[AArch64] Move PAuth codegen down the machine pipeline

[atrosinenko]

Summary

To simplify handling PAuth in the machine outliner, introduce a
separate AArch64PointerAuth pass that is executed after both
Prologue/Epilogue Inserter and Machine Outliner passes.

After moving to AArch64PointerAuth, signLR and authenticateLR are
not used outside of their class anymore, so make them private and
simplify accordingly.

The new pass is added via AArch64PassConfig::addPostBBSections(),
so that it can change the code size before branch relaxation occurs.
AArch64BranchTargets is placed there too, so it can take into account
any PACI(A|B)SP instructions and not excessively add BTIs at the start
of functions.

[pratlucas]

llvm/lib/Target/AArch64/AArch64FrameLowering.cpp

1421–1426

Why do we need these to be added as pseudo-instructions during frame lowering? Is there any chance the criteria for making the decision is lost before the new pass is executed?

llvm/lib/Target/AArch64/AArch64PointerAuth.cpp

33–42

I feel those member variables could be removed to make the class less stateful.
A single instantiation of this pass will be used over multiple machine functions and most of those members are specific to each of the functions. Removing them would also allow the private methods below to be made freestanding static functions instead.

[vhscampos]

I don't understand the motivation here. This moves PAuth's instruction insertion later down the pipeline, but why? The handling in the machine outliner isn't made any simpler IMO.

[tmatheson]

llvm/lib/Target/AArch64/AArch64PointerAuth.cpp

157

Looks like HasWinCFI is not used for anything but the asserts below, it could be removed. It has always been a confusing part of this code.

[atrosinenko]

llvm/lib/Target/AArch64/AArch64FrameLowering.cpp

1421–1426

One reason is that the insertion points computed by the shrink-wrapping pass are actually lost after PEI. Though, inserting PAC on entry and AUT before every return may be considered both as a bug (from the performance point of view) or as a feature (from the security point of view as it makes things easier to observe).

Another reason (mostly for the PAUTH_EPILOGUE instruction) is that the naive approach would wrap the Shadow Call Stack code inside PAuth one, but now it is explicitly checked in tests that the LR value is actually restored by SCS if both are enabled. I wonder if it is meaningful at all to sign and authenticate LR when SCS is enabled for the particular function, though.

[atrosinenko]

In D159357#4638040, @vhscampos wrote:

I don't understand the motivation here. This moves PAuth's instruction insertion later down the pipeline, but why? The handling in the machine outliner isn't made any simpler IMO.

The original motivation was to implement checking the LR value in tail calls (D156716) at some point after both PEI and machine outliner - the outliner doesn't seem to handle checker code well now. It seems that inserting PAuth-related hardening code is generally "the later the better" (IIRC, in the Ahmed's branch it was done even later, at the AsmPrinter phase), so I moved the existing code down the pipeline to handle everything PAuth-related at a single place.

[atrosinenko]

Addressed the review comments, rebased.

[atrosinenko]

llvm/lib/Target/AArch64/AArch64PointerAuth.cpp

33–42

Not sure if it is necessary to expose signLR and authenticateLR as public static methods right now, so kept Subtarget and TII fields (this seems to be done by some other passes as well). Dropped other "cached" fields. Though, I don't mind making signLR and authenticateLR methods static if needed.

157

Agree, dropped the assertions.

Here are some relevant patches that I found when investigating how WinCFI is handled:

• D61960 (correctness) computes the actual presence of WinCFI directives
• D88641 (binary size) optimizes emitEpilogue to not emit WinCFI directives if prologue doesn't have any.

llvm/lib/Target/AArch64/AArch64.h

 ModulePass *createAArch64LowerHomogeneousPrologEpilogPass();
 FunctionPass *createAArch64SIMDInstrOptPass();
 ModulePass *createAArch64PromoteConstantPass();
 FunctionPass *createAArch64ConditionOptimizerPass();
 FunctionPass *createAArch64A57FPLoadBalancing();
 FunctionPass *createAArch64A53Fix835769();
 FunctionPass *createFalkorHWPFFixPass();
 FunctionPass *createFalkorMarkStridedAccessesPass();
+FunctionPass *createAArch64PointerAuthPass();
 FunctionPass *createAArch64BranchTargetsPass();
 FunctionPass *createAArch64MIPeepholeOptPass();
 
 FunctionPass *createAArch64CleanupLocalDynamicTLSPass();
 
 FunctionPass *createAArch64CollectLOHPass();
 FunctionPass *createSMEABIPass();
 ModulePass *createSVEIntrinsicOptsPass();
 InstructionSelector *
 createAArch64InstructionSelector(const AArch64TargetMachine &,
                                  AArch64Subtarget &, AArch64RegisterBankInfo &);
 FunctionPass *createAArch64O0PreLegalizerCombiner();
 FunctionPass *createAArch64PreLegalizerCombiner();
 FunctionPass *createAArch64PostLegalizerCombiner(bool IsOptNone);
 FunctionPass *createAArch64PostLegalizerLowering();
 FunctionPass *createAArch64PostSelectOptimize();
 FunctionPass *createAArch64StackTaggingPass(bool IsOptNone);
 FunctionPass *createAArch64StackTaggingPreRAPass();
 ModulePass *createAArch64GlobalsTaggingPass();
 
 void initializeAArch64A53Fix835769Pass(PassRegistry&);
 void initializeAArch64A57FPLoadBalancingPass(PassRegistry&);
 void initializeAArch64AdvSIMDScalarPass(PassRegistry&);
+void initializeAArch64PointerAuthPass(PassRegistry&);
 void initializeAArch64BranchTargetsPass(PassRegistry&);
 void initializeAArch64CFIFixupPass(PassRegistry&);
 void initializeAArch64CollectLOHPass(PassRegistry &);
 void initializeAArch64CompressJumpTablesPass(PassRegistry&);
 void initializeAArch64CondBrTuningPass(PassRegistry &);
 void initializeAArch64ConditionOptimizerPass(PassRegistry&);
 void initializeAArch64ConditionalComparesPass(PassRegistry &);
 void initializeAArch64DAGToDAGISelPass(PassRegistry &);

llvm/lib/Target/AArch64/AArch64FrameLowering.h

explicit AArch64FrameLowering()
                             true /*StackRealignable*/) {}
 
   void resetCFIToInitialState(MachineBasicBlock &MBB) const override;
 
   MachineBasicBlock::iterator
   eliminateCallFramePseudoInstr(MachineFunction &MF, MachineBasicBlock &MBB,
                                 MachineBasicBlock::iterator I) const override;
 
