[AArch64] Remove implicit landing pads.

[danielkiss]

Summary

PACIASP and PACIA LR, SP are equivalent from PAC point of view while PACIA is not a BTI landing pad.
Direct branch does not need a landing pad. If PACIA is available from v8.3, the unnecessary landing pads could be eliminated.
Another patch will improve the detection of the direct only calls.

[chill]

llvm/lib/Target/AArch64/AArch64BranchTargets.cpp

127

Suggest using an explicit condition, to spare the reader back-inferencing what conditions could set HintNum to 32.

132

Why not create the PACI[AB] from the very start, with a comment why are we doing it?

[chill]

llvm/lib/Target/AArch64/AArch64FrameLowering.cpp

940

Why not create the PACI[AB] from the very start, with a comment why are we doing it?

Sorry, I meant do say, create in the prologue:

• PACIA if we do know the function should/can not be called indirectly and "branch-target-enforcement" attribute is present (if it's absent, it doesn't matter which insn we emit, right?)
• PACIASP otherwise

Then this BTI placrement pass could just check

if (MBBI->getOpcode() == AArch64::PACIASP ||
  MBBI->getOpcode() == AArch64::PACIBSP ||
  MBBI->getOpcode() == AArch64::PACIA ||
   MBBI->getOpcode() == AArch64::PACIB) 
  return false;

knowing that what needs to be done has already been done.

941

Could this be refactored in a separate function and shared with the similar code that signs outlined functions?

[danielkiss]

I'm going to refactor this and rebase on my other changes.

[danielkiss]

Simplify the patch, rebased.

[danielkiss]

llvm/lib/Target/AArch64/AArch64BranchTargets.cpp

132

Just replacing them here is a why more simpler code.
I won't change the generated code if BTI is not on.

llvm/lib/Target/AArch64/AArch64FrameLowering.cpp

941

I'm going to create a new patch that removes the code duplication.

[chill]

llvm/lib/Target/AArch64/AArch64BranchTargets.cpp

132

I don't find that simpler or logical at all. We have a function called addBTI and it *removes" a BTI?
The only two things that make sense are:

• create the right instruction from the very start, we have al the necessary information to do so, it makes sense doing the right thing on the spot, instead of patching it later, which in addition to being harder to understand (you have to have knowledge and be aware of multiple parts of the code in order to figure out what's at the beginning of a function and also has time/space overheads, or
• create the non-BTI instruction and the add the BTI property in the pass that adds the BTIs

[danielkiss]

I'll update this after other PAC/BTI patches got merged.

[danielkiss]

see D99417, way different approach is needed to reduce the number of landing pads.

llvm/lib/Target/AArch64/AArch64BranchTargets.cpp

 public:
   static char ID;
   AArch64BranchTargets() : MachineFunctionPass(ID) {}
   void getAnalysisUsage(AnalysisUsage &AU) const override;
   bool runOnMachineFunction(MachineFunction &MF) override;
   StringRef getPassName() const override { return AARCH64_BRANCH_TARGETS_NAME; }
 
 private:
-  void addBTI(MachineBasicBlock &MBB, bool CouldCall, bool CouldJump);
+  bool addBTI(MachineBasicBlock &MBB, bool CouldCall, bool CouldJump);
 };
 } // end anonymous namespace
 
 char AArch64BranchTargets::ID = 0;
 
 INITIALIZE_PASS(AArch64BranchTargets, "aarch64-branch-targets",
                 AARCH64_BRANCH_TARGETS_NAME, false, false)
 
for (MachineBasicBlock &MBB : MF) {
     if (&MBB == &*MF.begin() && (F.hasAddressTaken() || !F.hasLocalLinkage()))
       CouldCall = true;
 
     // If the block itself is address-taken, it could be indirectly branched
     // to, but not called.
     if (MBB.hasAddressTaken() || JumpTableTargets.count(&MBB))
       CouldJump = true;
 
