1 /* 2 * Copyright (c) 2024 Apple Inc. All rights reserved. 3 * 4 * @APPLE_OSREFERENCE_LICENSE_HEADER_START@ 5 * 6 * This file contains Original Code and/or Modifications of Original Code 7 * as defined in and that are subject to the Apple Public Source License 8 * Version 2.0 (the 'License'). You may not use this file except in 9 * compliance with the License. The rights granted to you under the License 10 * may not be used to create, or enable the creation or redistribution of, 11 * unlawful or unlicensed copies of an Apple operating system, or to 12 * circumvent, violate, or enable the circumvention or violation of, any 13 * terms of an Apple operating system software license agreement. 14 * 15 * Please obtain a copy of the License at 16 * http://www.opensource.apple.com/apsl/ and read it before using this file. 17 * 18 * The Original Code and all software distributed under the License are 19 * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER 20 * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES, 21 * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY, 22 * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT. 23 * Please see the License for the specific language governing rights and 24 * limitations under the License. 25 * 26 * @APPLE_OSREFERENCE_LICENSE_HEADER_END@ 27 */ 28 29 #ifndef _SPECULATION_H_ 30 #define _SPECULATION_H_ 31 #include <stddef.h> 32 #include <stdint.h> 33 #include <stdbool.h> 34 35 36 /* 37 * SPECULATION_GUARD_ZEROING_???_CC 38 * 39 * These macros perform a speculation safe version of the following pseudo-code: 40 * cc = cmp(cmp_1, cmp_2) 41 * if (cc) 42 * out = value 43 * else 44 * out = 0 45 * 46 * where "cc" is an ARM64 condition code (EQ, HS, etc.). 47 * 48 * Additionally, we provide four variants (for the ??? in the name): 49 * 1. XXX (value is 64-bits, cmp_1 and cmp_2 are 64-bits) 50 * 2. XWW (value is 64-bits, cmp_1 and cmp_2 are 32-bits) 51 * 3. WXX (value is 32-bits, cmp_1 and cmp_2 are 64-bits) 52 * 4. WWW (value is 32-bits, cmp_1 and cmp_2 are 32-bits) 53 */ 54 55 /** 56 * Generate the zeroing speculation guard expression 57 * 58 * out: The output location for the guarded value 59 * out_valid: The condition evaluated true non-speculatively 60 * value: The input value to guard 61 * cmp_1, cmp_2: The two operands to compare 62 * cmp_prefix: The ASM prefix for the registers in the compare instruction. For 63 * 64-bit operands, pass an empty string. For 32-bit operands, pass "w" 64 * cs_prefix: The ASM prefix for the registers in the select instruction. 65 */ 66 #define SPECULATION_GUARD_ZEROING_GEN(out, out_valid, value, cmp_1, cmp_2, cc, cmp_prefix, cs_prefix) \ 67 { \ 68 __asm__ ( \ 69 "cmp %" cmp_prefix "[_cmp_1], %" cmp_prefix "[_cmp_2]\n" \ 70 "csel %" cs_prefix "[_out], %" cs_prefix "[_value], %" cs_prefix "[_zero], " cc "\n" \ 71 "cset %w[_out_valid], " cc "\n" \ 72 "csdb\n" \ 73 : [_out] "=r" (out), [_out_valid] "=r" (out_valid) \ 74 : [_cmp_1] "r" (cmp_1), [_cmp_2] "r" (cmp_2), [_value] "r" (value), [_zero] "rz" (0ULL) \ 75 : "cc" \ 76 ); \ 77 } 78 79 #define SPECULATION_GUARD_ZEROING_XXX(out, out_valid, value, cmp_1, cmp_2, cc) \ 80 SPECULATION_GUARD_ZEROING_GEN(out, out_valid, value, cmp_1, cmp_2, cc, "", "") 