665 lines · plain
1// RUN: %clang %cflags -march=armv8.3-a %s -o %t.exe -Wl,--emit-relocs2// RUN: llvm-bolt-binary-analysis --scanners=pauth %t.exe 2>&1 | FileCheck %s3 4 .text5 6 .globl raise_error7 .type raise_error,@function8raise_error:9 ret10 .size raise_error, .-raise_error11 12 .globl resign_no_check13 .type resign_no_check,@function14resign_no_check:15// CHECK-LABEL: GS-PAUTH: signing oracle found in function resign_no_check, basic block {{[^,]+}}, at address16// CHECK-NEXT: The instruction is {{[0-9a-f]+}}: pacia x0, x217// CHECK-NEXT: The 0 instructions that write to the affected registers after any authentication are:18 autib x0, x119 pacia x0, x220 ret21 .size resign_no_check, .-resign_no_check22 23// Test "xpac" check method.24 25 .globl resign_xpaci_good26 .type resign_xpaci_good,@function27resign_xpaci_good:28// CHECK-NOT: resign_xpaci_good29 autib x0, x130 mov x16, x031 xpaci x1632 cmp x0, x1633 b.eq 1f34 brk 0xc471351:36 pacia x0, x237 ret38 .size resign_xpaci_good, .-resign_xpaci_good39 40 .globl resign_xpacd_good41 .type resign_xpacd_good,@function42resign_xpacd_good:43// CHECK-NOT: resign_xpacd_good44 autdb x0, x145 mov x16, x046 xpacd x1647 cmp x0, x1648 b.eq 1f49 brk 0xc473501:51 pacda x0, x252 ret53 .size resign_xpacd_good, .-resign_xpacd_good54 55 .globl resign_xpaci_wrong_error56 .type resign_xpaci_wrong_error,@function57resign_xpaci_wrong_error:58// CHECK-LABEL: GS-PAUTH: signing oracle found in function resign_xpaci_wrong_error, basic block {{[^,]+}}, at address59// CHECK-NEXT: The instruction is {{[0-9a-f]+}}: pacia x0, x260// CHECK-NEXT: The 1 instructions that write to the affected registers after any authentication are:61// CHECK-NEXT: 1. {{[0-9a-f]+}}: bl raise_error62 paciasp63 stp x29, x30, [sp, #-16]!64 65 autib x0, x166 mov x16, x067 xpaci x1668 cmp x0, x1669 b.eq 1f70 bl raise_error // should trigger breakpoint instead711:72 pacia x0, x273 74 ldp x29, x30, [sp], #1675 autiasp76 ret77 .size resign_xpaci_wrong_error, .-resign_xpaci_wrong_error78 79 .globl resign_xpaci_missing_brk80 .type resign_xpaci_missing_brk,@function81resign_xpaci_missing_brk:82// CHECK-LABEL: GS-PAUTH: signing oracle found in function resign_xpaci_missing_brk, basic block {{[^,]+}}, at address83// CHECK-NEXT: The instruction is {{[0-9a-f]+}}: pacia x0, x284// CHECK-NEXT: The 0 instructions that write to the affected registers after any authentication are:85 autib x0, x186 mov x16, x087 xpaci x1688 cmp x0, x1689 b.eq 1f901:91 pacia x0, x292 ret93 .size resign_xpaci_missing_brk, .-resign_xpaci_missing_brk94 95 .globl resign_xpaci_missing_branch_and_brk96 .type resign_xpaci_missing_branch_and_brk,@function97resign_xpaci_missing_branch_and_brk:98// CHECK-LABEL: GS-PAUTH: signing oracle found in function resign_xpaci_missing_branch_and_brk, basic block {{[^,]+}}, at address99// CHECK-NEXT: The instruction is {{[0-9a-f]+}}: pacia x0, x2100// CHECK-NEXT: The 0 instructions that write to the affected registers after any authentication are:101 autib x0, x1102 mov x16, x0103 xpaci x16104 cmp x0, x16105 pacia x0, x2106 ret107 .size resign_xpaci_missing_branch_and_brk, .