974 lines · plain
1// RUN: %clang %cflags -march=armv9.5-a+pauth-lr -mbranch-protection=pac-ret %s %p/../../Inputs/asm_main.c -o %t.exe2// RUN: llvm-bolt-binary-analysis --scanners=pacret %t.exe 2>&1 | FileCheck %s3 4 .text5 6 .globl f17 .type f1,@function8f1:9 paciasp10 stp x29, x30, [sp, #-16]!11 mov x29, sp12 bl g13 add x0, x0, #314 ldp x29, x30, [sp], #1615 // autiasp16// CHECK-LABEL: GS-PAUTH: non-protected ret found in function f1, basic block {{[0-9a-zA-Z.]+}}, at address17// CHECK-NEXT: The instruction is {{[0-9a-f]+}}: ret18// CHECK-NEXT: The 1 instructions that write to the affected registers after any authentication are:19// CHECK-NEXT: 1. {{[0-9a-f]+}}: ldp x29, x30, [sp], #0x1020// CHECK-NEXT: This happens in the following basic block:21// CHECK-NEXT: {{[0-9a-f]+}}: paciasp22// CHECK-NEXT: {{[0-9a-f]+}}: stp x29, x30, [sp, #-0x10]!23// CHECK-NEXT: {{[0-9a-f]+}}: mov x29, sp24// CHECK-NEXT: {{[0-9a-f]+}}: bl g25// CHECK-NEXT: {{[0-9a-f]+}}: add x0, x0, #0x326// CHECK-NEXT: {{[0-9a-f]+}}: ldp x29, x30, [sp], #0x1027// CHECK-NEXT: {{[0-9a-f]+}}: ret28 ret29 .size f1, .-f130 31 32 .globl f_intermediate_overwrite133 .type f_intermediate_overwrite1,@function34f_intermediate_overwrite1:35 paciasp36 stp x29, x30, [sp, #-16]!37 mov x29, sp38 bl g39 add x0, x0, #340 autiasp41 ldp x29, x30, [sp], #1642// CHECK-LABEL: GS-PAUTH: non-protected ret found in function f_intermediate_overwrite1, basic block {{[0-9a-zA-Z.]+}}43// CHECK-NEXT: The instruction is {{[0-9a-f]+}}: ret44// CHECK-NEXT: The 1 instructions that write to the affected registers after any authentication are:45// CHECK-NEXT: 1. {{[0-9a-f]+}}: ldp x29, x30, [sp], #0x1046// CHECK-NEXT: This happens in the following basic block:47// CHECK-NEXT: {{[0-9a-f]+}}: paciasp48// CHECK-NEXT: {{[0-9a-f]+}}: stp x29, x30, [sp, #-0x10]!49// CHECK-NEXT: {{[0-9a-f]+}}: mov x29, sp50// CHECK-NEXT: {{[0-9a-f]+}}: bl g51// CHECK-NEXT: {{[0-9a-f]+}}: add x0, x0, #0x352// CHECK-NEXT: {{[0-9a-f]+}}: autiasp53// CHECK-NEXT: {{[0-9a-f]+}}: ldp x29, x30, [sp], #0x1054// CHECK-NEXT: {{[0-9a-f]+}}: ret55 ret56 .size f_intermediate_overwrite1, .-f_intermediate_overwrite157 58 .globl f_intermediate_overwrite259 .type f_intermediate_overwrite2,@function60f_intermediate_overwrite2:61 paciasp62 stp x29, x30, [sp, #-16]!63 mov x29, sp64 bl g65 add x0, x0, #366 ldp x29, x30, [sp], #1667 autiasp68 mov x30, x069// CHECK-LABEL: GS-PAUTH: non-protected ret found in function f_intermediate_overwrite2, basic block {{[0-9a-zA-Z.]+}}, at address70// CHECK-NEXT: The instruction is {{[0-9a-f]+}}: ret71// CHECK-NEXT: The 1 instructions that write to the affected registers after any authentication are:72// CHECK-NEXT: 1. {{[0-9a-f]+}}: mov x30, x073// CHECK-NEXT: This happens in the following basic block:74// CHECK-NEXT: {{[0-9a-f]+}}: paciasp75// CHECK-NEXT: {{[0-9a-f]+}}: stp x29, x30, [sp, #-0x10]!76// CHECK-NEXT: {{[0-9a-f]+}}: mov x29, sp77// CHECK-NEXT: {{[0-9a-f]+}}: bl g78// CHECK-NEXT: {{[0-9a-f]+}}: add x0, x0, #0x379// CHECK-NEXT: {{[0-9a-f]+}}: ldp x29, x30, [sp], #0x1080// CHECK-NEXT: {{[0-9a-f]+}}: autiasp81// CHECK-NEXT: {{[0-9a-f]+}}: mov x30, x082// CHECK-NEXT: {{[0-9a-f]+}}: ret83 ret84 .size f_intermediate_overwrite2, .-f_intermediate_overwrite285 86 .globl f_intermediate_read87 .type f_intermediate_read,@function88f_intermediate_read:89 paciasp90 stp x29, x30, [sp, #-16]!91 mov x29, sp92 bl g93 add x0, x0, #394 ldp x29, x30, [sp], #1695 autiasp96 mov x0, x3097// CHECK-NOT: function f_intermediate_read98 ret99 .size f_intermediate_read, .-f_intermediate_read100 101 .globl f_intermediate_overwrite3102 .type f_intermediate_overwrite3,@function103f_intermediate_overwrite3:104 paciasp105 stp x29, x30, [sp, #-16]!106 mov x29, sp107 bl g108 add x0, x0, #3109 ldp x29, x30, [sp], #16110 autiasp111 mov w30, w0112// CHECK-LABEL: GS-PAUTH: non-protected ret found in function f_intermediate_overwrite3, basic block {{[0-9a-zA-Z.]