[ARM] Implement PAC return address signing mechanism for PACBTI-M

[stuij]

Summary

This patch implements PAC return address signing for armv8-m. This patch roughly
accomplishes the following things:

• PAC and AUT instructions are generated.
• They're part of the stack frame setup, so that shrink-wrapping can move them

inwards to cover only part of a function

• The auth code generated by PAC is saved across subroutine calls so that AUT

can find it again to check

• PAC is emitted before stacking registers (so that the SP it signs is the one

on function entry).

• The new pseudo-register ra_auth_code is mentioned in the DWARF frame data
• With CMSE also in use: PAC is emitted before stacking FPCXTNS, and AUT

validates the corresponding value of SP

• Emit correct unwind information when PAC is replaced by PACBTI
• Handle tail calls correctly

Some notes:

We make the assembler accept the .save {ra_auth_code} directive that is
emitted by the compiler when it saves a register that contains a
return address authentication code.

For EHABI we need to have the FrameSetup flag on the instruction and
handle the t2PACBTI opcode (identically to t2PAC), so we can emit
.save {ra_auth_code}, instead of .save {r12}.

For PACBTI-M, the instruction which computes return address PAC should use SP
value before adjustment for the argument registers save are (used for variadic
functions and when a parameter is is split between stack and register), but at
the same it should be after the instruction that saves FPCXT when compiling a
CMSE entry function.

This patch moves the varargs SP adjustment after the FPCXT save (they are never
enabled at the same time), so in a following patch handling of the PAC
instruction can be placed between them.

Epilogue emission code adjusted in a similar manner.

PACBTI-M code generation should not emit any instructions for architectures
v6-m, v8-m.base, and for A- and R-class cores. Diagnostic message for such cases
is handled separately by a future ticket.

note on tail calls:

If the called function has four arguments that occupy registers r0-r3, the
only option for holding the function pointer itself is r12, but this register
is used to keep the PAC during function/prologue epilogue and clobbers the
function pointer.

When we do the tail call we need the five registers (r0-r3 and r12) to
keep six values - the four function arguments, the function pointer and the PAC,
which is obviously impossible.

One option would be to authenticate the return address before all callee-saved
registers are restored, so we have a scratch register to temporarily keep the
value of r12. The issue with this approach is that it violates a fundamental
invariant that PAC is computed using CFA as a modifier. It would also mean using
separate instructions to pop lr and the rest of the callee-saved registers,
which would offset the advantages of doing a tail call.

Instead, this patch disables indirect tail calls when the called function take
four or more arguments and the return address sign and authentication is enabled
for the caller function, conservatively assuming the caller function would spill
LR.

This patch is part of a series that adds support for the PACBTI-M extension of
the Armv8.1-M architecture, as detailed here:

https://community.arm.com/arm-community-blogs/b/architectures-and-processors-blog/posts/armv8-1-m-pointer-authentication-and-branch-target-identification-extension

The PACBTI-M specification can be found in the Armv8-M Architecture Reference
Manual:

https://developer.arm.com/documentation/ddi0553/latest

The following people contributed to this patch:

• Momchil Velikov
• Ties Stuij

[stuij]

trimmed commit message

[stuij]

Unfortunately we're seeing an issue where the shrinkwrap pass isn't aware of PACBTI, and moves the prologue further down the function. Now r12 can already have been used before PAC does.

Of course we'll fix that, however it would be great if someone could review this patch to see if there are other things that need to change.

[stuij]

Disable shrinkwrapping for now when using PAC. A separate patch will tackle PAC and shrinkwrapping playing nice.

[danielkiss]

LGTM besides NITs.
Could you make clang-format happy?

llvm/lib/Target/ARM/ARMAsmPrinter.cpp

1157

NIT

1160

[stuij]

address review comments

[stuij]

rebasing

[RKSimon]

llvm/lib/Target/ARM/AsmParser/ARMAsmParser.cpp

4539

@stuij Static analysis is warning about dead code here - we've already handled the Reg == ARM::RA_AUTH_CODE case at line 4519, should this just be:

if (!RC->contains(Reg))
  return Error(AfterMinusLoc, "invalid register in register list");

[stuij]

llvm/lib/Target/ARM/AsmParser/ARMAsmParser.cpp

4539

Thanks! Made https://reviews.llvm.org/D122577 for this.

llvm/include/llvm/Support/ARMEHABI.h

 //===--- ARMEHABI.h - ARM Exception Handling ABI ----------------*- C++ -*-===//
 //
 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
 // See https://llvm.org/LICENSE.txt for license information.
 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
 //
 //===----------------------------------------------------------------------===//
 //
enum UnwindOpcodes {
     // Format: 10101xxx
     // Purpose: pop r14, r[(4+x):4]
     UNWIND_OPCODE_POP_REG_RANGE_R4_R14 = 0xa8,
 
     // Format: 10110000
     // Purpose: finish
     UNWIND_OPCODE_FINISH = 0xb0,
 
+    // Format: 10110100
+    // Purpose: Pop Return Address Authetication Code
+    UNWIND_OPCODE_POP_RA_AUTH_CODE = 0xb4,
+
     // Format: 10110001 0000xxxx
     // Purpose: pop r[3:0]
     // Constraint: x != 0
     UNWIND_OPCODE_POP_REG_MASK = 0xb100,
 
     // Format: 10110010 x(uleb128)
     // Purpose: vsp = vsp + ((x << 2) + 0x204)
     UNWIND_OPCODE_INC_VSP_ULEB128 = 0xb2,

llvm/lib/Target/ARM/ARMAsmPrinter.cpp

 //===-- ARMAsmPrinter.cpp - Print machine code to an ARM .s file ----------===//
 //
 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
 // See https://llvm.org/LICENSE.txt for license information.
 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
 //
 //===----------------------------------------------------------------------===//
 //
if (MI->mayStore()) {
     assert(DstReg == ARM::SP &&
            "Only stack pointer as a destination reg is supported");
 
     SmallVector<unsigned, 4> RegList;
     // Skip src & dst reg, and pred ops.
     unsigned StartOp = 2 + 2;
     // Use all the operands.
     unsigned NumOffset = 0;
-    // Amount of SP adjustment folded into a push.
-    unsigned Pad = 0;
+    // Amount of SP adjustment folded into a push, before the
+    // registers are stored (pad at higher addresses.)
+    unsigned PadBefore = 0;
+    // Amount of SP adjustment folded into a push, after the
+    // registers are stored (pad at lower addresses.)
+    unsigned PadAfter = 0;
 
     switch (Opc) {
     default:
       MI->print(errs());
       llvm_unreachable("Unsupported opcode for unwinding information");
     case ARM::tPUSH:
       // Special case here: no src & dst reg, but two extra imp ops.
       StartOp = 2; NumOffset = 2;
case ARM::VSTMDDB_UPD:
         // push instruction are marked as undef and should not be
         // restored when unwinding, because the function can modify the
         // corresponding stack slots.
         if (MO.isUndef()) {
           assert(RegList.empty() &&
                  "Pad registers must come before restored ones");
           unsigned Width =
             TargetRegInfo->getRegSizeInBits(MO.getReg(), MachineRegInfo) / 8;
-          Pad += Width;
+          PadAfter += Width;
           continue;
         }
         // Check for registers that are remapped (for a Thumb1 prologue that
         // saves high registers).
         Register Reg = MO.getReg();
         if (unsigned RemappedReg = AFI->EHPrologueRemappedRegs.lookup(Reg))
           Reg = RemappedReg;
         RegList.push_back(Reg);
       }
       break;
     case ARM::STR_PRE_IMM:
     case ARM::STR_PRE_REG:
     case ARM::t2STR_PRE:
       assert(MI->getOperand(2).getReg() == ARM::SP &&
              "Only stack pointer as a source reg is supported");
+      if (unsigned RemappedReg = AFI->EHPrologueRemappedRegs.lookup(SrcReg))
+        SrcReg = RemappedReg;
+
       RegList.push_back(SrcReg);
       break;
+    case ARM::t2STRD_PRE:
+      assert(MI->getOperand(3).getReg() == ARM::SP &&
+             "Only stack pointer as a source reg is supported");
+      SrcReg = MI->getOperand(1).getReg();
+      if (unsigned RemappedReg = AFI->EHPrologueRemappedRegs.lookup(SrcReg))
+        SrcReg = RemappedReg;
+      RegList.push_back(SrcReg);
+      SrcReg = MI->getOperand(2).getReg();
+      if (unsigned RemappedReg = AFI->EHPrologueRemappedRegs.lookup(SrcReg))
+        SrcReg = RemappedReg;
+      RegList.push_back(SrcReg);
+      PadBefore = - MI->getOperand(4).getImm() - 8;
+      break;
     }
     if (MAI->getExceptionHandlingType() == ExceptionHandling::ARM) {
+      if (PadBefore)
+        ATS.emitPad(PadBefore);
       ATS.emitRegSave(RegList, Opc == ARM::VSTMDDB_UPD);
       // Account for the SP adjustment, folded into the push.
-      if (Pad)
-        ATS.emitPad(Pad);
+      if (PadAfter)
+        ATS.emitPad(PadAfter);
     }
   } else {
     // Changes of stack / frame pointer.
     if (SrcReg == ARM::SP) {
       int64_t Offset = 0;
       switch (Opc) {
       default:
         MI->print(errs());
if (SrcReg == ARM::SP) {
       case ARM::t2MOVi16:
         Offset = MI->getOperand(1).getImm();
         AFI->EHPrologueOffsetInRegs[DstReg] = Offset;
         break;
       case ARM::t2MOVTi16:
         Offset = MI->getOperand(2).getImm();
         AFI->EHPrologueOffsetInRegs[DstReg] |= (Offset << 16);
         break;
+      case ARM::t2PAC:
+      case ARM::t2PACBTI:
+        AFI->EHPrologueRemappedRegs[ARM::R12] = ARM::RA_AUTH_CODE;
+        break;
       default:
         MI->print(errs());
         llvm_unreachable("Unsupported opcode for unwinding information");
       }
     }
   }
 }
 

llvm/lib/Target/ARM/ARMBaseInstrInfo.h

 //===-- ARMBaseInstrInfo.h - ARM Base Instruction Information ---*- C++ -*-===//
 //
 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
 // See https://llvm.org/LICENSE.txt for license information.
 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
 //
 //===----------------------------------------------------------------------===//
 //
return MI->getOpcode() == ARM::t2LoopEndDec ||
            MI->getOpcode() == ARM::t2WhileLoopStartTP;
   }
 
 private:
   /// Returns an unused general-purpose register which can be used for
   /// constructing an outlined call if one exists. Returns 0 otherwise.
   unsigned findRegisterToSaveLRTo(const outliner::Candidate &C) const;
 
-  // Adds an instruction which saves the link register on top of the stack into
-  /// the MachineBasicBlock \p MBB at position \p It.
-  void saveLROnStack(MachineBasicBlock &MBB,
-                     MachineBasicBlock::iterator It) const;
+  /// Adds an instruction which saves the link register on top of the stack into
+  /// the MachineBasicBlock \p MBB at position \p It. If \p Auth is true,
+  /// compute and store an authentication code alongiside the link register.
+  /// If \p CFI is true, emit CFI instructions.
+  void saveLROnStack(MachineBasicBlock &MBB, MachineBasicBlock::iterator It,
+                     bool CFI, bool Auth) const;
 
   /// Adds an instruction which restores the link register from the top the
-  /// stack into the MachineBasicBlock \p MBB at position \p It.
+  /// stack into the MachineBasicBlock \p MBB at position \p It. If \p Auth is
+  /// true, restore an authentication code and authenticate LR.
+  /// If \p CFI is true, emit CFI instructions.
   void restoreLRFromStack(MachineBasicBlock &MBB,
-                          MachineBasicBlock::iterator It) const;
-
-  /// Emit CFI instructions into the MachineBasicBlock \p MBB at position \p It,
-  /// for the case when the LR is saved on the stack.
-  void emitCFIForLRSaveOnStack(MachineBasicBlock &MBB,
-                               MachineBasicBlock::iterator It) const;
+                          MachineBasicBlock::iterator It, bool CFI,
+                          bool Auth) const;
 
   /// Emit CFI instructions into the MachineBasicBlock \p MBB at position \p It,
   /// for the case when the LR is saved in the register \p Reg.
   void emitCFIForLRSaveToReg(MachineBasicBlock &MBB,
                              MachineBasicBlock::iterator It,
                              Register Reg) const;
 
   /// Emit CFI instructions into the MachineBasicBlock \p MBB at position \p It,
-  /// after the LR is was restored from the stack.
-  void emitCFIForLRRestoreFromStack(MachineBasicBlock &MBB,
-                                    MachineBasicBlock::iterator It) const;
-
-  /// Emit CFI instructions into the MachineBasicBlock \p MBB at position \p It,
   /// after the LR is was restored from a register.
   void emitCFIForLRRestoreFromReg(MachineBasicBlock &MBB,
                                   MachineBasicBlock::iterator It) const;
   /// \brief Sets the offsets on outlined instructions in \p MBB which use SP
   /// so that they will be valid post-outlining.
   ///
   /// \param MBB A \p MachineBasicBlock in an outlined function.
   void fixupPostOutline(MachineBasicBlock &MBB) const;

llvm/lib/Target/ARM/ARMBaseInstrInfo.cpp

 //===-- ARMBaseInstrInfo.cpp - ARM Instruction Information ----------------===//
 //
 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
 // See https://llvm.org/LICENSE.txt for license information.
 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
 //
 //===----------------------------------------------------------------------===//
 //

 /// I3                                I2
 ///                                   I3
 ///                                   BX LR
 ///
 /// +-------------------------+--------+-----+
 /// |                         | Thumb2 | ARM |
 /// +-------------------------+--------+-----+
 /// | Call overhead in Bytes  |      4 |   4 |
-/// | Frame overhead in Bytes |      4 |   4 |
+/// | Frame overhead in Bytes |      2 |   4 |
 /// | Stack fixup required    |     No |  No |
 /// +-------------------------+--------+-----+
 ///
 /// \p MachineOutlinerRegSave implies that the function should be called with a
 /// save and restore of LR to an available register. This allows us to avoid
 /// stack fixups. Note that this outlining variant is compatible with the
 /// NoLRSave case.
 ///
struct OutlinerCosts {
   int SaveRestoreLROnStack;
 
   OutlinerCosts(const ARMSubtarget &target)
       : CallTailCall(target.isThumb() ? 4 : 4),
         FrameTailCall(target.isThumb() ? 0 : 0),
         CallThunk(target.isThumb() ? 4 : 4),
         FrameThunk(target.isThumb() ? 0 : 0),
         CallNoLRSave(target.isThumb() ? 4 : 4),
-        FrameNoLRSave(target.isThumb() ? 4 : 4),
+        FrameNoLRSave(target.isThumb() ? 2 : 4),
         CallRegSave(target.isThumb() ? 8 : 12),
         FrameRegSave(target.isThumb() ? 2 : 4),
         CallDefault(target.isThumb() ? 8 : 12),
         FrameDefault(target.isThumb() ? 2 : 4),
         SaveRestoreLROnStack(target.isThumb() ? 8 : 8) {}
 };
 
 unsigned
if (!(FlagsSetInAll & UnsafeRegsDead)) {
     // the case that, say, 1 out of 20 candidates violate the restructions.)
     llvm::erase_if(RepeatedSequenceLocs, CantGuaranteeValueAcrossCall);
 
     // If the sequence doesn't have enough candidates left, then we're done.
     if (RepeatedSequenceLocs.size() < 2)
       return outliner::OutlinedFunction();
   }
 
+  // We expect the majority of the outlining candidates to be in consensus with
+  // regard to return address sign and authentication, and branch target
+  // enforcement, in other words, partitioning according to all the four
+  // possible combinations of PAC-RET and BTI is going to yield one big subset
+  // and three small (likely empty) subsets. That allows us to cull incompatible
+  // candidates separately for PAC-RET and BTI.
+
   // Partition the candidates in two sets: one with BTI enabled and one with BTI
-  // disabled. Remove the candidates from the smaller set. We expect the
-  // majority of the candidates to be in consensus with regard to branch target
-  // enforcement with just a few oddballs, but if they are the same number
-  // prefer the non-BTI ones for outlining, since they have less overhead.
+  // disabled. Remove the candidates from the smaller set. If they are the same
+  // number prefer the non-BTI ones for outlining, since they have less
+  // overhead.
   auto NoBTI =
       llvm::partition(RepeatedSequenceLocs, [](const outliner::Candidate &C) {
         const ARMFunctionInfo &AFI = *C.getMF()->getInfo<ARMFunctionInfo>();
         return AFI.branchTargetEnforcement();
       });
   if (std::distance(RepeatedSequenceLocs.begin(), NoBTI) >
       std::distance(NoBTI, RepeatedSequenceLocs.end()))
     RepeatedSequenceLocs.erase(NoBTI, RepeatedSequenceLocs.end());
   else
     RepeatedSequenceLocs.erase(RepeatedSequenceLocs.begin(), NoBTI);
+
+  if (RepeatedSequenceLocs.size() < 2)
+    return outliner::OutlinedFunction();
+
+  // Likewise, partition the candidates according to PAC-RET enablement.
+  auto NoPAC =
+      llvm::partition(RepeatedSequenceLocs, [](const outliner::Candidate &C) {
+        const ARMFunctionInfo &AFI = *C.getMF()->getInfo<ARMFunctionInfo>();
+        // If the function happens to not spill the LR, do not disqualify it
+        // from the outlining.
+        return AFI.shouldSignReturnAddress(true);
+      });
+  if (std::distance(RepeatedSequenceLocs.begin(), NoPAC) >
+      std::distance(NoPAC, RepeatedSequenceLocs.end()))
+    RepeatedSequenceLocs.erase(NoPAC, RepeatedSequenceLocs.end());
+  else
+    RepeatedSequenceLocs.erase(RepeatedSequenceLocs.begin(), NoPAC);
+
   if (RepeatedSequenceLocs.size() < 2)
     return outliner::OutlinedFunction();
 
   // At this point, we have only "safe" candidates to outline. Figure out
   // frame + call instruction information.
 
   unsigned LastInstrOpcode = RepeatedSequenceLocs[0].back()->getOpcode();
 
   // Helper lambda which sets call information for every candidate.
   auto SetCandidateCallInfo =
       [&RepeatedSequenceLocs](unsigned CallID, unsigned NumBytesForCall) {
         for (outliner::Candidate &C : RepeatedSequenceLocs)
           C.setCallInfo(CallID, NumBytesForCall);
       };
 
   OutlinerCosts Costs(Subtarget);
+
   const auto &SomeMFI =
       *RepeatedSequenceLocs.front().getMF()->getInfo<ARMFunctionInfo>();
   // Adjust costs to account for the BTI instructions.
   if (SomeMFI.branchTargetEnforcement()) {
     Costs.FrameDefault += 4;
     Costs.FrameNoLRSave += 4;
     Costs.FrameRegSave += 4;
     Costs.FrameTailCall += 4;
     Costs.FrameThunk += 4;
   }
+
+  // Adjust costs to account for sign and authentication instructions.
+  if (SomeMFI.shouldSignReturnAddress(true)) {
+    Costs.CallDefault += 8;          // +PAC instr, +AUT instr
+    Costs.SaveRestoreLROnStack += 8; // +PAC instr, +AUT instr
+  }
+
   unsigned FrameID = MachineOutlinerDefault;
   unsigned NumBytesToCreateFrame = Costs.FrameDefault;
 
   // If the last instruction in any candidate is a terminator, then we should
   // tail call all of the candidates.
   if (RepeatedSequenceLocs[0].back()->isTerminator()) {
     FrameID = MachineOutlinerTailCall;
     NumBytesToCreateFrame = Costs.FrameTailCall;
ARMBaseInstrInfo::getOutliningType(MachineBasicBlock::iterator &MIT,
 
   // Does this use the stack?
   if (MI.modifiesRegister(ARM::SP, TRI) || MI.readsRegister(ARM::SP, TRI)) {
     // True if there is no chance that any outlined candidate from this range
     // could require stack fixups. That is, both
     // * LR is available in the range (No save/restore around call)
     // * The range doesn't include calls (No save/restore in outlined frame)
     // are true.
+    // These conditions also ensure correctness of the return address
+    // authentication - we insert sign and authentication instructions only if
+    // we save/restore LR on stack, but then this condition ensures that the
+    // outlined range does not modify the SP, therefore the SP value used for
+    // signing is the same as the one used for authentication.
     // FIXME: This is very restrictive; the flags check the whole block,
     // not just the bit we will try to outline.
     bool MightNeedStackFixUp =
         (Flags & (MachineOutlinerMBBFlags::LRUnavailableSomewhere |
                   MachineOutlinerMBBFlags::HasCalls));
 
     if (!MightNeedStackFixUp)
       return outliner::InstrType::Legal;

 
 void ARMBaseInstrInfo::fixupPostOutline(MachineBasicBlock &MBB) const {
   for (MachineInstr &MI : MBB) {
     checkAndUpdateStackOffset(&MI, Subtarget.getStackAlignment().value(), true);
   }
 }
 
 void ARMBaseInstrInfo::saveLROnStack(MachineBasicBlock &MBB,
-                                     MachineBasicBlock::iterator It) const {
+                                     MachineBasicBlock::iterator It, bool CFI,
+                                     bool Auth) const {
+  int Align = std::max(Subtarget.getStackAlignment().value(), uint64_t(8));
+  assert(Align >= 8 && Align <= 256);
+  if (Auth) {
+    assert(Subtarget.isThumb2());
+    // Compute PAC in R12. Outlining ensures R12 is dead across the outlined
+    // sequence.
+    BuildMI(MBB, It, DebugLoc(), get(ARM::t2PAC))
+        .setMIFlags(MachineInstr::FrameSetup);
+    BuildMI(MBB, It, DebugLoc(), get(ARM::t2STRD_PRE), ARM::SP)
+        .addReg(ARM::R12, RegState::Kill)
+        .addReg(ARM::LR, RegState::Kill)
+        .addReg(ARM::SP)
+        .addImm(-Align)
+        .add(predOps(ARMCC::AL))
+        .setMIFlags(MachineInstr::FrameSetup);
+  } else {
     unsigned Opc = Subtarget.isThumb() ? ARM::t2STR_PRE : ARM::STR_PRE_IMM;
-  int Align = -Subtarget.getStackAlignment().value();
     BuildMI(MBB, It, DebugLoc(), get(Opc), ARM::SP)
         .addReg(ARM::LR, RegState::Kill)
         .addReg(ARM::SP)
-    .addImm(Align)
-    .add(predOps(ARMCC::AL));
+        .addImm(-Align)
+        .add(predOps(ARMCC::AL))
+        .setMIFlags(MachineInstr::FrameSetup);
   }
 
-void ARMBaseInstrInfo::emitCFIForLRSaveOnStack(
-    MachineBasicBlock &MBB, MachineBasicBlock::iterator It) const {
+  if (!CFI)
+    return;
+
   MachineFunction &MF = *MBB.getParent();
-  const MCRegisterInfo *MRI = Subtarget.getRegisterInfo();
-  unsigned DwarfLR = MRI->getDwarfRegNum(ARM::LR, true);
-  int Align = Subtarget.getStackAlignment().value();
-  // Add a CFI saying the stack was moved down.
+
+  // Add a CFI, saying CFA is offset by Align bytes from SP.
   int64_t StackPosEntry =
       MF.addFrameInst(MCCFIInstruction::cfiDefCfaOffset(nullptr, Align));
   BuildMI(MBB, It, DebugLoc(), get(ARM::CFI_INSTRUCTION))
       .addCFIIndex(StackPosEntry)
       .setMIFlags(MachineInstr::FrameSetup);
 
   // Add a CFI saying that the LR that we want to find is now higher than
   // before.
-  int64_t LRPosEntry =
-      MF.addFrameInst(MCCFIInstruction::createOffset(nullptr, DwarfLR, -Align));
+  int LROffset = Auth ? Align - 4 : Align;
+  const MCRegisterInfo *MRI = Subtarget.getRegisterInfo();
+  unsigned DwarfLR = MRI->getDwarfRegNum(ARM::LR, true);
+  int64_t LRPosEntry = MF.addFrameInst(
+      MCCFIInstruction::createOffset(nullptr, DwarfLR, -LROffset));
   BuildMI(MBB, It, DebugLoc(), get(ARM::CFI_INSTRUCTION))
       .addCFIIndex(LRPosEntry)
       .setMIFlags(MachineInstr::FrameSetup);
+  if (Auth) {
+    // Add a CFI for the location of the return adddress PAC.
+    unsigned DwarfRAC = MRI->getDwarfRegNum(ARM::RA_AUTH_CODE, true);
+    int64_t RACPosEntry = MF.addFrameInst(
+        MCCFIInstruction::createOffset(nullptr, DwarfRAC, -Align));
+    BuildMI(MBB, It, DebugLoc(), get(ARM::CFI_INSTRUCTION))
+        .addCFIIndex(RACPosEntry)
+        .setMIFlags(MachineInstr::FrameSetup);
+  }
 }
 
 void ARMBaseInstrInfo::emitCFIForLRSaveToReg(MachineBasicBlock &MBB,
                                              MachineBasicBlock::iterator It,
                                              Register Reg) const {
   MachineFunction &MF = *MBB.getParent();
   const MCRegisterInfo *MRI = Subtarget.getRegisterInfo();
   unsigned DwarfLR = MRI->getDwarfRegNum(ARM::LR, true);
   unsigned DwarfReg = MRI->getDwarfRegNum(Reg, true);
 
   int64_t LRPosEntry = MF.addFrameInst(
       MCCFIInstruction::createRegister(nullptr, DwarfLR, DwarfReg));
   BuildMI(MBB, It, DebugLoc(), get(ARM::CFI_INSTRUCTION))
       .addCFIIndex(LRPosEntry)
       .setMIFlags(MachineInstr::FrameSetup);
 }
 