-resign_xpaci_missing_branch_and_brk108 109 .globl resign_xpaci_unrelated_auth_and_check110 .type resign_xpaci_unrelated_auth_and_check,@function111resign_xpaci_unrelated_auth_and_check:112// CHECK-LABEL: GS-PAUTH: signing oracle found in function resign_xpaci_unrelated_auth_and_check, basic block {{[^,]+}}, at address113// CHECK-NEXT: The instruction is {{[0-9a-f]+}}: pacia x10, x2114// CHECK-NEXT: The 0 instructions that write to the affected registers after any authentication are:115 autib x10, x1 // made x10 safe-to-dereference116 mov x16, x0 // start of checker sequence for x0117 xpaci x16118 cmp x0, x16119 b.eq 1f120 brk 0xc4711211:122 pacia x10, x2123 ret124 .size resign_xpaci_unrelated_auth_and_check, .-resign_xpaci_unrelated_auth_and_check125 126// There are lots of operands to check in the pattern - let's at the very least127// check that each of the three instructions (mov, xpac, cmp) undergoes *some*128// matching. Pay a bit more attention to those instructions and their operands129// that can be obviously replaced without crashing at run-time and making the130// check obviously weaker.131 .globl resign_xpaci_wrong_pattern_1132 .type resign_xpaci_wrong_pattern_1,@function133resign_xpaci_wrong_pattern_1:134// CHECK-LABEL: GS-PAUTH: signing oracle found in function resign_xpaci_wrong_pattern_1, basic block {{[^,]+}}, at address135// CHECK-NEXT: The instruction is {{[0-9a-f]+}}: pacia x0, x2136// CHECK-NEXT: The 0 instructions that write to the affected registers after any authentication are:137 autib x0, x1138 mov x16, x10 // x10 instead of x0139 xpaci x16140 cmp x0, x16141 b.eq 1f142 brk 0xc4711431:144 pacia x0, x2145 ret146 .size resign_xpaci_wrong_pattern_1, .-resign_xpaci_wrong_pattern_1147 148 .globl resign_xpaci_wrong_pattern_2149 .type resign_xpaci_wrong_pattern_2,@function150resign_xpaci_wrong_pattern_2:151// CHECK-LABEL: GS-PAUTH: signing oracle found in function resign_xpaci_wrong_pattern_2, basic block {{[^,]+}}, at address152// CHECK-NEXT: The instruction is {{[0-9a-f]+}}: pacia x0, x2153// CHECK-NEXT: The 1 instructions that write to the affected registers after any authentication are:154// CHECK-NEXT: 1. {{[0-9a-f]+}}: xpaci x0155 autib x0, x1156 mov x16, x0157 xpaci x0 // x0 instead of x16158 cmp x0, x16159 b.eq 1f160 brk 0xc4711611:162 pacia x0, x2163 ret164 .size resign_xpaci_wrong_pattern_2, .-resign_xpaci_wrong_pattern_2165 166 .globl resign_xpaci_wrong_pattern_3167 .type resign_xpaci_wrong_pattern_3,@function168resign_xpaci_wrong_pattern_3:169// CHECK-LABEL: GS-PAUTH: signing oracle found in function resign_xpaci_wrong_pattern_3, basic block {{[^,]+}}, at address170// CHECK-NEXT: The instruction is {{[0-9a-f]+}}: pacia x0, x2171// CHECK-NEXT: The 0 instructions that write to the affected registers after any authentication are:172 autib x0, x1173 mov x16, x0174 xpaci x16175 cmp x16, x16 // x16 instead of x0176 b.eq 1f177 brk 0xc4711781:179 pacia x0, x2180 ret181 .size resign_xpaci_wrong_pattern_3, .-resign_xpaci_wrong_pattern_3182 183 .globl resign_xpaci_wrong_pattern_4184 .type resign_xpaci_wrong_pattern_4,@function185resign_xpaci_wrong_pattern_4:186// CHECK-LABEL: GS-PAUTH: signing oracle found in function resign_xpaci_wrong_pattern_4, basic block {{[^,]+}}, at address187// CHECK-NEXT: The instruction is {{[0-9a-f]+}}: pacia x0, x2188// CHECK-NEXT: The 0 instructions that write to the affected registers after any authentication are:189 autib x0, x1190 mov x16, x0191 xpaci x16192 cmp x0, x0 // x0 instead of x16193 b.eq 1f194 brk 0xc4711951:196 pacia x0, x2197 ret198 .size resign_xpaci_wrong_pattern_4, .