1522 lines · plain
1// RUN: %clang %cflags -march=armv8.3-a %s -o %t.exe2// RUN: llvm-bolt-binary-analysis --scanners=pacret %t.exe 2>&1 | FileCheck -check-prefix=PACRET %s3// RUN: llvm-bolt-binary-analysis --scanners=pauth --auth-traps-on-failure %t.exe 2>&1 | FileCheck %s4// RUN: llvm-bolt-binary-analysis --scanners=pauth %t.exe 2>&1 | FileCheck %s5 6// PACRET-NOT: non-protected call found in function7 8 .text9 10 .globl callee11 .type callee,@function12callee:13 ret14 .size callee, .-callee15 16 .globl good_direct_call17 .type good_direct_call,@function18good_direct_call:19// CHECK-NOT: good_direct_call20 paciasp21 stp x29, x30, [sp, #-16]!22 mov x29, sp23 24 bl callee25 26 ldp x29, x30, [sp], #1627 autiasp28 ret29 .size good_direct_call, .-good_direct_call30 31 .globl good_indirect_call_arg32 .type good_indirect_call_arg,@function33good_indirect_call_arg:34// CHECK-NOT: good_indirect_call_arg35 paciasp36 stp x29, x30, [sp, #-16]!37 mov x29, sp38 39 autia x0, x140 blr x041 42 ldp x29, x30, [sp], #1643 autiasp44 ret45 .size good_indirect_call_arg, .-good_indirect_call_arg46 47 .globl good_indirect_call_mem48 .type good_indirect_call_mem,@function49good_indirect_call_mem:50// CHECK-NOT: good_indirect_call_mem51 paciasp52 stp x29, x30, [sp, #-16]!53 mov x29, sp54 55 ldr x16, [x0]56 autia x16, x057 blr x1658 59 ldp x29, x30, [sp], #1660 autiasp61 ret62 .size good_indirect_call_mem, .-good_indirect_call_mem63 64 .globl good_indirect_call_arg_v8365 .type good_indirect_call_arg_v83,@function66good_indirect_call_arg_v83:67// CHECK-NOT: good_indirect_call_arg_v8368 paciasp69 stp x29, x30, [sp, #-16]!70 mov x29, sp71 72 blraa x0, x173 74 ldp x29, x30, [sp], #1675 autiasp76 ret77 .size good_indirect_call_arg_v83, .-good_indirect_call_arg_v8378 79 .globl good_indirect_call_mem_v8380 .type good_indirect_call_mem_v83,@function81good_indirect_call_mem_v83:82// CHECK-NOT: good_indirect_call_mem_v8383 paciasp84 stp x29, x30, [sp, #-16]!85 mov x29, sp86 87 ldr x16, [x0]88 blraa x16, x089 90 ldp x29, x30, [sp], #1691 autiasp92 ret93 .size good_indirect_call_mem_v83, .-good_indirect_call_mem_v8394 95 .globl bad_indirect_call_arg96 .type bad_indirect_call_arg,@function97bad_indirect_call_arg:98// CHECK-LABEL: GS-PAUTH: non-protected call found in function bad_indirect_call_arg, basic block {{[^,]+}}, at address99// CHECK-NEXT: The instruction is {{[0-9a-f]+}}: blr x0100// CHECK-NEXT: The 0 instructions that write to the affected registers after any authentication are:101 paciasp102 stp x29, x30, [sp, #-16]!103 mov x29, sp104 105 blr x0106 107 ldp x29, x30, [sp], #16108 autiasp109 ret110 .size bad_indirect_call_arg, .-bad_indirect_call_arg111 112 .globl bad_indirect_call_mem113 .type bad_indirect_call_mem,@function114bad_indirect_call_mem:115// CHECK-LABEL: GS-PAUTH: non-protected call found in function bad_indirect_call_mem, basic block {{[^,]+}}, at address116// CHECK-NEXT: The instruction is {{[0-9a-f]+}}: blr x16117// CHECK-NEXT: The 1 instructions that write to the affected registers after any authentication are:118// CHECK-NEXT: 1. {{[0-9a-f]+}}: ldr x16, [x0]119// CHECK-NEXT: This happens in the following basic block:120// CHECK-NEXT: {{[0-9a-f]+}}: paciasp121// CHECK-NEXT: {{[0-9a-f]+}}: stp x29, x30, [sp, #-0x10]!122// CHECK-NEXT: {{[0-9a-f]+}}: mov x29, sp123// CHECK-NEXT: {{[0-9a-f]+}}: ldr x16, [x0]124// CHECK-NEXT: {{[0-9a-f]+}}: blr x16125// CHECK-NEXT: {{[0-9a-f]+}}: ldp x29, x30, [sp], #0x10126// CHECK-NEXT: {{[0-9a-f]+}}: autiasp127// CHECK-NEXT: {{[0-9a-f]+}}: ret128 paciasp129 stp x29, x30, [sp, #-16]!130 mov x29, sp131 132 ldr x16, [x0]133 blr x16134 135 ldp x29, x30, [sp], #16136 autiasp137 ret138 .size bad_indirect_call_mem, .-bad_indirect_call_mem139 140 .globl bad_indirect_call_arg_clobber141 .type bad_indirect_call_arg_clobber,@function142bad_indirect_call_arg_clobber:143// CHECK-LABEL: GS-PAUTH: non-protected call found in function bad_indirect_call_arg_clobber, basic block {{[^,]+}}, at address144// CHECK-NEXT: The instruction is {{[0-9a-f]+}}: blr x0145// CHECK-NEXT: The 1 instructions that write to the affected registers after any authentication are:146// CHECK-NEXT: 1. {{[0-9a-f]+}}: mov w0, w2147// CHECK-NEXT: This happens in the following basic block:148// CHECK-NEXT: {{[0-9a-f]+}}: paciasp149// CHECK-NEXT: {{[0-9a-f]+}}: stp x29, x30, [sp, #-0x10]!150// CHECK-NEXT: {{[0-9a-f]+}}: mov x29, sp151// CHECK-NEXT: {{[0-9a-f]+}}: autia x0, x1152// CHECK-NEXT: {{[0-9a-f]+}}: mov w0, w2153// CHECK-NEXT: {{[0-9a-f]+}}: blr x0154// CHECK-NEXT: {{[0-9a-f]+}}: ldp x29, x30, [sp], #0x10155// CHECK-NEXT: {{[0-9a-f]+}}: autiasp156// CHECK-NEXT: {{[0-9a-f]+}}: ret157 paciasp158 stp x29, x30, [sp, #-16]!159 mov x29, sp160 161 autia x0, x1162 mov w0, w2163 blr x0164 165 ldp x29, x30, [sp], #16166 autiasp167 ret168 .size bad_indirect_call_arg_clobber, .-bad_indirect_call_arg_clobber169 170 .globl bad_indirect_call_mem_clobber171 .type bad_indirect_call_mem_clobber,@function172bad_indirect_call_mem_clobber:173// CHECK-LABEL: GS-PAUTH: non-protected call found in function bad_indirect_call_mem_clobber, basic block {{[^,]+}}, at address174// CHECK-NEXT: The instruction is {{[0-9a-f]+}}: blr x16175// CHECK-NEXT: The 1 instructions that write to the affected registers after any authentication are:176// CHECK-NEXT: 1. {{[0-9a-f]+}}: mov w16, w2177// CHECK-NEXT: This happens in the following basic block:178// CHECK-NEXT: {{[0-9a-f]+}}: paciasp179// CHECK-NEXT: {{[0-9a-f]+}}: stp x29, x30, [sp, #-0x10]!180// CHECK-NEXT: {{[0-9a-f]+}}: mov x29, sp181// CHECK-NEXT: {{[0-9a-f]+}}: ldr x16, [x0]182// CHECK-NEXT: {{[0-9a-f]+}}: autia x16, x0183// CHECK-NEXT: {{[0-9a-f]+}}: mov w16, w2184// CHECK-NEXT: {{[0-9a-f]+}}: blr x16185// CHECK-NEXT: {{[0-9a-f]+}}: ldp x29, x30, [sp], #0x10186// CHECK-NEXT: {{[0-9a-f]+}}: autiasp187// CHECK-NEXT: {{[0-9a-f]+}}: ret188 paciasp189 stp x29, x30, [sp, #-16]!190 mov x29, sp191 192 ldr x16, [x0]193 autia x16, x0194 mov w16, w2195 blr x16196 197 ldp x29, x30, [sp], #16198 autiasp199 ret200 .size bad_indirect_call_mem_clobber, .-bad_indirect_call_mem_clobber201 202 .globl good_indirect_call_mem_chain_of_auts203 .type good_indirect_call_mem_chain_of_auts,@function204good_indirect_call_mem_chain_of_auts:205// CHECK-NOT: good_indirect_call_mem_chain_of_auts206 paciasp207 stp x29, x30, [sp, #-16]!208 mov x29, sp209 210 ldr x16, [x0]211 autda x16, x1212 ldr x16, [x16]213 autia x16, x0214 blr x16215 216 ldp x29, x30, [sp], #16217 autiasp218 ret219 .size good_indirect_call_mem_chain_of_auts, .