bti

Branch Target Identification

BTI {<target>}

Mark a valid target for an indirect branch (Control Flow Integrity).

Pseudocode Operation

if current_branch_type is not compatible with target then
  raise PACM_exception
else
  NOP

Example

BTI

Encoding

Binary Layout

11010101000000110010

31:12

0100

11:8

op2

7:5

11111

4:0

Format System

Opcode 0xD503241F

Extension BTI (Security)

Operands

target
Type (c, j, jc)

Other forms of bti

bti Branch Target Identification, System Hint

Reference

View in Arm A64 ISA Reference ↗ Arm A64 ISA

Instruction Forms

Encoding	Instruction		ISA		Bit pattern
0xD503241F	BTI {<targets>}		A64		11010101000000110010 \| 0100 \| op2 \| 11111

Description

Branch Target Identification. A BTI instruction is used to guard against the execution of instructions that are not the intended target of a branch. Outside of a guarded memory region, a BTI instruction executes as a NOP. Within a guarded memory region, while PSTATE.BTYPE != 0b00, a BTI instruction compatible with the current value of PSTATE.BTYPE will not generate a Branch Target Exception and will allow execution of subsequent instructions within the memory region. For more information, see PSTATE.BTYPE. The operand <targets> passed to a BTI instruction determines the values of PSTATE.BTYPE that the BTI instruction is compatible with.

Operation

case op of
    when SystemHintOp_YIELD
        Hint_Yield();

    when SystemHintOp_DGH
        Hint_DGH();

    when SystemHintOp_WFE
        integer localtimeout = 1 << 64;    // No local timeout event is generated
        Hint_WFE(localtimeout, WFxType_WFE);

    when SystemHintOp_WFI
        integer localtimeout = 1 << 64;    // No local timeout event is generated
        Hint_WFI(localtimeout, WFxType_WFI);

    when SystemHintOp_SEV
        SendEvent();

    when SystemHintOp_SEVL
        SendEventLocal();

    when SystemHintOp_ESB
        if IsFeatureImplemented(FEAT_TME) && TSTATE.depth > 0 then
            FailTransaction(TMFailure_ERR, FALSE);
        SynchronizeErrors();
        AArch64.ESBOperation();
        if PSTATE.EL IN {EL0, EL1} && EL2Enabled() then AArch64.vESBOperation();
        TakeUnmaskedSErrorInterrupts();

    when SystemHintOp_PSB
        ProfilingSynchronizationBarrier();

    when SystemHintOp_TSB
        TraceSynchronizationBarrier();

    when SystemHintOp_GCSB
        GCSSynchronizationBarrier();

    when SystemHintOp_CHKFEAT
        X[16, 64] = AArch64.ChkFeat(X[16, 64]);

    when SystemHintOp_CSDB
        ConsumptionOfSpeculativeDataBarrier();

    when SystemHintOp_CLRBHB
        Hint_CLRBHB();

    when SystemHintOp_BTI
        SetBTypeNext('00');

    when SystemHintOp_NOP
        return;    // do nothing

    otherwise
        Unreachable();

bti