[LLD][ELF][AArch64] Support for BTI and PAC

[peter.smith]

Summary

Branch Target Identification (BTI) and Pointer Authentication (PAC) are architecture features introduced in v8.5a and 8.3a respectively. The new instructions have been added in the hint space so that binaries take advantage of support where it exists yet still run on older hardware.

The impact of each feature is:

• BTI: For executable pages that have been guarded, all indirect branches must have a destination that is a BTI instruction of the appropriate type. For the static linker, this means that PLT entries must have a "BTI c" as the first instruction in the sequence. BTI is an all or nothing property for a link unit, any indirect branch not landing on a valid destination will cause a Branch Target Exception.
• PAC: The dynamic loader encodes with PACIA the address of the destination that the PLT entry will load from the .plt.got, placing the result in a subset of the top-bits that are not valid virtual addresses. The PLT entry may authenticate these top-bits using the AUTIA instruction before branching to the destination. Use of PAC in PLT sequences is a contract between the dynamic loader and the static linker, it is independent of whether the relocatable objects use PAC.

BTI and PAC are independent features that can be combined. So we can have several combinations of PLT:

• Standard with no BTI or PAC
• BTI PLT with "BTI c" as first instruction.
• PAC PLT with "AUTIA1716" before the indirect branch to X17.
• BTIPAC PLT with "BTI c" as first instruction and "AUTIA1716" before the first indirect branch to X17.

The use of BTI and PAC in relocatable object files are encoded by feature bits in the .note.gnu.property section in a similar way to Intel CET. There is one AArch64 specific program property GNU_PROPERTY_AARCH64_FEATURE_1_AND and two target feature bits defined:

• GNU_PROPERTY_AARCH64_FEATURE_1_BTI
  • All executable sections are compatible with BTI.
• GNU_PROPERTY_AARCH64_FEATURE_1_PAC
  • All executable sections have return address signing enabled.

Due to the properties of FEATURE_1_AND the static linker can tell when all input relocatable objects have the BTI and PAC feature bits set. The static linker uses this to enable the appropriate PLT sequence.

• Neither -> standard PLT
• GNU_PROPERTY_AARCH64_FEATURE_1_BTI -> BTI PLT
• GNU_PROPERTY_AARCH64_FEATURE_1_PAC -> PAC PLT
• Both properties -> BTIPAC PLT

In addition to the .note.gnu.properties there are two new command line options:
--force-bti : Act as if all relocatable inputs had GNU_PROPERTY_AARCH64_FEATURE_1_BTI and warn for every relocatable object that does not.
--pac-plt : Act as if all relocatable inputs had GNU_PROPERTY_AARCH64_FEATURE_1_PAC. As PAC is a contract between the loader and static linker no warning is given if it is not present in an input.

Two processor specific dynamic tags are used to communicate that a non standard PLT sequence is being used. DTI_AARCH64_BTI_PLT and DTI_AARCH64_BTI_PAC.

Implementation Notes:
Depends on llvm revisions for the properties, tags, llvm-readobj and llvm-objdump support D62595 D62596 D62598
Depends on lld revision D59780 for the .note.gnu.property implementation. I can remove the Intel CET code if it makes this easier to review?

For the changes to .note.gnu.property:

• There were some test cases in ld.bfd whereupon a single relocatable object file could have more than on FEATURE_1_AND in the .note.gnu.property section. The result for the relocatable object file was to set the bit for the object if it was set in any of the FEATURE_1_AND properties. I've altered LLD to handle multiple FEATURE_1_AND properties in the same file and added some test cases for that.
• There may be some merit in not merging the FEATURE_1_AND output into AndFeatures, instead we'd have X86Features and AArch64Features. This would make some of the if (Config->EMachine) checks go away but would mean more changes to the note parsing code.

For the command line options:

• They have been implemented to match the ld.bfd options ([PATCH, BFD, LD, AArch64, 0/4] Add support for AArch64 BTI and PAC in the linker) note that the command line options changed over the patch review cycle.
• The --force-bti option is intended for projects that may end up with assembler files without .note.gnu.property sections. A warning was chosen rather than an error to ease the initial porting effort for a project.
• There is scope to implement a --require-bti option like --require-cet that gives an error rather than warning.

For the PLT sequences:

• ld.bfd does not put "bti c" on the plt[N] entries when --pie is used. This is because ld.bfd can guarantee that the PLT address won't escape, however there is one small case in LLD where an ifunc has its address taken using a non-got reference when the PLT address can escape. There is potential for optimisation there, but at the moment we have to choose the PLT size early so it isn't easy to apply.

• The properties, features and dynamic tags are documented in: https://developer.arm.com/docs/ihi0056/latest/elf-for-the-arm-64-bit-architecture-aarch64-abi-2019q1-documentation
• The BTI and AUTIA instruction encoding is documented in https://static.docs.arm.com/ddi0596/a/DDI_0596_ARM_a64_instruction_set_architecture.pdf
• There is some documentation available on PAC in the general case https://events.static.linuxfound.org/sites/events/files/slides/slides_23.pdf
• BTI and PAC have some support in QEMU4.0 https://www.qemu.org/2019/04/24/qemu-4-0-0/

[MaskRay]

test/ELF/aarch64-feature-bti.s

13

Consider llvm-readelf -x .got.plt

45

Consider llvm-readelf -x .got.plt

test/ELF/aarch64-feature-btipac.s

105

This insn is misaligned.

test/ELF/aarch64-feature-pac.s

11

Consider llvm-readelf -x .got.plt

39

You may use llvm-readelf -x .got.plt to be more specific with the section you intend to dump.

74

Nit: misaligned (the nit is here just because you align such lines above..)

[peter.smith]

Thanks for the comments, I'll upload another diff with fixes.

test/ELF/aarch64-feature-bti.s

13

Thanks for the suggestion, will do.

[peter.smith]

Updated tests to align instructions and use readelf -x .got.plt.

[MaskRay]

ELF/Driver.cpp

347

What about adding

if (Config->EMachine != EM_AARCH64) {
  if (Config->PacPlt) error(...);
  if (Config->ForceBTI) error(...);
}

here? Then, below,

if (Config->EMachine == EM_AARCH64 && Config->ForceBTI &&

The Config->EMachine == EM_AARCH64 check can be removed.

docs/ld.lld.1

188

.Fl is a mdoc macro that prepends a dash., so this should be`.It Fl -force-bti` (single dash).

189

Use the full name GNU_PROPERTY_AARCH64_FEATURE_1_BTI?

390

.It Fl -pac-plt

[MaskRay]

ELF/Arch/AArch64.cpp

509

Is this autia1716?

535

Should the condition be ANDed with !Config->Shared? Currently with --force-bti a shared object may

539

Config->AndFeatures hasn't been computed when getTargetInfo is called.

Target = getTarget();
...
link<ELF64LE>(Args);  // Config->AndFeatures is computed inside this function

541

Have you considered the alternative: rather than define 4 writePlt*, define a unified one:

if Bti
  write bti c
write adrp/ldr/add
if Pac
  write autiax16x17
write br x17
write padding nop(s)

566

Is this autia1716?

ELF/Driver.cpp

1628

not 2-space indented.

I have a question: does DT_AARCH64_BTI_PLT make sense for a shared object? If not, you may apply the following here:

if (!Config->Shared)
  Ret &= ~GNU_PROPERTY_AARCH64_FEATURE_1_BTI;

If yes, in getTargetInfo(), you may want to check !Config->Shared beside GNU_PROPERTY_AARCH64_FEATURE_1_BTI.

ELF/SyntheticSections.cpp

1347

The ABI chooeses two DT_* tags (and with a value of 0! not 1) instead of a single DT_* with 2 bits seems a bit wasteful...

test/ELF/aarch64-feature-bti.s

9

In binary utility tests, people seem to start using ## to highlight comments from RUN/CHECK lines..

12

If the hex bytes in the dissassembly output are not important. consider --no-show-raw-insn

39

doesn't escape -> doesn't escape a shared object

77

.note.property -> .note.gnu.property

[MaskRay]

test/ELF/aarch64-feature-btipac.s

113

--pac-plt doesn't warn - it doesn't require support in the object files for correctness.

[MaskRay]

I am reading some binutils-gdb/bfd/elfnn-aarch64.c code as a reference. It doesn't use bti c for -pie (ET_DYN). <del>Is it intentional?</del>

It is intentional, because only indirect branch/call targets need BTI. A PIE PLT is not taken address so no BTI is needed.

static void
setup_plt_values (struct bfd_link_info *link_info,
		  aarch64_plt_type plt_type)
{
  struct elf_aarch64_link_hash_table *globals;
  globals = elf_aarch64_hash_table (link_info);

  if (plt_type == PLT_BTI_PAC)
    {
      globals->plt0_entry = elfNN_aarch64_small_plt0_bti_entry;

      /* Only in ET_EXEC we need PLTn with BTI.  */
      if (bfd_link_pde (link_info))
	{
	  globals->plt_entry_size = PLT_BTI_PAC_SMALL_ENTRY_SIZE;
	  globals->plt_entry = elfNN_aarch64_small_plt_bti_pac_entry;
	}
      else
	{
	  globals->plt_entry_size = PLT_PAC_SMALL_ENTRY_SIZE;
	  globals->plt_entry = elfNN_aarch64_small_plt_pac_entry;
	}
    }
  else if (plt_type == PLT_BTI)
    {
      globals->plt0_entry = elfNN_aarch64_small_plt0_bti_entry;

      /* Only in ET_EXEC we need PLTn with BTI.  */
      if (bfd_link_pde (link_info))
	{
	  globals->plt_entry_size = PLT_BTI_SMALL_ENTRY_SIZE;
	  globals->plt_entry = elfNN_aarch64_small_plt_bti_entry;
	}
    }
  else if (plt_type == PLT_PAC)
    {
      globals->plt_entry_size = PLT_PAC_SMALL_ENTRY_SIZE;
      globals->plt_entry = elfNN_aarch64_small_plt_pac_entry;
    }
}

[peter.smith]

In D62609#1526262, @MaskRay wrote:

I am reading some binutils-gdb/bfd/elfnn-aarch64.c code as a reference. It doesn't use bti c for -pie (ET_DYN). <del>Is it intentional?</del>

It is intentional, because only indirect branch/call targets need BTI. A PIE PLT is not taken address so no BTI is needed.

Yes this is intentional in BFD. Unfortunately clang can take the address of a non-preemptible ifunc with a non-got generating relocation with -fpie (case when the function is defined in the same object file so the compiler knows it won't be in the DSO), in this case LLD will make the PLT canonical (see Relocations.cpp // Handle a reference to a non-preemptible ifunc), and if a DSO also takes the address of the ifunc then the PLT address can leak to the DSO. I've put this as test/ELF/aarch64-ifunc-bti.s

There are some optimizations that could be performed, assuming an early scan of the relocations is not done for linker performance reasons:

• Detect when the PLT address might escape and only put the "BTI c" at the head of the entry if it does. Note that we still need to use the larger size as we may have used it before the PLT entry size has been used.
• Add a command line option that asserts that the program never indirect branches to an escaped PLT entry, or make the reverse assumption and the user has to say

I'm happy to do one of these either in this or a follow up patch.

[MaskRay]

ELF/Driver.cpp

347

You may ignore the comment above. The Config->EMachine == EM_AARCH64 check below cannot be removed.

[peter.smith]

Thanks very much for the comments and questions. I'll upload a new patch in a second.

ELF/Arch/AArch64.cpp

509

Yes it is thanks.

535

No. PLT[n] does an indirect branch "br x17" the destination of which will be PLT[0] in the case of lazy loading. I guess with -zbind-now this could be done.

