UNRATIFIED RISC-V: Add 'Zicfiss' extension and its TENTATIVE CSR

a4lg · a4lg · commit 067da0559b2b · 2023-08-15T06:32:38.000Z
[DO NOT MERGE] Until the 'Zicfiss' extension is frozen/ratified and final version number is determined, this patch should not be merged upstream. This commit uses unratified version 0.1 as in the documentation (instead of possible 1.0 after ratification). This commit adds RISC-V Shadow Stack extension (Zicfiss) and its CSRs based on the document version 0.1 (latest git revision): <riscv/riscv-cfi@c6a8311> **Note** Because CSR address is not fixed yet, this commit uses tentative one (a part of custom CSR space). bfd/ChangeLog: * elfxx-riscv.c (riscv_implicit_subsets): Add implication 'Zicfiss' -> 'Zicsr', 'A', 'Zimop' and 'Zcmop'. (riscv_supported_std_z_ext): Add 'Zicfiss' extension to valid 'Z' extension list. (riscv_multi_subset_supports): Support new instruction class. (riscv_multi_subset_supports_ext): Likewise. gas/ChangeLog: * config/tc-riscv.c (enum riscv_csr_class): Add new CSR class. (riscv_csr_address): Add new CSR class handling. * testsuite/gas/riscv/csr.s: Add new CSR test. * testsuite/gas/riscv/csr-dw-regnums.s: Likewise. * testsuite/gas/riscv/csr-dw-regnums.d: Likewise. * testsuite/gas/riscv/csr-version-1p10.d: Likewise. * testsuite/gas/riscv/csr-version-1p10.l: Likewise. * testsuite/gas/riscv/csr-version-1p11.d: Likewise. * testsuite/gas/riscv/csr-version-1p11.l: Likewise. * testsuite/gas/riscv/csr-version-1p12.d: Likewise. * testsuite/gas/riscv/csr-version-1p12.l: Likewise. * testsuite/gas/riscv/csr-version-1p9p1.d: Likewise. * testsuite/gas/riscv/csr-version-1p9p1.l: Likewise. * testsuite/gas/riscv/zicfiss.s: New test for shadow stack instructions and its auto-compression. * testsuite/gas/riscv/zicfiss.d: Likewise. * testsuite/gas/riscv/zicfiss-na.d: Likewise. * testsuite/gas/riscv/zicfiss-mop.s: New test for MOP encoding. * testsuite/gas/riscv/zicfiss-mop.d: Likewise. * testsuite/gas/riscv/zicfiss-fail.s: New failure test for shadow stack instructions. * testsuite/gas/riscv/zicfiss-fail.d: Likewise. * testsuite/gas/riscv/zicfiss-fail.l: Likewise. include/ChangeLog: * opcode/riscv-opc.h (MATCH_SSLOAD, MASK_SSLOAD, MATCH_SSPOPCHK, MASK_SSPOPCHK, MATCH_SSPINC, MASK_SSPINC, MATCH_SSPUSH, MASK_SSPUSH, MATCH_SSPRR, MASK_SSPRR, MATCH_SSAMOSWAP, MASK_SSAMOSWAP, MATCH_C_SSPUSH, MASK_C_SSPUSH, MATCH_C_SSPOPCHK, MASK_C_SSPOPCHK): New. (CSR_SSP): New. * opcode/riscv.h (enum riscv_insn_class): Add new instruction class INSN_CLASS_ZICFISS. opcodes/ChangeLog: * riscv-opc.c (match_rs1_nonzero, match_rd_eq_1_or_5, match_rs1_eq_1_or_5, match_rs2_eq_1_or_5): New. (riscv_opcodes): Add 'Zicfiss' instructions and aliases.