-good_indirect_call_mem_chain_of_auts220 221 .globl bad_indirect_call_mem_chain_of_auts222 .type bad_indirect_call_mem_chain_of_auts,@function223bad_indirect_call_mem_chain_of_auts:224// CHECK-LABEL: GS-PAUTH: non-protected call found in function bad_indirect_call_mem_chain_of_auts, basic block {{[^,]+}}, at address225// CHECK-NEXT: The instruction is {{[0-9a-f]+}}: blr x16226// CHECK-NEXT: The 1 instructions that write to the affected registers after any authentication are:227// CHECK-NEXT: 1. {{[0-9a-f]+}}: ldr x16, [x16]228// CHECK-NEXT: This happens in the following basic block:229// CHECK-NEXT: {{[0-9a-f]+}}: paciasp230// CHECK-NEXT: {{[0-9a-f]+}}: stp x29, x30, [sp, #-0x10]!231// CHECK-NEXT: {{[0-9a-f]+}}: mov x29, sp232// CHECK-NEXT: {{[0-9a-f]+}}: ldr x16, [x0]233// CHECK-NEXT: {{[0-9a-f]+}}: autda x16, x1234// CHECK-NEXT: {{[0-9a-f]+}}: ldr x16, [x16]235// CHECK-NEXT: {{[0-9a-f]+}}: blr x16236// CHECK-NEXT: {{[0-9a-f]+}}: ldp x29, x30, [sp], #0x10237// CHECK-NEXT: {{[0-9a-f]+}}: autiasp238// CHECK-NEXT: {{[0-9a-f]+}}: ret239 paciasp240 stp x29, x30, [sp, #-16]!241 mov x29, sp242 243 ldr x16, [x0]244 autda x16, x1245 ldr x16, [x16]246 // Missing AUT of x16. The fact that x16 was authenticated above has nothing to do with it.247 blr x16248 249 ldp x29, x30, [sp], #16250 autiasp251 ret252 .size bad_indirect_call_mem_chain_of_auts, .-bad_indirect_call_mem_chain_of_auts253 254// Multi-BB test cases.255//256// Positive ("good") test cases are designed so that the register is made safe257// in one BB and used in the other. Negative ("bad") ones are designed so that258// there are two predecessors, one of them ends with the register in a safe259// state and the other ends with that register being unsafe.260 261 .globl good_indirect_call_arg_multi_bb262 .type good_indirect_call_arg_multi_bb,@function263good_indirect_call_arg_multi_bb:264// CHECK-NOT: good_indirect_call_arg_multi_bb265 paciasp266 stp x29, x30, [sp, #-16]!267 mov x29, sp268 269 autia x0, x1270 cbz x2, 1f271 blr x02721:273 ldr x1, [x0] // prevent authentication oracle274 275 ldp x29, x30, [sp], #16276 autiasp277 ret278 .size good_indirect_call_arg_multi_bb, .-good_indirect_call_arg_multi_bb279 280 .globl good_indirect_call_mem_multi_bb281 .type good_indirect_call_mem_multi_bb,@function282good_indirect_call_mem_multi_bb:283// CHECK-NOT: good_indirect_call_mem_multi_bb284 paciasp285 stp x29, x30, [sp, #-16]!286 mov x29, sp287 288 ldr x16, [x0]289 autia x16, x0290 cbz x2, 1f291 blr x162921:293 ldr w0, [x16] // prevent authentication oracle294 295 ldp x29, x30, [sp], #16296 autiasp297 ret298 .size good_indirect_call_mem_multi_bb, .-good_indirect_call_mem_multi_bb299 300 .globl bad_indirect_call_arg_multi_bb301 .type bad_indirect_call_arg_multi_bb,@function302bad_indirect_call_arg_multi_bb:303// CHECK-LABEL: GS-PAUTH: non-protected call found in function bad_indirect_call_arg_multi_bb, basic block {{[^,]+}}, at address304// CHECK-NEXT: The instruction is {{[0-9a-f]+}}: blr x0305// CHECK-NEXT: The 0 instructions that write to the affected registers after any authentication are:306 paciasp307 stp x29, x30, [sp, #-16]!308 mov x29, sp309 310 cbz x2, 1f311 autia x0, x13121:313 blr x0314 315 ldp x29, x30, [sp], #16316 autiasp317 ret318 .size bad_indirect_call_arg_multi_bb, .-bad_indirect_call_arg_multi_bb319 320 .globl bad_indirect_call_mem_multi_bb321 .type bad_indirect_call_mem_multi_bb,@function322bad_indirect_call_mem_multi_bb:323// CHECK-LABEL: GS-PAUTH: non-protected call found in function bad_indirect_call_mem_multi_bb, basic block {{[^,]+}}, at address324// CHECK-NEXT: The instruction is {{[0-9a-f]+}}: blr x16325// CHECK-NEXT: The 1 instructions that write to the affected registers after any authentication are:326// CHECK-NEXT: 1. {{[0-9a-f]+}}: ldr x16, [x0]327 paciasp328 stp x29, x30, [sp, #-16]!329 mov x29, sp330 331 ldr x16, [x0]332 cbz x2, 1f333 autia x16, x13341:335 blr x16336 337 ldp x29, x30, [sp], #16338 autiasp339 ret340 .size bad_indirect_call_mem_multi_bb, .-bad_indirect_call_mem_multi_bb341 342 .globl bad_indirect_call_arg_clobber_multi_bb343 .type bad_indirect_call_arg_clobber_multi_bb,@function344bad_indirect_call_arg_clobber_multi_bb:345// CHECK-LABEL: GS-PAUTH: non-protected call found in function bad_indirect_call_arg_clobber_multi_bb, basic block {{[^,]+}}, at address346// CHECK-NEXT: The instruction is {{[0-9a-f]+}}: blr x0347// CHECK-NEXT: The 1 instructions that write to the affected registers after any authentication are:348// CHECK-NEXT: 1. {{[0-9a-f]+}}: mov w0, w3349 paciasp350 stp x29, x30, [sp, #-16]!351 mov x29, sp352 353 autia x0, x1354 cbz x2, 1f355 mov w0, w33561:357 blr x0358 359 ldp x29, x30, [sp], #16360 autiasp361 ret362 .size bad_indirect_call_arg_clobber_multi_bb, .-bad_indirect_call_arg_clobber_multi_bb363 364 .globl bad_indirect_call_mem_clobber_multi_bb365 .type bad_indirect_call_mem_clobber_multi_bb,@function366bad_indirect_call_mem_clobber_multi_bb:367// CHECK-LABEL: GS-PAUTH: non-protected call found in function bad_indirect_call_mem_clobber_multi_bb, basic block {{[^,]+}}, at address368// CHECK-NEXT: The instruction is {{[0-9a-f]+}}: blr x16369// CHECK-NEXT: The 1 instructions that write to the affected registers after any authentication are:370// CHECK-NEXT: 1. {{[0-9a-f]+}}: mov w16, w2371 paciasp372 stp x29, x30, [sp, #-16]!373 mov x29, sp374 375 ldr x16, [x0]376 autia x16, x0377 cbz x2, 1f378 mov w16, w23791:380 blr x16381 382 ldp x29, x30, [sp], #16383 autiasp384 ret385 .size bad_indirect_call_mem_clobber_multi_bb, .-bad_indirect_call_mem_clobber_multi_bb386 387 .globl good_indirect_call_mem_chain_of_auts_multi_bb388 .type good_indirect_call_mem_chain_of_auts_multi_bb,@function389good_indirect_call_mem_chain_of_auts_multi_bb:390// CHECK-NOT: good_indirect_call_mem_chain_of_auts_multi_bb391 paciasp392 stp x29, x30, [sp, #-16]!393 mov x29, sp394 395 ldr x16, [x0]396 autda x16, x1397 ldr x16, [x16]398 autia x16, x0399 cbz x2, 1f400 blr x164011:402 ldr w0, [x16] // prevent authentication oracle403 404 ldp x29, x30, [sp], #16405 autiasp406 ret407 .size good_indirect_call_mem_chain_of_auts_multi_bb, .-good_indirect_call_mem_chain_of_auts_multi_bb408 409 .globl bad_indirect_call_mem_chain_of_auts_multi_bb410 .type bad_indirect_call_mem_chain_of_auts_multi_bb,@function411bad_indirect_call_mem_chain_of_auts_multi_bb:412// CHECK-LABEL: GS-PAUTH: non-protected call found in function bad_indirect_call_mem_chain_of_auts_multi_bb, basic block {{[^,]+}}, at address413// CHECK-NEXT: The instruction is {{[0-9a-f]+}}: blr x16414// CHECK-NEXT: The 1 instructions that write to the affected registers after any authentication are:415// CHECK-NEXT: 1. {{[0-9a-f]+}}: ldr x16, [x16]416 paciasp417 stp x29, x30, [sp, #-16]!418 mov x29, sp419 420 ldr x16, [x0]421 autda x16, x1422 ldr x16, [x16]423 cbz x2, 1f424 autia x16, x04251:426 blr x16427 428 ldp x29, x30, [sp], #16429 autiasp430 ret431 .size bad_indirect_call_mem_chain_of_auts_multi_bb, .