Standard PLT entry for reference.

adrp x16, Page(&(.plt.got[n]))
ldr  x17, [x16, Offset(&(.plt.got[n]))]
add  x16, x16, Offset(&(.plt.got[n]))
br   x17  // Indirect branch, possibly to PLT[0]

539

At the moment getTarget() is called in two places. The first time will get the AArch64, the second will get AArch64BtiPac. I think that this is ok as the only difference is the PLT generation and that only matters later in the link. The same will be the case for the Intel CET patch D59780

Not sure if there is a good way around this yet.

541

I did try that at first, the disadvantage, particularly for the BTI is that the offsets for the relocations change and it gets a bit messy. Not overly so, but more difficult to follow on first reading. I'm happy to do that if you'd prefer?

566

Yes it is thanks. The 1716, means authorize x17 in the context of x16, my brain still wants to write 16 before 17.

ELF/Driver.cpp

347

Good idea, thanks.

1628

Fixed indentation, thanks for the spot.

We definitely need to propagate GNU_PROPERTY_AARCH64_FEATURE_1_BTI for shared objects, this communicates that all the input relocatable objects and any linker generated content has BTI instructions in the right place.

The PLT[0] sequence does change for shared objects as PLT[0] requires a BTI c (PLT[n] indirectly calls PLT[0]) so even for a Shared Object getTargetInfo() needs to do something different.

I guess it is possible that DT_AARCH64_BTI_PLT doesn't add a lot of value here although the wording in the ABI https://developer.arm.com/docs/ihi0056/latest/elf-for-the-arm-64-bit-architecture-aarch64-abi-2019q1-documentation requires it so I'd prefer to stick to that and ld.bfd.

ELF/SyntheticSections.cpp

1347

Possibly although there is quite a range to choose from [0x70000000, 0x80000000). My limited understanding is that two were chosen as it is faster for a dynamic loader to check for the presence, rather than check the value as well although I don't know how significant this is in practice.

docs/ld.lld.1

188

Thanks, for pointing that out, now fixed.

[peter.smith]

New patch to address review comments. Main changes:

• Updated Driver.cpp to check that --pac-plt and --force-bti are aarch64 only, add test.
• Correct number of dashes in docs
• Fix some comments
• Update tests to use ## for comments, use --no-show-raw-insn.

[MaskRay]

ELF/Arch/AArch64.cpp

541

I do prefer a unified PLT as because this is a big chunk of repetition (4x). While reading the code, I couldn't help comparing the 4 functions just to find the difference is bti/autia1716. Putting them in one place may help.

But I'd like to wait for others to comment on this.

ELF/Driver.cpp

1607–1611

the a, typo?

[ruiu]

Peter, do you want me to separate code to read AndFeatures from https://reviews.llvm.org/D59780 and submit?

[peter.smith]

In D62609#1528520, @ruiu wrote:

Peter, do you want me to separate code to read AndFeatures from https://reviews.llvm.org/D59780 and submit?

Yes please, that would decouple this patch from the CET specific work.

ELF/Arch/AArch64.cpp

541

I'll send an updated patch with a single unified PLT. If it is too complicated then we can always go back to the previous version.

ELF/Driver.cpp

1607–1611

Yes, thanks for spotting.

[ruiu]

In D62609#1528797, @peter.smith wrote:

In D62609#1528520, @ruiu wrote:

Peter, do you want me to separate code to read AndFeatures from https://reviews.llvm.org/D59780 and submit?

Yes please, that would decouple this patch from the CET specific work.

Sure, I'll send you a patch.

[peter.smith]

Updated diff with single unified PLT that optionally adds in the BTI prefix and AUTIA1716 before branch. This is less code overall as we don't have 4 similar PLT writing functions at the expense of being slightly more complicated.

[peter.smith]

Updated patch to rebase against parents D62853 and D62862

[ruiu]

ELF/Arch/AArch64.cpp

486–487

They are used only twice. We inline all other instructions. Maybe we should inline them and remove these varaibles?

512

I'm not sure whether it is intentional or a bug to not use BtiNeeded. If it's intentional, can you add a comment?

516

Looks like you can add sizeof(BtiData) to Buf and remove Pre.

567

Ditto -- do you need Pre? Pre is 0 only when !BtiNeeded, so you can use that condition instead.

ELF/Driver.cpp

1617

It looks a bit odd that a --force option only warns and is not a hard error. Is this intentional?

[peter.smith]

Thanks for the comments I'll upload a new patch shortly.

ELF/Arch/AArch64.cpp

512

I've split out BtiNeeded into BtiHeader and BtiEntry to make the intention explicit. In summary:

• BtiHeader is always needed if the FEATURE_1_BTI bit is set.
• BtiEntry is needed for non-shared libraries if the FEATURE_1_BTI bit is set.
• PacEntry is always needed if the FEATURE_1_PAC bit is set.

There is no PacHeader as we don't need to alter the header file.

516

I've updated the patch to do that. Pre also needs to be added to the Plt address so the getAArchPage(Plt + 8 + Pre) gets the right value.

ELF/Driver.cpp

1617

Yes it is intentional (behaves the same way in ld.bfd). It is intended for early adopters/experimenters with a lot of assembler files or even binary objects that do not have the appropriate .note.gnu.property, yet they are able to declare them compatible with BTI (not many functions in assembly are called indirectly). For example we have some people experimenting with bringing up Android with BTI enabled and they preferred a warning so that they could get it up and running without having to track each last assembler file down. I think over time, when the hardware is closer and more projects have decided to use BTI an option like --require-bti could be added that would behave like --require-cet.

[peter.smith]

Updated diff to split BtiNeeded into BtiHeader and BtiEntry, and removed Pre in favour of incrementing Buf.

[ruiu]

LGTM

Thank you for doing this! I can clearly see that this feature is very useful for defense-in-depth.

[MaskRay]

ELF/InputFiles.cpp

976

You may want to update this comment as well.

[peter.smith]

ELF/InputFiles.cpp

976

Thanks I'll make it more generic and will do that prior to commit.

[MaskRay]

Handle a reference to a non-preemptible ifunc), and if a DSO also takes the address of the ifunc then the PLT address can leak to the DSO. I've put this as test/ELF/aarch64-ifunc-bti.s

BtiEntry = BtiHeader && !Config->Shared;

This can be relaxed, but it will be a per-PLT property. Sym.NeedsPltAddr || Sym.IsInIplt. The problem is that writePlt doesn't pass the Symbol* argument to the target:

Target->writePlt(Buf + Off, Got, Plt, B->PltIndex, RelOff); // B itself is needed.

ELF/Arch/AArch64.cpp

 // Page(Expr) is the page address of the expression Expr, defined
 // as (Expr & ~0xFFF). (This applies even if the machine page size
 // supported by the platform has a different value.)
 uint64_t elf::getAArch64Page(uint64_t Expr) {
   return Expr & ~static_cast<uint64_t>(0xFFF);
 }
 
 namespace {
-class AArch64 final : public TargetInfo {
+class AArch64 : public TargetInfo {
 public:
   AArch64();
   RelExpr getRelExpr(RelType Type, const Symbol &S,
                      const uint8_t *Loc) const override;
   RelType getDynRel(RelType Type) const override;
   void writeGotPlt(uint8_t *Buf, const Symbol &S) const override;
   void writePltHeader(uint8_t *Buf) const override;
   void writePlt(uint8_t *Buf, uint64_t GotPltEntryAddr, uint64_t PltEntryAddr,
relocateOne(Buf + 4, R_AARCH64_ADR_PREL_PG_HI21,
               getAArch64Page(Got + 16) - getAArch64Page(Plt + 4));
   relocateOne(Buf + 8, R_AARCH64_LDST64_ABS_LO12_NC, Got + 16);
   relocateOne(Buf + 12, R_AARCH64_ADD_ABS_LO12_NC, Got + 16);
 }
 
 void AArch64::writePlt(uint8_t *Buf, uint64_t GotPltEntryAddr,
                        uint64_t PltEntryAddr, int32_t Index,
                        unsigned RelOff) const {
+  // Standard PLT entry
   const uint8_t Inst[] = {
       0x10, 0x00, 0x00, 0x90, // adrp x16, Page(&(.plt.got[n]))
       0x11, 0x02, 0x40, 0xf9, // ldr  x17, [x16, Offset(&(.plt.got[n]))]
       0x10, 0x02, 0x00, 0x91, // add  x16, x16, Offset(&(.plt.got[n]))
       0x20, 0x02, 0x1f, 0xd6  // br   x17
   };
   memcpy(Buf, Inst, sizeof(Inst));
 
if (Type == R_AARCH64_TLSIE_LD64_GOTTPREL_LO12_NC) {
     // Generate MOVK.
     uint32_t RegNo = read32le(Loc) & 0x1f;
     write32le(Loc, (0xf2800000 | RegNo) | ((Val & 0xffff) << 5));
     return;
   }
   llvm_unreachable("invalid relocation for TLS IE to LE relaxation");
 }
 
