Re: [PATCH v1 RFC Zisslpcfi 8/9] target/riscv: Instructions encodings, implementation and handlers

2023-02-15 Thread LIU Zhiwei



On 2023/2/9 14:24, Deepak Gupta wrote:

This patch implements instruction encodings for zisslpcfi instructions.
Additionally this patch implements zimops encodings as well. If Zisslpcfi
is supported by CPU but not enabled then all Zisslpcfi instructions
default to Zimops instuction behavior i.e. mov 0 to rd.

zisslpcfi defines following instructions.
- Backward control flow
 - sspush x1/x5 : Decrement shadow stack pointer and pushes x1 or x5
  on shadow stack.
 - sspop x1/x5 : Pops from shadow stack into x1 or x5. Increments
 shadow stack pointer.
 - ssprr : Reads current shadow stack pointer into a destination
   register.
 - sscheckra : Compares x1 with x5. Raises illegal instr fault if
 x1 != x5
 - ssamoswap : Atomically swaps value on top of shadow stack

- Forward control flow
 - lpsll, lpsml, lpsul : sets lower (9bit), mid (8bit) and upper
 (8bit) label values in CSR_ULLP respectively.
 - lpcll, lpcml, lpcul : checks lower (9bit), mid (8bit) and upper
 (8bit) label values with CSR_ULLP
 respectively.
 Check label instructions raise illegal instruction fault when labels
 mismatch.

Signed-off-by: Deepak Gupta 
Signed-off-by: Kip Walker  
---
  target/riscv/cpu_bits.h   |  10 +
  target/riscv/helper.h |   7 +
  target/riscv/insn32.decode|  29 ++
  target/riscv/insn_trans/trans_rvi.c.inc   |  14 +
  target/riscv/insn_trans/trans_zimops.c.inc|  53 +++
  target/riscv/insn_trans/trans_zisslpcfi.c.inc | 310 ++
  target/riscv/op_helper.c  |  67 
  target/riscv/translate.c  |   2 +
  8 files changed, 492 insertions(+)
  create mode 100644 target/riscv/insn_trans/trans_zimops.c.inc
  create mode 100644 target/riscv/insn_trans/trans_zisslpcfi.c.inc

diff --git a/target/riscv/cpu_bits.h b/target/riscv/cpu_bits.h
index 37100ec8f6..b2d527c626 100644
--- a/target/riscv/cpu_bits.h
+++ b/target/riscv/cpu_bits.h
@@ -600,6 +600,16 @@ typedef enum {
  LP_EXPECTED = 1,
  } cfi_elp;
  
+#define LPLR_UL(((1 << 8) - 1) << 17)

+#define LPLR_ML(((1 << 8) - 1) << 9)
+#define LPLR_LL((1 << 9) - 1)
+
+typedef enum {
+FCFI_LPLL = 0,
+FCFI_ML = 1,
+FCFI_UL = 2,
+} cfi_label_inst;
+
  /* hstatus CSR bits */
  #define HSTATUS_VSBE 0x0020
  #define HSTATUS_GVA  0x0040
diff --git a/target/riscv/helper.h b/target/riscv/helper.h
index 227c7122ef..6484415612 100644
--- a/target/riscv/helper.h
+++ b/target/riscv/helper.h
@@ -97,6 +97,11 @@ DEF_HELPER_FLAGS_2(fcvt_h_l, TCG_CALL_NO_RWG, i64, env, tl)
  DEF_HELPER_FLAGS_2(fcvt_h_lu, TCG_CALL_NO_RWG, i64, env, tl)
  DEF_HELPER_FLAGS_2(fclass_h, TCG_CALL_NO_RWG_SE, tl, env, i64)
  
+/* Forward CFI label checking */

+DEF_HELPER_2(cfi_jalr, void, env, int)
+DEF_HELPER_3(cfi_check_landing_pad, void, env, int, int)
+DEF_HELPER_3(cfi_set_landing_pad, void, env, int, int)
+
  /* Special functions */
  DEF_HELPER_2(csrr, tl, env, int)
  DEF_HELPER_3(csrw, void, env, int, tl)
@@ -112,6 +117,8 @@ DEF_HELPER_1(tlb_flush, void, env)
  /* Native Debug */
  DEF_HELPER_1(itrigger_match, void, env)
  #endif
+/* helper for back cfi mismatch */
+DEF_HELPER_1(sschkra_mismatch, void, env)
  
