cachepc-qemu

Fork of AMDESE/qemu with changes for cachepc side-channel attack
git clone https://git.sinitax.com/sinitax/cachepc-qemu
Log | Files | Refs | Submodules | LICENSE | sfeed.txt

mte-5.c (1095B)


      1/*
      2 * Memory tagging, faulting unaligned access.
      3 *
      4 * Copyright (c) 2021 Linaro Ltd
      5 * SPDX-License-Identifier: GPL-2.0-or-later
      6 */
      7
      8#include "mte.h"
      9
     10void pass(int sig, siginfo_t *info, void *uc)
     11{
     12    assert(info->si_code == SEGV_MTESERR);
     13    exit(0);
     14}
     15
     16int main(int ac, char **av)
     17{
     18    struct sigaction sa;
     19    void *p0, *p1, *p2;
     20    long excl = 1;
     21
     22    enable_mte(PR_MTE_TCF_SYNC);
     23    p0 = alloc_mte_mem(sizeof(*p0));
     24
     25    /* Create two differently tagged pointers.  */
     26    asm("irg %0,%1,%2" : "=r"(p1) : "r"(p0), "r"(excl));
     27    asm("gmi %0,%1,%0" : "+r"(excl) : "r" (p1));
     28    assert(excl != 1);
     29    asm("irg %0,%1,%2" : "=r"(p2) : "r"(p0), "r"(excl));
     30    assert(p1 != p2);
     31
     32    memset(&sa, 0, sizeof(sa));
     33    sa.sa_sigaction = pass;
     34    sa.sa_flags = SA_SIGINFO;
     35    sigaction(SIGSEGV, &sa, NULL);
     36
     37    /* Store store two different tags in sequential granules. */
     38    asm("stg %0, [%0]" : : "r"(p1));
     39    asm("stg %0, [%0]" : : "r"(p2 + 16));
     40
     41    /* Perform an unaligned load crossing the granules. */
     42    asm volatile("ldr %0, [%1]" : "=r"(p0) : "r"(p1 + 12));
     43    abort();
     44}