[AArch64] Handle BTI/PAC in case of generated functions.

[danielkiss]

Summary

Functions can be added not just by the fronted and PAC/BTI attributes
should be added to those too. The new pass manages the attributes.
After this change the all runtime created functions like _clang_call_terminate
or constructor that is emitted by a sanitizer will be handled for PAC/BTI if applicable.

[danielkiss]

Previous version of the patch handled only the functions that are created in clang. Sanitizers can't see the codegen options therefore they also disables BTI.
This version of the patch is less invasive in my opinion, effects only aarch64.
branch-target-enforcement(BTI) and sign-return-address(PAC) are added to all function that comes from clang frontend.
If the backend encounters with the function without BTI attribute but the module is compiled with BTI then it assumes it should be made BTI compatible.

[chill]

That said, my comments are not of the "over my dead body" kind ;)

clang/lib/CodeGen/CGCall.cpp

1827

I would really prefer to not set values "true" or "false" for the attribute: we don't really have tri-state logic there (absent/present-true/present-false), and those values just add some not-very useful string processing.

1830

What do we get from setting the PACBTI state in the default function attributes? We still have
to do a per function processing, we can just as well avoid repeating the logic, and spare us some
adding and potentially removing attributes churn.

llvm/lib/Target/AArch64/AArch64AsmPrinter.cpp

200

This should be "true", although the comment might turn out moot.

If we somehow end up with a function, that does not have that attribute, we should clear the
ELF flag.

201–202

... that kind of string processing, here and elsewhere.

llvm/lib/Target/AArch64/AArch64BranchTargets.cpp

61–65

Isn't there some redundancy with the two calls to getFnAttribute and to hasFnAttribute ?

[chill]

llvm/lib/Target/AArch64/AArch64AsmPrinter.cpp

200

Oh, I see, those are the cases of sanitizer functions, created at LLVM level, that don't have the attribute.
Please, leave a comment in that sense.

[danielkiss]

Thanks for the comments, patch is improved
isStringAttribute() check removed, the attribute is always a string in this case or "null" so the check is not needed.
Function level the attribute is now only change when needed, so as the function level attribute is expected to be rare I hope the performance won't be impacted by the patch.
I kept the "tri-state" logic because of the emitted functions. Introducing a "branch-target-enforcement-disabled" attribute seems even more confusing for me.

[danielkiss]

clang/lib/CodeGen/CGCall.cpp

1827

the attribute will be "absent" for the runtime emitted function.

1830

in the new patch the per function processing will change the attribute only if really need.

llvm/lib/Target/AArch64/AArch64BranchTargets.cpp

62

emmited -> emitted

[danielkiss]

Patch is rebased, test is updated.

[danielkiss]

ping

[chill]

clang/lib/CodeGen/CGCall.cpp

1827

How about setting the attribute for LLVM created functions at the time of creation, just like Clang created functions
get their attribute at the time of creation?

1830

Sure, but that's duplication of code/logic, it's a source of countless issues "oh, here's the place I should fix that thing ... oh noes, turns out I have to fix ten more ... hope I've found all ..." ;)

llvm/lib/Target/AArch64/AArch64AsmPrinter.cpp

200

Or, as mentioned in the other comment, check if it's possible to set the attribute at the time of creation (from module attributes?). Tri-state logic is added complexity, if it's necessary, it's necessary, but if it's not, better make it simpler.

[danielkiss]

clang/lib/CodeGen/CGCall.cpp

1827

Attributes are not always set in clang as I see:
CodeGenModule::CreateRuntimeFunction() -> CodeGenModule::GetOrCreateLLVMFunction
CreateRuntimeFunction could be fixed but, the common location for LLVM created function is the llvm::Function::Create() where the CodeGenOpts and LangOpts are no available.
Adding target specific code there seems not right for me.

[danielkiss]

clang/lib/CodeGen/TargetInfo.cpp

5149–5152

I'm going to rebase the patch. I add there a new attribute here "ignore-branch-target-enforcement"
so then the "branch-target-enforcement"="true"/"false" could be just "branch-target-enforcement".

[danielkiss]

The patched is rebased and the hopefully the logic is now simpler.

[tamas.petz]

clang/lib/CodeGen/CGCall.cpp

1826–1827

LangOptions has the following functions:

• hasSignReturnAddress()
• isSignReturnAddressWithAKey()
• isSignReturnAddressScopeAll()

With these functions some of these lines can be significantly reduced.

1836

Use getLangOpts(). isSignReturnAddressWithAKey()

clang/lib/CodeGen/CodeGenModule.cpp

595

Use new functions please.

[danielkiss]

Fix review comments from Tamas.

[chill]

clang/lib/CodeGen/TargetInfo.cpp

5149–5152

TBH, that's worse, IMHO.

Ideally, I *think* we'd like *every* LLVM IR function that the backend sees,
regardless of how, why and by whom it is created, to have (or not have)
the three existing PACBTI attributes "sign-return-address", "sign-return-address-key", and "branch-target-enforcement", so the backend can generate code accordingly.

The module attributes are LLVM IR metadata, and AFAIK LLVM IR metadata is an optional extra,
it should not affect correctness.
Indeed, *module* metadata is a somwhat grey area, better not use it if there a way around it.

[tamas.petz]

clang/lib/CodeGen/TargetInfo.cpp

5149–5152

Which case are you trying to handle here?
Is this the case, for example, when -mbranch-protection=standard is set but a function has _attribute _((target("branch-protection=none")))?

[danielkiss]

clang/lib/CodeGen/TargetInfo.cpp

5149–5152

Chill: I think I have code that solve that for clang created functions, but functions created in llvm I don't have any idea.

Tamas: yes, that is the case when module is compiled with bti but the function is not ( "none" or "pac-ret" and so on. )

[danielkiss]

Patch is refactored, the new pass smooth out the attribute issues.
This version fixes issues with _clang_call_terminate, sanitisers and the CFI.
New pass might need a new file, I'm not yet convinced myself.

[danielkiss]

depends on D80791

[chill]

This approach looks way too hackish to me with multiple opposing attributes ("sign-return-address" vs. "ignore-sign-return-address")
and some convoluted logic to resolve the contradiction.

[danielkiss]

Would it be better to add a new value to "sign-return-address" as "none"? I don't see any other alternative option, I'm open to any other idea.

[ktkachov]

In D75181#2193447, @danielkiss wrote:

Would it be better to add a new value to "sign-return-address" as "none"? I don't see any other alternative option, I'm open to any other idea.

FWIW GCC has a "sign-return-address" function attribute with a default value of "none". It is considered deprecated, however, in favour of "branch-protection"

[danielkiss]

FWIW GCC has a "sign-return-address" function attribute with a default value of "none". It is considered deprecated, however, in favour of "branch-protection"

This is just the internal representation, the function attribute in C/C++ source is the "branch-protection".

Old version of the patch used attribute value to represent the "ignore"/disabled state https://reviews.llvm.org/D75181?id=247201 so I have no idea what would be the right solution.

