[AArch64] PAC/BTI code generation for LLVM generated functions

[chill]

Summary

PAC/BTI-related codegen in the AArch64 backend is controlled by a set
of LLVM IR function attributes, added to the function by Clang, based
on command-line options and GCC-style function attributes. However,
functions, generated in the LLVM middle end (for example,
asan.module.ctor or __llvm_gcov_write_out) do not get any attributes
and the backend incorrectly does not do any PAC/BTI code generation.

This patch record the default state of PAC/BTI codegen in a set of
LLVM IR module-level attributes, based on command-line options:

• "sign-return-address", with non-zero value means generate code to sign return addresses (PAC-RET), zero value means disable PAC-RET.

• "sign-return-address-all", with non-zero value means enable PAC-RET for all functions, zero value means enable PAC-RET only for functions, which spill LR.

• "sign-return-address-with-bkey", with non-zero value means use B-key for signing, zero value mean use A-key.

This set of attributes are always added for AArch64 targets (as
opposed, for example, to interpreting a missing attribute as having a
value 0) in order to be able to check for conflicts when combining
module attributed during LTO.

Module-level attributes are overridden by function level attributes.
All the decision making about whether to not to generate PAC and/or
BTI code is factored out into AArch64FunctionInfo, there shouldn't be
any places left, other than AArch64FunctionInfo, which directly
examine PAC/BTI attributes, except AArch64AsmPrinter.cpp, which
is/will-be handled by a separate patch.

[nickdesaulniers]

Module-level attributes are overridden by function level attributes.

This sounds like the way to go. It looks like that's what llvm/test/CodeGen/AArch64/pacbti-llvm-generated-funcs-2.ll is doing. Is there a test for no module attributes + function level attribute enabling pac/bti that tests that just that function gets the proper handling?

[tellenbach]

Hi @chill, thanks for this patch, looks like the correct way to handle this.

[tellenbach]

llvm/lib/Target/AArch64/AArch64InstrInfo.cpp

5846

Is this a typo?

5856

Same.

llvm/lib/Target/AArch64/AArch64MachineFunctionInfo.h

149

The key type could in fact also be made an enum just like you did for the type of return address signing but no strong opinion here.

llvm/test/CodeGen/AArch64/pacbti-llvm-generated-funcs-1.ll

26

Do you need all of these attributes for the test case?

[chill]

In D85649#2207922, @nickdesaulniers wrote:

Is there a test for no module attributes + function level attribute enabling pac/bti that tests that just that function gets the proper handling?

Yes, virtually every PAC/BTI test so far. I also added in the last update tests when module flags are created and when they aren't.

llvm/lib/Target/AArch64/AArch64InstrInfo.cpp

5846

D'oh, bloody copy/paste. Good catch, thanks!

llvm/lib/Target/AArch64/AArch64MachineFunctionInfo.h

149

If I would be bothered to change it, I'd rather go in the opposite direction, replace the SignReturnAddress by two booleans. That'll remove the need for a typedef and make the code less verbose.

[chill]

Ping?

[tellenbach]

Does this conflict with D80791? Other than that it lgtm.

llvm/lib/Target/AArch64/AArch64MachineFunctionInfo.h

149

Yep, makes sense. Anyway, the current version is fine for me.

[chill]

In D85649#2231236, @tellenbach wrote:

Does this conflict with D80791?

It does, we're using different module attributes.

[tellenbach]

In D85649#2233902, @chill wrote:

In D85649#2231236, @tellenbach wrote:

Does this conflict with D80791?

It does, we're using different module attributes.

Okay, thanks. Please feel free to ping me again as soon as we know which version we want to use.

[danielkiss]

llvm/lib/Target/AArch64/AArch64MachineFunctionInfo.h

151–153

A way is needed to turn it to false even, when to the rule below turns it on. see D81251.
A setter function would be fine I think. If you agree I can add it when rebasing the D81251.

[chill]

In addition to the disabling of BTI in D81251, there's an issue that we explicitly disable BTI via branch-protection=none, the attribute would just be missing and we'll pick up the module attributes, which is not what we want.

IMHO the right way to handle this is to add a boolean value to branch-target-enforcement: if the attribute is absent default to module flags, if it's present - do as the attribute value says.

[danielkiss]

I support the idea, once I proposed back then ( see D75181 )

[chill]

Emit function-level LLVM IR attributes only when there's a GCC-style function attribute and be explicit with enabling/disabling.
Fixed an error where "none" in deferred to module attributes, instead of overriding them.

[chill]

Ping,

[chill]

Ping.

[danielkiss]

LGTM

[nickdesaulniers]

The only question I have about module level attributes is what happens for LTO (which we use for Linux kernels used in Android)? Is there any conflict linking together objects from two different translation units with two different flags? Maybe this should fail hard; but it would be cool to alert developers at compile time, rather than have an awful bug to debug at runtime. Just food for thought; I don't know enough about LTO to know if it already has machinery to handle module level conflicts or not. Maybe @tejohnson or @pcc knows?

[tejohnson]

In D85649#2277927, @nickdesaulniers wrote:

The only question I have about module level attributes is what happens for LTO (which we use for Linux kernels used in Android)? Is there any conflict linking together objects from two different translation units with two different flags? Maybe this should fail hard; but it would be cool to alert developers at compile time, rather than have an awful bug to debug at runtime. Just food for thought; I don't know enough about LTO to know if it already has machinery to handle module level conflicts or not. Maybe @tejohnson or @pcc knows?

I haven't looked at this patch or what it does in any detail, but any module level flag needs to specify its behavior when merging modules (for *LTO). The addModuleFlag calls added in this patch specify Override, which means:

/// Uses the specified value, regardless of the behavior or value of the
/// other module. If both modules specify **Override**, but the values
/// differ, an error will be emitted.
Override = 4,

So if it is specified in one module but not the other, the specified module flag will apply to the merged module. If it is specified in both modules (assuming both have the Override type, which it seems like the would), it will be an error if the values differ.

[chill]

Thank you for your comments. I'd like to have the same behaviour with or without LTO, which is apparently not the case with this patch.

[chill]

It looks like the only value that makes sense is Error - any other policy (existing or not) would potentially lead to meaningfully different code generated with or without LTO.

[danielkiss]

I think error is fine because realistically linking modules with different BTI settings will result probably a binary that crash runtime anyway if BTI is on.
otherwise turning BTI on just of a subset of object is useless.

[nickdesaulniers]

Thanks @tejohnson for the feedback. Error sounds fine. The only other question I have is that a common pattern in the Linux kernel for progressive support of the ARM ISA extensions is to build isolated translation units that either use those features unconditionally but wont call into those translation units at runtime if the extensions are not present, or the kernel will live patch itself (ie. "alternatives" patching). Maybe @mrutland has thoughts; with BTI be runtime-patchable or otherwise enable-able at runtime. ie. one kernel image that runs on hardware both with and without BTI ISA extensions?

If the plan is to have isolated TUs built with BTI, then the "Error" policy sounds like this would be incompatible; but I don't think the point of BTI is to have some small portion of the code built with it. IIRC, doesn't BTI uses the no-op encoding space? So I guess one image could run on hardware regardless of actual BTI hardware support. So it wouldn't be patched in at runtime either. In that case, via kernel config I guess we'd build everything with BTI, and have build time errors for translation units that accidentally dropped KBUILD_CFLAGS, which happens a lot, but is fixable in kernel's build system sources.

The final piece of food for thought is ensuring that we can LTO C code built with BTI can link with out of line asm; Clang usually needs the assembler directives in place in the source being assembled to enable architectural extensions. If "Error" policy is used, can we still LTO C and asm sources? I assume we "should" be able to, but it might save trouble down the road to test that locally. Particularly, having C code that calls asm routines and the visibility of those routines during LTO has given us trouble in the past, when enabling CFI (control flow integrity; which I believe has some overlap with BTI but some subtle differences as well; I wouldn't call them perfect substitutes).

[chill]

LTO related fixes - user Error combining behaviour, always emit the attributes with values 0 or 1
so they are present and their values can be checked for being the same during.

[chill]

In D85649#2282286, @nickdesaulniers wrote:

Thanks @tejohnson for the feedback. Error sounds fine. The only other question I have is that a common pattern in the Linux kernel for progressive support of the ARM ISA extensions is to build isolated translation units that either use those features unconditionally but wont call into those translation units at runtime if the extensions are not present, or the kernel will live patch itself (ie. "alternatives" patching). Maybe @mrutland has thoughts; with BTI be runtime-patchable or otherwise enable-able at runtime. ie. one kernel image that runs on hardware both with and without BTI ISA extensions?

If the plan is to have isolated TUs built with BTI, then the "Error" policy sounds like this would be incompatible; but I don't think the point of BTI is to have some small portion of the code built with it. IIRC, doesn't BTI uses the no-op encoding space? So I guess one image could run on hardware regardless of actual BTI hardware support. So it wouldn't be patched in at runtime either. In that case, via kernel config I guess we'd build everything with BTI, and have build time errors for translation units that accidentally dropped KBUILD_CFLAGS, which happens a lot, but is fixable in kernel's build system sources.

The final piece of food for thought is ensuring that we can LTO C code built with BTI can link with out of line asm; Clang usually needs the assembler directives in place in the source being assembled to enable architectural extensions. If "Error" policy is used, can we still LTO C and asm sources? I assume we "should" be able to, but it might save trouble down the road to test that locally. Particularly, having C code that calls asm routines and the visibility of those routines during LTO has given us trouble in the past, when enabling CFI (control flow integrity; which I believe has some overlap with BTI but some subtle differences as well; I wouldn't call them perfect substitutes).

Yes, PAC/BTI can be done entirely in NOP-space, controlled by -march=... - if the architecture revision does not have an instruction, a NOP-space equivalent is used.
For the C/ASM link I couldn't see any issues with my basic testing with lld.

[danielkiss]

LGTM

@nickdesaulniers

one kernel image that runs on hardware both with and without BTI ISA extensions?

In case of BTI one image could run on both HW due to BTI is in the no-op space.

In that case, via kernel config I guess we'd build everything with BTI, and have build time errors for translation units that accidentally dropped KBUILD_CFLAGS, which happens a lot, but is fixable in kernel's build system sources.

actually when compiling with BTI the "-Wl,-fatal-warnings, -Wl,-z,force-bti" could be added to the linker flags to catch these things, I will send a patch to the kernel mailing list.

[nickdesaulniers]

Thank you @momchil.velikov for considering the case for LTO, and testing C+asm linkage.

actually when compiling with BTI the "-Wl,-fatal-warnings, -Wl,-z,force-bti" could be added to the linker flags to catch these things, I will send a patch to the kernel mailing list.

SGTM, I'd be happy to help test it.

clang/lib/CodeGen/CodeGenModule.cpp

593–594

I was wondering if Arch.isAArch64() would be more concise, but curiously it does not contain aarch64_32 ArchType.

[pcc]

In D85649#2281439, @chill wrote:

It looks like the only value that makes sense is Error - any other policy (existing or not) would potentially lead to meaningfully different code generated with or without LTO.

