Re: [PATCH v2 05/24] target/riscv: tracking indirect branches (fcfi) for zicfilp

[Deepak Gupta]

On Thu, Aug 1, 2024 at 2:12 AM Richard Henderson
<richard.henderson@linaro.org> wrote:
>
> On 8/1/24 16:59, Deepak Gupta wrote:
> > hmm... you've suggested below to use `aarch64_tr_translate_insn` and
> > check if it's the first instruction.
> > and put the check there.
> > In that case I won't need FCFI_LP_EXPECTED TB flag.
> > Then I would rather use it as FCFI_ENABLED TB flag.
>
> You will need both bits.

I was thinking of following logic and wanted to run by you to check if
I am missing something
obvious.

---Recording fcfi_enabled in disascontext---
Add a FCFI_ENABLED TB flag which gets set (or not set) in `cpu_get_tb_cpu_state`

And `riscv_tr_init_disas_context` does
DisasContext->fcfi_enabled = extracts FCFI_ENABLED TB flag.


---Set elp on translation of indirect jump/call----
translation for jalr (instruction which triggers elp state) does following

trans_jalr:
if (DisasContext->fcfi_enabled)
    env->elp = LP_EXPECTED

---Check if first instruction is not a landing pad----
In `riscv_tr_translate_insn`

if (first instruction of TB && env->elp) {
      if (`insn` is not a `lpad` (landing pad) encoding)
         raise_exception();
}

---label check embedded in landing pad instruction---
In `trans_lpad`

env->elp =  NO_LP_EXPECTED
invoke a helper which will check embedded label value against value in
ISA defined register (x7)

I think this will work with just one TB flag (FCFI_ENABLED). Let me
know if I am missing something.

>
>
> r~