diff mbox series

[v4] aarch64,arm: Move branch-protection data to targets

Message ID 20240111143511.445844-1-szabolcs.nagy@arm.com
State New
Headers show
Series [v4] aarch64,arm: Move branch-protection data to targets | expand

Commit Message

Szabolcs Nagy Jan. 11, 2024, 2:35 p.m. UTC
The branch-protection types are target specific, not the same on arm
and aarch64.  This currently affects pac-ret+b-key, but there will be
a new type on aarch64 that is not relevant for arm.

After the move, change aarch_ identifiers to aarch64_ or arm_ as
appropriate.

Refactor aarch_validate_mbranch_protection to take the target specific
branch-protection types as an argument.

In case of invalid input currently no hints are provided: the way
branch-protection types and subtypes can be mixed makes it difficult
without causing confusion.

gcc/ChangeLog:

	* config/aarch64/aarch64.md: Rename aarch_ to aarch64_.
	* config/aarch64/aarch64.opt: Likewise.
	* config/aarch64/aarch64-c.cc (aarch64_update_cpp_builtins): Likewise.
	* config/aarch64/aarch64.cc (aarch64_expand_prologue): Likewise.
	(aarch64_expand_epilogue): Likewise.
	(aarch64_post_cfi_startproc): Likewise.
	(aarch64_handle_no_branch_protection): Copy and rename.
	(aarch64_handle_standard_branch_protection): Likewise.
	(aarch64_handle_pac_ret_protection): Likewise.
	(aarch64_handle_pac_ret_leaf): Likewise.
	(aarch64_handle_pac_ret_b_key): Likewise.
	(aarch64_handle_bti_protection): Likewise.
	(aarch64_override_options): Update branch protection validation.
	(aarch64_handle_attr_branch_protection): Likewise.
	* config/arm/aarch-common-protos.h (aarch_validate_mbranch_protection):
	Pass branch protection type description as argument.
	(struct aarch_branch_protect_type): Move from aarch-common.h.
	* config/arm/aarch-common.cc (aarch_handle_no_branch_protection):
	Remove.
	(aarch_handle_standard_branch_protection): Remove.
	(aarch_handle_pac_ret_protection): Remove.
	(aarch_handle_pac_ret_leaf): Remove.
	(aarch_handle_pac_ret_b_key): Remove.
	(aarch_handle_bti_protection): Remove.
	(aarch_validate_mbranch_protection): Pass branch protection type
	description as argument.
	* config/arm/aarch-common.h (enum aarch_key_type): Remove.
	(struct aarch_branch_protect_type): Remove.
	* config/arm/arm-c.cc (arm_cpu_builtins): Remove aarch_ra_sign_key.
	* config/arm/arm.cc (arm_handle_no_branch_protection): Copy and rename.
	(arm_handle_standard_branch_protection): Likewise.
	(arm_handle_pac_ret_protection): Likewise.
	(arm_handle_pac_ret_leaf): Likewise.
	(arm_handle_bti_protection): Likewise.
	(arm_configure_build_target): Update branch protection validation.
	* config/arm/arm.opt: Remove aarch_ra_sign_key.
---
v4:
- pass types as argument to validation.
- make target specific types data static.

 gcc/config/aarch64/aarch64-c.cc      |  4 +-
 gcc/config/aarch64/aarch64.cc        | 75 ++++++++++++++++++++++++----
 gcc/config/aarch64/aarch64.md        |  2 +-
 gcc/config/aarch64/aarch64.opt       |  2 +-
 gcc/config/arm/aarch-common-protos.h | 19 ++++++-
 gcc/config/arm/aarch-common.cc       | 71 ++++----------------------
 gcc/config/arm/aarch-common.h        | 20 --------
 gcc/config/arm/arm-c.cc              |  2 -
 gcc/config/arm/arm.cc                | 55 +++++++++++++++++---
 gcc/config/arm/arm.opt               |  3 --
 10 files changed, 145 insertions(+), 108 deletions(-)

