arm_bti_test_functions.S 1.8 KB

1234567891011121314151617181920212223242526272829303132333435363738394041424344454647484950
  1. # Copyright (c) 2021 The Chromium Authors. All rights reserved.
  2. # Use of this source code is governed by a BSD-style license that can be
  3. # found in the LICENSE file.
  4. # This file contains a test function for checking Arm's branch target
  5. # identification (BTI) feature, which helps mitigate jump-oriented
  6. # programming. To get it working, BTI instructions must be executed
  7. # on a compatible core, and the executable pages must be mapped with
  8. # PROT_BTI. To validate that pages mapped with PROT_BTI are working
  9. # correctly:
  10. # 1) Allocate a read-write page.
  11. # 2) Copy between the start and end symbols into that page.
  12. # 3) Set the page to read-execute with PROT_BTI.
  13. # 4) Call the first offset of the page, verify the result.
  14. # 5) Call the second offset of the page (skipping the landing pad).
  15. # Verify that it crashes as expected.
  16. # This test works irrespective of whether BTI is enabled for C/C++
  17. # objects via -mbranch-protection=standard.
  18. .text
  19. .global arm_bti_test_function
  20. .global arm_bti_test_function_invalid_offset
  21. .global arm_bti_test_function_end
  22. arm_bti_test_function:
  23. # Mark the start of this function as a valid call target.
  24. bti jc
  25. add x0, x0, #1
  26. arm_bti_test_function_invalid_offset:
  27. # This label simulates calling an incomplete function.
  28. # Jumping here should crash systems which support BTI.
  29. add x0, x0, #2
  30. ret
  31. arm_bti_test_function_end:
  32. nop
  33. // For details see section "6.2 Program Property" in
  34. // "ELF for the Arm 64-bit Architecture (AArch64)"
  35. // https://github.com/ARM-software/abi-aa/blob/main/aaelf64/aaelf64.rst#62program-property
  36. .pushsection .note.gnu.property, "a";
  37. .balign 8;
  38. .long 4;
  39. .long 0x10;
  40. .long 0x5;
  41. .asciz "GNU";
  42. .long 0xc0000000; /* GNU_PROPERTY_AARCH64_FEATURE_1_AND */
  43. .long 4;
  44. .long 1; /* GNU_PROPERTY_AARCH64_BTI */;
  45. .long 0;
  46. .popsection