-TargetInfo *elf::getAArch64TargetInfo() {
-  static AArch64 Target;
-  return &Target;
+// AArch64 may use security features in variant PLT sequences. These are:
+// Pointer Authentication (PAC), introduced in armv8.3-a and Branch Target
+// Indicator (BTI) introduced in armv8.5-a. The additional instructions used
+// in the variant Plt sequences are encoded in the Hint space so they can be
+// deployed on older architectures, which treat the instructions as a nop.
+// PAC and BTI can be combined leading to the following combinations:
+// writePltHeader
+// writePltHeaderBti (no PAC Header needed)
+// writePlt
+// writePltBti (BTI only)
+// writePltPac (PAC only)
+// writePltBtiPac (BTI and PAC)
+//
+// When PAC is enabled the dynamic loader encrypts the address that it places
+// in the .got.plt using the pacia1716 instruction which encrypts the value in
+// x17 using the modifier in x16. The static linker places autia1716 before the
+// indirect branch to x17 to authenticate the address in x17 with the modifier
+// in x16. This makes it more difficult for an attacker to modify the value in
+// the .got.plt.
+//
+// When BTI is enabled all indirect branches must land on a bti instruction.
+// The static linker must place a bti instruction at the start of any PLT entry
+// that may be the target of an indirect branch. As the PLT entries call the
+// lazy resolver indirectly this must have a bti instruction at start. In
+// general a bti instruction is not needed for a PLT entry as indirect calls
+// are resolved to the function address and not the PLT entry for the function.
+// There are a small number of cases where the PLT address can escape, such as
+// taking the address of a function or ifunc via a non got-generating
+// relocation, and a shared library refers to that symbol.
+//
+// We use the bti c variant of the instruction which permits indirect branches
+// (br) via x16/x17 and indirect function calls (blr) via any register. The ABI
+// guarantees that all indirect branches from code requiring BTI protection
+// will go via x16/x17
+
+namespace {
+class AArch64BtiPac final : public AArch64 {
+public:
+  AArch64BtiPac();
+  void writePltHeader(uint8_t *Buf) const override;
+  void writePlt(uint8_t *Buf, uint64_t GotPltEntryAddr, uint64_t PltEntryAddr,
+                int32_t Index, unsigned RelOff) const override;
+
+private:
+  bool BtiNeeded;
+  bool PacNeeded;
+  static const uint8_t NopData[4];
+  static const uint8_t BtiData[4];
+};
+} // namespace
+
+const uint8_t AArch64BtiPac::NopData[] = { 0x1f, 0x20, 0x03, 0xd5 }; // nop
+const uint8_t AArch64BtiPac::BtiData[] = { 0x5f, 0x24, 0x03, 0xd5 }; // bti c
+
+AArch64BtiPac::AArch64BtiPac() {
+  // A BTI (Branch Target Indicator) Plt Entry is only required if the
+  // address of the PLT entry can be taken by the program, which permits an
+  // indirect jump to the PLT entry.
+  BtiNeeded = !Config->Shared &&
+    (Config->AndFeatures & GNU_PROPERTY_AARCH64_FEATURE_1_BTI);
+  PacNeeded = (Config->AndFeatures & GNU_PROPERTY_AARCH64_FEATURE_1_PAC);
+
+  if (BtiNeeded || PacNeeded)
+    PltEntrySize = 24;
 }
+
+void AArch64BtiPac::writePltHeader(uint8_t *Buf) const {
+  const uint8_t PltData[] = {
+      0xf0, 0x7b, 0xbf, 0xa9, // stp    x16, x30, [sp,#-16]!
+      0x10, 0x00, 0x00, 0x90, // adrp   x16, Page(&(.plt.got[2]))
+      0x11, 0x02, 0x40, 0xf9, // ldr    x17, [x16, Offset(&(.plt.got[2]))]
+      0x10, 0x02, 0x00, 0x91, // add    x16, x16, Offset(&(.plt.got[2]))
+      0x20, 0x02, 0x1f, 0xd6, // br     x17
+      0x1f, 0x20, 0x03, 0xd5, // nop
+      0x1f, 0x20, 0x03, 0xd5  // nop
+  };
+  size_t Pre = 0;
+  if (Config->AndFeatures & GNU_PROPERTY_AARCH64_FEATURE_1_BTI) {
+    // PltHeader is called indirectly by Plt[N]. Prefix PltData with a BTI C
+    // instruction.
+    memcpy(Buf, BtiData, sizeof(BtiData));
+    Pre = sizeof(BtiData);
+  }
+  memcpy(Buf + Pre, PltData, sizeof(PltData));
+
+  uint64_t Got = In.GotPlt->getVA();
+  uint64_t Plt = In.Plt->getVA();
+  relocateOne(Buf + 4 + Pre, R_AARCH64_ADR_PREL_PG_HI21,
+              getAArch64Page(Got + 16) - getAArch64Page(Plt + 8 + Pre));
+  relocateOne(Buf + 8 + Pre, R_AARCH64_LDST64_ABS_LO12_NC, Got + 16);
+  relocateOne(Buf + 12 + Pre, R_AARCH64_ADD_ABS_LO12_NC, Got + 16);
+  if (Pre == 0)
+    // We didn't add the BTI c instruction so round out size with NOP.
+    memcpy(Buf + Pre + sizeof(PltData), NopData, sizeof(NopData));
+}
+
+void AArch64BtiPac::writePlt(uint8_t *Buf, uint64_t GotPltEntryAddr,
+                             uint64_t PltEntryAddr, int32_t Index,
+                             unsigned RelOff) const {
+  // The PLT entry is of the form:
+  // [BtiData] AddrInst (PacBr | StdBr) [NopData]
+  const uint8_t AddrInst[] = {
+      0x10, 0x00, 0x00, 0x90,  // adrp x16, Page(&(.plt.got[n]))
+      0x11, 0x02, 0x40, 0xf9,  // ldr  x17, [x16, Offset(&(.plt.got[n]))]
+      0x10, 0x02, 0x00, 0x91   // add  x16, x16, Offset(&(.plt.got[n]))
+  };
+  const uint8_t PacBr[] = {
+      0x9f, 0x21, 0x03, 0xd5,  // autia1716
+      0x20, 0x02, 0x1f, 0xd6   // br   x17
+  };
+  const uint8_t StdBr[] = {
+      0x20, 0x02, 0x1f, 0xd6,  // br   x17
+      0x1f, 0x20, 0x03, 0xd5   // nop
+  };
+
+  size_t Pre = 0;
+  if (BtiNeeded) {
+    memcpy(Buf, BtiData, sizeof(BtiData));
+    Pre = sizeof(BtiData);
+  }
+
+  memcpy(Buf + Pre, AddrInst, sizeof(AddrInst));
+  relocateOne(Buf + Pre, R_AARCH64_ADR_PREL_PG_HI21,
+              getAArch64Page(GotPltEntryAddr) -
+                  getAArch64Page(PltEntryAddr + Pre));
+  relocateOne(Buf + 4 + Pre, R_AARCH64_LDST64_ABS_LO12_NC, GotPltEntryAddr);
+  relocateOne(Buf + 8 + Pre, R_AARCH64_ADD_ABS_LO12_NC, GotPltEntryAddr);
+
+  if (PacNeeded)
+    memcpy(Buf + Pre + sizeof(AddrInst), PacBr, sizeof(PacBr));
+  else
+    memcpy(Buf + Pre + sizeof(AddrInst), StdBr, sizeof(StdBr));
+  if (Pre == 0)
+    // We didn't add the BTI c instruction so round out size with NOP.
+    memcpy(Buf + sizeof(AddrInst) + sizeof(StdBr), NopData, sizeof(NopData));
+}
+
+static TargetInfo *getTargetInfo() {
+  if (Config->AndFeatures & (GNU_PROPERTY_AARCH64_FEATURE_1_BTI |
+                             GNU_PROPERTY_AARCH64_FEATURE_1_PAC)) {
+    static AArch64BtiPac T;
+    return &T;
+  }
+  static AArch64 T;
+  return &T;
+}
+
+TargetInfo *elf::getAArch64TargetInfo() { return getTargetInfo(); }

ELF/Arch/X86.cpp

if (Config->ZRetpolineplt) {
     if (Config->Pic) {
       static RetpolinePic T;
       return &T;
     }
     static RetpolineNoPic T;
     return &T;
   }
 
-  if (Config->X86Features & GNU_PROPERTY_X86_FEATURE_1_IBT) {
+  if (Config->AndFeatures & GNU_PROPERTY_X86_FEATURE_1_IBT) {
     static IntelCET T;
     return &T;
   }
 
   static X86 T;
   return &T;
 }

ELF/Arch/X86_64.cpp

if (Config->ZRetpolineplt) {
     if (Config->ZNow) {
       static RetpolineZNow T;
       return &T;
     }
     static Retpoline T;
     return &T;
   }
 
-  if (Config->X86Features & GNU_PROPERTY_X86_FEATURE_1_IBT) {
+  if (Config->AndFeatures & GNU_PROPERTY_X86_FEATURE_1_IBT) {
     static IntelCET T;
     return &T;
   }
 
   static X86_64 T;
   return &T;
 }
 
 TargetInfo *elf::getX86_64TargetInfo() { return getTargetInfo(); }

ELF/Config.h

 };
 
 // This struct contains the global configuration for the linker.
 // Most fields are direct mapping from the command line options
 // and such fields have the same name as the corresponding options.
 // Most fields are initialized by the driver.
 struct Configuration {
   uint8_t OSABI = 0;
-  uint32_t X86Features = 0;
+  uint32_t AndFeatures = 0;
   llvm::CachePruningPolicy ThinLTOCachePolicy;
   llvm::StringMap<uint64_t> SectionStartMap;
   llvm::StringRef Chroot;
   llvm::StringRef DynamicLinker;
   llvm::StringRef DwoDir;
   llvm::StringRef Entry;
   llvm::StringRef Emulation;
   llvm::StringRef Fini;
struct Configuration {
   bool DisableVerify;
   bool EhFrameHdr;
   bool EmitLLVM;
   bool EmitRelocs;
   bool EnableNewDtags;
   bool ExecuteOnly;
   bool ExportDynamic;
   bool FixCortexA53Errata843419;
+  bool ForceBTI;
   bool FormatBinary = false;
   bool RequireCET;
   bool GcSections;
   bool GdbIndex;
   bool GnuHash = false;
   bool GnuUnique;
   bool HasDynamicList = false;
   bool HasDynSymTab;
   bool IgnoreDataAddressEquality;
   bool IgnoreFunctionAddressEquality;
   bool LTOCSProfileGenerate;
   bool LTODebugPassManager;
   bool LTONewPassManager;
   bool MergeArmExidx;
   bool MipsN32Abi = false;
   bool Nmagic;
   bool NoinhibitExec;
   bool Nostdlib;
   bool OFormatBinary;
   bool Omagic;
   bool OptRemarksWithHotness;
+  bool PacPlt;
   bool PicThunk;
   bool Pie;
   bool PrintGcSections;
   bool PrintIcfSections;
   bool Relocatable;
   bool RelrPackDynRelocs;
   bool SaveTemps;
   bool SingleRoRx;

ELF/Driver.cpp

if (Config->EMachine != EM_AARCH64)
       error("-execute-only is only supported on AArch64 targets");
 
     if (Config->SingleRoRx && !Script->HasSectionsCommand)
       error("-execute-only and -no-rosegment cannot be used together");
   }
 
   if (Config->ZRetpolineplt && Config->RequireCET)
     error("--require-cet may not be used with -z retpolineplt");
+
+  if (Config->EMachine != EM_AARCH64) {
+    if (Config->PacPlt)
+      error("--pac-plt only supported on AArch64");
+    if (Config->ForceBTI)
+      error("--force-bti only supported on AArch64");
+  }
 }
 
 static const char *getReproduceOption(opt::InputArgList &Args) {
   if (auto *Arg = Args.getLastArg(OPT_reproduce))
     return Arg->getValue();
   return getenv("LLD_REPRODUCE");
 }
 
 static bool hasZOption(opt::InputArgList &Args, StringRef Key) {
static void readConfigs(opt::InputArgList &Args) {
   Config->Entry = Args.getLastArgValue(OPT_entry);
   Config->ExecuteOnly =
       Args.hasFlag(OPT_execute_only, OPT_no_execute_only, false);
   Config->ExportDynamic =
       Args.hasFlag(OPT_export_dynamic, OPT_no_export_dynamic, false);
   Config->FilterList = args::getStrings(Args, OPT_filter);
   Config->Fini = Args.getLastArgValue(OPT_fini, "_fini");
   Config->FixCortexA53Errata843419 = Args.hasArg(OPT_fix_cortex_a53_843419);
+  Config->ForceBTI = Args.hasArg(OPT_force_bti);
   Config->RequireCET = Args.hasArg(OPT_require_cet);
   Config->GcSections = Args.hasFlag(OPT_gc_sections, OPT_no_gc_sections, false);
   Config->GnuUnique = Args.hasFlag(OPT_gnu_unique, OPT_no_gnu_unique, true);
   Config->GdbIndex = Args.hasFlag(OPT_gdb_index, OPT_no_gdb_index, false);
   Config->ICF = getICF(Args);
   Config->IgnoreDataAddressEquality =
       Args.hasArg(OPT_ignore_data_address_equality);
   Config->IgnoreFunctionAddressEquality =
static void readConfigs(opt::InputArgList &Args) {
   Config->OFormatBinary = isOutputFormatBinary(Args);
   Config->Omagic = Args.hasFlag(OPT_omagic, OPT_no_omagic, false);
   Config->OptRemarksFilename = Args.getLastArgValue(OPT_opt_remarks_filename);
   Config->OptRemarksPasses = Args.getLastArgValue(OPT_opt_remarks_passes);
   Config->OptRemarksWithHotness = Args.hasArg(OPT_opt_remarks_with_hotness);
   Config->Optimize = args::getInteger(Args, OPT_O, 1);
   Config->OrphanHandling = getOrphanHandling(Args);
   Config->OutputFile = Args.getLastArgValue(OPT_o);
+  Config->PacPlt = Args.hasArg(OPT_pac_plt);
   Config->Pie = Args.hasFlag(OPT_pie, OPT_no_pie, false);
   Config->PrintIcfSections =
       Args.hasFlag(OPT_print_icf_sections, OPT_no_print_icf_sections, false);
   Config->PrintGcSections =
       Args.hasFlag(OPT_print_gc_sections, OPT_no_print_gc_sections, false);
   Config->PrintSymbolOrder =
       Args.getLastArgValue(OPT_print_symbol_order);
   Config->Rpath = getRpath(Args);

