[PATCH v9 00/17] riscv support for control flow integrity extensions

Deepak Gupta posted 17 patches 2 months, 4 weeks ago
There is a newer version of this series
disas/riscv.c                                 |  77 ++++++++-
disas/riscv.h                                 |   4 +
target/riscv/cpu.c                            |  17 ++
target/riscv/cpu.h                            |  24 ++-
target/riscv/cpu_bits.h                       |  17 ++
target/riscv/cpu_cfg.h                        |   2 +
target/riscv/cpu_helper.c                     | 154 +++++++++++++++++-
target/riscv/cpu_user.h                       |   1 +
target/riscv/csr.c                            |  84 ++++++++++
target/riscv/insn16.decode                    |   4 +
target/riscv/insn32.decode                    |  26 ++-
.../riscv/insn_trans/trans_privileged.c.inc   |   8 +-
target/riscv/insn_trans/trans_rva.c.inc       |  43 ++++-
target/riscv/insn_trans/trans_rvd.c.inc       |   4 +-
target/riscv/insn_trans/trans_rvf.c.inc       |   4 +-
target/riscv/insn_trans/trans_rvh.c.inc       |   8 +-
target/riscv/insn_trans/trans_rvi.c.inc       |  61 ++++++-
target/riscv/insn_trans/trans_rvvk.c.inc      |  10 +-
target/riscv/insn_trans/trans_rvzacas.c.inc   |   4 +-
target/riscv/insn_trans/trans_rvzfh.c.inc     |   4 +-
target/riscv/insn_trans/trans_rvzicfiss.c.inc |  75 +++++++++
target/riscv/insn_trans/trans_svinval.c.inc   |   6 +-
target/riscv/internals.h                      |   3 +
target/riscv/machine.c                        |  38 +++++
target/riscv/op_helper.c                      |  18 ++
target/riscv/pmp.c                            |   5 +
target/riscv/pmp.h                            |   3 +-
target/riscv/tcg/tcg-cpu.c                    |  25 +++
target/riscv/translate.c                      |  45 ++++-
29 files changed, 725 insertions(+), 49 deletions(-)
create mode 100644 target/riscv/insn_trans/trans_rvzicfiss.c.inc
[PATCH v9 00/17] riscv support for control flow integrity extensions
Posted by Deepak Gupta 2 months, 4 weeks ago
v9 for riscv zicfilp and zicfiss extensions support in qemu.

Links for previous versions
[1] - v1 https://lists.nongnu.org/archive/html/qemu-devel/2024-07/msg06017.html
[2] - v2 https://lore.kernel.org/all/ed23bcbc-fdc4-4492-803c-daa95880375a@linaro.org/T/
[3] - v3 https://lists.nongnu.org/archive/html/qemu-devel/2024-08/msg01005.html
[4] - v4 https://lore.kernel.org/all/20240816010711.3055425-6-debug@rivosinc.com/T/
[5] - v5
+https://lore.kernel.org/all/20240820000129.3522346-1-debug@rivosinc.com/T/#m7b9cc847e739ec86f9569a3ca9f3d9377b01e21
[6] - v6 https://mail.gnu.org/archive/html/qemu-riscv/2024-08/msg00418.html
[7] - v7 https://lore.kernel.org/all/20240822082504.3979610-1-debug@rivosinc.com/
[8] - v8 https://lore.kernel.org/all/20240823190140.4156920-1-debug@rivosinc.com/T/
---
v9:
   - fix switch case fallthrough for sw_check excp in patch 4
v8:
   - fixed up `gen_cmpxchg` to store extra word2 during compile to raise storeAMO always
v7:
   - Updated decode_save_opc to take extra argument of excp_uw2 and
     updated callsites
   - added a helper for promoting load faults to store faults
   - Removed stale comments and edited existed comments
v6:
   - Added support extra store word 2 for tcg compile and extraction during unwind
   - Using extra word, AMO instructions and shadow stack instructions can raise store fault
   - some alignment and cosmetic changes
   - added vmstate migration support for elp and ssp cpu state
v5:
   - Simplified elp tracking and lpad implementation as per suggestion by richard
   - Simplified shadow stack mmu checks as per suggestion by richard
   - Converged zicfiss compressed and non-comressed instructions to same translation
   - Removed trace hooks. Don't need for upstream.

