From patchwork Thu Mar 7 17:04:22 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Richard Henderson X-Patchwork-Id: 159890 Delivered-To: patch@linaro.org Received: by 2002:a02:5cc1:0:0:0:0:0 with SMTP id w62csp7668606jad; Thu, 7 Mar 2019 09:05:33 -0800 (PST) X-Google-Smtp-Source: APXvYqzrVajrXC346TuwLS7su3PWiD6eH63rRkcr66yPllaxBJc68jWqySptiisyqANAeQJMVwP/ X-Received: by 2002:a37:dd41:: with SMTP id n62mr10428715qki.11.1551978332954; Thu, 07 Mar 2019 09:05:32 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1551978332; cv=none; d=google.com; s=arc-20160816; b=mM0vrSXQGNHEoqpSMkgiu20X1s5z43QSZlEhtCPiTul1+wL3e7q/qEmumK6f4q2xob 86sEFpnpeRWdodUxX8c4ESi5BSl0F2BalA+IjpiMGuLv6cxrG4xYi6G7OK8XkYc9s9lK ZdKYyyWD/fTnN8JAipwyWbs9rDedD0VNvytSaEsixd4toaskSR+znyhoexa7ZqgdUNw5 e8z4m6Lm6MfD65GUWt+55yapWkhFlp9ZXGSiCoHvZpQFHa3YtrVDpT2l5yunJCQZAkZn 7fTEtRBq1YV3jrbVUr5uMSl8yXdAK5jwyt8dY69anz64J2Il0CL/M002MyZSrcWYCiz6 n3Rw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=sender:errors-to:cc:list-subscribe:list-help:list-post:list-archive :list-unsubscribe:list-id:precedence:subject:references:in-reply-to :message-id:date:to:from:dkim-signature; bh=UyakrNf0omomqVZKKc3yoRouRXDll5R6WjQkXlQdklI=; b=aqwxlwtSiQf5HCV+BFryXYEl4n1y6YiJZb1BLCfXMBUTZgFz8gahL5cg7LIZzCeaJu w5iDFTalUlgiZknN/fmz9kzDyhsZRBpoAxF4zOFunB40Un4M73Wfj/Djp/M3IioxgIrW Jo+uyt4Q2F8M3XNtaEcgnJvVqs8JuWaHxqqBvwWlFkdf6K+42Sy8QnPuEOrfMYMkHAxX 1yzcVOxxt/0PnsTgE5jOvlCtmbybLHuRQw/Bmh70JQpGiDfT4ZTdGHQSnbXpOcfP0ihI NUaltNk/4xUCLhiFIkRLXSaAhlVnCR/zEg6hQOCtuMSol5tSW3KA4ZqrDzQhsmysv1Xm qGvA== ARC-Authentication-Results: i=1; mx.google.com; dkim=fail header.i=@linaro.org header.s=google header.b=UKB0GChT; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org"; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=linaro.org Return-Path: Received: from lists.gnu.org (lists.gnu.org. [209.51.188.17]) by mx.google.com with ESMTPS id r7si420814yba.308.2019.03.07.09.05.32 for (version=TLS1 cipher=AES128-SHA bits=128/128); Thu, 07 Mar 2019 09:05:32 -0800 (PST) Received-SPF: pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; Authentication-Results: mx.google.com; dkim=fail header.i=@linaro.org header.s=google header.b=UKB0GChT; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org"; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=linaro.org Received: from localhost ([127.0.0.1]:55544 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1h1wSa-0006Op-EM for patch@linaro.org; Thu, 07 Mar 2019 12:05:32 -0500 Received: from eggs.gnu.org ([209.51.188.92]:58876) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1h1wS9-0006Ls-VE for qemu-devel@nongnu.org; Thu, 07 Mar 2019 12:05:07 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1h1wS0-0004TX-Mr for qemu-devel@nongnu.org; Thu, 07 Mar 2019 12:05:04 -0500 Received: from mail-pf1-x429.google.com ([2607:f8b0:4864:20::429]:37884) by eggs.gnu.org with esmtps (TLS1.0:RSA_AES_128_CBC_SHA1:16) (Exim 4.71) (envelope-from ) id 1h1wRy-0004Mh-8I for qemu-devel@nongnu.org; Thu, 07 Mar 2019 12:04:55 -0500 Received: by mail-pf1-x429.google.com with SMTP id s22so11895511pfh.4 for ; Thu, 07 Mar 2019 09:04:48 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro.org; s=google; h=from:to:cc:subject:date:message-id:in-reply-to:references; bh=UyakrNf0omomqVZKKc3yoRouRXDll5R6WjQkXlQdklI=; b=UKB0GChTCwuSY3nXqHFe9dg8wxiz58cyU+9pRONYQq8ONGZEXfw2YNITaFLXvkLU0m ed4lxnRBxLO/8E7kkikl8h4c5bRE6dxftq4v9r0T8o1+GfSL8nvyVejWhIVIe3zMvHTf fQKIa/ONdC0ESAnZ5uinOJAn8uYXSQMI9Q3urTXf4yEbBImggEPhm+GOZtZXYIwTbA+G 70WIhlgfqClj/qLnGFpo41vyQdqTqlHXwlAoTzLJ/1eUrE8Jg7ShJAsBwxmTCX06tLrI ElE1RAc85auN/j/QnsjB8dflYlPfveZ3/3J3Yi95l6QYIniv7qrsp4R6GRg4vqDRiDcF LUZw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references; bh=UyakrNf0omomqVZKKc3yoRouRXDll5R6WjQkXlQdklI=; b=P8qASCyFPMnSPYIVQ+3gukKsC1corE0VKp8ltIQfnOy3tq2vYIlYv7CObyYp/BUfx9 a06YF90L7Sp3Pns9p/bAelygf0S4SO39tBiUJw6cOOjr1jsBIV04BKdWrVJsUe4M3EQ9 tHqV1QVUh2pvWqCN+mxcIaN2HKIPrKdDt9j6i92HsjtD6aQfRYhQmRRnhnopaq3uIKl3 JAI43UldTUGVxnA1pVh2BIfA3U9fZqBTVJLLeSrtkVcNwhS0gW7CNAmdTgYjXpy8UKij tBpV4wesPngqh5gXZXWuWWRX6rQ4C2AsIcxZNLGDBWd1M/32tB0AZpteaDQBwPhXu+eV bIJw== X-Gm-Message-State: APjAAAU8REgB92akN90cGOkKk7S3mOV6+UFudWDwTsJyBNY0n07/LB0g EKbbUDBAdS4do2VNzg9h4uiOtiHFxWI= X-Received: by 2002:a63:da43:: with SMTP id l3mr12438901pgj.164.1551978287560; Thu, 07 Mar 2019 09:04:47 -0800 (PST) Received: from cloudburst.twiddle.net (97-113-188-82.tukw.qwest.net. [97.113.188.82]) by smtp.gmail.com with ESMTPSA id r82sm10040562pfa.161.2019.03.07.09.04.46 (version=TLS1_2 cipher=ECDHE-RSA-CHACHA20-POLY1305 bits=256/256); Thu, 07 Mar 2019 09:04:46 -0800 (PST) From: Richard Henderson To: qemu-devel@nongnu.org Date: Thu, 7 Mar 2019 09:04:22 -0800 Message-Id: <20190307170440.3113-5-richard.henderson@linaro.org> X-Mailer: git-send-email 2.17.2 In-Reply-To: <20190307170440.3113-1-richard.henderson@linaro.org> References: <20190307170440.3113-1-richard.henderson@linaro.org> X-detected-operating-system: by eggs.gnu.org: Genre and OS details not recognized. X-Received-From: 2607:f8b0:4864:20::429 Subject: [Qemu-devel] [PATCH v4 04/22] target/arm: Add helper_mte_check{1, 2} X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: peter.maydell@linaro.org Errors-To: qemu-devel-bounces+patch=linaro.org@nongnu.org Sender: "Qemu-devel" Implements the rules of "PE generation of Checked and Unchecked accesses" which aren't already implied by TB_FLAGS_MTE_ACTIVE. Implements the rules of "PE handling of Tag Check Failure". Does not implement tag physical address space, so all operations reduce to unchecked so far. Signed-off-by: Richard Henderson --- v2: Fix TFSR update. v3: Split helper_mte_check per {1,2} IAs; take tbi data from translate. --- target/arm/helper-a64.h | 3 + target/arm/mte_helper.c | 133 +++++++++++++++++++++++++++++++++++++ target/arm/translate-a64.c | 14 +++- target/arm/Makefile.objs | 2 +- 4 files changed, 150 