-  static void signLR(MachineFunction &MF, MachineBasicBlock &MBB,
-                     MachineBasicBlock::iterator MBBI, bool NeedsWinCFI,
-                     bool *HasWinCFI);
-
-  static void authenticateLR(MachineFunction &MF, MachineBasicBlock &MBB,
-                             bool NeedsWinCFI, bool *HasWinCFI);
-
   /// emitProlog/emitEpilog - These methods insert prolog and epilog code into
   /// the function.
   void emitPrologue(MachineFunction &MF, MachineBasicBlock &MBB) const override;
   void emitEpilogue(MachineFunction &MF, MachineBasicBlock &MBB) const override;
 
   bool enableCFIFixup(MachineFunction &MF) const override;
 
   bool canUseAsPrologue(const MachineBasicBlock &MBB) const override;

llvm/lib/Target/AArch64/AArch64FrameLowering.cpp

static void emitDefineCFAWithFP(MachineFunction &MF, MachineBasicBlock &MBB,
   unsigned Reg = TRI->getDwarfRegNum(FramePtr, true);
   unsigned CFIIndex = MF.addFrameInst(MCCFIInstruction::cfiDefCfa(
       nullptr, Reg, FixedObject - OffsetToFirstCalleeSaveFromFP));
   BuildMI(MBB, MBBI, DL, TII->get(TargetOpcode::CFI_INSTRUCTION))
       .addCFIIndex(CFIIndex)
       .setMIFlags(MachineInstr::FrameSetup);
 }
 
-void AArch64FrameLowering::signLR(MachineFunction &MF, MachineBasicBlock &MBB,
-                                  MachineBasicBlock::iterator MBBI,
-                                  bool NeedsWinCFI, bool *HasWinCFI) {
-  const auto &MFnI = *MF.getInfo<AArch64FunctionInfo>();
-  const AArch64Subtarget &Subtarget = MF.getSubtarget<AArch64Subtarget>();
-  const TargetInstrInfo *TII = Subtarget.getInstrInfo();
-  bool EmitCFI = MFnI.needsDwarfUnwindInfo(MF);
-
-  // Debug location must be unknown, see emitPrologue().
-  DebugLoc DL;
-
-  if (MFnI.shouldSignWithBKey()) {
-    BuildMI(MBB, MBBI, DL, TII->get(AArch64::EMITBKEY))
-        .setMIFlag(MachineInstr::FrameSetup);
-  }
-
-  // No SEH opcode for this one; it doesn't materialize into an
-  // instruction on Windows.
-  BuildMI(
-      MBB, MBBI, DL,
-      TII->get(MFnI.shouldSignWithBKey() ? AArch64::PACIBSP : AArch64::PACIASP))
-      .setMIFlag(MachineInstr::FrameSetup);
-
-  if (EmitCFI) {
-    unsigned CFIIndex =
-        MF.addFrameInst(MCCFIInstruction::createNegateRAState(nullptr));
-    BuildMI(MBB, MBBI, DL, TII->get(TargetOpcode::CFI_INSTRUCTION))
-        .addCFIIndex(CFIIndex)
-        .setMIFlags(MachineInstr::FrameSetup);
-  } else if (NeedsWinCFI) {
-    *HasWinCFI = true;
-    BuildMI(MBB, MBBI, DL, TII->get(AArch64::SEH_PACSignLR))
-        .setMIFlag(MachineInstr::FrameSetup);
-  }
-}
-
 void AArch64FrameLowering::emitPrologue(MachineFunction &MF,
                                         MachineBasicBlock &MBB) const {
   MachineBasicBlock::iterator MBBI = MBB.begin();
   const MachineFrameInfo &MFI = MF.getFrameInfo();
   const Function &F = MF.getFunction();
   const AArch64Subtarget &Subtarget = MF.getSubtarget<AArch64Subtarget>();
   const AArch64RegisterInfo *RegInfo = Subtarget.getRegisterInfo();
   const TargetInstrInfo *TII = Subtarget.getInstrInfo();
void AArch64FrameLowering::emitPrologue(MachineFunction &MF,
   // to determine the end of the prologue.
   DebugLoc DL;
 
   const auto &MFnI = *MF.getInfo<AArch64FunctionInfo>();
   if (needsShadowCallStackPrologueEpilogue(MF))
     emitShadowCallStackPrologue(*TII, MF, MBB, MBBI, DL, NeedsWinCFI,
                                 MFnI.needsDwarfUnwindInfo(MF));
 
-  if (MFnI.shouldSignReturnAddress(MF))
-    signLR(MF, MBB, MBBI, NeedsWinCFI, &HasWinCFI);
+  if (MFnI.shouldSignReturnAddress(MF)) {
+    BuildMI(MBB, MBBI, DL, TII->get(AArch64::PAUTH_PROLOGUE))
+        .setMIFlag(MachineInstr::FrameSetup);
+    if (NeedsWinCFI)
+      HasWinCFI = true; // AArch64PointerAuth pass will insert SEH_PACSignLR
+  }
 
   if (EmitCFI && MFnI.isMTETagged()) {
     BuildMI(MBB, MBBI, DL, TII->get(AArch64::EMITMTETAGGED))
         .setMIFlag(MachineInstr::FrameSetup);
   }
 
   // We signal the presence of a Swift extended frame to external tools by
   // storing FP with 0b0001 in bits 63:60. In normal userland operation a simple
if (HasFP) {
           .addCFIIndex(CFIIndex)
           .setMIFlags(MachineInstr::FrameSetup);
     }
     emitCalleeSavedGPRLocations(MBB, MBBI);
     emitCalleeSavedSVELocations(MBB, MBBI);
   }
 }
 
-void AArch64FrameLowering::authenticateLR(MachineFunction &MF,
-                                          MachineBasicBlock &MBB,
-                                          bool NeedsWinCFI, bool *HasWinCFI) {
-  const auto &MFI = *MF.getInfo<AArch64FunctionInfo>();
-  const AArch64Subtarget &Subtarget = MF.getSubtarget<AArch64Subtarget>();
-  const TargetInstrInfo *TII = Subtarget.getInstrInfo();
-  bool EmitAsyncCFI = MFI.needsAsyncDwarfUnwindInfo(MF);
-
-  MachineBasicBlock::iterator MBBI = MBB.getFirstTerminator();
-  DebugLoc DL;
-  if (MBBI != MBB.end())
-    DL = MBBI->getDebugLoc();
-
-  // The AUTIASP instruction assembles to a hint instruction before v8.3a so
-  // this instruction can safely used for any v8a architecture.
-  // From v8.3a onwards there are optimised authenticate LR and return
-  // instructions, namely RETA{A,B}, that can be used instead. In this case the
-  // DW_CFA_AARCH64_negate_ra_state can't be emitted.
-  bool TerminatorIsCombinable =
-      MBBI != MBB.end() && (MBBI->getOpcode() == AArch64::RET_ReallyLR ||
-                            MBBI->getOpcode() == AArch64::RET);
-  if (Subtarget.hasPAuth() && TerminatorIsCombinable && !NeedsWinCFI &&
-      !MF.getFunction().hasFnAttribute(Attribute::ShadowCallStack)) {
-    BuildMI(MBB, MBBI, DL,
-            TII->get(MFI.shouldSignWithBKey() ? AArch64::RETAB : AArch64::RETAA))
-        .copyImplicitOps(*MBBI);
-    MBB.erase(MBBI);
-  } else {
-    BuildMI(
-        MBB, MBBI, DL,
-        TII->get(MFI.shouldSignWithBKey() ? AArch64::AUTIBSP : AArch64::AUTIASP))
-        .setMIFlag(MachineInstr::FrameDestroy);
-
-    if (EmitAsyncCFI) {
-      unsigned CFIIndex =
-          MF.addFrameInst(MCCFIInstruction::createNegateRAState(nullptr));
-      BuildMI(MBB, MBBI, DL, TII->get(TargetOpcode::CFI_INSTRUCTION))
-          .addCFIIndex(CFIIndex)
-          .setMIFlags(MachineInstr::FrameDestroy);
-    }
-    if (NeedsWinCFI) {
-      *HasWinCFI = true;
-      BuildMI(MBB, MBBI, DL, TII->get(AArch64::SEH_PACSignLR))
-          .setMIFlag(MachineInstr::FrameDestroy);
-    }
-  }
-}
-
 static bool isFuncletReturnInstr(const MachineInstr &MI) {
   switch (MI.getOpcode()) {
   default:
     return false;
   case AArch64::CATCHRET:
   case AArch64::CLEANUPRET:
     return true;
   }
void AArch64FrameLowering::emitEpilogue(MachineFunction &MF,
   if (MBB.end() != MBBI) {
     DL = MBBI->getDebugLoc();
     IsFunclet = isFuncletReturnInstr(*MBBI);
   }
 
