[BFD, LD, AArch64, 3/3] Add --pac-plt to enable PLTs protected with PAC.

This is part of the patch series to add support for BTI and
PAC in AArch64 linker.

1) This patch adds new definitions of PAC enabled PLTs
and both BTI and PAC enabled PLTs.
2) It also defines the new dynamic tag DT_AARCH64_PAC_PLT
for the PAC enabled PLTs.
3) This patch adds a new ld command line option: --pac-plt.
In the presence of this option, the linker uses the PAC
enabled PLTs and marks with DT_AARCH64_PAC_PLT.
4) In case both BTI and PAC are enabled the linker should
pick PLTs enabled with both and also use dynamic tags for both.
All these are made according to the new AArch64 ELF ABI
https://developer.arm.com/docs/ihi0056/latest/elf-for-the-arm-64-bit-architecture-aarch64-abi-2018q4

*** bfd/ChangeLog ***

2019-03-13  Sudakshina Das  <sudi.das@arm.com>

	* elfnn-aarch64.c (PLT_PAC_ENTRY_SIZE, PLT_PAC_SMALL_ENTRY_SIZE): New.
	(PLT_BTI_PAC_ENTRY_SIZE, PLT_BTI_PAC_SMALL_ENTRY_SIZE): New.
	(setup_plt_values): Account for PAC or PAC and BTI enabled PLTs.
	(elfNN_aarch64_size_dynamic_sections): Add checks for PLT_BTI_PAC
	and PLT_PAC_PLT.
	(elfNN_aarch64_finish_dynamic_sections): Account for PLT_BTI_PAC.
	(get_plt_type): Add case for DT_AARCH64_PAC_PLT.
	(elfNN_aarch64_plt_sym_val): Add cases for PLT_BTI_PAC and PLT_PAC.

*** binutils/ChangeLog ***

2019-03-13  Sudakshina Das  <sudi.das@arm.com>

	* readelf.c (get_aarch64_dynamic_type): Add case for
	DT_AARCH64_PAC_PLT.
	(dynamic_section_aarch64_val): Likewise.

*** include/ChangeLog ***

2019-03-13  Sudakshina Das  <sudi.das@arm.com>

	* elf/aarch64.h (DT_AARCH64_PAC_PLT): New.

*** ld/ChangeLog ***

2019-03-13  Sudakshina Das  <sudi.das@arm.com>

	* NEWS: Document --pac-plt.
	* emultempl/aarch64elf.em (OPTION_PAC_PLT): New.
	(PARSE_AND_LIST_LONGOPTS, PARSE_AND_LIST_OPTIONS): Add pac-plt.
	(PARSE_AND_LIST_ARGS_CASES): Handle OPTION_PAC_PLT.
	* testsuite/ld-aarch64/aarch64-elf.exp: Add the following tests.
	* testsuite/ld-aarch64/bti-pac-plt-1.d: New test.
	* testsuite/ld-aarch64/bti-pac-plt-2.d: New test.
	* testsuite/ld-aarch64/pac-plt-1.d: New test.
	* testsuite/ld-aarch64/pac-plt-2.d: New test.
	* testsuite/ld-aarch64/bti-plt-1.s: Add .ifndef directive.

15 files changed, 314 insertions, 6 deletions

diff --git a/bfd/ChangeLog b/bfd/ChangeLog
index 6e7748e..540f737 100644
--- a/bfd/ChangeLog
+++ b/bfd/ChangeLog
@@ -1,4 +1,15 @@
 2019-03-13  Sudakshina Das  <sudi.das@arm.com>
+
+	* elfnn-aarch64.c (PLT_PAC_ENTRY_SIZE, PLT_PAC_SMALL_ENTRY_SIZE): New.
+	(PLT_BTI_PAC_ENTRY_SIZE, PLT_BTI_PAC_SMALL_ENTRY_SIZE): New.
+	(setup_plt_values): Account for PAC or PAC and BTI enabled PLTs.
+	(elfNN_aarch64_size_dynamic_sections): Add checks for PLT_BTI_PAC
+	and PLT_PAC_PLT.
+	(elfNN_aarch64_finish_dynamic_sections): Account for PLT_BTI_PAC.
+	(get_plt_type): Add case for DT_AARCH64_PAC_PLT.
+	(elfNN_aarch64_plt_sym_val): Add cases for PLT_BTI_PAC and PLT_PAC.
+
+2019-03-13  Sudakshina Das  <sudi.das@arm.com>
 	    Szabolcs Nagy  <szabolcs.nagy@arm.com>
 
