* [Qemu-devel] [PATCH 01/26] target/arm: Add state for the ARMv8.3-PAuth extension
2018-12-07 10:36 [Qemu-devel] [PATCH 00/26] target/arm: Implement ARMv8.3-PAuth Richard Henderson
@ 2018-12-07 10:36 ` Richard Henderson
2018-12-11 14:50 ` Peter Maydell
2018-12-07 10:36 ` [Qemu-devel] [PATCH 02/26] target/arm: Add SCTLR bits through ARMv8.5 Richard Henderson
` (24 subsequent siblings)
25 siblings, 1 reply; 47+ messages in thread
From: Richard Henderson @ 2018-12-07 10:36 UTC (permalink / raw)
To: qemu-devel; +Cc: peter.maydell, ramana.radhakrishnan
Add storage space for the 5 encryption keys. Migrate them when
the extension is enabled.
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
target/arm/cpu.h | 23 +++++++++++++++++++++++
target/arm/machine.c | 23 +++++++++++++++++++++++
2 files changed, 46 insertions(+)
diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index c943f35dd9..0766e32a1b 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -605,6 +605,14 @@ typedef struct CPUARMState {
uint32_t cregs[16];
} iwmmxt;
+#ifdef TARGET_AARCH64
+ uint64_t apia_key[2];
+ uint64_t apib_key[2];
+ uint64_t apda_key[2];
+ uint64_t apdb_key[2];
+ uint64_t apga_key[2];
+#endif
+
#if defined(CONFIG_USER_ONLY)
/* For usermode syscall translation. */
int eabi;
@@ -3324,6 +3332,21 @@ static inline bool isar_feature_aa64_fcma(const ARMISARegisters *id)
return FIELD_EX64(id->id_aa64isar1, ID_AA64ISAR1, FCMA) != 0;
}
+static inline bool isar_feature_aa64_pauth(const ARMISARegisters *id)
+{
+ /*
+ * Note that while QEMU will only implement the architected algorithm
+ * QARMA, and thus APA+GPA, the host cpu for kvm may use implementation
+ * defined algorithms, and thus API+GPI, and this predicate controls
+ * migration of the 128-bit keys.
+ */
+ return (id->id_aa64isar1 &
+ (FIELD_DP64(0, ID_AA64ISAR1, APA, -1) |
+ FIELD_DP64(0, ID_AA64ISAR1, API, -1) |
+ FIELD_DP64(0, ID_AA64ISAR1, GPA, -1) |
+ FIELD_DP64(0, ID_AA64ISAR1, GPI, -1))) != 0;
+}
+
static inline bool isar_feature_aa64_fp16(const ARMISARegisters *id)
{
/* We always set the AdvSIMD and FP fields identically wrt FP16. */
diff --git a/target/arm/machine.c b/target/arm/machine.c
index 7a22ebc209..340b36084c 100644
--- a/target/arm/machine.c
+++ b/target/arm/machine.c
@@ -169,6 +169,28 @@ static const VMStateDescription vmstate_sve = {
VMSTATE_END_OF_LIST()
}
};
+
+static bool pauth_needed(void *opaque)
+{
+ ARMCPU *cpu = opaque;
+
+ return cpu_isar_feature(aa64_pauth, cpu);
+}
+
+static const VMStateDescription vmstate_pauth = {
+ .name = "cpu/pauth",
+ .version_id = 1,
+ .minimum_version_id = 1,
+ .needed = pauth_needed,
+ .fields = (VMStateField[]) {
+ VMSTATE_UINT64_ARRAY(env.apia_key, ARMCPU, 2),
+ VMSTATE_UINT64_ARRAY(env.apib_key, ARMCPU, 2),
+ VMSTATE_UINT64_ARRAY(env.apda_key, ARMCPU, 2),
+ VMSTATE_UINT64_ARRAY(env.apdb_key, ARMCPU, 2),
+ VMSTATE_UINT64_ARRAY(env.apga_key, ARMCPU, 2),
+ VMSTATE_END_OF_LIST()
+ }
+};
#endif /* AARCH64 */
static bool serror_needed(void *opaque)
@@ -795,6 +817,7 @@ const VMStateDescription vmstate_arm_cpu = {
&vmstate_m_security,
#ifdef TARGET_AARCH64
&vmstate_sve,
+ &vmstate_pauth,
#endif
&vmstate_serror,
&vmstate_irq_line_state,
--
2.17.2
^ permalink raw reply related [flat|nested] 47+ messages in thread* Re: [Qemu-devel] [PATCH 01/26] target/arm: Add state for the ARMv8.3-PAuth extension
2018-12-07 10:36 ` [Qemu-devel] [PATCH 01/26] target/arm: Add state for the ARMv8.3-PAuth extension Richard Henderson
@ 2018-12-11 14:50 ` Peter Maydell
2018-12-11 18:07 ` Richard Henderson
0 siblings, 1 reply; 47+ messages in thread
From: Peter Maydell @ 2018-12-11 14:50 UTC (permalink / raw)
To: Richard Henderson; +Cc: QEMU Developers, Ramana Radhakrishnan
On Fri, 7 Dec 2018 at 10:36, Richard Henderson
<richard.henderson@linaro.org> wrote:
>
> Add storage space for the 5 encryption keys. Migrate them when
> the extension is enabled.
>
> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
> ---
> target/arm/cpu.h | 23 +++++++++++++++++++++++
> target/arm/machine.c | 23 +++++++++++++++++++++++
> 2 files changed, 46 insertions(+)
>
> diff --git a/target/arm/cpu.h b/target/arm/cpu.h
> index c943f35dd9..0766e32a1b 100644
> --- a/target/arm/cpu.h
> +++ b/target/arm/cpu.h
> @@ -605,6 +605,14 @@ typedef struct CPUARMState {
> uint32_t cregs[16];
> } iwmmxt;
>
> +#ifdef TARGET_AARCH64
> + uint64_t apia_key[2];
> + uint64_t apib_key[2];
> + uint64_t apda_key[2];
> + uint64_t apdb_key[2];
> + uint64_t apga_key[2];
> +#endif
> +
> #if defined(CONFIG_USER_ONLY)
> /* For usermode syscall translation. */
> int eabi;
> @@ -3324,6 +3332,21 @@ static inline bool isar_feature_aa64_fcma(const ARMISARegisters *id)
> return FIELD_EX64(id->id_aa64isar1, ID_AA64ISAR1, FCMA) != 0;
> }
>
> +static inline bool isar_feature_aa64_pauth(const ARMISARegisters *id)
> +{
> + /*
> + * Note that while QEMU will only implement the architected algorithm
> + * QARMA, and thus APA+GPA, the host cpu for kvm may use implementation
> + * defined algorithms, and thus API+GPI, and this predicate controls
> + * migration of the 128-bit keys.
> + */
> + return (id->id_aa64isar1 &
> + (FIELD_DP64(0, ID_AA64ISAR1, APA, -1) |
> + FIELD_DP64(0, ID_AA64ISAR1, API, -1) |
> + FIELD_DP64(0, ID_AA64ISAR1, GPA, -1) |
> + FIELD_DP64(0, ID_AA64ISAR1, GPI, -1))) != 0;
> +}
> +
> static inline bool isar_feature_aa64_fp16(const ARMISARegisters *id)
> {
> /* We always set the AdvSIMD and FP fields identically wrt FP16. */
> diff --git a/target/arm/machine.c b/target/arm/machine.c
> index 7a22ebc209..340b36084c 100644
> --- a/target/arm/machine.c
> +++ b/target/arm/machine.c
> @@ -169,6 +169,28 @@ static const VMStateDescription vmstate_sve = {
> VMSTATE_END_OF_LIST()
> }
> };
> +
> +static bool pauth_needed(void *opaque)
> +{
> + ARMCPU *cpu = opaque;
> +
> + return cpu_isar_feature(aa64_pauth, cpu);
> +}
> +
> +static const VMStateDescription vmstate_pauth = {
> + .name = "cpu/pauth",
> + .version_id = 1,
> + .minimum_version_id = 1,
> + .needed = pauth_needed,
> + .fields = (VMStateField[]) {
> + VMSTATE_UINT64_ARRAY(env.apia_key, ARMCPU, 2),
> + VMSTATE_UINT64_ARRAY(env.apib_key, ARMCPU, 2),
> + VMSTATE_UINT64_ARRAY(env.apda_key, ARMCPU, 2),
> + VMSTATE_UINT64_ARRAY(env.apdb_key, ARMCPU, 2),
> + VMSTATE_UINT64_ARRAY(env.apga_key, ARMCPU, 2),
> + VMSTATE_END_OF_LIST()
> + }
> +};
What's the rationale for migrating these "by hand" rather
than relying on the usual sysreg migration code ?
thanks
-- PMM
^ permalink raw reply [flat|nested] 47+ messages in thread
* [Qemu-devel] [PATCH 02/26] target/arm: Add SCTLR bits through ARMv8.5
2018-12-07 10:36 [Qemu-devel] [PATCH 00/26] target/arm: Implement ARMv8.3-PAuth Richard Henderson
2018-12-07 10:36 ` [Qemu-devel] [PATCH 01/26] target/arm: Add state for the ARMv8.3-PAuth extension Richard Henderson
@ 2018-12-07 10:36 ` Richard Henderson
2018-12-11 15:18 ` Peter Maydell
2018-12-07 10:36 ` [Qemu-devel] [PATCH 03/26] target/arm: Add PAuth active bit to tbflags Richard Henderson
` (23 subsequent siblings)
25 siblings, 1 reply; 47+ messages in thread
From: Richard Henderson @ 2018-12-07 10:36 UTC (permalink / raw)
To: qemu-devel; +Cc: peter.maydell, ramana.radhakrishnan
Post v8.4 bits taken from SysReg_v85_xml-00bet8.
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
target/arm/cpu.h | 40 +++++++++++++++++++++++++++++-----------
1 file changed, 29 insertions(+), 11 deletions(-)
diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index 0766e32a1b..80d65866c6 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -984,12 +984,14 @@ void pmccntr_sync(CPUARMState *env);
#define SCTLR_A (1U << 1)
#define SCTLR_C (1U << 2)
#define SCTLR_W (1U << 3) /* up to v6; RAO in v7 */
-#define SCTLR_SA (1U << 3)
+#define SCTLR_nTLSMD_32 (1U << 3) /* v8.2-LSMAOC, AArch32 only */
#define SCTLR_P (1U << 4) /* up to v5; RAO in v6 and v7 */
+#define SCTLR_LSMAOE_32 (1U << 4) /* v8.2-LSMAOC, AArch32 only */
#define SCTLR_SA0 (1U << 4) /* v8 onward, AArch64 only */
#define SCTLR_D (1U << 5) /* up to v5; RAO in v6 */
#define SCTLR_CP15BEN (1U << 5) /* v7 onward */
#define SCTLR_L (1U << 6) /* up to v5; RAO in v6 and v7; RAZ in v8 */
+#define SCTLR_nAA (1U << 6) /* when v8.4-LSE is implemented */
#define SCTLR_B (1U << 7) /* up to v6; RAZ in v7 */
#define SCTLR_ITD (1U << 7) /* v8 onward */
#define SCTLR_S (1U << 8) /* up to v6; RAZ in v7 */
@@ -997,35 +999,51 @@ void pmccntr_sync(CPUARMState *env);
#define SCTLR_R (1U << 9) /* up to v6; RAZ in v7 */
#define SCTLR_UMA (1U << 9) /* v8 onward, AArch64 only */
#define SCTLR_F (1U << 10) /* up to v6 */
-#define SCTLR_SW (1U << 10) /* v7 onward */
-#define SCTLR_Z (1U << 11)
+#define SCTLR_SW (1U << 10) /* v7, RES0 in v8 */
+#define SCTLR_Z (1U << 11) /* in v7, RES1 in v8 */
#define SCTLR_I (1U << 12)
-#define SCTLR_V (1U << 13)
+#define SCTLR_V (1U << 13) /* AArch32 only */
+#define SCTLR_EnDB (1U << 13) /* v8.3, AArch64 only */
#define SCTLR_RR (1U << 14) /* up to v7 */
#define SCTLR_DZE (1U << 14) /* v8 onward, AArch64 only */
#define SCTLR_L4 (1U << 15) /* up to v6; RAZ in v7 */
#define SCTLR_UCT (1U << 15) /* v8 onward, AArch64 only */
#define SCTLR_DT (1U << 16) /* up to ??, RAO in v6 and v7 */
#define SCTLR_nTWI (1U << 16) /* v8 onward */
-#define SCTLR_HA (1U << 17)
+#define SCTLR_HA (1U << 17) /* up to v7, RES0 in v8 */
#define SCTLR_BR (1U << 17) /* PMSA only */
#define SCTLR_IT (1U << 18) /* up to ??, RAO in v6 and v7 */
#define SCTLR_nTWE (1U << 18) /* v8 onward */
#define SCTLR_WXN (1U << 19)
#define SCTLR_ST (1U << 20) /* up to ??, RAZ in v6 */
-#define SCTLR_UWXN (1U << 20) /* v7 onward */
-#define SCTLR_FI (1U << 21)
-#define SCTLR_U (1U << 22)
+#define SCTLR_UWXN (1U << 20) /* v7 onward, AArch32 only */
+#define SCTLR_FI (1U << 21) /* up to v7, v8 RES0 */
+#define SCTLR_IESB (1U << 21) /* v8.2-IESB, AArch64 only */
+#define SCTLR_U (1U << 22) /* up to ??, v8 RES1 */
#define SCTLR_XP (1U << 23) /* up to v6; v7 onward RAO */
+#define SCTLR_SPAN (1U << 23) /* v8.1-PAN */
#define SCTLR_VE (1U << 24) /* up to v7 */
#define SCTLR_E0E (1U << 24) /* v8 onward, AArch64 only */
#define SCTLR_EE (1U << 25)
#define SCTLR_L2 (1U << 26) /* up to v6, RAZ in v7 */
#define SCTLR_UCI (1U << 26) /* v8 onward, AArch64 only */
#define SCTLR_NMFI (1U << 27)
-#define SCTLR_TRE (1U << 28)
-#define SCTLR_AFE (1U << 29)
-#define SCTLR_TE (1U << 30)
+#define SCTLR_EnDA (1U << 27) /* v8.3, AArch64 only */
+#define SCTLR_TRE (1U << 28) /* AArch32 only */
+#define SCTLR_nTLSMD_64 (1U << 28) /* v8.2-LSMAOC, AArch64 only */
+#define SCTLR_AFE (1U << 29) /* AArch32 only */
+#define SCTLR_LSMAOE_64 (1U << 29) /* v8.2-LSMAOC, AArch64 only */
+#define SCTLR_TE (1U << 30) /* AArch32 only */
+#define SCTLR_EnIB (1U << 30) /* v8.3, AArch64 only */
+#define SCTLR_EnIA (1U << 31) /* v8.3, AArch64 only */
+#define SCTLR_BT0 (1ULL << 35) /* v8.5-BTI */
+#define SCTLR_BT1 (1ULL << 36) /* v8.5-BTI */
+#define SCTLR_ITFSB (1ULL << 37) /* v8.5-MemTag */
+#define SCTLR_TCF0 (3ULL << 38) /* v8.5-MemTag */
+#define SCTLR_TCF (3ULL << 40) /* v8.5-MemTag */
+#define SCTLR_ATA0 (1ULL << 42) /* v8.5-MemTag */
+#define SCTLR_ATA (1ULL << 43) /* v8.5-MemTag */
+#define SCTLR_DSSBS (1ULL << 44) /* v8.5 */
#define CPTR_TCPAC (1U << 31)
#define CPTR_TTA (1U << 20)
--
2.17.2
^ permalink raw reply related [flat|nested] 47+ messages in thread* Re: [Qemu-devel] [PATCH 02/26] target/arm: Add SCTLR bits through ARMv8.5
2018-12-07 10:36 ` [Qemu-devel] [PATCH 02/26] target/arm: Add SCTLR bits through ARMv8.5 Richard Henderson
@ 2018-12-11 15:18 ` Peter Maydell
0 siblings, 0 replies; 47+ messages in thread
From: Peter Maydell @ 2018-12-11 15:18 UTC (permalink / raw)
To: Richard Henderson; +Cc: QEMU Developers, Ramana Radhakrishnan
On Fri, 7 Dec 2018 at 10:36, Richard Henderson
<richard.henderson@linaro.org> wrote:
>
> Post v8.4 bits taken from SysReg_v85_xml-00bet8.
>
> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
> ---
> target/arm/cpu.h | 40 +++++++++++++++++++++++++++++-----------
> 1 file changed, 29 insertions(+), 11 deletions(-)
>
> diff --git a/target/arm/cpu.h b/target/arm/cpu.h
> index 0766e32a1b..80d65866c6 100644
> --- a/target/arm/cpu.h
> +++ b/target/arm/cpu.h
> @@ -984,12 +984,14 @@ void pmccntr_sync(CPUARMState *env);
> #define SCTLR_A (1U << 1)
> #define SCTLR_C (1U << 2)
> #define SCTLR_W (1U << 3) /* up to v6; RAO in v7 */
> -#define SCTLR_SA (1U << 3)
Why delete the SCTLR_SA definition? This is the meaning of
bit 3 for SCTLR_EL1 and SCTLR_EL3 (enables/disables A64
SP alignment checking).
> +#define SCTLR_nTLSMD_32 (1U << 3) /* v8.2-LSMAOC, AArch32 only */
> #define SCTLR_P (1U << 4) /* up to v5; RAO in v6 and v7 */
> +#define SCTLR_LSMAOE_32 (1U << 4) /* v8.2-LSMAOC, AArch32 only */
> #define SCTLR_SA0 (1U << 4) /* v8 onward, AArch64 only */
> #define SCTLR_D (1U << 5) /* up to v5; RAO in v6 */
> #define SCTLR_CP15BEN (1U << 5) /* v7 onward */
> #define SCTLR_L (1U << 6) /* up to v5; RAO in v6 and v7; RAZ in v8 */
> +#define SCTLR_nAA (1U << 6) /* when v8.4-LSE is implemented */
> #define SCTLR_B (1U << 7) /* up to v6; RAZ in v7 */
> #define SCTLR_ITD (1U << 7) /* v8 onward */
> #define SCTLR_S (1U << 8) /* up to v6; RAZ in v7 */
> @@ -997,35 +999,51 @@ void pmccntr_sync(CPUARMState *env);
> #define SCTLR_R (1U << 9) /* up to v6; RAZ in v7 */
> #define SCTLR_UMA (1U << 9) /* v8 onward, AArch64 only */
> #define SCTLR_F (1U << 10) /* up to v6 */
> -#define SCTLR_SW (1U << 10) /* v7 onward */
> -#define SCTLR_Z (1U << 11)
> +#define SCTLR_SW (1U << 10) /* v7, RES0 in v8 */
> +#define SCTLR_Z (1U << 11) /* in v7, RES1 in v8 */
Bit 11 is EOS from ARMv8.5 onward.
> #define SCTLR_I (1U << 12)
> -#define SCTLR_V (1U << 13)
> +#define SCTLR_V (1U << 13) /* AArch32 only */
> +#define SCTLR_EnDB (1U << 13) /* v8.3, AArch64 only */
> #define SCTLR_RR (1U << 14) /* up to v7 */
> #define SCTLR_DZE (1U << 14) /* v8 onward, AArch64 only */
> #define SCTLR_L4 (1U << 15) /* up to v6; RAZ in v7 */
> #define SCTLR_UCT (1U << 15) /* v8 onward, AArch64 only */
> #define SCTLR_DT (1U << 16) /* up to ??, RAO in v6 and v7 */
> #define SCTLR_nTWI (1U << 16) /* v8 onward */
> -#define SCTLR_HA (1U << 17)
> +#define SCTLR_HA (1U << 17) /* up to v7, RES0 in v8 */
> #define SCTLR_BR (1U << 17) /* PMSA only */
> #define SCTLR_IT (1U << 18) /* up to ??, RAO in v6 and v7 */
> #define SCTLR_nTWE (1U << 18) /* v8 onward */
> #define SCTLR_WXN (1U << 19)
> #define SCTLR_ST (1U << 20) /* up to ??, RAZ in v6 */
> -#define SCTLR_UWXN (1U << 20) /* v7 onward */
> -#define SCTLR_FI (1U << 21)
> -#define SCTLR_U (1U << 22)
> +#define SCTLR_UWXN (1U << 20) /* v7 onward, AArch32 only */
> +#define SCTLR_FI (1U << 21) /* up to v7, v8 RES0 */
> +#define SCTLR_IESB (1U << 21) /* v8.2-IESB, AArch64 only */
> +#define SCTLR_U (1U << 22) /* up to ??, v8 RES1 */
22 is EIS from v8.5 onward. It was U up to v6, then RAO in v7.
> #define SCTLR_XP (1U << 23) /* up to v6; v7 onward RAO */
> +#define SCTLR_SPAN (1U << 23) /* v8.1-PAN */
> #define SCTLR_VE (1U << 24) /* up to v7 */
> #define SCTLR_E0E (1U << 24) /* v8 onward, AArch64 only */
> #define SCTLR_EE (1U << 25)
> #define SCTLR_L2 (1U << 26) /* up to v6, RAZ in v7 */
> #define SCTLR_UCI (1U << 26) /* v8 onward, AArch64 only */
> #define SCTLR_NMFI (1U << 27)
NMFI comment /* up to v7, RAZ in v7VE and v8 */
> -#define SCTLR_TRE (1U << 28)
> -#define SCTLR_AFE (1U << 29)
> -#define SCTLR_TE (1U << 30)
> +#define SCTLR_EnDA (1U << 27) /* v8.3, AArch64 only */
> +#define SCTLR_TRE (1U << 28) /* AArch32 only */
> +#define SCTLR_nTLSMD_64 (1U << 28) /* v8.2-LSMAOC, AArch64 only */
> +#define SCTLR_AFE (1U << 29) /* AArch32 only */
> +#define SCTLR_LSMAOE_64 (1U << 29) /* v8.2-LSMAOC, AArch64 only */
> +#define SCTLR_TE (1U << 30) /* AArch32 only */
> +#define SCTLR_EnIB (1U << 30) /* v8.3, AArch64 only */
> +#define SCTLR_EnIA (1U << 31) /* v8.3, AArch64 only */
> +#define SCTLR_BT0 (1ULL << 35) /* v8.5-BTI */
> +#define SCTLR_BT1 (1ULL << 36) /* v8.5-BTI */
> +#define SCTLR_ITFSB (1ULL << 37) /* v8.5-MemTag */
> +#define SCTLR_TCF0 (3ULL << 38) /* v8.5-MemTag */
> +#define SCTLR_TCF (3ULL << 40) /* v8.5-MemTag */
> +#define SCTLR_ATA0 (1ULL << 42) /* v8.5-MemTag */
> +#define SCTLR_ATA (1ULL << 43) /* v8.5-MemTag */
> +#define SCTLR_DSSBS (1ULL << 44) /* v8.5 */
>
> #define CPTR_TCPAC (1U << 31)
> #define CPTR_TTA (1U << 20)
Otherwise
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
thanks
-- PMM
^ permalink raw reply [flat|nested] 47+ messages in thread
* [Qemu-devel] [PATCH 03/26] target/arm: Add PAuth active bit to tbflags
2018-12-07 10:36 [Qemu-devel] [PATCH 00/26] target/arm: Implement ARMv8.3-PAuth Richard Henderson
2018-12-07 10:36 ` [Qemu-devel] [PATCH 01/26] target/arm: Add state for the ARMv8.3-PAuth extension Richard Henderson
2018-12-07 10:36 ` [Qemu-devel] [PATCH 02/26] target/arm: Add SCTLR bits through ARMv8.5 Richard Henderson
@ 2018-12-07 10:36 ` Richard Henderson
2018-12-11 15:23 ` Peter Maydell
2018-12-07 10:36 ` [Qemu-devel] [PATCH 04/26] target/arm: Add PAuth helpers Richard Henderson
` (22 subsequent siblings)
25 siblings, 1 reply; 47+ messages in thread
From: Richard Henderson @ 2018-12-07 10:36 UTC (permalink / raw)
To: qemu-devel; +Cc: peter.maydell, ramana.radhakrishnan
There are 5 bits of state that could be added, but to save
space within tbflags, add only a single enable bit.
Helpers will determine the rest of the state at runtime.
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
target/arm/cpu.h | 4 ++++
target/arm/translate.h | 2 ++
target/arm/helper.c | 19 +++++++++++++++++++
target/arm/translate-a64.c | 1 +
4 files changed, 26 insertions(+)
diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index 80d65866c6..f70eff8bcf 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -3024,6 +3024,8 @@ static inline bool arm_cpu_data_is_big_endian(CPUARMState *env)
#define ARM_TBFLAG_SVEEXC_EL_MASK (0x3 << ARM_TBFLAG_SVEEXC_EL_SHIFT)
#define ARM_TBFLAG_ZCR_LEN_SHIFT 4
#define ARM_TBFLAG_ZCR_LEN_MASK (0xf << ARM_TBFLAG_ZCR_LEN_SHIFT)
+#define ARM_TBFLAG_PAUTH_ACTIVE_SHIFT 8
+#define ARM_TBFLAG_PAUTH_ACTIVE_MASK (1ull << ARM_TBFLAG_PAUTH_ACTIVE_SHIFT)
/* some convenience accessor macros */
#define ARM_TBFLAG_AARCH64_STATE(F) \
@@ -3066,6 +3068,8 @@ static inline bool arm_cpu_data_is_big_endian(CPUARMState *env)
(((F) & ARM_TBFLAG_SVEEXC_EL_MASK) >> ARM_TBFLAG_SVEEXC_EL_SHIFT)
#define ARM_TBFLAG_ZCR_LEN(F) \
(((F) & ARM_TBFLAG_ZCR_LEN_MASK) >> ARM_TBFLAG_ZCR_LEN_SHIFT)
+#define ARM_TBFLAG_PAUTH_ACTIVE(F) \
+ (((F) & ARM_TBFLAG_PAUTH_ACTIVE_MASK) >> ARM_TBFLAG_PAUTH_ACTIVE_SHIFT)
static inline bool bswap_code(bool sctlr_b)
{
diff --git a/target/arm/translate.h b/target/arm/translate.h
index 1550aa8bc7..d8a8bb4e9c 100644
--- a/target/arm/translate.h
+++ b/target/arm/translate.h
@@ -68,6 +68,8 @@ typedef struct DisasContext {
bool is_ldex;
/* True if a single-step exception will be taken to the current EL */
bool ss_same_el;
+ /* True if v8.3-PAuth is active. */
+ bool pauth_active;
/* Bottom two bits of XScale c15_cpar coprocessor access control reg */
int c15_cpar;
/* TCG op of the current insn_start. */
diff --git a/target/arm/helper.c b/target/arm/helper.c
index 1e20956376..158c550fab 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -12991,6 +12991,25 @@ void cpu_get_tb_cpu_state(CPUARMState *env, target_ulong *pc,
flags |= sve_el << ARM_TBFLAG_SVEEXC_EL_SHIFT;
flags |= zcr_len << ARM_TBFLAG_ZCR_LEN_SHIFT;
}
+
+ if (cpu_isar_feature(aa64_pauth, cpu)) {
+ /*
+ * In order to save space in flags, we record only whether
+ * pauth is "inactive", meaning the insns are implemented as
+ * a nop, or "active" when some action must be performed.
