On Wed, Aug 28, 2024 at 10:47:18AM -0700, Deepak Gupta wrote:
>v11 for riscv zicfilp and zicfiss extensions support in qemu.
Sorry once again, some problem in my work-flow and it missed picked up below
"
zicfilp and zicfiss spec pdf
https://github.com/riscv/riscv-cfi/releases/download/v1.0/riscv-cfi.pdf
github sources to spec
https://github.com/riscv/riscv-cfi
"
>
>Links for previous versions
>[1] - v1 https://lists.nongnu.org/archive/html/qemu-devel/2024-07/msg06017.html
>[2] - v2 https://lore.kernel.org/all/ed23bcbc-fdc4-4492-803c-daa95880375a@linaro.org/T/
>[3] - v3 https://lists.nongnu.org/archive/html/qemu-devel/2024-08/msg01005.html
>[4] - v4 https://lore.kernel.org/all/20240816010711.3055425-6-debug@rivosinc.com/T/
>[5] - v5
>+https://lore.kernel.org/all/20240820000129.3522346-1-debug@rivosinc.com/T/#m7b9cc847e739ec86f9569a3ca9f3d9377b01e21
>[6] - v6 https://mail.gnu.org/archive/html/qemu-riscv/2024-08/msg00418.html
>[7] - v7 https://lore.kernel.org/all/20240822082504.3979610-1-debug@rivosinc.com/
>[8] - v8 https://lore.kernel.org/all/20240823190140.4156920-1-debug@rivosinc.com/T/
>[9] - v9 https://lore.kernel.org/all/20240826152949.294506-1-debug@rivosinc.com/
>
>---
>v10:
> - Exposed *envcfg CSR and priv to qemu-user as well and removed special
> state management for *envcfg related feature enabling for qemu-user
> - Exposing zicfilp and zicfiss as different patch
>v9:
> - fix switch case fallthrough for sw_check excp in patch 4
>v8:
> - fixed up `gen_cmpxchg` to store extra word2 during compile to raise storeAMO always
>v7:
> - Updated decode_save_opc to take extra argument of excp_uw2 and
> updated callsites
> - added a helper for promoting load faults to store faults
> - Removed stale comments and edited existed comments
>v6:
> - Added support extra store word 2 for tcg compile and extraction during unwind
> - Using extra word, AMO instructions and shadow stack instructions can raise store fault
> - some alignment and cosmetic changes
> - added vmstate migration support for elp and ssp cpu state
>v5:
> - Simplified elp tracking and lpad implementation as per suggestion by richard
> - Simplified shadow stack mmu checks as per suggestion by richard
> - Converged zicfiss compressed and non-comressed instructions to same translation
> - Removed trace hooks. Don't need for upstream.
>
>v4:
> - elp state in cpu is true/false instead of enum and elp cleared
> unconditionally on trap entry. elp in *status cleared unconditionally on
> trap return.
> - Moved logic for branch tracking in instruction translation from tb_start.
> - fixed zicfiss dependency on 'A'
> - `cpu_get_fcfien/bcfien` helpers checks fixed to check for extension first.
> - removed trace hook enums. Instead added dedicated trace helpers wherever needed.
> - fixed/simplified instruction format in decoder for lpad, sspush, sspopchk
> - simplified tlb index logic for shadow stack instructions. Removed SUM TB_FLAG
> - access to ssp CSR is gated on `cpu_get_bcfien` instead of duplicated logic
> - removed vDSO related changes for now.
>v3:
> - Removed prctl specific patches because they need to be upstream
> in kernel first.
> - As suggested by Richard, added TB flag if fcfi enabled
> - Re-worked translation for landing pad and shadow stack instructions
> to not require helper.
> - tcg helpers only for cfi violation cases so that trace hooks can be
> placed.
> - Style changes.
> - fixes assert condition in accel/tcg
>
>v2:
> - added missed file (in v1) for shadow stack instructions implementation.
>
>Deepak Gupta (20):
> target/riscv: expose *envcfg csr and priv to qemu-user as well
> target/riscv: Add zicfilp extension
> target/riscv: Introduce elp state and enabling controls for zicfilp
> target/riscv: save and restore elp state on priv transitions
> target/riscv: additional code information for sw check
> target/riscv: tracking indirect branches (fcfi) for zicfilp
> target/riscv: zicfilp `lpad` impl and branch tracking
> disas/riscv: enable `lpad` disassembly
> target/riscv: Expose zicfilp extension as a cpu property
> target/riscv: Add zicfiss extension
> target/riscv: introduce ssp and enabling controls for zicfiss
> target/riscv: tb flag for shadow stack instructions
> target/riscv: mmu changes for zicfiss shadow stack protection
> target/riscv: AMO operations always raise store/AMO fault
> target/riscv: update `decode_save_opc` to store extra word2
> target/riscv: implement zicfiss instructions
> target/riscv: compressed encodings for sspush and sspopchk
> disas/riscv: enable disassembly for zicfiss instructions
> disas/riscv: enable disassembly for compressed sspush/sspopchk
> target/riscv: Expose zicfiss extension as a cpu property
>
> disas/riscv.c | 77 ++++++++-
> disas/riscv.h | 4 +
> target/riscv/cpu.c | 14 ++
> target/riscv/cpu.h | 31 +++-
> target/riscv/cpu_bits.h | 17 ++
> target/riscv/cpu_cfg.h | 2 +
> target/riscv/cpu_helper.c | 155 +++++++++++++++++-
> target/riscv/cpu_user.h | 1 +
> target/riscv/csr.c | 84 ++++++++++
> target/riscv/insn16.decode | 4 +
> target/riscv/insn32.decode | 26 ++-
> .../riscv/insn_trans/trans_privileged.c.inc | 8 +-
> target/riscv/insn_trans/trans_rva.c.inc | 43 ++++-
> target/riscv/insn_trans/trans_rvd.c.inc | 4 +-
> target/riscv/insn_trans/trans_rvf.c.inc | 4 +-
> target/riscv/insn_trans/trans_rvh.c.inc | 8 +-
> target/riscv/insn_trans/trans_rvi.c.inc | 61 ++++++-
> target/riscv/insn_trans/trans_rvvk.c.inc | 10 +-
> target/riscv/insn_trans/trans_rvzacas.c.inc | 4 +-
> target/riscv/insn_trans/trans_rvzfh.c.inc | 4 +-
> target/riscv/insn_trans/trans_rvzicfiss.c.inc | 75 +++++++++
> target/riscv/insn_trans/trans_svinval.c.inc | 6 +-
> target/riscv/internals.h | 3 +
> target/riscv/machine.c | 38 +++++
> target/riscv/op_helper.c | 18 ++
> target/riscv/pmp.c | 5 +
> target/riscv/pmp.h | 3 +-
> target/riscv/tcg/tcg-cpu.c | 25 +++
> target/riscv/translate.c | 45 ++++-
> 29 files changed, 726 insertions(+), 53 deletions(-)
> create mode 100644 target/riscv/insn_trans/trans_rvzicfiss.c.inc
>
>--
>2.44.0
>