-void ARMBaseInstrInfo::restoreLRFromStack(
-    MachineBasicBlock &MBB, MachineBasicBlock::iterator It) const {
+void ARMBaseInstrInfo::restoreLRFromStack(MachineBasicBlock &MBB,
+                                          MachineBasicBlock::iterator It,
+                                          bool CFI, bool Auth) const {
+  int Align = Subtarget.getStackAlignment().value();
+  if (Auth) {
+    assert(Subtarget.isThumb2());
+    // Restore return address PAC and LR.
+    BuildMI(MBB, It, DebugLoc(), get(ARM::t2LDRD_POST))
+        .addReg(ARM::R12, RegState::Define)
+        .addReg(ARM::LR, RegState::Define)
+        .addReg(ARM::SP, RegState::Define)
+        .addReg(ARM::SP)
+        .addImm(Align)
+        .add(predOps(ARMCC::AL))
+        .setMIFlags(MachineInstr::FrameDestroy);
+    // LR authentication is after the CFI instructions, below.
+  } else {
     unsigned Opc = Subtarget.isThumb() ? ARM::t2LDR_POST : ARM::LDR_POST_IMM;
     MachineInstrBuilder MIB = BuildMI(MBB, It, DebugLoc(), get(Opc), ARM::LR)
                                   .addReg(ARM::SP, RegState::Define)
                                   .addReg(ARM::SP);
     if (!Subtarget.isThumb())
       MIB.addReg(0);
-  MIB.addImm(Subtarget.getStackAlignment().value()).add(predOps(ARMCC::AL));
+    MIB.addImm(Subtarget.getStackAlignment().value())
+        .add(predOps(ARMCC::AL))
+        .setMIFlags(MachineInstr::FrameDestroy);
   }
 
-void ARMBaseInstrInfo::emitCFIForLRRestoreFromStack(
-    MachineBasicBlock &MBB, MachineBasicBlock::iterator It) const {
+  if (CFI) {
     // Now stack has moved back up...
     MachineFunction &MF = *MBB.getParent();
     const MCRegisterInfo *MRI = Subtarget.getRegisterInfo();
     unsigned DwarfLR = MRI->getDwarfRegNum(ARM::LR, true);
     int64_t StackPosEntry =
         MF.addFrameInst(MCCFIInstruction::cfiDefCfaOffset(nullptr, 0));
     BuildMI(MBB, It, DebugLoc(), get(ARM::CFI_INSTRUCTION))
         .addCFIIndex(StackPosEntry)
         .setMIFlags(MachineInstr::FrameDestroy);
 
     // ... and we have restored LR.
     int64_t LRPosEntry =
         MF.addFrameInst(MCCFIInstruction::createRestore(nullptr, DwarfLR));
     BuildMI(MBB, It, DebugLoc(), get(ARM::CFI_INSTRUCTION))
         .addCFIIndex(LRPosEntry)
         .setMIFlags(MachineInstr::FrameDestroy);
+
+    if (Auth) {
+      unsigned DwarfRAC = MRI->getDwarfRegNum(ARM::RA_AUTH_CODE, true);
+      int64_t Entry =
+          MF.addFrameInst(MCCFIInstruction::createUndefined(nullptr, DwarfRAC));
+      BuildMI(MBB, It, DebugLoc(), get(ARM::CFI_INSTRUCTION))
+          .addCFIIndex(Entry)
+          .setMIFlags(MachineInstr::FrameDestroy);
+    }
+  }
+
+  if (Auth)
+    BuildMI(MBB, It, DebugLoc(), get(ARM::t2AUT));
 }
 
 void ARMBaseInstrInfo::emitCFIForLRRestoreFromReg(
     MachineBasicBlock &MBB, MachineBasicBlock::iterator It) const {
   MachineFunction &MF = *MBB.getParent();
   const MCRegisterInfo *MRI = Subtarget.getRegisterInfo();
   unsigned DwarfLR = MRI->getDwarfRegNum(ARM::LR, true);
 
if (llvm::any_of(MBB.instrs(), IsNonTailCall)) {
 
     // We have to save and restore LR, we need to add it to the liveins if it
     // is not already part of the set.  This is suffient since outlined
     // functions only have one block.
     if (!MBB.isLiveIn(ARM::LR))
       MBB.addLiveIn(ARM::LR);
 
     // Insert a save before the outlined region
-    saveLROnStack(MBB, It);
-    emitCFIForLRSaveOnStack(MBB, It);
+    bool Auth = OF.Candidates.front()
+                    .getMF()
+                    ->getInfo<ARMFunctionInfo>()
+                    ->shouldSignReturnAddress(true);
+    saveLROnStack(MBB, It, true, Auth);
 
     // Fix up the instructions in the range, since we're going to modify the
     // stack.
     assert(OF.FrameConstructionID != MachineOutlinerDefault &&
            "Can only fix up stack references once");
     fixupPostOutline(MBB);
 
     // Insert a restore before the terminator for the function.  Restore LR.
-    restoreLRFromStack(MBB, Et);
-    emitCFIForLRRestoreFromStack(MBB, Et);
+    restoreLRFromStack(MBB, Et, true, Auth);
   }
 
   // If this is a tail call outlined function, then there's already a return.
   if (OF.FrameConstructionID == MachineOutlinerTailCall ||
       OF.FrameConstructionID == MachineOutlinerThunk)
     return;
 
   // Here we have to insert the return ourselves.  Get the correct opcode from
if (C.CallConstructionID == MachineOutlinerRegSave) {
     if (!AFI.isLRSpilled())
       emitCFIForLRRestoreFromReg(MBB, It);
     It--;
     return CallPt;
   }
   // We have the default case. Save and restore from SP.
   if (!MBB.isLiveIn(ARM::LR))
     MBB.addLiveIn(ARM::LR);
-  saveLROnStack(MBB, It);
-  if (!AFI.isLRSpilled())
-    emitCFIForLRSaveOnStack(MBB, It);
+  bool Auth = !AFI.isLRSpilled() && AFI.shouldSignReturnAddress(true);
+  saveLROnStack(MBB, It, !AFI.isLRSpilled(), Auth);
   CallPt = MBB.insert(It, CallMIB);
-  restoreLRFromStack(MBB, It);
-  if (!AFI.isLRSpilled())
-    emitCFIForLRRestoreFromStack(MBB, It);
+  restoreLRFromStack(MBB, It, !AFI.isLRSpilled(), Auth);
   It--;
   return CallPt;
 }
 
 bool ARMBaseInstrInfo::shouldOutlineFromFunctionByDefault(
     MachineFunction &MF) const {
   return Subtarget.isMClass() && MF.getFunction().hasMinSize();
 }

llvm/lib/Target/ARM/ARMBranchTargets.cpp

 //===-- ARMBranchTargets.cpp -- Harden code using v8.1-M BTI extension -----==//
 //
 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
 // See https://llvm.org/LICENSE.txt for license information.
 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
 //
 //===----------------------------------------------------------------------===//
 //

 /// to find a PAC instruction and replace it with PACBTI. Otherwise just insert
 /// a BTI instruction.
 /// The point of insertion is in the beginning of the BB, immediately after meta
 /// instructions (such labels in exception handling landing pads).
 void ARMBranchTargets::addBTI(const ARMInstrInfo &TII, MachineBasicBlock &MBB,
                               bool IsFirstBB) {
   // Which instruction to insert: BTI or PACBTI
   unsigned OpCode = ARM::t2BTI;
+  unsigned MIFlags = 0;
 
   // Skip meta instructions, including EH labels
   auto MBBI = llvm::find_if_not(MBB.instrs(), [](const MachineInstr &MI) {
     return MI.isMetaInstruction();
   });
 
   // If this is the first BB in a function, check if it starts with a PAC
   // instruction and in that case remove the PAC instruction.
   if (IsFirstBB) {
     if (MBBI != MBB.instr_end() && MBBI->getOpcode() == ARM::t2PAC) {
       LLVM_DEBUG(dbgs() << "Removing a 'PAC' instr from BB '" << MBB.getName()
                         << "' to replace with PACBTI\n");
       OpCode = ARM::t2PACBTI;
+      MIFlags = MachineInstr::FrameSetup;
       auto NextMBBI = std::next(MBBI);
       MBBI->eraseFromParent();
       MBBI = NextMBBI;
     }
   }
 
   LLVM_DEBUG(dbgs() << "Inserting a '"
                     << (OpCode == ARM::t2BTI ? "BTI" : "PACBTI")
                     << "' instr into BB '" << MBB.getName() << "'\n");
   // Finally, insert a new instruction (either PAC or PACBTI)
-  BuildMI(MBB, MBBI, MBB.findDebugLoc(MBBI), TII.get(OpCode));
+  BuildMI(MBB, MBBI, MBB.findDebugLoc(MBBI), TII.get(OpCode))
+      .setMIFlags(MIFlags);
 }

llvm/lib/Target/ARM/ARMExpandPseudoInsts.cpp

 //===-- ARMExpandPseudoInsts.cpp - Expand pseudo instructions -------------===//
 //
 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
 // See https://llvm.org/LICENSE.txt for license information.
 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
 //
 //===----------------------------------------------------------------------===//
 //
case ARM::TCRETURNri: {
       if (MI.isCandidateForCallSiteEntry())
         MI.getMF()->moveCallSiteInfo(&MI, &*NewMI);
       MBB.erase(MBBI);
 
       MBBI = NewMI;
       return true;
     }
     case ARM::tBXNS_RET: {
+      // For v8.0-M.Main we need to authenticate LR before clearing FPRs, which
+      // uses R12 as a scratch register.
+      if (!STI->hasV8_1MMainlineOps() && AFI->shouldSignReturnAddress())
+        BuildMI(MBB, MBBI, DebugLoc(), TII->get(ARM::t2AUT));
+
       MachineBasicBlock &AfterBB = CMSEClearFPRegs(MBB, MBBI);
 
       if (STI->hasV8_1MMainlineOps()) {
         // Restore the non-secure floating point context.
         BuildMI(MBB, MBBI, MBBI->getDebugLoc(),
                 TII->get(ARM::VLDR_FPCXTNS_post), ARM::SP)
             .addReg(ARM::SP)
             .addImm(4)
             .add(predOps(ARMCC::AL));
+
+        if (AFI->shouldSignReturnAddress())
+          BuildMI(AfterBB, AfterBB.end(), DebugLoc(), TII->get(ARM::t2AUT));
       }
 
       // Clear all GPR that are not a use of the return instruction.
       assert(llvm::all_of(MBBI->operands(), [](const MachineOperand &Op) {
         return !Op.isReg() || Op.getReg() != ARM::R12;
       }));
       SmallVector<unsigned, 5> ClearRegs;
       determineGPRegsToClear(

llvm/lib/Target/ARM/ARMFrameLowering.cpp

 //===- ARMFrameLowering.cpp - ARM Frame Information -----------------------===//
 //
 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
 // See https://llvm.org/LICENSE.txt for license information.
 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
 //
 //===----------------------------------------------------------------------===//
 //
void ARMFrameLowering::emitPrologue(MachineFunction &MF,
   // All calls are tail calls in GHC calling conv, and functions have no
   // prologue/epilogue.
   if (MF.getFunction().getCallingConv() == CallingConv::GHC)
     return;
 
   StackAdjustingInsts DefCFAOffsetCandidates;
   bool HasFP = hasFP(MF);
 
-  // Allocate the vararg register save area.
-  if (ArgRegsSaveSize) {
-    emitSPUpdate(isARM, MBB, MBBI, dl, TII, -ArgRegsSaveSize,
-                 MachineInstr::FrameSetup);
-    DefCFAOffsetCandidates.addInst(std::prev(MBBI), ArgRegsSaveSize, true);
-  }
-
   if (!AFI->hasStackFrame() &&
       (!STI.isTargetWindows() || !WindowsRequiresStackProbe(MF, NumBytes))) {
-    if (NumBytes - ArgRegsSaveSize != 0) {
-      emitSPUpdate(isARM, MBB, MBBI, dl, TII, -(NumBytes - ArgRegsSaveSize),
+    if (NumBytes != 0) {
+      emitSPUpdate(isARM, MBB, MBBI, dl, TII, -NumBytes,
                    MachineInstr::FrameSetup);
-      DefCFAOffsetCandidates.addInst(std::prev(MBBI),
-                                     NumBytes - ArgRegsSaveSize, true);
+      DefCFAOffsetCandidates.addInst(std::prev(MBBI), NumBytes, true);
     }
     DefCFAOffsetCandidates.emitDefCFAOffsets(MBB, dl, TII, HasFP);
     return;
   }
 
   // Determine spill area sizes.
   for (unsigned i = 0, e = CSI.size(); i != e; ++i) {
     unsigned Reg = CSI[i].getReg();
default:
       // This is a DPR. Exclude the aligned DPRCS2 spills.
       if (Reg == ARM::D8)
         D8SpillFI = FI;
       if (Reg < ARM::D8 || Reg >= ARM::D8 + AFI->getNumAlignedDPRCS2Regs())
         DPRCSSize += 8;
     }
   }
 
-  // Move past FPCXT area.
   MachineBasicBlock::iterator LastPush = MBB.end(), GPRCS1Push, GPRCS2Push;
+
+  // Move past the PAC computation.
+  if (AFI->shouldSignReturnAddress())
+    LastPush = MBBI++;
+
+  // Move past FPCXT area.
   if (FPCXTSaveSize > 0) {
     LastPush = MBBI++;
     DefCFAOffsetCandidates.addInst(LastPush, FPCXTSaveSize, true);
   }
 
+  // Allocate the vararg register save area.
+  if (ArgRegsSaveSize) {
+    emitSPUpdate(isARM, MBB, MBBI, dl, TII, -ArgRegsSaveSize,
+                 MachineInstr::FrameSetup);
+    LastPush = std::prev(MBBI);
+    DefCFAOffsetCandidates.addInst(LastPush, ArgRegsSaveSize, true);
+  }
+
   // Move past area 1.
   if (GPRCS1Size > 0) {
     GPRCS1Push = LastPush = MBBI++;
     DefCFAOffsetCandidates.addInst(LastPush, GPRCS1Size, true);
   }
 
   // Determine starting offsets of spill areas.
   unsigned FPCXTOffset = NumBytes - ArgRegsSaveSize - FPCXTSaveSize;
for (const auto &Entry : CSI) {
       int FI = Entry.getFrameIdx();
       switch (Reg) {
       case ARM::R8:
       case ARM::R9:
       case ARM::R10:
       case ARM::R11:
       case ARM::R12:
         if (STI.splitFramePushPop(MF)) {
-          unsigned DwarfReg =  MRI->getDwarfRegNum(Reg, true);
+          unsigned DwarfReg = MRI->getDwarfRegNum(
+              Reg == ARM::R12 ? ARM::RA_AUTH_CODE : Reg, true);
           unsigned Offset = MFI.getObjectOffset(FI);
           unsigned CFIIndex = MF.addFrameInst(
               MCCFIInstruction::createOffset(nullptr, DwarfReg, Offset));
           BuildMI(MBB, Pos, dl, TII.get(TargetOpcode::CFI_INSTRUCTION))
               .addCFIIndex(CFIIndex)
               .setMIFlags(MachineInstr::FrameSetup);
         }
         break;
void ARMFrameLowering::emitEpilogue(MachineFunction &MF,
   if (MF.getFunction().getCallingConv() == CallingConv::GHC)
     return;
 
   // First put ourselves on the first (from top) terminator instructions.
   MachineBasicBlock::iterator MBBI = MBB.getFirstTerminator();
   DebugLoc dl = MBBI != MBB.end() ? MBBI->getDebugLoc() : DebugLoc();
 
   if (!AFI->hasStackFrame()) {
-    if (NumBytes - ReservedArgStack != 0)
-      emitSPUpdate(isARM, MBB, MBBI, dl, TII, NumBytes - ReservedArgStack,
+    if (NumBytes + IncomingArgStackToRestore != 0)
+      emitSPUpdate(isARM, MBB, MBBI, dl, TII, NumBytes + IncomingArgStackToRestore,
                    MachineInstr::FrameDestroy);
   } else {
     // Unwind MBBI to point to first LDR / VLDRD.
     if (MBBI != MBB.begin()) {
       do {
         --MBBI;
       } while (MBBI != MBB.begin() &&
                MBBI->getFlag(MachineInstr::FrameDestroy));
if (!AFI->hasStackFrame()) {
     if (AFI->getDPRCalleeSavedGapSize()) {
       assert(AFI->getDPRCalleeSavedGapSize() == 4 &&
              "unexpected DPR alignment gap");
       emitSPUpdate(isARM, MBB, MBBI, dl, TII, AFI->getDPRCalleeSavedGapSize(),
                    MachineInstr::FrameDestroy);
     }
 
     if (AFI->getGPRCalleeSavedArea2Size()) MBBI++;
     if (AFI->getGPRCalleeSavedArea1Size()) MBBI++;
-    if (AFI->getFPCXTSaveAreaSize()) MBBI++;
-  }
 
     if (ReservedArgStack || IncomingArgStackToRestore) {
       assert((int)ReservedArgStack + IncomingArgStackToRestore >= 0 &&
              "attempting to restore negative stack amount");
       emitSPUpdate(isARM, MBB, MBBI, dl, TII,
                    ReservedArgStack + IncomingArgStackToRestore,
                    MachineInstr::FrameDestroy);
     }
+
+    // Validate PAC, It should have been already popped into R12. For CMSE entry
+    // function, the validation instruction is emitted during expansion of the
+    // tBXNS_RET, since the validation must use the value of SP at function
+    // entry, before saving, resp. after restoring, FPCXTNS.
+    if (AFI->shouldSignReturnAddress() && !AFI->isCmseNSEntryFunction())
+      BuildMI(MBB, MBBI, DebugLoc(), STI.getInstrInfo()->get(ARM::t2AUT));
+  }
 }
 
 /// getFrameIndexReference - Provide a base+offset reference to an FI slot for
 /// debug info.  It's the same as what we use for resolving the code-gen
 /// references for now.  FIXME: This can go wrong when references are
 /// SP-relative and simple call frames aren't used.
 StackOffset ARMFrameLowering::getFrameIndexReference(const MachineFunction &MF,
                                                      int FI,
void ARMFrameLowering::emitPopInst(MachineBasicBlock &MBB,
                                    unsigned LdmOpc, unsigned LdrOpc,
                                    bool isVarArg, bool NoGap,
                                    bool (*Func)(unsigned, bool),
                                    unsigned NumAlignedDPRCS2Regs) const {
   MachineFunction &MF = *MBB.getParent();
   const TargetInstrInfo &TII = *MF.getSubtarget().getInstrInfo();
   const TargetRegisterInfo &TRI = *STI.getRegisterInfo();
   ARMFunctionInfo *AFI = MF.getInfo<ARMFunctionInfo>();
+  bool hasPAC = AFI->shouldSignReturnAddress();
   DebugLoc DL;
   bool isTailCall = false;
   bool isInterrupt = false;
   bool isTrap = false;
   bool isCmseEntry = false;
   if (MBB.end() != MI) {
     DL = MI->getDebugLoc();
     unsigned RetOpcode = MI->getOpcode();
for (; i != 0; --i) {
       unsigned Reg = Info.getReg();
       if (!(Func)(Reg, STI.splitFramePushPop(MF))) continue;
 
       // The aligned reloads from area DPRCS2 are not inserted here.
       if (Reg >= ARM::D8 && Reg < ARM::D8 + NumAlignedDPRCS2Regs)
         continue;
       if (Reg == ARM::LR && !isTailCall && !isVarArg && !isInterrupt &&
           !isCmseEntry && !isTrap && AFI->getArgumentStackToRestore() == 0 &&
-          STI.hasV5TOps() && MBB.succ_empty()) {
+          STI.hasV5TOps() && MBB.succ_empty() && !hasPAC) {
         Reg = ARM::PC;
         // Fold the return instruction into the LDM.
         DeleteRet = true;
         LdmOpc = AFI->isThumbFunction() ? ARM::t2LDMIA_RET : ARM::LDMIA_RET;
         // We 'restore' LR into PC so it is not live out of the return block:
         // Clear Restored bit.
         Info.setRestored(false);
       }
bool ARMFrameLowering::spillCalleeSavedRegisters(
   MachineFunction &MF = *MBB.getParent();
   ARMFunctionInfo *AFI = MF.getInfo<ARMFunctionInfo>();
 
   unsigned PushOpc = AFI->isThumbFunction() ? ARM::t2STMDB_UPD : ARM::STMDB_UPD;
   unsigned PushOneOpc = AFI->isThumbFunction() ?
     ARM::t2STR_PRE : ARM::STR_PRE_IMM;
   unsigned FltOpc = ARM::VSTMDDB_UPD;
   unsigned NumAlignedDPRCS2Regs = AFI->getNumAlignedDPRCS2Regs();
+  // Compute PAC in R12.
+  if (AFI->shouldSignReturnAddress()) {
+    BuildMI(MBB, MI, DebugLoc(), STI.getInstrInfo()->get(ARM::t2PAC))
+        .setMIFlags(MachineInstr::FrameSetup);
+  }
   // Save the non-secure floating point context.
   if (llvm::any_of(CSI, [](const CalleeSavedInfo &C) {
         return C.getReg() == ARM::FPCXTNS;
       })) {
     BuildMI(MBB, MI, DebugLoc(), STI.getInstrInfo()->get(ARM::VSTR_FPCXTNS_pre),
             ARM::SP)
         .addReg(ARM::SP)
         .addImm(-4)

 
 bool ARMFrameLowering::enableShrinkWrapping(const MachineFunction &MF) const {
   // For CMSE entry functions, we want to save the FPCXT_NS immediately
   // upon function entry (resp. restore it immmediately before return)
   if (STI.hasV8_1MMainlineOps() &&
       MF.getInfo<ARMFunctionInfo>()->isCmseNSEntryFunction())
     return false;
 
+  // We are disabling shrinkwrapping for now when PAC is enabled, as
+  // shrinkwrapping can cause clobbering of r12 when the PAC code is
+  // generated. A follow-up patch will fix this in a more performant manner.
+  if (MF.getInfo<ARMFunctionInfo>()->shouldSignReturnAddress(false /*SpillsLR */))
+    return false;
+
   return true;
 }
 
 void ARMFrameLowering::determineCalleeSaves(MachineFunction &MF,
                                             BitVector &SavedRegs,
                                             RegScavenger *RS) const {
   TargetFrameLowering::determineCalleeSaves(MF, SavedRegs, RS);
   // This tells PEI to spill the FP as if it is any other callee-save register
bool ARMFrameLowering::assignCalleeSavedSpillSlots(
   // For CMSE entry functions, handle floating-point context as if it was a
   // callee-saved register.
   if (STI.hasV8_1MMainlineOps() &&
       MF.getInfo<ARMFunctionInfo>()->isCmseNSEntryFunction()) {
     CSI.emplace_back(ARM::FPCXTNS);
     CSI.back().setRestored(false);
   }
 
+  // For functions, which sign their return address, upon function entry, the
+  // return address PAC is computed in R12. Treat R12 as a callee-saved register
+  // in this case.
+  const auto &AFI = *MF.getInfo<ARMFunctionInfo>();
+  if (AFI.shouldSignReturnAddress()) {
+    // The order of register must match the order we push them, because the
+    // PEI assigns frame indices in that order. When compiling for return
+    // address sign and authenication, we use split push, therefore the orders
+    // we want are:
+    // LR, R7, R6, R5, R4, <R12>, R11, R10,  R9,  R8, D15-D8
+    CSI.insert(find_if(CSI,
+                       [=](const auto &CS) {
+                         unsigned Reg = CS.getReg();
+                         return Reg == ARM::R10 || Reg == ARM::R11 ||
+                                Reg == ARM::R8 || Reg == ARM::R9 ||
+                                ARM::DPRRegClass.contains(Reg);
+                       }),
+               CalleeSavedInfo(ARM::R12));
+  }
+
   return false;
 }
 
 const TargetFrameLowering::SpillSlot *
 ARMFrameLowering::getCalleeSavedSpillSlots(unsigned &NumEntries) const {
   static const SpillSlot FixedSpillOffsets[] = {{ARM::FPCXTNS, -4}};
   NumEntries = array_lengthof(FixedSpillOffsets);
   return FixedSpillOffsets;

llvm/lib/Target/ARM/ARMISelLowering.cpp

 //===- ARMISelLowering.cpp - ARM DAG Lowering Implementation --------------===//
 //
 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
 // See https://llvm.org/LICENSE.txt for license information.
 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
 //
 //===----------------------------------------------------------------------===//
 //
bool ARMTargetLowering::IsEligibleForTailCallOptimization(
   const Function &CallerF = MF.getFunction();
   CallingConv::ID CallerCC = CallerF.getCallingConv();
 
   assert(Subtarget->supportsTailCall());
 
   // Indirect tail calls cannot be optimized for Thumb1 if the args
   // to the call take up r0-r3. The reason is that there are no legal registers
   // left to hold the pointer to the function to be called.
-  if (Subtarget->isThumb1Only() && Outs.size() >= 4 &&
-      (!isa<GlobalAddressSDNode>(Callee.getNode()) || isIndirect))
+  // Similarly, if the function uses return address sign and authentication,
+  // r12 is needed to hold the PAC and is not available to hold the callee
+  // address.
+  if (Outs.size() >= 4 &&
+      (!isa<GlobalAddressSDNode>(Callee.getNode()) || isIndirect)) {
+    if (Subtarget->isThumb1Only())
+      return false;
+    // Conservatively assume the function spills LR.
+    if (MF.getInfo<ARMFunctionInfo>()->shouldSignReturnAddress(true))
       return false;
+  }
 
   // Look for obvious safe cases to perform tail call optimization that do not
   // require ABI changes. This is what gcc calls sibcall.
 