+ * The decision of which action to take is left to a helper.
+ */
+ uint64_t sctlr;
+ if (current_el == 0) {
+ /* FIXME: ARMv8.1-VHE S2 translation regime. */
+ sctlr = env->cp15.sctlr_el[1];
+ } else {
+ sctlr = env->cp15.sctlr_el[current_el];
+ }
+ if (sctlr & (SCTLR_EnIA |SCTLR_EnIB | SCTLR_EnDA | SCTLR_EnDB)) {
+ flags |= ARM_TBFLAG_PAUTH_ACTIVE_MASK;
+ }
+ }
} else {
*pc = env->regs[15];
flags = (env->thumb << ARM_TBFLAG_THUMB_SHIFT)
diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index e1da1e4d6f..7c1cc1ce8e 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -13407,6 +13407,7 @@ static void aarch64_tr_init_disas_context(DisasContextBase *dcbase,
dc->fp_excp_el = ARM_TBFLAG_FPEXC_EL(dc->base.tb->flags);
dc->sve_excp_el = ARM_TBFLAG_SVEEXC_EL(dc->base.tb->flags);
dc->sve_len = (ARM_TBFLAG_ZCR_LEN(dc->base.tb->flags) + 1) * 16;
+ dc->pauth_active = ARM_TBFLAG_PAUTH_ACTIVE(dc->base.tb->flags);
dc->vec_len = 0;
dc->vec_stride = 0;
dc->cp_regs = arm_cpu->cp_regs;
--
2.17.2
^ permalink raw reply related [flat|nested] 47+ messages in thread* Re: [Qemu-devel] [PATCH 03/26] target/arm: Add PAuth active bit to tbflags
2018-12-07 10:36 ` [Qemu-devel] [PATCH 03/26] target/arm: Add PAuth active bit to tbflags Richard Henderson
@ 2018-12-11 15:23 ` Peter Maydell
0 siblings, 0 replies; 47+ messages in thread
From: Peter Maydell @ 2018-12-11 15:23 UTC (permalink / raw)
To: Richard Henderson; +Cc: QEMU Developers, Ramana Radhakrishnan
On Fri, 7 Dec 2018 at 10:36, Richard Henderson
<richard.henderson@linaro.org> wrote:
>
> There are 5 bits of state that could be added, but to save
> space within tbflags, add only a single enable bit.
> Helpers will determine the rest of the state at runtime.
>
> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
> ---
> target/arm/cpu.h | 4 ++++
> target/arm/translate.h | 2 ++
> target/arm/helper.c | 19 +++++++++++++++++++
> target/arm/translate-a64.c | 1 +
> 4 files changed, 26 insertions(+)
>
> diff --git a/target/arm/cpu.h b/target/arm/cpu.h
> index 80d65866c6..f70eff8bcf 100644
> --- a/target/arm/cpu.h
> +++ b/target/arm/cpu.h
> @@ -3024,6 +3024,8 @@ static inline bool arm_cpu_data_is_big_endian(CPUARMState *env)
> #define ARM_TBFLAG_SVEEXC_EL_MASK (0x3 << ARM_TBFLAG_SVEEXC_EL_SHIFT)
> #define ARM_TBFLAG_ZCR_LEN_SHIFT 4
> #define ARM_TBFLAG_ZCR_LEN_MASK (0xf << ARM_TBFLAG_ZCR_LEN_SHIFT)
> +#define ARM_TBFLAG_PAUTH_ACTIVE_SHIFT 8
> +#define ARM_TBFLAG_PAUTH_ACTIVE_MASK (1ull << ARM_TBFLAG_PAUTH_ACTIVE_SHIFT)
>
> /* some convenience accessor macros */
> #define ARM_TBFLAG_AARCH64_STATE(F) \
> @@ -3066,6 +3068,8 @@ static inline bool arm_cpu_data_is_big_endian(CPUARMState *env)
> (((F) & ARM_TBFLAG_SVEEXC_EL_MASK) >> ARM_TBFLAG_SVEEXC_EL_SHIFT)
> #define ARM_TBFLAG_ZCR_LEN(F) \
> (((F) & ARM_TBFLAG_ZCR_LEN_MASK) >> ARM_TBFLAG_ZCR_LEN_SHIFT)
> +#define ARM_TBFLAG_PAUTH_ACTIVE(F) \
> + (((F) & ARM_TBFLAG_PAUTH_ACTIVE_MASK) >> ARM_TBFLAG_PAUTH_ACTIVE_SHIFT)
>
> static inline bool bswap_code(bool sctlr_b)
> {
> diff --git a/target/arm/translate.h b/target/arm/translate.h
> index 1550aa8bc7..d8a8bb4e9c 100644
> --- a/target/arm/translate.h
> +++ b/target/arm/translate.h
> @@ -68,6 +68,8 @@ typedef struct DisasContext {
> bool is_ldex;
> /* True if a single-step exception will be taken to the current EL */
> bool ss_same_el;
> + /* True if v8.3-PAuth is active. */
> + bool pauth_active;
> /* Bottom two bits of XScale c15_cpar coprocessor access control reg */
> int c15_cpar;
> /* TCG op of the current insn_start. */
> diff --git a/target/arm/helper.c b/target/arm/helper.c
> index 1e20956376..158c550fab 100644
> --- a/target/arm/helper.c
> +++ b/target/arm/helper.c
> @@ -12991,6 +12991,25 @@ void cpu_get_tb_cpu_state(CPUARMState *env, target_ulong *pc,
> flags |= sve_el << ARM_TBFLAG_SVEEXC_EL_SHIFT;
> flags |= zcr_len << ARM_TBFLAG_ZCR_LEN_SHIFT;
> }
> +
> + if (cpu_isar_feature(aa64_pauth, cpu)) {
> + /*
> + * In order to save space in flags, we record only whether
> + * pauth is "inactive", meaning the insns are implemented as
> + * a nop, or "active" when some action must be performed.
> + * The decision of which action to take is left to a helper.
> + */
> + uint64_t sctlr;
> + if (current_el == 0) {
> + /* FIXME: ARMv8.1-VHE S2 translation regime. */
> + sctlr = env->cp15.sctlr_el[1];
> + } else {
> + sctlr = env->cp15.sctlr_el[current_el];
> + }
> + if (sctlr & (SCTLR_EnIA |SCTLR_EnIB | SCTLR_EnDA | SCTLR_EnDB)) {
Missing space before SCTLR_EnIB.
> + flags |= ARM_TBFLAG_PAUTH_ACTIVE_MASK;
> + }
> + }
> } else {
> *pc = env->regs[15];
> flags = (env->thumb << ARM_TBFLAG_THUMB_SHIFT)
> diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
> index e1da1e4d6f..7c1cc1ce8e 100644
> --- a/target/arm/translate-a64.c
> +++ b/target/arm/translate-a64.c
> @@ -13407,6 +13407,7 @@ static void aarch64_tr_init_disas_context(DisasContextBase *dcbase,
> dc->fp_excp_el = ARM_TBFLAG_FPEXC_EL(dc->base.tb->flags);
> dc->sve_excp_el = ARM_TBFLAG_SVEEXC_EL(dc->base.tb->flags);
> dc->sve_len = (ARM_TBFLAG_ZCR_LEN(dc->base.tb->flags) + 1) * 16;
> + dc->pauth_active = ARM_TBFLAG_PAUTH_ACTIVE(dc->base.tb->flags);
> dc->vec_len = 0;
> dc->vec_stride = 0;
> dc->cp_regs = arm_cpu->cp_regs;
Otherwise
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
thanks
-- PMM
^ permalink raw reply [flat|nested] 47+ messages in thread
* [Qemu-devel] [PATCH 04/26] target/arm: Add PAuth helpers
2018-12-07 10:36 [Qemu-devel] [PATCH 00/26] target/arm: Implement ARMv8.3-PAuth Richard Henderson
` (2 preceding siblings ...)
2018-12-07 10:36 ` [Qemu-devel] [PATCH 03/26] target/arm: Add PAuth active bit to tbflags Richard Henderson
@ 2018-12-07 10:36 ` Richard Henderson
2018-12-07 10:36 ` [Qemu-devel] [PATCH 05/26] target/arm: Decode PAuth within system hint space Richard Henderson
` (21 subsequent siblings)
25 siblings, 0 replies; 47+ messages in thread
From: Richard Henderson @ 2018-12-07 10:36 UTC (permalink / raw)
To: qemu-devel; +Cc: peter.maydell, ramana.radhakrishnan
The cryptographic internals are stubbed out for now,
but the enable and trap bits are checked.
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
target/arm/helper-a64.h | 12 +++
target/arm/internals.h | 6 ++
target/arm/helper-a64.c | 169 ++++++++++++++++++++++++++++++++++++++++
3 files changed, 187 insertions(+)
diff --git a/target/arm/helper-a64.h b/target/arm/helper-a64.h
index 9d3a907049..70f6145b11 100644
--- a/target/arm/helper-a64.h
+++ b/target/arm/helper-a64.h
@@ -85,3 +85,15 @@ DEF_HELPER_2(advsimd_rinth, f16, f16, ptr)
DEF_HELPER_2(advsimd_f16tosinth, i32, f16, ptr)
DEF_HELPER_2(advsimd_f16touinth, i32, f16, ptr)
DEF_HELPER_2(sqrt_f16, f16, f16, ptr)
+
+DEF_HELPER_FLAGS_3(pacia, TCG_CALL_NO_WG, i64, env, i64, i64)
+DEF_HELPER_FLAGS_3(pacib, TCG_CALL_NO_WG, i64, env, i64, i64)
+DEF_HELPER_FLAGS_3(pacda, TCG_CALL_NO_WG, i64, env, i64, i64)
+DEF_HELPER_FLAGS_3(pacdb, TCG_CALL_NO_WG, i64, env, i64, i64)
+DEF_HELPER_FLAGS_3(pacga, TCG_CALL_NO_WG, i64, env, i64, i64)
+DEF_HELPER_FLAGS_3(autia, TCG_CALL_NO_WG, i64, env, i64, i64)
+DEF_HELPER_FLAGS_3(autib, TCG_CALL_NO_WG, i64, env, i64, i64)
+DEF_HELPER_FLAGS_3(autda, TCG_CALL_NO_WG, i64, env, i64, i64)
+DEF_HELPER_FLAGS_3(autdb, TCG_CALL_NO_WG, i64, env, i64, i64)
+DEF_HELPER_FLAGS_2(xpaci, TCG_CALL_NO_WG, i64, env, i64)
+DEF_HELPER_FLAGS_2(xpacd, TCG_CALL_NO_WG, i64, env, i64)
diff --git a/target/arm/internals.h b/target/arm/internals.h
index 78e026d6e9..6bc0daf560 100644
--- a/target/arm/internals.h
+++ b/target/arm/internals.h
@@ -259,6 +259,7 @@ enum arm_exception_class {
EC_CP14DTTRAP = 0x06,
EC_ADVSIMDFPACCESSTRAP = 0x07,
EC_FPIDTRAP = 0x08,
+ EC_PACTRAP = 0x09,
EC_CP14RRTTRAP = 0x0c,
EC_ILLEGALSTATE = 0x0e,
EC_AA32_SVC = 0x11,
@@ -426,6 +427,11 @@ static inline uint32_t syn_sve_access_trap(void)
return EC_SVEACCESSTRAP << ARM_EL_EC_SHIFT;
}
+static inline uint32_t syn_pactrap(void)
+{
+ return EC_PACTRAP << ARM_EL_EC_SHIFT;
+}
+
static inline uint32_t syn_insn_abort(int same_el, int ea, int s1ptw, int fsc)
{
return (EC_INSNABORT << ARM_EL_EC_SHIFT) | (same_el << ARM_EL_EC_SHIFT)
diff --git a/target/arm/helper-a64.c b/target/arm/helper-a64.c
index 61799d20e1..4aa34d4a3a 100644
--- a/target/arm/helper-a64.c
+++ b/target/arm/helper-a64.c
@@ -898,4 +898,173 @@ uint32_t HELPER(sqrt_f16)(uint32_t a, void *fpstp)
return float16_sqrt(a, s);
}
+/*
+ * Helpers for ARMv8.3-PAuth.
+ */
+static uint64_t pauth_computepac(uint64_t data, uint64_t modifier,
+ uint64_t key0, uint64_t key1)
+{
+ g_assert_not_reached(); /* FIXME */
+}
+
+static uint64_t pauth_addpac(CPUARMState *env, uint64_t ptr, uint64_t modifier,
+ uint64_t *key, bool data)
+{
+ g_assert_not_reached(); /* FIXME */
+}
+
+static uint64_t pauth_auth(CPUARMState *env, uint64_t ptr, uint64_t modifier,
+ uint64_t *key, bool data, int keynumber)
+{
+ g_assert_not_reached(); /* FIXME */
+}
+
+static uint64_t pauth_strip(CPUARMState *env, uint64_t a, bool data)
+{
+ g_assert_not_reached(); /* FIXME */
+}
+
+static void QEMU_NORETURN pauth_trap(CPUARMState *env, int target_el,
+ uintptr_t ra)
+{
+ CPUState *cs = ENV_GET_CPU(env);
+
+ cs->exception_index = EXCP_UDEF;
+ env->exception.syndrome = syn_pactrap();
+ env->exception.target_el = target_el;
+ cpu_loop_exit_restore(cs, ra);
+}
+
+static void pauth_check_trap(CPUARMState *env, int el, uintptr_t ra)
+{
+ if (el < 2 && arm_feature(env, ARM_FEATURE_EL2)) {
+ uint64_t hcr = arm_hcr_el2_eff(env);
+ bool trap = !(hcr & HCR_API);
+ /* FIXME: ARMv8.1-VHE: trap only applies to EL1&0 regime. */
+ /* FIXME: ARMv8.3-NV: HCR_NV trap takes precedence for ERETA[AB]. */
+ /* FIXME: PMM mentioned a "late breaking spec change" here. */
+ if (trap) {
+ pauth_trap(env, 2, ra);
+ }
+ }
+ if (el < 3 && arm_feature(env, ARM_FEATURE_EL3)) {
+ if (!(env->cp15.scr_el3 & SCR_API)) {
+ pauth_trap(env, 3, ra);
+ }
+ }
+}
+
+static bool pauth_key_enabled(CPUARMState *env, int el, uint32_t bit)
+{
+ uint32_t sctlr;
+ if (el == 0) {
+ /* FIXME: ARMv8.1-VHE S2 translation regime. */
+ sctlr = env->cp15.sctlr_el[1];
+ } else {
+ sctlr = env->cp15.sctlr_el[el];
+ }
+ return (sctlr & bit) != 0;
+}
+
+uint64_t HELPER(pacia)(CPUARMState *env, uint64_t x, uint64_t y)
+{
+ int el = arm_current_el(env);
+ if (!pauth_key_enabled(env, el, SCTLR_EnIA)) {
+ return x;
+ }
+ pauth_check_trap(env, el, GETPC());
+ return pauth_addpac(env, x, y, env->apia_key, false);
+}
+
+uint64_t HELPER(pacib)(CPUARMState *env, uint64_t x, uint64_t y)
+{
+ int el = arm_current_el(env);
+ if (!pauth_key_enabled(env, el, SCTLR_EnIB)) {
+ return x;
+ }
+ pauth_check_trap(env, el, GETPC());
+ return pauth_addpac(env, x, y, env->apib_key, false);
+}
+
+uint64_t HELPER(pacda)(CPUARMState *env, uint64_t x, uint64_t y)
+{
+ int el = arm_current_el(env);
+ if (!pauth_key_enabled(env, el, SCTLR_EnDA)) {
+ return x;
+ }
+ pauth_check_trap(env, el, GETPC());
+ return pauth_addpac(env, x, y, env->apda_key, true);
+}
+
+uint64_t HELPER(pacdb)(CPUARMState *env, uint64_t x, uint64_t y)
+{
+ int el = arm_current_el(env);
+ if (!pauth_key_enabled(env, el, SCTLR_EnDB)) {
+ return x;
+ }
+ pauth_check_trap(env, el, GETPC());
+ return pauth_addpac(env, x, y, env->apdb_key, true);
+}
+
+uint64_t HELPER(pacga)(CPUARMState *env, uint64_t x, uint64_t y)
+{
+ uint64_t pac;
+
+ pauth_check_trap(env, arm_current_el(env), GETPC());
+ pac = pauth_computepac(x, y, env->apga_key[1], env->apga_key[0]);
+
+ return pac & 0xffffffff00000000ull;
+}
+
+uint64_t HELPER(autia)(CPUARMState *env, uint64_t x, uint64_t y)
+{
+ int el = arm_current_el(env);
+ if (!pauth_key_enabled(env, el, SCTLR_EnIA)) {
+ return x;
+ }
+ pauth_check_trap(env, el, GETPC());
+ return pauth_auth(env, x, y, env->apia_key, false, 0);
+}
+
+uint64_t HELPER(autib)(CPUARMState *env, uint64_t x, uint64_t y)
+{
+ int el = arm_current_el(env);
+ if (!pauth_key_enabled(env, el, SCTLR_EnIB)) {
+ return x;
+ }
+ pauth_check_trap(env, el, GETPC());
+ return pauth_auth(env, x, y, env->apib_key, false, 1);
+}
+
+uint64_t HELPER(autda)(CPUARMState *env, uint64_t x, uint64_t y)
+{
+ int el = arm_current_el(env);
+ if (!pauth_key_enabled(env, el, SCTLR_EnDA)) {
+ return x;
+ }
+ pauth_check_trap(env, el, GETPC());
+ return pauth_auth(env, x, y, env->apda_key, true, 0);
+}
+
+uint64_t HELPER(autdb)(CPUARMState *env, uint64_t x, uint64_t y)
+{
+ int el = arm_current_el(env);
+ if (!pauth_key_enabled(env, el, SCTLR_EnDB)) {
+ return x;
+ }
+ pauth_check_trap(env, el, GETPC());
+ return pauth_auth(env, x, y, env->apdb_key, true, 1);
+}
+
+uint64_t HELPER(xpaci)(CPUARMState *env, uint64_t a)
+{
+ pauth_check_trap(env, arm_current_el(env), GETPC());
+ return pauth_strip(env, a, false);
+}
+
+uint64_t HELPER(xpacd)(CPUARMState *env, uint64_t a)
+{
+ pauth_check_trap(env, arm_current_el(env), GETPC());
+ return pauth_strip(env, a, true);
+}
--
2.17.2
^ permalink raw reply related [flat|nested] 47+ messages in thread* [Qemu-devel] [PATCH 05/26] target/arm: Decode PAuth within system hint space
2018-12-07 10:36 [Qemu-devel] [PATCH 00/26] target/arm: Implement ARMv8.3-PAuth Richard Henderson
` (3 preceding siblings ...)
2018-12-07 10:36 ` [Qemu-devel] [PATCH 04/26] target/arm: Add PAuth helpers Richard Henderson
@ 2018-12-07 10:36 ` Richard Henderson
2018-12-07 10:36 ` [Qemu-devel] [PATCH 06/26] target/arm: Rearrange decode in disas_data_proc_1src Richard Henderson
` (20 subsequent siblings)
25 siblings, 0 replies; 47+ messages in thread
From: Richard Henderson @ 2018-12-07 10:36 UTC (permalink / raw)
To: qemu-devel; +Cc: peter.maydell, ramana.radhakrishnan
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
target/arm/translate-a64.c | 93 +++++++++++++++++++++++++++++++++-----
1 file changed, 81 insertions(+), 12 deletions(-)
diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index 7c1cc1ce8e..0df344f9e8 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -1471,33 +1471,102 @@ static void handle_hint(DisasContext *s, uint32_t insn,
}
switch (selector) {
- case 0: /* NOP */
- return;
- case 3: /* WFI */
+ case 000: /* NOP */
+ break;
+ case 003: /* WFI */
s->base.is_jmp = DISAS_WFI;
- return;
+ break;
+ case 001: /* YIELD */
/* When running in MTTCG we don't generate jumps to the yield and
* WFE helpers as it won't affect the scheduling of other vCPUs.
* If we wanted to more completely model WFE/SEV so we don't busy
* spin unnecessarily we would need to do something more involved.
*/
- case 1: /* YIELD */
if (!(tb_cflags(s->base.tb) & CF_PARALLEL)) {
s->base.is_jmp = DISAS_YIELD;
}
- return;
- case 2: /* WFE */
+ break;
+ case 002: /* WFE */
if (!(tb_cflags(s->base.tb) & CF_PARALLEL)) {
s->base.is_jmp = DISAS_WFE;
}
- return;
- case 4: /* SEV */
- case 5: /* SEVL */
+ break;
+ case 004: /* SEV */
+ case 005: /* SEVL */
/* we treat all as NOP at least for now */
- return;
+ break;
+ case 007: /* XPACLRI */
+ if (s->pauth_active) {
+ gen_helper_xpaci(cpu_X[30], cpu_env, cpu_X[30]);
+ }
+ break;
+ case 010: /* PACIA1716 */
+ if (s->pauth_active) {
+ gen_helper_pacia(cpu_X[17], cpu_env, cpu_X[17], cpu_X[16]);
+ }
+ break;
+ case 012: /* PACIB1716 */
+ if (s->pauth_active) {
+ gen_helper_pacib(cpu_X[17], cpu_env, cpu_X[17], cpu_X[16]);
+ }
+ break;
+ case 014: /* AUTIA1716 */
+ if (s->pauth_active) {
+ gen_helper_autia(cpu_X[17], cpu_env, cpu_X[17], cpu_X[16]);
+ }
+ break;
+ case 016: /* AUTIB1716 */
+ if (s->pauth_active) {
+ gen_helper_autib(cpu_X[17], cpu_env, cpu_X[17], cpu_X[16]);
+ }
+ break;
+ case 030: /* PACIAZ */
+ if (s->pauth_active) {
+ gen_helper_pacia(cpu_X[30], cpu_env, cpu_X[30],
+ new_tmp_a64_zero(s));
+ }
+ break;
+ case 031: /* PACIASP */
+ if (s->pauth_active) {
+ gen_helper_pacia(cpu_X[30], cpu_env, cpu_X[30], cpu_X[31]);
+ }
+ break;
+ case 032: /* PACIBZ */
+ if (s->pauth_active) {
+ gen_helper_pacib(cpu_X[30], cpu_env, cpu_X[30],
+ new_tmp_a64_zero(s));
+ }
+ break;
+ case 033: /* PACIBSP */
+ if (s->pauth_active) {
+ gen_helper_pacib(cpu_X[30], cpu_env, cpu_X[30], cpu_X[31]);
+ }
+ break;
+ case 034: /* AUTIAZ */
+ if (s->pauth_active) {
+ gen_helper_autia(cpu_X[30], cpu_env, cpu_X[30],
+ new_tmp_a64_zero(s));
+ }
+ break;
+ case 035: /* AUTIASP */
+ if (s->pauth_active) {
+ gen_helper_autia(cpu_X[30], cpu_env, cpu_X[30], cpu_X[31]);
+ }
+ break;
+ case 036: /* AUTIBZ */
+ if (s->pauth_active) {
+ gen_helper_autib(cpu_X[30], cpu_env, cpu_X[30],
+ new_tmp_a64_zero(s));
+ }
+ break;
+ case 037: /* AUTIBSP */
+ if (s->pauth_active) {
+ gen_helper_autib(cpu_X[30], cpu_env, cpu_X[30], cpu_X[31]);
+ }
+ break;
default:
/* default specified as NOP equivalent */
- return;
+ break;
}
}
--
2.17.2
^ permalink raw reply related [flat|nested] 47+ messages in thread* [Qemu-devel] [PATCH 06/26] target/arm: Rearrange decode in disas_data_proc_1src
2018-12-07 10:36 [Qemu-devel] [PATCH 00/26] target/arm: Implement ARMv8.3-PAuth Richard Henderson
` (4 preceding siblings ...)
2018-12-07 10:36 ` [Qemu-devel] [PATCH 05/26] target/arm: Decode PAuth within system hint space Richard Henderson
@ 2018-12-07 10:36 ` Richard Henderson
2018-12-11 15:29 ` Peter Maydell
2018-12-07 10:36 ` [Qemu-devel] [PATCH 07/26] target/arm: Decode PAuth within disas_data_proc_1src Richard Henderson
` (19 subsequent siblings)
25 siblings, 1 reply; 47+ messages in thread
From: Richard Henderson @ 2018-12-07 10:36 UTC (permalink / raw)
To: qemu-devel; +Cc: peter.maydell, ramana.radhakrishnan
Now properly signals unallocated for REV64 with SF=0.
Allows for the opcode2 field to be decoded shortly.