Comments

Richard Earnshaw (lists) March 1, 2024, 3:53 p.m. UTC | #1
On 11/01/2024 14:35, Szabolcs Nagy wrote:
> The branch-protection types are target specific, not the same on arm
> and aarch64.  This currently affects pac-ret+b-key, but there will be
> a new type on aarch64 that is not relevant for arm.
> 
> After the move, change aarch_ identifiers to aarch64_ or arm_ as
> appropriate.
> 
> Refactor aarch_validate_mbranch_protection to take the target specific
> branch-protection types as an argument.
> 
> In case of invalid input currently no hints are provided: the way
> branch-protection types and subtypes can be mixed makes it difficult
> without causing confusion.
> 
> gcc/ChangeLog:
> 
> 	* config/aarch64/aarch64.md: Rename aarch_ to aarch64_.
> 	* config/aarch64/aarch64.opt: Likewise.
> 	* config/aarch64/aarch64-c.cc (aarch64_update_cpp_builtins): Likewise.
> 	* config/aarch64/aarch64.cc (aarch64_expand_prologue): Likewise.
> 	(aarch64_expand_epilogue): Likewise.
> 	(aarch64_post_cfi_startproc): Likewise.
> 	(aarch64_handle_no_branch_protection): Copy and rename.
> 	(aarch64_handle_standard_branch_protection): Likewise.
> 	(aarch64_handle_pac_ret_protection): Likewise.
> 	(aarch64_handle_pac_ret_leaf): Likewise.
> 	(aarch64_handle_pac_ret_b_key): Likewise.
> 	(aarch64_handle_bti_protection): Likewise.
> 	(aarch64_override_options): Update branch protection validation.
> 	(aarch64_handle_attr_branch_protection): Likewise.
> 	* config/arm/aarch-common-protos.h (aarch_validate_mbranch_protection):
> 	Pass branch protection type description as argument.
> 	(struct aarch_branch_protect_type): Move from aarch-common.h.
> 	* config/arm/aarch-common.cc (aarch_handle_no_branch_protection):
> 	Remove.
> 	(aarch_handle_standard_branch_protection): Remove.
> 	(aarch_handle_pac_ret_protection): Remove.
> 	(aarch_handle_pac_ret_leaf): Remove.
> 	(aarch_handle_pac_ret_b_key): Remove.
> 	(aarch_handle_bti_protection): Remove.
> 	(aarch_validate_mbranch_protection): Pass branch protection type
> 	description as argument.
> 	* config/arm/aarch-common.h (enum aarch_key_type): Remove.
> 	(struct aarch_branch_protect_type): Remove.
> 	* config/arm/arm-c.cc (arm_cpu_builtins): Remove aarch_ra_sign_key.
> 	* config/arm/arm.cc (arm_handle_no_branch_protection): Copy and rename.
> 	(arm_handle_standard_branch_protection): Likewise.
> 	(arm_handle_pac_ret_protection): Likewise.
> 	(arm_handle_pac_ret_leaf): Likewise.
> 	(arm_handle_bti_protection): Likewise.
> 	(arm_configure_build_target): Update branch protection validation.
> 	* config/arm/arm.opt: Remove aarch_ra_sign_key.
> ---
> v4:
> - pass types as argument to validation.
> - make target specific types data static.
> 
>  gcc/config/aarch64/aarch64-c.cc      |  4 +-
>  gcc/config/aarch64/aarch64.cc        | 75 ++++++++++++++++++++++++----
>  gcc/config/aarch64/aarch64.md        |  2 +-
>  gcc/config/aarch64/aarch64.opt       |  2 +-
>  gcc/config/arm/aarch-common-protos.h | 19 ++++++-
>  gcc/config/arm/aarch-common.cc       | 71 ++++----------------------
>  gcc/config/arm/aarch-common.h        | 20 --------
>  gcc/config/arm/arm-c.cc              |  2 -
>  gcc/config/arm/arm.cc                | 55 +++++++++++++++++---
>  gcc/config/arm/arm.opt               |  3 --
>  10 files changed, 145 insertions(+), 108 deletions(-)
> 


