Reviewed-by: Richard Henderson <richard.henderson@linaro.org>

The loads-and-stores documentation includes git grep regexes to find

occurrences of the various functions. Some of these regexes have

errors, typically failing to escape the '?', '(' and ')' when they

should be metacharacters (since these are POSIX basic REs). We also

weren't consistent about whether to have a ':' on the end of the

line introducing the list of regexes in each section.

Fix the errors.

The following shell rune will complain about any REs in the

file which don't have any matches in the codebase:

for re in $(sed -ne 's/ - ``\(\\<.*\)``/\1/p' docs/devel/loads-stores.rst); do git grep -q "$re" || echo "no matches for re $re"; done

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>

Message-id: 20230904161703.3996734-1-peter.maydell@linaro.org

---

docs/devel/loads-stores.rst | 40 ++++++++++++++++++-------------------

1 file changed, 20 insertions(+), 20 deletions(-)

diff --git a/docs/devel/loads-stores.rst b/docs/devel/loads-stores.rst

index XXXXXXX..XXXXXXX 100644

--- a/docs/devel/loads-stores.rst

+++ b/docs/devel/loads-stores.rst

@@ -XXX,XX +XXX,XX @@ which stores ``val`` to ``ptr`` as an ``{endian}`` order value

of size ``sz`` bytes.

-Regexes for git grep

+Regexes for git grep:

- ``\<ld[us]\?[bwlq]\(_[hbl]e\)\?_p\>``

- ``\<st[bwlq]\(_[hbl]e\)\?_p\>``

- ``\<st24\(_[hbl]e\)\?_p\>``

- - ``\<ldn_\([hbl]e\)?_p\>``

- - ``\<stn_\([hbl]e\)?_p\>``

+ - ``\<ldn_\([hbl]e\)\?_p\>``

+ - ``\<stn_\([hbl]e\)\?_p\>``

``cpu_{ld,st}*_mmu``

~~~~~~~~~~~~~~~~~~~~

@@ -XXX,XX +XXX,XX @@ store: ``cpu_st{size}{end}_mmu(env, ptr, val, oi, retaddr)``

- ``_le`` : little endian

Regexes for git grep:

- - ``\<cpu_ld[bwlq](_[bl]e)\?_mmu\>``

- - ``\<cpu_st[bwlq](_[bl]e)\?_mmu\>``

+ - ``\<cpu_ld[bwlq]\(_[bl]e\)\?_mmu\>``

+ - ``\<cpu_st[bwlq]\(_[bl]e\)\?_mmu\>``

``cpu_{ld,st}*_mmuidx_ra``

@@ -XXX,XX +XXX,XX @@ store: ``cpu_st{size}{end}_mmuidx_ra(env, ptr, val, mmuidx, retaddr)``

- ``_le`` : little endian

Regexes for git grep:

- - ``\<cpu_ld[us]\?[bwlq](_[bl]e)\?_mmuidx_ra\>``

- - ``\<cpu_st[bwlq](_[bl]e)\?_mmuidx_ra\>``

+ - ``\<cpu_ld[us]\?[bwlq]\(_[bl]e\)\?_mmuidx_ra\>``

+ - ``\<cpu_st[bwlq]\(_[bl]e\)\?_mmuidx_ra\>``

``cpu_{ld,st}*_data_ra``

~~~~~~~~~~~~~~~~~~~~~~~~

@@ -XXX,XX +XXX,XX @@ store: ``cpu_st{size}{end}_data_ra(env, ptr, val, ra)``

- ``_le`` : little endian

Regexes for git grep:

- - ``\<cpu_ld[us]\?[bwlq](_[bl]e)\?_data_ra\>``

- - ``\<cpu_st[bwlq](_[bl]e)\?_data_ra\>``

+ - ``\<cpu_ld[us]\?[bwlq]\(_[bl]e\)\?_data_ra\>``

+ - ``\<cpu_st[bwlq]\(_[bl]e\)\?_data_ra\>``

``cpu_{ld,st}*_data``

~~~~~~~~~~~~~~~~~~~~~

@@ -XXX,XX +XXX,XX @@ store: ``cpu_st{size}{end}_data(env, ptr, val)``

- ``_be`` : big endian

- ``_le`` : little endian

-Regexes for git grep

- - ``\<cpu_ld[us]\?[bwlq](_[bl]e)\?_data\>``

- - ``\<cpu_st[bwlq](_[bl]e)\?_data\+\>``

+Regexes for git grep:

+ - ``\<cpu_ld[us]\?[bwlq]\(_[bl]e\)\?_data\>``

+ - ``\<cpu_st[bwlq]\(_[bl]e\)\?_data\+\>``

``cpu_ld*_code``