-    if (CouldCall || CouldJump) {
-      addBTI(MBB, CouldCall, CouldJump);
-      MadeChange = true;
-    }
+    if (CouldCall || CouldJump)
+      MadeChange |= addBTI(MBB, CouldCall, CouldJump);
   }
 
   return MadeChange;
 }
 
-void AArch64BranchTargets::addBTI(MachineBasicBlock &MBB, bool CouldCall,
+bool AArch64BranchTargets::addBTI(MachineBasicBlock &MBB, bool CouldCall,
                                   bool CouldJump) {
   LLVM_DEBUG(dbgs() << "Adding BTI " << (CouldJump ? "j" : "")
                     << (CouldCall ? "c" : "") << " to " << MBB.getName()
                     << "\n");
 
   const AArch64InstrInfo *TII = static_cast<const AArch64InstrInfo *>(
       MBB.getParent()->getSubtarget().getInstrInfo());
 
-  unsigned HintNum = 32;
-  if (CouldCall)
-    HintNum |= 2;
-  if (CouldJump)
-    HintNum |= 4;
-  assert(HintNum != 32 && "No target kinds!");
-
   auto MBBI = MBB.begin();
 
-  // Skip the meta instuctions, those will be removed anyway.
+  // Skip the meta instructions, those will be removed anyway.
   for (; MBBI != MBB.end() && MBBI->isMetaInstruction(); ++MBBI)
     ;
 
+  if (MBBI == MBB.end())
+    return false;
+
+  const AArch64Subtarget &Subtarget =
+      MBB.getParent()->getSubtarget<AArch64Subtarget>();
+
   // PACI[AB]SP are implicitly BTI JC, so no BTI instruction needed there.
-  if (MBBI != MBB.end() && (MBBI->getOpcode() == AArch64::PACIASP ||
-                            MBBI->getOpcode() == AArch64::PACIBSP))
-    return;
+  if (MBBI->getOpcode() == AArch64::PACIASP ||
+      MBBI->getOpcode() == AArch64::PACIBSP)
+    return false;
+
+  // Check if PACI[AB] LR, SP is the first instruction.
+  if (Subtarget.hasV8_3aOps() &&
+      (MBBI->getOpcode() == AArch64::PACIA ||
+       MBBI->getOpcode() == AArch64::PACIB) &&
+      (MBBI->getNumOperands() == 2 &&
+       MBBI->getOperand(0).getReg() == AArch64::LR &&
+       MBBI->getOperand(1).getReg() == AArch64::SP)) {
+
+    BuildMI(MBB, MBBI, MBB.findDebugLoc(MBB.begin()),
+            TII->get(MBBI->getOpcode() == AArch64::PACIA ? AArch64::PACIASP
+                                                         : AArch64::PACIBSP));
+    MBB.erase(MBBI);
+    return true;
+  }
+
+  unsigned HintNum = 32;
+  if (CouldCall)
+    HintNum |= 2;
+  if (CouldJump)
+    HintNum |= 4;
+  assert(HintNum != 32 && "No target kinds!");
 
   BuildMI(MBB, MBB.begin(), MBB.findDebugLoc(MBB.begin()),
           TII->get(AArch64::HINT))
       .addImm(HintNum);
+  return true;
 }

llvm/lib/Target/AArch64/AArch64FrameLowering.cpp

void AArch64FrameLowering::emitPrologue(MachineFunction &MF,
   // assume that's false and set it to true in the case that there's a redzone.
   AFI->setHasRedZone(false);
 
   // Debug location must be unknown since the first debug location is used
   // to determine the end of the prologue.
   DebugLoc DL;
 
