75 lines · plain
1// RUN: %clang %cflags -march=armv8.3-a -mbranch-protection=pac-ret %s %p/../../Inputs/asm_main.c -o %t.exe2// RUN: llvm-bolt-binary-analysis --scanners=pacret %t.exe 2>&1 | FileCheck %s3 4 5// Verify that we can also detect gadgets across basic blocks6 7 .globl f_crossbb18 .type f_crossbb1,@function9f_crossbb1:10 paciasp11 stp x29, x30, [sp, #-16]!12 ldp x29, x30, [sp], #1613 cbnz x0, 1f14 autiasp151:16 ret17 .size f_crossbb1, .-f_crossbb118// CHECK-LABEL: GS-PAUTH: non-protected ret found in function f_crossbb1, basic block {{[^,]+}}, at address19// CHECK-NEXT: The instruction is {{[0-9a-f]+}}: ret20// CHECK-NEXT: The 1 instructions that write to the affected registers after any authentication are:21// CHECK-NEXT: 1. {{[0-9a-f]+}}: ldp x29, x30, [sp], #0x1022 23// A test that checks that the dataflow state tracking across when merging BBs24// seems to work:25 .globl f_mergebb126 .type f_mergebb1,@function27f_mergebb1:28 paciasp292:30 stp x29, x30, [sp, #-16]!31 ldp x29, x30, [sp], #1632 sub x0, x0, #133 cbnz x0, 1f34 autiasp35 b 2b361:37 ret38 .size f_mergebb1, .-f_mergebb139// CHECK-LABEL: GS-PAUTH: non-protected ret found in function f_mergebb1, basic block {{[^,]+}}, at address40// CHECK-NEXT: The instruction is {{[0-9a-f]+}}: ret41// CHECK-NEXT: The 1 instructions that write to the affected registers after any authentication are:42// CHECK-NEXT: 1. {{[0-9a-f]+}}: ldp x29, x30, [sp], #0x1043 44 .globl f_shrinkwrapping45 .type f_shrinkwrapping,@function46f_shrinkwrapping:47 cbz x0, 1f48 paciasp49 stp x29, x30, [sp, #-16]!50 ldp x29, x30, [sp], #1651 autiasp521:53 ret54 .size f_shrinkwrapping, .-f_shrinkwrapping55// CHECK-NOT: f_shrinkwrapping56 57 .globl f_multi_auth_insts58 .type f_multi_auth_insts,@function59f_multi_auth_insts:60 paciasp61 stp x29, x30, [sp, #-16]!62 ldp x29, x30, [sp], #1663 cbnz x0, 1f64 autibsp65 b 2f661:67 autiasp682:69 ret70 .size f_multi_auth_insts, .-f_multi_auth_insts71// CHECK-NOT: f_multi_auth_insts72 73// TODO: also verify that false negatives exist in across-BB gadgets in functions74// for which bolt cannot reconstruct the call graph.75