meson: target
[qemu.git] / target / arm / mte_helper.c
1 /*
2 * ARM v8.5-MemTag Operations
3 *
4 * Copyright (c) 2020 Linaro, Ltd.
5 *
6 * This library is free software; you can redistribute it and/or
7 * modify it under the terms of the GNU Lesser General Public
8 * License as published by the Free Software Foundation; either
9 * version 2.1 of the License, or (at your option) any later version.
10 *
11 * This library is distributed in the hope that it will be useful,
12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
14 * Lesser General Public License for more details.
15 *
16 * You should have received a copy of the GNU Lesser General Public
17 * License along with this library; if not, see <http://www.gnu.org/licenses/>.
18 */
19
20 #include "qemu/osdep.h"
21 #include "cpu.h"
22 #include "internals.h"
23 #include "exec/exec-all.h"
24 #include "exec/ram_addr.h"
25 #include "exec/cpu_ldst.h"
26 #include "exec/helper-proto.h"
27 #include "qapi/error.h"
28 #include "qemu/guest-random.h"
29
30
31 static int choose_nonexcluded_tag(int tag, int offset, uint16_t exclude)
32 {
33 if (exclude == 0xffff) {
34 return 0;
35 }
36 if (offset == 0) {
37 while (exclude & (1 << tag)) {
38 tag = (tag + 1) & 15;
39 }
40 } else {
41 do {
42 do {
43 tag = (tag + 1) & 15;
44 } while (exclude & (1 << tag));
45 } while (--offset > 0);
46 }
47 return tag;
48 }
49
50 /**
51 * allocation_tag_mem:
52 * @env: the cpu environment
53 * @ptr_mmu_idx: the addressing regime to use for the virtual address
54 * @ptr: the virtual address for which to look up tag memory
55 * @ptr_access: the access to use for the virtual address
56 * @ptr_size: the number of bytes in the normal memory access
57 * @tag_access: the access to use for the tag memory
58 * @tag_size: the number of bytes in the tag memory access
59 * @ra: the return address for exception handling
60 *
61 * Our tag memory is formatted as a sequence of little-endian nibbles.
62 * That is, the byte at (addr >> (LOG2_TAG_GRANULE + 1)) contains two
63 * tags, with the tag at [3:0] for the lower addr and the tag at [7:4]
64 * for the higher addr.
65 *
66 * Here, resolve the physical address from the virtual address, and return
67 * a pointer to the corresponding tag byte. Exit with exception if the
68 * virtual address is not accessible for @ptr_access.
69 *
70 * The @ptr_size and @tag_size values may not have an obvious relation
71 * due to the alignment of @ptr, and the number of tag checks required.
72 *
73 * If there is no tag storage corresponding to @ptr, return NULL.
74 */
75 static uint8_t *allocation_tag_mem(CPUARMState *env, int ptr_mmu_idx,
76 uint64_t ptr, MMUAccessType ptr_access,
77 int ptr_size, MMUAccessType tag_access,
78 int tag_size, uintptr_t ra)
79 {
80 #ifdef CONFIG_USER_ONLY
81 /* Tag storage not implemented. */
82 return NULL;
83 #else
84 uintptr_t index;
85 CPUIOTLBEntry *iotlbentry;
86 int in_page, flags;
87 ram_addr_t ptr_ra;
88 hwaddr ptr_paddr, tag_paddr, xlat;
89 MemoryRegion *mr;
90 ARMASIdx tag_asi;
91 AddressSpace *tag_as;
92 void *host;
93
94 /*
95 * Probe the first byte of the virtual address. This raises an
96 * exception for inaccessible pages, and resolves the virtual address
97 * into the softmmu tlb.
98 *
99 * When RA == 0, this is for mte_probe1. The page is expected to be
100 * valid. Indicate to probe_access_flags no-fault, then assert that
101 * we received a valid page.
102 */
103 flags = probe_access_flags(env, ptr, ptr_access, ptr_mmu_idx,
104 ra == 0, &host, ra);
105 assert(!(flags & TLB_INVALID_MASK));
106
107 /*
108 * Find the iotlbentry for ptr. This *must* be present in the TLB
109 * because we just found the mapping.
110 * TODO: Perhaps there should be a cputlb helper that returns a
111 * matching tlb entry + iotlb entry.
112 */
113 index = tlb_index(env, ptr_mmu_idx, ptr);
114 # ifdef CONFIG_DEBUG_TCG
115 {
116 CPUTLBEntry *entry = tlb_entry(env, ptr_mmu_idx, ptr);
117 target_ulong comparator = (ptr_access == MMU_DATA_LOAD
118 ? entry->addr_read
119 : tlb_addr_write(entry));
120 g_assert(tlb_hit(comparator, ptr));
121 }
122 # endif
123 iotlbentry = &env_tlb(env)->d[ptr_mmu_idx].iotlb[index];
124
125 /* If the virtual page MemAttr != Tagged, access unchecked. */
126 if (!arm_tlb_mte_tagged(&iotlbentry->attrs)) {
127 return NULL;
128 }
129
130 /*
131 * If not backed by host ram, there is no tag storage: access unchecked.