   MachineBasicBlock::iterator EpilogStartI = MBB.end();
 
   auto FinishingTouches = make_scope_exit([&]() {
-    if (AFI->shouldSignReturnAddress(MF))
-      authenticateLR(MF, MBB, NeedsWinCFI, &HasWinCFI);
+    if (AFI->shouldSignReturnAddress(MF)) {
+      BuildMI(MBB, MBB.getFirstTerminator(), DL,
+              TII->get(AArch64::PAUTH_EPILOGUE))
+          .setMIFlag(MachineInstr::FrameDestroy);
+      if (NeedsWinCFI)
+        HasWinCFI = true; // AArch64PointerAuth pass will insert SEH_PACSignLR
+    }
     if (needsShadowCallStackPrologueEpilogue(MF))
       emitShadowCallStackEpilogue(*TII, MF, MBB, MBB.getFirstTerminator(), DL);
     if (EmitCFI)
       emitCalleeSavedGPRRestores(MBB, MBB.getFirstTerminator());
     if (HasWinCFI) {
       BuildMI(MBB, MBB.getFirstTerminator(), DL,
               TII->get(AArch64::SEH_EpilogEnd))
           .setMIFlag(MachineInstr::FrameDestroy);

llvm/lib/Target/AArch64/AArch64InstrInfo.cpp

AArch64InstrInfo::getOutliningTypeImpl(MachineBasicBlock::iterator &MIT,
   switch (MI.getOpcode()) {
   case AArch64::PACIASP:
   case AArch64::PACIBSP:
   case AArch64::AUTIASP:
   case AArch64::AUTIBSP:
   case AArch64::RETAA:
   case AArch64::RETAB:
   case AArch64::EMITBKEY:
+  case AArch64::PAUTH_PROLOGUE:
+  case AArch64::PAUTH_EPILOGUE:
     return outliner::InstrType::Illegal;
   }
 
   // Don't outline LOHs.
   if (FuncInfo->getLOHRelated().count(&MI))
     return outliner::InstrType::Illegal;
 
   // We can only outline these if we will tail call the outlined function, or
for (MachineInstr &MI : MBB) {
     // This is safe, since we already checked if it would overflow when we
     // checked if this instruction was legal to outline.
     int64_t NewImm = (Offset + 16) / (int64_t)Scale.getFixedValue();
     StackOffsetOperand.setImm(NewImm);
   }
 }
 
 static void signOutlinedFunction(MachineFunction &MF, MachineBasicBlock &MBB,
+                                 const AArch64InstrInfo *TII,
                                  bool ShouldSignReturnAddr) {
   if (!ShouldSignReturnAddr)
     return;
 
-  AArch64FrameLowering::signLR(MF, MBB, MBB.begin(),
-                               /*NeedsWinCFI=*/false, /*HasWinCFI=*/nullptr);
-
-  AArch64FrameLowering::authenticateLR(MF, MBB, /*NeedsWinCFI=*/false,
-                                       /*HasWinCFI=*/nullptr);
+  BuildMI(MBB, MBB.begin(), DebugLoc(), TII->get(AArch64::PAUTH_PROLOGUE))
+      .setMIFlag(MachineInstr::FrameSetup);
+  BuildMI(MBB, MBB.getFirstInstrTerminator(), DebugLoc(),
+          TII->get(AArch64::PAUTH_EPILOGUE))
+      .setMIFlag(MachineInstr::FrameDestroy);
 }
 
 void AArch64InstrInfo::buildOutlinedFrame(
     MachineBasicBlock &MBB, MachineFunction &MF,
     const outliner::OutlinedFunction &OF) const {
 
   AArch64FunctionInfo *FI = MF.getInfo<AArch64FunctionInfo>();
 
if (llvm::any_of(MBB.instrs(), IsNonTailCall)) {
     Et = MBB.insert(Et, LDRXpost);
   }
 
   bool ShouldSignReturnAddr = FI->shouldSignReturnAddress(!IsLeafFunction);
 
   // If this is a tail call outlined function, then there's already a return.
   if (OF.FrameConstructionID == MachineOutlinerTailCall ||
       OF.FrameConstructionID == MachineOutlinerThunk) {
-    signOutlinedFunction(MF, MBB, ShouldSignReturnAddr);
+    signOutlinedFunction(MF, MBB, this, ShouldSignReturnAddr);
     return;
   }
 
   // It's not a tail call, so we have to insert the return ourselves.
 
   // LR has to be a live in so that we can return to it.
   if (!MBB.isLiveIn(AArch64::LR))
     MBB.addLiveIn(AArch64::LR);
 
   MachineInstr *ret = BuildMI(MF, DebugLoc(), get(AArch64::RET))
                           .addReg(AArch64::LR);
   MBB.insert(MBB.end(), ret);
 
-  signOutlinedFunction(MF, MBB, ShouldSignReturnAddr);
+  signOutlinedFunction(MF, MBB, this, ShouldSignReturnAddr);
 
   FI->setOutliningStyle("Function");
 
   // Did we have to modify the stack by saving the link register?
   if (OF.FrameConstructionID != MachineOutlinerDefault)
     return;
 
   // We modified the stack.

llvm/lib/Target/AArch64/AArch64InstrInfo.td

 def : InstAlias<"autiasp", (AUTIASP), 0>;
 def : InstAlias<"autibsp", (AUTIBSP), 0>;
 def : InstAlias<"pacia1716", (PACIA1716), 0>;
 def : InstAlias<"pacib1716", (PACIB1716), 0>;
 def : InstAlias<"autia1716", (AUTIA1716), 0>;
 def : InstAlias<"autib1716", (AUTIB1716), 0>;
 def : InstAlias<"xpaclri", (XPACLRI), 0>;
 
