375 lines · plain
1// REQUIRES: asserts2//3// RUN: %clang %cflags -march=armv8.3-a %s -o %t.exe4// RUN: llvm-bolt-binary-analysis --scanners=pacret --no-threads \5// RUN: -debug-only bolt-pauth-scanner %t.exe 2>&1 | FileCheck -check-prefixes=CHECK,NOFPAC %s6// RUN: llvm-bolt-binary-analysis --scanners=pacret --no-threads --auth-traps-on-failure \7// RUN: -debug-only bolt-pauth-scanner %t.exe 2>&1 | FileCheck -check-prefixes=CHECK,FPAC %s8// RUN: llvm-bolt-binary-analysis --scanners=pauth --no-threads \9// RUN: -debug-only bolt-pauth-scanner %t.exe 2>&1 | FileCheck -check-prefixes=CHECK,NOFPAC,AUTH-ORACLES,PAUTH %s10// RUN: llvm-bolt-binary-analysis --scanners=pauth --no-threads --auth-traps-on-failure \11// RUN: -debug-only bolt-pauth-scanner %t.exe 2>&1 | FileCheck -check-prefixes=CHECK,FPAC,PAUTH %s12 13// Check the debug output generated by PAuth gadget scanner to make sure the14// that output is kept meaningful and to provide an overview of what happens15// inside the scanner.16 17 .globl simple18 .type simple,@function19simple:20 paciasp21 stp x29, x30, [sp, #-0x10]!22 b 1f231:24 autiza x025 blr x026 ldp x29, x30, [sp], #0x1027 autiasp28 ret29 .size simple, .-simple30 31// CHECK-LABEL:Analyzing function simple, AllocatorId = 132// CHECK-NEXT: Binary Function "simple" {33// CHECK-NEXT: Number : 134// CHECK-NEXT: State : CFG constructed35// ...36// CHECK: BB Layout : [[BB0:[0-9a-zA-Z.]+]], [[BB1:[0-9a-zA-Z.]+]]37// CHECK-NEXT: }38// CHECK-NEXT: [[BB0]] (3 instructions, align : 1)39// CHECK-NEXT: Entry Point40// CHECK-NEXT: 00000000: paciasp41// CHECK-NEXT: 00000004: stp x29, x30, [sp, #-0x10]!42// CHECK-NEXT: 00000008: b [[BB1]]43// CHECK-NEXT: Successors: [[BB1]]44// CHECK-EMPTY:45// CHECK-NEXT: [[BB1]] (5 instructions, align : 1)46// CHECK-NEXT: Predecessors: [[BB0]]47// CHECK-NEXT: 0000000c: autiza x048// CHECK-NEXT: 00000010: blr x049// CHECK-NEXT: 00000014: ldp x29, x30, [sp], #0x1050// CHECK-NEXT: 00000018: autiasp51// CHECK-NEXT: 0000001c: ret52// CHECK-EMPTY:53// CHECK-NEXT: DWARF CFI Instructions:54// CHECK-NEXT: <empty>55// CHECK-NEXT: End of Function "simple"56// CHECK-EMPTY:57// CHECK-NEXT: Running src register safety analysis...58// CHECK-NEXT: SrcSafetyAnalysis::ComputeNext( hint #25, src-state<SafeToDerefRegs: LR W30 W30_HI , TrustedRegs: LR W30 W30_HI , Insts: >)59// CHECK-NEXT: .. result: (src-state<SafeToDerefRegs: , TrustedRegs: , Insts: >)60// CHECK-NEXT: SrcSafetyAnalysis::ComputeNext( stp x29, x30, [sp, #-0x10]!, src-state<SafeToDerefRegs: , TrustedRegs: , Insts: >)61// CHECK-NEXT: .. result: (src-state<SafeToDerefRegs: , TrustedRegs: , Insts: >)62// CHECK-NEXT: SrcSafetyAnalysis::ComputeNext( b [[BB1]], src-state<SafeToDerefRegs: , TrustedRegs: , Insts: >)63// CHECK-NEXT: .. result: (src-state<SafeToDerefRegs: , TrustedRegs: , Insts: >)64// CHECK-NEXT: DataflowSrcSafetyAnalysis::Confluence(65// CHECK-NEXT: State 1: src-state<empty>66// CHECK-NEXT: State 2: src-state<SafeToDerefRegs: , TrustedRegs: , Insts: >)67// CHECK-NEXT: merged state: src-state<SafeToDerefRegs: , TrustedRegs: , Insts: >68// NOFPAC-NEXT: SrcSafetyAnalysis::ComputeNext( autiza x0, src-state<SafeToDerefRegs: , TrustedRegs: , Insts: >)69// NOFPAC-NEXT: .. result: (src-state<SafeToDerefRegs: W0 X0 W0_HI , TrustedRegs: , Insts: >)70// NOFPAC-NEXT: SrcSafetyAnalysis::ComputeNext( blr x0, src-state<SafeToDerefRegs: W0 X0 W0_HI , TrustedRegs: , Insts: >)71// NOFPAC-NEXT: .. result: (src-state<SafeToDerefRegs: , TrustedRegs: , Insts: >)72// NOFPAC-NEXT: SrcSafetyAnalysis::ComputeNext( ldp x29, x30, [sp], #0x10, src-state<SafeToDerefRegs: , TrustedRegs: , Insts: >)73// NOFPAC-NEXT: .. result: (src-state<SafeToDerefRegs: , TrustedRegs: , Insts: >)74// NOFPAC-NEXT: SrcSafetyAnalysis::ComputeNext( hint #29, src-state<SafeToDerefRegs: , TrustedRegs: , Insts: >)75// NOFPAC-NEXT: .. result: (src-state<SafeToDerefRegs: LR W30 W30_HI , TrustedRegs: , Insts: >)76// NOFPAC-NEXT: SrcSafetyAnalysis::ComputeNext( ret x30, src-state<SafeToDerefRegs: LR W30 W30_HI , TrustedRegs: , Insts: >)77// NOFPAC-NEXT: .. result: (src-state<SafeToDerefRegs: LR W30 W30_HI , TrustedRegs: , Insts: >)78// NOFPAC-NEXT: DataflowSrcSafetyAnalysis::Confluence(79// NOFPAC-NEXT: State 1: src-state<SafeToDerefRegs: , TrustedRegs: , Insts: >80// NOFPAC-NEXT: State 2: src-state<SafeToDerefRegs: , TrustedRegs: , Insts: >)81// NOFPAC-NEXT: merged state: src-state<SafeToDerefRegs: , TrustedRegs: , Insts: >82// NOFPAC-NEXT: SrcSafetyAnalysis::ComputeNext( autiza x0, src-state<SafeToDerefRegs: , TrustedRegs: , Insts: >)83// NOFPAC-NEXT: .. result: (src-state<SafeToDerefRegs: W0 X0 W0_HI , TrustedRegs: , Insts: >)84// NOFPAC-NEXT: SrcSafetyAnalysis::ComputeNext( blr x0, src-state<SafeToDerefRegs: W0 X0 W0_HI , TrustedRegs: , Insts: >)85// NOFPAC-NEXT: .. result: (src-state<SafeToDerefRegs: , TrustedRegs: , Insts: >)86// NOFPAC-NEXT: SrcSafetyAnalysis::ComputeNext( ldp x29, x30, [sp], #0x10, src-state<SafeToDerefRegs: , TrustedRegs: , Insts: >)87// NOFPAC-NEXT: .. result: (src-state<SafeToDerefRegs: , TrustedRegs: , Insts: >)88// NOFPAC-NEXT: SrcSafetyAnalysis::ComputeNext( hint #29, src-state<SafeToDerefRegs: , TrustedRegs: , Insts: >)89// NOFPAC-NEXT: .. result: (src-state<SafeToDerefRegs: LR W30 W30_HI , TrustedRegs: , Insts: >)90// NOFPAC-NEXT: SrcSafetyAnalysis::ComputeNext( ret x30, src-state<SafeToDerefRegs: LR W30 W30_HI , TrustedRegs: , Insts: >)91// NOFPAC-NEXT: .. result: (src-state<SafeToDerefRegs: LR W30 W30_HI , TrustedRegs: , Insts: >)92// FPAC-NEXT: SrcSafetyAnalysis::ComputeNext( autiza x0, src-state<SafeToDerefRegs: , TrustedRegs: , Insts: >)93// FPAC-NEXT: .. result: (src-state<SafeToDerefRegs: W0 X0 W0_HI , TrustedRegs: W0 X0 W0_HI , Insts: >)94// FPAC-NEXT: SrcSafetyAnalysis::ComputeNext( blr x0, src-state<SafeToDerefRegs: W0 X0 W0_HI , TrustedRegs: W0 X0 W0_HI , Insts: >)95// FPAC-NEXT: .. result: (src-state<SafeToDerefRegs: , TrustedRegs: , Insts: >)96// FPAC-NEXT: SrcSafetyAnalysis::ComputeNext( ldp x29, x30, [sp], #0x10, src-state<SafeToDerefRegs: , TrustedRegs: , Insts: >)97// FPAC-NEXT: .. result: (src-state<SafeToDerefRegs: , TrustedRegs: , Insts: >)98// FPAC-NEXT: SrcSafetyAnalysis::ComputeNext( hint #29, src-state<SafeToDerefRegs: , TrustedRegs: , Insts: >)99// FPAC-NEXT: .. result: (src-state<SafeToDerefRegs: LR W30 W30_HI , TrustedRegs: LR W30 W30_HI , Insts: >)100// FPAC-NEXT: SrcSafetyAnalysis::ComputeNext( ret x30, src-state<SafeToDerefRegs: LR W30 W30_HI , TrustedRegs: LR W30 W30_HI , Insts: >)101// FPAC-NEXT: .. result: (src-state<SafeToDerefRegs: LR W30 W30_HI , TrustedRegs: LR W30 W30_HI , Insts: >)102// FPAC-NEXT: DataflowSrcSafetyAnalysis::Confluence(103// FPAC-NEXT: State 1: src-state<SafeToDerefRegs: , TrustedRegs: , Insts: >104// FPAC-NEXT: State 2: src-state<SafeToDerefRegs: , TrustedRegs: , Insts: >)105// FPAC-NEXT: merged state: src-state<SafeToDerefRegs: , TrustedRegs: , Insts: >106// FPAC-NEXT: SrcSafetyAnalysis::ComputeNext( autiza x0, src-state<SafeToDerefRegs: , TrustedRegs: , Insts: >)107// FPAC-NEXT: .. result: (src-state<SafeToDerefRegs: W0 X0 W0_HI , TrustedRegs: W0 X0 W0_HI , Insts: >)108// FPAC-NEXT: SrcSafetyAnalysis::ComputeNext( blr x0, src-state<SafeToDerefRegs: W0 X0 W0_HI , TrustedRegs: W0 X0 W0_HI , Insts: >)109// FPAC-NEXT: .. result: (src-state<SafeToDerefRegs: , TrustedRegs: , Insts: >)110// FPAC-NEXT: SrcSafetyAnalysis::ComputeNext( ldp x29, x30, [sp], #0x10, src-state<SafeToDerefRegs: , TrustedRegs: , Insts: >)111// FPAC-NEXT: .. result: (src-state<SafeToDerefRegs: , TrustedRegs: , Insts: >)112// FPAC-NEXT: SrcSafetyAnalysis::ComputeNext( hint #29, src-state<SafeToDerefRegs: , TrustedRegs: , Insts: >)113// FPAC-NEXT: .. result: (src-state<SafeToDerefRegs: LR W30 W30_HI , TrustedRegs: LR W30 W30_HI , Insts: >)114// FPAC-NEXT: SrcSafetyAnalysis::ComputeNext( ret x30, src-state<SafeToDerefRegs: LR W30 W30_HI , TrustedRegs: LR W30 W30_HI , Insts: >)115// FPAC-NEXT: .. result: (src-state<SafeToDerefRegs: LR W30 W30_HI , TrustedRegs: LR W30 W30_HI , Insts: >)116// CHECK-NEXT: After src register safety analysis:117// CHECK-NEXT: Binary Function "simple" {118// CHECK-NEXT: Number : 1119// CHECK-NEXT: State : CFG constructed120// ...121// CHECK: BB Layout : [[BB0]], [[BB1]]122// CHECK-NEXT: }123// CHECK-NEXT: [[BB0]] (3 instructions, align : 1)124// CHECK-NEXT: Entry Point125// CHECK-NEXT: 00000000: paciasp # DataflowSrcSafetyAnalysis: src-state<SafeToDerefRegs: BitVector, TrustedRegs: BitVector, Insts: >126// CHECK-NEXT: 00000004: stp x29, x30, [sp, #-0x10]! # DataflowSrcSafetyAnalysis: src-state<SafeToDerefRegs: BitVector, TrustedRegs: BitVector, Insts: >127// CHECK-NEXT: 00000008: b [[BB1]] # DataflowSrcSafetyAnalysis: src-state<SafeToDerefRegs: BitVector, TrustedRegs: BitVector, Insts: >128// CHECK-NEXT: Successors: [[BB1]]129// CHECK-EMPTY:130// CHECK-NEXT: [[BB1]] (5 instructions, align : 1)131// CHECK-NEXT: Predecessors: [[BB0]]132// CHECK-NEXT: 0000000c: autiza x0 # DataflowSrcSafetyAnalysis: src-state<SafeToDerefRegs: BitVector, TrustedRegs: BitVector, Insts: >133// CHECK-NEXT: 00000010: blr x0 # DataflowSrcSafetyAnalysis: src-state<SafeToDerefRegs: BitVector, TrustedRegs: BitVector, Insts: >134// CHECK-NEXT: 00000014: ldp x29, x30, [sp], #0x10 # DataflowSrcSafetyAnalysis: src-state<SafeToDerefRegs: BitVector, TrustedRegs: BitVector, Insts: >135// CHECK-NEXT: 00000018: autiasp # DataflowSrcSafetyAnalysis: src-state<SafeToDerefRegs: BitVector, TrustedRegs: BitVector, Insts: >136// CHECK-NEXT: 0000001c: ret # DataflowSrcSafetyAnalysis: src-state<SafeToDerefRegs: BitVector, TrustedRegs: BitVector, Insts: >137// CHECK-EMPTY:138// CHECK-NEXT: DWARF CFI Instructions:139// CHECK-NEXT: <empty>140// CHECK-NEXT: End of Function "simple"141// CHECK-EMPTY:142// PAUTH-NEXT: Found sign inst: 00000000: paciasp # DataflowSrcSafetyAnalysis: src-state<SafeToDerefRegs: BitVector, TrustedRegs: BitVector, Insts: >143// PAUTH-NEXT: Signed reg: LR144// PAUTH-NEXT: TrustedRegs: LR W30 W30_HI{{[ \t]*$}}145// PAUTH-NEXT: Found call inst: 00000000: blr x0 # DataflowSrcSafetyAnalysis: src-state<SafeToDerefRegs: BitVector, TrustedRegs: BitVector, Insts: >146// PAUTH-NEXT: Call destination reg: X0147// PAUTH-NEXT: SafeToDerefRegs: W0 X0 W0_HI{{[ \t]*$}}148// CHECK-NEXT: Found RET inst: 00000000: ret # DataflowSrcSafetyAnalysis: src-state<SafeToDerefRegs: BitVector, TrustedRegs: BitVector, Insts: >149// CHECK-NEXT: RetReg: LR150// CHECK-NEXT: SafeToDerefRegs: LR W30 W30_HI{{[ \t]*$}}151 152 .globl clobber153 .type clobber,@function154clobber:155 mov w30, #0156 ret157 .size clobber, .