[AArch64] - Return address signing dwarf support

[LukeCheeseman]

Summary

Functions that have signed return addresses need additional dwarf support:

• After signing the LR, and before authenticating it, the LR register is in a state the is unusable by a debugger or unwinder
• To account for this a new directive, .cfi_negate_ra_state, is added
• This directive says the signed state of the LR register has now changed, i.e. unsigned -> signed or signed -> unsigned
• This directive has the same CFA code as the SPARC directive GNU_window_save (0x2d), adding a macro to account for multiply defined codes
• This patch matches the gcc implementation of this support: https://patchwork.ozlabs.org/patch/800271/

[LukeCheeseman]

I would specifically like some feedback on the duplicated code. I couldn't find a way of adding vendor specific extensions and this seems like it may be a large change for a small result.

[LukeCheeseman]

• Don't generate cfi_negate_ra_state when using retaa
• The signing and return is combined so there isn't a correct point to emit it

[LukeCheeseman]

ping

[olista01]

I think this needs additional tests to cover:

• The encoding of the CFI instruction in object files
• The assembly parser and printer changes, to make sure that IR->assembly->object will work the same as IR->object.

lib/BinaryFormat/Dwarf.cpp

465

Does this get used by llvm-dwarfdump, or is it just for debugging? If it is used by anything user-facing, then we need to select the right one based on the target here.

lib/MC/MCParser/AsmParser.cpp

494

I think this should be done in the AArch64 assembly parser, because it doesn't apply to any other architectures.

lib/Target/AArch64/AArch64FrameLowering.cpp

896

This isn't covered by the test.

[LukeCheeseman]

• Removed the emission of negate_ra_state when emitting an AUTIASP. This causes issues when there are multiple exits from a function as the unwinder reads all the CFI directives without understanding control flow and may end up with the incorrect value in the sign state register. This isn't an issue as we currently do not support breaking on function return/tail call.
• Moved cfi_negate_ra_sign_state directive parsing into the aarch64 backend
• I haven't yet addressed the issue of printing the wrong cfi directive name with llvm-dwarfdump, I have a patch which I'm not too happy with but will upload shortly

[thegameg]

Can you please also add support for the new CFI directive in MIR? Mostly in lib/CodeGen/MIRParser/MIParser.cpp, lib/CodeGen/MIRParser/MILexer.cpp/h, lib/CodeGen/MIRPrinter.cpp and test/CodeGen/MIR/AArch64/cfi.mir.

Also, probably a MIR test with -run-pass prologepilog would be good.

[LukeCheeseman]

• Add MIR support (lexing, parsing and printing) for CFI negate_ra_sign_state
• Added MIR tests
• Added patch to print the correct CFI name given the target architecture of the object file being dumper:
  • This solution isn't pretty, the issue is that the dumping doesn't have any notion of context. I attempted to create a DwarfDumper class with vendor specific subclasses but this ended up needing significant plumbing and rework to many, far reaching places, in the LLVM code base.
  • I've opted here to pass through only the information that is required to make the dumping decision, in this case the architecture. The DW_CFA_DUP macro now takes a predicate that can be defined for selecting the vendor specific extension
  • An alternative to this is to just accept that the output is incorrect, this doesn't look to have any issues beyond printing the wrong string. Notably it is not an issue for target specific parsing/printing, only when dumping a file via llvm-dwarfdump. Even if overlapping encodings behaved differently (e.g. differing numbers of operands) the dumping would not be any more incorrect that just printing the wrong name. Whilst not a motivating point, it should be highlighted that this is the way that GNU tools handle overlapping encodings, i.e. the encoding not defined as a DUP is used.
  • I've extend a test to check for the correct string be printed

[olista01]

include/llvm/BinaryFormat/Dwarf.def

89

Maybe HANDLE_DW_CFA_TARGET or HANDLE_DW_CFA_PRED would be a better name for this?

829

Now that we have a way to represent target-specific opcodes, should we limit these to their respective targets? I think that GNU_window_save is PowerPC-specific, and GNU_args_size is X86-specific.

lib/BinaryFormat/Dwarf.cpp

460

Should this be #undef'd after these includes? The other macros are cleared at the end of Dwarf.def, but this one isn't.