+// Pseudos
+
+// Insertion point of LR signing code.
+def PAUTH_PROLOGUE : Pseudo<(outs), (ins), []>, Sched<[]>;
+// Insertion point of LR authentication code.
+// The RET terminator of the containing machine basic block may be replaced
+// with a combined RETA(A|B) instruction when rewriting this Pseudo.
+def PAUTH_EPILOGUE : Pseudo<(outs), (ins), []>, Sched<[]>;
+
 // These pointer authentication instructions require armv8.3a
 let Predicates = [HasPAuth] in {
 
   // When PA is enabled, a better mnemonic should be emitted.
   def : InstAlias<"paciaz", (PACIAZ), 1>;
   def : InstAlias<"pacibz", (PACIBZ), 1>;
   def : InstAlias<"autiaz", (AUTIAZ), 1>;
   def : InstAlias<"autibz", (AUTIBZ), 1>;

llvm/lib/Target/AArch64/AArch64PointerAuth.cpp

+//===-- AArch64PointerAuth.cpp -- Harden code using PAuth ------------------==//
+//
+// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
+// See https://llvm.org/LICENSE.txt for license information.
+// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
+//
+//===----------------------------------------------------------------------===//
+
+#include "AArch64.h"
+#include "AArch64MachineFunctionInfo.h"
+#include "AArch64Subtarget.h"
+#include "llvm/CodeGen/MachineBasicBlock.h"
+#include "llvm/CodeGen/MachineInstrBuilder.h"
+#include "llvm/CodeGen/MachineModuleInfo.h"
+
+using namespace llvm;
+
+#define AARCH64_POINTER_AUTH_NAME "AArch64 Pointer Authentication"
+
+namespace {
+
+class AArch64PointerAuth : public MachineFunctionPass {
+public:
+  static char ID;
+
+  AArch64PointerAuth() : MachineFunctionPass(ID) {}
+
+  bool runOnMachineFunction(MachineFunction &MF) override;
+
+  StringRef getPassName() const override { return AARCH64_POINTER_AUTH_NAME; }
+
+private:
+  MachineFunction *MF;
+
+  const AArch64Subtarget *Subtarget;
+  const AArch64FunctionInfo *MFnI;
+  const AArch64InstrInfo *TII;
+
+  bool UseBKey;
+  bool EmitCFI;
+  bool EmitAsyncCFI;
+  bool NeedsWinCFI;
+
+  void signLR(MachineBasicBlock::iterator MBBI, bool *HasWinCFI) const;
+
+  void authenticateLR(MachineBasicBlock::iterator MBBI, bool *HasWinCFI) const;
+};
+
+} // end anonymous namespace
+
+INITIALIZE_PASS(AArch64PointerAuth, "aarch64-ptrauth",
+                AARCH64_POINTER_AUTH_NAME, false, false)
+
+FunctionPass *llvm::createAArch64PointerAuthPass() {
+  return new AArch64PointerAuth();
+}
+
+char AArch64PointerAuth::ID = 0;
+
+void AArch64PointerAuth::signLR(MachineBasicBlock::iterator MBBI,
+                                bool *HasWinCFI) const {
+  MachineBasicBlock &MBB = *MBBI->getParent();
+
+  // Debug location must be unknown, see AArch64FrameLowering::emitPrologue.
+  DebugLoc DL;
+
+  if (UseBKey) {
+    BuildMI(MBB, MBBI, DL, TII->get(AArch64::EMITBKEY))
+        .setMIFlag(MachineInstr::FrameSetup);
+  }
+
+  // No SEH opcode for this one; it doesn't materialize into an
+  // instruction on Windows.
+  BuildMI(MBB, MBBI, DL,
+          TII->get(UseBKey ? AArch64::PACIBSP : AArch64::PACIASP))
+      .setMIFlag(MachineInstr::FrameSetup);
+
+  if (EmitCFI) {
+    unsigned CFIIndex =
+        MF->addFrameInst(MCCFIInstruction::createNegateRAState(nullptr));
+    BuildMI(MBB, MBBI, DL, TII->get(TargetOpcode::CFI_INSTRUCTION))
+        .addCFIIndex(CFIIndex)
+        .setMIFlags(MachineInstr::FrameSetup);
+  } else if (NeedsWinCFI) {
+    *HasWinCFI = true;
+    BuildMI(MBB, MBBI, DL, TII->get(AArch64::SEH_PACSignLR))
+        .setMIFlag(MachineInstr::FrameSetup);
+  }
+}
+
+void AArch64PointerAuth::authenticateLR(MachineBasicBlock::iterator MBBI,
+                                        bool *HasWinCFI) const {
+  MachineBasicBlock &MBB = *MBBI->getParent();
+  DebugLoc DL = MBBI->getDebugLoc();
+  // MBBI points to a PAUTH_EPILOGUE instruction to be replaced and
+  // TI points to a terminator instruction that may or may not be combined.
+  // Note that inserting new instructions "before MBBI" and "before TI" is
+  // not the same because if ShadowCallStack is enabled, its instructions
+  // are placed between MBBI and TI.
+  MachineBasicBlock::iterator TI = MBB.getFirstInstrTerminator();
+
+  // The AUTIASP instruction assembles to a hint instruction before v8.3a so
+  // this instruction can safely used for any v8a architecture.
+  // From v8.3a onwards there are optimised authenticate LR and return
+  // instructions, namely RETA{A,B}, that can be used instead. In this case the
+  // DW_CFA_AARCH64_negate_ra_state can't be emitted.
+  bool TerminatorIsCombinable =
+      TI != MBB.end() && TI->getOpcode() == AArch64::RET;
+  if (Subtarget->hasPAuth() && TerminatorIsCombinable && !NeedsWinCFI &&
+      !MF->getFunction().hasFnAttribute(Attribute::ShadowCallStack)) {
+    unsigned CombinedRetOpcode = UseBKey ? AArch64::RETAB : AArch64::RETAA;
+    BuildMI(MBB, TI, DL, TII->get(CombinedRetOpcode)).copyImplicitOps(*TI);
+    MBB.erase(TI);
+  } else {
+    unsigned AutOpcode = UseBKey ? AArch64::AUTIBSP : AArch64::AUTIASP;
+    BuildMI(MBB, MBBI, DL, TII->get(AutOpcode))
+        .setMIFlag(MachineInstr::FrameDestroy);
+
+    if (EmitAsyncCFI) {
+      unsigned CFIIndex =
+          MF->addFrameInst(MCCFIInstruction::createNegateRAState(nullptr));
+      BuildMI(MBB, MBBI, DL, TII->get(TargetOpcode::CFI_INSTRUCTION))
+          .addCFIIndex(CFIIndex)
+          .setMIFlags(MachineInstr::FrameDestroy);
+    }
+    if (NeedsWinCFI) {
+      *HasWinCFI = true;
+      BuildMI(MBB, MBBI, DL, TII->get(AArch64::SEH_PACSignLR))
+          .setMIFlag(MachineInstr::FrameDestroy);
+    }
+  }
+}
+
+bool AArch64PointerAuth::runOnMachineFunction(MachineFunction &MF) {
+  this->MF = &MF;
+
+  Subtarget = &MF.getSubtarget<AArch64Subtarget>();
+  MFnI = MF.getInfo<AArch64FunctionInfo>();
+  TII = Subtarget->getInstrInfo();
+
+  UseBKey = MFnI->shouldSignWithBKey();
+  EmitCFI = MFnI->needsDwarfUnwindInfo(MF);
+  EmitAsyncCFI = MFnI->needsAsyncDwarfUnwindInfo(MF);
+
+  // Set by AArch64FrameLowering::emitPrologue as needed.
+  NeedsWinCFI = MF.hasWinCFI();
+
+  if (!MFnI->shouldSignReturnAddress(true))
+    return false;
+
+  SmallVector<MachineBasicBlock::iterator> DeletedInstrs;
+  bool Modified = false;
+
+  for (auto &MBB : MF) {
+    for (auto &MI : MBB) {
+      auto It = MI.getIterator();
+      bool HasWinCFI = false;
+      switch (MI.getOpcode()) {
+      default:
+        // do nothing
+        break;
+      case AArch64::PAUTH_PROLOGUE:
+        signLR(It, &HasWinCFI);
+        DeletedInstrs.push_back(It);
+        Modified = true;
+        assert(HasWinCFI == MF.hasWinCFI());
+        break;
+      case AArch64::PAUTH_EPILOGUE:
+        authenticateLR(It, &HasWinCFI);
+        DeletedInstrs.push_back(It);
+        Modified = true;
+        assert(HasWinCFI == MF.hasWinCFI());
+        break;
+      }
+    }
+  }
+
+  for (auto MI : DeletedInstrs)
+    MI->eraseFromParent();
+
+  return Modified;
+}

