[ARM][CMSE] Implement CMSE attributes

[chill]

Summary

This patch adds CMSE attributes cmse_nonsecure_call and cmse_nonsecure_entry.
As usual, specification is available here: https://developer.arm.com/docs/ecm0359818/latest

Patch by Javed Absar, Bradley Smith, David Green, Momchil Velikov, possibly others.

[chill]

Ping?

[aaron.ballman]

You should also add tests in Sema to ensure the attribute appertains to the proper subjects, accepts no arguments, etc (and diagnoses otherwise).

clang/include/clang/Basic/Attr.td

155

Might as well use cast<> here because you already verified the type with the isa<>.

157

Same here.

961

Should these also be exposed via a double-square bracket attribute in both C and C++ mode? If so, under what vendor namespace?

964

No new undocumented attributes, please.

967

If this is intended to apply to types, it should be a TypeAttr instead of an InheritableAttr.

968

Same question here.

970

I don't think the ExpectedFunctionType bit is needed -- the diagnostic text should be pulled from the FunctionTypeDef declaration.

972

Same here.

clang/include/clang/Basic/DiagnosticSemaKinds.td

3122

Please add single quotes around the attribute name, 'cmse_nonsecure_entry'

3189

I don't think this change is necessary.

clang/include/clang/Sema/ParsedAttr.h

943 ↗

(On Diff #232594)

I think this can also be removed.

clang/lib/Sema/SemaDeclAttr.cpp

1997

You can just pass in AL instead of calling getAttrName().

clang/lib/Sema/SemaExpr.cpp

8040–8044

Rather than do isa<> followed by cast<>, better to just use dyn_cast<> and check the results.

8048

Drop the spurious parens.

clang/lib/Sema/SemaType.cpp

7102

Missing full stop at the end of the comment

7104

Can drop the getAttrName() call and just pass in attr.

7109

Missing full stop at the end of the comment

7115

Same here with getAttrName(). You may need to use warn_attribute_wrong_decl_type_str as well.

7132

Missing full stop at the end of the comment

7134

Drop the getAttrName()

[chill]

Phew, finally able to get back to this ...

[chill]

In D71129#1784813, @aaron.ballman wrote:

You should also add tests in Sema to ensure the attribute appertains to the proper subjects, accepts no arguments, etc (and diagnoses otherwise).

Have not forgotten about this one, will add tests.

clang/include/clang/Basic/Attr.td

961

We have not yet decided on such an addition to the ACLE specification.

[aaron.ballman]

clang/include/clang/AST/Type.h

3570–3573

You've gone over 12 with this change, but I'm not certain what changes are needed to Bits to support it (that should have 16 bits of space). Ideas? At the very least, the comment sounds like it's stale now.

clang/include/clang/Basic/DiagnosticDriverKinds.td

383

This is spelled ROPI elsewhere (like in err_drv_ropi_incompatible_with_cxx) -- which capitalization should we use to be consistent?

Also, I think these errors should be combined and use a %select to choose between the terms.

clang/lib/Sema/SemaDecl.cpp

8764

Can elide braces, and I'm pretty sure you can use castAs<> rather than getAs<> due to the preceding assert.

clang/lib/Sema/SemaDeclAttr.cpp

1996

I don't think this check is necessary -- the common attribute handler should already deal with it.

7270–7272

This looks incorrect -- that is a type attribute, not a declaration attribute, so the case should be removed entirely.

clang/lib/Sema/SemaExpr.cpp

8037–8039

const auto * in both cases.

clang/test/Sema/arm-cmse.c

21–22

Can remove some extra whitespace.

[chill]

clang/include/clang/AST/Type.h

3570–3573

Yeah, I'll update the comment. From https://github.com/llvm/llvm-project/commit/ed72e29 it looks like
the comment was mechanically updated with each added bit, whereas it should probably spell:

// Feel free to rearrange or add bits, but if you go over 16,
// you'll need to adjust the Bits field below, and if you add bits, you'll need to
// adjust Type::FunctionTypeBitfields::ExtInfo as well

[aaron.ballman]

clang/include/clang/AST/Type.h

3570–3573

Agreed.

[aaron.ballman]

LGTM aside from some minor nits.

clang/include/clang/Basic/AttrDocs.td

4858–4859

I think we typically go with two space indentation in td files, so this (and below) looks a bit over-indented.

clang/lib/Sema/SemaDeclAttr.cpp

2001–2003

if (cast<FunctionDecl>(D)->getStorageClass() == SC_Static) { is shorter and has the same assertion behavior.

[chill]

Rebased, resolved some merge conflicts, fixed a few nits.

[snidertm]

clang/include/clang/AST/Type.h

3588

Shouldn't RegParmOffset be updated to 9, I believe it is used to shift the regParm value so that it encoded in the bits above CmseNSCallMask

[chill]

clang/include/clang/AST/Type.h

3588

Hmm, I think 8 is OK, but we should mask it ...

3622

... here.

bool getHasRegParm() const { return ((Bits & RegParmMask) >> RegParmOffset) != 0;

[snidertm]

clang/include/clang/AST/Type.h

3604

Wouldn't this overwrite the CmseNSCallMask bit if hasRegParm is true and ((regParm + 1) & 1) is non-zero?

3622

I don't see how this helps. If RegParmOffset is 8 and the CmseNSCall bit is set in Bits, then your proposed getHasRegParm() will return true. Given the above assignment to Bits, we don't know if the CmseNSCall bit was set by cmseNSCall or by regParm.

MIght I be missing something?

[chill]

clang/include/clang/AST/Type.h

3622

No, it will not return true, because the mask will clear all bits, except bits [8-10,13-31].
Bits [13-31] are unused/zero, and in the patch I'm preparing, the RegParmMask will be simply 0x700,
so they will be cleared anyway.
CmseNSCall is bit 12, so it will be cleared. Also RegParm + 1 is at most 7, so, it cannot overflow into
NoCfCheck of CmseNSCall.

[snidertm]

clang/include/clang/AST/Type.h

3622

Got it, ok.

[snidertm]

Have you already committed support for CMSE attributes to the LLVM backend? Or is that on the way?

[snidertm]

clang/lib/CodeGen/CGCall.cpp

1882

Just curious … Does the LLVM backend have a way to extract a StringRef attribute from a CallInst? I know that you can do that with hasFnAttribute(), but I don't see anything for CallInst objects

[chill]

In D71129#1956137, @snidertm wrote:

Have you already committed support for CMSE attributes to the LLVM backend? Or is that on the way?

The last two CMSE patches are under review: https://reviews.llvm.org/D76518

[chill]

clang/lib/CodeGen/CGCall.cpp

1882

 CallInst *CI = ... ;
... = CI->getAttributes().hasFnAttribute("cmse_nonsecure_call"))

clang/include/clang/AST/Type.h

protected:
   class FunctionTypeBitfields {
     friend class FunctionProtoType;
     friend class FunctionType;
 
     unsigned : NumTypeBits;
 
     /// Extra information which affects how the function is called, like
     /// regparm and the calling convention.
-    unsigned ExtInfo : 12;
+    unsigned ExtInfo : 13;
 
     /// The ref-qualifier associated with a \c FunctionProtoType.
     ///
     /// This is a value of type \c RefQualifierKind.
     unsigned RefQualifier : 2;
 
     /// Used only by FunctionProtoType, put here to pack with the
     /// other bitfields.
public:
   // * ASTContext::mergeFunctionTypes
   // * FunctionNoProtoType::Profile
   // * FunctionProtoType::Profile
   // * TypePrinter::PrintFunctionProto
   // * AST read and write
   // * Codegen
   class ExtInfo {
     friend class FunctionType;
 
-    // Feel free to rearrange or add bits, but if you go over 12,
-    // you'll need to adjust both the Bits field below and
-    // Type::FunctionTypeBitfields.
+    // Feel free to rearrange or add bits, but if you go over 16, you'll need to
+    // adjust the Bits field below, and if you add bits, you'll need to adjust
+    // Type::FunctionTypeBitfields::ExtInfo as well.
 