[chill]

In D75181#2193447, @danielkiss wrote:

I don't see any other alternative option, I'm open to any other idea.

My original idea was to pass options to LLVM. I'll come up with a patch in a day or two (if it works) and then we'll see.

[danielkiss]

Abandoning in favour of D85649.

clang/lib/CodeGen/CGCall.cpp

if (getLangOpts().CUDA && getLangOpts().CUDAIsDevice) {
     FuncAttrs.addAttribute(llvm::Attribute::NoUnwind);
   }
 
   for (StringRef Attr : CodeGenOpts.DefaultFunctionAttrs) {
     StringRef Var, Value;
     std::tie(Var, Value) = Attr.split('=');
     FuncAttrs.addAttribute(Var, Value);
   }
+
+  if (CodeGenOpts.BranchTargetEnforcement) {
+    FuncAttrs.addAttribute("branch-target-enforcement", "true");
+  }
+
+  auto RASignKind = CodeGenOpts.getSignReturnAddress();
+  if (RASignKind != CodeGenOptions::SignReturnAddressScope::None) {
+    FuncAttrs.addAttribute(
+        "sign-return-address",
+        RASignKind == CodeGenOptions::SignReturnAddressScope::All ? "all"
+                                                                  : "non-leaf");
+    auto RASignKey = CodeGenOpts.getSignReturnAddressKey();
+    FuncAttrs.addAttribute(
+        "sign-return-address-key",
+        RASignKey == CodeGenOptions::SignReturnAddressKeyValue::AKey ? "a_key"
+                                                                     : "b_key");
+  }
 }
 
 void CodeGenModule::AddDefaultFnAttrs(llvm::Function &F) {
   llvm::AttrBuilder FuncAttrs;
   ConstructDefaultFnAttrList(F.getName(), F.hasOptNone(),
                              /* AttrOnCallSite = */ false, FuncAttrs);
   F.addAttributes(llvm::AttributeList::FunctionIndex, FuncAttrs);
 }

clang/lib/CodeGen/CGDeclCXX.cpp

if (RASignKind != CodeGenOptions::SignReturnAddressScope::None) {
     auto RASignKey = getCodeGenOpts().getSignReturnAddressKey();
     Fn->addFnAttr("sign-return-address-key",
                   RASignKey == CodeGenOptions::SignReturnAddressKeyValue::AKey
                       ? "a_key"
                       : "b_key");
   }
 
   if (getCodeGenOpts().BranchTargetEnforcement)
-    Fn->addFnAttr("branch-target-enforcement");
+    Fn->addFnAttr("branch-target-enforcement", "true");
 
   return Fn;
 }
 
 /// Create a global pointer to a function that will initialize a global
 /// variable.  The user has requested that this pointer be emitted in a specific
 /// section.
 void CodeGenModule::EmitPointerToInitFunc(const VarDecl *D,

clang/lib/CodeGen/CodeGenModule.cpp

void CodeGenModule::Release() {
 
   if (CodeGenOpts.CFProtectionBranch &&
       Target.checkCFProtectionBranchSupported(getDiags())) {
     // Indicate that we want to instrument branch control flow protection.
     getModule().addModuleFlag(llvm::Module::Override, "cf-protection-branch",
                               1);
   }
 
+  if (CodeGenOpts.BranchTargetEnforcement) {
+    getModule().addModuleFlag(llvm::Module::Override,
+                              "branch-target-enforcement", 1);
+  }
+
+  CodeGenOptions::SignReturnAddressScope Scope =
+      CodeGenOpts.getSignReturnAddress();
+  if (Scope != CodeGenOptions::SignReturnAddressScope::None) {
+    getModule().addModuleFlag(
+        llvm::Module::Override, "sign-return-address",
+        Scope == CodeGenOptions::SignReturnAddressScope::All
+            ? llvm::MDString::get(VMContext, "all")
+            : llvm::MDString::get(VMContext, "non-leaf"));
+    getModule().addModuleFlag(
+        llvm::Module::Override, "sign-return-address-key",
+        CodeGenOpts.getSignReturnAddressKey() ==
+                CodeGenOptions::SignReturnAddressKeyValue::AKey
+            ? llvm::MDString::get(VMContext, "a_key")
+            : llvm::MDString::get(VMContext, "b_key"));
+  }
+
   if (LangOpts.CUDAIsDevice && getTriple().isNVPTX()) {
     // Indicate whether __nvvm_reflect should be configured to flush denormal
     // floating point values to 0.  (This corresponds to its "__CUDA_FTZ"
     // property.)
     getModule().addModuleFlag(llvm::Module::Override, "nvvm-reflect-ftz",
                               CodeGenOpts.FP32DenormalMode.Output !=
                                   llvm::DenormalMode::IEEE);
   }

clang/lib/CodeGen/TargetInfo.cpp

public:
   bool doesReturnSlotInterfereWithArgs() const override { return false; }
 
   void setTargetAttributes(const Decl *D, llvm::GlobalValue *GV,
                            CodeGen::CodeGenModule &CGM) const override {
     const FunctionDecl *FD = dyn_cast_or_null<FunctionDecl>(D);
     if (!FD)
       return;
 
-    CodeGenOptions::SignReturnAddressScope Scope = CGM.getCodeGenOpts().getSignReturnAddress();
-    CodeGenOptions::SignReturnAddressKeyValue Key = CGM.getCodeGenOpts().getSignReturnAddressKey();
-    bool BranchTargetEnforcement = CGM.getCodeGenOpts().BranchTargetEnforcement;
     if (const auto *TA = FD->getAttr<TargetAttr>()) {
       ParsedTargetAttr Attr = TA->parse();
       if (!Attr.BranchProtection.empty()) {
         TargetInfo::BranchProtectionInfo BPI;
         StringRef Error;
+
+        CodeGenOptions::SignReturnAddressScope Scope =
+            CGM.getCodeGenOpts().getSignReturnAddress();
+        CodeGenOptions::SignReturnAddressKeyValue Key =
+            CGM.getCodeGenOpts().getSignReturnAddressKey();
+        bool BranchTargetEnforcement =
+            CGM.getCodeGenOpts().BranchTargetEnforcement;
+
         (void)CGM.getTarget().validateBranchProtection(Attr.BranchProtection,
                                                        BPI, Error);
         assert(Error.empty());
+        auto *Fn = cast<llvm::Function>(GV);
+
+        // Update flags only when differ from the codegen flags.
+        if (Scope != BPI.SignReturnAddr || Key != BPI.SignKey) {
           Scope = BPI.SignReturnAddr;
           Key = BPI.SignKey;
-        BranchTargetEnforcement = BPI.BranchTargetEnforcement;
-      }
-    }
-
-    auto *Fn = cast<llvm::Function>(GV);
           if (Scope != CodeGenOptions::SignReturnAddressScope::None) {
             Fn->addFnAttr("sign-return-address",
                           Scope == CodeGenOptions::SignReturnAddressScope::All
                               ? "all"
                               : "non-leaf");
 