 
 // To enable CET (x86's hardware-assited control flow enforcement), each
 // source file must be compiled with -fcf-protection. Object files compiled
 // with the flag contain feature flags indicating that they are compatible
 // with CET. We enable the feature only when all object files are compatible
 // with CET.
 //
 // This function returns the merged feature flags. If 0, we cannot enable CET.
-template <class ELFT> static uint32_t getX86Features() {
-  if (Config->EMachine != EM_386 && Config->EMachine != EM_X86_64)
+// This is also the case with AARCH64's BTI and PAC which use the similar
+// GNU_PROPERTY_AARCH64_FEATURE_1_AND mechanism.
+template <class ELFT> static uint32_t getAndFeatures() {
+  if (Config->EMachine != EM_386 && Config->EMachine != EM_X86_64 &&
+      Config->EMachine != EM_AARCH64)
     return 0;
 
   uint32_t Ret = -1;
   for (InputFile *F : ObjectFiles) {
-    uint32_t Features = cast<ObjFile<ELFT>>(F)->X86Features;
-    if (!Features && Config->RequireCET)
+    uint32_t Features = cast<ObjFile<ELFT>>(F)->AndFeatures;
+    if (Config->ForceBTI && !(Features & GNU_PROPERTY_AARCH64_FEATURE_1_BTI)) {
+      warn(toString(F) + ": --force-bti: file does not have BTI property");
+      Features |= GNU_PROPERTY_AARCH64_FEATURE_1_BTI;
+    } else if (!Features && Config->RequireCET)
       error(toString(F) + ": --require-cet: file is not compatible with CET");
     Ret &= Features;
   }
+
+  // Force enable pointer authentication Plt, we don't warn in this case as
+  // this does not require support in the object for correctness.
+  if (Config->PacPlt)
+    Ret |= GNU_PROPERTY_AARCH64_FEATURE_1_PAC;
+
   return Ret;
 }
 
 static const char *LibcallRoutineNames[] = {
 #define HANDLE_LIBCALL(code, name) name,
 #include "llvm/IR/RuntimeLibcalls.def"
 #undef HANDLE_LIBCALL
 };
llvm::erase_if(InputSections, [](InputSectionBase *S) {
     }
 
     // We do not want to emit debug sections if --strip-all
     // or -strip-debug are given.
     return Config->Strip != StripPolicy::None &&
            (S->Name.startswith(".debug") || S->Name.startswith(".zdebug"));
   });
 
-  Config->X86Features = getX86Features<ELFT>();
+  // The .note.gnu.property features can influence the type of Target returned
+  // by getTarget();
+  Config->AndFeatures = getAndFeatures<ELFT>();
 
   // The Target instance handles target-specific stuff, such as applying
   // relocations or writing a PLT section. It also contains target-dependent
   // values such as a default image base address.
   Target = getTarget();
 
   Config->EFlags = Target->calcEFlags();
   // MaxPageSize (sometimes called abi page size) is the maximum page size that

ELF/InputFiles.h

public:
   llvm::Optional<llvm::DILineInfo> getDILineInfo(InputSectionBase *, uint64_t);
   llvm::Optional<std::pair<std::string, unsigned>> getVariableLoc(StringRef Name);
 
   // MIPS GP0 value defined by this file. This value represents the gp value
   // used to create the relocatable object and required to support
   // R_MIPS_GPREL16 / R_MIPS_GPREL32 relocations.
   uint32_t MipsGp0 = 0;
 
-  uint32_t X86Features = 0;
+  uint32_t AndFeatures = 0;
 
   // Name of source file obtained from STT_FILE symbol value,
   // or empty string if there is no such symbol in object file
   // symbol table.
   StringRef SourceFile;
 
   // True if the file defines functions compiled with
   // -fsplit-stack. Usually false.

ELF/InputFiles.cpp

 // function is rather complicated because the value is buried deep inside a
 // .note.gnu.property section.
 //
 // The section consists of one or more NOTE records. Each NOTE record consists
 // of zero or more type-length-value fields. We want to find a field of a
 // certain type. It seems a bit too much to just store a 32-bit value, perhaps
 // the ABI is unnecessarily complicated.
 template <class ELFT>
-static uint32_t readX86Features(ObjFile<ELFT> *Obj, ArrayRef<uint8_t> Data) {
+static uint32_t readAndFeatures(ObjFile<ELFT> *Obj, ArrayRef<uint8_t> Data) {
   using Elf_Nhdr = typename ELFT::Nhdr;
   using Elf_Note = typename ELFT::Note;
 
+  uint32_t FeaturesSet = 0;
   while (!Data.empty()) {
     // Read one NOTE record.
     if (Data.size() < sizeof(Elf_Nhdr))
       fatal(toString(Obj) + ": .note.gnu.property: section too short");
 
     auto *Nhdr = reinterpret_cast<const Elf_Nhdr *>(Data.data());
     if (Data.size() < Nhdr->getSize())
       fatal(toString(Obj) + ": .note.gnu.property: section too short");
 
     Elf_Note Note(*Nhdr);
     if (Nhdr->n_type != NT_GNU_PROPERTY_TYPE_0 || Note.getName() != "GNU") {
       Data = Data.slice(Nhdr->getSize());
       continue;
     }
 
+    uint32_t FeatureAndType = Config->EMachine == EM_AARCH64
+                                  ? GNU_PROPERTY_AARCH64_FEATURE_1_AND
+                                  : GNU_PROPERTY_X86_FEATURE_1_AND;
+
     // Read a body of a NOTE record, which consists of type-length-value fields.
     ArrayRef<uint8_t> Desc = Note.getDesc();
     while (!Desc.empty()) {
       if (Desc.size() < 8)
         fatal(toString(Obj) + ": .note.gnu.property: section too short");
 
       uint32_t Type = read32le(Desc.data());
       uint32_t Size = read32le(Desc.data() + 4);
 
-      if (Type == GNU_PROPERTY_X86_FEATURE_1_AND) {
-        // We found the field.
-        return read32le(Desc.data() + 8);
+      if (Type == FeatureAndType) {
+        // We found a FEATURE_1_AND field. There may be more than one of these
+        // in a .note.gnu.propery section, for a relocatable object we
+        // accumulate the bits set.
+        FeaturesSet |= read32le(Desc.data() + 8);
       }
 
       // On 64-bit, a payload may be followed by a 4-byte padding to make its
       // size a multiple of 8.
       if (ELFT::Is64Bits)
         Size = alignTo(Size, 8);
 
       Desc = Desc.slice(Size + 8); // +8 for Type and Size
     }
 
-    // Go to next NOTE record if a note section didn't contain
-    // X86_FEATURES_1_AND description.
+    // Go to next NOTE record to look for more FEATURE_1_AND descriptions.
     Data = Data.slice(Nhdr->getSize());
   }
 
-  return 0;
+  return FeaturesSet;
 }
 
 template <class ELFT>
 InputSectionBase *ObjFile<ELFT>::getRelocTarget(const Elf_Shdr &Sec) {
   uint32_t Idx = Sec.sh_info;
   if (Idx >= this->Sections.size())
     fatal(toString(this) + ": invalid relocated section index: " + Twine(Idx));
   InputSectionBase *Target = this->Sections[Idx];
InputSectionBase *ObjFile<ELFT>::createInputSection(const Elf_Shdr &Sec) {
   // explicitly told to do otherwise (by -z execstack). Because the stack
   // executable-ness is controlled solely by command line options,
   // .note.GNU-stack sections are simply ignored.
   if (Name == ".note.GNU-stack")
     return &InputSection::Discarded;
 
   // If an object file is compatible with Intel Control-Flow Enforcement
   // Technology (CET), it has a .note.gnu.property section containing the
   // GNU_PROPERTY_X86_FEATURE_1_IBT flag. Read a bitmap containing the flag.
   //
   // Since we merge bitmaps from multiple object files to create a new
   // .note.gnu.property containing a single AND'ed bitmap, we discard an input
   // file's .note.gnu.property section.
   if (Name == ".note.gnu.property") {
     ArrayRef<uint8_t> Contents = check(this->getObj().getSectionContents(&Sec));
-    this->X86Features = readX86Features(this, Contents);
+    this->AndFeatures = readAndFeatures(this, Contents);
     return &InputSection::Discarded;
   }
 
   // Split stacks is a feature to support a discontiguous stack,
   // commonly used in the programming language Go. For the details,
   // see https://gcc.gnu.org/wiki/SplitStacks. An object file compiled
   // for split stack will include a .note.GNU-split-stack section.
   if (Name == ".note.GNU-split-stack") {

ELF/Options.td

 defm fini: Eq<"fini", "Specify a finalizer function">, MetaVarName<"<symbol>">;
 
 def fix_cortex_a53_843419: F<"fix-cortex-a53-843419">,
   HelpText<"Apply fixes for AArch64 Cortex-A53 erratum 843419">;
 
 def require_cet: F<"require-cet">,
   HelpText<"Force enable x86 Control-Flow Enforcement Technology">;
 
+def force_bti: F<"force-bti">,
+  HelpText<"Force enable AArch64 BTI in PLT, warn if Input ELF file does not have GNU_PROPERTY_AARCH64_FEATURE_1_BTI property">;
+
 defm format: Eq<"format", "Change the input format of the inputs following this option">,
   MetaVarName<"[default,elf,binary]">;
 
 defm gc_sections: B<"gc-sections",
     "Enable garbage collection of unused sections",
     "Disable garbage collection of unused sections (default)">;
 
 defm gdb_index: B<"gdb-index",

 
 defm orphan_handling:
   Eq<"orphan-handling", "Control how orphan sections are handled when linker script used">;
 
 defm pack_dyn_relocs:
   Eq<"pack-dyn-relocs", "Pack dynamic relocations in the given format">,
   MetaVarName<"[none,android,relr,android+relr]">;
 
+def pac_plt: F<"pac-plt">,
+  HelpText<"AArch64 only, use pointer authentication in PLT">;
+
 defm use_android_relr_tags: B<"use-android-relr-tags",
     "Use SHT_ANDROID_RELR / DT_ANDROID_RELR* tags instead of SHT_RELR / DT_RELR*",
     "Use SHT_RELR / DT_RELR* tags (default)">;
 
 def pic_veneer: F<"pic-veneer">,
   HelpText<"Always generate position independent thunks (veneers)">;
 
 defm pie: B<"pie",

ELF/Relocations.cpp

if (Config->Pie && Config->EMachine == EM_386)
       errorOrWarn("symbol '" + toString(Sym) +
                   "' cannot be preempted; recompile with -fPIE" +
                   getLocation(Sec, Sym, Offset));
     if (!Sym.isInPlt())
       addPltEntry<ELFT>(In.Plt, In.GotPlt, In.RelaPlt, Target->PltRel, Sym);
     if (!Sym.isDefined())
       replaceWithDefined(
           Sym, In.Plt,
-          Target->PltHeaderSize + Target->PltEntrySize * Sym.PltIndex, 0);
+          In.Plt->HeaderSize + Target->PltEntrySize * Sym.PltIndex, 0);
     Sym.NeedsPltAddr = true;
     Sec.Relocations.push_back({Expr, Type, Offset, Addend, &Sym});
     return;
   }
 
   errorOrWarn("symbol '" + toString(Sym) + "' has no type" +
               getLocation(Sec, Sym, Offset));
 }

ELF/SyntheticSections.cpp

case BuildIdKind::Hexstring:
     return Config->BuildIdVector.size();
   default:
     llvm_unreachable("unknown BuildIdKind");
   }
 }
 