v4:
   - elp state in cpu is true/false instead of enum and elp cleared
     unconditionally on trap entry. elp in *status cleared unconditionally on
     trap return.
   - Moved logic for branch tracking in instruction translation from tb_start.
   - fixed zicfiss dependency on 'A'
   - `cpu_get_fcfien/bcfien` helpers checks fixed to check for extension first.
   - removed trace hook enums. Instead added dedicated trace helpers wherever needed.
   - fixed/simplified instruction format in decoder for lpad, sspush, sspopchk
   - simplified tlb index logic for shadow stack instructions. Removed SUM TB_FLAG
   - access to ssp CSR is gated on `cpu_get_bcfien` instead of duplicated logic
   - removed vDSO related changes for now.
v3:
   - Removed prctl specific patches because they need to be upstream
     in kernel first.
   - As suggested by Richard, added TB flag if fcfi enabled
   - Re-worked translation for landing pad and shadow stack instructions
     to not require helper.
   - tcg helpers only for cfi violation cases so that trace hooks can be
     placed.
   - Style changes.
   - fixes assert condition in accel/tcg

v2:
   - added missed file (in v1) for shadow stack instructions implementation.   

Deepak Gupta (17):
  target/riscv: Add zicfilp extension
  target/riscv: Introduce elp state and enabling controls for zicfilp
  target/riscv: save and restore elp state on priv transitions
  target/riscv: additional code information for sw check
  target/riscv: tracking indirect branches (fcfi) for zicfilp
  target/riscv: zicfilp `lpad` impl and branch tracking
  disas/riscv: enable `lpad` disassembly
  target/riscv: Add zicfiss extension
  target/riscv: introduce ssp and enabling controls for zicfiss
  target/riscv: tb flag for shadow stack  instructions
  target/riscv: mmu changes for zicfiss shadow stack protection
  target/riscv: AMO operations always raise store/AMO fault
  target/riscv: update `decode_save_opc` to store extra word2
  target/riscv: implement zicfiss instructions
  target/riscv: compressed encodings for sspush and sspopchk
  disas/riscv: enable disassembly for zicfiss instructions
  disas/riscv: enable disassembly for compressed sspush/sspopchk

 disas/riscv.c                                 |  77 ++++++++-
 disas/riscv.h                                 |   4 +
 target/riscv/cpu.c                            |  17 ++
 target/riscv/cpu.h                            |  24 ++-
 target/riscv/cpu_bits.h                       |  17 ++
 target/riscv/cpu_cfg.h                        |   2 +
 target/riscv/cpu_helper.c                     | 154 +++++++++++++++++-
 target/riscv/cpu_user.h                       |   1 +
 target/riscv/csr.c                            |  84 ++++++++++
 target/riscv/insn16.decode                    |   4 +
 target/riscv/insn32.decode                    |  26 ++-
 .../riscv/insn_trans/trans_privileged.c.inc   |   8 +-
 target/riscv/insn_trans/trans_rva.c.inc       |  43 ++++-
 target/riscv/insn_trans/trans_rvd.c.inc       |   4 +-
 target/riscv/insn_trans/trans_rvf.c.inc       |   4 +-
 target/riscv/insn_trans/trans_rvh.c.inc       |   8 +-
 target/riscv/insn_trans/trans_rvi.c.inc       |  61 ++++++-
 target/riscv/insn_trans/trans_rvvk.c.inc      |  10 +-
 target/riscv/insn_trans/trans_rvzacas.c.inc   |   4 +-
 target/riscv/insn_trans/trans_rvzfh.c.inc     |   4 +-
 target/riscv/insn_trans/trans_rvzicfiss.c.inc |  75 +++++++++
 target/riscv/insn_trans/trans_svinval.c.inc   |   6 +-
 target/riscv/internals.h                      |   3 +
 target/riscv/machine.c                        |  38 +++++
 target/riscv/op_helper.c                      |  18 ++
 target/riscv/pmp.c                            |   5 +
 target/riscv/pmp.h                            |   3 +-
 target/riscv/tcg/tcg-cpu.c                    |  25 +++
 target/riscv/translate.c                      |  45 ++++-
 29 files changed, 725 insertions(+), 49 deletions(-)
 create mode 100644 target/riscv/insn_trans/trans_rvzicfiss.c.inc

