[AArch64][PtrAuth] Fix unwind state for tail calls

[olista01]

Summary

When generating unwind tables for code which uses return-address
signing, we need to toggle the RA_SIGN_STATE DWARF register around any
tail-calls, because these require the return address to be authenticated
before the call, and could throw an exception. This is done using the
.cfi_negate_ra_state directive before the call, and .cfi_restore_state
at the start of the next basic block.

However, since D153098, the .cfi_restore_state isn't being inserted,
because the CFIFixup pass isn't being run. This re-enables that pass
when return-adress signing is enabled.

[ikudrin]

Thanks for working on this!

Have you considered disabling the emitting of .cfi_negate_ra_state in InsertReturnAddressAuth() for synchronous unwind tables? This might be more in line with the changes in D153098.

[olista01]

• Don't emit .cfi_negate_ra_state for synchronous unwind tables
• Convert test to update_llc_test_checks
• Test sync and async unwind tables

[ikudrin]

LGTM with a nit. Please wait a few days for possible feedback from others.

It would also be great to backport the fix to the LLVM-17 release.

llvm/test/CodeGen/AArch64/sign-return-address-cfi-negate-ra-state.ll

209–230

Do you think it would be helpful to add some CHECK-DUMP-LABEL: lines here?

[olista01]

Added full checking of the llvm-dwarfdump output.

This also revealed another future optimisation opportunity: move the
negate_ra_state forward to the same location as the other unwind opcodes, to
save one advance_loc per function.

[ikudrin]

Could you update the review to reflect changes in sign-return-address.ll after D156327?

In D156428#4554317, @olista01 wrote:

This also revealed another future optimisation opportunity: move the
negate_ra_state forward to the same location as the other unwind opcodes, to
save one advance_loc per function.

Right, thanks. Do you want to prepare a patch for this?

llvm/test/CodeGen/AArch64/sign-return-address-cfi-negate-ra-state.ll

210–217

Perhaps remove excess details to make the test more robust?

[olista01]

• Updated sign-return-address.ll after D156327
• Simplified llvm-dwarfdump checks

[olista01]

Right, thanks. Do you want to prepare a patch for this?

I've put it on my ideas list, but probably won't get to it any time soon, so if you want to do it then go ahead.

[olista01]

Ticket for backport to LLVM 17: https://github.com/llvm/llvm-project/issues/64380

llvm/lib/Target/AArch64/AArch64FrameLowering.cpp

 
 static void InsertReturnAddressAuth(MachineFunction &MF, MachineBasicBlock &MBB,
                                     bool NeedsWinCFI, bool *HasWinCFI) {
   const auto &MFI = *MF.getInfo<AArch64FunctionInfo>();
   if (!MFI.shouldSignReturnAddress(MF))
     return;
   const AArch64Subtarget &Subtarget = MF.getSubtarget<AArch64Subtarget>();
   const TargetInstrInfo *TII = Subtarget.getInstrInfo();
+  bool EmitAsyncCFI = MFI.needsAsyncDwarfUnwindInfo(MF);
 
   MachineBasicBlock::iterator MBBI = MBB.getFirstTerminator();
   DebugLoc DL;
   if (MBBI != MBB.end())
     DL = MBBI->getDebugLoc();
 
   // The AUTIASP instruction assembles to a hint instruction before v8.3a so
   // this instruction can safely used for any v8a architecture.
BuildMI(MBB, MBBI, DL,
         .copyImplicitOps(*MBBI);
     MBB.erase(MBBI);
   } else {
     BuildMI(
         MBB, MBBI, DL,
         TII->get(MFI.shouldSignWithBKey() ? AArch64::AUTIBSP : AArch64::AUTIASP))
         .setMIFlag(MachineInstr::FrameDestroy);
 
+    if (EmitAsyncCFI) {
       unsigned CFIIndex =
           MF.addFrameInst(MCCFIInstruction::createNegateRAState(nullptr));
       BuildMI(MBB, MBBI, DL, TII->get(TargetOpcode::CFI_INSTRUCTION))
           .addCFIIndex(CFIIndex)
           .setMIFlags(MachineInstr::FrameDestroy);
+    }
     if (NeedsWinCFI) {
       *HasWinCFI = true;
       BuildMI(MBB, MBBI, DL, TII->get(AArch64::SEH_PACSignLR))
           .setMIFlag(MachineInstr::FrameDestroy);
     }
   }
 }
 