 // This class represents a linker-synthesized .note.gnu.property section.
 //
-// In x86, object files may contain feature flags indicating the features that
-// they have used. The flags are stored in a .note.gnu.property section.
+// In x86 and AArch64, object files may contain feature flags indicating the
+// features that they have used. The flags are stored in a .note.gnu.property
+// section.
 //
 // lld reads the sections from input files and merges them by computing AND of
 // the flags. The result is written as a new .note.gnu.property section.
 //
 // If the flag is zero (which indicates that the intersection of the feature
 // sets is empty, or some input files didn't have .note.gnu.property sections),
 // we don't create this section.
 GnuPropertySection::GnuPropertySection()
     : SyntheticSection(llvm::ELF::SHF_ALLOC, llvm::ELF::SHT_NOTE, 4,
                        ".note.gnu.property") {}
 
 void GnuPropertySection::writeTo(uint8_t *Buf) {
+  uint32_t FeatureAndType = Config->EMachine == EM_AARCH64
+                                ? GNU_PROPERTY_AARCH64_FEATURE_1_AND
+                                : GNU_PROPERTY_X86_FEATURE_1_AND;
+
   write32(Buf, 4);                                   // Name size
   write32(Buf + 4, Config->Is64 ? 16 : 12);          // Content size
   write32(Buf + 8, NT_GNU_PROPERTY_TYPE_0);          // Type
   memcpy(Buf + 12, "GNU", 4);                        // Name string
-  write32(Buf + 16, GNU_PROPERTY_X86_FEATURE_1_AND); // Feature type
+  write32(Buf + 16, FeatureAndType);                 // Feature type
   write32(Buf + 20, 4);                              // Feature size
-  write32(Buf + 24, Config->X86Features);            // Feature flags
+  write32(Buf + 24, Config->AndFeatures);            // Feature flags
   if (Config->Is64)
     write32(Buf + 28, 0);                            // Padding
 }
 
 size_t GnuPropertySection::getSize() const {
   return Config->Is64 ? 32 : 28;
 }
 
case EM_SPARCV9:
       break;
     default:
       addInSec(DT_PLTGOT, In.GotPlt);
       break;
     }
     addInt(DT_PLTREL, Config->IsRela ? DT_RELA : DT_REL);
   }
 
+  if (Config->EMachine == EM_AARCH64) {
+    if (Config->AndFeatures & GNU_PROPERTY_AARCH64_FEATURE_1_BTI)
+      addInt(DT_AARCH64_BTI_PLT, 0);
+    if (Config->AndFeatures & GNU_PROPERTY_AARCH64_FEATURE_1_PAC)
+      addInt(DT_AARCH64_PAC_PLT, 0);
+  }
+
   addInSec(DT_SYMTAB, In.DynSymTab);
   addInt(DT_SYMENT, sizeof(Elf_Sym));
   addInSec(DT_STRTAB, In.DynStrTab);
   addInt(DT_STRSZ, In.DynStrTab->getSize());
   if (!Config->ZText)
     addInt(DT_TEXTREL, 0);
   if (In.GnuHashTab)
     addInSec(DT_GNU_HASH, In.GnuHashTab);
void HashTableSection::writeTo(uint8_t *Buf) {
   }
 }
 
 // On PowerPC64 the lazy symbol resolvers go into the `global linkage table`
 // in the .glink section, rather then the typical .plt section.
 PltSection::PltSection(bool IsIplt)
     : SyntheticSection(SHF_ALLOC | SHF_EXECINSTR, SHT_PROGBITS, 16, ""),
       IsIplt(IsIplt) {
-  bool IsX86Ibt = (Config->X86Features & GNU_PROPERTY_X86_FEATURE_1_IBT);
+  bool IsX86Ibt = (Config->EMachine != EM_AARCH64 &&
+                   Config->AndFeatures & GNU_PROPERTY_X86_FEATURE_1_IBT);
 
   if (Config->EMachine == EM_PPC64)
     Name = ".glink";
   else if (IsX86Ibt)
     Name = ".plt.sec";
   else
     Name = ".plt";
 

ELF/Writer.cpp

template <class ELFT> static void createSyntheticSections() {
   // we can get the desired behaviour by placing the iplt section in .rel.plt.
   In.RelaIplt = make<RelocationSection<ELFT>>(
       (Config->EMachine == EM_ARM && !Config->AndroidPackDynRelocs)
           ? ".rel.dyn"
           : In.RelaPlt->Name,
       false /*Sort*/);
   Add(In.RelaIplt);
 
-  if (Config->X86Features & GNU_PROPERTY_X86_FEATURE_1_IBT) {
+  if (Config->EMachine != EM_AARCH64 &&
+      (Config->AndFeatures & GNU_PROPERTY_X86_FEATURE_1_IBT)) {
     In.IBTPlt = make<IBTPltSection>();
     Add(In.IBTPlt);
   }
 
   In.Plt = make<PltSection>(false);
   Add(In.Plt);
   In.Iplt = make<PltSection>(true);
   Add(In.Iplt);
 
-  if (Config->X86Features)
+  if (Config->AndFeatures)
     Add(make<GnuPropertySection>());
 
   // .note.GNU-stack is always added when we are creating a re-linkable
   // object file. Other linkers are using the presence of this marker
   // section to control the executable-ness of the stack area, but that
   // is irrelevant these days. Stack area should always be non-executable
   // by default. So we emit this section unconditionally.
   if (Config->Relocatable)

docs/ld.lld.1

 Set the
 .Dv DT_FILTER
 field to the specified value.
 .It Fl -fini Ns = Ns Ar symbol
 Specify a finalizer function.
 .It Fl -require-cet
 Intel Control-Flow Enforcement Technology is enforced. An error is
 reported if there is an input object file not compatible with CET.
+.It Fl -force-bti
+Force enable AArch64 BTI instruction in PLT, warn if Input ELF file does not have GNU_PROPERTY_AARCH64_FEATURE_1_BTI property.
 .It Fl -format Ns = Ns Ar input-format , Fl b Ar input-format
 Specify the format of the inputs following this option.
 .Ar input-format
 may be one of
 .Cm binary ,
 .Cm elf ,
 and
 .Cm default .

 Pack relative relocations in SHT_RELR, and the rest of dynamic relocations in SHT_ANDROID_REL(A).
 .El
 .Pp
 .Cm none
 is the default. If
 .Fl -use-android-relr-tags
 is specified, use SHT_ANDROID_RELR instead of SHT_RELR.
 .Pp
+.It Fl -pac-plt
+AArch64 only, use pointer authentication in PLT.
 .It Fl -pic-veneer
 Always generate position independent thunks.
 .It Fl -pie , Fl -pic-executable
 Create a position independent executable.
 .It Fl -print-gc-sections
 List removed unused sections.
 .It Fl -print-icf-sections
 List identical folded sections.

test/ELF/Inputs/aarch64-addrifunc.s

+        .text
+        .globl myfunc
+        .globl func1
+        .type func1, %function
+func1:
+        adrp x8, :got: myfunc
+        ldr x8, [x8, :got_lo12: myfunc]
+        ret

test/ELF/Inputs/aarch64-bti1.s

+.section ".note.gnu.property", "a"
+.long 4
+.long 0x10
+.long 0x5
+.asciz "GNU"
+
+.long 0xc0000000 // GNU_PROPERTY_AARCH64_FEATURE_1_AND
+.long 4
+.long 1          // GNU_PROPERTY_AARCH64_FEATURE_1_BTI
+.long 0
+
+.text
+.globl func2
+.type func2,@function
+func2:
+  .globl func3
+  .type func3, @function
+  bl func3
+  ret

test/ELF/Inputs/aarch64-btipac1.s

+.section ".note.gnu.property", "a"
+.long 4
+.long 0x10
+.long 0x5
+.asciz "GNU"
+
+.long 0xc0000000 // GNU_PROPERTY_AARCH64_FEATURE_1_AND
+.long 4
+.long 3          // GNU_PROPERTY_AARCH64_FEATURE_1_PAC and BTI
+.long 0
+
+.text
+.globl func2
+.type func2,@function
+func2:
+  .globl func3
+  .type func3, @function
+  bl func3
+  ret

test/ELF/Inputs/aarch64-func2.s

+.text
+.globl func2
+.type func2,@function
+func2:
+  .globl func3
+  .type func3, @function
+  bl func3
+  ret

test/ELF/Inputs/aarch64-func3-bti.s

+.section ".note.gnu.property", "a"
+.long 4
+.long 0x10
+.long 0x5
+.asciz "GNU"
+
+.long 0xc0000000 // GNU_PROPERTY_AARCH64_FEATURE_1_AND
+.long 4
+.long 1          // GNU_PROPERTY_AARCH64_FEATURE_1_BTI
+.long 0
+
+.text
+.globl func3
+.type func3,@function
+func3:
+  ret

test/ELF/Inputs/aarch64-func3-btipac.s

+.section ".note.gnu.property", "a"
+.long 4
+.long 0x10
+.long 0x5
+.asciz "GNU"
+
+.long 0xc0000000 // GNU_PROPERTY_AARCH64_FEATURE_1_AND
+.long 4
+.long 3          // GNU_PROPERTY_AARCH64_FEATURE_1_PAC
+.long 0
+
+.text
+.globl func3
+.type func3,@function
+func3:
+  ret

test/ELF/Inputs/aarch64-func3-pac.s

+.section ".note.gnu.property", "a"
+.long 4
+.long 0x10
+.long 0x5
+.asciz "GNU"
+
+.long 0xc0000000 // GNU_PROPERTY_AARCH64_FEATURE_1_AND
+.long 4
+.long 2          // GNU_PROPERTY_AARCH64_FEATURE_1_PAC
+.long 0
+
+.text
+.globl func3
+.type func3,@function
+func3:
+  ret

test/ELF/Inputs/aarch64-func3.s

+.text
+.globl func3
+.type func3,@function
+func3:
+  ret

test/ELF/Inputs/aarch64-nobti.s

+.text
+.globl func2
+.type func2,@function
+func2:
+  .globl func3
+  .type func3, @function
+  bl func3
+  ret

test/ELF/Inputs/aarch64-nopac.s

+.text
+.globl func2
+.type func2,@function
+func2:
+  .globl func3
+  .type func3, @function
+  bl func3
+  ret

test/ELF/Inputs/aarch64-pac1.s

+.section ".note.gnu.property", "a"
+.long 4
+.long 0x10
+.long 0x5
+.asciz "GNU"
+
+.long 0xc0000000 // GNU_PROPERTY_AARCH64_FEATURE_1_AND
+.long 4
+.long 2          // GNU_PROPERTY_AARCH64_FEATURE_1_PAC
+.long 0
+
+.text
+.globl func2
+.type func2,@function
+func2:
+  .globl func3
+  .type func3, @function
+  bl func3
+  ret

test/ELF/aarch64-bti-pac-cli-error.s

+# REQUIRES: x86
+# RUN: llvm-mc --triple=x86_64-pc-linux --filetype=obj -o %t.o %s
+# RUN: not ld.lld --pac-plt --force-bti %t.o -o %t 2>&1 | FileCheck %s
+#
+## Check that we error if --pac-plt and --force-bti are used when target is not
+## aarch64
+
+# CHECK: error: --pac-plt only supported on AArch64
+# CHECK-NEXT: error: --force-bti only supported on AArch64
+
+        .globl start
+start:  ret