             Fn->addFnAttr("sign-return-address-key",
                           Key == CodeGenOptions::SignReturnAddressKeyValue::AKey
                               ? "a_key"
                               : "b_key");
+          } else {
+            Fn->removeAttribute(llvm::AttributeList::FunctionIndex,
+                                "sign-return-address");
+            Fn->removeAttribute(llvm::AttributeList::FunctionIndex,
+                                "sign-return-address-key");
+          }
+        }
+        if (BranchTargetEnforcement != BPI.BranchTargetEnforcement) {
+          if (BPI.BranchTargetEnforcement)
+            Fn->addFnAttr("branch-target-enforcement", "true");
+          else
+            Fn->addFnAttr("branch-target-enforcement", "false");
+        }
+      }
     }
-
-    if (BranchTargetEnforcement)
-      Fn->addFnAttr("branch-target-enforcement");
   }
   llvm::Value *decodeReturnAddress(CodeGen::CodeGenFunction &CGF,
                                    llvm::Value *Address) const override {
     CodeGenOptions::SignReturnAddressScope Scope =
         CGF.CGM.getCodeGenOpts().getSignReturnAddress();
     if (Scope == CodeGenOptions::SignReturnAddressScope::None) {
       return Address;
     }

clang/test/CodeGen/aarch64-branch-protection-attr.c

 // REQUIRES: aarch64-registered-target
 // RUN: %clang_cc1 -triple aarch64-unknown-unknown-eabi -emit-llvm  -target-cpu generic -target-feature +v8.5a %s -o - \
 // RUN:                               | FileCheck %s --check-prefix=CHECK --check-prefix=NO-OVERRIDE
 // RUN: %clang_cc1 -triple aarch64-unknown-unknown-eabi -emit-llvm  -target-cpu generic -target-feature +v8.5a %s -o - \
 // RUN:   -msign-return-address=non-leaf -msign-return-address-key=a_key -mbranch-target-enforce \
 // RUN:                               | FileCheck %s --check-prefix=CHECK --check-prefix=OVERRIDE
 
 void missing() {}
 // NO-OVERRIDE: define void @missing() #[[#NONE:]]
 // OVERRIDE: define void @missing() #[[#STD:]]
 
 __attribute__ ((target("branch-protection=none")))
 void none() {}
-// NO-OVERRIDE: define void @none() #[[#NONE]]
+// NO-OVERRIDE: define void @none() #[[#NONE:]]
 // OVERRIDE: define void @none() #[[#NONE:]]
 
   __attribute__ ((target("branch-protection=standard")))
 void std() {}
 // NO-OVERRIDE: define void @std() #[[#STD:]]
 // OVERRIDE: define void @std() #[[#STD]]
 
 __attribute__ ((target("branch-protection=bti")))

 
 __attribute__ ((target("branch-protection=pac-ret+b-key+leaf")))
 void bkeyleaf0() {}
 // NO-OVERRIDE: define void @bkeyleaf0()  #[[#PACBKEYLEAF:]]
 // OVERRIDE: define void @bkeyleaf0()  #[[#PACBKEYLEAF:]]
 
 __attribute__ ((target("branch-protection=pac-ret+leaf+b-key")))
 void bkeyleaf1() {}
-// NO-OVERRIDE: define void @bkeyleaf1()  #[[#PACBKEYLEAF]]
-// OVERRIDE: define void @bkeyleaf1()  #[[#PACBKEYLEAF]]
+// NO-OVERRIDE: define void @bkeyleaf1()  #[[#PACBKEYLEAF:]]
+// OVERRIDE: define void @bkeyleaf1()  #[[#PACBKEYLEAF:]]
 
 __attribute__ ((target("branch-protection=pac-ret+leaf+bti")))
 void btileaf() {}
 // NO-OVERRIDE: define void @btileaf() #[[#BTIPACLEAF:]]
 // OVERRIDE: define void @btileaf() #[[#BTIPACLEAF:]]
 
-// CHECK-DAG: attributes #[[#NONE]]
+// NO-OVERRIDE-DAG: attributes #[[#NONE]] = { {{.*}}
+// OVERRIDE-DAG: attributes #[[#NONE]] = { {{.*}} "branch-target-enforcement"="false"
 
-// CHECK-DAG: attributes #[[#STD]] = { {{.*}} "branch-target-enforcement" {{.*}} "sign-return-address"="non-leaf" "sign-return-address-key"="a_key"
+// CHECK-DAG: attributes #[[#STD]] = { {{.*}} "branch-target-enforcement"="true" {{.*}} "sign-return-address"="non-leaf" "sign-return-address-key"="a_key"
 
-// CHECK-DAG: attributes #[[#BTI]] = { {{.*}}"branch-target-enforcement"
+// CHECK-DAG: attributes #[[#BTI]] = { {{.*}} "branch-target-enforcement"="true"
 
-// CHECK-DAG: attributes #[[#PAC]] = { {{.*}} "sign-return-address"="non-leaf" "sign-return-address-key"="a_key"
+// NO-OVERRIDE-DAG: attributes #[[#PAC]] = { {{.*}} "sign-return-address"="non-leaf" "sign-return-address-key"="a_key"
+// OVERRIDE-DAG: attributes #[[#PAC]] = { {{.*}} "branch-target-enforcement"="false" {{.*}} "sign-return-address"="non-leaf" "sign-return-address-key"="a_key"
 
-// CHECK-DAG: attributes #[[#PACLEAF]] = { {{.*}} "sign-return-address"="all" "sign-return-address-key"="a_key"
+// NO-OVERRIDE-DAG: attributes #[[#PACLEAF]] = { {{.*}} "sign-return-address"="all" "sign-return-address-key"="a_key"
+// OVERRIDE-DAG: attributes #[[#PACLEAF]] = { {{.*}} "branch-target-enforcement"="false" {{.*}} "sign-return-address"="all" "sign-return-address-key"="a_key"
 
-// CHECK-DAG: attributes #[[#PACBKEY]] = { {{.*}} "sign-return-address"="non-leaf" "sign-return-address-key"="b_key"
+// NO-OVERRIDE-DAG: attributes #[[#PACBKEY]] = { {{.*}} "sign-return-address"="non-leaf" "sign-return-address-key"="b_key"
+// OVERRIDE: attributes #[[#PACBKEY]] = { {{.*}} "branch-target-enforcement"="false" {{.*}} "sign-return-address"="non-leaf" "sign-return-address-key"="b_key"
 
-// CHECK-DAG: attributes #[[#PACBKEYLEAF]] = { {{.*}} "sign-return-address"="all" "sign-return-address-key"="b_key"
+// NO-OVERRIDE-DAG: attributes #[[#PACBKEYLEAF]] = { {{.*}} "sign-return-address"="all" "sign-return-address-key"="b_key"
+// OVERRIDE-DAG: attributes #[[#PACBKEYLEAF]] = { {{.*}} "branch-target-enforcement"="false" {{.*}} "sign-return-address"="all" "sign-return-address-key"="b_key"
 