-    //   |  CC  |noreturn|produces|nocallersavedregs|regparm|nocfcheck|
-    //   |0 .. 4|   5    |    6   |       7         |8 .. 10|    11   |
+    // |  CC  |noreturn|produces|nocallersavedregs|regparm|nocfcheck|cmsenscall|
+    // |0 .. 4|   5    |    6   |       7         |8 .. 10|    11   |    12    |
     //
     // regparm is either 0 (no regparm attribute) or the regparm value+1.
     enum { CallConvMask = 0x1F };
     enum { NoReturnMask = 0x20 };
     enum { ProducesResultMask = 0x40 };
     enum { NoCallerSavedRegsMask = 0x80 };
     enum { NoCfCheckMask = 0x800 };
+    enum { CmseNSCallMask = 0x1000 };
     enum {
       RegParmMask = ~(CallConvMask | NoReturnMask | ProducesResultMask |
-                      NoCallerSavedRegsMask | NoCfCheckMask),
+                      NoCallerSavedRegsMask | NoCfCheckMask | CmseNSCallMask),
       RegParmOffset = 8
     }; // Assumed to be the last field
     uint16_t Bits = CC_C;
 
     ExtInfo(unsigned Bits) : Bits(static_cast<uint16_t>(Bits)) {}
 
-   public:
-     // Constructor with no defaults. Use this when you know that you
-     // have all the elements (when reading an AST file for example).
-     ExtInfo(bool noReturn, bool hasRegParm, unsigned regParm, CallingConv cc,
-             bool producesResult, bool noCallerSavedRegs, bool NoCfCheck) {
-       assert((!hasRegParm || regParm < 7) && "Invalid regparm value");
-       Bits = ((unsigned)cc) | (noReturn ? NoReturnMask : 0) |
-              (producesResult ? ProducesResultMask : 0) |
-              (noCallerSavedRegs ? NoCallerSavedRegsMask : 0) |
-              (hasRegParm ? ((regParm + 1) << RegParmOffset) : 0) |
-              (NoCfCheck ? NoCfCheckMask : 0);
+            bool producesResult, bool noCallerSavedRegs, bool NoCfCheck,
+            bool cmseNSCall) {
+             (NoCfCheck ? NoCfCheckMask : 0) |
+             (cmseNSCall ? CmseNSCallMask : 0);
     }
 
     // Constructor with all defaults. Use when for example creating a
     // function known to use defaults.
     ExtInfo() = default;
 
     // Constructor with just the calling convention, which is an important part
     // of the canonical type.
     ExtInfo(CallingConv CC) : Bits(CC) {}
 
     bool getNoReturn() const { return Bits & NoReturnMask; }
     bool getProducesResult() const { return Bits & ProducesResultMask; }
+    bool getCmseNSCall() const { return Bits & CmseNSCallMask; }
     bool getNoCallerSavedRegs() const { return Bits & NoCallerSavedRegsMask; }
     bool getNoCfCheck() const { return Bits & NoCfCheckMask; }
     bool getHasRegParm() const { return (Bits >> RegParmOffset) != 0; }
 
     unsigned getRegParm() const {
       unsigned RegParm = (Bits & RegParmMask) >> RegParmOffset;
       if (RegParm > 0)
         --RegParm;
       return RegParm;
     }
 
public:
 
     ExtInfo withProducesResult(bool producesResult) const {
       if (producesResult)
         return ExtInfo(Bits | ProducesResultMask);
       else
         return ExtInfo(Bits & ~ProducesResultMask);
     }
 
+    ExtInfo withCmseNSCall(bool cmseNSCall) const {
+      if (cmseNSCall)
+        return ExtInfo(Bits | CmseNSCallMask);
+      else
+        return ExtInfo(Bits & ~CmseNSCallMask);
+    }
+
     ExtInfo withNoCallerSavedRegs(bool noCallerSavedRegs) const {
       if (noCallerSavedRegs)
         return ExtInfo(Bits | NoCallerSavedRegsMask);
       else
         return ExtInfo(Bits & ~NoCallerSavedRegsMask);
     }
 
     ExtInfo withNoCfCheck(bool noCfCheck) const {
public:
   bool getHasRegParm() const { return getExtInfo().getHasRegParm(); }
   unsigned getRegParmType() const { return getExtInfo().getRegParm(); }
 
   /// Determine whether this function type includes the GNU noreturn
   /// attribute. The C++11 [[noreturn]] attribute does not affect the function
   /// type.
   bool getNoReturnAttr() const { return getExtInfo().getNoReturn(); }
 
+  bool getCmseNSCallAttr() const { return getExtInfo().getCmseNSCall(); }
   CallingConv getCallConv() const { return getExtInfo().getCC(); }
   ExtInfo getExtInfo() const { return ExtInfo(FunctionTypeBits.ExtInfo); }
 
   static_assert((~Qualifiers::FastMask & Qualifiers::CVRMask) == 0,
                 "Const, volatile and restrict are assumed to be a subset of "
                 "the fast qualifiers.");
 
   bool isConst() const { return getFastTypeQuals().hasConst(); }

clang/include/clang/AST/TypeProperties.td

def : Property<"producesResult", Bool> {
     let Read = [{ node->getExtInfo().getProducesResult() }];
   }
   def : Property<"noCallerSavedRegs", Bool> {
     let Read = [{ node->getExtInfo().getNoCallerSavedRegs() }];
   }
   def : Property<"noCfCheck", Bool> {
     let Read = [{ node->getExtInfo().getNoCfCheck() }];
   }
+  def : Property<"cmseNSCall", Bool> {
+    let Read = [{ node->getExtInfo().getCmseNSCall() }];
+  }
 }
 
 let Class = FunctionNoProtoType in {
   def : Creator<[{
     auto extInfo = FunctionType::ExtInfo(noReturn, hasRegParm, regParm,
                                          callingConvention, producesResult,
-                                         noCallerSavedRegs, noCfCheck);
+                                         noCallerSavedRegs, noCfCheck,
+                                         cmseNSCall);
     return ctx.getFunctionNoProtoType(returnType, extInfo);
   }]>;
 }
 
 let Class = FunctionProtoType in {
   def : Property<"variadic", Bool> {
     let Read = [{ node->isVariadic() }];
   }
def : Property<"extParameterInfo", Array<ExtParameterInfo>> {
     let Read = [{ node->hasExtParameterInfos()
                     ? node->getExtParameterInfos()
                     : llvm::ArrayRef<FunctionProtoType::ExtParameterInfo>() }];
   }
 
   def : Creator<[{
     auto extInfo = FunctionType::ExtInfo(noReturn, hasRegParm, regParm,
                                          callingConvention, producesResult,
-                                         noCallerSavedRegs, noCfCheck);
+                                         noCallerSavedRegs, noCfCheck,
+                                         cmseNSCall);
     FunctionProtoType::ExtProtoInfo epi;
     epi.ExtInfo = extInfo;
     epi.Variadic = variadic;
     epi.HasTrailingReturn = trailingReturn;
     epi.TypeQuals = methodQualifiers;
     epi.RefQualifier = refQualifier;
     epi.ExceptionSpec = exceptionSpecifier;
     epi.ExtParameterInfos =

clang/include/clang/Basic/Attr.td

def HasFunctionProto : SubsetSubject<DeclBase,
                                      [{(S->getFunctionType(true) != nullptr &&
                               isa<FunctionProtoType>(S->getFunctionType())) ||
                                        isa<ObjCMethodDecl>(S) ||
                                        isa<BlockDecl>(S)}],
                                      "non-K&R-style functions">;
 
