From patchwork Thu Apr 28 09:38:54 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Andrea Corallo X-Patchwork-Id: 53296 Return-Path: X-Original-To: patchwork@sourceware.org Delivered-To: patchwork@sourceware.org Received: from server2.sourceware.org (localhost [IPv6:::1]) by sourceware.org (Postfix) with ESMTP id 8AA6E3857357 for ; Thu, 28 Apr 2022 09:40:13 +0000 (GMT) DKIM-Filter: OpenDKIM Filter v2.11.0 sourceware.org 8AA6E3857357 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gcc.gnu.org; s=default; t=1651138813; bh=Y+L2BLekhd7ZPVB8Ny1YnlDzkimooCC5bTNA974Tu/4=; h=To:Subject:References:Date:In-Reply-To:List-Id:List-Unsubscribe: List-Archive:List-Post:List-Help:List-Subscribe:From:Reply-To:Cc: From; b=oN4ipdY91n8sanZvVmiqBtjC0qoRWEI3396BpOGWEZl0G7VHjobk0demxKrzuD+OI QtWX/xaeRDIDXiwoeLhD+xurg5WOKDeTOlMAfg+c6CnyLIV8JslOPUB0Y3p5TlVnWk cy2z1LRmkynOB1sLBgszXxj3hi+Zuph26ymBcWbU= X-Original-To: gcc-patches@gcc.gnu.org Delivered-To: gcc-patches@gcc.gnu.org Received: from EUR04-DB3-obe.outbound.protection.outlook.com (mail-eopbgr60073.outbound.protection.outlook.com [40.107.6.73]) by sourceware.org (Postfix) with ESMTPS id D20FC3857C4A for ; Thu, 28 Apr 2022 09:39:07 +0000 (GMT) DMARC-Filter: OpenDMARC Filter v1.4.1 sourceware.org D20FC3857C4A ARC-Seal: i=2; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=pass; b=gRFGR7Tv9C/XMA5tw+WN4kaPBTJI+dacHrw+bUNIQxyhdIiLAjtW2cD+fI/WahfEzqzUjm51uNVytXBIdwwzBe6L5TBP0eyx5y+JtdPmpACO6kbc+aI152vZkMbcmHWwc6umJfoXZvudadJDF1o5LDJghryNH3kXsXzL+s05mE5cfZraewAEXXlbR43yGJyL+SuYJC7p9WqS8zGbSRt+uImPf2EDPYCEzZGkN/EYgwhaDQIHgqrSD7iOPLaeegmm2xn9vOIH8k93puB9YrBvmLu6C74iIN1FltX1c36Spv+EZE4L6UUkgca9aAIpcwYX9tm8dABliqN+9pwKjQEFkw== ARC-Message-Signature: i=2; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=Y+L2BLekhd7ZPVB8Ny1YnlDzkimooCC5bTNA974Tu/4=; b=A1dLGiRfMP7G8XrcBbzIy6pywBzu9yl4fy1/Lw0+4TqHxZkbNzpTahe0zLV5WZePtPdF0OxegfCWXm5vF9dQITPsqlPhNWrhxCGjMC5lyN8zcqxD3bfoPMFyKrEPgSoizuuZESgDkaK9CtfrMyv03MlYjoSO6XpNmtoZYNpjc4wyRDT7EAZfQoj4d5TkxcHAA0LVRxUv3bOmdFOXZKAGmC8Fb5WXLIvr9P+lFm1invvSL+9+t+mlazGmYUIhGSzXpbR1szUkexqnkGKjovDE7oZ+YsqwV32l8umKiJe/QjNKX000JFLAg44vsjom5jCnyPcEG8v+/myLfxd/RS2rZg== ARC-Authentication-Results: i=2; mx.microsoft.com 1; spf=pass (sender ip is 63.35.35.123) smtp.rcpttodomain=gcc.gnu.org smtp.mailfrom=arm.com; dmarc=pass (p=none sp=none pct=100) action=none header.from=arm.com; dkim=pass (signature was verified) header.d=armh.onmicrosoft.com; arc=pass (0 oda=1 ltdi=1 spf=[1,1,smtp.mailfrom=arm.com] dmarc=[1,1,header.from=arm.com]) Received: from AM6P195CA0103.EURP195.PROD.OUTLOOK.COM (2603:10a6:209:86::44) by AM5PR0801MB1731.eurprd08.prod.outlook.com (2603:10a6:203:3c::11) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.5206.13; Thu, 28 Apr 2022 09:39:05 +0000 Received: from VE1EUR03FT039.eop-EUR03.prod.protection.outlook.com (2603:10a6:209:86:cafe::47) by AM6P195CA0103.outlook.office365.com (2603:10a6:209:86::44) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.5186.14 via Frontend Transport; Thu, 28 Apr 2022 09:39:05 +0000 X-MS-Exchange-Authentication-Results: spf=pass (sender IP is 63.35.35.123) smtp.mailfrom=arm.com; dkim=pass (signature was verified) header.d=armh.onmicrosoft.com;dmarc=pass