132 * This is probably a guest os bug though, so log it.
133 */
134 if (unlikely(flags & TLB_MMIO)) {
135 qemu_log_mask(LOG_GUEST_ERROR,
136 "Page @ 0x%" PRIx64 " indicates Tagged Normal memory "
137 "but is not backed by host ram\n", ptr);
138 return NULL;
139 }
140
141 /*
142 * The Normal memory access can extend to the next page. E.g. a single
143 * 8-byte access to the last byte of a page will check only the last
144 * tag on the first page.
145 * Any page access exception has priority over tag check exception.
146 */
147 in_page = -(ptr | TARGET_PAGE_MASK);
148 if (unlikely(ptr_size > in_page)) {
149 void *ignore;
150 flags |= probe_access_flags(env, ptr + in_page, ptr_access,
151 ptr_mmu_idx, ra == 0, &ignore, ra);
152 assert(!(flags & TLB_INVALID_MASK));
153 }
154
155 /* Any debug exception has priority over a tag check exception. */
156 if (unlikely(flags & TLB_WATCHPOINT)) {
157 int wp = ptr_access == MMU_DATA_LOAD ? BP_MEM_READ : BP_MEM_WRITE;
158 assert(ra != 0);
159 cpu_check_watchpoint(env_cpu(env), ptr, ptr_size,
160 iotlbentry->attrs, wp, ra);
161 }
162
163 /*
164 * Find the physical address within the normal mem space.
165 * The memory region lookup must succeed because TLB_MMIO was
166 * not set in the cputlb lookup above.
167 */
168 mr = memory_region_from_host(host, &ptr_ra);
169 tcg_debug_assert(mr != NULL);
170 tcg_debug_assert(memory_region_is_ram(mr));
171 ptr_paddr = ptr_ra;
172 do {
173 ptr_paddr += mr->addr;
174 mr = mr->container;
175 } while (mr);
176
177 /* Convert to the physical address in tag space. */
178 tag_paddr = ptr_paddr >> (LOG2_TAG_GRANULE + 1);
179
180 /* Look up the address in tag space. */
181 tag_asi = iotlbentry->attrs.secure ? ARMASIdx_TagS : ARMASIdx_TagNS;
182 tag_as = cpu_get_address_space(env_cpu(env), tag_asi);
183 mr = address_space_translate(tag_as, tag_paddr, &xlat, NULL,
184 tag_access == MMU_DATA_STORE,
185 iotlbentry->attrs);
186
187 /*
188 * Note that @mr will never be NULL. If there is nothing in the address
189 * space at @tag_paddr, the translation will return the unallocated memory
190 * region. For our purposes, the result must be ram.
191 */
192 if (unlikely(!memory_region_is_ram(mr))) {
193 /* ??? Failure is a board configuration error. */
194 qemu_log_mask(LOG_UNIMP,
195 "Tag Memory @ 0x%" HWADDR_PRIx " not found for "
196 "Normal Memory @ 0x%" HWADDR_PRIx "\n",
197 tag_paddr, ptr_paddr);
198 return NULL;
199 }
200
201 /*
202 * Ensure the tag memory is dirty on write, for migration.
203 * Tag memory can never contain code or display memory (vga).
204 */
205 if (tag_access == MMU_DATA_STORE) {
206 ram_addr_t tag_ra = memory_region_get_ram_addr(mr) + xlat;
207 cpu_physical_memory_set_dirty_flag(tag_ra, DIRTY_MEMORY_MIGRATION);
208 }
209
210 return memory_region_get_ram_ptr(mr) + xlat;
211 #endif
212 }
213
214 uint64_t HELPER(irg)(CPUARMState *env, uint64_t rn, uint64_t rm)
215 {
216 uint16_t exclude = extract32(rm | env->cp15.gcr_el1, 0, 16);
217 int rrnd = extract32(env->cp15.gcr_el1, 16, 1);
218 int start = extract32(env->cp15.rgsr_el1, 0, 4);
219 int seed = extract32(env->cp15.rgsr_el1, 8, 16);
220 int offset, i, rtag;
221
222 /*
223 * Our IMPDEF choice for GCR_EL1.RRND==1 is to continue to use the
224 * deterministic algorithm. Except that with RRND==1 the kernel is
225 * not required to have set RGSR_EL1.SEED != 0, which is required for
226 * the deterministic algorithm to function. So we force a non-zero
227 * SEED for that case.
228 */
229 if (unlikely(seed == 0) && rrnd) {
230 do {
231 Error *err = NULL;
232 uint16_t two;
233
234 if (qemu_guest_getrandom(&two, sizeof(two), &err) < 0) {
235 /*
236 * Failed, for unknown reasons in the crypto subsystem.
237 * Best we can do is log the reason and use a constant seed.
238 */
239 qemu_log_mask(LOG_UNIMP, "IRG: Crypto failure: %s\n",
240 error_get_pretty(err));
241 error_free(err);
242 two = 1;
243 }
244 seed = two;
245 } while (seed == 0);
246 }
247
248 /* RandomTag */
249 for (i = offset = 0; i < 4; ++i) {
250 /* NextRandomTagBit */
251 int top = (extract32(seed, 5, 1) ^ extract32(seed, 3, 1) ^
252 extract32(seed, 2, 1) ^ extract32(seed, 0, 1));
253 seed = (top << 15) | (seed >> 1);
254 offset |= top << i;
255 }
256 rtag = choose_nonexcluded_tag(start, offset, exclude);
257 env->cp15.rgsr_el1 = rtag | (seed << 8);
258
259 return address_with_allocation_tag(rn, rtag);
260 }
261
262 uint64_t HELPER(addsubg)(CPUARMState *env, uint64_t ptr,
263 int32_t offset, uint32_t tag_offset)
264 {
265 int start_tag = allocation_tag_from_addr(ptr);
266 uint16_t exclude = extract32(env->cp15.gcr_el1, 0, 16);
267 int rtag = choose_nonexcluded_tag(start_tag, tag_offset, exclude);
268
269 return address_with_allocation_tag(ptr + offset, rtag);
270 }
271
272 static int load_tag1(uint64_t ptr, uint8_t *mem)
273 {
274 int ofs = extract32(ptr, LOG2_TAG_GRANULE, 1) * 4;
275 return extract32(*mem, ofs, 4);
276 }
277
278 uint64_t HELPER(ldg)(CPUARMState *env, uint64_t ptr, uint64_t xt)
279 {
280 int mmu_idx = cpu_mmu_index(env, false);
281 uint8_t *mem;
282 int rtag = 0;
283
284 /* Trap if accessing an invalid page. */
285 mem = allocation_tag_mem(env, mmu_idx, ptr, MMU_DATA_LOAD, 1,
286 MMU_DATA_LOAD, 1, GETPC());
287
288 /* Load if page supports tags. */
289 if (mem) {
290 rtag = load_tag1(ptr, mem);
291 }
292
293 return address_with_allocation_tag(xt, rtag);
294 }
295
296 static void check_tag_aligned(CPUARMState *env, uint64_t ptr, uintptr_t ra)
297 {
298 if (unlikely(!QEMU_IS_ALIGNED(ptr, TAG_GRANULE))) {
299 arm_cpu_do_unaligned_access(env_cpu(env), ptr, MMU_DATA_STORE,
300 cpu_mmu_index(env, false), ra);
301 g_assert_not_reached();
302 }
303 }
304
305 /* For use in a non-parallel context, store to the given nibble. */
306 static void store_tag1(uint64_t ptr, uint8_t *mem, int tag)
307 {
308 int ofs = extract32(ptr, LOG2_TAG_GRANULE, 1) * 4;
309 *mem = deposit32(*mem, ofs, 4, tag);
310 }
311
312 /* For use in a parallel context, atomically store to the given nibble. */
313 static void store_tag1_parallel(uint64_t ptr, uint8_t *mem, int tag)
314 {
315 int ofs = extract32(ptr, LOG2_TAG_GRANULE, 1) * 4;
316 uint8_t old = atomic_read(mem);
317
318 while (1) {
319 uint8_t new = deposit32(old, ofs, 4, tag);
320 uint8_t cmp = atomic_cmpxchg(mem, old, new);
321 if (likely(cmp == old)) {
322 return;
323 }
324 old = cmp;
325 }
326 }
327
328 typedef void stg_store1(uint64_t, uint8_t *, int);
329
330 static inline void do_stg(CPUARMState *env, uint64_t ptr, uint64_t xt,
331 uintptr_t ra, stg_store1 store1)
332 {
333 int mmu_idx = cpu_mmu_index(env, false);
334 uint8_t *mem;
335
336 check_tag_aligned(env, ptr, ra);
337
338 /* Trap if accessing an invalid page. */
339 mem = allocation_tag_mem(env, mmu_idx, ptr, MMU_DATA_STORE, TAG_GRANULE,
340 MMU_DATA_STORE, 1, ra);
341
342 /* Store if page supports tags. */
343 if (mem) {
344 store1(ptr, mem, allocation_tag_from_addr(xt));
345 }
346 }
347
348 void HELPER(stg)(CPUARMState *env, uint64_t ptr, uint64_t xt)
349 {
350 do_stg(env, ptr, xt, GETPC(), store_tag1);
351 }
352
353 void HELPER(stg_parallel)(CPUARMState *env, uint64_t ptr, uint64_t xt)
354 {
355 do_stg(env, ptr, xt, GETPC(), store_tag1_parallel);
356 }
357
358 void HELPER(stg_stub)(CPUARMState *env, uint64_t ptr)
359 {
360 int mmu_idx = cpu_mmu_index(env, false);
361 uintptr_t ra = GETPC();
362
363 check_tag_aligned(env, ptr, ra);
364 probe_write(env, ptr, TAG_GRANULE, mmu_idx, ra);
365 }
366
367 static inline void do_st2g(CPUARMState *env, uint64_t ptr, uint64_t xt,
368 uintptr_t ra, stg_store1 store1)
369 {
370 int mmu_idx = cpu_mmu_index(env, false);
371 int tag = allocation_tag_from_addr(xt);
372 uint8_t *mem1, *mem2;
373
374 check_tag_aligned(env, ptr, ra);
375
376 /*
377 * Trap if accessing an invalid page(s).
