1; RUN: llc -mtriple aarch64 -mattr=+bti < %s | FileCheck %s 2; RUN: llc -mtriple aarch64 -global-isel -mattr=+bti < %s | FileCheck %s 3 4target datalayout = "e-m:e-i8:8:32-i16:16:32-i64:64-i128:128-n32:64-S128" 5target triple = "aarch64" 6 7; When BTI is enabled, all indirect tail-calls must use x16 or x17 (the intra 8; procedure call scratch registers) to hold the address, as these instructions 9; are allowed to target the "BTI c" instruction at the start of the target 10; function. The alternative to this would be to start functions with "BTI jc", 11; which increases the number of potential ways they could be called, and 12; weakens the security protections. 13 14define void @bti_disabled(ptr %p) { 15entry: 16 tail call void %p() 17; CHECK: br x0 18 ret void 19} 20 21define void @bti_enabled(ptr %p) "branch-target-enforcement" { 22entry: 23 tail call void %p() 24; CHECK: br {{x16|x17}} 25 ret void 26} 27define void @bti_enabled_force_x10(ptr %p) "branch-target-enforcement" { 28entry: 29 %p_x10 = tail call ptr asm "", "={x10},{x10},~{lr}"(ptr %p) 30 tail call void %p_x10() 31; CHECK: br {{x16|x17}} 32 ret void 33} 34 35; sign-return-address places no further restrictions on the tail-call register. 36 37define void @bti_enabled_pac_enabled(ptr %p) "branch-target-enforcement" "sign-return-address"="all" { 38entry: 39 tail call void %p() 40; CHECK: br {{x16|x17}} 41 ret void 42} 43define void @bti_enabled_pac_enabled_force_x10(ptr %p) "branch-target-enforcement" "sign-return-address"="all" { 44entry: 45 %p_x10 = tail call ptr asm "", "={x10},{x10},~{lr}"(ptr %p) 46 tail call void %p_x10() 47; CHECK: br {{x16|x17}} 48 ret void 49} 50 51; PAuthLR needs to use x16 to hold the address of the signing instruction. That 52; can't be changed because the hint instruction only uses that register, so the 53; only choice for the tail-call function pointer is x17. 54 55define void @bti_enabled_pac_pc_enabled(ptr %p) "branch-target-enforcement" "sign-return-address"="all" "branch-protection-pauth-lr" { 56entry: 57 tail call void %p() 58; CHECK: br x17 59 ret void 60} 61define void @bti_enabled_pac_pc_enabled_force_x16(ptr %p) "branch-target-enforcement" "sign-return-address"="all" "branch-protection-pauth-lr" { 62entry: 63 %p_x16 = tail call ptr asm "", "={x16},{x16},~{lr}"(ptr %p) 64 tail call void %p_x16() 65; CHECK: br x17 66 ret void 67} 68 69; PAuthLR by itself prevents x16 from being used, but any other 70; non-callee-saved register can be used. 71 72define void @pac_pc_enabled(ptr %p) "sign-return-address"="all" "branch-protection-pauth-lr" { 73entry: 74 tail call void %p() 75; CHECK: br {{(x[0-9]|x1[0-578])$}} 76 ret void 77} 78define void @pac_pc_enabled_force_x16(ptr %p) "sign-return-address"="all" "branch-protection-pauth-lr" { 79entry: 80 %p_x16 = tail call ptr asm "", "={x16},{x16},~{lr}"(ptr %p) 81 tail call void %p_x16() 82; CHECK: br {{(x[0-9]|x1[0-578])$}} 83 ret void 84} 85define void @pac_pc_enabled_force_x17(ptr %p) "sign-return-address"="all" "branch-protection-pauth-lr" { 86entry: 87 %p_x17 = tail call ptr asm "", "={x17},{x17},~{lr}"(ptr %p) 88 tail call void %p_x17() 89; CHECK: br x17 90 ret void 91} 92