   // Exception-handling functions need a special set of instructions to indicate
   // a return to the hardware. Tail-calling another function would probably
   // break this.
   if (CallerF.hasFnAttribute("interrupt"))

llvm/lib/Target/ARM/ARMLoadStoreOptimizer.cpp

 //===- ARMLoadStoreOptimizer.cpp - ARM load / store opt. pass -------------===//
 //
 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
 // See https://llvm.org/LICENSE.txt for license information.
 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
 //
 //===----------------------------------------------------------------------===//
 //
bool ARMLoadStoreOpt::runOnMachineFunction(MachineFunction &Fn) {
   isThumb2 = AFI->isThumb2Function();
   isThumb1 = AFI->isThumbFunction() && !isThumb2;
 
   bool Modified = false;
   for (MachineFunction::iterator MFI = Fn.begin(), E = Fn.end(); MFI != E;
        ++MFI) {
     MachineBasicBlock &MBB = *MFI;
     Modified |= LoadStoreMultipleOpti(MBB);
-    if (STI->hasV5TOps())
+    if (STI->hasV5TOps() && !AFI->shouldSignReturnAddress())
       Modified |= MergeReturnIntoLDM(MBB);
     if (isThumb1)
       Modified |= CombineMovBx(MBB);
   }
 
   Allocator.DestroyAll();
   return Modified;
 }

llvm/lib/Target/ARM/ARMMachineFunctionInfo.h

 //===-- ARMMachineFunctionInfo.h - ARM machine function info ----*- C++ -*-===//
 //
 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
 // See https://llvm.org/LICENSE.txt for license information.
 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
 //
 //===----------------------------------------------------------------------===//
 //
bool shouldSignReturnAddress() const {
     return shouldSignReturnAddress(LRSpilled);
   }
 
   bool shouldSignReturnAddress(bool SpillsLR) const {
     if (!SignReturnAddress)
       return false;
     if (SignReturnAddressAll)
       return true;
-    return LRSpilled;
+    return SpillsLR;
   }
 
   bool branchTargetEnforcement() const { return BranchTargetEnforcement; }
 };
 
 } // end namespace llvm
 
 #endif // LLVM_LIB_TARGET_ARM_ARMMACHINEFUNCTIONINFO_H

llvm/lib/Target/ARM/ARMRegisterInfo.td

 def FPSCR_NZCVQC
             : ARMReg<2, "fpscr_nzcvqc">;
 def P0      : ARMReg<13, "p0">;
 def FPCXTNS : ARMReg<14, "fpcxtns">;
 def FPCXTS  : ARMReg<15, "fpcxts">;
 
 def ZR  : ARMReg<15, "zr">,  DwarfRegNum<[15]>;
 
+def RA_AUTH_CODE : ARMReg<12, "ra_auth_code">, DwarfRegNum<[143]>;
+
 // Register classes.
 //
 // pc  == Program Counter
 // lr  == Link Register
 // sp  == Stack Pointer
 // r12 == ip (scratch)
 // r7  == Frame Pointer (thumb-style backtraces)
 // r9  == May be reserved as Thread Register

llvm/lib/Target/ARM/ARMSubtarget.h

 //===-- ARMSubtarget.h - Define Subtarget for the ARM ----------*- C++ -*--===//
 //
 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
 // See https://llvm.org/LICENSE.txt for license information.
 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
 //
 //===----------------------------------------------------------------------===//
 //
 // This file declares the ARM specific subclass of TargetSubtargetInfo.
 //
 //===----------------------------------------------------------------------===//
 
 #ifndef LLVM_LIB_TARGET_ARM_ARMSUBTARGET_H
 #define LLVM_LIB_TARGET_ARM_ARMSUBTARGET_H
 
 #include "ARMBaseInstrInfo.h"
 #include "ARMBaseRegisterInfo.h"
 #include "ARMConstantPoolValue.h"
 #include "ARMFrameLowering.h"
+#include "ARMMachineFunctionInfo.h"
 #include "ARMISelLowering.h"
 #include "ARMSelectionDAGInfo.h"
 #include "llvm/ADT/Triple.h"
 #include "llvm/Analysis/TargetTransformInfo.h"
 #include "llvm/CodeGen/GlobalISel/CallLowering.h"
 #include "llvm/CodeGen/GlobalISel/InstructionSelector.h"
 #include "llvm/CodeGen/GlobalISel/LegalizerInfo.h"
 #include "llvm/CodeGen/GlobalISel/RegisterBankInfo.h"
 #include "llvm/CodeGen/MachineFunction.h"
MCPhysReg getFramePointerReg() const {
     return ARM::R11;
   }
 
   /// Returns true if the frame setup is split into two separate pushes (first
   /// r0-r7,lr then r8-r11), principally so that the frame pointer is adjacent
   /// to lr. This is always required on Thumb1-only targets, as the push and
   /// pop instructions can't access the high registers.
   bool splitFramePushPop(const MachineFunction &MF) const {
+    if (MF.getInfo<ARMFunctionInfo>()->shouldSignReturnAddress())
+      return true;
     return (getFramePointerReg() == ARM::R7 &&
             MF.getTarget().Options.DisableFramePointerElim(MF)) ||
            isThumb1Only();
   }
 
   bool useStride4VFPs() const;
 
   bool useMovt() const;

llvm/lib/Target/ARM/AsmParser/ARMAsmParser.cpp

 //===- ARMAsmParser.cpp - Parse ARM assembly to MCInst instructions -------===//
 //
 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
 // See https://llvm.org/LICENSE.txt for license information.
 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
 //
 //===----------------------------------------------------------------------===//
 
class ARMAsmParser : public MCTargetAsmParser {
   bool validatetLDMRegList(const MCInst &Inst, const OperandVector &Operands,
                            unsigned ListNo, bool IsARPop = false);
   bool validatetSTMRegList(const MCInst &Inst, const OperandVector &Operands,
                            unsigned ListNo);
 
   int tryParseRegister();
   bool tryParseRegisterWithWriteBack(OperandVector &);
   int tryParseShiftRegister(OperandVector &);
-  bool parseRegisterList(OperandVector &, bool EnforceOrder = true);
+  bool parseRegisterList(OperandVector &, bool EnforceOrder = true,
+                         bool AllowRAAC = false);
   bool parseMemory(OperandVector &);
   bool parseOperand(OperandVector &, StringRef Mnemonic);
   bool parsePrefix(ARMMCExpr::VariantKind &RefKind);
   bool parseMemRegOffsetShift(ARM_AM::ShiftOpc &ShiftType,
                               unsigned &ShiftAmount);
   bool parseLiteralValues(unsigned Size, SMLoc L);
   bool parseDirectiveThumb(SMLoc L);
   bool parseDirectiveARM(SMLoc L);
for (auto I = Regs.rbegin(), J = I + 1, E = Regs.rend(); J != E; ++I, ++J) {
     if (J->first < Enc)
       break;
     std::swap(*I, *J);
   }
   return true;
 }
 
 /// Parse a register list.
 bool ARMAsmParser::parseRegisterList(OperandVector &Operands,
-                                     bool EnforceOrder) {
+                                     bool EnforceOrder, bool AllowRAAC) {
   MCAsmParser &Parser = getParser();
   if (Parser.getTok().isNot(AsmToken::LCurly))
     return TokError("Token is not a Left Curly Brace");
   SMLoc S = Parser.getTok().getLoc();
   Parser.Lex(); // Eat '{' token.
   SMLoc RegLoc = Parser.getTok().getLoc();
 
   // Check the first register in the list to see what register class
   // this is a list of.
   int Reg = tryParseRegister();
   if (Reg == -1)
     return Error(RegLoc, "register expected");
-
+  if (!AllowRAAC && Reg == ARM::RA_AUTH_CODE)
+    return Error(RegLoc, "pseudo-register not allowed");
   // The reglist instructions have at most 16 registers, so reserve
   // space for that many.
   int EReg = 0;
   SmallVector<std::pair<unsigned, unsigned>, 16> Registers;
 
   // Allow Q regs and just interpret them as the two D sub-registers.
   if (ARMMCRegisterClasses[ARM::QPRRegClassID].contains(Reg)) {
     Reg = getDRegFromQReg(Reg);
     EReg = MRI->getEncodingValue(Reg);
     Registers.emplace_back(EReg, Reg);
     ++Reg;
   }
   const MCRegisterClass *RC;
-  if (ARMMCRegisterClasses[ARM::GPRRegClassID].contains(Reg))
+  if (Reg == ARM::RA_AUTH_CODE ||
+      ARMMCRegisterClasses[ARM::GPRRegClassID].contains(Reg))
     RC = &ARMMCRegisterClasses[ARM::GPRRegClassID];
   else if (ARMMCRegisterClasses[ARM::DPRRegClassID].contains(Reg))
     RC = &ARMMCRegisterClasses[ARM::DPRRegClassID];
   else if (ARMMCRegisterClasses[ARM::SPRRegClassID].contains(Reg))
     RC = &ARMMCRegisterClasses[ARM::SPRRegClassID];
   else if (ARMMCRegisterClasses[ARM::GPRwithAPSRnospRegClassID].contains(Reg))
     RC = &ARMMCRegisterClasses[ARM::GPRwithAPSRnospRegClassID];
   else
     return Error(RegLoc, "invalid register in register list");
 
   // Store the register.
   EReg = MRI->getEncodingValue(Reg);
   Registers.emplace_back(EReg, Reg);
 
   // This starts immediately after the first register token in the list,
   // so we can see either a comma or a minus (range separator) as a legal
   // next token.
   while (Parser.getTok().is(AsmToken::Comma) ||
          Parser.getTok().is(AsmToken::Minus)) {
     if (Parser.getTok().is(AsmToken::Minus)) {
+      if (Reg == ARM::RA_AUTH_CODE)
+        return Error(RegLoc, "pseudo-register not allowed");
       Parser.Lex(); // Eat the minus.
       SMLoc AfterMinusLoc = Parser.getTok().getLoc();
       int EndReg = tryParseRegister();
       if (EndReg == -1)
         return Error(AfterMinusLoc, "register expected");
+      if (EndReg == ARM::RA_AUTH_CODE)
+        return Error(AfterMinusLoc, "pseudo-register not allowed");
       // Allow Q regs and just interpret them as the two D sub-registers.
       if (ARMMCRegisterClasses[ARM::QPRRegClassID].contains(EndReg))
         EndReg = getDRegFromQReg(EndReg) + 1;
       // If the register is the same as the start reg, there's nothing
       // more to do.
       if (Reg == EndReg)
         continue;
       // The register must be in the same register class as the first.
-      if (!RC->contains(EndReg))
+      if ((Reg == ARM::RA_AUTH_CODE &&
+           RC != &ARMMCRegisterClasses[ARM::GPRRegClassID]) ||
+          (Reg != ARM::RA_AUTH_CODE && !RC->contains(Reg)))
         return Error(AfterMinusLoc, "invalid register in register list");
       // Ranges must go from low to high.
       if (MRI->getEncodingValue(Reg) > MRI->getEncodingValue(EndReg))
         return Error(AfterMinusLoc, "bad range in register list");
 
       // Add all the registers in the range to the register list.
       while (Reg != EndReg) {
         Reg = getNextRegister(Reg);
         EReg = MRI->getEncodingValue(Reg);
         if (!insertNoDuplicates(Registers, EReg, Reg)) {
           Warning(AfterMinusLoc, StringRef("duplicated register (") +
                                      ARMInstPrinter::getRegisterName(Reg) +
                                      ") in register list");
         }
       }
       continue;
     }
     Parser.Lex(); // Eat the comma.
     RegLoc = Parser.getTok().getLoc();
     int OldReg = Reg;
     const AsmToken RegTok = Parser.getTok();
     Reg = tryParseRegister();
     if (Reg == -1)
       return Error(RegLoc, "register expected");
+    if (!AllowRAAC && Reg == ARM::RA_AUTH_CODE)
+      return Error(RegLoc, "pseudo-register not allowed");
     // Allow Q regs and just interpret them as the two D sub-registers.
     bool isQReg = false;
     if (ARMMCRegisterClasses[ARM::QPRRegClassID].contains(Reg)) {
       Reg = getDRegFromQReg(Reg);
       isQReg = true;
     }
-    if (!RC->contains(Reg) &&
+    if (Reg != ARM::RA_AUTH_CODE && !RC->contains(Reg) &&
         RC->getID() == ARMMCRegisterClasses[ARM::GPRRegClassID].getID() &&
         ARMMCRegisterClasses[ARM::GPRwithAPSRnospRegClassID].contains(Reg)) {
       // switch the register classes, as GPRwithAPSRnospRegClassID is a partial
       // subset of GPRRegClassId except it contains APSR as well.
       RC = &ARMMCRegisterClasses[ARM::GPRwithAPSRnospRegClassID];
     }
     if (Reg == ARM::VPR &&
         (RC == &ARMMCRegisterClasses[ARM::SPRRegClassID] ||
          RC == &ARMMCRegisterClasses[ARM::DPRRegClassID] ||
          RC == &ARMMCRegisterClasses[ARM::FPWithVPRRegClassID])) {
       RC = &ARMMCRegisterClasses[ARM::FPWithVPRRegClassID];
       EReg = MRI->getEncodingValue(Reg);
       if (!insertNoDuplicates(Registers, EReg, Reg)) {
         Warning(RegLoc, "duplicated register (" + RegTok.getString() +
                             ") in register list");
       }
       continue;
     }
     // The register must be in the same register class as the first.
-    if (!RC->contains(Reg))
+    if ((Reg == ARM::RA_AUTH_CODE &&
+         RC != &ARMMCRegisterClasses[ARM::GPRRegClassID]) ||
+        (Reg != ARM::RA_AUTH_CODE && !RC->contains(Reg)))
       return Error(RegLoc, "invalid register in register list");
     // In most cases, the list must be monotonically increasing. An
     // exception is CLRM, which is order-independent anyway, so
     // there's no potential for confusion if you write clrm {r2,r1}
     // instead of clrm {r1,r2}.
     if (EnforceOrder &&
         MRI->getEncodingValue(Reg) < MRI->getEncodingValue(OldReg)) {
       if (ARMMCRegisterClasses[ARM::GPRRegClassID].contains(Reg))
if (!UC.hasFnStart())
     return Error(L, ".fnstart must precede .save or .vsave directives");
   if (UC.hasHandlerData())
     return Error(L, ".save or .vsave must precede .handlerdata directive");
 
   // RAII object to make sure parsed operands are deleted.
   SmallVector<std::unique_ptr<MCParsedAsmOperand>, 1> Operands;
 
   // Parse the register list
-  if (parseRegisterList(Operands) ||
+  if (parseRegisterList(Operands, true, true) ||
       parseToken(AsmToken::EndOfStatement, "unexpected token in directive"))
     return true;
   ARMOperand &Op = (ARMOperand &)*Operands[0];
   if (!IsVector && !Op.isRegList())
     return Error(L, ".save expects GPR registers");
   if (IsVector && !Op.isDPRRegList())
     return Error(L, ".vsave expects DPR registers");
 

llvm/lib/Target/ARM/MCTargetDesc/ARMELFStreamer.cpp

 //===- lib/MC/ARMELFStreamer.cpp - ELF Object Output for ARM --------------===//
 //
 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
 // See https://llvm.org/LICENSE.txt for license information.
 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
 //
 //===----------------------------------------------------------------------===//
 //
void ARMELFStreamer::emitPad(int64_t Offset) {
   // Track the change of the $sp offset
   SPOffset -= Offset;
 
   // To squash multiple .pad directives, we should delay the unwind opcode
   // until the .save, .vsave, .handlerdata, or .fnend directives.
   PendingOffset -= Offset;
 }
 
-void ARMELFStreamer::emitRegSave(const SmallVectorImpl<unsigned> &RegList,
-                                 bool IsVector) {
-  // Collect the registers in the register list
-  unsigned Count = 0;
+static std::pair<unsigned, unsigned>
+collectHWRegs(const MCRegisterInfo &MRI, unsigned Idx,
+              const SmallVectorImpl<unsigned> &RegList, bool IsVector,
+              uint32_t &Mask_) {
   uint32_t Mask = 0;
-  const MCRegisterInfo *MRI = getContext().getRegisterInfo();
-  for (size_t i = 0; i < RegList.size(); ++i) {
-    unsigned Reg = MRI->getEncodingValue(RegList[i]);
+  unsigned Count = 0;
+  while (Idx > 0) {
+    unsigned Reg = RegList[Idx - 1];
+    if (Reg == ARM::RA_AUTH_CODE)
+      break;
+    Reg = MRI.getEncodingValue(Reg);
     assert(Reg < (IsVector ? 32U : 16U) && "Register out of range");
     unsigned Bit = (1u << Reg);
     if ((Mask & Bit) == 0) {
       Mask |= Bit;
       ++Count;
     }
+    --Idx;
   }
 
+  Mask_ = Mask;
+  return {Idx, Count};
+}
+
+void ARMELFStreamer::emitRegSave(const SmallVectorImpl<unsigned> &RegList,
+                                 bool IsVector) {
+  uint32_t Mask;
+  unsigned Idx, Count;
+  const MCRegisterInfo &MRI = *getContext().getRegisterInfo();
+
+  // Collect the registers in the register list. Issue unwinding instructions in
+  // three parts: ordinary hardware registers, return address authentication
+  // code pseudo register, the rest of the registers. The RA PAC is kept in an
+  // architectural register (usually r12), but we treat it as a special case in
+  // order to distinguish between that register containing RA PAC or a general
+  // value.
+  Idx = RegList.size();
+  while (Idx > 0) {
+    std::tie(Idx, Count) = collectHWRegs(MRI, Idx, RegList, IsVector, Mask);
+    if (Count) {
       // Track the change the $sp offset: For the .save directive, the
       // corresponding push instruction will decrease the $sp by (4 * Count).
       // For the .vsave directive, the corresponding vpush instruction will
       // decrease $sp by (8 * Count).
       SPOffset -= Count * (IsVector ? 8 : 4);
 
       // Emit the opcode
       FlushPendingOffset();
       if (IsVector)
         UnwindOpAsm.EmitVFPRegSave(Mask);
       else
         UnwindOpAsm.EmitRegSave(Mask);
+    } else if (Idx > 0 && RegList[Idx - 1] == ARM::RA_AUTH_CODE) {
+      --Idx;
+      SPOffset -= 4;
+      FlushPendingOffset();
+      UnwindOpAsm.EmitRegSave(0);
+    }
+  }
 }
 
 void ARMELFStreamer::emitUnwindRaw(int64_t Offset,
                                    const SmallVectorImpl<uint8_t> &Opcodes) {
   FlushPendingOffset();
   SPOffset = SPOffset - Offset;
   UnwindOpAsm.EmitRaw(Opcodes);
 }

llvm/lib/Target/ARM/MCTargetDesc/ARMUnwindOpAsm.cpp

 //===-- ARMUnwindOpAsm.cpp - ARM Unwind Opcodes Assembler -------*- C++ -*-===//
 //
 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
 // See https://llvm.org/LICENSE.txt for license information.
 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
 //
 //===----------------------------------------------------------------------===//
 //
void FillFinishOpcode() {
       while (Pos < Vec.size())
         EmitByte(ARM::EHABI::UNWIND_OPCODE_FINISH);
     }
   };
 
 } // end anonymous namespace
 
 void UnwindOpcodeAssembler::EmitRegSave(uint32_t RegSave) {
-  if (RegSave == 0u)
+  if (RegSave == 0u) {
+    // That's the special case for RA PAC.
+    EmitInt8(ARM::EHABI::UNWIND_OPCODE_POP_RA_AUTH_CODE);
     return;
+  }
 
   // One byte opcode to save register r14 and r11-r4
   if (RegSave & (1u << 4)) {
     // The one byte opcode will always save r4, thus we can't use the one byte
     // opcode when r4 is not in .save directive.
 
     // Compute the consecutive registers from r4 to r11.
     uint32_t Mask = RegSave & 0xff0u;

llvm/test/CodeGen/ARM/2012-10-04-AAPCS-byval-align8.ll

 ; RUN: llc < %s -mtriple=armv7-none-linux-gnueabi | FileCheck %s
 ; Test that we correctly use registers and align elements when using va_arg
 
 %struct_t = type { double, double, double }
 @static_val = constant %struct_t { double 1.0, double 2.0, double 3.0 }
 
 declare void @llvm.va_start(i8*) nounwind
 declare void @llvm.va_end(i8*) nounwind
 
 ; CHECK-LABEL: test_byval_8_bytes_alignment:
 define void @test_byval_8_bytes_alignment(i32 %i, ...) {
 entry:
-; CHECK: sub       sp, sp, #12
-; CHECK: sub       sp, sp, #4
+; CHECK: sub       sp, sp, #16
 ; CHECK: add       r0, sp, #4
 ; CHECK: stmib     sp, {r1, r2, r3}
   %g = alloca i8*
   %g1 = bitcast i8** %g to i8*
   call void @llvm.va_start(i8* %g1)
 
 ; CHECK: add  [[REG:(r[0-9]+)|(lr)]], {{(r[0-9]+)|(lr)}}, #7
 ; CHECK: bic  [[REG]], [[REG]], #7

llvm/test/CodeGen/ARM/ipra-reg-usage.ll

 ; RUN: llc -mcpu=cortex-a8 -enable-ipra -print-regusage -o /dev/null 2>&1 < %s | FileCheck %s
 ; ipra used to wrongly assumed that registers without subregisters were saved.
 ; In that example, r0 wouldn't be in the list of clobbered registers.
 target datalayout = "e-p:32:32:32-i1:8:8-i8:8:8-i16:16:16-i32:32:32-i64:64:64-f32:32:32-f64:64:64-v64:64:64-v128:128:128-a0:0:64"
 target triple = "armv7-eabi"
 
 declare void @bar1()
 define void @foo()#0 {
-; CHECK: foo Clobbered Registers: $apsr $apsr_nzcv $cpsr $fpcxtns $fpcxts $fpexc $fpinst $fpscr $fpscr_nzcv $fpscr_nzcvqc $fpsid $itstate $pc $sp $spsr $vpr $zr $d0 $d1 $d2 $d3 $d4 $d5 $d6 $d7 $d16 $d17 $d18 $d19 $d20 $d21 $d22 $d23 $d24 $d25 $d26 $d27 $d28 $d29 $d30 $d31 $fpinst2 $mvfr0 $mvfr1 $mvfr2 $p0 $q0 $q1 $q2 $q3 $q8 $q9 $q10 $q11 $q12 $q13 $q14 $q15 $r0 $r1 $r2 $r3 $r12 $s0 $s1 $s2 $s3 $s4 $s5 $s6 $s7 $s8 $s9 $s10 $s11 $s12 $s13 $s14 $s15 $d0_d2 $d1_d3 $d2_d4 $d3_d5 $d4_d6 $d5_d7 $d6_d8 $d7_d9 $d14_d16 $d15_d17 $d16_d18 $d17_d19 $d18_d20 $d19_d21 $d20_d22 $d21_d23 $d22_d24 $d23_d25 $d24_d26 $d25_d27 $d26_d28 $d27_d29 $d28_d30 $d29_d31 $q0_q1 $q1_q2 $q2_q3 $q3_q4 $q7_q8 $q8_q9 $q9_q10 $q10_q11 $q11_q12 $q12_q13 $q13_q14 $q14_q15 $q0_q1_q2_q3 $q1_q2_q3_q4 $q2_q3_q4_q5 $q3_q4_q5_q6 $q5_q6_q7_q8 $q6_q7_q8_q9 $q7_q8_q9_q10 $q8_q9_q10_q11 $q9_q10_q11_q12 $q10_q11_q12_q13 $q11_q12_q13_q14 $q12_q13_q14_q15 $r0_r1 $r2_r3 $r12_sp $d0_d1_d2 $d1_d2_d3 $d2_d3_d4 $d3_d4_d5 $d4_d5_d6 $d5_d6_d7 $d6_d7_d8 $d7_d8_d9 $d14_d15_d16 $d15_d16_d17 $d16_d17_d18 $d17_d18_d19 $d18_d19_d20 $d19_d20_d21 $d20_d21_d22 $d21_d22_d23 $d22_d23_d24 $d23_d24_d25 $d24_d25_d26 $d25_d26_d27 $d26_d27_d28 $d27_d28_d29 $d28_d29_d30 $d29_d30_d31 $d0_d2_d4 $d1_d3_d5 $d2_d4_d6 $d3_d5_d7 $d4_d6_d8 $d5_d7_d9 $d6_d8_d10 $d7_d9_d11 $d12_d14_d16 $d13_d15_d17 $d14_d16_d18 $d15_d17_d19 $d16_d18_d20 $d17_d19_d21 $d18_d20_d22 $d19_d21_d23 $d20_d22_d24 $d21_d23_d25 $d22_d24_d26 $d23_d25_d27 $d24_d26_d28 $d25_d27_d29 $d26_d28_d30 $d27_d29_d31 $d0_d2_d4_d6 $d1_d3_d5_d7 $d2_d4_d6_d8 $d3_d5_d7_d9 $d4_d6_d8_d10 $d5_d7_d9_d11 $d6_d8_d10_d12 $d7_d9_d11_d13 $d10_d12_d14_d16 $d11_d13_d15_d17 $d12_d14_d16_d18 $d13_d15_d17_d19 $d14_d16_d18_d20 $d15_d17_d19_d21 $d16_d18_d20_d22 $d17_d19_d21_d23 $d18_d20_d22_d24 $d19_d21_d23_d25 $d20_d22_d24_d26 $d21_d23_d25_d27 $d22_d24_d26_d28 $d23_d25_d27_d29 $d24_d26_d28_d30 $d25_d27_d29_d31 $d1_d2 $d3_d4 $d5_d6 $d7_d8 $d15_d16 $d17_d18 $d19_d20 $d21_d22 $d23_d24 $d25_d26 $d27_d28 $d29_d30 $d1_d2_d3_d4 $d3_d4_d5_d6 $d5_d6_d7_d8 $d7_d8_d9_d10 $d13_d14_d15_d16 $d15_d16_d17_d18 $d17_d18_d19_d20 $d19_d20_d21_d22 $d21_d22_d23_d24 $d23_d24_d25_d26 $d25_d26_d27_d28 $d27_d28_d29_d30
+; CHECK: foo Clobbered Registers: $apsr $apsr_nzcv $cpsr $fpcxtns $fpcxts $fpexc $fpinst $fpscr $fpscr_nzcv $fpscr_nzcvqc $fpsid $itstate $pc $ra_auth_code $sp $spsr $vpr $zr $d0 $d1 $d2 $d3 $d4 $d5 $d6 $d7 $d16 $d17 $d18 $d19 $d20 $d21 $d22 $d23 $d24 $d25 $d26 $d27 $d28 $d29 $d30 $d31 $fpinst2 $mvfr0 $mvfr1 $mvfr2 $p0 $q0 $q1 $q2 $q3 $q8 $q9 $q10 $q11 $q12 $q13 $q14 $q15 $r0 $r1 $r2 $r3 $r12 $s0 $s1 $s2 $s3 $s4 $s5 $s6 $s7 $s8 $s9 $s10 $s11 $s12 $s13 $s14 $s15 $d0_d2 $d1_d3 $d2_d4 $d3_d5 $d4_d6 $d5_d7 $d6_d8 $d7_d9 $d14_d16 $d15_d17 $d16_d18 $d17_d19 $d18_d20 $d19_d21 $d20_d22 $d21_d23 $d22_d24 $d23_d25 $d24_d26 $d25_d27 $d26_d28 $d27_d29 $d28_d30 $d29_d31 $q0_q1 $q1_q2 $q2_q3 $q3_q4 $q7_q8 $q8_q9 $q9_q10 $q10_q11 $q11_q12 $q12_q13 $q13_q14 $q14_q15 $q0_q1_q2_q3 $q1_q2_q3_q4 $q2_q3_q4_q5 $q3_q4_q5_q6 $q5_q6_q7_q8 $q6_q7_q8_q9 $q7_q8_q9_q10 $q8_q9_q10_q11 $q9_q10_q11_q12 $q10_q11_q12_q13 $q11_q12_q13_q14 $q12_q13_q14_q15 $r0_r1 $r2_r3 $r12_sp $d0_d1_d2 $d1_d2_d3 $d2_d3_d4 $d3_d4_d5 $d4_d5_d6 $d5_d6_d7 $d6_d7_d8 $d7_d8_d9 $d14_d15_d16 $d15_d16_d17 $d16_d17_d18 $d17_d18_d19 $d18_d19_d20 $d19_d20_d21 $d20_d21_d22 $d21_d22_d23 $d22_d23_d24 $d23_d24_d25 $d24_d25_d26 $d25_d26_d27 $d26_d27_d28 $d27_d28_d29 $d28_d29_d30 $d29_d30_d31 $d0_d2_d4 $d1_d3_d5 $d2_d4_d6 $d3_d5_d7 $d4_d6_d8 $d5_d7_d9 $d6_d8_d10 $d7_d9_d11 $d12_d14_d16 $d13_d15_d17 $d14_d16_d18 $d15_d17_d19 $d16_d18_d20 $d17_d19_d21 $d18_d20_d22 $d19_d21_d23 $d20_d22_d24 $d21_d23_d25 $d22_d24_d26 $d23_d25_d27 $d24_d26_d28 $d25_d27_d29 $d26_d28_d30 $d27_d29_d31 $d0_d2_d4_d6 $d1_d3_d5_d7 $d2_d4_d6_d8 $d3_d5_d7_d9 $d4_d6_d8_d10 $d5_d7_d9_d11 $d6_d8_d10_d12 $d7_d9_d11_d13 $d10_d12_d14_d16 $d11_d13_d15_d17 $d12_d14_d16_d18 $d13_d15_d17_d19 $d14_d16_d18_d20 $d15_d17_d19_d21 $d16_d18_d20_d22 $d17_d19_d21_d23 $d18_d20_d22_d24 $d19_d21_d23_d25 $d20_d22_d24_d26 $d21_d23_d25_d27 $d22_d24_d26_d28 $d23_d25_d27_d29 $d24_d26_d28_d30 $d25_d27_d29_d31 $d1_d2 $d3_d4 $d5_d6 $d7_d8 $d15_d16 $d17_d18 $d19_d20 $d21_d22 $d23_d24 $d25_d26 $d27_d28 $d29_d30 $d1_d2_d3_d4 $d3_d4_d5_d6 $d5_d6_d7_d8 $d7_d8_d9_d10 $d13_d14_d15_d16 $d15_d16_d17_d18 $d17_d18_d19_d20 $d19_d20_d21_d22 $d21_d22_d23_d24 $d23_d24_d25_d26 $d25_d26_d27_d28 $d27_d28_d29_d30
   call void @bar1()
   call void @bar2()
   ret void
 }
 
 @llvm.used = appending global [1 x i8*] [i8* bitcast (void ()* @foo to i8*)]
 
 declare void @bar2()
 attributes #0 = {nounwind}

llvm/test/CodeGen/ARM/machine-outliner-calls.mir

 body:             |
   bb.0:
     BX_RET 14, $noreg
 
 
   ; CHECK-LABEL: name: OUTLINED_FUNCTION_0
   ; CHECK: bb.0:
   ; CHECK:   liveins: $r11, $r10, $r9, $r8, $r7, $r6, $r5, $d15, $d14, $d13, $d12, $d11, $d10, $d9, $d8, $lr
-  ; CHECK:   early-clobber $sp = STR_PRE_IMM killed $lr, $sp, -8, 14 /* CC::al */, $noreg
+  ; CHECK:   early-clobber $sp = frame-setup STR_PRE_IMM killed $lr, $sp, -8, 14 /* CC::al */, $noreg
   ; CHECK:   frame-setup CFI_INSTRUCTION def_cfa_offset 8
   ; CHECK:   frame-setup CFI_INSTRUCTION offset $lr, -8
   ; CHECK:   BL @bar, implicit-def dead $lr, implicit $sp
   ; CHECK:   $r0 = MOVi 1, 14 /* CC::al */, $noreg, $noreg
   ; CHECK:   $r1 = MOVi 1, 14 /* CC::al */, $noreg, $noreg
   ; CHECK:   $r2 = MOVi 1, 14 /* CC::al */, $noreg, $noreg
   ; CHECK:   $r3 = MOVi 1, 14 /* CC::al */, $noreg, $noreg
   ; CHECK:   $r4 = MOVi 1, 14 /* CC::al */, $noreg, $noreg
-  ; CHECK:   $lr, $sp = LDR_POST_IMM $sp, $noreg, 8, 14 /* CC::al */, $noreg
+  ; CHECK:   $lr, $sp = frame-destroy LDR_POST_IMM $sp, $noreg, 8, 14 /* CC::al */, $noreg
   ; CHECK:   MOVPCLR 14 /* CC::al */, $noreg
 
   ; CHECK-LABEL: name: OUTLINED_FUNCTION_1
   ; CHECK: bb.0:
   ; CHECK:   liveins: $r11, $r10, $r9, $r8, $r7, $r6, $r5, $d15, $d14, $d13, $d12, $d11, $d10, $d9, $d8, $lr
-  ; CHECK:   early-clobber $sp = STR_PRE_IMM killed $lr, $sp, -8, 14 /* CC::al */, $noreg
+  ; CHECK:   early-clobber $sp = frame-setup STR_PRE_IMM killed $lr, $sp, -8, 14 /* CC::al */, $noreg
   ; CHECK:   frame-setup CFI_INSTRUCTION def_cfa_offset 8
   ; CHECK:   frame-setup CFI_INSTRUCTION offset $lr, -8
   ; CHECK:   BL @bar, implicit-def dead $lr, implicit $sp
   ; CHECK:   $r0 = MOVi 2, 14 /* CC::al */, $noreg, $noreg
   ; CHECK:   $r1 = MOVi 2, 14 /* CC::al */, $noreg, $noreg
   ; CHECK:   $r2 = MOVi 2, 14 /* CC::al */, $noreg, $noreg
   ; CHECK:   $r3 = MOVi 2, 14 /* CC::al */, $noreg, $noreg
   ; CHECK:   $r4 = MOVi 2, 14 /* CC::al */, $noreg, $noreg
-  ; CHECK:   $lr, $sp = LDR_POST_IMM $sp, $noreg, 8, 14 /* CC::al */, $noreg
+  ; CHECK:   $lr, $sp = frame-destroy LDR_POST_IMM $sp, $noreg, 8, 14 /* CC::al */, $noreg
   ; CHECK:   TAILJMPd @bar, implicit $sp
 
   ; CHECK-LABEL: name: OUTLINED_FUNCTION_2
   ; CHECK: bb.0:
   ; CHECK:   liveins: $r11, $r10, $r9, $r8, $r7, $r6, $r5, $d15, $d14, $d13, $d12, $d11, $d10, $d9, $d8
   ; CHECK:   $r0 = MOVi 3, 14 /* CC::al */, $noreg, $noreg
   ; CHECK:   $r1 = MOVi 3, 14 /* CC::al */, $noreg, $noreg
   ; CHECK:   $r2 = MOVi 3, 14 /* CC::al */, $noreg, $noreg
   ; CHECK:   $r3 = MOVi 3, 14 /* CC::al */, $noreg, $noreg
   ; CHECK:   $r4 = MOVi 3, 14 /* CC::al */, $noreg, $noreg
   ; CHECK:   MOVPCLR 14 /* CC::al */, $noreg
 
   ; CHECK-LABEL: name: OUTLINED_FUNCTION_3
   ; CHECK: bb.0:
   ; CHECK:   liveins: $r11, $r10, $r9, $r8, $r6, $r5, $r4, $d15, $d14, $d13, $d12, $d11, $d10, $d9, $d8, $lr
-  ; CHECK:   early-clobber $sp = t2STR_PRE killed $lr, $sp, -8, 14 /* CC::al */, $noreg
+  ; CHECK:   early-clobber $sp = frame-setup t2STR_PRE killed $lr, $sp, -8, 14 /* CC::al */, $noreg
   ; CHECK:   frame-setup CFI_INSTRUCTION def_cfa_offset 8
   ; CHECK:   frame-setup CFI_INSTRUCTION offset $lr, -8
   ; CHECK:   tBL 14 /* CC::al */, $noreg, @bar, implicit-def dead $lr, implicit $sp
   ; CHECK:   $r0 = t2MOVi 2, 14 /* CC::al */, $noreg, $noreg
   ; CHECK:   $r1 = t2MOVi 2, 14 /* CC::al */, $noreg, $noreg
   ; CHECK:   $r2 = t2MOVi 2, 14 /* CC::al */, $noreg, $noreg
-  ; CHECK:   $lr, $sp = t2LDR_POST $sp, 8, 14 /* CC::al */, $noreg
+  ; CHECK:   $lr, $sp = frame-destroy t2LDR_POST $sp, 8, 14 /* CC::al */, $noreg
   ; CHECK:   tTAILJMPdND @bar, 14 /* CC::al */, $noreg, implicit $sp
 
   ; CHECK-LABEL: name: OUTLINED_FUNCTION_4
   ; CHECK: bb.0:
   ; CHECK:   liveins: $r11, $r10, $r9, $r8, $r6, $r5, $r4, $d15, $d14, $d13, $d12, $d11, $d10, $d9, $d8, $lr
-  ; CHECK:   early-clobber $sp = t2STR_PRE killed $lr, $sp, -8, 14 /* CC::al */, $noreg
+  ; CHECK:   early-clobber $sp = frame-setup t2STR_PRE killed $lr, $sp, -8, 14 /* CC::al */, $noreg
   ; CHECK:   frame-setup CFI_INSTRUCTION def_cfa_offset 8
   ; CHECK:   frame-setup CFI_INSTRUCTION offset $lr, -8
   ; CHECK:   tBL 14 /* CC::al */, $noreg, @bar, implicit-def dead $lr, implicit $sp
   ; CHECK:   $r0 = t2MOVi 1, 14 /* CC::al */, $noreg, $noreg
   ; CHECK:   $r1 = t2MOVi 1, 14 /* CC::al */, $noreg, $noreg
   ; CHECK:   $r2 = t2MOVi 1, 14 /* CC::al */, $noreg, $noreg
-  ; CHECK:   $lr, $sp = t2LDR_POST $sp, 8, 14 /* CC::al */, $noreg
+  ; CHECK:   $lr, $sp = frame-destroy t2LDR_POST $sp, 8, 14 /* CC::al */, $noreg
   ; CHECK:   tBX_RET 14 /* CC::al */, $noreg
 
 
 

llvm/test/CodeGen/ARM/machine-outliner-default.mir

 ---
 
 name:           outline_default_arm
 tracksRegLiveness: true
 body:             |
   ; CHECK-LABEL: name: outline_default_arm
   ; CHECK: bb.0:
   ; CHECK:   liveins: $lr
-  ; CHECK:   early-clobber $sp = STR_PRE_IMM killed $lr, $sp, -8, 14 /* CC::al */, $noreg
+  ; CHECK:   early-clobber $sp = frame-setup STR_PRE_IMM killed $lr, $sp, -8, 14 /* CC::al */, $noreg
   ; CHECK:   BL @OUTLINED_FUNCTION_0
-  ; CHECK:   $lr, $sp = LDR_POST_IMM $sp, $noreg, 8, 14 /* CC::al */, $noreg
+  ; CHECK:   $lr, $sp = frame-destroy LDR_POST_IMM $sp, $noreg, 8, 14 /* CC::al */, $noreg
   ; CHECK: bb.1:
   ; CHECK:   liveins: $lr, $r6, $r7, $r8, $r9, $r10, $r11
-  ; CHECK:   early-clobber $sp = STR_PRE_IMM killed $lr, $sp, -8, 14 /* CC::al */, $noreg
+  ; CHECK:   early-clobber $sp = frame-setup STR_PRE_IMM killed $lr, $sp, -8, 14 /* CC::al */, $noreg
   ; CHECK:   BL @OUTLINED_FUNCTION_0
-  ; CHECK:   $lr, $sp = LDR_POST_IMM $sp, $noreg, 8, 14 /* CC::al */, $noreg
+  ; CHECK:   $lr, $sp = frame-destroy LDR_POST_IMM $sp, $noreg, 8, 14 /* CC::al */, $noreg
   ; CHECK: bb.2:
   ; CHECK:   liveins: $lr, $r6, $r7, $r8, $r9, $r10, $r11
-  ; CHECK:   early-clobber $sp = STR_PRE_IMM killed $lr, $sp, -8, 14 /* CC::al */, $noreg
+  ; CHECK:   early-clobber $sp = frame-setup STR_PRE_IMM killed $lr, $sp, -8, 14 /* CC::al */, $noreg
   ; CHECK:   BL @OUTLINED_FUNCTION_0
-  ; CHECK:   $lr, $sp = LDR_POST_IMM $sp, $noreg, 8, 14 /* CC::al */, $noreg
+  ; CHECK:   $lr, $sp = frame-destroy LDR_POST_IMM $sp, $noreg, 8, 14 /* CC::al */, $noreg
   ; CHECK: bb.3:
   ; CHECK:   liveins: $lr, $r6, $r7, $r8, $r9, $r10, $r11
   ; CHECK:   $r2 = MOVr $lr, 14 /* CC::al */, $noreg, $noreg
   ; CHECK:   BX_RET 14 /* CC::al */, $noreg
   bb.0:
     liveins: $lr
     $r0 = MOVi 1, 14, $noreg, $noreg
     $r1 = MOVi 1, 14, $noreg, $noreg

 ---
 
 name:           outline_default_thumb
 tracksRegLiveness: true
 body:             |
   ; CHECK-LABEL: name: outline_default_thumb
   ; CHECK: bb.0:
   ; CHECK:   liveins: $lr
-  ; CHECK:   early-clobber $sp = t2STR_PRE killed $lr, $sp, -8, 14 /* CC::al */, $noreg
+  ; CHECK:   early-clobber $sp = frame-setup t2STR_PRE killed $lr, $sp, -8, 14 /* CC::al */, $noreg
   ; CHECK:   tBL 14 /* CC::al */, $noreg, @OUTLINED_FUNCTION_1
-  ; CHECK:   $lr, $sp = t2LDR_POST $sp, 8, 14 /* CC::al */, $noreg
+  ; CHECK:   $lr, $sp = frame-destroy t2LDR_POST $sp, 8, 14 /* CC::al */, $noreg
   ; CHECK: bb.1:
   ; CHECK:   liveins: $lr, $r4, $r5, $r6, $r7, $r8, $r9, $r10, $r11
-  ; CHECK:   early-clobber $sp = t2STR_PRE killed $lr, $sp, -8, 14 /* CC::al */, $noreg
+  ; CHECK:   early-clobber $sp = frame-setup t2STR_PRE killed $lr, $sp, -8, 14 /* CC::al */, $noreg
   ; CHECK:   tBL 14 /* CC::al */, $noreg, @OUTLINED_FUNCTION_1
-  ; CHECK:   $lr, $sp = t2LDR_POST $sp, 8, 14 /* CC::al */, $noreg
+  ; CHECK:   $lr, $sp = frame-destroy t2LDR_POST $sp, 8, 14 /* CC::al */, $noreg
   ; CHECK: bb.2:
   ; CHECK:   liveins: $lr, $r4, $r5, $r6, $r7, $r8, $r9, $r10, $r11
-  ; CHECK:   early-clobber $sp = t2STR_PRE killed $lr, $sp, -8, 14 /* CC::al */, $noreg
+  ; CHECK:   early-clobber $sp = frame-setup t2STR_PRE killed $lr, $sp, -8, 14 /* CC::al */, $noreg
   ; CHECK:   tBL 14 /* CC::al */, $noreg, @OUTLINED_FUNCTION_1
-  ; CHECK:   $lr, $sp = t2LDR_POST $sp, 8, 14 /* CC::al */, $noreg
+  ; CHECK:   $lr, $sp = frame-destroy t2LDR_POST $sp, 8, 14 /* CC::al */, $noreg
   ; CHECK: bb.3:
   ; CHECK:   liveins: $lr, $r4, $r5, $r6, $r7, $r8, $r9, $r10, $r11
   ; CHECK:   $r2 = tMOVr $lr, 14 /* CC::al */, $noreg
   ; CHECK:   tBX_RET 14 /* CC::al */, $noreg
   bb.0:
     liveins: $lr
     $r0 = t2MOVi 1, 14, $noreg, $noreg
     $r1 = t2MOVi 1, 14, $noreg, $noreg

llvm/test/CodeGen/ARM/machine-outliner-lr-regsave.mir

body:             |
   ; CHECK:   $lr = MOVr killed $r6, 14 /* CC::al */, $noreg, $noreg
   ; CHECK: bb.1:
   ; CHECK:   liveins: $lr
   ; CHECK:   $r6 = MOVr killed $lr, 14 /* CC::al */, $noreg, $noreg
   ; CHECK:   BL @OUTLINED_FUNCTION_1
   ; CHECK:   $lr = MOVr killed $r6, 14 /* CC::al */, $noreg, $noreg
   ; CHECK: bb.2:
   ; CHECK:   liveins: $lr
-  ; CHECK:   early-clobber $sp = STR_PRE_IMM killed $lr, $sp, -8, 14 /* CC::al */, $noreg
+  ; CHECK:   early-clobber $sp = frame-setup STR_PRE_IMM killed $lr, $sp, -8, 14 /* CC::al */, $noreg
   ; CHECK:   BL @OUTLINED_FUNCTION_1
-  ; CHECK:   $lr, $sp = LDR_POST_IMM $sp, $noreg, 8, 14 /* CC::al */, $noreg
+  ; CHECK:   $lr, $sp = frame-destroy LDR_POST_IMM $sp, $noreg, 8, 14 /* CC::al */, $noreg
   ; CHECK: bb.3:
   ; CHECK:   liveins: $lr, $r0, $r6, $r7, $r8, $r9, $r10, $r11
   ; CHECK:   $r6 = MOVr killed $lr, 14 /* CC::al */, $noreg, $noreg
   ; CHECK:   BL @OUTLINED_FUNCTION_1
   ; CHECK:   $lr = MOVr killed $r6, 14 /* CC::al */, $noreg, $noreg
   ; CHECK: bb.4:
   ; CHECK:   liveins: $lr
   ; CHECK:   $r2 = MOVr $lr, 14 /* CC::al */, $noreg, $noreg
body:             |
   ; CHECK:   $lr = tMOVr killed $r6, 14 /* CC::al */, $noreg
   ; CHECK: bb.1:
   ; CHECK:   liveins: $lr
   ; CHECK:   $r6 = tMOVr killed $lr, 14 /* CC::al */, $noreg
   ; CHECK:   tBL 14 /* CC::al */, $noreg, @OUTLINED_FUNCTION_0
   ; CHECK:   $lr = tMOVr killed $r6, 14 /* CC::al */, $noreg
   ; CHECK: bb.2:
   ; CHECK:   liveins: $lr
-  ; CHECK:   early-clobber $sp = t2STR_PRE killed $lr, $sp, -8, 14 /* CC::al */, $noreg
+  ; CHECK:   early-clobber $sp = frame-setup t2STR_PRE killed $lr, $sp, -8, 14 /* CC::al */, $noreg
   ; CHECK:   tBL 14 /* CC::al */, $noreg, @OUTLINED_FUNCTION_0
-  ; CHECK:   $lr, $sp = t2LDR_POST $sp, 8, 14 /* CC::al */, $noreg
+  ; CHECK:   $lr, $sp = frame-destroy t2LDR_POST $sp, 8, 14 /* CC::al */, $noreg
   ; CHECK: bb.3:
   ; CHECK:   liveins: $lr, $r0, $r6, $r7
   ; CHECK:   $r6 = tMOVr killed $lr, 14 /* CC::al */, $noreg
   ; CHECK:   tBL 14 /* CC::al */, $noreg, @OUTLINED_FUNCTION_0
   ; CHECK:   $lr = tMOVr killed $r6, 14 /* CC::al */, $noreg
   ; CHECK: bb.4:
   ; CHECK:   liveins: $lr
   ; CHECK:   $r2 = tMOVr $lr, 14 /* CC::al */, $noreg

llvm/test/CodeGen/ARM/machine-outliner-stack-fixup-arm.mir

 tracksRegLiveness: true
 body:             |
   bb.0:
     liveins: $lr
 
     BX_RET 14, $noreg
 
     ;CHECK: name:           OUTLINED_FUNCTION_[[I5]]
-    ;CHECK: early-clobber $sp = STR_PRE_IMM killed $lr, $sp, -8, 14 /* CC::al */, $noreg
+    ;CHECK: early-clobber $sp = frame-setup STR_PRE_IMM killed $lr, $sp, -8, 14 /* CC::al */, $noreg
     ;CHECK-NEXT: frame-setup CFI_INSTRUCTION def_cfa_offset 8
     ;CHECK-NEXT: frame-setup CFI_INSTRUCTION offset $lr, -8
     ;CHECK-NEXT: BL @foo, implicit-def dead $lr, implicit $sp
     ;CHECK-NEXT: $d0 = VLDRD $sp, 2, 14 /* CC::al */, $noreg
     ;CHECK-NEXT: $d1 = VLDRD $sp, 10, 14 /* CC::al */, $noreg
     ;CHECK-NEXT: $d4 = VLDRD $sp, 255, 14 /* CC::al */, $noreg
-    ;CHECK-NEXT: $lr, $sp = LDR_POST_IMM $sp, $noreg, 8, 14 /* CC::al */, $noreg
+    ;CHECK-NEXT: $lr, $sp = frame-destroy LDR_POST_IMM $sp, $noreg, 8, 14 /* CC::al */, $noreg
 
