[AArch64] Avoid incompatibility between SLSBLR mitigation and BTI codegen.

[kristof.beyls]

Summary

A "BTI c" instruction only allows jumping/calling to using a BLR* instruction.
However, the SLSBLR mitigation changes a BLR to a BR to implement the
function call. Therefore, a "BTI c" check that passed before could
trigger after the BLR->BL change done by the SLSBLR mitigation.
However, if the register used in BR is X16 or X17, this trigger will not
fire (see ArmARM for further details).

Therefore, this patch simply changes the function stubs for the SLSBLR
mitigation from
__llvm_slsblr_thunk_x<N>:

br x<N>
SpeculationBarrier

to
__llvm_slsblr_thunk_x<N>:

mov x16, x<N>
br  x16
SpeculationBarrier

[ostannard]

I have the same concern as in D81402: will this still work if the call to the thunk goes through a long-branch veneer or PLT, which could clobber x16 and x17?

llvm/lib/Target/AArch64/AArch64FastISel.cpp

3274

Do we need to conditionally emit BLRCallX16X17 here too?

3307

Again, might we need to emit BLRCallX16X17 here?

llvm/lib/Target/AArch64/AArch64FrameLowering.cpp

1129

Why is this hard-coded to BLRCallX16X17, never BLRCall?

llvm/lib/Target/AArch64/AArch64InstrInfo.cpp

6562

Would it be possible for a BLRCallX16X17 to reach here?

llvm/lib/Target/AArch64/GISel/AArch64CallLowering.cpp

779

Same as fast-sel, do we need to emit BLRCallX16X17 here?

llvm/lib/Target/AArch64/GISel/AArch64InstructionSelector.cpp

2874

Same as fast-sel, do we need to emit BLRCallX16X17 here?

[kristof.beyls]

Based on the review feedback that using X16 or X17 could be problematic since a linker can clobber those registers on a call, this patch goes for a different approach to achieve compatibility with BTI-enabled callees.
It simply moves the register to be called always to be in X16, and then does BR X16.
It seems it's simplest to do that unconditionally, as it may not always be easy to find out if the call target has been BTI-enabled.

[ostannard]

LGTM.

I think we could make this conditional based on whether the caller has BTI enabled, because:

• If the caller has BTI enabled, then we correctly use X16 for a BTI callee, or wastefully (but still with correct behaviour) use X16 for a non-BTI callee.
• If the caller has BTI disabled, then it must be in a page with BTI disabled, and so is able to use BR with any register, even if the destination is BTI-protected.

This relies on the caller and thunk being allocated in memory with the same BTI state, which I expect to be a safe assumption.

This patch still looks good by itself, the above would just be an optimisation and can be done later.

llvm/lib/Target/AArch64/AArch64AsmPrinter.cpp

case AArch64::TCRETURNdi: {
     MCOperand Dest;
     MCInstLowering.lowerOperand(MI->getOperand(0), Dest);
     MCInst TmpInst;
     TmpInst.setOpcode(AArch64::B);
     TmpInst.addOperand(Dest);
     EmitToStreamer(*OutStreamer, TmpInst);
     return;
   }
+  case AArch64::BLRCall:
+  case AArch64::BLRCallX16X17: {
+    MCInst TmpInst;
+    TmpInst.setOpcode(AArch64::BLR);
+    TmpInst.addOperand(MCOperand::createReg(MI->getOperand(0).getReg()));
+    EmitToStreamer(*OutStreamer, TmpInst);
+    return;
+  }
   case AArch64::SpeculationBarrierISBDSBEndBB: {
     // Print DSB SYS + ISB
     MCInst TmpInstDSB;
     TmpInstDSB.setOpcode(AArch64::DSB);
     TmpInstDSB.addOperand(MCOperand::createImm(0xf));
     EmitToStreamer(*OutStreamer, TmpInstDSB);
     MCInst TmpInstISB;
     TmpInstISB.setOpcode(AArch64::ISB);

llvm/lib/Target/AArch64/AArch64FastISel.cpp

bool AArch64FastISel::fastLowerCall(CallLoweringInfo &CLI) {
 
   const AArch64RegisterInfo *RegInfo = Subtarget->getRegisterInfo();
   if (RegInfo->isAnyArgRegReserved(*MF))
     RegInfo->emitReservedArgRegCallError(*MF);
 
   // Issue the call.
   MachineInstrBuilder MIB;
   if (Subtarget->useSmallAddressing()) {
-    const MCInstrDesc &II = TII.get(Addr.getReg() ? AArch64::BLR : AArch64::BL);
+    const MCInstrDesc &II =
+        TII.get(Addr.getReg() ? AArch64::BLRCall : AArch64::BL);
     MIB = BuildMI(*FuncInfo.MBB, FuncInfo.InsertPt, DbgLoc, II);
     if (Symbol)
       MIB.addSym(Symbol, 0);
     else if (Addr.getGlobalValue())
       MIB.addGlobalAddress(Addr.getGlobalValue(), 0, 0);
     else if (Addr.getReg()) {
       unsigned Reg = constrainOperandRegClass(II, Addr.getReg(), 0);
       MIB.addReg(Reg);
if (Subtarget->useSmallAddressing()) {
     } else if (Addr.getGlobalValue())
       CallReg = materializeGV(Addr.getGlobalValue());
     else if (Addr.getReg())
       CallReg = Addr.getReg();
 
     if (!CallReg)
       return false;
 
-    const MCInstrDesc &II = TII.get(AArch64::BLR);
+    const MCInstrDesc &II = TII.get(AArch64::BLRCall);
     CallReg = constrainOperandRegClass(II, CallReg, 0);
     MIB = BuildMI(*FuncInfo.MBB, FuncInfo.InsertPt, DbgLoc, II).addReg(CallReg);
   }
 
   // Add implicit physical register uses to the call.
   for (auto Reg : CLI.OutRegs)
     MIB.addReg(Reg, RegState::Implicit);
 

llvm/lib/Target/AArch64/AArch64FrameLowering.cpp

case CodeModel::Large:
           .addExternalSymbol("__chkstk")
           .setMIFlags(MachineInstr::FrameSetup);
       if (NeedsWinCFI) {
         HasWinCFI = true;
         BuildMI(MBB, MBBI, DL, TII->get(AArch64::SEH_Nop))
             .setMIFlag(MachineInstr::FrameSetup);
       }
 
-      BuildMI(MBB, MBBI, DL, TII->get(AArch64::BLR))
+      BuildMI(MBB, MBBI, DL, TII->get(AArch64::BLRCallX16X17))
           .addReg(AArch64::X16, RegState::Kill)
           .addReg(AArch64::X15, RegState::Implicit | RegState::Define)
           .addReg(AArch64::X16, RegState::Implicit | RegState::Define | RegState::Dead)
           .addReg(AArch64::X17, RegState::Implicit | RegState::Define | RegState::Dead)
           .addReg(AArch64::NZCV, RegState::Implicit | RegState::Define | RegState::Dead)
           .setMIFlags(MachineInstr::FrameSetup);
       if (NeedsWinCFI) {
         HasWinCFI = true;

llvm/lib/Target/AArch64/AArch64InstrInfo.cpp

outliner::OutlinedFunction AArch64InstrInfo::getOutliningCandidateInfo(
   // tail call all of the candidates.
   if (RepeatedSequenceLocs[0].back()->isTerminator()) {
     FrameID = MachineOutlinerTailCall;
     NumBytesToCreateFrame = 0;
     SetCandidateCallInfo(MachineOutlinerTailCall, 4);
   }
 
   else if (LastInstrOpcode == AArch64::BL ||
-           (LastInstrOpcode == AArch64::BLR && !HasBTI)) {
+           (LastInstrOpcode == AArch64::BLRCall && !HasBTI)) {
     // FIXME: Do we need to check if the code after this uses the value of LR?
     FrameID = MachineOutlinerThunk;
     NumBytesToCreateFrame = 0;
     SetCandidateCallInfo(MachineOutlinerThunk, 4);
   }
 
   else {
     // We need to decide how to emit calls + frames. We can always emit the same
if (MI.isCall()) {
     if (Callee && Callee->getName() == "\01_mcount")
       return outliner::InstrType::Illegal;
 
     // If we don't know anything about the callee, assume it depends on the
     // stack layout of the caller. In that case, it's only legal to outline
     // as a tail-call.  Whitelist the call instructions we know about so we
     // don't get unexpected results with call pseudo-instructions.
     auto UnknownCallOutlineType = outliner::InstrType::Illegal;
-    if (MI.getOpcode() == AArch64::BLR || MI.getOpcode() == AArch64::BL)
+    if (MI.getOpcode() == AArch64::BLRCall ||
+        MI.getOpcode() == AArch64::BLRCallX16X17 ||
+        MI.getOpcode() == AArch64::BL)
       UnknownCallOutlineType = outliner::InstrType::LegalTerminator;
 
     if (!Callee)
       return UnknownCallOutlineType;
 
     // We have a function we have information about. Check it if it's something
     // can safely outline.
     MachineFunction *CalleeMF = MF->getMMI().getMachineFunction(*Callee);
void AArch64InstrInfo::buildOutlinedFrame(
   else if (OF.FrameConstructionID == MachineOutlinerThunk) {
     // For thunk outlining, rewrite the last instruction from a call to a
     // tail-call.
     MachineInstr *Call = &*--MBB.instr_end();
     unsigned TailOpcode;
     if (Call->getOpcode() == AArch64::BL) {
       TailOpcode = AArch64::TCRETURNdi;
     } else {
-      assert(Call->getOpcode() == AArch64::BLR);
+      assert(Call->getOpcode() == AArch64::BLRCall);
       TailOpcode = AArch64::TCRETURNriALL;
     }
     MachineInstr *TC = BuildMI(MF, DebugLoc(), get(TailOpcode))
                            .add(Call->getOperand(0))
                            .addImm(0);
     MBB.insert(MBB.end(), TC);
     Call->eraseFromParent();
 

llvm/lib/Target/AArch64/AArch64InstrInfo.td

 let RecomputePerFunction = 1 in {
   def ForCodeSize   : Predicate<"shouldOptForSize(MF)">;
   def NotForCodeSize   : Predicate<"!shouldOptForSize(MF)">;
   // Avoid generating STRQro if it is slow, unless we're optimizing for code size.
   def UseSTRQro : Predicate<"!Subtarget->isSTRQroSlow() || shouldOptForSize(MF)">;
 
   def UseBTI : Predicate<[{ MF->getFunction().hasFnAttribute("branch-target-enforcement") }]>;
   def NotUseBTI : Predicate<[{ !MF->getFunction().hasFnAttribute("branch-target-enforcement") }]>;
+  def SLSBLRMitigationWithBTI : Predicate<[{ (MF->getFunction().hasFnAttribute("branch-target-enforcement") && MF->getSubtarget<AArch64Subtarget>().hardenSlsBlr()) }]>;
+  def NotSLSBLRMitigationWithBTI : Predicate<[{ !(MF->getFunction().hasFnAttribute("branch-target-enforcement") && MF->getSubtarget<AArch64Subtarget>().hardenSlsBlr()) }]>;
 
   // Toggles patterns which aren't beneficial in GlobalISel when we aren't
   // optimizing. This allows us to selectively use patterns without impacting
   // SelectionDAG's behaviour.
   // FIXME: One day there will probably be a nicer way to check for this, but
   // today is not that day.
   def OptimizedGISelOrOtherSelector : Predicate<"!MF->getFunction().hasOptNone() || MF->getProperties().hasProperty(MachineFunctionProperties::Property::FailedISel) || !MF->getProperties().hasProperty(MachineFunctionProperties::Property::Legalized)">;
 }

 def DRPS : SpecialReturn<0b0101, "drps">;
 def ERET : SpecialReturn<0b0100, "eret">;
 } // isReturn = 1, isTerminator = 1, isBarrier = 1
 
 // Default to the LR register.
 def : InstAlias<"ret", (RET LR)>;
 
 let isCall = 1, Defs = [LR], Uses = [SP] in {
-def BLR : BranchReg<0b0001, "blr", [(AArch64call GPR64:$Rn)]>;
+  def BLR : BranchReg<0b0001, "blr", []>;
+  def BLRCall : Pseudo<(outs), (ins GPR64:$Rn), []>,
+                Sched<[WriteBrReg]>;
+  def BLRCallX16X17 : Pseudo<(outs), (ins rtcGPR64:$Rn), []>,
+                Sched<[WriteBrReg]>;
 } // isCall
 
+def : Pat<(AArch64call GPR64:$Rn),
+          (BLRCall GPR64:$Rn)>,
+      Requires<[NotSLSBLRMitigationWithBTI]>;
+def : Pat<(AArch64call rtcGPR64:$Rn),
+          (BLRCallX16X17 rtcGPR64:$Rn)>,
+      Requires<[SLSBLRMitigationWithBTI]>;
+
 let isBranch = 1, isTerminator = 1, isBarrier = 1, isIndirectBranch = 1 in {
 def BR  : BranchReg<0b0000, "br", [(brind GPR64:$Rn)]>;
 } // isBranch, isTerminator, isBarrier, isIndirectBranch
 
 // Create a separate pseudo-instruction for codegen to use so that we don't
 // flag lr as used in every function. It'll be restored before the RET by the
 // epilogue if it's legitimately used.
 def RET_ReallyLR : Pseudo<(outs), (ins), [(AArch64retflag)]>,

llvm/lib/Target/AArch64/AArch64RegisterBankInfo.cpp

AArch64RegisterBankInfo::getRegBankFromRegClass(const TargetRegisterClass &RC,
   case AArch64::GPR64spRegClassID:
   case AArch64::GPR64sponlyRegClassID:
   case AArch64::GPR64argRegClassID:
   case AArch64::GPR64allRegClassID:
   case AArch64::GPR64noipRegClassID:
   case AArch64::GPR64common_and_GPR64noipRegClassID:
   case AArch64::GPR64noip_and_tcGPR64RegClassID:
   case AArch64::tcGPR64RegClassID:
+  case AArch64::rtcGPR64RegClassID:
   case AArch64::WSeqPairsClassRegClassID:
   case AArch64::XSeqPairsClassRegClassID:
     return getRegBank(AArch64::GPRRegBankID);
   case AArch64::CCRRegClassID:
     return getRegBank(AArch64::CCRegBankID);
   default:
     llvm_unreachable("Register class not supported");
   }

llvm/lib/Target/AArch64/AArch64SLSHardening.cpp

for (auto &MBB : MF) {
     Modified |= hardenBLRs(MBB);
   }
 
   return Modified;
 }
 
 static bool isBLR(const MachineInstr &MI) {
   switch (MI.getOpcode()) {
-  case AArch64::BLR:
+  case AArch64::BLRCall:
+  case AArch64::BLRCallX16X17:
     return true;
+  case AArch64::BLR:
+    llvm_unreachable("BLR should only be used at the MC layer level.");
   case AArch64::BLRAA:
   case AArch64::BLRAB:
   case AArch64::BLRAAZ:
   case AArch64::BLRABZ:
     llvm_unreachable("Currently, LLVM's code generator does not support "
                      "producing BLRA* instructions. Therefore, there's no "
                      "support in this pass for those instructions.");
   }
AArch64SLSHardening::ConvertBLRToBL(MachineBasicBlock &MBB,
   // __llvm_slsblr_thunk_xN.
 
   MachineInstr &BLR = *MBBI;
   assert(isBLR(BLR));
   unsigned BLOpcode;
   Register Reg;
   bool RegIsKilled;
   switch (BLR.getOpcode()) {
-  case AArch64::BLR:
+  case AArch64::BLRCall:
+  case AArch64::BLRCallX16X17:
     BLOpcode = AArch64::BL;
     Reg = BLR.getOperand(0).getReg();
     RegIsKilled = BLR.getOperand(0).isKill();
     break;
+  case AArch64::BLR:
+    llvm_unreachable("BLR should only be used at the MC layer level.");
   case AArch64::BLRAA:
   case AArch64::BLRAB:
   case AArch64::BLRAAZ:
   case AArch64::BLRABZ:
     llvm_unreachable("BLRA instructions cannot yet be produced by LLVM, "
                      "therefore there is no need to support them for now.");
   default:
     llvm_unreachable("unhandled BLR");

llvm/lib/Target/AArch64/GISel/AArch64CallLowering.cpp

bool AArch64CallLowering::isEligibleForTailCallOptimization(
   LLVM_DEBUG(
       dbgs() << "... Call is eligible for tail call optimization.\n");
   return true;
 }
 
 static unsigned getCallOpcode(const Function &CallerF, bool IsIndirect,
                               bool IsTailCall) {
   if (!IsTailCall)
-    return IsIndirect ? AArch64::BLR : AArch64::BL;
+    return IsIndirect ? AArch64::BLRCall : AArch64::BL;
 
   if (!IsIndirect)
     return AArch64::TCRETURNdi;
 
   // When BTI is enabled, we need to use TCRETURNriBTI to make sure that we use
   // x16 or x17.
   if (CallerF.hasFnAttribute("branch-target-enforcement"))
     return AArch64::TCRETURNriBTI;

llvm/lib/Target/AArch64/GISel/AArch64InstructionSelector.cpp

bool AArch64InstructionSelector::selectTLSGlobalValue(
 
   auto Load = MIB.buildInstr(AArch64::LDRXui, {&AArch64::GPR64commonRegClass},
                              {Register(AArch64::X0)})
                   .addImm(0);
 
   // TLS calls preserve all registers except those that absolutely must be
   // trashed: X0 (it takes an argument), LR (it's a call) and NZCV (let's not be
   // silly).
-  MIB.buildInstr(AArch64::BLR, {}, {Load})
+  MIB.buildInstr(AArch64::BLRCall, {}, {Load})
       .addDef(AArch64::X0, RegState::Implicit)
       .addRegMask(TRI.getTLSCallPreservedMask());
 
   MIB.buildCopy(I.getOperand(0).getReg(), Register(AArch64::X0));
   RBI.constrainGenericRegister(I.getOperand(0).getReg(), AArch64::GPR64RegClass,
                                MRI);
   I.eraseFromParent();
   return true;

llvm/test/CodeGen/AArch64/GlobalISel/call-translator.ll

define void @test_simple_arg(i32 %in) {
   ret void
 }
 
 ; CHECK-LABEL: name: test_indirect_call
 ; CHECK: registers:
 ; Make sure the register feeding the indirect call is properly constrained.
 ; CHECK: - { id: [[FUNC:[0-9]+]], class: gpr64, preferred-register: '' }
 ; CHECK: %[[FUNC]]:gpr64(p0) = COPY $x0
-; CHECK: BLR %[[FUNC]](p0), csr_aarch64_aapcs, implicit-def $lr, implicit $sp
+; CHECK: BLRCall %[[FUNC]](p0), csr_aarch64_aapcs, implicit-def $lr, implicit $sp
 ; CHECK: RET_ReallyLR
 define void @test_indirect_call(void()* %func) {
   call void %func()
   ret void
 }
 
 ; CHECK-LABEL: name: test_multiple_args
 ; CHECK: [[IN:%[0-9]+]]:_(s64) = COPY $x0

llvm/test/CodeGen/AArch64/GlobalISel/irtranslator-exceptions.ll

 continue:
   %sel.int = tail call i32 @llvm.eh.typeid.for(i8* bitcast(i8** @_ZTIi to i8*))
   %res.good = insertvalue { i8*, i32 } undef, i32 %sel.int, 1
   ret { i8*, i32 } %res.good
 }
 
 ; CHECK-LABEL: name: test_invoke_indirect
 ; CHECK: [[CALLEE:%[0-9]+]]:gpr64(p0) = COPY $x0
-; CHECK: BLR [[CALLEE]]
+; CHECK: BLRCall [[CALLEE]]
 define void @test_invoke_indirect(void()* %callee) personality i8* bitcast (i32 (...)* @__gxx_personality_v0 to i8*) {
   invoke void %callee() to label %continue unwind label %broken
 
 broken:
   landingpad { i8*, i32 } catch i8* bitcast(i8** @_ZTIi to i8*)
   ret void
 
 continue:

llvm/test/CodeGen/AArch64/chkstk.ll

 ; CHECK-LARGE-CODE-MODEL: check_watermark:
 ; CHECK-LARGE-CODE-MODEL-DAG: stp x29, x30, [sp
 ; CHECK-LARGE-CODE-MODEL-DAG: mov x15, #256
 ; CHECK-LARGE-CODE-MODEL-DAG: adrp x16, __chkstk
 ; CHECK-LARGE-CODE-MODEL-DAG: add x16, x16, __chkstk
 ; CHECK-LARGE-CODE-MODEL:     blr x16
 ; CHECK-LARGE-CODE-MODEL:     sub sp, sp, x15, lsl #4
 
-; CHECK-REGSTATE-LARGE: frame-setup BLR killed $x16, implicit-def $lr, implicit $sp, implicit-def $x15, implicit-def dead $x16, implicit-def dead $x17, implicit-def dead $nzcv
+; CHECK-REGSTATE-LARGE: frame-setup BLRCallX16X17 killed $x16, implicit-def $lr, implicit $sp, implicit-def $x15, implicit-def dead $x16, implicit-def dead $x17, implicit-def dead $nzcv

llvm/test/CodeGen/AArch64/speculation-hardening-sls-blr.mir

body:             |
   bb.0.entry:
     liveins: $lr
 
     early-clobber $sp = frame-setup STRXpre killed $lr, $sp, -16 ; :: (store 8 into %stack.0)
     frame-setup CFI_INSTRUCTION def_cfa_offset 16
     frame-setup CFI_INSTRUCTION offset $w30, -16
     renamable $x8 = ADRP target-flags(aarch64-page) @a
     renamable $x8 = LDRXui killed renamable $x8, target-flags(aarch64-pageoff, aarch64-nc) @a :: (dereferenceable load 8 from `i32 ()** bitcast (i32 (...)** @a to i32 ()**)`)
-    BLR killed renamable $x8, csr_aarch64_aapcs, implicit-def dead $lr, implicit $sp, implicit-def $sp, implicit-def $w0
+    BLRCall killed renamable $x8, csr_aarch64_aapcs, implicit-def dead $lr, implicit $sp, implicit-def $sp, implicit-def $w0
   ; CHECK:  BL <mcsymbol __llvm_slsblr_thunk_x8>, csr_aarch64_aapcs, implicit-def dead $lr, implicit $sp, implicit-def $sp, implicit-def $w0, implicit killed $x8
     renamable $x8 = ADRP target-flags(aarch64-page) @b
     STRWui killed renamable $w0, killed renamable $x8, target-flags(aarch64-pageoff, aarch64-nc) @b :: (store 4 into @b)
     early-clobber $sp, $lr = frame-destroy LDRXpost $sp, 16 ; :: (load 8 from %stack.0)
     RET undef $lr
 
 
 ...

llvm/test/CodeGen/AArch64/speculation-hardening-sls.ll

 ; RUN: llc -mattr=harden-sls-retbr,harden-sls-blr -verify-machineinstrs -mtriple=aarch64-none-linux-gnu < %s | FileCheck %s --check-prefixes=CHECK,ISBDSB --dump-input-on-failure
 ; RUN: llc -mattr=harden-sls-retbr,harden-sls-blr -mattr=+sb -verify-machineinstrs -mtriple=aarch64-none-linux-gnu < %s | FileCheck %s --check-prefixes=CHECK,SB --dump-input-on-failure
 ; RUN: llc -global-isel -global-isel-abort=0 -mattr=harden-sls-retbr,harden-sls-blr -verify-machineinstrs -mtriple=aarch64-none-linux-gnu < %s | FileCheck %s --check-prefixes=CHECK,ISBDSB --dump-input-on-failure
 ; RUN: llc -global-isel -global-isel-abort=0 -mattr=harden-sls-retbr,harden-sls-blr -mattr=+sb -verify-machineinstrs -mtriple=aarch64-none-linux-gnu < %s | FileCheck %s --check-prefixes=CHECK,SB --dump-input-on-failure
+; RUN: llc -mattr=+sb -mattr=harden-sls-blr -verify-machineinstrs -mtriple=aarch64-none-linux-gnu < %s | FileCheck %s --check-prefixes=BLRBTISB --dump-input-on-failure
 