-resign_xpaci_wrong_pattern_4199 200 .globl resign_xpaci_wrong_pattern_5201 .type resign_xpaci_wrong_pattern_5,@function202resign_xpaci_wrong_pattern_5:203// CHECK-LABEL: GS-PAUTH: signing oracle found in function resign_xpaci_wrong_pattern_5, basic block {{[^,]+}}, at address204// CHECK-NEXT: The instruction is {{[0-9a-f]+}}: pacia x0, x2205// CHECK-NEXT: The 0 instructions that write to the affected registers after any authentication are:206 autib x0, x1207 mov x16, x0208 mov x16, x16 // replace xpaci with a no-op instruction209 cmp x0, x16210 b.eq 1f211 brk 0xc4712121:213 pacia x0, x2214 ret215 .size resign_xpaci_wrong_pattern_5, .-resign_xpaci_wrong_pattern_5216 217// Test "xpac-hint" check method.218 219 .globl resign_xpaclri_good220 .type resign_xpaclri_good,@function221resign_xpaclri_good:222// CHECK-NOT: resign_xpaclri_good223 paciasp224 stp x29, x30, [sp, #-16]!225 226 autib x30, x1227 mov x16, x30228 xpaclri229 cmp x30, x16230 b.eq 1f231 brk 0xc4712321:233 pacia x30, x2234 235 ldp x29, x30, [sp], #16236 autiasp237 ret238 .size resign_xpaclri_good, .-resign_xpaclri_good239 240 .globl xpaclri_check_keeps_lr_safe241 .type xpaclri_check_keeps_lr_safe,@function242xpaclri_check_keeps_lr_safe:243// CHECK-NOT: xpaclri_check_keeps_lr_safe244 // LR is implicitly safe-to-dereference and trusted here245 mov x16, x30246 xpaclri // clobbers LR247 cmp x30, x16248 b.eq 1f249 brk 0xc471 // marks LR as trusted and safe-to-dereference2501:251 ret // not reporting non-protected return252 .size xpaclri_check_keeps_lr_safe, .-xpaclri_check_keeps_lr_safe253 254 .globl xpaclri_check_requires_safe_lr255 .type xpaclri_check_requires_safe_lr,@function256xpaclri_check_requires_safe_lr:257// CHECK-LABEL: GS-PAUTH: non-protected ret found in function xpaclri_check_requires_safe_lr, basic block {{[^,]+}}, at address258// CHECK-NEXT: The instruction is {{[0-9a-f]+}}: ret259// CHECK-NEXT: The 1 instructions that write to the affected registers after any authentication are:260// CHECK-NEXT: 1. {{[0-9a-f]+}}: xpaclri261 mov x30, x0262 // LR is not safe-to-dereference here - check that xpac-hint checker263 // does not make LR safe-to-dereference, but only *keeps* this state.264 mov x16, x30265 xpaclri266 cmp x30, x16267 b.eq 1f268 brk 0xc4712691:270 ret271 .size xpaclri_check_requires_safe_lr, .-xpaclri_check_requires_safe_lr272 273 .globl resign_xpaclri_wrong_reg274 .type resign_xpaclri_wrong_reg,@function275resign_xpaclri_wrong_reg:276// CHECK-LABEL: GS-PAUTH: signing oracle found in function resign_xpaclri_wrong_reg, basic block {{[^,]+}}, at address277// CHECK-NEXT: The instruction is {{[0-9a-f]+}}: pacia x20, x2278// CHECK-NEXT: The 0 instructions that write to the affected registers after any authentication are:279 paciasp280 281 autib x20, x1 // consistently using x20 instead of x30282 mov x16, x20283 xpaclri // ... but xpaclri still operates on x30284 cmp x20, x16285 b.eq 1f286 brk 0xc4712871:288 pacia x20, x2289 290 autiasp291 ret292 .size resign_xpaclri_wrong_reg, .