 // A subject that matches the implicit object parameter of a non-static member
 // function. Accepted as a function type attribute on the type of such a
 // member function.
 // FIXME: This does not actually ever match currently.
 def ImplicitObjectParameter
     : SubsetSubject<Function, [{static_cast<void>(S), false}],
                     "implicit object parameters">;
 
 // A single argument to an attribute
 class Argument<string name, bit optional, bit fake = 0> {
   string Name = name;
   bit Optional = optional;
 

 
 def Cleanup : InheritableAttr {
   let Spellings = [GCC<"cleanup">];
   let Args = [FunctionArgument<"FunctionDecl">];
   let Subjects = SubjectList<[LocalVar]>;
   let Documentation = [Undocumented];
 }
 
+def CmseNSEntry : InheritableAttr, TargetSpecificAttr<TargetARM> {
+  let Spellings = [GNU<"cmse_nonsecure_entry">];
+  let Subjects = SubjectList<[Function]>;
+  let LangOpts = [Cmse];
+  let Documentation = [ArmCmseNSEntryDocs];
+}
+
+def CmseNSCall : TypeAttr, TargetSpecificAttr<TargetARM> {
+  let Spellings = [GNU<"cmse_nonsecure_call">];
+  let LangOpts = [Cmse];
+  let Documentation = [ArmCmseNSCallDocs];
+}
+
 def Cold : InheritableAttr {
   let Spellings = [GCC<"cold">];
   let Subjects = SubjectList<[Function]>;
   let Documentation = [Undocumented];
 }
 
 def Common : InheritableAttr {
   let Spellings = [GCC<"common">];

clang/include/clang/Basic/AttrDocs.td

.. code-block:: c++
   uint16x8_t function();
 
   // This is still permitted with lax vector conversion enabled, even
   // if the vector types have __clang_arm_mve_strict_polymorphism
   int32x4_t result = function();
 
     }];
 }
+
+def ArmCmseNSCallDocs : Documentation {
+    let Category = DocCatType;
+    let Content = [{
+This attribute declares a non-secure function type.  When compiling for secure
+state, a call to such a function would switch from secure to non-secure state.
+All non-secure function calls must happen only through a function pointer, and
+a non-secure function type should only be used as a base type of a pointer.
+See `ARMv8-M Security Extensions: Requirements on Development
+Tools - Engineering Specification Documentation
+<https://developer.arm.com/docs/ecm0359818/latest/>`_ for more information.
+    }];
+}
+
+def ArmCmseNSEntryDocs : Documentation {
+    let Category = DocCatFunction;
+    let Content = [{
+This attribute declares a function that can be called from non-secure state, or
+from secure state. Entering from and returning to non-secure state would switch
+to and from secure state, respectively, and prevent flow of information
+to non-secure state, except via return values. See `ARMv8-M Security Extensions:
+Requirements on Development Tools - Engineering Specification Documentation
+<https://developer.arm.com/docs/ecm0359818/latest/>`_ for more information.
+   }];
+}

clang/include/clang/Basic/DiagnosticDriverKinds.td

 def err_drv_ropi_rwpi_incompatible_with_pic : Error<
   "embedded and GOT-based position independence are incompatible">;
 def err_drv_ropi_incompatible_with_cxx : Error<
   "ROPI is not compatible with c++">;
 
 def err_stack_tagging_requires_hardware_feature : Error<
   "'-fsanitize=memtag' requires hardware support (+memtag)">;
 
+def err_cmse_pi_are_incompatible : Error<
+  "cmse is not compatible with %select{RWPI|ROPI}0">;
+
 def warn_target_unsupported_nan2008 : Warning<
   "ignoring '-mnan=2008' option because the '%0' architecture does not support it">,
   InGroup<UnsupportedNan>;
 def warn_target_unsupported_nanlegacy : Warning<
   "ignoring '-mnan=legacy' option because the '%0' architecture does not support it">,
   InGroup<UnsupportedNan>;
 def warn_target_unsupported_abslegacy : Warning<
   "ignoring '-mabs=legacy' option because the '%0' architecture does not support it">,
   InGroup<UnsupportedAbs>;

clang/include/clang/Basic/DiagnosticSemaKinds.td

def err_attribute_address_space_negative : Error<
   "address space is negative">;
 def err_attribute_address_space_too_high : Error<
   "address space is larger than the maximum supported (%0)">;
 def err_attribute_address_multiple_qualifiers : Error<
   "multiple address spaces specified for type">;
 def warn_attribute_address_multiple_identical_qualifiers : Warning<
   "multiple identical address spaces specified for type">,
   InGroup<DuplicateDeclSpecifier>;
+def err_attribute_not_clinkage : Error<
+  "function type with %0 attribute must have C linkage">;
+def err_function_decl_cmse_ns_call : Error<
+  "functions may not be declared with 'cmse_nonsecure_call' attribute">;
 def err_attribute_address_function_type : Error<
   "function type may not be qualified with an address space">;
 def err_as_qualified_auto_decl : Error<
   "automatic variable qualified with an%select{| invalid}0 address space">;
 def err_arg_with_address_space : Error<
   "parameter may not be qualified with an address space">;
 def err_field_with_address_space : Error<
   "field may not be qualified with an address space">;
def warn_ptr_independentclass_attribute : Warning<
   "pointer type only; attribute is ignored">,
   InGroup<IndependentClassAttribute>;
 def warn_attribute_weak_on_local : Warning<
   "__weak attribute cannot be specified on an automatic variable when ARC "
   "is not enabled">,
   InGroup<IgnoredAttributes>;
 def warn_weak_identifier_undeclared : Warning<
   "weak identifier %0 never declared">;
+def warn_attribute_cmse_entry_static : Warning<
+  "'cmse_nonsecure_entry' cannot be applied to functions with internal linkage">,
+  InGroup<IgnoredAttributes>;
 def err_attribute_weak_static : Error<
   "weak declaration cannot have internal linkage">;
 def err_attribute_selectany_non_extern_data : Error<
   "'selectany' can only be applied to data items with external linkage">;
 def err_declspec_thread_on_thread_variable : Error<
   "'__declspec(thread)' applied to variable that already has a "
   "thread-local storage specifier">;
 def err_attribute_dll_not_extern : Error<
def err_alias_not_supported_on_darwin : Error <
   "aliases are not supported on darwin">;
 def warn_attribute_wrong_decl_type_str : Warning<
   "%0 attribute only applies to %1">, InGroup<IgnoredAttributes>;
 def err_attribute_wrong_decl_type_str : Error<
   warn_attribute_wrong_decl_type_str.Text>;
 def warn_attribute_wrong_decl_type : Warning<
   "%0 attribute only applies to %select{"
   "functions"
   "|unions"
   "|variables and functions"
   "|functions and methods"
   "|functions, methods and blocks"
   "|functions, methods, and parameters"
   "|variables"
   "|variables and fields"
   "|variables, data members and tag types"
   "|types and namespaces"

clang/include/clang/CodeGen/CGFunctionInfo.h

class CGFunctionInfo final
   unsigned ASTCallingConvention : 6;
 