It should have been (the currently non-existent) "Min" -- with "Error" we get different behavior at link time with and without LTO, as a mixture of BTI and non-BTI objects ought to disable BTI in the final linked object, instead of producing an error. The code generation should be controlled by the function attribute so you ought to get the same code generated with and without LTO.

clang/lib/CodeGen/CGDeclCXX.cpp

llvm::Function *CodeGenModule::CreateGlobalInitOrCleanUpFunction(
   if (getLangOpts().Sanitize.has(SanitizerKind::SafeStack) &&
       !isInSanitizerBlacklist(SanitizerKind::SafeStack, Fn, Loc))
     Fn->addFnAttr(llvm::Attribute::SafeStack);
 
   if (getLangOpts().Sanitize.has(SanitizerKind::ShadowCallStack) &&
       !isInSanitizerBlacklist(SanitizerKind::ShadowCallStack, Fn, Loc))
     Fn->addFnAttr(llvm::Attribute::ShadowCallStack);
 
-  auto RASignKind = getLangOpts().getSignReturnAddressScope();
-  if (RASignKind != LangOptions::SignReturnAddressScopeKind::None) {
-    Fn->addFnAttr("sign-return-address",
-                  RASignKind == LangOptions::SignReturnAddressScopeKind::All
-                      ? "all"
-                      : "non-leaf");
-    auto RASignKey = getLangOpts().getSignReturnAddressKey();
-    Fn->addFnAttr("sign-return-address-key",
-                  RASignKey == LangOptions::SignReturnAddressKeyKind::AKey
-                      ? "a_key"
-                      : "b_key");
-  }
-
-  if (getLangOpts().BranchTargetEnforcement)
-    Fn->addFnAttr("branch-target-enforcement");
-
   return Fn;
 }
 
 /// Create a global pointer to a function that will initialize a global
 /// variable.  The user has requested that this pointer be emitted in a specific
 /// section.
 void CodeGenModule::EmitPointerToInitFunc(const VarDecl *D,
                                           llvm::GlobalVariable *GV,

clang/lib/CodeGen/CodeGenModule.cpp

void CodeGenModule::Release() {
 
   if (CodeGenOpts.CFProtectionBranch &&
       Target.checkCFProtectionBranchSupported(getDiags())) {
     // Indicate that we want to instrument branch control flow protection.
     getModule().addModuleFlag(llvm::Module::Override, "cf-protection-branch",
                               1);
   }
 
+  if (Arch == llvm::Triple::aarch64 || Arch == llvm::Triple::aarch64_32 ||
+      Arch == llvm::Triple::aarch64_be) {
+    getModule().addModuleFlag(llvm::Module::Error,
+                              "branch-target-enforcement",
+                              LangOpts.BranchTargetEnforcement);
+
+    getModule().addModuleFlag(llvm::Module::Error, "sign-return-address",
+                              LangOpts.hasSignReturnAddress());
+
+    getModule().addModuleFlag(llvm::Module::Error, "sign-return-address-all",
+                              LangOpts.isSignReturnAddressScopeAll());
+
+    getModule().addModuleFlag(llvm::Module::Error,
+                              "sign-return-address-with-bkey",
+                              !LangOpts.isSignReturnAddressWithAKey());
+  }
+
   if (LangOpts.CUDAIsDevice && getTriple().isNVPTX()) {
     // Indicate whether __nvvm_reflect should be configured to flush denormal
     // floating point values to 0.  (This corresponds to its "__CUDA_FTZ"
     // property.)
     getModule().addModuleFlag(llvm::Module::Override, "nvvm-reflect-ftz",
                               CodeGenOpts.FP32DenormalMode.Output !=
                                   llvm::DenormalMode::IEEE);
   }

clang/lib/CodeGen/TargetInfo.cpp

public:
   bool doesReturnSlotInterfereWithArgs() const override { return false; }
 
   void setTargetAttributes(const Decl *D, llvm::GlobalValue *GV,
                            CodeGen::CodeGenModule &CGM) const override {
     const FunctionDecl *FD = dyn_cast_or_null<FunctionDecl>(D);
     if (!FD)
       return;
 
-    LangOptions::SignReturnAddressScopeKind Scope =
-        CGM.getLangOpts().getSignReturnAddressScope();
-    LangOptions::SignReturnAddressKeyKind Key =
-        CGM.getLangOpts().getSignReturnAddressKey();
-    bool BranchTargetEnforcement = CGM.getLangOpts().BranchTargetEnforcement;
-    if (const auto *TA = FD->getAttr<TargetAttr>()) {
-      ParsedTargetAttr Attr = TA->parse();
-      if (!Attr.BranchProtection.empty()) {
-        TargetInfo::BranchProtectionInfo BPI;
-        StringRef Error;
-        (void)CGM.getTarget().validateBranchProtection(Attr.BranchProtection,
-                                                       BPI, Error);
-        assert(Error.empty());
-        Scope = BPI.SignReturnAddr;
-        Key = BPI.SignKey;
-        BranchTargetEnforcement = BPI.BranchTargetEnforcement;
-      }
-    }
+    const auto *TA = FD->getAttr<TargetAttr>();
+    if (TA == nullptr)
+      return;
+
+    if (Attr.BranchProtection.empty())
+      return;
+
 
     auto *Fn = cast<llvm::Function>(GV);
-    if (Scope != LangOptions::SignReturnAddressScopeKind::None) {
-      Fn->addFnAttr("sign-return-address",
-                    Scope == LangOptions::SignReturnAddressScopeKind::All
-                        ? "all"
-                        : "non-leaf");
+    static const char *SignReturnAddrStr[] = {"none", "non-leaf", "all"};
+    Fn->addFnAttr("sign-return-address", SignReturnAddrStr[static_cast<int>(BPI.SignReturnAddr)]);
 
+    if (BPI.SignReturnAddr != LangOptions::SignReturnAddressScopeKind::None) {
       Fn->addFnAttr("sign-return-address-key",
-                    Key == LangOptions::SignReturnAddressKeyKind::AKey
+                    BPI.SignKey == LangOptions::SignReturnAddressKeyKind::AKey
                         ? "a_key"
                         : "b_key");
     }
 
-    if (BranchTargetEnforcement)
-      Fn->addFnAttr("branch-target-enforcement");
+    Fn->addFnAttr("branch-target-enforcement",
+                  BPI.BranchTargetEnforcement ? "true" : "false");
   }
 };
 
 class WindowsAArch64TargetCodeGenInfo : public AArch64TargetCodeGenInfo {
 public:
   WindowsAArch64TargetCodeGenInfo(CodeGenTypes &CGT, AArch64ABIInfo::ABIKind K)
       : AArch64TargetCodeGenInfo(CGT, K) {}
 

clang/test/CodeGen/aarch64-branch-protection-attr.c

 // REQUIRES: aarch64-registered-target
 // RUN: %clang_cc1 -triple aarch64-unknown-unknown-eabi -emit-llvm  -target-cpu generic -target-feature +v8.5a %s -o - \
-// RUN:                               | FileCheck %s --check-prefix=CHECK --check-prefix=NO-OVERRIDE
-// RUN: %clang_cc1 -triple aarch64-unknown-unknown-eabi -emit-llvm  -target-cpu generic -target-feature +v8.5a %s -o - \
-// RUN:   -msign-return-address=non-leaf -msign-return-address-key=a_key -mbranch-target-enforce \
-// RUN:                               | FileCheck %s --check-prefix=CHECK --check-prefix=OVERRIDE
-
-void missing() {}
-// NO-OVERRIDE: define void @missing() #[[#NONE:]]
-// OVERRIDE: define void @missing() #[[#STD:]]
+// RUN:                               | FileCheck %s --check-prefix=CHECK
 
 __attribute__ ((target("branch-protection=none")))
 void none() {}
-// NO-OVERRIDE: define void @none() #[[#NONE]]
-// OVERRIDE: define void @none() #[[#NONE:]]
+// CHECK: define void @none() #[[#NONE:]]
 
   __attribute__ ((target("branch-protection=standard")))
 void std() {}
-// NO-OVERRIDE: define void @std() #[[#STD:]]
-// OVERRIDE: define void @std() #[[#STD]]
+// CHECK: define void @std() #[[#STD:]]
 
 __attribute__ ((target("branch-protection=bti")))
 void btionly() {}
-// NO-OVERRIDE: define void @btionly() #[[#BTI:]]
-// OVERRIDE: define void @btionly() #[[#BTI:]]
+// CHECK: define void @btionly() #[[#BTI:]]
 
 __attribute__ ((target("branch-protection=pac-ret")))
 void paconly() {}
-// NO-OVERRIDE: define void @paconly() #[[#PAC:]]
-// OVERRIDE: define void @paconly() #[[#PAC:]]
+// CHECK: define void @paconly() #[[#PAC:]]
 
 __attribute__ ((target("branch-protection=pac-ret+bti")))
 void pacbti0() {}
-// NO-OVERRIDE: define void @pacbti0() #[[#PACBTI:]]
-// OVERRIDE: define void @pacbti0() #[[#PACBTI:]]
+// CHECK: define void @pacbti0() #[[#PACBTI:]]
 
 __attribute__ ((target("branch-protection=bti+pac-ret")))
 void pacbti1() {}
-// NO-OVERRIDE: define void @pacbti1() #[[#PACBTI]]
-// OVERRIDE: define void @pacbti1() #[[#PACBTI]]
+// CHECK: define void @pacbti1() #[[#PACBTI]]
 
 __attribute__ ((target("branch-protection=pac-ret+leaf")))
 void leaf() {}
-// NO-OVERRIDE: define void @leaf() #[[#PACLEAF:]]
-// OVERRIDE: define void @leaf() #[[#PACLEAF:]]
+// CHECK: define void @leaf() #[[#PACLEAF:]]
 
 __attribute__ ((target("branch-protection=pac-ret+b-key")))
 void bkey() {}
-// NO-OVERRIDE: define void @bkey() #[[#PACBKEY:]]
-// OVERRIDE: define void @bkey() #[[#PACBKEY:]]
+// CHECK: define void @bkey() #[[#PACBKEY:]]
 
 __attribute__ ((target("branch-protection=pac-ret+b-key+leaf")))
 void bkeyleaf0() {}
-// NO-OVERRIDE: define void @bkeyleaf0()  #[[#PACBKEYLEAF:]]
-// OVERRIDE: define void @bkeyleaf0()  #[[#PACBKEYLEAF:]]
+// CHECK: define void @bkeyleaf0()  #[[#PACBKEYLEAF:]]
 
 __attribute__ ((target("branch-protection=pac-ret+leaf+b-key")))
 void bkeyleaf1() {}
-// NO-OVERRIDE: define void @bkeyleaf1()  #[[#PACBKEYLEAF]]
-// OVERRIDE: define void @bkeyleaf1()  #[[#PACBKEYLEAF]]
+// CHECK: define void @bkeyleaf1()  #[[#PACBKEYLEAF]]
 
 __attribute__ ((target("branch-protection=pac-ret+leaf+bti")))
 void btileaf() {}
-// NO-OVERRIDE: define void @btileaf() #[[#BTIPACLEAF:]]
-// OVERRIDE: define void @btileaf() #[[#BTIPACLEAF:]]
+// CHECK: define void @btileaf() #[[#BTIPACLEAF:]]
 
-// CHECK-DAG: attributes #[[#NONE]]
+// CHECK-DAG: attributes #[[#NONE]] = { {{.*}} "branch-target-enforcement"="false" {{.*}} "sign-return-address"="none"
 
-// CHECK-DAG: attributes #[[#STD]] = { {{.*}} "branch-target-enforcement" {{.*}} "sign-return-address"="non-leaf" "sign-return-address-key"="a_key"
+// CHECK-DAG: attributes #[[#STD]] = { {{.*}} "branch-target-enforcement"="true" {{.*}} "sign-return-address"="non-leaf" "sign-return-address-key"="a_key"
 
-// CHECK-DAG: attributes #[[#BTI]] = { {{.*}}"branch-target-enforcement"
+// CHECK-DAG: attributes #[[#BTI]] = { {{.*}} "branch-target-enforcement"="true" {{.*}} "sign-return-address"="none"
 
