* [PATCH v3 1/3] tcg: Introduce target-specific page data for user-only
2019-10-15 16:35 [PATCH 0/3] target/arm: Implement ARMv8.5-MemTag, user mode Richard Henderson
@ 2019-10-15 16:35 ` Richard Henderson
2019-10-15 16:35 ` [PATCH v3 2/3] target/arm: Add allocation tag storage for user mode Richard Henderson
` (2 subsequent siblings)
3 siblings, 0 replies; 5+ messages in thread
From: Richard Henderson @ 2019-10-15 16:35 UTC (permalink / raw)
To: qemu-devel; +Cc: elver, icb, qemu-arm
At the same time, remember MAP_SHARED as PAGE_SHARED. When mapping
new pages, make sure that old target-specific page data is removed.
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
include/exec/cpu-all.h | 10 ++++++++--
accel/tcg/translate-all.c | 28 ++++++++++++++++++++++++++++
linux-user/mmap.c | 8 +++++++-
linux-user/syscall.c | 4 ++--
4 files changed, 45 insertions(+), 5 deletions(-)
diff --git a/include/exec/cpu-all.h b/include/exec/cpu-all.h
index d23ced1d12..034773e319 100644
--- a/include/exec/cpu-all.h
+++ b/include/exec/cpu-all.h
@@ -243,10 +243,14 @@ extern intptr_t qemu_host_page_mask;
#define PAGE_WRITE_ORG 0x0010
/* Invalidate the TLB entry immediately, helpful for s390x
* Low-Address-Protection. Used with PAGE_WRITE in tlb_set_page_with_attrs() */
-#define PAGE_WRITE_INV 0x0040
+#define PAGE_WRITE_INV 0x0020
+/* Page is mapped shared. */
+#define PAGE_SHARED 0x0040
+/* For use with page_set_flags: page is being replaced; target_data cleared. */
+#define PAGE_RESET 0x0080
#if defined(CONFIG_BSD) && defined(CONFIG_USER_ONLY)
/* FIXME: Code that sets/uses this is broken and needs to go away. */
-#define PAGE_RESERVED 0x0020
+#define PAGE_RESERVED 0x0100
#endif
/* Target-specific bits that will be used via page_get_flags(). */
#define PAGE_TARGET_1 0x0080
@@ -261,6 +265,8 @@ int walk_memory_regions(void *, walk_memory_regions_fn);
int page_get_flags(target_ulong address);
void page_set_flags(target_ulong start, target_ulong end, int flags);
int page_check_range(target_ulong start, target_ulong len, int flags);
+void *page_get_target_data(target_ulong address);
+void *page_alloc_target_data(target_ulong address, size_t size);
#endif
CPUArchState *cpu_copy(CPUArchState *env);
diff --git a/accel/tcg/translate-all.c b/accel/tcg/translate-all.c
index 66d4bc4341..dbf08b55e2 100644
--- a/accel/tcg/translate-all.c
+++ b/accel/tcg/translate-all.c
@@ -110,6 +110,7 @@ typedef struct PageDesc {
unsigned int code_write_count;
#else
unsigned long flags;
+ void *target_data;
#endif
#ifndef CONFIG_USER_ONLY
QemuSpin lock;
@@ -2513,6 +2514,7 @@ int page_get_flags(target_ulong address)
void page_set_flags(target_ulong start, target_ulong end, int flags)
{
target_ulong addr, len;
+ bool reset_target_data;
/* This function should never be called with addresses outside the
guest address space. If this assert fires, it probably indicates
@@ -2529,6 +2531,8 @@ void page_set_flags(target_ulong start, target_ulong end, int flags)
if (flags & PAGE_WRITE) {
flags |= PAGE_WRITE_ORG;
}
+ reset_target_data = !(flags & PAGE_VALID) || (flags & PAGE_RESET);
+ flags &= ~PAGE_RESET;
for (addr = start, len = end - start;
len != 0;
@@ -2542,10 +2546,34 @@ void page_set_flags(target_ulong start, target_ulong end, int flags)
p->first_tb) {
tb_invalidate_phys_page(addr, 0);
}
+ if (reset_target_data && p->target_data) {
+ g_free(p->target_data);
+ p->target_data = NULL;
+ }
p->flags = flags;
}
}
+void *page_get_target_data(target_ulong address)
+{
+ PageDesc *p = page_find(address >> TARGET_PAGE_BITS);
+ return p ? p->target_data : NULL;
+}
+
+void *page_alloc_target_data(target_ulong address, size_t size)
+{
+ PageDesc *p = page_find(address >> TARGET_PAGE_BITS);
+ void *ret = NULL;
+
+ if (p) {
+ ret = p->target_data;
+ if (!ret && (p->flags & PAGE_VALID)) {
+ p->target_data = ret = g_malloc0(size);
+ }
+ }
+ return ret;
+}
+
