#include #include #include #include #define TESTS 1000 int main() { int i, count = 0; float perc; void *base = malloc(TESTS); for (i = 0; i < TESTS; i++) { uintptr_t in, x, y; in = i + (uintptr_t) base; asm("mov %0, %[in]\n\t" "pacia %0, sp\n\t" /* sigill if pauth not supported */ "eor %0, %0, #4\n\t" /* corrupt single bit */ "mov %1, %0\n\t" "autia %1, sp\n\t" /* validate corrupted pointer */ "xpaci %0\n\t" /* strip pac from corrupted pointer */ : /* out */ "=r"(x), "=r"(y) : /* in */ [in] "r" (in) : /* clobbers */); /* * Once stripped, the corrupted pointer is of the form 0x0000...wxyz. * We expect the autia to indicate failure, producing a pointer of the * form 0x000e....wxyz. Use xpaci and != for the test, rather than * extracting explicit bits from the top, because the location of the * error code "e" depends on the configuration of virtual memory. */ if (x != y) { count++; } } perc = (float) count / (float) TESTS; printf("Checks Passed: %0.2f%%", perc * 100.0); assert(perc > 0.95); return 0; }