diff --git a/bfd/elfxx-riscv.c b/bfd/elfxx-riscv.c
@@ -1148,6 +1148,10 @@ static struct riscv_implicit_subset riscv_implicit_subsets[] =
   {"zhinx", "zhinxmin",	check_implicit_always},
   {"zhinxmin", "zfinx",	check_implicit_always},
   {"zfinx", "zicsr",	check_implicit_always},
+  {"zicfiss", "a",	check_implicit_always},
+  {"zicfiss", "zicsr",	check_implicit_always},
+  {"zicfiss", "zimop",	check_implicit_always},
+  {"zicfiss", "zcmop",	check_implicit_always},
   {"zk", "zkn",		check_implicit_always},
   {"zk", "zkr",		check_implicit_always},
   {"zk", "zkt",		check_implicit_always},
@@ -1190,6 +1194,8 @@ static struct riscv_implicit_subset riscv_implicit_subsets[] =
   {"sscofpmf", "zicsr",		check_implicit_always},
   {"ssstateen", "zicsr",	check_implicit_always},
   {"sstc", "zicsr",		check_implicit_always},
+  /* Complex implications (that should be checked after others).  */
+  /* Tail of the list.  */
   {NULL, NULL, NULL}
 };
 
@@ -1250,6 +1256,7 @@ static struct riscv_supported_ext riscv_supported_std_z_ext[] =
   {"zicbom",		ISA_SPEC_CLASS_DRAFT,		1, 0,  0 },
   {"zicbop",		ISA_SPEC_CLASS_DRAFT,		1, 0,  0 },
   {"zicboz",		ISA_SPEC_CLASS_DRAFT,		1, 0,  0 },
+  {"zicfiss",		ISA_SPEC_CLASS_DRAFT,		0, 1,  0 },
   {"zicond",		ISA_SPEC_CLASS_DRAFT,		1, 0,  0 },
   {"zicsr",		ISA_SPEC_CLASS_20191213,	2, 0,  0 },
   {"zicsr",		ISA_SPEC_CLASS_20190608,	2, 0,  0 },
@@ -2388,6 +2395,8 @@ riscv_multi_subset_supports (riscv_parse_subset_t *rps,
       return riscv_subset_supports (rps, "zicbop");
     case INSN_CLASS_ZICBOZ:
       return riscv_subset_supports (rps, "zicboz");
+    case INSN_CLASS_ZICFISS:
+      return riscv_subset_supports (rps, "zicfiss");
     case INSN_CLASS_ZICOND:
       return riscv_subset_supports (rps, "zicond");
     case INSN_CLASS_ZICSR:
@@ -2585,6 +2594,8 @@ riscv_multi_subset_supports_ext (riscv_parse_subset_t *rps,
       return "zicbop";
     case INSN_CLASS_ZICBOZ:
       return "zicboz";
+    case INSN_CLASS_ZICFISS:
+      return "zicfiss";
     case INSN_CLASS_ZICOND:
       return "zicond";
     case INSN_CLASS_ZICSR:
diff --git a/gas/config/tc-riscv.c b/gas/config/tc-riscv.c
@@ -67,6 +67,7 @@ enum riscv_csr_class
   CSR_CLASS_I,
   CSR_CLASS_I_32,	/* rv32 only */
   CSR_CLASS_F,		/* f-ext only */
+  CSR_CLASS_ZICFISS,	/* Zicfiss only */