-// CHECK-DAG: attributes #[[#BTIPACLEAF]] = { {{.*}}"branch-target-enforcement" {{.*}} "sign-return-address"="all" "sign-return-address-key"="a_key"
+// CHECK-DAG: attributes #[[#BTIPACLEAF]] = { {{.*}} "branch-target-enforcement"="true" {{.*}} "sign-return-address"="all" "sign-return-address-key"="a_key"

clang/test/CodeGen/aarch64-sign-return-address.c

 // CHECK: @foo() #[[ATTR:[0-9]*]]
 //
 // NONE-NOT: "sign-return-address"={{.*}}
 
 // PARTIAL: "sign-return-address"="non-leaf"
 
 // ALL: "sign-return-address"="all"
 
-// BTE: "branch-target-enforcement"
+// BTE: "branch-target-enforcement"="true"
 
 // A-KEY: "sign-return-address-key"="a_key"
 
 // B-KEY: "sign-return-address-key"="b_key"
 
 void foo() {}

clang/test/CodeGenCXX/aarch64-branch-target_clang_call_terminate.cpp

+// RUN: %clang  -target aarch64-linux-android -mbranch-protection=none -c %s -o - | \
+// RUN: llvm-objdump -d -mattr=+bti - | FileCheck %s --check-prefix=CHECK --check-prefix=CHECK-NONE
+// RUN: %clang -target aarch64-linux-android -mbranch-protection=pac-ret -c %s -o - | \
+// RUN: llvm-objdump -d -mattr=+bti - | FileCheck %s --check-prefix=CHECK --check-prefix=CHECK-NONE
+// RUN: %clang -target aarch64-linux-android -mbranch-protection=pac-ret+leaf -c %s -o - | \
+// RUN: llvm-objdump -d -mattr=+bti - | FileCheck %s --check-prefix=CHECK --check-prefix=CHECK-NONE
+// RUN: %clang -target aarch64-linux-android -mbranch-protection=pac-ret+b-key -c %s -o - | \
+// RUN: llvm-objdump -d -mattr=+bti - | FileCheck %s --check-prefix=CHECK --check-prefix=CHECK-NONE
+// RUN: %clang -target aarch64-linux-android -mbranch-protection=pac-ret+b-key+leaf -c %s -o - | \
+// RUN: llvm-objdump -d -mattr=+bti - | FileCheck %s --check-prefix=CHECK --check-prefix=CHECK-NONE
+// RUN: %clang -target aarch64-linux-android -mbranch-protection=standard -c %s -o - | \
+// RUN: llvm-objdump -d -mattr=+bti - | FileCheck %s --check-prefix=CHECK --check-prefix=CHECK-BTI
+// RUN: %clang -target aarch64-linux-android -mbranch-protection=bti -c %s -o - | \
+// RUN: llvm-objdump -d -mattr=+bti - | FileCheck %s --check-prefix=CHECK --check-prefix=CHECK-BTI
+// RUN: %clang -target aarch64-linux-android -mbranch-protection=pac-ret+b-key+leaf+bti -c %s -o - | \
+// RUN: llvm-objdump -d -mattr=+bti - | FileCheck %s --check-prefix=CHECK --check-prefix=CHECK-BTI
+
+void a();
+void d();
+
+void c() {
+  try {
+    d();
+  } catch (...) {
+    a();
+  }
+}
+
+// CHECK-BTI: 0000000000000000 __clang_call_terminate:
+// CHECK-BTI-NEXT:            bti     c
+// CHECK-BTI-NEXT:            str     x30, [sp, #-16]!
+
+// CHECK-NONE: 0000000000000000 __clang_call_terminate:
+// CHECK-NONE-NEXT:           str     x30, [sp, #-16]!

clang/test/CodeGenCXX/aarch64-sign-return-address-static-ctor.cpp

 
 // CHECK: @[[CTOR_FN]]() #[[ATTR:[0-9]*]]
 
 // CHECK-NONE-NOT: "sign-return-address"={{.*}}
 // CHECK-PARTIAL: "sign-return-address"="non-leaf"
 // CHECK-ALL: "sign-return-address"="all"
 // CHECK-A-KEY: "sign-return-address-key"="a_key"
 // CHECK-B-KEY: "sign-return-address-key"="b_key"
-// CHECK-BTE: "branch-target-enforcement"
+// CHECK-BTE: "branch-target-enforcement"="true"

llvm/lib/Target/AArch64/AArch64AsmPrinter.cpp

 
 } // end anonymous namespace
 
 void AArch64AsmPrinter::emitStartOfAsmFile(Module &M) {
   if (!TM.getTargetTriple().isOSBinFormatELF())
     return;
 
   // Assemble feature flags that may require creation of a note section.
-  unsigned Flags = ELF::GNU_PROPERTY_AARCH64_FEATURE_1_BTI |
-                   ELF::GNU_PROPERTY_AARCH64_FEATURE_1_PAC;
+  unsigned Flags = 0;
+  if (M.getModuleFlag("branch-target-enforcement"))
+    Flags |= ELF::GNU_PROPERTY_AARCH64_FEATURE_1_BTI;
+  if (M.getModuleFlag("sign-return-address"))
+    Flags |= ELF::GNU_PROPERTY_AARCH64_FEATURE_1_PAC;
 
   if (any_of(M, [](const Function &F) {
-        return !F.isDeclaration() &&
-               !F.hasFnAttribute("branch-target-enforcement");
+        if (F.isDeclaration())
+          return false;
+        return F.getFnAttribute("branch-target-enforcement")
+                   .getValueAsString() == "false";
       })) {
     Flags &= ~ELF::GNU_PROPERTY_AARCH64_FEATURE_1_BTI;
   }
 
   if ((Flags & ELF::GNU_PROPERTY_AARCH64_FEATURE_1_BTI) == 0 &&
       any_of(M, [](const Function &F) {
-        return F.hasFnAttribute("branch-target-enforcement");
+        if (F.isDeclaration())
+          return false;
+        if (!F.hasFnAttribute("branch-target-enforcement"))
+          return false;
+        return F.getFnAttribute("branch-target-enforcement")
+                   .getValueAsString() == "true";
       })) {
     errs() << "warning: some functions compiled with BTI and some compiled "
               "without BTI\n"
            << "warning: not setting BTI in feature flags\n";
   }
 
   if (any_of(M, [](const Function &F) {
         if (F.isDeclaration())

llvm/lib/Target/AArch64/AArch64BranchTargets.cpp

 }
 
 FunctionPass *llvm::createAArch64BranchTargetsPass() {
   return new AArch64BranchTargets();
 }
 
 bool AArch64BranchTargets::runOnMachineFunction(MachineFunction &MF) {
   const Function &F = MF.getFunction();
-  if (!F.hasFnAttribute("branch-target-enforcement"))
+
+  // LLVM emmitted function won't have the attribute.
+  if (!F.hasFnAttribute("branch-target-enforcement")) {
+    // Fall back to the module flag, add BTI if the module is compiled with it.
+    if (!MF.getMMI().getModule()->getModuleFlag("branch-target-enforcement"))
+      return false;
+  } else {
+    // Explicitly requested to not generate BTI.
+    if (F.getFnAttribute("branch-target-enforcement").getValueAsString() ==
+        "false")
       return false;
+  }
 
