[AArch64][v8.3A] Avoid inserting implicit landing pads (PACI*SP)

[pbarrio]

Summary

PACI*SP have the advantage that they are in HINT space, meaning
they can be run successfully in hardware without PAuth support -
they will just behave as a NOP. However, PACI*SP are also implicit
landing pads (think of an extra BTI jc). Therefore, they allow
indirect jumps of all kinds into them, potentially inserting new
gadgets. This patch replaces PACI*SP by PACI* LR, SP when
compiling explicitly for hardware with full PAuth support. PACI*
is not in the HINT space, therefore it will fault when run in
hardware without PAuth support, but it is also not a landing pad,
making programs safer in newer HW.

[danielkiss]

Wondering if AArch64InstrInfo::getOutliningType and the outline should do the same because it might emit PACIASP.
see the old change:
https://reviews.llvm.org/D77565?id=256025#change-SC49e8S7FnMX

llvm/lib/Target/AArch64/AArch64FrameLowering.cpp

1126

maybe.

[pbarrio]

Added handling of outlining for PACI* similarly to PACI*SP etc, and RegState info to SP.

[pbarrio]

Updated PAC handling in the outliner. Now all outlined functions should use v8.3a instructions where possible.

[pbarrio]

All comments addressed (thank you @danielkiss). Does it look reasonable now?

[pbarrio]

Ping

[tamas.petz]

LGTM

[pbarrio]

Ping

[efriedma]

llvm/lib/Target/AArch64/AArch64InstrInfo.cpp

6841 ↗

(On Diff #345102)

This isn't necessary, I think. The PACIA has an explicit "LR" operand, which should block outlining anyway.

[pbarrio]

@efriedma thank you for the review. Commit updated without the special outlining handling.

[pbarrio]

llvm/lib/Target/AArch64/AArch64InstrInfo.cpp

6841 ↗

(On Diff #345102)

You are right. I remember I broke the outlining tests at some point and I thought this special-casing fixed them. The tests below are now passing without the special cases, though, so I may be imagining things.

[efriedma]

LGTM

[pbarrio]

The following commit added a register in the definition of the PAC instructions:

https://reviews.llvm.org/rGea0eec69f16e0f1b00fec413986e4e44f6f627fa

Patch updated to add the register when building the MI.

[pbarrio]

I'll leave the review open for a couple of days in case anyone sees a problem with the additional .addReg(AArch64::LR), otherwise I'll commit.

[danielkiss]

LGTM, thanks!

[eugenis]

This change claims that PACIASP has an implicit BTI JC. Is that correct? From my reading of the spec (and I have about 50% certainty that I'm right), the behavior is actually the same as of BTI C. At least this is true on Linux, where SCTRL_EL1.BT0 is set to 1.

I'm asking because -mbranch-protection=standard emits shorter code sequence with -march=armv8.2-a compared to -march=armv8.3-a. See

0:   d503233f        paciasp

vs

0:   d503245f        bti     c
4:   dac103fe        pacia   x30, sp

[pbarrio]

You are right, yes, the implicit landing pad in PACIxSP is configurable through SCTRL_EL1.BT0. It can behave either as BTI c or BTI jc. Since the value of a sysreg is not known at compile time, I took the safe approach here and assumed that PACIxSP could allow all kinds of jumps and therefore they would be unsafe: better have an explicit BTI c than an implicit BTI jc.

We could take the efficient approach and go back to emitting PACIxSP. It may not be a problem in practice if we are reasonably sure that SCTRL_EL1.BT0 will be 1 in most cases. Worst case, we could allow changing the default behaviour with a CLI flag (e.g. adding another value for -mbranch-protection), or with the triple's ABI field if the decision will be taken by the platform ABI (i.e. --target=*-linux)?

I don't have a strong opinion.

[eugenis]

I think using the environment part of the triple is the right choice. We could also just go ahead and flip the current behavior until there is evidence of a platform that configures SCTRL_EL1.BT0 differently, at which point they can implement the triple logic.