   /// Whether this is an instance method.
   unsigned InstanceMethod : 1;
 
   /// Whether this is a chain call.
   unsigned ChainCall : 1;
 
+  /// Whether this function is a CMSE nonsecure call
+  unsigned CmseNSCall : 1;
+
   /// Whether this function is noreturn.
   unsigned NoReturn : 1;
 
   /// Whether this function is returns-retained.
   unsigned ReturnsRetained : 1;
 
   /// Whether this function saved caller registers.
   unsigned NoCallerSavedRegs : 1;
public:
   unsigned getNumRequiredArgs() const {
     return isVariadic() ? getRequiredArgs().getNumRequiredArgs() : arg_size();
   }
 
   bool isInstanceMethod() const { return InstanceMethod; }
 
   bool isChainCall() const { return ChainCall; }
 
+  bool isCmseNSCall() const { return CmseNSCall; }
+
   bool isNoReturn() const { return NoReturn; }
 
   /// In ARC, whether this function retains its return value.  This
   /// is not always reliable for call sites.
   bool isReturnsRetained() const { return ReturnsRetained; }
 
   /// Whether this function no longer saves caller registers.
   bool isNoCallerSavedRegs() const { return NoCallerSavedRegs; }
public:
   }
 
   bool getHasRegParm() const { return HasRegParm; }
   unsigned getRegParm() const { return RegParm; }
 
   FunctionType::ExtInfo getExtInfo() const {
     return FunctionType::ExtInfo(isNoReturn(), getHasRegParm(), getRegParm(),
                                  getASTCallingConvention(), isReturnsRetained(),
-                                 isNoCallerSavedRegs(), isNoCfCheck());
+                                 isNoCallerSavedRegs(), isNoCfCheck(),
+                                 isCmseNSCall());
   }
 
   CanQualType getReturnType() const { return getArgsBuffer()[0].type; }
 
   ABIArgInfo &getReturnInfo() { return getArgsBuffer()[0].info; }
   const ABIArgInfo &getReturnInfo() const { return getArgsBuffer()[0].info; }
 
   ArrayRef<ExtParameterInfo> getExtParameterInfos() const {
void Profile(llvm::FoldingSetNodeID &ID) {
     ID.AddBoolean(InstanceMethod);
     ID.AddBoolean(ChainCall);
     ID.AddBoolean(NoReturn);
     ID.AddBoolean(ReturnsRetained);
     ID.AddBoolean(NoCallerSavedRegs);
     ID.AddBoolean(HasRegParm);
     ID.AddInteger(RegParm);
     ID.AddBoolean(NoCfCheck);
+    ID.AddBoolean(CmseNSCall);
     ID.AddInteger(Required.getOpaqueData());
     ID.AddBoolean(HasExtParameterInfos);
     if (HasExtParameterInfos) {
       for (auto paramInfo : getExtParameterInfos())
         ID.AddInteger(paramInfo.getOpaqueValue());
     }
     getReturnType().Profile(ID);
     for (const auto &I : arguments())
static void Profile(llvm::FoldingSetNodeID &ID,
     ID.AddBoolean(InstanceMethod);
     ID.AddBoolean(ChainCall);
     ID.AddBoolean(info.getNoReturn());
     ID.AddBoolean(info.getProducesResult());
     ID.AddBoolean(info.getNoCallerSavedRegs());
     ID.AddBoolean(info.getHasRegParm());
     ID.AddInteger(info.getRegParm());
     ID.AddBoolean(info.getNoCfCheck());
+    ID.AddBoolean(info.getCmseNSCall());
     ID.AddInteger(required.getOpaqueData());
     ID.AddBoolean(!paramInfos.empty());
     if (!paramInfos.empty()) {
       for (auto paramInfo : paramInfos)
         ID.AddInteger(paramInfo.getOpaqueValue());
     }
     resultType.Profile(ID);
     for (ArrayRef<CanQualType>::iterator

clang/lib/AST/TypePrinter.cpp

if (!InsideCCAttribute) {
     case CC_PreserveAll:
       OS << " __attribute__((preserve_all))";
       break;
     }
   }
 
   if (Info.getNoReturn())
     OS << " __attribute__((noreturn))";
+  if (Info.getCmseNSCall())
+    OS << " __attribute__((cmse_nonsecure_call))";
   if (Info.getProducesResult())
     OS << " __attribute__((ns_returns_retained))";
   if (Info.getRegParm())
     OS << " __attribute__((regparm ("
        << Info.getRegParm() << ")))";
   if (Info.getNoCallerSavedRegs())
     OS << " __attribute__((no_caller_saved_registers))";
   if (Info.getNoCfCheck())
#include "clang/Basic/AttrList.inc"
   case attr::ObjCInertUnsafeUnretained:
   case attr::ObjCKindOf:
   case attr::ObjCOwnership:
   case attr::Ptr32:
   case attr::Ptr64:
   case attr::SPtr:
   case attr::UPtr:
   case attr::AddressSpace:
+  case attr::CmseNSCall:
     llvm_unreachable("This attribute should have been handled already");
 
   case attr::NSReturnsRetained:
     OS << "ns_returns_retained";
     break;
 
   // FIXME: When Sema learns to form this AttributedType, avoid printing the
   // attribute again in printFunctionProtoAfter.

clang/lib/CodeGen/CGCall.cpp

operator new(totalSizeToAlloc<ArgInfo,             ExtParameterInfo>(
                                   argTypes.size() + 1, paramInfos.size()));
 
   CGFunctionInfo *FI = new(buffer) CGFunctionInfo();
   FI->CallingConvention = llvmCC;
   FI->EffectiveCallingConvention = llvmCC;
   FI->ASTCallingConvention = info.getCC();
   FI->InstanceMethod = instanceMethod;
   FI->ChainCall = chainCall;
+  FI->CmseNSCall = info.getCmseNSCall();
   FI->NoReturn = info.getNoReturn();
   FI->ReturnsRetained = info.getProducesResult();
   FI->NoCallerSavedRegs = info.getNoCallerSavedRegs();
   FI->NoCfCheck = info.getNoCfCheck();
   FI->Required = required;
   FI->HasRegParm = info.getHasRegParm();
   FI->RegParm = info.getRegParm();
   FI->ArgStruct = nullptr;
void CodeGenModule::ConstructAttributeList(
     llvm::AttributeList &AttrList, unsigned &CallingConv, bool AttrOnCallSite) {
   llvm::AttrBuilder FuncAttrs;
   llvm::AttrBuilder RetAttrs;
 
   CallingConv = FI.getEffectiveCallingConvention();
   if (FI.isNoReturn())
     FuncAttrs.addAttribute(llvm::Attribute::NoReturn);
 