 	* bfd-in.h (aarch64_plt_type, aarch64_enable_bti_type): New.
diff --git a/bfd/elfnn-aarch64.c b/bfd/elfnn-aarch64.c
index 69b8f83..50541f0 100644
--- a/bfd/elfnn-aarch64.c
+++ b/bfd/elfnn-aarch64.c
@@ -271,6 +271,12 @@
 #define PLT_BTI_ENTRY_SIZE		(36)
 #define PLT_BTI_SMALL_ENTRY_SIZE	(20)
 #define PLT_BTI_TLSDESC_ENTRY_SIZE	(36)
+/* PLT sizes with PAC insn.  */
+#define PLT_PAC_ENTRY_SIZE		(36)
+#define PLT_PAC_SMALL_ENTRY_SIZE	(20)
+/* PLT sizes with BTI and PAC insn.  */
+#define PLT_BTI_PAC_ENTRY_SIZE		(40)
+#define PLT_BTI_PAC_SMALL_ENTRY_SIZE	(24)
 
 /* Encoding of the nop instruction.  */
 #define INSN_NOP 0xd503201f
@@ -319,6 +325,44 @@ static const bfd_byte elfNN_aarch64_small_plt0_bti_entry[PLT_BTI_ENTRY_SIZE] =
   0x1f, 0x20, 0x03, 0xd5,	/* nop */
 };
 
+static const bfd_byte elfNN_aarch64_small_plt0_pac_entry[PLT_PAC_ENTRY_SIZE] =
+{
+  0xf0, 0x7b, 0xbf, 0xa9,	/* stp x16, x30, [sp, #-16]!  */
+  0x10, 0x00, 0x00, 0x90,	/* adrp x16, (GOT+16)  */
+#if ARCH_SIZE == 64
+  0x11, 0x0A, 0x40, 0xf9,	/* ldr x17, [x16, #PLT_GOT+0x10]  */
+  0x10, 0x42, 0x00, 0x91,	/* add x16, x16,#PLT_GOT+0x10   */
+#else
+  0x11, 0x0A, 0x40, 0xb9,	/* ldr w17, [x16, #PLT_GOT+0x8]  */
+  0x10, 0x22, 0x00, 0x11,	/* add w16, w16,#PLT_GOT+0x8   */
+#endif
+  0x9f, 0x21, 0x03, 0xd5,	/* autia1716 */
+  0x20, 0x02, 0x1f, 0xd6,	/* br x17  */
+  0x1f, 0x20, 0x03, 0xd5,	/* nop */
+  0x1f, 0x20, 0x03, 0xd5,	/* nop */
+  0x1f, 0x20, 0x03, 0xd5,	/* nop */
+};
+
+static const bfd_byte
+elfNN_aarch64_small_plt0_bti_pac_entry[PLT_BTI_PAC_ENTRY_SIZE] =
+{
+  0x5f, 0x24, 0x03, 0xd5,	/* bti c.  */
+  0xf0, 0x7b, 0xbf, 0xa9,	/* stp x16, x30, [sp, #-16]!  */
+  0x10, 0x00, 0x00, 0x90,	/* adrp x16, (GOT+16)  */
+#if ARCH_SIZE == 64
+  0x11, 0x0A, 0x40, 0xf9,	/* ldr x17, [x16, #PLT_GOT+0x10]  */
+  0x10, 0x42, 0x00, 0x91,	/* add x16, x16,#PLT_GOT+0x10   */
+#else
+  0x11, 0x0A, 0x40, 0xb9,	/* ldr w17, [x16, #PLT_GOT+0x8]  */
+  0x10, 0x22, 0x00, 0x11,	/* add w16, w16,#PLT_GOT+0x8   */
+#endif
+  0x9f, 0x21, 0x03, 0xd5,	/* autia1716 */
+  0x20, 0x02, 0x1f, 0xd6,	/* br x17  */
+  0x1f, 0x20, 0x03, 0xd5,	/* nop */
+  0x1f, 0x20, 0x03, 0xd5,	/* nop */
+  0x1f, 0x20, 0x03, 0xd5,	/* nop */
+};
+
 /* Per function entry in a procedure linkage table looks like this
    if the distance between the PLTGOT and the PLT is < 4GB use
    these PLT entries.  Use BTI versions of the PLTs when enabled.  */
@@ -351,6 +395,37 @@ elfNN_aarch64_small_plt_bti_entry[PLT_BTI_SMALL_ENTRY_SIZE] =
 };
 