llvm/test/CodeGen/AArch64/machine-outliner-retaddr-sign-regsave.mir

 # CHECK:        bb.2:
 # CHECK:            BL @[[OUTLINED_FUNCTION]]
 # CHECK:        bb.3:
 # CHECK:            BL @[[OUTLINED_FUNCTION]]
 # CHECK:        bb.4:
 # CHECK:            BL @[[OUTLINED_FUNCTION]]
 # CHECK:        bb.5:
 # CHECK:            frame-destroy AUTIBSP
-# CHECK-NEXT:       frame-destroy CFI_INSTRUCTION negate_ra_sign_state
 # CHECK-NEXT:       RET
 name:            foo
 tracksRegLiveness: true
 fixedStack:
 body:             |
   bb.0:
     $x25 = ORRXri $xzr, 1
     $lr = ORRXri $xzr, 1

llvm/test/CodeGen/AArch64/machine-outliner-retaddr-sign-thunk.ll

 ; RUN: llc -mtriple aarch64-arm-linux-gnu --enable-machine-outliner \
 ; RUN: -verify-machineinstrs %s -o - | FileCheck --check-prefixes CHECK,V8A %s
 ; RUN-V83A: llc -mtriple aarch64 -enable-machine-outliner \
 ; RUN-V83A: -verify-machineinstrs -mattr=+v8.3a %s -o - > %t
 ; RUN-V83A: FileCheck --check-prefixes CHECK,V83A < %t %s
 
 declare i32 @thunk_called_fn(i32, i32, i32, i32)
 
 define i32 @a() #0 {
 ; CHECK-LABEL:  a:                                      // @a
 ; CHECK:        // %bb.0:                               // %entry
 ; V8A-NEXT:         hint #25
 ; V83A-NEXT:        paciasp
 ; CHECK-NEXT:       .cfi_negate_ra_state
 ; V8A:              hint #29
 ; V83A:             autiasp
-; CHECK-NEXT:       .cfi_negate_ra_state
 ; CHECK-NEXT:       ret
 entry:
   %call = tail call i32 @thunk_called_fn(i32 1, i32 2, i32 3, i32 4)
   %cx = add i32 %call, 8
   ret i32 %cx
 }
 
 define i32 @b() #0 {
 ; CHECK-LABEL:  b:                                      // @b
 ; CHECK:        // %bb.0:                               // %entry
 ; V8A-NEXT:         hint #25
 ; V83A-NEXT:        paciasp
 ; CHECK-NEXT:       .cfi_negate_ra_state
 ; V8A:              hint #29
 ; V83A:             autiasp
-; CHECK-NEXT:       .cfi_negate_ra_state
 ; CHECK-NEXT:       ret
 entry:
   %call = tail call i32 @thunk_called_fn(i32 1, i32 2, i32 3, i32 4)
   %cx = add i32 %call, 88
   ret i32 %cx
 }
 
 define hidden i32 @c(ptr %fptr) #0 {
 ; CHECK-LABEL:  c:                                      // @c
 ; CHECK:        // %bb.0:                               // %entry
 ; V8A-NEXT:         hint #25
 ; V83A-NEXT:        paciasp
 ; CHECK-NEXT:       .cfi_negate_ra_state
 ; V8A:              hint #29
 ; V83A:             autiasp
-; CHECK-NEXT:       .cfi_negate_ra_state
 ; CHECK-NEXT:       ret
 entry:
   %call = tail call i32 %fptr(i32 1, i32 2, i32 3, i32 4)
   %add = add nsw i32 %call, 8
   ret i32 %add
 }
 
 define hidden i32 @d(ptr %fptr) #0 {
 ; CHECK-LABEL:  d:                                      // @d
 ; CHECK:        // %bb.0:                               // %entry
 ; V8A-NEXT:         hint #25
 ; V83A-NEXT:        paciasp
 ; CHECK-NEXT:       .cfi_negate_ra_state
 ; V8A:              hint #29
 ; V83A:             autiasp
-; CHECK-NEXT:       .cfi_negate_ra_state
 ; CHECK-NEXT:       ret
 entry:
   %call = tail call i32 %fptr(i32 1, i32 2, i32 3, i32 4)
   %add = add nsw i32 %call, 88
   ret i32 %add
 }
 