460

I think this also needs to check Triple::aarch64_be.

lib/Target/AArch64/AsmParser/AArch64AsmParser.cpp

5290 ↗

(On Diff #164376)

The assembly parsing isn't covered by any of the tests.

5292 ↗

(On Diff #164376)

Do we need to check that we are at AsmToken::EndOfStatement (as is done for other directives), or is that checked somewhere else?

tools/llvm-readobj/DwarfCFIEHPrinter.h

190 ↗

(On Diff #164376)

Long line, please clang-format this.

[LukeCheeseman]

Added tests for assembly parsing
Added predicates for the other dwarf vendor extensions

[JDevlieghere]

include/llvm/BinaryFormat/Dwarf.def

834

It doesn't seem right that these two predicates have the same ID?

[LukeCheeseman]

include/llvm/BinaryFormat/Dwarf.def

834

The two directives are provided by two different vendors. Although it makes selecting the correct one for dumping require more information, I think this is legal based on the DWARF standard. This is also the encoding used for the GNU patch that provides the same functionality (see https://github.com/gcc-mirror/gcc/blob/f47edbb56126b7e8564f22b0b9d55565a995b7f0/include/dwarf2.def)

[thegameg]

test/CodeGen/MIR/AArch64/return-address-signing.mir

12 ↗

(On Diff #165511)

Are all the attributes needed here? I assume only the sign-* are.

48 ↗

(On Diff #165511)

A lot of these are not needed here. In order to dump the MIR file you can use -simplify-mir with -stop-before or -stop-after to skip all the default values.

[LukeCheeseman]

• Reduce MIR test case

[olista01]

LGTM, thanks!

include/llvm/BinaryFormat/Dwarf.h

 enum RangeListEntries {
 #define HANDLE_DW_RLE(ID, NAME) DW_RLE_##NAME = ID,
 #include "llvm/BinaryFormat/Dwarf.def"
 };
 
 /// Call frame instruction encodings.
 enum CallFrameInfo {
 #define HANDLE_DW_CFA(ID, NAME) DW_CFA_##NAME = ID,
+#define HANDLE_DW_CFA_DUP(ID, NAME) DW_CFA_##NAME = ID,
 #include "llvm/BinaryFormat/Dwarf.def"
   DW_CFA_extended = 0x00,
 
   DW_CFA_lo_user = 0x1c,
   DW_CFA_hi_user = 0x3f
 };
 
 enum Constants {

include/llvm/BinaryFormat/Dwarf.def

 
 // TODO: Add other DW-based macros.
 #if !(                                                                         \
     defined HANDLE_DW_TAG || defined HANDLE_DW_AT || defined HANDLE_DW_FORM || \
     defined HANDLE_DW_OP || defined HANDLE_DW_LANG || defined HANDLE_DW_ATE || \
     defined HANDLE_DW_VIRTUALITY || defined HANDLE_DW_DEFAULTED ||             \
     defined HANDLE_DW_CC || defined HANDLE_DW_LNS || defined HANDLE_DW_LNE ||  \
     defined HANDLE_DW_LNCT || defined HANDLE_DW_MACRO ||                       \
-    defined HANDLE_DW_RLE || defined HANDLE_DW_CFA ||                          \
+    defined HANDLE_DW_RLE ||                                                   \
+    (defined HANDLE_DW_CFA && defined HANDLE_DW_CFA_DUP) ||                    \
     defined HANDLE_DW_APPLE_PROPERTY || defined HANDLE_DW_UT ||                \
     defined HANDLE_DWARF_SECTION || defined HANDLE_DW_IDX)
 #error "Missing macro definition of HANDLE_DW*"
 #endif
 
