BLRAA, BLRAAZ, BLRAB, BLRABZ

Branch with link to register, with pointer authentication

This instruction authenticates the address in the general-purpose register that is specified by <Xn>, using a modifier and the specified key, and calls a subroutine at the authenticated address, setting register X30 to PC+4.

The modifier is:

  • In the general-purpose register or stack pointer that is specified by <Xm|SP>, for BLRAA and BLRAB.
  • The value zero, for BLRAAZ and BLRABZ.

    • Key A is used for BLRAA and BLRAAZ. Key B is used for BLRAB and BLRABZ.

    If the authentication passes, the PE continues execution at the target of the branch. For information on behavior if the authentication fails, see Faulting on pointer authentication.

    The authenticated address is not written back to the general-purpose register.

    Encoding: Integer

    Variants: FEAT_PAuth (ARMv8.3)

    313029282726252423222120191817161514131211109876543210
    11010110011111100001
    Zopop2AMRnRm

    Key A, register modifier (Z == 1 && M == 0)

    BLRAA <Xn>, <Xm|SP>

    Key A, zero modifier (Z == 0 && M == 0 && Rm == 11111)

    BLRAAZ <Xn>

    Key B, register modifier (Z == 1 && M == 1)

    BLRAB <Xn>, <Xm|SP>

    Key B, zero modifier (Z == 0 && M == 1 && Rm == 11111)

    BLRABZ <Xn>

    Decoding algorithm

    if !IsFeatureImplemented(FEAT_PAuth) then EndOfDecode(Decode_UNDEF);
if Z == '0' && Rm != '11111' then EndOfDecode(Decode_UNDEF);

constant integer n = UInt(Rn);
constant integer m = UInt(Rm);
constant boolean use_key_a = (M == '0');
constant boolean source_is_sp = ((Z == '1') && (m == 31));
constant boolean auth_then_branch = TRUE;

    Operation

    bits(64) target = X[n, 64];
constant bits(64) modifier = if source_is_sp then SP[64] else X[m, 64];

if use_key_a then
    target = AuthIA(target, modifier, auth_then_branch);
else
    target = AuthIB(target, modifier, auth_then_branch);
if IsFeatureImplemented(FEAT_GCS) && GCSPCREnabled(PSTATE.EL) then
    AddGCSRecord(PC64 + 4);

// Value in BTypeNext will be used to set PSTATE.BTYPE
BTypeNext = '10';

X[30, 64] = PC64 + 4;

constant boolean branch_conditional = FALSE;
BranchTo(target, BranchType_INDCALL, branch_conditional);

    Explanations

    <Xn>: Is the 64-bit name of the general-purpose register holding the address to be branched to, encoded in the "Rn" field.
    <Xm|SP>: Is the 64-bit name of the general-purpose source register or stack pointer holding the modifier, encoded in the "Rm" field.