+}}, at address113// CHECK-NEXT: The instruction is {{[0-9a-f]+}}: ret114// CHECK-NEXT: The 1 instructions that write to the affected registers after any authentication are:115// CHECK-NEXT: 1. {{[0-9a-f]+}}: mov w30, w0116// CHECK-NEXT: This happens in the following basic block:117// CHECK-NEXT: {{[0-9a-f]+}}: paciasp118// CHECK-NEXT: {{[0-9a-f]+}}: stp x29, x30, [sp, #-0x10]!119// CHECK-NEXT: {{[0-9a-f]+}}: mov x29, sp120// CHECK-NEXT: {{[0-9a-f]+}}: bl g121// CHECK-NEXT: {{[0-9a-f]+}}: add x0, x0, #0x3122// CHECK-NEXT: {{[0-9a-f]+}}: ldp x29, x30, [sp], #0x10123// CHECK-NEXT: {{[0-9a-f]+}}: autiasp124// CHECK-NEXT: {{[0-9a-f]+}}: mov w30, w0125// CHECK-NEXT: {{[0-9a-f]+}}: ret126 ret127 .size f_intermediate_overwrite3, .-f_intermediate_overwrite3128 129 .globl f_nonx30_ret130 .type f_nonx30_ret,@function131f_nonx30_ret:132 paciasp133 stp x29, x30, [sp, #-16]!134 mov x29, sp135 bl g136 add x0, x0, #3137 ldp x29, x30, [sp], #16138 mov x16, x30139 autiasp140// CHECK-LABEL: GS-PAUTH: non-protected ret found in function f_nonx30_ret, basic block {{[0-9a-zA-Z.]+}}, at address141// CHECK-NEXT: The instruction is {{[0-9a-f]+}}: ret x16142// CHECK-NEXT: The 1 instructions that write to the affected registers after any authentication are:143// CHECK-NEXT: 1. {{[0-9a-f]+}}: mov x16, x30144// CHECK-NEXT: This happens in the following basic block:145// CHECK-NEXT: {{[0-9a-f]+}}: paciasp146// CHECK-NEXT: {{[0-9a-f]+}}: stp x29, x30, [sp, #-0x10]!147// CHECK-NEXT: {{[0-9a-f]+}}: mov x29, sp148// CHECK-NEXT: {{[0-9a-f]+}}: bl g149// CHECK-NEXT: {{[0-9a-f]+}}: add x0, x0, #0x3150// CHECK-NEXT: {{[0-9a-f]+}}: ldp x29, x30, [sp], #0x10151// CHECK-NEXT: {{[0-9a-f]+}}: mov x16, x30152// CHECK-NEXT: {{[0-9a-f]+}}: autiasp153// CHECK-NEXT: {{[0-9a-f]+}}: ret x16154 ret x16155 .size f_nonx30_ret, .-f_nonx30_ret156 157 .globl f_nonx30_ret_ok158 .type f_nonx30_ret_ok,@function159f_nonx30_ret_ok:160 paciasp161 stp x29, x30, [sp, #-16]!162 mov x29, sp163 bl g164 ldp x29, x30, [sp], #16165 autiasp166 mov x16, x30167// CHECK-NOT: function f_nonx30_ret_ok168 ret x16169 .size f_nonx30_ret_ok, .-f_nonx30_ret_ok170 171 .globl f_detect_clobbered_x30_passed_to_other172 .type f_detect_clobbered_x30_passed_to_other,@function173f_detect_clobbered_x30_passed_to_other:174 str x30, [sp]175 ldr x30, [sp]176// FIXME: Ideally, the pac-ret scanner would report on the following instruction, which177// performs a tail call, that x30 might be attacker-controlled.178// CHECK-NOT: function f_detect_clobbered_x30_passed_to_other179 b f_tail_called180 .size f_detect_clobbered_x30_passed_to_other, .-f_detect_clobbered_x30_passed_to_other181 182 .globl f_tail_called183 .type f_tail_called,@function184f_tail_called:185 ret186 .size f_tail_called, .-f_tail_called187 188 .globl f_nonx30_ret_non_auted189 .type f_nonx30_ret_non_auted,@function190f_nonx30_ret_non_auted:191// x1 is neither authenticated nor implicitly considered safe at function entry.192// Note that we assume it's fine for x30 to not be authenticated before193// returning to, as assuming that x30 is not attacker controlled at function194// entry is part (implicitly) of the pac-ret hardening scheme.195//196// CHECK-LABEL: GS-PAUTH: non-protected ret found in function f_nonx30_ret_non_auted, basic block {{[0-9a-zA-Z.]+}}, at address197// CHECK-NEXT: The instruction is {{[0-9a-f]+}}: ret198// CHECK-NEXT: The 0 instructions that write to the affected registers after any authentication are:199 ret x1200 .size f_nonx30_ret_non_auted, .-f_nonx30_ret_non_auted201 202 203 .globl f_callclobbered_x30204 .type f_callclobbered_x30,@function205f_callclobbered_x30:206 bl g207// CHECK-LABEL: GS-PAUTH: non-protected ret found in function f_callclobbered_x30, basic block {{[0-9a-zA-Z.]