 static const bfd_byte
+elfNN_aarch64_small_plt_pac_entry[PLT_PAC_SMALL_ENTRY_SIZE] =
+{
+  0x10, 0x00, 0x00, 0x90,	/* adrp x16, PLTGOT + n * 8  */
+#if ARCH_SIZE == 64
+  0x11, 0x02, 0x40, 0xf9,	/* ldr x17, [x16, PLTGOT + n * 8] */
+  0x10, 0x02, 0x00, 0x91,	/* add x16, x16, :lo12:PLTGOT + n * 8  */
+#else
+  0x11, 0x02, 0x40, 0xb9,	/* ldr w17, [x16, PLTGOT + n * 4] */
+  0x10, 0x02, 0x00, 0x11,	/* add w16, w16, :lo12:PLTGOT + n * 4  */
+#endif
+  0x9f, 0x21, 0x03, 0xd5,	/* autia1716 */
+  0x20, 0x02, 0x1f, 0xd6,	/* br x17.  */
+};
+
+static const bfd_byte
+elfNN_aarch64_small_plt_bti_pac_entry[PLT_BTI_PAC_SMALL_ENTRY_SIZE] =
+{
+  0x5f, 0x24, 0x03, 0xd5,	/* bti c.  */
+  0x10, 0x00, 0x00, 0x90,	/* adrp x16, PLTGOT + n * 8  */
+#if ARCH_SIZE == 64
+  0x11, 0x02, 0x40, 0xf9,	/* ldr x17, [x16, PLTGOT + n * 8] */
+  0x10, 0x02, 0x00, 0x91,	/* add x16, x16, :lo12:PLTGOT + n * 8  */
+#else
+  0x11, 0x02, 0x40, 0xb9,	/* ldr w17, [x16, PLTGOT + n * 4] */
+  0x10, 0x02, 0x00, 0x11,	/* add w16, w16, :lo12:PLTGOT + n * 4  */
+#endif
+  0x9f, 0x21, 0x03, 0xd5,	/* autia1716 */
+  0x20, 0x02, 0x1f, 0xd6,	/* br x17.  */
+};
+
+static const bfd_byte
 elfNN_aarch64_tlsdesc_small_plt_entry[PLT_TLSDESC_ENTRY_SIZE] =
 {
   0xe2, 0x0f, 0xbf, 0xa9,	/* stp x2, x3, [sp, #-16]! */
@@ -4681,7 +4756,25 @@ setup_plt_values (struct bfd_link_info *link_info,
   struct elf_aarch64_link_hash_table *globals;
   globals = elf_aarch64_hash_table (link_info);
 
