1; RUN: llc -mtriple aarch64--none-eabi -mattr=+bti < %s | FileCheck %s 2; RUN: llc -mtriple aarch64--none-eabi -global-isel -global-isel-abort=2 -pass-remarks-missed=gisel* -mattr=+bti %s -verify-machineinstrs -o - 2>&1 | FileCheck %s --check-prefixes=CHECK,FALLBACK 3 4; FALLBACK: remark: <unknown>:0:0: unable to translate instruction: call: ' tail call void %p()' (in function: bti_enabled) 5 6target datalayout = "e-m:e-i8:8:32-i16:16:32-i64:64-i128:128-n32:64-S128" 7target triple = "aarch64-arm-none-eabi" 8 9; When BTI is enabled, all indirect tail-calls must use x16 or x17 (the intra 10; procedure call scratch registers) to hold the address, as these instructions 11; are allowed to target the "BTI c" instruction at the start of the target 12; function. The alternative to this would be to start functions with "BTI jc", 13; which increases the number of potential ways they could be called, and 14; weakens the security protections. 15 16define void @bti_disabled(void ()* %p) { 17entry: 18 tail call void %p() 19; CHECK: br x0 20 ret void 21} 22 23define void @bti_enabled(void ()* %p) "branch-target-enforcement" { 24entry: 25 tail call void %p() 26; CHECK: br {{x16|x17}} 27 ret void 28} 29