+}}, at address208// CHECK-NEXT: The instruction is {{[0-9a-f]+}}: ret209// CHECK-NEXT: The 1 instructions that write to the affected registers after any authentication are:210// CHECK-NEXT: 1. {{[0-9a-f]+}}: bl211 ret212 .size f_callclobbered_x30, .-f_callclobbered_x30213 214 .globl f_callclobbered_calleesaved215 .type f_callclobbered_calleesaved,@function216f_callclobbered_calleesaved:217 bl g218// CHECK-LABEL: GS-PAUTH: non-protected ret found in function f_callclobbered_calleesaved, basic block {{[0-9a-zA-Z.]+}}, at address219// CHECK-NEXT: The instruction is {{[0-9a-f]+}}: ret x19220// CHECK-NEXT: The 1 instructions that write to the affected registers after any authentication are:221// CHECK-NEXT: 1. {{[0-9a-f]+}}: bl222 // x19, according to the Arm ABI (AAPCS) is a callee-saved register.223 // Therefore, if function g respects the AAPCS, it should not write224 // anything to x19. However, we can't know whether function g actually225 // does respect the AAPCS rules, so the scanner should assume x19 can226 // get overwritten, and report a gadget if the code does not properly227 // deal with that.228 // Furthermore, there's a good chance that callee-saved registers have229 // been saved on the stack at some point during execution of the callee,230 // and so should be considered as potentially modified by an231 // attacker/written to.232 ret x19233 .size f_callclobbered_calleesaved, .-f_callclobbered_calleesaved234 235 .globl f_unreachable_instruction236 .type f_unreachable_instruction,@function237f_unreachable_instruction:238// CHECK-LABEL: GS-PAUTH: Warning: possibly imprecise CFG, the analysis quality may be degraded in this function. According to BOLT, unreachable code is found in function f_unreachable_instruction, basic block {{[0-9a-zA-Z.]+}}, at address239// CHECK-NEXT: The instruction is {{[0-9a-f]+}}: add x0, x1, x2240// CHECK-NOT: instructions that write to the affected registers after any authentication are:241 b 1f242 add x0, x1, x22431:244 ret245 .size f_unreachable_instruction, .-f_unreachable_instruction246 247// Without CFG, the state is reset at labels, assuming every register that can248// be clobbered in the function was actually clobbered.249 250 .globl lr_untouched_nocfg251 .type lr_untouched_nocfg,@function252lr_untouched_nocfg:253// CHECK-NOT: lr_untouched_nocfg254 adr x2, 1f255 br x22561:257 ret258 .size lr_untouched_nocfg, .-lr_untouched_nocfg259 260 .globl lr_clobbered_nocfg261 .type lr_clobbered_nocfg,@function262lr_clobbered_nocfg:263// CHECK-LABEL: GS-PAUTH: non-protected ret found in function lr_clobbered_nocfg, at address264// CHECK-NEXT: The instruction is {{[0-9a-f]+}}: ret265// CHECK-NEXT: The 0 instructions that write to the affected registers after any authentication are:266 adr x2, 1f267 br x22681:269 b 2f270 bl g // never executed, but affects the expected worst-case scenario2712:272 ret273 .size lr_clobbered_nocfg, .-lr_clobbered_nocfg274 275/// Now do a basic sanity check on every different Authentication instruction:276 277 .globl f_autiasp278 .type f_autiasp,@function279f_autiasp:280 paciasp281 stp x29, x30, [sp, #-16]!282 mov x29, sp283 bl g284 add x0, x0, #3285 ldp x29, x30, [sp], #16286 autiasp287// CHECK-NOT: function f_autiasp288 ret289 .size f_autiasp, .-f_autiasp290 291 .globl f_autibsp292 .type f_autibsp,@function293f_autibsp:294 paciasp295 stp x29, x30, [sp, #-16]!296 mov x29, sp297 bl g298 add x0, x0, #3299 ldp x29, x30, [sp], #16300 autibsp301// CHECK-NOT: function f_autibsp302 ret303 .size f_autibsp, .-f_autibsp304 305 .globl f_autiaz306 .type f_autiaz,@function307f_autiaz:308 paciasp309 stp x29, x30, [sp, #-16]!310 mov x29, sp311 bl g312 add x0, x0, #3313 ldp x29, x30, [sp], #16314 autiaz315// CHECK-NOT: function f_autiaz316 ret317 .size f_autiaz, .