-  if (plt_type == PLT_BTI)
+  if (plt_type == PLT_BTI_PAC)
+    {
+      globals->plt_header_size = PLT_BTI_PAC_ENTRY_SIZE;
+      globals->plt0_entry = elfNN_aarch64_small_plt0_bti_pac_entry;
+      globals->tlsdesc_plt_entry_size = PLT_BTI_TLSDESC_ENTRY_SIZE;
+
+      /* Only in ET_EXEC we need PLTn with BTI.  */
+      if (bfd_link_pde (link_info))
+	{
+	  globals->plt_entry_size = PLT_BTI_PAC_SMALL_ENTRY_SIZE;
+	  globals->plt_entry = elfNN_aarch64_small_plt_bti_pac_entry;
+	}
+      else
+	{
+	  globals->plt_entry_size = PLT_PAC_SMALL_ENTRY_SIZE;
+	  globals->plt_entry = elfNN_aarch64_small_plt_pac_entry;
+	}
+    }
+  else if (plt_type == PLT_BTI)
     {
       globals->plt_header_size = PLT_BTI_ENTRY_SIZE;
       globals->plt0_entry = elfNN_aarch64_small_plt0_bti_entry;
@@ -4694,6 +4787,14 @@ setup_plt_values (struct bfd_link_info *link_info,
 	  globals->plt_entry = elfNN_aarch64_small_plt_bti_entry;
 	}
     }
+  else if (plt_type == PLT_PAC)
+    {
+      globals->plt_header_size = PLT_PAC_ENTRY_SIZE;
+      globals->plt0_entry = elfNN_aarch64_small_plt0_pac_entry;
+      globals->tlsdesc_plt_entry_size = PLT_TLSDESC_ENTRY_SIZE;
+      globals->plt_entry_size = PLT_PAC_SMALL_ENTRY_SIZE;
+      globals->plt_entry = elfNN_aarch64_small_plt_pac_entry;
+    }
 }
 
 /* Set option values needed during linking.  */
@@ -9077,8 +9178,17 @@ elfNN_aarch64_size_dynamic_sections (bfd *output_bfd ATTRIBUTE_UNUSED,
 		  || !add_dynamic_entry (DT_TLSDESC_GOT, 0)))
 	    return FALSE;
 
-	  if ((elf_aarch64_tdata (output_bfd)->plt_type == PLT_BTI)
-	      && !add_dynamic_entry (DT_AARCH64_BTI_PLT, 0))
+	  if ((elf_aarch64_tdata (output_bfd)->plt_type == PLT_BTI_PAC)
+	      && (!add_dynamic_entry (DT_AARCH64_BTI_PLT, 0)
+		  || !add_dynamic_entry (DT_AARCH64_PAC_PLT, 0)))
+	    return FALSE;
+
+	  else if ((elf_aarch64_tdata (output_bfd)->plt_type == PLT_BTI)
+		   && !add_dynamic_entry (DT_AARCH64_BTI_PLT, 0))
+	    return FALSE;
+
+	  else if ((elf_aarch64_tdata (output_bfd)->plt_type == PLT_PAC)
+		   && !add_dynamic_entry (DT_AARCH64_PAC_PLT, 0))
 	    return FALSE;
 	}
 
@@ -9604,7 +9714,7 @@ elfNN_aarch64_finish_dynamic_sections (bfd *output_bfd,
 	  htab->tlsdesc_plt_entry_size = PLT_TLSDESC_ENTRY_SIZE;
 
 	  aarch64_plt_type type = elf_aarch64_tdata (output_bfd)->plt_type;
-	  if (type == PLT_BTI)
+	  if (type == PLT_BTI || type == PLT_BTI_PAC)
 	    {
 	      entry = elfNN_aarch64_tlsdesc_small_plt_bti_entry;
 	      htab->tlsdesc_plt_entry_size = PLT_BTI_TLSDESC_ENTRY_SIZE;
@@ -9744,7 +9854,11 @@ get_plt_type (bfd *abfd)
       switch (tag)
 	{
 	case DT_AARCH64_BTI_PLT:
-	  ret = PLT_BTI;
+	  ret |= PLT_BTI;
+	  break;
+
+	case DT_AARCH64_PAC_PLT:
+	  ret |= PLT_PAC;
 	  break;
 
 	default: break;
@@ -9777,12 +9891,26 @@ elfNN_aarch64_plt_sym_val (bfd_vma i, const asection *plt,
   size_t plt0_size = PLT_ENTRY_SIZE;
   size_t pltn_size = PLT_SMALL_ENTRY_SIZE;
 