-- 
2.44.0
Re: [PATCH v9 00/17] riscv support for control flow integrity extensions
Posted by Alistair Francis 2 months, 4 weeks ago
On Tue, Aug 27, 2024 at 1:31 AM Deepak Gupta <debug@rivosinc.com> wrote:
>
> v9 for riscv zicfilp and zicfiss extensions support in qemu.

Can you please link to the exact specification and version you used?

We have had issues where there are multiple RVI spec versions ratified
and it's difficult to figure out which exact one is supported

Alistair

>
> Links for previous versions
> [1] - v1 https://lists.nongnu.org/archive/html/qemu-devel/2024-07/msg06017.html
> [2] - v2 https://lore.kernel.org/all/ed23bcbc-fdc4-4492-803c-daa95880375a@linaro.org/T/
> [3] - v3 https://lists.nongnu.org/archive/html/qemu-devel/2024-08/msg01005.html
> [4] - v4 https://lore.kernel.org/all/20240816010711.3055425-6-debug@rivosinc.com/T/
> [5] - v5
> +https://lore.kernel.org/all/20240820000129.3522346-1-debug@rivosinc.com/T/#m7b9cc847e739ec86f9569a3ca9f3d9377b01e21
> [6] - v6 https://mail.gnu.org/archive/html/qemu-riscv/2024-08/msg00418.html
> [7] - v7 https://lore.kernel.org/all/20240822082504.3979610-1-debug@rivosinc.com/
> [8] - v8 https://lore.kernel.org/all/20240823190140.4156920-1-debug@rivosinc.com/T/
> ---
> v9:
>    - fix switch case fallthrough for sw_check excp in patch 4
> v8:
>    - fixed up `gen_cmpxchg` to store extra word2 during compile to raise storeAMO always
> v7:
>    - Updated decode_save_opc to take extra argument of excp_uw2 and
>      updated callsites
>    - added a helper for promoting load faults to store faults
>    - Removed stale comments and edited existed comments
> v6:
>    - Added support extra store word 2 for tcg compile and extraction during unwind
>    - Using extra word, AMO instructions and shadow stack instructions can raise store fault
>    - some alignment and cosmetic changes
>    - added vmstate migration support for elp and ssp cpu state
> v5:
>    - Simplified elp tracking and lpad implementation as per suggestion by richard
>    - Simplified shadow stack mmu checks as per suggestion by richard
>    - Converged zicfiss compressed and non-comressed instructions to same translation
>    - Removed trace hooks. Don't need for upstream.
>
> v4:
>    - elp state in cpu is true/false instead of enum and elp cleared
>      unconditionally on trap entry. elp in *status cleared unconditionally on
>      trap return.
>    - Moved logic for branch tracking in instruction translation from tb_start.
>    - fixed zicfiss dependency on 'A'
>    - `cpu_get_fcfien/bcfien` helpers checks fixed to check for extension first.
>    - removed trace hook enums. Instead added dedicated trace helpers wherever needed.
>    - fixed/simplified instruction format in decoder for lpad, sspush, sspopchk
>    - simplified tlb index logic for shadow stack instructions. Removed SUM TB_FLAG
>    - access to ssp CSR is gated on `cpu_get_bcfien` instead of duplicated logic
>    - removed vDSO related changes for now.
> v3:
>    - Removed prctl specific patches because they need to be upstream
>      in kernel first.
>    - As suggested by Richard, added TB flag if fcfi enabled
>    - Re-worked translation for landing pad and shadow stack instructions
