When enabled, indirect calls and jumps must set X7 to a label value that matches the label in a so-called landing pad at the call target. This check does not apply if the indirect call is made through X1/RA, X5/RA2 or X7/T2, with the expectation that the compiler will limit use of these registers for logically direct calls like an AUPIC+JALR pair, or for software guarded branches like a bounds-checked jump table. We use FAR_TMP for logically direct jumps that exceed J-type range, and blocking it from register allocation limits the availablity of gadgets that set X7.
Compare x64's IBT and arm64's BTI.
TEST=ci
Change-Id: Ic00195eb3c04cc10379f9965e05ef84052e02933
Reviewed-on: https://dart-review.googlesource.com/c/sdk/+/494861
Reviewed-by: Alexander Markov <alexmarkov@google.com>
Commit-Queue: Ryan Macnak <rmacnak@google.com>
Ryan Macnak
af43c1a3d4