~~~~~~~~~~~~~~~~

@@ -XXX,XX +XXX,XX @@ swap: ``translator_ld{sign}{size}_swap(env, ptr, swap)``

- ``l`` : 32 bits

- ``q`` : 64 bits

-Regexes for git grep

+Regexes for git grep:

- ``\<translator_ld[us]\?[bwlq]\(_swap\)\?\>``

``helper_{ld,st}*_mmu``

@@ -XXX,XX +XXX,XX @@ store: ``helper_{size}_mmu(env, addr, val, opindex, retaddr)``

- ``l`` : 32 bits

- ``q`` : 64 bits

-Regexes for git grep

+Regexes for git grep:

- ``\<helper_ld[us]\?[bwlq]_mmu\>``

- ``\<helper_st[bwlq]_mmu\>``

@@ -XXX,XX +XXX,XX @@ succeeded using a MemTxResult return code.

The ``_{endian}`` suffix is omitted for byte accesses.

-Regexes for git grep

+Regexes for git grep:

- ``\<address_space_\(read\|write\|rw\)\>``

- ``\<address_space_ldu\?[bwql]\(_[lb]e\)\?\>``

- ``\<address_space_st[bwql]\(_[lb]e\)\?\>``

@@ -XXX,XX +XXX,XX @@ Note that portions of the write which attempt to write data to a

device will be silently ignored -- only real RAM and ROM will

be written to.

-Regexes for git grep

+Regexes for git grep:

- ``address_space_write_rom``

``{ld,st}*_phys``

@@ -XXX,XX +XXX,XX @@ device doing the access has no way to report such an error.

The ``_{endian}_`` infix is omitted for byte accesses.

-Regexes for git grep

+Regexes for git grep:

- ``\<ldu\?[bwlq]\(_[bl]e\)\?_phys\>``

- ``\<st[bwlq]\(_[bl]e\)\?_phys\>``

@@ -XXX,XX +XXX,XX @@ For new code they are better avoided:

``cpu_physical_memory_rw``

-Regexes for git grep

+Regexes for git grep:

- ``\<cpu_physical_memory_\(read\|write\|rw\)\>``

``cpu_memory_rw_debug``

@@ -XXX,XX +XXX,XX @@ make sure our existing code is doing things correctly.

``dma_memory_rw``

-Regexes for git grep

+Regexes for git grep:

- ``\<dma_memory_\(read\|write\|rw\)\>``

- ``\<ldu\?[bwlq]\(_[bl]e\)\?_dma\>``

- ``\<st[bwlq]\(_[bl]e\)\?_dma\>``

@@ -XXX,XX +XXX,XX @@ correct address space for that device.

The ``_{endian}_`` infix is omitted for byte accesses.

-Regexes for git grep

+Regexes for git grep:

- ``\<pci_dma_\(read\|write\|rw\)\>``

- ``\<ldu\?[bwlq]\(_[bl]e\)\?_pci_dma\>``

- ``\<st[bwlq]\(_[bl]e\)\?_pci_dma\>``

--

2.34.1

Add the code to report the arm32 hwcaps we were previously missing:

ss, ssbs, fphp, asimdhp, asimddp, asimdfhm, asimdbf16, i8mm

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>

---

linux-user/elfload.c | 12 ++++++++++++

1 file changed, 12 insertions(+)

diff --git a/linux-user/elfload.c b/linux-user/elfload.c

index XXXXXXX..XXXXXXX 100644

--- a/linux-user/elfload.c

+++ b/linux-user/elfload.c

@@ -XXX,XX +XXX,XX @@ uint32_t get_elf_hwcap(void)

}

}

GET_FEATURE_ID(aa32_simdfmac, ARM_HWCAP_ARM_VFPv4);

+ /*

+ * MVFR1.FPHP and .SIMDHP must be in sync, and QEMU uses the same

+ * isar_feature function for both. The kernel reports them as two hwcaps.

