| Message ID | 20220427042312.294300-1-richard.henderson@linaro.org |
|---|---|
| State | Accepted |
| Commit | cda86e2b46de857e8b6e16ecd13bb85d81e07899 |
| Headers | show |
| Series | target/arm: Enable SCTLR_EL1.BT0 for aarch64-linux-user | expand |
On Wed, 27 Apr 2022 at 05:23, Richard Henderson <richard.henderson@linaro.org> wrote: > > This controls whether the PACI{A,B}SP instructions trap with BTYPE=3 > (indirect branch from register other than x16/x17). The linux kernel > sets this in bti_enable(). > > Resolves: https://gitlab.com/qemu-project/qemu/-/issues/998 > Signed-off-by: Richard Henderson <richard.henderson@linaro.org> > --- a/tests/tcg/aarch64/Makefile.target > +++ b/tests/tcg/aarch64/Makefile.target > @@ -26,11 +26,11 @@ run-plugin-pauth-%: QEMU_OPTS += -cpu max > endif > > # BTI Tests > -# bti-1 tests the elf notes, so we require special compiler support. > +# bti-1 test the elf notes, so we require special compiler support. Did you intend to edit this comment line ? Otherwise Reviewed-by: Peter Maydell <peter.maydell@linaro.org> thanks -- PMM
On 4/28/22 05:56, Peter Maydell wrote: > On Wed, 27 Apr 2022 at 05:23, Richard Henderson > <richard.henderson@linaro.org> wrote: >> >> This controls whether the PACI{A,B}SP instructions trap with BTYPE=3 >> (indirect branch from register other than x16/x17). The linux kernel >> sets this in bti_enable(). >> >> Resolves: https://gitlab.com/qemu-project/qemu/-/issues/998 >> Signed-off-by: Richard Henderson <richard.henderson@linaro.org> > >> --- a/tests/tcg/aarch64/Makefile.target >> +++ b/tests/tcg/aarch64/Makefile.target >> @@ -26,11 +26,11 @@ run-plugin-pauth-%: QEMU_OPTS += -cpu max >> endif >> >> # BTI Tests >> -# bti-1 tests the elf notes, so we require special compiler support. >> +# bti-1 test the elf notes, so we require special compiler support. > > Did you intend to edit this comment line ? > > Otherwise > Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Oops, no. At one point I had bti-3 sharing this line, and following code, but it didn't work. r~
On Thu, 28 Apr 2022 at 16:19, Richard Henderson <richard.henderson@linaro.org> wrote: > > On 4/28/22 05:56, Peter Maydell wrote: > > On Wed, 27 Apr 2022 at 05:23, Richard Henderson > > <richard.henderson@linaro.org> wrote: > >> > >> This controls whether the PACI{A,B}SP instructions trap with BTYPE=3 > >> (indirect branch from register other than x16/x17). The linux kernel > >> sets this in bti_enable(). > >> > >> Resolves: https://gitlab.com/qemu-project/qemu/-/issues/998 > >> Signed-off-by: Richard Henderson <richard.henderson@linaro.org> > > > >> --- a/tests/tcg/aarch64/Makefile.target > >> +++ b/tests/tcg/aarch64/Makefile.target > >> @@ -26,11 +26,11 @@ run-plugin-pauth-%: QEMU_OPTS += -cpu max > >> endif > >> > >> # BTI Tests > >> -# bti-1 tests the elf notes, so we require special compiler support. > >> +# bti-1 test the elf notes, so we require special compiler support. > > > > Did you intend to edit this comment line ? > > > > Otherwise > > Reviewed-by: Peter Maydell <peter.maydell@linaro.org> > > Oops, no. At one point I had bti-3 sharing this line, and following code, but it didn't work. OK; applied to target-arm.next with that line fixed up, thanks. -- PMM