   LLVM_DEBUG(
       dbgs() << "********** AArch64 Branch Targets  **********\n"
              << "********** Function: " << MF.getName() << '\n');
 
   // LLVM does not consider basic blocks which are the targets of jump tables
   // to be address-taken (the address can't escape anywhere else), but they are
   // used for indirect branches, so need BTI instructions.

llvm/lib/Target/AArch64/AArch64CallLowering.cpp

static unsigned getCallOpcode(const Function &CallerF, bool IsIndirect,
   if (!IsTailCall)
     return IsIndirect ? AArch64::BLR : AArch64::BL;
 
   if (!IsIndirect)
     return AArch64::TCRETURNdi;
 
   // When BTI is enabled, we need to use TCRETURNriBTI to make sure that we use
   // x16 or x17.
-  if (CallerF.hasFnAttribute("branch-target-enforcement"))
+  if (CallerF.getFnAttribute("branch-target-enforcement").getValueAsString() ==
+      "true")
     return AArch64::TCRETURNriBTI;
 
   return AArch64::TCRETURNri;
 }
 
 bool AArch64CallLowering::lowerTailCall(
     MachineIRBuilder &MIRBuilder, CallLoweringInfo &Info,
     SmallVectorImpl<ArgInfo> &OutArgs) const {
   MachineFunction &MF = MIRBuilder.getMF();
   const Function &F = MF.getFunction();
   MachineRegisterInfo &MRI = MF.getRegInfo();
   const AArch64TargetLowering &TLI = *getTLI<AArch64TargetLowering>();
   AArch64FunctionInfo *FuncInfo = MF.getInfo<AArch64FunctionInfo>();
 
   // True when we're tail calling, but without -tailcallopt.
   bool IsSibCall = !MF.getTarget().Options.GuaranteedTailCallOpt;
 
   // TODO: Right now, regbankselect doesn't know how to handle the rtcGPR64
   // register class. Until we can do that, we should fall back here.
-  if (F.hasFnAttribute("branch-target-enforcement")) {
+  if (F.getFnAttribute("branch-target-enforcement").getValueAsString() ==
+      "true") {
     LLVM_DEBUG(
         dbgs() << "Cannot lower indirect tail calls with BTI enabled yet.\n");
     return false;
   }
 
   // Find out which ABI gets to decide where things go.
   CallingConv::ID CalleeCC = Info.CallConv;
   CCAssignFn *AssignFnFixed;

llvm/lib/Target/AArch64/AArch64InstrInfo.cpp

auto SetCandidateCallInfo =
         for (outliner::Candidate &C : RepeatedSequenceLocs)
           C.setCallInfo(CallID, NumBytesForCall);
       };
 
   unsigned FrameID = MachineOutlinerDefault;
   NumBytesToCreateFrame += 4;
 
   bool HasBTI = any_of(RepeatedSequenceLocs, [](outliner::Candidate &C) {
-    return C.getMF()->getFunction().hasFnAttribute("branch-target-enforcement");
+    return C.getMF()
+               ->getFunction()
+               .getFnAttribute("branch-target-enforcement")
+               .getValueAsString() == "true";
   });
 
   // Returns true if an instructions is safe to fix up, false otherwise.
   auto IsSafeToFixup = [this, &TRI](MachineInstr &MI) {
     if (MI.isCall())
       return true;
 
     if (!MI.modifiesRegister(AArch64::SP, &TRI) &&

llvm/lib/Target/AArch64/AArch64InstrInfo.td

 // the Function object through the <Target>Subtarget and objections were raised
 // to that (see post-commit review comments for r301750).
 let RecomputePerFunction = 1 in {
   def ForCodeSize   : Predicate<"shouldOptForSize(MF)">;
   def NotForCodeSize   : Predicate<"!shouldOptForSize(MF)">;
   // Avoid generating STRQro if it is slow, unless we're optimizing for code size.
   def UseSTRQro : Predicate<"!Subtarget->isSTRQroSlow() || shouldOptForSize(MF)">;
 
-  def UseBTI : Predicate<[{ MF->getFunction().hasFnAttribute("branch-target-enforcement") }]>;
-  def NotUseBTI : Predicate<[{ !MF->getFunction().hasFnAttribute("branch-target-enforcement") }]>;
+  def UseBTI : Predicate<[{ MF->getFunction().getFnAttribute("branch-target-enforcement").getValueAsString() == "true" }]>;
+  def NotUseBTI : Predicate<[{ !(MF->getFunction().getFnAttribute("branch-target-enforcement").getValueAsString() == "true") }]>;
 
   // Toggles patterns which aren't beneficial in GlobalISel when we aren't
   // optimizing. This allows us to selectively use patterns without impacting
   // SelectionDAG's behaviour.
   // FIXME: One day there will probably be a nicer way to check for this, but
   // today is not that day.
   def OptimizedGISelOrOtherSelector : Predicate<"!MF->getFunction().hasOptNone() || MF->getProperties().hasProperty(MachineFunctionProperties::Property::FailedISel) || !MF->getProperties().hasProperty(MachineFunctionProperties::Property::Legalized)">;
 }

llvm/test/CodeGen/AArch64/branch-target-enforcement-indirect-calls.ll

 
 define void @bti_disabled(void ()* %p) {
 entry:
   tail call void %p()
 ; CHECK: br x0
   ret void
 }
 
-define void @bti_enabled(void ()* %p) "branch-target-enforcement" {
+define void @bti_enabled(void ()* %p) "branch-target-enforcement"="true" {
 entry:
   tail call void %p()
 ; CHECK: br {{x16|x17}}
   ret void
 }

llvm/test/CodeGen/AArch64/branch-target-enforcement.mir

 # RUN: llc -run-pass=aarch64-branch-targets %s -o - | FileCheck %s
 --- |
   target datalayout = "e-m:e-i8:8:32-i16:16:32-i64:64-i128:128-n32:64-S128"
   target triple = "aarch64-arm-none-eabi"
 
-  define hidden i32 @simple_external() "branch-target-enforcement" {
+  define hidden i32 @simple_external() "branch-target-enforcement"="true" {
   entry:
     ret i32 0
   }
 
-  define internal i32 @simple_internal() "branch-target-enforcement" {
+  define internal i32 @simple_internal() "branch-target-enforcement"="true" {
   entry:
     ret i32 0
   }
 