+ */

+ GET_FEATURE_ID(aa32_fp16_arith, ARM_HWCAP_ARM_FPHP);

+ GET_FEATURE_ID(aa32_fp16_arith, ARM_HWCAP_ARM_ASIMDHP);

+ GET_FEATURE_ID(aa32_dp, ARM_HWCAP_ARM_ASIMDDP);

+ GET_FEATURE_ID(aa32_fhm, ARM_HWCAP_ARM_ASIMDFHM);

+ GET_FEATURE_ID(aa32_bf16, ARM_HWCAP_ARM_ASIMDBF16);

+ GET_FEATURE_ID(aa32_i8mm, ARM_HWCAP_ARM_I8MM);

return hwcaps;

}

@@ -XXX,XX +XXX,XX @@ uint32_t get_elf_hwcap2(void)

GET_FEATURE_ID(aa32_sha1, ARM_HWCAP2_ARM_SHA1);

GET_FEATURE_ID(aa32_sha2, ARM_HWCAP2_ARM_SHA2);

GET_FEATURE_ID(aa32_crc32, ARM_HWCAP2_ARM_CRC32);

+ GET_FEATURE_ID(aa32_sb, ARM_HWCAP2_ARM_SB);

+ GET_FEATURE_ID(aa32_ssbs, ARM_HWCAP2_ARM_SSBS);

return hwcaps;

}

--

2.34.1

Update our AArch64 ID register field definitions from the 2023-06

system register XML release:

https://developer.arm.com/documentation/ddi0601/2023-06/

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>

---

target/arm/cpu.h | 23 +++++++++++++++++++++++

1 file changed, 23 insertions(+)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h

index XXXXXXX..XXXXXXX 100644

--- a/target/arm/cpu.h

+++ b/target/arm/cpu.h

@@ -XXX,XX +XXX,XX @@ FIELD(ID_AA64ISAR0, SHA1, 8, 4)

FIELD(ID_AA64ISAR0, SHA2, 12, 4)

FIELD(ID_AA64ISAR0, CRC32, 16, 4)

FIELD(ID_AA64ISAR0, ATOMIC, 20, 4)

+FIELD(ID_AA64ISAR0, TME, 24, 4)

FIELD(ID_AA64ISAR0, RDM, 28, 4)

FIELD(ID_AA64ISAR0, SHA3, 32, 4)

FIELD(ID_AA64ISAR0, SM3, 36, 4)

@@ -XXX,XX +XXX,XX @@ FIELD(ID_AA64ISAR2, APA3, 12, 4)

FIELD(ID_AA64ISAR2, MOPS, 16, 4)

FIELD(ID_AA64ISAR2, BC, 20, 4)

FIELD(ID_AA64ISAR2, PAC_FRAC, 24, 4)

+FIELD(ID_AA64ISAR2, CLRBHB, 28, 4)

+FIELD(ID_AA64ISAR2, SYSREG_128, 32, 4)

+FIELD(ID_AA64ISAR2, SYSINSTR_128, 36, 4)

+FIELD(ID_AA64ISAR2, PRFMSLC, 40, 4)

+FIELD(ID_AA64ISAR2, RPRFM, 48, 4)

+FIELD(ID_AA64ISAR2, CSSC, 52, 4)

+FIELD(ID_AA64ISAR2, ATS1A, 60, 4)

FIELD(ID_AA64PFR0, EL0, 0, 4)

FIELD(ID_AA64PFR0, EL1, 4, 4)

@@ -XXX,XX +XXX,XX @@ FIELD(ID_AA64PFR1, SME, 24, 4)

FIELD(ID_AA64PFR1, RNDR_TRAP, 28, 4)

FIELD(ID_AA64PFR1, CSV2_FRAC, 32, 4)

FIELD(ID_AA64PFR1, NMI, 36, 4)