   CSR_CLASS_ZKR,	/* zkr only */
   CSR_CLASS_V,		/* rvv only */
   CSR_CLASS_DEBUG,	/* debug CSR */
@@ -1040,6 +1041,9 @@ riscv_csr_address (const char *csr_name,
     case CSR_CLASS_F:
       extension = "f";
       break;
+    case CSR_CLASS_ZICFISS:
+      extension = "zicfiss";
+      break;
     case CSR_CLASS_ZKR:
       extension = "zkr";
       break;
diff --git a/gas/testsuite/gas/riscv/csr-dw-regnums.d b/gas/testsuite/gas/riscv/csr-dw-regnums.d
@@ -399,6 +399,7 @@ Contents of the .* section:
   DW_CFA_offset_extended_sf: r4445 \(stimecmph\) at cfa\+1396
   DW_CFA_offset_extended_sf: r4685 \(vstimecmp\) at cfa\+2356
   DW_CFA_offset_extended_sf: r4701 \(vstimecmph\) at cfa\+2420
+  DW_CFA_offset_extended_sf: r6144 \(ssp\) at cfa\+8192
   DW_CFA_offset_extended_sf: r4163 \(utval\) at cfa\+268
   DW_CFA_offset_extended_sf: r4419 \(stval\) at cfa\+1292
   DW_CFA_offset_extended_sf: r4480 \(satp\) at cfa\+1536
diff --git a/gas/testsuite/gas/riscv/csr-dw-regnums.s b/gas/testsuite/gas/riscv/csr-dw-regnums.s
@@ -400,6 +400,8 @@ _start:
 	.cfi_offset stimecmph, 1396
 	.cfi_offset vstimecmp, 2356
 	.cfi_offset vstimecmph, 2420
+	# Zicfiss extension
+	.cfi_offset ssp, 8192
 	# dropped
 	.cfi_offset ubadaddr, 268	# aliases
 	.cfi_offset sbadaddr, 1292	# aliases
diff --git a/gas/testsuite/gas/riscv/csr-version-1p10.d b/gas/testsuite/gas/riscv/csr-version-1p10.d
@@ -887,3 +887,5 @@ Disassembly of section .text:
 [ 	]+[0-9a-f]+:[ 	]+c2159073[ 	]+csrw[ 	]+vtype,a1
 [ 	]+[0-9a-f]+:[ 	]+c2202573[ 	]+csrr[ 	]+a0,vlenb
 [ 	]+[0-9a-f]+:[ 	]+c2259073[ 	]+csrw[ 	]+vlenb,a1
+[ 	]+[0-9a-f]+:[ 	]+80002573[ 	]+csrr[ 	]+a0,ssp
+[ 	]+[0-9a-f]+:[ 	]+80059073[ 	]+csrw[ 	]+ssp,a1
diff --git a/gas/testsuite/gas/riscv/csr-version-1p10.l b/gas/testsuite/gas/riscv/csr-version-1p10.l
@@ -1589,3 +1589,7 @@
 .*Info: macro .*
 .*Warning: read-only CSR is written `csrw vlenb,a1'
 .*Info: macro .*
+.*Warning: invalid CSR `ssp', needs `zicfiss' extension
+.*Info: macro .*
+.*Warning: invalid CSR `ssp', needs `zicfiss' extension
+.*Info: macro .*
diff --git a/gas/testsuite/gas/riscv/csr-version-1p11.d b/gas/testsuite/gas/riscv/csr-version-1p11.d
@@ -887,3 +887,5 @@ Disassembly of section .text:
 [ 	]+[0-9a-f]+:[ 	]+c2159073[ 	]+csrw[ 	]+vtype,a1
 [ 	]+[0-9a-f]+:[ 	]+c2202573[ 	]+csrr[ 	]+a0,vlenb
 [ 	]+[0-9a-f]+:[ 	]+c2259073[ 	]+csrw[ 	]+vlenb,a1
+[ 	]+[0-9a-f]+:[ 	]+80002573[ 	]+csrr[ 	]+a0,ssp
+[ 	]+[0-9a-f]+:[ 	]+80059073[ 	]+csrw[ 	]+ssp,a1
diff --git a/gas/testsuite/gas/riscv/csr-version-1p11.l b/gas/testsuite/gas/riscv/csr-version-1p11.l
@@ -1585,3 +1585,7 @@
 .*Info: macro .*
 .*Warning: read-only CSR is written `csrw vlenb,a1'
 .*Info: macro .*
+.*Warning: invalid CSR `ssp', needs `zicfiss' extension
+.*Info: macro .*
+.*Warning: invalid CSR `ssp', needs `zicfiss' extension
+.*Info: macro .*
diff --git a/gas/testsuite/gas/riscv/csr-version-1p12.d b/gas/testsuite/gas/riscv/csr-version-1p12.d
@@ -887,3 +887,5 @@ Disassembly of section .text:
 [ 	]+[0-9a-f]+:[ 	]+c2159073[ 	]+csrw[ 	]+vtype,a1
 [ 	]+[0-9a-f]+:[ 	]+c2202573[ 	]+csrr[ 	]+a0,vlenb
 [ 	]+[0-9a-f]+:[ 	]+c2259073[ 	]+csrw[ 	]+vlenb,a1
+[ 	]+[0-9a-f]+:[ 	]+80002573[ 	]+csrr[ 	]+a0,ssp
+[ 	]+[0-9a-f]+:[ 	]+80059073[ 	]+csrw[ 	]+ssp,a1
diff --git a/gas/testsuite/gas/riscv/csr-version-1p12.l b/gas/testsuite/gas/riscv/csr-version-1p12.l
@@ -1349,3 +1349,7 @@
 .*Info: macro .*
 .*Warning: read-only CSR is written `csrw vlenb,a1'
 .*Info: macro .*
+.*Warning: invalid CSR `ssp', needs `zicfiss' extension
+.*Info: macro .*
+.*Warning: invalid CSR `ssp', needs `zicfiss' extension
+.*Info: macro .*
diff --git a/gas/testsuite/gas/riscv/csr-version-1p9p1.d b/gas/testsuite/gas/riscv/csr-version-1p9p1.d
@@ -887,3 +887,5 @@ Disassembly of section .text:
 [ 	]+[0-9a-f]+:[ 	]+c2159073[ 	]+csrw[ 	]+vtype,a1
 [ 	]+[0-9a-f]+:[ 	]+c2202573[ 	]+csrr[ 	]+a0,vlenb
 [ 	]+[0-9a-f]+:[ 	]+c2259073[ 	]+csrw[ 	]+vlenb,a1
+[ 	]+[0-9a-f]+:[ 	]+80002573[ 	]+csrr[ 	]+a0,ssp
+[ 	]+[0-9a-f]+:[ 	]+80059073[ 	]+csrw[ 	]+ssp,a1
diff --git a/gas/testsuite/gas/riscv/csr-version-1p9p1.l b/gas/testsuite/gas/riscv/csr-version-1p9p1.l
@@ -1641,3 +1641,7 @@
 .*Info: macro .*
 .*Warning: read-only CSR is written `csrw vlenb,a1'
 .*Info: macro .*
+.*Warning: invalid CSR `ssp', needs `zicfiss' extension
+.*Info: macro .*
+.*Warning: invalid CSR `ssp', needs `zicfiss' extension
+.*Info: macro .*
diff --git a/gas/testsuite/gas/riscv/csr.s b/gas/testsuite/gas/riscv/csr.s
@@ -504,3 +504,6 @@
 	csr vl
 	csr vtype
 	csr vlenb
+
+	# Control flow integrity (the Zicfiss extension)
+	csr ssp
diff --git a/gas/testsuite/gas/riscv/zicfiss-fail.d b/gas/testsuite/gas/riscv/zicfiss-fail.d