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
target/arm/translate-a64.c | 31 ++++++++++++++++++++++---------
1 file changed, 22 insertions(+), 9 deletions(-)
diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index 0df344f9e8..c5ec430b42 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -4563,38 +4563,51 @@ static void handle_rev16(DisasContext *s, unsigned int sf,
*/
static void disas_data_proc_1src(DisasContext *s, uint32_t insn)
{
- unsigned int sf, opcode, rn, rd;
+ unsigned int sf, opcode, opcode2, rn, rd;
- if (extract32(insn, 29, 1) || extract32(insn, 16, 5)) {
+ if (extract32(insn, 29, 1)) {
unallocated_encoding(s);
return;
}
sf = extract32(insn, 31, 1);
opcode = extract32(insn, 10, 6);
+ opcode2 = extract32(insn, 16, 5);
rn = extract32(insn, 5, 5);
rd = extract32(insn, 0, 5);
- switch (opcode) {
- case 0: /* RBIT */
+#define MAP(SF, O2, O1) ((SF) | (O1 << 1) | (O2 << 7))
+
+ switch (MAP(sf, opcode2, opcode)) {
+ case MAP(0, 0x00, 0x00): /* RBIT */
+ case MAP(1, 0x00, 0x00):
handle_rbit(s, sf, rn, rd);
break;
- case 1: /* REV16 */
+ case MAP(0, 0x00, 0x01): /* REV16 */
+ case MAP(1, 0x00, 0x01):
handle_rev16(s, sf, rn, rd);
break;
- case 2: /* REV32 */
+ case MAP(0, 0x00, 0x02): /* REV/REV32 */
+ case MAP(1, 0x00, 0x02):
handle_rev32(s, sf, rn, rd);
break;
- case 3: /* REV64 */
+ case MAP(1, 0x00, 0x03): /* REV64 */
handle_rev64(s, sf, rn, rd);
break;
- case 4: /* CLZ */
+ case MAP(0, 0x00, 0x04): /* CLZ */
+ case MAP(1, 0x00, 0x04):
handle_clz(s, sf, rn, rd);
break;
- case 5: /* CLS */
+ case MAP(0, 0x00, 0x05): /* CLS */
+ case MAP(1, 0x00, 0x05):
handle_cls(s, sf, rn, rd);
break;
+ default:
+ unallocated_encoding(s);
+ break;
}
+
+#undef MAP
}
static void handle_div(DisasContext *s, bool is_signed, unsigned int sf,
--
2.17.2
^ permalink raw reply related [flat|nested] 47+ messages in thread* [Qemu-devel] [PATCH 07/26] target/arm: Decode PAuth within disas_data_proc_1src
2018-12-07 10:36 [Qemu-devel] [PATCH 00/26] target/arm: Implement ARMv8.3-PAuth Richard Henderson
` (5 preceding siblings ...)
2018-12-07 10:36 ` [Qemu-devel] [PATCH 06/26] target/arm: Rearrange decode in disas_data_proc_1src Richard Henderson
@ 2018-12-07 10:36 ` Richard Henderson
2018-12-07 10:36 ` [Qemu-devel] [PATCH 08/26] target/arm: Decode PAuth within disas_data_proc_2src Richard Henderson
` (18 subsequent siblings)
25 siblings, 0 replies; 47+ messages in thread
From: Richard Henderson @ 2018-12-07 10:36 UTC (permalink / raw)
To: qemu-devel; +Cc: peter.maydell, ramana.radhakrishnan
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
target/arm/translate-a64.c | 146 +++++++++++++++++++++++++++++++++++++
1 file changed, 146 insertions(+)
diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index c5ec430b42..7ba4c996cf 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -4564,6 +4564,7 @@ static void handle_rev16(DisasContext *s, unsigned int sf,
static void disas_data_proc_1src(DisasContext *s, uint32_t insn)
{
unsigned int sf, opcode, opcode2, rn, rd;
+ TCGv_i64 tcg_rd;
if (extract32(insn, 29, 1)) {
unallocated_encoding(s);
@@ -4602,7 +4603,152 @@ static void disas_data_proc_1src(DisasContext *s, uint32_t insn)
case MAP(1, 0x00, 0x05):
handle_cls(s, sf, rn, rd);
break;
+ case MAP(1, 0x01, 0x00): /* PACIA */
+ if (s->pauth_active) {
+ tcg_rd = cpu_reg(s, rd);
+ gen_helper_pacia(tcg_rd, cpu_env, tcg_rd, cpu_reg_sp(s, rn));
+ } else if (!dc_isar_feature(aa64_pauth, s)) {
+ goto do_unallocated;
+ }
+ break;
+ case MAP(1, 0x01, 0x01): /* PACIB */
+ if (s->pauth_active) {
+ tcg_rd = cpu_reg(s, rd);
+ gen_helper_pacib(tcg_rd, cpu_env, tcg_rd, cpu_reg_sp(s, rn));
+ } else if (!dc_isar_feature(aa64_pauth, s)) {
+ goto do_unallocated;
+ }
+ break;
+ case MAP(1, 0x01, 0x02): /* PACDA */
+ if (s->pauth_active) {
+ tcg_rd = cpu_reg(s, rd);
+ gen_helper_pacda(tcg_rd, cpu_env, tcg_rd, cpu_reg_sp(s, rn));
+ } else if (!dc_isar_feature(aa64_pauth, s)) {
+ goto do_unallocated;
+ }
+ break;
+ case MAP(1, 0x01, 0x03): /* PACDB */
+ if (s->pauth_active) {
+ tcg_rd = cpu_reg(s, rd);
+ gen_helper_pacdb(tcg_rd, cpu_env, tcg_rd, cpu_reg_sp(s, rn));
+ } else if (!dc_isar_feature(aa64_pauth, s)) {
+ goto do_unallocated;
+ }
+ break;
+ case MAP(1, 0x01, 0x04): /* AUTIA */
+ if (s->pauth_active) {
+ tcg_rd = cpu_reg(s, rd);
+ gen_helper_autia(tcg_rd, cpu_env, tcg_rd, cpu_reg_sp(s, rn));
+ } else if (!dc_isar_feature(aa64_pauth, s)) {
+ goto do_unallocated;
+ }
+ break;
+ case MAP(1, 0x01, 0x05): /* AUTIB */
+ if (s->pauth_active) {
+ tcg_rd = cpu_reg(s, rd);
+ gen_helper_autib(tcg_rd, cpu_env, tcg_rd, cpu_reg_sp(s, rn));
+ } else if (!dc_isar_feature(aa64_pauth, s)) {
+ goto do_unallocated;
+ }
+ break;
+ case MAP(1, 0x01, 0x06): /* AUTDA */
+ if (s->pauth_active) {
+ tcg_rd = cpu_reg(s, rd);
+ gen_helper_autda(tcg_rd, cpu_env, tcg_rd, cpu_reg_sp(s, rn));
+ } else if (!dc_isar_feature(aa64_pauth, s)) {
+ goto do_unallocated;
+ }
+ break;
+ case MAP(1, 0x01, 0x07): /* AUTDB */
+ if (s->pauth_active) {
+ tcg_rd = cpu_reg(s, rd);
+ gen_helper_autdb(tcg_rd, cpu_env, tcg_rd, cpu_reg_sp(s, rn));
+ } else if (!dc_isar_feature(aa64_pauth, s)) {
+ goto do_unallocated;
+ }
+ break;
+ case MAP(1, 0x01, 0x08): /* PACIZA */
+ if (!dc_isar_feature(aa64_pauth, s) || rn != 31) {
+ goto do_unallocated;
+ } else if (s->pauth_active) {
+ tcg_rd = cpu_reg(s, rd);
+ gen_helper_pacia(tcg_rd, cpu_env, tcg_rd, new_tmp_a64_zero(s));
+ }
+ break;
+ case MAP(1, 0x01, 0x09): /* PACIZB */
+ if (!dc_isar_feature(aa64_pauth, s) || rn != 31) {
+ goto do_unallocated;
+ } else if (s->pauth_active) {
+ tcg_rd = cpu_reg(s, rd);
+ gen_helper_pacib(tcg_rd, cpu_env, tcg_rd, new_tmp_a64_zero(s));
+ }
+ break;
+ case MAP(1, 0x01, 0x0a): /* PACDZA */
+ if (!dc_isar_feature(aa64_pauth, s) || rn != 31) {
+ goto do_unallocated;
+ } else if (s->pauth_active) {
+ tcg_rd = cpu_reg(s, rd);
+ gen_helper_pacda(tcg_rd, cpu_env, tcg_rd, new_tmp_a64_zero(s));
+ }
+ break;
+ case MAP(1, 0x01, 0x0b): /* PACDZB */
+ if (!dc_isar_feature(aa64_pauth, s) || rn != 31) {
+ goto do_unallocated;
+ } else if (s->pauth_active) {
+ tcg_rd = cpu_reg(s, rd);
+ gen_helper_pacdb(tcg_rd, cpu_env, tcg_rd, new_tmp_a64_zero(s));
+ }
+ break;
+ case MAP(1, 0x01, 0x0c): /* AUTIZA */
+ if (!dc_isar_feature(aa64_pauth, s) || rn != 31) {
+ goto do_unallocated;
+ } else if (s->pauth_active) {
+ tcg_rd = cpu_reg(s, rd);
+ gen_helper_autia(tcg_rd, cpu_env, tcg_rd, new_tmp_a64_zero(s));
+ }
+ break;
+ case MAP(1, 0x01, 0x0d): /* AUTIZB */
+ if (!dc_isar_feature(aa64_pauth, s) || rn != 31) {
+ goto do_unallocated;
+ } else if (s->pauth_active) {
+ tcg_rd = cpu_reg(s, rd);
+ gen_helper_autib(tcg_rd, cpu_env, tcg_rd, new_tmp_a64_zero(s));
+ }
+ break;
+ case MAP(1, 0x01, 0x0e): /* AUTDZA */
+ if (!dc_isar_feature(aa64_pauth, s) || rn != 31) {
+ goto do_unallocated;
+ } else if (s->pauth_active) {
+ tcg_rd = cpu_reg(s, rd);
+ gen_helper_autda(tcg_rd, cpu_env, tcg_rd, new_tmp_a64_zero(s));
+ }
+ break;
+ case MAP(1, 0x01, 0x0f): /* AUTDZB */
+ if (!dc_isar_feature(aa64_pauth, s) || rn != 31) {
+ goto do_unallocated;
+ } else if (s->pauth_active) {
+ tcg_rd = cpu_reg(s, rd);
+ gen_helper_autdb(tcg_rd, cpu_env, tcg_rd, new_tmp_a64_zero(s));
+ }
+ break;
+ case MAP(1, 0x01, 0x10): /* XPACI */
+ if (!dc_isar_feature(aa64_pauth, s) || rn != 31) {
+ goto do_unallocated;
+ } else if (s->pauth_active) {
+ tcg_rd = cpu_reg(s, rd);
+ gen_helper_xpaci(tcg_rd, cpu_env, tcg_rd);
+ }
+ break;
+ case MAP(1, 0x01, 0x11): /* XPACD */
+ if (!dc_isar_feature(aa64_pauth, s) || rn != 31) {
+ goto do_unallocated;
+ } else if (s->pauth_active) {
+ tcg_rd = cpu_reg(s, rd);
+ gen_helper_xpacd(tcg_rd, cpu_env, tcg_rd);
+ }
+ break;
default:
+ do_unallocated:
unallocated_encoding(s);
break;
}
--
2.17.2
^ permalink raw reply related [flat|nested] 47+ messages in thread* [Qemu-devel] [PATCH 08/26] target/arm: Decode PAuth within disas_data_proc_2src
2018-12-07 10:36 [Qemu-devel] [PATCH 00/26] target/arm: Implement ARMv8.3-PAuth Richard Henderson
` (6 preceding siblings ...)
2018-12-07 10:36 ` [Qemu-devel] [PATCH 07/26] target/arm: Decode PAuth within disas_data_proc_1src Richard Henderson
@ 2018-12-07 10:36 ` Richard Henderson
2018-12-11 15:31 ` Peter Maydell
2018-12-07 10:36 ` [Qemu-devel] [PATCH 09/26] target/arm: Move helper_exception_return to helper-a64.c Richard Henderson
` (17 subsequent siblings)
25 siblings, 1 reply; 47+ messages in thread
From: Richard Henderson @ 2018-12-07 10:36 UTC (permalink / raw)
To: qemu-devel; +Cc: peter.maydell, ramana.radhakrishnan
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
target/arm/translate-a64.c | 8 ++++++++
1 file changed, 8 insertions(+)
diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index 7ba4c996cf..d034a5edf3 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -4884,6 +4884,13 @@ static void disas_data_proc_2src(DisasContext *s, uint32_t insn)
case 11: /* RORV */
handle_shift_reg(s, A64_SHIFT_TYPE_ROR, sf, rm, rn, rd);
break;
+ case 12: /* PACGA */
+ if (sf == 0 || !dc_isar_feature(aa64_pauth, s)) {
+ goto do_unallocated;
+ }
+ gen_helper_pacga(cpu_reg(s, rd), cpu_env,
+ cpu_reg(s, rn), cpu_reg_sp(s, rm));
+ break;
case 16:
case 17:
case 18:
@@ -4899,6 +4906,7 @@ static void disas_data_proc_2src(DisasContext *s, uint32_t insn)
break;
}
default:
+ do_unallocated:
unallocated_encoding(s);
break;
}
--
2.17.2
^ permalink raw reply related [flat|nested] 47+ messages in thread* Re: [Qemu-devel] [PATCH 08/26] target/arm: Decode PAuth within disas_data_proc_2src
2018-12-07 10:36 ` [Qemu-devel] [PATCH 08/26] target/arm: Decode PAuth within disas_data_proc_2src Richard Henderson
@ 2018-12-11 15:31 ` Peter Maydell
0 siblings, 0 replies; 47+ messages in thread
From: Peter Maydell @ 2018-12-11 15:31 UTC (permalink / raw)
To: Richard Henderson; +Cc: QEMU Developers, Ramana Radhakrishnan
On Fri, 7 Dec 2018 at 10:36, Richard Henderson
<richard.henderson@linaro.org> wrote:
>
> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
> ---
> target/arm/translate-a64.c | 8 ++++++++
> 1 file changed, 8 insertions(+)
>
> diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
> index 7ba4c996cf..d034a5edf3 100644
> --- a/target/arm/translate-a64.c
> +++ b/target/arm/translate-a64.c
> @@ -4884,6 +4884,13 @@ static void disas_data_proc_2src(DisasContext *s, uint32_t insn)
> case 11: /* RORV */
> handle_shift_reg(s, A64_SHIFT_TYPE_ROR, sf, rm, rn, rd);
> break;
> + case 12: /* PACGA */
> + if (sf == 0 || !dc_isar_feature(aa64_pauth, s)) {
> + goto do_unallocated;
> + }
> + gen_helper_pacga(cpu_reg(s, rd), cpu_env,
> + cpu_reg(s, rn), cpu_reg_sp(s, rm));
> + break;
> case 16:
> case 17:
> case 18:
> @@ -4899,6 +4906,7 @@ static void disas_data_proc_2src(DisasContext *s, uint32_t insn)
> break;
> }
> default:
> + do_unallocated:
> unallocated_encoding(s);
> break;
> }
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
thanks
-- PMM
^ permalink raw reply [flat|nested] 47+ messages in thread
* [Qemu-devel] [PATCH 09/26] target/arm: Move helper_exception_return to helper-a64.c
2018-12-07 10:36 [Qemu-devel] [PATCH 00/26] target/arm: Implement ARMv8.3-PAuth Richard Henderson
` (7 preceding siblings ...)
2018-12-07 10:36 ` [Qemu-devel] [PATCH 08/26] target/arm: Decode PAuth within disas_data_proc_2src Richard Henderson
@ 2018-12-07 10:36 ` Richard Henderson
2018-12-11 15:33 ` Peter Maydell
2018-12-07 10:36 ` [Qemu-devel] [PATCH 10/26] target/arm: Add new_pc argument to helper_exception_return Richard Henderson
` (16 subsequent siblings)
25 siblings, 1 reply; 47+ messages in thread
From: Richard Henderson @ 2018-12-07 10:36 UTC (permalink / raw)
To: qemu-devel; +Cc: peter.maydell, ramana.radhakrishnan
This function is only used by AArch64. Code movement only.
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
target/arm/helper-a64.h | 2 +
target/arm/helper.h | 1 -
target/arm/helper-a64.c | 155 ++++++++++++++++++++++++++++++++++++++++
target/arm/op_helper.c | 155 ----------------------------------------
4 files changed, 157 insertions(+), 156 deletions(-)
diff --git a/target/arm/helper-a64.h b/target/arm/helper-a64.h
index 70f6145b11..cb7209eb31 100644
--- a/target/arm/helper-a64.h
+++ b/target/arm/helper-a64.h
@@ -86,6 +86,8 @@ DEF_HELPER_2(advsimd_f16tosinth, i32, f16, ptr)
DEF_HELPER_2(advsimd_f16touinth, i32, f16, ptr)
DEF_HELPER_2(sqrt_f16, f16, f16, ptr)
+DEF_HELPER_1(exception_return, void, env)
+
DEF_HELPER_FLAGS_3(pacia, TCG_CALL_NO_WG, i64, env, i64, i64)
DEF_HELPER_FLAGS_3(pacib, TCG_CALL_NO_WG, i64, env, i64, i64)
DEF_HELPER_FLAGS_3(pacda, TCG_CALL_NO_WG, i64, env, i64, i64)
diff --git a/target/arm/helper.h b/target/arm/helper.h
index 8c9590091b..53a38188c6 100644
--- a/target/arm/helper.h
+++ b/target/arm/helper.h
@@ -79,7 +79,6 @@ DEF_HELPER_2(get_cp_reg64, i64, env, ptr)
DEF_HELPER_3(msr_i_pstate, void, env, i32, i32)
DEF_HELPER_1(clear_pstate_ss, void, env)
-DEF_HELPER_1(exception_return, void, env)
DEF_HELPER_2(get_r13_banked, i32, env, i32)
DEF_HELPER_3(set_r13_banked, void, env, i32, i32)
diff --git a/target/arm/helper-a64.c b/target/arm/helper-a64.c
index 4aa34d4a3a..92e751fa07 100644
--- a/target/arm/helper-a64.c
+++ b/target/arm/helper-a64.c
@@ -887,6 +887,161 @@ uint32_t HELPER(advsimd_f16touinth)(uint32_t a, void *fpstp)
return float16_to_uint16(a, fpst);
}
+static int el_from_spsr(uint32_t spsr)
+{
+ /* Return the exception level that this SPSR is requesting a return to,
+ * or -1 if it is invalid (an illegal return)
+ */
+ if (spsr & PSTATE_nRW) {
+ switch (spsr & CPSR_M) {
+ case ARM_CPU_MODE_USR:
+ return 0;
+ case ARM_CPU_MODE_HYP:
+ return 2;
+ case ARM_CPU_MODE_FIQ:
+ case ARM_CPU_MODE_IRQ:
+ case ARM_CPU_MODE_SVC:
+ case ARM_CPU_MODE_ABT:
+ case ARM_CPU_MODE_UND:
+ case ARM_CPU_MODE_SYS:
+ return 1;
+ case ARM_CPU_MODE_MON:
+ /* Returning to Mon from AArch64 is never possible,
+ * so this is an illegal return.
+ */
+ default:
+ return -1;
+ }
+ } else {
+ if (extract32(spsr, 1, 1)) {
+ /* Return with reserved M[1] bit set */
+ return -1;
+ }
+ if (extract32(spsr, 0, 4) == 1) {
+ /* return to EL0 with M[0] bit set */
+ return -1;
+ }
+ return extract32(spsr, 2, 2);
+ }
+}
+
+void HELPER(exception_return)(CPUARMState *env)
+{
+ int cur_el = arm_current_el(env);
+ unsigned int spsr_idx = aarch64_banked_spsr_index(cur_el);
+ uint32_t spsr = env->banked_spsr[spsr_idx];
+ int new_el;
+ bool return_to_aa64 = (spsr & PSTATE_nRW) == 0;
+
+ aarch64_save_sp(env, cur_el);
+
+ arm_clear_exclusive(env);
+
+ /* We must squash the PSTATE.SS bit to zero unless both of the
+ * following hold:
+ * 1. debug exceptions are currently disabled
+ * 2. singlestep will be active in the EL we return to
+ * We check 1 here and 2 after we've done the pstate/cpsr write() to
+ * transition to the EL we're going to.
+ */
+ if (arm_generate_debug_exceptions(env)) {
+ spsr &= ~PSTATE_SS;
+ }
+
+ new_el = el_from_spsr(spsr);
+ if (new_el == -1) {
+ goto illegal_return;
+ }
+ if (new_el > cur_el
+ || (new_el == 2 && !arm_feature(env, ARM_FEATURE_EL2))) {
+ /* Disallow return to an EL which is unimplemented or higher
+ * than the current one.
+ */
+ goto illegal_return;
+ }
+
+ if (new_el != 0 && arm_el_is_aa64(env, new_el) != return_to_aa64) {
+ /* Return to an EL which is configured for a different register width */
+ goto illegal_return;
+ }
+
+ if (new_el == 2 && arm_is_secure_below_el3(env)) {
+ /* Return to the non-existent secure-EL2 */
+ goto illegal_return;
+ }
+
+ if (new_el == 1 && (arm_hcr_el2_eff(env) & HCR_TGE)) {
+ goto illegal_return;
+ }
+
+ qemu_mutex_lock_iothread();
+ arm_call_pre_el_change_hook(arm_env_get_cpu(env));
+ qemu_mutex_unlock_iothread();
+
+ if (!return_to_aa64) {
+ env->aarch64 = 0;
+ /* We do a raw CPSR write because aarch64_sync_64_to_32()
+ * will sort the register banks out for us, and we've already
+ * caught all the bad-mode cases in el_from_spsr().
+ */
+ cpsr_write(env, spsr, ~0, CPSRWriteRaw);
+ if (!arm_singlestep_active(env)) {
+ env->uncached_cpsr &= ~PSTATE_SS;
+ }
+ aarch64_sync_64_to_32(env);
+
+ if (spsr & CPSR_T) {
+ env->regs[15] = env->elr_el[cur_el] & ~0x1;
+ } else {
+ env->regs[15] = env->elr_el[cur_el] & ~0x3;
+ }
+ qemu_log_mask(CPU_LOG_INT, "Exception return from AArch64 EL%d to "
+ "AArch32 EL%d PC 0x%" PRIx32 "\n",
+ cur_el, new_el, env->regs[15]);
+ } else {
+ env->aarch64 = 1;
+ pstate_write(env, spsr);
+ if (!arm_singlestep_active(env)) {
+ env->pstate &= ~PSTATE_SS;
+ }
+ aarch64_restore_sp(env, new_el);
+ env->pc = env->elr_el[cur_el];
+ qemu_log_mask(CPU_LOG_INT, "Exception return from AArch64 EL%d to "
+ "AArch64 EL%d PC 0x%" PRIx64 "\n",
+ cur_el, new_el, env->pc);
+ }
+ /*
+ * Note that cur_el can never be 0. If new_el is 0, then
+ * el0_a64 is return_to_aa64, else el0_a64 is ignored.
+ */
+ aarch64_sve_change_el(env, cur_el, new_el, return_to_aa64);
+
+ qemu_mutex_lock_iothread();
+ arm_call_el_change_hook(arm_env_get_cpu(env));
+ qemu_mutex_unlock_iothread();
+
+ return;
+
+illegal_return:
+ /* Illegal return events of various kinds have architecturally
+ * mandated behaviour:
+ * restore NZCV and DAIF from SPSR_ELx
+ * set PSTATE.IL
+ * restore PC from ELR_ELx
+ * no change to exception level, execution state or stack pointer
+ */
+ env->pstate |= PSTATE_IL;
+ env->pc = env->elr_el[cur_el];
+ spsr &= PSTATE_NZCV | PSTATE_DAIF;
+ spsr |= pstate_read(env) & ~(PSTATE_NZCV | PSTATE_DAIF);
+ pstate_write(env, spsr);
+ if (!arm_singlestep_active(env)) {
+ env->pstate &= ~PSTATE_SS;
+ }
+ qemu_log_mask(LOG_GUEST_ERROR, "Illegal exception return at EL%d: "
+ "resuming execution at 0x%" PRIx64 "\n", cur_el, env->pc);
+}
+
/*
* Square Root and Reciprocal square root
*/
diff --git a/target/arm/op_helper.c b/target/arm/op_helper.c
index ef72361a36..24229981cd 100644
--- a/target/arm/op_helper.c
+++ b/target/arm/op_helper.c
@@ -1014,161 +1014,6 @@ void HELPER(pre_smc)(CPUARMState *env, uint32_t syndrome)
}
}
-static int el_from_spsr(uint32_t spsr)
-{
- /* Return the exception level that this SPSR is requesting a return to,
- * or -1 if it is invalid (an illegal return)
- */
- if (spsr & PSTATE_nRW) {
- switch (spsr & CPSR_M) {
- case ARM_CPU_MODE_USR:
- return 0;
- case ARM_CPU_MODE_HYP:
- return 2;
- case ARM_CPU_MODE_FIQ:
- case ARM_CPU_MODE_IRQ:
- case ARM_CPU_MODE_SVC:
- case ARM_CPU_MODE_ABT:
- case ARM_CPU_MODE_UND:
- case ARM_CPU_MODE_SYS:
- return 1;
- case ARM_CPU_MODE_MON:
- /* Returning to Mon from AArch64 is never possible,
- * so this is an illegal return.
- */
- default:
- return -1;
- }
- } else {
- if (extract32(spsr, 1, 1)) {
- /* Return with reserved M[1] bit set */
- return -1;
- }
- if (extract32(spsr, 0, 4) == 1) {
- /* return to EL0 with M[0] bit set */
- return -1;
- }
- return extract32(spsr, 2, 2);
- }
-}
-
-void HELPER(exception_return)(CPUARMState *env)
-{
- int cur_el = arm_current_el(env);
- unsigned int spsr_idx = aarch64_banked_spsr_index(cur_el);
- uint32_t spsr = env->banked_spsr[spsr_idx];
- int new_el;
- bool return_to_aa64 = (spsr & PSTATE_nRW) == 0;
-
- aarch64_save_sp(env, cur_el);
-
- arm_clear_exclusive(env);
-
- /* We must squash the PSTATE.SS bit to zero unless both of the
- * following hold:
- * 1. debug exceptions are currently disabled
- * 2. singlestep will be active in the EL we return to
- * We check 1 here and 2 after we've done the pstate/cpsr write() to
- * transition to the EL we're going to.