 attributes #0 = { "sign-return-address"="non-leaf" minsize }
 
 ; CHECK-NOT:        OUTLINED_FUNCTION_{{.*}}
 ; CHECK-NOT:         .cfi_b_key_frame
 ; CHECK-NOT:         paci{{[a,b]}}sp
 ; CHECK-NOT:         hint #2{{[5,7]}}
 ; CHECK-NOT:         .cfi_negate_ra_state
 ; CHECK-NOT:         auti{{[a,b]}}sp
 ; CHECK-NOT:         hint #{{[29,31]}}

llvm/test/CodeGen/AArch64/sign-return-address-cfi-negate-ra-state.ll

-; RUN: llc -mtriple=aarch64 < %s | FileCheck --check-prefixes CHECK,CHECK-V8A %s
-; RUN: llc -mtriple=aarch64 -mattr=v8.3a < %s | FileCheck --check-prefixes CHECK,CHECK-V83A %s
+; NOTE: Assertions have been autogenerated by utils/update_llc_test_checks.py UTC_ARGS: --version 2
+; RUN: llc -mtriple=aarch64 < %s | FileCheck --check-prefixes CHECK-V8A %s
+; RUN: llc -mtriple=aarch64 -mattr=v8.3a < %s | FileCheck --check-prefixes CHECK-V83A %s
 ; RUN: llc -mtriple=aarch64 -filetype=obj -o - <%s | llvm-dwarfdump -v - | FileCheck --check-prefix=CHECK-DUMP %s
 
 @.str = private unnamed_addr constant [15 x i8] c"some exception\00", align 1
 @_ZTIPKc = external dso_local constant ptr
 
-; CHECK: @_Z3fooi
-; CHECK-V8A: hint #25
-; CHECK-V83A: paciasp
-; CHECK-NEXT: .cfi_negate_ra_state
-; CHECK-NOT: .cfi_negate_ra_state
 define dso_local i32 @_Z3fooi(i32 %x) #0 {
+; CHECK-V8A-LABEL: _Z3fooi:
+; CHECK-V8A:       // %bb.0: // %entry
+; CHECK-V8A-NEXT:    hint #25
+; CHECK-V8A-NEXT:    .cfi_negate_ra_state
+; CHECK-V8A-NEXT:    str x30, [sp, #-16]! // 8-byte Folded Spill
+; CHECK-V8A-NEXT:    .cfi_def_cfa_offset 16
+; CHECK-V8A-NEXT:    .cfi_offset w30, -16
+; CHECK-V8A-NEXT:    str w0, [sp, #8]
+; CHECK-V8A-NEXT:    mov w0, #8 // =0x8
+; CHECK-V8A-NEXT:    bl __cxa_allocate_exception
+; CHECK-V8A-NEXT:    adrp x8, .L.str
+; CHECK-V8A-NEXT:    add x8, x8, :lo12:.L.str
+; CHECK-V8A-NEXT:    adrp x1, _ZTIPKc
+; CHECK-V8A-NEXT:    add x1, x1, :lo12:_ZTIPKc
+; CHECK-V8A-NEXT:    mov x2, xzr
+; CHECK-V8A-NEXT:    str x8, [x0]
+; CHECK-V8A-NEXT:    bl __cxa_throw
+;
+; CHECK-V83A-LABEL: _Z3fooi:
+; CHECK-V83A:       // %bb.0: // %entry
+; CHECK-V83A-NEXT:    paciasp
+; CHECK-V83A-NEXT:    .cfi_negate_ra_state
+; CHECK-V83A-NEXT:    str x30, [sp, #-16]! // 8-byte Folded Spill
+; CHECK-V83A-NEXT:    .cfi_def_cfa_offset 16
+; CHECK-V83A-NEXT:    .cfi_offset w30, -16
+; CHECK-V83A-NEXT:    str w0, [sp, #8]
+; CHECK-V83A-NEXT:    mov w0, #8 // =0x8
+; CHECK-V83A-NEXT:    bl __cxa_allocate_exception
+; CHECK-V83A-NEXT:    adrp x8, .L.str
+; CHECK-V83A-NEXT:    add x8, x8, :lo12:.L.str
+; CHECK-V83A-NEXT:    adrp x1, _ZTIPKc
+; CHECK-V83A-NEXT:    add x1, x1, :lo12:_ZTIPKc
+; CHECK-V83A-NEXT:    mov x2, xzr
+; CHECK-V83A-NEXT:    str x8, [x0]
+; CHECK-V83A-NEXT:    bl __cxa_throw
 entry:
   %retval = alloca i32, align 4
   %x.addr = alloca i32, align 4
   store i32 %x, ptr %x.addr, align 4
   %exception = call ptr @__cxa_allocate_exception(i64 8) #1
   store ptr @.str, ptr %exception, align 16
   call void @__cxa_throw(ptr %exception, ptr @_ZTIPKc, ptr null) #2
   unreachable
 
 return:                                           ; No predecessors!
   %0 = load i32, ptr %retval, align 4
   ret i32 %0
 }
 
