[v5,06/22] target/arm: Implement the IRG instruction

Message ID 20191011134744.2477-7-richard.henderson@linaro.org
State New
Headers show
Series
  • [v5,01/22] target/arm: Add MTE_ACTIVE to tb_flags
Related show

Commit Message

Richard Henderson Oct. 11, 2019, 1:47 p.m.
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>

---
v2: Update to 00eac5.
    Merge choose_random_nonexcluded_tag into helper_irg since
    that pseudo function no longer exists separately.
---
 target/arm/helper-a64.h    |  1 +
 target/arm/mte_helper.c    | 57 ++++++++++++++++++++++++++++++++++++++
 target/arm/translate-a64.c |  7 +++++
 3 files changed, 65 insertions(+)

-- 
2.17.1

Comments

Peter Maydell Dec. 3, 2019, 2:26 p.m. | #1
On Fri, 11 Oct 2019 at 14:49, Richard Henderson
<richard.henderson@linaro.org> wrote:
>

> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>

> ---

> v2: Update to 00eac5.

>     Merge choose_random_nonexcluded_tag into helper_irg since

>     that pseudo function no longer exists separately.

> ---

>  target/arm/helper-a64.h    |  1 +

>  target/arm/mte_helper.c    | 57 ++++++++++++++++++++++++++++++++++++++

>  target/arm/translate-a64.c |  7 +++++

>  3 files changed, 65 insertions(+)

>

> diff --git a/target/arm/helper-a64.h b/target/arm/helper-a64.h

> index a82e21f15a..6ff7f5b756 100644

> --- a/target/arm/helper-a64.h

> +++ b/target/arm/helper-a64.h

> @@ -106,3 +106,4 @@ DEF_HELPER_FLAGS_2(xpacd, TCG_CALL_NO_RWG_SE, i64, env, i64)

>  DEF_HELPER_FLAGS_2(mte_check1, TCG_CALL_NO_WG, i64, env, i64)

>  DEF_HELPER_FLAGS_2(mte_check2, TCG_CALL_NO_WG, i64, env, i64)

>  DEF_HELPER_FLAGS_3(mte_check3, TCG_CALL_NO_WG, i64, env, i64, i32)

> +DEF_HELPER_FLAGS_3(irg, TCG_CALL_NO_RWG, i64, env, i64, i64)

> diff --git a/target/arm/mte_helper.c b/target/arm/mte_helper.c

> index bbb90cbe86..9848849a91 100644

> --- a/target/arm/mte_helper.c

> +++ b/target/arm/mte_helper.c

> @@ -37,6 +37,31 @@ static int allocation_tag_from_addr(uint64_t ptr)

>      return extract64(ptr, 56, 4);

>  }

>

> +static int choose_nonexcluded_tag(int tag, int offset, uint16_t exclude)

> +{

> +    if (exclude == 0xffff) {

> +        return 0;

> +    }

> +    if (offset == 0) {

> +        while (exclude & (1 << tag)) {

> +            tag = (tag + 1) & 15;

> +        }

> +    } else {

> +        do {

> +            do {

> +                tag = (tag + 1) & 15;

> +            } while (exclude & (1 << tag));

> +        } while (--offset > 0);

> +    }


I feel like this would be easier to review if it matched
the logic the pseudocode uses, though I think the end result
comes out the same.

> +    return tag;

> +}

> +

> +static uint64_t address_with_allocation_tag(uint64_t ptr, int rtag)

> +{

> +    rtag -= extract64(ptr, 55, 1);

> +    return deposit64(ptr, 56, 4, rtag);


This doesn't match AArch64.AddressWithAllocationTag -- the
fiddling with bit 55 is unwanted.

> +}

> +

>  /*

>   * Perform a checked access for MTE.

>   * On arrival, TBI is known to enabled, as is allocation_tag_access_enabled.

> @@ -165,3 +190,35 @@ uint64_t HELPER(mte_check3)(CPUARMState *env, uint64_t dirty_ptr, uint32_t tbi)

>          return dirty_ptr;

>      }

>  }

> +

> +uint64_t HELPER(irg)(CPUARMState *env, uint64_t rn, uint64_t rm)

> +{

> +    int el = arm_current_el(env);

> +    uint64_t sctlr = arm_sctlr(env, el);

> +    int rtag = 0;

> +

> +    if (allocation_tag_access_enabled(env, el, sctlr)) {

> +        /*

> +         * Our IMPDEF choice for GCR_EL1.RRND==1 is to behave as if

> +         * GCR_EL1.RRND==0, always producing deterministic results.

> +         */

> +        uint16_t exclude = extract32(rm | env->cp15.gcr_el1, 0, 16);

> +        int start = extract32(env->cp15.rgsr_el1, 0, 4);

> +        int seed = extract32(env->cp15.rgsr_el1, 8, 16);

> +        int offset, i;

> +

> +        /* RandomTag */

> +        for (i = offset = 0; i < 4; ++i) {

> +            /* NextRandomTagBit */

> +            int top = (extract32(seed, 5, 1) ^ extract32(seed, 3, 1) ^

> +                       extract32(seed, 2, 1) ^ extract32(seed, 0, 1));

> +            seed = (top << 15) | (seed >> 1);

> +            offset |= top << i;

> +        }

> +        rtag = choose_nonexcluded_tag(start, offset, exclude);

> +

> +        env->cp15.rgsr_el1 = rtag | (seed << 8);

> +    }

> +

> +    return address_with_allocation_tag(rn, rtag);