-f_autiaz318 319 .globl f_autibz320 .type f_autibz,@function321f_autibz:322 paciasp323 stp x29, x30, [sp, #-16]!324 mov x29, sp325 bl g326 add x0, x0, #3327 ldp x29, x30, [sp], #16328 autibz329// CHECK-NOT: function f_autibz330 ret331 .size f_autibz, .-f_autibz332 333 .globl f_autia1716334 .type f_autia1716,@function335f_autia1716:336 paciasp337 stp x29, x30, [sp, #-16]!338 mov x29, sp339 bl g340 add x0, x0, #3341 ldp x29, x30, [sp], #16342 autia1716343// CHECK-LABEL: GS-PAUTH: non-protected ret found in function f_autia1716, basic block {{[0-9a-zA-Z.]+}}, at address344// CHECK-NEXT: The instruction is {{[0-9a-f]+}}: ret345// CHECK-NEXT: The 1 instructions that write to the affected registers after any authentication are:346// CHECK-NEXT: 1. {{[0-9a-f]+}}: ldp x29, x30, [sp], #0x10347// CHECK-NEXT: This happens in the following basic block:348// CHECK-NEXT: {{[0-9a-f]+}}: paciasp349// CHECK-NEXT: {{[0-9a-f]+}}: stp x29, x30, [sp, #-0x10]!350// CHECK-NEXT: {{[0-9a-f]+}}: mov x29, sp351// CHECK-NEXT: {{[0-9a-f]+}}: bl g352// CHECK-NEXT: {{[0-9a-f]+}}: add x0, x0, #0x3353// CHECK-NEXT: {{[0-9a-f]+}}: ldp x29, x30, [sp], #0x10354// CHECK-NEXT: {{[0-9a-f]+}}: autia1716355// CHECK-NEXT: {{[0-9a-f]+}}: ret356 ret357 .size f_autia1716, .-f_autia1716358 359 .globl f_autib1716360 .type f_autib1716,@function361f_autib1716:362 paciasp363 stp x29, x30, [sp, #-16]!364 mov x29, sp365 bl g366 add x0, x0, #3367 ldp x29, x30, [sp], #16368 autib1716369// CHECK-LABEL: GS-PAUTH: non-protected ret found in function f_autib1716, basic block {{[0-9a-zA-Z.]+}}, at address370// CHECK-NEXT: The instruction is {{[0-9a-f]+}}: ret371// CHECK-NEXT: The 1 instructions that write to the affected registers after any authentication are:372// CHECK-NEXT: 1. {{[0-9a-f]+}}: ldp x29, x30, [sp], #0x10373// CHECK-NEXT: This happens in the following basic block:374// CHECK-NEXT: {{[0-9a-f]+}}: paciasp375// CHECK-NEXT: {{[0-9a-f]+}}: stp x29, x30, [sp, #-0x10]!376// CHECK-NEXT: {{[0-9a-f]+}}: mov x29, sp377// CHECK-NEXT: {{[0-9a-f]+}}: bl g378// CHECK-NEXT: {{[0-9a-f]+}}: add x0, x0, #0x3379// CHECK-NEXT: {{[0-9a-f]+}}: ldp x29, x30, [sp], #0x10380// CHECK-NEXT: {{[0-9a-f]+}}: autib1716381// CHECK-NEXT: {{[0-9a-f]+}}: ret382 ret383 .size f_autib1716, .-f_autib1716384 385 .globl f_autiax12386 .type f_autiax12,@function387f_autiax12:388 paciasp389 stp x29, x30, [sp, #-16]!390 mov x29, sp391 bl g392 add x0, x0, #3393 ldp x29, x30, [sp], #16394 autia x12, sp395// CHECK-LABEL: GS-PAUTH: non-protected ret found in function f_autiax12, basic block {{[0-9a-zA-Z.]+}}, at address396// CHECK-NEXT: The instruction is {{[0-9a-f]+}}: ret397// CHECK-NEXT: The 1 instructions that write to the affected registers after any authentication are:398// CHECK-NEXT: 1. {{[0-9a-f]+}}: ldp x29, x30, [sp], #0x10399// CHECK-NEXT: This happens in the following basic block:400// CHECK-NEXT: {{[0-9a-f]+}}: paciasp401// CHECK-NEXT: {{[0-9a-f]+}}: stp x29, x30, [sp, #-0x10]!402// CHECK-NEXT: {{[0-9a-f]+}}: mov x29, sp403// CHECK-NEXT: {{[0-9a-f]+}}: bl g404// CHECK-NEXT: {{[0-9a-f]+}}: add x0, x0, #0x3405// CHECK-NEXT: {{[0-9a-f]+}}: ldp x29, x30, [sp], #0x10406// CHECK-NEXT: {{[0-9a-f]+}}: autia x12, sp407// CHECK-NEXT: {{[0-9a-f]+}}: ret408 ret409 .size f_autiax12, .-f_autiax12410 411 .globl f_autibx12412 .type f_autibx12,@function413f_autibx12:414 paciasp415 stp x29, x30, [sp, #-16]!416 mov x29, sp417 bl g418 add x0, x0, #3419 ldp x29, x30, [sp], #16420 autib x12, sp421// CHECK-LABEL: GS-PAUTH: non-protected ret found in function f_autibx12, basic block {{[0-9a-zA-Z.]+}}, at address422// CHECK-NEXT: The instruction is {{[0-9a-f]+}}: ret423// CHECK-NEXT: The 1 instructions that write to the affected registers after any authentication are:424// CHECK-NEXT: 1. {{[0-9a-f]+}}: ldp x29, x30, [sp], #0x10425// CHECK-NEXT: This happens in the following basic block:426// CHECK-NEXT: {{[0-9a-f]+}}: paciasp427// CHECK-NEXT: {{[0-9a-f]+}}: stp x29, x30, [sp, #-0x10]!428// CHECK-NEXT: {{[0-9a-f]+}}: mov x29, sp429// CHECK-NEXT: {{[0-9a-f]+}}: bl g430// CHECK-NEXT: {{[0-9a-f]+}}: add x0, x0, #0x3431// CHECK-NEXT: {{[0-9a-f]+}}: ldp x29, x30, [sp], #0x10432// CHECK-NEXT: {{[0-9a-f]+}}: autib x12, sp433// CHECK-NEXT: {{[0-9a-f]+}}: ret434 ret435 .size f_autibx12, .