- */
- if (arm_generate_debug_exceptions(env)) {
- spsr &= ~PSTATE_SS;
- }
-
- new_el = el_from_spsr(spsr);
- if (new_el == -1) {
- goto illegal_return;
- }
- if (new_el > cur_el
- || (new_el == 2 && !arm_feature(env, ARM_FEATURE_EL2))) {
- /* Disallow return to an EL which is unimplemented or higher
- * than the current one.
- */
- goto illegal_return;
- }
-
- if (new_el != 0 && arm_el_is_aa64(env, new_el) != return_to_aa64) {
- /* Return to an EL which is configured for a different register width */
- goto illegal_return;
- }
-
- if (new_el == 2 && arm_is_secure_below_el3(env)) {
- /* Return to the non-existent secure-EL2 */
- goto illegal_return;
- }
-
- if (new_el == 1 && (arm_hcr_el2_eff(env) & HCR_TGE)) {
- goto illegal_return;
- }
-
- qemu_mutex_lock_iothread();
- arm_call_pre_el_change_hook(arm_env_get_cpu(env));
- qemu_mutex_unlock_iothread();
-
- if (!return_to_aa64) {
- env->aarch64 = 0;
- /* We do a raw CPSR write because aarch64_sync_64_to_32()
- * will sort the register banks out for us, and we've already
- * caught all the bad-mode cases in el_from_spsr().
- */
- cpsr_write(env, spsr, ~0, CPSRWriteRaw);
- if (!arm_singlestep_active(env)) {
- env->uncached_cpsr &= ~PSTATE_SS;
- }
- aarch64_sync_64_to_32(env);
-
- if (spsr & CPSR_T) {
- env->regs[15] = env->elr_el[cur_el] & ~0x1;
- } else {
- env->regs[15] = env->elr_el[cur_el] & ~0x3;
- }
- qemu_log_mask(CPU_LOG_INT, "Exception return from AArch64 EL%d to "
- "AArch32 EL%d PC 0x%" PRIx32 "\n",
- cur_el, new_el, env->regs[15]);
- } else {
- env->aarch64 = 1;
- pstate_write(env, spsr);
- if (!arm_singlestep_active(env)) {
- env->pstate &= ~PSTATE_SS;
- }
- aarch64_restore_sp(env, new_el);
- env->pc = env->elr_el[cur_el];
- qemu_log_mask(CPU_LOG_INT, "Exception return from AArch64 EL%d to "
- "AArch64 EL%d PC 0x%" PRIx64 "\n",
- cur_el, new_el, env->pc);
- }
- /*
- * Note that cur_el can never be 0. If new_el is 0, then
- * el0_a64 is return_to_aa64, else el0_a64 is ignored.
- */
- aarch64_sve_change_el(env, cur_el, new_el, return_to_aa64);
-
- qemu_mutex_lock_iothread();
- arm_call_el_change_hook(arm_env_get_cpu(env));
- qemu_mutex_unlock_iothread();
-
- return;
-
-illegal_return:
- /* Illegal return events of various kinds have architecturally
- * mandated behaviour:
- * restore NZCV and DAIF from SPSR_ELx
- * set PSTATE.IL
- * restore PC from ELR_ELx
- * no change to exception level, execution state or stack pointer
- */
- env->pstate |= PSTATE_IL;
- env->pc = env->elr_el[cur_el];
- spsr &= PSTATE_NZCV | PSTATE_DAIF;
- spsr |= pstate_read(env) & ~(PSTATE_NZCV | PSTATE_DAIF);
- pstate_write(env, spsr);
- if (!arm_singlestep_active(env)) {
- env->pstate &= ~PSTATE_SS;
- }
- qemu_log_mask(LOG_GUEST_ERROR, "Illegal exception return at EL%d: "
- "resuming execution at 0x%" PRIx64 "\n", cur_el, env->pc);
-}
-
/* Return true if the linked breakpoint entry lbn passes its checks */
static bool linked_bp_matches(ARMCPU *cpu, int lbn)
{
--
2.17.2
^ permalink raw reply related [flat|nested] 47+ messages in thread* [Qemu-devel] [PATCH 10/26] target/arm: Add new_pc argument to helper_exception_return
2018-12-07 10:36 [Qemu-devel] [PATCH 00/26] target/arm: Implement ARMv8.3-PAuth Richard Henderson
` (8 preceding siblings ...)
2018-12-07 10:36 ` [Qemu-devel] [PATCH 09/26] target/arm: Move helper_exception_return to helper-a64.c Richard Henderson
@ 2018-12-07 10:36 ` Richard Henderson
2018-12-11 15:34 ` Peter Maydell
2018-12-07 10:36 ` [Qemu-devel] [PATCH 11/26] target/arm: Rearrange decode in disas_uncond_b_reg Richard Henderson
` (15 subsequent siblings)
25 siblings, 1 reply; 47+ messages in thread
From: Richard Henderson @ 2018-12-07 10:36 UTC (permalink / raw)
To: qemu-devel; +Cc: peter.maydell, ramana.radhakrishnan
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
target/arm/helper-a64.h | 2 +-
target/arm/helper-a64.c | 10 +++++-----
target/arm/translate-a64.c | 7 ++++++-
3 files changed, 12 insertions(+), 7 deletions(-)
diff --git a/target/arm/helper-a64.h b/target/arm/helper-a64.h
index cb7209eb31..b54ce59c48 100644
--- a/target/arm/helper-a64.h
+++ b/target/arm/helper-a64.h
@@ -86,7 +86,7 @@ DEF_HELPER_2(advsimd_f16tosinth, i32, f16, ptr)
DEF_HELPER_2(advsimd_f16touinth, i32, f16, ptr)
DEF_HELPER_2(sqrt_f16, f16, f16, ptr)
-DEF_HELPER_1(exception_return, void, env)
+DEF_HELPER_2(exception_return, void, env, i64)
DEF_HELPER_FLAGS_3(pacia, TCG_CALL_NO_WG, i64, env, i64, i64)
DEF_HELPER_FLAGS_3(pacib, TCG_CALL_NO_WG, i64, env, i64, i64)
diff --git a/target/arm/helper-a64.c b/target/arm/helper-a64.c
index 92e751fa07..0818fd5451 100644
--- a/target/arm/helper-a64.c
+++ b/target/arm/helper-a64.c
@@ -925,7 +925,7 @@ static int el_from_spsr(uint32_t spsr)
}
}
-void HELPER(exception_return)(CPUARMState *env)
+void HELPER(exception_return)(CPUARMState *env, uint64_t new_pc)
{
int cur_el = arm_current_el(env);
unsigned int spsr_idx = aarch64_banked_spsr_index(cur_el);
@@ -991,9 +991,9 @@ void HELPER(exception_return)(CPUARMState *env)
aarch64_sync_64_to_32(env);
if (spsr & CPSR_T) {
- env->regs[15] = env->elr_el[cur_el] & ~0x1;
+ env->regs[15] = new_pc & ~0x1;
} else {
- env->regs[15] = env->elr_el[cur_el] & ~0x3;
+ env->regs[15] = new_pc & ~0x3;
}
qemu_log_mask(CPU_LOG_INT, "Exception return from AArch64 EL%d to "
"AArch32 EL%d PC 0x%" PRIx32 "\n",
@@ -1005,7 +1005,7 @@ void HELPER(exception_return)(CPUARMState *env)
env->pstate &= ~PSTATE_SS;
}
aarch64_restore_sp(env, new_el);
- env->pc = env->elr_el[cur_el];
+ env->pc = new_pc;
qemu_log_mask(CPU_LOG_INT, "Exception return from AArch64 EL%d to "
"AArch64 EL%d PC 0x%" PRIx64 "\n",
cur_el, new_el, env->pc);
@@ -1031,7 +1031,7 @@ illegal_return:
* no change to exception level, execution state or stack pointer
*/
env->pstate |= PSTATE_IL;
- env->pc = env->elr_el[cur_el];
+ env->pc = new_pc;
spsr &= PSTATE_NZCV | PSTATE_DAIF;
spsr |= pstate_read(env) & ~(PSTATE_NZCV | PSTATE_DAIF);
pstate_write(env, spsr);
diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index d034a5edf3..c84c2dbb66 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -1981,6 +1981,7 @@ static void disas_exc(DisasContext *s, uint32_t insn)
static void disas_uncond_b_reg(DisasContext *s, uint32_t insn)
{
unsigned int opc, op2, op3, rn, op4;
+ TCGv_i64 dst;
opc = extract32(insn, 21, 4);
op2 = extract32(insn, 16, 5);
@@ -2011,7 +2012,11 @@ static void disas_uncond_b_reg(DisasContext *s, uint32_t insn)
if (tb_cflags(s->base.tb) & CF_USE_ICOUNT) {
gen_io_start();
}
- gen_helper_exception_return(cpu_env);
+ dst = tcg_temp_new_i64();
+ tcg_gen_ld_i64(dst, cpu_env,
+ offsetof(CPUARMState, elr_el[s->current_el]));
+ gen_helper_exception_return(cpu_env, dst);
+ tcg_temp_free_i64(dst);
if (tb_cflags(s->base.tb) & CF_USE_ICOUNT) {
gen_io_end();
}
--
2.17.2
^ permalink raw reply related [flat|nested] 47+ messages in thread* [Qemu-devel] [PATCH 11/26] target/arm: Rearrange decode in disas_uncond_b_reg
2018-12-07 10:36 [Qemu-devel] [PATCH 00/26] target/arm: Implement ARMv8.3-PAuth Richard Henderson
` (9 preceding siblings ...)
2018-12-07 10:36 ` [Qemu-devel] [PATCH 10/26] target/arm: Add new_pc argument to helper_exception_return Richard Henderson
@ 2018-12-07 10:36 ` Richard Henderson
2018-12-11 15:40 ` Peter Maydell
2018-12-07 10:36 ` [Qemu-devel] [PATCH 12/26] target/arm: Decode PAuth within disas_uncond_b_reg Richard Henderson
` (14 subsequent siblings)
25 siblings, 1 reply; 47+ messages in thread
From: Richard Henderson @ 2018-12-07 10:36 UTC (permalink / raw)
To: qemu-devel; +Cc: peter.maydell, ramana.radhakrishnan
This will enable PAuth decode in a subsequent patch.
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
target/arm/translate-a64.c | 34 +++++++++++++++++++++++-----------
1 file changed, 23 insertions(+), 11 deletions(-)
diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index c84c2dbb66..5fa2647771 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -1989,32 +1989,41 @@ static void disas_uncond_b_reg(DisasContext *s, uint32_t insn)
rn = extract32(insn, 5, 5);
op4 = extract32(insn, 0, 5);
- if (op4 != 0x0 || op3 != 0x0 || op2 != 0x1f) {
- unallocated_encoding(s);
- return;
+ if (op2 != 0x1f) {
+ goto do_unallocated;
}
switch (opc) {
case 0: /* BR */
case 1: /* BLR */
case 2: /* RET */
- gen_a64_set_pc(s, cpu_reg(s, rn));
+ if (op3 == 0 && op4 == 0) {
+ dst = cpu_reg(s, rn);
+ } else {
+ goto do_unallocated;
+ }
+ gen_a64_set_pc(s, dst);
/* BLR also needs to load return address */
if (opc == 1) {
tcg_gen_movi_i64(cpu_reg(s, 30), s->pc);
}
break;
+
case 4: /* ERET */
if (s->current_el == 0) {
- unallocated_encoding(s);
- return;
- }
- if (tb_cflags(s->base.tb) & CF_USE_ICOUNT) {
- gen_io_start();
+ goto do_unallocated;
}
dst = tcg_temp_new_i64();
tcg_gen_ld_i64(dst, cpu_env,
offsetof(CPUARMState, elr_el[s->current_el]));
+ if (op3 == 0 && op4 == 0) {
+ ;
+ } else {
+ goto do_unallocated;
+ }
+ if (tb_cflags(s->base.tb) & CF_USE_ICOUNT) {
+ gen_io_start();
+ }
gen_helper_exception_return(cpu_env, dst);
tcg_temp_free_i64(dst);
if (tb_cflags(s->base.tb) & CF_USE_ICOUNT) {
@@ -2023,14 +2032,17 @@ static void disas_uncond_b_reg(DisasContext *s, uint32_t insn)
/* Must exit loop to check un-masked IRQs */
s->base.is_jmp = DISAS_EXIT;
return;
+
case 5: /* DRPS */
- if (rn != 0x1f) {
- unallocated_encoding(s);
+ if (op3 != 0 || op4 != 0 || rn != 0x1f) {
+ goto do_unallocated;
} else {
unsupported_encoding(s, insn);
}
return;
+
default:
+ do_unallocated:
unallocated_encoding(s);
return;
}
--
2.17.2
^ permalink raw reply related [flat|nested] 47+ messages in thread* Re: [Qemu-devel] [PATCH 11/26] target/arm: Rearrange decode in disas_uncond_b_reg
2018-12-07 10:36 ` [Qemu-devel] [PATCH 11/26] target/arm: Rearrange decode in disas_uncond_b_reg Richard Henderson
@ 2018-12-11 15:40 ` Peter Maydell
2018-12-12 19:20 ` Richard Henderson
0 siblings, 1 reply; 47+ messages in thread
From: Peter Maydell @ 2018-12-11 15:40 UTC (permalink / raw)
To: Richard Henderson; +Cc: QEMU Developers, Ramana Radhakrishnan
On Fri, 7 Dec 2018 at 10:36, Richard Henderson
<richard.henderson@linaro.org> wrote:
>
> This will enable PAuth decode in a subsequent patch.
>
> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
> ---
> target/arm/translate-a64.c | 34 +++++++++++++++++++++++-----------
> 1 file changed, 23 insertions(+), 11 deletions(-)
>
> diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
> index c84c2dbb66..5fa2647771 100644
> --- a/target/arm/translate-a64.c
> +++ b/target/arm/translate-a64.c
> @@ -1989,32 +1989,41 @@ static void disas_uncond_b_reg(DisasContext *s, uint32_t insn)
> rn = extract32(insn, 5, 5);
> op4 = extract32(insn, 0, 5);
>
> - if (op4 != 0x0 || op3 != 0x0 || op2 != 0x1f) {
> - unallocated_encoding(s);
> - return;
> + if (op2 != 0x1f) {
> + goto do_unallocated;
> }
>
> switch (opc) {
> case 0: /* BR */
> case 1: /* BLR */
> case 2: /* RET */
> - gen_a64_set_pc(s, cpu_reg(s, rn));
> + if (op3 == 0 && op4 == 0) {
> + dst = cpu_reg(s, rn);
> + } else {
> + goto do_unallocated;
> + }
> + gen_a64_set_pc(s, dst);
> /* BLR also needs to load return address */
> if (opc == 1) {
> tcg_gen_movi_i64(cpu_reg(s, 30), s->pc);
> }
> break;
> +
> case 4: /* ERET */
> if (s->current_el == 0) {
> - unallocated_encoding(s);
> - return;
> - }
> - if (tb_cflags(s->base.tb) & CF_USE_ICOUNT) {
> - gen_io_start();
> + goto do_unallocated;
> }
> dst = tcg_temp_new_i64();
> tcg_gen_ld_i64(dst, cpu_env,
> offsetof(CPUARMState, elr_el[s->current_el]));
> + if (op3 == 0 && op4 == 0) {
> + ;
> + } else {
> + goto do_unallocated;
This decode check should go before any code has been
emittede (ie before the tcg_gen_ld_i64 above it).
> + }
> + if (tb_cflags(s->base.tb) & CF_USE_ICOUNT) {
> + gen_io_start();
> + }
> gen_helper_exception_return(cpu_env, dst);
> tcg_temp_free_i64(dst);
> if (tb_cflags(s->base.tb) & CF_USE_ICOUNT) {
> @@ -2023,14 +2032,17 @@ static void disas_uncond_b_reg(DisasContext *s, uint32_t insn)
> /* Must exit loop to check un-masked IRQs */
> s->base.is_jmp = DISAS_EXIT;
> return;
> +
> case 5: /* DRPS */
> - if (rn != 0x1f) {
> - unallocated_encoding(s);
> + if (op3 != 0 || op4 != 0 || rn != 0x1f) {
> + goto do_unallocated;
> } else {
> unsupported_encoding(s, insn);
> }
> return;
> +
> default:
> + do_unallocated:
> unallocated_encoding(s);
> return;
> }
thanks
-- PMM
^ permalink raw reply [flat|nested] 47+ messages in thread* Re: [Qemu-devel] [PATCH 11/26] target/arm: Rearrange decode in disas_uncond_b_reg
2018-12-11 15:40 ` Peter Maydell
@ 2018-12-12 19:20 ` Richard Henderson
2018-12-12 21:18 ` Peter Maydell
0 siblings, 1 reply; 47+ messages in thread
From: Richard Henderson @ 2018-12-12 19:20 UTC (permalink / raw)
To: Peter Maydell; +Cc: QEMU Developers, Ramana Radhakrishnan
On 12/11/18 9:40 AM, Peter Maydell wrote:
> On Fri, 7 Dec 2018 at 10:36, Richard Henderson
> <richard.henderson@linaro.org> wrote:
>>
>> This will enable PAuth decode in a subsequent patch.
>>
>> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
>> ---
>> target/arm/translate-a64.c | 34 +++++++++++++++++++++++-----------
>> 1 file changed, 23 insertions(+), 11 deletions(-)
>>
>> diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
>> index c84c2dbb66..5fa2647771 100644
>> --- a/target/arm/translate-a64.c
>> +++ b/target/arm/translate-a64.c
>> @@ -1989,32 +1989,41 @@ static void disas_uncond_b_reg(DisasContext *s, uint32_t insn)
>> rn = extract32(insn, 5, 5);
>> op4 = extract32(insn, 0, 5);
>>
>> - if (op4 != 0x0 || op3 != 0x0 || op2 != 0x1f) {
>> - unallocated_encoding(s);
>> - return;
>> + if (op2 != 0x1f) {
>> + goto do_unallocated;
>> }
>>
>> switch (opc) {
>> case 0: /* BR */
>> case 1: /* BLR */
>> case 2: /* RET */
>> - gen_a64_set_pc(s, cpu_reg(s, rn));
>> + if (op3 == 0 && op4 == 0) {
>> + dst = cpu_reg(s, rn);
>> + } else {
>> + goto do_unallocated;
>> + }
>> + gen_a64_set_pc(s, dst);
>> /* BLR also needs to load return address */
>> if (opc == 1) {
>> tcg_gen_movi_i64(cpu_reg(s, 30), s->pc);
>> }
>> break;
>> +
>> case 4: /* ERET */
>> if (s->current_el == 0) {
>> - unallocated_encoding(s);
>> - return;
>> - }
>> - if (tb_cflags(s->base.tb) & CF_USE_ICOUNT) {
>> - gen_io_start();
>> + goto do_unallocated;
>> }
>> dst = tcg_temp_new_i64();
>> tcg_gen_ld_i64(dst, cpu_env,
>> offsetof(CPUARMState, elr_el[s->current_el]));
>> + if (op3 == 0 && op4 == 0) {
>> + ;
>> + } else {
>> + goto do_unallocated;
>
>
> This decode check should go before any code has been
> emittede (ie before the tcg_gen_ld_i64 above it).
Well, it could, but only if we duplicate the ld_i64 in the various branches
that require it. E.g.
if (op3 == 0 && op4 == 0) {
tcg_gen_ld_i64(...);
} else if (dc_ir_feature(aa64_pauth, s) && ...) {
tcg_gen_ld_i64(...);
if (s->pauth_active) {
gen_helper_auti*(...);
}
} else {
goto do_unallocated;
}
which I suppose isn't so bad.
What I have isn't an error because the ld_i64 will simply be deleted as dead
code by the tcg optimizer. But I'll rearrange anyway.
r~
^ permalink raw reply [flat|nested] 47+ messages in thread* Re: [Qemu-devel] [PATCH 11/26] target/arm: Rearrange decode in disas_uncond_b_reg
2018-12-12 19:20 ` Richard Henderson
@ 2018-12-12 21:18 ` Peter Maydell
0 siblings, 0 replies; 47+ messages in thread
From: Peter Maydell @ 2018-12-12 21:18 UTC (permalink / raw)
To: Richard Henderson; +Cc: QEMU Developers, Ramana Radhakrishnan
On Wed, 12 Dec 2018 at 19:20, Richard Henderson
<richard.henderson@linaro.org> wrote:
>
> On 12/11/18 9:40 AM, Peter Maydell wrote:
> > On Fri, 7 Dec 2018 at 10:36, Richard Henderson
> > <richard.henderson@linaro.org> wrote:
> >>
> >> This will enable PAuth decode in a subsequent patch.
> >>
> >> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
> > This decode check should go before any code has been
> > emittede (ie before the tcg_gen_ld_i64 above it).
>
> Well, it could, but only if we duplicate the ld_i64 in the various branches
> that require it. E.g.
>
> if (op3 == 0 && op4 == 0) {
> tcg_gen_ld_i64(...);
> } else if (dc_ir_feature(aa64_pauth, s) && ...) {
> tcg_gen_ld_i64(...);
> if (s->pauth_active) {
> gen_helper_auti*(...);
> }
> } else {
> goto do_unallocated;
> }
>
> which I suppose isn't so bad.
>
> What I have isn't an error because the ld_i64 will simply be deleted as dead
> code by the tcg optimizer. But I'll rearrange anyway.
You'd also need to manually free the 'dst' TCG temp before the goto.
The A32/T32 decoder is full of (harmless) "leaked" TCG temps in
error-exit paths, which is one reason I think it's nicer to
fully decode before proceeding to codegen.
thanks
-- PMM
^ permalink raw reply [flat|nested] 47+ messages in thread
* [Qemu-devel] [PATCH 12/26] target/arm: Decode PAuth within disas_uncond_b_reg
2018-12-07 10:36 [Qemu-devel] [PATCH 00/26] target/arm: Implement ARMv8.3-PAuth Richard Henderson
` (10 preceding siblings ...)
2018-12-07 10:36 ` [Qemu-devel] [PATCH 11/26] target/arm: Rearrange decode in disas_uncond_b_reg Richard Henderson
@ 2018-12-07 10:36 ` Richard Henderson
2018-12-07 10:36 ` [Qemu-devel] [PATCH 13/26] target/arm: Decode Load/store register (pac) Richard Henderson
` (13 subsequent siblings)
25 siblings, 0 replies; 47+ messages in thread
From: Richard Henderson @ 2018-12-07 10:36 UTC (permalink / raw)
To: qemu-devel; +Cc: peter.maydell, ramana.radhakrishnan
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
target/arm/translate-a64.c | 100 +++++++++++++++++++++++++++++++++++--
1 file changed, 95 insertions(+), 5 deletions(-)
diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index 5fa2647771..d4df2b48b1 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -1982,6 +1982,7 @@ static void disas_uncond_b_reg(DisasContext *s, uint32_t insn)
{
unsigned int opc, op2, op3, rn, op4;
TCGv_i64 dst;
+ TCGv_i64 modifier;
opc = extract32(insn, 21, 4);
op2 = extract32(insn, 16, 5);
@@ -1997,9 +1998,47 @@ static void disas_uncond_b_reg(DisasContext *s, uint32_t insn)
case 0: /* BR */
case 1: /* BLR */
case 2: /* RET */
- if (op3 == 0 && op4 == 0) {
+ switch (op3) {
+ case 0:
+ /* BR, BLR, RET */
+ if (op4 != 0) {
+ goto do_unallocated;
+ }
dst = cpu_reg(s, rn);
- } else {
+ break;
+
+ case 2:
+ case 3:
+ if (!dc_isar_feature(aa64_pauth, s)) {
+ goto do_unallocated;
+ }
+ if (opc == 2) {
+ /* RETAA, RETAB */
+ if (rn != 0x1f || op4 != 0x1f) {
+ goto do_unallocated;
+ }
+ rn = 30;
+ modifier = cpu_X[31];
+ } else {
+ /* BRAAZ, BRABZ, BLRAAZ, BLRABZ */
+ if (op4 != 0x1f) {
+ goto do_unallocated;
+ }
+ modifier = new_tmp_a64_zero(s);
+ }
+ if (s->pauth_active) {
+ dst = new_tmp_a64(s);
+ if (op3 == 2) {
+ gen_helper_autia(dst, cpu_env, cpu_reg(s, rn), modifier);
+ } else {
+ gen_helper_autib(dst, cpu_env, cpu_reg(s, rn), modifier);
+ }
+ } else {
+ dst = cpu_reg(s, rn);
+ }
+ break;
+
+ default:
goto do_unallocated;
}
gen_a64_set_pc(s, dst);
@@ -2009,6 +2048,32 @@ static void disas_uncond_b_reg(DisasContext *s, uint32_t insn)
}
break;
+ case 8: /* BRAA */
+ case 9: /* BLRAA */
+ if (!dc_isar_feature(aa64_pauth, s)) {
+ goto do_unallocated;
+ }
+ if (op3 != 2 || op3 != 3) {
+ goto do_unallocated;
+ }
+ if (s->pauth_active) {
+ dst = new_tmp_a64(s);
+ modifier = cpu_reg_sp(s, op4);
+ if (op3 == 2) {
+ gen_helper_autia(dst, cpu_env, cpu_reg(s, rn), modifier);
+ } else {
+ gen_helper_autib(dst, cpu_env, cpu_reg(s, rn), modifier);
+ }
+ } else {
+ dst = cpu_reg(s, rn);
+ }
+ gen_a64_set_pc(s, dst);
+ /* BLRAA also needs to load return address */
+ if (opc == 9) {
+ tcg_gen_movi_i64(cpu_reg(s, 30), s->pc);
+ }
+ break;
+
case 4: /* ERET */
if (s->current_el == 0) {
goto do_unallocated;
@@ -2016,11 +2081,36 @@ static void disas_uncond_b_reg(DisasContext *s, uint32_t insn)
dst = tcg_temp_new_i64();
tcg_gen_ld_i64(dst, cpu_env,
offsetof(CPUARMState, elr_el[s->current_el]));
- if (op3 == 0 && op4 == 0) {
- ;
- } else {
+
+ switch (op3) {
+ case 0: /* ERET */
+ if (op4 != 0) {
+ goto do_unallocated;
+ }
+ break;
+
+ case 2: /* ERETAA */
+ case 3: /* ERETAB */
+ if (!dc_isar_feature(aa64_pauth, s)) {
+ goto do_unallocated;
+ }
+ if (rn != 0x1f || op4 != 0x1f) {
+ goto do_unallocated;
+ }
+ if (s->pauth_active) {
+ modifier = cpu_X[31];
+ if (op3 == 2) {
+ gen_helper_autia(dst, cpu_env, dst, modifier);
+ } else {
+ gen_helper_autib(dst, cpu_env, dst, modifier);
+ }
+ }
+ break;
+
+ default:
goto do_unallocated;
}
+
if (tb_cflags(s->base.tb) & CF_USE_ICOUNT) {
gen_io_start();
}
--
2.17.2
^ permalink raw reply related [flat|nested] 47+ messages in thread* [Qemu-devel] [PATCH 13/26] target/arm: Decode Load/store register (pac)
2018-12-07 10:36 [Qemu-devel] [PATCH 00/26] target/arm: Implement ARMv8.3-PAuth Richard Henderson
` (11 preceding siblings ...)