-bad_indirect_call_mem_chain_of_auts_multi_bb432 433// Tests for CFG-unaware analysis.434//435// All these tests use an instruction sequence like this436//437// adr x2, 1f438// br x2439// 1:440// ; ...441//442// to make BOLT unable to reconstruct the control flow. Note that one can easily443// tell whether the report corresponds to a function with or without CFG:444// normally, the location of the gadget is described like this:445//446// ... found in function <function_name>, basic block <basic block name>, at address <address>447//448// When CFG information is not available, this is reduced to449//450// ... found in function <function_name>, at address <address>451 452 .globl good_direct_call_nocfg453 .type good_direct_call_nocfg,@function454good_direct_call_nocfg:455// CHECK-NOT: good_direct_call_nocfg456 paciasp457 stp x29, x30, [sp, #-16]!458 mov x29, sp459 460 bl callee461 462 adr x2, 1f463 br x24641:465 ldp x29, x30, [sp], #16466 autiasp467 ret468 .size good_direct_call_nocfg, .-good_direct_call_nocfg469 470 .globl good_indirect_call_arg_nocfg471 .type good_indirect_call_arg_nocfg,@function472good_indirect_call_arg_nocfg:473// CHECK-NOT: good_indirect_call_arg_nocfg474 paciasp475 stp x29, x30, [sp, #-16]!476 mov x29, sp477 478 autia x0, x1479 blr x0480 481 adr x2, 1f482 br x24831:484 ldp x29, x30, [sp], #16485 autiasp486 ret487 .size good_indirect_call_arg_nocfg, .-good_indirect_call_arg_nocfg488 489 .globl good_indirect_call_mem_nocfg490 .type good_indirect_call_mem_nocfg,@function491good_indirect_call_mem_nocfg:492// CHECK-NOT: good_indirect_call_mem_nocfg493 paciasp494 stp x29, x30, [sp, #-16]!495 mov x29, sp496 497 ldr x16, [x0]498 autia x16, x0499 blr x16500 501 adr x2, 1f502 br x25031:504 ldp x29, x30, [sp], #16505 autiasp506 ret507 .size good_indirect_call_mem_nocfg, .-good_indirect_call_mem_nocfg508 509 .globl good_indirect_call_arg_v83_nocfg510 .type good_indirect_call_arg_v83_nocfg,@function511good_indirect_call_arg_v83_nocfg:512// CHECK-NOT: good_indirect_call_arg_v83_nocfg513 paciasp514 stp x29, x30, [sp, #-16]!515 mov x29, sp516 517 blraa x0, x1518 519 adr x2, 1f520 br x25211:522 ldp x29, x30, [sp], #16523 autiasp524 ret525 .size good_indirect_call_arg_v83_nocfg, .-good_indirect_call_arg_v83_nocfg526 527 .globl good_indirect_call_mem_v83_nocfg528 .type good_indirect_call_mem_v83_nocfg,@function529good_indirect_call_mem_v83_nocfg:530// CHECK-NOT: good_indirect_call_mem_v83_nocfg531 paciasp532 stp x29, x30, [sp, #-16]!533 mov x29, sp534 535 ldr x16, [x0]536 blraa x16, x0537 538 adr x2, 1f539 br x25401:541 ldp x29, x30, [sp], #16542 autiasp543 ret544 .size good_indirect_call_mem_v83_nocfg, .-good_indirect_call_mem_v83_nocfg545 546 .globl bad_indirect_call_arg_nocfg547 .type bad_indirect_call_arg_nocfg,@function548bad_indirect_call_arg_nocfg:549// CHECK-LABEL: GS-PAUTH: non-protected call found in function bad_indirect_call_arg_nocfg, at address550// CHECK-NEXT: The instruction is {{[0-9a-f]+}}: blr x0551// CHECK-NEXT: The 0 instructions that write to the affected registers after any authentication are:552 paciasp553 stp x29, x30, [sp, #-16]!554 mov x29, sp555 556 blr x0557 558 adr x2, 1f559 br x25601:561 ldp x29, x30, [sp], #16562 autiasp563 ret564 .size bad_indirect_call_arg_nocfg, .-bad_indirect_call_arg_nocfg565 566 .globl obscure_indirect_call_arg_nocfg567 .type obscure_indirect_call_arg_nocfg,@function568obscure_indirect_call_arg_nocfg:569// CHECK-NOCFG-LABEL: GS-PAUTH: non-protected call found in function obscure_indirect_call_arg_nocfg, at address570// CHECK-NOCFG-NEXT: The instruction is {{[0-9a-f]+}}: blr x0571// CHECK-NOCFG-NEXT: The 0 instructions that write to the affected registers after any authentication are:572 paciasp573 stp x29, x30, [sp, #-16]!574 mov x29, sp575 576 autia x0, x1 // not observed by the checker577 b 1f5781:579 // The register state is pessimistically reset after a label, thus580 // the below branch instruction is reported as non-protected - this is581 // a known false-positive.582 blr x0583 584 adr x2, 1f585 br x25861:587 ldp x29, x30, [sp], #16588 autiasp589 ret590 .size obscure_good_indirect_call_arg_nocfg, .-obscure_good_indirect_call_arg_nocfg591 592 .globl safe_lr_at_function_entry_nocfg593 .type safe_lr_at_function_entry_nocfg,@function594safe_lr_at_function_entry_nocfg:595// Due to state being reset after a label, paciasp is reported as596// a signing oracle - this is a known false positive, ignore it.597// CHECK-NOT: non-protected call{{.*}}safe_lr_at_function_entry_nocfg598 cbz x0, 1f599 ret // LR is safe at the start of the function6001:601 paciasp602 stp x29, x30, [sp, #-16]!603 mov x29, sp604 605 adr x2, 2f606 br x26072:608 ldp x29, x30, [sp], #16609 autiasp610 ret611 .size safe_lr_at_function_entry_nocfg, .-safe_lr_at_function_entry_nocfg612 613 .globl lr_is_never_unsafe_before_first_inst_nocfg614 .type lr_is_never_unsafe_before_first_inst_nocfg,@function615// CHECK-NOT: lr_is_never_unsafe_before_first_inst_nocfg616lr_is_never_unsafe_before_first_inst_nocfg:6171:618 // The register state is never reset before the first instruction of619 // the function. This can lead to a known false-negative if LR is620 // clobbered and then a jump to the very first instruction of the621 // function is performed.622 paciasp623 stp x29, x30, [sp, #-16]!624 mov x29, sp625 626 mov x30, x0627 cbz x1, 1b628 629 adr x2, 2f630 br x26312:632 ldp x29, x30, [sp], #16633 autiasp634 ret635 .size lr_is_never_unsafe_before_first_inst_nocfg, .-lr_is_never_unsafe_before_first_inst_nocfg636 637 .globl bad_indirect_call_mem_nocfg638 .type bad_indirect_call_mem_nocfg,@function639bad_indirect_call_mem_nocfg:640// CHECK-LABEL: GS-PAUTH: non-protected call found in function bad_indirect_call_mem_nocfg, at address641// CHECK-NEXT: The instruction is {{[0-9a-f]+}}: blr x16642// CHECK-NEXT: The 1 instructions that write to the affected registers after any authentication are:643// CHECK-NEXT: 1. {{[0-9a-f]+}}: ldr x16, [x0]644 paciasp645 stp x29, x30, [sp, #-16]!646 mov x29, sp647 648 ldr x16, [x0]649 blr x16650 651 adr x2, 1f652 br x26531:654 ldp x29, x30, [sp], #16655 autiasp656 ret657 .size bad_indirect_call_mem_nocfg, .-bad_indirect_call_mem_nocfg658 659 .globl bad_indirect_call_arg_clobber_nocfg660 .type bad_indirect_call_arg_clobber_nocfg,@function661bad_indirect_call_arg_clobber_nocfg:662// CHECK-LABEL: GS-PAUTH: non-protected call found in function bad_indirect_call_arg_clobber_nocfg, at address663// CHECK-NEXT: The instruction is {{[0-9a-f]+}}: blr x0664// CHECK-NEXT: The 1 instructions that write to the affected registers after any authentication are:665// CHECK-NEXT: 1. {{[0-9a-f]+}}: mov w0, w2666 paciasp667 stp x29, x30, [sp, #-16]!668 mov x29, sp669 670 autia x0, x1671 mov w0, w2672 blr x0673 674 adr x2, 1f675 br x26761:677 ldp x29, x30, [sp], #16678 autiasp679 ret680 .size bad_indirect_call_arg_clobber_nocfg, .