-resign_xpaclri_wrong_reg293 294// Test that pointer should be authenticated AND checked to be safe-to-sign.295// Checking alone is not enough.296 .globl resign_checked_not_authenticated297 .type resign_checked_not_authenticated,@function298resign_checked_not_authenticated:299// CHECK-LABEL: GS-PAUTH: signing oracle found in function resign_checked_not_authenticated, basic block {{[^,]+}}, at address300// CHECK-NEXT: The instruction is {{[0-9a-f]+}}: pacia x0, x2301// CHECK-NEXT: The 0 instructions that write to the affected registers after any authentication are:302 mov x16, x0303 xpaci x16304 cmp x0, x16305 b.eq 1f306 brk 0xc4713071:308 pacia x0, x2309 ret310 .size resign_checked_not_authenticated, .-resign_checked_not_authenticated311 312// The particular register should be *first* written by an authentication313// instruction and *then* that new value should be checked.314// Such code pattern will probably crash at run-time anyway, but let's check315// "safe-to-dereference" -> "trusted" transition.316 .globl resign_checked_before_authenticated317 .type resign_checked_before_authenticated,@function318resign_checked_before_authenticated:319// CHECK-LABEL: GS-PAUTH: signing oracle found in function resign_checked_before_authenticated, basic block {{[^,]+}}, at address320// CHECK-NEXT: The instruction is {{[0-9a-f]+}}: pacia x0, x2321// CHECK-NEXT: The 0 instructions that write to the affected registers after any authentication are:322 mov x16, x0323 xpaci x16324 cmp x0, x16325 b.eq 1f326 brk 0xc4713271:328 autib x0, x1329 pacia x0, x2330 ret331 .size resign_checked_before_authenticated, .-resign_checked_before_authenticated332 333// Test "high-bits-notbi" check method.334 335 .globl resign_high_bits_tbz_good336 .type resign_high_bits_tbz_good,@function337resign_high_bits_tbz_good:338// CHECK-NOT: resign_high_bits_tbz_good339 autib x0, x1340 eor x16, x0, x0, lsl #1341 tbz x16, #62, 1f342 brk 0xc4713431:344 pacia x0, x2345 ret346 .size resign_high_bits_tbz_good, .-resign_high_bits_tbz_good347 348// Check BRK matching briefly - this logic is shared with the "xpac" sequence matcher.349 350 .globl resign_high_bits_tbz_wrong_error351 .type resign_high_bits_tbz_wrong_error,@function352resign_high_bits_tbz_wrong_error:353// CHECK-LABEL: GS-PAUTH: signing oracle found in function resign_high_bits_tbz_wrong_error, basic block {{[^,]+}}, at address354// CHECK-NEXT: The instruction is {{[0-9a-f]+}}: pacia x0, x2355// CHECK-NEXT: The 1 instructions that write to the affected registers after any authentication are:356// CHECK-NEXT: 1. {{[0-9a-f]+}}: bl raise_error357 paciasp358 stp x29, x30, [sp, #-16]!359 360 autib x0, x1361 eor x16, x0, x0, lsl #1362 tbz x16, #62, 1f363 bl raise_error // should trigger breakpoint instead3641:365 pacia x0, x2366 367 ldp x29, x30, [sp], #16368 autiasp369 ret370 .size resign_high_bits_tbz_wrong_error, .-resign_high_bits_tbz_wrong_error371 372 .globl resign_high_bits_tbz_wrong_bit373 .type resign_high_bits_tbz_wrong_bit,@function374resign_high_bits_tbz_wrong_bit:375// CHECK-LABEL: GS-PAUTH: signing oracle found in function resign_high_bits_tbz_wrong_bit, basic block {{[^,]+}}, at address376// CHECK-NEXT: The instruction is {{[0-9a-f]+}}: pacia x0, x2377// CHECK-NEXT: The 0 instructions that write to the affected registers after any authentication are:378 autib x0, x1379 eor x16, x0, x0, lsl #1380 tbz x16, #63, 1f381 brk 0xc4713821:383 pacia x0, x2384 ret385 .size resign_high_bits_tbz_wrong_bit, .