   if (ShouldSignReturnAddress(MF)) {
-    if (ShouldSignWithAKey(MF))
+    if (ShouldSignWithAKey(MF)) {
+      if (Subtarget.hasV8_3aOps()) {
+        BuildMI(MBB, MBBI, DL, TII->get(AArch64::PACIA))
+            .addReg(AArch64::LR, RegState::Define)
+            .addReg(AArch64::SP, RegState::InternalRead)
+            .setMIFlag(MachineInstr::FrameSetup);
+      } else {
         BuildMI(MBB, MBBI, DL, TII->get(AArch64::PACIASP))
             .setMIFlag(MachineInstr::FrameSetup);
-    else {
+      }
+    } else {
       BuildMI(MBB, MBBI, DL, TII->get(AArch64::EMITBKEY))
           .setMIFlag(MachineInstr::FrameSetup);
+      if (Subtarget.hasV8_3aOps()) {
+        BuildMI(MBB, MBBI, DL, TII->get(AArch64::PACIB))
+            .addReg(AArch64::LR, RegState::Define)
+            .addReg(AArch64::SP, RegState::InternalRead)
+            .setMIFlag(MachineInstr::FrameSetup);
+      } else {
         BuildMI(MBB, MBBI, DL, TII->get(AArch64::PACIBSP))
             .setMIFlag(MachineInstr::FrameSetup);
       }
+    }
 
     unsigned CFIIndex =
         MF.addFrameInst(MCCFIInstruction::createNegateRAState(nullptr));
     BuildMI(MBB, MBBI, DL, TII->get(TargetOpcode::CFI_INSTRUCTION))
         .addCFIIndex(CFIIndex)
         .setMIFlags(MachineInstr::FrameSetup);
   }
 

llvm/lib/Target/AArch64/AArch64InstrInfo.cpp

AArch64InstrInfo::getOutliningType(MachineBasicBlock::iterator &MIT,
   MachineInstr &MI = *MIT;
   MachineBasicBlock *MBB = MI.getParent();
   MachineFunction *MF = MBB->getParent();
   AArch64FunctionInfo *FuncInfo = MF->getInfo<AArch64FunctionInfo>();
 
   // Don't outline anything used for return address signing. The outlined
   // function will get signed later if needed
   switch (MI.getOpcode()) {
+  case AArch64::PACIA:
+  case AArch64::PACIB:
+    /* PACI[A|B] LR, SP is same as PACI[A|B]SP */
+    if (MI.getNumOperands() == 2 && MI.getOperand(0).getReg() == AArch64::LR &&
+        MI.getOperand(1).getReg() == AArch64::SP)
+      return outliner::InstrType::Illegal;
+    break;
   case AArch64::PACIASP:
   case AArch64::PACIBSP:
   case AArch64::AUTIASP:
   case AArch64::AUTIBSP:
   case AArch64::RETAA:
   case AArch64::RETAB:
   case AArch64::EMITBKEY:
     return outliner::InstrType::Illegal;
if (ShouldSignReturnAddr) {
     const AArch64Subtarget &Subtarget = MF.getSubtarget<AArch64Subtarget>();
     const TargetInstrInfo *TII = Subtarget.getInstrInfo();
     DebugLoc DL;
 
     if (MBBAUT != MBB.end())
       DL = MBBAUT->getDebugLoc();
 
     // At the very beginning of the basic block we insert the following
-    // depending on the key type
+    // depending on the key type.
+    // PACI[A|B] LR, SP is effectively the same PAuth instruction as PACI[A|B]SP
+    // except it is not a BTI landing pad. BTI pass will manage the BTI property
+    // accordingly.
     //
     // a_key:                   b_key:
     //    PACIASP                   EMITBKEY
     //    CFI_INSTRUCTION           PACIBSP
     //                              CFI_INSTRUCTION
     if (ShouldSignReturnAddrWithAKey) {
+      if (Subtarget.hasV8_3aOps()) {
+        BuildMI(MBB, MBBPAC, DebugLoc(), TII->get(AArch64::PACIA))
+            .addReg(AArch64::LR, RegState::Define)
+            .addReg(AArch64::SP, RegState::InternalRead)
+            .setMIFlag(MachineInstr::FrameSetup);
+      } else {
         BuildMI(MBB, MBBPAC, DebugLoc(), TII->get(AArch64::PACIASP))
             .setMIFlag(MachineInstr::FrameSetup);
+      }
     } else {
       BuildMI(MBB, MBBPAC, DebugLoc(), TII->get(AArch64::EMITBKEY))
           .setMIFlag(MachineInstr::FrameSetup);
+      if (Subtarget.hasV8_3aOps()) {
+        BuildMI(MBB, MBBPAC, DebugLoc(), TII->get(AArch64::PACIB))
+            .addReg(AArch64::LR, RegState::Define)
+            .addReg(AArch64::SP, RegState::InternalRead)
+            .setMIFlag(MachineInstr::FrameSetup);
+      } else {
         BuildMI(MBB, MBBPAC, DebugLoc(), TII->get(AArch64::PACIBSP))
             .setMIFlag(MachineInstr::FrameSetup);
       }
+    }
     unsigned CFIIndex =
         MF.addFrameInst(MCCFIInstruction::createNegateRAState(nullptr));
     BuildMI(MBB, MBBPAC, DebugLoc(), TII->get(AArch64::CFI_INSTRUCTION))
         .addCFIIndex(CFIIndex)
         .setMIFlags(MachineInstr::FrameSetup);
 