+; For asynchronous unwind tables, we need to flip the value of RA_SIGN_STATE
+; before and after the tail call.
+define hidden noundef i32 @baz_async(i32 noundef %a) #0 uwtable(async) {
+; CHECK-V8A-LABEL: baz_async:
+; CHECK-V8A:       // %bb.0: // %entry
+; CHECK-V8A-NEXT:    hint #25
+; CHECK-V8A-NEXT:    .cfi_negate_ra_state
+; CHECK-V8A-NEXT:    str x30, [sp, #-16]! // 8-byte Folded Spill
+; CHECK-V8A-NEXT:    .cfi_def_cfa_offset 16
+; CHECK-V8A-NEXT:    .cfi_offset w30, -16
+; CHECK-V8A-NEXT:    .cfi_remember_state
+; CHECK-V8A-NEXT:    cbz w0, .LBB1_2
+; CHECK-V8A-NEXT:  // %bb.1: // %if.then
+; CHECK-V8A-NEXT:    mov w0, wzr
+; CHECK-V8A-NEXT:    bl _Z3bari
+; CHECK-V8A-NEXT:    ldr x30, [sp], #16 // 8-byte Folded Reload
+; CHECK-V8A-NEXT:    .cfi_def_cfa_offset 0
+; CHECK-V8A-NEXT:    hint #29
+; CHECK-V8A-NEXT:    .cfi_negate_ra_state
+; CHECK-V8A-NEXT:    .cfi_restore w30
+; CHECK-V8A-NEXT:    b _Z3bari
+; CHECK-V8A-NEXT:  .LBB1_2: // %if.else
+; CHECK-V8A-NEXT:    .cfi_restore_state
+; CHECK-V8A-NEXT:    bl _Z4quuxi
+; CHECK-V8A-NEXT:    add w0, w0, #1
+; CHECK-V8A-NEXT:    ldr x30, [sp], #16 // 8-byte Folded Reload
+; CHECK-V8A-NEXT:    .cfi_def_cfa_offset 0
+; CHECK-V8A-NEXT:    hint #29
+; CHECK-V8A-NEXT:    .cfi_negate_ra_state
+; CHECK-V8A-NEXT:    .cfi_restore w30
+; CHECK-V8A-NEXT:    ret
+;
+; CHECK-V83A-LABEL: baz_async:
+; CHECK-V83A:       // %bb.0: // %entry
+; CHECK-V83A-NEXT:    paciasp
+; CHECK-V83A-NEXT:    .cfi_negate_ra_state
+; CHECK-V83A-NEXT:    str x30, [sp, #-16]! // 8-byte Folded Spill
+; CHECK-V83A-NEXT:    .cfi_def_cfa_offset 16
+; CHECK-V83A-NEXT:    .cfi_offset w30, -16
+; CHECK-V83A-NEXT:    .cfi_remember_state
+; CHECK-V83A-NEXT:    cbz w0, .LBB1_2
+; CHECK-V83A-NEXT:  // %bb.1: // %if.then
+; CHECK-V83A-NEXT:    mov w0, wzr
+; CHECK-V83A-NEXT:    bl _Z3bari
+; CHECK-V83A-NEXT:    ldr x30, [sp], #16 // 8-byte Folded Reload
+; CHECK-V83A-NEXT:    .cfi_def_cfa_offset 0
+; CHECK-V83A-NEXT:    autiasp
+; CHECK-V83A-NEXT:    .cfi_negate_ra_state
+; CHECK-V83A-NEXT:    .cfi_restore w30
+; CHECK-V83A-NEXT:    b _Z3bari
+; CHECK-V83A-NEXT:  .LBB1_2: // %if.else
+; CHECK-V83A-NEXT:    .cfi_restore_state
+; CHECK-V83A-NEXT:    bl _Z4quuxi
+; CHECK-V83A-NEXT:    add w0, w0, #1
+; CHECK-V83A-NEXT:    ldr x30, [sp], #16 // 8-byte Folded Reload
+; CHECK-V83A-NEXT:    .cfi_def_cfa_offset 0
+; CHECK-V83A-NEXT:    .cfi_restore w30
+; CHECK-V83A-NEXT:    retaa
+entry:
+  %tobool.not = icmp eq i32 %a, 0
+  br i1 %tobool.not, label %if.else, label %if.then
+
+if.then:                                          ; preds = %entry
+  %call = tail call noundef i32 @_Z3bari(i32 noundef 0)
+  %call1 = tail call noundef i32 @_Z3bari(i32 noundef %call)
+  br label %return
+
+if.else:                                          ; preds = %entry
+  %call2 = tail call noundef i32 @_Z4quuxi(i32 noundef 0)
+  %add = add nsw i32 %call2, 1