-resign_high_bits_tbz_wrong_bit386 387 .globl resign_high_bits_tbz_wrong_shift_amount388 .type resign_high_bits_tbz_wrong_shift_amount,@function389resign_high_bits_tbz_wrong_shift_amount:390// CHECK-LABEL: GS-PAUTH: signing oracle found in function resign_high_bits_tbz_wrong_shift_amount, basic block {{[^,]+}}, at address391// CHECK-NEXT: The instruction is {{[0-9a-f]+}}: pacia x0, x2392// CHECK-NEXT: The 0 instructions that write to the affected registers after any authentication are:393 autib x0, x1394 eor x16, x0, x0, lsl #2395 tbz x16, #62, 1f396 brk 0xc4713971:398 pacia x0, x2399 ret400 .size resign_high_bits_tbz_wrong_shift_amount, .-resign_high_bits_tbz_wrong_shift_amount401 402 .globl resign_high_bits_tbz_wrong_shift_type403 .type resign_high_bits_tbz_wrong_shift_type,@function404resign_high_bits_tbz_wrong_shift_type:405// CHECK-LABEL: GS-PAUTH: signing oracle found in function resign_high_bits_tbz_wrong_shift_type, basic block {{[^,]+}}, at address406// CHECK-NEXT: The instruction is {{[0-9a-f]+}}: pacia x0, x2407// CHECK-NEXT: The 0 instructions that write to the affected registers after any authentication are:408 autib x0, x1409 eor x16, x0, x0, lsr #1410 tbz x16, #62, 1f411 brk 0xc4714121:413 pacia x0, x2414 ret415 .size resign_high_bits_tbz_wrong_shift_type, .-resign_high_bits_tbz_wrong_shift_type416 417 .globl resign_high_bits_tbz_wrong_pattern_1418 .type resign_high_bits_tbz_wrong_pattern_1,@function419resign_high_bits_tbz_wrong_pattern_1:420// CHECK-LABEL: GS-PAUTH: signing oracle found in function resign_high_bits_tbz_wrong_pattern_1, basic block {{[^,]+}}, at address421// CHECK-NEXT: The instruction is {{[0-9a-f]+}}: pacia x0, x2422// CHECK-NEXT: The 0 instructions that write to the affected registers after any authentication are:423 autib x0, x1424 eor x16, x0, x0, lsl #1425 tbz x17, #62, 1f426 brk 0xc4714271:428 pacia x0, x2429 ret430 .size resign_high_bits_tbz_wrong_pattern_1, .-resign_high_bits_tbz_wrong_pattern_1431 432 .globl resign_high_bits_tbz_wrong_pattern_2433 .type resign_high_bits_tbz_wrong_pattern_2,@function434resign_high_bits_tbz_wrong_pattern_2:435// CHECK-LABEL: GS-PAUTH: signing oracle found in function resign_high_bits_tbz_wrong_pattern_2, basic block {{[^,]+}}, at address436// CHECK-NEXT: The instruction is {{[0-9a-f]+}}: pacia x0, x2437// CHECK-NEXT: The 0 instructions that write to the affected registers after any authentication are:438 autib x0, x1439 eor x16, x10, x0, lsl #1440 tbz x16, #62, 1f441 brk 0xc4714421:443 pacia x0, x2444 ret445 .size resign_high_bits_tbz_wrong_pattern_2, .-resign_high_bits_tbz_wrong_pattern_2446 447 .globl resign_high_bits_tbz_wrong_pattern_3448 .type resign_high_bits_tbz_wrong_pattern_3,@function449resign_high_bits_tbz_wrong_pattern_3:450// CHECK-LABEL: GS-PAUTH: signing oracle found in function resign_high_bits_tbz_wrong_pattern_3, basic block {{[^,]+}}, at address451// CHECK-NEXT: The instruction is {{[0-9a-f]+}}: pacia x0, x2452// CHECK-NEXT: The 0 instructions that write to the affected registers after any authentication are:453 autib x0, x1454 eor x16, x0, x10, lsl #1455 tbz x16, #62, 1f456 brk 0xc4714571:458 pacia x0, x2459 ret460 .size resign_high_bits_tbz_wrong_pattern_3, .-resign_high_bits_tbz_wrong_pattern_3461 462// Test checking by loading via the authenticated pointer.463 464 .globl resign_load_good465 .type resign_load_good,@function466resign_load_good:467// CHECK-NOT: resign_load_good468 autdb x0, x1469 ldr x3, [x0]470 pacda x0, x2471 ret472 .size resign_load_good, .