diff --git a/target/arm/cpu.c b/target/arm/cpu.c index e3f8215203..c50a8dca0b 100644 --- a/target/arm/cpu.c +++ b/target/arm/cpu.c @@ -197,6 +197,8 @@ static void arm_cpu_reset(DeviceState *dev) /* Enable all PAC keys. */ env->cp15.sctlr_el[1] |= (SCTLR_EnIA | SCTLR_EnIB | SCTLR_EnDA | SCTLR_EnDB); + /* Trap on btype=3 for PACIxSP. */ + env->cp15.sctlr_el[1] |= SCTLR_BT0; /* and to the FP/Neon instructions */ env->cp15.cpacr_el1 = deposit64(env->cp15.cpacr_el1, 20, 2, 3); /* and to the SVE instructions */ diff --git a/tests/tcg/aarch64/bti-3.c b/tests/tcg/aarch64/bti-3.c new file mode 100644 index 0000000000..a852856d9a --- /dev/null +++ b/tests/tcg/aarch64/bti-3.c @@ -0,0 +1,42 @@ +/* + * BTI vs PACIASP + */ + +#include "bti-crt.inc.c" + +static void skip2_sigill(int sig, siginfo_t *info, ucontext_t *uc) +{ + uc->uc_mcontext.pc += 8; + uc->uc_mcontext.pstate = 1; +} + +#define BTYPE_1() \ + asm("mov %0,#1; adr x16, 1f; br x16; 1: hint #25; mov %0,#0" \ + : "=r"(skipped) : : "x16", "x30") + +#define BTYPE_2() \ + asm("mov %0,#1; adr x16, 1f; blr x16; 1: hint #25; mov %0,#0" \ + : "=r"(skipped) : : "x16", "x30") + +#define BTYPE_3() \ + asm("mov %0,#1; adr x15, 1f; br x15; 1: hint #25; mov %0,#0" \ + : "=r"(skipped) : : "x15", "x30") + +#define TEST(WHICH, EXPECT) \ + do { WHICH(); fail += skipped ^ EXPECT; } while (0) + +int main() +{ + int fail = 0; + int skipped; + + /* Signal-like with SA_SIGINFO. */ + signal_info(SIGILL, skip2_sigill); + + /* With SCTLR_EL1.BT0 set, PACIASP is not compatible with type=3. */ + TEST(BTYPE_1, 0); + TEST(BTYPE_2, 0); + TEST(BTYPE_3, 1); + + return fail; +} diff --git a/tests/tcg/aarch64/Makefile.target b/tests/tcg/aarch64/Makefile.target index 6ad0ad49f9..a738eb137c 100644 --- a/tests/tcg/aarch64/Makefile.target +++ b/tests/tcg/aarch64/Makefile.target @@ -26,11 +26,11 @@ run-plugin-pauth-%: QEMU_OPTS += -cpu max endif # BTI Tests -# bti-1 tests the elf notes, so we require special compiler support. +# bti-1 test the elf notes, so we require special compiler support. ifneq ($(CROSS_CC_HAS_ARMV8_BTI),) -AARCH64_TESTS += bti-1 -bti-1: CFLAGS += -mbranch-protection=standard -bti-1: LDFLAGS += -nostdlib +AARCH64_TESTS += bti-1 bti-3 +bti-1 bti-3: CFLAGS += -mbranch-protection=standard +bti-1 bti-3: LDFLAGS += -nostdlib endif # bti-2 tests PROT_BTI, so no special compiler support required. AARCH64_TESTS += bti-2
This controls whether the PACI{A,B}SP instructions trap with BTYPE=3 (indirect branch from register other than x16/x17). The linux kernel sets this in bti_enable(). Resolves: https://gitlab.com/qemu-project/qemu/-/issues/998 Signed-off-by: Richard Henderson <richard.henderson@linaro.org> --- target/arm/cpu.c | 2 ++ tests/tcg/aarch64/bti-3.c | 42 +++++++++++++++++++++++++++++++ tests/tcg/aarch64/Makefile.target | 8 +++--- 3 files changed, 48 insertions(+), 4 deletions(-) create mode 100644 tests/tcg/aarch64/bti-3.c