* [PATCH] target/arm: Enable SCTLR_EL1.BT0 for aarch64-linux-user
@ 2022-04-27 4:23 Richard Henderson
2022-04-28 12:56 ` Peter Maydell
0 siblings, 1 reply; 4+ messages in thread
From: Richard Henderson @ 2022-04-27 4:23 UTC (permalink / raw)
To: qemu-devel; +Cc: qemu-arm
This controls whether the PACI{A,B}SP instructions trap with BTYPE=3
(indirect branch from register other than x16/x17). The linux kernel
sets this in bti_enable().
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/998
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
target/arm/cpu.c | 2 ++
tests/tcg/aarch64/bti-3.c | 42 +++++++++++++++++++++++++++++++
tests/tcg/aarch64/Makefile.target | 8 +++---
3 files changed, 48 insertions(+), 4 deletions(-)
create mode 100644 tests/tcg/aarch64/bti-3.c
diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index e3f8215203..c50a8dca0b 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -197,6 +197,8 @@ static void arm_cpu_reset(DeviceState *dev)
/* Enable all PAC keys. */
env->cp15.sctlr_el[1] |= (SCTLR_EnIA | SCTLR_EnIB |
SCTLR_EnDA | SCTLR_EnDB);
+ /* Trap on btype=3 for PACIxSP. */
+ env->cp15.sctlr_el[1] |= SCTLR_BT0;
/* and to the FP/Neon instructions */
env->cp15.cpacr_el1 = deposit64(env->cp15.cpacr_el1, 20, 2, 3);
/* and to the SVE instructions */
diff --git a/tests/tcg/aarch64/bti-3.c b/tests/tcg/aarch64/bti-3.c
new file mode 100644
index 0000000000..a852856d9a
--- /dev/null
+++ b/tests/tcg/aarch64/bti-3.c
@@ -0,0 +1,42 @@
+/*
+ * BTI vs PACIASP
+ */
+
+#include "bti-crt.inc.c"
+
+static void skip2_sigill(int sig, siginfo_t *info, ucontext_t *uc)
+{
+ uc->uc_mcontext.pc += 8;
+ uc->uc_mcontext.pstate = 1;
+}
+
+#define BTYPE_1() \
+ asm("mov %0,#1; adr x16, 1f; br x16; 1: hint #25; mov %0,#0" \
+ : "=r"(skipped) : : "x16", "x30")
+
+#define BTYPE_2() \
+ asm("mov %0,#1; adr x16, 1f; blr x16; 1: hint #25; mov %0,#0" \
+ : "=r"(skipped) : : "x16", "x30")
+
+#define BTYPE_3() \
+ asm("mov %0,#1; adr x15, 1f; br x15; 1: hint #25; mov %0,#0" \
+ : "=r"(skipped) : : "x15", "x30")
+
+#define TEST(WHICH, EXPECT) \
+ do { WHICH(); fail += skipped ^ EXPECT; } while (0)
+
+int main()
+{
+ int fail = 0;
+ int skipped;
+
+ /* Signal-like with SA_SIGINFO. */
+ signal_info(SIGILL, skip2_sigill);
+
+ /* With SCTLR_EL1.BT0 set, PACIASP is not compatible with type=3. */
+ TEST(BTYPE_1, 0);
+ TEST(BTYPE_2, 0);
+ TEST(BTYPE_3, 1);
+
+ return fail;
+}
diff --git a/tests/tcg/aarch64/Makefile.target b/tests/tcg/aarch64/Makefile.target
index 6ad0ad49f9..a738eb137c 100644
--- a/tests/tcg/aarch64/Makefile.target
+++ b/tests/tcg/aarch64/Makefile.target
@@ -26,11 +26,11 @@ run-plugin-pauth-%: QEMU_OPTS += -cpu max
endif
# BTI Tests
-# bti-1 tests the elf notes, so we require special compiler support.
+# bti-1 test the elf notes, so we require special compiler support.
ifneq ($(CROSS_CC_HAS_ARMV8_BTI),)
-AARCH64_TESTS += bti-1
-bti-1: CFLAGS += -mbranch-protection=standard
-bti-1: LDFLAGS += -nostdlib
+AARCH64_TESTS += bti-1 bti-3
+bti-1 bti-3: CFLAGS += -mbranch-protection=standard
+bti-1 bti-3: LDFLAGS += -nostdlib
endif
# bti-2 tests PROT_BTI, so no special compiler support required.
AARCH64_TESTS += bti-2
--
2.34.1
^ permalink raw reply related [flat|nested] 4+ messages in thread
* Re: [PATCH] target/arm: Enable SCTLR_EL1.BT0 for aarch64-linux-user
2022-04-27 4:23 [PATCH] target/arm: Enable SCTLR_EL1.BT0 for aarch64-linux-user Richard Henderson
@ 2022-04-28 12:56 ` Peter Maydell
2022-04-28 15:19 ` Richard Henderson
0 siblings, 1 reply; 4+ messages in thread
From: Peter Maydell @ 2022-04-28 12:56 UTC (permalink / raw)
To: Richard Henderson; +Cc: qemu-arm, qemu-devel
On Wed, 27 Apr 2022 at 05:23, Richard Henderson
<richard.henderson@linaro.org> wrote:
>
> This controls whether the PACI{A,B}SP instructions trap with BTYPE=3
> (indirect branch from register other than x16/x17). The linux kernel
> sets this in bti_enable().