+  if (FI.isCmseNSCall())
+    FuncAttrs.addAttribute("cmse_nonsecure_call");
+
   // If we have information about the function prototype, we can learn
   // attributes from there.
   AddAttributesFromFunctionProtoType(getContext(), FuncAttrs,
                                      CalleeInfo.getCalleeFunctionProtoType());
 
   const Decl *TargetDecl = CalleeInfo.getCalleeDecl().getDecl();
 
   bool HasOptnone = false;
if (getLangOpts().OpenCLVersion <= 120) {
       // the work-group size specified to clEnqueueNDRangeKernel
       // (i.e. work groups are uniform).
       FuncAttrs.addAttribute("uniform-work-group-size",
                              llvm::toStringRef(CodeGenOpts.UniformWGSize));
     }
   }
 
   if (!AttrOnCallSite) {
+    if (TargetDecl && TargetDecl->hasAttr<CmseNSEntryAttr>())
+      FuncAttrs.addAttribute("cmse_nonsecure_entry");
+
     bool DisableTailCalls = false;
 
     if (CodeGenOpts.DisableTailCalls)
       DisableTailCalls = true;
     else if (TargetDecl) {
       if (TargetDecl->hasAttr<DisableTailCallsAttr>() ||
           TargetDecl->hasAttr<AnyX86InterruptAttr>())
         DisableTailCalls = true;

clang/lib/Driver/ToolChains/Clang.cpp

if (FunctionAlignment) {
     CmdArgs.push_back(Args.MakeArgString(std::to_string(FunctionAlignment)));
   }
 
   llvm::Reloc::Model RelocationModel;
   unsigned PICLevel;
   bool IsPIE;
   std::tie(RelocationModel, PICLevel, IsPIE) = ParsePICArgs(TC, Args);
 
-  const char *RMName = RelocationModelName(RelocationModel);
+  bool IsROPI = RelocationModel == llvm::Reloc::ROPI ||
+                RelocationModel == llvm::Reloc::ROPI_RWPI;
+  bool IsRWPI = RelocationModel == llvm::Reloc::RWPI ||
+                RelocationModel == llvm::Reloc::ROPI_RWPI;
+
+  if (Args.hasArg(options::OPT_mcmse) &&
+      !Args.hasArg(options::OPT_fallow_unsupported)) {
+    if (IsROPI)
+      D.Diag(diag::err_cmse_pi_are_incompatible) << IsROPI;
+    if (IsRWPI)
+      D.Diag(diag::err_cmse_pi_are_incompatible) << !IsRWPI;
+  }
 
-  if ((RelocationModel == llvm::Reloc::ROPI ||
-       RelocationModel == llvm::Reloc::ROPI_RWPI) &&
-      types::isCXX(Input.getType()) &&
+  if (IsROPI && types::isCXX(Input.getType()) &&
       !Args.hasArg(options::OPT_fallow_unsupported))
     D.Diag(diag::err_drv_ropi_incompatible_with_cxx);
 
+  const char *RMName = RelocationModelName(RelocationModel);
   if (RMName) {
     CmdArgs.push_back("-mrelocation-model");
     CmdArgs.push_back(RMName);
   }
   if (PICLevel > 0) {
     CmdArgs.push_back("-pic-level");
     CmdArgs.push_back(PICLevel == 1 ? "1" : "2");
     if (IsPIE)

clang/lib/Sema/SemaDecl.cpp

 NamedDecl*
 Sema::ActOnFunctionDeclarator(Scope *S, Declarator &D, DeclContext *DC,
                               TypeSourceInfo *TInfo, LookupResult &Previous,
                               MultiTemplateParamsArg TemplateParamListsRef,
                               bool &AddToScope) {
   QualType R = TInfo->getType();
 
   assert(R->isFunctionType());
+  if (R.getCanonicalType()->castAs<FunctionType>()->getCmseNSCallAttr())
+    Diag(D.getIdentifierLoc(), diag::err_function_decl_cmse_ns_call);
+
   SmallVector<TemplateParameterList *, 4> TemplateParamLists;
   for (TemplateParameterList *TPL : TemplateParamListsRef)
     TemplateParamLists.push_back(TPL);
   if (TemplateParameterList *Invented = D.getInventedTemplateParameterList()) {
     if (!TemplateParamLists.empty() &&
         Invented->getDepth() == TemplateParamLists.back()->getDepth())
       TemplateParamLists.back() = Invented;
     else

clang/lib/Sema/SemaDeclAttr.cpp

S.Diag(AL.getLoc(), diag::err_attribute_not_supported_in_lang)
         << AL << AttributeLangSupport::Cpp;
     return;
   }
 
   if (CommonAttr *CA = S.mergeCommonAttr(D, AL))
     D->addAttr(CA);
 }
 
+static void handleCmseNSEntryAttr(Sema &S, Decl *D, const ParsedAttr &AL) {
+  if (S.LangOpts.CPlusPlus && !D->getDeclContext()->isExternCContext()) {
+    S.Diag(AL.getLoc(), diag::err_attribute_not_clinkage) << AL;
+    return;
+  }
+
+  FunctionDecl *FD = D->getAsFunction();
+  assert(FD && "Expected a function declaration!");
+  if (FD->getStorageClass() == SC_Static) {
+    S.Diag(AL.getLoc(), diag::warn_attribute_cmse_entry_static);
+    return;
+  }
+
+  D->addAttr(::new (S.Context) CmseNSEntryAttr(S.Context, AL));
+}
+
 static void handleNakedAttr(Sema &S, Decl *D, const ParsedAttr &AL) {
   if (checkAttrMutualExclusion<DisableTailCallsAttr>(S, D, AL))
     return;
 
   if (AL.isDeclspecAttribute()) {
     const auto &Triple = S.getASTContext().getTargetInfo().getTriple();
     const auto &Arch = Triple.getArch();
     if (Arch != llvm::Triple::x86 &&
case ParsedAttr::AT_Convergent:
     handleSimpleAttribute<ConvergentAttr>(S, D, AL);
     break;
   case ParsedAttr::AT_NoInline:
     handleSimpleAttribute<NoInlineAttr>(S, D, AL);
     break;
   case ParsedAttr::AT_NoInstrumentFunction: // Interacts with -pg.
     handleSimpleAttribute<NoInstrumentFunctionAttr>(S, D, AL);
     break;
+  case ParsedAttr::AT_CmseNSEntry:
+    handleCmseNSEntryAttr(S, D, AL);
+    break;
   case ParsedAttr::AT_NoStackProtector:
     // Interacts with -fstack-protector options.
     handleSimpleAttribute<NoStackProtectorAttr>(S, D, AL);
     break;
   case ParsedAttr::AT_CFICanonicalJumpTable:
     handleSimpleAttribute<CFICanonicalJumpTableAttr>(S, D, AL);
     break;
   case ParsedAttr::AT_StdCall:
   case ParsedAttr::AT_CDecl:
   case ParsedAttr::AT_FastCall:
   case ParsedAttr::AT_ThisCall:

clang/lib/Sema/SemaExpr.cpp

return new (Context)
         ConditionalOperator(Cond.get(), QuestionLoc, LHS.get(), ColonLoc,
                             RHS.get(), result, VK, OK);
 
   return new (Context) BinaryConditionalOperator(
       commonExpr, opaqueValue, Cond.get(), LHS.get(), RHS.get(), QuestionLoc,
       ColonLoc, result, VK, OK);
 }
 