test/ELF/aarch64-feature-bti.s

+# REQUIRES: aarch64
+# RUN: llvm-mc -filetype=obj -triple=aarch64-linux-gnu %s -o %t.o
+# RUN: llvm-mc -filetype=obj -triple=aarch64-linux-gnu %p/Inputs/aarch64-bti1.s -o %t1.o
+# RUN: llvm-mc -filetype=obj -triple=aarch64-linux-gnu %p/Inputs/aarch64-func3.s -o %t2.o
+# RUN: llvm-mc -filetype=obj -triple=aarch64-linux-gnu %p/Inputs/aarch64-func3-bti.s -o %t3.o
+# RUN: llvm-mc -filetype=obj -triple=aarch64-linux-gnu %p/Inputs/aarch64-func2.s -o %tno.o
+
+## We do not add BTI support when the inputs don't have the .note.gnu.property
+## field.
+
+# RUN: ld.lld %tno.o %t3.o --shared -o %tno.so
+# RUN: llvm-objdump -d -mattr=+bti --no-show-raw-insn %tno.so | FileCheck --check-prefix=NOBTI %s
+# RUN: llvm-readelf -x .got.plt %tno.so | FileCheck --check-prefix SOGOTPLT %s
+# RUN: llvm-readelf --dynamic-table %tno.so | FileCheck --check-prefix NOBTIDYN %s
+
+# NOBTIDYN-NOT:   0x0000000070000001 (AARCH64_BTI_PLT)
+# NOBTIDYN-NOT:   0x0000000070000003 (AARCH64_PAC_PLT)
+
+# NOBTI: 0000000000010000 func2:
+# NOBTI-NEXT:    10000: bl      #48 <func3@plt>
+# NOBTI-NEXT:    10004: ret
+# NOBTI: Disassembly of section .plt:
+# NOBTI: 0000000000010010 .plt:
+# NOBTI-NEXT:    10010: stp     x16, x30, [sp, #-16]!
+# NOBTI-NEXT:    10014: adrp    x16, #131072
+# NOBTI-NEXT:    10018: ldr     x17, [x16, #16]
+# NOBTI-NEXT:    1001c: add     x16, x16, #16
+# NOBTI-NEXT:    10020: br      x17
+# NOBTI-NEXT:    10024: nop
+# NOBTI-NEXT:    10028: nop
+# NOBTI-NEXT:    1002c: nop
+# NOBTI: 0000000000010030 func3@plt:
+# NOBTI-NEXT:    10030: adrp    x16, #131072
+# NOBTI-NEXT:    10034: ldr     x17, [x16, #24]
+# NOBTI-NEXT:    10038: add     x16, x16, #24
+# NOBTI-NEXT:    1003c: br      x17
+
+## Expect a bti c at the start of plt[0], the plt entries do not need bti c as
+## their address doesn't escape the shared object, so they can't be indirectly
+## called. Expect no other difference.
+
+# RUN: ld.lld %t1.o %t3.o --shared -o %t.so
+# RUN: llvm-readelf -n %t.so | FileCheck --check-prefix BTIPROP %s
+# RUN: llvm-objdump -d -mattr=+bti --no-show-raw-insn %t.so | FileCheck --check-prefix BTISO %s
+# RUN: llvm-readelf -x .got.plt %t.so | FileCheck --check-prefix SOGOTPLT %s
+# RUN: llvm-readelf --dynamic-table %t.so | FileCheck --check-prefix BTIDYN %s
+
+# BTIPROP: Properties:    aarch64 feature: BTI
+
+# BTIDYN:      0x0000000070000001 (AARCH64_BTI_PLT)
+# BTIDYN-NOT:  0x0000000070000003 (AARCH64_PAC_PLT)
+
+# BTISO: 0000000000010000 func2:
+# BTISO-NEXT:    10000: bl      #48 <func3@plt>
+# BTISO-NEXT:    10004: ret
+# BTISO: Disassembly of section .plt:
+# BTISO: 0000000000010010 .plt:
+# BTISO-NEXT:    10010: bti     c
+# BTISO-NEXT:    10014: stp     x16, x30, [sp, #-16]!
+# BTISO-NEXT:    10018: adrp    x16, #131072
+# BTISO-NEXT:    1001c: ldr     x17, [x16, #16]
+# BTISO-NEXT:    10020: add     x16, x16, #16
+# BTISO-NEXT:    10024: br      x17
+# BTISO-NEXT:    10028: nop
+# BTISO-NEXT:    1002c: nop
+# BTISO: 0000000000010030 func3@plt:
+# BTISO-NEXT:    10030: adrp    x16, #131072
+# BTISO-NEXT:    10034: ldr     x17, [x16, #24]
+# BTISO-NEXT:    10038: add     x16, x16, #24
+# BTISO-NEXT:    1003c: br      x17
+
+## The .got.plt should be identical between the BTI and no BTI DSO PLT.
+# SOGOTPLT: Hex dump of section '.got.plt'
+# SOGOTPLT-NEXT:  0x00030000 00000000 00000000 00000000 00000000
+# SOGOTPLT-NEXT:  0x00030010 00000000 00000000 10000100 00000000
+
+## Build an executable with all relocatable inputs having the BTI
+## .note.gnu.property. We expect a bti c in front of all PLT entries as the
+## address of a PLT entry can escape an executable.
+
+# RUN: ld.lld %t2.o --shared -o %t2.so
+
+# RUN: ld.lld %t.o %t.so %t2.so -o %t.exe
+# RUN: llvm-readelf --dynamic-table -n %t.exe | FileCheck --check-prefix=BTIPROP %s
+# RUN: llvm-objdump -d -mattr=+bti --no-show-raw-insn %t.exe | FileCheck --check-prefix=EXECBTI %s
+
+# EXECBTI: Disassembly of section .text:
+# EXECBTI: 0000000000210000 func1:
+# EXECBTI-NEXT:   210000: bl      #48 <func2@plt>
+# EXECBTI-NEXT:   210004: ret
+# EXECBTI: Disassembly of section .plt:
+# EXECBTI: 0000000000210010 .plt:
+# EXECBTI-NEXT:   210010: bti     c
+# EXECBTI-NEXT:   210014: stp     x16, x30, [sp, #-16]!
+# EXECBTI-NEXT:   210018: adrp    x16, #131072
+# EXECBTI-NEXT:   21001c: ldr     x17, [x16, #16]
+# EXECBTI-NEXT:   210020: add     x16, x16, #16
+# EXECBTI-NEXT:   210024: br      x17
+# EXECBTI-NEXT:   210028: nop
+# EXECBTI-NEXT:   21002c: nop
+# EXECBTI: 0000000000210030 func2@plt:
+# EXECBTI-NEXT:   210030: bti     c
+# EXECBTI-NEXT:   210034: adrp    x16, #131072
+# EXECBTI-NEXT:   210038: ldr     x17, [x16, #24]
+# EXECBTI-NEXT:   21003c: add     x16, x16, #24
+# EXECBTI-NEXT:   210040: br      x17
+# EXECBTI-NEXT:   210044: nop
+
+## We expect the same for PIE, as the address of an ifunc can escape
+# RUN: ld.lld --pie %t.o %t.so %t2.so -o %tpie.exe
+# RUN: llvm-readelf -n %tpie.exe | FileCheck --check-prefix=BTIPROP %s
+# RUN: llvm-readelf --dynamic-table -n %tpie.exe | FileCheck --check-prefix=BTIPROP %s
+# RUN: llvm-objdump -d -mattr=+bti --no-show-raw-insn %tpie.exe | FileCheck --check-prefix=PIE %s
+
+# PIE: Disassembly of section .text:
+# PIE: 0000000000010000 func1:
+# PIE-NEXT:    10000: bl      #48 <func2@plt>
+# PIE-NEXT:    10004: ret
+# PIE: Disassembly of section .plt:
+# PIE: 0000000000010010 .plt:
+# PIE-NEXT:    10010: bti     c
+# PIE-NEXT:    10014: stp     x16, x30, [sp, #-16]!
+# PIE-NEXT:    10018: adrp    x16, #131072
+# PIE-NEXT:    1001c: ldr     x17, [x16, #16]
+# PIE-NEXT:    10020: add     x16, x16, #16
+# PIE-NEXT:    10024: br      x17
+# PIE-NEXT:    10028: nop
+# PIE-NEXT:    1002c: nop
+# PIE: 0000000000010030 func2@plt:
+# PIE-NEXT:    10030: bti     c
+# PIE-NEXT:    10034: adrp    x16, #131072
+# PIE-NEXT:    10038: ldr     x17, [x16, #24]
+# PIE-NEXT:    1003c: add     x16, x16, #24
+# PIE-NEXT:    10040: br      x17
+# PIE-NEXT:    10044: nop
+
+## Build and executable with not all relocatable inputs having the BTI
+## .note.property, expect no bti c and no .note.gnu.property entry
+
+# RUN: ld.lld %t.o %t2.o %t.so -o %tnobti.exe
+# RUN: llvm-readelf --dynamic-table %tnobti.exe | FileCheck --check-prefix NOBTIDYN %s
+# RUN: llvm-objdump -d -mattr=+bti --no-show-raw-insn %tnobti.exe | FileCheck --check-prefix=NOEX %s
+
+# NOEX: Disassembly of section .text:
+# NOEX: 0000000000210000 func1:
+# NOEX-NEXT:   210000: bl      #48 <func2@plt>
+# NOEX-NEXT:   210004: ret
+# NOEX: 0000000000210008 func3:
+# NOEX-NEXT:   210008: ret
+# NOEX: Disassembly of section .plt:
+# NOEX: 0000000000210010 .plt:
+# NOEX-NEXT:   210010: stp     x16, x30, [sp, #-16]!
+# NOEX-NEXT:   210014: adrp    x16, #131072
+# NOEX-NEXT:   210018: ldr     x17, [x16, #16]
+# NOEX-NEXT:   21001c: add     x16, x16, #16
+# NOEX-NEXT:   210020: br      x17
+# NOEX-NEXT:   210024: nop
+# NOEX-NEXT:   210028: nop
+# NOEX-NEXT:   21002c: nop
+# NOEX: 0000000000210030 func2@plt:
+# NOEX-NEXT:   210030: adrp    x16, #131072
+# NOEX-NEXT:   210034: ldr     x17, [x16, #24]
+# NOEX-NEXT:   210038: add     x16, x16, #24
+# NOEX-NEXT:   21003c: br      x17
+
+## Force BTI entries with the --force-bti command line option. Expect a warning
+## from the file without the .note.gnu.property.
+
+# RUN: ld.lld %t.o %t2.o --force-bti %t.so -o %tforcebti.exe 2>&1 | FileCheck --check-prefix=FORCE-WARN %s
+
+# FORCE-WARN: aarch64-feature-bti.s.tmp2.o: --force-bti: file does not have BTI property
+
+
+# RUN: llvm-readelf -n %tforcebti.exe | FileCheck --check-prefix=BTIPROP %s
+# RUN: llvm-readelf --dynamic-table %tforcebti.exe | FileCheck --check-prefix BTIDYN %s
+# RUN: llvm-objdump -d -mattr=+bti --no-show-raw-insn %tforcebti.exe | FileCheck --check-prefix=FORCE %s
+
+# FORCE: Disassembly of section .text:
+# FORCE: 0000000000210000 func1:
+# FORCE-NEXT:   210000: bl      #48 <func2@plt>
+# FORCE-NEXT:   210004: ret
+# FORCE: 0000000000210008 func3:
+# FORCE-NEXT:   210008: ret
+# FORCE: Disassembly of section .plt:
+# FORCE: 0000000000210010 .plt:
+# FORCE-NEXT:   210010: bti     c
+# FORCE-NEXT:   210014: stp     x16, x30, [sp, #-16]!
+# FORCE-NEXT:   210018: adrp    x16, #131072
+# FORCE-NEXT:   21001c: ldr     x17, [x16, #16]
+# FORCE-NEXT:   210020: add     x16, x16, #16
+# FORCE-NEXT:   210024: br      x17
+# FORCE-NEXT:   210028: nop
+# FORCE-NEXT:   21002c: nop
+# FORCE: 0000000000210030 func2@plt:
+# FORCE-NEXT:   210030: bti     c
+# FORCE-NEXT:   210034: adrp    x16, #131072
+# FORCE-NEXT:   210038: ldr     x17, [x16, #24]
+# FORCE-NEXT:   21003c: add     x16, x16, #24
+# FORCE-NEXT:   210040: br      x17
+# FORCE-NEXT:   210044: nop
+
+.section ".note.gnu.property", "a"
+.long 4
+.long 0x10
+.long 0x5
+.asciz "GNU"
+
+.long 0xc0000000 // GNU_PROPERTY_AARCH64_FEATURE_1_AND
+.long 4
+.long 1          // GNU_PROPERTY_AARCH64_FEATURE_1_BTI
+.long 0
+
+.text
+.globl _start
+.type func1,%function
+func1:
+  bl func2
+  ret