     ;CHECK: name:           OUTLINED_FUNCTION_[[I5FP16]]
-    ;CHECK: early-clobber $sp = STR_PRE_IMM killed $lr, $sp, -8, 14 /* CC::al */, $noreg
+    ;CHECK: early-clobber $sp = frame-setup STR_PRE_IMM killed $lr, $sp, -8, 14 /* CC::al */, $noreg
     ;CHECK-NEXT: frame-setup CFI_INSTRUCTION def_cfa_offset 8
     ;CHECK-NEXT: frame-setup CFI_INSTRUCTION offset $lr, -8
     ;CHECK-NEXT: BL @foo, implicit-def dead $lr, implicit $sp
     ;CHECK-NEXT: $s1 = VLDRH $sp, 4, 14, $noreg
     ;CHECK-NEXT: $s2 = VLDRH $sp, 12, 14, $noreg
     ;CHECK-NEXT: $s5 = VLDRH $sp, 244, 14, $noreg
-    ;CHECK-NEXT: $lr, $sp = LDR_POST_IMM $sp, $noreg, 8, 14 /* CC::al */, $noreg
+    ;CHECK-NEXT: $lr, $sp = frame-destroy LDR_POST_IMM $sp, $noreg, 8, 14 /* CC::al */, $noreg
 
     ;CHECK: name:           OUTLINED_FUNCTION_[[I12]]
-    ;CHECK: early-clobber $sp = STR_PRE_IMM killed $lr, $sp, -8, 14 /* CC::al */, $noreg
+    ;CHECK: early-clobber $sp = frame-setup STR_PRE_IMM killed $lr, $sp, -8, 14 /* CC::al */, $noreg
     ;CHECK-NEXT: frame-setup CFI_INSTRUCTION def_cfa_offset 8
     ;CHECK-NEXT: frame-setup CFI_INSTRUCTION offset $lr, -8
     ;CHECK-NEXT: BL @foo, implicit-def dead $lr, implicit $sp
     ;CHECK-NEXT: $r1 = LDRi12 $sp, 8, 14 /* CC::al */, $noreg
     ;CHECK-NEXT: $r2 = LDRi12 $sp, 16, 14 /* CC::al */, $noreg
     ;CHECK-NEXT: $r5 = LDRi12 $sp, 4094, 14 /* CC::al */, $noreg
-    ;CHECK-NEXT: $lr, $sp = LDR_POST_IMM $sp, $noreg, 8, 14 /* CC::al */, $noreg
+    ;CHECK-NEXT: $lr, $sp = frame-destroy LDR_POST_IMM $sp, $noreg, 8, 14 /* CC::al */, $noreg
 
     ;CHECK: name:           OUTLINED_FUNCTION_[[I3]]
-    ;CHECK: early-clobber $sp = STR_PRE_IMM killed $lr, $sp, -8, 14 /* CC::al */, $noreg
+    ;CHECK: early-clobber $sp = frame-setup STR_PRE_IMM killed $lr, $sp, -8, 14 /* CC::al */, $noreg
     ;CHECK-NEXT: frame-setup CFI_INSTRUCTION def_cfa_offset 8
     ;CHECK-NEXT: frame-setup CFI_INSTRUCTION offset $lr, -8
     ;CHECK-NEXT: BL @foo, implicit-def dead $lr, implicit $sp
     ;CHECK-NEXT: $r1 = LDRSH $sp, $noreg, 8, 14 /* CC::al */, $noreg
     ;CHECK-NEXT: $r2 = LDRSH $sp, $noreg, 16, 14 /* CC::al */, $noreg
     ;CHECK-NEXT: $r5 = LDRSH $sp, $noreg, 255, 14 /* CC::al */, $noreg
-    ;CHECK-NEXT: $lr, $sp = LDR_POST_IMM $sp, $noreg, 8, 14 /* CC::al */, $noreg
+    ;CHECK-NEXT: $lr, $sp = frame-destroy LDR_POST_IMM $sp, $noreg, 8, 14 /* CC::al */, $noreg

llvm/test/CodeGen/ARM/machine-outliner-stack-fixup-thumb.mir

 tracksRegLiveness: true
 body:             |
   bb.0:
     liveins: $lr
 
     BX_RET 14, $noreg
 
     ;CHECK: name:           OUTLINED_FUNCTION_[[LDREX]]
-    ;CHECK: early-clobber $sp = t2STR_PRE killed $lr, $sp, -8, 14 /* CC::al */, $noreg
+    ;CHECK: early-clobber $sp = frame-setup t2STR_PRE killed $lr, $sp, -8, 14 /* CC::al */, $noreg
     ;CHECK-NEXT: frame-setup CFI_INSTRUCTION def_cfa_offset 8
     ;CHECK-NEXT: frame-setup CFI_INSTRUCTION offset $lr, -8
     ;CHECK-NEXT: tBL 14 /* CC::al */, $noreg, @foo, implicit-def dead $lr, implicit $sp
     ;CHECK-NEXT: $r1 = t2LDREX $sp, 2, 14 /* CC::al */, $noreg
     ;CHECK-NEXT: $r1 = t2LDREX $sp, 10, 14 /* CC::al */, $noreg
     ;CHECK-NEXT: $r1 = t2LDREX $sp, 255, 14 /* CC::al */, $noreg
-    ;CHECK-NEXT: $lr, $sp = t2LDR_POST $sp, 8, 14 /* CC::al */, $noreg
+    ;CHECK-NEXT: $lr, $sp = frame-destroy t2LDR_POST $sp, 8, 14 /* CC::al */, $noreg
 
     ;CHECK: name:           OUTLINED_FUNCTION_[[I8]]
-    ;CHECK: early-clobber $sp = t2STR_PRE killed $lr, $sp, -8, 14 /* CC::al */, $noreg
+    ;CHECK: early-clobber $sp = frame-setup t2STR_PRE killed $lr, $sp, -8, 14 /* CC::al */, $noreg
     ;CHECK-NEXT: frame-setup CFI_INSTRUCTION def_cfa_offset 8
     ;CHECK-NEXT: frame-setup CFI_INSTRUCTION offset $lr, -8
     ;CHECK-NEXT: tBL 14 /* CC::al */, $noreg, @foo, implicit-def dead $lr, implicit $sp
     ;CHECK-NEXT: t2STRHi8 $r0, $sp, 8, 14 /* CC::al */, $noreg
     ;CHECK-NEXT: t2STRHi8 $r0, $sp, 12, 14 /* CC::al */, $noreg
     ;CHECK-NEXT: t2STRHi8 $r0, $sp, 255, 14 /* CC::al */, $noreg
-    ;CHECK-NEXT: $lr, $sp = t2LDR_POST $sp, 8, 14 /* CC::al */, $noreg
+    ;CHECK-NEXT: $lr, $sp = frame-destroy t2LDR_POST $sp, 8, 14 /* CC::al */, $noreg
 
     ;CHECK: name:           OUTLINED_FUNCTION_[[I8S4]]
-    ;CHECK: early-clobber $sp = t2STR_PRE killed $lr, $sp, -8, 14 /* CC::al */, $noreg
+    ;CHECK: early-clobber $sp = frame-setup t2STR_PRE killed $lr, $sp, -8, 14 /* CC::al */, $noreg
     ;CHECK-NEXT: frame-setup CFI_INSTRUCTION def_cfa_offset 8
     ;CHECK-NEXT: frame-setup CFI_INSTRUCTION offset $lr, -8
     ;CHECK-NEXT: tBL 14 /* CC::al */, $noreg, @foo, implicit-def dead $lr, implicit $sp
     ;CHECK-NEXT: t2STRDi8 $r0, $r1, $sp, 8, 14 /* CC::al */, $noreg
     ;CHECK-NEXT: t2STRDi8 $r0, $r1, $sp, 16, 14 /* CC::al */, $noreg
     ;CHECK-NEXT: t2STRDi8 $r0, $r1, $sp, 1020, 14 /* CC::al */, $noreg
-    ;CHECK-NEXT: $lr, $sp = t2LDR_POST $sp, 8, 14 /* CC::al */, $noreg
+    ;CHECK-NEXT: $lr, $sp = frame-destroy t2LDR_POST $sp, 8, 14 /* CC::al */, $noreg
 
     ;CHECK: name:           OUTLINED_FUNCTION_[[I12]]
-    ;CHECK: early-clobber $sp = t2STR_PRE killed $lr, $sp, -8, 14 /* CC::al */, $noreg
+    ;CHECK: early-clobber $sp = frame-setup t2STR_PRE killed $lr, $sp, -8, 14 /* CC::al */, $noreg
     ;CHECK-NEXT: frame-setup CFI_INSTRUCTION def_cfa_offset 8
     ;CHECK-NEXT: frame-setup CFI_INSTRUCTION offset $lr, -8
     ;CHECK-NEXT: tBL 14 /* CC::al */, $noreg, @foo, implicit-def dead $lr, implicit $sp
     ;CHECK-NEXT: $r0 = t2LDRi12 $sp, 8, 14 /* CC::al */, $noreg
     ;CHECK-NEXT: $r0 = t2LDRi12 $sp, 12, 14 /* CC::al */, $noreg
     ;CHECK-NEXT: $r0 = t2LDRi12 $sp, 4094, 14 /* CC::al */, $noreg
-    ;CHECK-NEXT: $lr, $sp = t2LDR_POST $sp, 8, 14 /* CC::al */, $noreg
+    ;CHECK-NEXT: $lr, $sp = frame-destroy t2LDR_POST $sp, 8, 14 /* CC::al */, $noreg
 
     ;CHECK: name:           OUTLINED_FUNCTION_[[T1_S]]
-    ;CHECK: early-clobber $sp = t2STR_PRE killed $lr, $sp, -8, 14 /* CC::al */, $noreg
+    ;CHECK: early-clobber $sp = frame-setup t2STR_PRE killed $lr, $sp, -8, 14 /* CC::al */, $noreg
     ;CHECK-NEXT: frame-setup CFI_INSTRUCTION def_cfa_offset 8
     ;CHECK-NEXT: frame-setup CFI_INSTRUCTION offset $lr, -8
     ;CHECK-NEXT: tBL 14 /* CC::al */, $noreg, @foo, implicit-def dead $lr, implicit $sp
     ;CHECK-NEXT: tSTRspi $r0, $sp, 2, 14 /* CC::al */, $noreg
     ;CHECK-NEXT: tSTRspi $r0, $sp, 6, 14 /* CC::al */, $noreg
     ;CHECK-NEXT: tSTRspi $r0, $sp, 255, 14 /* CC::al */, $noreg
-    ;CHECK-NEXT: $lr, $sp = t2LDR_POST $sp, 8, 14 /* CC::al */, $noreg
+    ;CHECK-NEXT: $lr, $sp = frame-destroy t2LDR_POST $sp, 8, 14 /* CC::al */, $noreg

llvm/test/CodeGen/ARM/va_arg.ll

 ; NOTE: Assertions have been autogenerated by utils/update_llc_test_checks.py
 ; RUN: llc < %s -mtriple=armv7-none-linux-gnueabi -pre-RA-sched=source | FileCheck %s
 ; Test that we correctly align elements when using va_arg
 
 define i64 @test1(i32 %i, ...) nounwind optsize {
 ; CHECK-LABEL: test1:
 ; CHECK:       @ %bb.0: @ %entry
-; CHECK-NEXT:    .pad #12
-; CHECK-NEXT:    sub sp, sp, #12
-; CHECK-NEXT:    .pad #4
-; CHECK-NEXT:    sub sp, sp, #4
+; CHECK-NEXT:    .pad #16
+; CHECK-NEXT:    sub sp, sp, #16
 ; CHECK-NEXT:    add r0, sp, #4
 ; CHECK-NEXT:    stmib sp, {r1, r2, r3}
 ; CHECK-NEXT:    add r0, r0, #7
 ; CHECK-NEXT:    bic r1, r0, #7
 ; CHECK-NEXT:    orr r0, r1, #4
 ; CHECK-NEXT:    str r0, [sp]
 ; CHECK-NEXT:    ldr r0, [r1]
 ; CHECK-NEXT:    add r2, r1, #8
 ; CHECK-NEXT:    str r2, [sp]
 ; CHECK-NEXT:    ldr r1, [r1, #4]
-; CHECK-NEXT:    add sp, sp, #4
-; CHECK-NEXT:    add sp, sp, #12
+; CHECK-NEXT:    add sp, sp, #16
 ; CHECK-NEXT:    bx lr
 entry:
   %g = alloca i8*, align 4
   %g1 = bitcast i8** %g to i8*
   call void @llvm.va_start(i8* %g1)
   %0 = va_arg i8** %g, i64
   call void @llvm.va_end(i8* %g1)
   ret i64 %0
 }
 
 define double @test2(i32 %a, i32* %b, ...) nounwind optsize {
 ; CHECK-LABEL: test2:
 ; CHECK:       @ %bb.0: @ %entry
-; CHECK-NEXT:    .pad #8
-; CHECK-NEXT:    sub sp, sp, #8
-; CHECK-NEXT:    .pad #4
-; CHECK-NEXT:    sub sp, sp, #4
+; CHECK-NEXT:    .pad #12
+; CHECK-NEXT:    sub sp, sp, #12
 ; CHECK-NEXT:    add r0, sp, #4
 ; CHECK-NEXT:    stmib sp, {r2, r3}
 ; CHECK-NEXT:    add r0, r0, #11
 ; CHECK-NEXT:    bic r0, r0, #3
 ; CHECK-NEXT:    str r2, [r1]
 ; CHECK-NEXT:    add r1, r0, #8
 ; CHECK-NEXT:    str r1, [sp]
 ; CHECK-NEXT:    vldr d16, [r0]
 ; CHECK-NEXT:    vmov r0, r1, d16
-; CHECK-NEXT:    add sp, sp, #4
-; CHECK-NEXT:    add sp, sp, #8
+; CHECK-NEXT:    add sp, sp, #12
 ; CHECK-NEXT:    bx lr
 entry:
   %ap = alloca i8*, align 4                       ; <i8**> [#uses=3]
   %ap1 = bitcast i8** %ap to i8*                  ; <i8*> [#uses=2]
   call void @llvm.va_start(i8* %ap1)
   %0 = va_arg i8** %ap, i32                       ; <i32> [#uses=0]
   store i32 %0, i32* %b
   %1 = va_arg i8** %ap, double                    ; <double> [#uses=1]
   call void @llvm.va_end(i8* %ap1)
   ret double %1
 }
 
 
 declare void @llvm.va_start(i8*) nounwind
 
 declare void @llvm.va_end(i8*) nounwind

llvm/test/CodeGen/ARM/vargs_align.ll

 return:   ; preds = %entry
   %retval2 = load i32, i32* %retval    ; <i32> [#uses=1]
   ret i32 %retval2
 ; EABI: add sp, sp, #16
 ; EABI: vpop {d8}
 ; EABI: add sp, sp, #4
 ; EABI: add sp, sp, #12
 
-; OABI: add sp, sp, #12
-; OABI: add sp, sp, #12
+; OABI: add sp, sp, #24
 }
 
 declare void @llvm.va_start(i8*) nounwind

llvm/test/CodeGen/Thumb2/bti-pac-replace-1.mir

+# RUN: llc --run-pass=arm-branch-targets %s -o - | FileCheck %s
+--- |
+  target datalayout = "e-m:e-p:32:32-Fi8-i64:64-v128:64:128-a:0:32-n32-S64"
+  target triple = "thumbv8.1m.main-arm-unknown-eabi"
+
+  define hidden i32 @_Z1fi(i32 %x) {
+  entry:
+    %add = add nsw i32 %x, 1
+    %call = tail call i32 @_Z1gi(i32 %add)
+    %sub = add nsw i32 %call, -1
+    ret i32 %sub
+  }
+
+  declare dso_local i32 @_Z1gi(i32)
+
+  !llvm.module.flags = !{!0, !1, !2}
+
+  !0 = !{i32 1, !"branch-target-enforcement", i32 1}
+  !1 = !{i32 1, !"sign-return-address", i32 1}
+  !2 = !{i32 1, !"sign-return-address-all", i32 0}
+
+...
+---
+name:            _Z1fi
+alignment:       4
+exposesReturnsTwice: false
+legalized:       false
+regBankSelected: false
+selected:        false
+failedISel:      false
+tracksRegLiveness: true
+hasWinCFI:       false
+registers:       []
+liveins:
+  - { reg: '$r0', virtual-reg: '' }
+frameInfo:
+  isFrameAddressTaken: false
+  isReturnAddressTaken: false
+  hasStackMap:     false
+  hasPatchPoint:   false
+  stackSize:       16
+  offsetAdjustment: 0
+  maxAlignment:    4
+  adjustsStack:    true
+  hasCalls:        true
+  stackProtector:  ''
+  maxCallFrameSize: 0
+  cvBytesOfCalleeSavedRegisters: 0
+  hasOpaqueSPAdjustment: false
+  hasVAStart:      false
+  hasMustTailInVarArgFunc: false
+  localFrameSize:  0
+  savePoint:       ''
+  restorePoint:    ''
+fixedStack:      []
+stack:
+  - { id: 0, name: '', type: spill-slot, offset: -4, size: 4, alignment: 4,
+      stack-id: default, callee-saved-register: '$lr', callee-saved-restored: true,
+      debug-info-variable: '', debug-info-expression: '', debug-info-location: '' }
+  - { id: 1, name: '', type: spill-slot, offset: -8, size: 4, alignment: 4,
+      stack-id: default, callee-saved-register: '$r7', callee-saved-restored: true,
+      debug-info-variable: '', debug-info-expression: '', debug-info-location: '' }
+  - { id: 2, name: '', type: spill-slot, offset: -12, size: 4, alignment: 4,
+      stack-id: default, callee-saved-register: '$r12', callee-saved-restored: true,
+      debug-info-variable: '', debug-info-expression: '', debug-info-location: '' }
+callSites:       []
+debugValueSubstitutions: []
+constants:       []
+machineFunctionInfo: {}
+body:             |
+  bb.0.entry:
+    liveins: $r0, $r7, $lr, $r12
+
+    frame-setup t2PAC implicit-def $r12, implicit $lr, implicit $sp
+    frame-setup tPUSH 14 /* CC::al */, $noreg, killed $r7, killed $lr, implicit-def $sp, implicit $sp
+    frame-setup CFI_INSTRUCTION def_cfa_offset 8
+    frame-setup CFI_INSTRUCTION offset $lr, -4
+    frame-setup CFI_INSTRUCTION offset $r7, -8
+    early-clobber $sp = frame-setup t2STR_PRE killed $r12, $sp, -4, 14 /* CC::al */, $noreg
+    frame-setup CFI_INSTRUCTION def_cfa_offset 12
+    frame-setup CFI_INSTRUCTION offset $ra_auth_code, -12
+    $sp = frame-setup tSUBspi $sp, 1, 14 /* CC::al */, $noreg
+    frame-setup CFI_INSTRUCTION def_cfa_offset 16
+    renamable $r0, dead $cpsr = nsw tADDi8 killed renamable $r0, 1, 14 /* CC::al */, $noreg
+    tBL 14 /* CC::al */, $noreg, @_Z1gi, csr_aapcs, implicit-def dead $lr, implicit $sp, implicit killed $r0, implicit-def $sp, implicit-def $r0
+    renamable $r0, dead $cpsr = nsw tSUBi8 killed renamable $r0, 1, 14 /* CC::al */, $noreg
+    $sp = frame-destroy tADDspi $sp, 1, 14 /* CC::al */, $noreg
+    $r12, $sp = frame-destroy t2LDR_POST $sp, 4, 14 /* CC::al */, $noreg
+    $sp = frame-destroy t2LDMIA_UPD $sp, 14 /* CC::al */, $noreg, def $r7, def $lr
+    t2AUT implicit $r12, implicit $lr, implicit $sp
+    tBX_RET 14 /* CC::al */, $noreg, implicit killed $r0
+
+...
+# Check PAC is replaces with PACBTI and it has the frame-setup flag
+# CHECK-LABEL: bb.0.entry:
+# CHECK:       frame-setup t2PACBTI
 No newline at end of file

llvm/test/CodeGen/Thumb2/bti-pac-replace-2.ll

+; RUN: llc --force-dwarf-frame-section %s -o - | FileCheck %s
+; RUN: llc --filetype=obj %s -o - | llvm-readelf -u - | FileCheck %s --check-prefix=UNWIND
+target datalayout = "e-m:e-p:32:32-Fi8-i64:64-v128:64:128-a:0:32-n32-S64"
+target triple = "thumbv8.1m.main-arm-unknown-eabi"
+
+define hidden i32 @_Z1fi(i32 %x) {
+entry:
+  %add = add nsw i32 %x, 1
+  %call = tail call i32 @_Z1gi(i32 %add)
+  %sub = add nsw i32 %call, -1
+  ret i32 %sub
+}
+
+declare dso_local i32 @_Z1gi(i32)
+
+!llvm.module.flags = !{!0, !1, !2}
+!0 = !{i32 1, !"branch-target-enforcement", i32 1}
+!1 = !{i32 1, !"sign-return-address", i32 1}
+!2 = !{i32 1, !"sign-return-address-all", i32 0}
+
+; Check the function starts with `pacbti` and correct unwind info is emitted
+; CHECK-LABEL: _Z1fi:
+; ...
+; CHECK:       pacbti   r12, lr, sp
+; CHECK-NEXT:  .save    {r7, lr}
+; CHECK-NEXT:  push     {r7, lr}
+; CHECK-NEXT:  .cfi_def_cfa_offset 8
+; CHECK-NEXT:  .cfi_offset lr, -4
+; CHECK-NEXT:  .cfi_offset r7, -8
+; CHECK-NEXT:  .save   {ra_auth_code}
+; CHECK-NEXT:  str     r12, [sp, #-4]!
+; CHECK-NEXT:  .cfi_def_cfa_offset 12
+; CHECK-NEXT:  .cfi_offset ra_auth_code, -12
+; CHECK-NEXT:  .pad    #4
+; CHECK-NEXT:  sub     sp, #4
+; CHECK-NEXT:  .cfi_def_cfa_offset 16
+; ...
+
+; UNWIND-LABEL: Opcodes [
+; UNWIND-NEXT:  0x00      ; vsp = vsp + 4
+; UNWIND-NEXT:  0xB4      ; pop ra_auth_code
+; UNWIND-NEXT:  0x84 0x08 ; pop {r7, lr}
+; UNWIND-NEXT:  0xB0      ; finish