-resign_load_good473 474 .globl resign_load_wreg_good475 .type resign_load_wreg_good,@function476resign_load_wreg_good:477// CHECK-NOT: resign_load_wreg_good478 autdb x0, x1479 ldr w3, [x0]480 pacda x0, x2481 ret482 .size resign_load_wreg_good, .-resign_load_wreg_good483 484 .globl resign_load_byte_good485 .type resign_load_byte_good,@function486resign_load_byte_good:487// CHECK-NOT: resign_load_byte_good488 autdb x0, x1489 ldrb w3, [x0]490 pacda x0, x2491 ret492 .size resign_load_byte_good, .-resign_load_byte_good493 494 .globl resign_load_pair_good495 .type resign_load_pair_good,@function496resign_load_pair_good:497// CHECK-NOT: resign_load_pair_good498 autdb x0, x1499 ldp x3, x4, [x0]500 pacda x0, x2501 ret502 .size resign_load_pair_good, .-resign_load_pair_good503 504 .globl resign_load_imm_offset_good505 .type resign_load_imm_offset_good,@function506resign_load_imm_offset_good:507// CHECK-NOT: resign_load_imm_offset_good508 autdb x0, x1509 ldr x3, [x0, #16]510 pacda x0, x2511 ret512 .size resign_load_imm_offset_good, .-resign_load_imm_offset_good513 514 .globl resign_load_preinc_good515 .type resign_load_preinc_good,@function516resign_load_preinc_good:517// CHECK-NOT: resign_load_preinc_good518 autdb x0, x1519 ldr x3, [x0, #16]!520 pacda x0, x2521 ret522 .size resign_load_preinc_good, .-resign_load_preinc_good523 524 .globl resign_load_postinc_good525 .type resign_load_postinc_good,@function526resign_load_postinc_good:527// CHECK-NOT: resign_load_postinc_good528 autdb x0, x1529 ldr x3, [x0], #16530 pacda x0, x2531 ret532 .size resign_load_postinc_good, .-resign_load_postinc_good533 534 .globl resign_load_pair_with_ptr_writeback_good535 .type resign_load_pair_with_ptr_writeback_good,@function536resign_load_pair_with_ptr_writeback_good:537// CHECK-NOT: resign_load_pair_with_ptr_writeback_good538 autdb x0, x1539 ldp x3, x4, [x0, #16]! // three output registers (incl. tied x0 register)540 pacda x0, x2541 ret542 .size resign_load_pair_with_ptr_writeback_good, .-resign_load_pair_with_ptr_writeback_good543 544 .globl resign_load_overwrite545 .type resign_load_overwrite,@function546resign_load_overwrite:547// CHECK-LABEL: GS-PAUTH: signing oracle found in function resign_load_overwrite, basic block {{[^,]+}}, at address548// CHECK-NEXT: The instruction is {{[0-9a-f]+}}: pacda x0, x2549// CHECK-NEXT: The 1 instructions that write to the affected registers after any authentication are:550// CHECK-NEXT: 1. {{[0-9a-f]+}}: ldr x0, [x0]551 autdb x0, x1552 ldr x0, [x0]553 pacda x0, x2554 ret555 .size resign_load_overwrite, .-resign_load_overwrite556 557 .globl resign_load_overwrite_out2558 .type resign_load_overwrite_out2,@function559resign_load_overwrite_out2:560// CHECK-LABEL: GS-PAUTH: signing oracle found in function resign_load_overwrite_out2, basic block {{[^,]+}}, at address561// CHECK-NEXT: The instruction is {{[0-9a-f]+}}: pacda x0, x2562// CHECK-NEXT: The 1 instructions that write to the affected registers after any authentication are:563// CHECK-NEXT: 1. {{[0-9a-f]+}}: ldp x10, x0, [x0]564 autdb x0, x1565 ldp x10, x0, [x0]566 pacda x0, x2567 ret568 .size resign_load_overwrite_out2, .