OK

R.
diff mbox series

Patch

diff --git a/gcc/config/aarch64/aarch64-c.cc b/gcc/config/aarch64/aarch64-c.cc
index c3bc8c49034..b5a6917d06d 100644
--- a/gcc/config/aarch64/aarch64-c.cc
+++ b/gcc/config/aarch64/aarch64-c.cc
@@ -235,9 +235,9 @@  aarch64_update_cpp_builtins (cpp_reader *pfile)
   if (aarch_ra_sign_scope != AARCH_FUNCTION_NONE)
     {
       int v = 0;
-      if (aarch_ra_sign_key == AARCH_KEY_A)
+      if (aarch64_ra_sign_key == AARCH64_KEY_A)
 	v |= 1;
-      if (aarch_ra_sign_key == AARCH_KEY_B)
+      if (aarch64_ra_sign_key == AARCH64_KEY_B)
 	v |= 2;
       if (aarch_ra_sign_scope == AARCH_FUNCTION_ALL)
 	v |= 4;
diff --git a/gcc/config/aarch64/aarch64.cc b/gcc/config/aarch64/aarch64.cc
index a5a6b52730d..3ae8fc1878f 100644
--- a/gcc/config/aarch64/aarch64.cc
+++ b/gcc/config/aarch64/aarch64.cc
@@ -9478,12 +9478,12 @@  aarch64_expand_prologue (void)
   /* Sign return address for functions.  */
   if (aarch64_return_address_signing_enabled ())
     {
-      switch (aarch_ra_sign_key)
+      switch (aarch64_ra_sign_key)
 	{
-	  case AARCH_KEY_A:
+	  case AARCH64_KEY_A:
 	    insn = emit_insn (gen_paciasp ());
 	    break;
-	  case AARCH_KEY_B:
+	  case AARCH64_KEY_B:
 	    insn = emit_insn (gen_pacibsp ());
 	    break;
 	  default:
@@ -9897,12 +9897,12 @@  aarch64_expand_epilogue (rtx_call_insn *sibcall)
   if (aarch64_return_address_signing_enabled ()
       && (sibcall || !TARGET_ARMV8_3))
     {
-      switch (aarch_ra_sign_key)
+      switch (aarch64_ra_sign_key)
 	{
-	  case AARCH_KEY_A:
+	  case AARCH64_KEY_A:
 	    insn = emit_insn (gen_autiasp ());
 	    break;
-	  case AARCH_KEY_B:
+	  case AARCH64_KEY_B:
 	    insn = emit_insn (gen_autibsp ());
 	    break;
 	  default:
@@ -18609,6 +18609,62 @@  aarch64_set_asm_isa_flags (aarch64_feature_flags flags)
   aarch64_set_asm_isa_flags (&global_options, flags);
 }
 
+static void
+aarch64_handle_no_branch_protection (void)
+{
+  aarch_ra_sign_scope = AARCH_FUNCTION_NONE;
+  aarch_enable_bti = 0;
+}
+
+static void
+aarch64_handle_standard_branch_protection (void)
+{
+  aarch_ra_sign_scope = AARCH_FUNCTION_NON_LEAF;
+  aarch64_ra_sign_key = AARCH64_KEY_A;
+  aarch_enable_bti = 1;
+}
+
+static void
+aarch64_handle_pac_ret_protection (void)
+{
+  aarch_ra_sign_scope = AARCH_FUNCTION_NON_LEAF;
+  aarch64_ra_sign_key = AARCH64_KEY_A;
+}
+
+static void
+aarch64_handle_pac_ret_leaf (void)
+{
+  aarch_ra_sign_scope = AARCH_FUNCTION_ALL;
+}
+
+static void
+aarch64_handle_pac_ret_b_key (void)
+{
+  aarch64_ra_sign_key = AARCH64_KEY_B;
+}
+
+static void
+aarch64_handle_bti_protection (void)
+{
+  aarch_enable_bti = 1;
+}
+
+static const struct aarch_branch_protect_type aarch64_pac_ret_subtypes[] = {
+  { "leaf", false, aarch64_handle_pac_ret_leaf, NULL, 0 },
+  { "b-key", false, aarch64_handle_pac_ret_b_key, NULL, 0 },
+  { NULL, false, NULL, NULL, 0 }
+};
+
+static const struct aarch_branch_protect_type aarch64_branch_protect_types[] =
+{
+  { "none", true, aarch64_handle_no_branch_protection, NULL, 0 },
+  { "standard", true, aarch64_handle_standard_branch_protection, NULL, 0 },
+  { "pac-ret", false, aarch64_handle_pac_ret_protection,
+    aarch64_pac_ret_subtypes, ARRAY_SIZE (aarch64_pac_ret_subtypes) },
+  { "bti", false, aarch64_handle_bti_protection, NULL, 0 },
+  { NULL, false, NULL, NULL, 0 }
+};
+
 /* Implement TARGET_OPTION_OVERRIDE.  This is called once in the beginning
    and is used to parse the -m{cpu,tune,arch} strings and setup the initial
    tuning structs.  In particular it must set selected_tune and
@@ -18631,7 +18687,8 @@  aarch64_override_options (void)
     aarch64_validate_sls_mitigation (aarch64_harden_sls_string);
 
   if (aarch64_branch_protection_string)
-    aarch_validate_mbranch_protection (aarch64_branch_protection_string,
+    aarch_validate_mbranch_protection (aarch64_branch_protect_types,
+				       aarch64_branch_protection_string,
 				       "-mbranch-protection=");
 
