92 lines · plain
1; RUN: llc -mtriple aarch64 -mattr=+bti < %s | FileCheck %s2; RUN: llc -mtriple aarch64 -global-isel -mattr=+bti < %s | FileCheck %s3 4target datalayout = "e-m:e-i8:8:32-i16:16:32-i64:64-i128:128-n32:64-S128"5target triple = "aarch64"6 7; When BTI is enabled, all indirect tail-calls must use x16 or x17 (the intra8; procedure call scratch registers) to hold the address, as these instructions9; are allowed to target the "BTI c" instruction at the start of the target10; function. The alternative to this would be to start functions with "BTI jc",11; which increases the number of potential ways they could be called, and12; weakens the security protections.13 14define void @bti_disabled(ptr %p) {15entry:16 tail call void %p()17; CHECK: br x018 ret void19}20 21define void @bti_enabled(ptr %p) "branch-target-enforcement" {22entry:23 tail call void %p()24; CHECK: br {{x16|x17}}25 ret void26}27define void @bti_enabled_force_x10(ptr %p) "branch-target-enforcement" {28entry:29 %p_x10 = tail call ptr asm "", "={x10},{x10},~{lr}"(ptr %p)30 tail call void %p_x10()31; CHECK: br {{x16|x17}}32 ret void33}34 35; sign-return-address places no further restrictions on the tail-call register.36 37define void @bti_enabled_pac_enabled(ptr %p) "branch-target-enforcement" "sign-return-address"="all" {38entry:39 tail call void %p()40; CHECK: br {{x16|x17}}41 ret void42}43define void @bti_enabled_pac_enabled_force_x10(ptr %p) "branch-target-enforcement" "sign-return-address"="all" {44entry:45 %p_x10 = tail call ptr asm "", "={x10},{x10},~{lr}"(ptr %p)46 tail call void %p_x10()47; CHECK: br {{x16|x17}}48 ret void49}50 51; PAuthLR needs to use x16 to hold the address of the signing instruction. That52; can't be changed because the hint instruction only uses that register, so the53; only choice for the tail-call function pointer is x17.54 55define void @bti_enabled_pac_pc_enabled(ptr %p) "branch-target-enforcement" "sign-return-address"="all" "branch-protection-pauth-lr" {56entry:57 tail call void %p()58; CHECK: br x1759 ret void60}61define void @bti_enabled_pac_pc_enabled_force_x16(ptr %p) "branch-target-enforcement" "sign-return-address"="all" "branch-protection-pauth-lr" {62entry:63 %p_x16 = tail call ptr asm "", "={x16},{x16},~{lr}"(ptr %p)64 tail call void %p_x16()65; CHECK: br x1766 ret void67}68 69; PAuthLR by itself prevents x16 from being used, but any other70; non-callee-saved register can be used.71 72define void @pac_pc_enabled(ptr %p) "sign-return-address"="all" "branch-protection-pauth-lr" {73entry:74 tail call void %p()75; CHECK: br {{(x[0-9]|x1[0-578])$}}76 ret void77}78define void @pac_pc_enabled_force_x16(ptr %p) "sign-return-address"="all" "branch-protection-pauth-lr" {79entry:80 %p_x16 = tail call ptr asm "", "={x16},{x16},~{lr}"(ptr %p)81 tail call void %p_x16()82; CHECK: br {{(x[0-9]|x1[0-578])$}}83 ret void84}85define void @pac_pc_enabled_force_x17(ptr %p) "sign-return-address"="all" "branch-protection-pauth-lr" {86entry:87 %p_x17 = tail call ptr asm "", "={x17},{x17},~{lr}"(ptr %p)88 tail call void %p_x17()89; CHECK: br x1790 ret void91}92