378 * This takes priority over !allocation_tag_access_enabled.
379 */
380 if (ptr & TAG_GRANULE) {
381 /* Two stores unaligned mod TAG_GRANULE*2 -- modify two bytes. */
382 mem1 = allocation_tag_mem(env, mmu_idx, ptr, MMU_DATA_STORE,
383 TAG_GRANULE, MMU_DATA_STORE, 1, ra);
384 mem2 = allocation_tag_mem(env, mmu_idx, ptr + TAG_GRANULE,
385 MMU_DATA_STORE, TAG_GRANULE,
386 MMU_DATA_STORE, 1, ra);
387
388 /* Store if page(s) support tags. */
389 if (mem1) {
390 store1(TAG_GRANULE, mem1, tag);
391 }
392 if (mem2) {
393 store1(0, mem2, tag);
394 }
395 } else {
396 /* Two stores aligned mod TAG_GRANULE*2 -- modify one byte. */
397 mem1 = allocation_tag_mem(env, mmu_idx, ptr, MMU_DATA_STORE,
398 2 * TAG_GRANULE, MMU_DATA_STORE, 1, ra);
399 if (mem1) {
400 tag |= tag << 4;
401 atomic_set(mem1, tag);
402 }
403 }
404 }
405
406 void HELPER(st2g)(CPUARMState *env, uint64_t ptr, uint64_t xt)
407 {
408 do_st2g(env, ptr, xt, GETPC(), store_tag1);
409 }
410
411 void HELPER(st2g_parallel)(CPUARMState *env, uint64_t ptr, uint64_t xt)
412 {
413 do_st2g(env, ptr, xt, GETPC(), store_tag1_parallel);
414 }
415
416 void HELPER(st2g_stub)(CPUARMState *env, uint64_t ptr)
417 {
418 int mmu_idx = cpu_mmu_index(env, false);
419 uintptr_t ra = GETPC();
420 int in_page = -(ptr | TARGET_PAGE_MASK);
421
422 check_tag_aligned(env, ptr, ra);
423
424 if (likely(in_page >= 2 * TAG_GRANULE)) {
425 probe_write(env, ptr, 2 * TAG_GRANULE, mmu_idx, ra);
426 } else {
427 probe_write(env, ptr, TAG_GRANULE, mmu_idx, ra);
428 probe_write(env, ptr + TAG_GRANULE, TAG_GRANULE, mmu_idx, ra);
429 }
430 }
431
432 #define LDGM_STGM_SIZE (4 << GMID_EL1_BS)
433
434 uint64_t HELPER(ldgm)(CPUARMState *env, uint64_t ptr)
435 {
436 int mmu_idx = cpu_mmu_index(env, false);
437 uintptr_t ra = GETPC();
438 void *tag_mem;
439
440 ptr = QEMU_ALIGN_DOWN(ptr, LDGM_STGM_SIZE);
441
442 /* Trap if accessing an invalid page. */
443 tag_mem = allocation_tag_mem(env, mmu_idx, ptr, MMU_DATA_LOAD,
444 LDGM_STGM_SIZE, MMU_DATA_LOAD,
445 LDGM_STGM_SIZE / (2 * TAG_GRANULE), ra);
446
447 /* The tag is squashed to zero if the page does not support tags. */
448 if (!tag_mem) {
449 return 0;
450 }
451
452 QEMU_BUILD_BUG_ON(GMID_EL1_BS != 6);
453 /*
454 * We are loading 64-bits worth of tags. The ordering of elements
455 * within the word corresponds to a 64-bit little-endian operation.