 #ifndef HANDLE_DW_TAG
 #define HANDLE_DW_TAG(ID, NAME, VERSION, VENDOR)
 #endif

 #ifndef HANDLE_DW_RLE
 #define HANDLE_DW_RLE(ID, NAME)
 #endif
 
 #ifndef HANDLE_DW_CFA
 #define HANDLE_DW_CFA(ID, NAME)
 #endif
 
+#ifndef HANDLE_DW_CFA_DUP
+#define HANDLE_DW_CFA_DUP(ID, NAME)
+#endif
+
 #ifndef HANDLE_DW_APPLE_PROPERTY
 #define HANDLE_DW_APPLE_PROPERTY(ID, NAME)
 #endif
 
 #ifndef HANDLE_DW_UT
 #define HANDLE_DW_UT(ID, NAME)
 #endif
 

 HANDLE_DW_CFA(0x10, expression)
 HANDLE_DW_CFA(0x11, offset_extended_sf)
 HANDLE_DW_CFA(0x12, def_cfa_sf)
 HANDLE_DW_CFA(0x13, def_cfa_offset_sf)
 HANDLE_DW_CFA(0x14, val_offset)
 HANDLE_DW_CFA(0x15, val_offset_sf)
 HANDLE_DW_CFA(0x16, val_expression)
 // Vendor extensions:
 HANDLE_DW_CFA(0x1d, MIPS_advance_loc8)
 HANDLE_DW_CFA(0x2d, GNU_window_save)
+HANDLE_DW_CFA_DUP(0x2d, AARCH64_negate_ra_state)
 HANDLE_DW_CFA(0x2e, GNU_args_size)
 
 // Apple Objective-C Property Attributes.
 // Keep this list in sync with clang's DeclSpec.h ObjCPropertyAttributeKind!
 HANDLE_DW_APPLE_PROPERTY(0x01, readonly)
 HANDLE_DW_APPLE_PROPERTY(0x02, getter)
 HANDLE_DW_APPLE_PROPERTY(0x04, assign)
 HANDLE_DW_APPLE_PROPERTY(0x08, readwrite)
 HANDLE_DW_APPLE_PROPERTY(0x10, retain)
 HANDLE_DW_APPLE_PROPERTY(0x20, copy)
 HANDLE_DW_APPLE_PROPERTY(0x40, nonatomic)

 #undef HANDLE_DW_DEFAULTED
 #undef HANDLE_DW_CC
 #undef HANDLE_DW_LNS
 #undef HANDLE_DW_LNE
 #undef HANDLE_DW_LNCT
 #undef HANDLE_DW_MACRO
 #undef HANDLE_DW_RLE
 #undef HANDLE_DW_CFA
+#undef HANDLE_DW_CFA_DUP
 #undef HANDLE_DW_APPLE_PROPERTY
 #undef HANDLE_DW_UT
 #undef HANDLE_DWARF_SECTION
 #undef HANDLE_DW_IDX

include/llvm/MC/MCDwarf.h

enum OpType {
     OpDefCfa,
     OpRelOffset,
     OpAdjustCfaOffset,
     OpEscape,
     OpRestore,
     OpUndefined,
     OpRegister,
     OpWindowSave,
+    OpNegateRAState,
     OpGnuArgsSize
   };
 
 private:
   OpType Operation;
   MCSymbol *Label;
   unsigned Register;
   union {
static MCCFIInstruction createRegister(MCSymbol *L, unsigned Register1,
     return MCCFIInstruction(OpRegister, L, Register1, Register2);
   }
 
   /// .cfi_window_save SPARC register window is saved.
   static MCCFIInstruction createWindowSave(MCSymbol *L) {
     return MCCFIInstruction(OpWindowSave, L, 0, 0, "");
   }
 
+  /// .cfi_negate_ra_state AArch64 negate RA state.
+  static MCCFIInstruction createNegateRAState(MCSymbol *L) {
+    return MCCFIInstruction(OpNegateRAState, L, 0, 0, "");
+  }
+
   /// .cfi_restore says that the rule for Register is now the same as it
   /// was at the beginning of the function, after all initial instructions added
   /// by .cfi_startproc were executed.
   static MCCFIInstruction createRestore(MCSymbol *L, unsigned Register) {
     return MCCFIInstruction(OpRestore, L, Register, 0, "");
   }
 