-// CHECK-DAG: attributes #[[#PAC]] = { {{.*}} "sign-return-address"="non-leaf" "sign-return-address-key"="a_key"
+// CHECK-DAG: attributes #[[#PAC]] = { {{.*}} "branch-target-enforcement"="false" {{.*}} "sign-return-address"="non-leaf" "sign-return-address-key"="a_key"
 
-// CHECK-DAG: attributes #[[#PACLEAF]] = { {{.*}} "sign-return-address"="all" "sign-return-address-key"="a_key"
+// CHECK-DAG: attributes #[[#PACLEAF]] = { {{.*}} "branch-target-enforcement"="false" {{.*}}"sign-return-address"="all" "sign-return-address-key"="a_key"
 
-// CHECK-DAG: attributes #[[#PACBKEY]] = { {{.*}} "sign-return-address"="non-leaf" "sign-return-address-key"="b_key"
+// CHECK-DAG: attributes #[[#PACBKEY]] = { {{.*}}"branch-target-enforcement"="false" {{.*}} "sign-return-address"="non-leaf" "sign-return-address-key"="b_key"
 
-// CHECK-DAG: attributes #[[#PACBKEYLEAF]] = { {{.*}} "sign-return-address"="all" "sign-return-address-key"="b_key"
+// CHECK-DAG: attributes #[[#PACBKEYLEAF]] = { {{.*}} "branch-target-enforcement"="false" {{.*}}"sign-return-address"="all" "sign-return-address-key"="b_key"
 
-// CHECK-DAG: attributes #[[#BTIPACLEAF]] = { {{.*}}"branch-target-enforcement" {{.*}} "sign-return-address"="all" "sign-return-address-key"="a_key"
+// CHECK-DAG: attributes #[[#BTIPACLEAF]] = { {{.*}}"branch-target-enforcement"="true" {{.*}} "sign-return-address"="all" "sign-return-address-key"="a_key"

clang/test/CodeGen/aarch64-sign-return-address.c

-// RUN: %clang -target aarch64-arm-none-eabi -march=armv8.3-a -S -emit-llvm -o - -msign-return-address=none  %s | FileCheck %s --check-prefix=CHECK --check-prefix=NONE
-// RUN: %clang -target aarch64-arm-none-eabi -march=armv8.2-a -S -emit-llvm -o - -msign-return-address=all  %s | FileCheck %s --check-prefix=CHECK --check-prefix=ALL --check-prefix=A-KEY
-// RUN: %clang -target aarch64-arm-none-eabi -march=armv8.3-a -S -emit-llvm -o - -msign-return-address=all %s   | FileCheck %s --check-prefix=CHECK --check-prefix=ALL --check-prefix=A-KEY
-// RUN: %clang -target aarch64-arm-none-eabi -march=armv8.3-a -S -emit-llvm -o - -msign-return-address=non-leaf %s | FileCheck %s --check-prefix=CHECK --check-prefix=PARTIAL --check-prefix=A-KEY
-// RUN: %clang -target aarch64-arm-none-eabi -march=armv8.3-a -S -emit-llvm -o - -msign-return-address=all %s | FileCheck %s --check-prefix=CHECK --check-prefix=ALL --check-prefix=A-KEY
-// RUN: %clang -target aarch64-arm-none-eabi -march=armv8.4-a -S -emit-llvm -o - -msign-return-address=all %s | FileCheck %s --check-prefix=CHECK --check-prefix=ALL --check-prefix=A-KEY
-// RUN: %clang -target aarch64-arm-none-eabi -march=armv8.3-a -S -emit-llvm -o - -mbranch-protection=pac-ret+b-key %s   | FileCheck %s --check-prefix=CHECK --check-prefix=PARTIAL --check-prefix=B-KEY
-// RUN: %clang -target aarch64-arm-none-eabi -march=armv8.3-a -S -emit-llvm -o - -mbranch-protection=pac-ret+b-key+leaf %s   | FileCheck %s --check-prefix=CHECK --check-prefix=ALL --check-prefix=B-KEY
-// RUN: %clang -target aarch64-arm-none-eabi -march=armv8.3-a -S -emit-llvm -o - -mbranch-protection=bti %s | FileCheck %s --check-prefix=CHECK --check-prefix=BTE
+// RUN: %clang -target aarch64-arm-none-eabi -S -emit-llvm -o - -msign-return-address=none     %s | FileCheck %s --check-prefix=CHECK --check-prefix=NONE
+// RUN: %clang -target aarch64-arm-none-eabi -S -emit-llvm -o - -msign-return-address=all      %s | FileCheck %s --check-prefix=CHECK --check-prefix=ALL
+// RUN: %clang -target aarch64-arm-none-eabi -S -emit-llvm -o - -msign-return-address=non-leaf %s | FileCheck %s --check-prefix=CHECK --check-prefix=PART
+
+// RUN: %clang -target aarch64-arm-none-eabi -S -emit-llvm -o - -mbranch-protection=none %s          | FileCheck %s --check-prefix=CHECK --check-prefix=NONE
+// RUN: %clang -target aarch64-arm-none-eabi -S -emit-llvm -o - -mbranch-protection=pac-ret+leaf  %s | FileCheck %s --check-prefix=CHECK --check-prefix=ALL
+// RUN: %clang -target aarch64-arm-none-eabi -S -emit-llvm -o - -mbranch-protection=pac-ret+b-key %s | FileCheck %s --check-prefix=CHECK --check-prefix=B-KEY
+// RUN: %clang -target aarch64-arm-none-eabi -S -emit-llvm -o - -mbranch-protection=bti %s           | FileCheck %s --check-prefix=CHECK --check-prefix=BTE
 
 // REQUIRES: aarch64-registered-target
 
-// CHECK: @foo() #[[ATTR:[0-9]*]]
-//
-// NONE-NOT: "sign-return-address"={{.*}}
+// Check there are no branch protection function attributes
 
-// PARTIAL: "sign-return-address"="non-leaf"
+// CHECK-LABEL: @foo() #[[#ATTR:]]
 
-// ALL: "sign-return-address"="all"
-
-// BTE: "branch-target-enforcement"
-
-// A-KEY: "sign-return-address-key"="a_key"
-
-// B-KEY: "sign-return-address-key"="b_key"
+// CHECK-NOT:  attributes #[[#ATTR]] = { {{.*}} "sign-return-address"
+// CHECK-NOT:  attributes #[[#ATTR]] = { {{.*}} "sign-return-address-key"
+// CHECK-NOT:  attributes #[[#ATTR]] = { {{.*}} "branch-target-enforcement"
+
+// Check module attributes
+
+// NONE:  !{i32 1, !"branch-target-enforcement", i32 0}
+// ALL:   !{i32 1, !"branch-target-enforcement", i32 0}
+// PART:  !{i32 1, !"branch-target-enforcement", i32 0}
+// BTE:   !{i32 1, !"branch-target-enforcement", i32 1}
+// B-KEY: !{i32 1, !"branch-target-enforcement", i32 0}
+
+// NONE:  !{i32 1, !"sign-return-address", i32 0}
+// ALL:   !{i32 1, !"sign-return-address", i32 1}
+// PART:  !{i32 1, !"sign-return-address", i32 1}
+// BTE:   !{i32 1, !"sign-return-address", i32 0}
+// B-KEY: !{i32 1, !"sign-return-address", i32 1}
+
+// NONE:  !{i32 1, !"sign-return-address-all", i32 0}
+// ALL:   !{i32 1, !"sign-return-address-all", i32 1}
+// PART:  !{i32 1, !"sign-return-address-all", i32 0}
+// BTE:   !{i32 1, !"sign-return-address-all", i32 0}
+// B-KEY: !{i32 1, !"sign-return-address-all", i32 0}
+
+// NONE:  !{i32 1, !"sign-return-address-with-bkey", i32 0}
+// ALL:   !{i32 1, !"sign-return-address-with-bkey", i32 0}
+// PART:  !{i32 1, !"sign-return-address-with-bkey", i32 0}
+// BTE:   !{i32 1, !"sign-return-address-with-bkey", i32 0}
+// B-KEY: !{i32 1, !"sign-return-address-with-bkey", i32 1}
 
 void foo() {}

clang/test/CodeGenCXX/aarch64-sign-return-address-static-ctor.cpp

-// RUN: %clang -target aarch64-arm-none-eabi -S -emit-llvm -o - -msign-return-address=none  %s | \
-// RUN: FileCheck %s --check-prefix=CHECK --check-prefix=CHECK-NONE
-// RUN: %clang -target aarch64-arm-none-eabi -S -emit-llvm -o - -msign-return-address=non-leaf %s | \
-// RUN: FileCheck %s --check-prefix=CHECK --check-prefix=CHECK-PARTIAL  --check-prefix=CHECK-A-KEY
-// RUN: %clang -target aarch64-arm-none-eabi -S -emit-llvm -o - -msign-return-address=all %s | \
-// RUN: FileCheck %s --check-prefix=CHECK --check-prefix=CHECK-ALL  --check-prefix=CHECK-A-KEY
-
-// RUN: %clang -target aarch64-arm-none-eabi -S -emit-llvm -o - -mbranch-protection=none %s | \
-// RUN: FileCheck %s --check-prefix=CHECK --check-prefix=CHECK-NONE
-// RUN: %clang -target aarch64-arm-none-eabi -S -emit-llvm -o - -mbranch-protection=standard %s | \
-// RUN: FileCheck %s --check-prefix=CHECK --check-prefix=CHECK-PARTIAL  --check-prefix=CHECK-A-KEY  --check-prefix=CHECK-BTE
-// RUN: %clang -target aarch64-arm-none-eabi -S -emit-llvm -o - -mbranch-protection=pac-ret %s | \
-// RUN: FileCheck %s --check-prefix=CHECK --check-prefix=CHECK-PARTIAL  --check-prefix=CHECK-A-KEY
-// RUN: %clang -target aarch64-arm-none-eabi -S -emit-llvm -o - -mbranch-protection=pac-ret+leaf %s | \
-// RUN: FileCheck %s --check-prefix=CHECK --check-prefix=CHECK-ALL  --check-prefix=CHECK-A-KEY
-// RUN: %clang -target aarch64-arm-none-eabi -S -emit-llvm -o - -mbranch-protection=pac-ret+b-key %s | \
-// RUN: FileCheck %s --check-prefix=CHECK --check-prefix=CHECK-PARTIAL  --check-prefix=CHECK-B-KEY
-// RUN: %clang -target aarch64-arm-none-eabi -S -emit-llvm -o - -mbranch-protection=pac-ret+b-key+leaf %s | \
-// RUN: FileCheck %s --check-prefix=CHECK --check-prefix=CHECK-ALL  --check-prefix=CHECK-B-KEY
-// RUN: %clang -target aarch64-arm-none-eabi -S -emit-llvm -o - -mbranch-protection=bti %s | \
-// RUN: FileCheck %s --check-prefix=CHECK --check-prefix=CHECK-BTE
-// RUN: %clang -target aarch64-arm-none-eabi -S -emit-llvm -o - -mbranch-protection=pac-ret+b-key+leaf+bti %s | \
-// RUN: FileCheck %s --check-prefix=CHECK --check-prefix=CHECK-ALL  --check-prefix=CHECK-B-KEY --check-prefix=BTE
-
-struct Foo {
-  Foo() {}
-  ~Foo() {}
-};
-
-Foo f;
-
-// CHECK: @llvm.global_ctors {{.*}}i32 65535, void ()* @[[CTOR_FN:.*]], i8* null
-
-// CHECK: @[[CTOR_FN]]() #[[ATTR:[0-9]*]]
-
-// CHECK-NONE-NOT: "sign-return-address"={{.*}}
-// CHECK-PARTIAL: "sign-return-address"="non-leaf"
-// CHECK-ALL: "sign-return-address"="all"
-// CHECK-A-KEY: "sign-return-address-key"="a_key"
-// CHECK-B-KEY: "sign-return-address-key"="b_key"
-// CHECK-BTE: "branch-target-enforcement"

llvm/lib/Target/AArch64/AArch64BranchTargets.cpp

 // trap when an indirect branch or call instruction targets an instruction
 // which is not a valid BTI instruction. This is intended to guard against
 // control-flow hijacking attacks. Note that this does not do anything for RET
 // instructions, as they can be more precisely protected by return address
 // signing.
 //
 //===----------------------------------------------------------------------===//
 