456 */
457 return ldq_le_p(tag_mem);
458 }
459
460 void HELPER(stgm)(CPUARMState *env, uint64_t ptr, uint64_t val)
461 {
462 int mmu_idx = cpu_mmu_index(env, false);
463 uintptr_t ra = GETPC();
464 void *tag_mem;
465
466 ptr = QEMU_ALIGN_DOWN(ptr, LDGM_STGM_SIZE);
467
468 /* Trap if accessing an invalid page. */
469 tag_mem = allocation_tag_mem(env, mmu_idx, ptr, MMU_DATA_STORE,
470 LDGM_STGM_SIZE, MMU_DATA_LOAD,
471 LDGM_STGM_SIZE / (2 * TAG_GRANULE), ra);
472
473 /*
474 * Tag store only happens if the page support tags,
475 * and if the OS has enabled access to the tags.
476 */
477 if (!tag_mem) {
478 return;
479 }
480
481 QEMU_BUILD_BUG_ON(GMID_EL1_BS != 6);
482 /*
483 * We are storing 64-bits worth of tags. The ordering of elements
484 * within the word corresponds to a 64-bit little-endian operation.
485 */
486 stq_le_p(tag_mem, val);
487 }
488
489 void HELPER(stzgm_tags)(CPUARMState *env, uint64_t ptr, uint64_t val)
490 {
491 uintptr_t ra = GETPC();
492 int mmu_idx = cpu_mmu_index(env, false);
493 int log2_dcz_bytes, log2_tag_bytes;
494 intptr_t dcz_bytes, tag_bytes;
495 uint8_t *mem;
496
497 /*
498 * In arm_cpu_realizefn, we assert that dcz > LOG2_TAG_GRANULE+1,
499 * i.e. 32 bytes, which is an unreasonably small dcz anyway,
500 * to make sure that we can access one complete tag byte here.
501 */
502 log2_dcz_bytes = env_archcpu(env)->dcz_blocksize + 2;
503 log2_tag_bytes = log2_dcz_bytes - (LOG2_TAG_GRANULE + 1);
504 dcz_bytes = (intptr_t)1 << log2_dcz_bytes;
505 tag_bytes = (intptr_t)1 << log2_tag_bytes;
506 ptr &= -dcz_bytes;
507
508 mem = allocation_tag_mem(env, mmu_idx, ptr, MMU_DATA_STORE, dcz_bytes,
509 MMU_DATA_STORE, tag_bytes, ra);
510 if (mem) {
511 int tag_pair = (val & 0xf) * 0x11;
512 memset(mem, tag_pair, tag_bytes);
513 }
514 }
515
516 /* Record a tag check failure. */
517 static void mte_check_fail(CPUARMState *env, int mmu_idx,
518 uint64_t dirty_ptr, uintptr_t ra)
519 {
520 ARMMMUIdx arm_mmu_idx = core_to_aa64_mmu_idx(mmu_idx);
521 int el, reg_el, tcf, select;
522 uint64_t sctlr;
523
524 reg_el = regime_el(env, arm_mmu_idx);
525 sctlr = env->cp15.sctlr_el[reg_el];
526
527 switch (arm_mmu_idx) {
528 case ARMMMUIdx_E10_0:
529 case ARMMMUIdx_E20_0:
530 el = 0;
531 tcf = extract64(sctlr, 38, 2);
532 break;
533 default:
534 el = reg_el;
535 tcf = extract64(sctlr, 40, 2);
536 }
537
538 switch (tcf) {
539 case 1:
540 /*
541 * Tag check fail causes a synchronous exception.
542 *
543 * In restore_state_to_opc, we set the exception syndrome
544 * for the load or store operation. Unwind first so we
545 * may overwrite that with the syndrome for the tag check.
546 */
547 cpu_restore_state(env_cpu(env), ra, true);
548 env->exception.vaddress = dirty_ptr;
549 raise_exception(env, EXCP_DATA_ABORT,
550 syn_data_abort_no_iss(el != 0, 0, 0, 0, 0, 0, 0x11),
551 exception_target_el(env));
552 /* noreturn, but fall through to the assert anyway */
553
554 case 0:
555 /*
556 * Tag check fail does not affect the PE.
557 * We eliminate this case by not setting MTE_ACTIVE
558 * in tb_flags, so that we never make this runtime call.