  /* Hypervisor functions */

  #ifndef CONFIG_USER_ONLY
diff --git a/target/riscv/insn32.decode b/target/riscv/insn32.decode
index b7e7613ea2..cd734f03ae 100644
--- a/target/riscv/insn32.decode
+++ b/target/riscv/insn32.decode
@@ -37,6 +37,8 @@
  %imm_u12:s20 !function=ex_shift_12
  %imm_bs   30:2   !function=ex_shift_3
  %imm_rnum 20:4
+%imm_cfi9  15:9
+%imm_cfi8  15:8
  
  # Argument sets:

  &empty
@@ -163,6 +165,33 @@ csrrwi    . 101 . 1110011 @csr
  csrrsi    . 110 . 1110011 @csr
  csrrci    . 111 . 1110011 @csr
  
+# zimops (unpriv integer may be operations) instructions with system opcode

+# These're superset of for cfi encodings. zimops_r and zimops_rr should be last
+# entry in below overlapping patterns so that it acts as final sink for 
overlapping patterns.
+# Any new encoding that can be used should be placed above mop.r and mop.rr
+
+# cfi instructions carved out of mop.r
+{
+  sspush10 0 11100 . 100 0 1110011 %rs1
+  sspop 10 0 11100 0 100 . 1110011 %rd
+  ssprr 10 0 11101 0 100 . 1110011 %rd
+  zimops_r  1-00-- 0 111-- - 100 . 1110011 %rd
+}
+
+# cfi instructions carved out of mop.rr
+{
+  sschckra  100010 1 1 00101 100 0 1110011
+  ssamoswap 10 1 . . 100 . 1110011 @r
+
+  lpsll 10 1 0 .100 0 1110011 %imm_cfi9
+  lpcll 10 1 1 .100 0 1110011 %imm_cfi9
+  lpsml

[PATCH v1 RFC Zisslpcfi 8/9] target/riscv: Instructions encodings, implementation and handlers

2023-02-08 Thread Deepak Gupta
This patch implements instruction encodings for zisslpcfi instructions.
Additionally this patch implements zimops encodings as well. If Zisslpcfi
is supported by CPU but not enabled then all Zisslpcfi instructions
default to Zimops instuction behavior i.e. mov 0 to rd.

zisslpcfi defines following instructions.
- Backward control flow
- sspush x1/x5 : Decrement shadow stack pointer and pushes x1 or x5
 on shadow stack.
- sspop x1/x5 : Pops from shadow stack into x1 or x5. Increments
shadow stack pointer.
- ssprr : Reads current shadow stack pointer into a destination
  register.
- sscheckra : Compares x1 with x5. Raises illegal instr fault if
x1 != x5
- ssamoswap : Atomically swaps value on top of shadow stack

- Forward control flow
- lpsll, lpsml, lpsul : sets lower (9bit), mid (8bit) and upper
(8bit) label values in CSR_ULLP respectively.
- lpcll, lpcml, lpcul : checks lower (9bit), mid (8bit) and upper
(8bit) label values with CSR_ULLP
respectively.
Check label instructions raise illegal instruction fault when labels
mismatch.

Signed-off-by: Deepak Gupta 
Signed-off-by: Kip Walker  
---
 target/riscv/cpu_bits.h   |  10 +
 target/riscv/helper.h |   7 +
 target/riscv/insn32.decode|  29 ++
 target/riscv/insn_trans/trans_rvi.c.inc   |  14 +
 target/riscv/insn_trans/trans_zimops.c.inc|  53 +++
 target/riscv/insn_trans/trans_zisslpcfi.c.inc | 310 ++
 target/riscv/op_helper.c  |  67 
 target/riscv/translate.c  |   2 +
 8 files changed, 492 insertions(+)
 create mode 100644 target/riscv/insn_trans/trans_zimops.c.inc
 create mode 100644 target/riscv/insn_trans/trans_zisslpcfi.c.inc

diff --git a/target/riscv/cpu_bits.h b/target/riscv/cpu_bits.h
index 37100ec8f6..b2d527c626 100644
--- a/target/riscv/cpu_bits.h
+++ b/target/riscv/cpu_bits.h
@@ -600,6 +600,16 @@ typedef enum {
 LP_EXPECTED = 1,
 } cfi_elp;
 
+#define LPLR_UL(((1 << 8) - 1) << 17)
+#define LPLR_ML(((1 << 8) - 1) << 9)
+#define LPLR_LL((1 << 9) - 1)
+
+typedef enum {
+FCFI_LPLL = 0,
+FCFI_ML = 1,
+FCFI_UL = 2,
+} cfi_label_inst;
+
 /* hstatus CSR bits */
 #define HSTATUS_VSBE 0x0020
 #define HSTATUS_GVA  0x0040
diff --git a/target/riscv/helper.h b/target/riscv/helper.h
index 227c7122ef..6484415612 100644
--- a/target/riscv/helper.h
+++ b/target/riscv/helper.h
@@ -97,6 +97,11 @@ DEF_HELPER_FLAGS_2(fcvt_h_l, TCG_CALL_NO_RWG, i64, env, tl)
 DEF_HELPER_FLAGS_2(fcvt_h_lu, TCG_CALL_NO_RWG, i64, env, tl)
 DEF_HELPER_FLAGS_2(fclass_h, TCG_CALL_NO_RWG_SE, tl, env, i64)
 