-  if (elf_aarch64_tdata (plt->owner)->plt_type == PLT_BTI)
+  if (elf_aarch64_tdata (plt->owner)->plt_type == PLT_BTI_PAC)
+    {
+      plt0_size = PLT_BTI_PAC_ENTRY_SIZE;
+      if (elf_elfheader (plt->owner)->e_type == ET_EXEC)
+	pltn_size = PLT_BTI_PAC_SMALL_ENTRY_SIZE;
+      else
+	pltn_size = PLT_PAC_SMALL_ENTRY_SIZE;
+    }
+  else if (elf_aarch64_tdata (plt->owner)->plt_type == PLT_BTI)
     {
       plt0_size = PLT_BTI_ENTRY_SIZE;
       if (elf_elfheader (plt->owner)->e_type == ET_EXEC)
 	pltn_size = PLT_BTI_SMALL_ENTRY_SIZE;
     }
+  else if (elf_aarch64_tdata (plt->owner)->plt_type == PLT_PAC)
+    {
+      plt0_size = PLT_PAC_ENTRY_SIZE;
+      pltn_size = PLT_PAC_SMALL_ENTRY_SIZE;
+    }
+
   return plt->vma + plt0_size + i * pltn_size;
 }
 
diff --git a/binutils/ChangeLog b/binutils/ChangeLog
index b2adf16..95ea555 100644
--- a/binutils/ChangeLog
+++ b/binutils/ChangeLog
@@ -1,4 +1,10 @@
 2019-03-13  Sudakshina Das  <sudi.das@arm.com>
+
+	* readelf.c (get_aarch64_dynamic_type): Add case for
+	DT_AARCH64_PAC_PLT.
+	(dynamic_section_aarch64_val): Likewise.
+
+2019-03-13  Sudakshina Das  <sudi.das@arm.com>
 	    Szabolcs Nagy  <szabolcs.nagy@arm.com>
 
 	* readelf.c (get_aarch64_dynamic_type): New.
diff --git a/binutils/readelf.c b/binutils/readelf.c
index f4775b4..5a9d9ff 100644
--- a/binutils/readelf.c
+++ b/binutils/readelf.c
@@ -1803,6 +1803,7 @@ get_aarch64_dynamic_type (unsigned long type)
   switch (type)
     {
     case DT_AARCH64_BTI_PLT:  return "AARCH64_BTI_PLT";
+    case DT_AARCH64_PAC_PLT:  return "AARCH64_PAC_PLT";
     default:
       return NULL;
     }
@@ -9364,6 +9365,7 @@ dynamic_section_aarch64_val (Elf_Internal_Dyn * entry)
   switch (entry->d_tag)
     {
     case DT_AARCH64_BTI_PLT:
+    case DT_AARCH64_PAC_PLT:
       break;
     default:
       print_vma (entry->d_un.d_ptr, PREFIX_HEX);
diff --git a/include/ChangeLog b/include/ChangeLog
index d67f80f..b4a0907 100644
--- a/include/ChangeLog
+++ b/include/ChangeLog
@@ -1,4 +1,8 @@
 2019-03-13  Sudakshina Das  <sudi.das@arm.com>
+
+	* elf/aarch64.h (DT_AARCH64_PAC_PLT): New.
+
+2019-03-13  Sudakshina Das  <sudi.das@arm.com>
 	    Szabolcs Nagy  <szabolcs.nagy@arm.com>
 
 	* elf/aarch64.h (DT_AARCH64_BTI_PLT): New.
diff --git a/include/elf/aarch64.h b/include/elf/aarch64.h
index b86a100..4466547 100644
--- a/include/elf/aarch64.h
+++ b/include/elf/aarch64.h
@@ -37,6 +37,7 @@
 						in the input to a link step.  */
 /* Processor specific dynamic array tags.  */
 #define DT_AARCH64_BTI_PLT	(DT_LOPROC + 1)
+#define DT_AARCH64_PAC_PLT	(DT_LOPROC + 3)
 