     // If v8.3a features are available we can replace a RET instruction by
     // RETAA or RETAB and omit the AUT instructions

llvm/test/CodeGen/AArch64/branch-target-enforcement-direct-calls.ll

+; RUN: llc -mtriple aarch64--none-eabi -mattr=+bti < %s | FileCheck %s --check-prefixes=CHECK,CHECK8_0
+; RUN: llc -mtriple aarch64--none-eabi -mattr=+bti -mattr=v8.3a < %s | FileCheck %s --check-prefixes=CHECK,CHECK8_3
+
+target datalayout = "e-m:e-i8:8:32-i16:16:32-i64:64-i128:128-n32:64-S128"
+target triple = "aarch64-arm-none-eabi"
+
+; When BTI is enabled and Arm v8.3 is avaliable then in case of function that is called
+; only with direct branch the landing pad should be replaced with an equivalent non landing
+; instruction.
+
+define internal void @localfunc() #0 {
+;CHECK:  localfunc:
+;CHECK8_0:          hint    #25
+;CHECK8_3:          pacia x30, sp
+entry:
+  %l1 = alloca i32, align 4
+  ret void
+}
+
+; Global function should have landing pad. Note hint #25 is paciasp.
+;CHECK: bti_enabled:
+;CHECK8_0:        hint    #25
+;CHECK8_3:        paciasp
+define void @bti_enabled() #0  {
+entry:
+  %l1 = alloca i32, align 4
+  tail call void @localfunc()
+  ret void
+}
+
+attributes #0 = { noinline  "branch-target-enforcement" "sign-return-address"="all" "sign-return-address-key"="a_key" }
 No newline at end of file

llvm/test/CodeGen/AArch64/machine-outliner-retaddr-sign-sp-mod.ll

 ; RUN: llc -mtriple aarch64-arm-none-eabi -enable-machine-outliner \
 ; RUN:  -verify-machineinstrs %s -o - | FileCheck %s
 
 @v = common dso_local global i32* null, align 8
 
 ; CHECK-LABEL:  foo:                                    // @foo
 ; CHECK-NEXT:   .Lfoo$local:
 ; CHECK-NEXT:   // %bb.0:                               // %entry
-; CHECK-NEXT:       paciasp
+; CHECK-NEXT:       pacia x30, sp
 ; CHECK-NOT:        OUTLINED_FUNCTION_
 ; CHECK:            retaa
 define dso_local void @foo(i32 %x) #0 {
 entry:
   %0 = zext i32 %x to i64
   %vla = alloca i32, i64 %0, align 4
   store volatile i32* %vla, i32** @v, align 8
   store volatile i32* %vla, i32** @v, align 8
   store volatile i32* %vla, i32** @v, align 8
   store volatile i32* %vla, i32** @v, align 8
   store volatile i32* %vla, i32** @v, align 8
   store volatile i32* %vla, i32** @v, align 8
   ret void
 }
 