This has non-trivial code size impact (0.5 to 1%).

[danielkiss]

Linux kernel sets the the BT0 (and BT1) to 1 unconditionally.
This results the When the PE is executing at EL0, PACIASP and PACIBSP are not compatible with PSTATE.BTYPE == 0b11. (ArmARM)
That means PACI*SP is just a BTI C from BTI point of view.

I think right now changing the default is reasonable. (reverting this patch)
Maybe just add new subtarget feature that represent this BT flag and change the above Subtarget.hasPAuth to Subtarget.hasBTGoodName.. which is false until needed by a target.

[eugenis]

I've uploaded D141978 with a revert. I've opted against introducing a new subtarget feature because that would mean keeping dead code in the repo, without a way of testing it.

llvm/lib/Target/AArch64/AArch64FrameLowering.cpp

void AArch64FrameLowering::emitPrologue(MachineFunction &MF,
   AFI->setHasRedZone(false);
 
   // Debug location must be unknown since the first debug location is used
   // to determine the end of the prologue.
   DebugLoc DL;
 
   const auto &MFnI = *MF.getInfo<AArch64FunctionInfo>();
   if (MFnI.shouldSignReturnAddress()) {
+
+    unsigned PACI;
     if (MFnI.shouldSignWithBKey()) {
       BuildMI(MBB, MBBI, DL, TII->get(AArch64::EMITBKEY))
           .setMIFlag(MachineInstr::FrameSetup);
-      BuildMI(MBB, MBBI, DL, TII->get(AArch64::PACIBSP))
-          .setMIFlag(MachineInstr::FrameSetup);
+      PACI = Subtarget.hasPAuth() ? AArch64::PACIB : AArch64::PACIBSP;
     } else {
-      BuildMI(MBB, MBBI, DL, TII->get(AArch64::PACIASP))
-          .setMIFlag(MachineInstr::FrameSetup);
+      PACI = Subtarget.hasPAuth() ? AArch64::PACIA : AArch64::PACIASP;
     }
 
+    auto MI = BuildMI(MBB, MBBI, DL, TII->get(PACI));
+    if (Subtarget.hasPAuth())
+      MI.addReg(AArch64::LR, RegState::Define).addReg(AArch64::SP);
+    MI.setMIFlag(MachineInstr::FrameSetup);
+
     unsigned CFIIndex =
         MF.addFrameInst(MCCFIInstruction::createNegateRAState(nullptr));
     BuildMI(MBB, MBBI, DL, TII->get(TargetOpcode::CFI_INSTRUCTION))
         .addCFIIndex(CFIIndex)
         .setMIFlags(MachineInstr::FrameSetup);
   }
 
   // All calls are tail calls in GHC calling conv, and functions have no

llvm/test/CodeGen/AArch64/aarch64-signedreturnaddress.ll

 ; RUN: llc < %s -mtriple=arm64-eabi -asm-verbose=false -mattr=v8.2a | FileCheck %s
 ; RUN: llc < %s -mtriple=arm64-eabi -asm-verbose=false -mattr=v8.3a | FileCheck %s --check-prefix=CHECKV83
 
-; Armv8.3-A Pointer Authetication requires a special intsruction to strip the
+; Armv8.3-A Pointer Authetication requires a special instruction to strip the
 ; pointer authentication code from the pointer.
 ; The XPACLRI instruction assembles to a hint-space instruction before Armv8.3-A
 ; therefore this instruction can be safely used for any pre Armv8.3-A architectures.
 ; On Armv8.3-A and onwards XPACI is available so use that instead.
 
 define i8* @ra0() nounwind readnone {
 entry:
 ; CHECK-LABEL: ra0:

