Skip to content

src/mte_tag: HLV/HSV support for opt-out based on PTE.MTAG for codepage #77

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 1 commit into
base: main
Choose a base branch
from
Open

src/mte_tag: HLV/HSV support for opt-out based on PTE.MTAG for codepage #77

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
94 changes: 85 additions & 9 deletions src/mte_tag.adoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -380,11 +380,20 @@ tables is ignored.
[[HYPERVISOR_LDST]]
=== Memory tagging and hypervisor memory accesses

HLVX* instructions always generate unchecked loads. HLV*/HSV* instructions in
HS and HU mode may generate checked accesses depending on effective privilege
of VS or VU (as defined in privileged specification). Memory accesses generated
from HLV*/HSV* instructions in HU mode may generate checked accesses when
`hstatus.HU` is set.
HLVX* instructions always generate unchecked loads and collect MTAG bit from
VS-stage page table for code page of guest instruction in following manner

hstatus.MTAG_I = VS-stage_leaf_PTE(s).MTAG & VS-stage_leaf_PTE(s).X

If `vsatp.MODE == BARE`, then collected value of `hstatus.MTAG_I` will be 0.

HLV*/HSV* instructions generate unchecked memory accesses if VS-stage leaf
PTE entry's execute permission bit is set.

If `hstatus.MTAG_I` is set, then HLV*/HSV* instructions do not generate
checked accesses. If `hstatus.MTAG_I` is clear, then HLV*/HSV* instructions
in HS and HU mode may generate checked accesses depending on effective privilege
of VS or VU (as defined in privileged specification).

`xMT_MODE` (see <<MEM_TAG_EN>>) for HLV* and HSV* instructions is defined based
on the effective privilege of VS or VU (as defined in privileged specification),
Expand All @@ -403,6 +412,23 @@ If HLV*/HSV* instructions result in a tag mismatch, software check exception is
delivered to HS mode with tval = 4 and hstatus.GVA set. In case of tag mismatch,
software check exception is always delivered synchronously.

[[MPRV_LDST]]
=== Memory tagging on loads/stores affected by Modify Privilege bit (MPRV)

If MPRV and MXR both are set, then load instruction collect MTAG bit from first
stage page table for code page of guest instruction in following manner

mstatus.MTAG_I = first-stage_leaf_PTE(s).MTAG & first-stage_leaf_PTE(s).X

If `satp.MODE == BARE`, then collected value of `mstatus.MTAG_I` will be 0.

If MRPV=1 and first-stage page table leaf entry PTE (for effective mode S/U/VU/VS
/HS/HU) has execute permission bit set then load generate unchecked accesses. If
MPRV=1 and `mstatus.MTAG_I` is set, then load and store instructions generate
unchecked accesses. If MPRV=1 and `mstatus.MTAG_I` is clear, then load and store
instructions may generate checked accesses depending on effective privilege.
`xMT_MODE` is selected based on effective privilege (see <<MEM_TAG_EN>>).

[[MEMTAG_CSR_CTRL]]
=== CSR bits for memory tagging

Expand Down Expand Up @@ -574,6 +600,52 @@ When `MT_MODE` is `0b00`, the following rules apply to VS-mode:

* Zimt instructions will revert to their behavior as defined by Zimop.

==== Machine Status Register (`mstatus`)

.Machine-mode status register (`mstatus`) for RV64
[wavedrom, ,svg]
....
{reg: [
{bits: 1, name: 'WPRI'},
{bits: 1, name: 'SIE'},
{bits: 1, name: 'WPRI'},
{bits: 1, name: 'MIE'},
{bits: 1, name: 'WPRI'},
{bits: 1, name: 'SPIE'},
{bits: 1, name: 'UBE'},
{bits: 1, name: 'MPIE'},
{bits: 1, name: 'SPP'},
{bits: 2, name: 'VS[1:0]'},
{bits: 2, name: 'MPP[1:0]'},
{bits: 2, name: 'FS[1:0]'},
{bits: 2, name: 'XS[1:0]'},
{bits: 1, name: 'MPRV'},
{bits: 1, name: 'SUM'},
{bits: 1, name: 'MXR'},
{bits: 1, name: 'TVM'},
{bits: 1, name: 'TW'},
{bits: 1, name: 'TSR'},
{bits: 1, name: 'SPELP'},
{bits: 1, name: 'SDT'},
{bits: 7, name: 'WPRI'},
{bits: 2, name: 'UXL[1:0]'},
{bits: 2, name: 'SXL[1:0]'},
{bits: 1, name: 'SBE'},
{bits: 1, name: 'MBE'},
{bits: 1, name: 'GVA'},
{bits: 1, name: 'MPV'},
{bits: 1, name: 'MTAG_I'},
{bits: 1, name: 'MPELP'},
{bits: 1, name: 'MDT'},
{bits: 20, name: 'WPRI'},
{bits: 1, name: 'SD'},
], config:{lanes: 4, hspace:1024}}
....

The Zimt extension adds `MTAG_I` bit to `mstatus`. When a trap is taken to
M-mode and `mtval` is written with nonzero value, then MTAG bit for code page
of trapping instruction is deposited in `mstatus.MTAG_I`.
Copy link

@radimkrcmar radimkrcmar Nov 18, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We're basing MTAG_I on htinst for traps to HS-mode, but a trap to M-mode depends on mtval instead.

Should we make M-mode depend on mtinst as well?

M-mode does have instruction in mtval for illegal-instruction, does that change what is written in mtinst, so we ought to depend on any CSR where an instruction is written?


==== Hypervisor Status Register (`hstatus`)

.Hypervisor status register (`hstatus`)
Expand All @@ -586,7 +658,8 @@ When `MT_MODE` is `0b00`, the following rules apply to VS-mode:
{bits: 1, name: 'SPV'},
{bits: 1, name: 'SPVP'},
{bits: 1, name: 'HU'},
{bits: 2, name: 'WPRI'},
{bits: 1, name: 'MTAG_I'},
{bits: 1, name: 'WPRI'},
{bits: 6, name: 'VGEIN'},
{bits: 2, name: 'WPRI'},
{bits: 1, name: 'VTVM'},
Expand All @@ -601,9 +674,12 @@ When `MT_MODE` is `0b00`, the following rules apply to VS-mode:
], config:{lanes: 4, hspace:1024}}
....

The Zimt extension adds `VUMT_MODE` (bit 51:50) to `hstatus`. When the `HU`
field is set, HLV*/HSV* may generate checked accesses in HU mode. `VUMT_MODE`
selects the `xMT_MODE` if effective privilege mode is VU.
The Zimt extension adds `VUMT_MODE` (bit 51:50) to `hstatus`. `VUMT_MODE`
selects the `xMT_MODE` if execution environment is HU mode and effective
privilege mode is VU. `hstatus.MTAG_I` bit emulates `MTAG` bit for
instruction fetch from code page. When a trap is taken to HS mode and `htinst`
is written with nonzero value, then VS-stage page table's MTAG bit on code page
for trapping instruction is deposited in `hstatus.MTAG_I`.

<<<

Expand Down
Loading