+  br label %return
+
+return:                                           ; preds = %if.else, %if.then
+  %retval.0 = phi i32 [ %call1, %if.then ], [ %add, %if.else ]
+  ret i32 %retval.0
+}
+
+; For synchronous unwind tables, we don't need to update the unwind tables
+; around the tail call. The tail-called function might throw an exception, but
+; at this point we are set up to return into baz's caller, so the unwinder will
+; never see baz's unwind table for that exception.
+define hidden noundef i32 @baz_sync(i32 noundef %a) #0 uwtable(sync) {
+; CHECK-V8A-LABEL: baz_sync:
+; CHECK-V8A:       // %bb.0: // %entry
+; CHECK-V8A-NEXT:    hint #25
+; CHECK-V8A-NEXT:    .cfi_negate_ra_state
+; CHECK-V8A-NEXT:    str x30, [sp, #-16]! // 8-byte Folded Spill
+; CHECK-V8A-NEXT:    .cfi_def_cfa_offset 16
+; CHECK-V8A-NEXT:    .cfi_offset w30, -16
+; CHECK-V8A-NEXT:    cbz w0, .LBB2_2
+; CHECK-V8A-NEXT:  // %bb.1: // %if.then
+; CHECK-V8A-NEXT:    mov w0, wzr
+; CHECK-V8A-NEXT:    bl _Z3bari
+; CHECK-V8A-NEXT:    ldr x30, [sp], #16 // 8-byte Folded Reload
+; CHECK-V8A-NEXT:    hint #29
+; CHECK-V8A-NEXT:    b _Z3bari
+; CHECK-V8A-NEXT:  .LBB2_2: // %if.else
+; CHECK-V8A-NEXT:    bl _Z4quuxi
+; CHECK-V8A-NEXT:    add w0, w0, #1
+; CHECK-V8A-NEXT:    ldr x30, [sp], #16 // 8-byte Folded Reload
+; CHECK-V8A-NEXT:    hint #29
+; CHECK-V8A-NEXT:    ret
+;
+; CHECK-V83A-LABEL: baz_sync:
+; CHECK-V83A:       // %bb.0: // %entry
+; CHECK-V83A-NEXT:    paciasp
+; CHECK-V83A-NEXT:    .cfi_negate_ra_state
+; CHECK-V83A-NEXT:    str x30, [sp, #-16]! // 8-byte Folded Spill
+; CHECK-V83A-NEXT:    .cfi_def_cfa_offset 16
+; CHECK-V83A-NEXT:    .cfi_offset w30, -16
+; CHECK-V83A-NEXT:    cbz w0, .LBB2_2
+; CHECK-V83A-NEXT:  // %bb.1: // %if.then
+; CHECK-V83A-NEXT:    mov w0, wzr
+; CHECK-V83A-NEXT:    bl _Z3bari
+; CHECK-V83A-NEXT:    ldr x30, [sp], #16 // 8-byte Folded Reload
+; CHECK-V83A-NEXT:    autiasp
+; CHECK-V83A-NEXT:    b _Z3bari
+; CHECK-V83A-NEXT:  .LBB2_2: // %if.else
+; CHECK-V83A-NEXT:    bl _Z4quuxi
+; CHECK-V83A-NEXT:    add w0, w0, #1
+; CHECK-V83A-NEXT:    ldr x30, [sp], #16 // 8-byte Folded Reload
+; CHECK-V83A-NEXT:    retaa
+entry:
+  %tobool.not = icmp eq i32 %a, 0
+  br i1 %tobool.not, label %if.else, label %if.then
+
+if.then:                                          ; preds = %entry
+  %call = tail call noundef i32 @_Z3bari(i32 noundef 0)
+  %call1 = tail call noundef i32 @_Z3bari(i32 noundef %call)
+  br label %return
+
+if.else:                                          ; preds = %entry
+  %call2 = tail call noundef i32 @_Z4quuxi(i32 noundef 0)
+  %add = add nsw i32 %call2, 1
+  br label %return
+
+return:                                           ; preds = %if.else, %if.then
+  %retval.0 = phi i32 [ %call1, %if.then ], [ %add, %if.else ]
+  ret i32 %retval.0
+}
+
 declare dso_local ptr @__cxa_allocate_exception(i64)
 