@@ -0,0 +1,2 @@
+#as: -march=rv32i_zicfiss
+#error_output: zicfiss-fail.l
diff --git a/gas/testsuite/gas/riscv/zicfiss-fail.l b/gas/testsuite/gas/riscv/zicfiss-fail.l
@@ -0,0 +1,28 @@
+.*: Assembler messages:
+.*: Error: illegal operands `ssload x0'
+.*: Error: illegal operands `ssload x2'
+.*: Error: illegal operands `ssload x31'
+.*: Error: illegal operands `sspopchk x0'
+.*: Error: illegal operands `sspopchk x2'
+.*: Error: illegal operands `sspopchk x31'
+.*: Error: illegal operands `sspush x0'
+.*: Error: illegal operands `sspush x2'
+.*: Error: illegal operands `sspush x31'
+.*: Error: improper immediate value \(-?[0-9]+\)
+.*: Error: improper immediate value \(32\)
+.*: Error: illegal operands `sspinc 32'
+.*: Error: illegal operands `sspinc 0'
+.*: Error: illegal operands `c\.sspush x5'
+.*: Error: illegal operands `c\.sspopchk x1'
+.*: Error: illegal operands `c\.sspush x0'
+.*: Error: illegal operands `c\.sspush x2'
+.*: Error: illegal operands `c\.sspush x31'
+.*: Error: illegal operands `c\.sspopchk x0'
+.*: Error: illegal operands `c\.sspopchk x2'
+.*: Error: illegal operands `c\.sspopchk x31'
+.*: Error: illegal operands `ssprr x0'
+.*: Error: illegal operands `ssamoswap x0,t1,t2'
+.*: Error: illegal operands `ssamoswap x0,a0,\(a1\)'
+.*: Error: illegal operands `ssamoswap x0,t0,0\(t1\)'
+.*: Error: illegal operands `ssamoswap t0,zero,4\(a0\)'
+.*: Error: illegal operands `ssamoswap t1,t2,8\(t3\)'
diff --git a/gas/testsuite/gas/riscv/zicfiss-fail.s b/gas/testsuite/gas/riscv/zicfiss-fail.s
@@ -0,0 +1,42 @@
+target:
+	# ssload / sspopchk / sspush: only x1 or x5 are allowed.
+	ssload		x0
+	ssload		x2
+	ssload		x31
+	sspopchk	x0
+	sspopchk	x2
+	sspopchk	x31
+	sspush		x0
+	sspush		x2
+	sspush		x31
+
+	# sspinc: nzuimm is an unsigned 5-bit width integer.
+	sspinc		-1
+	sspinc		32
+
+	# sspinc: nzuimm must not be zero.
+	sspinc		0
+
+	# c.sspush x1 / c.sspopchk x5: all other GPRs are not allowed.
+	c.sspush	x5
+	c.sspopchk	x1
+	c.sspush	x0
+	c.sspush	x2
+	c.sspush	x31
+	c.sspopchk	x0
+	c.sspopchk	x2
+	c.sspopchk	x31
+
+	# ssprr: rd must not be x0.
+	ssprr		x0
+
+	# ssamoswap: old form is no longer supported.
+	ssamoswap	x0, t1, t2
+
+	# ssamoswap: rd must not be x0.
+	ssamoswap	x0, a0, (a1)
+	ssamoswap	x0, t0, 0(t1)
+
+	# ssamoswap: offset is always zero.
