mirror of
https://github.com/RPCS3/llvm-mirror.git
synced 2024-10-19 11:02:59 +02:00
886a23647c
When branch target identification is enabled, all indirectly-callable functions start with a BTI C instruction. this instruction can only be the target of certain indirect branches (direct branches and fall-through are not affected): - A BLR instruction, in either a protected or unprotected page. - A BR instruction in a protected page, using x16 or x17. - A BR instruction in an unprotected page, using any register. Without BTI, we can use any non call-preserved register to hold the address for an indirect tail call. However, when BTI is enabled, then the code being compiled might be loaded into a BTI-protected page, where only x16 and x17 can be used for indirect tail calls. Legacy code withiout this restriction can still indirectly tail-call BTI-protected functions, because they will be loaded into an unprotected page, so any register is allowed. Differential revision: https://reviews.llvm.org/D52868 llvm-svn: 343968
26 lines
841 B
LLVM
26 lines
841 B
LLVM
; RUN: llc -mtriple aarch64--none-eabi -mattr=+bti < %s | FileCheck %s
|
|
|
|
target datalayout = "e-m:e-i8:8:32-i16:16:32-i64:64-i128:128-n32:64-S128"
|
|
target triple = "aarch64-arm-none-eabi"
|
|
|
|
; When BTI is enabled, all indirect tail-calls must use x16 or x17 (the intra
|
|
; procedure call scratch registers) to hold the address, as these instructions
|
|
; are allowed to target the "BTI c" instruction at the start of the target
|
|
; function. The alternative to this would be to start functions with "BTI jc",
|
|
; which increases the number of potential ways they could be called, and
|
|
; weakens the security protections.
|
|
|
|
define void @bti_disabled(void ()* %p) {
|
|
entry:
|
|
tail call void %p()
|
|
; CHECK: br x0
|
|
ret void
|
|
}
|
|
|
|
define void @bti_enabled(void ()* %p) "branch-target-enforcement" {
|
|
entry:
|
|
tail call void %p()
|
|
; CHECK: br {{x16|x17}}
|
|
ret void
|
|
}
|