559 */
560 g_assert_not_reached();
561
562 case 2:
563 /* Tag check fail causes asynchronous flag set. */
564 mmu_idx = arm_mmu_idx_el(env, el);
565 if (regime_has_2_ranges(mmu_idx)) {
566 select = extract64(dirty_ptr, 55, 1);
567 } else {
568 select = 0;
569 }
570 env->cp15.tfsr_el[el] |= 1 << select;
571 break;
572
573 default:
574 /* Case 3: Reserved. */
575 qemu_log_mask(LOG_GUEST_ERROR,
576 "Tag check failure with SCTLR_EL%d.TCF%s "
577 "set to reserved value %d\n",
578 reg_el, el ? "" : "0", tcf);
579 break;
580 }
581 }
582
583 /*
584 * Perform an MTE checked access for a single logical or atomic access.
585 */
586 static bool mte_probe1_int(CPUARMState *env, uint32_t desc, uint64_t ptr,
587 uintptr_t ra, int bit55)
588 {
589 int mem_tag, mmu_idx, ptr_tag, size;
590 MMUAccessType type;
591 uint8_t *mem;
592
593 ptr_tag = allocation_tag_from_addr(ptr);
594
595 if (tcma_check(desc, bit55, ptr_tag)) {
596 return true;
597 }
598
599 mmu_idx = FIELD_EX32(desc, MTEDESC, MIDX);
600 type = FIELD_EX32(desc, MTEDESC, WRITE) ? MMU_DATA_STORE : MMU_DATA_LOAD;
601 size = FIELD_EX32(desc, MTEDESC, ESIZE);
602
603 mem = allocation_tag_mem(env, mmu_idx, ptr, type, size,
604 MMU_DATA_LOAD, 1, ra);
605 if (!mem) {
606 return true;
607 }
608
609 mem_tag = load_tag1(ptr, mem);
610 return ptr_tag == mem_tag;
611 }
612
613 /*
614 * No-fault version of mte_check1, to be used by SVE for MemSingleNF.
615 * Returns false if the access is Checked and the check failed. This
616 * is only intended to probe the tag -- the validity of the page must
617 * be checked beforehand.
618 */
619 bool mte_probe1(CPUARMState *env, uint32_t desc, uint64_t ptr)
620 {
621 int bit55 = extract64(ptr, 55, 1);
622
623 /* If TBI is disabled, the access is unchecked. */
624 if (unlikely(!tbi_check(desc, bit55))) {
625 return true;
626 }
627
628 return mte_probe1_int(env, desc, ptr, 0, bit55);
629 }
630
631 uint64_t mte_check1(CPUARMState *env, uint32_t desc,
632 uint64_t ptr, uintptr_t ra)
633 {
634 int bit55 = extract64(ptr, 55, 1);
635
636 /* If TBI is disabled, the access is unchecked, and ptr is not dirty. */
637 if (unlikely(!tbi_check(desc, bit55))) {
638 return ptr;
639 }
640
641 if (unlikely(!mte_probe1_int(env, desc, ptr, ra, bit55))) {
642 int mmu_idx = FIELD_EX32(desc, MTEDESC, MIDX);
643 mte_check_fail(env, mmu_idx, ptr, ra);
644 }
645
646 return useronly_clean_ptr(ptr);
647 }
648
649 uint64_t HELPER(mte_check1)(CPUARMState *env, uint32_t desc, uint64_t ptr)
650 {
651 return mte_check1(env, desc, ptr, GETPC());
652 }
653
654 /*
655 * Perform an MTE checked access for multiple logical accesses.
656 */
657
658 /**
659 * checkN:
660 * @tag: tag memory to test
661 * @odd: true to begin testing at tags at odd nibble
662 * @cmp: the tag to compare against
663 * @count: number of tags to test
664 *
665 * Return the number of successful tests.
666 * Thus a return value < @count indicates a failure.
667 *
668 * A note about sizes: count is expected to be small.
669 *
670 * The most common use will be LDP/STP of two integer registers,
671 * which means 16 bytes of memory touching at most 2 tags, but
672 * often the access is aligned and thus just 1 tag.
673 *
674 * Using AdvSIMD LD/ST (multiple), one can access 64 bytes of memory,
675 * touching at most 5 tags. SVE LDR/STR (vector) with the default
676 * vector length is also 64 bytes; the maximum architectural length
677 * is 256 bytes touching at most 9 tags.
678 *
679 * The loop below uses 7 logical operations and 1 memory operation
680 * per tag pair. An implementation that loads an aligned word and
681 * uses masking to ignore adjacent tags requires 18 logical operations
682 * and thus does not begin to pay off until 6 tags.
683 * Which, according to the survey above, is unlikely to be common.