81 82 #define SPECULATION_GUARD_ZEROING_XWW(out, out_valid, value, cmp_1, cmp_2, cc) \ 83 SPECULATION_GUARD_ZEROING_GEN(out, out_valid, value, cmp_1, cmp_2, cc, "w", "") 84 85 #define SPECULATION_GUARD_ZEROING_WXX(out, out_valid, value, cmp_1, cmp_2, cc) \ 86 SPECULATION_GUARD_ZEROING_GEN(out, out_valid, value, cmp_1, cmp_2, cc, "", "w") 87 88 #define SPECULATION_GUARD_ZEROING_WWW(out, out_valid, value, cmp_1, cmp_2, cc) \ 89 SPECULATION_GUARD_ZEROING_GEN(out, out_valid, value, cmp_1, cmp_2, cc, "w", "w") 90 91 /* 92 * SPECULATION_GUARD_SELECT_???_CC 93 * 94 * These macros perform a speculation safe version of the following pseudo-code: 95 * cc = cmp(cmp_1, cmp_2) 96 * if (cc) 97 * value = sel_1 98 * else 99 * value = sel_2 100 * 101 * where "cc" is an ARM64 condition code (EQ, HS, etc.). 102 * 103 * Due to the limitations of macros/ASM, callers must provide both CC and !CC 104 * (the compliment, e.g. EQ and NE, HS and LO, etc.). Passing an incorrect 105 * compliment may result in incorrect or otherwise surprising behavior. 106 * 107 * Additionally, we provide four variants (for the ??? in the name): 108 * 1. XXX (value is 64-bits, cmp_1 and cmp_2 are 64-bits) 109 * 2. XWW (value is 64-bits, cmp_1 and cmp_2 are 32-bits) 110 * 3. WXX (value is 32-bits, cmp_1 and cmp_2 are 64-bits) 111 * 4. WWW (value is 32-bits, cmp_1 and cmp_2 are 32-bits) 112 * 113 * This guard has no requirements on non-speculative resolution. 114 */ 115 116 /** 117 * Generate the selection speculation guard expression 118 * 119 * output: The output value 120 * cmp_1, cmp_2: The two operands to compare 121 * sel_1, sel_2: The values to pick if cc or n_cc (respectively) 122 * cc, n_cc: The ARM64 condition code CC and its compliment !CC 123 * cmp_prefix: The ASM prefix for the registers in the compare instruction. For 124 * 64-bit operands, pass an empty string. For 32-bit operands, pass "w" 125 * cs_prefix: The ASM prefix for the registers in the select instruction. 126 */ 127 #define SPECULATION_GUARD_SELECT_GEN(out, cmp_1, cmp_2, cc, sel_1, n_cc, sel_2, cmp_prefix, cs_prefix) \ 128 __asm__ ( \ 129 "cmp %" cmp_prefix "[_cmp_1], %" cmp_prefix "[_cmp_2]\n" \ 130 "csel %" cs_prefix "[_out], %" cs_prefix "[_sel_1], %" cs_prefix "[_sel_2], " cc "\n" \ 131 "csdb\n" \ 132 : [_out] "=r" (out) \ 133 : [_cmp_1] "r" (cmp_1), [_cmp_2] "r" (cmp_2), [_sel_1] "r" (sel_1), [_sel_2] "r" (sel_2), [_zero] "rz" (0ULL) \ 134 : "cc" \ 135 ); 136 137 #define SPECULATION_GUARD_SELECT_XXX(out, cmp_1, cmp_2, cc, sel_1, n_cc, sel_2) \ 138 SPECULATION_GUARD_SELECT_GEN(out, cmp_1, cmp_2, cc, sel_1, n_cc, sel_2, "", "") 139 140 #define SPECULATION_GUARD_SELECT_XWW(out, cmp_1, cmp_2, cc, sel_1, n_cc, sel_2) \ 141 SPECULATION_GUARD_SELECT_GEN(out, cmp_1, cmp_2, cc, sel_1, n_cc, sel_2, "w", "") 142 143 #define SPECULATION_GUARD_SELECT_WXX(out, cmp_1, cmp_2, cc, sel_1, n_cc, sel_2) \ 144 SPECULATION_GUARD_SELECT_GEN(out, cmp_1, cmp_2, cc, sel_1, n_cc, sel_2, "", "w") 145 146 #define SPECULATION_GUARD_SELECT_WWW(out, cmp_1, cmp_2, cc, sel_1, n_cc, sel_2) \ 147 SPECULATION_GUARD_SELECT_GEN(out, cmp_1, cmp_2, cc, sel_1, n_cc, sel_2, "w", "w") 148 149 #endif /* _SPECULATION_H_ */ 150