int page_check_range(target_ulong start, target_ulong len, int flags)
{
PageDesc *p;
diff --git a/linux-user/mmap.c b/linux-user/mmap.c
index c1bed290f6..75e0355ff7 100644
--- a/linux-user/mmap.c
+++ b/linux-user/mmap.c
@@ -626,6 +626,10 @@ abi_long target_mmap(abi_ulong start, abi_ulong len, int target_prot,
}
}
the_end1:
+ if ((flags & MAP_TYPE) == MAP_SHARED) {
+ page_flags |= PAGE_SHARED;
+ }
+ page_flags |= PAGE_RESET;
page_set_flags(start, start + len, page_flags);
the_end:
#ifdef DEBUG_MMAP
@@ -818,9 +822,11 @@ abi_long target_mremap(abi_ulong old_addr, abi_ulong old_size,
new_addr = -1;
} else {
new_addr = h2g(host_addr);
+ /* FIXME: Move page flags (and target_data?) for each page. */
prot = page_get_flags(old_addr);
page_set_flags(old_addr, old_addr + old_size, 0);
- page_set_flags(new_addr, new_addr + new_size, prot | PAGE_VALID);
+ page_set_flags(new_addr, new_addr + new_size,
+ prot | PAGE_VALID | PAGE_RESET);
}
tb_invalidate_phys_range(new_addr, new_addr + new_size);
mmap_unlock();
diff --git a/linux-user/syscall.c b/linux-user/syscall.c
index e2af3c1494..52f50eca4b 100644
--- a/linux-user/syscall.c
+++ b/linux-user/syscall.c
@@ -4061,8 +4061,8 @@ static inline abi_ulong do_shmat(CPUArchState *cpu_env,
raddr=h2g((unsigned long)host_raddr);
page_set_flags(raddr, raddr + shm_info.shm_segsz,
- PAGE_VALID | PAGE_READ |
- ((shmflg & SHM_RDONLY)? 0 : PAGE_WRITE));
+ PAGE_VALID | PAGE_SHARED | PAGE_RESET | PAGE_READ |
+ (shmflg & SHM_RDONLY ? 0 : PAGE_WRITE));
for (i = 0; i < N_SHM_REGIONS; i++) {
if (!shm_regions[i].in_use) {
--
2.17.1
^ permalink raw reply related [flat|nested] 5+ messages in thread* [PATCH v3 2/3] target/arm: Add allocation tag storage for user mode
2019-10-15 16:35 [PATCH 0/3] target/arm: Implement ARMv8.5-MemTag, user mode Richard Henderson
2019-10-15 16:35 ` [PATCH v3 1/3] tcg: Introduce target-specific page data for user-only Richard Henderson
@ 2019-10-15 16:35 ` Richard Henderson
2019-10-15 16:35 ` [PATCH v3 3/3] tests/tcg/aarch64: Add mte smoke tests Richard Henderson
2019-12-06 13:23 ` [PATCH 0/3] target/arm: Implement ARMv8.5-MemTag, user mode Peter Maydell
3 siblings, 0 replies; 5+ messages in thread
From: Richard Henderson @ 2019-10-15 16:35 UTC (permalink / raw)
To: qemu-devel; +Cc: elver, icb, qemu-arm
Control this with x-tagged-pages, which is off by default.
The limitation to non-shared pages is not part of a future kernel API,
but a limitation of linux-user not being able to map virtual pages back
to physical pages.
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
v2: Add the x-tagged-pages cpu property
---
target/arm/cpu.h | 4 ++++
target/arm/cpu64.c | 20 ++++++++++++++++++++
target/arm/mte_helper.c | 35 +++++++++++++++++++++++++++++++++--
3 files changed, 57 insertions(+), 2 deletions(-)
diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index c3609ef9d5..272df43d3c 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -912,6 +912,10 @@ struct ARMCPU {
*/
bool cfgend;
+#ifdef CONFIG_USER_ONLY
+ bool tagged_pages;
+#endif
+
QLIST_HEAD(, ARMELChangeHook) pre_el_change_hooks;
QLIST_HEAD(, ARMELChangeHook) el_change_hooks;
diff --git a/target/arm/cpu64.c b/target/arm/cpu64.c
index ac1e2dc2c4..4bf498f778 100644
--- a/target/arm/cpu64.c
+++ b/target/arm/cpu64.c
@@ -279,6 +279,20 @@ static void cpu_max_set_sve_vq(Object *obj, Visitor *v, const char *name,
error_propagate(errp, err);
}
+#ifdef CONFIG_USER_ONLY
+static bool aarch64_cpu_get_tagged_pages(Object *obj, Error **errp)
+{
+ ARMCPU *cpu = ARM_CPU(obj);
+ return cpu->tagged_pages;
+}
+
+static void aarch64_cpu_set_tagged_pages(Object *obj, bool val, Error **errp)
+{
+ ARMCPU *cpu = ARM_CPU(obj);
+ cpu->tagged_pages = val;
+}
+#endif
+
/* -cpu max: if KVM is enabled, like -cpu host (best possible with this host);
* otherwise, a CPU with as many features enabled as our emulation supports.