684 */
685 static int checkN(uint8_t *mem, int odd, int cmp, int count)
686 {
687 int n = 0, diff;
688
689 /* Replicate the test tag and compare. */
690 cmp *= 0x11;
691 diff = *mem++ ^ cmp;
692
693 if (odd) {
694 goto start_odd;
695 }
696
697 while (1) {
698 /* Test even tag. */
699 if (unlikely((diff) & 0x0f)) {
700 break;
701 }
702 if (++n == count) {
703 break;
704 }
705
706 start_odd:
707 /* Test odd tag. */
708 if (unlikely((diff) & 0xf0)) {
709 break;
710 }
711 if (++n == count) {
712 break;
713 }
714
715 diff = *mem++ ^ cmp;
716 }
717 return n;
718 }
719
720 uint64_t mte_checkN(CPUARMState *env, uint32_t desc,
721 uint64_t ptr, uintptr_t ra)
722 {
723 int mmu_idx, ptr_tag, bit55;
724 uint64_t ptr_last, ptr_end, prev_page, next_page;
725 uint64_t tag_first, tag_end;
726 uint64_t tag_byte_first, tag_byte_end;
727 uint32_t esize, total, tag_count, tag_size, n, c;
728 uint8_t *mem1, *mem2;
729 MMUAccessType type;
730
731 bit55 = extract64(ptr, 55, 1);
732
733 /* If TBI is disabled, the access is unchecked, and ptr is not dirty. */
734 if (unlikely(!tbi_check(desc, bit55))) {
735 return ptr;
736 }
737
738 ptr_tag = allocation_tag_from_addr(ptr);
739
740 if (tcma_check(desc, bit55, ptr_tag)) {
741 goto done;
742 }
743
744 mmu_idx = FIELD_EX32(desc, MTEDESC, MIDX);
745 type = FIELD_EX32(desc, MTEDESC, WRITE) ? MMU_DATA_STORE : MMU_DATA_LOAD;
746 esize = FIELD_EX32(desc, MTEDESC, ESIZE);
747 total = FIELD_EX32(desc, MTEDESC, TSIZE);
748
749 /* Find the addr of the end of the access, and of the last element. */
750 ptr_end = ptr + total;
751 ptr_last = ptr_end - esize;
752
753 /* Round the bounds to the tag granule, and compute the number of tags. */
754 tag_first = QEMU_ALIGN_DOWN(ptr, TAG_GRANULE);
755 tag_end = QEMU_ALIGN_UP(ptr_last, TAG_GRANULE);
756 tag_count = (tag_end - tag_first) / TAG_GRANULE;
757
758 /* Round the bounds to twice the tag granule, and compute the bytes. */
759 tag_byte_first = QEMU_ALIGN_DOWN(ptr, 2 * TAG_GRANULE);
760 tag_byte_end = QEMU_ALIGN_UP(ptr_last, 2 * TAG_GRANULE);
761
762 /* Locate the page boundaries. */
763 prev_page = ptr & TARGET_PAGE_MASK;
764 next_page = prev_page + TARGET_PAGE_SIZE;
765
766 if (likely(tag_end - prev_page <= TARGET_PAGE_SIZE)) {
767 /* Memory access stays on one page. */
768 tag_size = (tag_byte_end - tag_byte_first) / (2 * TAG_GRANULE);
769 mem1 = allocation_tag_mem(env, mmu_idx, ptr, type, total,
770 MMU_DATA_LOAD, tag_size, ra);
771 if (!mem1) {
772 goto done;
773 }
774 /* Perform all of the comparisons. */
775 n = checkN(mem1, ptr & TAG_GRANULE, ptr_tag, tag_count);
776 } else {
777 /* Memory access crosses to next page. */
778 tag_size = (next_page - tag_byte_first) / (2 * TAG_GRANULE);
779 mem1 = allocation_tag_mem(env, mmu_idx, ptr, type, next_page - ptr,
780 MMU_DATA_LOAD, tag_size, ra);
781
782 tag_size = (tag_byte_end - next_page) / (2 * TAG_GRANULE);
783 mem2 = allocation_tag_mem(env, mmu_idx, next_page, type,
784 ptr_end - next_page,
785 MMU_DATA_LOAD, tag_size, ra);
786
787 /*
788 * Perform all of the comparisons.
789 * Note the possible but unlikely case of the operation spanning
790 * two pages that do not both have tagging enabled.
791 */
792 n = c = (next_page - tag_first) / TAG_GRANULE;
793 if (mem1) {
794 n = checkN(mem1, ptr & TAG_GRANULE, ptr_tag, c);
795 }
796 if (n == c) {
797 if (!mem2) {
798 goto done;
799 }
800 n += checkN(mem2, 0, ptr_tag, tag_count - c);
801 }
802 }
803
804 /*
805 * If we failed, we know which granule. Compute the element that
806 * is first in that granule, and signal failure on that element.