llvm/lib/Target/AArch64/AArch64TargetMachine.cpp

extern "C" LLVM_EXTERNAL_VISIBILITY void LLVMInitializeAArch64Target() {
   initializeAArch64ConditionOptimizerPass(*PR);
   initializeAArch64DeadRegisterDefinitionsPass(*PR);
   initializeAArch64ExpandPseudoPass(*PR);
   initializeAArch64LoadStoreOptPass(*PR);
   initializeAArch64MIPeepholeOptPass(*PR);
   initializeAArch64SIMDInstrOptPass(*PR);
   initializeAArch64O0PreLegalizerCombinerPass(*PR);
   initializeAArch64PreLegalizerCombinerPass(*PR);
+  initializeAArch64PointerAuthPass(*PR);
   initializeAArch64PostLegalizerCombinerPass(*PR);
   initializeAArch64PostLegalizerLoweringPass(*PR);
   initializeAArch64PostSelectOptimizePass(*PR);
   initializeAArch64PromoteConstantPass(*PR);
   initializeAArch64RedundantCopyEliminationPass(*PR);
   initializeAArch64StorePairSuppressPass(*PR);
   initializeFalkorHWPFFixPass(*PR);
   initializeFalkorMarkStridedAccessesLegacyPass(*PR);
if (TM->getOptLevel() >= CodeGenOpt::Aggressive && EnableLoadStoreOpt)
     addPass(createAArch64LoadStoreOptimizationPass());
 
   if (TM->getOptLevel() >= CodeGenOpt::Aggressive &&
       EnableAArch64CopyPropagation)
     addPass(createMachineCopyPropagationPass(true));
 
   addPass(createAArch64A53Fix835769());
 
-  if (EnableBranchTargets)
-    addPass(createAArch64BranchTargetsPass());
-
   if (TM->getTargetTriple().isOSWindows()) {
     // Identify valid longjmp targets for Windows Control Flow Guard.
     addPass(createCFGuardLongjmpPass());
     // Identify valid eh continuation targets for Windows EHCont Guard.
     addPass(createEHContGuardCatchretPass());
   }
 
   if (TM->getOptLevel() != CodeGenOpt::None && EnableCollectLOH &&
       TM->getTargetTriple().isOSBinFormatMachO())
     addPass(createAArch64CollectLOHPass());
 }
 
 void AArch64PassConfig::addPostBBSections() {
+  addPass(createAArch64PointerAuthPass());
+  if (EnableBranchTargets)
+    addPass(createAArch64BranchTargetsPass());
   // Relax conditional branch instructions if they're otherwise out of
   // range of their destination.
   if (BranchRelaxation)
     addPass(&BranchRelaxationPassID);
 
   if (TM->getOptLevel() != CodeGenOpt::None && EnableCompressJumpTables)
     addPass(createAArch64CompressJumpTablesPass());
 }

llvm/lib/Target/AArch64/CMakeLists.txt

add_llvm_target(AArch64CodeGen
   AArch64InstrInfo.cpp
   AArch64LoadStoreOptimizer.cpp
   AArch64LowerHomogeneousPrologEpilog.cpp
   AArch64MachineFunctionInfo.cpp
   AArch64MachineScheduler.cpp
   AArch64MacroFusion.cpp
   AArch64MIPeepholeOpt.cpp
   AArch64MCInstLower.cpp
+  AArch64PointerAuth.cpp
   AArch64PromoteConstant.cpp
   AArch64PBQPRegAlloc.cpp
   AArch64RegisterInfo.cpp
   AArch64SLSHardening.cpp
   AArch64SelectionDAGInfo.cpp
   AArch64SpeculationHardening.cpp
   AArch64StackTagging.cpp
   AArch64StackTaggingPreRA.cpp

llvm/test/CodeGen/AArch64/O0-pipeline.ll

 ; CHECK-NEXT:       AArch64 speculation hardening pass
 ; CHECK-NEXT:       AArch64 Indirect Thunks
 ; CHECK-NEXT:       AArch64 sls hardening pass
 ; CHECK-NEXT:       Analyze Machine Code For Garbage Collection
 ; CHECK-NEXT:       Insert fentry calls
 ; CHECK-NEXT:       Insert XRay ops
 ; CHECK-NEXT:       Implement the 'patchable-function' attribute
 ; CHECK-NEXT:       Workaround A53 erratum 835769 pass
-; CHECK-NEXT:       AArch64 Branch Targets
 ; CHECK-NEXT:       Contiguously Lay Out Funclets
 ; CHECK-NEXT:       StackMap Liveness Analysis
 ; CHECK-NEXT:       Live DEBUG_VALUE analysis
 ; CHECK-NEXT:       Machine Sanitizer Binary Metadata
+; CHECK-NEXT:       AArch64 Pointer Authentication
+; CHECK-NEXT:       AArch64 Branch Targets
 ; CHECK-NEXT:       Branch relaxation pass
 ; CHECK-NEXT:       Insert CFI remember/restore state instructions
 ; CHECK-NEXT:       Lazy Machine Block Frequency Analysis
 ; CHECK-NEXT:       Machine Optimization Remark Emitter
 ; CHECK-NEXT:       Stack Frame Layout Analysis
 ; CHECK-NEXT:       Unpack machine instruction bundles
 ; CHECK-NEXT:       Lazy Machine Block Frequency Analysis
 ; CHECK-NEXT:       Machine Optimization Remark Emitter
 ; CHECK-NEXT:       AArch64 Assembly Printer
 ; CHECK-NEXT:       Free MachineFunction
 