+/* Forward CFI label checking */
+DEF_HELPER_2(cfi_jalr, void, env, int)
+DEF_HELPER_3(cfi_check_landing_pad, void, env, int, int)
+DEF_HELPER_3(cfi_set_landing_pad, void, env, int, int)
+
 /* Special functions */
 DEF_HELPER_2(csrr, tl, env, int)
 DEF_HELPER_3(csrw, void, env, int, tl)
@@ -112,6 +117,8 @@ DEF_HELPER_1(tlb_flush, void, env)
 /* Native Debug */
 DEF_HELPER_1(itrigger_match, void, env)
 #endif
+/* helper for back cfi mismatch */
+DEF_HELPER_1(sschkra_mismatch, void, env)
 
 /* Hypervisor functions */
 #ifndef CONFIG_USER_ONLY
diff --git a/target/riscv/insn32.decode b/target/riscv/insn32.decode
index b7e7613ea2..cd734f03ae 100644
--- a/target/riscv/insn32.decode
+++ b/target/riscv/insn32.decode
@@ -37,6 +37,8 @@
 %imm_u12:s20 !function=ex_shift_12
 %imm_bs   30:2   !function=ex_shift_3
 %imm_rnum 20:4
+%imm_cfi9  15:9
+%imm_cfi8  15:8
 
 # Argument sets:
 &empty
@@ -163,6 +165,33 @@ csrrwi    . 101 . 1110011 @csr
 csrrsi    . 110 . 1110011 @csr
 csrrci    . 111 . 1110011 @csr
 
+# zimops (unpriv integer may be operations) instructions with system opcode
+# These're superset of for cfi encodings. zimops_r and zimops_rr should be last
+# entry in below overlapping patterns so that it acts as final sink for 
overlapping patterns.
+# Any new encoding that can be used should be placed above mop.r and mop.rr
+
+# cfi instructions carved out of mop.r
+{
+  sspush10 0 11100 . 100 0 1110011 %rs1
+  sspop 10 0 11100 0 100 . 1110011 %rd
+  ssprr 10 0 11101 0 100 . 1110011 %rd
+  zimops_r  1-00-- 0 111-- - 100 . 1110011 %rd
+}
+
+# cfi instructions carved out of mop.rr
+{
+  sschckra  100010 1 1 00101 100 0 1110011
+  ssamoswap 10 1 . . 100 . 1110011 @r
+
+  lpsll 10 1 0 .100 0 1110011 %imm_cfi9
+  lpcll 10 1 1 .100 0 1110011 %imm_cfi9
+  lpsml 11 1 0 0100 0 1110011 %imm_cfi8
+  lpcml 11 1 0 1100 

[PATCH v1 RFC Zisslpcfi 8/9] target/riscv: Instructions encodings, implementation and handlers

2023-02-08 Thread Deepak Gupta
This patch implements instruction encodings for zisslpcfi instructions.
Additionally this patch implements zimops encodings as well. If Zisslpcfi
is supported by CPU but not enabled then all Zisslpcfi instructions
default to Zimops instuction behavior i.e. mov 0 to rd.

zisslpcfi defines following instructions.
- Backward control flow
- sspush x1/x5 : Decrement shadow stack pointer and pushes x1 or x5
 on shadow stack.
- sspop x1/x5 : Pops from shadow stack into x1 or x5. Increments
shadow stack pointer.
- ssprr : Reads current shadow stack pointer into a destination
  register.
- sscheckra : Compares x1 with x5. Raises illegal instr fault if
x1 != x5
- ssamoswap : Atomically swaps value on top of shadow stack

- Forward control flow
- lpsll, lpsml, lpsul : sets lower (9bit), mid (8bit) and upper
(8bit) label values in CSR_ULLP respectively.
- lpcll, lpcml, lpcul : checks lower (9bit), mid (8bit) and upper
(8bit) label values with CSR_ULLP
respectively.
Check label instructions raise illegal instruction fault when labels
mismatch.