-f_autibx12436 437 .globl f_autiax30438 .type f_autiax30,@function439f_autiax30:440 paciasp441 stp x29, x30, [sp, #-16]!442 mov x29, sp443 bl g444 add x0, x0, #3445 ldp x29, x30, [sp], #16446 autia x30, sp447// CHECK-NOT: function f_autiax30448 ret449 .size f_autiax30, .-f_autiax30450 451 .globl f_autibx30452 .type f_autibx30,@function453f_autibx30:454 paciasp455 stp x29, x30, [sp, #-16]!456 mov x29, sp457 bl g458 add x0, x0, #3459 ldp x29, x30, [sp], #16460 autib x30, sp461// CHECK-NOT: function f_autibx30462 ret463 .size f_autibx30, .-f_autibx30464 465 466 .globl f_autdax12467 .type f_autdax12,@function468f_autdax12:469 paciasp470 stp x29, x30, [sp, #-16]!471 mov x29, sp472 bl g473 add x0, x0, #3474 ldp x29, x30, [sp], #16475 autda x12, sp476// CHECK-LABEL: GS-PAUTH: non-protected ret found in function f_autdax12, basic block {{[0-9a-zA-Z.]+}}, at address477// CHECK-NEXT: The instruction is {{[0-9a-f]+}}: ret478// CHECK-NEXT: The 1 instructions that write to the affected registers after any authentication are:479// CHECK-NEXT: 1. {{[0-9a-f]+}}: ldp x29, x30, [sp], #0x10480// CHECK-NEXT: This happens in the following basic block:481// CHECK-NEXT: {{[0-9a-f]+}}: paciasp482// CHECK-NEXT: {{[0-9a-f]+}}: stp x29, x30, [sp, #-0x10]!483// CHECK-NEXT: {{[0-9a-f]+}}: mov x29, sp484// CHECK-NEXT: {{[0-9a-f]+}}: bl g485// CHECK-NEXT: {{[0-9a-f]+}}: add x0, x0, #0x3486// CHECK-NEXT: {{[0-9a-f]+}}: ldp x29, x30, [sp], #0x10487// CHECK-NEXT: {{[0-9a-f]+}}: autda x12, sp488// CHECK-NEXT: {{[0-9a-f]+}}: ret489 ret490 .size f_autdax12, .-f_autdax12491 492 .globl f_autdbx12493 .type f_autdbx12,@function494f_autdbx12:495 paciasp496 stp x29, x30, [sp, #-16]!497 mov x29, sp498 bl g499 add x0, x0, #3500 ldp x29, x30, [sp], #16501 autdb x12, sp502// CHECK-LABEL: GS-PAUTH: non-protected ret found in function f_autdbx12, basic block {{[0-9a-zA-Z.]+}}, at address503// CHECK-NEXT: The instruction is {{[0-9a-f]+}}: ret504// CHECK-NEXT: The 1 instructions that write to the affected registers after any authentication are:505// CHECK-NEXT: 1. {{[0-9a-f]+}}: ldp x29, x30, [sp], #0x10506// CHECK-NEXT: This happens in the following basic block:507// CHECK-NEXT: {{[0-9a-f]+}}: paciasp508// CHECK-NEXT: {{[0-9a-f]+}}: stp x29, x30, [sp, #-0x10]!509// CHECK-NEXT: {{[0-9a-f]+}}: mov x29, sp510// CHECK-NEXT: {{[0-9a-f]+}}: bl g511// CHECK-NEXT: {{[0-9a-f]+}}: add x0, x0, #0x3512// CHECK-NEXT: {{[0-9a-f]+}}: ldp x29, x30, [sp], #0x10513// CHECK-NEXT: {{[0-9a-f]+}}: autdb x12, sp514// CHECK-NEXT: {{[0-9a-f]+}}: ret515 ret516 .size f_autdbx12, .-f_autdbx12517 518 .globl f_autdax30519 .type f_autdax30,@function520f_autdax30:521 paciasp522 stp x29, x30, [sp, #-16]!523 mov x29, sp524 bl g525 add x0, x0, #3526 ldp x29, x30, [sp], #16527 autda x30, sp528// CHECK-NOT: function f_autdax30529 ret530 .size f_autdax30, .-f_autdax30531 532 .globl f_autdbx30533 .type f_autdbx30,@function534f_autdbx30:535 paciasp536 stp x29, x30, [sp, #-16]!537 mov x29, sp538 bl g539 add x0, x0, #3540 ldp x29, x30, [sp], #16541 autdb x30, sp542// CHECK-NOT: function f_autdbx30543 ret544 .size f_autdbx30, .-f_autdbx30545 546 547 .globl f_autizax12548 .type f_autizax12,@function549f_autizax12:550 paciasp551 stp x29, x30, [sp, #-16]!552 mov x29, sp553 bl g554 add x0, x0, #3555 ldp x29, x30, [sp], #16556 autiza x12557// CHECK-LABEL: GS-PAUTH: non-protected ret found in function f_autizax12, basic block {{[0-9a-zA-Z.]