+#include "AArch64MachineFunctionInfo.h"
 #include "AArch64Subtarget.h"
 #include "llvm/CodeGen/MachineFunctionPass.h"
 #include "llvm/CodeGen/MachineInstrBuilder.h"
 #include "llvm/CodeGen/MachineJumpTableInfo.h"
 #include "llvm/CodeGen/MachineModuleInfo.h"
 #include "llvm/Support/Debug.h"
 
 using namespace llvm;
void AArch64BranchTargets::getAnalysisUsage(AnalysisUsage &AU) const {
   MachineFunctionPass::getAnalysisUsage(AU);
 }
 
 FunctionPass *llvm::createAArch64BranchTargetsPass() {
   return new AArch64BranchTargets();
 }
 
 bool AArch64BranchTargets::runOnMachineFunction(MachineFunction &MF) {
-  const Function &F = MF.getFunction();
-  if (!F.hasFnAttribute("branch-target-enforcement"))
+  if (!MF.getInfo<AArch64FunctionInfo>()->branchTargetEnforcement())
     return false;
 
   LLVM_DEBUG(
       dbgs() << "********** AArch64 Branch Targets  **********\n"
              << "********** Function: " << MF.getName() << '\n');
+  const Function &F = MF.getFunction();
 
   // LLVM does not consider basic blocks which are the targets of jump tables
   // to be address-taken (the address can't escape anywhere else), but they are
   // used for indirect branches, so need BTI instructions.
   SmallPtrSet<MachineBasicBlock *, 8> JumpTableTargets;
   if (auto *JTI = MF.getJumpTableInfo())
     for (auto &JTE : JTI->getJumpTables())
       for (auto *MBB : JTE.MBBs)

llvm/lib/Target/AArch64/AArch64FrameLowering.cpp

if (!hasReservedCallFrame(MF)) {
     // stack, we want to add it back if we have a reserved call frame.
     assert(CalleePopAmount < 0xffffff && "call frame too large");
     emitFrameOffset(MBB, I, DL, AArch64::SP, AArch64::SP,
                     {-(int64_t)CalleePopAmount, MVT::i8}, TII);
   }
   return MBB.erase(I);
 }
 
-static bool ShouldSignReturnAddress(MachineFunction &MF) {
-  // The function should be signed in the following situations:
-  // - sign-return-address=all
-  // - sign-return-address=non-leaf and the functions spills the LR
-
-  const Function &F = MF.getFunction();
-  if (!F.hasFnAttribute("sign-return-address"))
-    return false;
-
-  StringRef Scope = F.getFnAttribute("sign-return-address").getValueAsString();
-  if (Scope.equals("none"))
-    return false;
-
-  if (Scope.equals("all"))
-    return true;
-
-  assert(Scope.equals("non-leaf") && "Expected all, none or non-leaf");
-
-  for (const auto &Info : MF.getFrameInfo().getCalleeSavedInfo())
-    if (Info.getReg() == AArch64::LR)
-      return true;
-
-  return false;
-}
-
 // Convenience function to create a DWARF expression for
 //   Expr + NumBytes + NumVGScaledBytes * AArch64::VG
 static void appendVGScaledOffsetExpr(SmallVectorImpl<char> &Expr,
                                      int NumBytes, int NumVGScaledBytes, unsigned VG,
                                      llvm::raw_string_ostream &Comment) {
   uint8_t buffer[16];
 
   if (NumBytes) {
static void adaptForLdStOpt(MachineBasicBlock &MBB,
   // add      sp, sp, #64
   //
   // and the load-store optimizer can merge the last two instructions into:
   //
   // ldp      x26, x25, [sp], #64
   //
 }
 
-static bool ShouldSignWithAKey(MachineFunction &MF) {
-  const Function &F = MF.getFunction();
-  if (!F.hasFnAttribute("sign-return-address-key"))
-    return true;
-
-  const StringRef Key =
-      F.getFnAttribute("sign-return-address-key").getValueAsString();
-  assert(Key.equals_lower("a_key") || Key.equals_lower("b_key"));
-  return Key.equals_lower("a_key");
-}
-
 static bool needsWinCFI(const MachineFunction &MF) {
   const Function &F = MF.getFunction();
   return MF.getTarget().getMCAsmInfo()->usesWindowsCFI() &&
          F.needsUnwindTableEntry();
 }
 
 static bool isTargetWindows(const MachineFunction &MF) {
   return MF.getSubtarget<AArch64Subtarget>().isTargetWindows();
void AArch64FrameLowering::emitPrologue(MachineFunction &MF,
   // redzone. In most cases, the function doesn't have a redzone so let's
   // assume that's false and set it to true in the case that there's a redzone.
   AFI->setHasRedZone(false);
 
   // Debug location must be unknown since the first debug location is used
   // to determine the end of the prologue.
   DebugLoc DL;
 
-  if (ShouldSignReturnAddress(MF)) {
-    if (ShouldSignWithAKey(MF))
-      BuildMI(MBB, MBBI, DL, TII->get(AArch64::PACIASP))
-          .setMIFlag(MachineInstr::FrameSetup);
-    else {
+  const auto &MFnI = *MF.getInfo<AArch64FunctionInfo>();
+  if (MFnI.shouldSignReturnAddress()) {
+    if (MFnI.shouldSignWithBKey()) {
       BuildMI(MBB, MBBI, DL, TII->get(AArch64::EMITBKEY))
           .setMIFlag(MachineInstr::FrameSetup);
       BuildMI(MBB, MBBI, DL, TII->get(AArch64::PACIBSP))
           .setMIFlag(MachineInstr::FrameSetup);
+    } else {
+      BuildMI(MBB, MBBI, DL, TII->get(AArch64::PACIASP))
+          .setMIFlag(MachineInstr::FrameSetup);
     }
 
     unsigned CFIIndex =
         MF.addFrameInst(MCCFIInstruction::createNegateRAState(nullptr));
     BuildMI(MBB, MBBI, DL, TII->get(TargetOpcode::CFI_INSTRUCTION))
         .addCFIIndex(CFIIndex)
         .setMIFlags(MachineInstr::FrameSetup);
   }
if (needsFrameMoves) {
     // Now emit the moves for whatever callee saved regs we have (including FP,
     // LR if those are saved).
     emitCalleeSavedFrameMoves(MBB, MBBI);
   }
 }
 
 static void InsertReturnAddressAuth(MachineFunction &MF,
                                     MachineBasicBlock &MBB) {
-  if (!ShouldSignReturnAddress(MF))
+  const auto &MFI = *MF.getInfo<AArch64FunctionInfo>();
+  if (!MFI.shouldSignReturnAddress())
     return;
   const AArch64Subtarget &Subtarget = MF.getSubtarget<AArch64Subtarget>();
   const TargetInstrInfo *TII = Subtarget.getInstrInfo();
 
   MachineBasicBlock::iterator MBBI = MBB.getFirstTerminator();
   DebugLoc DL;
   if (MBBI != MBB.end())
     DL = MBBI->getDebugLoc();
 
   // The AUTIASP instruction assembles to a hint instruction before v8.3a so
   // this instruction can safely used for any v8a architecture.
   // From v8.3a onwards there are optimised authenticate LR and return
   // instructions, namely RETA{A,B}, that can be used instead.
   if (Subtarget.hasV8_3aOps() && MBBI != MBB.end() &&
       MBBI->getOpcode() == AArch64::RET_ReallyLR) {
     BuildMI(MBB, MBBI, DL,
-            TII->get(ShouldSignWithAKey(MF) ? AArch64::RETAA : AArch64::RETAB))
+            TII->get(MFI.shouldSignWithBKey() ? AArch64::RETAB : AArch64::RETAA))
         .copyImplicitOps(*MBBI);
     MBB.erase(MBBI);
   } else {
     BuildMI(
         MBB, MBBI, DL,
-        TII->get(ShouldSignWithAKey(MF) ? AArch64::AUTIASP : AArch64::AUTIBSP))
+        TII->get(MFI.shouldSignWithBKey() ? AArch64::AUTIBSP : AArch64::AUTIASP))
         .setMIFlag(MachineInstr::FrameDestroy);
   }
 }
 
 static bool isFuncletReturnInstr(const MachineInstr &MI) {
   switch (MI.getOpcode()) {
   default:
     return false;

llvm/lib/Target/AArch64/AArch64ISelDAGToDAG.cpp

 //===-- AArch64ISelDAGToDAG.cpp - A dag to dag inst selector for AArch64 --===//
 //
 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
 // See https://llvm.org/LICENSE.txt for license information.
 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
 //
 //===----------------------------------------------------------------------===//
 //
 // This file defines an instruction selector for the AArch64 target.
 //
 //===----------------------------------------------------------------------===//
 
+#include "AArch64MachineFunctionInfo.h"
 #include "AArch64TargetMachine.h"
 #include "MCTargetDesc/AArch64AddressingModes.h"
 #include "llvm/ADT/APSInt.h"
 #include "llvm/CodeGen/SelectionDAGISel.h"
 #include "llvm/IR/Function.h" // To access function attributes.
 #include "llvm/IR/GlobalValue.h"
 #include "llvm/IR/Intrinsics.h"
 #include "llvm/IR/IntrinsicsAArch64.h"

llvm/lib/Target/AArch64/AArch64InstrInfo.cpp

AArch64InstrInfo::findRegisterToSaveLRTo(const outliner::Candidate &C) const {
 
   // No suitable register. Return 0.
   return 0u;
 }
 
 static bool
 outliningCandidatesSigningScopeConsensus(const outliner::Candidate &a,
                                          const outliner::Candidate &b) {
-  const Function &Fa = a.getMF()->getFunction();
-  const Function &Fb = b.getMF()->getFunction();
+  const auto &MFIa = a.getMF()->getInfo<AArch64FunctionInfo>();
+  const auto &MFIb = b.getMF()->getInfo<AArch64FunctionInfo>();
 