 /* Relocation types.  */
 
diff --git a/ld/ChangeLog b/ld/ChangeLog
index 151877d..d37865b 100644
--- a/ld/ChangeLog
+++ b/ld/ChangeLog
@@ -1,4 +1,17 @@
 2019-03-13  Sudakshina Das  <sudi.das@arm.com>
+
+	* NEWS: Document --pac-plt.
+	* emultempl/aarch64elf.em (OPTION_PAC_PLT): New.
+	(PARSE_AND_LIST_LONGOPTS, PARSE_AND_LIST_OPTIONS): Add pac-plt.
+	(PARSE_AND_LIST_ARGS_CASES): Handle OPTION_PAC_PLT.
+	* testsuite/ld-aarch64/aarch64-elf.exp: Add the following tests.
+	* testsuite/ld-aarch64/bti-pac-plt-1.d: New test.
+	* testsuite/ld-aarch64/bti-pac-plt-2.d: New test.
+	* testsuite/ld-aarch64/pac-plt-1.d: New test.
+	* testsuite/ld-aarch64/pac-plt-2.d: New test.
+	* testsuite/ld-aarch64/bti-plt-1.s: Add .ifndef directive.
+
+2019-03-13  Sudakshina Das  <sudi.das@arm.com>
 	    Szabolcs Nagy  <szabolcs.nagy@arm.com>
 
 	* NEWS: Document --force-bti.
diff --git a/ld/NEWS b/ld/NEWS
index ed8dfc5..597845a 100644
--- a/ld/NEWS
+++ b/ld/NEWS
@@ -14,6 +14,8 @@ Changes in 2.33:
   on output while warning about missing GNU_PROPERTY_AARCH64_FEATURE_1_BTI
   on inputs and use PLTs protected with BTI.
 
+* Add --pac-plt for AArch64 to pick PAC enabled PLTs.
+
 Changes in 2.32:
 
 * Report property change in linker map file when merging GNU properties.
diff --git a/ld/emultempl/aarch64elf.em b/ld/emultempl/aarch64elf.em
index 02243d9..bfe8d1b 100644
--- a/ld/emultempl/aarch64elf.em
+++ b/ld/emultempl/aarch64elf.em
@@ -373,6 +373,7 @@ PARSE_AND_LIST_PROLOGUE='
 #define OPTION_FIX_ERRATUM_843419	314
 #define OPTION_NO_APPLY_DYNAMIC_RELOCS	315
 #define OPTION_FORCE_BTI		316
+#define OPTION_PAC_PLT			317
 '
 
 PARSE_AND_LIST_SHORTOPTS=p
@@ -387,6 +388,7 @@ PARSE_AND_LIST_LONGOPTS='
   { "fix-cortex-a53-843419", no_argument, NULL, OPTION_FIX_ERRATUM_843419},
   { "no-apply-dynamic-relocs", no_argument, NULL, OPTION_NO_APPLY_DYNAMIC_RELOCS},
   { "force-bti", no_argument, NULL, OPTION_FORCE_BTI},
+  { "pac-plt", no_argument, NULL, OPTION_PAC_PLT},
 '
 
 PARSE_AND_LIST_OPTIONS='
@@ -408,6 +410,7 @@ PARSE_AND_LIST_OPTIONS='
   fprintf (file, _("  --fix-cortex-a53-843419      Fix erratum 843419\n"));
   fprintf (file, _("  --no-apply-dynamic-relocs    Do not apply link-time values for dynamic relocations\n"));
   fprintf (file, _("  --force-bti                  Turn on Branch Target Identification mechanism and generate PLTs with BTI. Generate warnings for missing BTI on inputs\n"));
+  fprintf (file, _("  --pac-plt                    Protect PLTs with Pointer Authentication.\n"));
 '
 
 PARSE_AND_LIST_ARGS_CASES='
@@ -444,6 +447,10 @@ PARSE_AND_LIST_ARGS_CASES='
       bti_type = BTI_WARN;
       break;
 