+}}, at address558// CHECK-NEXT: The instruction is {{[0-9a-f]+}}: ret559// CHECK-NEXT: The 1 instructions that write to the affected registers after any authentication are:560// CHECK-NEXT: 1. {{[0-9a-f]+}}: ldp x29, x30, [sp], #0x10561// CHECK-NEXT: This happens in the following basic block:562// CHECK-NEXT: {{[0-9a-f]+}}: paciasp563// CHECK-NEXT: {{[0-9a-f]+}}: stp x29, x30, [sp, #-0x10]!564// CHECK-NEXT: {{[0-9a-f]+}}: mov x29, sp565// CHECK-NEXT: {{[0-9a-f]+}}: bl g566// CHECK-NEXT: {{[0-9a-f]+}}: add x0, x0, #0x3567// CHECK-NEXT: {{[0-9a-f]+}}: ldp x29, x30, [sp], #0x10568// CHECK-NEXT: {{[0-9a-f]+}}: autiza x12569// CHECK-NEXT: {{[0-9a-f]+}}: ret570 ret571 .size f_autizax12, .-f_autizax12572 573 .globl f_autizbx12574 .type f_autizbx12,@function575f_autizbx12:576 paciasp577 stp x29, x30, [sp, #-16]!578 mov x29, sp579 bl g580 add x0, x0, #3581 ldp x29, x30, [sp], #16582 autizb x12583// CHECK-LABEL: GS-PAUTH: non-protected ret found in function f_autizbx12, basic block {{[0-9a-zA-Z.]+}}, at address584// CHECK-NEXT: The instruction is {{[0-9a-f]+}}: ret585// CHECK-NEXT: The 1 instructions that write to the affected registers after any authentication are:586// CHECK-NEXT: 1. {{[0-9a-f]+}}: ldp x29, x30, [sp], #0x10587// CHECK-NEXT: This happens in the following basic block:588// CHECK-NEXT: {{[0-9a-f]+}}: paciasp589// CHECK-NEXT: {{[0-9a-f]+}}: stp x29, x30, [sp, #-0x10]!590// CHECK-NEXT: {{[0-9a-f]+}}: mov x29, sp591// CHECK-NEXT: {{[0-9a-f]+}}: bl g592// CHECK-NEXT: {{[0-9a-f]+}}: add x0, x0, #0x3593// CHECK-NEXT: {{[0-9a-f]+}}: ldp x29, x30, [sp], #0x10594// CHECK-NEXT: {{[0-9a-f]+}}: autizb x12595// CHECK-NEXT: {{[0-9a-f]+}}: ret596 ret597 .size f_autizbx12, .-f_autizbx12598 599 .globl f_autizax30600 .type f_autizax30,@function601f_autizax30:602 paciasp603 stp x29, x30, [sp, #-16]!604 mov x29, sp605 bl g606 add x0, x0, #3607 ldp x29, x30, [sp], #16608 autiza x30609// CHECK-NOT: function f_autizax30610 ret611 .size f_autizax30, .-f_autizax30612 613 .globl f_autizbx30614 .type f_autizbx30,@function615f_autizbx30:616 paciasp617 stp x29, x30, [sp, #-16]!618 mov x29, sp619 bl g620 add x0, x0, #3621 ldp x29, x30, [sp], #16622 autizb x30623// CHECK-NOT: function f_autizbx30624 ret625 .size f_autizbx30, .-f_autizbx30626 627 628 .globl f_autdzax12629 .type f_autdzax12,@function630f_autdzax12:631 paciasp632 stp x29, x30, [sp, #-16]!633 mov x29, sp634 bl g635 add x0, x0, #3636 ldp x29, x30, [sp], #16637 autdza x12638// CHECK-LABEL: GS-PAUTH: non-protected ret found in function f_autdzax12, basic block {{[0-9a-zA-Z.]+}}, at address639// CHECK-NEXT: The instruction is {{[0-9a-f]+}}: ret640// CHECK-NEXT: The 1 instructions that write to the affected registers after any authentication are:641// CHECK-NEXT: 1. {{[0-9a-f]+}}: ldp x29, x30, [sp], #0x10642// CHECK-NEXT: This happens in the following basic block:643// CHECK-NEXT: {{[0-9a-f]+}}: paciasp644// CHECK-NEXT: {{[0-9a-f]+}}: stp x29, x30, [sp, #-0x10]!645// CHECK-NEXT: {{[0-9a-f]+}}: mov x29, sp646// CHECK-NEXT: {{[0-9a-f]+}}: bl g647// CHECK-NEXT: {{[0-9a-f]+}}: add x0, x0, #0x3648// CHECK-NEXT: {{[0-9a-f]+}}: ldp x29, x30, [sp], #0x10649// CHECK-NEXT: {{[0-9a-f]+}}: autdza x12650// CHECK-NEXT: {{[0-9a-f]+}}: ret651 ret652 .size f_autdzax12, .-f_autdzax12653 654 .globl f_autdzbx12655 .type f_autdzbx12,@function656f_autdzbx12:657 paciasp658 stp x29, x30, [sp, #-16]!659 mov x29, sp660 bl g661 add x0, x0, #3662 ldp x29, x30, [sp], #16663 autdzb x12664// CHECK-LABEL: GS-PAUTH: non-protected ret found in function f_autdzbx12, basic block {{[0-9a-zA-Z.]+}}, at address665// CHECK-NEXT: The instruction is {{[0-9a-f]+}}: ret666// CHECK-NEXT: The 1 instructions that write to the affected registers after any authentication are:667// CHECK-NEXT: 1. {{[0-9a-f]+}}: ldp x29, x30, [sp], #0x10668// CHECK-NEXT: This happens in the following basic block:669// CHECK-NEXT: {{[0-9a-f]+}}: paciasp670// CHECK-NEXT: {{[0-9a-f]+}}: stp x29, x30, [sp, #-0x10]!671// CHECK-NEXT: {{[0-9a-f]+}}: mov x29, sp672// CHECK-NEXT: {{[0-9a-f]+}}: bl g673// CHECK-NEXT: {{[0-9a-f]+}}: add x0, x0, #0x3674// CHECK-NEXT: {{[0-9a-f]+}}: ldp x29, x30, [sp], #0x10675// CHECK-NEXT: {{[0-9a-f]+}}: autdzb x12676// CHECK-NEXT: {{[0-9a-f]+}}: ret677 ret678 .size f_autdzbx12, .