+FIELD(ID_AA64PFR1, MTE_FRAC, 40, 4)

+FIELD(ID_AA64PFR1, GCS, 44, 4)

+FIELD(ID_AA64PFR1, THE, 48, 4)

+FIELD(ID_AA64PFR1, MTEX, 52, 4)

+FIELD(ID_AA64PFR1, DF2, 56, 4)

+FIELD(ID_AA64PFR1, PFAR, 60, 4)

FIELD(ID_AA64MMFR0, PARANGE, 0, 4)

FIELD(ID_AA64MMFR0, ASIDBITS, 4, 4)

@@ -XXX,XX +XXX,XX @@ FIELD(ID_AA64MMFR1, AFP, 44, 4)

FIELD(ID_AA64MMFR1, NTLBPA, 48, 4)

FIELD(ID_AA64MMFR1, TIDCP1, 52, 4)

FIELD(ID_AA64MMFR1, CMOW, 56, 4)

+FIELD(ID_AA64MMFR1, ECBHB, 60, 4)

FIELD(ID_AA64MMFR2, CNP, 0, 4)

FIELD(ID_AA64MMFR2, UAO, 4, 4)

@@ -XXX,XX +XXX,XX @@ FIELD(ID_AA64DFR0, DEBUGVER, 0, 4)

FIELD(ID_AA64DFR0, TRACEVER, 4, 4)

FIELD(ID_AA64DFR0, PMUVER, 8, 4)

FIELD(ID_AA64DFR0, BRPS, 12, 4)

+FIELD(ID_AA64DFR0, PMSS, 16, 4)

FIELD(ID_AA64DFR0, WRPS, 20, 4)

+FIELD(ID_AA64DFR0, SEBEP, 24, 4)

FIELD(ID_AA64DFR0, CTX_CMPS, 28, 4)

FIELD(ID_AA64DFR0, PMSVER, 32, 4)

FIELD(ID_AA64DFR0, DOUBLELOCK, 36, 4)

@@ -XXX,XX +XXX,XX @@ FIELD(ID_AA64DFR0, TRACEFILT, 40, 4)

FIELD(ID_AA64DFR0, TRACEBUFFER, 44, 4)

FIELD(ID_AA64DFR0, MTPMU, 48, 4)

FIELD(ID_AA64DFR0, BRBE, 52, 4)

+FIELD(ID_AA64DFR0, EXTTRCBUFF, 56, 4)

FIELD(ID_AA64DFR0, HPMN0, 60, 4)

FIELD(ID_AA64ZFR0, SVEVER, 0, 4)

FIELD(ID_AA64ZFR0, AES, 4, 4)

FIELD(ID_AA64ZFR0, BITPERM, 16, 4)

FIELD(ID_AA64ZFR0, BFLOAT16, 20, 4)

+FIELD(ID_AA64ZFR0, B16B16, 24, 4)

FIELD(ID_AA64ZFR0, SHA3, 32, 4)

FIELD(ID_AA64ZFR0, SM4, 40, 4)

FIELD(ID_AA64ZFR0, I8MM, 44, 4)

@@ -XXX,XX +XXX,XX @@ FIELD(ID_AA64ZFR0, F32MM, 52, 4)

FIELD(ID_AA64ZFR0, F64MM, 56, 4)

FIELD(ID_AA64SMFR0, F32F32, 32, 1)

+FIELD(ID_AA64SMFR0, BI32I32, 33, 1)

FIELD(ID_AA64SMFR0, B16F32, 34, 1)

FIELD(ID_AA64SMFR0, F16F32, 35, 1)

FIELD(ID_AA64SMFR0, I8I32, 36, 4)

+FIELD(ID_AA64SMFR0, F16F16, 42, 1)

+FIELD(ID_AA64SMFR0, B16B16, 43, 1)

+FIELD(ID_AA64SMFR0, I16I32, 44, 4)

FIELD(ID_AA64SMFR0, F64F64, 48, 1)

FIELD(ID_AA64SMFR0, I16I64, 52, 4)

FIELD(ID_AA64SMFR0, SMEVER, 56, 4)

--

2.34.1

For user-only mode we reveal a subset of the AArch64 ID registers

to the guest, to emulate the kernel's trap-and-emulate-ID-regs

handling. Update the feature bit masks to match upstream kernel

commit a48fa7efaf1161c1c.