   /// .cfi_undefined From now on the previous value of Register can't be

include/llvm/MC/MCStreamer.h

public:
   virtual void EmitCFIAdjustCfaOffset(int64_t Adjustment);
   virtual void EmitCFIEscape(StringRef Values);
   virtual void EmitCFIReturnColumn(int64_t Register);
   virtual void EmitCFIGnuArgsSize(int64_t Size);
   virtual void EmitCFISignalFrame();
   virtual void EmitCFIUndefined(int64_t Register);
   virtual void EmitCFIRegister(int64_t Register1, int64_t Register2);
   virtual void EmitCFIWindowSave();
+  virtual void EmitCFINegateRAState();
 
   virtual void EmitWinCFIStartProc(const MCSymbol *Symbol, SMLoc Loc = SMLoc());
   virtual void EmitWinCFIEndProc(SMLoc Loc = SMLoc());
   virtual void EmitWinCFIStartChained(SMLoc Loc = SMLoc());
   virtual void EmitWinCFIEndChained(SMLoc Loc = SMLoc());
   virtual void EmitWinCFIPushReg(unsigned Register, SMLoc Loc = SMLoc());
   virtual void EmitWinCFISetFrame(unsigned Register, unsigned Offset,
                                   SMLoc Loc = SMLoc());

lib/BinaryFormat/Dwarf.cpp

#define HANDLE_DW_RLE(ID, NAME)                                                \
   case DW_RLE_##NAME:                                                          \
     return "DW_RLE_" #NAME;
 #include "llvm/BinaryFormat/Dwarf.def"
   }
 }
 
 StringRef llvm::dwarf::CallFrameString(unsigned Encoding) {
   switch (Encoding) {
   default:
     return StringRef();
 #define HANDLE_DW_CFA(ID, NAME)                                                \
   case DW_CFA_##NAME:                                                          \
     return "DW_CFA_" #NAME;
+#define HANDLE_DW_CFA_DUP(ID, NAME)
 #include "llvm/BinaryFormat/Dwarf.def"
   }
 }
 
 StringRef llvm::dwarf::ApplePropertyString(unsigned Prop) {
   switch (Prop) {
   default:
     return StringRef();

lib/CodeGen/AsmPrinter/AsmPrinterDwarf.cpp

case MCCFIInstruction::OpOffset:
     OutStreamer->EmitCFIOffset(Inst.getRegister(), Inst.getOffset());
     break;
   case MCCFIInstruction::OpRegister:
     OutStreamer->EmitCFIRegister(Inst.getRegister(), Inst.getRegister2());
     break;
   case MCCFIInstruction::OpWindowSave:
     OutStreamer->EmitCFIWindowSave();
     break;
+  case MCCFIInstruction::OpNegateRAState:
+    OutStreamer->EmitCFINegateRAState();
+    break;
   case MCCFIInstruction::OpSameValue:
     OutStreamer->EmitCFISameValue(Inst.getRegister());
     break;
   case MCCFIInstruction::OpGnuArgsSize:
     OutStreamer->EmitCFIGnuArgsSize(Inst.getOffset());
     break;
   case MCCFIInstruction::OpEscape:
     OutStreamer->EmitCFIEscape(Inst.getValues());

lib/CodeGen/CFIInstrInserter.cpp

#endif
       case MCCFIInstruction::OpSameValue:
       case MCCFIInstruction::OpOffset:
       case MCCFIInstruction::OpRelOffset:
       case MCCFIInstruction::OpEscape:
       case MCCFIInstruction::OpRestore:
       case MCCFIInstruction::OpUndefined:
       case MCCFIInstruction::OpRegister:
       case MCCFIInstruction::OpWindowSave:
+      case MCCFIInstruction::OpNegateRAState:
       case MCCFIInstruction::OpGnuArgsSize:
         break;
       }
     }
   }
 