2018-12-07 10:36 ` [Qemu-devel] [PATCH 12/26] target/arm: Decode PAuth within disas_uncond_b_reg Richard Henderson
@ 2018-12-07 10:36 ` Richard Henderson
2018-12-07 10:36 ` [Qemu-devel] [PATCH 14/26] target/arm: Move cpu_mmu_index out of line Richard Henderson
` (12 subsequent siblings)
25 siblings, 0 replies; 47+ messages in thread
From: Richard Henderson @ 2018-12-07 10:36 UTC (permalink / raw)
To: qemu-devel; +Cc: peter.maydell, ramana.radhakrishnan
Not that there are any stores involved, but why argue with ARM's
naming convention.
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
target/arm/translate-a64.c | 62 ++++++++++++++++++++++++++++++++++++++
1 file changed, 62 insertions(+)
diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index d4df2b48b1..99e1405dff 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -3143,6 +3143,65 @@ static void disas_ldst_atomic(DisasContext *s, uint32_t insn,
s->be_data | size | MO_ALIGN);
}
+/* PAC memory operations
+ *
+ * 31 30 27 26 24 22 21 12 11 10 5 0
+ * +------+-------+---+-----+-----+---+--------+---+---+----+-----+
+ * | size | 1 1 1 | V | 0 0 | M S | 1 | imm9 | W | 1 | Rn | Rt |
+ * +------+-------+---+-----+-----+------------+---+---+----+-----+
+ *
+ * Rt: the result register
+ * Rn: base address or SP
+ * Rs: the source register for the operation
+ * V: vector flag (always 0 as of v8.3)
+ * M: clear for key DA, set for key DB
+ * W: pre-indexing flag
+ * S: sign for imm9.
+ */
+static void disas_ldst_pac(DisasContext *s, uint32_t insn,
+ int size, int rt, bool is_vector)
+{
+ int rn = extract32(insn, 5, 5);
+ bool is_wback = extract32(insn, 11, 1);
+ bool use_key_a = !extract32(insn, 23, 1);
+ int offset, memidx;
+ TCGv_i64 tcg_addr, tcg_rt;
+
+ if (size != 3 || is_vector || !dc_isar_feature(aa64_pauth, s)) {
+ unallocated_encoding(s);
+ return;
+ }
+
+ if (rn == 31) {
+ gen_check_sp_alignment(s);
+ }
+ tcg_addr = read_cpu_reg_sp(s, rn, 1);
+
+ if (s->pauth_active) {
+ if (use_key_a) {
+ gen_helper_autda(tcg_addr, cpu_env, tcg_addr, cpu_X[31]);
+ } else {
+ gen_helper_autdb(tcg_addr, cpu_env, tcg_addr, cpu_X[31]);
+ }
+ }
+
+ /* Form the 10-bit signed, scaled offset. */
+ offset = (extract32(insn, 22, 1) << 9) | extract32(insn, 12, 9);
+ offset = sextract32(offset << size, 10 + size, 0);
+ tcg_gen_addi_i64(tcg_addr, tcg_addr, offset);
+
+ tcg_rt = cpu_reg(s, rt);
+ memidx = get_mem_index(s);
+ do_gpr_ld_memidx(s, tcg_rt, tcg_addr, size,
+ /* is_signed */ false, /* extend */ false, memidx,
+ /* iss_valid */ true, /* iss_srt */ rt,
+ /* iss_sf */ true, /* iss_ar */ false);
+
+ if (is_wback) {
+ tcg_gen_mov_i64(cpu_reg_sp(s, rn), tcg_addr);
+ }
+}
+
/* Load/store register (all forms) */
static void disas_ldst_reg(DisasContext *s, uint32_t insn)
{
@@ -3168,6 +3227,9 @@ static void disas_ldst_reg(DisasContext *s, uint32_t insn)
case 2:
disas_ldst_reg_roffset(s, insn, opc, size, rt, is_vector);
return;
+ default:
+ disas_ldst_pac(s, insn, size, rt, is_vector);
+ return;
}
break;
case 1:
--
2.17.2
^ permalink raw reply related [flat|nested] 47+ messages in thread* [Qemu-devel] [PATCH 14/26] target/arm: Move cpu_mmu_index out of line
2018-12-07 10:36 [Qemu-devel] [PATCH 00/26] target/arm: Implement ARMv8.3-PAuth Richard Henderson
` (12 preceding siblings ...)
2018-12-07 10:36 ` [Qemu-devel] [PATCH 13/26] target/arm: Decode Load/store register (pac) Richard Henderson
@ 2018-12-07 10:36 ` Richard Henderson
2018-12-11 15:41 ` Peter Maydell
2018-12-07 10:36 ` [Qemu-devel] [PATCH 15/26] target/arm: Introduce arm_mmu_idx Richard Henderson
` (11 subsequent siblings)
25 siblings, 1 reply; 47+ messages in thread
From: Richard Henderson @ 2018-12-07 10:36 UTC (permalink / raw)
To: qemu-devel; +Cc: peter.maydell, ramana.radhakrishnan
This function is, or will shortly become, too big to inline.
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
target/arm/cpu.h | 48 +++++----------------------------------------
target/arm/helper.c | 44 +++++++++++++++++++++++++++++++++++++++++
2 files changed, 49 insertions(+), 43 deletions(-)
diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index f70eff8bcf..18f2378b87 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -2731,54 +2731,16 @@ static inline int arm_mmu_idx_to_el(ARMMMUIdx mmu_idx)
}
/* Return the MMU index for a v7M CPU in the specified security and
- * privilege state
+ * privilege state.
*/
-static inline ARMMMUIdx arm_v7m_mmu_idx_for_secstate_and_priv(CPUARMState *env,
- bool secstate,
- bool priv)
-{
- ARMMMUIdx mmu_idx = ARM_MMU_IDX_M;
-
- if (priv) {
- mmu_idx |= ARM_MMU_IDX_M_PRIV;
- }
-
- if (armv7m_nvic_neg_prio_requested(env->nvic, secstate)) {
- mmu_idx |= ARM_MMU_IDX_M_NEGPRI;
- }
-
- if (secstate) {
- mmu_idx |= ARM_MMU_IDX_M_S;
- }
-
- return mmu_idx;
-}
+ARMMMUIdx arm_v7m_mmu_idx_for_secstate_and_priv(CPUARMState *env,
+ bool secstate, bool priv);
/* Return the MMU index for a v7M CPU in the specified security state */
-static inline ARMMMUIdx arm_v7m_mmu_idx_for_secstate(CPUARMState *env,
- bool secstate)
-{
- bool priv = arm_current_el(env) != 0;
-
- return arm_v7m_mmu_idx_for_secstate_and_priv(env, secstate, priv);
-}
+ARMMMUIdx arm_v7m_mmu_idx_for_secstate(CPUARMState *env, bool secstate);
/* Determine the current mmu_idx to use for normal loads/stores */
-static inline int cpu_mmu_index(CPUARMState *env, bool ifetch)
-{
- int el = arm_current_el(env);
-
- if (arm_feature(env, ARM_FEATURE_M)) {
- ARMMMUIdx mmu_idx = arm_v7m_mmu_idx_for_secstate(env, env->v7m.secure);
-
- return arm_to_core_mmu_idx(mmu_idx);
- }
-
- if (el < 2 && arm_is_secure_below_el3(env)) {
- return arm_to_core_mmu_idx(ARMMMUIdx_S1SE0 + el);
- }
- return el;
-}
+int cpu_mmu_index(CPUARMState *env, bool ifetch);
/* Indexes used when registering address spaces with cpu_address_space_init */
typedef enum ARMASIdx {
diff --git a/target/arm/helper.c b/target/arm/helper.c
index 158c550fab..eaa9e60e7b 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -12959,6 +12959,50 @@ int fp_exception_el(CPUARMState *env, int cur_el)
return 0;
}
+ARMMMUIdx arm_v7m_mmu_idx_for_secstate_and_priv(CPUARMState *env,
+ bool secstate, bool priv)
+{
+ ARMMMUIdx mmu_idx = ARM_MMU_IDX_M;
+
+ if (priv) {
+ mmu_idx |= ARM_MMU_IDX_M_PRIV;
+ }
+
+ if (armv7m_nvic_neg_prio_requested(env->nvic, secstate)) {
+ mmu_idx |= ARM_MMU_IDX_M_NEGPRI;
+ }
+
+ if (secstate) {
+ mmu_idx |= ARM_MMU_IDX_M_S;
+ }
+
+ return mmu_idx;
+}
+
+/* Return the MMU index for a v7M CPU in the specified security state */
+ARMMMUIdx arm_v7m_mmu_idx_for_secstate(CPUARMState *env, bool secstate)
+{
+ bool priv = arm_current_el(env) != 0;
+
+ return arm_v7m_mmu_idx_for_secstate_and_priv(env, secstate, priv);
+}
+
+int cpu_mmu_index(CPUARMState *env, bool ifetch)
+{
+ int el = arm_current_el(env);
+
+ if (arm_feature(env, ARM_FEATURE_M)) {
+ ARMMMUIdx mmu_idx = arm_v7m_mmu_idx_for_secstate(env, env->v7m.secure);
+
+ return arm_to_core_mmu_idx(mmu_idx);
+ }
+
+ if (el < 2 && arm_is_secure_below_el3(env)) {
+ return arm_to_core_mmu_idx(ARMMMUIdx_S1SE0 + el);
+ }
+ return el;
+}
+
void cpu_get_tb_cpu_state(CPUARMState *env, target_ulong *pc,
target_ulong *cs_base, uint32_t *pflags)
{
--
2.17.2
^ permalink raw reply related [flat|nested] 47+ messages in thread* [Qemu-devel] [PATCH 15/26] target/arm: Introduce arm_mmu_idx
2018-12-07 10:36 [Qemu-devel] [PATCH 00/26] target/arm: Implement ARMv8.3-PAuth Richard Henderson
` (13 preceding siblings ...)
2018-12-07 10:36 ` [Qemu-devel] [PATCH 14/26] target/arm: Move cpu_mmu_index out of line Richard Henderson
@ 2018-12-07 10:36 ` Richard Henderson
2018-12-11 15:43 ` Peter Maydell
2018-12-07 10:36 ` [Qemu-devel] [PATCH 16/26] target/arm: Create ARMVAParameters and helpers Richard Henderson
` (10 subsequent siblings)
25 siblings, 1 reply; 47+ messages in thread
From: Richard Henderson @ 2018-12-07 10:36 UTC (permalink / raw)
To: qemu-devel; +Cc: peter.maydell, ramana.radhakrishnan
The pattern
ARMMMUIdx mmu_idx = core_to_arm_mmu_idx(env, cpu_mmu_index(env, false));
is computing the full ARMMMUIdx, stripping off the ARM bits,
and then putting them back.
Avoid the extra two steps with the appropriate helper function.
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
target/arm/cpu.h | 1 +
target/arm/helper.c | 27 ++++++++++++++++-----------
2 files changed, 17 insertions(+), 11 deletions(-)
diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index 18f2378b87..6bac5c18d0 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -2740,6 +2740,7 @@ ARMMMUIdx arm_v7m_mmu_idx_for_secstate_and_priv(CPUARMState *env,
ARMMMUIdx arm_v7m_mmu_idx_for_secstate(CPUARMState *env, bool secstate);
/* Determine the current mmu_idx to use for normal loads/stores */
+ARMMMUIdx arm_mmu_idx(CPUARMState *env);
int cpu_mmu_index(CPUARMState *env, bool ifetch);
/* Indexes used when registering address spaces with cpu_address_space_init */
diff --git a/target/arm/helper.c b/target/arm/helper.c
index eaa9e60e7b..be8daefc46 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -7127,7 +7127,7 @@ static bool v7m_push_callee_stack(ARMCPU *cpu, uint32_t lr, bool dotailchain,
limit = env->v7m.msplim[M_REG_S];
}
} else {
- mmu_idx = core_to_arm_mmu_idx(env, cpu_mmu_index(env, false));
+ mmu_idx = arm_mmu_idx(env);
frame_sp_p = &env->regs[13];
limit = v7m_sp_limit(env);
}
@@ -7308,7 +7308,7 @@ static bool v7m_push_stack(ARMCPU *cpu)
CPUARMState *env = &cpu->env;
uint32_t xpsr = xpsr_read(env);
uint32_t frameptr = env->regs[13];
- ARMMMUIdx mmu_idx = core_to_arm_mmu_idx(env, cpu_mmu_index(env, false));
+ ARMMMUIdx mmu_idx = arm_mmu_idx(env);
/* Align stack pointer if the guest wants that */
if ((frameptr & 4) &&
@@ -11083,7 +11083,7 @@ hwaddr arm_cpu_get_phys_page_attrs_debug(CPUState *cs, vaddr addr,
int prot;
bool ret;
ARMMMUFaultInfo fi = {};
- ARMMMUIdx mmu_idx = core_to_arm_mmu_idx(env, cpu_mmu_index(env, false));
+ ARMMMUIdx mmu_idx = arm_mmu_idx(env);
*attrs = (MemTxAttrs) {};
@@ -12987,26 +12987,31 @@ ARMMMUIdx arm_v7m_mmu_idx_for_secstate(CPUARMState *env, bool secstate)
return arm_v7m_mmu_idx_for_secstate_and_priv(env, secstate, priv);
}
-int cpu_mmu_index(CPUARMState *env, bool ifetch)
+ARMMMUIdx arm_mmu_idx(CPUARMState *env)
{
- int el = arm_current_el(env);
+ int el;
if (arm_feature(env, ARM_FEATURE_M)) {
- ARMMMUIdx mmu_idx = arm_v7m_mmu_idx_for_secstate(env, env->v7m.secure);
-
- return arm_to_core_mmu_idx(mmu_idx);
+ return arm_v7m_mmu_idx_for_secstate(env, env->v7m.secure);
}
+ el = arm_current_el(env);
if (el < 2 && arm_is_secure_below_el3(env)) {
- return arm_to_core_mmu_idx(ARMMMUIdx_S1SE0 + el);
+ return ARMMMUIdx_S1SE0 + el;
+ } else {
+ return ARMMMUIdx_S12NSE0 + el;
}
- return el;
+}
+
+int cpu_mmu_index(CPUARMState *env, bool ifetch)
+{
+ return arm_to_core_mmu_idx(arm_mmu_idx(env));
}
void cpu_get_tb_cpu_state(CPUARMState *env, target_ulong *pc,
target_ulong *cs_base, uint32_t *pflags)
{
- ARMMMUIdx mmu_idx = core_to_arm_mmu_idx(env, cpu_mmu_index(env, false));
+ ARMMMUIdx mmu_idx = arm_mmu_idx(env);
int current_el = arm_current_el(env);
int fp_el = fp_exception_el(env, current_el);
uint32_t flags;
--
2.17.2
^ permalink raw reply related [flat|nested] 47+ messages in thread* Re: [Qemu-devel] [PATCH 15/26] target/arm: Introduce arm_mmu_idx
2018-12-07 10:36 ` [Qemu-devel] [PATCH 15/26] target/arm: Introduce arm_mmu_idx Richard Henderson
@ 2018-12-11 15:43 ` Peter Maydell
0 siblings, 0 replies; 47+ messages in thread
From: Peter Maydell @ 2018-12-11 15:43 UTC (permalink / raw)
To: Richard Henderson; +Cc: QEMU Developers, Ramana Radhakrishnan
On Fri, 7 Dec 2018 at 10:36, Richard Henderson
<richard.henderson@linaro.org> wrote:
>
> The pattern
>
> ARMMMUIdx mmu_idx = core_to_arm_mmu_idx(env, cpu_mmu_index(env, false));
>
> is computing the full ARMMMUIdx, stripping off the ARM bits,
> and then putting them back.
>
> Avoid the extra two steps with the appropriate helper function.
>
> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
> ---
> target/arm/cpu.h | 1 +
> target/arm/helper.c | 27 ++++++++++++++++-----------
> 2 files changed, 17 insertions(+), 11 deletions(-)
>
> diff --git a/target/arm/cpu.h b/target/arm/cpu.h
> index 18f2378b87..6bac5c18d0 100644
> --- a/target/arm/cpu.h
> +++ b/target/arm/cpu.h
> @@ -2740,6 +2740,7 @@ ARMMMUIdx arm_v7m_mmu_idx_for_secstate_and_priv(CPUARMState *env,
> ARMMMUIdx arm_v7m_mmu_idx_for_secstate(CPUARMState *env, bool secstate);
>
> /* Determine the current mmu_idx to use for normal loads/stores */
> +ARMMMUIdx arm_mmu_idx(CPUARMState *env);
> int cpu_mmu_index(CPUARMState *env, bool ifetch);
Could we give the new function its own comment rather than
making it share with the existing function, please?
Otherwise
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
thanks
-- PMM
^ permalink raw reply [flat|nested] 47+ messages in thread
* [Qemu-devel] [PATCH 16/26] target/arm: Create ARMVAParameters and helpers
2018-12-07 10:36 [Qemu-devel] [PATCH 00/26] target/arm: Implement ARMv8.3-PAuth Richard Henderson
` (14 preceding siblings ...)
2018-12-07 10:36 ` [Qemu-devel] [PATCH 15/26] target/arm: Introduce arm_mmu_idx Richard Henderson
@ 2018-12-07 10:36 ` Richard Henderson
2018-12-11 16:40 ` Peter Maydell
2018-12-07 10:36 ` [Qemu-devel] [PATCH 17/26] target/arm: Reuse aa64_va_parameters for setting tbflags Richard Henderson
` (9 subsequent siblings)
25 siblings, 1 reply; 47+ messages in thread
From: Richard Henderson @ 2018-12-07 10:36 UTC (permalink / raw)
To: qemu-devel; +Cc: peter.maydell, ramana.radhakrishnan
Split out functions to extract the virtual address parameters.
Let the functions choose T0 or T1 address space half, if present.
Extract (most of) the control bits that vary between EL or Tx.
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
target/arm/helper.c | 274 ++++++++++++++++++++++++--------------------
1 file changed, 147 insertions(+), 127 deletions(-)
diff --git a/target/arm/helper.c b/target/arm/helper.c
index be8daefc46..99ceed2cab 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -9754,6 +9754,123 @@ static uint8_t convert_stage2_attrs(CPUARMState *env, uint8_t s2attrs)
return (hiattr << 6) | (hihint << 4) | (loattr << 2) | lohint;
}
+typedef struct ARMVAParameters {
+ unsigned tsz : 8;
+ unsigned select : 1;
+ bool tbi : 1;
+ bool epd : 1;
+ bool hpd : 1;
+ bool ha : 1;
+ bool hd : 1;
+ bool using16k : 1;
+ bool using64k : 1;
+} ARMVAParameters;
+
+static ARMVAParameters aa64_va_parameters(CPUARMState *env, uint64_t va,
+ ARMMMUIdx mmu_idx, bool data)
+{
+ uint64_t tcr = regime_tcr(env, mmu_idx)->raw_tcr;
+ uint32_t el = regime_el(env, mmu_idx);
+ bool tbi, tbid, epd, hpd, ha, hd, using16k, using64k;
+ int select, tsz;
+
+ /* Bit 55 is always between the two regions, and is canonical for
+ * determining if address tagging is enabled.
+ */
+ select = extract64(va, 55, 1);
+
+ if (el > 1) {
+ tsz = extract32(tcr, 0, 6);
+ using64k = extract32(tcr, 14, 1);
+ using16k = extract32(tcr, 15, 1);
+ tbi = extract32(tcr, 20, 1);
+ ha = extract32(tcr, 21, 1);
+ hd = extract32(tcr, 22, 1);
+ hpd = extract32(tcr, 24, 1);
+ tbid = extract32(tcr, 29, 1);
+ epd = false;
+ } else if (!select) {
+ tsz = extract32(tcr, 0, 6);
+ epd = extract32(tcr, 7, 1);
+ using64k = extract32(tcr, 14, 1);
+ using16k = extract32(tcr, 15, 1);
+ tbi = extract64(tcr, 37, 1);
+ ha = extract64(tcr, 39, 1);
+ hd = extract64(tcr, 40, 1);
+ hpd = extract64(tcr, 41, 1);
+ tbid = extract64(tcr, 51, 1);
+ } else {
+ int tg = extract32(tcr, 30, 2);
+ using16k = tg == 1;
+ using64k = tg == 3;
+ tsz = extract32(tcr, 16, 6);
+ epd = extract32(tcr, 23, 1);
+ tbi = extract64(tcr, 38, 1);
+ ha = extract64(tcr, 39, 1);
+ hd = extract64(tcr, 40, 1);
+ hpd = extract64(tcr, 42, 1);
+ tbid = extract64(tcr, 52, 1);
+ }
+ tsz = MIN(tsz, 39); /* TODO: ARMv8.4-TTST */
+ tsz = MAX(tsz, 16); /* TODO: ARMv8.2-LVA */
+
+ return (ARMVAParameters) {
+ .tsz = tsz,
+ .select = select,
+ .tbi = tbi & (data | !tbid),
+ .epd = epd,
+ .hpd = hpd,
+ .ha = ha,
+ .hd = hd,
+ .using16k = using16k,
+ .using64k = using64k,
+ };
+}
+
+static ARMVAParameters aa32_va_parameters(CPUARMState *env, uint32_t va,
+ ARMMMUIdx mmu_idx)
+{
+ uint64_t tcr = regime_tcr(env, mmu_idx)->raw_tcr;
+ int select, tsz;
+ bool epd, hpd;
+
+ if (mmu_idx == ARMMMUIdx_S2NS) {
+ tsz = sextract32(tcr, 0, 4) + 8;
+ select = 0;
+ hpd = false;
+ epd = false;
+ } else {
+ int t0sz = extract32(tcr, 0, 3);
+ int t1sz = extract32(tcr, 16, 3);
+
+ if (t1sz == 0) {
+ select = va > (0xffffffffu >> t0sz);
+ } else {
+ /* Note that we will detect errors later. */
+ select = va >= ~(0xffffffffu >> t1sz);
+ }
+
+ if (!select) {
+ tsz = t0sz;
+ epd = extract32(tcr, 7, 1);
+ hpd = extract64(tcr, 41, 1);
+ } else {
+ tsz = t1sz;
+ epd = extract32(tcr, 23, 1);
+ hpd = extract64(tcr, 42, 1);
+ }
+ /* For aarch32, hpd0 is not enabled without t2e as well. */
+ hpd &= extract32(tcr, 6, 1);
+ }
+
+ return (ARMVAParameters) {
+ .tsz = tsz,
+ .select = select,
+ .epd = epd,
+ .hpd = hpd,
+ };
+}
+
static bool get_phys_addr_lpae(CPUARMState *env, target_ulong address,
MMUAccessType access_type, ARMMMUIdx mmu_idx,
hwaddr *phys_ptr, MemTxAttrs *txattrs, int *prot,
@@ -9765,26 +9882,20 @@ static bool get_phys_addr_lpae(CPUARMState *env, target_ulong address,
/* Read an LPAE long-descriptor translation table. */
ARMFaultType fault_type = ARMFault_Translation;
uint32_t level;
- uint32_t epd = 0;
- int32_t t0sz, t1sz;
- uint32_t tg;
+ ARMVAParameters param;
uint64_t ttbr;
- int ttbr_select;
hwaddr descaddr, indexmask, indexmask_grainsize;
uint32_t tableattrs;
target_ulong page_size;
uint32_t attrs;
- int32_t stride = 9;
- int32_t addrsize;
- int inputsize;
- int32_t tbi = 0;
+ int32_t stride;
+ int top_bit, inputsize;
TCR *tcr = regime_tcr(env, mmu_idx);
int ap, ns, xn, pxn;
uint32_t el = regime_el(env, mmu_idx);
- bool ttbr1_valid = true;
+ bool ttbr1_valid;
uint64_t descaddrmask;
bool aarch64 = arm_el_is_aa64(env, el);
- bool hpd = false;
/* TODO:
* This code does not handle the different format TCR for VTCR_EL2.
@@ -9793,91 +9904,43 @@ static bool get_phys_addr_lpae(CPUARMState *env, target_ulong address,
* support for those page table walks.
*/
if (aarch64) {
+ param = aa64_va_parameters(env, address, mmu_idx,
+ access_type != MMU_INST_FETCH);
level = 0;
- addrsize = 64;
- if (el > 1) {
- if (mmu_idx != ARMMMUIdx_S2NS) {
- tbi = extract64(tcr->raw_tcr, 20, 1);
- }
- } else {
- if (extract64(address, 55, 1)) {
- tbi = extract64(tcr->raw_tcr, 38, 1);
- } else {
- tbi = extract64(tcr->raw_tcr, 37, 1);
- }
- }
- tbi *= 8;
-
/* If we are in 64-bit EL2 or EL3 then there is no TTBR1, so mark it
* invalid.
*/
- if (el > 1) {
- ttbr1_valid = false;
- }
+ ttbr1_valid = (el < 1);
} else {
+ param = aa32_va_parameters(env, address, mmu_idx);
level = 1;
- addrsize = 32;
/* There is no TTBR1 for EL2 */
- if (el == 2) {
- ttbr1_valid = false;
- }
+ ttbr1_valid = (el != 2);
}
- /* Determine whether this address is in the region controlled by
- * TTBR0 or TTBR1 (or if it is in neither region and should fault).
- * This is a Non-secure PL0/1 stage 1 translation, so controlled by
- * TTBCR/TTBR0/TTBR1 in accordance with ARM ARM DDI0406C table B-32:
+ top_bit = (aarch64 ? 64 : 32);
+ inputsize = top_bit - param.tsz;
+ top_bit -= 8 * param.tbi;
+
+ /* We determined the region when collecting the parameters, but we
+ * have not yet validated that the address is valid for the region.
*/
- if (aarch64) {
- /* AArch64 translation. */
- t0sz = extract32(tcr->raw_tcr, 0, 6);
- t0sz = MIN(t0sz, 39);
- t0sz = MAX(t0sz, 16);
- } else if (mmu_idx != ARMMMUIdx_S2NS) {
- /* AArch32 stage 1 translation. */
- t0sz = extract32(tcr->raw_tcr, 0, 3);
- } else {
- /* AArch32 stage 2 translation. */
- bool sext = extract32(tcr->raw_tcr, 4, 1);
- bool sign = extract32(tcr->raw_tcr, 3, 1);
- /* Address size is 40-bit for a stage 2 translation,
- * and t0sz can be negative (from -8 to 7),
- * so we need to adjust it to use the TTBR selecting logic below.
- */
- addrsize = 40;
- t0sz = sextract32(tcr->raw_tcr, 0, 4) + 8;
-
- /* If the sign-extend bit is not the same as t0sz[3], the result
- * is unpredictable. Flag this as a guest error. */
- if (sign != sext) {
- qemu_log_mask(LOG_GUEST_ERROR,
- "AArch32: VTCR.S / VTCR.T0SZ[3] mismatch\n");
- }
- }
- t1sz = extract32(tcr->raw_tcr, 16, 6);
- if (aarch64) {
- t1sz = MIN(t1sz, 39);
- t1sz = MAX(t1sz, 16);
- }
- if (t0sz && !extract64(address, addrsize - t0sz, t0sz - tbi)) {
- /* there is a ttbr0 region and we are in it (high bits all zero) */
- ttbr_select = 0;
- } else if (ttbr1_valid && t1sz &&
- !extract64(~address, addrsize - t1sz, t1sz - tbi)) {
- /* there is a ttbr1 region and we are in it (high bits all one) */
- ttbr_select = 1;
- } else if (!t0sz) {
- /* ttbr0 region is "everything not in the ttbr1 region" */
- ttbr_select = 0;
- } else if (!t1sz && ttbr1_valid) {
- /* ttbr1 region is "everything not in the ttbr0 region" */
- ttbr_select = 1;
- } else {
- /* in the gap between the two regions, this is a Translation fault */
+ if (param.select
+ ? extract64(~address, inputsize, top_bit - inputsize) || !ttbr1_valid
+ : extract64(address, inputsize, top_bit - inputsize)) {
+ /* In the gap between the two regions, this is a Translation fault */
fault_type = ARMFault_Translation;
goto do_fault;
}
+ if (param.using64k) {
+ stride = 13;
+ } else if (param.using16k) {
+ stride = 11;
+ } else {
+ stride = 9;
+ }
+
/* Note that QEMU ignores shareability and cacheability attributes,
* so we don't need to do anything with the SH, ORGN, IRGN fields
* in the TTBCR. Similarly, TTBCR:A1 selects whether we get the
@@ -9885,56 +9948,13 @@ static bool get_phys_addr_lpae(CPUARMState *env, target_ulong address,
* implement any ASID-like capability so we can ignore it (instead
* we will always flush the TLB any time the ASID is changed).
*/
- if (ttbr_select == 0) {
- ttbr = regime_ttbr(env, mmu_idx, 0);
- if (el < 2) {
- epd = extract32(tcr->raw_tcr, 7, 1);
- }
- inputsize = addrsize - t0sz;
-
- tg = extract32(tcr->raw_tcr, 14, 2);
- if (tg == 1) { /* 64KB pages */
- stride = 13;
- }
- if (tg == 2) { /* 16KB pages */
- stride = 11;
- }
- if (aarch64 && el > 1) {
- hpd = extract64(tcr->raw_tcr, 24, 1);
- } else {
- hpd = extract64(tcr->raw_tcr, 41, 1);
- }
- if (!aarch64) {
- /* For aarch32, hpd0 is not enabled without t2e as well. */
- hpd &= extract64(tcr->raw_tcr, 6, 1);
- }
- } else {
- /* We should only be here if TTBR1 is valid */
- assert(ttbr1_valid);
-
- ttbr = regime_ttbr(env, mmu_idx, 1);
- epd = extract32(tcr->raw_tcr, 23, 1);
- inputsize = addrsize - t1sz;
-
- tg = extract32(tcr->raw_tcr, 30, 2);
- if (tg == 3) { /* 64KB pages */
- stride = 13;
- }
- if (tg == 1) { /* 16KB pages */
- stride = 11;
- }
- hpd = extract64(tcr->raw_tcr, 42, 1);
- if (!aarch64) {
- /* For aarch32, hpd1 is not enabled without t2e as well. */
- hpd &= extract64(tcr->raw_tcr, 6, 1);
- }
- }
+ ttbr = regime_ttbr(env, mmu_idx, param.select);
/* Here we should have set up all the parameters for the translation:
* inputsize, ttbr, epd, stride, tbi
*/
- if (epd) {
+ if (param.epd) {
/* Translation table walk disabled => Translation fault on TLB miss
* Note: This is always 0 on 64-bit EL2 and EL3.
*/
@@ -10047,7 +10067,7 @@ static bool get_phys_addr_lpae(CPUARMState *env, target_ulong address,
}
/* Merge in attributes from table descriptors */
attrs |= nstable << 3; /* NS */
- if (hpd) {
+ if (param.hpd) {
/* HPD disables all the table attributes except NSTable. */
break;
}
--
2.17.2
^ permalink raw reply related [flat|nested] 47+ messages in thread* Re: [Qemu-devel] [PATCH 16/26] target/arm: Create ARMVAParameters and helpers
2018-12-07 10:36 ` [Qemu-devel] [PATCH 16/26] target/arm: Create ARMVAParameters and helpers Richard Henderson
@ 2018-12-11 16:40 ` Peter Maydell
0 siblings, 0 replies; 47+ messages in thread
From: Peter Maydell @ 2018-12-11 16:40 UTC (permalink / raw)
To: Richard Henderson; +Cc: QEMU Developers, Ramana Radhakrishnan
On Fri, 7 Dec 2018 at 10:37, Richard Henderson
<richard.henderson@linaro.org> wrote:
>
> Split out functions to extract the virtual address parameters.
> Let the functions choose T0 or T1 address space half, if present.
> Extract (most of) the control bits that vary between EL or Tx.
>
> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
> ---
> target/arm/helper.c | 274 ++++++++++++++++++++++++--------------------
> 1 file changed, 147 insertions(+), 127 deletions(-)
>
> diff --git a/target/arm/helper.c b/target/arm/helper.c
> index be8daefc46..99ceed2cab 100644
> --- a/target/arm/helper.c
> +++ b/target/arm/helper.c
> @@ -9754,6 +9754,123 @@ static uint8_t convert_stage2_attrs(CPUARMState *env, uint8_t s2attrs)
> return (hiattr << 6) | (hihint << 4) | (loattr << 2) | lohint;
> }
>
> +typedef struct ARMVAParameters {
> + unsigned tsz : 8;
> + unsigned select : 1;
> + bool tbi : 1;
> + bool epd : 1;
> + bool hpd : 1;
> + bool ha : 1;
> + bool hd : 1;
> + bool using16k : 1;
> + bool using64k : 1;
> +} ARMVAParameters;
> +
> +static ARMVAParameters aa64_va_parameters(CPUARMState *env, uint64_t va,
> + ARMMMUIdx mmu_idx, bool data)
> +{
> + uint64_t tcr = regime_tcr(env, mmu_idx)->raw_tcr;
> + uint32_t el = regime_el(env, mmu_idx);
> + bool tbi, tbid, epd, hpd, ha, hd, using16k, using64k;
> + int select, tsz;
> +
> + /* Bit 55 is always between the two regions, and is canonical for
> + * determining if address tagging is enabled.
> + */
> + select = extract64(va, 55, 1);
> +
> + if (el > 1) {
> + tsz = extract32(tcr, 0, 6);
> + using64k = extract32(tcr, 14, 1);
> + using16k = extract32(tcr, 15, 1);
> + tbi = extract32(tcr, 20, 1);
The old code explicitly avoided looking at the TCR bit 20
for the mmu_idx == ARMMMUIdx_S2NS case. At the moment VTCR_EL2
bit 20 is RES0 but it might not be in future.
> + ha = extract32(tcr, 21, 1);
> + hd = extract32(tcr, 22, 1);
> + hpd = extract32(tcr, 24, 1);
> + tbid = extract32(tcr, 29, 1);
No HPD in VTCR_EL2 either, and bit 29 is NSW there.
> + epd = false;
> + } else if (!select) {
> + tsz = extract32(tcr, 0, 6);
> + epd = extract32(tcr, 7, 1);
> + using64k = extract32(tcr, 14, 1);
> + using16k = extract32(tcr, 15, 1);
> + tbi = extract64(tcr, 37, 1);
> + ha = extract64(tcr, 39, 1);
> + hd = extract64(tcr, 40, 1);
> + hpd = extract64(tcr, 41, 1);
> + tbid = extract64(tcr, 51, 1);
> + } else {
> + int tg = extract32(tcr, 30, 2);
> + using16k = tg == 1;
> + using64k = tg == 3;
> + tsz = extract32(tcr, 16, 6);
> + epd = extract32(tcr, 23, 1);
> + tbi = extract64(tcr, 38, 1);
> + ha = extract64(tcr, 39, 1);
> + hd = extract64(tcr, 40, 1);
> + hpd = extract64(tcr, 42, 1);
> + tbid = extract64(tcr, 52, 1);
> + }
> + tsz = MIN(tsz, 39); /* TODO: ARMv8.4-TTST */
> + tsz = MAX(tsz, 16); /* TODO: ARMv8.2-LVA */
> +
> + return (ARMVAParameters) {
> + .tsz = tsz,
> + .select = select,
> + .tbi = tbi & (data | !tbid),
> + .epd = epd,
> + .hpd = hpd,
> + .ha = ha,
> + .hd = hd,
> + .using16k = using16k,
> + .using64k = using64k,
> + };
> +}
> +
> +static ARMVAParameters aa32_va_parameters(CPUARMState *env, uint32_t va,
> + ARMMMUIdx mmu_idx)
> +{
> + uint64_t tcr = regime_tcr(env, mmu_idx)->raw_tcr;
> + int select, tsz;
> + bool epd, hpd;
> +
> + if (mmu_idx == ARMMMUIdx_S2NS) {
> + tsz = sextract32(tcr, 0, 4) + 8;
> + select = 0;
> + hpd = false;
> + epd = false;
> + } else {
> + int t0sz = extract32(tcr, 0, 3);
> + int t1sz = extract32(tcr, 16, 3);
If this is EL2 (ie regime_tcr() is HTCR) then we
shouldn't be looking at bits 16:3, because there is
no T1SZ field there.
> +
> + if (t1sz == 0) {
> + select = va > (0xffffffffu >> t0sz);
> + } else {
> + /* Note that we will detect errors later. */
> + select = va >= ~(0xffffffffu >> t1sz);
> + }
> +
> + if (!select) {
> + tsz = t0sz;
> + epd = extract32(tcr, 7, 1);
> + hpd = extract64(tcr, 41, 1);
> + } else {
> + tsz = t1sz;
> + epd = extract32(tcr, 23, 1);
> + hpd = extract64(tcr, 42, 1);
In HTCR the HPD bit is 24, and there is no EPD bit and no T2E bit.
> + }
> + /* For aarch32, hpd0 is not enabled without t2e as well. */
> + hpd &= extract32(tcr, 6, 1);
> + }
> +
> + return (ARMVAParameters) {
> + .tsz = tsz,
> + .select = select,
> + .epd = epd,
> + .hpd = hpd,
> + };
> +}
> +
> static bool get_phys_addr_lpae(CPUARMState *env, target_ulong address,
> MMUAccessType access_type, ARMMMUIdx mmu_idx,
> hwaddr *phys_ptr, MemTxAttrs *txattrs, int *prot,
> @@ -9765,26 +9882,20 @@ static bool get_phys_addr_lpae(CPUARMState *env, target_ulong address,
> /* Read an LPAE long-descriptor translation table. */
> ARMFaultType fault_type = ARMFault_Translation;
> uint32_t level;
> - uint32_t epd = 0;
> - int32_t t0sz, t1sz;
> - uint32_t tg;
> + ARMVAParameters param;
> uint64_t ttbr;
> - int ttbr_select;
> hwaddr descaddr, indexmask, indexmask_grainsize;
> uint32_t tableattrs;
> target_ulong page_size;
> uint32_t attrs;
> - int32_t stride = 9;
> - int32_t addrsize;
> - int inputsize;
> - int32_t tbi = 0;
> + int32_t stride;
> + int top_bit, inputsize;
> TCR *tcr = regime_tcr(env, mmu_idx);
> int ap, ns, xn, pxn;
> uint32_t el = regime_el(env, mmu_idx);
> - bool ttbr1_valid = true;
> + bool ttbr1_valid;
> uint64_t descaddrmask;
> bool aarch64 = arm_el_is_aa64(env, el);
> - bool hpd = false;
>
> /* TODO:
> * This code does not handle the different format TCR for VTCR_EL2.
> @@ -9793,91 +9904,43 @@ static bool get_phys_addr_lpae(CPUARMState *env, target_ulong address,
> * support for those page table walks.
> */
> if (aarch64) {
> + param = aa64_va_parameters(env, address, mmu_idx,
> + access_type != MMU_INST_FETCH);
> level = 0;
> - addrsize = 64;
> - if (el > 1) {
> - if (mmu_idx != ARMMMUIdx_S2NS) {
> - tbi = extract64(tcr->raw_tcr, 20, 1);
> - }
> - } else {
> - if (extract64(address, 55, 1)) {
> - tbi = extract64(tcr->raw_tcr, 38, 1);
> - } else {
> - tbi = extract64(tcr->raw_tcr, 37, 1);
> - }
> - }
> - tbi *= 8;
> -
> /* If we are in 64-bit EL2 or EL3 then there is no TTBR1, so mark it
> * invalid.
> */
> - if (el > 1) {
> - ttbr1_valid = false;
> - }
> + ttbr1_valid = (el < 1);
> } else {
> + param = aa32_va_parameters(env, address, mmu_idx);
> level = 1;
> - addrsize = 32;
> /* There is no TTBR1 for EL2 */
> - if (el == 2) {
> - ttbr1_valid = false;
> - }
> + ttbr1_valid = (el != 2);
> }
>
> - /* Determine whether this address is in the region controlled by
> - * TTBR0 or TTBR1 (or if it is in neither region and should fault).
> - * This is a Non-secure PL0/1 stage 1 translation, so controlled by
> - * TTBCR/TTBR0/TTBR1 in accordance with ARM ARM DDI0406C table B-32:
> + top_bit = (aarch64 ? 64 : 32);
The old code had 3 cases here: 64 for AArch64, 32 for AArch32 stage 1,
and 40 for AArch32 stage 2.
> + inputsize = top_bit - param.tsz;
> + top_bit -= 8 * param.tbi;
> +
> + /* We determined the region when collecting the parameters, but we
> + * have not yet validated that the address is valid for the region.
> */
> - if (aarch64) {
> - /* AArch64 translation. */
> - t0sz = extract32(tcr->raw_tcr, 0, 6);
> - t0sz = MIN(t0sz, 39);
> - t0sz = MAX(t0sz, 16);
> - } else if (mmu_idx != ARMMMUIdx_S2NS) {
> - /* AArch32 stage 1 translation. */
> - t0sz = extract32(tcr->raw_tcr, 0, 3);
> - } else {
> - /* AArch32 stage 2 translation. */
> - bool sext = extract32(tcr->raw_tcr, 4, 1);
> - bool sign = extract32(tcr->raw_tcr, 3, 1);
> - /* Address size is 40-bit for a stage 2 translation,
> - * and t0sz can be negative (from -8 to 7),
> - * so we need to adjust it to use the TTBR selecting logic below.
> - */
> - addrsize = 40;
> - t0sz = sextract32(tcr->raw_tcr, 0, 4) + 8;
> -
> - /* If the sign-extend bit is not the same as t0sz[3], the result
> - * is unpredictable. Flag this as a guest error. */
> - if (sign != sext) {
> - qemu_log_mask(LOG_GUEST_ERROR,
> - "AArch32: VTCR.S / VTCR.T0SZ[3] mismatch\n");
This guest-error check seems to have vanished in the refactoring.
> - }
> - }
> - t1sz = extract32(tcr->raw_tcr, 16, 6);
> - if (aarch64) {
> - t1sz = MIN(t1sz, 39);
> - t1sz = MAX(t1sz, 16);
> - }
> - if (t0sz && !extract64(address, addrsize - t0sz, t0sz - tbi)) {
> - /* there is a ttbr0 region and we are in it (high bits all zero) */
> - ttbr_select = 0;
> - } else if (ttbr1_valid && t1sz &&
> - !extract64(~address, addrsize - t1sz, t1sz - tbi)) {
> - /* there is a ttbr1 region and we are in it (high bits all one) */
> - ttbr_select = 1;
> - } else if (!t0sz) {
> - /* ttbr0 region is "everything not in the ttbr1 region" */
> - ttbr_select = 0;
> - } else if (!t1sz && ttbr1_valid) {
> - /* ttbr1 region is "everything not in the ttbr0 region" */
> - ttbr_select = 1;
> - } else {
> - /* in the gap between the two regions, this is a Translation fault */
> + if (param.select
> + ? extract64(~address, inputsize, top_bit - inputsize) || !ttbr1_valid
> + : extract64(address, inputsize, top_bit - inputsize)) {
I find this expression rather confusing...
> + /* In the gap between the two regions, this is a Translation fault */
> fault_type = ARMFault_Translation;
> goto do_fault;
> }
>
> + if (param.using64k) {
> + stride = 13;
> + } else if (param.using16k) {
> + stride = 11;
> + } else {
> + stride = 9;
> + }
> +
> /* Note that QEMU ignores shareability and cacheability attributes,
> * so we don't need to do anything with the SH, ORGN, IRGN fields
> * in the TTBCR. Similarly, TTBCR:A1 selects whether we get the
> @@ -9885,56 +9948,13 @@ static bool get_phys_addr_lpae(CPUARMState *env, target_ulong address,
> * implement any ASID-like capability so we can ignore it (instead
> * we will always flush the TLB any time the ASID is changed).
> */
> - if (ttbr_select == 0) {
> - ttbr = regime_ttbr(env, mmu_idx, 0);
> - if (el < 2) {
> - epd = extract32(tcr->raw_tcr, 7, 1);
> - }
> - inputsize = addrsize - t0sz;
> -
> - tg = extract32(tcr->raw_tcr, 14, 2);
> - if (tg == 1) { /* 64KB pages */
> - stride = 13;
> - }
> - if (tg == 2) { /* 16KB pages */
> - stride = 11;
> - }
> - if (aarch64 && el > 1) {
> - hpd = extract64(tcr->raw_tcr, 24, 1);
> - } else {
> - hpd = extract64(tcr->raw_tcr, 41, 1);
> - }
> - if (!aarch64) {
> - /* For aarch32, hpd0 is not enabled without t2e as well. */
> - hpd &= extract64(tcr->raw_tcr, 6, 1);
> - }
> - } else {
> - /* We should only be here if TTBR1 is valid */
> - assert(ttbr1_valid);
> -
> - ttbr = regime_ttbr(env, mmu_idx, 1);
> - epd = extract32(tcr->raw_tcr, 23, 1);
> - inputsize = addrsize - t1sz;
> -
> - tg = extract32(tcr->raw_tcr, 30, 2);
> - if (tg == 3) { /* 64KB pages */
> - stride = 13;
> - }
> - if (tg == 1) { /* 16KB pages */
> - stride = 11;
> - }
> - hpd = extract64(tcr->raw_tcr, 42, 1);
> - if (!aarch64) {
> - /* For aarch32, hpd1 is not enabled without t2e as well. */
> - hpd &= extract64(tcr->raw_tcr, 6, 1);
> - }
> - }
> + ttbr = regime_ttbr(env, mmu_idx, param.select);
>
> /* Here we should have set up all the parameters for the translation:
> * inputsize, ttbr, epd, stride, tbi
> */
>
> - if (epd) {
> + if (param.epd) {
> /* Translation table walk disabled => Translation fault on TLB miss
> * Note: This is always 0 on 64-bit EL2 and EL3.
> */
> @@ -10047,7 +10067,7 @@ static bool get_phys_addr_lpae(CPUARMState *env, target_ulong address,
> }
> /* Merge in attributes from table descriptors */
> attrs |= nstable << 3; /* NS */
> - if (hpd) {
> + if (param.hpd) {
> /* HPD disables all the table attributes except NSTable. */
> break;
> }
> --
> 2.17.2
>
thanks
-- PMM
^ permalink raw reply [flat|nested] 47+ messages in thread
* [Qemu-devel] [PATCH 17/26] target/arm: Reuse aa64_va_parameters for setting tbflags
2018-12-07 10:36 [Qemu-devel] [PATCH 00/26] target/arm: Implement ARMv8.3-PAuth Richard Henderson
` (15 preceding siblings ...)
2018-12-07 10:36 ` [Qemu-devel] [PATCH 16/26] target/arm: Create ARMVAParameters and helpers Richard Henderson
@ 2018-12-07 10:36 ` Richard Henderson
2018-12-11 16:52 ` Peter Maydell
2018-12-07 10:36 ` [Qemu-devel] [PATCH 18/26] target/arm: Export aa64_va_parameters to internals.h Richard Henderson
` (8 subsequent siblings)
25 siblings, 1 reply; 47+ messages in thread
From: Richard Henderson @ 2018-12-07 10:36 UTC (permalink / raw)
To: qemu-devel; +Cc: peter.maydell, ramana.radhakrishnan
The arm_regime_tbi{0,1} functions are replacable with the new function
by giving the lowest and highest address.
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
target/arm/cpu.h | 35 -----------------------------
target/arm/helper.c | 55 +++++++++------------------------------------
2 files changed, 10 insertions(+), 80 deletions(-)
diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index 6bac5c18d0..f7a0eace68 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -3065,41 +3065,6 @@ static inline bool arm_cpu_bswap_data(CPUARMState *env)
}
#endif
-#ifndef CONFIG_USER_ONLY
-/**
- * arm_regime_tbi0:
- * @env: CPUARMState
- * @mmu_idx: MMU index indicating required translation regime
- *
- * Extracts the TBI0 value from the appropriate TCR for the current EL
- *
- * Returns: the TBI0 value.
- */
-uint32_t arm_regime_tbi0(CPUARMState *env, ARMMMUIdx mmu_idx);
-
-/**
- * arm_regime_tbi1:
- * @env: CPUARMState
- * @mmu_idx: MMU index indicating required translation regime
- *
- * Extracts the TBI1 value from the appropriate TCR for the current EL
- *
- * Returns: the TBI1 value.
- */
-uint32_t arm_regime_tbi1(CPUARMState *env, ARMMMUIdx mmu_idx);
-#else
-/* We can't handle tagged addresses properly in user-only mode */
-static inline uint32_t arm_regime_tbi0(CPUARMState *env, ARMMMUIdx mmu_idx)
-{
- return 0;
-}
-
-static inline uint32_t arm_regime_tbi1(CPUARMState *env, ARMMMUIdx mmu_idx)
-{
- return 0;
-}
-#endif
-
void cpu_get_tb_cpu_state(CPUARMState *env, target_ulong *pc,
target_ulong *cs_base, uint32_t *flags);
diff --git a/target/arm/helper.c b/target/arm/helper.c
index 99ceed2cab..3ad5909b1e 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -8967,48 +8967,6 @@ static inline ARMMMUIdx stage_1_mmu_idx(ARMMMUIdx mmu_idx)
return mmu_idx;
}
-/* Returns TBI0 value for current regime el */
-uint32_t arm_regime_tbi0(CPUARMState *env, ARMMMUIdx mmu_idx)
-{
- TCR *tcr;
- uint32_t el;
-
- /* For EL0 and EL1, TBI is controlled by stage 1's TCR, so convert
- * a stage 1+2 mmu index into the appropriate stage 1 mmu index.
- */
- mmu_idx = stage_1_mmu_idx(mmu_idx);
-
- tcr = regime_tcr(env, mmu_idx);
- el = regime_el(env, mmu_idx);
-
- if (el > 1) {
- return extract64(tcr->raw_tcr, 20, 1);
- } else {
- return extract64(tcr->raw_tcr, 37, 1);
- }
-}
-
-/* Returns TBI1 value for current regime el */
-uint32_t arm_regime_tbi1(CPUARMState *env, ARMMMUIdx mmu_idx)
-{
- TCR *tcr;
- uint32_t el;
-
- /* For EL0 and EL1, TBI is controlled by stage 1's TCR, so convert
- * a stage 1+2 mmu index into the appropriate stage 1 mmu index.
- */
- mmu_idx = stage_1_mmu_idx(mmu_idx);
-
- tcr = regime_tcr(env, mmu_idx);
- el = regime_el(env, mmu_idx);
-
- if (el > 1) {
- return 0;
- } else {
- return extract64(tcr->raw_tcr, 38, 1);
- }
-}
-
/* Return the TTBR associated with this translation regime */
static inline uint64_t regime_ttbr(CPUARMState *env, ARMMMUIdx mmu_idx,
int ttbrn)
@@ -13041,9 +12999,16 @@ void cpu_get_tb_cpu_state(CPUARMState *env, target_ulong *pc,
*pc = env->pc;
flags = ARM_TBFLAG_AARCH64_STATE_MASK;
- /* Get control bits for tagged addresses */
- flags |= (arm_regime_tbi0(env, mmu_idx) << ARM_TBFLAG_TBI0_SHIFT);
- flags |= (arm_regime_tbi1(env, mmu_idx) << ARM_TBFLAG_TBI1_SHIFT);
+
+#ifndef CONFIG_USER_ONLY
+ /* Get control bits for tagged addresses. Note that the
+ * translator only uses this for instruction addresses.