-f_autdzbx12679 680 .globl f_autdzax30681 .type f_autdzax30,@function682f_autdzax30:683 paciasp684 stp x29, x30, [sp, #-16]!685 mov x29, sp686 bl g687 add x0, x0, #3688 ldp x29, x30, [sp], #16689 autdza x30690// CHECK-NOT: function f_autdzax30691 ret692 .size f_autdzax30, .-f_autdzax30693 694 .globl f_autdzbx30695 .type f_autdzbx30,@function696f_autdzbx30:697 paciasp698 stp x29, x30, [sp, #-16]!699 mov x29, sp700 bl g701 add x0, x0, #3702 ldp x29, x30, [sp], #16703 autdzb x30704// CHECK-NOT: function f_autdzbx30705 ret706 .size f_autdzbx30, .-f_autdzbx30707 708 .globl f_retaa709 .type f_retaa,@function710f_retaa:711 paciasp712 stp x29, x30, [sp, #-16]!713 mov x29, sp714 bl g715 add x0, x0, #3716 ldp x29, x30, [sp], #16717// CHECK-NOT: function f_retaa718 retaa719 .size f_retaa, .-f_retaa720 721 .globl f_retab722 .type f_retab,@function723f_retab:724 paciasp725 stp x29, x30, [sp, #-16]!726 mov x29, sp727 bl g728 add x0, x0, #3729 ldp x29, x30, [sp], #16730// CHECK-NOT: function f_retab731 retab732 .size f_retab, .-f_retab733 734 .globl f_eretaa735 .type f_eretaa,@function736f_eretaa:737 paciasp738 stp x29, x30, [sp, #-16]!739 mov x29, sp740 bl g741 add x0, x0, #3742 ldp x29, x30, [sp], #16743// CHECK-LABEL: GS-PAUTH: Warning: pac-ret analysis could not analyze this return instruction in function f_eretaa, basic block {{[0-9a-zA-Z.]+}}, at address744// CHECK-NEXT: The instruction is {{[0-9a-f]+}}: eretaa745 eretaa746 .size f_eretaa, .-f_eretaa747 748 .globl f_eretab749 .type f_eretab,@function750f_eretab:751 paciasp752 stp x29, x30, [sp, #-16]!753 mov x29, sp754 bl g755 add x0, x0, #3756 ldp x29, x30, [sp], #16757// CHECK-LABEL: GS-PAUTH: Warning: pac-ret analysis could not analyze this return instruction in function f_eretab, basic block {{[0-9a-zA-Z.]+}}, at address758// CHECK-NEXT: The instruction is {{[0-9a-f]+}}: eretab759 eretab760 .size f_eretab, .-f_eretab761 762 .globl f_eret763 .type f_eret,@function764f_eret:765 paciasp766 stp x29, x30, [sp, #-16]!767 mov x29, sp768 bl g769 add x0, x0, #3770 ldp x29, x30, [sp], #16771// CHECK-LABEL: GS-PAUTH: Warning: pac-ret analysis could not analyze this return instruction in function f_eret, basic block {{[0-9a-zA-Z.]+}}, at address772// CHECK-NEXT: The instruction is {{[0-9a-f]+}}: eret773 eret774 .size f_eret, .-f_eret775 776 .globl f_movx30reg777 .type f_movx30reg,@function778f_movx30reg:779// CHECK-LABEL: GS-PAUTH: non-protected ret found in function f_movx30reg, basic block {{[0-9a-zA-Z.]+}}, at address780// CHECK-NEXT: The instruction is {{[0-9a-f]+}}: ret781// CHECK-NEXT: The 1 instructions that write to the affected registers after any authentication are:782// CHECK-NEXT: 1. {{[0-9a-f]+}}: mov x30, x22783// CHECK-NEXT: This happens in the following basic block:784// CHECK-NEXT: {{[0-9a-f]+}}: mov x30, x22785// CHECK-NEXT: {{[0-9a-f]+}}: ret786 mov x30, x22787 ret788 .size f_movx30reg, .-f_movx30reg789 790 .globl f_autiasppci791 .type f_autiasppci,@function792f_autiasppci:7930:794 pacnbiasppc795 paciasp796 stp x29, x30, [sp, #-16]!797 mov x29, sp798 bl g799 add x0, x0, #3800 ldp x29, x30, [sp], #16801 autiasppc 0b802// CHECK-NOT: function f_autiasppci803 ret804 .size f_autiasppci, .-f_autiasppci805 806 .globl f_autibsppci807 .type f_autibsppci,@function808f_autibsppci:8090:810 pacnbibsppc811 paciasp812 stp x29, x30, [sp, #-16]!813 mov x29, sp814 bl g815 add x0, x0, #3816 ldp x29, x30, [sp], #16817 autibsppc 0b818// CHECK-NOT: function f_autibsppci819 ret820 .size f_autibsppci, .