   /* -mcpu=CPU is shorthand for -march=ARCH_FOR_CPU, -mtune=CPU.
@@ -19069,7 +19126,7 @@  aarch64_handle_attr_cpu (const char *str)
 static bool
 aarch64_handle_attr_branch_protection (const char* str)
 {
-  return aarch_validate_mbranch_protection (str,
+  return aarch_validate_mbranch_protection (aarch64_branch_protect_types, str,
 					    "target(\"branch-protection=\")");
 }
 
@@ -24282,7 +24339,7 @@  void
 aarch64_post_cfi_startproc (FILE *f, tree ignored ATTRIBUTE_UNUSED)
 {
   if (cfun->machine->frame.laid_out && aarch64_return_address_signing_enabled ()
-      && aarch_ra_sign_key == AARCH_KEY_B)
+      && aarch64_ra_sign_key == AARCH64_KEY_B)
 	asm_fprintf (f, "\t.cfi_b_key_frame\n");
 }
 
diff --git a/gcc/config/aarch64/aarch64.md b/gcc/config/aarch64/aarch64.md
index 6d39d2109e1..15b08ab1981 100644
--- a/gcc/config/aarch64/aarch64.md
+++ b/gcc/config/aarch64/aarch64.md
@@ -1022,7 +1022,7 @@  (define_insn "*do_return"
     if (aarch64_return_address_signing_enabled ()
 	&& (TARGET_PAUTH))
       {
-	if (aarch_ra_sign_key == AARCH_KEY_B)
+	if (aarch64_ra_sign_key == AARCH64_KEY_B)
 	  ret = "retab";
 	else
 	  ret = "retaa";
diff --git a/gcc/config/aarch64/aarch64.opt b/gcc/config/aarch64/aarch64.opt
index ceed5cdb201..6356c419399 100644
--- a/gcc/config/aarch64/aarch64.opt
+++ b/gcc/config/aarch64/aarch64.opt
@@ -40,7 +40,7 @@  TargetVariable
 unsigned aarch_enable_bti = 2
 
 TargetVariable
-enum aarch_key_type aarch_ra_sign_key = AARCH_KEY_A
+enum aarch64_key_type aarch64_ra_sign_key = AARCH64_KEY_A
 
 ; The TLS dialect names to use with -mtls-dialect.
 
diff --git a/gcc/config/arm/aarch-common-protos.h b/gcc/config/arm/aarch-common-protos.h
index 936d03c82ee..9849fcbc098 100644
--- a/gcc/config/arm/aarch-common-protos.h
+++ b/gcc/config/arm/aarch-common-protos.h
@@ -159,7 +159,22 @@  rtx_insn *arm_md_asm_adjust (vec<rtx> &outputs, vec<rtx> & /*inputs*/,
 			     vec<rtx> &clobbers, HARD_REG_SET &clobbered_regs,
 			     location_t loc);
 
-/* Validation routine for branch-protection common to AArch64 and Arm.  */
-bool aarch_validate_mbranch_protection (const char *, const char *);
+/* Specifies a -mbranch-protection= argument.  */
+struct aarch_branch_protect_type
+{
+  /* The type's name that the user passes to the branch-protection option
+     string.  */
+  const char* name;
+  /* The type can only appear alone, other types should be rejected.  */
+  int alone;
+  /* Function to handle the protection type and set global variables.  */
+  void (*handler)(void);
+  /* A list of types that can follow this type in the option string.  */
+  const struct aarch_branch_protect_type* subtypes;
+  unsigned int num_subtypes;
+};
+
+bool aarch_validate_mbranch_protection (
+  const struct aarch_branch_protect_type *, const char *, const char *);
 
 #endif /* GCC_AARCH_COMMON_PROTOS_H */
diff --git a/gcc/config/arm/aarch-common.cc b/gcc/config/arm/aarch-common.cc
index 9bbde936978..aa405af8192 100644
--- a/gcc/config/arm/aarch-common.cc
+++ b/gcc/config/arm/aarch-common.cc
@@ -37,6 +37,7 @@ 
 #include "function.h"
 #include "emit-rtl.h"
 #include "aarch-common.h"
+#include "aarch-common-protos.h"
 
 /* Return TRUE if X is either an arithmetic shift left, or
    is a multiplication by a power of two.  */
@@ -660,61 +661,6 @@  arm_md_asm_adjust (vec<rtx> &outputs, vec<rtx> & /*inputs*/,
   return saw_asm_flag ? seq : NULL;
 }
 