 ; CHECK-LABEL:  bar:                                    // @bar
 ; CHECK-NEXT:   .Lbar$local:
 ; CHECK-NEXT:   // %bb.0:                               // %entry
-; CHECK-NEXT:       paciasp
+; CHECK-NEXT:       pacia x30, sp
 ; CHECK-NOT:        OUTLINED_FUNCTION_
 ; CHECK:            retaa
 define dso_local void @bar(i32 %x) #0 {
 entry:
   %0 = zext i32 %x to i64
   %vla = alloca i32, i64 %0, align 4
   store volatile i32* null, i32** @v, align 8
   store volatile i32* %vla, i32** @v, align 8

llvm/test/CodeGen/AArch64/machine-outliner-retaddr-sign-subtarget.ll

 ; RUN: llc -verify-machineinstrs -enable-machine-outliner -mtriple \
 ; RUN: aarch64-arm-linux-gnu %s -o - | FileCheck %s
 
 ; Check that functions that should sign their return addresses don't get
 ; outlined if not all of the function either support v8.3a features or all of
 ; the functions don't!!
 
 define void @a() #0 {
 ; CHECK-LABEL:      a:                                     // @a
 ; CHECK:            // %bb.0:
 ; CHECK-NEXT:               .cfi_b_key_frame
-; CHECK-NEXT:               pacibsp
+; CHECK-NEXT:               pacib   x30, sp
 ; CHECK-NEXT:               .cfi_negate_ra_state
 ; CHECK-NOT:                OUTLINED_FUNCTION_
   %1 = alloca i32, align 4
   %2 = alloca i32, align 4
   %3 = alloca i32, align 4
   %4 = alloca i32, align 4
   %5 = alloca i32, align 4
   %6 = alloca i32, align 4
   store i32 1, i32* %1, align 4
   store i32 2, i32* %2, align 4
   store i32 3, i32* %3, align 4
   store i32 4, i32* %4, align 4
   store i32 5, i32* %5, align 4
   store i32 6, i32* %6, align 4
 ; CHECK:                  retab
 ; CHECK-NOT:              auti[a,b]sp
   ret void
 }
 
 define void @b() #0 {
 ; CHECK-LABEL:      b:                                     // @b
 ; CHECK:            // %bb.0:
 ; CHECK-NEXT:               .cfi_b_key_frame
-; CHECK-NEXT:               pacibsp
+; CHECK-NEXT:               pacib   x30, sp
 ; CHECK-NEXT:               .cfi_negate_ra_state
 ; CHECK-NOT:                OUTLINED_FUNCTION_
   %1 = alloca i32, align 4
   %2 = alloca i32, align 4
   %3 = alloca i32, align 4
   %4 = alloca i32, align 4
   %5 = alloca i32, align 4
   %6 = alloca i32, align 4

llvm/test/CodeGen/AArch64/machine-outliner-retaddr-sign-v8-3.ll

 ; RUN: llc -verify-machineinstrs -enable-machine-outliner -mtriple \
 ; RUN: aarch64-arm-linux-gnu %s -o - | FileCheck %s
 
 ; Check that outlined functions use the dedicated RETAA/RETAB instructions
 ; to sign their return address if available.
 
 define void @a() #0 {
 ; CHECK-LABEL:      a:                                     // @a
 ; CHECK:            // %bb.0:
-; CHECK-NEXT:               pacibsp
+; CHECK-NEXT:               pacib x30, sp
 ; CHECK:                    bl [[OUTLINED_FUNC:OUTLINED_FUNCTION_[0-9]+]]
   %1 = alloca i32, align 4
   %2 = alloca i32, align 4
   %3 = alloca i32, align 4
   %4 = alloca i32, align 4
   %5 = alloca i32, align 4
   %6 = alloca i32, align 4
   store i32 1, i32* %1, align 4
   store i32 2, i32* %2, align 4
   store i32 3, i32* %3, align 4
   store i32 4, i32* %4, align 4
   store i32 5, i32* %5, align 4
   store i32 6, i32* %6, align 4
 ; CHECK:                  retab
 ; CHECK-NOT:              auti[a,b]sp
   ret void
 }
 