+ */
+ flags |= (aa64_va_parameters(env, 0, mmu_idx, false).tbi
+ << ARM_TBFLAG_TBI0_SHIFT);
+ flags |= (aa64_va_parameters(env, -1, mmu_idx, false).tbi
+ << ARM_TBFLAG_TBI1_SHIFT);
+#endif
if (cpu_isar_feature(aa64_sve, cpu)) {
int sve_el = sve_exception_el(env, current_el);
--
2.17.2
^ permalink raw reply related [flat|nested] 47+ messages in thread* Re: [Qemu-devel] [PATCH 17/26] target/arm: Reuse aa64_va_parameters for setting tbflags
2018-12-07 10:36 ` [Qemu-devel] [PATCH 17/26] target/arm: Reuse aa64_va_parameters for setting tbflags Richard Henderson
@ 2018-12-11 16:52 ` Peter Maydell
2018-12-11 18:21 ` Richard Henderson
0 siblings, 1 reply; 47+ messages in thread
From: Peter Maydell @ 2018-12-11 16:52 UTC (permalink / raw)
To: Richard Henderson; +Cc: QEMU Developers, Ramana Radhakrishnan
On Fri, 7 Dec 2018 at 10:37, Richard Henderson
<richard.henderson@linaro.org> wrote:
>
> The arm_regime_tbi{0,1} functions are replacable with the new function
> by giving the lowest and highest address.
>
> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
> ---
> target/arm/cpu.h | 35 -----------------------------
> target/arm/helper.c | 55 +++++++++------------------------------------
> 2 files changed, 10 insertions(+), 80 deletions(-)
> diff --git a/target/arm/helper.c b/target/arm/helper.c
> index 99ceed2cab..3ad5909b1e 100644
> --- a/target/arm/helper.c
> +++ b/target/arm/helper.c
> @@ -8967,48 +8967,6 @@ static inline ARMMMUIdx stage_1_mmu_idx(ARMMMUIdx mmu_idx)
> return mmu_idx;
> }
>
> -/* Returns TBI0 value for current regime el */
> -uint32_t arm_regime_tbi0(CPUARMState *env, ARMMMUIdx mmu_idx)
> -{
> - TCR *tcr;
> - uint32_t el;
> -
> - /* For EL0 and EL1, TBI is controlled by stage 1's TCR, so convert
> - * a stage 1+2 mmu index into the appropriate stage 1 mmu index.
> - */
> - mmu_idx = stage_1_mmu_idx(mmu_idx);
> -
> - tcr = regime_tcr(env, mmu_idx);
> - el = regime_el(env, mmu_idx);
> -
> - if (el > 1) {
> - return extract64(tcr->raw_tcr, 20, 1);
> - } else {
> - return extract64(tcr->raw_tcr, 37, 1);
> - }
> -}
> -
> -/* Returns TBI1 value for current regime el */
> -uint32_t arm_regime_tbi1(CPUARMState *env, ARMMMUIdx mmu_idx)
> -{
> - TCR *tcr;
> - uint32_t el;
> -
> - /* For EL0 and EL1, TBI is controlled by stage 1's TCR, so convert
> - * a stage 1+2 mmu index into the appropriate stage 1 mmu index.
> - */
> - mmu_idx = stage_1_mmu_idx(mmu_idx);
> -
> - tcr = regime_tcr(env, mmu_idx);
> - el = regime_el(env, mmu_idx);
> -
> - if (el > 1) {
> - return 0;
> - } else {
> - return extract64(tcr->raw_tcr, 38, 1);
> - }
> -}
> -
> /* Return the TTBR associated with this translation regime */
> static inline uint64_t regime_ttbr(CPUARMState *env, ARMMMUIdx mmu_idx,
> int ttbrn)
> @@ -13041,9 +12999,16 @@ void cpu_get_tb_cpu_state(CPUARMState *env, target_ulong *pc,
>
> *pc = env->pc;
> flags = ARM_TBFLAG_AARCH64_STATE_MASK;
> - /* Get control bits for tagged addresses */
> - flags |= (arm_regime_tbi0(env, mmu_idx) << ARM_TBFLAG_TBI0_SHIFT);
> - flags |= (arm_regime_tbi1(env, mmu_idx) << ARM_TBFLAG_TBI1_SHIFT);
> +
> +#ifndef CONFIG_USER_ONLY
> + /* Get control bits for tagged addresses. Note that the
> + * translator only uses this for instruction addresses.
> + */
> + flags |= (aa64_va_parameters(env, 0, mmu_idx, false).tbi
> + << ARM_TBFLAG_TBI0_SHIFT);
> + flags |= (aa64_va_parameters(env, -1, mmu_idx, false).tbi
> + << ARM_TBFLAG_TBI1_SHIFT);
> +#endif
This has lost the bit of the old functions that converted
the stage 1+2 MMU index into a stage 1 MMU index. The call
to regime_el() in aa64_va_parameters() will assert if it is
passed ARMMMUIdx_S12NSE0 or ARMMMUIdx_S12NSE1. (In the code
paths in the get_phys_addr() functions, this is handled by
the top level get_phys_addr() code, so get_phys_addr_lpae()
never sees a stage 1+2 MMU index.)
thanks
-- PMM
^ permalink raw reply [flat|nested] 47+ messages in thread* Re: [Qemu-devel] [PATCH 17/26] target/arm: Reuse aa64_va_parameters for setting tbflags
2018-12-11 16:52 ` Peter Maydell
@ 2018-12-11 18:21 ` Richard Henderson
0 siblings, 0 replies; 47+ messages in thread
From: Richard Henderson @ 2018-12-11 18:21 UTC (permalink / raw)
To: Peter Maydell; +Cc: QEMU Developers, Ramana Radhakrishnan
On 12/11/18 10:52 AM, Peter Maydell wrote:
> This has lost the bit of the old functions that converted
> the stage 1+2 MMU index into a stage 1 MMU index. The call
> to regime_el() in aa64_va_parameters() will assert if it is
> passed ARMMMUIdx_S12NSE0 or ARMMMUIdx_S12NSE1. (In the code
> paths in the get_phys_addr() functions, this is handled by
> the top level get_phys_addr() code, so get_phys_addr_lpae()
> never sees a stage 1+2 MMU index.)
Yes, I've got a fixup patch on my branch for this.
It showed up quite early booting bios. ;-)
r~
^ permalink raw reply [flat|nested] 47+ messages in thread
* [Qemu-devel] [PATCH 18/26] target/arm: Export aa64_va_parameters to internals.h
2018-12-07 10:36 [Qemu-devel] [PATCH 00/26] target/arm: Implement ARMv8.3-PAuth Richard Henderson
` (16 preceding siblings ...)
2018-12-07 10:36 ` [Qemu-devel] [PATCH 17/26] target/arm: Reuse aa64_va_parameters for setting tbflags Richard Henderson
@ 2018-12-07 10:36 ` Richard Henderson
2018-12-11 16:53 ` Peter Maydell
2018-12-07 10:36 ` [Qemu-devel] [PATCH 19/26] target/arm: Implement pauth_strip Richard Henderson
` (7 subsequent siblings)
25 siblings, 1 reply; 47+ messages in thread
From: Richard Henderson @ 2018-12-07 10:36 UTC (permalink / raw)
To: qemu-devel; +Cc: peter.maydell, ramana.radhakrishnan
We need to reuse this from helper-a64.c. Provide a stub
definition for CONFIG_USER_ONLY. This matches the stub
definitions that we removed for arm_regime_tbi{0,1} before.
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
target/arm/internals.h | 29 +++++++++++++++++++++++++++++
target/arm/helper.c | 16 ++--------------
2 files changed, 31 insertions(+), 14 deletions(-)
diff --git a/target/arm/internals.h b/target/arm/internals.h
index 6bc0daf560..4d25b267e8 100644
--- a/target/arm/internals.h
+++ b/target/arm/internals.h
@@ -912,4 +912,33 @@ void arm_cpu_update_virq(ARMCPU *cpu);
*/
void arm_cpu_update_vfiq(ARMCPU *cpu);
+typedef struct ARMVAParameters {
+ unsigned tsz : 8;
+ unsigned select : 1;
+ bool tbi : 1;
+ bool epd : 1;
+ bool hpd : 1;
+ bool ha : 1;
+ bool hd : 1;
+ bool using16k : 1;
+ bool using64k : 1;
+} ARMVAParameters;
+
+#ifdef CONFIG_USER_ONLY
+static inline ARMVAParameters aa64_va_parameters(CPUARMState *env,
+ uint64_t va,
+ ARMMMUIdx mmu_idx, bool data)
+{
+ return (ARMVAParameters) {
+ /* 48-bit address space */
+ .tsz = 16,
+ /* We can't handle tagged addresses properly in user-only mode */
+ .tbi = false,
+ };
+}
+#else
+ARMVAParameters aa64_va_parameters(CPUARMState *env, uint64_t va,
+ ARMMMUIdx mmu_idx, bool data);
+#endif
+
#endif
diff --git a/target/arm/helper.c b/target/arm/helper.c
index 3ad5909b1e..c73525f813 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -9712,20 +9712,8 @@ static uint8_t convert_stage2_attrs(CPUARMState *env, uint8_t s2attrs)
return (hiattr << 6) | (hihint << 4) | (loattr << 2) | lohint;
}
-typedef struct ARMVAParameters {
- unsigned tsz : 8;
- unsigned select : 1;
- bool tbi : 1;
- bool epd : 1;
- bool hpd : 1;
- bool ha : 1;
- bool hd : 1;
- bool using16k : 1;
- bool using64k : 1;
-} ARMVAParameters;
-
-static ARMVAParameters aa64_va_parameters(CPUARMState *env, uint64_t va,
- ARMMMUIdx mmu_idx, bool data)
+ARMVAParameters aa64_va_parameters(CPUARMState *env, uint64_t va,
+ ARMMMUIdx mmu_idx, bool data)
{
uint64_t tcr = regime_tcr(env, mmu_idx)->raw_tcr;
uint32_t el = regime_el(env, mmu_idx);
--
2.17.2
^ permalink raw reply related [flat|nested] 47+ messages in thread* Re: [Qemu-devel] [PATCH 18/26] target/arm: Export aa64_va_parameters to internals.h
2018-12-07 10:36 ` [Qemu-devel] [PATCH 18/26] target/arm: Export aa64_va_parameters to internals.h Richard Henderson
@ 2018-12-11 16:53 ` Peter Maydell
2018-12-11 18:23 ` Richard Henderson
0 siblings, 1 reply; 47+ messages in thread
From: Peter Maydell @ 2018-12-11 16:53 UTC (permalink / raw)
To: Richard Henderson; +Cc: QEMU Developers, Ramana Radhakrishnan
On Fri, 7 Dec 2018 at 10:37, Richard Henderson
<richard.henderson@linaro.org> wrote:
>
> We need to reuse this from helper-a64.c. Provide a stub
> definition for CONFIG_USER_ONLY. This matches the stub
> definitions that we removed for arm_regime_tbi{0,1} before.
>
> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
> ---
> target/arm/internals.h | 29 +++++++++++++++++++++++++++++
> target/arm/helper.c | 16 ++--------------
> 2 files changed, 31 insertions(+), 14 deletions(-)
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
thanks
-- PMM
^ permalink raw reply [flat|nested] 47+ messages in thread* Re: [Qemu-devel] [PATCH 18/26] target/arm: Export aa64_va_parameters to internals.h
2018-12-11 16:53 ` Peter Maydell
@ 2018-12-11 18:23 ` Richard Henderson
0 siblings, 0 replies; 47+ messages in thread
From: Richard Henderson @ 2018-12-11 18:23 UTC (permalink / raw)
To: Peter Maydell; +Cc: QEMU Developers, Ramana Radhakrishnan
On 12/11/18 10:53 AM, Peter Maydell wrote:
> On Fri, 7 Dec 2018 at 10:37, Richard Henderson
> <richard.henderson@linaro.org> wrote:
>>
>> We need to reuse this from helper-a64.c. Provide a stub
>> definition for CONFIG_USER_ONLY. This matches the stub
>> definitions that we removed for arm_regime_tbi{0,1} before.
>>
>> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
>> ---
>> target/arm/internals.h | 29 +++++++++++++++++++++++++++++
>> target/arm/helper.c | 16 ++--------------
>> 2 files changed, 31 insertions(+), 14 deletions(-)
>
> Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
FWIW, I'll smoosh this into the creation of the helper.
At some point we may fix tbi for user-only.
r~
^ permalink raw reply [flat|nested] 47+ messages in thread
* [Qemu-devel] [PATCH 19/26] target/arm: Implement pauth_strip
2018-12-07 10:36 [Qemu-devel] [PATCH 00/26] target/arm: Implement ARMv8.3-PAuth Richard Henderson
` (17 preceding siblings ...)
2018-12-07 10:36 ` [Qemu-devel] [PATCH 18/26] target/arm: Export aa64_va_parameters to internals.h Richard Henderson
@ 2018-12-07 10:36 ` Richard Henderson
2018-12-07 10:36 ` [Qemu-devel] [PATCH 20/26] target/arm: Implement pauth_auth Richard Henderson
` (6 subsequent siblings)
25 siblings, 0 replies; 47+ messages in thread
From: Richard Henderson @ 2018-12-07 10:36 UTC (permalink / raw)
To: qemu-devel; +Cc: peter.maydell, ramana.radhakrishnan
Stripping out the authentication data does not require any crypto,
it merely requires the virtual address parameters.
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
target/arm/helper-a64.c | 16 ++++++++++++++--
1 file changed, 14 insertions(+), 2 deletions(-)
diff --git a/target/arm/helper-a64.c b/target/arm/helper-a64.c
index 0818fd5451..8860704720 100644
--- a/target/arm/helper-a64.c
+++ b/target/arm/helper-a64.c
@@ -1069,15 +1069,27 @@ static uint64_t pauth_addpac(CPUARMState *env, uint64_t ptr, uint64_t modifier,
g_assert_not_reached(); /* FIXME */
}
+static uint64_t pauth_original_ptr(uint64_t ptr, ARMVAParameters param)
+{
+ uint64_t extfield = -param.select;
+ int bot_pac_bit = 64 - param.tsz;
+ int top_pac_bit = 64 - 8 * param.tbi;
+
+ return deposit64(ptr, bot_pac_bit, top_pac_bit - bot_pac_bit, extfield);
+}
+
static uint64_t pauth_auth(CPUARMState *env, uint64_t ptr, uint64_t modifier,
uint64_t *key, bool data, int keynumber)
{
g_assert_not_reached(); /* FIXME */
}
-static uint64_t pauth_strip(CPUARMState *env, uint64_t a, bool data)
+static uint64_t pauth_strip(CPUARMState *env, uint64_t ptr, bool data)
{
- g_assert_not_reached(); /* FIXME */
+ ARMMMUIdx mmu_idx = arm_mmu_idx(env);
+ ARMVAParameters param = aa64_va_parameters(env, ptr, mmu_idx, data);
+
+ return pauth_original_ptr(ptr, param);
}
static void QEMU_NORETURN pauth_trap(CPUARMState *env, int target_el,
--
2.17.2
^ permalink raw reply related [flat|nested] 47+ messages in thread* [Qemu-devel] [PATCH 20/26] target/arm: Implement pauth_auth
2018-12-07 10:36 [Qemu-devel] [PATCH 00/26] target/arm: Implement ARMv8.3-PAuth Richard Henderson
` (18 preceding siblings ...)
2018-12-07 10:36 ` [Qemu-devel] [PATCH 19/26] target/arm: Implement pauth_strip Richard Henderson
@ 2018-12-07 10:36 ` Richard Henderson
2018-12-07 10:36 ` [Qemu-devel] [PATCH 21/26] target/arm: Implement pauth_addpac Richard Henderson
` (5 subsequent siblings)
25 siblings, 0 replies; 47+ messages in thread
From: Richard Henderson @ 2018-12-07 10:36 UTC (permalink / raw)
To: qemu-devel; +Cc: peter.maydell, ramana.radhakrishnan
This is not really functional yet, because the crypto is not yet
implemented. This, however follows the Auth pseudo function.
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
target/arm/helper-a64.c | 21 ++++++++++++++++++++-
1 file changed, 20 insertions(+), 1 deletion(-)
diff --git a/target/arm/helper-a64.c b/target/arm/helper-a64.c
index 8860704720..2c14a71f03 100644
--- a/target/arm/helper-a64.c
+++ b/target/arm/helper-a64.c
@@ -1081,7 +1081,26 @@ static uint64_t pauth_original_ptr(uint64_t ptr, ARMVAParameters param)
static uint64_t pauth_auth(CPUARMState *env, uint64_t ptr, uint64_t modifier,
uint64_t *key, bool data, int keynumber)
{
- g_assert_not_reached(); /* FIXME */
+ ARMMMUIdx mmu_idx = arm_mmu_idx(env);
+ ARMVAParameters param = aa64_va_parameters(env, ptr, mmu_idx, data);
+ int bot_bit, top_bit;
+ uint64_t pac, orig_ptr, test;
+
+ orig_ptr = pauth_original_ptr(ptr, param);
+ pac = pauth_computepac(orig_ptr, modifier, key[1], key[0]);
+ bot_bit = 64 - param.tsz;
+ top_bit = 64 - 8 * param.tbi;
+
+ test = (pac ^ ptr) & ~MAKE_64BIT_MASK(55, 1);
+ if (unlikely(extract64(test, bot_bit, top_bit - bot_bit))) {
+ int error_code = (keynumber << 1) | (keynumber ^ 1);
+ if (param.tbi) {
+ return deposit64(ptr, 53, 2, error_code);
+ } else {
+ return deposit64(ptr, 61, 2, error_code);
+ }
+ }
+ return orig_ptr;
}
static uint64_t pauth_strip(CPUARMState *env, uint64_t ptr, bool data)
--
2.17.2
^ permalink raw reply related [flat|nested] 47+ messages in thread* [Qemu-devel] [PATCH 21/26] target/arm: Implement pauth_addpac
2018-12-07 10:36 [Qemu-devel] [PATCH 00/26] target/arm: Implement ARMv8.3-PAuth Richard Henderson
` (19 preceding siblings ...)
2018-12-07 10:36 ` [Qemu-devel] [PATCH 20/26] target/arm: Implement pauth_auth Richard Henderson
@ 2018-12-07 10:36 ` Richard Henderson
2018-12-07 10:36 ` [Qemu-devel] [PATCH 22/26] target/arm: Implement pauth_computepac Richard Henderson
` (4 subsequent siblings)
25 siblings, 0 replies; 47+ messages in thread
From: Richard Henderson @ 2018-12-07 10:36 UTC (permalink / raw)
To: qemu-devel; +Cc: peter.maydell, ramana.radhakrishnan
This is not really functional yet, because the crypto is not yet
implemented. This, however follows the AddPAC pseudo function.
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
target/arm/helper-a64.c | 40 +++++++++++++++++++++++++++++++++++++++-
1 file changed, 39 insertions(+), 1 deletion(-)
diff --git a/target/arm/helper-a64.c b/target/arm/helper-a64.c
index 2c14a71f03..28bdf6f0b2 100644
--- a/target/arm/helper-a64.c
+++ b/target/arm/helper-a64.c
@@ -1066,7 +1066,45 @@ static uint64_t pauth_computepac(uint64_t data, uint64_t modifier,
static uint64_t pauth_addpac(CPUARMState *env, uint64_t ptr, uint64_t modifier,
uint64_t *key, bool data)
{
- g_assert_not_reached(); /* FIXME */
+ ARMMMUIdx mmu_idx = arm_mmu_idx(env);
+ ARMVAParameters param = aa64_va_parameters(env, ptr, mmu_idx, data);
+ uint64_t pac, ext_ptr, ext, test;
+ int bot_bit, top_bit;
+
+ /* If tagged pointers are in use, use ptr<55>, otherwise ptr<63>. */
+ if (param.tbi) {
+ ext = sextract64(ptr, 55, 1);
+ } else {
+ ext = sextract64(ptr, 63, 1);
+ }
+
+ /* Build a pointer with known good extension bits. */
+ top_bit = 64 - 8 * param.tbi;
+ bot_bit = 64 - param.tsz;
+ ext_ptr = deposit64(ptr, bot_bit, top_bit - bot_bit, ext);
+
+ pac = pauth_computepac(ext_ptr, modifier, key[1], key[0]);
+
+ /* Check if the ptr has good extension bits and corrupt the
+ * pointer authentication code if not.
+ */
+ test = sextract64(ptr, bot_bit, top_bit - bot_bit);
+ if (test != 0 && test != -1) {
+ pac ^= 1ull << (top_bit - 1);
+ }
+
+ /* Preserve the determination between upper and lower at bit 55,
+ * and insert pointer authentication code.
+ */
+ if (param.tbi) {
+ ptr &= ~MAKE_64BIT_MASK(bot_bit, 55 - bot_bit);
+ pac &= MAKE_64BIT_MASK(bot_bit, 54 - bot_bit);
+ } else {
+ ptr &= MAKE_64BIT_MASK(0, bot_bit - 1);
+ pac &= ~(MAKE_64BIT_MASK(55, 1) | MAKE_64BIT_MASK(0, bot_bit - 1));
+ }
+ ext &= MAKE_64BIT_MASK(55, 1);
+ return pac | ext | ptr;
}
static uint64_t pauth_original_ptr(uint64_t ptr, ARMVAParameters param)
--
2.17.2
^ permalink raw reply related [flat|nested] 47+ messages in thread* [Qemu-devel] [PATCH 22/26] target/arm: Implement pauth_computepac
2018-12-07 10:36 [Qemu-devel] [PATCH 00/26] target/arm: Implement ARMv8.3-PAuth Richard Henderson
` (20 preceding siblings ...)
2018-12-07 10:36 ` [Qemu-devel] [PATCH 21/26] target/arm: Implement pauth_addpac Richard Henderson
@ 2018-12-07 10:36 ` Richard Henderson
2018-12-07 10:36 ` [Qemu-devel] [PATCH 23/26] target/arm: Add PAuth system registers Richard Henderson
` (3 subsequent siblings)
25 siblings, 0 replies; 47+ messages in thread
From: Richard Henderson @ 2018-12-07 10:36 UTC (permalink / raw)
To: qemu-devel; +Cc: peter.maydell, ramana.radhakrishnan
This is the main crypto routine, an implementation of QARMA.
This matches, as much as possible, ARM pseudocode.
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
target/arm/helper-a64.c | 240 +++++++++++++++++++++++++++++++++++++++-
1 file changed, 239 insertions(+), 1 deletion(-)
diff --git a/target/arm/helper-a64.c b/target/arm/helper-a64.c
index 28bdf6f0b2..c6755a7a07 100644
--- a/target/arm/helper-a64.c
+++ b/target/arm/helper-a64.c
@@ -1057,10 +1057,248 @@ uint32_t HELPER(sqrt_f16)(uint32_t a, void *fpstp)
* Helpers for ARMv8.3-PAuth.