* The version of '-cpu max' for qemu-system-arm is defined in cpu.c;
@@ -389,6 +403,12 @@ static void aarch64_max_initfn(Object *obj)
*/
cpu->ctr = 0x80038003; /* 32 byte I and D cacheline size, VIPT icache */
cpu->dcz_blocksize = 7; /* 512 bytes */
+
+ object_property_add_bool(obj, "x-tagged-pages",
+ aarch64_cpu_get_tagged_pages,
+ aarch64_cpu_set_tagged_pages, NULL);
+ object_property_set_description(obj, "x-tagged-pages",
+ "Set on/off MemAttr Tagged for all pages", NULL);
#endif
cpu->sve_max_vq = ARM_MAX_VQ;
diff --git a/target/arm/mte_helper.c b/target/arm/mte_helper.c
index 657383ba0e..797c6229ab 100644
--- a/target/arm/mte_helper.c
+++ b/target/arm/mte_helper.c
@@ -29,8 +29,39 @@ static uint8_t *allocation_tag_mem(CPUARMState *env, uint64_t ptr,
bool write, uintptr_t ra)
{
#ifdef CONFIG_USER_ONLY
- /* Tag storage not implemented. */
- return NULL;
+ ARMCPU *cpu = env_archcpu(env);
+ uint8_t *tags;
+ uintptr_t index;
+ int flags;
+
+ flags = page_get_flags(ptr);
+
+ if (!(flags & PAGE_VALID) || !(flags & (write ? PAGE_WRITE : PAGE_READ))) {
+ /* SIGSEGV */
+ env->exception.vaddress = ptr;
+ cpu_restore_state(CPU(cpu), ra, true);
+ raise_exception(env, EXCP_DATA_ABORT, 0, 1);
+ }
+
+ if (!cpu->tagged_pages) {
+ /* Tag storage is disabled. */
+ return NULL;
+ }
+ if (flags & PAGE_SHARED) {
+ /* There may be multiple mappings; pretend not implemented. */
+ return NULL;
+ }
+
+ tags = page_get_target_data(ptr);
+ if (tags == NULL) {
+ size_t alloc_size = TARGET_PAGE_SIZE >> (LOG2_TAG_GRANULE + 1);
+ tags = page_alloc_target_data(ptr, alloc_size);
+ assert(tags != NULL);
+ }
+
+ index = extract32(ptr, LOG2_TAG_GRANULE + 1,
+ TARGET_PAGE_BITS - LOG2_TAG_GRANULE - 1);
+ return tags + index;
#else
CPUState *cs = env_cpu(env);
uintptr_t index;
--
2.17.1
^ permalink raw reply related [flat|nested] 5+ messages in thread* [PATCH v3 3/3] tests/tcg/aarch64: Add mte smoke tests
2019-10-15 16:35 [PATCH 0/3] target/arm: Implement ARMv8.5-MemTag, user mode Richard Henderson
2019-10-15 16:35 ` [PATCH v3 1/3] tcg: Introduce target-specific page data for user-only Richard Henderson
2019-10-15 16:35 ` [PATCH v3 2/3] target/arm: Add allocation tag storage for user mode Richard Henderson
@ 2019-10-15 16:35 ` Richard Henderson
2019-12-06 13:23 ` [PATCH 0/3] target/arm: Implement ARMv8.5-MemTag, user mode Peter Maydell
3 siblings, 0 replies; 5+ messages in thread
From: Richard Henderson @ 2019-10-15 16:35 UTC (permalink / raw)
To: qemu-devel; +Cc: elver, icb, qemu-arm
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
tests/tcg/aarch64/mte-1.c | 27 +++++++++++++++++++++
tests/tcg/aarch64/mte-2.c | 39 +++++++++++++++++++++++++++++++
tests/tcg/aarch64/Makefile.target | 5 ++++
3 files changed, 71 insertions(+)
create mode 100644 tests/tcg/aarch64/mte-1.c
create mode 100644 tests/tcg/aarch64/mte-2.c
diff --git a/tests/tcg/aarch64/mte-1.c b/tests/tcg/aarch64/mte-1.c
new file mode 100644
index 0000000000..18bfb1120f
--- /dev/null
+++ b/tests/tcg/aarch64/mte-1.c
@@ -0,0 +1,27 @@
+/*
+ * Memory tagging, basic pass cases.