-  define hidden i32 @ptr_auth() "branch-target-enforcement" {
+  define hidden i32 @ptr_auth() "branch-target-enforcement"="true" {
   entry:
     tail call void asm sideeffect "", "~{lr}"()
     ret i32 0
   }
 
-  define hidden i32 @ptr_auth_b() "branch-target-enforcement" {
+  define hidden i32 @ptr_auth_b() "branch-target-enforcement"="true" {
   entry:
     tail call void asm sideeffect "", "~{lr}"()
     ret i32 0
   }
 
-  define hidden i32 @jump_table(i32 %a) "branch-target-enforcement" {
+  define hidden i32 @jump_table(i32 %a) "branch-target-enforcement"="true" {
   entry:
     switch i32 %a, label %sw.epilog [
       i32 1, label %sw.bb
       i32 2, label %sw.bb1
       i32 3, label %sw.bb2
       i32 4, label %sw.bb3
       i32 5, label %sw.bb4
     ]
sw.bb4:                                           ; preds = %entry
     br label %sw.epilog
 
   sw.epilog:                                        ; preds = %entry, %sw.bb4, %sw.bb3, %sw.bb2, %sw.bb1, %sw.bb
     ret i32 0
   }
 
   @label_address.addr = internal unnamed_addr global i8* blockaddress(@label_address, %return), align 8
 
-  define hidden i32 @label_address() "branch-target-enforcement" {
+  define hidden i32 @label_address() "branch-target-enforcement"="true" {
   entry:
     %0 = load i8*, i8** @label_address.addr, align 8
     indirectbr i8* %0, [label %return, label %lab2]
 
   lab2:                                             ; preds = %entry
     br label %.split
 
   return:                                           ; preds = %entry
     br label %.split
 
   .split:                                           ; preds = %lab2, %return
     %merge = phi i8* [ blockaddress(@label_address, %lab2), %return ], [ blockaddress(@label_address, %return), %lab2 ]
     %merge2 = phi i32 [ 1, %return ], [ 2, %lab2 ]
     store i8* %merge, i8** @label_address.addr, align 8
     ret i32 %merge2
   }
 
-  define hidden i32 @label_address_entry() "branch-target-enforcement" {
+  define hidden i32 @label_address_entry() "branch-target-enforcement"="true" {
   entry:
     %0 = load i8*, i8** @label_address.addr, align 8
     indirectbr i8* %0, [label %return, label %lab2]
 
   lab2:                                             ; preds = %entry
     br label %.split
 
   return:                                           ; preds = %entry
     br label %.split
 
   .split:                                           ; preds = %lab2, %return
     %merge = phi i8* [ blockaddress(@label_address, %lab2), %return ], [ blockaddress(@label_address, %return), %lab2 ]
     %merge2 = phi i32 [ 1, %return ], [ 2, %lab2 ]
     store i8* %merge, i8** @label_address.addr, align 8
     ret i32 %merge2
   }
 
-  define hidden i32 @debug_ptr_auth() "branch-target-enforcement" {
+  define hidden i32 @debug_ptr_auth() "branch-target-enforcement"="true" {
   entry:
     tail call void asm sideeffect "", "~{lr}"()
     ret i32 0
   }
 
 ...
 ---
 # External function, could be addres-taken elsewhere so needs BTI JC.

llvm/test/CodeGen/AArch64/bti-branch-relaxation.ll

 declare dso_local void @g2(...) local_unnamed_addr #0
 
 declare dso_local void @g3(...) local_unnamed_addr #0
 
 declare dso_local void @e(...) local_unnamed_addr #0
 
 declare dso_local i64 @llvm.aarch64.space(i32, i64) local_unnamed_addr #0
 
-attributes #0 = { nounwind "branch-target-enforcement" "correctly-rounded-divide-sqrt-fp-math"="false" "disable-tail-calls"="false" "frame-pointer"="all" "less-precise-fpmad"="false" "min-legal-vector-width"="0" "no-infs-fp-math"="false" "no-jump-tables"="false" "no-nans-fp-math"="false" "no-signed-zeros-fp-math"="false" "no-trapping-math"="false" "stack-protector-buffer-size"="8" "target-cpu"="generic" "target-features"="+neon,+v8.5a" "unsafe-fp-math"="false" "use-soft-float"="false" }
+attributes #0 = { nounwind "branch-target-enforcement"="true" "correctly-rounded-divide-sqrt-fp-math"="false" "disable-tail-calls"="false" "frame-pointer"="all" "less-precise-fpmad"="false" "min-legal-vector-width"="0" "no-infs-fp-math"="false" "no-jump-tables"="false" "no-nans-fp-math"="false" "no-signed-zeros-fp-math"="false" "no-trapping-math"="false" "stack-protector-buffer-size"="8" "target-cpu"="generic" "target-features"="+neon,+v8.5a" "unsafe-fp-math"="false" "use-soft-float"="false" }

llvm/test/CodeGen/AArch64/machine-outliner-bti.mir

 # instruction. We make of this for general tail-calls (tested elsewhere), but
 # don't currently make use of this in the outliner.
 
 # CHECK-NOT: OUTLINED_FUNCTION_
 
 --- |
   @g = hidden local_unnamed_addr global i32 0, align 4
 
-  define hidden void @bar(void ()* nocapture %f) "branch-target-enforcement" {
+  define hidden void @bar(void ()* nocapture %f) "branch-target-enforcement"="true" {
   entry:
     ret void
   }
 
   declare void @foo()
 ...
 ---
 name:            bar

llvm/test/CodeGen/AArch64/machine-outliner-outline-bti.ll

 ; RUN: llc -mtriple aarch64--none-eabi < %s | FileCheck %s
 
 ; The BTI instruction cannot be outlined, because it needs to be the very first
 ; instruction executed after an indirect call.
 
 @g = hidden global i32 0, align 4
 
-define hidden void @foo() minsize "branch-target-enforcement" {
+define hidden void @foo() minsize "branch-target-enforcement"="true" {
 entry:
 ; CHECK: hint #34
 ; CHECK: b       OUTLINED_FUNCTION_0
   store volatile i32 1, i32* @g, align 4
   ret void
 }
 
-define hidden void @bar() minsize "branch-target-enforcement" {
+define hidden void @bar() minsize "branch-target-enforcement"="true" {
 entry:
 ; CHECK: hint #34
 ; CHECK: b       OUTLINED_FUNCTION_0
   store volatile i32 1, i32* @g, align 4
   ret void
-}
+}
 No newline at end of file

llvm/test/CodeGen/AArch64/note-gnu-property-pac-bti-0.ll

 ; RUN: llc -mtriple=aarch64-linux %s               -o - | \
 ; RUN:   FileCheck %s --check-prefix=ASM
 ; RUN: llc -mtriple=aarch64-linux %s -filetype=obj -o - |  \
 ; RUN:   llvm-readelf --notes | FileCheck %s --check-prefix=OBJ
 @x = common dso_local global i32 0, align 4
 
