meta-arm/selftest: add test that PAC/BTI instructions are used

We enable PAC/BTI out of the box, but all of the pieces (such as gcc and
glibc) need to support it for the final binary to be protected.

Add a minimal test recipe to verify that the "Hello, World" binary is
using PAC/BTI, and add it to oe-selftest.

Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Jon Mason <jon.mason@arm.com>

meta-arm/lib/oeqa/selftest/cases/pacbti.py

@@ -0,0 +1,11 @@
+from oeqa.selftest.case import OESelftestTestCase
+from oeqa.core.decorator import OETestTag
+from oeqa.core.decorator.data import skipIfNotArch
+from oeqa.utils.commands import bitbake
+
+@OETestTag("meta-arm")
+class PacBtiTest(OESelftestTestCase):
+
+    @skipIfNotArch(["aarch64"])
+    def test_pac_bti(self):
+        bitbake("test-pacbti")

meta-arm/recipes-test/pacbti/files/pacbti.c

@@ -0,0 +1,9 @@
+// Copyright (C) 2023 Arm Ltd
+// SPDX-License-Identifier: MIT
+
+#include <stdio.h>
+
+int main() {
+    puts("Hello, world");
+    return 0;
+}

meta-arm/recipes-test/pacbti/test-pacbti.bb

@@ -0,0 +1,21 @@
+SUMMARY = "Test to verify that PAC/BTI is enabled"
+LICENSE = "MIT"
+LIC_FILES_CHKSUM = "file://pacbti.c;beginline=2;endline=2;md5=6ec41034e04432ee375d0e14fba596f4"
+
+SRC_URI = "file://pacbti.c"
+
+S = "${WORKDIR}"
+
+do_compile() {
+    # Compile with -zforce-bti with fatal warnings, so the link fails if PAC/BTI
+    # is requested but gcc/glibc are built without it.
+    ${CC} ${CFLAGS} ${LDFLAGS} -z force-bti -Werror -Wl,--fatal-warnings ${S}/pacbti.c
+
+    # If we have a binary, check that the AArch64 feature list in the binary
+    # actually enables PAC/BTI.
+    ${READELF} --notes a.out | grep "AArch64 feature" >notes
+    grep BTI notes
+    grep PAC notes
+}
+
+COMPATIBLE_HOST = "aarch64.*-linux"