Signed-off-by: Deepak Gupta 
Signed-off-by: Kip Walker  
---
 target/riscv/cpu_bits.h   |  10 +
 target/riscv/helper.h |   7 +
 target/riscv/insn32.decode|  29 ++
 target/riscv/insn_trans/trans_rvi.c.inc   |  14 +
 target/riscv/insn_trans/trans_zimops.c.inc|  53 +++
 target/riscv/insn_trans/trans_zisslpcfi.c.inc | 310 ++
 target/riscv/op_helper.c  |  67 
 target/riscv/translate.c  |   2 +
 8 files changed, 492 insertions(+)
 create mode 100644 target/riscv/insn_trans/trans_zimops.c.inc
 create mode 100644 target/riscv/insn_trans/trans_zisslpcfi.c.inc

diff --git a/target/riscv/cpu_bits.h b/target/riscv/cpu_bits.h
index 37100ec8f6..b2d527c626 100644
--- a/target/riscv/cpu_bits.h
+++ b/target/riscv/cpu_bits.h
@@ -600,6 +600,16 @@ typedef enum {
 LP_EXPECTED = 1,
 } cfi_elp;
 
+#define LPLR_UL(((1 << 8) - 1) << 17)
+#define LPLR_ML(((1 << 8) - 1) << 9)
+#define LPLR_LL((1 << 9) - 1)
+
+typedef enum {
+FCFI_LPLL = 0,
+FCFI_ML = 1,
+FCFI_UL = 2,
+} cfi_label_inst;
+
 /* hstatus CSR bits */
 #define HSTATUS_VSBE 0x0020
 #define HSTATUS_GVA  0x0040
diff --git a/target/riscv/helper.h b/target/riscv/helper.h
index 227c7122ef..6484415612 100644
--- a/target/riscv/helper.h
+++ b/target/riscv/helper.h
@@ -97,6 +97,11 @@ DEF_HELPER_FLAGS_2(fcvt_h_l, TCG_CALL_NO_RWG, i64, env, tl)
 DEF_HELPER_FLAGS_2(fcvt_h_lu, TCG_CALL_NO_RWG, i64, env, tl)
 DEF_HELPER_FLAGS_2(fclass_h, TCG_CALL_NO_RWG_SE, tl, env, i64)
 
+/* Forward CFI label checking */
+DEF_HELPER_2(cfi_jalr, void, env, int)
+DEF_HELPER_3(cfi_check_landing_pad, void, env, int, int)
+DEF_HELPER_3(cfi_set_landing_pad, void, env, int, int)
+
 /* Special functions */
 DEF_HELPER_2(csrr, tl, env, int)
 DEF_HELPER_3(csrw, void, env, int, tl)
@@ -112,6 +117,8 @@ DEF_HELPER_1(tlb_flush, void, env)
 /* Native Debug */
 DEF_HELPER_1(itrigger_match, void, env)
 #endif
+/* helper for back cfi mismatch */
+DEF_HELPER_1(sschkra_mismatch, void, env)
 
 /* Hypervisor functions */
 #ifndef CONFIG_USER_ONLY
diff --git a/target/riscv/insn32.decode b/target/riscv/insn32.decode
index b7e7613ea2..cd734f03ae 100644
--- a/target/riscv/insn32.decode
+++ b/target/riscv/insn32.decode
@@ -37,6 +37,8 @@
 %imm_u12:s20 !function=ex_shift_12
 %imm_bs   30:2   !function=ex_shift_3
 %imm_rnum 20:4
+%imm_cfi9  15:9
+%imm_cfi8  15:8
 
 # Argument sets:
 &empty
@@ -163,6 +165,33 @@ csrrwi    . 101 . 1110011 @csr
 csrrsi    . 110 . 1110011 @csr
 csrrci    . 111 . 1110011 @csr
 
+# zimops (unpriv integer may be operations) instructions with system opcode
+# These're superset of for cfi encodings. zimops_r and zimops_rr should be last
+# entry in below overlapping patterns so that it acts as final sink for 
overlapping patterns.
+# Any new encoding that can be used should be placed above mop.r and mop.rr
+
+# cfi instructions carved out of mop.r
+{
+  sspush10 0 11100 . 100 0 1110011 %rs1
+  sspop 10 0 11100 0 100 . 1110011 %rd
+  ssprr 10 0 11101 0 100 . 1110011 %rd
+  zimops_r  1-00-- 0 111-- - 100 . 1110011 %rd
+}
+
+# cfi instructions carved out of mop.rr
+{
+  sschckra  100010 1 1 00101 100 0 1110011
+  ssamoswap 10 1 . . 100 . 1110011 @r
+
+  lpsll 10 1 0 .100 0 1110011 %imm_cfi9
+  lpcll 10 1 1 .100 0 1110011 %imm_cfi9
+  lpsml 11 1 0 0100 0 1110011 %imm_cfi8
+  lpcml 11 1 0 1100