+    case OPTION_PAC_PLT:
+      plt_type |= PLT_PAC;
+      break;
+
     case OPTION_STUBGROUP_SIZE:
       {
 	const char *end;
diff --git a/ld/testsuite/ld-aarch64/aarch64-elf.exp b/ld/testsuite/ld-aarch64/aarch64-elf.exp
index 906534b..12c2d97 100644
--- a/ld/testsuite/ld-aarch64/aarch64-elf.exp
+++ b/ld/testsuite/ld-aarch64/aarch64-elf.exp
@@ -402,3 +402,8 @@ run_dump_test "bti-plt-4"
 run_dump_test "bti-plt-5"
 run_dump_test "bti-plt-6"
 run_dump_test "bti-plt-7"
+
+run_dump_test "pac-plt-1"
+run_dump_test "pac-plt-2"
+run_dump_test "bti-pac-plt-1"
+run_dump_test "bti-pac-plt-2"
diff --git a/ld/testsuite/ld-aarch64/bti-pac-plt-1.d b/ld/testsuite/ld-aarch64/bti-pac-plt-1.d
new file mode 100644
index 0000000..8d780ca
--- /dev/null
+++ b/ld/testsuite/ld-aarch64/bti-pac-plt-1.d
@@ -0,0 +1,34 @@
+#source: bti-plt-1.s
+#as: -mabi=lp64
+#ld: -shared --force-bti --pac-plt -T bti-plt.ld
+#objdump: -dr -j .plt
+
+[^:]*: *file format elf64-.*aarch64
+
+Disassembly of section \.plt:
+
+[0-9a-f]+ <.*>:
+.*:	d503245f 	bti	c
+.*:	a9bf7bf0 	stp	x16, x30, \[sp, #-16\]!
+.*:	90000090 	adrp	x16, 28000 <_GLOBAL_OFFSET_TABLE_>
+.*:	f9400e11 	ldr	x17, \[x16, #24\]
+.*:	91006210 	add	x16, x16, #0x18
+.*:	d503219f 	autia1716
+.*:	d61f0220 	br	x17
+.*:	d503201f 	nop
+.*:	d503201f 	nop
+.*:	d503201f 	nop
+
+[0-9a-f]+ <.*>:
+.*:	90000090 	adrp	x16, 28000 <_GLOBAL_OFFSET_TABLE_>
+.*:	f9401211 	ldr	x17, \[x16, #32\]
+.*:	91008210 	add	x16, x16, #0x20
+.*:	d503219f 	autia1716
+.*:	d61f0220 	br	x17
+
+[0-9a-f]+ <.*>:
+.*:	90000090 	adrp	x16, 28000 <_GLOBAL_OFFSET_TABLE_>
+.*:	f9401611 	ldr	x17, \[x16, #40\]
+.*:	9100a210 	add	x16, x16, #0x28
+.*:	d503219f 	autia1716
+.*:	d61f0220 	br	x17
diff --git a/ld/testsuite/ld-aarch64/bti-pac-plt-2.d b/ld/testsuite/ld-aarch64/bti-pac-plt-2.d
new file mode 100644
index 0000000..d1264ea
--- /dev/null
+++ b/ld/testsuite/ld-aarch64/bti-pac-plt-2.d
@@ -0,0 +1,36 @@
+#source: bti-plt-1.s
+#as: -mabi=lp64
+#ld: --force-bti --pac-plt -e _start -T bti-plt.ld -L./tmpdir -lbti-plt-so
+#objdump: -dr -j .plt
+
+[^:]*: *file format elf64-.*aarch64
+
+Disassembly of section \.plt:
+
+[0-9]+ <.*>:
+.*:	d503245f 	bti	c
+.*:	a9bf7bf0 	stp	x16, x30, \[sp, #-16\]!
+.*:	90000090 	adrp	x16, 28000 <_GLOBAL_OFFSET_TABLE_>
+.*:	f9400e11 	ldr	x17, \[x16, #24\]
+.*:	91006210 	add	x16, x16, #0x18
+.*:	d503219f 	autia1716
+.*:	d61f0220 	br	x17
+.*:	d503201f 	nop
+.*:	d503201f 	nop
+.*:	d503201f 	nop
+
+[0-9]+ <.*>:
+.*:	d503245f 	bti	c
+.*:	90000090 	adrp	x16, 28000 <_GLOBAL_OFFSET_TABLE_>
+.*:	f9401211 	ldr	x17, \[x16, #32\]
+.*:	91008210 	add	x16, x16, #0x20
