target/arm: tag is not a part of PAuth with MTX
As described in the section on MTX, tag bits should not be used to store or compute the PAC when MTX is set. See also Authenticate(), InsertPAC(), and Strip(). Signed-off-by: Gabriel Brookman <brookmangabriel@gmail.com> Reviewed-by: Richard Henderson <richard.henderson@linaro.org> Message-id: 20260529-feat-mte4-v7-12-ccbd3c14eb3c@gmail.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Gabriel Brookman committed
May 29, 2026 at 12:52 UTC
ba93f3ae5cbe9bace0a8163843f0d678f08a3e6e
2 files changed
+28
-2
target/arm/internals.h
+11
-1
@@ -1840,7 +1840,17 @@ static inline uint64_t pauth_ptr_mask(ARMVAParameters param)
1840
int bot_pac_bit = 64 - param.tsz;
1841
int top_pac_bit = 64 - 8 * param.tbi;
1842
1843
- return MAKE_64BIT_MASK(bot_pac_bit, top_pac_bit - bot_pac_bit);
1843
+ uint64_t mask = MAKE_64BIT_MASK(bot_pac_bit, top_pac_bit - bot_pac_bit);
1844
+
1845
+ /*
1846
+ * If mtx is enabled, second nibble is not part of PAC. See
1847
+ * InsertPAC().
1848
+ */
1849
+ if (param.mtx) {
1850
+ mask &= ~MAKE_64BIT_MASK(56, 4);
1851
+ }
1852
+
1853
+ return mask;
1854
}
1855
1856
/* Add the cpreg definitions for debug related system registers */
target/arm/tcg/pauth_helper.c
+17
-1
@@ -342,9 +342,16 @@ static uint64_t pauth_addpac(CPUARMState *env, uint64_t ptr, uint64_t modifier,
342
}
343
344
/* Build a pointer with known good extension bits. */
345
- top_bit = 64 - 8 * param.tbi;
345
+ top_bit = 64 - 8 * (param.tbi || param.mtx);
346
bot_bit = 64 - param.tsz;
347
ext_ptr = deposit64(ptr, bot_bit, top_bit - bot_bit, ext);
348
+ /*
349
+ * If mtx is active but not tbi, then the top 4 bits are replaced with the
350
+ * ext bit, while leaving bits 56-59 alone. See InsertPAC().
351
+ */
352
+ if (param.mtx && !param.tbi) {
353
+ ext_ptr = deposit64(ext_ptr, 60, 4, ext);
354
+ }
355
356
pac = pauth_computepac(env, ext_ptr, modifier, *key);
357
@@ -377,6 +384,11 @@ static uint64_t pauth_addpac(CPUARMState *env, uint64_t ptr, uint64_t modifier,
384
if (param.tbi) {
385
ptr &= ~MAKE_64BIT_MASK(bot_bit, 55 - bot_bit + 1);
386
pac &= MAKE_64BIT_MASK(bot_bit, 54 - bot_bit + 1);
387
+ } else if (param.mtx) {
388
+ ptr &= ~(MAKE_64BIT_MASK(60, 4) |
389
+ MAKE_64BIT_MASK(bot_bit, 55 - bot_bit + 1));
390
+ pac &= MAKE_64BIT_MASK(60, 4) |
391
+ MAKE_64BIT_MASK(bot_bit, 54 - bot_bit + 1);
392
} else {
393
ptr &= MAKE_64BIT_MASK(0, bot_bit);
394
pac &= ~(MAKE_64BIT_MASK(55, 1) | MAKE_64BIT_MASK(0, bot_bit));
@@ -424,6 +436,10 @@ static uint64_t pauth_auth(CPUARMState *env, uint64_t ptr, uint64_t modifier,
436
cmp_mask = MAKE_64BIT_MASK(bot_bit, top_bit - bot_bit);
437
cmp_mask &= ~MAKE_64BIT_MASK(55, 1);
438
439
+ if (param.mtx) {
440
+ cmp_mask &= ~MAKE_64BIT_MASK(56, 4);
441
+ }
442
+
443
if (pauth_feature >= PauthFeat_2) {
444
ARMPauthFeature fault_feature =
445
is_combined ? PauthFeat_FPACCOMBINED : PauthFeat_FPAC;