-f_autibsppci821 822 .globl f_autiasppcr823 .type f_autiasppcr,@function824 825f_autiasppcr:8260:827 pacnbiasppc828 paciasp829 stp x29, x30, [sp, #-16]!830 mov x29, sp831 bl g832 add x0, x0, #3833 ldp x29, x30, [sp], #16834 adr x28, 0b835 autiasppcr x28836// CHECK-NOT: function f_autiasppcr837 ret838 .size f_autiasppcr, .-f_autiasppcr839 840f_autibsppcr:8410:842 pacnbibsppc843 paciasp844 stp x29, x30, [sp, #-16]!845 mov x29, sp846 bl g847 add x0, x0, #3848 ldp x29, x30, [sp], #16849 adr x28, 0b850 autibsppcr x28851// CHECK-NOT: function f_autibsppcr852 ret853 .size f_autibsppcr, .-f_autibsppcr854 855 .globl f_retaasppci856 .type f_retaasppci,@function857f_retaasppci:8580:859 pacnbiasppc860 paciasp861 stp x29, x30, [sp, #-16]!862 mov x29, sp863 bl g864 add x0, x0, #3865 ldp x29, x30, [sp], #16866// CHECK-NOT: function f_retaasppci867 retaasppc 0b868 .size f_retaasppci, .-f_retaasppci869 870 .globl f_retabsppci871 .type f_retabsppci,@function872f_retabsppci:8730:874 pacnbibsppc875 paciasp876 stp x29, x30, [sp, #-16]!877 mov x29, sp878 bl g879 add x0, x0, #3880 ldp x29, x30, [sp], #16881// CHECK-NOT: function f_retabsppci882 retabsppc 0b883 .size f_retabsppci, .-f_retabsppci884 885 .globl f_retaasppcr886 .type f_retaasppcr,@function887 888f_retaasppcr:8890:890 pacnbiasppc891 paciasp892 stp x29, x30, [sp, #-16]!893 mov x29, sp894 bl g895 add x0, x0, #3896 ldp x29, x30, [sp], #16897 adr x28, 0b898// CHECK-NOT: function f_retaasppcr899 retaasppcr x28900 .size f_retaasppcr, .-f_retaasppcr901 902f_retabsppcr:9030:904 pacnbibsppc905 paciasp906 stp x29, x30, [sp, #-16]!907 mov x29, sp908 bl g909 add x0, x0, #3910 ldp x29, x30, [sp], #16911 adr x28, 0b912// CHECK-NOT: function f_retabsppcr913 retabsppcr x28914 .size f_retabsppcr, .-f_retabsppcr915 916 .globl f_autia171615917 .type f_autia171615,@function918f_autia171615:919 paciasp920 stp x29, x30, [sp, #-16]!921 mov x29, sp922 bl g923 add x0, x0, #3924 ldp x29, x30, [sp], #16925 autia171615926// CHECK-LABEL: GS-PAUTH: non-protected ret found in function f_autia171615, basic block {{[0-9a-zA-Z.]+}}, at address927// CHECK-NEXT: The instruction is {{[0-9a-f]+}}: ret928// CHECK-NEXT: The 1 instructions that write to the affected registers after any authentication are:929// CHECK-NEXT: 1. {{[0-9a-f]+}}: ldp x29, x30, [sp], #0x10930// CHECK-NEXT: This happens in the following basic block:931// CHECK-NEXT: {{[0-9a-f]+}}: paciasp932// CHECK-NEXT: {{[0-9a-f]+}}: stp x29, x30, [sp, #-0x10]!933// CHECK-NEXT: {{[0-9a-f]+}}: mov x29, sp934// CHECK-NEXT: {{[0-9a-f]+}}: bl g935// CHECK-NEXT: {{[0-9a-f]+}}: add x0, x0, #0x3936// CHECK-NEXT: {{[0-9a-f]+}}: ldp x29, x30, [sp], #0x10937// CHECK-NEXT: {{[0-9a-f]+}}: autia171615938// CHECK-NEXT: {{[0-9a-f]+}}: ret939 ret940 .size f_autia171615, .-f_autia171615941 942 .globl f_autib171615943 .type f_autib171615,@function944f_autib171615:945 paciasp946 stp x29, x30, [sp, #-16]!947 mov x29, sp948 bl g949 add x0, x0, #3950 ldp x29, x30, [sp], #16951 autib171615952// CHECK-LABEL: GS-PAUTH: non-protected ret found in function f_autib171615, basic block {{[0-9a-zA-Z.]+}}, at address953// CHECK-NEXT: The instruction is {{[0-9a-f]+}}: ret954// CHECK-NEXT: The 1 instructions that write to the affected registers after any authentication are:955// CHECK-NEXT: 1. {{[0-9a-f]+}}: ldp x29, x30, [sp], #0x10956// CHECK-NEXT: This happens in the following basic block:957// CHECK-NEXT: {{[0-9a-f]+}}: paciasp958// CHECK-NEXT: {{[0-9a-f]+}}: stp x29, x30, [sp, #-0x10]!959// CHECK-NEXT: {{[0-9a-f]+}}: mov x29, sp960// CHECK-NEXT: {{[0-9a-f]+}}: bl g961// CHECK-NEXT: {{[0-9a-f]+}}: add x0, x0, #0x3962// CHECK-NEXT: {{[0-9a-f]+}}: ldp x29, x30, [sp], #0x10963// CHECK-NEXT: {{[0-9a-f]+}}: autib171615964// CHECK-NEXT: {{[0-9a-f]+}}: ret965 ret966 .size f_autib171615, .-f_autib171615967 968 .globl g969 .type g,@function970g:971 nop972 ret973 .size g, .-g974