-  // If none of the functions have the "sign-return-address" attribute their
-  // signing behaviour is equal
-  if (!Fa.hasFnAttribute("sign-return-address") &&
-      !Fb.hasFnAttribute("sign-return-address")) {
-    return true;
-  }
-
-  // If both functions have the "sign-return-address" attribute their signing
-  // behaviour is equal, if the values of the attributes are equal
-  if (Fa.hasFnAttribute("sign-return-address") &&
-      Fb.hasFnAttribute("sign-return-address")) {
-    StringRef ScopeA =
-        Fa.getFnAttribute("sign-return-address").getValueAsString();
-    StringRef ScopeB =
-        Fb.getFnAttribute("sign-return-address").getValueAsString();
-    return ScopeA.equals(ScopeB);
-  }
-
-  // If function B doesn't have the "sign-return-address" attribute but A does,
-  // the functions' signing behaviour is equal if A's value for
-  // "sign-return-address" is "none" and vice versa.
-  if (Fa.hasFnAttribute("sign-return-address")) {
-    StringRef ScopeA =
-        Fa.getFnAttribute("sign-return-address").getValueAsString();
-    return ScopeA.equals("none");
-  }
-
-  if (Fb.hasFnAttribute("sign-return-address")) {
-    StringRef ScopeB =
-        Fb.getFnAttribute("sign-return-address").getValueAsString();
-    return ScopeB.equals("none");
-  }
-
-  llvm_unreachable("Unkown combination of sign-return-address attributes");
+  return MFIa->shouldSignReturnAddress(false) == MFIb->shouldSignReturnAddress(false) &&
+         MFIa->shouldSignReturnAddress(true) == MFIb->shouldSignReturnAddress(true);
 }
 
 static bool
 outliningCandidatesSigningKeyConsensus(const outliner::Candidate &a,
                                        const outliner::Candidate &b) {
-  const Function &Fa = a.getMF()->getFunction();
-  const Function &Fb = b.getMF()->getFunction();
-
-  // If none of the functions have the "sign-return-address-key" attribute
-  // their keys are equal
-  if (!Fa.hasFnAttribute("sign-return-address-key") &&
-      !Fb.hasFnAttribute("sign-return-address-key")) {
-    return true;
-  }
-
-  // If both functions have the "sign-return-address-key" attribute their
-  // keys are equal if the values of "sign-return-address-key" are equal
-  if (Fa.hasFnAttribute("sign-return-address-key") &&
-      Fb.hasFnAttribute("sign-return-address-key")) {
-    StringRef KeyA =
-        Fa.getFnAttribute("sign-return-address-key").getValueAsString();
-    StringRef KeyB =
-        Fb.getFnAttribute("sign-return-address-key").getValueAsString();
-    return KeyA.equals(KeyB);
-  }
-
-  // If B doesn't have the "sign-return-address-key" attribute, both keys are
-  // equal, if function a has the default key (a_key)
-  if (Fa.hasFnAttribute("sign-return-address-key")) {
-    StringRef KeyA =
-        Fa.getFnAttribute("sign-return-address-key").getValueAsString();
-    return KeyA.equals_lower("a_key");
-  }
-
-  if (Fb.hasFnAttribute("sign-return-address-key")) {
-    StringRef KeyB =
-        Fb.getFnAttribute("sign-return-address-key").getValueAsString();
-    return KeyB.equals_lower("a_key");
-  }
+  const auto &MFIa = a.getMF()->getInfo<AArch64FunctionInfo>();
+  const auto &MFIb = b.getMF()->getInfo<AArch64FunctionInfo>();
 
-  llvm_unreachable("Unkown combination of sign-return-address-key attributes");
+  return MFIa->shouldSignWithBKey() == MFIb->shouldSignWithBKey();
 }
 
 static bool outliningCandidatesV8_3OpsConsensus(const outliner::Candidate &a,
                                                 const outliner::Candidate &b) {
   const AArch64Subtarget &SubtargetA =
       a.getMF()->getSubtarget<AArch64Subtarget>();
   const AArch64Subtarget &SubtargetB =
       b.getMF()->getSubtarget<AArch64Subtarget>();
outliner::OutlinedFunction AArch64InstrInfo::getOutliningCandidateInfo(
   // the case of "sign-return-address"="non-leaf" this is an assumption: It is
   // not certainly true that the outlined function will have to sign its return
   // address but this decision is made later, when the decision to outline
   // has already been made.
   // The same holds for the number of additional instructions we need: On
   // v8.3a RET can be replaced by RETAA/RETAB and no AUT instruction is
   // necessary. However, at this point we don't know if the outlined function
   // will have a RET instruction so we assume the worst.
-  const Function &FCF = FirstCand.getMF()->getFunction();
   const TargetRegisterInfo &TRI = getRegisterInfo();
-  if (FCF.hasFnAttribute("sign-return-address")) {
+  if (FirstCand.getMF()
+          ->getInfo<AArch64FunctionInfo>()
+          ->shouldSignReturnAddress(true)) {
     // One PAC and one AUT instructions
     NumBytesToCreateFrame += 8;
 
     // We have to check if sp modifying instructions would get outlined.
     // If so we only allow outlining if sp is unchanged overall, so matching
     // sub and add instructions are okay to outline, all other sp modifications
     // are not
     auto hasIllegalSPModification = [&TRI](outliner::Candidate &C) {
auto SetCandidateCallInfo =
         for (outliner::Candidate &C : RepeatedSequenceLocs)
           C.setCallInfo(CallID, NumBytesForCall);
       };
 
   unsigned FrameID = MachineOutlinerDefault;
   NumBytesToCreateFrame += 4;
 
   bool HasBTI = any_of(RepeatedSequenceLocs, [](outliner::Candidate &C) {
-    return C.getMF()->getFunction().hasFnAttribute("branch-target-enforcement");
+    return C.getMF()->getInfo<AArch64FunctionInfo>()->branchTargetEnforcement();
   });
 
   // We check to see if CFI Instructions are present, and if they are
   // we find the number of CFI Instructions in the candidates.
   unsigned CFICount = 0;
   MachineBasicBlock::iterator MBBI = RepeatedSequenceLocs[0].front();
   for (unsigned Loc = RepeatedSequenceLocs[0].getStartIdx();
        Loc < RepeatedSequenceLocs[0].getEndIdx() + 1; Loc++) {
MachineInstr *LDRXpost = BuildMI(MF, DebugLoc(), get(AArch64::LDRXpost))
                                  .addReg(AArch64::SP)
                                  .addImm(16);
     Et = MBB.insert(Et, LDRXpost);
   }
 
   // If a bunch of candidates reach this point they must agree on their return
   // address signing. It is therefore enough to just consider the signing
   // behaviour of one of them
-  const Function &CF = OF.Candidates.front().getMF()->getFunction();
-  bool ShouldSignReturnAddr = false;
-  if (CF.hasFnAttribute("sign-return-address")) {
-    StringRef Scope =
-        CF.getFnAttribute("sign-return-address").getValueAsString();
-    if (Scope.equals("all"))
-      ShouldSignReturnAddr = true;
-    else if (Scope.equals("non-leaf") && !IsLeafFunction)
-      ShouldSignReturnAddr = true;
-  }
+  const auto &MFI = *OF.Candidates.front().getMF()->getInfo<AArch64FunctionInfo>();
+  bool ShouldSignReturnAddr = MFI.shouldSignReturnAddress(!IsLeafFunction);
 
   // a_key is the default
-  bool ShouldSignReturnAddrWithAKey = true;
-  if (CF.hasFnAttribute("sign-return-address-key")) {
-    const StringRef Key =
-        CF.getFnAttribute("sign-return-address-key").getValueAsString();
-    // Key can either be a_key or b_key
-    assert((Key.equals_lower("a_key") || Key.equals_lower("b_key")) &&
-           "Return address signing key must be either a_key or b_key");
-    ShouldSignReturnAddrWithAKey = Key.equals_lower("a_key");
-  }
+  bool ShouldSignReturnAddrWithAKey = !MFI.shouldSignWithBKey();
 
   // If this is a tail call outlined function, then there's already a return.
   if (OF.FrameConstructionID == MachineOutlinerTailCall ||
       OF.FrameConstructionID == MachineOutlinerThunk) {
     signOutlinedFunction(MF, MBB, ShouldSignReturnAddr,
                          ShouldSignReturnAddrWithAKey);
     return;
   }

llvm/lib/Target/AArch64/AArch64InstrInfo.td

 // the Function object through the <Target>Subtarget and objections were raised
 // to that (see post-commit review comments for r301750).
 let RecomputePerFunction = 1 in {
   def ForCodeSize   : Predicate<"shouldOptForSize(MF)">;
   def NotForCodeSize   : Predicate<"!shouldOptForSize(MF)">;
   // Avoid generating STRQro if it is slow, unless we're optimizing for code size.
   def UseSTRQro : Predicate<"!Subtarget->isSTRQroSlow() || shouldOptForSize(MF)">;
 
-  def UseBTI : Predicate<[{ MF->getFunction().hasFnAttribute("branch-target-enforcement") }]>;
-  def NotUseBTI : Predicate<[{ !MF->getFunction().hasFnAttribute("branch-target-enforcement") }]>;
+  def UseBTI : Predicate<[{ MF->getInfo<AArch64FunctionInfo>()->branchTargetEnforcement() }]>;
+  def NotUseBTI : Predicate<[{ !MF->getInfo<AArch64FunctionInfo>()->branchTargetEnforcement() }]>;
 
   def SLSBLRMitigation : Predicate<[{ MF->getSubtarget<AArch64Subtarget>().hardenSlsBlr() }]>;
   def NoSLSBLRMitigation : Predicate<[{ !MF->getSubtarget<AArch64Subtarget>().hardenSlsBlr() }]>;
   // Toggles patterns which aren't beneficial in GlobalISel when we aren't
   // optimizing. This allows us to selectively use patterns without impacting
   // SelectionDAG's behaviour.
   // FIXME: One day there will probably be a nicer way to check for this, but
   // today is not that day.

llvm/lib/Target/AArch64/AArch64MachineFunctionInfo.h

 struct AArch64FunctionInfo;
 } // end namespace yaml
 
 class MachineInstr;
 
 /// AArch64FunctionInfo - This class is derived from MachineFunctionInfo and
 /// contains private AArch64-specific information for each MachineFunction.
 class AArch64FunctionInfo final : public MachineFunctionInfo {
+  /// Backreference to the machine function.
+  MachineFunction &MF;
+
   /// Number of bytes of arguments this function has on the stack. If the callee
   /// is expected to restore the argument stack this should be a multiple of 16,
   /// all usable during a tail call.
   ///
   /// The alternative would forbid tail call optimisation in some cases: if we
   /// want to transfer control from a function with 8-bytes of stack-argument
   /// space to a function with 16-bytes then misalignment of this value would
   /// make a stack adjustment necessary, which could not be undone by the
class AArch64FunctionInfo final : public MachineFunctionInfo {
   /// OutliningStyle denotes, if a function was outined, how it was outlined,
   /// e.g. Tail Call, Thunk, or Function if none apply.
   Optional<std::string> OutliningStyle;
 
   // Offset from SP-after-callee-saved-spills (i.e. SP-at-entry minus
   // CalleeSavedStackSize) to the address of the frame record.
   int CalleeSaveBaseToFrameRecordOffset = 0;
 
-public:
-  AArch64FunctionInfo() = default;
+  /// SignReturnAddress is true if PAC-RET is enabled for the function with
+  /// defaults being sign non-leaf functions only, with the B key.
+  bool SignReturnAddress = false;
+
+  /// SignReturnAddressAll modifies the default PAC-RET mode to signing leaf
+  /// functions as well.
+  bool SignReturnAddressAll = false;
+
+  /// SignWithBKey modifies the default PAC-RET mode to signing with the B key.
+  bool SignWithBKey = false;
+
+  /// BranchTargetEnforcement enables placing BTI instructions at potential
+  /// indirect branch destinations.
+  bool BranchTargetEnforcement = false;
 
-  explicit AArch64FunctionInfo(MachineFunction &MF) {
-    (void)MF;
+public:
+  explicit AArch64FunctionInfo(MachineFunction &MF);
 
-    // If we already know that the function doesn't have a redzone, set
-    // HasRedZone here.
-    if (MF.getFunction().hasFnAttribute(Attribute::NoRedZone))
-      HasRedZone = false;
-  }
   void initializeBaseYamlFields(const yaml::AArch64FunctionInfo &YamlMFI);
 
   unsigned getBytesInStackArgArea() const { return BytesInStackArgArea; }
   void setBytesInStackArgArea(unsigned bytes) { BytesInStackArgArea = bytes; }
 
   unsigned getArgumentStackToRestore() const { return ArgumentStackToRestore; }
   void setArgumentStackToRestore(unsigned bytes) {
     ArgumentStackToRestore = bytes;
#endif
 
   int getCalleeSaveBaseToFrameRecordOffset() const {
     return CalleeSaveBaseToFrameRecordOffset;
   }
   void setCalleeSaveBaseToFrameRecordOffset(int Offset) {
     CalleeSaveBaseToFrameRecordOffset = Offset;
   }
 