>      to not require helper.
>    - tcg helpers only for cfi violation cases so that trace hooks can be
>      placed.
>    - Style changes.
>    - fixes assert condition in accel/tcg
>
> v2:
>    - added missed file (in v1) for shadow stack instructions implementation.
>
> Deepak Gupta (17):
>   target/riscv: Add zicfilp extension
>   target/riscv: Introduce elp state and enabling controls for zicfilp
>   target/riscv: save and restore elp state on priv transitions
>   target/riscv: additional code information for sw check
>   target/riscv: tracking indirect branches (fcfi) for zicfilp
>   target/riscv: zicfilp `lpad` impl and branch tracking
>   disas/riscv: enable `lpad` disassembly
>   target/riscv: Add zicfiss extension
>   target/riscv: introduce ssp and enabling controls for zicfiss
>   target/riscv: tb flag for shadow stack  instructions
>   target/riscv: mmu changes for zicfiss shadow stack protection
>   target/riscv: AMO operations always raise store/AMO fault
>   target/riscv: update `decode_save_opc` to store extra word2
>   target/riscv: implement zicfiss instructions
>   target/riscv: compressed encodings for sspush and sspopchk
>   disas/riscv: enable disassembly for zicfiss instructions
>   disas/riscv: enable disassembly for compressed sspush/sspopchk
>
>  disas/riscv.c                                 |  77 ++++++++-
>  disas/riscv.h                                 |   4 +
>  target/riscv/cpu.c                            |  17 ++
>  target/riscv/cpu.h                            |  24 ++-
>  target/riscv/cpu_bits.h                       |  17 ++
>  target/riscv/cpu_cfg.h                        |   2 +
>  target/riscv/cpu_helper.c                     | 154 +++++++++++++++++-
>  target/riscv/cpu_user.h                       |   1 +
>  target/riscv/csr.c                            |  84 ++++++++++
>  target/riscv/insn16.decode                    |   4 +
>  target/riscv/insn32.decode                    |  26 ++-
>  .../riscv/insn_trans/trans_privileged.c.inc   |   8 +-
>  target/riscv/insn_trans/trans_rva.c.inc       |  43 ++++-
>  target/riscv/insn_trans/trans_rvd.c.inc       |   4 +-
>  target/riscv/insn_trans/trans_rvf.c.inc       |   4 +-
>  target/riscv/insn_trans/trans_rvh.c.inc       |   8 +-
>  target/riscv/insn_trans/trans_rvi.c.inc       |  61 ++++++-
>  target/riscv/insn_trans/trans_rvvk.c.inc      |  10 +-
>  target/riscv/insn_trans/trans_rvzacas.c.inc   |   4 +-
>  target/riscv/insn_trans/trans_rvzfh.c.inc     |   4 +-
>  target/riscv/insn_trans/trans_rvzicfiss.c.inc |  75 +++++++++
>  target/riscv/insn_trans/trans_svinval.c.inc   |   6 +-
>  target/riscv/internals.h                      |   3 +
>  target/riscv/machine.c                        |  38 +++++
>  target/riscv/op_helper.c                      |  18 ++
>  target/riscv/pmp.c                            |   5 +
>  target/riscv/pmp.h                            |   3 +-
>  target/riscv/tcg/tcg-cpu.c                    |  25 +++
>  target/riscv/translate.c                      |  45 ++++-
>  29 files changed, 725 insertions(+), 49 deletions(-)
>  create mode 100644 target/riscv/insn_trans/trans_rvzicfiss.c.inc
>
> --
> 2.44.0
>
>