https://gcc.gnu.org/bugzilla/show_bug.cgi?id=94697

            Bug ID: 94697
           Summary: aarch64: bti j at function start instead of bti c
           Product: gcc
           Version: 10.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: target
          Assignee: unassigned at gcc dot gnu.org
          Reporter: nsz at gcc dot gnu.org
  Target Milestone: ---

function that may be indirectly called does not start with bti c:

void bar(int *);
void *addr;
int foo(int x)
{
label:
  addr=&&label;
  bar(&x);
  return x;
} 

with -O2 -mbranch-protection=bti+pac-ret

foo:
.L2:
        hint    36 // bti j
        hint    25 // paciasp
        adrp    x1, .L2
        stp     x29, x30, [sp, -32]!
        add     x1, x1, :lo12:.L2
        adrp    x2, .LANCHOR0
        mov     x29, sp
        str     x1, [x2, #:lo12:.LANCHOR0]
        str     w0, [sp, 28]
        add     x0, sp, 28
        bl      bar
        ldr     w0, [sp, 28]
        ldp     x29, x30, [sp], 32
        hint    29 // autiasp
        ret

        .set    .LANCHOR0,. + 0
addr:
        .zero   8

happens if function starts with a label that may be indirect
jump target so a bti j is inserted, but there is a paciasp
at the beginning which would normally act as implicit bti c
when it's the first instruction.

Reply via email to