+  bool shouldSignReturnAddress() const;
+  bool shouldSignReturnAddress(bool SpillsLR) const;
+
+  bool shouldSignWithBKey() const { return SignWithBKey; }
+
+  bool branchTargetEnforcement() const { return BranchTargetEnforcement; }
+
 private:
   // Hold the lists of LOHs.
   MILOHContainer LOHContainerSet;
   SetOfInstructions LOHRelated;
 
   SmallVector<std::pair<unsigned, MCSymbol *>, 2> JumpTableEntryInfo;
 };
 

llvm/lib/Target/AArch64/AArch64MachineFunctionInfo.cpp

 //=- AArch64MachineFunctionInfo.cpp - AArch64 Machine Function Info ---------=//
 
 //
 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
 // See https://llvm.org/LICENSE.txt for license information.
 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
 //
 //===----------------------------------------------------------------------===//
 ///
 /// \file
 /// This file implements AArch64-specific per-machine-function
 /// information.
 ///
 //===----------------------------------------------------------------------===//
 
 #include "AArch64MachineFunctionInfo.h"
+#include "AArch64InstrInfo.h"
+#include <llvm/IR/Metadata.h>
+#include <llvm/IR/Module.h>
 
 using namespace llvm;
 
 yaml::AArch64FunctionInfo::AArch64FunctionInfo(
     const llvm::AArch64FunctionInfo &MFI)
     : HasRedZone(MFI.hasRedZone()) {}
 
 void yaml::AArch64FunctionInfo::mappingImpl(yaml::IO &YamlIO) {
   MappingTraits<AArch64FunctionInfo>::mapping(YamlIO, *this);
 }
 
 void AArch64FunctionInfo::initializeBaseYamlFields(
     const yaml::AArch64FunctionInfo &YamlMFI) {
   if (YamlMFI.HasRedZone.hasValue())
     HasRedZone = YamlMFI.HasRedZone;
 }
+
+static std::pair<bool, bool> GetSignReturnAddress(const Function &F) {
+  // The function should be signed in the following situations:
+  // - sign-return-address=all
+  // - sign-return-address=non-leaf and the functions spills the LR
+  if (!F.hasFnAttribute("sign-return-address")) {
+    const Module &M = *F.getParent();
+    if (const auto *Sign = mdconst::extract_or_null<ConstantInt>(
+            M.getModuleFlag("sign-return-address"))) {
+      if (Sign->getZExtValue()) {
+        if (const auto *All = mdconst::extract_or_null<ConstantInt>(
+                M.getModuleFlag("sign-return-address-all")))
+          return {true, All->getZExtValue()};
+        return {true, false};
+      }
+    }
+    return {false, false};
+  }
+
+  StringRef Scope = F.getFnAttribute("sign-return-address").getValueAsString();
+  if (Scope.equals("none"))
+    return {false, false};
+
+  if (Scope.equals("all"))
+    return {true, true};
+
+  assert(Scope.equals("non-leaf"));
+  return {true, false};
+}
+
+static bool ShouldSignWithBKey(const Function &F) {
+  if (!F.hasFnAttribute("sign-return-address-key")) {
+    if (const auto *BKey = mdconst::extract_or_null<ConstantInt>(
+            F.getParent()->getModuleFlag("sign-return-address-with-bkey")))
+      return BKey->getZExtValue();
+    return false;
+  }
+
+  const StringRef Key =
+      F.getFnAttribute("sign-return-address-key").getValueAsString();
+  assert(Key.equals_lower("a_key") || Key.equals_lower("b_key"));
+  return Key.equals_lower("b_key");
+}
+
+AArch64FunctionInfo::AArch64FunctionInfo(MachineFunction &MF) : MF(MF) {
+  // If we already know that the function doesn't have a redzone, set
+  // HasRedZone here.
+  if (MF.getFunction().hasFnAttribute(Attribute::NoRedZone))
+    HasRedZone = false;
+
+  const Function &F = MF.getFunction();
+  std::tie(SignReturnAddress, SignReturnAddressAll) = GetSignReturnAddress(F);
+  SignWithBKey = ShouldSignWithBKey(F);
+
+  if (!F.hasFnAttribute("branch-target-enforcement")) {
+    if (const auto *BTE = mdconst::extract_or_null<ConstantInt>(
+            F.getParent()->getModuleFlag("branch-target-enforcement")))
+      BranchTargetEnforcement = BTE->getZExtValue();
+    return;
+  }
+
+  const StringRef BTIEnable = F.getFnAttribute("branch-target-enforcement").getValueAsString();
+  assert(BTIEnable.equals_lower("true") || BTIEnable.equals_lower("false"));
+  BranchTargetEnforcement = BTIEnable.equals_lower("true");
+}
+
+bool AArch64FunctionInfo::shouldSignReturnAddress(bool SpillsLR) const {
+  if (!SignReturnAddress)
+    return false;
+  if (SignReturnAddressAll)
+    return true;
+  return SpillsLR;
+}
+
+bool AArch64FunctionInfo::shouldSignReturnAddress() const {
+  return shouldSignReturnAddress(llvm::any_of(
+      MF.getFrameInfo().getCalleeSavedInfo(),
+      [](const auto &Info) { return Info.getReg() == AArch64::LR; }));
+}

llvm/lib/Target/AArch64/GISel/AArch64CallLowering.cpp

static unsigned getCallOpcode(const MachineFunction &CallerF, bool IsIndirect,
   if (!IsTailCall)
     return IsIndirect ? getBLRCallOpcode(CallerF) : (unsigned)AArch64::BL;
 
   if (!IsIndirect)
     return AArch64::TCRETURNdi;
 
   // When BTI is enabled, we need to use TCRETURNriBTI to make sure that we use
   // x16 or x17.
-  if (CallerF.getFunction().hasFnAttribute("branch-target-enforcement"))
+  if (CallerF.getInfo<AArch64FunctionInfo>()->branchTargetEnforcement())
     return AArch64::TCRETURNriBTI;
 
   return AArch64::TCRETURNri;
 }
 
 bool AArch64CallLowering::lowerTailCall(
     MachineIRBuilder &MIRBuilder, CallLoweringInfo &Info,
     SmallVectorImpl<ArgInfo> &OutArgs) const {
   MachineFunction &MF = MIRBuilder.getMF();
   const Function &F = MF.getFunction();
   MachineRegisterInfo &MRI = MF.getRegInfo();
   const AArch64TargetLowering &TLI = *getTLI<AArch64TargetLowering>();
   AArch64FunctionInfo *FuncInfo = MF.getInfo<AArch64FunctionInfo>();
 
   // True when we're tail calling, but without -tailcallopt.
   bool IsSibCall = !MF.getTarget().Options.GuaranteedTailCallOpt;
 
   // TODO: Right now, regbankselect doesn't know how to handle the rtcGPR64
   // register class. Until we can do that, we should fall back here.
-  if (F.hasFnAttribute("branch-target-enforcement")) {
+  if (MF.getInfo<AArch64FunctionInfo>()->branchTargetEnforcement()) {
     LLVM_DEBUG(
         dbgs() << "Cannot lower indirect tail calls with BTI enabled yet.\n");
     return false;
   }
 
   // Find out which ABI gets to decide where things go.
   CallingConv::ID CalleeCC = Info.CallConv;
   CCAssignFn *AssignFnFixed;

llvm/test/CodeGen/AArch64/branch-target-enforcement-indirect-calls.ll

 
 define void @bti_disabled(void ()* %p) {
 entry:
   tail call void %p()
 ; CHECK: br x0
   ret void
 }
 
-define void @bti_enabled(void ()* %p) "branch-target-enforcement" {
+define void @bti_enabled(void ()* %p) "branch-target-enforcement"="true" {
 entry:
   tail call void %p()
 ; CHECK: br {{x16|x17}}
   ret void
 }

llvm/test/CodeGen/AArch64/branch-target-enforcement.mir

 # RUN: llc -run-pass=aarch64-branch-targets %s -o - | FileCheck %s
 --- |
   target datalayout = "e-m:e-i8:8:32-i16:16:32-i64:64-i128:128-n32:64-S128"
   target triple = "aarch64-arm-none-eabi"
 
-  define hidden i32 @simple_external() "branch-target-enforcement" {
+  define hidden i32 @simple_external() "branch-target-enforcement"="true" {
   entry:
     ret i32 0
   }
 
-  define internal i32 @simple_internal() "branch-target-enforcement" {
+  define internal i32 @simple_internal() "branch-target-enforcement"="true" {
   entry:
     ret i32 0
   }
 
-  define hidden i32 @ptr_auth() "branch-target-enforcement" {
+  define hidden i32 @ptr_auth() "branch-target-enforcement"="true" {
   entry:
     tail call void asm sideeffect "", "~{lr}"()
     ret i32 0
   }
 
-  define hidden i32 @ptr_auth_b() "branch-target-enforcement" {
+  define hidden i32 @ptr_auth_b() "branch-target-enforcement"="true" {
   entry:
     tail call void asm sideeffect "", "~{lr}"()
     ret i32 0
   }
 
-  define hidden i32 @jump_table(i32 %a) "branch-target-enforcement" {
+  define hidden i32 @jump_table(i32 %a) "branch-target-enforcement"="true" {
   entry:
     switch i32 %a, label %sw.epilog [
       i32 1, label %sw.bb
       i32 2, label %sw.bb1
       i32 3, label %sw.bb2
       i32 4, label %sw.bb3
       i32 5, label %sw.bb4
     ]
sw.bb4:                                           ; preds = %entry
     br label %sw.epilog
 
   sw.epilog:                                        ; preds = %entry, %sw.bb4, %sw.bb3, %sw.bb2, %sw.bb1, %sw.bb
     ret i32 0
   }
 
   @label_address.addr = internal unnamed_addr global i8* blockaddress(@label_address, %return), align 8
 
-  define hidden i32 @label_address() "branch-target-enforcement" {
+  define hidden i32 @label_address() "branch-target-enforcement"="true" {
   entry:
     %0 = load i8*, i8** @label_address.addr, align 8
     indirectbr i8* %0, [label %return, label %lab2]
 
   lab2:                                             ; preds = %entry
     br label %.split
 
   return:                                           ; preds = %entry
     br label %.split
 
   .split:                                           ; preds = %lab2, %return
     %merge = phi i8* [ blockaddress(@label_address, %lab2), %return ], [ blockaddress(@label_address, %return), %lab2 ]
     %merge2 = phi i32 [ 1, %return ], [ 2, %lab2 ]
     store i8* %merge, i8** @label_address.addr, align 8
     ret i32 %merge2
   }
 
-  define hidden i32 @label_address_entry() "branch-target-enforcement" {
+  define hidden i32 @label_address_entry() "branch-target-enforcement"="true" {
   entry:
     %0 = load i8*, i8** @label_address.addr, align 8
     indirectbr i8* %0, [label %return, label %lab2]
 
   lab2:                                             ; preds = %entry
     br label %.split
 
   return:                                           ; preds = %entry
     br label %.split
 
   .split:                                           ; preds = %lab2, %return
     %merge = phi i8* [ blockaddress(@label_address, %lab2), %return ], [ blockaddress(@label_address, %return), %lab2 ]
     %merge2 = phi i32 [ 1, %return ], [ 2, %lab2 ]
     store i8* %merge, i8** @label_address.addr, align 8
     ret i32 %merge2
   }
 
