BTI

About

Branch Target Indication
First introduced in Armv8.5-A to prevent Jump-Oriented Programming related attacks

BTI instructions serve as landing pad instructions
Processor can be configured so that indirect branches (BR and BLR) can only allow target landing pad instructions
If the target of an indirect branch is not a landing pad, a Branch Target Exception is generated

BTI protection

Option	Description
`-mbranch-protection=bti`	Enables branch protection using BTI
`-mbranch-protection=standard`	Enables PAC (`pac-ret`) and BTI (`bti`)
`-mbranch-protection=none`	Disables all types of branch protection