-resign_load_overwrite_out2569 570 .globl resign_load_partial_overwrite571 .type resign_load_partial_overwrite,@function572resign_load_partial_overwrite:573// CHECK-LABEL: GS-PAUTH: signing oracle found in function resign_load_partial_overwrite, basic block {{[^,]+}}, at address574// CHECK-NEXT: The instruction is {{[0-9a-f]+}}: pacda x0, x2575// CHECK-NEXT: The 1 instructions that write to the affected registers after any authentication are:576// CHECK-NEXT: 1. {{[0-9a-f]+}}: ldr w0, [x0]577 autdb x0, x1578 ldr w0, [x0]579 pacda x0, x2580 ret581 .size resign_load_partial_overwrite, .-resign_load_partial_overwrite582 583 .globl resign_load_partial_overwrite_out2584 .type resign_load_partial_overwrite_out2,@function585resign_load_partial_overwrite_out2:586// CHECK-LABEL: GS-PAUTH: signing oracle found in function resign_load_partial_overwrite_out2, basic block {{[^,]+}}, at address587// CHECK-NEXT: The instruction is {{[0-9a-f]+}}: pacda x0, x2588// CHECK-NEXT: The 1 instructions that write to the affected registers after any authentication are:589// CHECK-NEXT: 1. {{[0-9a-f]+}}: ldp w10, w0, [x0]590 autdb x0, x1591 ldp w10, w0, [x0]592 pacda x0, x2593 ret594 .size resign_load_partial_overwrite_out2, .-resign_load_partial_overwrite_out2595 596// Test that base register + offset register addressing mode is rejected.597 598 .globl resign_load_reg_plus_reg599 .type resign_load_reg_plus_reg,@function600resign_load_reg_plus_reg:601// CHECK-LABEL: GS-PAUTH: signing oracle found in function resign_load_reg_plus_reg, basic block {{[^,]+}}, at address602// CHECK-NEXT: The instruction is {{[0-9a-f]+}}: pacda x0, x2603// CHECK-NEXT: The 0 instructions that write to the affected registers after any authentication are:604 autdb x0, x1605 ldr x3, [x0, x4]606 pacda x0, x2607 ret608 .size resign_load_reg_plus_reg, .-resign_load_reg_plus_reg609 610 .globl resign_load_reg_plus_reg_in2611 .type resign_load_reg_plus_reg_in2,@function612resign_load_reg_plus_reg_in2:613// CHECK-LABEL: GS-PAUTH: signing oracle found in function resign_load_reg_plus_reg_in2, basic block {{[^,]+}}, at address614// CHECK-NEXT: The instruction is {{[0-9a-f]+}}: pacda x0, x2615// CHECK-NEXT: The 0 instructions that write to the affected registers after any authentication are:616 autdb x0, x1617 ldr x3, [x4, x0]618 pacda x0, x2619 ret620 .size resign_load_reg_plus_reg_in2, .-resign_load_reg_plus_reg_in2621 622 .globl resign_load_unscaled_good623 .type resign_load_unscaled_good,@function624resign_load_unscaled_good:625// CHECK-NOT: resign_load_unscaled_good626 autdb x0, x1627 ldurb w3, [x0, #-1]628 pacda x0, x2629 ret630 .size resign_load_unscaled_good, .-resign_load_unscaled_good631 632// Any basic block can check at most one register using a multi-instruction633// pointer-checking sequence, but it can contain an arbitrary number of single-634// instruction pointer checks.635 636 .globl many_checked_regs637 .type many_checked_regs,@function638many_checked_regs:639// CHECK-NOT: many_checked_regs640 autdzb x0641 autdzb x1642 autdzb x2643 b 1f6441:645 ldr w3, [x0] // single-instruction check646 ldr w3, [x1] // single-instruction check647 mov x16, x2 // start of multi-instruction checker sequence648 xpacd x16 // ...649 cmp x2, x16 // ...650 b.eq 2f // end of basic block651 brk 0xc4736522:653 pacdza x0654 pacdza x1655 pacdza x2656 ret657 .size many_checked_regs, .-many_checked_regs658 659 .globl main660 .type main,@function661main:662 mov x0, 0663 ret664 .size main, .-main665