 define void @f() {
   ret void
 }

llvm/test/CodeGen/AArch64/O3-pipeline.ll

 ; CHECK-NEXT:       MachinePostDominator Tree Construction
 ; CHECK-NEXT:       Branch Probability Basic Block Placement
 ; CHECK-NEXT:       Insert fentry calls
 ; CHECK-NEXT:       Insert XRay ops
 ; CHECK-NEXT:       Implement the 'patchable-function' attribute
 ; CHECK-NEXT:       AArch64 load / store optimization pass
 ; CHECK-NEXT:       Machine Copy Propagation Pass
 ; CHECK-NEXT:       Workaround A53 erratum 835769 pass
-; CHECK-NEXT:       AArch64 Branch Targets
 ; CHECK-NEXT:       Contiguously Lay Out Funclets
 ; CHECK-NEXT:       StackMap Liveness Analysis
 ; CHECK-NEXT:       Live DEBUG_VALUE analysis
 ; CHECK-NEXT:       Machine Sanitizer Binary Metadata
 ; CHECK-NEXT:     Machine Outliner
 ; CHECK-NEXT:     FunctionPass Manager
+; CHECK-NEXT:       AArch64 Pointer Authentication
+; CHECK-NEXT:       AArch64 Branch Targets
 ; CHECK-NEXT:       Branch relaxation pass
 ; CHECK-NEXT:       AArch64 Compress Jump Tables
 ; CHECK-NEXT:       Insert CFI remember/restore state instructions
 ; CHECK-NEXT:       Lazy Machine Block Frequency Analysis
 ; CHECK-NEXT:       Machine Optimization Remark Emitter
 ; CHECK-NEXT:       Stack Frame Layout Analysis
 ; CHECK-NEXT:       Unpack machine instruction bundles
 ; CHECK-NEXT:       Lazy Machine Block Frequency Analysis

llvm/test/CodeGen/AArch64/arm64-opt-remarks-lazy-bfi.ll

 ; Verify that we only populate MachineBFI on behalf of ORE when hotness is
 ; requested.  (This hard-codes the previous pass to the Assembly Printer,
 ; please adjust accordingly.)
 
 ; HOTNESS:      Freeing Pass 'Machine Outliner'
 ; HOTNESS-NEXT:  Executing Pass 'Function Pass Manager'
 ; HOTNESS-NEXT: Executing Pass 'Verify generated machine code'
 ; HOTNESS-NEXT: Freeing Pass 'Verify generated machine code'
+; HOTNESS-NEXT: Executing Pass 'AArch64 Pointer Authentication' on Function 'empty_func'...
+; HOTNESS-NEXT: Freeing Pass 'AArch64 Pointer Authentication' on Function 'empty_func'...
+; HOTNESS-NEXT: Executing Pass 'Verify generated machine code' on Function 'empty_func'...
+; HOTNESS-NEXT: Freeing Pass 'Verify generated machine code' on Function 'empty_func'...
+; HOTNESS-NEXT: Executing Pass 'AArch64 Branch Targets' on Function 'empty_func'...
+; HOTNESS-NEXT: Freeing Pass 'AArch64 Branch Targets' on Function 'empty_func'...
+; HOTNESS-NEXT: Executing Pass 'Verify generated machine code' on Function 'empty_func'...
+; HOTNESS-NEXT: Freeing Pass 'Verify generated machine code' on Function 'empty_func'...
 ; HOTNESS-NEXT: Executing Pass 'Branch relaxation pass' on Function 'empty_func'
 ; HOTNESS-NEXT: Freeing Pass 'Branch relaxation pass' on Function 'empty_func'
 ; HOTNESS-NEXT: Executing Pass 'Verify generated machine code'
 ; HOTNESS-NEXT: Freeing Pass 'Verify generated machine code'
 ; HOTNESS-NEXT: Executing Pass 'AArch64 Compress Jump Tables' on Function 'empty_func'
 ; HOTNESS-NEXT: Freeing Pass 'AArch64 Compress Jump Tables' on Function 'empty_func'
 ; HOTNESS-NEXT: Executing Pass 'Verify generated machine code'
 ; HOTNESS-NEXT: Freeing Pass 'Verify generated machine code'

 
 ; HOTNESS: arm64-summary-remarks.ll:5:0: 1 instructions in function (hotness: 33)
 
 
 ; NO_HOTNESS:      Freeing Pass 'Machine Outliner'
 ; NO_HOTNESS-NEXT:  Executing Pass 'Function Pass Manager'
 ; NO_HOTNESS-NEXT: Executing Pass 'Verify generated machine code'
 ; NO_HOTNESS-NEXT: Freeing Pass 'Verify generated machine code'
+; NO_HOTNESS-NEXT: Executing Pass 'AArch64 Pointer Authentication' on Function 'empty_func'...
+; NO_HOTNESS-NEXT: Freeing Pass 'AArch64 Pointer Authentication' on Function 'empty_func'...
+; NO_HOTNESS-NEXT: Executing Pass 'Verify generated machine code' on Function 'empty_func'...
+; NO_HOTNESS-NEXT: Freeing Pass 'Verify generated machine code' on Function 'empty_func'...
+; NO_HOTNESS-NEXT: Executing Pass 'AArch64 Branch Targets' on Function 'empty_func'...
+; NO_HOTNESS-NEXT: Freeing Pass 'AArch64 Branch Targets' on Function 'empty_func'...
+; NO_HOTNESS-NEXT: Executing Pass 'Verify generated machine code' on Function 'empty_func'...
+; NO_HOTNESS-NEXT: Freeing Pass 'Verify generated machine code' on Function 'empty_func'...
 ; NO_HOTNESS-NEXT: Executing Pass 'Branch relaxation pass' on Function 'empty_func'
 ; NO_HOTNESS-NEXT: Freeing Pass 'Branch relaxation pass' on Function 'empty_func'
 ; NO_HOTNESS-NEXT: Executing Pass 'Verify generated machine code'
 ; NO_HOTNESS-NEXT: Freeing Pass 'Verify generated machine code'
 ; NO_HOTNESS-NEXT: Executing Pass 'AArch64 Compress Jump Tables' on Function 'empty_func'
 ; NO_HOTNESS-NEXT: Freeing Pass 'AArch64 Compress Jump Tables' on Function 'empty_func'
 ; NO_HOTNESS-NEXT: Executing Pass 'Verify generated machine code'
 ; NO_HOTNESS-NEXT: Freeing Pass 'Verify generated machine code'

llvm/test/CodeGen/AArch64/machine-outliner-retaddr-sign-regsave.mir

-# RUN: llc -mtriple=aarch64 -run-pass=prologepilog \
-# RUN: -run-pass=machine-outliner -verify-machineinstrs %s -o - | FileCheck %s
+# RUN: llc -mtriple=aarch64 -run-pass=prologepilog -run-pass=machine-outliner \
+# RUN: -verify-machineinstrs -run-pass=aarch64-ptrauth %s -o - | FileCheck %s
 