-static void
-aarch_handle_no_branch_protection (void)
-{
-  aarch_ra_sign_scope = AARCH_FUNCTION_NONE;
-  aarch_enable_bti = 0;
-}
-
-static void
-aarch_handle_standard_branch_protection (void)
-{
-  aarch_ra_sign_scope = AARCH_FUNCTION_NON_LEAF;
-  aarch_ra_sign_key = AARCH_KEY_A;
-  aarch_enable_bti = 1;
-}
-
-static void
-aarch_handle_pac_ret_protection (void)
-{
-  aarch_ra_sign_scope = AARCH_FUNCTION_NON_LEAF;
-  aarch_ra_sign_key = AARCH_KEY_A;
-}
-
-static void
-aarch_handle_pac_ret_leaf (void)
-{
-  aarch_ra_sign_scope = AARCH_FUNCTION_ALL;
-}
-
-static void
-aarch_handle_pac_ret_b_key (void)
-{
-  aarch_ra_sign_key = AARCH_KEY_B;
-}
-
-static void
-aarch_handle_bti_protection (void)
-{
-  aarch_enable_bti = 1;
-}
-
-static const struct aarch_branch_protect_type aarch_pac_ret_subtypes[] = {
-  { "leaf", false, aarch_handle_pac_ret_leaf, NULL, 0 },
-  { "b-key", false, aarch_handle_pac_ret_b_key, NULL, 0 },
-  { NULL, false, NULL, NULL, 0 }
-};
-
-static const struct aarch_branch_protect_type aarch_branch_protect_types[] = {
-  { "none", true, aarch_handle_no_branch_protection, NULL, 0 },
-  { "standard", true, aarch_handle_standard_branch_protection, NULL, 0 },
-  { "pac-ret", false, aarch_handle_pac_ret_protection, aarch_pac_ret_subtypes,
-    ARRAY_SIZE (aarch_pac_ret_subtypes) },
-  { "bti", false, aarch_handle_bti_protection, NULL, 0 },
-  { NULL, false, NULL, NULL, 0 }
-};
-
 /* In-place split *str at delim, return *str and set *str to the tail
    of the string or NULL if the end is reached.  */
 
@@ -735,12 +681,15 @@  next_tok (char **str, int delim)
   return tok;
 }
 
-/* Parses CONST_STR for branch protection features specified in
-   aarch64_branch_protect_types, and set any global variables required.
-   Returns true on success.  */
+/* Parses CONST_STR according to branch protection features specified in
+   TYPES.  The first type resets the settings, the last type is marked with
+   name == NULL.  On failure an error message is printed referencing OPT as
+   the source of the options.  Returns true on success.  */
 
 bool
-aarch_validate_mbranch_protection (const char *const_str, const char *opt)
+aarch_validate_mbranch_protection (
+  const struct aarch_branch_protect_type *types, const char *const_str,
+  const char *opt)
 {
   char *str_root = xstrdup (const_str);
   char *next_str = str_root;
@@ -750,11 +699,11 @@  aarch_validate_mbranch_protection (const char *const_str, const char *opt)
   bool res = true;
 
   /* First entry is "none" and it is used to reset the state.  */
-  aarch_branch_protect_types[0].handler ();
+  types->handler ();
 
   while (str)
     {
-      const aarch_branch_protect_type *type = aarch_branch_protect_types;
+      const aarch_branch_protect_type *type = types;
       for (; type->name; type++)
 	if (strcmp (str, type->name) == 0)
 	  break;
diff --git a/gcc/config/arm/aarch-common.h b/gcc/config/arm/aarch-common.h
index 8a1964fdf17..6bfdbdacf16 100644
--- a/gcc/config/arm/aarch-common.h
+++ b/gcc/config/arm/aarch-common.h
@@ -45,24 +45,4 @@  enum aarch_function_type {
   AARCH_FUNCTION_ALL
 };
 