+// Check if we have a conversion between incompatible cmse function pointer
+// types, that is, a conversion between a function pointer with the
+// cmse_nonsecure_call attribute and one without.
+static bool IsInvalidCmseNSCallConversion(Sema &S, QualType FromType,
+                                          QualType ToType) {
+  if (const auto *ToFn =
+          dyn_cast<FunctionType>(S.Context.getCanonicalType(ToType))) {
+    if (const auto *FromFn =
+            dyn_cast<FunctionType>(S.Context.getCanonicalType(FromType))) {
+      FunctionType::ExtInfo ToEInfo = ToFn->getExtInfo();
+      FunctionType::ExtInfo FromEInfo = FromFn->getExtInfo();
+
+      return ToEInfo.getCmseNSCall() != FromEInfo.getCmseNSCall();
+    }
+  }
+  return false;
+}
+
 // checkPointerTypesForAssignment - This is a very tricky routine (despite
 // being closely modeled after the C99 spec:-). The odd characteristic of this
 // routine is it effectively iqnores the qualifiers on the top level pointee.
 // This circumvents the usual type rules specified in 6.2.7p1 & 6.7.5.[1-3].
 // FIXME: add a couple examples in this comment.
 static Sema::AssignConvertType
 checkPointerTypesForAssignment(Sema &S, QualType LHSType, QualType RHSType) {
   assert(LHSType.isCanonical() && "LHS not canonicalized!");
if (!S.Context.typesAreCompatible(ltrans, rtrans)) {
     // General pointer incompatibility takes priority over qualifiers.
     if (RHSType->isFunctionPointerType() && LHSType->isFunctionPointerType())
       return Sema::IncompatibleFunctionPointer;
     return Sema::IncompatiblePointer;
   }
   if (!S.getLangOpts().CPlusPlus &&
       S.IsFunctionConversion(ltrans, rtrans, ltrans))
     return Sema::IncompatibleFunctionPointer;
+  if (IsInvalidCmseNSCallConversion(S, ltrans, rtrans))
+    return Sema::IncompatibleFunctionPointer;
   return ConvTy;
 }
 
 /// checkBlockPointerTypesForAssignment - This routine determines whether two
 /// block pointer types are compatible or whether a block and normal pointer
 /// are compatible. It is more restrict than comparing two function pointer
 // types.
 static Sema::AssignConvertType

clang/lib/Sema/SemaType.cpp

#define CALLING_CONV_ATTRS_CASELIST                                            \
   case ParsedAttr::AT_PreserveMost:                                            \
   case ParsedAttr::AT_PreserveAll
 
 // Function type attributes.
 #define FUNCTION_TYPE_ATTRS_CASELIST                                           \
   case ParsedAttr::AT_NSReturnsRetained:                                       \
   case ParsedAttr::AT_NoReturn:                                                \
   case ParsedAttr::AT_Regparm:                                                 \
+  case ParsedAttr::AT_CmseNSCall:                                              \
   case ParsedAttr::AT_AnyX86NoCallerSavedRegisters:                            \
   case ParsedAttr::AT_AnyX86NoCfCheck:                                         \
     CALLING_CONV_ATTRS_CASELIST
 
 // Microsoft-specific type qualifiers.
 #define MS_TYPE_ATTRS_CASELIST                                                 \
   case ParsedAttr::AT_Ptr32:                                                   \
   case ParsedAttr::AT_Ptr64:                                                   \
if (!unwrapped.isFunctionType())
       return false;
 
     // Otherwise we can process right away.
     FunctionType::ExtInfo EI = unwrapped.get()->getExtInfo().withNoReturn(true);
     type = unwrapped.wrap(S, S.Context.adjustFunctionType(unwrapped.get(), EI));
     return true;
   }
 
+  if (attr.getKind() == ParsedAttr::AT_CmseNSCall) {
+    // Delay if this is not a function type.
+    if (!unwrapped.isFunctionType())
+      return false;
+
+    // Ignore if we don't have CMSE enabled.
+    if (!S.getLangOpts().Cmse) {
+      S.Diag(attr.getLoc(), diag::warn_attribute_ignored) << attr;
+      attr.setInvalid();
+      return true;
+    }
+
+    // Otherwise we can process right away.
+    FunctionType::ExtInfo EI =
+        unwrapped.get()->getExtInfo().withCmseNSCall(true);
+    type = unwrapped.wrap(S, S.Context.adjustFunctionType(unwrapped.get(), EI));
+    return true;
+  }
+
   // ns_returns_retained is not always a type attribute, but if we got
   // here, we're treating it as one right now.
   if (attr.getKind() == ParsedAttr::AT_NSReturnsRetained) {
     if (attr.getNumArgs()) return true;
 
     // Delay if this is not a function type.
     if (!unwrapped.isFunctionType())
       return false;
 
     // Check whether the return type is reasonable.
     if (S.checkNSReturnsRetainedReturnType(attr.getLoc(),
                                            unwrapped.get()->getReturnType()))
       return true;
 
     // Only actually change the underlying type in ARC builds.
     QualType origType = type;
     if (state.getSema().getLangOpts().ObjCAutoRefCount) {
       FunctionType::ExtInfo EI
         = unwrapped.get()->getExtInfo().withProducesResult(true);
       type = unwrapped.wrap(S, S.Context.adjustFunctionType(unwrapped.get(), EI));
     }
     type = state.getAttributedType(
         createSimpleAttr<NSReturnsRetainedAttr>(S.Context, attr),
         origType, type);
     return true;
   }
 

clang/lib/Serialization/ASTWriter.cpp

void ASTWriter::WriteTypeAbbrevs() {
   Abv->Add(BitCodeAbbrevOp(BitCodeAbbrevOp::VBR, 6));   // ReturnType
   Abv->Add(BitCodeAbbrevOp(BitCodeAbbrevOp::Fixed, 1)); // NoReturn
   Abv->Add(BitCodeAbbrevOp(0));                         // HasRegParm
   Abv->Add(BitCodeAbbrevOp(0));                         // RegParm
   Abv->Add(BitCodeAbbrevOp(BitCodeAbbrevOp::Fixed, 4)); // CC
   Abv->Add(BitCodeAbbrevOp(0));                         // ProducesResult
   Abv->Add(BitCodeAbbrevOp(0));                         // NoCallerSavedRegs
   Abv->Add(BitCodeAbbrevOp(0));                         // NoCfCheck
+  Abv->Add(BitCodeAbbrevOp(BitCodeAbbrevOp::Fixed, 1)); // CmseNSCall
   // FunctionProtoType
   Abv->Add(BitCodeAbbrevOp(0));                         // IsVariadic
   Abv->Add(BitCodeAbbrevOp(0));                         // HasTrailingReturn
   Abv->Add(BitCodeAbbrevOp(0));                         // TypeQuals
   Abv->Add(BitCodeAbbrevOp(0));                         // RefQualifier
   Abv->Add(BitCodeAbbrevOp(EST_None));                  // ExceptionSpec
   Abv->Add(BitCodeAbbrevOp(BitCodeAbbrevOp::VBR, 6));   // NumParams
   Abv->Add(BitCodeAbbrevOp(BitCodeAbbrevOp::Array));

clang/test/AST/ast-dump-arm-attr.c

 // RUN: %clang_cc1 -triple arm-apple-darwin -ast-dump -ast-dump-filter Test %s | FileCheck --strict-whitespace %s
+// RUN: %clang_cc1 -triple armv8m.base-none-eabi -mcmse -ast-dump -ast-dump-filter Test %s | FileCheck --strict-whitespace %s --check-prefix=CHECK-CMSE
 