   MBBInfo.Processed = true;
 

lib/MC/MCAsmStreamer.cpp

public:
   void EmitCFIRelOffset(int64_t Register, int64_t Offset) override;
   void EmitCFIAdjustCfaOffset(int64_t Adjustment) override;
   void EmitCFIEscape(StringRef Values) override;
   void EmitCFIGnuArgsSize(int64_t Size) override;
   void EmitCFISignalFrame() override;
   void EmitCFIUndefined(int64_t Register) override;
   void EmitCFIRegister(int64_t Register1, int64_t Register2) override;
   void EmitCFIWindowSave() override;
+  void EmitCFINegateRAState() override;
   void EmitCFIReturnColumn(int64_t Register) override;
 
   void EmitWinCFIStartProc(const MCSymbol *Symbol, SMLoc Loc) override;
   void EmitWinCFIEndProc(SMLoc Loc) override;
   void EmitWinCFIStartChained(SMLoc Loc) override;
   void EmitWinCFIEndChained(SMLoc Loc) override;
   void EmitWinCFIPushReg(unsigned Register, SMLoc Loc) override;
   void EmitWinCFISetFrame(unsigned Register, unsigned Offset,

 }
 
 void MCAsmStreamer::EmitCFIWindowSave() {
   MCStreamer::EmitCFIWindowSave();
   OS << "\t.cfi_window_save";
   EmitEOL();
 }
 
+void MCAsmStreamer::EmitCFINegateRAState() {
+  MCStreamer::EmitCFINegateRAState();
+  OS << "\t.cfi_negate_ra_state";
+  EmitEOL();
+}
+
 void MCAsmStreamer::EmitCFIReturnColumn(int64_t Register) {
   MCStreamer::EmitCFIReturnColumn(Register);
   OS << "\t.cfi_return_column " << Register;
   EmitEOL();
 }
 
 void MCAsmStreamer::EmitWinCFIStartProc(const MCSymbol *Symbol, SMLoc Loc) {
   MCStreamer::EmitWinCFIStartProc(Symbol, Loc);

lib/MC/MCDwarf.cpp

case MCCFIInstruction::OpRegister: {
     Streamer.EmitULEB128IntValue(Reg1);
     Streamer.EmitULEB128IntValue(Reg2);
     return;
   }
   case MCCFIInstruction::OpWindowSave:
     Streamer.EmitIntValue(dwarf::DW_CFA_GNU_window_save, 1);
     return;
 
+  case MCCFIInstruction::OpNegateRAState:
+    Streamer.EmitIntValue(dwarf::DW_CFA_AARCH64_negate_ra_state, 1);
+    return;
+
   case MCCFIInstruction::OpUndefined: {
     unsigned Reg = Instr.getRegister();
     Streamer.EmitIntValue(dwarf::DW_CFA_undefined, 1);
     Streamer.EmitULEB128IntValue(Reg);
     return;
   }
   case MCCFIInstruction::OpAdjustCfaOffset:
   case MCCFIInstruction::OpDefCfaOffset: {

lib/MC/MCParser/AsmParser.cpp

enum DirectiveKind {
     DK_CFI_SAME_VALUE,
     DK_CFI_RESTORE,
     DK_CFI_ESCAPE,
     DK_CFI_RETURN_COLUMN,
     DK_CFI_SIGNAL_FRAME,
     DK_CFI_UNDEFINED,
     DK_CFI_REGISTER,
     DK_CFI_WINDOW_SAVE,
+    DK_CFI_NEGATE_RA_STATE,
     DK_MACROS_ON,
     DK_MACROS_OFF,
     DK_ALTMACRO,
     DK_NOALTMACRO,
     DK_MACRO,
     DK_EXITM,
     DK_ENDM,
     DK_ENDMACRO,
private:
   bool parseDirectiveCVStringTable();
   bool parseDirectiveCVFileChecksums();
   bool parseDirectiveCVFileChecksumOffset();
   bool parseDirectiveCVFPOData();
 
