Add gentag exclusion-mask CSRs

[Adam 'pi3' Zabrocki (Adam-pi3)]

Add pairs of CSRs to hold a 128-bit tag generation exclusion mask for gentag. The mask controls which pointer tag values gentag may generate, allowing software to exclude special values such as zero for untagged pointers.

Define mask semantics for 4-bit and 7-bit pointer tags, clarify that the mask affects only gentag, and leave CSR addresses to be allocated.

This commit addresses #92.

[Luís Fiolhais (lfiolhais)]

As a final point on my side, we also need to address the fact that the addition
of these CSRs create a data syntactic dependency in the memory model between
gentag and the *tagexclude CSRs. Specifically, the dependency as the
*tagexclude as sources and the destination operand of gentag as the
destination.

[Adam 'pi3' Zabrocki (Adam-pi3)]

As a final point on my side, we also need to address the fact that the addition of these CSRs create a data syntactic dependency in the memory model between gentag and the *tagexclude CSRs. Specifically, the dependency as the *tagexclude as sources and the destination operand of gentag as the destination.

I can add the following sentence:

For the purposes of syntactic dependencies in the memory model, `gentag` has the
active tag generation exclusion mask CSRs as source operands and `rd` as its
destination operand.

[Florian Mayer (fmayer)]

"requirement that the read-back value leaves at
least one tag value permitted for every supported pointer_tag_width"

isn't that requirement also needed for tag_width = 4?

[Florian Mayer (fmayer)]

I guess my actual comment: this shouldn't be in the same sentence as "When pointer_tag_width = 7"

[Adam 'pi3' Zabrocki (Adam-pi3)]

Florian Mayer (@fmayer) what about #102 (comment)

[Luís Fiolhais (lfiolhais)]

As a final point on my side, we also need to address the fact that the addition of these CSRs create a data syntactic dependency in the memory model between gentag and the *tagexclude CSRs. Specifically, the dependency as the *tagexclude as sources and the destination operand of gentag as the destination.

I can add the following sentence:

For the purposes of syntactic dependencies in the memory model, `gentag` has the
active tag generation exclusion mask CSRs as source operands and `rd` as its
destination operand.

LGTM 👍

[Luís Fiolhais (lfiolhais)]

Thanks for the PR Adam 'pi3' Zabrocki (@Adam-pi3). All of my concerns were addressed. Apologies for the sparse replies. I'm at the EU Sumit and don't have much time to look at my laptop.

[Radim Krčmář (radimkrcmar)]

I didn't notice this PR before the meeting, sorry.

When adding new architectural state, we also have to provide protection against side channel usage on software that doesn't context-switch it. A bit in *stateen CSRs seems ideal.

[Radim Krčmář (radimkrcmar)]

Out of curiosity -- are there performance reasons against providing a single CSR pair for all privilege levels?

[Adam 'pi3' Zabrocki (Adam-pi3)]

Thanks. For the `stateen point, I understand your later comment that this is already covered by the existing new state added for Svatag, so I did not add a separate stateen bit in this PR.

On the single-CSR-pair question: I don't think the main reason for separate CSR pairs is performance. The intent was to mirror the existing per-execution- environment MT_MODE structure and allow M, S/HS, U/HU, and VS/VU contexts to have independent gentag exclusion policies. A single global pair would be simpler architecturally, but it would couple host/guest/kernel/user/M-mode policy and could require extra save/restore when switching between domains that want different excluded tags.