 __attribute__((interrupt)) void Test(void);
 // CHECK: FunctionDecl{{.*}}Test
 // CHECK-NEXT: ARMInterruptAttr
+
+typedef int (*CmseTest)(int a) __attribute__((cmse_nonsecure_call));
+// CHECK-CMSE: TypedefDecl{{.*}}CmseTest{{.*}}__attribute__((cmse_nonsecure_call))

clang/test/CodeGen/arm-cmse-attr.c

+// RUN: %clang_cc1 -triple thumbv8m.base-none-eabi -O1 -emit-llvm %s -o - 2>&1 | \
+// RUN: FileCheck %s --check-prefix=CHECK-NOSE --check-prefix=CHECK
+// RUN: %clang_cc1 -triple thumbebv8m.base-none-eabi -O1 -emit-llvm %s -o - 2>&1 | \
+// RUN: FileCheck %s --check-prefix=CHECK-NOSE --check-prefix=CHECK
+// RUN: %clang_cc1 -triple thumbv8m.base-none-eabi -mcmse -O1 -emit-llvm %s -o - 2>&1 | \
+// RUN: FileCheck %s --check-prefix=CHECK-SE --check-prefix=CHECK
+// RUN: %clang_cc1 -triple thumbebv8m.base-none-eabi -mcmse -O1 -emit-llvm %s -o - 2>&1 | \
+// RUN: FileCheck %s --check-prefix=CHECK-SE --check-prefix=CHECK
+
+typedef void (*callback_t)(void) __attribute__((cmse_nonsecure_call));
+typedef void callback2_t(void) __attribute__((cmse_nonsecure_call));
+
+void f1(callback_t fptr)
+{
+    fptr();
+}
+
+void f2(callback2_t *fptr)
+{
+    fptr();
+}
+
+void f3() __attribute__((cmse_nonsecure_entry));
+void f3()
+{
+}
+
+void f4() __attribute__((cmse_nonsecure_entry))
+{
+}
+
+// CHECK: define void @f1(void ()* nocapture %fptr) {{[^#]*}}#0 {
+// CHECK: call void %fptr() #2
+// CHECK: define void @f2(void ()* nocapture %fptr) {{[^#]*}}#0 {
+// CHECK: call void %fptr() #2
+// CHECK: define void @f3() {{[^#]*}}#1 {
+// CHECK: define void @f4() {{[^#]*}}#1 {
+
+// CHECK-NOSE-NOT: cmse_nonsecure_entry
+// CHECK-NOSE-NOT: cmse_nonsecure_call
+// CHECK-SE: attributes #0 = { nounwind
+// CHECK-SE: attributes #1 = { {{.*}} "cmse_nonsecure_entry"
+// CHECK-SE: attributes #2 = { {{.*}} "cmse_nonsecure_call"

clang/test/CodeGen/arm-cmse-call.c

+// RUN: %clang_cc1 -triple thumbv8m.base-none-eabi -mcmse -O1 -emit-llvm %s -o - 2>&1 | \
+// RUN: FileCheck %s --check-prefix=CHECK
+// RUN: %clang_cc1 -triple thumbebv8m.base-none-eabi -mcmse -O1 -emit-llvm %s -o - 2>&1 | \
+// RUN: FileCheck %s --check-prefix=CHECK
+
+typedef void fn_t(void);
+fn_t s;
+fn_t *p0 __attribute__((cmse_nonsecure_call));
+
+typedef fn_t *pfn_t __attribute__((cmse_nonsecure_call));
+pfn_t p1;
+pfn_t a0[4];
+extern pfn_t a1[];
+
+typedef void (*pfn1_t)(int) __attribute__((cmse_nonsecure_call));
+pfn1_t p2;
+
+typedef fn_t *apfn_t[4] __attribute__((cmse_nonsecure_call));
+apfn_t a2;
+
+typedef pfn_t apfn1_t[4] __attribute__((cmse_nonsecure_call));
+apfn1_t a3;
+
+typedef void (*apfn2_t[4])(void) __attribute__((cmse_nonsecure_call));
+apfn2_t a4;
+
+void (*b[4])(int) __attribute__((cmse_nonsecure_call));
+
+void f(int i) {
+  s();
+// CHECK: call void @s() #[[#A1:]]
+
+  p0();
+// CHECK: %[[#P0:]] = load {{.*}} @p0
+// CHECK: call void %[[#P0]]() #[[#A2:]]
+
+  p1();
+// CHECK: %[[#P1:]] = load {{.*}} @p1
+// CHECK: call void %[[#P1]]() #[[#A2]]
+
+  p2(i);
+// CHECK: %[[#P2:]] = load {{.*}} @p2
+// CHECK: call void %[[#P2]](i32 %i) #[[#A2]]
+
+  a0[i]();
+// CHECK: %[[EP0:.*]] = getelementptr {{.*}} @a0
+// CHECK: %[[#E0:]] = load {{.*}} %[[EP0]]
+// CHECK: call void %[[#E0]]() #[[#A2]]
+
+  a1[i]();
+// CHECK: %[[EP1:.*]] = getelementptr {{.*}} @a1
+// CHECK: %[[#E1:]] = load {{.*}} %[[EP1]]
+// CHECK: call void %[[#E1]]() #[[#A2]]
+
+  a2[i]();
+// CHECK: %[[EP2:.*]] = getelementptr {{.*}} @a2
+// CHECK: %[[#E2:]] = load {{.*}} %[[EP2]]
+// CHECK: call void %[[#E2]]() #[[#A2]]
+
+  a3[i]();
+// CHECK: %[[EP3:.*]] = getelementptr {{.*}} @a3
+// CHECK: %[[#E3:]] = load {{.*}} %[[EP3]]
+// CHECK: call void %[[#E3]]() #[[#A2]]
+
+  a4[i]();
+// CHECK: %[[EP4:.*]] = getelementptr {{.*}} @a4
+// CHECK: %[[#E4:]] = load {{.*}} %[[EP4]]
+// CHECK: call void %[[#E4]]() #[[#A2]]
+
+  b[i](i);
+// CHECK: %[[EP5:.*]] = getelementptr {{.*}} @b
+// CHECK: %[[#E5:]] = load {{.*}} %[[EP5]]
+// CHECK: call void %[[#E5]](i32 %i) #[[#A2]]
+}
+
+// CHECK: attributes #[[#A1]] = { nounwind }
+// CHECK: attributes #[[#A2]] = { nounwind "cmse_nonsecure_call"

clang/test/Driver/ropi-rwpi.c

 // RUN: %clang -target arm-none-eabi -fPIC    -fropi -frwpi -### -c %s 2>&1 | FileCheck --check-prefix=PIC %s
 // RUN: %clang -target arm-none-eabi -fno-pic -fropi        -### -c %s 2>&1 | FileCheck --check-prefix=ROPI %s
 
 // RUN: %clang -target arm-none-eabi -x c++ -fropi        -### -c %s 2>&1 | FileCheck --check-prefix=CXX %s
 // RUN: %clang -target arm-none-eabi -x c++        -frwpi -### -c %s 2>&1 | FileCheck --check-prefix=RWPI %s
 // RUN: %clang -target arm-none-eabi -x c++ -fropi -frwpi -### -c %s 2>&1 | FileCheck --check-prefix=CXX %s
 // RUN: %clang -target arm-none-eabi -x c++ -fallow-unsupported -fropi        -### -c %s 2>&1 | FileCheck --check-prefix=ROPI %s
 
+// RUN: %clang -target arm-none-eabi -march=armv8m.main -fropi -mcmse -### -c %s 2>&1 | FileCheck --check-prefix=ROPI-CMSE   %s
+// RUN: %clang -target arm-none-eabi -march=armv8m.main -frwpi -mcmse -### -c %s 2>&1 | FileCheck --check-prefix=RWPI-CMSE  %s
+// RUN: %clang -target arm-none-eabi -march=armv8m.main -frwpi -fropi -mcmse -### -c %s 2>&1 | FileCheck --check-prefix=ROPI-CMSE --check-prefix=RWPI-CMSE %s
+
+// RUN: %clang -target arm-none-eabi -march=armv8m.main -frwpi -mcmse -fallow-unsupported -### -c %s 2>&1 | FileCheck --check-prefix=RWPI-CMSE-ALLOW-UNSUPPORTED --check-prefix=ROPI-CMSE-ALLOW-UNSUPPORTED  %s
+// RUN: %clang -target arm-none-eabi -march=armv8m.main -fropi -mcmse -fallow-unsupported -### -c %s 2>&1 | FileCheck --check-prefix=ROPI-CMSE-ALLOW-UNSUPPORTED  %s
+// RUN: %clang -target arm-none-eabi -march=armv8m.main -frwpi -fropi -mcmse -fallow-unsupported -### -c %s 2>&1 | FileCheck --check-prefix=ROPI-CMSE-ALLOW-UNSUPPORTED --check-prefix=RWPI-CMSE-ALLOW-UNSUPPORTED %s
+
 