-attributes #0 = { "branch-target-enforcement" }
+attributes #0 = { "branch-target-enforcement"="true" }
+
+!llvm.module.flags = !{!0, !1}
+
+!0 = !{i32 4, !"branch-target-enforcement", i32 1}
+!1 = !{i32 4, !"sign-return-address", !"all"}
 
 ; Both attributes present in a file with no functions.
 ; ASM:      .word 3221225472
 ; ASM-NEXT: .word 4
 ; ASM-NEXT  .word 3
 
 ; OBJ: Properties: aarch64 feature: BTI, PAC

llvm/test/CodeGen/AArch64/note-gnu-property-pac-bti-1.ll

 ; RUN: llc -mtriple=aarch64-linux %s               -o - | \
 ; RUN:   FileCheck %s --check-prefix=ASM
 ; RUN: llc -mtriple=aarch64-linux %s -filetype=obj -o - |  \
 ; RUN:   llvm-readelf --notes | FileCheck %s --check-prefix=OBJ
 
 define dso_local i32 @f() #0 {
 entry:
   ret i32 0
 }
 
-attributes #0 = { "branch-target-enforcement" }
+attributes #0 = { "branch-target-enforcement"="true" }
+
+!llvm.module.flags = !{!0}
+
+!0 = !{i32 4, !"branch-target-enforcement", i32 1}
 
 ; BTI attribute present
 ; ASM:      .word 3221225472
 ; ASM-NEXT: .word 4
 ; ASM-NEXT  .word 1
 
 ; OBJ: Properties: aarch64 feature: BTI

llvm/test/CodeGen/AArch64/note-gnu-property-pac-bti-2.ll

 ; RUN: llc -mtriple=aarch64-linux %s               -o - | \
 ; RUN:   FileCheck %s --check-prefix=ASM
 ; RUN: llc -mtriple=aarch64-linux %s -filetype=obj -o - |  \
 ; RUN:   llvm-readelf --notes | FileCheck %s --check-prefix=OBJ
 
 define dso_local i32 @f() #0 {
 entry:
   ret i32 0
 }
 
 attributes #0 = { "sign-return-address"="all" }
 
+!llvm.module.flags = !{!0}
+
+!0 = !{i32 4, !"sign-return-address", !"all"}
+
 ; PAC attribute present
 ; ASM:      .word 3221225472
 ; ASM-NEXT: .word 4
 ; ASM-NEXT  .word 2
 
 ; OBJ: Properties: aarch64 feature: PAC

llvm/test/CodeGen/AArch64/note-gnu-property-pac-bti-3.ll

 ; RUN: llc -mtriple=aarch64-linux %s               -o - | \
 ; RUN:   FileCheck %s --check-prefix=ASM
 ; RUN: llc -mtriple=aarch64-linux %s -filetype=obj -o - |  \
 ; RUN:   llvm-readelf --notes | FileCheck %s --check-prefix=OBJ
 
 define dso_local i32 @f() #0 {
 entry:
   ret i32 0
 }
 
-attributes #0 = { "branch-target-enforcement" "sign-return-address"="non-leaf" }
+attributes #0 = { "branch-target-enforcement"="true" "sign-return-address"="non-leaf" }
+
+!llvm.module.flags = !{!0, !1}
+
+!0 = !{i32 4, !"branch-target-enforcement", i32 1}
+!1 = !{i32 4, !"sign-return-address", !"non-leaf"}
 
 ; Both attribute present
 ; ASM:      .word 3221225472
 ; ASM-NEXT: .word 4
 ; ASM-NEXT  .word 3
 
 ; OBJ: Properties: aarch64 feature: BTI, PAC

llvm/test/CodeGen/AArch64/note-gnu-property-pac-bti-4.ll

 ; RUN: llc -mtriple=aarch64-linux %s               -o - | \
 ; RUN:   FileCheck %s --check-prefix=ASM
 ; RUN: llc -mtriple=aarch64-linux %s -filetype=obj -o - |  \
 ; RUN:   llvm-readelf --notes | FileCheck %s --check-prefix=OBJ
 
 define dso_local i32 @f() #0 {
 entry:
   ret i32 0
 }
 
 define dso_local i32 @g() #1 {
 entry:
   ret i32 0
 }
 
-attributes #0 = { "branch-target-enforcement" "sign-return-address"="non-leaf" }
+attributes #0 = { "branch-target-enforcement"="true" "sign-return-address"="non-leaf" }
 
-attributes #1 = { "branch-target-enforcement" }
+attributes #1 = { "branch-target-enforcement"="true" }
+
+!llvm.module.flags = !{!0}
+
+!0 = !{i32 4, !"branch-target-enforcement", i32 1}
 
 ; Only the common atttribute (BTI)
 ; ASM:      .word 3221225472
 ; ASM-NEXT: .word 4
 ; ASM-NEXT  .word 1
 
 ; OBJ: Properties: aarch64 feature: BTI

llvm/test/CodeGen/AArch64/note-gnu-property-pac-bti-5.ll

 ; RUN: llc -mtriple=aarch64-linux %s               -o - 2>&1 | \
 ; RUN:   FileCheck %s --check-prefix=ASM
 ; RUN: llc -mtriple=aarch64-linux %s -filetype=obj -o -      |  \
 ; RUN:   llvm-readelf --notes | FileCheck %s --check-prefix=OBJ
 
 define dso_local i32 @f() #0 {
 entry:
   ret i32 0
 }
 
 define dso_local i32 @g() #1 {
 entry:
   ret i32 0
 }
 
-attributes #0 = { "branch-target-enforcement" "sign-return-address"="non-leaf" }
+attributes #0 = { "branch-target-enforcement"="true" "sign-return-address"="non-leaf" }
+
+attributes #1 = { "branch-target-enforcement"="false" "sign-return-address"="all" }
+
+!llvm.module.flags = !{!0, !1}
+
+!0 = !{i32 4, !"branch-target-enforcement", i32 1}
+!1 = !{i32 4, !"sign-return-address", !"all"}
 
-attributes #1 = { "sign-return-address"="all" }
 
 ; Only the common atttribute (PAC)
 ; ASM: warning: not setting BTI in feature flags
 ; ASM:      .word 3221225472
 ; ASM-NEXT: .word 4
 ; ASM-NEXT  .word 2
 
 ; OBJ: Properties: aarch64 feature: PAC

llvm/test/CodeGen/AArch64/note-gnu-property-pac-bti-6.ll

 entry:
   ret i32 0
 }
 
 attributes #0 = { "sign-return-address"="non-leaf" }
 
 attributes #1 = { "sign-return-address"="none" }
 
+!llvm.module.flags = !{!0}
+
+!0 = !{i32 4, !"sign-return-address", !"non-leaf"}
+
+
 ; No common attribute, no note section
 ; ASM-NOT: .note.gnu.property
 ; OBJ-NOT: .note.gnu.property

llvm/test/CodeGen/AArch64/note-gnu-property-pac-bti-7.ll

 ; RUN: llc -mtriple=aarch64-linux %s               -o - 2>&1 | \
 ; RUN:   FileCheck %s --check-prefix=ASM
 ; RUN: llc -mtriple=aarch64-linux %s -filetype=obj -o -      |  \
 ; RUN:   llvm-readelf -S | FileCheck %s --check-prefix=OBJ
 
 define dso_local i32 @f() #0 {
 entry:
   ret i32 0
 }
 
 define dso_local i32 @g() #1 {
 entry:
   ret i32 0
 }
 
-attributes #0 = { "sign-return-address"="non-leaf" }
+attributes #0 = { "branch-target-enforcement"="false" "sign-return-address"="non-leaf" }
 