-/* The key type that -msign-return-address should use.  */
-enum aarch_key_type {
-  AARCH_KEY_A,
-  AARCH_KEY_B
-};
-
-struct aarch_branch_protect_type
-{
-  /* The type's name that the user passes to the branch-protection option
-     string.  */
-  const char* name;
-  /* The type can only appear alone, other types should be rejected.  */
-  int alone;
-  /* Function to handle the protection type and set global variables.  */
-  void (*handler)(void);
-  /* A list of types that can follow this type in the option string.  */
-  const struct aarch_branch_protect_type* subtypes;
-  unsigned int num_subtypes;
-};
-
 #endif /* GCC_AARCH_COMMON_H */
diff --git a/gcc/config/arm/arm-c.cc b/gcc/config/arm/arm-c.cc
index 2e181bf7f36..6e10262b067 100644
--- a/gcc/config/arm/arm-c.cc
+++ b/gcc/config/arm/arm-c.cc
@@ -248,8 +248,6 @@  arm_cpu_builtins (struct cpp_reader* pfile)
   {
     unsigned int pac = 1;
 
-    gcc_assert (aarch_ra_sign_key == AARCH_KEY_A);
-
     if (aarch_ra_sign_scope == AARCH_FUNCTION_ALL)
       pac |= 0x4;
 
diff --git a/gcc/config/arm/arm.cc b/gcc/config/arm/arm.cc
index e5a944486d7..1d3410ba2aa 100644
--- a/gcc/config/arm/arm.cc
+++ b/gcc/config/arm/arm.cc
@@ -3259,6 +3259,52 @@  static sbitmap isa_all_fpubits_internal;
 static sbitmap isa_all_fpbits;
 static sbitmap isa_quirkbits;
 
+static void
+arm_handle_no_branch_protection (void)
+{
+  aarch_ra_sign_scope = AARCH_FUNCTION_NONE;
+  aarch_enable_bti = 0;
+}
+
+static void
+arm_handle_standard_branch_protection (void)
+{
+  aarch_ra_sign_scope = AARCH_FUNCTION_NON_LEAF;
+  aarch_enable_bti = 1;
+}
+
+static void
+arm_handle_pac_ret_protection (void)
+{
+  aarch_ra_sign_scope = AARCH_FUNCTION_NON_LEAF;
+}
+
+static void
+arm_handle_pac_ret_leaf (void)
+{
+  aarch_ra_sign_scope = AARCH_FUNCTION_ALL;
+}
+
+static void
+arm_handle_bti_protection (void)
+{
+  aarch_enable_bti = 1;
+}
+
+static const struct aarch_branch_protect_type arm_pac_ret_subtypes[] = {
+  { "leaf", false, arm_handle_pac_ret_leaf, NULL, 0 },
+  { NULL, false, NULL, NULL, 0 }
+};
+
+static const struct aarch_branch_protect_type arm_branch_protect_types[] = {
+  { "none", true, arm_handle_no_branch_protection, NULL, 0 },
+  { "standard", true, arm_handle_standard_branch_protection, NULL, 0 },
+  { "pac-ret", false, arm_handle_pac_ret_protection, arm_pac_ret_subtypes,
+    ARRAY_SIZE (arm_pac_ret_subtypes) },
+  { "bti", false, arm_handle_bti_protection, NULL, 0 },
+  { NULL, false, NULL, NULL, 0 }
+};
+
 /* Configure a build target TARGET from the user-specified options OPTS and
    OPTS_SET.  If WARN_COMPATIBLE, emit a diagnostic if both the CPU and
    architecture have been specified, but the two are not identical.  */
@@ -3306,14 +3352,9 @@  arm_configure_build_target (struct arm_build_target *target,
 
   if (opts->x_arm_branch_protection_string)
     {
-      aarch_validate_mbranch_protection (opts->x_arm_branch_protection_string,
+      aarch_validate_mbranch_protection (arm_branch_protect_types,
+					 opts->x_arm_branch_protection_string,
 					 "-mbranch-protection=");
-
-      if (aarch_ra_sign_key != AARCH_KEY_A)
-	{
-	  warning (0, "invalid key type for %<-mbranch-protection=%>");
-	  aarch_ra_sign_key = AARCH_KEY_A;
-	}
     }
 
   if (arm_selected_arch)
diff --git a/gcc/config/arm/arm.opt b/gcc/config/arm/arm.opt
index e4b29facad3..0cd3fc2cd0c 100644
--- a/gcc/config/arm/arm.opt
+++ b/gcc/config/arm/arm.opt
@@ -30,9 +30,6 @@  enum aarch_function_type aarch_ra_sign_scope = AARCH_FUNCTION_NONE
 TargetVariable
 unsigned aarch_enable_bti = 0
 
-TargetVariable
-enum aarch_key_type aarch_ra_sign_key = AARCH_KEY_A
-
 Enum
 Name(tls_type) Type(enum arm_tls_type)
 TLS dialect to use: