1721951215014; Thu, 25 Jul 2024 16:46:55 -0700 (PDT) Received: from debug.ba.rivosinc.com ([64.71.180.162]) by smtp.gmail.com with ESMTPSA id d2e1a72fcca58-70ead8128d0sm1647565b3a.118.2024.07.25.16.46.53 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 25 Jul 2024 16:46:54 -0700 (PDT) From: Deepak Gupta To: qemu-riscv@nongnu.org, qemu-devel@nongnu.org, jim.shu@sifive.com, andy.chiu@sifive.com, jesse.huang@sifive.com, kito.cheng@sifive.com Cc: palmer@dabbelt.com, Alistair.Francis@wdc.com, laurent@vivier.eu, bmeng.cn@gmail.com, liwei1518@gmail.com, dbarboza@ventanamicro.com, zhiwei_liu@linux.alibaba.com, Deepak Gupta Subject: [PATCH 24/24] linux-user/riscv: Adding zicfiss/lp extension in hwprobe syscall Date: Thu, 25 Jul 2024 16:46:13 -0700 Message-ID: <20240725234614.3850142-25-debug@rivosinc.com> X-Mailer: git-send-email 2.44.0 In-Reply-To: <20240725234614.3850142-1-debug@rivosinc.com> References: <20240725234614.3850142-1-debug@rivosinc.com> MIME-Version: 1.0 Received-SPF: pass client-ip=2607:f8b0:4864:20::434; envelope-from=debug@rivosinc.com; helo=mail-pf1-x434.google.com X-Spam_score_int: -18 X-Spam_score: -1.9 X-Spam_bar: - X-Spam_report: (-1.9 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+qemu-devel=archiver.kernel.org@nongnu.org Sender: qemu-devel-bounces+qemu-devel=archiver.kernel.org@nongnu.org Add zicfiss/lp extensions in the ext0 key of hwprobe syscall. It is aligned with Linux CFI patchset. Signed-off-by: Jim Shu Signed-off-by: Deepak Gupta --- linux-user/syscall.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/linux-user/syscall.c b/linux-user/syscall.c index f879be7cfe..f2f2164ee5 100644 --- a/linux-user/syscall.c +++ b/linux-user/syscall.c @@ -8882,6 +8882,8 @@ static int do_getdents64(abi_long dirfd, abi_long arg2, abi_long count) #define RISCV_HWPROBE_EXT_ZTSO (1ULL << 33) #define RISCV_HWPROBE_EXT_ZACAS (1ULL << 34) #define RISCV_HWPROBE_EXT_ZICOND (1ULL << 35) +#define RISCV_HWPROBE_EXT_ZICFILP (1ULL << 36) +#define RISCV_HWPROBE_EXT_ZICFISS (1ULL << 37) #define RISCV_HWPROBE_KEY_CPUPERF_0 5 #define RISCV_HWPROBE_MISALIGNED_UNKNOWN (0 << 0) @@ -9000,6 +9002,10 @@ static void risc_hwprobe_fill_pairs(CPURISCVState *env, RISCV_HWPROBE_EXT_ZACAS : 0; value |= cfg->ext_zicond ? RISCV_HWPROBE_EXT_ZICOND : 0; + value |= cfg->ext_zicfilp ? + RISCV_HWPROBE_EXT_ZICFILP : 0; + value |= cfg->ext_zicfiss ? + RISCV_HWPROBE_EXT_ZICFISS : 0; __put_user(value, &pair->value); break; case RISCV_HWPROBE_KEY_CPUPERF_0: