# RUN: llc -run-pass=aarch64-branch-targets %s -o - | FileCheck %s
--- |
  target datalayout = "e-m:e-i8:8:32-i16:16:32-i64:64-i128:128-n32:64-S128"
  target triple = "aarch64-arm-none-eabi"

  define hidden i32 @simple_external() "branch-target-enforcement"="true" {
  entry:
    ret i32 0
  }

  define internal i32 @simple_internal() "branch-target-enforcement"="true" {
  entry:
    ret i32 0
  }

  define hidden i32 @ptr_auth() "branch-target-enforcement"="true" {
  entry:
    tail call void asm sideeffect "", "~{lr}"()
    ret i32 0
  }

  define hidden i32 @ptr_auth_b() "branch-target-enforcement"="true" {
  entry:
    tail call void asm sideeffect "", "~{lr}"()
    ret i32 0
  }

  define hidden i32 @jump_table(i32 %a) "branch-target-enforcement"="true" {
  entry:
    switch i32 %a, label %sw.epilog [
      i32 1, label %sw.bb
      i32 2, label %sw.bb1
      i32 3, label %sw.bb2
      i32 4, label %sw.bb3
      i32 5, label %sw.bb4
    ]

  sw.bb:                                            ; preds = %entry
    tail call void asm sideeffect "", ""()
    br label %sw.epilog

  sw.bb1:                                           ; preds = %entry
    tail call void asm sideeffect "", ""()
    br label %sw.epilog

  sw.bb2:                                           ; preds = %entry
    tail call void asm sideeffect "", ""()
    br label %sw.epilog

  sw.bb3:                                           ; preds = %entry
    tail call void asm sideeffect "", ""()
    br label %sw.epilog

  sw.bb4:                                           ; preds = %entry
    tail call void asm sideeffect "", ""()
    br label %sw.epilog

  sw.epilog:                                        ; preds = %entry, %sw.bb4, %sw.bb3, %sw.bb2, %sw.bb1, %sw.bb
    ret i32 0
  }

  @label_address.addr = internal unnamed_addr global i8* blockaddress(@label_address, %return), align 8

  define hidden i32 @label_address() "branch-target-enforcement"="true" {
  entry:
    %0 = load i8*, i8** @label_address.addr, align 8
    indirectbr i8* %0, [label %return, label %lab2]

  lab2:                                             ; preds = %entry
    br label %.split

  return:                                           ; preds = %entry
    br label %.split

  .split:                                           ; preds = %lab2, %return
    %merge = phi i8* [ blockaddress(@label_address, %lab2), %return ], [ blockaddress(@label_address, %return), %lab2 ]
    %merge2 = phi i32 [ 1, %return ], [ 2, %lab2 ]
    store i8* %merge, i8** @label_address.addr, align 8
    ret i32 %merge2
  }

  define hidden i32 @label_address_entry() "branch-target-enforcement"="true" {
  entry:
    %0 = load i8*, i8** @label_address.addr, align 8
    indirectbr i8* %0, [label %return, label %lab2]

  lab2:                                             ; preds = %entry
    br label %.split

  return:                                           ; preds = %entry
    br label %.split

  .split:                                           ; preds = %lab2, %return
    %merge = phi i8* [ blockaddress(@label_address, %lab2), %return ], [ blockaddress(@label_address, %return), %lab2 ]
    %merge2 = phi i32 [ 1, %return ], [ 2, %lab2 ]
    store i8* %merge, i8** @label_address.addr, align 8
    ret i32 %merge2
  }

  define hidden i32 @debug_ptr_auth() "branch-target-enforcement"="true" {
  entry:
    tail call void asm sideeffect "", "~{lr}"()
    ret i32 0
  }

...
---
# External function, could be addres-taken elsewhere so needs BTI JC.
name:            simple_external
body:             |
  bb.0.entry:
    ; CHECK-LABEL: name: simple_external
    ; CHECK: HINT 34
    ; CHECK: RET
    $w0 = ORRWrs $wzr, $wzr, 0
    RET undef $lr, implicit killed $w0

---
# Internal function, not address-taken in this module, however the compiler
# cannot 100% ensure that later parts of the toolchain won't add indirect
# jumps. E.g. a linker adding a thunk to extend the range of a direct jump.
# Therefore, even this case needs a BTI.
name:            simple_internal
body:             |
  bb.0.entry:
    ; CHECK-LABEL: name: simple_internal
    ; CHECK: HINT 34
    ; CHECK: RET
    $w0 = ORRWrs $wzr, $wzr, 0
    RET undef $lr, implicit killed $w0

---
# Function starts with PACIASP, which implicitly acts as BTI JC, so no change
# needed.
name:            ptr_auth
stack:
  - { id: 0, name: '', type: spill-slot, offset: -16, size: 8, alignment: 16,
      stack-id: default, callee-saved-register: '$lr', callee-saved-restored: true,
      debug-info-variable: '', debug-info-expression: '', debug-info-location: '' }
body:             |
  bb.0.entry:
    liveins: $lr

    ; CHECK-LABEL: name: ptr_auth
    ; CHECK-NOT: HINT
    ; CHECK: frame-setup PACIASP
    ; CHECK-NOT: HINT
    ; CHECK: RETAA
    frame-setup PACIASP implicit-def $lr, implicit killed $lr, implicit $sp
    early-clobber $sp = frame-setup STRXpre killed $lr, $sp, -16 :: (store (s64) into %stack.0)
    INLINEASM &"", 1, 12, implicit-def dead early-clobber $lr
    $w0 = ORRWrs $wzr, $wzr, 0
    early-clobber $sp, $lr = frame-destroy LDRXpost $sp, 16 :: (load (s64) from %stack.0)
    RETAA implicit $sp, implicit $lr, implicit killed $w0

---
# Function starts with PACIBSP, which implicitly acts as BTI JC, so no change
# needed.
name:            ptr_auth_b
stack:
  - { id: 0, name: '', type: spill-slot, offset: -16, size: 8, alignment: 16,
      stack-id: default, callee-saved-register: '$lr', callee-saved-restored: true,
      debug-info-variable: '', debug-info-expression: '', debug-info-location: '' }
body:             |
  bb.0.entry:
    liveins: $lr

    ; CHECK-LABEL: name: ptr_auth_b
    ; CHECK-NOT: HINT
    ; CHECK: frame-setup PACIBSP
    ; CHECK-NOT: HINT
    ; CHECK: RETAB
    frame-setup PACIBSP implicit-def $lr, implicit killed $lr, implicit $sp
    early-clobber $sp = frame-setup STRXpre killed $lr, $sp, -16 :: (store (s64) into %stack.0)
    INLINEASM &"", 1, 12, implicit-def dead early-clobber $lr
    $w0 = ORRWrs $wzr, $wzr, 0
    early-clobber $sp, $lr = frame-destroy LDRXpost $sp, 16 :: (load (s64) from %stack.0)
    RETAB implicit $sp, implicit $lr, implicit killed $w0

---
# Function contains a jump table, so every target of the jump table must start
# with BTI J.
name:            jump_table
jumpTable:
  kind:            block-address
  entries:
    - id:              0
      blocks:          [ '%bb.2', '%bb.3', '%bb.4', '%bb.5', '%bb.6' ]
body:             |
  bb.0.entry:
    ; CHECK-LABEL: name: jump_table
    ; CHECK: HINT 34
    successors: %bb.7(0x15555555), %bb.1(0x6aaaaaab)
    liveins: $w0

    renamable $w8 = SUBWri killed renamable $w0, 1, 0, implicit-def $x8
    dead $wzr = SUBSWri renamable $w8, 4, 0, implicit-def $nzcv
    Bcc 8, %bb.7, implicit $nzcv

  bb.1.entry:
    ; CHECK: bb.1.entry:
    ; CHECK-NOT: HINT
    ; CHECK: BR killed renamable $x8
    successors: %bb.2(0x1999999a), %bb.3(0x1999999a), %bb.4(0x1999999a), %bb.5(0x1999999a), %bb.6(0x1999999a)
    liveins: $x8

    $x9 = ADRP target-flags(aarch64-page) %jump-table.0
    renamable $x9 = ADDXri killed $x9, target-flags(aarch64-pageoff, aarch64-nc) %jump-table.0, 0
    renamable $x8 = LDRXroX killed renamable $x9, killed renamable $x8, 0, 1 :: (load (s64) from jump-table)
    BR killed renamable $x8

  bb.2.sw.bb:
    ; CHECK: bb.2.sw.bb
    ; CHECK-NEXT: HINT 36
    $w0 = ORRWrs $wzr, $wzr, 0
    INLINEASM &"", 1
    RET undef $lr, implicit killed $w0

  bb.3.sw.bb1:
    ; CHECK: bb.3.sw.bb1
    ; CHECK-NEXT: HINT 36
    $w0 = ORRWrs $wzr, $wzr, 0
    INLINEASM &"", 1
    RET undef $lr, implicit killed $w0

  bb.4.sw.bb2:
    ; CHECK: bb.4.sw.bb2
    ; CHECK-NEXT: HINT 36
    $w0 = ORRWrs $wzr, $wzr, 0
    INLINEASM &"", 1
    RET undef $lr, implicit killed $w0

  bb.5.sw.bb3:
    ; CHECK: bb.5.sw.bb3
    ; CHECK-NEXT: HINT 36
    $w0 = ORRWrs $wzr, $wzr, 0
    INLINEASM &"", 1
    RET undef $lr, implicit killed $w0

  bb.6.sw.bb4:
    ; CHECK: bb.6.sw.bb4
    ; CHECK-NEXT: successors: %bb.7(0x80000000)
    ; CHECK-NEXT: {{  }}
    ; CHECK-NEXT: HINT 36
    successors: %bb.7(0x80000000)

    INLINEASM &"", 1

  bb.7.sw.epilog:
    ; CHECK: bb.7.sw.epilog:
    ; CHECK-NOT: HINT
    ; CHECK: RET
    $w0 = ORRWrs $wzr, $wzr, 0
    RET undef $lr, implicit killed $w0

---
# Function takes address of basic blocks, so they must start with BTI J.
name:            label_address
body:             |
  bb.0.entry:
    ; CHECK-LABEL: label_address
    ; CHECK: bb.0.entry:
    ; CHECK-NEXT: successors: %bb.1(0x40000000), %bb.2(0x40000000)
    ; CHECK-NEXT: {{  }}
    ; CHECK-NEXT: HINT 34
    ; CHECK: BR killed renamable $x9
    successors: %bb.1(0x40000000), %bb.2(0x40000000)

    renamable $x8 = ADRP target-flags(aarch64-page) @label_address.addr
    renamable $x9 = LDRXui renamable $x8, target-flags(aarch64-pageoff, aarch64-nc) @label_address.addr :: (dereferenceable load (s64) from @label_address.addr)
    BR killed renamable $x9

  bb.1.return (address-taken):
    ; CHECK: bb.1.return (address-taken):
    ; CHECK-NEXT: HINT 36
    liveins: $x8

    $x9 = ADRP target-flags(aarch64-page) blockaddress(@label_address, %ir-block.lab2)
    renamable $w0 = ORRWri $wzr, 0
    renamable $x9 = ADDXri killed $x9, target-flags(aarch64-pageoff, aarch64-nc) blockaddress(@label_address, %ir-block.lab2), 0
    STRXui killed renamable $x9, killed renamable $x8, target-flags(aarch64-pageoff, aarch64-nc) @label_address.addr :: (store (s64) into @label_address.addr)
    RET undef $lr, implicit killed $w0

  bb.2.lab2 (address-taken):
    ; CHECK: bb.2.lab2 (address-taken):
    ; CHECK-NEXT: HINT 36
    liveins: $x8

    $x9 = ADRP target-flags(aarch64-page) blockaddress(@label_address, %ir-block.return)
    renamable $w0 = ORRWri $wzr, 1984
    renamable $x9 = ADDXri killed $x9, target-flags(aarch64-pageoff, aarch64-nc) blockaddress(@label_address, %ir-block.return), 0
    STRXui killed renamable $x9, killed renamable $x8, target-flags(aarch64-pageoff, aarch64-nc) @label_address.addr :: (store (s64) into @label_address.addr)
    RET undef $lr, implicit killed $w0