llvm/test/CodeGen/Thumb2/pacbti-m-basic.ll

+; RUN: llc --force-dwarf-frame-section %s -o - | FileCheck %s
+; RUN: llc --filetype=obj %s -o - | llvm-readelf -s --unwind - | FileCheck %s --check-prefix=UNWIND
+target datalayout = "e-m:e-p:32:32-Fi8-i64:64-v128:64:128-a:0:32-n32-S64"
+target triple = "thumbv8m.main-none-none-eabi"
+
+; int g(int);
+;
+; #if __ARM_FEATURE_CMSE == 3
+; #define ENTRY __attribute__((cmse_nonsecure_entry))
+; #else
+; #define ENTRY
+; #endif
+;
+; ENTRY int f(int x) {
+;     return 1 + g(x - 1);
+; }
+
+define hidden i32 @f0(i32 %x) local_unnamed_addr {
+entry:
+  %sub = add nsw i32 %x, -1
+  %call = tail call i32 @g(i32 %sub)
+  %add = add nsw i32 %call, 1
+  ret i32 %add
+}
+
+; CHECK-LABEL: f0:
+; CHECK:       pac     r12, lr, sp
+; CHECK-NEXT:  .save   {r7, lr}
+; CHECK-NEXT:  push    {r7, lr}
+; CHECK-NEXT: .cfi_def_cfa_offset 8
+; CHECK-NEXT: .cfi_offset lr, -4
+; CHECK-NEXT: .cfi_offset r7, -8
+; CHECK-NEXT: .save   {ra_auth_code}
+; CHECK-NEXT:  str     r12, [sp, #-4]!
+; CHECK-NEXT: .cfi_def_cfa_offset 12
+; CHECK-NEXT: .cfi_offset ra_auth_code, -12
+; CHECK-NEXT: .pad    #4
+; CHECK-NEXT:  sub     sp, #4
+; ...
+; CHECK:       add     sp, #4
+; CHECK-NEXT:  ldr     r12, [sp], #4
+; CHECK-NEXT:  pop.w   {r7, lr}
+; CHECK-NEXT:  aut     r12, lr, sp
+; CHECK-NEXT:  bx      lr
+
+define hidden i32 @f1(i32 %x) local_unnamed_addr #0 {
+entry:
+  %sub = add nsw i32 %x, -1
+  %call = tail call i32 @g(i32 %sub)
+  %add = add nsw i32 %call, 1
+  ret i32 %add
+}
+
+; CHECK-LABEL: f1:
+; CHECK:       pac     r12, lr, sp
+; CHECK-NEXT:  vstr    fpcxtns, [sp, #-4]!
+; CHECK-NEXT:  .cfi_def_cfa_offset 4
+; CHECK-NEXT:  .save    {r7, lr}
+; CHECK-NEXT:  push    {r7, lr}
+; CHECK:       vldr    fpcxtns, [sp], #4
+; CHECK:       aut     r12, lr, sp
+
+define hidden i32 @f2(i32 %x) local_unnamed_addr #1 {
+entry:
+  %sub = add nsw i32 %x, -1
+  %call = tail call i32 @g(i32 %sub)
+  %add = add nsw i32 %call, 1
+  ret i32 %add
+}
+; CHECK-LABEL: f2:
+; CHECK:       pac    r12, lr, sp
+; CHECK-NEXT:  .save  {r7, lr}
+; CHECK-NEXT:  push   {r7, lr}
+; CHECK-NEXT: .cfi_def_cfa_offset 8
+; CHECK-NEXT: .cfi_offset lr, -4
+; CHECK-NEXT: .cfi_offset r7, -8
+; CHECK-NEXT:  .save  {ra_auth_code}
+; CHECK-NEXT:  str    r12, [sp, #-4]!
+; CHECK-NEXT: .cfi_def_cfa_offset 12
+; CHECK-NEXT: .cfi_offset ra_auth_code, -12
+; CHECK-NEXT:  .pad   #4
+; CHECK-NEXT:  sub    sp, #4
+; CHECK-NEXT:  .cfi_def_cfa_offset 16
+; ...
+; CHECK:       add    sp, #4
+; CHECK-NEXT:  ldr    r12, [sp], #4
+; CHECK-NEXT:  pop.w  {r7, lr}
+; CHECK-NEXT:  aut    r12, lr, sp
+; CHECK-NEXT:  mrs    r12, control
+; ...
+; CHECK:       bxns    lr
+
+declare dso_local i32 @g(i32) local_unnamed_addr
+
+attributes #0 = { "cmse_nonsecure_entry" "target-features"="+8msecext,+armv8.1-m.main"}
+attributes #1 = { "cmse_nonsecure_entry" "target-features"="+8msecext,+armv8-m.main,+fp-armv8d16"}
+
+!llvm.module.flags = !{!0, !1, !2}
+
+!0 = !{i32 1, !"branch-target-enforcement", i32 0}
+!1 = !{i32 1, !"sign-return-address", i32 1}
+!2 = !{i32 1, !"sign-return-address-all", i32 0}
+
+; UNWIND-LABEL: FunctionAddress: 0x0
+; UNWIND:       0x00      ; vsp = vsp + 4
+; UNWIND-NEXT:  0xB4      ; pop ra_auth_code
+; UNWIND-NEXT:  0x84 0x08 ; pop {r7, lr}
+; UNWIND-NEXT:  0xB0      ; finish
+; UNWIND-NEXT:  0xB0      ; finish
+
+; UNWIND-LABEL: FunctionAddress: 0x24
+; UNWIND:       0xB4      ; pop ra_auth_code
+; UNWIND-NEXT:  0x84 0x08 ; pop {r7, lr}
+
+; UNWIND-LABEL: FunctionAddress: 0x54
+; UNWIND:       0x00      ; vsp = vsp + 4
+; UNWIND-NEXT:  0xB4      ; pop ra_auth_code
+; UNWIND-NEXT:  0x84 0x08 ; pop {r7, lr}
+; UNWIND-NEXT:  0xB0      ; finish
+; UNWIND-NEXT:  0xB0      ; finish
+
+; UNWIND-LABEL: 00000001 {{.*}} f0
+; UNWIND-LABEL: 00000025 {{.*}} f1
+; UNWIND-LABEL: 00000055 {{.*}} f2

llvm/test/CodeGen/Thumb2/pacbti-m-indirect-tail-call.ll

+; RUN: llc %s -o - | FileCheck %s --check-prefix=CHECK1
+; RUN: llc %s -o - | FileCheck %s --check-prefix=CHECK2
+target datalayout = "e-m:e-p:32:32-Fi8-i64:64-v128:64:128-a:0:32-n32-S64"
+target triple = "thumbv8.1m.main-arm-unknown-eabi"
+
+@p = hidden local_unnamed_addr global i32 (i32, i32, i32, i32)* null, align 4
+
+define hidden i32 @f(i32 %a, i32 %b, i32 %c, i32 %d) local_unnamed_addr #0 {
+entry:
+  %call = tail call i32 @g(i32 %a) #0
+  %0 = load i32 (i32, i32, i32, i32)*, i32 (i32, i32, i32, i32)** @p, align 4
+  %call1 = tail call i32 %0(i32 %call, i32 %b, i32 %c, i32 %d) #0
+  ret i32 %call1
+}
+
+; CHECK1-LABEL: f
+; ...
+; CHECK1:       aut r12, lr, sp
+; CHECK1-NOT:   bx r12
+
+; CHECK2-LABEL: f
+; ...
+; CHECK2:       blx r4
+; CHECK2-NEXT:  ldr r12, [sp], #4
+; CHECK2-NEXT:  pop.w {r4, r5, r6, r7, lr}
+; CHECK2-NEXT:  aut r12, lr, sp
+; CHECK2-NEXT:  bx lr
+
+declare dso_local i32 @g(i32) local_unnamed_addr #0
+
+attributes #0 = { nounwind }
+
+!llvm.module.flags = !{!0, !1, !2}
+
+!0 = !{i32 1, !"branch-target-enforcement", i32 0}
+!1 = !{i32 1, !"sign-return-address", i32 1}
+!2 = !{i32 1, !"sign-return-address-all", i32 0}

llvm/test/CodeGen/Thumb2/pacbti-m-outliner-1.ll

+; RUN: llc --force-dwarf-frame-section --exception-model=arm %s -o - | FileCheck %s
+; RUN: llc --filetype=obj %s --exception-model=arm -o - | llvm-readelf -s --unwind - | FileCheck %s --check-prefix=UNWIND
+target datalayout = "e-m:e-p:32:32-Fi8-i64:64-v128:64:128-a:0:32-n32-S64"
+
+; Triple tweaked so we get 16-byte stack alignment and better test coverage.
+target triple = "armv7m-none-nacl-android"
+
+; -Oz
+; volatile int a, b, c, d, e, f, g, h, i;
+;
+; int x() {
+;   int r = (a + b) / (c + d) + e + f / g + h + i;
+;   return r + 1;
+; }
+;
+; int y() {
+;   int r = (a + b) / (c + d) + e + f / g + h + i;
+;   return r + 2;
+; }
+
+@a = hidden global i32 0, align 4
+@b = hidden global i32 0, align 4
+@c = hidden global i32 0, align 4
+@d = hidden global i32 0, align 4
+@e = hidden global i32 0, align 4
+@f = hidden global i32 0, align 4
+@g = hidden global i32 0, align 4
+@h = hidden global i32 0, align 4
+@i = hidden global i32 0, align 4
+
+
+define hidden i32 @x() local_unnamed_addr #0 {
+entry:
+  %0 = load volatile i32, i32* @a, align 4
+  %1 = load volatile i32, i32* @b, align 4
+  %add = add nsw i32 %1, %0
+  %2 = load volatile i32, i32* @c, align 4
+  %3 = load volatile i32, i32* @d, align 4
+  %add1 = add nsw i32 %3, %2
+  %div = sdiv i32 %add, %add1
+  %4 = load volatile i32, i32* @e, align 4
+  %5 = load volatile i32, i32* @f, align 4
+  %6 = load volatile i32, i32* @g, align 4
+  %div3 = sdiv i32 %5, %6
+  %7 = load volatile i32, i32* @h, align 4
+  %8 = load volatile i32, i32* @i, align 4
+  %add2 = add i32 %div, 1
+  %add4 = add i32 %add2, %4
+  %add5 = add i32 %add4, %div3
+  %add6 = add i32 %add5, %7
+  %add7 = add i32 %add6, %8
+  ret i32 %add7
+}
+
+; CHECK-LABEL: x:
+; CHECK:       ldr    r0, .LCPI0_0
+; CHECK-NEXT:  pac    r12, lr, sp
+; CHECK-NEXT:  .pad #8
+; CHECK-NEXT:  .save  {ra_auth_code, lr}
+; CHECK-NEXT:  strd   r12, lr, [sp, #-16]!
+; CHECK-NEXT:  .cfi_def_cfa_offset 16
+; CHECK-NEXT:  .cfi_offset lr, -12
+; CHECK-NEXT:  .cfi_offset ra_auth_code, -16
+; CHECK-NEXT:  bl    OUTLINED_FUNCTION_0
+; CHECK-NEXT:  ldrd  r12, lr, [sp], #16
+; CHECK-NEXT:  .cfi_def_cfa_offset 0
+; CHECK-NEXT:  .cfi_restore lr
+; CHECK-NEXT:  .cfi_undefined ra_auth_code
+; CHECK-NEXT:  aut    r12, lr, sp
+; CHECK-NEXT:  adds   r0, #1
+; CHECK-NEXT:  bx     lr
+
+define hidden i32 @y() local_unnamed_addr #0 {
+entry:
+  %0 = load volatile i32, i32* @a, align 4
+  %1 = load volatile i32, i32* @b, align 4
+  %add = add nsw i32 %1, %0
+  %2 = load volatile i32, i32* @c, align 4
+  %3 = load volatile i32, i32* @d, align 4
+  %add1 = add nsw i32 %3, %2
+  %div = sdiv i32 %add, %add1
+  %4 = load volatile i32, i32* @e, align 4
+  %5 = load volatile i32, i32* @f, align 4
+  %6 = load volatile i32, i32* @g, align 4
+  %div3 = sdiv i32 %5, %6
+  %7 = load volatile i32, i32* @h, align 4
+  %8 = load volatile i32, i32* @i, align 4
+  %add2 = add i32 %div, 2
+  %add4 = add i32 %add2, %4
+  %add5 = add i32 %add4, %div3
+  %add6 = add i32 %add5, %7
+  %add7 = add i32 %add6, %8
+  ret i32 %add7
+}
+; CHECK-LABEL: y:
+; CHECK:      ldr    r0, .LCPI1_0
+; CHECK-NEXT: pac    r12, lr, sp
+; CHECK-NEXT:  .pad #8
+; CHECK-NEXT: .save  {ra_auth_code, lr}
+; CHECK-NEXT: strd   r12, lr, [sp, #-16]!
+; CHECK-NEXT: .cfi_def_cfa_offset 16
+; CHECK-NEXT: .cfi_offset lr, -12
+; CHECK-NEXT: .cfi_offset ra_auth_code, -16
+; CHECK-NEXT: bl    OUTLINED_FUNCTION_0
+; CHECK-NEXT: ldrd  r12, lr, [sp], #16
+; CHECK-NEXT: .cfi_def_cfa_offset 0
+; CHECK-NEXT: .cfi_restore lr
+; CHECK-NEXT: .cfi_undefined ra_auth_code
+; CHECK-NEXT: aut   r12, lr, sp
+; CHECK-NEXT: adds  r0, #2
+; CHECK-NEXT: bx    lr
+
+; CHECK-LABEL: OUTLINED_FUNCTION_0:
+; CHECK-NOT: pac
+; CHECK-NOT: aut
+; CHECK-NOT: r12
+; CHECK: bx lr
+
+attributes #0 = { minsize nofree norecurse nounwind optsize uwtable}
+
+!llvm.module.flags = !{!0, !1, !2}
+
+!0 = !{i32 1, !"branch-target-enforcement", i32 0}
+!1 = !{i32 1, !"sign-return-address", i32 1}
+!2 = !{i32 1, !"sign-return-address-all", i32 0}
+
+; UNWIND-LABEL: FunctionAddress: 0x0
+; UNWIND:       0xB4      ; pop ra_auth_code
+; UNWIND-NEXT:  0x84 0x00 ; pop {lr}
+; UNWIND-NEXT:  0x01      ; vsp = vsp + 8
+; UNWIND-NEXT:  0xB0      ; finish
+
+; UNWIND-LABEL: FunctionAddress: 0x20
+; UNWIND:       0xB4      ; pop ra_auth_code
+; UNWIND-NEXT:  0x84 0x00 ; pop {lr}
+; UNWIND-NEXT:  0x01      ; vsp = vsp + 8
+; UNWIND-NEXT:  0xB0      ; finish
+
+; UNWIND-LABEL:  FunctionAddress: 0x40
+; UNWIND:        Model: CantUnwind
+
+; UNWINND-LABEL: 00000041 {{.*}} OUTLINED_FUNCTION_0
+; UNWINND-LABEL: 00000001 {{.*}} x
+; UNWINND-LABEL: 00000021 {{.*}} y

llvm/test/CodeGen/Thumb2/pacbti-m-outliner-2.ll

+; RUN: llc --force-dwarf-frame-section %s -o - | FileCheck %s
+target datalayout = "e-m:e-p:32:32-Fi8-i64:64-v128:64:128-a:0:32-n32-S64"
+target triple = "thumbv7m-arm-none-eabi"
+
+; -Oz
+; volatile int a, b, c, d, e, f;
+;
+; int x() {
+;   int r = a + b + c + d + e + f;
+;   return r + 1;
+; }
+;
+; int y() {
+;   int r = a + b + c + d + e + f;
+;   return r + 2;
+; }
+
+@a = hidden global i32 0, align 4
+@b = hidden global i32 0, align 4
+@c = hidden global i32 0, align 4
+@d = hidden global i32 0, align 4
+@e = hidden global i32 0, align 4
+@f = hidden global i32 0, align 4
+
+define hidden i32 @x() local_unnamed_addr #0 {
+entry:
+  %0 = load volatile i32, i32* @a, align 4
+  %1 = load volatile i32, i32* @b, align 4
+  %2 = load volatile i32, i32* @c, align 4
+  %3 = load volatile i32, i32* @d, align 4
+  %4 = load volatile i32, i32* @e, align 4
+  %5 = load volatile i32, i32* @f, align 4
+  %add = add i32 %0, 1
+  %add1 = add i32 %add, %1
+  %add2 = add i32 %add1, %2
+  %add3 = add i32 %add2, %3
+  %add4 = add i32 %add3, %4
+  %add5 = add i32 %add4, %5
+  ret i32 %add5
+}
+; CHECK-LABEL: x:
+; CHECK:        ldr   r{{.*}}, .LCPI0_0
+; CHECK-NEXT:   mov   r[[A:[0-9]*]], lr
+; CHECK-NEXT:   .cfi_register lr, r[[A]]
+; CHECK-NEXT:   bl    OUTLINED_FUNCTION_0
+; CHECK-NEXT:   mov   lr, r[[A]]
+; CHECK-NEXT:   .cfi_restore lr
+; CHECK-NEXT:   adds  r0, #1
+; CHECK-NEXT:   bx    lr
+
+define hidden i32 @y() local_unnamed_addr #0 {
+entry:
+  %0 = load volatile i32, i32* @a, align 4
+  %1 = load volatile i32, i32* @b, align 4
+  %2 = load volatile i32, i32* @c, align 4
+  %3 = load volatile i32, i32* @d, align 4
+  %4 = load volatile i32, i32* @e, align 4
+  %5 = load volatile i32, i32* @f, align 4
+  %add = add i32 %0, 2
+  %add1 = add i32 %add, %1
+  %add2 = add i32 %add1, %2
+  %add3 = add i32 %add2, %3
+  %add4 = add i32 %add3, %4
+  %add5 = add i32 %add4, %5
+  ret i32 %add5
+}
+; CHECK-LABEL: y:
+; CHECK:       ldr   r{{.*}}, .LCPI1_0
+; CHECK-NEXT:  mov   r[[B:[0-9]*]], lr
+; CHECK-NEXT:  .cfi_register lr, r[[B]]
+; CHECK-NEXT:  bl    OUTLINED_FUNCTION_0
+; CHECK-NEXT:  mov   lr, r[[B]]
+; CHECK-NEXT:  .cfi_restore lr
+; CHECK-NEXT:  adds  r0, #2
+; CHECK-NEXT:  bx    lr
+
+; CHECK-LABEL: OUTLINED_FUNCTION_0:
+; CHECK-NOT: pac
+; CHECK-NOT: aut
+; CHECK-NOT: r12
+; CHECK:     bx lr
+
+attributes #0 = { minsize nofree norecurse nounwind optsize}
+
+!llvm.module.flags = !{!0, !1, !2}
+
+!0 = !{i32 1, !"branch-target-enforcement", i32 0}
+!1 = !{i32 1, !"sign-return-address", i32 1}
+!2 = !{i32 1, !"sign-return-address-all", i32 0}

llvm/test/CodeGen/Thumb2/pacbti-m-outliner-3.ll

+; RUN: llc --force-dwarf-frame-section %s -o - | FileCheck %s
+; RUN: llc --filetype=obj %s -o - | llvm-readelf -s --unwind - | FileCheck %s --check-prefix=UNWIND
+target datalayout = "e-m:e-p:32:32-Fi8-i64:64-v128:64:128-a:0:32-n32-S64"
+target triple = "thumbv7m-arm-none-eabi"
+
+; -Oz
+; __attribute__((noinline)) int h(int a, int b) { return a + b; }
+;
+; int f(int a, int b, int c, int d) {
+;   if (a < 0)
+;     return -1;
+;   a = h(11 * a - b, b);
+;   return 2 + a * (a + b) / (c + d);
+; }
+;
+; int g(int a, int b, int c, int d) {
+;   if (a < 0)
+;     return -1;
+;   a = h(11 * a - b, b);
+;   return 1 + a * (a + b) / (c + d);
+; }
+
+define hidden i32 @h(i32 %a, i32 %b) local_unnamed_addr #0 {
+entry:
+  %add = add nsw i32 %b, %a
+  ret i32 %add
+}
+
+define hidden i32 @f(i32 %a, i32 %b, i32 %c, i32 %d) local_unnamed_addr #0 {
+entry:
+  %cmp = icmp slt i32 %a, 0
+  br i1 %cmp, label %return, label %if.end
+
+if.end:                                           ; preds = %entry
+  %mul = mul nsw i32 %a, 11
+  %sub = sub nsw i32 %mul, %b
+  %call = tail call i32 @h(i32 %sub, i32 %b)
+  %add = add nsw i32 %call, %b
+  %mul1 = mul nsw i32 %add, %call
+  %add2 = add nsw i32 %d, %c
+  %div = sdiv i32 %mul1, %add2
+  %add3 = add nsw i32 %div, 2
+  br label %return
+
+return:                                           ; preds = %entry, %if.end
+  %retval.0 = phi i32 [ %add3, %if.end ], [ -1, %entry ]
+  ret i32 %retval.0
+}
+
+; CHECK-LABEL: f:
+; CHECK:       bmi    .LBB
+; ...
+; CHECK:       pac    r12, lr, sp
+; CHECK-NEXT:  .save  {r4, r5, r6, lr}
+; CHECK-NEXT:  push   {r4, r5, r6, lr}
+; CHECK-NEXT:  .cfi_def_cfa_offset 16
+; CHECK-NEXT:  .cfi_offset lr, -4
+; CHECK-NEXT:  .cfi_offset r6, -8
+; CHECK-NEXT:  .cfi_offset r5, -12
+; CHECK-NEXT:  .cfi_offset r4, -16
+; CHECK-NEXT:  .save  {ra_auth_code}
+; CHECK-NEXT:  str    r12, [sp, #-4]!
+; CHECK-NEXT:  .cfi_def_cfa_offset 20
+; CHECK-NEXT:  .cfi_offset ra_auth_code, -20
+; CHECK-NEXT:  .pad    #4
+; CHECK-NEXT:  sub     sp, #4
+; CHECK-NEXT:  .cfi_def_cfa_offset 24
+; ...
+; CHECK:        add    sp, #4
+; CHECK-NEXT:   ldr    r12, [sp], #4
+; CHECK-NEXT:   pop.w  {r4, r5, r6, lr}
+; CHECK-NEXT:   aut    r12, lr, sp
+; CHECK-NEXT:   bx     lr
+; ...
+; CHECK: .LBB
+; CHECK:        bx    lr
+
+
+define hidden i32 @g(i32 %a, i32 %b, i32 %c, i32 %d) local_unnamed_addr #0 {
+entry:
+  %cmp = icmp slt i32 %a, 0
+  br i1 %cmp, label %return, label %if.end
+
+if.end:                                           ; preds = %entry
+  %mul = mul nsw i32 %a, 11
+  %sub = sub nsw i32 %mul, %b
+  %call = tail call i32 @h(i32 %sub, i32 %b)
+  %add = add nsw i32 %call, %b
+  %mul1 = mul nsw i32 %add, %call
+  %add2 = add nsw i32 %d, %c
+  %div = sdiv i32 %mul1, %add2
+  %add3 = add nsw i32 %div, 1
+  br label %return
+
+return:                                           ; preds = %entry, %if.end
+  %retval.0 = phi i32 [ %add3, %if.end ], [ -1, %entry ]
+  ret i32 %retval.0
+}
+; CHECK-LABEL: g:
+; CHECK:       bmi    .LBB
+; ...
+; CHECK:       pac    r12, lr, sp
+; CHECK-NEXT:  .save  {r4, r5, r6, lr}
+; CHECK-NEXT:  push   {r4, r5, r6, lr}
+; CHECK-NEXT:  .cfi_def_cfa_offset 16
+; CHECK-NEXT:  .cfi_offset lr, -4
+; CHECK-NEXT:  .cfi_offset r6, -8
+; CHECK-NEXT:  .cfi_offset r5, -12
+; CHECK-NEXT:  .cfi_offset r4, -16
+; CHECK-NEXT:  .save  {ra_auth_code}
+; CHECK-NEXT:  str    r12, [sp, #-4]!
+; CHECK-NEXT:  .cfi_def_cfa_offset 20
+; CHECK-NEXT:  .cfi_offset ra_auth_code, -20
+; CHECK-NEXT:  .pad   #4
+; CHECK-NEXT:  sub    sp, #4
+; CHECK-NEXT:  .cfi_def_cfa_offset 24
+; ...
+; CHECK:       add    sp, #4
+; CHECK-NEXT:  ldr    r12, [sp], #4
+; CHECK-NEXT:  pop.w  {r4, r5, r6, lr}
+; CHECK-NEXT:  aut    r12, lr, sp
+; CHECK-NEXT:  bx     lr
+; ...
+; CHECK: .LBB
+; CHECK:       bx     lr
+
+; CHECK-LABEL: OUTLINED_FUNCTION_0:
+; CHECK:       pac    r12, lr, sp
+; CHECK-NEXT:  .save  {ra_auth_code, lr}
+; CHECK-NEXT:  strd    r12, lr, [sp, #-8]!
+; CHECK-NEXT:  .cfi_def_cfa_offset 8
+; CHECK-NEXT:  .cfi_offset lr, -4
+; CHECK-NEXT:  .cfi_offset ra_auth_code, -8
+; ...
+; CHECK:       ldrd   r12, lr, [sp], #8
+; CHECK-NEXT:  .cfi_def_cfa_offset 0
+; CHECK-NEXT:  .cfi_restore lr
+; CHECK-NEXT:  .cfi_undefined ra_auth_code
+; CHECK-NEXT:  aut   r12, lr, sp
+; CHECK-NEXT:  bx    lr
+
+attributes #0 = { minsize noinline norecurse nounwind optsize readnone uwtable }
+
+!llvm.module.flags = !{!0, !1, !2}
+
+!0 = !{i32 1, !"branch-target-enforcement", i32 0}
+!1 = !{i32 1, !"sign-return-address", i32 1}
+!2 = !{i32 1, !"sign-return-address-all", i32 0}
+
+
+; UNWIND-LABEL: FunctionAddress: 0x4
+; UNWIND:       0x00      ; vsp = vsp + 4
+; UNWIND-NEXT:  0xB4      ; pop ra_auth_code
+; UNWIND-NEXT:  0xAA      ; pop {r4, r5, r6, lr}
+
+; UNWIND-LABEL: FunctionAddress: 0x30
+; UNWIND:       0x00      ; vsp = vsp + 4
+; UNWIND-NEXT:  0xB4      ; pop ra_auth_code
+; UNWIND-NEXT:  0xAA      ; pop {r4, r5, r6, lr}
+
+; UNWIND-LABEL: FunctionAddress: 0x5C
+; UNWIND:       Model: CantUnwind
+
+; UNWIND-LABEL: 0000005d {{.*}} OUTLINED_FUNCTION_0
+; UNWIND-LABEL: 00000005 {{.*}} f
+; UNWIND-LABEL: 00000031 {{.*}} g

