https://gcc.gnu.org/bugzilla/show_bug.cgi?id=85388
--- Comment #4 from H.J. Lu <hjl.tools at gmail dot com> ---
This works:
diff --git a/gcc/config/i386/i386.c b/gcc/config/i386/i386.c
index 03e5c433574..324e2ec60fc 100644
--- a/gcc/config/i386/i386.c
+++ b/gcc/config/i386/i386.c
@@ -15242,7 +15242,13 @@ ix86_expand_split_stack_prologue (void)
instruction--we need control flow to continue at the subsequent
label. Therefore, we use an unspec. */
gcc_assert (crtl->args.pops_args < 65536);
- emit_insn (gen_split_stack_return (GEN_INT (crtl->args.pops_args)));
+ rtx_insn *ret_insn
+ = emit_insn (gen_split_stack_return (GEN_INT (crtl->args.pops_args)));
+ if ((flag_cf_protection & CF_BRANCH) && TARGET_IBT)
+ {
+ rtx cet_eb = gen_nop_endbr ();
+ emit_insn_after (cet_eb, ret_insn);
+ }
/* If we are in 64-bit mode and this function uses a static chain,
we saved %r10 in %rax before calling _morestack. */