 # Check that we save LR to a callee-saved register when possible.
 # foo() should use a callee-saved register. However, bar() should not.
 --- |
 
   define void @foo() #0 {
     ret void
   }

llvm/test/CodeGen/AArch64/machine-outliner-retaddr-sign-sp-mod.mir

-# RUN: llc -verify-machineinstrs -run-pass=machine-outliner %s -o - | FileCheck %s
+# RUN: llc -verify-machineinstrs -run-pass=machine-outliner -run-pass=aarch64-ptrauth %s -o - | FileCheck %s
 
 --- |
   target datalayout = "e-m:e-i8:8:32-i16:16:32-i64:64-i128:128-n32:64-S128"
   target triple = "aarch64-arm-linux-gnu"
 
   @v = common dso_local global i32* null, align 8
 
   ; Function Attrs: nounwind

 
 ...
 ---
 name:            legal0
 tracksRegLiveness: true
 body:             |
   bb.0 (%ir-block.0):
   liveins: $lr
-    frame-setup PACIASP implicit-def $lr, implicit killed $lr, implicit $sp
-    frame-setup CFI_INSTRUCTION negate_ra_sign_state
+    frame-setup PAUTH_PROLOGUE
     $sp = frame-setup SUBXri $sp, 16, 0
     renamable $x8 = ADRP target-flags(aarch64-page) @v
     $x9 = ADDXri $sp, 12, 0
     STRXui renamable $x9, renamable $x8, target-flags(aarch64-pageoff, aarch64-nc) @v :: (volatile store (s64) into @v)
     STRXui renamable $x9, renamable $x8, target-flags(aarch64-pageoff, aarch64-nc) @v :: (volatile store (s64) into @v)
     STRXui renamable $x9, renamable $x8, target-flags(aarch64-pageoff, aarch64-nc) @v :: (volatile store (s64) into @v)
     STRXui renamable $x9, renamable $x8, target-flags(aarch64-pageoff, aarch64-nc) @v :: (volatile store (s64) into @v)
     STRXui renamable $x9, renamable $x8, target-flags(aarch64-pageoff, aarch64-nc) @v :: (volatile store (s64) into @v)
     STRXui renamable $x9, renamable $x8, target-flags(aarch64-pageoff, aarch64-nc) @v :: (volatile store (s64) into @v)
     STRXui killed renamable $x9, killed renamable $x8, target-flags(aarch64-pageoff, aarch64-nc) @v :: (volatile store (s64) into @v)
     $sp = frame-destroy ADDXri $sp, 16, 0
-    frame-destroy AUTIASP implicit-def $lr, implicit killed $lr, implicit $sp
-    frame-destroy CFI_INSTRUCTION negate_ra_sign_state
+    frame-destroy PAUTH_EPILOGUE
     RET undef $lr
 
 # CHECK-LABEL:    name:            legal0
 # CHECK:          body:             |
 # CHECK-NEXT:         bb.0 (%ir-block.0):
 # CHECK-NEXT:           liveins: $lr
-# CHECK:                frame-setup PACIASP implicit-def $lr, implicit killed $lr, implicit $sp
+# CHECK:                frame-setup PACIASP implicit-def $lr, implicit $lr, implicit $sp
 # CHECK-NEXT:           frame-setup CFI_INSTRUCTION negate_ra_sign_state
 # CHECK:                BL @[[OUTLINED_FUNC:OUTLINED_FUNCTION_[0-9]+]]
-# CHECK:                frame-destroy AUTIASP implicit-def $lr, implicit killed $lr, implicit $sp
+# CHECK:                frame-destroy AUTIASP implicit-def $lr, implicit $lr, implicit $sp
 # CHECK-NEXT:           frame-destroy CFI_INSTRUCTION negate_ra_sign_state
 # CHECK-NEXT:           RET undef $lr
 
 ...
 ---
 name:            legal1
 tracksRegLiveness: true
 body:             |
   bb.0 (%ir-block.0):
   liveins: $lr
-    frame-setup PACIASP implicit-def $lr, implicit killed $lr, implicit $sp
-    frame-setup CFI_INSTRUCTION negate_ra_sign_state
+    frame-setup PAUTH_PROLOGUE
     $sp = frame-setup SUBXri $sp, 16, 0
     renamable $x8 = ADRP target-flags(aarch64-page) @v
     $x9 = ADDXri $sp, 12, 0
     STRXui renamable $x9, renamable $x8, target-flags(aarch64-pageoff, aarch64-nc) @v :: (volatile store (s64) into @v)
     STRXui renamable $x9, renamable $x8, target-flags(aarch64-pageoff, aarch64-nc) @v :: (volatile store (s64) into @v)
     STRXui renamable $x9, renamable $x8, target-flags(aarch64-pageoff, aarch64-nc) @v :: (volatile store (s64) into @v)
     STRXui renamable $x9, renamable $x8, target-flags(aarch64-pageoff, aarch64-nc) @v :: (volatile store (s64) into @v)
     STRXui renamable $x9, renamable $x8, target-flags(aarch64-pageoff, aarch64-nc) @v :: (volatile store (s64) into @v)
     STRXui renamable $x9, renamable $x8, target-flags(aarch64-pageoff, aarch64-nc) @v :: (volatile store (s64) into @v)
     STRXui killed renamable $x9, killed renamable $x8, target-flags(aarch64-pageoff, aarch64-nc) @v :: (volatile store (s64) into @v)
     $sp = frame-destroy ADDXri $sp, 16, 0
-    frame-destroy AUTIASP implicit-def $lr, implicit killed $lr, implicit $sp
-    frame-destroy CFI_INSTRUCTION negate_ra_sign_state
+    frame-destroy PAUTH_EPILOGUE
     RET undef $lr
 
 # CHECK-LABEL:    name:            legal1
 # CHECK:          body:             |
 # CHECK-NEXT:         bb.0 (%ir-block.0):
 # CHECK-NEXT:           liveins: $lr
-# CHECK:                frame-setup PACIASP implicit-def $lr, implicit killed $lr, implicit $sp
+# CHECK:                frame-setup PACIASP implicit-def $lr, implicit $lr, implicit $sp
 # CHECK-NEXT:           frame-setup CFI_INSTRUCTION negate_ra_sign_state
 # CHECK:                BL @[[OUTLINED_FUNC]]
-# CHECK:                frame-destroy AUTIASP implicit-def $lr, implicit killed $lr, implicit $sp
+# CHECK:                frame-destroy AUTIASP implicit-def $lr, implicit $lr, implicit $sp
 # CHECK-NEXT:           frame-destroy CFI_INSTRUCTION negate_ra_sign_state
 # CHECK-NEXT:           RET undef $lr
 