   // .cfi directives
   bool parseDirectiveCFIRegister(SMLoc DirectiveLoc);
   bool parseDirectiveCFIWindowSave();
+  bool parseDirectiveCFINegateRAState();
   bool parseDirectiveCFISections();
   bool parseDirectiveCFIStartProc();
   bool parseDirectiveCFIEndProc();
   bool parseDirectiveCFIDefCfaOffset();
   bool parseDirectiveCFIDefCfa(SMLoc DirectiveLoc);
   bool parseDirectiveCFIAdjustCfaOffset();
   bool parseDirectiveCFIDefCfaRegister(SMLoc DirectiveLoc);
   bool parseDirectiveCFIOffset(SMLoc DirectiveLoc);
if (IDVal[0] == '.' && IDVal != ".") {
     case DK_CFI_SIGNAL_FRAME:
       return parseDirectiveCFISignalFrame();
     case DK_CFI_UNDEFINED:
       return parseDirectiveCFIUndefined(IDLoc);
     case DK_CFI_REGISTER:
       return parseDirectiveCFIRegister(IDLoc);
     case DK_CFI_WINDOW_SAVE:
       return parseDirectiveCFIWindowSave();
+    case DK_CFI_NEGATE_RA_STATE:
+      return parseDirectiveCFINegateRAState();
     case DK_MACROS_ON:
     case DK_MACROS_OFF:
       return parseDirectiveMacrosOnOff(IDVal);
     case DK_MACRO:
       return parseDirectiveMacro(IDLoc);
     case DK_ALTMACRO:
     case DK_NOALTMACRO:
       return parseDirectiveAltmacro(IDVal);

 
 /// parseDirectiveCFIWindowSave
 /// ::= .cfi_window_save
 bool AsmParser::parseDirectiveCFIWindowSave() {
   getStreamer().EmitCFIWindowSave();
   return false;
 }
 
+/// parseDirectiveCFINegateRAState
+/// ::= .cfi_negate_ra_state
+bool AsmParser::parseDirectiveCFINegateRAState() {
+  getStreamer().EmitCFINegateRAState();
+  return false;
+}
+
 /// parseDirectiveCFIAdjustCfaOffset
 /// ::= .cfi_adjust_cfa_offset adjustment
 bool AsmParser::parseDirectiveCFIAdjustCfaOffset() {
   int64_t Adjustment = 0;
   if (parseAbsoluteExpression(Adjustment))
     return true;
 
   getStreamer().EmitCFIAdjustCfaOffset(Adjustment);
void AsmParser::initializeDirectiveKindMap() {
   DirectiveKindMap[".cfi_same_value"] = DK_CFI_SAME_VALUE;
   DirectiveKindMap[".cfi_restore"] = DK_CFI_RESTORE;
   DirectiveKindMap[".cfi_escape"] = DK_CFI_ESCAPE;
   DirectiveKindMap[".cfi_return_column"] = DK_CFI_RETURN_COLUMN;
   DirectiveKindMap[".cfi_signal_frame"] = DK_CFI_SIGNAL_FRAME;
   DirectiveKindMap[".cfi_undefined"] = DK_CFI_UNDEFINED;
   DirectiveKindMap[".cfi_register"] = DK_CFI_REGISTER;
   DirectiveKindMap[".cfi_window_save"] = DK_CFI_WINDOW_SAVE;
+  DirectiveKindMap[".cfi_negate_ra_state"] = DK_CFI_NEGATE_RA_STATE;
   DirectiveKindMap[".macros_on"] = DK_MACROS_ON;
   DirectiveKindMap[".macros_off"] = DK_MACROS_OFF;
   DirectiveKindMap[".macro"] = DK_MACRO;
   DirectiveKindMap[".exitm"] = DK_EXITM;
   DirectiveKindMap[".endm"] = DK_ENDM;
   DirectiveKindMap[".endmacro"] = DK_ENDMACRO;
   DirectiveKindMap[".purgem"] = DK_PURGEM;
   DirectiveKindMap[".err"] = DK_ERR;

lib/MC/MCStreamer.cpp

void MCStreamer::EmitCFIWindowSave() {
   MCCFIInstruction Instruction =
     MCCFIInstruction::createWindowSave(Label);
   MCDwarfFrameInfo *CurFrame = getCurrentDwarfFrameInfo();
   if (!CurFrame)
     return;
   CurFrame->Instructions.push_back(Instruction);
 }
 