-bad_indirect_call_arg_clobber_nocfg681 682 .globl bad_indirect_call_mem_clobber_nocfg683 .type bad_indirect_call_mem_clobber_nocfg,@function684bad_indirect_call_mem_clobber_nocfg:685// CHECK-LABEL: GS-PAUTH: non-protected call found in function bad_indirect_call_mem_clobber_nocfg, at address686// CHECK-NEXT: The instruction is {{[0-9a-f]+}}: blr x16687// CHECK-NEXT: The 1 instructions that write to the affected registers after any authentication are:688// CHECK-NEXT: 1. {{[0-9a-f]+}}: mov w16, w2689 paciasp690 stp x29, x30, [sp, #-16]!691 mov x29, sp692 693 ldr x16, [x0]694 autia x16, x0695 mov w16, w2696 blr x16697 698 adr x2, 1f699 br x27001:701 ldp x29, x30, [sp], #16702 autiasp703 ret704 .size bad_indirect_call_mem_clobber_nocfg, .-bad_indirect_call_mem_clobber_nocfg705 706 .globl good_indirect_call_mem_chain_of_auts_nocfg707 .type good_indirect_call_mem_chain_of_auts_nocfg,@function708good_indirect_call_mem_chain_of_auts_nocfg:709// CHECK-NOT: good_indirect_call_mem_chain_of_auts_nocfg710 paciasp711 stp x29, x30, [sp, #-16]!712 mov x29, sp713 714 ldr x16, [x0]715 autda x16, x1716 ldr x16, [x16]717 autia x16, x0718 blr x16719 720 adr x2, 1f721 br x27221:723 ldp x29, x30, [sp], #16724 autiasp725 ret726 .size good_indirect_call_mem_chain_of_auts_nocfg, .-good_indirect_call_mem_chain_of_auts_nocfg727 728 .globl bad_indirect_call_mem_chain_of_auts_nocfg729 .type bad_indirect_call_mem_chain_of_auts_nocfg,@function730bad_indirect_call_mem_chain_of_auts_nocfg:731// CHECK-LABEL: GS-PAUTH: non-protected call found in function bad_indirect_call_mem_chain_of_auts_nocfg, at address732// CHECK-NEXT: The instruction is {{[0-9a-f]+}}: blr x16733// CHECK-NEXT: The 1 instructions that write to the affected registers after any authentication are:734// CHECK-NEXT: 1. {{[0-9a-f]+}}: ldr x16, [x16]735 paciasp736 stp x29, x30, [sp, #-16]!737 mov x29, sp738 739 ldr x16, [x0]740 autda x16, x1741 ldr x16, [x16]742 // Missing AUT of x16. The fact that x16 was authenticated above has nothing to do with it.743 blr x16744 745 adr x2, 1f746 br x27471:748 ldp x29, x30, [sp], #16749 autiasp750 ret751 .size bad_indirect_call_mem_chain_of_auts_nocfg, .-bad_indirect_call_mem_chain_of_auts_nocfg752 753// Test tail calls. To somewhat decrease the number of test cases and not754// duplicate all of the above, only implement "mem" variant of test cases and755// mostly test negative cases.756 757 .globl good_direct_tailcall758 .type good_direct_tailcall,@function759good_direct_tailcall:760// CHECK-NOT: good_direct_tailcall761 b callee762 .size good_direct_tailcall, .-good_direct_tailcall763 764 .globl good_indirect_tailcall_mem765 .type good_indirect_tailcall_mem,@function766good_indirect_tailcall_mem:767// CHECK-NOT: good_indirect_tailcall_mem768 ldr x16, [x0]769 autia x16, x0770 br x16771 .size good_indirect_tailcall_mem, .-good_indirect_tailcall_mem772 773 .globl good_indirect_tailcall_mem_v83774 .type good_indirect_tailcall_mem_v83,@function775good_indirect_tailcall_mem_v83:776// CHECK-NOT: good_indirect_tailcall_mem_v83777 ldr x16, [x0]778 braa x16, x0779 .size good_indirect_tailcall_mem_v83, .-good_indirect_tailcall_mem_v83780 781 .globl bad_indirect_tailcall_mem782 .type bad_indirect_tailcall_mem,@function783bad_indirect_tailcall_mem:784// CHECK-LABEL: GS-PAUTH: non-protected call found in function bad_indirect_tailcall_mem, basic block {{[^,]+}}, at address785// CHECK-NEXT: The instruction is {{[0-9a-f]+}}: br x16786// CHECK-NEXT: The 1 instructions that write to the affected registers after any authentication are:787// CHECK-NEXT: 1. {{[0-9a-f]+}}: ldr x16, [x0]788// CHECK-NEXT: This happens in the following basic block:789// CHECK-NEXT: {{[0-9a-f]+}}: ldr x16, [x0]790// CHECK-NEXT: {{[0-9a-f]+}}: br x16791 ldr x16, [x0]792 br x16793 .size bad_indirect_tailcall_mem, .-bad_indirect_tailcall_mem794 795 .globl bad_indirect_tailcall_mem_clobber796 .type bad_indirect_tailcall_mem_clobber,@function797bad_indirect_tailcall_mem_clobber:798// CHECK-LABEL: GS-PAUTH: non-protected call found in function bad_indirect_tailcall_mem_clobber, basic block {{[^,]+}}, at address799// CHECK-NEXT: The instruction is {{[0-9a-f]+}}: br x16800// CHECK-NEXT: The 1 instructions that write to the affected registers after any authentication are:801// CHECK-NEXT: 1. {{[0-9a-f]+}}: mov w16, w2802// CHECK-NEXT: This happens in the following basic block:803// CHECK-NEXT: {{[0-9a-f]+}}: ldr x16, [x0]804// CHECK-NEXT: {{[0-9a-f]+}}: autia x16, x0805// CHECK-NEXT: {{[0-9a-f]+}}: mov w16, w2806// CHECK-NEXT: {{[0-9a-f]+}}: br x16807 ldr x16, [x0]808 autia x16, x0809 mov w16, w2810 br x16811 .size bad_indirect_tailcall_mem_clobber, .-bad_indirect_tailcall_mem_clobber812 813 .globl bad_indirect_tailcall_mem_chain_of_auts814 .type bad_indirect_tailcall_mem_chain_of_auts,@function815bad_indirect_tailcall_mem_chain_of_auts:816// CHECK-LABEL: GS-PAUTH: non-protected call found in function bad_indirect_tailcall_mem_chain_of_auts, basic block {{[^,]+}}, at address817// CHECK-NEXT: The instruction is {{[0-9a-f]+}}: br x16818// CHECK-NEXT: The 1 instructions that write to the affected registers after any authentication are:819// CHECK-NEXT: 1. {{[0-9a-f]+}}: ldr x16, [x16]820// CHECK-NEXT: This happens in the following basic block:821// CHECK-NEXT: {{[0-9a-f]+}}: ldr x16, [x0]822// CHECK-NEXT: {{[0-9a-f]+}}: autda x16, x1823// CHECK-NEXT: {{[0-9a-f]+}}: ldr x16, [x16]824// CHECK-NEXT: {{[0-9a-f]+}}: br x16825 ldr x16, [x0]826 autda x16, x1827 ldr x16, [x16]828 // Missing AUT of x16. The fact that x16 was authenticated above has nothing to do with it.829 br x16830 .size bad_indirect_tailcall_mem_chain_of_auts, .-bad_indirect_tailcall_mem_chain_of_auts831 832 .globl bad_indirect_tailcall_mem_multi_bb833 .type bad_indirect_tailcall_mem_multi_bb,@function834bad_indirect_tailcall_mem_multi_bb:835// CHECK-LABEL: GS-PAUTH: non-protected call found in function bad_indirect_tailcall_mem_multi_bb, basic block {{[^,]+}}, at address836// CHECK-NEXT: The instruction is {{[0-9a-f]+}}: br x16837// CHECK-NEXT: The 1 instructions that write to the affected registers after any authentication are:838// CHECK-NEXT: 1. {{[0-9a-f]+}}: ldr x16, [x0]839 ldr x16, [x0]840 cbz x2, 1f841 autia x16, x18421:843 br x16844 .size bad_indirect_tailcall_mem_multi_bb, .-bad_indirect_tailcall_mem_multi_bb845 846 .globl bad_indirect_tailcall_mem_clobber_multi_bb847 .type bad_indirect_tailcall_mem_clobber_multi_bb,@function848bad_indirect_tailcall_mem_clobber_multi_bb:849// CHECK-LABEL: GS-PAUTH: non-protected call found in function bad_indirect_tailcall_mem_clobber_multi_bb, basic block {{[^,]+}}, at address850// CHECK-NEXT: The instruction is {{[0-9a-f]+}}: br x16851// CHECK-NEXT: The 1 instructions that write to the affected registers after any authentication are:852// CHECK-NEXT: 1. {{[0-9a-f]+}}: mov w16, w2853 ldr x16, [x0]854 autia x16, x0855 cbz x2, 1f856 mov w16, w28571:858 br x16859 .size bad_indirect_tailcall_mem_clobber_multi_bb, .