 ; Function Attrs: norecurse nounwind readnone
 define dso_local i32 @double_return(i32 %a, i32 %b) {
 entry:
   %cmp = icmp sgt i32 %a, 0
   br i1 %cmp, label %if.then, label %if.else
 
 if.then:                                          ; preds = %entry

 ; ISBDSB-NEXT: dsb sy
 ; ISBDSB-NEXT: isb
 ; SB-NEXT:     {{ sb$}}
 ; CHECK-NEXT: .Lfunc_end
     ret i32 %a
 }
 
 define dso_local i32 @indirect_call(
-i32 (...)* nocapture %f1, i32 (...)* nocapture %f2) {
+i32 (...)* nocapture %f1, i32 (...)* nocapture %f2) "branch-target-enforcement" {
 entry:
 ; CHECK-LABEL: indirect_call:
+; BLRBTISB-LABEL: indirect_call:
   %callee.knr.cast = bitcast i32 (...)* %f1 to i32 ()*
   %call = tail call i32 %callee.knr.cast()
 ; CHECK: bl {{__llvm_slsblr_thunk_x[0-9]+$}}
+; BLRBTISB: bl {{__llvm_slsblr_thunk_x(16|17)$}}
   %callee.knr.cast1 = bitcast i32 (...)* %f2 to i32 ()*
   %call2 = tail call i32 %callee.knr.cast1()
 ; CHECK: bl {{__llvm_slsblr_thunk_x[0-9]+$}}
+; BLRBTISB: bl {{__llvm_slsblr_thunk_x(16|17)$}}
   %add = add nsw i32 %call2, %call
   ret i32 %add
 ; CHECK: .Lfunc_end
+; BLRBTISB: .Lfunc_end
 }
 
 ; verify calling through a function pointer.
 @a = dso_local local_unnamed_addr global i32 (...)* null, align 8
 @b = dso_local local_unnamed_addr global i32 0, align 4
-define dso_local void @indirect_call_global() local_unnamed_addr {
+define dso_local void @indirect_call_global() "branch-target-enforcement" {
 ; CHECK-LABEL: indirect_call_global:
+; CLRBTISB-LABEL: indirect_call_global:
 entry:
   %0 = load i32 ()*, i32 ()** bitcast (i32 (...)** @a to i32 ()**), align 8
   %call = tail call i32 %0()  nounwind
 ; CHECK: bl {{__llvm_slsblr_thunk_x[0-9]+$}}
+; BLRBTISB: bl {{__llvm_slsblr_thunk_x(16|17)$}}
   store i32 %call, i32* @b, align 4
   ret void
 ; CHECK: .Lfunc_end
+; BLRBTISB: .Lfunc_end
 }
 
 ; CHECK-label: __llvm_slsblr_thunk_x0:
 ; CHECK:    br x0
 ; ISBDSB-NEXT: dsb sy
 ; ISBDSB-NEXT: isb
 ; SB-NEXT:     dsb sy
 ; SB-NEXT:     isb
 ; CHECK-NEXT: .Lfunc_end
 ; CHECK-label: __llvm_slsblr_thunk_x19:
 ; CHECK:    br x19
 ; ISBDSB-NEXT: dsb sy
 ; ISBDSB-NEXT: isb
 ; SB-NEXT:     dsb sy
 ; SB-NEXT:     isb
 ; CHECK-NEXT: .Lfunc_end