test/ELF/aarch64-feature-btipac.s

+# REQUIRES: aarch64
+# RUN: llvm-mc -filetype=obj -triple=aarch64-linux-gnu %s -o %t.o
+# RUN: llvm-mc -filetype=obj -triple=aarch64-linux-gnu %p/Inputs/aarch64-btipac1.s -o %t1.o
+# RUN: llvm-mc -filetype=obj -triple=aarch64-linux-gnu %p/Inputs/aarch64-func3.s -o %t3.o
+# RUN: llvm-mc -filetype=obj -triple=aarch64-linux-gnu %p/Inputs/aarch64-func3-btipac.s -o %t3btipac.o
+
+## Build shared library with all inputs having BTI and PAC, expect PLT
+## entries supporting both PAC and BTI. For a shared library this means:
+## PLT[0] has bti c at start
+## PLT[n] has autia1716 before br x17
+
+# RUN: ld.lld %t1.o %t3btipac.o --shared -o %t.so
+# RUN: llvm-readelf -n %t.so | FileCheck --check-prefix BTIPACPROP %s
+# RUN: llvm-objdump -d -mattr=+v8.5a --no-show-raw-insn %t.so | FileCheck --check-prefix BTIPACSO %s
+# RUN: llvm-readelf --dynamic-table %t.so | FileCheck --check-prefix BTIPACDYN %s
+
+# BTIPACSO: Disassembly of section .text:
+# BTIPACSO: 0000000000010000 func2:
+# BTIPACSO-NEXT:    10000: bl      #48 <func3@plt>
+# BTIPACSO-NEXT:    10004: ret
+# BTIPACSO: 0000000000010008 func3:
+# BTIPACSO-NEXT:    10008: ret
+# BTIPACSO: Disassembly of section .plt:
+# BTIPACSO: 0000000000010010 .plt:
+# BTIPACSO-NEXT:    10010: bti     c
+# BTIPACSO-NEXT:    10014: stp     x16, x30, [sp, #-16]!
+# BTIPACSO-NEXT:    10018: adrp    x16, #131072
+# BTIPACSO-NEXT:    1001c: ldr     x17, [x16, #16]
+# BTIPACSO-NEXT:    10020: add     x16, x16, #16
+# BTIPACSO-NEXT:    10024: br      x17
+# BTIPACSO-NEXT:    10028: nop
+# BTIPACSO-NEXT:    1002c: nop
+# BTIPACSO: 0000000000010030 func3@plt:
+# BTIPACSO-NEXT:    10030: adrp    x16, #131072
+# BTIPACSO-NEXT:    10034: ldr     x17, [x16, #24]
+# BTIPACSO-NEXT:    10038: add     x16, x16, #24
+# BTIPACSO-NEXT:    1003c: autia1716
+# BTIPACSO-NEXT:    10040: br      x17
+# BTIPACSO-NEXT:    10044: nop
+
+# BTIPACPROP:    Properties:    aarch64 feature: BTI, PAC
+
+# BTIPACDYN:   0x0000000070000001 (AARCH64_BTI_PLT)
+# BTIPACDYN:   0x0000000070000003 (AARCH64_PAC_PLT)
+
+## Make an executable with both BTI and PAC properties. Expect:
+## PLT[0] bti c as first instruction
+## PLT[n] bti n as first instruction, autia1716 before br x17
+
+# RUN: ld.lld %t.o %t3btipac.o %t.so -o %t.exe
+# RUN: llvm-readelf -n %t.exe | FileCheck --check-prefix=BTIPACPROP %s
+# RUN: llvm-objdump -d -mattr=+v8.5a --no-show-raw-insn %t.exe | FileCheck --check-prefix BTIPACEX %s
+# RUN: llvm-readelf --dynamic-table %t.exe | FileCheck --check-prefix BTIPACDYN %s
+
+# BTIPACEX: Disassembly of section .text:
+# BTIPACEX: 0000000000210000 func1:
+# BTIPACEX-NEXT:   210000: bl      #48 <func2@plt>
+# BTIPACEX-NEXT:   210004: ret
+# BTIPACEX-NEXT:   210008: ret
+# BTIPACEX: 000000000021000c func3:
+# BTIPACEX-NEXT:   21000c: ret
+# BTIPACEX: Disassembly of section .plt:
+# BTIPACEX: 0000000000210010 .plt:
+# BTIPACEX-NEXT:   210010: bti     c
+# BTIPACEX-NEXT:   210014: stp     x16, x30, [sp, #-16]!
+# BTIPACEX-NEXT:   210018: adrp    x16, #131072
+# BTIPACEX-NEXT:   21001c: ldr     x17, [x16, #16]
+# BTIPACEX-NEXT:   210020: add     x16, x16, #16
+# BTIPACEX-NEXT:   210024: br      x17
+# BTIPACEX-NEXT:   210028: nop
+# BTIPACEX-NEXT:   21002c: nop
+# BTIPACEX: 0000000000210030 func2@plt:
+# BTIPACEX-NEXT:   210030: bti     c
+# BTIPACEX-NEXT:   210034: adrp    x16, #131072
+# BTIPACEX-NEXT:   210038: ldr     x17, [x16, #24]
+# BTIPACEX-NEXT:   21003c: add     x16, x16, #24
+# BTIPACEX-NEXT:   210040: autia1716
+# BTIPACEX-NEXT:   210044: br      x17
+
+## Check that combinations of BTI+PAC with 0 properties results in standard PLT
+
+# RUN: ld.lld %t.o %t3.o %t.so -o %t.exe
+# RUN: llvm-objdump -d -mattr=+v8.5a --no-show-raw-insn %t.exe | FileCheck --check-prefix EX %s
+# RUN: llvm-readelf --dynamic-table %t.exe | FileCheck --check-prefix=NODYN %s
+
+# EX: Disassembly of section .text:
+# EX: 0000000000210000 func1:
+# EX-NEXT:   210000: bl      #48 <func2@plt>
+# EX-NEXT:   210004: ret
+# EX-NEXT:   210008: ret
+# EX: 000000000021000c func3:
+# EX-NEXT:   21000c: ret
+# EX: Disassembly of section .plt:
+# EX: 0000000000210010 .plt:
+# EX-NEXT:   210010: stp     x16, x30, [sp, #-16]!
+# EX-NEXT:   210014: adrp    x16, #131072
+# EX-NEXT:   210018: ldr     x17, [x16, #16]
+# EX-NEXT:   21001c: add     x16, x16, #16
+# EX-NEXT:   210020: br      x17
+# EX-NEXT:   210024: nop
+# EX-NEXT:   210028: nop
+# EX-NEXT:   21002c: nop
+# EX: 0000000000210030 func2@plt:
+# EX:        210030: adrp    x16, #131072
+# EX-NEXT:   210034: ldr     x17, [x16, #24]
+# EX-NEXT:   210038: add     x16, x16, #24
+# EX-NEXT:   21003c: br      x17
+
+# NODYN-NOT:   0x0000000070000001 (AARCH64_BTI_PLT)
+# NODYN-NOT:   0x0000000070000003 (AARCH64_PAC_PLT)
+
+## Check that combination of --pac-plt and --force-bti warns for the file that
+## doesn't contain the BTI property, but generates PAC and BTI PLT sequences.
+## The --pac-plt doesn't warn as it is not required for correctness.
+
+# RUN: ld.lld %t.o %t3.o %t.so --pac-plt --force-bti -o %t.exe 2>&1 | FileCheck --check-prefix=FORCE-WARN %s
+
+# FORCE-WARN: aarch64-feature-btipac.s.tmp3.o: --force-bti: file does not have BTI property
+
+# RUN: llvm-readelf -n %t.exe | FileCheck --check-prefix=BTIPACPROP %s
+# RUN: llvm-objdump -d -mattr=+v8.5a --no-show-raw-insn %t.exe | FileCheck --check-prefix BTIPACEX %s
+# RUN: llvm-readelf --dynamic-table %t.exe | FileCheck --check-prefix BTIPACDYN %s
+.section ".note.gnu.property", "a"
+.long 4
+.long 0x10
+.long 0x5
+.asciz "GNU"
+
+.long 0xc0000000 // GNU_PROPERTY_AARCH64_FEATURE_1_AND
+.long 4
+.long 3          // GNU_PROPERTY_AARCH64_FEATURE_1_BTI and PAC
+.long 0
+
+.text
+.globl _start
+.type func1,%function
+func1:
+  bl func2
+  ret
+.globl func3
+.type func3,%function
+  ret