>
> Resolves: https://gitlab.com/qemu-project/qemu/-/issues/998
> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
> --- a/tests/tcg/aarch64/Makefile.target
> +++ b/tests/tcg/aarch64/Makefile.target
> @@ -26,11 +26,11 @@ run-plugin-pauth-%: QEMU_OPTS += -cpu max
> endif
>
> # BTI Tests
> -# bti-1 tests the elf notes, so we require special compiler support.
> +# bti-1 test the elf notes, so we require special compiler support.
Did you intend to edit this comment line ?
Otherwise
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
thanks
-- PMM
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH] target/arm: Enable SCTLR_EL1.BT0 for aarch64-linux-user
2022-04-28 12:56 ` Peter Maydell
@ 2022-04-28 15:19 ` Richard Henderson
2022-05-03 15:24 ` Peter Maydell
0 siblings, 1 reply; 4+ messages in thread
From: Richard Henderson @ 2022-04-28 15:19 UTC (permalink / raw)
To: Peter Maydell; +Cc: qemu-arm, qemu-devel
On 4/28/22 05:56, Peter Maydell wrote:
> On Wed, 27 Apr 2022 at 05:23, Richard Henderson
> <richard.henderson@linaro.org> wrote:
>>
>> This controls whether the PACI{A,B}SP instructions trap with BTYPE=3
>> (indirect branch from register other than x16/x17). The linux kernel
>> sets this in bti_enable().
>>
>> Resolves: https://gitlab.com/qemu-project/qemu/-/issues/998
>> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
>
>> --- a/tests/tcg/aarch64/Makefile.target
>> +++ b/tests/tcg/aarch64/Makefile.target
>> @@ -26,11 +26,11 @@ run-plugin-pauth-%: QEMU_OPTS += -cpu max
>> endif
>>
>> # BTI Tests
>> -# bti-1 tests the elf notes, so we require special compiler support.
>> +# bti-1 test the elf notes, so we require special compiler support.
>
> Did you intend to edit this comment line ?
>
> Otherwise
> Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Oops, no. At one point I had bti-3 sharing this line, and following code, but it didn't work.
r~
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH] target/arm: Enable SCTLR_EL1.BT0 for aarch64-linux-user
2022-04-28 15:19 ` Richard Henderson
@ 2022-05-03 15:24 ` Peter Maydell
0 siblings, 0 replies; 4+ messages in thread
From: Peter Maydell @ 2022-05-03 15:24 UTC (permalink / raw)
To: Richard Henderson; +Cc: qemu-devel, qemu-arm
On Thu, 28 Apr 2022 at 16:19, Richard Henderson
<richard.henderson@linaro.org> wrote:
>
> On 4/28/22 05:56, Peter Maydell wrote:
> > On Wed, 27 Apr 2022 at 05:23, Richard Henderson
> > <richard.henderson@linaro.org> wrote:
> >>
> >> This controls whether the PACI{A,B}SP instructions trap with BTYPE=3
> >> (indirect branch from register other than x16/x17). The linux kernel
> >> sets this in bti_enable().
> >>
> >> Resolves: https://gitlab.com/qemu-project/qemu/-/issues/998
> >> Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
> >
> >> --- a/tests/tcg/aarch64/Makefile.target
> >> +++ b/tests/tcg/aarch64/Makefile.target
> >> @@ -26,11 +26,11 @@ run-plugin-pauth-%: QEMU_OPTS += -cpu max
> >> endif
> >>
> >> # BTI Tests
> >> -# bti-1 tests the elf notes, so we require special compiler support.
> >> +# bti-1 test the elf notes, so we require special compiler support.
> >
> > Did you intend to edit this comment line ?
> >
> > Otherwise
> > Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
>
> Oops, no. At one point I had bti-3 sharing this line, and following code, but it didn't work.
OK; applied to target-arm.next with that line fixed up, thanks.
-- PMM
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2022-05-03 15:26 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2022-04-27 4:23 [PATCH] target/arm: Enable SCTLR_EL1.BT0 for aarch64-linux-user Richard Henderson
2022-04-28 12:56 ` Peter Maydell
2022-04-28 15:19 ` Richard Henderson
2022-05-03 15:24 ` Peter Maydell
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.