-bad_indirect_tailcall_mem_clobber_multi_bb860 861 .globl good_direct_tailcall_nocfg862 .type good_direct_tailcall_nocfg,@function863good_direct_tailcall_nocfg:864// CHECK-NOT: good_direct_tailcall_nocfg865 adr x2, 1f866 br x28671:868 b callee869 .size good_direct_tailcall_nocfg, .-good_direct_tailcall_nocfg870 871 .globl good_indirect_tailcall_mem_nocfg872 .type good_indirect_tailcall_mem_nocfg,@function873good_indirect_tailcall_mem_nocfg:874// CHECK-NOT: good_indirect_tailcall_mem_nocfg875 adr x2, 1f876 br x28771:878 ldr x16, [x0]879 autia x16, x0880 br x16881 .size good_indirect_tailcall_mem_nocfg, .-good_indirect_tailcall_mem_nocfg882 883 .globl good_indirect_tailcall_mem_v83_nocfg884 .type good_indirect_tailcall_mem_v83_nocfg,@function885good_indirect_tailcall_mem_v83_nocfg:886// CHECK-NOT: good_indirect_tailcall_mem_v83_nocfg887 adr x2, 1f888 br x28891:890 ldr x16, [x0]891 braa x16, x0892 .size good_indirect_tailcall_mem_v83_nocfg, .-good_indirect_tailcall_mem_v83_nocfg893 894 .globl bad_indirect_tailcall_mem_nocfg895 .type bad_indirect_tailcall_mem_nocfg,@function896bad_indirect_tailcall_mem_nocfg:897// CHECK-LABEL: GS-PAUTH: non-protected call found in function bad_indirect_tailcall_mem_nocfg, at address898// CHECK-NEXT: The instruction is {{[0-9a-f]+}}: br x16899// CHECK-NEXT: The 1 instructions that write to the affected registers after any authentication are:900// CHECK-NEXT: 1. {{[0-9a-f]+}}: ldr x16, [x0]901 adr x2, 1f902 br x29031:904 ldr x16, [x0]905 br x16906 .size bad_indirect_tailcall_mem_nocfg, .-bad_indirect_tailcall_mem_nocfg907 908 .globl bad_indirect_tailcall_mem_clobber_nocfg909 .type bad_indirect_tailcall_mem_clobber_nocfg,@function910bad_indirect_tailcall_mem_clobber_nocfg:911// CHECK-LABEL: GS-PAUTH: non-protected call found in function bad_indirect_tailcall_mem_clobber_nocfg, at address912// CHECK-NEXT: The instruction is {{[0-9a-f]+}}: br x16913// CHECK-NEXT: The 1 instructions that write to the affected registers after any authentication are:914// CHECK-NEXT: 1. {{[0-9a-f]+}}: mov w16, w2915 adr x2, 1f916 br x29171:918 ldr x16, [x0]919 autia x16, x0920 mov w16, w2921 br x16922 .size bad_indirect_tailcall_mem_clobber_nocfg, .-bad_indirect_tailcall_mem_clobber_nocfg923 924 .globl bad_indirect_tailcall_mem_chain_of_auts_nocfg925 .type bad_indirect_tailcall_mem_chain_of_auts_nocfg,@function926bad_indirect_tailcall_mem_chain_of_auts_nocfg:927// CHECK-LABEL: GS-PAUTH: non-protected call found in function bad_indirect_tailcall_mem_chain_of_auts_nocfg, at address928// CHECK-NEXT: The instruction is {{[0-9a-f]+}}: br x16929// CHECK-NEXT: The 1 instructions that write to the affected registers after any authentication are:930// CHECK-NEXT: 1. {{[0-9a-f]+}}: ldr x16, [x16]931 adr x2, 1f932 br x29331:934 ldr x16, [x0]935 autda x16, x1936 ldr x16, [x16]937 // Missing AUT of x16. The fact that x16 was authenticated above has nothing to do with it.938 br x16939 .size bad_indirect_tailcall_mem_chain_of_auts_nocfg, .-bad_indirect_tailcall_mem_chain_of_auts_nocfg940 941 .globl state_is_reset_at_branch_destination_nocfg942 .type state_is_reset_at_branch_destination_nocfg,@function943state_is_reset_at_branch_destination_nocfg:944// CHECK-LABEL: GS-PAUTH: non-protected call found in function state_is_reset_at_branch_destination_nocfg, at address945// CHECK-NEXT: The instruction is {{[0-9a-f]+}}: blr x0946// CHECK-NEXT: The 0 instructions that write to the affected registers after any authentication are:947 paciasp948 stp x29, x30, [sp, #-16]!949 mov x29, sp950 951 b 1f952 autia x0, x1 // skipped9531:954 blr x0955 956 adr x2, 2f957 br x29582:959 ldp x29, x30, [sp], #16960 autiasp961 ret962 .size state_is_reset_at_branch_destination_nocfg, .-state_is_reset_at_branch_destination_nocfg963 964// Test that calling a function is considered as invalidating safety of every965// register. Note that we only have to consider "returning" function calls966// (via branch-with-link), but both direct and indirect variants.967// Checking different registers:968// * x2 - function argument969// * x8 - indirect result location970// * x10 - temporary971// * x16 - intra-procedure-call scratch register972// * x18 - platform register973// * x20 - callee-saved register974 975 .globl direct_call_invalidates_safety976 .type direct_call_invalidates_safety,@function977direct_call_invalidates_safety:978// CHECK-LABEL: GS-PAUTH: non-protected call found in function direct_call_invalidates_safety, basic block {{[^,]+}}, at address979// CHECK-NEXT: The instruction is {{[0-9a-f]+}}: blr x2980// CHECK-NEXT: The 1 instructions that write to the affected registers after any authentication are:981// CHECK-NEXT: 1. {{[0-9a-f]+}}: bl callee982// CHECK-LABEL: GS-PAUTH: non-protected call found in function direct_call_invalidates_safety, basic block {{[^,]+}}, at address983// CHECK-NEXT: The instruction is {{[0-9a-f]+}}: blr x8984// CHECK-NEXT: The 1 instructions that write to the affected registers after any authentication are:985// CHECK-NEXT: 1. {{[0-9a-f]+}}: bl callee986// CHECK-LABEL: GS-PAUTH: non-protected call found in function direct_call_invalidates_safety, basic block {{[^,]+}}, at address987// CHECK-NEXT: The instruction is {{[0-9a-f]+}}: blr x10988// CHECK-NEXT: The 1 instructions that write to the affected registers after any authentication are:989// CHECK-NEXT: 1. {{[0-9a-f]+}}: bl callee990// CHECK-LABEL: GS-PAUTH: non-protected call found in function direct_call_invalidates_safety, basic block {{[^,]+}}, at address991// CHECK-NEXT: The instruction is {{[0-9a-f]+}}: blr x16992// CHECK-NEXT: The 1 instructions that write to the affected registers after any authentication are:993// CHECK-NEXT: 1. {{[0-9a-f]+}}: bl callee994// CHECK-LABEL: GS-PAUTH: non-protected call found in function direct_call_invalidates_safety, basic block {{[^,]+}}, at address995// CHECK-NEXT: The instruction is {{[0-9a-f]+}}: blr x18996// CHECK-NEXT: The 1 instructions that write to the affected registers after any authentication are:997// CHECK-NEXT: 1. {{[0-9a-f]+}}: bl callee998// CHECK-LABEL: GS-PAUTH: non-protected call found in function direct_call_invalidates_safety, basic block {{[^,]+}}, at address999// CHECK-NEXT: The instruction is {{[0-9a-f]+}}: blr x201000// CHECK-NEXT: The 1 instructions that write to the affected registers after any authentication are:1001// CHECK-NEXT: 1. {{[0-9a-f]+}}: bl callee1002 paciasp1003 stp x29, x30, [sp, #-16]!1004 mov x29, sp1005 1006 mov x2, x01007 autiza x21008 bl callee1009 blr x21010 1011 mov x8, x01012 autiza x81013 bl callee1014 blr x81015 1016 mov x10, x01017 autiza x101018 bl callee1019 blr x101020 1021 mov x16, x01022 autiza x161023 bl callee1024 blr x161025 1026 mov x18, x01027 autiza x181028 bl callee1029 blr x181030 1031 mov x20, x01032 autiza x201033 bl callee1034 blr x201035 1036 ldp x29, x30, [sp], #161037 autiasp1038 ret1039 .size direct_call_invalidates_safety, .