 declare dso_local void @__cxa_throw(ptr, ptr, ptr)
 
+declare dso_local noundef i32 @_Z3bari(i32 noundef) local_unnamed_addr
+declare dso_local noundef i32 @_Z4quuxi(i32 noundef) local_unnamed_addr
+
 attributes #0 = { "sign-return-address"="all" }
 
-;CHECK-DUMP: DW_CFA_AARCH64_negate_ra_state
+; foo
+; CHECK-DUMP-LABEL: FDE
+; CHECK-DUMP:   DW_CFA_AARCH64_negate_ra_state:
+; CHECK-DUMP-NOT: DW_CFA_AARCH64_negate_ra_state
+; CHECK-DUMP-NOT: DW_CFA_remember_state
+; CHECK-DUMP-NOT: DW_CFA_restore_state
+
+; baz_async
+; CHECK-DUMP-LABEL: FDE
+; CHECK-DUMP: Format:       DWARF32
+; CHECK-DUMP:   DW_CFA_AARCH64_negate_ra_state:
+; CHECK-DUMP:   DW_CFA_remember_state:
+; CHECK-DUMP:   DW_CFA_AARCH64_negate_ra_state:
+; CHECK-DUMP:   DW_CFA_restore_state:
+; CHECK-DUMP:   DW_CFA_AARCH64_negate_ra_state:
+
+; baz_sync
+; CHECK-DUMP-LABEL: FDE
+; CHECK-DUMP:   DW_CFA_AARCH64_negate_ra_state:
+; CHECK-DUMP-NOT: DW_CFA_AARCH64_negate_ra_state
+; CHECK-DUMP-NOT: DW_CFA_remember_state
+; CHECK-DUMP-NOT: DW_CFA_restore_state

llvm/test/CodeGen/AArch64/sign-return-address.ll

 }
 
 define i32 @leaf_sign_all(i32 %x) "sign-return-address"="all" {
 ; COMPAT-LABEL: leaf_sign_all:
 ; COMPAT:       // %bb.0:
 ; COMPAT-NEXT:    hint #25
 ; COMPAT-NEXT:    .cfi_negate_ra_state
 ; COMPAT-NEXT:    hint #29
-; COMPAT-NEXT:    .cfi_negate_ra_state
 ; COMPAT-NEXT:    ret
 ;
 ; V83A-LABEL: leaf_sign_all:
 ; V83A:       // %bb.0:
 ; V83A-NEXT:    paciasp
 ; V83A-NEXT:    .cfi_negate_ra_state
 ; V83A-NEXT:    retaa
   ret i32 %x
 }
 
 define i64 @leaf_clobbers_lr(i64 %x) "sign-return-address"="non-leaf"  {
 ; COMPAT-LABEL: leaf_clobbers_lr:
 ; COMPAT:       // %bb.0:
 ; COMPAT-NEXT:    hint #25
 ; COMPAT-NEXT:    .cfi_negate_ra_state
 ; COMPAT-NEXT:    str x30, [sp, #-16]! // 8-byte Folded Spill
 ; COMPAT-NEXT:    .cfi_def_cfa_offset 16
 ; COMPAT-NEXT:    .cfi_offset w30, -16
 ; COMPAT-NEXT:    //APP
 ; COMPAT-NEXT:    mov x30, x0
 ; COMPAT-NEXT:    //NO_APP
 ; COMPAT-NEXT:    ldr x30, [sp], #16 // 8-byte Folded Reload
 ; COMPAT-NEXT:    hint #29
-; COMPAT-NEXT:    .cfi_negate_ra_state
 ; COMPAT-NEXT:    ret
 ;
 ; V83A-LABEL: leaf_clobbers_lr:
 ; V83A:       // %bb.0:
 ; V83A-NEXT:    paciasp
 ; V83A-NEXT:    .cfi_negate_ra_state
 ; V83A-NEXT:    str x30, [sp, #-16]! // 8-byte Folded Spill
 ; V83A-NEXT:    .cfi_def_cfa_offset 16