-attributes #1 = { "branch-target-enforcement" }
+attributes #1 = { "branch-target-enforcement"="true" }
+
+!llvm.module.flags = !{!0}
+
+!0 = !{i32 4, !"branch-target-enforcement", i32 1}
 
 ; No common attribute, no note section
 ; ASM: warning: not setting BTI in feature flags
 ; ASM-NOT: .note.gnu.property
 ; OBJ-NOT: .note.gnu.property

llvm/test/CodeGen/AArch64/note-gnu-property-pac-bti-8.ll

 ; RUN: llc -mtriple=aarch64-linux %s               -o - | \
 ; RUN:   FileCheck %s --check-prefix=ASM
 ; RUN: llc -mtriple=aarch64-linux %s -filetype=obj -o - | \
 ; RUN:   llvm-readelf --notes | FileCheck %s --check-prefix=OBJ
 
 define dso_local i32 @f() #0 {
 entry:
   %r = tail call i32 @g()
   ret i32 %r
 }
 
 declare dso_local i32 @g()
 
-attributes #0 = { "branch-target-enforcement" }
+attributes #0 = { "branch-target-enforcement"="true" }
+
+!llvm.module.flags = !{!0}
+
+!0 = !{i32 4, !"branch-target-enforcement", i32 1}
 
 ; Declarations don't prevent setting BTI
 ; ASM:      .word 3221225472
 ; ASM-NEXT: .word 4
 ; ASM-NEXT  .word 1
 
 ; OBJ: Properties: aarch64 feature: BTI

llvm/test/CodeGen/AArch64/note-gnu-property-pac-bti-9.ll

+; RUN: llc -mtriple=aarch64-linux %s               -o - | \
+; RUN:   FileCheck %s --check-prefix=ASM
+; RUN: llc -mtriple=aarch64-linux %s -filetype=obj -o - | \
+; RUN:   llvm-readelf --notes | FileCheck %s --check-prefix=OBJ
+
+define dso_local i32 @f() #0 {
+entry:
+  ret i32 0
+}
+
+define dso_local i32 @g() {
+entry:
+  ret i32 0
+}
+
+attributes #0 = { "branch-target-enforcement"="true" }
+
+!llvm.module.flags = !{!0}
+
+!0 = !{i32 4, !"branch-target-enforcement", i32 1}
+
+; Only the common atttribute (BTI)
+; ASM:      .word 3221225472
+; ASM-NEXT: .word 4
+; ASM-NEXT  .word 1
+
+; OBJ: Properties: aarch64 feature: BTI

llvm/test/CodeGen/AArch64/patchable-function-entry-bti.ll

 ; RUN: llc -mtriple=aarch64 %s -o - | FileCheck %s
 
-define void @f0() "patchable-function-entry"="0" "branch-target-enforcement" {
+define void @f0() "patchable-function-entry"="0" "branch-target-enforcement"="true" {
 ; CHECK-LABEL: f0:
 ; CHECK-NEXT: .Lfunc_begin0:
 ; CHECK:      // %bb.0:
 ; CHECK-NEXT:  hint #34
 ; CHECK-NEXT:  ret
 ; CHECK-NOT:  .section __patchable_function_entries
   ret void
 }
 
 ;; -fpatchable-function-entry=1 -mbranch-protection=bti
 ;; For M=0, place the label .Lpatch0 after the initial BTI.
-define void @f1() "patchable-function-entry"="1" "branch-target-enforcement" {
+define void @f1() "patchable-function-entry"="1" "branch-target-enforcement"="true" {
 ; CHECK-LABEL: f1:
 ; CHECK-NEXT: .Lfunc_begin1:
 ; CHECK-NEXT: .cfi_startproc
 ; CHECK-NEXT: // %bb.0:
 ; CHECK-NEXT:  hint #34
 ; CHECK-NEXT: .Lpatch0:
 ; CHECK-NEXT:  nop
 ; CHECK-NEXT:  ret
 ; CHECK:      .section __patchable_function_entries,"awo",@progbits,f1{{$}}
 ; CHECK-NEXT: .p2align 3
 ; CHECK-NEXT: .xword .Lpatch0
   ret void
 }
 
 ;; -fpatchable-function-entry=2,1 -mbranch-protection=bti
-define void @f2_1() "patchable-function-entry"="1" "patchable-function-prefix"="1" "branch-target-enforcement" {
+define void @f2_1() "patchable-function-entry"="1" "patchable-function-prefix"="1" "branch-target-enforcement"="true" {
 ; CHECK-LABEL: .type f2_1,@function
 ; CHECK-NEXT: .Ltmp0:
 ; CHECK-NEXT:  nop
 ; CHECK-NEXT: f2_1:
 ; CHECK-NEXT: .Lfunc_begin2:
 ; CHECK-NEXT: .cfi_startproc
 ; CHECK-NEXT: // %bb.0:
 ; CHECK-NEXT:  hint #34
 ; CHECK-NEXT:  nop
 ; CHECK-NEXT:  ret
 ; CHECK:      .Lfunc_end2:
 ; CHECK-NEXT: .size f2_1, .Lfunc_end2-f2_1
 ; CHECK:      .section __patchable_function_entries,"awo",@progbits,f2_1{{$}}
 ; CHECK-NEXT: .p2align 3
 ; CHECK-NEXT: .xword .Ltmp0
   ret void
 }
 
 ;; -fpatchable-function-entry=1 -mbranch-protection=bti
 ;; For M=0, don't create .Lpatch0 if the initial instruction is not BTI,
 ;; even if other basic blocks may have BTI.
-define internal void @f1i(i64 %v) "patchable-function-entry"="1" "branch-target-enforcement" {
+define internal void @f1i(i64 %v) "patchable-function-entry"="1" "branch-target-enforcement"="true" {
 ; CHECK-LABEL: f1i:
 ; CHECK-NEXT: .Lfunc_begin3:
 ; CHECK:      // %bb.0:
 ; CHECK-NEXT:  nop
 ;; Other basic blocks have BTI, but they don't affect our decision to not create .Lpatch0
 ; CHECK:      .LBB{{.+}} // %sw.bb1
 ; CHECK-NEXT:  hint #36
 ; CHECK:      .section __patchable_function_entries,"awo",@progbits,f1i{{$}}