@samitouri / QOSamiQemu / commits / ba93f3ae5c

target/arm: tag is not a part of PAuth with MTX

As described in the section on MTX, tag bits should not be used to store or compute the PAC when MTX is set. See also Authenticate(), InsertPAC(), and Strip(). Signed-off-by: Gabriel Brookman <brookmangabriel@gmail.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20260529-feat-mte4-v7-12-ccbd3c14eb3c@gmail.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

Gabriel Brookman committed May 29, 2026 at 12:52 UTC ba93f3ae5cbe9bace0a8163843f0d678f08a3e6e
2 files changed +28 -2
target/arm/internals.h
+11 -1
@@ -1840,7 +1840,17 @@ static inline uint64_t pauth_ptr_mask(ARMVAParameters param)
1840 int bot_pac_bit = 64 - param.tsz;
1841 int top_pac_bit = 64 - 8 * param.tbi;
1842
1843 - return MAKE_64BIT_MASK(bot_pac_bit, top_pac_bit - bot_pac_bit);
1843 + uint64_t mask = MAKE_64BIT_MASK(bot_pac_bit, top_pac_bit - bot_pac_bit);
1844 +
1845 + /*
1846 + * If mtx is enabled, second nibble is not part of PAC. See
1847 + * InsertPAC().
1848 + */
1849 + if (param.mtx) {
1850 + mask &= ~MAKE_64BIT_MASK(56, 4);
1851 + }
1852 +
1853 + return mask;
1854 }
1855
1856 /* Add the cpreg definitions for debug related system registers */
target/arm/tcg/pauth_helper.c
+17 -1
@@ -342,9 +342,16 @@ static uint64_t pauth_addpac(CPUARMState *env, uint64_t ptr, uint64_t modifier,
342 }
343
344 /* Build a pointer with known good extension bits. */
345 - top_bit = 64 - 8 * param.tbi;
345 + top_bit = 64 - 8 * (param.tbi || param.mtx);
346 bot_bit = 64 - param.tsz;
347 ext_ptr = deposit64(ptr, bot_bit, top_bit - bot_bit, ext);
348 + /*
349 + * If mtx is active but not tbi, then the top 4 bits are replaced with the
350 + * ext bit, while leaving bits 56-59 alone. See InsertPAC().
351 + */
352 + if (param.mtx && !param.tbi) {
353 + ext_ptr = deposit64(ext_ptr, 60, 4, ext);
354 + }
355
356 pac = pauth_computepac(env, ext_ptr, modifier, *key);
357
@@ -377,6 +384,11 @@ static uint64_t pauth_addpac(CPUARMState *env, uint64_t ptr, uint64_t modifier,
384 if (param.tbi) {
385 ptr &= ~MAKE_64BIT_MASK(bot_bit, 55 - bot_bit + 1);
386 pac &= MAKE_64BIT_MASK(bot_bit, 54 - bot_bit + 1);
387 + } else if (param.mtx) {
388 + ptr &= ~(MAKE_64BIT_MASK(60, 4) |
389 + MAKE_64BIT_MASK(bot_bit, 55 - bot_bit + 1));
390 + pac &= MAKE_64BIT_MASK(60, 4) |
391 + MAKE_64BIT_MASK(bot_bit, 54 - bot_bit + 1);
392 } else {
393 ptr &= MAKE_64BIT_MASK(0, bot_bit);
394 pac &= ~(MAKE_64BIT_MASK(55, 1) | MAKE_64BIT_MASK(0, bot_bit));
@@ -424,6 +436,10 @@ static uint64_t pauth_auth(CPUARMState *env, uint64_t ptr, uint64_t modifier,
436 cmp_mask = MAKE_64BIT_MASK(bot_bit, top_bit - bot_bit);
437 cmp_mask &= ~MAKE_64BIT_MASK(55, 1);
438
439 + if (param.mtx) {
440 + cmp_mask &= ~MAKE_64BIT_MASK(56, 4);
441 + }
442 +
443 if (pauth_feature >= PauthFeat_2) {
444 ARMPauthFeature fault_feature =
445 is_combined ? PauthFeat_FPACCOMBINED : PauthFeat_FPAC;