+	ssamoswap	t0, zero, 4(a0)
+	ssamoswap	t1, t2, 8(t3)
diff --git a/gas/testsuite/gas/riscv/zicfiss-mop.d b/gas/testsuite/gas/riscv/zicfiss-mop.d
@@ -0,0 +1,19 @@
+#as: -march=rv32ic_zicfiss
+#objdump: -d
+
+.*:[ 	]+file format .*
+
+Disassembly of section .text:
+
+0+000 <target>:
+[ 	]+[0-9a-f]+:[ 	]+81c040f3[ 	]+ssload[ 	]+ra
+[ 	]+[0-9a-f]+:[ 	]+81c042f3[ 	]+ssload[ 	]+t0
+[ 	]+[0-9a-f]+:[ 	]+81c0c073[ 	]+sspopchk[ 	]+ra
+[ 	]+[0-9a-f]+:[ 	]+81c2c073[ 	]+sspopchk[ 	]+t0
+[ 	]+[0-9a-f]+:[ 	]+81dfc073[ 	]+sspinc[ 	]+31
+[ 	]+[0-9a-f]+:[ 	]+81d04ff3[ 	]+ssprr[ 	]+t6
+[ 	]+[0-9a-f]+:[ 	]+82104073[ 	]+sspush[ 	]+ra
+[ 	]+[0-9a-f]+:[ 	]+82504073[ 	]+sspush[ 	]+t0
+[ 	]+[0-9a-f]+:[ 	]+82c5c573[ 	]+ssamoswap[ 	]+a0,a2,\(a1\)
+[ 	]+[0-9a-f]+:[ 	]+6081[ 	]+sspush[ 	]+ra
+[ 	]+[0-9a-f]+:[ 	]+6281[ 	]+sspopchk[ 	]+t0
diff --git a/gas/testsuite/gas/riscv/zicfiss-mop.s b/gas/testsuite/gas/riscv/zicfiss-mop.s
@@ -0,0 +1,26 @@
+target:
+	# ssload   x1 == mop.r.0 x1, x0
+	# ssload   x5 == mop.r.0 x5, x0
+	# sspopchk x1 == mop.r.0 x0, x1
+	# sspopchk x5 == mop.r.0 x0, x5
+	mop.r.0		ra, zero
+	mop.r.0		t0, zero
+	mop.r.0		zero, ra
+	mop.r.0		zero, t0
+
+	# sspinc nzuimm == mop.r.1 x0, xreg[nzuimm]
+	# ssprr  rd     == mop.r.1 rd, x0 (rd != 0)
+	mop.r.1		zero, x31
+	mop.r.1		x31, zero
+
+	# sspush    x1            == mop.rr.0 x0, x0, x1
+	# sspush    x5            == mop.rr.0 x0, x0, x5
+	# ssamoswap rd, rt, 0(rs) == mop.rr.0 rd, rs, rt (rd != 0)
+	mop.rr.0	zero, zero, ra
+	mop.rr.0	zero, zero, t0
+	mop.rr.0	x10, x11, x12
+
+	# c.sspush   x1 == c.mop.0
+	# c.sspopchk x5 == c.mop.2
+	c.mop.0
+	c.mop.2
diff --git a/gas/testsuite/gas/riscv/zicfiss-na.d b/gas/testsuite/gas/riscv/zicfiss-na.d
@@ -0,0 +1,26 @@
+#as: -march=rv32i_zicfiss
+#source: zicfiss.s
+#objdump: -d -M no-aliases
+
+.*:[ 	]+file format .*
+
+Disassembly of section .text:
+
+0+000 <target>:
+[ 	]+[0-9a-f]+:[ 	]+6081[ 	]+c\.sspush[ 	]+ra
+[ 	]+[0-9a-f]+:[ 	]+6081[ 	]+c\.sspush[ 	]+ra
+[ 	]+[0-9a-f]+:[ 	]+6281[ 	]+c\.sspopchk[ 	]+t0
+[ 	]+[0-9a-f]+:[ 	]+6281[ 	]+c\.sspopchk[ 	]+t0
+[ 	]+[0-9a-f]+:[ 	]+81c040f3[ 	]+ssload[ 	]+ra