+.*:	d503219f 	autia1716
+.*:	d61f0220 	br	x17
+
+[0-9]+ <.*>:
+.*:	d503245f 	bti	c
+.*:	90000090 	adrp	x16, 28000 <_GLOBAL_OFFSET_TABLE_>
+.*:	f9401611 	ldr	x17, \[x16, #40\]
+.*:	9100a210 	add	x16, x16, #0x28
+.*:	d503219f 	autia1716
+.*:	d61f0220 	br	x17
diff --git a/ld/testsuite/ld-aarch64/bti-plt-1.s b/ld/testsuite/ld-aarch64/bti-plt-1.s
index 78e1aaa..b798ca4 100644
--- a/ld/testsuite/ld-aarch64/bti-plt-1.s
+++ b/ld/testsuite/ld-aarch64/bti-plt-1.s
@@ -4,6 +4,7 @@
 _start:
 	bl foo
 	bl bar
+.ifndef __guard_property_bti__
 	.section ".note.gnu.property", "a"
 	.p2align 3
 	.long 1f - 0f		/* name length */
@@ -19,3 +20,4 @@ _start:
 4:
 	.p2align 3
 5:
+.endif
diff --git a/ld/testsuite/ld-aarch64/pac-plt-1.d b/ld/testsuite/ld-aarch64/pac-plt-1.d
new file mode 100644
index 0000000..47be949
--- /dev/null
+++ b/ld/testsuite/ld-aarch64/pac-plt-1.d
@@ -0,0 +1,33 @@
+#source: bti-plt-1.s
+#as: -mabi=lp64 --defsym __guard_property_bti__=1
+#ld: -shared --pac-plt -T bti-plt.ld
+#objdump: -dr -j .plt
+
+[^:]*: *file format elf64-.*aarch64
+
+Disassembly of section \.plt:
+
+[0-9]+ <.*>:
+.*:	a9bf7bf0 	stp	x16, x30, \[sp, #-16\]!
+.*:	90000090 	adrp	x16, 28000 <_GLOBAL_OFFSET_TABLE_>
+.*:	f9400e11 	ldr	x17, \[x16, #24\]
+.*:	91006210 	add	x16, x16, #0x18
+.*:	d503219f 	autia1716
+.*:	d61f0220 	br	x17
+.*:	d503201f 	nop
+.*:	d503201f 	nop
+.*:	d503201f 	nop
+
+[0-9]+ <.*>:
+.*:	90000090 	adrp	x16, 28000 <_GLOBAL_OFFSET_TABLE_>
+.*:	f9401211 	ldr	x17, \[x16, #32\]
+.*:	91008210 	add	x16, x16, #0x20
+.*:	d503219f 	autia1716
+.*:	d61f0220 	br	x17
+
+[0-9]+ <.*>:
+.*:	90000090 	adrp	x16, 28000 <_GLOBAL_OFFSET_TABLE_>
+.*:	f9401611 	ldr	x17, \[x16, #40\]
+.*:	9100a210 	add	x16, x16, #0x28
+.*:	d503219f 	autia1716
+.*:	d61f0220 	br	x17
diff --git a/ld/testsuite/ld-aarch64/pac-plt-2.d b/ld/testsuite/ld-aarch64/pac-plt-2.d
new file mode 100644
index 0000000..42bfdca
--- /dev/null
+++ b/ld/testsuite/ld-aarch64/pac-plt-2.d
@@ -0,0 +1,24 @@
+#source: tls-desc-ie.s
+#ld: -shared --pac-plt -T bti-plt.ld
+#objdump: -dr -j .plt
+#...
+Disassembly of section .plt:
+
+0000000000018000 \<.plt\>:
+.*:	a9bf7bf0 	stp	x16, x30, \[sp, #-16\]!
+.*:	90000090 	adrp	x16, 28000 <_GLOBAL_OFFSET_TABLE_>
+.*:	f9401a11 	ldr	x17, \[x16, #48\]
+.*:	9100c210 	add	x16, x16, #0x30
+.*:	d503219f 	autia1716
+.*:	d61f0220 	br	x17
+.*:	d503201f 	nop
+.*:	d503201f 	nop
+.*:	d503201f 	nop
+
+
+0000000000018024 \<__tls_get_addr@plt\>:
+.*:	90000090 	adrp	x16, 28000 <_GLOBAL_OFFSET_TABLE_>
+.*:	f9401e11 	ldr	x17, \[x16, #56\]
+.*:	9100e210 	add	x16, x16, #0x38
+.*:	d503219f 	autia1716
+.*:	d61f0220 	br	x17