> +}

> diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c

> index 18d45fba87..83d253d67f 100644

> --- a/target/arm/translate-a64.c

> +++ b/target/arm/translate-a64.c

> @@ -5156,6 +5156,13 @@ static void disas_data_proc_2src(DisasContext *s, uint32_t insn)

>      case 3: /* SDIV */

>          handle_div(s, true, sf, rm, rn, rd);

>          break;

> +    case 4: /* IRG */

> +        if (sf == 0 || !dc_isar_feature(aa64_mte_insn_reg, s)) {

> +            goto do_unallocated;

> +        }

> +        gen_helper_irg(cpu_reg_sp(s, rd), cpu_env,

> +                       cpu_reg_sp(s, rn), cpu_reg(s, rm));


In the case of "we only have mte_insn_reg, not full MTE",
the allocation tag we insert into the address must always
be zero, so you could just special case this and emit code
inline to clear bits [59:56]. The code as it stands works
because we ensure that the guest can't set the SCTLR.*ATA*
bits. (That's a bit inconsistent with our approach to the
PSTATE.TCO bit, which we do allow a guest to toggle, but
the inconsistency is permitted by the architecture.) I'm
not sure whether "we only have the EL0 visible bits" is
going to be a common enough config to care about to
special-case.

thanks
-- PMM

Patch

diff --git a/target/arm/helper-a64.h b/target/arm/helper-a64.h
index a82e21f15a..6ff7f5b756 100644
--- a/target/arm/helper-a64.h
+++ b/target/arm/helper-a64.h
@@ -106,3 +106,4 @@  DEF_HELPER_FLAGS_2(xpacd, TCG_CALL_NO_RWG_SE, i64, env, i64)
 DEF_HELPER_FLAGS_2(mte_check1, TCG_CALL_NO_WG, i64, env, i64)
 DEF_HELPER_FLAGS_2(mte_check2, TCG_CALL_NO_WG, i64, env, i64)
 DEF_HELPER_FLAGS_3(mte_check3, TCG_CALL_NO_WG, i64, env, i64, i32)
+DEF_HELPER_FLAGS_3(irg, TCG_CALL_NO_RWG, i64, env, i64, i64)
diff --git a/target/arm/mte_helper.c b/target/arm/mte_helper.c
index bbb90cbe86..9848849a91 100644
--- a/target/arm/mte_helper.c
+++ b/target/arm/mte_helper.c
@@ -37,6 +37,31 @@  static int allocation_tag_from_addr(uint64_t ptr)
     return extract64(ptr, 56, 4);
 }
 
+static int choose_nonexcluded_tag(int tag, int offset, uint16_t exclude)
+{
+    if (exclude == 0xffff) {
+        return 0;
+    }
+    if (offset == 0) {
+        while (exclude & (1 << tag)) {
+            tag = (tag + 1) & 15;
+        }
+    } else {
+        do {
+            do {
+                tag = (tag + 1) & 15;
+            } while (exclude & (1 << tag));
+        } while (--offset > 0);
+    }
+    return tag;
+}
+
+static uint64_t address_with_allocation_tag(uint64_t ptr, int rtag)
+{
+    rtag -= extract64(ptr, 55, 1);
+    return deposit64(ptr, 56, 4, rtag);
+}
+
 /*
  * Perform a checked access for MTE.
  * On arrival, TBI is known to enabled, as is allocation_tag_access_enabled.
@@ -165,3 +190,35 @@  uint64_t HELPER(mte_check3)(CPUARMState *env, uint64_t dirty_ptr, uint32_t tbi)
         return dirty_ptr;
     }
 }
+
+uint64_t HELPER(irg)(CPUARMState *env, uint64_t rn, uint64_t rm)
+{
+    int el = arm_current_el(env);
+    uint64_t sctlr = arm_sctlr(env, el);
+    int rtag = 0;
+
+    if (allocation_tag_access_enabled(env, el, sctlr)) {
+        /*
+         * Our IMPDEF choice for GCR_EL1.RRND==1 is to behave as if
+         * GCR_EL1.RRND==0, always producing deterministic results.
+         */
+        uint16_t exclude = extract32(rm | env->cp15.gcr_el1, 0, 16);
+        int start = extract32(env->cp15.rgsr_el1, 0, 4);
+        int seed = extract32(env->cp15.rgsr_el1, 8, 16);
+        int offset, i;
+
+        /* RandomTag */
+        for (i = offset = 0; i < 4; ++i) {
+            /* NextRandomTagBit */
+            int top = (extract32(seed, 5, 1) ^ extract32(seed, 3, 1) ^
+                       extract32(seed, 2, 1) ^ extract32(seed, 0, 1));
+            seed = (top << 15) | (seed >> 1);
+            offset |= top << i;
+        }
+        rtag = choose_nonexcluded_tag(start, offset, exclude);
+
+        env->cp15.rgsr_el1 = rtag | (seed << 8);
+    }
+
+    return address_with_allocation_tag(rn, rtag);
+}
diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index 18d45fba87..83d253d67f 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -5156,6 +5156,13 @@  static void disas_data_proc_2src(DisasContext *s, uint32_t insn)
     case 3: /* SDIV */
         handle_div(s, true, sf, rm, rn, rd);
         break;
+    case 4: /* IRG */
+        if (sf == 0 || !dc_isar_feature(aa64_mte_insn_reg, s)) {
+            goto do_unallocated;
+        }
+        gen_helper_irg(cpu_reg_sp(s, rd), cpu_env,
+                       cpu_reg_sp(s, rn), cpu_reg(s, rm));
+        break;
     case 8: /* LSLV */
         handle_shift_reg(s, A64_SHIFT_TYPE_LSL, sf, rm, rn, rd);
         break;