+[ 	]+[0-9a-f]+:[ 	]+81c042f3[ 	]+ssload[ 	]+t0
+[ 	]+[0-9a-f]+:[ 	]+81c0c073[ 	]+sspopchk[ 	]+ra
+[ 	]+[0-9a-f]+:[ 	]+6281[ 	]+c\.sspopchk[ 	]+t0
+[ 	]+[0-9a-f]+:[ 	]+81d0c073[ 	]+sspinc[ 	]+1
+[ 	]+[0-9a-f]+:[ 	]+81d14073[ 	]+sspinc[ 	]+2
+[ 	]+[0-9a-f]+:[ 	]+81dfc073[ 	]+sspinc[ 	]+31
+[ 	]+[0-9a-f]+:[ 	]+6081[ 	]+c\.sspush[ 	]+ra
+[ 	]+[0-9a-f]+:[ 	]+82504073[ 	]+sspush[ 	]+t0
+[ 	]+[0-9a-f]+:[ 	]+81d042f3[ 	]+ssprr[ 	]+t0
+[ 	]+[0-9a-f]+:[ 	]+81d04573[ 	]+ssprr[ 	]+a0
+[ 	]+[0-9a-f]+:[ 	]+820542f3[ 	]+ssamoswap[ 	]+t0,zero,\(a0\)
+[ 	]+[0-9a-f]+:[ 	]+82704373[ 	]+ssamoswap[ 	]+t1,t2,\(zero\)
diff --git a/gas/testsuite/gas/riscv/zicfiss.d b/gas/testsuite/gas/riscv/zicfiss.d
@@ -0,0 +1,25 @@
+#as: -march=rv32i_zicfiss
+#objdump: -d
+
+.*:[ 	]+file format .*
+
+Disassembly of section .text:
+
+0+000 <target>:
+[ 	]+[0-9a-f]+:[ 	]+6081[ 	]+sspush[ 	]+ra
+[ 	]+[0-9a-f]+:[ 	]+6081[ 	]+sspush[ 	]+ra
+[ 	]+[0-9a-f]+:[ 	]+6281[ 	]+sspopchk[ 	]+t0
+[ 	]+[0-9a-f]+:[ 	]+6281[ 	]+sspopchk[ 	]+t0
+[ 	]+[0-9a-f]+:[ 	]+81c040f3[ 	]+ssload[ 	]+ra
+[ 	]+[0-9a-f]+:[ 	]+81c042f3[ 	]+ssload[ 	]+t0
+[ 	]+[0-9a-f]+:[ 	]+81c0c073[ 	]+sspopchk[ 	]+ra
+[ 	]+[0-9a-f]+:[ 	]+6281[ 	]+sspopchk[ 	]+t0
+[ 	]+[0-9a-f]+:[ 	]+81d0c073[ 	]+sspinc[ 	]+1
+[ 	]+[0-9a-f]+:[ 	]+81d14073[ 	]+sspinc[ 	]+2
+[ 	]+[0-9a-f]+:[ 	]+81dfc073[ 	]+sspinc[ 	]+31
+[ 	]+[0-9a-f]+:[ 	]+6081[ 	]+sspush[ 	]+ra
+[ 	]+[0-9a-f]+:[ 	]+82504073[ 	]+sspush[ 	]+t0
+[ 	]+[0-9a-f]+:[ 	]+81d042f3[ 	]+ssprr[ 	]+t0
+[ 	]+[0-9a-f]+:[ 	]+81d04573[ 	]+ssprr[ 	]+a0
+[ 	]+[0-9a-f]+:[ 	]+820542f3[ 	]+ssamoswap[ 	]+t0,zero,\(a0\)
+[ 	]+[0-9a-f]+:[ 	]+82704373[ 	]+ssamoswap[ 	]+t1,t2,\(zero\)
diff --git a/gas/testsuite/gas/riscv/zicfiss.s b/gas/testsuite/gas/riscv/zicfiss.s
@@ -0,0 +1,21 @@
+target:
+	# Auto-compressed variants
+	sspush		ra
+	c.sspush	ra
+	sspopchk	t0
+	c.sspopchk	t0
+
+	# All uncompressed forms
+	ssload		ra
+	ssload		t0
+	sspopchk	ra
+	sspopchk	t0
+	sspinc		1
+	sspinc		2
+	sspinc		31
+	sspush		ra
+	sspush		t0
+	ssprr		t0
+	ssprr		a0
+	ssamoswap	t0, zero, (a0)
+	ssamoswap	t1, t2, 0(zero) # though unlikely
diff --git a/include/opcode/riscv-opc.h b/include/opcode/riscv-opc.h
