cachepc-qemu

Fork of AMDESE/qemu with changes for cachepc side-channel attack
git clone https://git.sinitax.com/sinitax/cachepc-qemu
Log | Files | Refs | Submodules | LICENSE | sfeed.txt

mte-3.c (1341B)

      1/*
      2 * Memory tagging, basic fail cases, asynchronous signals.
      3 *
      4 * Copyright (c) 2021 Linaro Ltd
      5 * SPDX-License-Identifier: GPL-2.0-or-later
      6 */
      7
      8#include "mte.h"
      9
     10void pass(int sig, siginfo_t *info, void *uc)
     11{
     12    assert(info->si_code == SEGV_MTEAERR);
     13    exit(0);
     14}
     15
     16int main(int ac, char **av)
     17{
     18    struct sigaction sa;
     19    long *p0, *p1, *p2;
     20    long excl = 1;
     21
     22    enable_mte(PR_MTE_TCF_ASYNC);
     23    p0 = alloc_mte_mem(sizeof(*p0));
     24
     25    /* Create two differently tagged pointers.  */
     26    asm("irg %0,%1,%2" : "=r"(p1) : "r"(p0), "r"(excl));
     27    asm("gmi %0,%1,%0" : "+r"(excl) : "r" (p1));
     28    assert(excl != 1);
     29    asm("irg %0,%1,%2" : "=r"(p2) : "r"(p0), "r"(excl));
     30    assert(p1 != p2);
     31
     32    /* Store the tag from the first pointer.  */
     33    asm("stg %0, [%0]" : : "r"(p1));
     34
     35    *p1 = 0;
     36
     37    memset(&sa, 0, sizeof(sa));
     38    sa.sa_sigaction = pass;
     39    sa.sa_flags = SA_SIGINFO;
     40    sigaction(SIGSEGV, &sa, NULL);
     41
     42    /*
     43     * Signal for async error will happen eventually.
     44     * For a real kernel this should be after the next IRQ (e.g. timer).
     45     * For qemu linux-user, we kick the cpu and exit at the next TB.
     46     * In either case, loop until this happens (or killed by timeout).
     47     * For extra sauce, yield, producing EXCP_YIELD to cpu_loop().
     48     */
     49    asm("str %0, [%0]; yield" : : "r"(p2));
     50    while (1);
     51}