None of these features are yet implemented by QEMU, so this

doesn't yet have a behavioural change, but implementation of

FEAT_MOPS and FEAT_HBC is imminent.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>

---

target/arm/helper.c | 11 ++++++++++-

tests/tcg/aarch64/sysregs.c | 4 ++--

2 files changed, 12 insertions(+), 3 deletions(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c

index XXXXXXX..XXXXXXX 100644

--- a/target/arm/helper.c

+++ b/target/arm/helper.c

@@ -XXX,XX +XXX,XX @@ void register_cp_regs_for_features(ARMCPU *cpu)

R_ID_AA64ZFR0_F64MM_MASK },

{ .name = "ID_AA64SMFR0_EL1",

.exported_bits = R_ID_AA64SMFR0_F32F32_MASK |

+ R_ID_AA64SMFR0_BI32I32_MASK |

R_ID_AA64SMFR0_B16F32_MASK |

R_ID_AA64SMFR0_F16F32_MASK |

R_ID_AA64SMFR0_I8I32_MASK |

+ R_ID_AA64SMFR0_F16F16_MASK |

+ R_ID_AA64SMFR0_B16B16_MASK |

+ R_ID_AA64SMFR0_I16I32_MASK |

R_ID_AA64SMFR0_F64F64_MASK |

R_ID_AA64SMFR0_I16I64_MASK |

+ R_ID_AA64SMFR0_SMEVER_MASK |

R_ID_AA64SMFR0_FA64_MASK },

{ .name = "ID_AA64MMFR0_EL1",

.exported_bits = R_ID_AA64MMFR0_ECV_MASK,

@@ -XXX,XX +XXX,XX @@ void register_cp_regs_for_features(ARMCPU *cpu)

.exported_bits = R_ID_AA64ISAR2_WFXT_MASK |

R_ID_AA64ISAR2_RPRES_MASK |

R_ID_AA64ISAR2_GPA3_MASK |

- R_ID_AA64ISAR2_APA3_MASK },

+ R_ID_AA64ISAR2_APA3_MASK |

+ R_ID_AA64ISAR2_MOPS_MASK |

+ R_ID_AA64ISAR2_BC_MASK |

+ R_ID_AA64ISAR2_RPRFM_MASK |

+ R_ID_AA64ISAR2_CSSC_MASK },

{ .name = "ID_AA64ISAR*_EL1_RESERVED",

.is_glob = true },

};

diff --git a/tests/tcg/aarch64/sysregs.c b/tests/tcg/aarch64/sysregs.c

index XXXXXXX..XXXXXXX 100644

--- a/tests/tcg/aarch64/sysregs.c

+++ b/tests/tcg/aarch64/sysregs.c

@@ -XXX,XX +XXX,XX @@ int main(void)

*/

get_cpu_reg_check_mask(id_aa64isar0_el1, _m(f0ff,ffff,f0ff,fff0));

get_cpu_reg_check_mask(id_aa64isar1_el1, _m(00ff,f0ff,ffff,ffff));

- get_cpu_reg_check_mask(SYS_ID_AA64ISAR2_EL1, _m(0000,0000,0000,ffff));

+ get_cpu_reg_check_mask(SYS_ID_AA64ISAR2_EL1, _m(00ff,0000,00ff,ffff));

/* TGran4 & TGran64 as pegged to -1 */

get_cpu_reg_check_mask(id_aa64mmfr0_el1, _m(f000,0000,ff00,0000));

get_cpu_reg_check_mask(id_aa64mmfr1_el1, _m(0000,f000,0000,0000));

@@ -XXX,XX +XXX,XX @@ int main(void)

get_cpu_reg_check_mask(id_aa64dfr0_el1, _m(0000,0000,0000,0006));

get_cpu_reg_check_zero(id_aa64dfr1_el1);

get_cpu_reg_check_mask(SYS_ID_AA64ZFR0_EL1, _m(0ff0,ff0f,00ff,00ff));