-direct_call_invalidates_safety1040 1041 .globl indirect_call_invalidates_safety1042 .type indirect_call_invalidates_safety,@function1043indirect_call_invalidates_safety:1044// CHECK-LABEL: GS-PAUTH: non-protected call found in function indirect_call_invalidates_safety, basic block {{[^,]+}}, at address1045// CHECK-NEXT: The instruction is {{[0-9a-f]+}}: blr x21046// CHECK-NEXT: The 1 instructions that write to the affected registers after any authentication are:1047// CHECK-NEXT: 1. {{[0-9a-f]+}}: blr x21048// Check that only one error is reported per pair of BLRs.1049// CHECK-NOT: The instruction is {{[0-9a-f]+}}: blr x21050 1051// CHECK-LABEL: GS-PAUTH: non-protected call found in function indirect_call_invalidates_safety, basic block {{[^,]+}}, at address1052// CHECK-NEXT: The instruction is {{[0-9a-f]+}}: blr x81053// CHECK-NEXT: The 1 instructions that write to the affected registers after any authentication are:1054// CHECK-NEXT: 1. {{[0-9a-f]+}}: blr x81055// CHECK-NOT: The instruction is {{[0-9a-f]+}}: blr x81056 1057// CHECK-LABEL: GS-PAUTH: non-protected call found in function indirect_call_invalidates_safety, basic block {{[^,]+}}, at address1058// CHECK-NEXT: The instruction is {{[0-9a-f]+}}: blr x101059// CHECK-NEXT: The 1 instructions that write to the affected registers after any authentication are:1060// CHECK-NEXT: 1. {{[0-9a-f]+}}: blr x101061// CHECK-NOT: The instruction is {{[0-9a-f]+}}: blr x101062 1063// CHECK-LABEL: GS-PAUTH: non-protected call found in function indirect_call_invalidates_safety, basic block {{[^,]+}}, at address1064// CHECK-NEXT: The instruction is {{[0-9a-f]+}}: blr x161065// CHECK-NEXT: The 1 instructions that write to the affected registers after any authentication are:1066// CHECK-NEXT: 1. {{[0-9a-f]+}}: blr x161067// CHECK-NOT: The instruction is {{[0-9a-f]+}}: blr x161068 1069// CHECK-LABEL: GS-PAUTH: non-protected call found in function indirect_call_invalidates_safety, basic block {{[^,]+}}, at address1070// CHECK-NEXT: The instruction is {{[0-9a-f]+}}: blr x181071// CHECK-NEXT: The 1 instructions that write to the affected registers after any authentication are:1072// CHECK-NEXT: 1. {{[0-9a-f]+}}: blr x181073// CHECK-NOT: The instruction is {{[0-9a-f]+}}: blr x181074 1075// CHECK-LABEL: GS-PAUTH: non-protected call found in function indirect_call_invalidates_safety, basic block {{[^,]+}}, at address1076// CHECK-NEXT: The instruction is {{[0-9a-f]+}}: blr x201077// CHECK-NEXT: The 1 instructions that write to the affected registers after any authentication are:1078// CHECK-NEXT: 1. {{[0-9a-f]+}}: blr x201079// CHECK-NOT: The instruction is {{[0-9a-f]+}}: blr x201080 paciasp1081 stp x29, x30, [sp, #-16]!1082 mov x29, sp1083 1084 mov x2, x01085 autiza x21086 blr x2 // protected call, but makes x2 unsafe1087 blr x2 // unprotected call1088 1089 mov x8, x01090 autiza x81091 blr x8 // protected call, but makes x8 unsafe1092 blr x8 // unprotected call1093 1094 mov x10, x01095 autiza x101096 blr x10 // protected call, but makes x10 unsafe1097 blr x10 // unprotected call1098 1099 mov x16, x01100 autiza x161101 blr x16 // protected call, but makes x16 unsafe1102 blr x16 // unprotected call1103 1104 mov x18, x01105 autiza x181106 blr x18 // protected call, but makes x18 unsafe1107 blr x18 // unprotected call1108 1109 mov x20, x01110 autiza x201111 blr x20 // protected call, but makes x20 unsafe1112 blr x20 // unprotected call1113 1114 ldp x29, x30, [sp], #161115 autiasp1116 ret1117 .size indirect_call_invalidates_safety, .-indirect_call_invalidates_safety1118 1119 .globl direct_call_invalidates_safety_nocfg1120 .type direct_call_invalidates_safety_nocfg,@function1121direct_call_invalidates_safety_nocfg:1122// CHECK-LABEL: GS-PAUTH: non-protected call found in function direct_call_invalidates_safety_nocfg, at address1123// CHECK-NEXT: The instruction is {{[0-9a-f]+}}: blr x21124// CHECK-NEXT: The 1 instructions that write to the affected registers after any authentication are:1125// CHECK-NEXT: 1. {{[0-9a-f]+}}: bl callee1126// CHECK-LABEL: GS-PAUTH: non-protected call found in function direct_call_invalidates_safety_nocfg, at address1127// CHECK-NEXT: The instruction is {{[0-9a-f]+}}: blr x81128// CHECK-NEXT: The 1 instructions that write to the affected registers after any authentication are:1129// CHECK-NEXT: 1. {{[0-9a-f]+}}: bl callee1130// CHECK-LABEL: GS-PAUTH: non-protected call found in function direct_call_invalidates_safety_nocfg, at address1131// CHECK-NEXT: The instruction is {{[0-9a-f]+}}: blr x101132// CHECK-NEXT: The 1 instructions that write to the affected registers after any authentication are:1133// CHECK-NEXT: 1. {{[0-9a-f]+}}: bl callee1134// CHECK-LABEL: GS-PAUTH: non-protected call found in function direct_call_invalidates_safety_nocfg, at address1135// CHECK-NEXT: The instruction is {{[0-9a-f]+}}: blr x161136// CHECK-NEXT: The 1 instructions that write to the affected registers after any authentication are:1137// CHECK-NEXT: 1. {{[0-9a-f]+}}: bl callee1138// CHECK-LABEL: GS-PAUTH: non-protected call found in function direct_call_invalidates_safety_nocfg, at address1139// CHECK-NEXT: The instruction is {{[0-9a-f]+}}: blr x181140// CHECK-NEXT: The 1 instructions that write to the affected registers after any authentication are:1141// CHECK-NEXT: 1. {{[0-9a-f]+}}: bl callee1142// CHECK-LABEL: GS-PAUTH: non-protected call found in function direct_call_invalidates_safety_nocfg, at address1143// CHECK-NEXT: The instruction is {{[0-9a-f]+}}: blr x201144// CHECK-NEXT: The 1 instructions that write to the affected registers after any authentication are:1145// CHECK-NEXT: 1. {{[0-9a-f]+}}: bl callee1146 paciasp1147 stp x29, x30, [sp, #-16]!1148 mov x29, sp1149 1150 mov x2, x01151 autiza x21152 bl callee1153 blr x21154 1155 mov x8, x01156 autiza x81157 bl callee1158 blr x81159 1160 mov x10, x01161 autiza x101162 bl callee1163 blr x101164 1165 mov x16, x01166 autiza x161167 bl callee1168 blr x161169 1170 mov x18, x01171 autiza x181172 bl callee1173 blr x181174 1175 mov x20, x01176 autiza x201177 bl callee1178 blr x201179 1180 adr x2, 1f1181 br x211821:1183 ldp x29, x30, [sp], #161184 autiasp1185 ret1186 .size direct_call_invalidates_safety_nocfg, .