 ; CHECK-LABEL: ra1:
 ; CHECK:          hint    #25
 ; CHECK-NEXT:     str     x30, [sp, #-16]!
 ; CHECK-NEXT:     hint    #7
 ; CHECK-NEXT:     mov     x0, x30
 ; CHECK-NEXT:     ldr     x30, [sp], #16
 ; CHECK-NEXT:     hint    #29
 ; CHECK-NEXT:     ret
-; CHECKV83:       paciasp
+; CHECKV83:       pacia   x30, sp
 ; CHECKV83-NEXT:  str     x30, [sp, #-16]!
 ; CHECKV83-NEXT:  xpaci   x30
 ; CHECKV83-NEXT:  mov     x0, x30
 ; CHECKV83-NEXT:  ldr     x30, [sp], #16
 ; CHECKV83-NEXT:  retaa
   %0 = tail call i8* @llvm.returnaddress(i32 0)
   ret i8* %0
 }
 
 attributes #0 = { "sign-return-address"="all" }
 
 declare i8* @llvm.returnaddress(i32) nounwind readnone

llvm/test/CodeGen/AArch64/machine-outliner-retaddr-sign-sp-mod.ll

 ; RUN: llc -mtriple aarch64-arm-none-eabi -enable-machine-outliner \
 ; RUN:  -verify-machineinstrs %s -o - | FileCheck %s
 
 @v = common dso_local global i32* null, align 8
 
 ; CHECK-LABEL:  foo:                                    // @foo
 ; CHECK-NEXT:   // %bb.0:                               // %entry
-; CHECK-NEXT:       paciasp
+; CHECK-NEXT:       pacia x30, sp
 ; CHECK-NOT:        OUTLINED_FUNCTION_
 ; CHECK:            retaa
 define dso_local void @foo(i32 %x) #0 {
 entry:
   %0 = zext i32 %x to i64
   %vla = alloca i32, i64 %0, align 4
   store volatile i32* %vla, i32** @v, align 8
   store volatile i32* %vla, i32** @v, align 8
   store volatile i32* %vla, i32** @v, align 8
   store volatile i32* %vla, i32** @v, align 8
   store volatile i32* %vla, i32** @v, align 8
   store volatile i32* %vla, i32** @v, align 8
   ret void
 }
 
 ; CHECK-LABEL:  bar:                                    // @bar
 ; CHECK-NEXT:   // %bb.0:                               // %entry
-; CHECK-NEXT:       paciasp
+; CHECK-NEXT:       pacia x30, sp
 ; CHECK-NOT:        OUTLINED_FUNCTION_
 ; CHECK:            retaa
 define dso_local void @bar(i32 %x) #0 {
 entry:
   %0 = zext i32 %x to i64
   %vla = alloca i32, i64 %0, align 4
   store volatile i32* null, i32** @v, align 8
   store volatile i32* %vla, i32** @v, align 8

llvm/test/CodeGen/AArch64/machine-outliner-retaddr-sign-subtarget.ll

 ; RUN: llc -verify-machineinstrs -enable-machine-outliner -mtriple \
 ; RUN: aarch64-arm-linux-gnu %s -o - | FileCheck %s
 
 ; Check that functions that should sign their return addresses don't get
 ; outlined if not all of the function either support v8.3a features or all of
 ; the functions don't!!
 
 define void @a() #0 {
 ; CHECK-LABEL:      a:                                     // @a
 ; CHECK:            // %bb.0:
 ; CHECK-NEXT:               .cfi_b_key_frame
-; CHECK-NEXT:               pacibsp
+; CHECK-NEXT:               pacib x30, sp
 ; CHECK-NEXT:               .cfi_negate_ra_state
 ; CHECK-NOT:                OUTLINED_FUNCTION_
   %1 = alloca i32, align 4
   %2 = alloca i32, align 4
   %3 = alloca i32, align 4
   %4 = alloca i32, align 4
   %5 = alloca i32, align 4
   %6 = alloca i32, align 4
   store i32 1, i32* %1, align 4
   store i32 2, i32* %2, align 4
   store i32 3, i32* %3, align 4
   store i32 4, i32* %4, align 4
   store i32 5, i32* %5, align 4
   store i32 6, i32* %6, align 4
 ; CHECK:                  retab
 ; CHECK-NOT:              auti[a,b]sp
   ret void
 }
 
 define void @b() #0 {
 ; CHECK-LABEL:      b:                                     // @b
 ; CHECK:            // %bb.0:
 ; CHECK-NEXT:               .cfi_b_key_frame
-; CHECK-NEXT:               pacibsp
+; CHECK-NEXT:               pacib x30, sp
 ; CHECK-NEXT:               .cfi_negate_ra_state
 ; CHECK-NOT:                OUTLINED_FUNCTION_
   %1 = alloca i32, align 4
   %2 = alloca i32, align 4
   %3 = alloca i32, align 4
   %4 = alloca i32, align 4
   %5 = alloca i32, align 4
   %6 = alloca i32, align 4

llvm/test/CodeGen/AArch64/machine-outliner-retaddr-sign-v8-3.ll

 ; RUN: llc -verify-machineinstrs -enable-machine-outliner -mtriple \
 ; RUN: aarch64-arm-linux-gnu %s -o - | FileCheck %s
 
 ; Check that outlined functions use the dedicated RETAA/RETAB instructions
 ; to sign their return address if available.
 
 define void @a() #0 {
 ; CHECK-LABEL:      a:                                     // @a
 ; CHECK:            // %bb.0:
-; CHECK-NEXT:               pacibsp
+; CHECK-NEXT:               pacib x30, sp
 ; CHECK:                    bl [[OUTLINED_FUNC:OUTLINED_FUNCTION_[0-9]+]]
   %1 = alloca i32, align 4
   %2 = alloca i32, align 4
   %3 = alloca i32, align 4
   %4 = alloca i32, align 4
   %5 = alloca i32, align 4
   %6 = alloca i32, align 4
   store i32 1, i32* %1, align 4
   store i32 2, i32* %2, align 4
   store i32 3, i32* %3, align 4
   store i32 4, i32* %4, align 4
   store i32 5, i32* %5, align 4
   store i32 6, i32* %6, align 4
 ; CHECK:                  retab
-; CHECK-NOT:              auti[a,b]sp
+; CHECK-NOT:              auti
   ret void
 }
 
 define void @b() #0 {
 ; CHECK-LABEL:      b:                                     // @b
 ; CHECK:            // %bb.0:
-; CHECK-NEXT:               pacibsp
+; CHECK-NEXT:               pacib x30, sp
 ; CHECK:                    bl OUTLINED_FUNC
   %1 = alloca i32, align 4
   %2 = alloca i32, align 4
   %3 = alloca i32, align 4
   %4 = alloca i32, align 4
   %5 = alloca i32, align 4
   %6 = alloca i32, align 4
   store i32 1, i32* %1, align 4
   store i32 2, i32* %2, align 4
   store i32 3, i32* %3, align 4
   store i32 4, i32* %4, align 4
   store i32 5, i32* %5, align 4
   store i32 6, i32* %6, align 4
 ; CHECK:                  retab
-; CHECK-NOT:              auti[a,b]sp
+; CHECK-NOT:              auti
   ret void
 }
 
 define void @c() #0 {
 ; CHECK-LABEL:      c:                                     // @c
 ; CHECK:            // %bb.0:
-; CHECK-NEXT:               pacibsp
+; CHECK-NEXT:               pacib x30, sp
 ; CHECK:                    bl OUTLINED_FUNC
   %1 = alloca i32, align 4
   %2 = alloca i32, align 4
   %3 = alloca i32, align 4
   %4 = alloca i32, align 4
   %5 = alloca i32, align 4
   %6 = alloca i32, align 4
   store i32 1, i32* %1, align 4
   store i32 2, i32* %2, align 4
   store i32 3, i32* %3, align 4
   store i32 4, i32* %4, align 4
   store i32 5, i32* %5, align 4
   store i32 6, i32* %6, align 4
 ; CHECK:                  retab
-; CHECK-NOT:              auti[a,b]sp
+; CHECK-NOT:              auti
   ret void
 }
 
 attributes #0 = { "sign-return-address"="all"
                   "sign-return-address-key"="b_key"
                   "target-features"="+v8.3a"
                   nounwind }
 
 ; CHECK:            OUTLINED_FUNC
 ; CHECK:            // %bb.0:
 ; CHECK-NEXT:               pacibsp
 ; CHECK:                    retab
 ; CHECK-NOT:                auti[a,b]sp

llvm/test/CodeGen/AArch64/pacbti-llvm-generated-funcs-2.ll

 ;; RUN: llc --mattr=+v8.3a %s -o - | FileCheck %s
 target datalayout = "e-m:e-i8:8:32-i16:16:32-i64:64-i128:128-n32:64-S128"
 target triple = "aarch64-unknown-linux"
 
 @__llvm_gcov_ctr = internal global [1 x i64] zeroinitializer
 @0 = private unnamed_addr constant [7 x i8] c"m.gcda\00", align 1
 @llvm.global_ctors = appending global [1 x { i32, void ()*, i8* }] [{ i32, void ()*, i8* } { i32 0, void ()* @__llvm_gcov_init, i8* null }]
 
 define dso_local i32 @f() local_unnamed_addr #0 {
 entry:
   ret i32 0
 }
 ;; CHECK-LABEL: f:
-;; CHECK: pacibsp
+;; CHECK: pacib x30, sp
 
 declare void @llvm_gcda_start_file(i8*, i32, i32) local_unnamed_addr
 
 declare void @llvm_gcda_emit_function(i32, i32, i32) local_unnamed_addr
 
 declare void @llvm_gcda_emit_arcs(i32, i64*) local_unnamed_addr
 
 declare void @llvm_gcda_summary_info() local_unnamed_addr
 
 declare void @llvm_gcda_end_file() local_unnamed_addr
 
 define internal void @__llvm_gcov_writeout() unnamed_addr #1 {
 entry:
   tail call void @llvm_gcda_start_file(i8* getelementptr inbounds ([7 x i8], [7 x i8]* @0, i64 0, i64 0), i32 875575338, i32 0)
   tail call void @llvm_gcda_emit_function(i32 0, i32 0, i32 0)
   tail call void @llvm_gcda_emit_arcs(i32 1, i64* getelementptr inbounds ([1 x i64], [1 x i64]* @__llvm_gcov_ctr, i64 0, i64 0))
   tail call void @llvm_gcda_summary_info()
   tail call void @llvm_gcda_end_file()
   ret void
 }
 ;; CHECK-LABEL: __llvm_gcov_writeout:
 ;; CHECK:       .cfi_b_key_frame
-;; CHECK-NEXT:  pacibsp
+;; CHECK-NEXT:  pacib x30, sp
 ;; CHECK-NEXT: .cfi_negate_ra_state
 
 define internal void @__llvm_gcov_reset() unnamed_addr #2 {
 entry:
   store i64 0, i64* getelementptr inbounds ([1 x i64], [1 x i64]* @__llvm_gcov_ctr, i64 0, i64 0), align 8
   ret void
 }
 ;; CHECK-LABEL: __llvm_gcov_reset:
-;; CHECK:       pacibsp
+;; CHECK:       pacib x30, sp
 
 declare void @llvm_gcov_init(void ()*, void ()*) local_unnamed_addr
 
 define internal void @__llvm_gcov_init() unnamed_addr #1 {
 entry:
   tail call void @llvm_gcov_init(void ()* nonnull @__llvm_gcov_writeout, void ()* nonnull @__llvm_gcov_reset)
   ret void
 }
 ;; CHECK-LABEL: __llvm_gcov_init:
 ;; CHECK:      .cfi_b_key_frame
-;; CHECK-NEXT:  pacibsp
+;; CHECK-NEXT:  pacib x30, sp
 ;; CHECK-NEXT: .cfi_negate_ra_state
 
 attributes #0 = { norecurse nounwind readnone "sign-return-address"="all" "sign-return-address-key"="b_key" }
 attributes #1 = { noinline }
 attributes #2 = { nofree noinline norecurse nounwind writeonly }
 
 !llvm.module.flags = !{!0, !1, !2, !3, !4, !5}
 
 !0 = !{i32 2, !"Debug Info Version", i32 3}
 !1 = !{i32 1, !"wchar_size", i32 4}
 !2 = !{i32 1, !"branch-target-enforcement", i32 0}
 !3 = !{i32 1, !"sign-return-address", i32 1}
 !4 = !{i32 1, !"sign-return-address-all", i32 1}
 !5 = !{i32 1, !"sign-return-address-with-bkey", i32 1}

llvm/test/CodeGen/AArch64/pacbti-module-attrs.ll

 
 define i32 @f2(i32 %x) #2 {
 entry:
   %call = tail call i32 @g(i32 %x) #5
   %add = add nsw i32 %call, 1
   ret i32 %add
 }
 ;; CHECK-LABEL: f2:
-;; CHECK:       paciasp
+;; CHECK:       pacia x30, sp
 ;; CHECK:       retaa
 
 define i32 @f3(i32 %x) #3 {
 entry:
   %call = tail call i32 @g(i32 %x) #5
   %add = add nsw i32 %call, 1
   ret i32 %add
 }
 ;; CHECK-LABEL: f3:
-;; CHECK:       pacibsp
+;; CHECK:       pacib x30, sp
 ;; CHECK:       retab
 
 define i32 @f4(i32 %x) #4 {
 entry:
   ret i32 1
 }
 ;; CHECK-LABEL: f4:
-;; CHECK:       paciasp
+;; CHECK:       pacia x30, sp
 ;; CHECK:       retaa
 
 define i32 @f5(i32 %x) #5 {
 entry:
   %call = tail call i32 @g(i32 %x) #5
   %add = add nsw i32 %call, 1
   ret i32 %add
 }
 ;; CHECK-LABEL: f5:
-;; CHECK:       paciasp
+;; CHECK:       pacia x30, sp
 ;; CHECK:       retaa
 
 attributes #0 = { nounwind "branch-target-enforcement"="false" "sign-return-address"="none" }
 attributes #1 = { nounwind "branch-target-enforcement"="true"  "sign-return-address"="none" }
 attributes #2 = { nounwind "branch-target-enforcement"="false" "sign-return-address"="non-leaf" "sign-return-address-key"="a_key" }
 attributes #3 = { nounwind "branch-target-enforcement"="false" "sign-return-address"="non-leaf" "sign-return-address-key"="b_key" }
 attributes #4 = { nounwind "branch-target-enforcement"="false" "sign-return-address"="all" "sign-return-address-key"="a_key" }
 attributes #5 = { nounwind }
 
 !llvm.module.flags = !{!0, !1, !2, !3, !4}
 
 !0 = !{i32 1, !"wchar_size", i32 4}
 !1 = !{i32 1, !"branch-target-enforcement", i32 1}
 !2 = !{i32 1, !"sign-return-address", i32 1}
 !3 = !{i32 1, !"sign-return-address-all", i32 0}
 !4 = !{i32 1, !"sign-return-address-with-bkey", i32 0}

llvm/test/CodeGen/AArch64/sign-return-address-cfi-negate-ra-state.ll

 ; RUN: llc -mtriple=aarch64-none-eabi < %s | FileCheck --check-prefixes CHECK,CHECK-V8A %s
 ; RUN: llc -mtriple=aarch64-none-eabi -mattr=v8.3a < %s | FileCheck --check-prefixes CHECK,CHECK-V83A %s
 ; RUN: llc -mtriple=aarch64-none-eabi -filetype=obj -o - <%s | llvm-dwarfdump -v - | FileCheck --check-prefix=CHECK-DUMP %s
 
 @.str = private unnamed_addr constant [15 x i8] c"some exception\00", align 1
 @_ZTIPKc = external dso_local constant i8*
 
 ; CHECK: @_Z3fooi
 ; CHECK-V8A: hint #25
-; CHECK-V83A: paciasp
+; CHECK-V83A: pacia x30, sp
 ; CHECK-NEXT: .cfi_negate_ra_state
 ; CHECK-NOT: .cfi_negate_ra_state
 define dso_local i32 @_Z3fooi(i32 %x) #0 {
 entry:
   %retval = alloca i32, align 4
   %x.addr = alloca i32, align 4
   store i32 %x, i32* %x.addr, align 4
   %exception = call i8* @__cxa_allocate_exception(i64 8) #1

llvm/test/CodeGen/AArch64/sign-return-address.ll

 define i32 @leaf_sign_non_leaf(i32 %x) "sign-return-address"="non-leaf"  {
   ret i32 %x
 }
 
 ; CHECK-LABEL: @leaf_sign_all
 ; CHECK:       hint #25
 ; CHECK:       hint #29
 ; CHECK:       ret
-; CHECK-V83A:  paciasp
+; CHECK-V83A:  pacia x30, sp
 ; CHECK-V83A:  retaa
 define i32 @leaf_sign_all(i32 %x) "sign-return-address"="all" {
   ret i32 %x
 }
 
 ; CHECK:             @leaf_clobbers_lr
 ; CHECK:             hint #25
-; CHECK-V83A:        paciasp
+; CHECK-V83A:        pacia x30, sp
 ; CHECK, CHECK-V83A: str x30, [sp, #-16]!
 ; CHECK, CHECK-V83A: ldr x30, [sp], #16
 ; CHECK:             hint #29
 ; CHECK:             ret
 ; CHECK-V32A-NEXT:   retaa
 define i64 @leaf_clobbers_lr(i64 %x) "sign-return-address"="non-leaf"  {
   call void asm sideeffect "mov x30, $0", "r,~{lr}"(i64 %x) #1
   ret i64 %x
 }
 
 declare i32 @foo(i32)
 
 ; CHECK:      @non_leaf_sign_all
 ; CHECK:      hint #25
 ; CHECK:      hint #29
 ; CHECK:      ret
-; CHECK-V83A: paciasp
+; CHECK-V83A: pacia x30, sp
 ; CHECK-V83A: retaa
 define i32 @non_leaf_sign_all(i32 %x) "sign-return-address"="all" {
   %call = call i32 @foo(i32 %x)
   ret i32 %call
 }
 
 ; CHECK:             @non_leaf_sign_non_leaf
 ; CHECK:             hint #25
-; CHECK-V83A:        paciasp
+; CHECK-V83A:        pacia x30, sp
 ; CHECK, CHECK-V83A: str x30, [sp, #-16]!
 ; CHECK, CHECK-V83A: ldr x30, [sp], #16
 ; CHECK:             hint #29
 ; CHECK:             ret
 ; CHECK-V83A:        retaa
 define i32 @non_leaf_sign_non_leaf(i32 %x) "sign-return-address"="non-leaf"  {
   %call = call i32 @foo(i32 %x)
   ret i32 %call
 }
 
 ; CHECK-LABEL: @leaf_sign_all_v83
-; CHECK: paciasp
+; CHECK: pacia x30, sp
 ; CHECK-NOT: ret
 ; CHECK: retaa
 ; CHECK-NOT: ret
 define i32 @leaf_sign_all_v83(i32 %x) "sign-return-address"="all" "target-features"="+v8.3a" {
   ret i32 %x
 }
 
 declare fastcc i64 @bar(i64)
 
 ; CHECK-LABEL:       @spill_lr_and_tail_call
 ; CHECK:             hint #25
-; CHECK-V83A:        paciasp
+; CHECK-V83A:        pacia x30, sp
 ; CHECK, CHECK-V83A: str x30, [sp, #-16]!
 ; CHECK, CHECK-V83A: ldr x30, [sp], #16
 ; CHECK-V83A:        autiasp
 ; CHECK:             hint #29
 ; CHECK:             b bar
 define fastcc void @spill_lr_and_tail_call(i64 %x) "sign-return-address"="all" {
   call void asm sideeffect "mov x30, $0", "r,~{lr}"(i64 %x) #1
   tail call fastcc i64 @bar(i64 %x)
   ret void
 }
 
 ; CHECK-LABEL: @leaf_sign_all_a_key
 ; CHECK:       hint #25
 ; CHECK:       hint #29
-; CHECK-V83A:  paciasp
+; CHECK-V83A:  pacia x30, sp
 ; CHECK-V83A:  retaa
 define i32 @leaf_sign_all_a_key(i32 %x) "sign-return-address"="all" "sign-return-address-key"="a_key" {
   ret i32 %x
 }
 
 ; CHECK-LABEL: @leaf_sign_all_b_key
 ; CHECK:       hint #27
 ; CHECK:       hint #31
-; CHECK-V83A:  pacibsp
+; CHECK-V83A:  pacib x30, sp
 ; CHECK-V83A:  retab
 define i32 @leaf_sign_all_b_key(i32 %x) "sign-return-address"="all" "sign-return-address-key"="b_key" {
   ret i32 %x
 }
 
 ; CHECK-LABEL: @leaf_sign_all_v83_b_key
-; CHECK: pacibsp
+; CHECK: pacib x30, sp
 ; CHECK-NOT: ret
 ; CHECK: retab
 ; CHECK-NOT: ret
 define i32 @leaf_sign_all_v83_b_key(i32 %x) "sign-return-address"="all" "target-features"="+v8.3a" "sign-return-address-key"="b_key" {
   ret i32 %x
 }
 
 ; CHECK-LABEL: @leaf_sign_all_a_key_bti
 ; CHECK-NOT:   hint #34
 ; CHECK:       hint #25
 ; CHECK:       hint #29
-; CHECK-V83A:  paciasp
+; CHECK-V83A:  pacia x30, sp
 ; CHECK-V83A:  retaa
 define i32 @leaf_sign_all_a_key_bti(i32 %x) "sign-return-address"="all" "sign-return-address-key"="a_key" "branch-target-enforcement"="true"{
   ret i32 %x
 }
 
 ; CHECK-LABEL: @leaf_sign_all_b_key_bti
 ; CHECK-NOT:   hint #34
 ; CHECK:       hint #27
 ; CHECK:       hint #31
-; CHECK-V83A:  pacibsp
+; CHECK-V83A:  pacib x30, sp
 ; CHECK-V83A:  retab
 define i32 @leaf_sign_all_b_key_bti(i32 %x) "sign-return-address"="all" "sign-return-address-key"="b_key" "branch-target-enforcement"="true"{
   ret i32 %x
 }
 
 ; CHECK-LABEL: @leaf_sign_all_v83_b_key_bti
-; CHECK-NOT:   hint #34
-; CHECK: pacibsp
+; CHECK:       pacib x30, sp
 ; CHECK-NOT: ret
 ; CHECK: retab
 ; CHECK-NOT: ret
 define i32 @leaf_sign_all_v83_b_key_bti(i32 %x) "sign-return-address"="all" "target-features"="+v8.3a" "sign-return-address-key"="b_key" "branch-target-enforcement"="true" {
   ret i32 %x
 }