insertions(+), 2 deletions(-) create mode 100644 target/arm/mte_helper.c -- 2.17.2 diff --git a/target/arm/helper-a64.h b/target/arm/helper-a64.h index a915c1247f..c88797a922 100644 --- a/target/arm/helper-a64.h +++ b/target/arm/helper-a64.h @@ -102,3 +102,6 @@ DEF_HELPER_FLAGS_3(autda, TCG_CALL_NO_WG, i64, env, i64, i64) DEF_HELPER_FLAGS_3(autdb, TCG_CALL_NO_WG, i64, env, i64, i64) DEF_HELPER_FLAGS_2(xpaci, TCG_CALL_NO_RWG_SE, i64, env, i64) DEF_HELPER_FLAGS_2(xpacd, TCG_CALL_NO_RWG_SE, i64, env, i64) + +DEF_HELPER_FLAGS_2(mte_check1, TCG_CALL_NO_WG, i64, env, i64) +DEF_HELPER_FLAGS_3(mte_check2, TCG_CALL_NO_WG, i64, env, i64, i32) diff --git a/target/arm/mte_helper.c b/target/arm/mte_helper.c new file mode 100644 index 0000000000..bcd82a9be0 --- /dev/null +++ b/target/arm/mte_helper.c @@ -0,0 +1,133 @@ +/* + * ARM v8.5-MemTag Operations + * + * Copyright (c) 2019 Linaro, Ltd. + * + * This library is free software; you can redistribute it and/or + * modify it under the terms of the GNU Lesser General Public + * License as published by the Free Software Foundation; either + * version 2.1 of the License, or (at your option) any later version. + * + * This library is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public + * License along with this library; if not, see . + */ + +#include "qemu/osdep.h" +#include "cpu.h" +#include "internals.h" +#include "exec/exec-all.h" +#include "exec/cpu_ldst.h" +#include "exec/helper-proto.h" + + +static int get_allocation_tag(CPUARMState *env, uint64_t ptr, uintptr_t ra) +{ + /* Tag storage not implemented. */ + return -1; +} + +static int allocation_tag_from_addr(uint64_t ptr) +{ + ptr += 1ULL << 55; /* carry ptr[55] into ptr[59:56]. */ + return extract64(ptr, 56, 4); +} + +/* + * Perform a checked access for MTE. + * On arrival, TBI is known to enabled, as is allocation_tag_access_enabled. + */ +static uint64_t do_mte_check(CPUARMState *env, uint64_t dirty_ptr, + uint64_t clean_ptr, uint32_t select, + uintptr_t ra) +{ + int ptr_tag, mem_tag; + + /* + * If TCMA is enabled, then physical tag 0 is unchecked. + * Note the rules R0076 & R0077 are written with logical tags, + * and we need the physical tag below anyway. + */ + ptr_tag = allocation_tag_from_addr(dirty_ptr); + if (ptr_tag == 0) { + ARMMMUIdx stage1 = arm_stage1_mmu_idx(env); + ARMVAParameters p = aa64_va_parameters(env, dirty_ptr, stage1, true); + if (p.tcma) { + return clean_ptr; + } + } + + /* + * If an access is made to an address that does not provide tag storage, + * the result is implementation defined (R0006). We choose to treat the + * access as unchecked. + * This is similar to MemAttr != Tagged, which are also unchecked. + */ + mem_tag = get_allocation_tag(env, clean_ptr, ra); + if (mem_tag < 0) { + return clean_ptr; + } + + /* If the tags do not match, the tag check operation fails. */ + if (unlikely(ptr_tag != mem_tag)) { + int tcf, el = arm_current_el(env); + + if (el == 0) { + /* FIXME: ARMv8.1-VHE S2 translation regime. */ + tcf = extract64(env->cp15.sctlr_el[1], 38, 2); + } else { + tcf = extract64(env->cp15.sctlr_el[el], 40, 2); + } + if (tcf == 1) { + /* + * Tag check fail causes a synchronous exception. + * + * In restore_state_to_opc, we set the exception syndrome + * for the load or store operation. Do that first so we + * may overwrite that with the syndrome for the tag check. + */ + cpu_restore_state(ENV_GET_CPU(env), ra, true); + env->exception.vaddress = dirty_ptr; + raise_exception(env, EXCP_DATA_ABORT, + syn_data_abort_no_iss(el != 0, 0, 0, 0, 0, 0x11), + exception_target_el(env)); + } else if (tcf == 2) { + /* Tag check fail causes asynchronous flag set. */ + env->cp15.tfsr_el[el] |= 1 << select; + } + } + + return clean_ptr; +} + +/* + * Perform check in translation regime w/single IA range. + * It is known that TBI is enabled on entry. + */ +uint64_t HELPER(mte_check1)(CPUARMState *env, uint64_t dirty_ptr) +{ + uint64_t clean_ptr = extract64(dirty_ptr, 0, 56); + return do_mte_check(env, dirty_ptr, clean_ptr, 0, GETPC()); +} + +/* + * Perform check in translation regime w/two IA ranges. + * The TBI argument is the concatenation of TBI1:TBI0. We have filtered + * TBI==0, but still need to check the IA range being referenced. + */ +uint64_t HELPER(mte_check2)(CPUARMState *env, uint64_t dirty_ptr, uint32_t tbi) +{ + uint32_t select = extract64(dirty_ptr, 55, 1); + + if ((tbi >> select) & 1) { + uint64_t clean_ptr = sextract64(dirty_ptr, 0, 56); + return do_mte_check(env, dirty_ptr, clean_ptr, select, GETPC()); + } else { + /* TBI is disabled; the access is unchecked. */ + return dirty_ptr; + } +} diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c index 128b7f2e32..6ec77fc67c 100644 --- a/target/arm/translate-a64.c +++ b/target/arm/translate-a64.c @@ -343,7 +343,19 @@ static void gen_a64_set_pc(DisasContext *s, TCGv_i64 src) static TCGv_i64 clean_data_tbi(DisasContext *s, TCGv_i64 addr) { TCGv_i64 clean = new_tmp_a64(s); - gen_top_byte_ignore(s, clean, addr, s->tbid); + + if (s->mte_active) { + if (s->current_el >= 2) { + /* FIXME: ARMv8.1-VHE S2 translation regime. */ + gen_helper_mte_check1(clean, cpu_env, addr); + } else { + TCGv_i32 tbi = tcg_const_i32(s->tbid); + gen_helper_mte_check2(clean, cpu_env, addr, tbi); + tcg_temp_free_i32(tbi); + } + } else { + gen_top_byte_ignore(s, clean, addr, s->tbid); + } return clean; } diff --git a/target/arm/Makefile.objs b/target/arm/Makefile.objs index 6bdcc65c2c..c22cbc5567 100644 --- a/target/arm/Makefile.objs +++ b/target/arm/Makefile.objs @@ -8,7 +8,7 @@ obj-y += translate.o op_helper.o helper.o cpu.o obj-y += neon_helper.o iwmmxt_helper.o vec_helper.o vfp_helper.o obj-y += gdbstub.o obj-$(TARGET_AARCH64) += cpu64.o translate-a64.o helper-a64.o gdbstub64.o -obj-$(TARGET_AARCH64) += pauth_helper.o +obj-$(TARGET_AARCH64) += pauth_helper.o mte_helper.o obj-y += crypto_helper.o obj-$(CONFIG_SOFTMMU) += arm-powerctl.o