-direct_call_invalidates_safety_nocfg1187 1188 .globl indirect_call_invalidates_safety_nocfg1189 .type indirect_call_invalidates_safety_nocfg,@function1190indirect_call_invalidates_safety_nocfg:1191// CHECK-LABEL: GS-PAUTH: non-protected call found in function indirect_call_invalidates_safety_nocfg, at address1192// CHECK-NEXT: The instruction is {{[0-9a-f]+}}: blr x21193// CHECK-NEXT: The 1 instructions that write to the affected registers after any authentication are:1194// CHECK-NEXT: 1. {{[0-9a-f]+}}: blr x21195// Check that only one error is reported per pair of BLRs.1196// CHECK-NOT: The instruction is {{[0-9a-f]+}}: blr x21197 1198// CHECK-LABEL: GS-PAUTH: non-protected call found in function indirect_call_invalidates_safety_nocfg, at address1199// CHECK-NEXT: The instruction is {{[0-9a-f]+}}: blr x81200// CHECK-NEXT: The 1 instructions that write to the affected registers after any authentication are:1201// CHECK-NEXT: 1. {{[0-9a-f]+}}: blr x81202// CHECK-NOT: The instruction is {{[0-9a-f]+}}: blr x81203 1204// CHECK-LABEL: GS-PAUTH: non-protected call found in function indirect_call_invalidates_safety_nocfg, at address1205// CHECK-NEXT: The instruction is {{[0-9a-f]+}}: blr x101206// CHECK-NEXT: The 1 instructions that write to the affected registers after any authentication are:1207// CHECK-NEXT: 1. {{[0-9a-f]+}}: blr x101208// CHECK-NOT: The instruction is {{[0-9a-f]+}}: blr x101209 1210// CHECK-LABEL: GS-PAUTH: non-protected call found in function indirect_call_invalidates_safety_nocfg, at address1211// CHECK-NEXT: The instruction is {{[0-9a-f]+}}: blr x161212// CHECK-NEXT: The 1 instructions that write to the affected registers after any authentication are:1213// CHECK-NEXT: 1. {{[0-9a-f]+}}: blr x161214// CHECK-NOT: The instruction is {{[0-9a-f]+}}: blr x161215 1216// CHECK-LABEL: GS-PAUTH: non-protected call found in function indirect_call_invalidates_safety_nocfg, at address1217// CHECK-NEXT: The instruction is {{[0-9a-f]+}}: blr x181218// CHECK-NEXT: The 1 instructions that write to the affected registers after any authentication are:1219// CHECK-NEXT: 1. {{[0-9a-f]+}}: blr x181220// CHECK-NOT: The instruction is {{[0-9a-f]+}}: blr x181221 1222// CHECK-LABEL: GS-PAUTH: non-protected call found in function indirect_call_invalidates_safety_nocfg, at address1223// CHECK-NEXT: The instruction is {{[0-9a-f]+}}: blr x201224// CHECK-NEXT: The 1 instructions that write to the affected registers after any authentication are:1225// CHECK-NEXT: 1. {{[0-9a-f]+}}: blr x201226// CHECK-NOT: The instruction is {{[0-9a-f]+}}: blr x201227 paciasp1228 stp x29, x30, [sp, #-16]!1229 mov x29, sp1230 1231 mov x2, x01232 autiza x21233 blr x2 // protected call, but makes x2 unsafe1234 blr x2 // unprotected call1235 1236 mov x8, x01237 autiza x81238 blr x8 // protected call, but makes x8 unsafe1239 blr x8 // unprotected call1240 1241 mov x10, x01242 autiza x101243 blr x10 // protected call, but makes x10 unsafe1244 blr x10 // unprotected call1245 1246 mov x16, x01247 autiza x161248 blr x16 // protected call, but makes x16 unsafe1249 blr x16 // unprotected call1250 1251 mov x18, x01252 autiza x181253 blr x18 // protected call, but makes x18 unsafe1254 blr x18 // unprotected call1255 1256 mov x20, x01257 autiza x201258 blr x20 // protected call, but makes x20 unsafe1259 blr x20 // unprotected call1260 1261 adr x2, 1f1262 br x212631:1264 ldp x29, x30, [sp], #161265 autiasp1266 ret1267 .size indirect_call_invalidates_safety_nocfg, .-indirect_call_invalidates_safety_nocfg1268 1269// Test that fused auth+use Armv8.3 instruction do not mark register as safe.1270 1271 .globl blraa_no_mark_safe1272 .type blraa_no_mark_safe,@function1273blraa_no_mark_safe:1274// CHECK-LABEL: GS-PAUTH: non-protected call found in function blraa_no_mark_safe, basic block {{[^,]+}}, at address1275// CHECK-NEXT: The instruction is {{[0-9a-f]+}}: blr x01276// CHECK-NEXT: The 1 instructions that write to the affected registers after any authentication are:1277// CHECK-NEXT: 1. {{[0-9a-f]+}}: blraa x0, x11278// CHECK-NEXT: This happens in the following basic block:1279// CHECK-NEXT: {{[0-9a-f]+}}: paciasp1280// CHECK-NEXT: {{[0-9a-f]+}}: stp x29, x30, [sp, #-0x10]!1281// CHECK-NEXT: {{[0-9a-f]+}}: mov x29, sp1282// CHECK-NEXT: {{[0-9a-f]+}}: blraa x0, x11283// CHECK-NEXT: {{[0-9a-f]+}}: blr x01284// CHECK-NEXT: {{[0-9a-f]+}}: ldp x29, x30, [sp], #0x101285// CHECK-NEXT: {{[0-9a-f]+}}: autiasp1286// CHECK-NEXT: {{[0-9a-f]+}}: ret1287 paciasp1288 stp x29, x30, [sp, #-16]!1289 mov x29, sp1290 1291 blraa x0, x1 // safe, no write-back, clobbers everything1292 blr x0 // unsafe1293 1294 ldp x29, x30, [sp], #161295 autiasp1296 ret1297 .size blraa_no_mark_safe, .-blraa_no_mark_safe1298 1299 .globl blraa_no_mark_safe_nocfg1300 .type blraa_no_mark_safe_nocfg,@function1301blraa_no_mark_safe_nocfg:1302// CHECK-LABEL: GS-PAUTH: non-protected call found in function blraa_no_mark_safe_nocfg, at address1303// CHECK-NEXT: The instruction is {{[0-9a-f]+}}: blr x01304// CHECK-NEXT: The 1 instructions that write to the affected registers after any authentication are:1305// CHECK-NEXT: 1. {{[0-9a-f]+}}: blraa x0, x11306 paciasp1307 stp x29, x30, [sp, #-16]!1308 mov x29, sp1309 1310 blraa x0, x1 // safe, no write-back, clobbers everything1311 blr x0 // detected as unsafe1312 1313 adr x2, 1f1314 br x213151:1316 ldp x29, x30, [sp], #161317 autiasp1318 ret1319 .size blraa_no_mark_safe_nocfg, .-blraa_no_mark_safe_nocfg1320 1321// Check that the correct set of registers is used to compute the set of last1322// writing instructions: both x16 and x17 are tracked in this function, but1323// only one particular register is used to compute the set of clobbering1324// instructions in each report.1325 1326 .globl last_insts_writing_to_reg1327 .type last_insts_writing_to_reg,@function1328last_insts_writing_to_reg:1329// CHECK-LABEL: GS-PAUTH: non-protected call found in function last_insts_writing_to_reg, basic block {{[^,]+}}, at address1330// CHECK-NEXT: The instruction is {{[0-9a-f]+}}: blr x161331// CHECK-NEXT: The 1 instructions that write to the affected registers after any authentication are:1332// CHECK-NEXT: 1. {{[0-9a-f]+}}: ldr x16, [x0]1333// CHECK-NEXT: This happens in the following basic block:1334// CHECK-NEXT: {{[0-9a-f]+}}: paciasp1335// CHECK-NEXT: {{[0-9a-f]+}}: stp x29, x30, [sp, #-0x10]!1336// CHECK-NEXT: {{[0-9a-f]+}}: mov x29, sp1337// CHECK-NEXT: {{[0-9a-f]+}}: ldr x16, [x0]1338// CHECK-NEXT: {{[0-9a-f]+}}: blr x161339// CHECK-NEXT: {{[0-9a-f]+}}: ldr x17, [x1]1340// CHECK-NEXT: {{[0-9a-f]+}}: blr x171341// CHECK-NEXT: {{[0-9a-f]+}}: ldp x29, x30, [sp], #0x101342// CHECK-NEXT: {{[0-9a-f]+}}: autiasp1343// CHECK-NEXT: {{[0-9a-f]+}}: ret1344// CHECK-LABEL: GS-PAUTH: non-protected call found in function last_insts_writing_to_reg, basic block {{[^,]+}}, at address1345// CHECK-NEXT: The instruction is {{[0-9a-f]+}}: blr x171346// CHECK-NEXT: The 1 instructions that write to the affected registers after any authentication are:1347// CHECK-NEXT: 1. {{[0-9a-f]+}}: ldr x17, [x1]1348// CHECK-NEXT: This happens in the following basic block:1349// CHECK-NEXT: {{[0-9a-f]+}}: paciasp1350// CHECK-NEXT: {{[0-9a-f]+}}: stp x29, x30, [sp, #-0x10]!1351// CHECK-NEXT: {{[0-9a-f]+}}: mov x29, sp1352// CHECK-NEXT: {{[0-9a-f]+}}: ldr x16, [x0]1353// CHECK-NEXT: {{[0-9a-f]+}}: blr x161354// CHECK-NEXT: {{[0-9a-f]+}}: ldr x17, [x1]1355// CHECK-NEXT: {{[0-9a-f]+}}: blr x171356// CHECK-NEXT: {{[0-9a-f]+}}: ldp x29, x30, [sp], #0x101357// CHECK-NEXT: {{[0-9a-f]+}}: autiasp1358// CHECK-NEXT: {{[0-9a-f]+}}: ret1359 paciasp1360 stp x29, x30, [sp, #-16]!1361 mov x29, sp1362 1363 ldr x16, [x0]1364 blr x161365 ldr x17, [x1]1366 blr x171367 1368 ldp x29, x30, [sp], #161369 autiasp1370 ret1371 .size last_insts_writing_to_reg, .