 define void @b() #0 {
 ; CHECK-LABEL:      b:                                     // @b
 ; CHECK:            // %bb.0:
-; CHECK-NEXT:               pacibsp
+; CHECK-NEXT:               pacib x30, sp
 ; CHECK:                    bl OUTLINED_FUNC
   %1 = alloca i32, align 4
   %2 = alloca i32, align 4
   %3 = alloca i32, align 4
   %4 = alloca i32, align 4
   %5 = alloca i32, align 4
   %6 = alloca i32, align 4
   store i32 1, i32* %1, align 4
   store i32 2, i32* %2, align 4
   store i32 3, i32* %3, align 4
   store i32 4, i32* %4, align 4
   store i32 5, i32* %5, align 4
   store i32 6, i32* %6, align 4
 ; CHECK:                  retab
 ; CHECK-NOT:              auti[a,b]sp
   ret void
 }
 
 define void @c() #0 {
 ; CHECK-LABEL:      c:                                     // @c
 ; CHECK:            // %bb.0:
-; CHECK-NEXT:               pacibsp
+; CHECK-NEXT:               pacib x30, sp
 ; CHECK:                    bl OUTLINED_FUNC
   %1 = alloca i32, align 4
   %2 = alloca i32, align 4
   %3 = alloca i32, align 4
   %4 = alloca i32, align 4
   %5 = alloca i32, align 4
   %6 = alloca i32, align 4
   store i32 1, i32* %1, align 4

 attributes #0 = { "sign-return-address"="all"
                   "sign-return-address-key"="b_key"
                   "target-features"="+v8.3a"
                   nounwind }
 
 ; CHECK:            OUTLINED_FUNC
 ; CHECK:            // %bb.0:
 ; CHECK-NEXT:               .cfi_b_key_frame
-; CHECK-NEXT:               pacibsp
+; CHECK-NEXT:               pacib x30, sp
 ; CHECK:                    retab
 ; CHECK-NOT:                auti[a,b]sp

llvm/test/CodeGen/AArch64/sign-return-address-cfi-negate-ra-state.ll

 ; RUN: llc -mtriple=aarch64-none-eabi < %s | FileCheck --check-prefixes CHECK,CHECK-V8A %s
 ; RUN: llc -mtriple=aarch64-none-eabi -mattr=v8.3a < %s | FileCheck --check-prefixes CHECK,CHECK-V83A %s
 ; RUN: llc -mtriple=aarch64-none-eabi -filetype=obj -o - <%s | llvm-dwarfdump -v - | FileCheck --check-prefix=CHECK-DUMP %s
 
 @.str = private unnamed_addr constant [15 x i8] c"some exception\00", align 1
 @_ZTIPKc = external dso_local constant i8*
 
 ; CHECK: @_Z3fooi
 ; CHECK-V8A: hint #25
-; CHECK-V83A: paciasp
+; CHECK-V83A: pacia x30, sp
 ; CHECK-NEXT: .cfi_negate_ra_state
 ; CHECK-NOT: .cfi_negate_ra_state
 define dso_local i32 @_Z3fooi(i32 %x) #0 {
 entry:
   %retval = alloca i32, align 4
   %x.addr = alloca i32, align 4
   store i32 %x, i32* %x.addr, align 4
   %exception = call i8* @__cxa_allocate_exception(i64 8) #1

llvm/test/CodeGen/AArch64/sign-return-address.ll

 define i32 @leaf_sign_non_leaf(i32 %x) "sign-return-address"="non-leaf"  {
   ret i32 %x
 }
 
 ; CHECK-LABEL: @leaf_sign_all
 ; CHECK:       hint #25
 ; CHECK:       hint #29
 ; CHECK:       ret
-; CHECK-V83A:  paciasp
+; CHECK-V83A:  pacia x30, sp
 ; CHECK-V83A:  retaa
 define i32 @leaf_sign_all(i32 %x) "sign-return-address"="all" {
   ret i32 %x
 }
 