-  define hidden i32 @debug_ptr_auth() "branch-target-enforcement" {
+  define hidden i32 @debug_ptr_auth() "branch-target-enforcement"="true" {
   entry:
     tail call void asm sideeffect "", "~{lr}"()
     ret i32 0
   }
 
 ...
 ---
 # External function, could be addres-taken elsewhere so needs BTI JC.

llvm/test/CodeGen/AArch64/bti-branch-relaxation.ll

 declare dso_local void @g2(...) local_unnamed_addr #0
 
 declare dso_local void @g3(...) local_unnamed_addr #0
 
 declare dso_local void @e(...) local_unnamed_addr #0
 
 declare dso_local i64 @llvm.aarch64.space(i32, i64) local_unnamed_addr #0
 
-attributes #0 = { nounwind "branch-target-enforcement" "correctly-rounded-divide-sqrt-fp-math"="false" "disable-tail-calls"="false" "frame-pointer"="all" "less-precise-fpmad"="false" "min-legal-vector-width"="0" "no-infs-fp-math"="false" "no-jump-tables"="false" "no-nans-fp-math"="false" "no-signed-zeros-fp-math"="false" "no-trapping-math"="false" "stack-protector-buffer-size"="8" "target-cpu"="generic" "target-features"="+neon,+v8.5a" "unsafe-fp-math"="false" "use-soft-float"="false" }
+attributes #0 = { nounwind "branch-target-enforcement"="true" "correctly-rounded-divide-sqrt-fp-math"="false" "disable-tail-calls"="false" "frame-pointer"="all" "less-precise-fpmad"="false" "min-legal-vector-width"="0" "no-infs-fp-math"="false" "no-jump-tables"="false" "no-nans-fp-math"="false" "no-signed-zeros-fp-math"="false" "no-trapping-math"="false" "stack-protector-buffer-size"="8" "target-cpu"="generic" "target-features"="+neon,+v8.5a" "unsafe-fp-math"="false" "use-soft-float"="false" }

llvm/test/CodeGen/AArch64/machine-outliner-2fixup-blr-terminator.mir

 # RUN: llc -mtriple=aarch64--- -run-pass=machine-outliner \
 # RUN: -verify-machineinstrs %s -o - | FileCheck %s
 
 # CHECK-NOT: OUTLINED_FUNCTION
 
 --- |
   define void @f1() #0 { ret void }
   define void @f2() #0 { ret void }
   define void @f3() #0 { ret void }
   define void @f4() #0 { ret void }
-  attributes #0 = { minsize noredzone "branch-target-enforcement" }
+  attributes #0 = { minsize noredzone "branch-target-enforcement"="true" }
 ...
 ---
 name: f1
 tracksRegLiveness: true
 body: |
   bb.0:
   liveins: $lr, $x0, $x1, $x2, $x3, $x4, $x5, $x6, $x7, $x8, $x9, $x10, $x11, $x12, $x13, $x14, $x15, $x18, $x19, $x20, $x21, $x22, $x23, $x20, $x21, $x22, $x23, $x24, $x25, $x26, $x27, $x28, $fp
     $x20, $x19 = LDPXi $sp, 11

llvm/test/CodeGen/AArch64/machine-outliner-bti.mir

 # instruction. We make of this for general tail-calls (tested elsewhere), but
 # don't currently make use of this in the outliner.
 
 # CHECK-NOT: OUTLINED_FUNCTION_
 
 --- |
   @g = hidden local_unnamed_addr global i32 0, align 4
 
-  define hidden void @bar(void ()* nocapture %f) "branch-target-enforcement" {
+  define hidden void @bar(void ()* nocapture %f) "branch-target-enforcement"="true" {
   entry:
     ret void
   }
 
   declare void @foo()
 ...
 ---
 name:            bar

llvm/test/CodeGen/AArch64/machine-outliner-outline-bti.ll

 ; RUN: llc -mtriple aarch64--none-eabi < %s | FileCheck %s
 
 ; The BTI instruction cannot be outlined, because it needs to be the very first
 ; instruction executed after an indirect call.
 
 @g = hidden global i32 0, align 4
 
-define hidden void @foo() minsize "branch-target-enforcement" {
+define hidden void @foo() minsize "branch-target-enforcement"="true" {
 entry:
 ; CHECK: hint #34
 ; CHECK: b       OUTLINED_FUNCTION_0
   store volatile i32 1, i32* @g, align 4
   ret void
 }
 
-define hidden void @bar() minsize "branch-target-enforcement" {
+define hidden void @bar() minsize "branch-target-enforcement"="true" {
 entry:
 ; CHECK: hint #34
 ; CHECK: b       OUTLINED_FUNCTION_0
   store volatile i32 1, i32* @g, align 4
   ret void
 }

llvm/test/CodeGen/AArch64/note-gnu-property-pac-bti-0.ll

 ; RUN: llc -mtriple=aarch64-linux %s               -o - | \
 ; RUN:   FileCheck %s --check-prefix=ASM
 ; RUN: llc -mtriple=aarch64-linux %s -filetype=obj -o - |  \
 ; RUN:   llvm-readelf --notes - | FileCheck %s --check-prefix=OBJ
 @x = common dso_local global i32 0, align 4
 
-attributes #0 = { "branch-target-enforcement" }
+attributes #0 = { "branch-target-enforcement"="true" }
 
 ; Both attributes present in a file with no functions.
 ; ASM:      .word 3221225472
 ; ASM-NEXT: .word 4
 ; ASM-NEXT: .word 3
 
 ; OBJ: Properties: aarch64 feature: BTI, PAC

llvm/test/CodeGen/AArch64/note-gnu-property-pac-bti-1.ll

 ; RUN: llc -mtriple=aarch64-linux %s               -o - | \
 ; RUN:   FileCheck %s --check-prefix=ASM
 ; RUN: llc -mtriple=aarch64-linux %s -filetype=obj -o - |  \
 ; RUN:   llvm-readelf --notes - | FileCheck %s --check-prefix=OBJ
 
 define dso_local i32 @f() #0 {
 entry:
   ret i32 0
 }
 
-attributes #0 = { "branch-target-enforcement" }
+attributes #0 = { "branch-target-enforcement"="true" }
 
 ; BTI attribute present
 ; ASM:      .word 3221225472
 ; ASM-NEXT: .word 4
 ; ASM-NEXT: .word 1
 
 ; OBJ: Properties: aarch64 feature: BTI

llvm/test/CodeGen/AArch64/note-gnu-property-pac-bti-3.ll

 ; RUN: llc -mtriple=aarch64-linux %s               -o - | \
 ; RUN:   FileCheck %s --check-prefix=ASM
 ; RUN: llc -mtriple=aarch64-linux %s -filetype=obj -o - |  \
 ; RUN:   llvm-readelf --notes - | FileCheck %s --check-prefix=OBJ
 
 define dso_local i32 @f() #0 {
 entry:
   ret i32 0
 }
 
-attributes #0 = { "branch-target-enforcement" "sign-return-address"="non-leaf" }
+attributes #0 = { "branch-target-enforcement"="true" "sign-return-address"="non-leaf" }
 
 ; Both attribute present
 ; ASM:      .word 3221225472
 ; ASM-NEXT: .word 4
 ; ASM-NEXT: .word 3
 
 ; OBJ: Properties: aarch64 feature: BTI, PAC

llvm/test/CodeGen/AArch64/note-gnu-property-pac-bti-4.ll

 ; RUN: llc -mtriple=aarch64-linux %s               -o - | \
 ; RUN:   FileCheck %s --check-prefix=ASM
 ; RUN: llc -mtriple=aarch64-linux %s -filetype=obj -o - |  \
 ; RUN:   llvm-readelf --notes - | FileCheck %s --check-prefix=OBJ
 
 define dso_local i32 @f() #0 {
 entry:
   ret i32 0
 }
 
 define dso_local i32 @g() #1 {
 entry:
   ret i32 0
 }
 
-attributes #0 = { "branch-target-enforcement" "sign-return-address"="non-leaf" }
+attributes #0 = { "branch-target-enforcement"="true" "sign-return-address"="non-leaf" }
 
-attributes #1 = { "branch-target-enforcement" }
+attributes #1 = { "branch-target-enforcement"="true" }
 
 ; Only the common atttribute (BTI)
 ; ASM:      .word 3221225472
 ; ASM-NEXT: .word 4
 ; ASM-NEXT: .word 1
 
 ; OBJ: Properties: aarch64 feature: BTI

llvm/test/CodeGen/AArch64/note-gnu-property-pac-bti-5.ll

 ; RUN: llc -mtriple=aarch64-linux %s               -o - 2>&1 | \
 ; RUN:   FileCheck %s --check-prefix=ASM
 ; RUN: llc -mtriple=aarch64-linux %s -filetype=obj -o -      |  \
 ; RUN:   llvm-readelf --notes - | FileCheck %s --check-prefix=OBJ
 
 define dso_local i32 @f() #0 {
 entry:
   ret i32 0
 }
 
 define dso_local i32 @g() #1 {
 entry:
   ret i32 0
 }
 
-attributes #0 = { "branch-target-enforcement" "sign-return-address"="non-leaf" }
+attributes #0 = { "branch-target-enforcement"="true" "sign-return-address"="non-leaf" }
 
 attributes #1 = { "sign-return-address"="all" }
 
 ; Only the common atttribute (PAC)
 ; ASM: warning: not setting BTI in feature flags
 ; ASM:      .word 3221225472
 ; ASM-NEXT: .word 4
 ; ASM-NEXT: .word 2
 
 ; OBJ: Properties: aarch64 feature: PAC

llvm/test/CodeGen/AArch64/note-gnu-property-pac-bti-7.ll

 
 define dso_local i32 @g() #1 {
 entry:
   ret i32 0
 }
 
 attributes #0 = { "sign-return-address"="non-leaf" }
 
-attributes #1 = { "branch-target-enforcement" }
+attributes #1 = { "branch-target-enforcement"="true" }
 
 ; No common attribute, no note section
 ; ASM: warning: not setting BTI in feature flags
 ; ASM-NOT: .note.gnu.property
 ; OBJ-NOT: .note.gnu.property

llvm/test/CodeGen/AArch64/note-gnu-property-pac-bti-8.ll

 ; RUN: llc -mtriple=aarch64-linux %s               -o - | \
 ; RUN:   FileCheck %s --check-prefix=ASM
 ; RUN: llc -mtriple=aarch64-linux %s -filetype=obj -o - | \
 ; RUN:   llvm-readelf --notes - | FileCheck %s --check-prefix=OBJ
 
 define dso_local i32 @f() #0 {
 entry:
   %r = tail call i32 @g()
   ret i32 %r
 }
 
 declare dso_local i32 @g()
 
-attributes #0 = { "branch-target-enforcement" }
+attributes #0 = { "branch-target-enforcement"="true" }
 
 ; Declarations don't prevent setting BTI
 ; ASM:      .word 3221225472
 ; ASM-NEXT: .word 4
 ; ASM-NEXT: .word 1
 