 ...
 ---
 name:            illegal0
 tracksRegLiveness: true
 body:             |
   bb.0 (%ir-block.0):
   liveins: $lr
-    frame-setup PACIASP implicit-def $lr, implicit killed $lr, implicit $sp
-    frame-setup CFI_INSTRUCTION negate_ra_sign_state
+    frame-setup PAUTH_PROLOGUE
     $sp = frame-setup SUBXri $sp, 16, 0
     renamable $x8 = ADRP target-flags(aarch64-page) @v
     $x9 = ADDXri $sp, 12, 0
     STRXui renamable $x9, renamable $x8, target-flags(aarch64-pageoff, aarch64-nc) @v :: (volatile store (s64) into @v)
     STRXui renamable $x9, renamable $x8, target-flags(aarch64-pageoff, aarch64-nc) @v :: (volatile store (s64) into @v)
     STRXui renamable $x9, renamable $x8, target-flags(aarch64-pageoff, aarch64-nc) @v :: (volatile store (s64) into @v)
     STRXui renamable $x9, renamable $x8, target-flags(aarch64-pageoff, aarch64-nc) @v :: (volatile store (s64) into @v)
     STRXui renamable $x9, renamable $x8, target-flags(aarch64-pageoff, aarch64-nc) @v :: (volatile store (s64) into @v)
     STRXui renamable $x9, renamable $x8, target-flags(aarch64-pageoff, aarch64-nc) @v :: (volatile store (s64) into @v)
     STRXui killed renamable $x9, killed renamable $x8, target-flags(aarch64-pageoff, aarch64-nc) @v :: (volatile store (s64) into @v)
     $sp = frame-destroy ADDXri $sp, 12, 0
-    frame-destroy AUTIASP implicit-def $lr, implicit killed $lr, implicit $sp
-    frame-destroy CFI_INSTRUCTION negate_ra_sign_state
+    frame-destroy PAUTH_EPILOGUE
     RET undef $lr
 
 ...
 ---
 name:            illegal1
 tracksRegLiveness: true
 body:             |
   bb.0 (%ir-block.0):
   liveins: $lr
-    frame-setup PACIASP implicit-def $lr, implicit killed $lr, implicit $sp
-    frame-setup CFI_INSTRUCTION negate_ra_sign_state
+    frame-setup PAUTH_PROLOGUE
     $sp = frame-setup SUBXri $sp, 16, 0
     renamable $x8 = ADRP target-flags(aarch64-page) @v
     $x9 = ADDXri $sp, 12, 0
     STRXui renamable $x9, renamable $x8, target-flags(aarch64-pageoff, aarch64-nc) @v :: (volatile store (s64) into @v)
     STRXui renamable $x9, renamable $x8, target-flags(aarch64-pageoff, aarch64-nc) @v :: (volatile store (s64) into @v)
     STRXui renamable $x9, renamable $x8, target-flags(aarch64-pageoff, aarch64-nc) @v :: (volatile store (s64) into @v)
     STRXui renamable $x9, renamable $x8, target-flags(aarch64-pageoff, aarch64-nc) @v :: (volatile store (s64) into @v)
     STRXui renamable $x9, renamable $x8, target-flags(aarch64-pageoff, aarch64-nc) @v :: (volatile store (s64) into @v)
     STRXui renamable $x9, renamable $x8, target-flags(aarch64-pageoff, aarch64-nc) @v :: (volatile store (s64) into @v)
     STRXui killed renamable $x9, killed renamable $x8, target-flags(aarch64-pageoff, aarch64-nc) @v :: (volatile store (s64) into @v)
     $sp = frame-destroy ADDXri $sp, 12, 0
-    frame-destroy AUTIASP implicit-def $lr, implicit killed $lr, implicit $sp
-    frame-destroy CFI_INSTRUCTION negate_ra_sign_state
+    frame-destroy PAUTH_EPILOGUE
     RET undef $lr
 
 # CHECK-LABEL:    name:            illegal0
 # CHECK:          body:             |
 # CHECK-NEXT:         bb.0 (%ir-block.0):
 # CHECK-NEXT:           liveins: $lr
-# CHECK:                frame-setup PACIASP implicit-def $lr, implicit killed $lr, implicit $sp
+# CHECK:                frame-setup PACIASP implicit-def $lr, implicit $lr, implicit $sp
 # CHECK-NEXT:           frame-setup CFI_INSTRUCTION negate_ra_sign_state
 # CHECK-NOT:            BL @OUTLINED_FUNCTION_{{.*}}
-# CHECK:                frame-destroy AUTIASP implicit-def $lr, implicit killed $lr, implicit $sp
+# CHECK:                frame-destroy AUTIASP implicit-def $lr, implicit $lr, implicit $sp
 # CHECK-NEXT:           frame-destroy CFI_INSTRUCTION negate_ra_sign_state
 # CHECK-NEXT:           RET undef $lr
 
 # CHECK-LABEL:    name:            illegal1
 # CHECK:          body:             |
 # CHECK-NEXT:         bb.0 (%ir-block.0):
 # CHECK-NEXT:           liveins: $lr
-# CHECK:                frame-setup PACIASP implicit-def $lr, implicit killed $lr, implicit $sp
+# CHECK:                frame-setup PACIASP implicit-def $lr, implicit $lr, implicit $sp
 # CHECK-NEXT:           frame-setup CFI_INSTRUCTION negate_ra_sign_state
 # CHECK-NOT:            BL @OUTLINED_FUNCTION_{{.*}}
-# CHECK:                frame-destroy AUTIASP implicit-def $lr, implicit killed $lr, implicit $sp
+# CHECK:                frame-destroy AUTIASP implicit-def $lr, implicit $lr, implicit $sp
 # CHECK-NEXT:           frame-destroy CFI_INSTRUCTION negate_ra_sign_state
 # CHECK-NEXT:           RET undef $lr
 
 # Outlined function that contains only legal sp modifications
 # CHECK:          name:            [[OUTLINED_FUNC]]
 # CHECK:          body:             |
 # CHECK-NEXT:       bb.0:
 # CHECK-NEXT: liveins: $lr
 # CHECK-NEXT: {{^  $}}
 # CHECK-NEXT:         frame-setup PACIASP implicit-def $lr, implicit $lr, implicit $sp
 # CHECK-NEXT:         frame-setup CFI_INSTRUCTION negate_ra_sign_state
 # CHECK-NEXT:         $sp = frame-setup SUBXri $sp, 16, 0
 # CHECK:              $sp = frame-destroy ADDXri $sp, 16, 0
 # CHECK-NEXT:         frame-destroy AUTIASP implicit-def $lr, implicit $lr, implicit $sp
 # CHECK-NEXT:         RET $lr

llvm/test/CodeGen/MIR/AArch64/return-address-signing.mir

-# RUN: llc -mtriple=aarch64 -run-pass=prologepilog -o - %s 2>&1 | FileCheck %s
+# RUN: llc -mtriple=aarch64 -run-pass=prologepilog -run-pass=aarch64-ptrauth -o - %s 2>&1 | FileCheck %s
 --- |
   target datalayout = "e-m:e-i8:8:32-i16:16:32-i64:64-i128:128-n32:64-S128"
   target triple = "aarch64"
 
   define dso_local i32 @foo() "sign-return-address"="all" "sign-return-address-key"="a_key" {
   entry:
     ret i32 2
   }