- get_cpu_reg_check_mask(SYS_ID_AA64SMFR0_EL1, _m(80f1,00fd,0000,0000));

+ get_cpu_reg_check_mask(SYS_ID_AA64SMFR0_EL1, _m(8ff1,fcff,0000,0000));

get_cpu_reg_check_zero(id_aa64afr0_el1);

get_cpu_reg_check_zero(id_aa64afr1_el1);

--

2.34.1

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>

/* Two stores aligned mod TAG_GRANULE*2 -- modify one byte. */

mem1 = allocation_tag_mem(env, mmu_idx, ptr, MMU_DATA_STORE,

- 2 * TAG_GRANULE, MMU_DATA_STORE, 1, ra);

+ 2 * TAG_GRANULE, MMU_DATA_STORE, ra);

if (mem1) {

tag |= tag << 4;

qatomic_set(mem1, tag);

@@ -XXX,XX +XXX,XX @@ uint64_t HELPER(ldgm)(CPUARMState *env, uint64_t ptr)

/* Trap if accessing an invalid page. */

tag_mem = allocation_tag_mem(env, mmu_idx, ptr, MMU_DATA_LOAD,

- gm_bs_bytes, MMU_DATA_LOAD,

- gm_bs_bytes / (2 * TAG_GRANULE), ra);

+ gm_bs_bytes, MMU_DATA_LOAD, ra);

/* The tag is squashed to zero if the page does not support tags. */

if (!tag_mem) {

@@ -XXX,XX +XXX,XX @@ void HELPER(stgm)(CPUARMState *env, uint64_t ptr, uint64_t val)

/* Trap if accessing an invalid page. */

tag_mem = allocation_tag_mem(env, mmu_idx, ptr, MMU_DATA_STORE,

- gm_bs_bytes, MMU_DATA_LOAD,

- gm_bs_bytes / (2 * TAG_GRANULE), ra);

+ gm_bs_bytes, MMU_DATA_LOAD, ra);

/*

* Tag store only happens if the page support tags,

@@ -XXX,XX +XXX,XX @@ void HELPER(stzgm_tags)(CPUARMState *env, uint64_t ptr, uint64_t val)

ptr &= -dcz_bytes;

mem = allocation_tag_mem(env, mmu_idx, ptr, MMU_DATA_STORE, dcz_bytes,

- MMU_DATA_STORE, tag_bytes, ra);

+ MMU_DATA_STORE, ra);

if (mem) {

int tag_pair = (val & 0xf) * 0x11;

memset(mem, tag_pair, tag_bytes);

@@ -XXX,XX +XXX,XX @@ static int mte_probe_int(CPUARMState *env, uint32_t desc, uint64_t ptr,

int mmu_idx, ptr_tag, bit55;

uint64_t ptr_last, prev_page, next_page;

uint64_t tag_first, tag_last;

- uint64_t tag_byte_first, tag_byte_last;

- uint32_t sizem1, tag_count, tag_size, n, c;

+ uint32_t sizem1, tag_count, n, c;

uint8_t *mem1, *mem2;

MMUAccessType type;

@@ -XXX,XX +XXX,XX @@ static int mte_probe_int(CPUARMState *env, uint32_t desc, uint64_t ptr,

tag_last = QEMU_ALIGN_DOWN(ptr_last, TAG_GRANULE);

tag_count = ((tag_last - tag_first) / TAG_GRANULE) + 1;

- /* Round the bounds to twice the tag granule, and compute the bytes. */

- tag_byte_first = QEMU_ALIGN_DOWN(ptr, 2 * TAG_GRANULE);

- tag_byte_last = QEMU_ALIGN_DOWN(ptr_last, 2 * TAG_GRANULE);

-

/* Locate the page boundaries. */

prev_page = ptr & TARGET_PAGE_MASK;

next_page = prev_page + TARGET_PAGE_SIZE;

if (likely(tag_last - prev_page < TARGET_PAGE_SIZE)) {

/* Memory access stays on one page. */

- tag_size = ((tag_byte_last - tag_byte_first) / (2 * TAG_GRANULE)) + 1;

mem1 = allocation_tag_mem(env, mmu_idx, ptr, type, sizem1 + 1,

- MMU_DATA_LOAD, tag_size, ra);

+ MMU_DATA_LOAD, ra);

if (!mem1) {

return 1;

}

@@ -XXX,XX +XXX,XX @@ static int mte_probe_int(CPUARMState *env, uint32_t desc, uint64_t ptr,

n = checkN(mem1, ptr & TAG_GRANULE, ptr_tag, tag_count);

} else {

/* Memory access crosses to next page. */

- tag_size = (next_page - tag_byte_first) / (2 * TAG_GRANULE);

mem1 = allocation_tag_mem(env, mmu_idx, ptr, type, next_page - ptr,

- MMU_DATA_LOAD, tag_size, ra);

+ MMU_DATA_LOAD, ra);

- tag_size = ((tag_byte_last - next_page) / (2 * TAG_GRANULE)) + 1;

mem2 = allocation_tag_mem(env, mmu_idx, next_page, type,

ptr_last - next_page + 1,

- MMU_DATA_LOAD, tag_size, ra);

+ MMU_DATA_LOAD, ra);

The LDRT/STRT "unprivileged load/store" instructions behave like

normal ones if executed at EL0. We handle this correctly for

the load/store semantics, but get the MTE checking wrong.

We always look at s->mte_active[is_unpriv] to see whether we should

be doing MTE checks, but in hflags.c when we set the TB flags that

will be used to fill the mte_active[] array we only set the

MTE0_ACTIVE bit if UNPRIV is true (i.e. we are not at EL0).

This means that a LDRT at EL0 will see s->mte_active[1] as 0,

and will not do MTE checks even when MTE is enabled.

To avoid the translate-time code having to do an explicit check on

s->unpriv to see if it is OK to index into the mte_active[] array,

duplicate MTE_ACTIVE into MTE0_ACTIVE when UNPRIV is false.

(This isn't a very serious bug because generally nobody executes

LDRT/STRT at EL0, because they have no use there.)

Cc: qemu-stable@nongnu.org

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>

Message-id: 20230912140434.1333369-2-peter.maydell@linaro.org

---

target/arm/tcg/hflags.c | 9 +++++++++

1 file changed, 9 insertions(+)

diff --git a/target/arm/tcg/hflags.c b/target/arm/tcg/hflags.c

index XXXXXXX..XXXXXXX 100644

--- a/target/arm/tcg/hflags.c

+++ b/target/arm/tcg/hflags.c

@@ -XXX,XX +XXX,XX @@ static CPUARMTBFlags rebuild_hflags_a64(CPUARMState *env, int el, int fp_el,

&& !(env->pstate & PSTATE_TCO)

&& (sctlr & (el == 0 ? SCTLR_TCF0 : SCTLR_TCF))) {

DP_TBFLAG_A64(flags, MTE_ACTIVE, 1);

+ if (!EX_TBFLAG_A64(flags, UNPRIV)) {

+ /*

+ * In non-unpriv contexts (eg EL0), unpriv load/stores

+ * act like normal ones; duplicate the MTE info to

+ * avoid translate-a64.c having to check UNPRIV to see

+ * whether it is OK to index into MTE_ACTIVE[].

+ */

+ DP_TBFLAG_A64(flags, MTE0_ACTIVE, 1);

+ }

}

}

/* And again for unprivileged accesses, if required. */

--

2.34.1

FEAT_MOPS defines a handful of new enable bits:

* HCRX_EL2.MSCEn, SCTLR_EL1.MSCEn, SCTLR_EL2.MSCen:

define whether the new insns should UNDEF or not

* HCRX_EL2.MCE2: defines whether memops exceptions from

EL1 should be taken to EL1 or EL2

Since we don't sanitise what bits can be written for the SCTLR

registers, we only need to handle the new bits in HCRX_EL2, and

define SCTLR_MSCEN for the new SCTLR bit value.

The precedence of "HCRX bits acts as 0 if SCR_EL3.HXEn is 0" versus

"bit acts as 1 if EL2 disabled" is not clear from the register

definition text, but it is clear in the CheckMOPSEnabled()

pseudocode(), so we follow that. We'll have to check whether other

bits we need to implement in future follow the same logic or not.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>

Message-id: 20230912140434.1333369-3-peter.maydell@linaro.org

---

target/arm/cpu.h | 6 ++++++

target/arm/helper.c | 28 +++++++++++++++++++++-------

2 files changed, 27 insertions(+), 7 deletions(-)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h

index XXXXXXX..XXXXXXX 100644

--- a/target/arm/cpu.h

+++ b/target/arm/cpu.h

@@ -XXX,XX +XXX,XX @@ void pmu_init(ARMCPU *cpu);

#define SCTLR_EnIB (1U << 30) /* v8.3, AArch64 only */

#define SCTLR_EnIA (1U << 31) /* v8.3, AArch64 only */

#define SCTLR_DSSBS_32 (1U << 31) /* v8.5, AArch32 only */

+#define SCTLR_MSCEN (1ULL << 33) /* FEAT_MOPS */

#define SCTLR_BT0 (1ULL << 35) /* v8.5-BTI */

#define SCTLR_BT1 (1ULL << 36) /* v8.5-BTI */

#define SCTLR_ITFSB (1ULL << 37) /* v8.5-MemTag */

@@ -XXX,XX +XXX,XX @@ static inline bool isar_feature_aa64_doublelock(const ARMISARegisters *id)

return FIELD_SEX64(id->id_aa64dfr0, ID_AA64DFR0, DOUBLELOCK) >= 0;

}

+static inline bool isar_feature_aa64_mops(const ARMISARegisters *id)

+{

+ return FIELD_EX64(id->id_aa64isar2, ID_AA64ISAR2, MOPS);

+}

+

/*

* Feature tests for "does this exist in either 32-bit or 64-bit?"

*/

diff --git a/target/arm/helper.c b/target/arm/helper.c

index XXXXXXX..XXXXXXX 100644

--- a/target/arm/helper.c

+++ b/target/arm/helper.c

@@ -XXX,XX +XXX,XX @@ static void hcrx_write(CPUARMState *env, const ARMCPRegInfo *ri,

{

uint64_t valid_mask = 0;

- /* No features adding bits to HCRX are implemented. */

+ /* FEAT_MOPS adds MSCEn and MCE2 */

+ if (cpu_isar_feature(aa64_mops, env_archcpu(env))) {

+ valid_mask |= HCRX_MSCEN | HCRX_MCE2;

+ }

/* Clear RES0 bits. */

env->cp15.hcrx_el2 = value & valid_mask;

@@ -XXX,XX +XXX,XX @@ uint64_t arm_hcrx_el2_eff(CPUARMState *env)

{

/*

* The bits in this register behave as 0 for all purposes other than

- * direct reads of the register if:

- * - EL2 is not enabled in the current security state,

- * - SCR_EL3.HXEn is 0.

+ * direct reads of the register if SCR_EL3.HXEn is 0.

+ * If EL2 is not enabled in the current security state, then the

+ * bit may behave as if 0, or as if 1, depending on the bit.

+ * For the moment, we treat the EL2-disabled case as taking

+ * priority over the HXEn-disabled case. This is true for the only

+ * bit for a feature which we implement where the answer is different

+ * for the two cases (MSCEn for FEAT_MOPS).

+ * This may need to be revisited for future bits.

*/

- if (!arm_is_el2_enabled(env)

- || (arm_feature(env, ARM_FEATURE_EL3)

- && !(env->cp15.scr_el3 & SCR_HXEN))) {

+ if (!arm_is_el2_enabled(env)) {

+ uint64_t hcrx = 0;

+ if (cpu_isar_feature(aa64_mops, env_archcpu(env))) {

+ /* MSCEn behaves as 1 if EL2 is not enabled */

+ hcrx |= HCRX_MSCEN;

+ }

+ return hcrx;

+ }

+ if (arm_feature(env, ARM_FEATURE_EL3) && !(env->cp15.scr_el3 & SCR_HXEN)) {

return 0;

}

return env->cp15.hcrx_el2;

--

2.34.1

In every place that we call the get_a64_user_mem_index() function

we do it like this:

memidx = a->unpriv ? get_a64_user_mem_index(s) : get_mem_index(s);