 ; CHECK:             @leaf_clobbers_lr
 ; CHECK:             hint #25
-; CHECK-V83A:        paciasp
+; CHECK-V83A:        pacia x30, sp
 ; CHECK, CHECK-V83A: str x30, [sp, #-16]!
 ; CHECK, CHECK-V83A: ldr x30, [sp], #16
 ; CHECK:             hint #29
 ; CHECK:             ret
 ; CHECK-V32A-NEXT:   retaa
 define i64 @leaf_clobbers_lr(i64 %x) "sign-return-address"="non-leaf"  {
   call void asm sideeffect "mov x30, $0", "r,~{lr}"(i64 %x) #1
   ret i64 %x
 }
 
 declare i32 @foo(i32)
 
 ; CHECK:      @non_leaf_sign_all
 ; CHECK:      hint #25
 ; CHECK:      hint #29
 ; CHECK:      ret
-; CHECK-V83A: paciasp
+; CHECK-V83A: pacia x30, sp
 ; CHECK-V83A: retaa
 define i32 @non_leaf_sign_all(i32 %x) "sign-return-address"="all" {
   %call = call i32 @foo(i32 %x)
   ret i32 %call
 }
 
 ; CHECK:             @non_leaf_sign_non_leaf
 ; CHECK:             hint #25
-; CHECK-V83A:        paciasp
+; CHECK-V83A:        pacia x30, sp
 ; CHECK, CHECK-V83A: str x30, [sp, #-16]!
 ; CHECK, CHECK-V83A: ldr x30, [sp], #16
 ; CHECK:             hint #29
 ; CHECK:             ret
 ; CHECK-V83A:        retaa
 define i32 @non_leaf_sign_non_leaf(i32 %x) "sign-return-address"="non-leaf"  {
   %call = call i32 @foo(i32 %x)
   ret i32 %call
 }
 
 ; CHECK-LABEL: @leaf_sign_all_v83
-; CHECK: paciasp
+; CHECK: pacia x30, sp
 ; CHECK-NOT: ret
 ; CHECK: retaa
 ; CHECK-NOT: ret
 define i32 @leaf_sign_all_v83(i32 %x) "sign-return-address"="all" "target-features"="+v8.3a" {
   ret i32 %x
 }
 
 declare fastcc i64 @bar(i64)
 
 ; CHECK-LABEL:       @spill_lr_and_tail_call
 ; CHECK:             hint #25
-; CHECK-V83A:        paciasp
+; CHECK-V83A:        pacia x30, sp
 ; CHECK, CHECK-V83A: str x30, [sp, #-16]!
 ; CHECK, CHECK-V83A: ldr x30, [sp], #16
 ; CHECK-V83A:        autiasp
 ; CHECK:             hint #29
 ; CHECK:             b bar
 define fastcc void @spill_lr_and_tail_call(i64 %x) "sign-return-address"="all" {
   call void asm sideeffect "mov x30, $0", "r,~{lr}"(i64 %x) #1
   tail call fastcc i64 @bar(i64 %x)
   ret void
 }
 
 ; CHECK-LABEL: @leaf_sign_all_a_key
 ; CHECK:       hint #25
 ; CHECK:       hint #29
-; CHECK-V83A:  paciasp
+; CHECK-V83A:  pacia x30, sp
 ; CHECK-V83A:  retaa
 define i32 @leaf_sign_all_a_key(i32 %x) "sign-return-address"="all" "sign-return-address-key"="a_key" {
   ret i32 %x
 }
 
 ; CHECK-LABEL: @leaf_sign_all_b_key
 ; CHECK:       hint #27
 ; CHECK:       hint #31
-; CHECK-V83A:  pacibsp
+; CHECK-V83A:  pacib x30, sp
 ; CHECK-V83A:  retab
 define i32 @leaf_sign_all_b_key(i32 %x) "sign-return-address"="all" "sign-return-address-key"="b_key" {
   ret i32 %x
 }
 
 ; CHECK-LABEL: @leaf_sign_all_v83_b_key
-; CHECK: pacibsp
+; CHECK: pacib x30, sp
 ; CHECK-NOT: ret
 ; CHECK: retab
 ; CHECK-NOT: ret
 define i32 @leaf_sign_all_v83_b_key(i32 %x) "sign-return-address"="all" "target-features"="+v8.3a" "sign-return-address-key"="b_key" {
   ret i32 %x
 }