diff options
| author | Richard Henderson | 2022-04-27 06:23:12 +0200 |
|---|---|---|
| committer | Peter Maydell | 2022-05-05 10:35:50 +0200 |
| commit | cda86e2b46de857e8b6e16ecd13bb85d81e07899 (patch) | |
| tree | bf6320cd591e079db6260b53488740dd79040376 | |
| parent | Merge tag 'pull-request-2022-05-04' of https://gitlab.com/thuth/qemu into sta... (diff) | |
| download | qemu-cda86e2b46de857e8b6e16ecd13bb85d81e07899.tar.gz qemu-cda86e2b46de857e8b6e16ecd13bb85d81e07899.tar.xz qemu-cda86e2b46de857e8b6e16ecd13bb85d81e07899.zip | |
target/arm: Enable SCTLR_EL1.BT0 for aarch64-linux-user
This controls whether the PACI{A,B}SP instructions trap with BTYPE=3
(indirect branch from register other than x16/x17). The linux kernel
sets this in bti_enable().
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/998
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20220427042312.294300-1-richard.henderson@linaro.org
[PMM: remove stray change to makefile comment]
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| -rw-r--r-- | target/arm/cpu.c | 2 | ||||
| -rw-r--r-- | tests/tcg/aarch64/Makefile.target | 6 | ||||
| -rw-r--r-- | tests/tcg/aarch64/bti-3.c | 42 |
3 files changed, 47 insertions, 3 deletions
diff --git a/target/arm/cpu.c b/target/arm/cpu.c index e46a766d77..2b81b18351 100644 --- a/target/arm/cpu.c +++ b/target/arm/cpu.c @@ -197,6 +197,8 @@ static void arm_cpu_reset(DeviceState *dev) /* Enable all PAC keys. */ env->cp15.sctlr_el[1] |= (SCTLR_EnIA | SCTLR_EnIB | SCTLR_EnDA | SCTLR_EnDB); + /* Trap on btype=3 for PACIxSP. */ + env->cp15.sctlr_el[1] |= SCTLR_BT0; /* and to the FP/Neon instructions */ env->cp15.cpacr_el1 = deposit64(env->cp15.cpacr_el1, 20, 2, 3); /* and to the SVE instructions */ diff --git a/tests/tcg/aarch64/Makefile.target b/tests/tcg/aarch64/Makefile.target index 6ad0ad49f9..d6a74d24dc 100644 --- a/tests/tcg/aarch64/Makefile.target +++ b/tests/tcg/aarch64/Makefile.target @@ -28,9 +28,9 @@ endif # BTI Tests # bti-1 tests the elf notes, so we require special compiler support. ifneq ($(CROSS_CC_HAS_ARMV8_BTI),) -AARCH64_TESTS += bti-1 -bti-1: CFLAGS += -mbranch-protection=standard -bti-1: LDFLAGS += -nostdlib +AARCH64_TESTS += bti-1 bti-3 +bti-1 bti-3: CFLAGS += -mbranch-protection=standard +bti-1 bti-3: LDFLAGS += -nostdlib endif # bti-2 tests PROT_BTI, so no special compiler support required. AARCH64_TESTS += bti-2 diff --git a/tests/tcg/aarch64/bti-3.c b/tests/tcg/aarch64/bti-3.c new file mode 100644 index 0000000000..a852856d9a --- /dev/null +++ b/tests/tcg/aarch64/bti-3.c @@ -0,0 +1,42 @@ +/* + * BTI vs PACIASP + */ + +#include "bti-crt.inc.c" + +static void skip2_sigill(int sig, siginfo_t *info, ucontext_t *uc) +{ + uc->uc_mcontext.pc += 8; + uc->uc_mcontext.pstate = 1; +} + +#define BTYPE_1() \ + asm("mov %0,#1; adr x16, 1f; br x16; 1: hint #25; mov %0,#0" \ + : "=r"(skipped) : : "x16", "x30") + +#define BTYPE_2() \ + asm("mov %0,#1; adr x16, 1f; blr x16; 1: hint #25; mov %0,#0" \ + : "=r"(skipped) : : "x16", "x30") + +#define BTYPE_3() \ + asm("mov %0,#1; adr x15, 1f; br x15; 1: hint #25; mov %0,#0" \ + : "=r"(skipped) : : "x15", "x30") + +#define TEST(WHICH, EXPECT) \ + do { WHICH(); fail += skipped ^ EXPECT; } while (0) + +int main() +{ + int fail = 0; + int skipped; + + /* Signal-like with SA_SIGINFO. */ + signal_info(SIGILL, skip2_sigill); + + /* With SCTLR_EL1.BT0 set, PACIASP is not compatible with type=3. */ + TEST(BTYPE_1, 0); + TEST(BTYPE_2, 0); + TEST(BTYPE_3, 1); + + return fail; +} |