*/
+static uint64_t pac_cell_shuffle(uint64_t i)
+{
+ uint64_t o = 0;
+
+ o |= extract64(i, 52, 4);
+ o |= extract64(i, 24, 4) << 4;
+ o |= extract64(i, 44, 4) << 8;
+ o |= extract64(i, 0, 4) << 12;
+
+ o |= extract64(i, 28, 4) << 16;
+ o |= extract64(i, 48, 4) << 20;
+ o |= extract64(i, 4, 4) << 24;
+ o |= extract64(i, 40, 4) << 28;
+
+ o |= i & MAKE_64BIT_MASK(32, 4);
+ o |= extract64(i, 12, 4) << 36;
+ o |= extract64(i, 56, 4) << 40;
+ o |= extract64(i, 8, 4) << 44;
+
+ o |= extract64(i, 36, 4) << 48;
+ o |= extract64(i, 16, 4) << 52;
+ o |= extract64(i, 40, 4) << 56;
+ o |= i & MAKE_64BIT_MASK(60, 4);
+
+ return o;
+}
+
+static uint64_t pac_cell_inv_shuffle(uint64_t i)
+{
+ uint64_t o = 0;
+
+ o |= extract64(i, 12, 4);
+ o |= extract64(i, 24, 4) << 4;
+ o |= extract64(i, 48, 4) << 8;
+ o |= extract64(i, 36, 4) << 12;
+
+ o |= extract64(i, 56, 4) << 16;
+ o |= extract64(i, 44, 4) << 20;
+ o |= extract64(i, 4, 4) << 24;
+ o |= extract64(i, 16, 4) << 28;
+
+ o |= i & MAKE_64BIT_MASK(32, 4);
+ o |= extract64(i, 52, 4) << 36;
+ o |= extract64(i, 28, 4) << 40;
+ o |= extract64(i, 8, 4) << 44;
+
+ o |= extract64(i, 20, 4) << 48;
+ o |= extract64(i, 0, 4) << 52;
+ o |= extract64(i, 40, 4) << 56;
+ o |= i & MAKE_64BIT_MASK(60, 4);
+
+ return o;
+}
+
+static uint64_t pac_sub(uint64_t i)
+{
+ static const uint8_t sub[16] = {
+ 0xb, 0x6, 0x8, 0xf, 0xc, 0x0, 0x9, 0xe,
+ 0x3, 0x7, 0x4, 0x5, 0xd, 0x2, 0x1, 0xa,
+ };
+ uint64_t o = 0;
+ int b;
+
+ for (b = 0; b < 64; b += 16) {
+ o |= (uint64_t)sub[(i >> b) & 0xf] << b;
+ }
+ return o;
+}
+
+static uint64_t pac_inv_sub(uint64_t i)
+{
+ static const uint8_t inv_sub[16] = {
+ 0x5, 0xe, 0xd, 0x8, 0xa, 0xb, 0x1, 0x9,
+ 0x2, 0x6, 0xf, 0x0, 0x4, 0xc, 0x7, 0x3,
+ };
+ uint64_t o = 0;
+ int b;
+
+ for (b = 0; b < 64; b += 16) {
+ o |= (uint64_t)inv_sub[(i >> b) & 0xf] << b;
+ }
+ return o;
+}
+
+static int rot_cell(int cell, int n)
+{
+ cell |= cell << 4;
+ cell >>= n;
+ return cell & 0xf;
+}
+
+static uint64_t pac_mult(uint64_t i)
+{
+ uint64_t o = 0;
+ int b;
+
+ for (b = 0; b < 4 * 4; b += 4) {
+ int i0, i4, i8, ic, t0, t1, t2, t3;
+
+ i0 = extract64(i, b, 4);
+ i4 = extract64(i, b + 4 * 4, 4);
+ i8 = extract64(i, b + 8 * 4, 4);
+ ic = extract64(i, b + 12 * 4, 4);
+
+ t0 = rot_cell(i8, 1) ^ rot_cell(i4, 2) ^ rot_cell(i0, 1);
+ t1 = rot_cell(ic, 1) ^ rot_cell(i4, 1) ^ rot_cell(i0, 2);
+ t2 = rot_cell(ic, 2) ^ rot_cell(i8, 1) ^ rot_cell(i0, 1);
+ t3 = rot_cell(ic, 2) ^ rot_cell(i8, 2) ^ rot_cell(i4, 1);
+
+ o |= (uint64_t)t3 << b;
+ o |= (uint64_t)t2 << (b + 4 * 4);
+ o |= (uint64_t)t1 << (b + 8 * 4);
+ o |= (uint64_t)t0 << (b + 12 * 4);
+ }
+ return o;
+}
+
+static uint64_t tweak_cell_rot(uint64_t cell)
+{
+ return (cell >> 1) | (((cell ^ (cell >> 1)) & 1) << 3);
+}
+
+static uint64_t tweak_shuffle(uint64_t i)
+{
+ uint64_t o = 0;
+
+ o |= extract64(i, 16, 4) << 0;
+ o |= extract64(i, 20, 4) << 4;
+ o |= tweak_cell_rot(extract64(i, 24, 4)) << 8;
+ o |= extract64(i, 28, 4) << 12;
+
+ o |= tweak_cell_rot(extract64(i, 44, 4)) << 16;
+ o |= extract64(i, 8, 4) << 20;
+ o |= extract64(i, 12, 4) << 24;
+ o |= tweak_cell_rot(extract64(i, 32, 4)) << 28;
+
+ o |= extract64(i, 48, 4) << 32;
+ o |= extract64(i, 52, 4) << 36;
+ o |= extract64(i, 56, 4) << 40;
+ o |= tweak_cell_rot(extract64(i, 60, 4)) << 44;
+
+ o |= tweak_cell_rot(extract64(i, 0, 4)) << 48;
+ o |= extract64(i, 4, 4) << 52;
+ o |= tweak_cell_rot(extract64(i, 40, 4)) << 56;
+ o |= tweak_cell_rot(extract64(i, 36, 4)) << 60;
+
+ return o;
+}
+
+static uint64_t tweak_cell_inv_rot(uint64_t cell)
+{
+ return ((cell << 1) & 0xf) | ((cell & 1) ^ (cell >> 3));
+}
+
+static uint64_t tweak_inv_shuffle(uint64_t i)
+{
+ uint64_t o = 0;
+
+ o |= tweak_cell_inv_rot(extract64(i, 48, 4));
+ o |= extract64(i, 52, 4) << 4;
+ o |= extract64(i, 20, 4) << 8;
+ o |= extract64(i, 24, 4) << 12;
+
+ o |= extract64(i, 0, 4) << 16;
+ o |= extract64(i, 4, 4) << 20;
+ o |= tweak_cell_inv_rot(extract64(i, 8, 4)) << 24;
+ o |= extract64(i, 12, 4) << 28;
+
+ o |= tweak_cell_inv_rot(extract64(i, 28, 4)) << 32;
+ o |= tweak_cell_inv_rot(extract64(i, 60, 4)) << 36;
+ o |= tweak_cell_inv_rot(extract64(i, 56, 4)) << 40;
+ o |= tweak_cell_inv_rot(extract64(i, 16, 4)) << 44;
+
+ o |= extract64(i, 32, 4) << 48;
+ o |= extract64(i, 36, 4) << 52;
+ o |= extract64(i, 40, 4) << 56;
+ o |= tweak_cell_inv_rot(extract64(i, 44, 4)) << 60;
+
+ return o;
+}
+
+/* Note that in the ARM pseudocode, key0 contains bits <127:64>
+ * and key1 contains bits <63:0> of the 128-bit key.
+ */
static uint64_t pauth_computepac(uint64_t data, uint64_t modifier,
uint64_t key0, uint64_t key1)
{
- g_assert_not_reached(); /* FIXME */
+ static const uint64_t RC[5] = {
+ 0x0000000000000000ull,
+ 0x13198A2E03707344ull,
+ 0xA4093822299F31D0ull,
+ 0x082EFA98EC4E6C89ull,
+ 0x452821E638D01377ull,
+ };
+ const uint64_t alpha = 0xC0AC29B7C97C50DDull;
+ uint64_t workingval, runningmod, roundkey, modk0;
+ int i;
+
+ modk0 = (key0 << 63) | ((key0 >> 1) ^ (key0 >> 63));
+ runningmod = modifier;
+ workingval = data ^ key0;
+
+ for (i = 0; i <= 4; ++i) {
+ roundkey = key1 ^ runningmod;
+ workingval ^= roundkey;
+ workingval ^= RC[i];
+ if (i > 0) {
+ workingval = pac_cell_shuffle(workingval);
+ workingval = pac_mult(workingval);
+ }
+ workingval = pac_sub(workingval);
+ runningmod = tweak_shuffle(runningmod);
+ }
+ roundkey = modk0 ^ runningmod;
+ workingval ^= roundkey;
+ workingval = pac_cell_shuffle(workingval);
+ workingval = pac_mult(workingval);
+ workingval = pac_sub(workingval);
+ workingval = pac_cell_shuffle(workingval);
+ workingval = pac_mult(workingval);
+ workingval ^= key1;
+ workingval = pac_cell_inv_shuffle(workingval);
+ workingval = pac_inv_sub(workingval);
+ workingval = pac_mult(workingval);
+ workingval = pac_cell_inv_shuffle(workingval);
+ workingval ^= key0;
+ workingval ^= runningmod;
+ for (i = 0; i <= 4; ++i) {
+ workingval = pac_inv_sub(workingval);
+ if (i < 4) {
+ workingval = pac_mult(workingval);
+ workingval = pac_cell_inv_shuffle(workingval);
+ }
+ runningmod = tweak_inv_shuffle(runningmod);
+ roundkey = key1 ^ runningmod;
+ workingval ^= RC[4-i];
+ workingval ^= roundkey;
+ workingval ^= alpha;
+ }
+ workingval ^= modk0;
+
+ return workingval;
}
static uint64_t pauth_addpac(CPUARMState *env, uint64_t ptr, uint64_t modifier,
--
2.17.2
^ permalink raw reply related [flat|nested] 47+ messages in thread* [Qemu-devel] [PATCH 23/26] target/arm: Add PAuth system registers
2018-12-07 10:36 [Qemu-devel] [PATCH 00/26] target/arm: Implement ARMv8.3-PAuth Richard Henderson
` (21 preceding siblings ...)
2018-12-07 10:36 ` [Qemu-devel] [PATCH 22/26] target/arm: Implement pauth_computepac Richard Henderson
@ 2018-12-07 10:36 ` Richard Henderson
2018-12-07 10:36 ` [Qemu-devel] [PATCH 24/26] target/arm: Enable PAuth for user-only -cpu max Richard Henderson
` (2 subsequent siblings)
25 siblings, 0 replies; 47+ messages in thread
From: Richard Henderson @ 2018-12-07 10:36 UTC (permalink / raw)
To: qemu-devel; +Cc: peter.maydell, ramana.radhakrishnan
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
target/arm/helper.c | 66 +++++++++++++++++++++++++++++++++++++++++++++
1 file changed, 66 insertions(+)
diff --git a/target/arm/helper.c b/target/arm/helper.c
index c73525f813..f466c174e6 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -5071,6 +5071,66 @@ static CPAccessResult access_lor_other(CPUARMState *env,
return access_lor_ns(env);
}
+#ifdef TARGET_AARCH64
+static CPAccessResult access_pauth(CPUARMState *env, const ARMCPRegInfo *ri,
+ bool isread)
+{
+ int el = arm_current_el(env);
+
+ if (el < 2 && (arm_hcr_el2_eff(env) & HCR_APK)) {
+ return CP_ACCESS_TRAP_EL2;
+ }
+ if (el < 3 && (env->cp15.scr_el3 & SCR_APK)) {
+ return CP_ACCESS_TRAP_EL3;
+ }
+ return CP_ACCESS_OK;
+}
+
+static const ARMCPRegInfo pauth_reginfo[] = {
+ { .name = "APDAKEYLOW_EL1", .state = ARM_CP_STATE_AA64,
+ .opc0 = 3, .opc1 = 0, .crn = 2, .crm = 2, .opc2 = 0,
+ .access = PL1_RW, .accessfn = access_pauth,
+ .fieldoffset = offsetof(CPUARMState, apda_key[0]) },
+ { .name = "APDAKEYHI_EL1", .state = ARM_CP_STATE_AA64,
+ .opc0 = 3, .opc1 = 0, .crn = 2, .crm = 2, .opc2 = 1,
+ .access = PL1_RW, .accessfn = access_pauth,
+ .fieldoffset = offsetof(CPUARMState, apda_key[1]) },
+ { .name = "APDBKEYLOW_EL1", .state = ARM_CP_STATE_AA64,
+ .opc0 = 3, .opc1 = 0, .crn = 2, .crm = 2, .opc2 = 2,
+ .access = PL1_RW, .accessfn = access_pauth,
+ .fieldoffset = offsetof(CPUARMState, apdb_key[0]) },
+ { .name = "APDBKEYHI_EL1", .state = ARM_CP_STATE_AA64,
+ .opc0 = 3, .opc1 = 0, .crn = 2, .crm = 2, .opc2 = 3,
+ .access = PL1_RW, .accessfn = access_pauth,
+ .fieldoffset = offsetof(CPUARMState, apdb_key[1]) },
+ { .name = "APGAKEYLOW_EL1", .state = ARM_CP_STATE_AA64,
+ .opc0 = 3, .opc1 = 0, .crn = 2, .crm = 3, .opc2 = 0,
+ .access = PL1_RW, .accessfn = access_pauth,
+ .fieldoffset = offsetof(CPUARMState, apia_key[0]) },
+ { .name = "APGAKEYHI_EL1", .state = ARM_CP_STATE_AA64,
+ .opc0 = 3, .opc1 = 0, .crn = 2, .crm = 3, .opc2 = 1,
+ .access = PL1_RW, .accessfn = access_pauth,
+ .fieldoffset = offsetof(CPUARMState, apia_key[1]) },
+ { .name = "APIAKEYLOW_EL1", .state = ARM_CP_STATE_AA64,
+ .opc0 = 3, .opc1 = 0, .crn = 2, .crm = 1, .opc2 = 0,
+ .access = PL1_RW, .accessfn = access_pauth,
+ .fieldoffset = offsetof(CPUARMState, apia_key[0]) },
+ { .name = "APIAKEYHI_EL1", .state = ARM_CP_STATE_AA64,
+ .opc0 = 3, .opc1 = 0, .crn = 2, .crm = 1, .opc2 = 1,
+ .access = PL1_RW, .accessfn = access_pauth,
+ .fieldoffset = offsetof(CPUARMState, apia_key[1]) },
+ { .name = "APIBKEYLOW_EL1", .state = ARM_CP_STATE_AA64,
+ .opc0 = 3, .opc1 = 0, .crn = 2, .crm = 1, .opc2 = 2,
+ .access = PL1_RW, .accessfn = access_pauth,
+ .fieldoffset = offsetof(CPUARMState, apib_key[0]) },
+ { .name = "APIBKEYHI_EL1", .state = ARM_CP_STATE_AA64,
+ .opc0 = 3, .opc1 = 0, .crn = 2, .crm = 1, .opc2 = 3,
+ .access = PL1_RW, .accessfn = access_pauth,
+ .fieldoffset = offsetof(CPUARMState, apib_key[1]) },
+ REGINFO_SENTINEL
+};
+#endif
+
void register_cp_regs_for_features(ARMCPU *cpu)
{
/* Register all the coprocessor registers based on feature bits */
@@ -5855,6 +5915,12 @@ void register_cp_regs_for_features(ARMCPU *cpu)
define_one_arm_cp_reg(cpu, &zcr_el3_reginfo);
}
}
+
+#ifdef TARGET_AARCH64
+ if (cpu_isar_feature(aa64_pauth, cpu)) {
+ define_arm_cp_regs(cpu, pauth_reginfo);
+ }
+#endif
}
void arm_cpu_register_gdb_regs_for_features(ARMCPU *cpu)
--
2.17.2
^ permalink raw reply related [flat|nested] 47+ messages in thread* [Qemu-devel] [PATCH 24/26] target/arm: Enable PAuth for user-only -cpu max
2018-12-07 10:36 [Qemu-devel] [PATCH 00/26] target/arm: Implement ARMv8.3-PAuth Richard Henderson
` (22 preceding siblings ...)
2018-12-07 10:36 ` [Qemu-devel] [PATCH 23/26] target/arm: Add PAuth system registers Richard Henderson
@ 2018-12-07 10:36 ` Richard Henderson
2018-12-11 15:45 ` Peter Maydell
2018-12-07 10:36 ` [Qemu-devel] [PATCH 25/26] target/arm: Enable PAuth for user-only, part 2 Richard Henderson
2018-12-07 10:36 ` [Qemu-devel] [PATCH 26/26] target/arm: Tidy TBI handling in gen_a64_set_pc Richard Henderson
25 siblings, 1 reply; 47+ messages in thread
From: Richard Henderson @ 2018-12-07 10:36 UTC (permalink / raw)
To: qemu-devel; +Cc: peter.maydell, ramana.radhakrishnan
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
target/arm/cpu64.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/target/arm/cpu64.c b/target/arm/cpu64.c
index 1d57be0c91..84f70b2a24 100644
--- a/target/arm/cpu64.c
+++ b/target/arm/cpu64.c
@@ -316,6 +316,10 @@ static void aarch64_max_initfn(Object *obj)
t = cpu->isar.id_aa64isar1;
t = FIELD_DP64(t, ID_AA64ISAR1, FCMA, 1);
+ t = FIELD_DP64(t, ID_AA64ISAR1, APA, 1); /* PAuth, architected only */
+ t = FIELD_DP64(t, ID_AA64ISAR1, API, 0);
+ t = FIELD_DP64(t, ID_AA64ISAR1, GPA, 1);
+ t = FIELD_DP64(t, ID_AA64ISAR1, GPI, 0);
cpu->isar.id_aa64isar1 = t;
t = cpu->isar.id_aa64pfr0;
--
2.17.2
^ permalink raw reply related [flat|nested] 47+ messages in thread* Re: [Qemu-devel] [PATCH 24/26] target/arm: Enable PAuth for user-only -cpu max
2018-12-07 10:36 ` [Qemu-devel] [PATCH 24/26] target/arm: Enable PAuth for user-only -cpu max Richard Henderson
@ 2018-12-11 15:45 ` Peter Maydell
2018-12-11 18:24 ` Richard Henderson
0 siblings, 1 reply; 47+ messages in thread
From: Peter Maydell @ 2018-12-11 15:45 UTC (permalink / raw)
To: Richard Henderson; +Cc: QEMU Developers, Ramana Radhakrishnan
On Fri, 7 Dec 2018 at 10:37, Richard Henderson
<richard.henderson@linaro.org> wrote:
>
> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
> ---
> target/arm/cpu64.c | 4 ++++
> 1 file changed, 4 insertions(+)
>
> diff --git a/target/arm/cpu64.c b/target/arm/cpu64.c
> index 1d57be0c91..84f70b2a24 100644
> --- a/target/arm/cpu64.c
> +++ b/target/arm/cpu64.c
> @@ -316,6 +316,10 @@ static void aarch64_max_initfn(Object *obj)
>
> t = cpu->isar.id_aa64isar1;
> t = FIELD_DP64(t, ID_AA64ISAR1, FCMA, 1);
> + t = FIELD_DP64(t, ID_AA64ISAR1, APA, 1); /* PAuth, architected only */
> + t = FIELD_DP64(t, ID_AA64ISAR1, API, 0);
> + t = FIELD_DP64(t, ID_AA64ISAR1, GPA, 1);
> + t = FIELD_DP64(t, ID_AA64ISAR1, GPI, 0);
> cpu->isar.id_aa64isar1 = t;
>
> t = cpu->isar.id_aa64pfr0;
I don't see why this is enabling for user-only and
not also for system: what am I missing ?
thanks
-- PMM
^ permalink raw reply [flat|nested] 47+ messages in thread
* Re: [Qemu-devel] [PATCH 24/26] target/arm: Enable PAuth for user-only -cpu max
2018-12-11 15:45 ` Peter Maydell
@ 2018-12-11 18:24 ` Richard Henderson
0 siblings, 0 replies; 47+ messages in thread
From: Richard Henderson @ 2018-12-11 18:24 UTC (permalink / raw)
To: Peter Maydell; +Cc: QEMU Developers, Ramana Radhakrishnan
On 12/11/18 9:45 AM, Peter Maydell wrote:
> On Fri, 7 Dec 2018 at 10:37, Richard Henderson
> <richard.henderson@linaro.org> wrote:
>>
>> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
>> ---
>> target/arm/cpu64.c | 4 ++++
>> 1 file changed, 4 insertions(+)
>>
>> diff --git a/target/arm/cpu64.c b/target/arm/cpu64.c
>> index 1d57be0c91..84f70b2a24 100644
>> --- a/target/arm/cpu64.c
>> +++ b/target/arm/cpu64.c
>> @@ -316,6 +316,10 @@ static void aarch64_max_initfn(Object *obj)
>>
>> t = cpu->isar.id_aa64isar1;
>> t = FIELD_DP64(t, ID_AA64ISAR1, FCMA, 1);
>> + t = FIELD_DP64(t, ID_AA64ISAR1, APA, 1); /* PAuth, architected only */
>> + t = FIELD_DP64(t, ID_AA64ISAR1, API, 0);
>> + t = FIELD_DP64(t, ID_AA64ISAR1, GPA, 1);
>> + t = FIELD_DP64(t, ID_AA64ISAR1, GPI, 0);
>> cpu->isar.id_aa64isar1 = t;
>>
>> t = cpu->isar.id_aa64pfr0;
>
> I don't see why this is enabling for user-only and
> not also for system: what am I missing ?
Err.. more brain fluff. This does enable for system;
it's the next patch that's for user-only.
r~
^ permalink raw reply [flat|nested] 47+ messages in thread
* [Qemu-devel] [PATCH 25/26] target/arm: Enable PAuth for user-only, part 2
2018-12-07 10:36 [Qemu-devel] [PATCH 00/26] target/arm: Implement ARMv8.3-PAuth Richard Henderson
` (23 preceding siblings ...)
2018-12-07 10:36 ` [Qemu-devel] [PATCH 24/26] target/arm: Enable PAuth for user-only -cpu max Richard Henderson
@ 2018-12-07 10:36 ` Richard Henderson
2018-12-07 10:36 ` [Qemu-devel] [PATCH 26/26] target/arm: Tidy TBI handling in gen_a64_set_pc Richard Henderson
25 siblings, 0 replies; 47+ messages in thread
From: Richard Henderson @ 2018-12-07 10:36 UTC (permalink / raw)
To: qemu-devel; +Cc: peter.maydell, ramana.radhakrishnan
FIXME: We should have an attribute that controls the EL1 enable bits.
We may not always want to turn on pointer authentication with -cpu max.
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
target/arm/cpu.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index 0b185f8d30..bc2c9eb551 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -162,6 +162,12 @@ static void arm_cpu_reset(CPUState *s)
env->pstate = PSTATE_MODE_EL0t;
/* Userspace expects access to DC ZVA, CTL_EL0 and the cache ops */
env->cp15.sctlr_el[1] |= SCTLR_UCT | SCTLR_UCI | SCTLR_DZE;
+ /* Enable all PAC keys. */
+ env->cp15.sctlr_el[1] |= SCTLR_EnIA | SCTLR_EnIB;
+ env->cp15.sctlr_el[1] |= SCTLR_EnDA | SCTLR_EnDB;
+ /* Enable all PAC instructions */
+ env->cp15.hcr_el2 |= HCR_API;
+ env->cp15.scr_el3 |= SCR_API;
/* and to the FP/Neon instructions */
env->cp15.cpacr_el1 = deposit64(env->cp15.cpacr_el1, 20, 2, 3);
/* and to the SVE instructions */
--
2.17.2
^ permalink raw reply related [flat|nested] 47+ messages in thread* [Qemu-devel] [PATCH 26/26] target/arm: Tidy TBI handling in gen_a64_set_pc
2018-12-07 10:36 [Qemu-devel] [PATCH 00/26] target/arm: Implement ARMv8.3-PAuth Richard Henderson
` (24 preceding siblings ...)
2018-12-07 10:36 ` [Qemu-devel] [PATCH 25/26] target/arm: Enable PAuth for user-only, part 2 Richard Henderson
@ 2018-12-07 10:36 ` Richard Henderson
25 siblings, 0 replies; 47+ messages in thread
From: Richard Henderson @ 2018-12-07 10:36 UTC (permalink / raw)
To: qemu-devel; +Cc: peter.maydell, ramana.radhakrishnan
We can perform this with fewer operations.
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
target/arm/translate-a64.c | 65 ++++++++++++++------------------------
1 file changed, 23 insertions(+), 42 deletions(-)
diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index 99e1405dff..15080cbb3c 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -261,7 +261,7 @@ void gen_a64_set_pc_im(uint64_t val)
/* Load the PC from a generic TCG variable.
*
* If address tagging is enabled via the TCR TBI bits, then loading
- * an address into the PC will clear out any tag in the it:
+ * an address into the PC will clear out any tag in it:
* + for EL2 and EL3 there is only one TBI bit, and if it is set
* then the address is zero-extended, clearing bits [63:56]
* + for EL0 and EL1, TBI0 controls addresses with bit 55 == 0
@@ -276,56 +276,37 @@ void gen_a64_set_pc_im(uint64_t val)
*/
static void gen_a64_set_pc(DisasContext *s, TCGv_i64 src)
{
+ bool tbi0 = s->tbi0, tbi1 = s->tbi1;
if (s->current_el <= 1) {
- /* Test if NEITHER or BOTH TBI values are set. If so, no need to
- * examine bit 55 of address, can just generate code.
- * If mixed, then test via generated code
- */
- if (s->tbi0 && s->tbi1) {
- TCGv_i64 tmp_reg = tcg_temp_new_i64();
- /* Both bits set, sign extension from bit 55 into [63:56] will
- * cover both cases
- */
- tcg_gen_shli_i64(tmp_reg, src, 8);
- tcg_gen_sari_i64(cpu_pc, tmp_reg, 8);
- tcg_temp_free_i64(tmp_reg);
- } else if (!s->tbi0 && !s->tbi1) {
- /* Neither bit set, just load it as-is */
- tcg_gen_mov_i64(cpu_pc, src);
- } else {
- TCGv_i64 tcg_tmpval = tcg_temp_new_i64();
- TCGv_i64 tcg_bit55 = tcg_temp_new_i64();
- TCGv_i64 tcg_zero = tcg_const_i64(0);
+ if (tbi0 || tbi1) {
+ /* Sign-extend from bit 55. */
+ tcg_gen_sextract_i64(cpu_pc, src, 0, 56);
- tcg_gen_andi_i64(tcg_bit55, src, (1ull << 55));
+ if (tbi0 != tbi1) {
+ TCGv_i64 tcg_zero = tcg_const_i64(0);
- if (s->tbi0) {
- /* tbi0==1, tbi1==0, so 0-fill upper byte if bit 55 = 0 */
- tcg_gen_andi_i64(tcg_tmpval, src,
- 0x00FFFFFFFFFFFFFFull);
- tcg_gen_movcond_i64(TCG_COND_EQ, cpu_pc, tcg_bit55, tcg_zero,
- tcg_tmpval, src);
- } else {
- /* tbi0==0, tbi1==1, so 1-fill upper byte if bit 55 = 1 */
- tcg_gen_ori_i64(tcg_tmpval, src,
- 0xFF00000000000000ull);
- tcg_gen_movcond_i64(TCG_COND_NE, cpu_pc, tcg_bit55, tcg_zero,
- tcg_tmpval, src);
+ /*
+ * The two TBI bits differ.
+ * If tbi0, then !tbi1: only use the extension if positive.
+ * if !tbi0, then tbi1: only use the extension if negative.
+ */
+ tcg_gen_movcond_i64(tbi0 ? TCG_COND_GE : TCG_COND_LT,
+ cpu_pc, cpu_pc, tcg_zero, cpu_pc, src);
+ tcg_temp_free_i64(tcg_zero);
}
- tcg_temp_free_i64(tcg_zero);
- tcg_temp_free_i64(tcg_bit55);
- tcg_temp_free_i64(tcg_tmpval);
+ return;
}
- } else { /* EL > 1 */
- if (s->tbi0) {
+ } else {
+ if (tbi0) {
/* Force tag byte to all zero */
- tcg_gen_andi_i64(cpu_pc, src, 0x00FFFFFFFFFFFFFFull);
- } else {
- /* Load unmodified address */
- tcg_gen_mov_i64(cpu_pc, src);
+ tcg_gen_extract_i64(cpu_pc, src, 0, 56);
+ return;
}
}
+
+ /* Load unmodified address */
+ tcg_gen_mov_i64(cpu_pc, src);
}
typedef struct DisasCompare64 {
--
2.17.2
^ permalink raw reply related [flat|nested] 47+ messages in thread