2  * ARM v8.5-MemTag Operations
24 #include "exec/page-protection.h"
27 #include "user/page-protection.h"
31 #include "accel/tcg/cpu-ldst.h"
33 #include "exec/helper-proto.h"
34 #include "exec/tlb-flags.h"
35 #include "accel/tcg/cpu-ops.h"
37 #include "qemu/guest-random.h"
54         } while (--offset > 0);  in choose_nonexcluded_tag()
89                       TARGET_PAGE_BITS - LOG2_TAG_GRANULE - 1);  in allocation_tag_mem_probe()
104      * into the softmmu tlb.  in allocation_tag_mem_probe()
106      * When RA == 0, this is either a pure probe or a no-fault-expected probe.  in allocation_tag_mem_probe()
107      * Indicate to probe_access_flags no-fault, then either return NULL  in allocation_tag_mem_probe()
109      * no-fault-expected probe.  in allocation_tag_mem_probe()
119     if (full->extra.arm.pte_attrs != 0xf0) {  in allocation_tag_mem_probe()
138     ptr_paddr = full->phys_addr | (ptr & ~TARGET_PAGE_MASK);  in allocation_tag_mem_probe()
139     attrs = full->attrs;  in allocation_tag_mem_probe()
144      * 8-byte access to the last byte of a page will check only the last  in allocation_tag_mem_probe()
148     in_page = -(ptr | TARGET_PAGE_MASK);  in allocation_tag_mem_probe()
209     uint16_t exclude = extract32(rm | env->cp15.gcr_el1, 0, 16);  in HELPER()
210     int rrnd = extract32(env->cp15.gcr_el1, 16, 1);  in HELPER()
211     int start = extract32(env->cp15.rgsr_el1, 0, 4);  in HELPER()
212     int seed = extract32(env->cp15.rgsr_el1, 8, 16);  in HELPER()
219      * the deterministic algorithm to function.  So we force a non-zero  in HELPER()
250     env->cp15.rgsr_el1 = rtag | (seed << 8);  in HELPER()
259     uint16_t exclude = extract32(env->cp15.gcr_el1, 0, 16);  in HELPER()
298 /* For use in a non-parallel context, store to the given nibble.  */
374         /* Two stores unaligned mod TAG_GRANULE*2 -- modify two bytes. */  in do_st2g()
389         /* Two stores aligned mod TAG_GRANULE*2 -- modify one byte. */  in do_st2g()
413     int in_page = -(ptr | TARGET_PAGE_MASK);  in HELPER()
429     int gm_bs = env_archcpu(env)->gm_blocksize;  in HELPER()
448      * a little-endian operation.  Computation of shift comes from  in HELPER()
460         /* 32 bytes -> 2 tags -> 8 result bits */  in HELPER()
464         /* 64 bytes -> 4 tags -> 16 result bits */  in HELPER()
468         /* 128 bytes -> 8 tags -> 32 result bits */  in HELPER()
472         /* 256 bytes -> 16 tags -> 64 result bits */  in HELPER()
489     int gm_bs = env_archcpu(env)->gm_blocksize;  in HELPER()
513         /* 32 bytes -> 2 tags -> 8 result bits */  in HELPER()
517         /* 64 bytes -> 4 tags -> 16 result bits */  in HELPER()
521         /* 128 bytes -> 8 tags -> 32 result bits */  in HELPER()
525         /* 256 bytes -> 16 tags -> 64 result bits */  in HELPER()
547     log2_dcz_bytes = env_archcpu(env)->dcz_blocksize + 2;  in HELPER()
548     log2_tag_bytes = log2_dcz_bytes - (LOG2_TAG_GRANULE + 1);  in HELPER()
551     ptr &= -dcz_bytes;  in HELPER()
566     env->exception.vaddress = dirty_ptr;  in mte_sync_check_fail()
585     env->cp15.tfsr_el[el] |= 1 << select;  in mte_async_check_fail()
608     sctlr = env->cp15.sctlr_el[reg_el];  in mte_check_fail()
728  * This is needed by the backwards-memory-copying operations.
736     diff = *mem-- ^ cmp;  in checkNrev()
760         diff = *mem-- ^ cmp;  in checkNrev()
766  * mte_probe_int() - helper for mte_probe and mte_check
792         return -1;  in mte_probe_int()
811     tag_count = ((tag_last - tag_first) / TAG_GRANULE) + 1;  in mte_probe_int()
817     if (likely(tag_last - prev_page < TARGET_PAGE_SIZE)) {  in mte_probe_int()
828         mem1 = allocation_tag_mem(env, mmu_idx, ptr, type, next_page - ptr,  in mte_probe_int()
832                                   ptr_last - next_page + 1,  in mte_probe_int()
840         n = c = (next_page - tag_first) / TAG_GRANULE;  in mte_probe_int()
848             n += checkN(mem2, 0, ptr_tag, tag_count - c);  in mte_probe_int()
891         align = (1u << align) - 1;  in HELPER()
904  * No-fault version of mte_check, to be used by SVE for MemSingleNF.
906  * is only intended to probe the tag -- the validity of the page must
947     log2_dcz_bytes = env_archcpu(env)->dcz_blocksize + 2;  in HELPER()
948     log2_tag_bytes = log2_dcz_bytes - (LOG2_TAG_GRANULE + 1);  in HELPER()
951     align_ptr = ptr & -dcz_bytes;  in HELPER()
972      * a block size of 128.  For user-only, aarch64_max_initfn will set the  in HELPER()
973      * block size to 512.  Fill out the other cases for future-proofing.  in HELPER()
976      * tag bytes to be in little-endian order.  in HELPER()
1054     tag_last = QEMU_ALIGN_DOWN(ptr + size - 1, TAG_GRANULE);  in mte_mops_probe()
1055     tag_count = ((tag_last - tag_first) / TAG_GRANULE) + 1;  in mte_mops_probe()
1069         return n * TAG_GRANULE - (ptr - tag_first);  in mte_mops_probe()
1111     tag_first = QEMU_ALIGN_DOWN(ptr - (size - 1), TAG_GRANULE);  in mte_mops_probe_rev()
1113     tag_count = ((tag_last - tag_first) / TAG_GRANULE) + 1;  in mte_mops_probe_rev()
1127         return (n - 1) * TAG_GRANULE + ((ptr + 1) - tag_last);  in mte_mops_probe_rev()
1158         /* Not 2*TAG_GRANULE-aligned: store tag to first nibble */  in mte_mops_set_tags()
1161         tag_count--;  in mte_mops_set_tags()