-last_insts_writing_to_reg1372 1373 .globl last_insts_writing_to_reg_nocfg1374 .type last_insts_writing_to_reg_nocfg,@function1375last_insts_writing_to_reg_nocfg:1376// CHECK-LABEL: GS-PAUTH: non-protected call found in function last_insts_writing_to_reg_nocfg, at address1377// CHECK-NEXT: The instruction is {{[0-9a-f]+}}: blr x161378// CHECK-NEXT: The 1 instructions that write to the affected registers after any authentication are:1379// CHECK-NEXT: 1. {{[0-9a-f]+}}: ldr x16, [x0]1380// CHECK-LABEL: GS-PAUTH: non-protected call found in function last_insts_writing_to_reg_nocfg, at address1381// CHECK-NEXT: The instruction is {{[0-9a-f]+}}: blr x171382// CHECK-NEXT: The 1 instructions that write to the affected registers after any authentication are:1383// CHECK-NEXT: 1. {{[0-9a-f]+}}: ldr x17, [x1]1384 paciasp1385 stp x29, x30, [sp, #-16]!1386 mov x29, sp1387 1388 ldr x16, [x0]1389 blr x161390 ldr x17, [x1]1391 blr x171392 1393 adr x2, 1f1394 br x213951:1396 ldp x29, x30, [sp], #161397 autiasp1398 ret1399 .size last_insts_writing_to_reg_nocfg, .-last_insts_writing_to_reg_nocfg1400 1401// Test that the instructions reported to the user are not cluttered with1402// annotations attached by data-flow analysis or its CFG-unaware counterpart.1403 1404 .globl printed_instrs_dataflow1405 .type printed_instrs_dataflow,@function1406printed_instrs_dataflow:1407// CHECK-LABEL: GS-PAUTH: non-protected call found in function printed_instrs_dataflow, basic block {{[^,]+}}, at address1408// CHECK-NEXT: The instruction is {{[0-9a-f]+}}: br x0 # TAILCALL{{ *$}}1409// CHECK-NEXT: The 1 instructions that write to the affected registers after any authentication are:1410// CHECK-NEXT: 1. {{[0-9a-f]+}}: ldr x0, [x0]{{ *$}}1411// CHECK-NEXT: This happens in the following basic block:1412// CHECK-NEXT: {{[0-9a-f]+}}: ldr x0, [x0]{{ *$}}1413// CHECK-NEXT: {{[0-9a-f]+}}: br x0 # TAILCALL{{ *$}}1414 ldr x0, [x0]1415 br x01416 .size printed_instrs_dataflow, .-printed_instrs_dataflow1417 1418 .globl printed_instrs_nocfg1419 .type printed_instrs_nocfg,@function1420printed_instrs_nocfg:1421// CHECK-LABEL: GS-PAUTH: non-protected call found in function printed_instrs_nocfg, at address1422// CHECK-NEXT: The instruction is {{[0-9a-f]+}}: br x0 # UNKNOWN CONTROL FLOW # Offset: 12{{ *$}}1423// CHECK-NEXT: The 1 instructions that write to the affected registers after any authentication are:1424// CHECK-NEXT: 1. {{[0-9a-f]+}}: ldr x0, [x0]{{ *$}}1425 adr x2, 1f1426 br x214271:1428 ldr x0, [x0]1429 br x01430 .size printed_instrs_nocfg, .-printed_instrs_nocfg1431 1432// Test handling of unreachable basic blocks.1433//1434// Basic blocks without any predecessors were observed in real-world optimized1435// code. At least sometimes they were actually reachable via jump table, which1436// was not detected, but the function was processed as if its CFG was1437// reconstructed successfully.1438//1439// As a more predictable model example, let's use really unreachable code1440// for testing.1441 1442 .globl bad_unreachable_call1443 .type bad_unreachable_call,@function1444bad_unreachable_call:1445// CHECK-LABEL: GS-PAUTH: Warning: possibly imprecise CFG, the analysis quality may be degraded in this function. According to BOLT, unreachable code is found in function bad_unreachable_call, basic block {{[^,]+}}, at address1446// CHECK-NEXT: The instruction is {{[0-9a-f]+}}: blr x01447// CHECK-NOT: instructions that write to the affected registers after any authentication are:1448// CHECK-LABEL: GS-PAUTH: non-protected call found in function bad_unreachable_call, basic block {{[^,]+}}, at address1449// CHECK-NEXT: The instruction is {{[0-9a-f]+}}: blr x01450// CHECK-NEXT: The 0 instructions that write to the affected registers after any authentication are:1451 paciasp1452 stp x29, x30, [sp, #-16]!1453 mov x29, sp1454 1455 b 1f1456 // unreachable basic block:1457 blr x01458 14591: // reachable basic block:1460 ldp x29, x30, [sp], #161461 autiasp1462 ret1463 .size bad_unreachable_call, .-bad_unreachable_call1464 1465 .globl good_unreachable_call1466 .type good_unreachable_call,@function1467good_unreachable_call:1468// CHECK-NOT: non-protected call{{.*}}good_unreachable_call1469// CHECK-LABEL: GS-PAUTH: Warning: possibly imprecise CFG, the analysis quality may be degraded in this function. According to BOLT, unreachable code is found in function good_unreachable_call, basic block {{[^,]+}}, at address1470// CHECK-NEXT: The instruction is {{[0-9a-f]+}}: autia x0, x11471// CHECK-NOT: instructions that write to the affected registers after any authentication are:1472// CHECK-NOT: non-protected call{{.*}}good_unreachable_call1473 paciasp1474 stp x29, x30, [sp, #-16]!1475 mov x29, sp1476 1477 b 1f1478 // unreachable basic block:1479 autia x0, x11480 blr x0 // <-- this call is definitely protected provided at least1481 // basic block boundaries are detected correctly1482 14831: // reachable basic block:1484 ldp x29, x30, [sp], #161485 autiasp1486 ret1487 .size good_unreachable_call, .-good_unreachable_call1488 1489 .globl unreachable_loop_of_bbs1490 .type unreachable_loop_of_bbs,@function1491unreachable_loop_of_bbs:1492// CHECK-NOT: unreachable basic blocks{{.*}}unreachable_loop_of_bbs1493// CHECK-NOT: non-protected call{{.*}}unreachable_loop_of_bbs1494// CHECK-LABEL: GS-PAUTH: Warning: possibly imprecise CFG, the analysis quality may be degraded in this function. According to BOLT, unreachable code is found in function unreachable_loop_of_bbs, basic block {{[^,]+}}, at address1495// CHECK-NEXT: The instruction is {{[0-9a-f]+}}: blr x01496// CHECK-NOT: unreachable basic blocks{{.*}}unreachable_loop_of_bbs1497// CHECK-NOT: non-protected call{{.*}}unreachable_loop_of_bbs1498 paciasp1499 stp x29, x30, [sp, #-16]!1500 mov x29, sp1501 b .Lreachable_epilogue_bb1502 1503.Lfirst_unreachable_bb:1504 blr x0 // <-- this call is not analyzed1505 b .Lsecond_unreachable_bb1506.Lsecond_unreachable_bb:1507 blr x1 // <-- this call is not analyzed1508 b .Lfirst_unreachable_bb1509 1510.Lreachable_epilogue_bb:1511 ldp x29, x30, [sp], #161512 autiasp1513 ret1514 .size unreachable_loop_of_bbs, .-unreachable_loop_of_bbs1515 1516 .globl main1517 .type main,@function1518main:1519 mov x0, 01520 ret1521 .size main, .-main1522