+void MCStreamer::EmitCFINegateRAState() {
+  MCSymbol *Label = EmitCFILabel();
+  MCCFIInstruction Instruction = MCCFIInstruction::createNegateRAState(Label);
+  MCDwarfFrameInfo *CurFrame = getCurrentDwarfFrameInfo();
+  if (!CurFrame)
+    return;
+  CurFrame->Instructions.push_back(Instruction);
+}
+
 void MCStreamer::EmitCFIReturnColumn(int64_t Register) {
   MCDwarfFrameInfo *CurFrame = getCurrentDwarfFrameInfo();
   if (!CurFrame)
     return;
   CurFrame->RAReg = Register;
 }
 
 WinEH::FrameInfo *MCStreamer::EnsureValidWinFrameInfo(SMLoc Loc) {

lib/Target/AArch64/AArch64FrameLowering.cpp

void AArch64FrameLowering::emitPrologue(MachineFunction &MF,
 
   // Debug location must be unknown since the first debug location is used
   // to determine the end of the prologue.
   DebugLoc DL;
 
   if (ShouldSignReturnAddress(MF)) {
     BuildMI(MBB, MBBI, DL, TII->get(AArch64::PACIASP))
         .setMIFlag(MachineInstr::FrameSetup);
+
+    unsigned CFIIndex =
+        MF.addFrameInst(MCCFIInstruction::createNegateRAState(nullptr));
+    BuildMI(MBB, MBBI, DL, TII->get(TargetOpcode::CFI_INSTRUCTION))
+        .addCFIIndex(CFIIndex)
+        .setMIFlags(MachineInstr::FrameSetup);
   }
 
   // All calls are tail calls in GHC calling conv, and functions have no
   // prologue/epilogue.
   if (MF.getFunction().getCallingConv() == CallingConv::GHC)
     return;
 
   int NumBytes = (int)MFI.getStackSize();
static void InsertReturnAddressAuth(MachineFunction &MF,
   // instructions, namely RETA{A,B}, that can be used instead.
   if (Subtarget.hasV8_3aOps() && MBBI != MBB.end() &&
       MBBI->getOpcode() == AArch64::RET_ReallyLR) {
     BuildMI(MBB, MBBI, DL, TII->get(AArch64::RETAA)).copyImplicitOps(*MBBI);
     MBB.erase(MBBI);
   } else {
     BuildMI(MBB, MBBI, DL, TII->get(AArch64::AUTIASP))
         .setMIFlag(MachineInstr::FrameDestroy);
+
+    unsigned CFIIndex =
+        MF.addFrameInst(MCCFIInstruction::createNegateRAState(nullptr));
+    BuildMI(MBB, MBBI, DL, TII->get(TargetOpcode::CFI_INSTRUCTION))
+        .addCFIIndex(CFIIndex)
+        .setMIFlags(MachineInstr::FrameSetup);
   }
 }
 
 void AArch64FrameLowering::emitEpilogue(MachineFunction &MF,
                                         MachineBasicBlock &MBB) const {
   MachineBasicBlock::iterator MBBI = MBB.getLastNonDebugInstr();
   MachineFrameInfo &MFI = MF.getFrameInfo();
   const AArch64Subtarget &Subtarget = MF.getSubtarget<AArch64Subtarget>();

