Fix BTI support for PACIXSP

All BTI types, including the authenticating variety, should accept a BTYPE of
zero. Fix the simulator and add a test for falling into a BTI with BTYPE zero.

Change-Id: I14931fa9ba561cd03969e96701742b173927bca6

2 files changed, 28 insertions, 3 deletions

diff --git a/src/aarch64/simulator-aarch64.cc b/src/aarch64/simulator-aarch64.cc
index dcf2ef86..80a99c74 100644
--- a/src/aarch64/simulator-aarch64.cc
+++ b/src/aarch64/simulator-aarch64.cc
@@ -3862,13 +3862,11 @@ void Simulator::VisitSystem(const Instruction* instr) {
       Instr i = instr->Mask(SystemPAuthMask);
       if ((i == PACIASP) || (i == PACIBSP)) {
         switch (ReadBType()) {
-          case DefaultBType:
-            VIXL_ABORT_WITH_MSG("Executing PACIXSP with wrong BType.");
-            break;
           case BranchFromGuardedNotToIP:
           // TODO: This case depends on the value of SCTLR_EL1.BT0, which we
           // assume here to be zero. This allows execution of PACI[AB]SP when
           // BTYPE is BranchFromGuardedNotToIP (0b11).
+          case DefaultBType:
           case BranchFromUnguardedOrToIP:
           case BranchAndLink:
             break;
diff --git a/test/aarch64/test-assembler-aarch64.cc b/test/aarch64/test-assembler-aarch64.cc
index 49429e78..39802fd8 100644
--- a/test/aarch64/test-assembler-aarch64.cc
+++ b/test/aarch64/test-assembler-aarch64.cc
@@ -15700,6 +15700,33 @@ TEST(bti_call_to_j) {
 }
 #endif  // VIXL_NEGATIVE_TESTING
 
+TEST(fall_through_bti) {
+  SETUP_WITH_FEATURES(CPUFeatures::kBTI, CPUFeatures::kPAuth);
+
+  START();
+  Label target, target_j, target_c, target_jc;
+  __ Mov(x0, 0);  // 'Normal' instruction sets BTYPE to zero.
+  __ Bind(&target, EmitBTI);
+  __ Add(x0, x0, 1);
+  __ Bind(&target_j, EmitBTI_j);
+  __ Add(x0, x0, 1);
+  __ Bind(&target_c, EmitBTI_c);
+  __ Add(x0, x0, 1);
+  __ Bind(&target_jc, EmitBTI_jc);
+  __ Add(x0, x0, 1);
+  __ Paciasp();
+  END();
+
+#ifdef VIXL_INCLUDE_SIMULATOR_AARCH64
+  simulator.SetGuardedPages(true);
+#endif  // VIXL_INCLUDE_SIMULATOR_AARCH64
+  RUN();
+
+  ASSERT_EQUAL_64(4, x0);
+
+  TEARDOWN();
+}
+
 TEST(zero_dest) {
   // RegisterDump::Dump uses NEON.
   SETUP_WITH_FEATURES(CPUFeatures::kNEON);