807 */
808 if (unlikely(n < tag_count)) {
809 uint64_t fail_ofs;
810
811 fail_ofs = tag_first + n * TAG_GRANULE - ptr;
812 fail_ofs = ROUND_UP(fail_ofs, esize);
813 mte_check_fail(env, mmu_idx, ptr + fail_ofs, ra);
814 }
815
816 done:
817 return useronly_clean_ptr(ptr);
818 }
819
820 uint64_t HELPER(mte_checkN)(CPUARMState *env, uint32_t desc, uint64_t ptr)
821 {
822 return mte_checkN(env, desc, ptr, GETPC());
823 }
824
825 /*
826 * Perform an MTE checked access for DC_ZVA.
827 */
828 uint64_t HELPER(mte_check_zva)(CPUARMState *env, uint32_t desc, uint64_t ptr)
829 {
830 uintptr_t ra = GETPC();
831 int log2_dcz_bytes, log2_tag_bytes;
832 int mmu_idx, bit55;
833 intptr_t dcz_bytes, tag_bytes, i;
834 void *mem;
835 uint64_t ptr_tag, mem_tag, align_ptr;
836
837 bit55 = extract64(ptr, 55, 1);
838
839 /* If TBI is disabled, the access is unchecked, and ptr is not dirty. */
840 if (unlikely(!tbi_check(desc, bit55))) {
841 return ptr;
842 }
843
844 ptr_tag = allocation_tag_from_addr(ptr);
845
846 if (tcma_check(desc, bit55, ptr_tag)) {
847 goto done;
848 }
849
850 /*
851 * In arm_cpu_realizefn, we asserted that dcz > LOG2_TAG_GRANULE+1,
852 * i.e. 32 bytes, which is an unreasonably small dcz anyway, to make
853 * sure that we can access one complete tag byte here.
854 */
855 log2_dcz_bytes = env_archcpu(env)->dcz_blocksize + 2;
856 log2_tag_bytes = log2_dcz_bytes - (LOG2_TAG_GRANULE + 1);
857 dcz_bytes = (intptr_t)1 << log2_dcz_bytes;
858 tag_bytes = (intptr_t)1 << log2_tag_bytes;
859 align_ptr = ptr & -dcz_bytes;
860
861 /*
862 * Trap if accessing an invalid page. DC_ZVA requires that we supply
863 * the original pointer for an invalid page. But watchpoints require
864 * that we probe the actual space. So do both.
865 */
866 mmu_idx = FIELD_EX32(desc, MTEDESC, MIDX);
867 (void) probe_write(env, ptr, 1, mmu_idx, ra);
868 mem = allocation_tag_mem(env, mmu_idx, align_ptr, MMU_DATA_STORE,
869 dcz_bytes, MMU_DATA_LOAD, tag_bytes, ra);
870 if (!mem) {
871 goto done;
872 }
873
874 /*
875 * Unlike the reasoning for checkN, DC_ZVA is always aligned, and thus
876 * it is quite easy to perform all of the comparisons at once without
877 * any extra masking.
878 *
879 * The most common zva block size is 64; some of the thunderx cpus use
880 * a block size of 128. For user-only, aarch64_max_initfn will set the
881 * block size to 512. Fill out the other cases for future-proofing.
882 *
883 * In order to be able to find the first miscompare later, we want the
884 * tag bytes to be in little-endian order.
885 */
886 switch (log2_tag_bytes) {
887 case 0: /* zva_blocksize 32 */
888 mem_tag = *(uint8_t *)mem;
889 ptr_tag *= 0x11u;
890 break;
891 case 1: /* zva_blocksize 64 */
892 mem_tag = cpu_to_le16(*(uint16_t *)mem);
893 ptr_tag *= 0x1111u;
894 break;
895 case 2: /* zva_blocksize 128 */
896 mem_tag = cpu_to_le32(*(uint32_t *)mem);
897 ptr_tag *= 0x11111111u;
898 break;
899 case 3: /* zva_blocksize 256 */
900 mem_tag = cpu_to_le64(*(uint64_t *)mem);
901 ptr_tag *= 0x1111111111111111ull;
902 break;
903
904 default: /* zva_blocksize 512, 1024, 2048 */
905 ptr_tag *= 0x1111111111111111ull;
906 i = 0;
907 do {
908 mem_tag = cpu_to_le64(*(uint64_t *)(mem + i));
909 if (unlikely(mem_tag != ptr_tag)) {
910 goto fail;
911 }
912 i += 8;
913 align_ptr += 16 * TAG_GRANULE;
914 } while (i < tag_bytes);
915 goto done;
916 }
917
918 if (likely(mem_tag == ptr_tag)) {
919 goto done;
920 }
921
922 fail:
923 /* Locate the first nibble that differs. */
924 i = ctz64(mem_tag ^ ptr_tag) >> 4;
925 mte_check_fail(env, mmu_idx, align_ptr + i * TAG_GRANULE, ra);
926
927 done:
928 return useronly_clean_ptr(ptr);
929 }