test/CodeGen/AArch64/sign-return-address-cfi-negate-ra-state.ll

+; RUN: llc -mtriple=aarch64-none-eabi < %s | FileCheck %s
+
+@.str = private unnamed_addr constant [15 x i8] c"some exception\00", align 1
+@_ZTIPKc = external dso_local constant i8*
+
+; CHECK: @_Z3fooi
+; CHECK: paciasp
+; CHECK-NEXT: .cfi_negate_ra_state
+define dso_local i32 @_Z3fooi(i32 %x) #0 {
+entry:
+  %retval = alloca i32, align 4
+  %x.addr = alloca i32, align 4
+  store i32 %x, i32* %x.addr, align 4
+  %exception = call i8* @__cxa_allocate_exception(i64 8) #1
+  %0 = bitcast i8* %exception to i8**
+  store i8* getelementptr inbounds ([15 x i8], [15 x i8]* @.str, i32 0, i32 0), i8** %0, align 16
+  call void @__cxa_throw(i8* %exception, i8* bitcast (i8** @_ZTIPKc to i8*), i8* null) #2
+  unreachable
+
+return:                                           ; No predecessors!
+  %1 = load i32, i32* %retval, align 4
+  ret i32 %1
+}
+
+declare dso_local i8* @__cxa_allocate_exception(i64)
+
+declare dso_local void @__cxa_throw(i8*, i8*, i8*)
+
+attributes #0 = { "sign-return-address"="all" }

test/CodeGen/AArch64/sign-return-address.ll

 ; CHECK-NOT: auti{{[a,b]}}sp
 define i32 @leaf_sign_non_leaf(i32 %x) "sign-return-address"="non-leaf"  {
   ret i32 %x
 }
 
 ; CHECK-LABEL: @leaf_sign_all
 ; CHECK: paciasp
 ; CHECK: autiasp
-; CHECK-NEXT: ret
+; CHECK: ret
 define i32 @leaf_sign_all(i32 %x) "sign-return-address"="all" {
   ret i32 %x
 }
 
 ; CHECK: @leaf_clobbers_lr
 ; CHECK: paciasp
-; CHECK-NEXT: str x30, [sp, #-16]!
+; CHECK: str x30, [sp, #-16]!
 ; CHECK: ldr  x30, [sp], #16
 ; CHECK-NEXT: autiasp
-; CHECK-NEXT: ret
+; CHECK: ret
 define i64 @leaf_clobbers_lr(i64 %x) "sign-return-address"="non-leaf"  {
   call void asm sideeffect "mov x30, $0", "r,~{lr}"(i64 %x) #1
   ret i64 %x
 }
 
 declare i32 @foo(i32)
 
 ; CHECK: @non_leaf_sign_all
 ; CHECK: paciasp
 ; CHECK: autiasp
-; CHECK-NEXT: ret
+; CHECK: ret
 define i32 @non_leaf_sign_all(i32 %x) "sign-return-address"="all" {
   %call = call i32 @foo(i32 %x)
   ret i32 %call
 }
 
 ; CHECK: @non_leaf_sign_non_leaf
 ; CHECK: paciasp
-; CHECK-NEXT: str x30, [sp, #-16]!
+; CHECK: str x30, [sp, #-16]!
 ; CHECK: ldr  x30, [sp], #16
-; CHECK-NEXT: autiasp
-; CHECK-NEXT: ret
+; CHECK: autiasp
+; CHECK: ret
 define i32 @non_leaf_sign_non_leaf(i32 %x) "sign-return-address"="non-leaf"  {
   %call = call i32 @foo(i32 %x)
   ret i32 %call
 }
 
 ; CHECK-LABEL: @leaf_sign_all_v83
 ; CHECK: paciasp
 ; CHECK-NOT: ret
-; CHECK-NEXT: retaa
+; CHECK: retaa
 ; CHECK-NOT: ret
 define i32 @leaf_sign_all_v83(i32 %x) "sign-return-address"="all" "target-features"="+v8.3a" {
   ret i32 %x
 }
 
 declare fastcc i64 @bar(i64)
 
 ; CHECK-LABEL: @spill_lr_and_tail_call
 ; CHECK: paciasp
-; CHECK-NEXT: str x30, [sp, #-16]!
+; CHECK: str x30, [sp, #-16]!
 ; CHECK: ldr  x30, [sp], #16
-; CHECK-NEXT: autiasp
-; CHECK-NEXT: b  bar
+; CHECK: autiasp
+; CHECK: b  bar
 define fastcc void @spill_lr_and_tail_call(i64 %x) "sign-return-address"="all" {
   call void asm sideeffect "mov x30, $0", "r,~{lr}"(i64 %x) #1
   tail call fastcc i64 @bar(i64 %x)
   ret void
 }