---
# Function takes address of the entry block, so the entry block needs a BTI JC.
name:            label_address_entry
stack:
  - { id: 0, name: '', type: spill-slot, offset: -16, size: 8, alignment: 16,
      stack-id: default, callee-saved-register: '$lr', callee-saved-restored: true,
      debug-info-variable: '', debug-info-expression: '', debug-info-location: '' }
body:             |
  bb.0.entry (address-taken):
    ; CHECK-LABEL: label_address_entry
    ; CHECK: bb.0.entry (address-taken):
    ; CHECK-NEXT: successors: %bb.1(0x40000000), %bb.2(0x40000000)
    ; CHECK-NEXT: {{  }}
    ; CHECK-NEXT: HINT 38
    ; CHECK: BR killed renamable $x9
    successors: %bb.1(0x40000000), %bb.2(0x40000000)

    renamable $x8 = ADRP target-flags(aarch64-page) @label_address.addr
    renamable $x9 = LDRXui renamable $x8, target-flags(aarch64-pageoff, aarch64-nc) @label_address.addr :: (dereferenceable load (s64) from @label_address.addr)
    BR killed renamable $x9

  bb.1.return (address-taken):
    ; CHECK: bb.1.return (address-taken):
    ; CHECK-NEXT: HINT 36
    liveins: $x8
    frame-setup PACIASP implicit-def $lr, implicit killed $lr, implicit $sp
    frame-setup CFI_INSTRUCTION negate_ra_sign_state
    early-clobber $sp = frame-setup STRXpre killed $lr, $sp, -16 :: (store (s64) into %stack.0)
    INLINEASM &"", 1, 12, implicit-def dead early-clobber $lr
    $x9 = ADRP target-flags(aarch64-page) blockaddress(@label_address, %ir-block.entry)
    renamable $w0 = ORRWri $wzr, 0
    renamable $x9 = ADDXri killed $x9, target-flags(aarch64-pageoff, aarch64-nc) blockaddress(@label_address, %ir-block.entry), 0
    STRXui killed renamable $x9, killed renamable $x8, target-flags(aarch64-pageoff, aarch64-nc) @label_address.addr :: (store (s64) into @label_address.addr)
    early-clobber $sp, $lr = frame-destroy LDRXpost $sp, 16 :: (load (s64) from %stack.0)
    RETAA implicit $sp, implicit $lr, implicit killed $w0

  bb.2.lab2:
    ; CHECK: bb.2.lab2:
    ; CHECK-NOT: HINT
    liveins: $x8

    $x9 = ADRP target-flags(aarch64-page) blockaddress(@label_address, %ir-block.return)
    renamable $w0 = ORRWri $wzr, 1984
    renamable $x9 = ADDXri killed $x9, target-flags(aarch64-pageoff, aarch64-nc) blockaddress(@label_address, %ir-block.return), 0
    STRXui killed renamable $x9, killed renamable $x8, target-flags(aarch64-pageoff, aarch64-nc) @label_address.addr :: (store (s64) into @label_address.addr)
    RET undef $lr, implicit killed $w0
---
# When PACIASP is the first real instruction in the functions then BTI should not be inserted.
name:            debug_ptr_auth
stack:
  - { id: 0, name: '', type: spill-slot, offset: -16, size: 8, alignment: 16,
      stack-id: default, callee-saved-register: '$lr', callee-saved-restored: true,
      debug-info-variable: '', debug-info-expression: '', debug-info-location: '' }
body:             |
  bb.0.entry:
    liveins: $lr

    ; CHECK-LABEL: name: debug_ptr_auth
    ; CHECK-NOT: HINT
    ; CHECK: frame-setup PACIASP
    ; CHECK-NOT: HINT
    ; CHECK: RETAA
    frame-setup PACIASP implicit-def $lr, implicit killed $lr, implicit $sp
    frame-setup CFI_INSTRUCTION negate_ra_sign_state
    early-clobber $sp = frame-setup STRXpre killed $lr, $sp, -16 :: (store (s64) into %stack.0)
    INLINEASM &"", 1, 12, implicit-def dead early-clobber $lr
    $w0 = ORRWrs $wzr, $wzr, 0
    early-clobber $sp, $lr = frame-destroy LDRXpost $sp, 16 :: (load (s64) from %stack.0)
    RETAA implicit $sp, implicit $lr, implicit killed $w0

...