 ; COMPAT-NEXT:    hint #25
 ; COMPAT-NEXT:    .cfi_negate_ra_state
 ; COMPAT-NEXT:    str x30, [sp, #-16]! // 8-byte Folded Spill
 ; COMPAT-NEXT:    .cfi_def_cfa_offset 16
 ; COMPAT-NEXT:    .cfi_offset w30, -16
 ; COMPAT-NEXT:    bl foo
 ; COMPAT-NEXT:    ldr x30, [sp], #16 // 8-byte Folded Reload
 ; COMPAT-NEXT:    hint #29
-; COMPAT-NEXT:    .cfi_negate_ra_state
 ; COMPAT-NEXT:    ret
 ;
 ; V83A-LABEL: non_leaf_sign_all:
 ; V83A:       // %bb.0:
 ; V83A-NEXT:    paciasp
 ; V83A-NEXT:    .cfi_negate_ra_state
 ; V83A-NEXT:    str x30, [sp, #-16]! // 8-byte Folded Spill
 ; V83A-NEXT:    .cfi_def_cfa_offset 16

 ; COMPAT-NEXT:    hint #25
 ; COMPAT-NEXT:    .cfi_negate_ra_state
 ; COMPAT-NEXT:    str x30, [sp, #-16]! // 8-byte Folded Spill
 ; COMPAT-NEXT:    .cfi_def_cfa_offset 16
 ; COMPAT-NEXT:    .cfi_offset w30, -16
 ; COMPAT-NEXT:    bl foo
 ; COMPAT-NEXT:    ldr x30, [sp], #16 // 8-byte Folded Reload
 ; COMPAT-NEXT:    hint #29
-; COMPAT-NEXT:    .cfi_negate_ra_state
 ; COMPAT-NEXT:    ret
 ;
 ; V83A-LABEL: non_leaf_sign_non_leaf:
 ; V83A:       // %bb.0:
 ; V83A-NEXT:    paciasp
 ; V83A-NEXT:    .cfi_negate_ra_state
 ; V83A-NEXT:    str x30, [sp, #-16]! // 8-byte Folded Spill
 ; V83A-NEXT:    .cfi_def_cfa_offset 16

 ; CHECK-NEXT:    paciasp
 ; CHECK-NEXT:    .cfi_negate_ra_state
 ; CHECK-NEXT:    str x30, [sp, #-16]! // 8-byte Folded Spill
 ; CHECK-NEXT:    .cfi_def_cfa_offset 16
 ; CHECK-NEXT:    .cfi_offset w30, -16
 ; CHECK-NEXT:    bl foo
 ; CHECK-NEXT:    ldr x30, [sp], #16 // 8-byte Folded Reload
 ; CHECK-NEXT:    autiasp
-; CHECK-NEXT:    .cfi_negate_ra_state
 ; CHECK-NEXT:    ldr x30, [x18, #-8]!
 ; CHECK-NEXT:    ret
   %call = call i32 @foo(i32 %x)
   ret i32 %call
 }
 
 define i32 @leaf_sign_all_v83(i32 %x) "sign-return-address"="all" "target-features"="+v8.3a" {
 ; CHECK-LABEL: leaf_sign_all_v83:

 ; COMPAT-NEXT:    str x30, [sp, #-16]! // 8-byte Folded Spill
 ; COMPAT-NEXT:    .cfi_def_cfa_offset 16
 ; COMPAT-NEXT:    .cfi_offset w30, -16
 ; COMPAT-NEXT:    //APP
 ; COMPAT-NEXT:    mov x30, x0
 ; COMPAT-NEXT:    //NO_APP
 ; COMPAT-NEXT:    ldr x30, [sp], #16 // 8-byte Folded Reload
 ; COMPAT-NEXT:    hint #29
-; COMPAT-NEXT:    .cfi_negate_ra_state
 ; COMPAT-NEXT:    b bar
 ;
 ; V83A-LABEL: spill_lr_and_tail_call:
 ; V83A:       // %bb.0:
 ; V83A-NEXT:    paciasp
 ; V83A-NEXT:    .cfi_negate_ra_state
 ; V83A-NEXT:    str x30, [sp, #-16]! // 8-byte Folded Spill
 ; V83A-NEXT:    .cfi_def_cfa_offset 16
 ; V83A-NEXT:    .cfi_offset w30, -16
 ; V83A-NEXT:    //APP
 ; V83A-NEXT:    mov x30, x0
 ; V83A-NEXT:    //NO_APP
 ; V83A-NEXT:    ldr x30, [sp], #16 // 8-byte Folded Reload
 ; V83A-NEXT:    autiasp
-; V83A-NEXT:    .cfi_negate_ra_state
 ; V83A-NEXT:    b bar
   call void asm sideeffect "mov x30, $0", "r,~{lr}"(i64 %x) #1
   tail call fastcc i64 @bar(i64 %x)
   ret void
 }
 