 // STATIC: "-mrelocation-model" "static"
 
 // ROPI: "-mrelocation-model" "ropi"
 
 // RWPI: "-mrelocation-model" "rwpi"
 
 // ROPI-RWPI: "-mrelocation-model" "ropi-rwpi"
 
 // ROPI-NON-ARM: error: unsupported option '-fropi' for target 'x86_64-unknown-linux-gnu'
 // RWPI-NON-ARM: error: unsupported option '-frwpi' for target 'x86_64-unknown-linux-gnu'
 
 // PIC: error: embedded and GOT-based position independence are incompatible
 
 // CXX: error: ROPI is not compatible with c++
+
+// ROPI-CMSE: error: cmse is not compatible with ROPI
+// RWPI-CMSE: error: cmse is not compatible with RWPI
+// ROPI-CMSE-ALLOW-UNSUPPORTED-NOT: error: cmse is not compatible with ROPI
+// RWPI-CMSE-ALLOW-UNSUPPORTED-NOT: error: cmse is not compatible with RWPI

clang/test/Driver/save-temps.c

 // CHECK-OBJ-NOO: "-o" "save-temps.s"
 // CHECK-OBJ-NOO: "-o" "save-temps.o"
 // CHECK-OBJ-NOO: "-o" "a.out"
 
 // RUN: %clang -target i386-unknown-freebsd -save-temps -g -c %s -### 2>&1 \
 // RUN:   | FileCheck %s -check-prefix=CHECK-SAVE-TEMPS
 // CHECK-SAVE-TEMPS: "-cc1as"
 // CHECK-SAVE-TEMPS: "-dwarf-version={{.}}"
+
+// RUN: %clang --target=arm-arm-none-eabi -march=armv8-m.main -mcmse -save-temps -c -v %s 2>&1 \
+// RUN:   | FileCheck %s -check-prefix=CHECK-SAVE-TEMPS-CMSE
+// RUN: %clang --target=arm-arm-none-eabi -march=armv8-m.main -mcmse -x assembler -c -v %s 2>&1 \
+// RUN:   | FileCheck %s -check-prefix=CHECK-SAVE-TEMPS-CMSE
+// CHECK-SAVE-TEMPS-CMSE: -cc1as
+// CHECK-SAVE-TEMPS-CMSE: +8msecext
+// CHECK-SAVE-TEMPS-CMSE-NOT: '+cmse' is not a recognized feature for this target (ignoring feature)

clang/test/Misc/pragma-attribute-supported-attributes-list.test

 // CHECK-NEXT: CUDAHost (SubjectMatchRule_function)
 // CHECK-NEXT: CUDALaunchBounds (SubjectMatchRule_objc_method, SubjectMatchRule_hasType_functionType)
 // CHECK-NEXT: CUDAShared (SubjectMatchRule_variable)
 // CHECK-NEXT: CXX11NoReturn (SubjectMatchRule_function)
 // CHECK-NEXT: CallableWhen (SubjectMatchRule_function_is_member)
 // CHECK-NEXT: Callback (SubjectMatchRule_function)
 // CHECK-NEXT: Capability (SubjectMatchRule_record, SubjectMatchRule_type_alias)
 // CHECK-NEXT: CarriesDependency (SubjectMatchRule_variable_is_parameter, SubjectMatchRule_objc_method, SubjectMatchRule_function)
+// CHECK-NEXT: CmseNSEntry (SubjectMatchRule_function)
 // CHECK-NEXT: Cold (SubjectMatchRule_function)
 // CHECK-NEXT: Common (SubjectMatchRule_variable)
 // CHECK-NEXT: ConstInit (SubjectMatchRule_variable_is_global)
 // CHECK-NEXT: Constructor (SubjectMatchRule_function)
 // CHECK-NEXT: Consumable (SubjectMatchRule_record)
 // CHECK-NEXT: ConsumableAutoCast (SubjectMatchRule_record)
 // CHECK-NEXT: ConsumableSetOnRead (SubjectMatchRule_record)
 // CHECK-NEXT: Convergent (SubjectMatchRule_function)

clang/test/Sema/arm-cmse.c

+// RUN: %clang_cc1 -triple thumbv8m.base-none-eabi -mcmse -verify %s
+
+typedef void (*callback_ns_1t)() __attribute__((cmse_nonsecure_call));
+typedef void (*callback_1t)();
+typedef void (*callback_ns_2t)() __attribute__((cmse_nonsecure_call));
+typedef void (*callback_2t)();
+
+void foo(callback_ns_1t nsfptr, // expected-error{{functions may not be declared with 'cmse_nonsecure_call' attribute}}
+         callback_1t fptr) __attribute__((cmse_nonsecure_call))
+{
+  callback_1t fp1 = nsfptr; // expected-warning{{incompatible function pointer types initializing 'callback_1t'}}
+  callback_ns_1t fp2 = fptr; // expected-warning{{incompatible function pointer types initializing 'callback_ns_1t'}}
+  callback_2t fp3 = fptr;
+  callback_ns_2t fp4 = nsfptr;
+}
+
+static void bar() __attribute__((cmse_nonsecure_entry)) // expected-warning{{'cmse_nonsecure_entry' cannot be applied to functions with internal linkage}}
+{
+}
+
+typedef void nonsecure_fn_t(int) __attribute__((cmse_nonsecure_call));
+extern nonsecure_fn_t baz; // expected-error{{functions may not be declared with 'cmse_nonsecure_call' attribute}}
+
+int v0 __attribute__((cmse_nonsecure_call)); // expected-warning {{'cmse_nonsecure_call' only applies to function types; type here is 'int'}}
+int v1 __attribute__((cmse_nonsecure_entry)); // expected-warning {{'cmse_nonsecure_entry' attribute only applies to functions}}
+
+void fn0() __attribute__((cmse_nonsecure_entry));
+void fn1() __attribute__((cmse_nonsecure_entry(1)));  // expected-error {{'cmse_nonsecure_entry' attribute takes no arguments}}
+
+typedef void (*fn2_t)() __attribute__((cmse_nonsecure_call("abc"))); // expected-error {{'cmse_nonsecure_call' attribute takes no argument}}

clang/test/Sema/arm-no-cmse.c

+// RUN: %clang_cc1 -triple thumbv8m.base-none-eabi -verify %s
+
+typedef void (*callback_ns_1t)()
+  __attribute__((cmse_nonsecure_call)); // expected-warning{{'cmse_nonsecure_call' attribute ignored}}
+
+void f()
+  __attribute__((cmse_nonsecure_entry)) {} // expected-warning{{'cmse_nonsecure_entry' attribute ignored}}

clang/test/SemaCXX/arm-cmse.cpp

+// RUN: %clang_cc1 -triple thumbv8m.base-none-eabi -mcmse -verify %s
+
+extern "C" void foo() __attribute__((cmse_nonsecure_entry)) {}
+
+void bar() __attribute__((cmse_nonsecure_entry)) {} // expected-error{{function type with 'cmse_nonsecure_entry' attribute must have C linkage}}