action=none header.from=arm.com; Received-SPF: Pass (protection.outlook.com: domain of arm.com designates 63.35.35.123 as permitted sender) receiver=protection.outlook.com; client-ip=63.35.35.123; helo=64aa7808-outbound-1.mta.getcheckrecipient.com; Received: from 64aa7808-outbound-1.mta.getcheckrecipient.com (63.35.35.123) by VE1EUR03FT039.mail.protection.outlook.com (10.152.19.196) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.5206.12 via Frontend Transport; Thu, 28 Apr 2022 09:39:05 +0000 Received: ("Tessian outbound 2d401af10eb3:v118"); Thu, 28 Apr 2022 09:39:05 +0000 X-CheckRecipientChecked: true X-CR-MTA-CID: 7be425605f502d54 X-CR-MTA-TID: 64aa7808 Received: from f97cbd4e7d71.1 by 64aa7808-outbound-1.mta.getcheckrecipient.com id 3906CF07-5BA6-46AE-9FEC-2139B699C510.1; Thu, 28 Apr 2022 09:38:58 +0000 Received: from EUR02-HE1-obe.outbound.protection.outlook.com by 64aa7808-outbound-1.mta.getcheckrecipient.com with ESMTPS id f97cbd4e7d71.1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384); Thu, 28 Apr 2022 09:38:58 +0000 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=jvHZqVWTHGY3PbZDmfsdgkdG5FeVrm9v754G9Xj1S9yN6qAfbqeSMwmkBwVjUi6IdWWC8m/xXRLg251d0LEBuOLLQcNkv2rizj7fIw+ZmbmNWBxurKCwUxNZ2jcvFslbAFgbSlcwrvdt431XGCFtwhU8s73mVVYxrKAQ3UiFj8gCEU9xNcGcujayGEL9I92UR48fxw60N7xMeaQrjR5kRvbUMHyvdtYSSCL6sL0nZSDAis39PXqEJ9tN1ojEVZ3Iwoe02TMaWzUwctDdLmlh2UuWkx52ITVGQBCbEUBeVLcoOkQWYmdp/yyvZYRjc68KoZqxsGnzf2HW5MI4Mc+4QA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=Y+L2BLekhd7ZPVB8Ny1YnlDzkimooCC5bTNA974Tu/4=; b=lhrlvxB0GkDsyeV3uhIgtK05/kqZAGM7UIure56khnq2S8y5k/89+rYDs9HIJzJ4czFeolsGvOI6ZbNfS8AEk9dRM6Ofi6RlyaPbNpSGoH2DvotrRYE/37ilEpYX2OiTVzYF9W/+S9tchElO4/Ipben6V1W4TASd2QRUVvd5py5NGJjcefATmWZgJGbEqhbAtxzCo38leBnsppeKB7rh7lfLwgm492w8bwxs7v0y9LOkL6HGn0ABaVd3bktj7h8y1a5ScrEVjtcDcWaZZI6OJsu2nVZeZinYHeHs7w+Do83uWIpuP9Em6zdBiMqPVHE33LYkW7Imo/Y5yOiH2gJn8A== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass (sender ip is 40.67.248.234) smtp.rcpttodomain=gcc.gnu.org smtp.mailfrom=arm.com; dmarc=pass (p=none sp=none pct=100) action=none header.from=arm.com; dkim=none (message not signed); arc=none Received: from DU2PR04CA0334.eurprd04.prod.outlook.com (2603:10a6:10:2b4::24) by HE1PR0802MB2395.eurprd08.prod.outlook.com (2603:10a6:3:db::9) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.5186.18; Thu, 28 Apr 2022 09:38:56 +0000 Received: from DB5EUR03FT049.eop-EUR03.prod.protection.outlook.com (2603:10a6:10:2b4:cafe::a7) by DU2PR04CA0334.outlook.office365.com (2603:10a6:10:2b4::24) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.5206.14 via Frontend Transport; Thu, 28 Apr 2022 09:38:56 +0000 X-MS-Exchange-Authentication-Results: spf=pass (sender IP is 40.67.248.234) smtp.mailfrom=arm.com; dkim=none (message not signed) header.d=none;dmarc=pass action=none header.from=arm.com; Received-SPF: Pass (protection.outlook.com: domain of arm.com designates 40.67.248.234 as permitted sender) receiver=protection.outlook.com; client-ip=40.67.248.234; helo=nebula.arm.com; Received: from nebula.arm.com (40.67.248.234) by DB5EUR03FT049.mail.protection.outlook.com (10.152.20.191) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.20.5206.12 via Frontend Transport; Thu, 28 Apr 2022 09:38:56 +0000 Received: from AZ-NEU-EX01.Emea.Arm.com (10.251.26.4) by AZ-NEU-EX04.Arm.com (10.251.24.32) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256) id 15.1.2308.27; Thu, 28 Apr 2022 09:38:58 +0000 Received: from AZ-NEU-EX04.Arm.com (10.251.24.32) by AZ-NEU-EX01.Emea.Arm.com (10.251.26.4) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.2308.27; Thu, 28 Apr 2022 09:38:55 +0000 Received: from e124257 (10.34.101.64) by mail.arm.com (10.251.24.32) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2308.27 via Frontend Transport; Thu, 28 Apr 2022 09:38:57 +0000 To: Andrea Corallo via Gcc-patches Subject: [PATCH 3/12] arm: Add option -mbranch-protection References: Date: Thu, 28 Apr 2022 11:38:54 +0200 In-Reply-To: (Andrea Corallo via Gcc-patches's message of "Thu, 28 Apr 2022 10:39:31 +0200") Message-ID: User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/29.0.50 (gnu/linux) MIME-Version: 1.0 X-EOPAttributedMessage: 1 X-MS-Office365-Filtering-Correlation-Id: 2455f89b-7187-4c3d-9305-08da28faef94 X-MS-TrafficTypeDiagnostic: HE1PR0802MB2395:EE_|VE1EUR03FT039:EE_|AM5PR0801MB1731:EE_ X-Microsoft-Antispam-PRVS: x-checkrecipientrouted: true NoDisclaimer: true X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam-Untrusted: BCL:0; X-Microsoft-Antispam-Message-Info-Original: tXfFv1HG2aLWATux9oStKoGbDgmMt9gi44l5haQ1DY/xbAQ4Pw4oo32vndBrqIeR7LMO1K2qcA2oTj/kRXtH7YCNPLnuXE4B9ZZamk9ESf8lUmwpO9Uo+flDbj14P/S1+XCnadb/D4OFgaSUUcv3CwzTprzEVVgwdhVc3yZdG8U+vT2Ub5Xgwith/ifuVmCrES45ZmxYfjq8FcTWgavzBzu6ifVpSycZ9gtyaDW9EPO8hzQTCoTi7gcmYy3WtCCzHIZd8/4x0b8Q4WzYjG4pVZof06HK6lweVhIGf5YtsFXFfqukRPRO6Pna3if3q/5FcJDl40R/7KN2pbEQdbHlhujAA5sX6JKlVfo5crgprFstUWrV0GVbU+4j4LXRmFwDiX3VaZ6iBNoWt6kDEqWD4WsAO6Xj50Wr6QmQXZAMamMv6JJ1nRyCUhgmFBRV6Uc0YxSEep6O1tuHkrpvnNNvQm46A31i7Mcfemp+DyrCXGr0tWuKRXg8pTGb33ddJYl7o0Ub4QQEDiqqQQ/s8cgNDTQ4taqudWjqEo/OCHtG8Ne/Wp5r/c2k0p0/Qwy3O9dxXbI2y0tf8cn5ALFRljcl1LiWnl73L5bq88eoLZxjjRZnoy9uM5L0VGIIEbI9+F98lNyjKapkXha0o4bFT4ZKL5aUyaFQP0fCqFPfukE1EMakCIDAedtYjzZBG7VV61v7pbt4TWRQtbhb31cUJKiHwA== X-Forefront-Antispam-Report-Untrusted: CIP:40.67.248.234; CTRY:IE; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:nebula.arm.com; PTR:InfoDomainNonexistent; CAT:NONE; SFS:(13230001)(4636009)(46966006)(40470700004)(36840700001)(70586007)(70206006)(8676002)(6916009)(54906003)(2616005)(33964004)(4326008)(81166007)(6666004)(316002)(82310400005)(36860700001)(40460700003)(356005)(36756003)(186003)(47076005)(336012)(426003)(508600001)(86362001)(83380400001)(2906002)(44832011)(8936002)(235185007)(5660300002)(26005)(36900700001); DIR:OUT; SFP:1101; X-MS-Exchange-Transport-CrossTenantHeadersStamped: HE1PR0802MB2395 X-MS-Exchange-Transport-CrossTenantHeadersStripped: VE1EUR03FT039.eop-EUR03.prod.protection.outlook.com X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id-Prvs: 68e04169-d545-40de-c35b-08da28faea67 X-Microsoft-Antispam: BCL:0; X-Microsoft-Antispam-Message-Info: /qEiaAByhj2ufxZHMtaBjTJ9NtxMUhPLBem6KPCbVQcAGe17XGKZ8pOwYRN3jkoz77bD+HoCI0292Vjl8lsy8pG/4zHPDx1fdpHedIM1NtGtzfvmi6/VHDMY1W4NMtOQF7DfgV5l7U0BKsQmrTsq865EJ/PB1nk5FJzTkWA44Z4XlIbgwOz+fLQFR/9WzRMNre+ZkxXzlkIKuDjtUtSnWe6OeiKmqqNNeRqgfOmQMKRKXwj7rXrnx5mGHq6tma73+YNjC5f7iKN9iqvQQqjtfu4Ou/JO+ZrQ+XNfKHnmYhhDuI2T5VczmAYWZy82JL52yeS2oY5KyMbLUUQ6cVXSIpsW40ov7sEvuV4uuOHh1p51mnq4OuqTsy7q8176cLYfY9A+igq3bWnG7lc7vp7+6TX6i9s3kBESRTeJWd/juQwtb1+vOjG3n1DKRzCuIVOexSPrqjxT3BoJfw4qoTNdGRQFyYLJHQi6OOsXREKuc1Gzvk90oetfJEyaZqSZ3J/a/Hk0in91TMY4Al4g5N+lIB/lctEg5Amc9OD+XvelupcZHpNu9cqj3wo3MfxfgTkQ9mcVhHUlU/PWkYjjiNU+V4Ny8l56mMI4/dZAV30DgGaNjgrBX0pHCI1XCJPD+L9a0pCFufMKVbWK9SMdXoNf6Mftmpd+i//YzMmZCgfToH/EDHKmLOx+P6EcnyuJUr5q X-Forefront-Antispam-Report: CIP:63.35.35.123; CTRY:IE; LANG:en; SCL:1; SRV:; IPV:CAL; SFV:NSPM; H:64aa7808-outbound-1.mta.getcheckrecipient.com; PTR:ec2-63-35-35-123.eu-west-1.compute.amazonaws.com; CAT:NONE; SFS:(13230001)(4636009)(36840700001)(40470700004)(46966006)(40460700003)(508600001)(82310400005)(426003)(2616005)(86362001)(336012)(47076005)(26005)(33964004)(81166007)(6666004)(186003)(316002)(36860700001)(70206006)(2906002)(44832011)(36756003)(5660300002)(235185007)(70586007)(8936002)(54906003)(83380400001)(4326008)(6916009)(8676002); DIR:OUT; SFP:1101; X-OriginatorOrg: arm.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 28 Apr 2022 09:39:05.1523 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: 2455f89b-7187-4c3d-9305-08da28faef94 X-MS-Exchange-CrossTenant-Id: f34e5979-57d9-4aaa-ad4d-b122a662184d X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=f34e5979-57d9-4aaa-ad4d-b122a662184d; Ip=[63.35.35.123]; Helo=[64aa7808-outbound-1.mta.getcheckrecipient.com] X-MS-Exchange-CrossTenant-AuthSource: VE1EUR03FT039.eop-EUR03.prod.protection.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Anonymous X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: AM5PR0801MB1731 X-Spam-Status: No, score=-12.7 required=5.0 tests=BAYES_00, DKIM_SIGNED, DKIM_VALID, GIT_PATCH_0, RCVD_IN_DNSWL_NONE, RCVD_IN_MSPIKE_H2, SPF_HELO_PASS, SPF_PASS, TXREP, UNPARSEABLE_RELAY autolearn=ham autolearn_force=no version=3.4.4 X-Spam-Checker-Version: SpamAssassin 3.4.4 (2020-01-24) on server2.sourceware.org X-BeenThere: gcc-patches@gcc.gnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Gcc-patches mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-Patchwork-Original-From: Andrea Corallo via Gcc-patches From: Andrea Corallo Reply-To: Andrea Corallo Cc: Richard Earnshaw , nd Errors-To: gcc-patches-bounces+patchwork=sourceware.org@gcc.gnu.org Sender: "Gcc-patches" [PATCH 3/12] arm: Add option -mbranch-protection Add -mbranch-protection option. This option enables the code-generation of pointer signing and authentication instructions in function prologues and epilogues. gcc/ChangeLog: * config/arm/arm.c (arm_configure_build_target): Parse and validate -mbranch-protection option and initialize appropriate data structures. * config/arm/arm.opt (-mbranch-protection): New option. * doc/invoke.texi (Arm Options): Document it. Co-Authored-By: Tejas Belagod Co-Authored-By: Richard Earnshaw diff --git a/gcc/config/arm/arm.cc b/gcc/config/arm/arm.cc index 60f3eae82a4..0068817b0f2 100644 --- a/gcc/config/arm/arm.cc +++ b/gcc/config/arm/arm.cc @@ -3263,6 +3263,17 @@ arm_configure_build_target (struct arm_build_target *target, tune_opts = strchr (opts->x_arm_tune_string, '+'); } + if (opts->x_arm_branch_protection_string) + { + aarch_validate_mbranch_protection (opts->x_arm_branch_protection_string); + + if (aarch_ra_sign_key != AARCH_KEY_A) + { + warning (0, "invalid key type for %<-mbranch-protection=%>"); + aarch_ra_sign_key = AARCH_KEY_A; + } + } + if (arm_selected_arch) { arm_initialize_isa (target->isa, arm_selected_arch->common.isa_bits); diff --git a/gcc/config/arm/arm.opt b/gcc/config/arm/arm.opt index f54ec8356c3..d292e23ea11 100644 --- a/gcc/config/arm/arm.opt +++ b/gcc/config/arm/arm.opt @@ -323,6 +323,10 @@ mbranch-cost= Target RejectNegative Joined UInteger Var(arm_branch_cost) Init(-1) Cost to assume for a branch insn. +mbranch-protection= +Target RejectNegative Joined Var(arm_branch_protection_string) Save +Use branch-protection features. + mgeneral-regs-only Target RejectNegative Mask(GENERAL_REGS_ONLY) Save Generate code which uses the core registers only (r0-r14). diff --git a/gcc/doc/invoke.texi b/gcc/doc/invoke.texi index 079e34ed98c..f6f724af26e 100644 --- a/gcc/doc/invoke.texi +++ b/gcc/doc/invoke.texi @@ -825,7 +825,9 @@ Objective-C and Objective-C++ Dialects}. -mcmse @gol -mfix-cmse-cve-2021-35465 @gol -mstack-protector-guard=@var{guard} -mstack-protector-guard-offset=@var{offset} @gol --mfdpic} +-mfdpic @gol +-mbranch-protection=@var{none}|@var{standard}|@var{pac-ret}[+@var{leaf}] +[+@var{bti}]|@var{bti}[+@var{pac-ret}[+@var{leaf}]]} @emph{AVR Options} @gccoptlist{-mmcu=@var{mcu} -mabsdata -maccumulate-args @gol @@ -21521,6 +21523,37 @@ The opposite @option{-mno-fdpic} option is useful (and required) to build the Linux kernel using the same (@code{arm-*-uclinuxfdpiceabi}) toolchain as the one used to build the userland programs. +@item +-mbranch-protection=@var{none}|@var{standard}|@var{pac-ret}[+@var{leaf}][+@var{bti}]|@var{bti}[+@var{pac-ret}[+@var{leaf}]] +@opindex mbranch-protection +Enable branch protection features (armv8.1-m.main only). +@samp{none} generate code without branch protection or return address +signing. +@samp{standard[+@var{leaf}]} generate code with all branch protection +features enabled at their standard level. +@samp{pac-ret[+@var{leaf}]} generate code with return address signing +set to its standard level, which is to sign all functions that save +the return address to memory. +@samp{leaf} When return address signing is enabled, also sign leaf +functions even if they do not write the return address to memory. ++@samp{bti} Add landing-pad instructions at the permitted targets of +indirect branch instructions. + +If the @samp{+pacbti} architecture extension is not enabled, then all +branch protection and return address signing operations are +constrained to use only the instructions defined in the +architectural-NOP space. The generated code will remain +backwards-compatible with earlier versions of the architecture, but +the additional security can be enabled at run time on processors that +support the @samp{PACBTI} extension. + +Branch target enforcement using BTI can only be enabled at runtime if +all code in the application has been compiled with at least +@samp{-mbranch-protection=bti}. + +The default is to generate code without branch protection or return +address signing. + @end table @node AVR Options