test/ELF/aarch64-feature-pac.s

+# REQUIRES: aarch64
+# RUN: llvm-mc -filetype=obj -triple=aarch64-linux-gnu %s -o %t.o
+# RUN: llvm-mc -filetype=obj -triple=aarch64-linux-gnu %p/Inputs/aarch64-pac1.s -o %t1.o
+# RUN: llvm-mc -filetype=obj -triple=aarch64-linux-gnu %p/Inputs/aarch64-func3.s -o %t2.o
+# RUN: llvm-mc -filetype=obj -triple=aarch64-linux-gnu %p/Inputs/aarch64-func3-pac.s -o %t3.o
+# RUN: llvm-mc -filetype=obj -triple=aarch64-linux-gnu %p/Inputs/aarch64-func2.s -o %tno.o
+
+## We do not add PAC support when the inputs don't have the .note.gnu.property
+## field.
+
+# RUN: ld.lld %tno.o %t3.o --shared -o %tno.so
+# RUN: llvm-objdump -d -mattr=+v8.3a --no-show-raw-insn %tno.so | FileCheck --check-prefix=NOPAC %s
+# RUN: llvm-readelf -x .got.plt %tno.so | FileCheck --check-prefix SOGOTPLT %s
+# RUN: llvm-readelf --dynamic-table %tno.so | FileCheck --check-prefix NOPACDYN %s
+
+# NOPAC: 0000000000010000 func2:
+# NOPAC-NEXT:    10000: bl      #48 <func3@plt>
+# NOPAC-NEXT:    10004: ret
+# NOPAC: Disassembly of section .plt:
+# NOPAC: 0000000000010010 .plt:
+# NOPAC-NEXT:    10010: stp     x16, x30, [sp, #-16]!
+# NOPAC-NEXT:    10014: adrp    x16, #131072
+# NOPAC-NEXT:    10018: ldr     x17, [x16, #16]
+# NOPAC-NEXT:    1001c: add     x16, x16, #16
+# NOPAC-NEXT:    10020: br      x17
+# NOPAC-NEXT:    10024: nop
+# NOPAC-NEXT:    10028: nop
+# NOPAC-NEXT:    1002c: nop
+# NOPAC: 0000000000010030 func3@plt:
+# NOPAC-NEXT:    10030: adrp    x16, #131072
+# NOPAC-NEXT:    10034: ldr     x17, [x16, #24]
+# NOPAC-NEXT:    10038: add     x16, x16, #24
+# NOPAC-NEXT:    1003c: br      x17
+
+# NOPACDYN-NOT:   0x0000000070000001 (AARCH64_BTI_PLT)
+# NOPACDYN-NOT:   0x0000000070000003 (AARCH64_PAC_PLT)
+
+# RUN: ld.lld %t1.o %t3.o --shared -o %t.so
+# RUN: llvm-readelf -n %t.so | FileCheck --check-prefix PACPROP %s
+# RUN: llvm-objdump -d -mattr=+v8.3a --no-show-raw-insn %t.so | FileCheck --check-prefix PACSO %s
+# RUN: llvm-readelf -x .got.plt %t.so | FileCheck --check-prefix SOGOTPLT %s
+# RUN: llvm-readelf --dynamic-table %t.so |  FileCheck --check-prefix PACDYN %s
+
+## PAC has no effect on PLT[0], for PLT[N] autia1716 is used to authenticate
+## the address in x17 (context in x16) before branching to it. The dynamic
+## loader is responsible for calling pacia1716 on the entry.
+# PACSO: 0000000000010000 func2:
+# PACSO-NEXT:    10000: bl      #48 <func3@plt>
+# PACSO-NEXT:    10004: ret
+# PACSO: Disassembly of section .plt:
+# PACSO: 0000000000010010 .plt:
+# PACSO-NEXT:    10010: stp     x16, x30, [sp, #-16]!
+# PACSO-NEXT:    10014: adrp    x16, #131072
+# PACSO-NEXT:    10018: ldr     x17, [x16, #16]
+# PACSO-NEXT:    1001c: add     x16, x16, #16
+# PACSO-NEXT:    10020: br      x17
+# PACSO-NEXT:    10024: nop
+# PACSO-NEXT:    10028: nop
+# PACSO-NEXT:    1002c: nop
+# PACSO: 0000000000010030 func3@plt:
+# PACSO-NEXT:    10030: adrp    x16, #131072
+# PACSO-NEXT:    10034: ldr     x17, [x16, #24]
+# PACSO-NEXT:    10038: add     x16, x16, #24
+# PACSO-NEXT:    1003c: autia1716
+# PACSO-NEXT:    10040: br      x17
+# PACSO-NEXT:    10044: nop
+
+# The .got.plt should be identical between the PAC and no PAC DSO PLT.
+# SOGOTPLT: Hex dump of section '.got.plt':
+# SOGOTPLT-NEXT: 0x00030000 00000000 00000000 00000000 00000000
+# SOGOTPLT-NEXT: 0x00030010 00000000 00000000 10000100 00000000
+
+# PACPROP: Properties:    aarch64 feature: PAC
+
+# PACDYN-NOT:      0x0000000070000001 (AARCH64_BTI_PLT)
+# PACDYN:          0x0000000070000003 (AARCH64_PAC_PLT)
+
+## Turn on PAC entries with the --pac-plt command line option. There are no
+## warnings in this case as the choice to use PAC in PLT entries is orthogonal
+## to the choice of using PAC in relocatable objects. The presence of the PAC
+## .note.gnu.property is an indication of preference by the relocatable object.
+
+# RUN: ld.lld %t.o %t2.o --pac-plt %t.so -o %tpacplt.exe
+# RUN: llvm-readelf -n %tpacplt.exe | FileCheck --check-prefix=PACPROP %s
+# RUN: llvm-readelf --dynamic-table %tpacplt.exe | FileCheck --check-prefix PACDYN %s
+# RUN: llvm-objdump -d -mattr=+v8.3a --no-show-raw-insn %tpacplt.exe | FileCheck --check-prefix PACPLT %s
+
+# PACPLT: Disassembly of section .text:
+# PACPLT: 0000000000210000 func1:
+# PACPLT-NEXT:   210000: bl      #48 <func2@plt>
+# PACPLT-NEXT:   210004: ret
+# PACPLT: 0000000000210008 func3:
+# PACPLT-NEXT:   210008: ret
+# PACPLT: Disassembly of section .plt:
+# PACPLT: 0000000000210010 .plt:
+# PACPLT-NEXT:   210010: stp     x16, x30, [sp, #-16]!
+# PACPLT-NEXT:   210014: adrp    x16, #131072
+# PACPLT-NEXT:   210018: ldr     x17, [x16, #16]
+# PACPLT-NEXT:   21001c: add     x16, x16, #16
+# PACPLT-NEXT:   210020: br      x17
+# PACPLT-NEXT:   210024: nop
+# PACPLT-NEXT:   210028: nop
+# PACPLT-NEXT:   21002c: nop
+# PACPLT: 0000000000210030 func2@plt:
+# PACPLT-NEXT:   210030: adrp    x16, #131072
+# PACPLT-NEXT:   210034: ldr     x17, [x16, #24]
+# PACPLT-NEXT:   210038: add     x16, x16, #24
+# PACPLT-NEXT:   21003c: autia1716
+# PACPLT-NEXT:   210040: br      x17
+# PACPLT-NEXT:   210044: nop
+
+
+.section ".note.gnu.property", "a"
+.long 4
+.long 0x10
+.long 0x5
+.asciz "GNU"
+
+.long 0xc0000000 // GNU_PROPERTY_AARCH64_FEATURE_1_AND
+.long 4
+.long 2          // GNU_PROPERTY_AARCH64_FEATURE_1_PAC
+.long 0
+
+.text
+.globl _start
+.type func1,%function
+func1:
+  bl func2
+  ret

test/ELF/aarch64-ifunc-bti.s

+# REQUIRES: aarch64
+# RUN: llvm-mc -filetype=obj -triple=aarch64-none-linux-gnu %s -o %t.o
+# RUN: llvm-mc -filetype=obj -triple=aarch64-none-linux-gnu %p/Inputs/aarch64-addrifunc.s -o %lib.o
+
+# RUN: ld.lld --shared %lib.o -o %lib.so
+# RUN: ld.lld --pie %lib.so %t.o -o %t
+# RUN: llvm-objdump -d -mattr=+bti -triple=aarch64-linux-gnu %t | FileCheck %s
+
+# When the address of an ifunc is taken using a non-got reference which clang
+# can do, LLD exports a canonical PLT entry that may have its address taken so
+# we must use bti c.
+
+# CHECK: Disassembly of section .plt:
+# CHECK: 0000000000010020 .plt:
+# CHECK-NEXT:    10020: 5f 24 03 d5                     bti     c
+# CHECK-NEXT:    10024: f0 7b bf a9                     stp     x16, x30, [sp, #-16]!
+# CHECK-NEXT:    10028: 10 01 00 90                     adrp    x16, #131072
+# CHECK-NEXT:    1002c: 11 0a 40 f9                     ldr     x17, [x16, #16]
+# CHECK-NEXT:    10030: 10 42 00 91                     add     x16, x16, #16
+# CHECK-NEXT:    10034: 20 02 1f d6                     br      x17
+# CHECK-NEXT:    10038: 1f 20 03 d5                     nop
+# CHECK-NEXT:    1003c: 1f 20 03 d5                     nop
+# CHECK: 0000000000010040 func1@plt:
+# CHECK-NEXT:    10040: 5f 24 03 d5                     bti     c
+# CHECK-NEXT:    10044: 10 01 00 90                     adrp    x16, #131072
+# CHECK-NEXT:    10048: 11 0e 40 f9                     ldr     x17, [x16, #24]
+# CHECK-NEXT:    1004c: 10 62 00 91                     add     x16, x16, #24
+# CHECK-NEXT:    10050: 20 02 1f d6                     br      x17
+# CHECK-NEXT:    10054: 1f 20 03 d5                     nop
+# CHECK-NEXT:           ...
+# CHECK: 0000000000010060 myfunc:
+# CHECK-NEXT:    10060: 5f 24 03 d5                     bti     c
+# CHECK-NEXT:    10064: 10 01 00 90                     adrp    x16, #131072
+# CHECK-NEXT:    10068: 11 12 40 f9                     ldr     x17, [x16, #32]
+# CHECK-NEXT:    1006c: 10 82 00 91                     add     x16, x16, #32
+# CHECK-NEXT:    10070: 20 02 1f d6                     br      x17
+# CHECK-NEXT:    10074: 1f 20 03 d5                     nop
+
+.section ".note.gnu.property", "a"
+.long 4
+.long 0x10
+.long 0x5
+.asciz "GNU"
+
+.long 0xc0000000 // GNU_PROPERTY_AARCH64_FEATURE_1_AND
+.long 4
+.long 1          // GNU_PROPERTY_AARCH64_FEATURE_1_BTI
+.long 0
+
+.text
+.globl myfunc
+.type myfunc,@gnu_indirect_function
+myfunc:
+ ret
+
+.globl func1
+
+.text
+.globl _start
+.type _start, %function
+_start:
+  bl func1
+  adrp x8, myfunc
+  add x8, x8, :lo12:myfunc
+  ret

test/ELF/aarch64-property-relocatable.s

+# REQUIRES: aarch64
+# RUN: llvm-mc -filetype=obj -triple=aarch64-linux-gnu %s -o %t.o
+# RUN: ld.lld -r %t.o -o %t2.o
+# RUN: llvm-readelf -n %t2.o | FileCheck -match-full-lines %s
+
+## Test that .note.gnu.property is passed through -r, and that we can handle
+## more than one FEATURE_AND in the same object file. This is logically the
+## same as if the features were combined in a single FEATURE_AND as the rule
+## states that the bit in the output pr_data field if it is set in all
+.text
+ret
+
+.section ".note.gnu.property", "a"
+.p2align 3
+.long 4
+.long 0x10
+.long 0x5
+.asciz "GNU"
+
+.long 0xc0000000 // GNU_PROPERTY_AARCH64_FEATURE_1_AND
+.long 4
+.long 1          // GNU_PROPERTY_AARCH64_FEATURE_1_BTI
+.long 0
+
+.long 4
+.long 0x10
+.long 0x5
+.asciz "GNU"
+.long 0xc0000000 // GNU_PROPERTY_AARCH64_FEATURE_1_AND
+.long 4
+.long 2          // GNU_PROPERTY_AARCH64_FEATURE_1_PAC
+.long 0
+
+# CHECK:   Owner                 Data size  Description
+# CHECK-NEXT:   GNU                   0x00000010  NT_GNU_PROPERTY_TYPE_0 (property note)
+# CHECK-NEXT:     Properties:    aarch64 feature: BTI, PAC

test/ELF/i386-cet.s

 # DISASM-NEXT: 401034:       ff 25 0c 30 40 00       jmpl    *4206604
 # DISASM-NEXT: 40103a:       66 0f 1f 44 00 00       nopw    (%eax,%eax)
 #
 # DISASM:      Contents of section .got.plt:
 # DISASM-NEXT: 403000 00204000 00000000 00000000 20104000
 
 .section ".note.gnu.property", "a"
 .long 4
-.long 0x10
+.long 0xc
 .long 0x5
 .asciz "GNU"
 
 .long 0xc0000002
 .long 4
 .long 3
-.long 0
 
 .text
 .globl func1
 .type func1,@function
 func1:
   call func2
   ret

test/ELF/x86-property-relocatable.s

+# REQUIRES: x86
+# RUN: llvm-mc -filetype=obj -triple=x86_64-unknown-linux %s -o %t.o
+# RUN: ld.lld -r %t.o -o %t2.o
+# RUN: llvm-readelf -n %t2.o | FileCheck -match-full-lines %s
+
+## Test that .note.gnu.property is passed through -r, and that we can handle
+## more than one FEATURE_AND in the same object file. This is logically the
+## same as if the features were combined in a single FEATURE_AND as the rule
+## states that the bit in the output pr_data field if it is set in all
+.text
+ret
+
+.section ".note.gnu.property", "a"
+.p2align 3
+.long 4
+.long 0x10
+.long 0x5
+.asciz "GNU"
+
+.long 0xc0000002 // GNU_PROPERTY_X86_FEATURE_1_AND
+.long 4
+.long 1          // GNU_PROPERTY_X86_FEATURE_1_IBT
+.long 0
+
+.long 4
+.long 0x10
+.long 0x5
+.asciz "GNU"
+.long 0xc0000002 // GNU_PROPERTY_X86_FEATURE_1_AND
+.long 4
+.long 2          // GNU_PROPERTY_X86_FEATURE_1_SHSTK
+.long 0
+
+# CHECK:   Owner                 Data size  Description
+# CHECK-NEXT:   GNU                   0x00000010  NT_GNU_PROPERTY_TYPE_0 (property note)
+# CHECK-NEXT:     Properties:    x86 feature: IBT, SHSTK