+ */
+
+#include <assert.h>
+
+asm(".arch armv8.5-a+memtag");
+
+int data[16 / sizeof(int)] __attribute__((aligned(16)));
+
+int main(int ac, char **av)
+{
+ int *p0 = data;
+ int *p1, *p2;
+ long c;
+
+ asm("irg %0,%1,%2" : "=r"(p1) : "r"(p0), "r"(1));
+ assert(p1 != p0);
+ asm("subp %0,%1,%2" : "=r"(c) : "r"(p0), "r"(p1));
+ assert(c == 0);
+
+ asm("stg %0, [%0]" : : "r"(p1));
+ asm("ldg %0, [%1]" : "=r"(p2) : "r"(p0), "0"(p0));
+ assert(p1 == p2);
+
+ return 0;
+}
diff --git a/tests/tcg/aarch64/mte-2.c b/tests/tcg/aarch64/mte-2.c
new file mode 100644
index 0000000000..2991b7df69
--- /dev/null
+++ b/tests/tcg/aarch64/mte-2.c
@@ -0,0 +1,39 @@
+/*
+ * Memory tagging, basic fail cases.
+ */
+
+#include <assert.h>
+#include <signal.h>
+#include <stdlib.h>
+
+asm(".arch armv8.5-a+memtag");
+
+int data[16 / sizeof(int)] __attribute__((aligned(16)));
+
+void pass(int sig)
+{
+ exit(0);
+}
+
+int main(int ac, char **av)
+{
+ int *p0 = data;
+ int *p1, *p2;
+ long excl = 1;
+
+ /* Create two differently tagged pointers. */
+ asm("irg %0,%1,%2" : "=r"(p1) : "r"(p0), "r"(excl));
+ asm("gmi %0,%1,%0" : "+r"(excl) : "r" (p1));
+ assert(excl != 1);
+ asm("irg %0,%1,%2" : "=r"(p2) : "r"(p0), "r"(excl));
+ assert(p1 != p2);
+
+ /* Store the tag from the first pointer. */
+ asm("stg %0, [%0]" : : "r"(p1));
+
+ *p1 = 0;
+ signal(SIGSEGV, pass);
+ *p2 = 0;
+
+ assert(0);
+}
diff --git a/tests/tcg/aarch64/Makefile.target b/tests/tcg/aarch64/Makefile.target
index 0040b68dd0..0971c244b7 100644
--- a/tests/tcg/aarch64/Makefile.target
+++ b/tests/tcg/aarch64/Makefile.target
@@ -32,4 +32,9 @@ run-semihosting: semihosting
# AARCH64_TESTS += bti-1
bti-1: LDFLAGS += -nostdlib -Wl,-T,$(AARCH64_SRC)/bti.ld
+# We need binutils-2.32 to assemble this test case.
+# AARCH64_TESTS += mte-1 mte-2
+mte-%: CFLAGS += -O -g
+run-mte-%: QEMU += -cpu max,x-tagged-pages=on
+
TESTS += $(AARCH64_TESTS)
--
2.17.1
^ permalink raw reply related [flat|nested] 5+ messages in thread* Re: [PATCH 0/3] target/arm: Implement ARMv8.5-MemTag, user mode
2019-10-15 16:35 [PATCH 0/3] target/arm: Implement ARMv8.5-MemTag, user mode Richard Henderson
` (2 preceding siblings ...)
2019-10-15 16:35 ` [PATCH v3 3/3] tests/tcg/aarch64: Add mte smoke tests Richard Henderson
@ 2019-12-06 13:23 ` Peter Maydell
3 siblings, 0 replies; 5+ messages in thread
From: Peter Maydell @ 2019-12-06 13:23 UTC (permalink / raw)
To: Richard Henderson; +Cc: elver, icb, QEMU Developers, qemu-arm
On Tue, 15 Oct 2019 at 17:47, Richard Henderson
<richard.henderson@linaro.org> wrote:
>
> This is a refresh of the user-only patch set from March.
>
> I do not attempt to implement any part of a kernel abi wrt mmap
> and/or mprotect. Instead, it uses a x-tagged-pages property to
> assume that all anonymous pages have tags.
>
> The tests added are disabled by default, but do pass if you have
> binutils 2.32 installed.
I'm going to skip reviewing this until we have a defined
kernel ABI to compare against.
thanks
-- PMM
^ permalink raw reply [flat|nested] 5+ messages in thread