fix(bti): Add branch protection for VHE host apps
This patch enables branch protection for EL0 host apps that are build
with the test infrastructure. This patch also edits the VM memory
sharing tests to add the BTI instruction in tests where executable
memory is shared/lent. This is because the test VMs use the same page
table library as the hypervisor and the GP bit gets set, when it is
compiled branch protection enabled.
Signed-off-by: Raghu Krishnamurthy <raghu.ncstate@gmail.com>
Change-Id: Ib8ba887fe386c8e47e3e65487255a14665a74bc4
diff --git a/test/hftest/hftest.py b/test/hftest/hftest.py
index 35cabdc..65e267e 100755
--- a/test/hftest/hftest.py
+++ b/test/hftest/hftest.py
@@ -367,8 +367,14 @@
f"cluster0.cpu0={self.FVP_PREBUILT_BL31}@{self.CPU_START_ADDRESS}",
"-C", "bp.ve_sysregs.mmbSiteDefault=0",
"-C", "bp.ve_sysregs.exit_on_shutdown=1",
- "-C", "cluster0.has_arm_v8-1=1",
- "-C", "cluster1.has_arm_v8-1=1",
+ "-C", "cluster0.has_arm_v8-5=1",
+ "-C", "cluster1.has_arm_v8-5=1",
+ "-C", "cluster0.has_branch_target_exception=1",
+ "-C", "cluster1.has_branch_target_exception=1",
+ "-C", "cluster0.restriction_on_speculative_execution=2",
+ "-C", "cluster1.restriction_on_speculative_execution=2",
+ "-C", "cluster0.restriction_on_speculative_execution_aarch32=2",
+ "-C", "cluster1.restriction_on_speculative_execution_aarch32=2",
]
if uart0_log_path and uart1_log_path:
@@ -520,12 +526,6 @@
fvp_args += [
"--data", f"cluster0.cpu0={dt.dtb}@{self.SPMC_DTB_ADDRESS}",
"--data", f"cluster0.cpu0={self.args.spmc}@{self.SPMC_ADDRESS}",
- "-C", "cluster0.has_arm_v8-5=1",
- "-C", "cluster1.has_arm_v8-5=1",
- "-C", "cluster0.has_branch_target_exception=1",
- "-C", "cluster1.has_branch_target_exception=1",
- "-C", "cluster0.restriction_on_speculative_execution=2",
- "-C", "cluster1.restriction_on_speculative_execution=2",
]
if secure_ctrl: