Page MenuHomeFreeBSD

arm64: Add BTI landing pads to assembly functions

Authored by andrew on Oct 4 2023, 3:23 PM.
Referenced Files
Unknown Object (File)
Sun, Apr 21, 3:29 AM
Unknown Object (File)
Mon, Apr 8, 11:10 AM
Unknown Object (File)
Wed, Mar 27, 10:36 AM
Unknown Object (File)
Feb 9 2024, 4:20 PM
Unknown Object (File)
Jan 5 2024, 10:32 PM
Unknown Object (File)
Dec 25 2023, 5:20 PM
Unknown Object (File)
Dec 19 2023, 10:06 PM
Unknown Object (File)
Dec 10 2023, 11:56 PM



When we enable BTI iboth the first instruction in a function that could
be called indirectly, and a branch within a function need a valid
landing pad instruction.

There are three options for these instructions:

  1. A breakpoint instruction
  2. A pointer authentication PACIASP/PACIBSP
  3. A BTI instruction

Option 1 will raise a breakpoint exception so isn't useable in either
cases. Option 2 could be used in some function entry cases, but needs
to be paired with an authentication instruction, and is normally only
used in non-leaf functions we can't use it in this case. This leaves
option 3.

There are four variants of the instruction, the C variant is used on
function entry and the J variant is for jumping within a function.
There is also a JC that works with both and one with no target that
works with neither.

Sponsored by: Arm Ltd
Sponsored by: The FreeBSD Foundation (earlier version)

Diff Detail

rG FreeBSD src repository
Lint Not Applicable
Tests Not Applicable

Event Timeline

andrew requested review of this revision.Oct 4 2023, 3:23 PM

Does the need for BTI_J apply only to unconditional branches?


Could you please add a comment explaining how and when to use these macros?


It is used as a target for a BR/BRA* instruction to reduce where the instruction can branch to in the case the register value is corrupted.

Add a comment on usage of BRI_C/BTI_J

markj added inline comments.
This revision is now accepted and ready to land.Oct 9 2023, 2:33 PM