 define i32 @leaf_sign_all_a_key(i32 %x) "sign-return-address"="all" "sign-return-address-key"="a_key" {
 ; COMPAT-LABEL: leaf_sign_all_a_key:
 ; COMPAT:       // %bb.0:
 ; COMPAT-NEXT:    hint #25
 ; COMPAT-NEXT:    .cfi_negate_ra_state
 ; COMPAT-NEXT:    hint #29
-; COMPAT-NEXT:    .cfi_negate_ra_state
 ; COMPAT-NEXT:    ret
 ;
 ; V83A-LABEL: leaf_sign_all_a_key:
 ; V83A:       // %bb.0:
 ; V83A-NEXT:    paciasp
 ; V83A-NEXT:    .cfi_negate_ra_state
 ; V83A-NEXT:    retaa
   ret i32 %x
 }
 
 define i32 @leaf_sign_all_b_key(i32 %x) "sign-return-address"="all" "sign-return-address-key"="b_key" {
 ; COMPAT-LABEL: leaf_sign_all_b_key:
 ; COMPAT:       // %bb.0:
 ; COMPAT-NEXT:    .cfi_b_key_frame
 ; COMPAT-NEXT:    hint #27
 ; COMPAT-NEXT:    .cfi_negate_ra_state
 ; COMPAT-NEXT:    hint #31
-; COMPAT-NEXT:    .cfi_negate_ra_state
 ; COMPAT-NEXT:    ret
 ;
 ; V83A-LABEL: leaf_sign_all_b_key:
 ; V83A:       // %bb.0:
 ; V83A-NEXT:    .cfi_b_key_frame
 ; V83A-NEXT:    pacibsp
 ; V83A-NEXT:    .cfi_negate_ra_state
 ; V83A-NEXT:    retab

 
 ; Note that BTI instruction is not needed before PACIASP.
 define i32 @leaf_sign_all_a_key_bti(i32 %x) "sign-return-address"="all" "sign-return-address-key"="a_key" "branch-target-enforcement"="true"{
 ; COMPAT-LABEL: leaf_sign_all_a_key_bti:
 ; COMPAT:       // %bb.0:
 ; COMPAT-NEXT:    hint #25
 ; COMPAT-NEXT:    .cfi_negate_ra_state
 ; COMPAT-NEXT:    hint #29
-; COMPAT-NEXT:    .cfi_negate_ra_state
 ; COMPAT-NEXT:    ret
 ;
 ; V83A-LABEL: leaf_sign_all_a_key_bti:
 ; V83A:       // %bb.0:
 ; V83A-NEXT:    paciasp
 ; V83A-NEXT:    .cfi_negate_ra_state
 ; V83A-NEXT:    retaa
   ret i32 %x
 }
 
 ; Note that BTI instruction is not needed before PACIBSP.
 define i32 @leaf_sign_all_b_key_bti(i32 %x) "sign-return-address"="all" "sign-return-address-key"="b_key" "branch-target-enforcement"="true"{
 ; COMPAT-LABEL: leaf_sign_all_b_key_bti:
 ; COMPAT:       // %bb.0:
 ; COMPAT-NEXT:    .cfi_b_key_frame
 ; COMPAT-NEXT:    hint #27
 ; COMPAT-NEXT:    .cfi_negate_ra_state
 ; COMPAT-NEXT:    hint #31
-; COMPAT-NEXT:    .cfi_negate_ra_state
 ; COMPAT-NEXT:    ret
 ;
 ; V83A-LABEL: leaf_sign_all_b_key_bti:
 ; V83A:       // %bb.0:
 ; V83A-NEXT:    .cfi_b_key_frame
 ; V83A-NEXT:    pacibsp
 ; V83A-NEXT:    .cfi_negate_ra_state
 ; V83A-NEXT:    retab