[BOLT] Rename pac-ret feature flag

- new name is update-branch-protection, which can be extended later to
  include a "strict mode", and to cover BTI rewriting.

Author: bgergely0

bolt/include/bolt/Utils/CommandLineOpts.h

@@ -78,7 +78,7 @@ extern llvm::cl::opt<std::string> OutputFilename;
 extern llvm::cl::opt<std::string> PerfData;
 extern llvm::cl::opt<bool> PrintCacheMetrics;
 extern llvm::cl::opt<bool> PrintSections;
-extern llvm::cl::opt<bool> DisallowPacret;
+extern llvm::cl::opt<bool> UpdateBranchProtection;
 
 // The format to use with -o in aggregation mode (perf2bolt)
 enum ProfileFormatKind { PF_Fdata, PF_YAML };

bolt/lib/Rewrite/BinaryPassManager.cpp

@@ -279,14 +279,11 @@ static cl::opt<bool> ShortenInstructions("shorten-instructions",
                                          cl::init(true),
                                          cl::cat(BoltOptCategory));
 
-// This flag is used to "gate" the negate-ra-state CFI handling.
-// Sometimes, binaries use pac-ret but not contain negate-ra-state CFIs. That
-// should cause no issues for BOLT.
-cl::opt<bool> DisallowPacret(
-    "disallow-pacret",
-    cl::desc("Disable processing binaries containing negate-ra-state DWARF "
-             "CFIs (e.g. binaries using pac-ret hardening)"),
-    cl::cat(BoltOptCategory));
+cl::opt<bool>
+    UpdateBranchProtection("update-branch-protection",
+                           cl::desc("Rewrites pac-ret DWARF CFI instructions "
+                                    "(AArch64-only, on by default)"),
+                           cl::init(true), cl::cat(BoltOptCategory));
 } // namespace opts
 
 namespace llvm {

bolt/lib/Rewrite/RewriteInstance.cpp

@@ -3523,10 +3523,10 @@ void RewriteInstance::disassembleFunctions() {
     // Check if fillCFIInfoFor removed any OpNegateRAState CFIs from the
     // function.
     if (Function.containedNegateRAState()) {
-      if (opts::DisallowPacret) {
-        BC->errs() << "BOLT-ERROR: --disallow-pacret flag was used, but "
-                   << Function.getPrintName()
-                   << " contains .cfi-negate-ra-state.\n";
+      if (!opts::UpdateBranchProtection) {
+        BC->errs()
+            << "BOLT-ERROR: --update-branch-protection is set to false, but "
+            << Function.getPrintName() << " contains .cfi-negate-ra-state.\n";
         exit(1);
       }
     }

bolt/test/AArch64/negate-ra-state-disallow.s

@@ -1,8 +1,8 @@
 # RUN: llvm-mc -filetype=obj -triple aarch64-unknown-unknown %s -o %t.o
 # RUN: %clang %cflags  %t.o -o %t.exe -Wl,-q
-# RUN: not llvm-bolt %t.exe -o %t.exe.bolt --disallow-pacret 2>&1 | FileCheck %s
+# RUN: not llvm-bolt %t.exe -o %t.exe.bolt --update-branch-protection=false 2>&1 | FileCheck %s
 
-# CHECK: BOLT-ERROR: --disallow-pacret flag was used, but foo contains .cfi-negate-ra-state.
+# CHECK: BOLT-ERROR: --update-branch-protection is set to false, but foo contains .cfi-negate-ra-state.
 
   .text
   .globl  foo