v15 for riscv zicfilp and zicfiss extensions support in qemu.
I've rebased again on https://github.com/alistair23/qemu/blob/riscv-to-apply.next
(tag: pull-riscv-to-apply-20241002)
There is an additional patch in this with comment title
"target/riscv: disallow probe accesses to shadow stack"
cache block operations of clean, flush and inval have store semantics.
These operations on shadow stack must look like regular stores and must
always raise store/AMO access fault. However with current logic,
`probe_access_flags` will succeed because it will be seen as a load.
In order to prevent that `get_physical_address` must receive `probe`
parameter. Depending on that parameter, `get_physical_address` can return
TRANSLATE_PMP_FAIL.
In v15, this is created as a new commit so that we can review and discuss
it out and placed this next to below commit.
"target/riscv: mmu changes for zicfiss shadow stack protection"
If this looks good, eventually I'll squash both the commits.
zicfilp and zicfiss spec pdf
----------------------------
https://github.com/riscv/riscv-cfi/releases/download/v1.0/riscv-cfi.pdf
github sources to spec
https://github.com/riscv/riscv-cfi
Links for previous versions
[1] - v1 https://lists.nongnu.org/archive/html/qemu-devel/2024-07/msg06017.html
[2] - v2 https://lore.kernel.org/all/ed23bcbc-fdc4-4492-803c-daa95880375a@linaro.org/T/
[3] - v3 https://lists.nongnu.org/archive/html/qemu-devel/2024-08/msg01005.html
[4] - v4 https://lore.kernel.org/all/20240816010711.3055425-6-debug@rivosinc.com/T/
[5] - v5
+https://lore.kernel.org/all/20240820000129.3522346-1-debug@rivosinc.com/T/#m7b9cc847e739ec86f9569a3ca9f3d9377b01e21
[6] - v6 https://mail.gnu.org/archive/html/qemu-riscv/2024-08/msg00418.html
[7] - v7 https://lore.kernel.org/all/20240822082504.3979610-1-debug@rivosinc.com/
[8] - v8 https://lore.kernel.org/all/20240823190140.4156920-1-debug@rivosinc.com/T/
[9] - v9 https://lore.kernel.org/all/20240826152949.294506-1-debug@rivosinc.com/
[10]- v10 https://lore.kernel.org/all/20240827231906.553327-1-debug@rivosinc.com/
[11]- v11 https://lore.kernel.org/all/20240828174739.714313-1-debug@rivosinc.com/
[12]- v12 https://lore.kernel.org/all/20240829233425.1005029-1-debug@rivosinc.com/
[13]- v14 https://lore.kernel.org/all/20240912235320.3768582-1-debug@rivosinc.com/
---
v15:
- Extended `get_physical_address` to take `probe` parameter. This is to ensure
that cbo.clean/flush/inval accesses to shadow stack always lead to store/AMO
access fault
v14:
- Rebased on https://github.com/alistair23/qemu/blob/riscv-to-apply.next
v13:
- Fixed bug(s) reported by richard that
- shadow stack doesn't exist in M-mode
- shadow stack is not available in M + U only config
- updated commit messages with removal of `ufcfien` and `ubcfien` mentions
v12
- Moved ssamoswap to trans_rvzicfiss.
- Fixed bcfi_enabled in disascontext to rely only on tb flag
- added comment on why PMP_TRANSLATE_FAIL for stores on shadow stack page
v11:
- default *envcfg and priv for qemu-user are handled in `riscv_cpu_reset_hold`
v10:
- Exposed *envcfg CSR and priv to qemu-user as well and removed special
state management for *envcfg related feature enabling for qemu-user
- Exposing zicfilp and zicfiss as different patch
v9:
- fix switch case fallthrough for sw_check excp in patch 4
v8:
- fixed up `gen_cmpxchg` to store extra word2 during compile to raise storeAMO always
v7:
- Updated decode_save_opc to take extra argument of excp_uw2 and
updated callsites
- added a helper for promoting load faults to store faults
- Removed stale comments and edited existed comments
v6:
- Added support extra store word 2 for tcg compile and extraction during unwind
- Using extra word, AMO instructions and shadow stack instructions can raise store fault
- some alignment and cosmetic changes
- added vmstate migration support for elp and ssp cpu state
v5:
- Simplified elp tracking and lpad implementation as per suggestion by richard
- Simplified shadow stack mmu checks as per suggestion by richard
- Converged zicfiss compressed and non-comressed instructions to same translation
- Removed trace hooks. Don't need for upstream.
v4:
- elp state in cpu is true/false instead of enum and elp cleared
unconditionally on trap entry. elp in *status cleared unconditionally on
trap return.
- Moved logic for branch tracking in instruction translation from tb_start.
- fixed zicfiss dependency on 'A'
- `cpu_get_fcfien/bcfien` helpers checks fixed to check for extension first.
- removed trace hook enums. Instead added dedicated trace helpers wherever needed.
- fixed/simplified instruction format in decoder for lpad, sspush, sspopchk
- simplified tlb index logic for shadow stack instructions. Removed SUM TB_FLAG
- access to ssp CSR is gated on `cpu_get_bcfien` instead of duplicated logic
- removed vDSO related changes for now.
v3:
- Removed prctl specific patches because they need to be upstream
in kernel first.
- As suggested by Richard, added TB flag if fcfi enabled
- Re-worked translation for landing pad and shadow stack instructions
to not require helper.
- tcg helpers only for cfi violation cases so that trace hooks can be
placed.
- Style changes.
- fixes assert condition in accel/tcg
v2:
- added missed file (in v1) for shadow stack instructions implementation.
Deepak Gupta (21):
target/riscv: expose *envcfg csr and priv to qemu-user as well
target/riscv: Add zicfilp extension
target/riscv: Introduce elp state and enabling controls for zicfilp
target/riscv: save and restore elp state on priv transitions
target/riscv: additional code information for sw check
target/riscv: tracking indirect branches (fcfi) for zicfilp
target/riscv: zicfilp `lpad` impl and branch tracking
disas/riscv: enable `lpad` disassembly
target/riscv: Expose zicfilp extension as a cpu property
target/riscv: Add zicfiss extension
target/riscv: introduce ssp and enabling controls for zicfiss
target/riscv: tb flag for shadow stack instructions
target/riscv: mmu changes for zicfiss shadow stack protection
target/riscv: disallow probe accesses to shadow stack
target/riscv: AMO operations always raise store/AMO fault
target/riscv: update `decode_save_opc` to store extra word2
target/riscv: implement zicfiss instructions
target/riscv: compressed encodings for sspush and sspopchk
disas/riscv: enable disassembly for zicfiss instructions
disas/riscv: enable disassembly for compressed sspush/sspopchk
target/riscv: Expose zicfiss extension as a cpu property
disas/riscv.c | 77 +++++++-
disas/riscv.h | 4 +
target/riscv/cpu.c | 14 ++
target/riscv/cpu.h | 31 ++-
target/riscv/cpu_bits.h | 17 ++
target/riscv/cpu_cfg.h | 2 +
target/riscv/cpu_helper.c | 184 ++++++++++++++++--
target/riscv/cpu_user.h | 1 +
target/riscv/csr.c | 84 ++++++++
target/riscv/insn16.decode | 4 +
target/riscv/insn32.decode | 26 ++-
.../riscv/insn_trans/trans_privileged.c.inc | 8 +-
target/riscv/insn_trans/trans_rva.c.inc | 4 +-
target/riscv/insn_trans/trans_rvd.c.inc | 4 +-
target/riscv/insn_trans/trans_rvf.c.inc | 4 +-
target/riscv/insn_trans/trans_rvh.c.inc | 8 +-
target/riscv/insn_trans/trans_rvi.c.inc | 61 +++++-
target/riscv/insn_trans/trans_rvvk.c.inc | 10 +-
target/riscv/insn_trans/trans_rvzacas.c.inc | 4 +-
target/riscv/insn_trans/trans_rvzfh.c.inc | 4 +-
target/riscv/insn_trans/trans_rvzicfiss.c.inc | 114 +++++++++++
target/riscv/insn_trans/trans_svinval.c.inc | 6 +-
target/riscv/internals.h | 3 +
target/riscv/machine.c | 38 ++++
target/riscv/op_helper.c | 17 ++
target/riscv/pmp.c | 5 +
target/riscv/pmp.h | 3 +-
target/riscv/tcg/tcg-cpu.c | 29 +++
target/riscv/translate.c | 44 ++++-
29 files changed, 749 insertions(+), 61 deletions(-)
create mode 100644 target/riscv/insn_trans/trans_rvzicfiss.c.inc
--
2.45.0