 ; OBJ: Properties: aarch64 feature: BTI

llvm/test/CodeGen/AArch64/pacbti-llvm-generated-funcs-1.ll

+;; RUN: llc %s -o -| FileCheck %s
+target datalayout = "e-m:e-i8:8:32-i16:16:32-i64:64-i128:128-n32:64-S128"
+target triple = "aarch64-unknown-linux"
+
[e-mail]_ctors = appending global [1 x { i32, void ()*, i8* }] [{ i32, void ()*, i8* } { i32 1, void ()* @asan.module_ctor, i8* null }]
+
+define dso_local i32 @f() #0 {
+entry:
+  ret i32 0
+}
+;; CHECK-LABEL: f:
+;; CHECK: hint #34
+
+declare void @__asan_init()
+declare void @__asan_version_mismatch_check_v8()
+
+define internal void @asan.module_ctor() {
+  call void @__asan_init()
+  call void @__asan_version_mismatch_check_v8()
+  ret void
+}
+;; CHECK-LABEL: asan.module_ctor:
+;; CHECK: hint #34
+
+attributes #0 = { noinline nounwind optnone sanitize_address uwtable "branch-target-enforcement"="true" }
+
+!llvm.module.flags = !{!0, !1, !2, !3, !4}
+
+!0 = !{i32 1, !"wchar_size", i32 4}
+!1 = !{i32 4, !"branch-target-enforcement", i32 1}
+!2 = !{i32 4, !"sign-return-address", i32 0}
+!3 = !{i32 4, !"sign-return-address-all", i32 0}
+!4 = !{i32 4, !"sign-return-address-with-bkey", i32 0}
 No newline at end of file

llvm/test/CodeGen/AArch64/pacbti-llvm-generated-funcs-2.ll

+;; RUN: llc --mattr=+v8.3a %s -o - | FileCheck %s
+target datalayout = "e-m:e-i8:8:32-i16:16:32-i64:64-i128:128-n32:64-S128"
+target triple = "aarch64-unknown-linux"
+
+@__llvm_gcov_ctr = internal global [1 x i64] zeroinitializer
+@0 = private unnamed_addr constant [7 x i8] c"m.gcda\00", align 1
[e-mail]_ctors = appending global [1 x { i32, void ()*, i8* }] [{ i32, void ()*, i8* } { i32 0, void ()* @__llvm_gcov_init, i8* null }]
+
+define dso_local i32 @f() local_unnamed_addr #0 {
+entry:
+  ret i32 0
+}
+;; CHECK-LABEL: f:
+;; CHECK: pacibsp
+
+declare void @llvm_gcda_start_file(i8*, i32, i32) local_unnamed_addr
+
+declare void @llvm_gcda_emit_function(i32, i32, i32) local_unnamed_addr
+
+declare void @llvm_gcda_emit_arcs(i32, i64*) local_unnamed_addr
+
+declare void @llvm_gcda_summary_info() local_unnamed_addr
+
+declare void @llvm_gcda_end_file() local_unnamed_addr
+
+define internal void @__llvm_gcov_writeout() unnamed_addr #1 {
+entry:
+  tail call void @llvm_gcda_start_file(i8* getelementptr inbounds ([7 x i8], [7 x i8]* @0, i64 0, i64 0), i32 875575338, i32 0)
+  tail call void @llvm_gcda_emit_function(i32 0, i32 0, i32 0)
+  tail call void @llvm_gcda_emit_arcs(i32 1, i64* getelementptr inbounds ([1 x i64], [1 x i64]* @__llvm_gcov_ctr, i64 0, i64 0))
+  tail call void @llvm_gcda_summary_info()
+  tail call void @llvm_gcda_end_file()
+  ret void
+}
+;; CHECK-LABEL: __llvm_gcov_writeout:
+;; CHECK:       .cfi_b_key_frame
+;; CHECK-NEXT:  pacibsp
+;; CHECK-NEXT: .cfi_negate_ra_state
+
+define internal void @__llvm_gcov_reset() unnamed_addr #2 {
+entry:
+  store i64 0, i64* getelementptr inbounds ([1 x i64], [1 x i64]* @__llvm_gcov_ctr, i64 0, i64 0), align 8
+  ret void
+}
+;; CHECK-LABEL: __llvm_gcov_reset:
+;; CHECK:       pacibsp
+
+declare void @llvm_gcov_init(void ()*, void ()*) local_unnamed_addr
+
+define internal void @__llvm_gcov_init() unnamed_addr #1 {
+entry:
+  tail call void @llvm_gcov_init(void ()* nonnull @__llvm_gcov_writeout, void ()* nonnull @__llvm_gcov_reset)
+  ret void
+}
+;; CHECK-LABEL: __llvm_gcov_init:
+;; CHECK:      .cfi_b_key_frame
+;; CHECK-NEXT:  pacibsp
+;; CHECK-NEXT: .cfi_negate_ra_state
+
+attributes #0 = { norecurse nounwind readnone "sign-return-address"="all" "sign-return-address-key"="b_key" }
+attributes #1 = { noinline }
+attributes #2 = { nofree noinline norecurse nounwind writeonly }
+
+!llvm.module.flags = !{!0, !1, !2, !3, !4, !5}
+
+!0 = !{i32 2, !"Debug Info Version", i32 3}
+!1 = !{i32 1, !"wchar_size", i32 4}
+!2 = !{i32 1, !"branch-target-enforcement", i32 0}
+!3 = !{i32 1, !"sign-return-address", i32 1}
+!4 = !{i32 1, !"sign-return-address-all", i32 1}
+!5 = !{i32 1, !"sign-return-address-with-bkey", i32 1}

llvm/test/CodeGen/AArch64/pacbti-module-attrs.ll

+;; RUN: llc -mtriple=aarch64-eabi -mattr=+v8.5a %s -o - | FileCheck %s
+
+declare i32 @g(i32) #5
+
+define i32 @f0(i32 %x) #0 {
+entry:
+  %call = tail call i32 @g(i32 %x) #5
+  %add = add nsw i32 %call, 1
+  ret i32 %add
+}
+;; CHECK-LABEL: f0:
+;; CHECK-NOT:   bti
+;; CHECK-NOT:   pacia
+;; CHECK-NOT:   reta
+
+define i32 @f1(i32 %x) #1 {
+entry:
+  %call = tail call i32 @g(i32 %x) #5
+  %add = add nsw i32 %call, 1
+  ret i32 %add
+}
+;; CHECK-LABEL: f1:
+;; CHECK:       bti c
+;; CHECK-NOT:   reta
+
+define i32 @f2(i32 %x) #2 {
+entry:
+  %call = tail call i32 @g(i32 %x) #5
+  %add = add nsw i32 %call, 1
+  ret i32 %add
+}
+;; CHECK-LABEL: f2:
+;; CHECK:       paciasp
+;; CHECK:       retaa
+
+define i32 @f3(i32 %x) #3 {
+entry:
+  %call = tail call i32 @g(i32 %x) #5
+  %add = add nsw i32 %call, 1
+  ret i32 %add
+}
+;; CHECK-LABEL: f3:
+;; CHECK:       pacibsp
+;; CHECK:       retab
+
+define i32 @f4(i32 %x) #4 {
+entry:
+  ret i32 1
+}
+;; CHECK-LABEL: f4:
+;; CHECK:       paciasp
+;; CHECK:       retaa
+
+define i32 @f5(i32 %x) #5 {
+entry:
+  %call = tail call i32 @g(i32 %x) #5
+  %add = add nsw i32 %call, 1
+  ret i32 %add
+}
+;; CHECK-LABEL: f5:
+;; CHECK:       paciasp
+;; CHECK:       retaa
+
+attributes #0 = { nounwind "branch-target-enforcement"="false" "sign-return-address"="none" }
+attributes #1 = { nounwind "branch-target-enforcement"="true"  "sign-return-address"="none" }
+attributes #2 = { nounwind "branch-target-enforcement"="false" "sign-return-address"="non-leaf" "sign-return-address-key"="a_key" }
+attributes #3 = { nounwind "branch-target-enforcement"="false" "sign-return-address"="non-leaf" "sign-return-address-key"="b_key" }
+attributes #4 = { nounwind "branch-target-enforcement"="false" "sign-return-address"="all" "sign-return-address-key"="a_key" }
+attributes #5 = { nounwind }
+
+!llvm.module.flags = !{!0, !1, !2, !3, !4}
+
+!0 = !{i32 1, !"wchar_size", i32 4}
+!1 = !{i32 1, !"branch-target-enforcement", i32 1}
+!2 = !{i32 1, !"sign-return-address", i32 1}
+!3 = !{i32 1, !"sign-return-address-all", i32 0}
+!4 = !{i32 1, !"sign-return-address-with-bkey", i32 0}

llvm/test/CodeGen/AArch64/patchable-function-entry-bti.ll

 ; RUN: llc -mtriple=aarch64 %s -o - | FileCheck %s
 
-define void @f0() "patchable-function-entry"="0" "branch-target-enforcement" {
+define void @f0() "patchable-function-entry"="0" "branch-target-enforcement"="true" {
 ; CHECK-LABEL: f0:
 ; CHECK-NEXT: .Lfunc_begin0:
 ; CHECK:      // %bb.0:
 ; CHECK-NEXT:  hint #34
 ; CHECK-NEXT:  ret
 ; CHECK-NOT:  .section __patchable_function_entries
   ret void
 }
 
 ;; -fpatchable-function-entry=1 -mbranch-protection=bti
 ;; For M=0, place the label .Lpatch0 after the initial BTI.
-define void @f1() "patchable-function-entry"="1" "branch-target-enforcement" {
+define void @f1() "patchable-function-entry"="1" "branch-target-enforcement"="true" {
 ; CHECK-LABEL: f1:
 ; CHECK-NEXT: .Lfunc_begin1:
 ; CHECK-NEXT: .cfi_startproc
 ; CHECK-NEXT: // %bb.0:
 ; CHECK-NEXT:  hint #34
 ; CHECK-NEXT: .Lpatch0:
 ; CHECK-NEXT:  nop
 ; CHECK-NEXT:  ret
 ; CHECK:      .section __patchable_function_entries,"awo",@progbits,f1{{$}}
 ; CHECK-NEXT: .p2align 3
 ; CHECK-NEXT: .xword .Lpatch0
   ret void
 }
 
 ;; -fpatchable-function-entry=2,1 -mbranch-protection=bti
-define void @f2_1() "patchable-function-entry"="1" "patchable-function-prefix"="1" "branch-target-enforcement" {
+define void @f2_1() "patchable-function-entry"="1" "patchable-function-prefix"="1" "branch-target-enforcement"="true" {
 ; CHECK-LABEL: .type f2_1,@function
 ; CHECK-NEXT: .Ltmp0:
 ; CHECK-NEXT:  nop
 ; CHECK-NEXT: f2_1:
 ; CHECK-NEXT: .Lfunc_begin2:
 ; CHECK-NEXT: .cfi_startproc
 ; CHECK-NEXT: // %bb.0:
 ; CHECK-NEXT:  hint #34
 ; CHECK-NEXT:  nop
 ; CHECK-NEXT:  ret
 ; CHECK:      .Lfunc_end2:
 ; CHECK-NEXT: .size f2_1, .Lfunc_end2-f2_1
 ; CHECK:      .section __patchable_function_entries,"awo",@progbits,f2_1{{$}}
 ; CHECK-NEXT: .p2align 3
 ; CHECK-NEXT: .xword .Ltmp0
   ret void
 }
 
 ;; -fpatchable-function-entry=1 -mbranch-protection=bti
 ;; For M=0, don't create .Lpatch0 if the initial instruction is not BTI,
 ;; even if other basic blocks may have BTI.
-define internal void @f1i(i64 %v) "patchable-function-entry"="1" "branch-target-enforcement" {
+define internal void @f1i(i64 %v) "patchable-function-entry"="1" "branch-target-enforcement"="true" {
 ; CHECK-LABEL: f1i:
 ; CHECK-NEXT: .Lfunc_begin3:
 ; CHECK:      // %bb.0:
 ; CHECK-NEXT:  nop
 ;; Other basic blocks have BTI, but they don't affect our decision to not create .Lpatch0
 ; CHECK:      .LBB{{.+}} // %sw.bb1
 ; CHECK-NEXT:  hint #36
 ; CHECK:      .section __patchable_function_entries,"awo",@progbits,f1i{{$}}