@@ -2379,6 +2379,23 @@
 #define MASK_MOP_RR_6 0xfe00707f
 #define MATCH_MOP_RR_7 0xce004073
 #define MASK_MOP_RR_7 0xfe00707f
+/* Zicfiss instructions.  */
+#define MATCH_SSLOAD 0x81c04073
+#define MASK_SSLOAD 0xfffff07f
+#define MATCH_SSPOPCHK 0x81c04073
+#define MASK_SSPOPCHK 0xfff07fff
+#define MATCH_SSPINC 0x81d04073
+#define MASK_SSPINC 0xfff07fff
+#define MATCH_SSPUSH 0x82004073
+#define MASK_SSPUSH 0xfe0fffff
+#define MATCH_SSPRR 0x81d04073
+#define MASK_SSPRR 0xfffff07f
+#define MATCH_SSAMOSWAP 0x82004073
+#define MASK_SSAMOSWAP 0xfe00707f
+#define MATCH_C_SSPUSH 0x6081
+#define MASK_C_SSPUSH 0xffff
+#define MATCH_C_SSPOPCHK 0x6281
+#define MASK_C_SSPOPCHK 0xffff
 /* Zawrs intructions.  */
 #define MATCH_WRS_NTO 0x00d00073
 #define MASK_WRS_NTO 0xffffffff
@@ -3069,6 +3086,8 @@
 #define CSR_VL 0xc20
 #define CSR_VTYPE 0xc21
 #define CSR_VLENB 0xc22
+/* Zicfiss extension CSR addresses.  */
+#define CSR_SSP 0x800   /* TENTATIVELY use custom CSR address.  */
 #endif /* RISCV_ENCODING_H */
 #ifdef DECLARE_INSN
 DECLARE_INSN(slli_rv32, MATCH_SLLI_RV32, MASK_SLLI_RV32)
@@ -4086,6 +4105,8 @@ DECLARE_CSR(utval, CSR_UTVAL, CSR_CLASS_I, PRIV_SPEC_CLASS_1P10, PRIV_SPEC_CLASS
 DECLARE_CSR(uip, CSR_UIP, CSR_CLASS_I, PRIV_SPEC_CLASS_1P9P1, PRIV_SPEC_CLASS_1P12)
 DECLARE_CSR(sedeleg, CSR_SEDELEG, CSR_CLASS_I, PRIV_SPEC_CLASS_1P9P1, PRIV_SPEC_CLASS_1P12)
 DECLARE_CSR(sideleg, CSR_SIDELEG, CSR_CLASS_I, PRIV_SPEC_CLASS_1P9P1, PRIV_SPEC_CLASS_1P12)
+/* Zicfiss extension CSRs.  */
+DECLARE_CSR(ssp, CSR_SSP, CSR_CLASS_ZICFISS, PRIV_SPEC_CLASS_NONE, PRIV_SPEC_CLASS_NONE)
 /* Unprivileged Floating-Point CSRs.  */
 DECLARE_CSR(fflags, CSR_FFLAGS, CSR_CLASS_F, PRIV_SPEC_CLASS_NONE, PRIV_SPEC_CLASS_NONE)
 DECLARE_CSR(frm, CSR_FRM, CSR_CLASS_F, PRIV_SPEC_CLASS_NONE, PRIV_SPEC_CLASS_NONE)
diff --git a/include/opcode/riscv.h b/include/opcode/riscv.h
@@ -441,6 +441,7 @@ enum riscv_insn_class
   INSN_CLASS_ZICBOM,
   INSN_CLASS_ZICBOP,
   INSN_CLASS_ZICBOZ,
+  INSN_CLASS_ZICFISS,
   INSN_CLASS_H,
   INSN_CLASS_XTHEADBA,
   INSN_CLASS_XTHEADBB,
diff --git a/opcodes/riscv-opc.c b/opcodes/riscv-opc.c