llvm/test/CodeGen/Thumb2/pacbti-m-outliner-4.ll

+; RUN: llc --force-dwarf-frame-section %s -o - | FileCheck %s
+; RUN: llc --filetype=obj %s -o - | llvm-readelf -s --unwind - | FileCheck %s --check-prefix=UNWIND
+target datalayout = "e-m:e-p:32:32-Fi8-i64:64-v128:64:128-a:0:32-n32-S64"
+target triple = "thumbv7m-arm-none-eabi"
+
+; C++, -Oz
+; __attribute__((noinline)) int h(int a, int b) {
+;   if (a < 0)
+;     throw 1;
+;   return a + b;
+; }
+;
+; int f(int a, int b, int c, int d) {
+;   if (a < 0)
+;     return -1;
+;   a = h(a, b);
+;   return 2 + a * (a + b) / (c + d);
+; }
+;
+; int g(int a, int b, int c, int d) {
+;   if (a < 0)
+;     return -1;
+;   a = h(a, b);
+;   return 1 + a * (a + b) / (c + d);
+; }
+
+@_ZTIi = external dso_local constant i8*
+
+define hidden i32 @_Z1hii(i32 %a, i32 %b) local_unnamed_addr #0 {
+entry:
+  %cmp = icmp slt i32 %a, 0
+  br i1 %cmp, label %if.then, label %if.end
+
+if.then:                                          ; preds = %entry
+  %exception = tail call i8* @__cxa_allocate_exception(i32 4) #1
+  %0 = bitcast i8* %exception to i32*
+  store i32 1, i32* %0, align 8
+  tail call void @__cxa_throw(i8* %exception, i8* bitcast (i8** @_ZTIi to i8*), i8* null) #2
+  unreachable
+
+if.end:                                           ; preds = %entry
+  %add = add nsw i32 %b, %a
+  ret i32 %add
+}
+
+; CHECK-LABEL: _Z1hii:
+; ...
+; CHECK:    bxgt    lr
+; ...
+; CHECK:    pac    r12, lr, sp
+; CHECK-NEXT:    .save    {r7, lr}
+; CHECK-NEXT:    push    {r7, lr}
+; CHECK-NEXT:    .cfi_def_cfa_offset 8
+; CHECK-NEXT:    .cfi_offset lr, -4
+; CHECK-NEXT:    .cfi_offset r7, -8
+; CHECK-NEXT:    .save    {ra_auth_code}
+; CHECK-NEXT:    str    r12, [sp, #-4]!
+; CHECK-NEXT:    .cfi_def_cfa_offset 12
+; CHECK-NEXT:    .cfi_offset ra_auth_code, -12
+; CHECK-NEXT:    .pad    #4
+; CHECK-NEXT:    sub    sp, #4
+; CHECK-NEXT:    .cfi_def_cfa_offset 16
+; ...
+; CHECK-NOT: pac
+; CHECK-NOT: aut
+; CHECK:     .cfi_endproc
+
+declare dso_local i8* @__cxa_allocate_exception(i32) local_unnamed_addr
+
+declare dso_local void @__cxa_throw(i8*, i8*, i8*) local_unnamed_addr
+
+define hidden i32 @_Z1fiiii(i32 %a, i32 %b, i32 %c, i32 %d) local_unnamed_addr #0 {
+entry:
+  %cmp = icmp slt i32 %a, 0
+  br i1 %cmp, label %return, label %if.end
+
+if.end:                                           ; preds = %entry
+  %call = tail call i32 @_Z1hii(i32 %a, i32 %b)
+  %add = add nsw i32 %call, %b
+  %mul = mul nsw i32 %add, %call
+  %add1 = add nsw i32 %d, %c
+  %div = sdiv i32 %mul, %add1
+  %add2 = add nsw i32 %div, 2
+  br label %return
+
+return:                                           ; preds = %entry, %if.end
+  %retval.0 = phi i32 [ %add2, %if.end ], [ -1, %entry ]
+  ret i32 %retval.0
+}
+
+; CHECK-LABEL: _Z1fiiii:
+; ...
+; CHECK:    bmi    .L[[B:[a-zA-Z0-9]*]]
+; ...
+; CHECK:    pac    r12, lr, sp
+; CHECK-NEXT:    .save    {r4, r5, r6, lr}
+; CHECK-NEXT:    push    {r4, r5, r6, lr}
+; CHECK-NEXT:    .cfi_def_cfa_offset 16
+; CHECK-NEXT:    .cfi_offset lr, -4
+; CHECK-NEXT:    .cfi_offset r6, -8
+; CHECK-NEXT:    .cfi_offset r5, -12
+; CHECK-NEXT:    .cfi_offset r4, -16
+; CHECK-NEXT:    .save    {ra_auth_code}
+; CHECK-NEXT:    str    r12, [sp, #-4]!
+; CHECK-NEXT:    .cfi_def_cfa_offset 20
+; CHECK-NEXT:    .cfi_offset ra_auth_code, -20
+; CHECK-NEXT:    .pad    #4
+; CHECK-NEXT:    sub    sp, #4
+; CHECK-NEXT:    .cfi_def_cfa_offset 24
+; ...
+; CHECK:    add    sp, #4
+; CHECK-NEXT:    ldr    r12, [sp], #4
+; CHECK-NEXT:    pop.w    {r4, r5, r6, lr}
+; CHECK-NEXT:    aut    r12, lr, sp
+; CHECK-NEXT:    bx    lr
+; ...
+; CHECK: .L[[B]]
+; ...
+; CHECK:    bx    lr
+
+
+
+define hidden i32 @_Z1giiii(i32 %a, i32 %b, i32 %c, i32 %d) local_unnamed_addr #0 {
+entry:
+  %cmp = icmp slt i32 %a, 0
+  br i1 %cmp, label %return, label %if.end
+
+if.end:                                           ; preds = %entry
+  %call = tail call i32 @_Z1hii(i32 %a, i32 %b)
+  %add = add nsw i32 %call, %b
+  %mul = mul nsw i32 %add, %call
+  %add1 = add nsw i32 %d, %c
+  %div = sdiv i32 %mul, %add1
+  %add2 = add nsw i32 %div, 1
+  br label %return
+
+return:                                           ; preds = %entry, %if.end
+  %retval.0 = phi i32 [ %add2, %if.end ], [ -1, %entry ]
+  ret i32 %retval.0
+}
+
+; CHECK-LABEL: _Z1giiii:
+; ...
+; CHECK:    bmi    .L[[B:[a-zA-Z0-9]*]]
+; ...
+; CHECK:    pac    r12, lr, sp
+; CHECK-NEXT:    .save    {r4, r5, r6, lr}
+; CHECK-NEXT:    push    {r4, r5, r6, lr}
+; CHECK-NEXT:    .cfi_def_cfa_offset 16
+; CHECK-NEXT:    .cfi_offset lr, -4
+; CHECK-NEXT:    .cfi_offset r6, -8
+; CHECK-NEXT:    .cfi_offset r5, -12
+; CHECK-NEXT:    .cfi_offset r4, -16
+; CHECK-NEXT:    .save    {ra_auth_code}
+; CHECK-NEXT:    str    r12, [sp, #-4]!
+; CHECK-NEXT:    .cfi_def_cfa_offset 20
+; CHECK-NEXT:    .cfi_offset ra_auth_code, -20
+; CHECK-NEXT:    .pad    #4
+; CHECK-NEXT:    sub    sp, #4
+; CHECK-NEXT:    .cfi_def_cfa_offset 24
+; ...
+; CHECK:    add    sp, #4
+; CHECK-NEXT:    ldr    r12, [sp], #4
+; CHECK-NEXT:    pop.w    {r4, r5, r6, lr}
+; CHECK-NEXT:    aut    r12, lr, sp
+; CHECK-NEXT:    bx    lr
+; ...
+; CHECK: .L[[B]]
+; ...
+; CHECK:    bx    lr
+
+
+; CHEK-LABEL: OUTLINED_FUNCTION_0:
+; CHECK-NOT: pac
+; CHECK-NOT: aut
+; CHECK:        b    _Z1hii
+
+attributes #0 = { minsize noinline optsize "denormal-fp-math"="preserve-sign,preserve-sign" "denormal-fp-math-f32"="ieee,ieee" "disable-tail-calls"="false" "frame-pointer"="none" "less-precise-fpmad"="false" "min-legal-vector-width"="0" "no-infs-fp-math"="true" "no-jump-tables"="false" "no-nans-fp-math"="true" "no-signed-zeros-fp-math"="true" "no-trapping-math"="true" "stack-protector-buffer-size"="8" "target-cpu"="cortex-m3" "target-features"="+armv7-m,+hwdiv,+thumb-mode" "unsafe-fp-math"="false" "use-soft-float"="false" }
+attributes #1 = { nounwind }
+attributes #2 = { noreturn }
+
+
+!llvm.module.flags = !{!0, !1, !2}
+
+!0 = !{i32 1, !"branch-target-enforcement", i32 0}
+!1 = !{i32 1, !"sign-return-address", i32 1}
+!2 = !{i32 1, !"sign-return-address-all", i32 0}
+
+
+; UNWIND-LABEL: FunctionAddress: 0x0
+; UNWIND:       Opcodes
+; UNWIND-NEXT:  0x00      ; vsp = vsp + 4
+; UNWIND-NEXT:  0xB4      ; pop ra_auth_code
+; UNWIND-NEXT:  0x84 0x08 ; pop {r7, lr}
+; UNWIND-NEXT:  0xB0      ; finish
+; UNWIND-NEXT:  0xB0      ; finish
+
+; UNWIND-LABEL: FunctionAddress: 0x2C
+; UNWIND:       Opcodes
+; UNWIND-NEXT:  0x00      ; vsp = vsp + 4
+; UNWIND-NEXT:  0xB4      ; pop ra_auth_code
+; UNWIND-NEXT:  0xAA      ; pop {r4, r5, r6, lr}
+
+; UNWIND-LABEL: FunctionAddress: 0x62
+; UNWIND:       Opcodes
+; UNWIND-NEXT:  0x00      ; vsp = vsp + 4
+; UNWIND-NEXT:  0xB4      ; pop ra_auth_code
+; UNWIND-NEXT:  0xAA      ; pop {r4, r5, r6, lr}
+
+; UNWIND-LABEL: FunctionAddress: 0x98
+; UNWIND:       Opcodes
+; UNWIND-NEXT:  0xB0      ; finish
+; UNWIND-NEXT:  0xB0      ; finish
+; UNWIND-NEXT:  0xB0      ; finish
+
+; UNWIND: 00000099 {{.*}} OUTLINED_FUNCTION_0
+; UWNIND: 0000002d {{.*}} _Z1fiiii
+; UWNIND: 00000063 {{.*}} _Z1giiii
+; UWNIND: 00000001 {{.*}} _Z1hii

llvm/test/CodeGen/Thumb2/pacbti-m-outliner-5.ll

+; RUN: llc %s -o - | FileCheck %s
+target datalayout = "e-m:e-p:32:32-Fi8-i64:64-v128:64:128-a:0:32-n32-S64"
+target triple = "thumbv7m-arm-none-eabi"
+
+; CHECK-LABEL: x:
+; CHECK: bl OUTLINED_FUNCTION
+; CHECK-LABEL: y:
+; CHECK: bl OUTLINED_FUNCTION
+; CHECK-LABEL: z:
+; CHECK-NOT: bl OUTLINED_FUNCTION
+
+@a = hidden global i32 0, align 4
+@b = hidden global i32 0, align 4
+@c = hidden global i32 0, align 4
+@d = hidden global i32 0, align 4
+@e = hidden global i32 0, align 4
+@f = hidden global i32 0, align 4
+@g = hidden global i32 0, align 4
+@h = hidden global i32 0, align 4
+@i = hidden global i32 0, align 4
+
+define hidden i32 @x() local_unnamed_addr #0 {
+entry:
+  %0 = load volatile i32, i32* @a, align 4
+  %1 = load volatile i32, i32* @b, align 4
+  %add = add nsw i32 %1, %0
+  %2 = load volatile i32, i32* @c, align 4
+  %3 = load volatile i32, i32* @d, align 4
+  %add1 = add nsw i32 %3, %2
+  %div = sdiv i32 %add, %add1
+  %4 = load volatile i32, i32* @e, align 4
+  %5 = load volatile i32, i32* @f, align 4
+  %6 = load volatile i32, i32* @g, align 4
+  %div3 = sdiv i32 %5, %6
+  %7 = load volatile i32, i32* @h, align 4
+  %8 = load volatile i32, i32* @i, align 4
+  %add2 = add i32 %div, 1
+  %add4 = add i32 %add2, %4
+  %add5 = add i32 %add4, %div3
+  %add6 = add i32 %add5, %7
+  %add7 = add i32 %add6, %8
+  ret i32 %add7
+}
+
+define hidden i32 @y() local_unnamed_addr #0 {
+entry:
+  %0 = load volatile i32, i32* @a, align 4
+  %1 = load volatile i32, i32* @b, align 4
+  %add = add nsw i32 %1, %0
+  %2 = load volatile i32, i32* @c, align 4
+  %3 = load volatile i32, i32* @d, align 4
+  %add1 = add nsw i32 %3, %2
+  %div = sdiv i32 %add, %add1
+  %4 = load volatile i32, i32* @e, align 4
+  %5 = load volatile i32, i32* @f, align 4
+  %6 = load volatile i32, i32* @g, align 4
+  %div3 = sdiv i32 %5, %6
+  %7 = load volatile i32, i32* @h, align 4
+  %8 = load volatile i32, i32* @i, align 4
+  %add2 = add i32 %div, 2
+  %add4 = add i32 %add2, %4
+  %add5 = add i32 %add4, %div3
+  %add6 = add i32 %add5, %7
+  %add7 = add i32 %add6, %8
+  ret i32 %add7
+}
+
+define hidden i32 @z() local_unnamed_addr #1 {
+entry:
+  %0 = load volatile i32, i32* @a, align 4
+  %1 = load volatile i32, i32* @b, align 4
+  %add = add nsw i32 %1, %0
+  %2 = load volatile i32, i32* @c, align 4
+  %3 = load volatile i32, i32* @d, align 4
+  %add1 = add nsw i32 %3, %2
+  %div = sdiv i32 %add, %add1
+  %4 = load volatile i32, i32* @e, align 4
+  %5 = load volatile i32, i32* @f, align 4
+  %6 = load volatile i32, i32* @g, align 4
+  %div3 = sdiv i32 %5, %6
+  %7 = load volatile i32, i32* @h, align 4
+  %8 = load volatile i32, i32* @i, align 4
+  %add2 = add i32 %div, 3
+  %add4 = add i32 %add2, %4
+  %add5 = add i32 %add4, %div3
+  %add6 = add i32 %add5, %7
+  %add7 = add i32 %add6, %8
+  ret i32 %add7
+}
+
+attributes #0 = { minsize nofree norecurse nounwind optsize }
+attributes #1 = { minsize nofree norecurse nounwind optsize "sign-return-address"="none" }
+
+!llvm.module.flags = !{!0, !1, !2}
+
+!0 = !{i32 1, !"branch-target-enforcement", i32 0}
+!1 = !{i32 1, !"sign-return-address", i32 1}
+!2 = !{i32 1, !"sign-return-address-all", i32 0}

llvm/test/CodeGen/Thumb2/pacbti-m-overalign.ll

+; RUN: llc --force-dwarf-frame-section %s -o - | FileCheck %s
+; RUN: llc --filetype=obj %s -o - | llvm-readelf --unwind - | FileCheck %s --check-prefix=UNWIND
+target datalayout = "e-m:e-p:32:32-Fi8-i64:64-v128:64:128-a:0:32-n32-S64"
+target triple = "thumbv8.1m.main-arm-none-eabi"
+
+; int g(int, int *);
+;
+; int f() {
+;     __attribute__((aligned(32))) int a[4];
+;    g(4, a);
+;   int s = 0;
+;   for (int i = 0; i < 4; ++i)
+;     s +=  a[i];
+;   return s;
+; }
+
+define hidden i32 @_Z1fv() local_unnamed_addr {
+entry:
+  %a = alloca [4 x i32], align 32
+  %0 = bitcast [4 x i32]* %a to i8*
+  %arraydecay = getelementptr inbounds [4 x i32], [4 x i32]* %a, i32 0, i32 0
+  %call = call i32 @_Z1giPi(i32 4, i32* nonnull %arraydecay)
+  %1 = load i32, i32* %arraydecay, align 32
+  %arrayidx.1 = getelementptr inbounds [4 x i32], [4 x i32]* %a, i32 0, i32 1
+  %2 = load i32, i32* %arrayidx.1, align 4
+  %add.1 = add nsw i32 %2, %1
+  %arrayidx.2 = getelementptr inbounds [4 x i32], [4 x i32]* %a, i32 0, i32 2
+  %3 = load i32, i32* %arrayidx.2, align 8
+  %add.2 = add nsw i32 %3, %add.1
+  %arrayidx.3 = getelementptr inbounds [4 x i32], [4 x i32]* %a, i32 0, i32 3
+  %4 = load i32, i32* %arrayidx.3, align 4
+  %add.3 = add nsw i32 %4, %add.2
+  ret i32 %add.3
+}
+
+; CHECK-LABEL: _Z1fv:
+; CHECK:      pac     r12, lr, sp
+; CHECK:      .save   {r4, r6, r7, lr}
+; CHECK-NEXT: push    {r4, r6, r7, lr}
+; CHECK-NEXT: .cfi_def_cfa_offset 16
+; CHECK-NEXT: .cfi_offset lr, -4
+; CHECK-NEXT: .cfi_offset r7, -8
+; CHECK-NEXT: .cfi_offset r6, -12
+; CHECK-NEXT: .cfi_offset r4, -16
+; CHECK-NEXT: .setfp  r7, sp, #8
+; CHECK-NEXT: add     r7, sp, #8
+; CHECK-NEXT: .cfi_def_cfa r7, 8
+; CHECK-NEXT: .save   {ra_auth_code}
+; CHECK-NEXT: str     r12, [sp, #-4]!
+; CHECK-NEXT: .cfi_offset ra_auth_code, -20
+; CHECK-NEXT: .pad    #44
+; CHECK-NEXT: sub     sp, #44
+; CHECK:      ldr     r12, [sp], #4
+; CHECK-NEXT: pop.w   {r4, r6, r7, lr}
+; CHECK-NEXT: aut     r12, lr, sp
+; CHECK-NEXT: bx      lr
+
+
+declare dso_local i32 @_Z1giPi(i32, i32*) local_unnamed_addr
+
+!llvm.module.flags = !{!0, !1, !2}
+
+!0 = !{i32 1, !"branch-target-enforcement", i32 0}
+!1 = !{i32 1, !"sign-return-address", i32 1}
+!2 = !{i32 1, !"sign-return-address-all", i32 0}
+
+; UNWIND-LABEL:        FunctionAddress: 0x0
+; UNWIND:          0x97      ; vsp = r7
+; UNWIND:          0x42      ; vsp = vsp - 12
+; UNWIND:          0xB4      ; pop ra_auth_code
+; UNWIND:          0x84 0x0D ; pop {r4, r6, r7, lr}

llvm/test/CodeGen/Thumb2/pacbti-m-unsupported-arch.ll

+; RUN: llc -mtriple thumbv6m-eabi      %s -o - | FileCheck %s
+; RUN: llc -mtriple thumbv8m.base-eabi %s -o - | FileCheck %s
+; RUN: llc -mtriple thumbv7a-eabi %s      -o - | FileCheck %s
+; RUN: llc -mtriple thumbv7m-eabi      %s -o - | FileCheck %s --check-prefix=CHECK-PACBTI
+
+; Check we don't emit PACBTI-M instructions for architectures
+; that do not support them.
+define hidden i32 @f(i32 %x) #0 {
+entry:
+  %x.addr = alloca i32, align 4
+  store i32 %x, i32* %x.addr, align 4
+  %0 = load i32, i32* %x.addr, align 4
+  %sub = sub nsw i32 1, %0
+  %call = call i32 @g(i32 %sub)
+  %add = add nsw i32 1, %call
+  ret i32 %add
+}
+; CHECK-LABEL: f:
+; CHECK-NOT:   bti
+
+; CHECK-PACBTI-LABEL: f:
+; CHECK-PACBTI:       pacbti
+declare dso_local i32 @g(i32)
+
+attributes #0 = { noinline nounwind }
+
+!llvm.module.flags = !{!0, !1, !2}
+
+!0 = !{i32 1, !"branch-target-enforcement", i32 1}
+!1 = !{i32 1, !"sign-return-address", i32 1}
+!2 = !{i32 1, !"sign-return-address-all", i32 0}

llvm/test/CodeGen/Thumb2/pacbti-m-varargs-1.ll

+; RUN: llc --force-dwarf-frame-section %s -o - | FileCheck %s
+target datalayout = "e-m:e-p:32:32-Fi8-i64:64-v128:64:128-a:0:32-n32-S64"
+target triple = "thumbv8.1m.main-arm-none-eabi"
+
+%"struct.std::__va_list" = type { i8* }
+
+define hidden i32 @_Z1fiz(i32 %n, ...) local_unnamed_addr #0 {
+entry:
+  %ap = alloca %"struct.std::__va_list", align 4
+  %0 = bitcast %"struct.std::__va_list"* %ap to i8*
+  call void @llvm.va_start(i8* nonnull %0)
+  %cmp7 = icmp sgt i32 %n, 0
+  br i1 %cmp7, label %for.body.lr.ph, label %for.cond.cleanup
+
+for.body.lr.ph:                                   ; preds = %entry
+  %1 = getelementptr inbounds %"struct.std::__va_list", %"struct.std::__va_list"* %ap, i32 0, i32 0
+  %argp.cur.pre = load i8*, i8** %1, align 4
+  br label %for.body
+
+for.cond.cleanup:                                 ; preds = %for.body, %entry
+  %s.0.lcssa = phi i32 [ 0, %entry ], [ %add, %for.body ]
+  call void @llvm.va_end(i8* nonnull %0)
+  ret i32 %s.0.lcssa
+
+for.body:                                         ; preds = %for.body.lr.ph, %for.body
+  %argp.cur = phi i8* [ %argp.cur.pre, %for.body.lr.ph ], [ %argp.next, %for.body ]
+  %i.09 = phi i32 [ 0, %for.body.lr.ph ], [ %inc, %for.body ]
+  %s.08 = phi i32 [ 0, %for.body.lr.ph ], [ %add, %for.body ]
+  %argp.next = getelementptr inbounds i8, i8* %argp.cur, i32 4
+  store i8* %argp.next, i8** %1, align 4
+  %2 = bitcast i8* %argp.cur to i32*
+  %3 = load i32, i32* %2, align 4
+  %add = add nsw i32 %3, %s.08
+  %inc = add nuw nsw i32 %i.09, 1
+  %exitcond.not = icmp eq i32 %inc, %n
+  br i1 %exitcond.not, label %for.cond.cleanup, label %for.body
+}
+
+; CHECK-LABEL: _Z1fiz:
+; CHECK:      pac    r12, lr, sp
+; CHECK-NEXT: .pad    #12
+; CHECK-NEXT: sub    sp, #12
+; CHECK-NEXT: .cfi_def_cfa_offset 12
+; CHECK-NEXT:  .save    {r7, lr}
+; CHECK-NEXT: push    {r7, lr}
+; CHECK-NEXT: .cfi_def_cfa_offset 20
+; CHECK-NEXT: .cfi_offset lr, -16
+; CHECK-NEXT: .cfi_offset r7, -20
+; CHECK-NEXT: .save    {ra_auth_code}
+; CHECK-NEXT: str    r12, [sp, #-4]!
+; CHECK-NEXT: .cfi_def_cfa_offset 24
+; CHECK-NEXT: .cfi_offset ra_auth_code, -24
+; CHECK-NEXT: .pad    #4
+; CHECK-NEXT: sub    sp, #4
+; CHECK-NEXT: .cfi_def_cfa_offset 28
+; ...
+; CHECK:      add.w r[[N:[0-9]*]], sp, #16
+; CHECK:      stm.w r[[N]], {r1, r2, r3}
+; ...
+; CHECK:      add    sp, #4
+; CHECK-NEXT: ldr    r12, [sp], #4
+; CHECK-NEXT: pop.w    {r7, lr}
+; CHECK-NEXT: add    sp, #12
+; CHECK-NEXT: aut    r12, lr, sp
+; CHECK-NEXT: bx    lr
+
+declare void @llvm.va_start(i8*) #1
+declare void @llvm.va_end(i8*) #1
+
+attributes #0 = { nounwind optsize}
+attributes #1 = { nounwind }
+
+!llvm.module.flags = !{!0, !1, !2}
+
+!0 = !{i32 1, !"branch-target-enforcement", i32 0}
+!1 = !{i32 1, !"sign-return-address", i32 1}
+!2 = !{i32 1, !"sign-return-address-all", i32 0}

llvm/test/CodeGen/Thumb2/pacbti-m-varargs-2.ll

+; RUN: llc --force-dwarf-frame-section %s -o - | FileCheck %s
+; RUN: llc --filetype=obj %s -o - | llvm-readelf --unwind - | FileCheck %s --check-prefix=UNWIND
+target datalayout = "e-m:e-p:32:32-Fi8-i64:64-v128:64:128-a:0:32-n32-S64"
+target triple = "thumbv8.1m.main-arm-none-eabi"
+
+; C++
+; int g(int);
+;
+; int f(int n, ...) {
+;   __builtin_va_list ap;
+;   __builtin_va_start(ap, n);
+;   int s = 0;
+;   for (int i = 0; i < n; ++i)
+;     s += g(__builtin_va_arg(ap, int));
+;   __builtin_va_end(ap);
+;   return s;
+; }
+
+%"struct.std::__va_list" = type { i8* }
+
+define hidden i32 @_Z1fiz(i32 %n, ...) local_unnamed_addr #0 {
+entry:
+  %ap = alloca %"struct.std::__va_list", align 4
+  %0 = bitcast %"struct.std::__va_list"* %ap to i8*
+  call void @llvm.va_start(i8* nonnull %0)
+  %cmp7 = icmp sgt i32 %n, 0
+  br i1 %cmp7, label %for.body.lr.ph, label %for.cond.cleanup
+
+for.body.lr.ph:                                   ; preds = %entry
+  %1 = getelementptr inbounds %"struct.std::__va_list", %"struct.std::__va_list"* %ap, i32 0, i32 0
+  br label %for.body
+
+for.cond.cleanup:                                 ; preds = %for.body, %entry
+  %s.0.lcssa = phi i32 [ 0, %entry ], [ %add, %for.body ]
+  call void @llvm.va_end(i8* nonnull %0)
+  ret i32 %s.0.lcssa
+
+for.body:                                         ; preds = %for.body.lr.ph, %for.body
+  %i.09 = phi i32 [ 0, %for.body.lr.ph ], [ %inc, %for.body ]
+  %s.08 = phi i32 [ 0, %for.body.lr.ph ], [ %add, %for.body ]
+  %argp.cur = load i8*, i8** %1, align 4
+  %argp.next = getelementptr inbounds i8, i8* %argp.cur, i32 4
+  store i8* %argp.next, i8** %1, align 4
+  %2 = bitcast i8* %argp.cur to i32*
+  %3 = load i32, i32* %2, align 4
+  %call = call i32 @_Z1gi(i32 %3)
+  %add = add nsw i32 %call, %s.08
+  %inc = add nuw nsw i32 %i.09, 1
+  %exitcond.not = icmp eq i32 %inc, %n
+  br i1 %exitcond.not, label %for.cond.cleanup, label %for.body
+}
+
+; CHECK-LABEL: _Z1fiz:
+; CHECK:       pac    r12, lr, sp
+; CHECK-NEXT:  .pad   #12
+; CHECK-NEXT:  sub    sp, #12
+; CHECK-NEXT:  .cfi_def_cfa_offset 12
+; CHECK-NEXT:  .save   {r4, r5, r7, lr}
+; CHECK-NEXT:  push    {r4, r5, r7, lr}
+; CHECK-NEXT:  .cfi_def_cfa_offset 28
+; CHECK-NEXT:  .cfi_offset lr, -16
+; CHECK-NEXT:  .cfi_offset r7, -20
+; CHECK-NEXT:  .cfi_offset r5, -24
+; CHECK-NEXT:  .cfi_offset r4, -28
+; CHECK-NEXT:  .save  {ra_auth_code}
+; CHECK-NEXT:  str    r12, [sp, #-4]!
+; CHECK-NEXT: .cfi_def_cfa_offset 32
+; CHECK-NEXT: .cfi_offset ra_auth_code, -32
+; CHECK-NEXT:  .pad   #8
+; CHECK-NEXT:  sub    sp, #8
+; CHECK-NEXT: .cfi_def_cfa_offset 40
+; ...
+; CHECK:       add    r[[N:[0-9]*]], sp, #28
+; CHECK:       stm    r[[N]]!, {r1, r2, r3}
+; ...
+; CHECK:       add    sp, #8
+; CHECK-NEXT:  ldr    r12, [sp], #4
+; CHECK-NEXT:  pop.w  {r4, r5, r7, lr}
+; CHECK-NEXT:  add    sp, #12
+; CHECK-NEXT:  aut    r12, lr, sp
+; CHECK-NEXT:  bx     lr
+
+declare void @llvm.va_start(i8*) #1
+declare void @llvm.va_end(i8*) #1
+
+declare dso_local i32 @_Z1gi(i32) local_unnamed_addr
+
+attributes #0 = { optsize }
+attributes #1 = { nounwind }
+
+!llvm.module.flags = !{!0, !1, !2}
+
+!0 = !{i32 1, !"branch-target-enforcement", i32 0}
+!1 = !{i32 1, !"sign-return-address", i32 1}
+!2 = !{i32 1, !"sign-return-address-all", i32 0}
+
+; UNWIND-LABEL: FunctionAddress
+; UNWIND:       0x01      ; vsp = vsp + 8
+; UNWIND-NEXT:  0xB4      ; pop ra_auth_code
+; UNWIND-NEXT:  0x84 0x0B ; pop {r4, r5, r7, lr}
+; UNWIND-NEXT:  0x02      ; vsp = vsp + 12

llvm/test/CodeGen/Thumb2/pacbti-m-vla.ll

+; RUN: llc --force-dwarf-frame-section %s -o - | FileCheck %s
+target datalayout = "e-m:e-p:32:32-Fi8-i64:64-v128:64:128-a:0:32-n32-S64"
+target triple = "thumbv8.1m.main-arm-none-eabi"
+
+; int g(int, int *);
+;
+; int f(int n) {
+;   int a[n];
+;   g(n, a);
+;   int s = 0;
+;   for (int i = 0; i < n; ++i)
+;     s += a[i];
+;   return s;
+; }
+
+define hidden i32 @f(i32 %n) local_unnamed_addr #0 {
+entry:
+  %vla = alloca i32, i32 %n, align 4
+  %call = call i32 @g(i32 %n, i32* nonnull %vla) #0
+  %cmp8 = icmp sgt i32 %n, 0
+  br i1 %cmp8, label %for.body.preheader, label %for.cond.cleanup
+
+for.body.preheader:                               ; preds = %entry
+  %0 = add i32 %n, -1
+  %xtraiter = and i32 %n, 3
+  %1 = icmp ult i32 %0, 3
+  br i1 %1, label %for.cond.cleanup.loopexit.unr-lcssa, label %for.body.preheader.new
+
+for.body.preheader.new:                           ; preds = %for.body.preheader
+  %unroll_iter = and i32 %n, -4
+  br label %for.body
+
+for.cond.cleanup.loopexit.unr-lcssa:              ; preds = %for.body, %for.body.preheader
+  %add.lcssa.ph = phi i32 [ undef, %for.body.preheader ], [ %add.3, %for.body ]
+  %i.010.unr = phi i32 [ 0, %for.body.preheader ], [ %inc.3, %for.body ]
+  %s.09.unr = phi i32 [ 0, %for.body.preheader ], [ %add.3, %for.body ]
+  %lcmp.mod.not = icmp eq i32 %xtraiter, 0
+  br i1 %lcmp.mod.not, label %for.cond.cleanup, label %for.body.epil
+
+for.body.epil:                                    ; preds = %for.cond.cleanup.loopexit.unr-lcssa
+  %arrayidx.epil = getelementptr inbounds i32, i32* %vla, i32 %i.010.unr
+  %2 = load i32, i32* %arrayidx.epil, align 4
+  %add.epil = add nsw i32 %2, %s.09.unr
+  %epil.iter.cmp.not = icmp eq i32 %xtraiter, 1
+  br i1 %epil.iter.cmp.not, label %for.cond.cleanup, label %for.body.epil.1
+
+for.cond.cleanup:                                 ; preds = %for.cond.cleanup.loopexit.unr-lcssa, %for.body.epil.2, %for.body.epil.1, %for.body.epil, %entry
+  %s.0.lcssa = phi i32 [ 0, %entry ], [ %add.lcssa.ph, %for.cond.cleanup.loopexit.unr-lcssa ], [ %add.epil, %for.body.epil ], [ %add.epil.1, %for.body.epil.1 ], [ %add.epil.2, %for.body.epil.2 ]
+  ret i32 %s.0.lcssa
+
+for.body:                                         ; preds = %for.body, %for.body.preheader.new
+  %i.010 = phi i32 [ 0, %for.body.preheader.new ], [ %inc.3, %for.body ]
+  %s.09 = phi i32 [ 0, %for.body.preheader.new ], [ %add.3, %for.body ]
+  %niter = phi i32 [ %unroll_iter, %for.body.preheader.new ], [ %niter.nsub.3, %for.body ]
+  %arrayidx = getelementptr inbounds i32, i32* %vla, i32 %i.010
+  %3 = load i32, i32* %arrayidx, align 4
+  %add = add nsw i32 %3, %s.09
+  %inc = or i32 %i.010, 1
+  %arrayidx.1 = getelementptr inbounds i32, i32* %vla, i32 %inc
+  %4 = load i32, i32* %arrayidx.1, align 4
+  %add.1 = add nsw i32 %4, %add
+  %inc.1 = or i32 %i.010, 2
+  %arrayidx.2 = getelementptr inbounds i32, i32* %vla, i32 %inc.1
+  %5 = load i32, i32* %arrayidx.2, align 4
+  %add.2 = add nsw i32 %5, %add.1
+  %inc.2 = or i32 %i.010, 3
+  %arrayidx.3 = getelementptr inbounds i32, i32* %vla, i32 %inc.2
+  %6 = load i32, i32* %arrayidx.3, align 4
+  %add.3 = add nsw i32 %6, %add.2
+  %inc.3 = add nuw nsw i32 %i.010, 4
+  %niter.nsub.3 = add i32 %niter, -4
+  %niter.ncmp.3 = icmp eq i32 %niter.nsub.3, 0
+  br i1 %niter.ncmp.3, label %for.cond.cleanup.loopexit.unr-lcssa, label %for.body
+
+for.body.epil.1:                                  ; preds = %for.body.epil
+  %inc.epil = add nuw nsw i32 %i.010.unr, 1
+  %arrayidx.epil.1 = getelementptr inbounds i32, i32* %vla, i32 %inc.epil
+  %7 = load i32, i32* %arrayidx.epil.1, align 4
+  %add.epil.1 = add nsw i32 %7, %add.epil
+  %epil.iter.cmp.1.not = icmp eq i32 %xtraiter, 2
+  br i1 %epil.iter.cmp.1.not, label %for.cond.cleanup, label %for.body.epil.2
+
+for.body.epil.2:                                  ; preds = %for.body.epil.1
+  %inc.epil.1 = add nuw nsw i32 %i.010.unr, 2
+  %arrayidx.epil.2 = getelementptr inbounds i32, i32* %vla, i32 %inc.epil.1
+  %8 = load i32, i32* %arrayidx.epil.2, align 4
+  %add.epil.2 = add nsw i32 %8, %add.epil.1
+  br label %for.cond.cleanup
+}
+
+; CHECK-LABEL: f:
+; CHECK:       pac    r12, lr, sp
+; CHECK-NEXT: .save   {r4, r5, r6, r7, lr}
+; CHECK-NEXT: push    {r4, r5, r6, r7, lr}
+; CHECK-NEXT: .cfi_def_cfa_offset 20
+; CHECK-NEXT: .cfi_offset lr, -4
+; CHECK-NEXT: .cfi_offset r7, -8
+; CHECK-NEXT: .cfi_offset r6, -12
+; CHECK-NEXT: .cfi_offset r5, -16
+; CHECK-NEXT: .cfi_offset r4, -20
+; CHECK-NEXT: .setfp r7, sp, #12
+; CHECK-NEXT: add    r7, sp, #12
+; CHECK-NEXT: .cfi_def_cfa r7, 8
+; CHECK-NEXT: .save    {r8, r9, ra_auth_code}
+; CHECK-NEXT: push.w   {r8, r9, r12}
+; CHECK-NEXT: .cfi_offset ra_auth_code, -24
+; CHECK-NEXT: .cfi_offset r9, -28
+; CHECK-NEXT: .cfi_offset r8, -32
+; ...
+; CHECK:      sub.w  r[[N:[0-9]*]], r7, #24
+; CHECK-NEXT: mov    sp, r[[N]]
+; CHECK-NEXT: pop.w  {r8, r9, r12}
+; CHECK-NEXT: pop.w  {r4, r5, r6, r7, lr}
+; CHECK-NEXT: aut    r12, lr, sp
+; CHECK-NEXT: bx     lr
+
+declare dso_local i32 @g(i32, i32*) local_unnamed_addr #0
+
+attributes #0 = { nounwind }
+
+!llvm.module.flags = !{!0, !1, !2}
+
+!0 = !{i32 1, !"branch-target-enforcement", i32 0}
+!1 = !{i32 1, !"sign-return-address", i32 1}
+!2 = !{i32 1, !"sign-return-address-all", i32 0}

llvm/test/MC/ARM/ra-auth-code-errors.s

+// RUN: not llvm-mc -triple=thumbv7 %s -o - 2>&1 | FileCheck  %s --strict-whitespace
+        .text
+    .syntax unified
+    .code 16
+    .thumb_func
+    .global f
+f:
+    .fnstart
+    .save {r11-ra_auth_code}
+// CHECK: [[# @LINE - 1]]:16: error: pseudo-register not allowed
+// CHECK-NEXT:    .save {r11-ra_auth_code}
+// CHECK-NEXT:               ^
+    .save {r11, ra_auth_code, r12}
+// CHECK: [[# @LINE - 1]]:31: warning: duplicated register (r12) in register list
+// CHECK-NEXT:    .save {r11, ra_auth_code, r12}
+// CHECK-NEXT:                              ^
+    .save {ra_auth_code-r13}
+// CHECK: [[# @LINE - 1]]:12: error: pseudo-register not allowed
+// CHECK-NEXT:    .save {ra_auth_code-r13}
+// CHECK-NEXT:           ^
+    push {ra_auth_code}
+// CHECK: [[# @LINE - 1]]:11: error: pseudo-register not allowed
+// CHECK-NEXT:    push {ra_auth_code}
+// CHECK-NEXT:          ^
+    push {r11, ra_auth_code}
+// CHECK: [[# @LINE - 1]]:16: error: pseudo-register not allowed
+// CHECK-NEXT:    push {r11, ra_auth_code}
+// CHECK-NEXT:               ^
+    push {ra_auth_code, r12}
+// CHECK: [[# @LINE - 1]]:11: error: pseudo-register not allowed
+// CHECK-NEXT:    push {ra_auth_code, r12}
+// CHECK-NEXT:          ^
+    push {ra_auth_code, r13}
+// CHECK: [[# @LINE - 1]]:11: error: pseudo-register not allowed
+// CHECK-NEXT:    push {ra_auth_code, r13}
+// CHECK-NEXT:          ^

llvm/test/MC/ARM/ra-auth-code.s

+// RUN: llvm-mc -triple=thumbv7 -filetype=obj %s -o - | llvm-readelf -u - | FileCheck  %s
+
+  .syntax unified
+  .code 16
+  .thumb_func
+  .global f
+f:
+  .fnstart
+  .save {ra_auth_code}
+  .save {ra_auth_code, r13}
+  .save {r11, ra_auth_code, r13}
+  .save {r11, ra_auth_code}
+  .fnend
+// CHECK-LABEL: Opcodes [
+// CHECK-NEXT: 0x80 0x80 ; pop {fp}
+// CHECK-NEXT: 0xB4      ; pop ra_auth_code
+// CHECK-NEXT: 0x80 0x80 ; pop {fp}
+// CHECK-NEXT: 0xB4      ; pop ra_auth_code
+// CHECK-NEXT: 0x82 0x00 ; pop {sp}
+// CHECK-NEXT: 0xB4      ; pop ra_auth_code
+// CHECK-NEXT: 0x82 0x00 ; pop {sp}
+// CHECK-NEXT: 0xB4      ; pop ra_auth_code
+// CHECK-NEXT: 0xB0      ; finish
+// CHECK-NEXT: 0xB0      ; finish

llvm/test/MC/Disassembler/ARM/sub-sp-imm-thumb2.txt

 # RUN: llvm-mc -triple=thumbv7 -disassemble -show-inst < %s | FileCheck %s
 
 # https://bugs.llvm.org/show_bug.cgi?id=49974
 # Incorrect number of predicate operands were inserted to the
 # disassembled MCInst.
 
 # CHECK:      subw sp, sp, #1148
 # CHECK-SAME: <MCInst #{{[0-9]+}} t2SUBspImm12
-# CHECK-NEXT: <MCOperand Reg:15>
-# CHECK-NEXT: <MCOperand Reg:15>
+# CHECK-NEXT: <MCOperand Reg:[[SP:[0-9]+]]>
+# CHECK-NEXT: <MCOperand Reg:[[SP]]>
 # CHECK-NEXT: <MCOperand Imm:1148>
 # CHECK-NEXT: <MCOperand Imm:14>
 # CHECK-NEXT: <MCOperand Reg:0>>
 
 0xad 0xf2 0x7c 0x4d
 
 # CHECK:      sub.w   sp, sp, #1024
 # CHECK-SAME: <MCInst #{{[0-9]+}} t2SUBspImm
-# CHECK-NEXT: <MCOperand Reg:15>
-# CHECK-NEXT: <MCOperand Reg:15>
+# CHECK-NEXT: <MCOperand Reg:[[SP]]>
+# CHECK-NEXT: <MCOperand Reg:[[SP]]>
 # CHECK-NEXT: <MCOperand Imm:1024>
 # CHECK-NEXT: <MCOperand Imm:14>
 # CHECK-NEXT: <MCOperand Reg:0>
 # CHECK-NEXT: <MCOperand Reg:0>>
 
 0xad,0xf5,0x80,0x6d
 
 # CHECK:      subs.w  sp, sp, #1024
 # CHECK-SAME: <MCInst #{{[0-9]+}} t2SUBspImm
-# CHECK-NEXT: <MCOperand Reg:15>
-# CHECK-NEXT: <MCOperand Reg:15>
+# CHECK-NEXT: <MCOperand Reg:[[SP]]>
+# CHECK-NEXT: <MCOperand Reg:[[SP]]>
 # CHECK-NEXT: <MCOperand Imm:1024>
 # CHECK-NEXT: <MCOperand Imm:14>
 # CHECK-NEXT: <MCOperand Reg:0>
 # CHECK-NEXT: <MCOperand Reg:3>>
 
 0xbd,0xf5,0x80,0x6d

llvm/test/tools/llvm-readobj/ELF/ARM/unwind.s

raw:
   .unwind_raw 4, 0x81, 0x00
   .unwind_raw 4, 0x80, 0x01
   .unwind_raw 8, 0x80, 0xc0
   .unwind_raw 12, 0x84, 0xc0
   .unwind_raw 0, 0x91
   .unwind_raw 8, 0xa1
   .unwind_raw 12, 0xa9
   .unwind_raw 0, 0xb0
+  .unwind_raw 4, 0xb4
   .unwind_raw 4, 0xb1, 0x01
   .unwind_raw 0xa04, 0xb2, 0x80, 0x04
   .unwind_raw 24, 0xb3, 0x12
   .unwind_raw 24, 0xba
   .unwind_raw 24, 0xc2
   .unwind_raw 24, 0xc6, 0x02
   .unwind_raw 8, 0xc7, 0x03
   .unwind_raw 24, 0xc8, 0x02
spare:
   .unwind_raw 0, 0x80, 0x00
   .unwind_raw 4, 0x88, 0x00
   .unwind_raw 0, 0x91
   .unwind_raw 0, 0x9d
   .unwind_raw 0, 0x9f
   .unwind_raw 0, 0xa0
   .unwind_raw 0, 0xa8
   .unwind_raw 0, 0xb0
-  .unwind_raw 0, 0xb1, 0x00
   .unwind_raw 4, 0xb1, 0x01
   .unwind_raw 0, 0xb1, 0x10
   .unwind_raw 0x204, 0xb2, 0x00
   .unwind_raw 16, 0xb3, 0x00
-  .unwind_raw 0, 0xb4
   .unwind_raw 16, 0xb8
   .unwind_raw 4, 0xc0
   .unwind_raw 4, 0xc6, 0x00
   .unwind_raw 4, 0xc7, 0x00
   .unwind_raw 4, 0xc7, 0x01
   .unwind_raw 0, 0xc7, 0x10
   .unwind_raw 16, 0xc8, 0x00
   .unwind_raw 16, 0xc9, 0x00

 @ SYM:           0xC8 0x02 ; pop {d16, d17, d18}
 @ SYM:           0xC7 0x03 ; pop {wCGR0, wCGR1}
 @ SYM:           0xC6 0x02 ; pop {wR0, wR1, wR2}
 @ SYM:           0xC2      ; pop {wR10, wR11, wR12}
 @ SYM:           0xBA      ; pop {d8, d9, d10}
 @ SYM:           0xB3 0x12 ; pop {d1, d2, d3}
 @ SYM:           0xB2 0x80 0x04 ; vsp = vsp + 2564
 @ SYM:           0xB1 0x01 ; pop {r0}
+@ SYM:           0xB4      ; pop ra_auth_code
 @ SYM:           0xB0      ; finish
 @ SYM:           0xA9      ; pop {r4, r5, lr}
 @ SYM:           0xA1      ; pop {r4, r5}
 @ SYM:           0x91      ; vsp = r1
 @ SYM:           0x84 0xC0 ; pop {r10, fp, lr}
 @ SYM:           0x80 0xC0 ; pop {r10, fp}
 @ SYM:           0x80 0x01 ; pop {r4}
 @ SYM:           0x81 0x00 ; pop {ip}

 @ SYM:           0xC9 0x00 ; pop {d0}
 @ SYM:           0xC8 0x00 ; pop {d16}
 @ SYM:           0xC7 0x10 ; spare
 @ SYM:           0xC7 0x01 ; pop {wCGR0}
 @ SYM:           0xC7 0x00 ; spare
 @ SYM:           0xC6 0x00 ; pop {wR0}
 @ SYM:           0xC0      ; pop {wR10}
 @ SYM:           0xB8      ; pop {d8}
-@ SYM:           0xB4      ; spare
 @ SYM:           0xB3 0x00 ; pop {d0}
 @ SYM:           0xB2 0x00 ; vsp = vsp + 516
 @ SYM:           0xB1 0x10 ; spare
 @ SYM:           0xB1 0x01 ; pop {r0}
-@ SYM:           0xB1 0x00 ; spare
 @ SYM:           0xB0      ; finish
 @ SYM:           0xA8      ; pop {r4, lr}
 @ SYM:           0xA0      ; pop {r4}
 @ SYM:           0x9F      ; reserved (WiMMX MOVrr)
 @ SYM:           0x9D      ; reserved (ARM MOVrr)
 @ SYM:           0x91      ; vsp = r1
 @ SYM:           0x88 0x00 ; pop {pc}
 @ SYM:           0x80 0x00 ; refuse to unwind
 @ SYM:           0x40      ; vsp = vsp - 4
 @ SYM:           0x00      ; vsp = vsp + 4
 @ SYM:         ]
 @ CHECK:     ]
 @ CHECK:   }
 @ CHECK: }
 

llvm/tools/llvm-readobj/ARMEHABIPrinter.h

 //===--- ARMEHABIPrinter.h - ARM EHABI Unwind Information Printer ----------===//
 //
 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
 // See https://llvm.org/LICENSE.txt for license information.
 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
 //
 //===----------------------------------------------------------------------===//
 
inline void OpcodeDecoder::Decode_10110000(const uint8_t *Opcodes,
   uint8_t Opcode = Opcodes[OI++ ^ 3];
   SW.startLine() << format("0x%02X      ; finish\n", Opcode);
 }
 inline void OpcodeDecoder::Decode_10110001_0000iiii(const uint8_t *Opcodes,
                                                     unsigned &OI) {
   uint8_t Opcode0 = Opcodes[OI++ ^ 3];
   uint8_t Opcode1 = Opcodes[OI++ ^ 3];
 
-  SW.startLine()
-    << format("0x%02X 0x%02X ; %s", Opcode0, Opcode1,
-              ((Opcode1 & 0xf0) || Opcode1 == 0x00) ? "spare" : "pop ");
+  SW.startLine() << format(
+      "0x%02X 0x%02X ; %s", Opcode0, Opcode1,
+      (Opcode1 & 0xf0) ? "spare" : "pop ");
   if (((Opcode1 & 0xf0) == 0x00) && Opcode1)
     PrintGPR((Opcode1 & 0x0f));
   OS << '\n';
 }
 inline void OpcodeDecoder::Decode_10110010_uleb128(const uint8_t *Opcodes,
                                                    unsigned &OI) {
   uint8_t Opcode = Opcodes[OI++ ^ 3];
   SW.startLine() << format("0x%02X ", Opcode);
inline void OpcodeDecoder::Decode_10110011_sssscccc(const uint8_t *Opcodes,
   uint8_t Start = ((Opcode1 & 0xf0) >> 4);
   uint8_t Count = ((Opcode1 & 0x0f) >> 0);
   PrintRegisters((((1 << (Count + 1)) - 1) << Start), "d");
   OS << '\n';
 }
 inline void OpcodeDecoder::Decode_101101nn(const uint8_t *Opcodes,
                                            unsigned &OI) {
   uint8_t Opcode = Opcodes[OI++ ^ 3];
-  SW.startLine() << format("0x%02X      ; spare\n", Opcode);
+  SW.startLine() << format("0x%02X      ; %s\n", Opcode,
+                           (Opcode == 0xb4) ? "pop ra_auth_code" : "spare");
 }
 inline void OpcodeDecoder::Decode_10111nnn(const uint8_t *Opcodes,
                                            unsigned &OI) {
   uint8_t Opcode = Opcodes[OI++ ^ 3];
   SW.startLine() << format("0x%02X      ; pop ", Opcode);
   PrintRegisters((((1 << ((Opcode & 0x07) + 1)) - 1) << 8), "d");
   OS << '\n';
 }