-clobber158 159// CHECK-LABEL:Analyzing function clobber, AllocatorId = 1160// ...161// CHECK: Running src register safety analysis...162// CHECK-NEXT: SrcSafetyAnalysis::ComputeNext( mov w30, #0x0, src-state<SafeToDerefRegs: LR W30 W30_HI , TrustedRegs: LR W30 W30_HI , Insts: >)163// CHECK-NEXT: .. result: (src-state<SafeToDerefRegs: W30_HI , TrustedRegs: W30_HI , Insts: >)164// CHECK-NEXT: SrcSafetyAnalysis::ComputeNext( ret x30, src-state<SafeToDerefRegs: W30_HI , TrustedRegs: W30_HI , Insts: >)165// CHECK-NEXT: .. result: (src-state<SafeToDerefRegs: W30_HI , TrustedRegs: W30_HI , Insts: >)166// CHECK-NEXT: After src register safety analysis:167// CHECK-NEXT: Binary Function "clobber" {168// ...169// CHECK: End of Function "clobber"170 171// The above output was printed after first run of analysis172 173// CHECK-EMPTY:174// CHECK-NEXT: Found RET inst: 00000000: ret # DataflowSrcSafetyAnalysis: src-state<SafeToDerefRegs: BitVector, TrustedRegs: BitVector, Insts: >175// CHECK-NEXT: RetReg: LR176// CHECK-NEXT: SafeToDerefRegs: W30_HI{{[ \t]*$}}177// CHECK-EMPTY:178// CHECK-NEXT: Running detailed src register safety analysis...179// CHECK-NEXT: SrcSafetyAnalysis::ComputeNext( mov w30, #0x0, src-state<SafeToDerefRegs: LR W30 W30_HI , TrustedRegs: LR W30 W30_HI , Insts: [0]()>)180// CHECK-NEXT: .. result: (src-state<SafeToDerefRegs: W30_HI , TrustedRegs: W30_HI , Insts: [0](0x{{[0-9a-f]+}})>)181// CHECK-NEXT: SrcSafetyAnalysis::ComputeNext( ret x30, src-state<SafeToDerefRegs: W30_HI , TrustedRegs: W30_HI , Insts: [0](0x{{[0-9a-f]+}})>)182// CHECK-NEXT: .. result: (src-state<SafeToDerefRegs: W30_HI , TrustedRegs: W30_HI , Insts: [0](0x{{[0-9a-f]+}})>)183// CHECK-NEXT: After detailed src register safety analysis:184// CHECK-NEXT: Binary Function "clobber" {185// ...186// CHECK: End of Function "clobber"187 188// The analysis was re-computed with register tracking, as an issue was found in this function.189// Iterating over the reports and attaching clobbering info:190 191// CHECK-EMPTY:192// CHECK-NEXT: Attaching clobbering info to: 00000000: ret # DataflowSrcSafetyAnalysis: src-state<SafeToDerefRegs: BitVector, TrustedRegs: BitVector, Insts: [0](0x{{[0-9a-f]+}})>193 194 .globl nocfg195 .type nocfg,@function196nocfg:197 adr x0, 1f198 br x01991:200 ret201 .size nocfg, .-nocfg202 203// CHECK-LABEL:Analyzing function nocfg, AllocatorId = 1204// CHECK-NEXT: Binary Function "nocfg" {205// CHECK-NEXT: Number : 3206// CHECK-NEXT: State : disassembled207// ...208// CHECK: IsSimple : 0209// CHECK-NEXT: IsMultiEntry: 1210// CHECK-NEXT: IsSplit : 0211// CHECK-NEXT: BB Count : 0212// CHECK-NEXT: Secondary Entry Points : __ENTRY_nocfg@0x[[ENTRY_ADDR:[0-9a-f]+]]213// CHECK-NEXT: }214// CHECK-NEXT: .{{[A-Za-z0-9]+}}:215// CHECK-NEXT: 00000000: adr x0, __ENTRY_nocfg@0x[[ENTRY_ADDR]]216// CHECK-NEXT: 00000004: br x0 # UNKNOWN CONTROL FLOW # Offset: 4217// CHECK-NEXT: __ENTRY_nocfg@0x[[ENTRY_ADDR]] (Entry Point):218// CHECK-NEXT: .{{[A-Za-z0-9]+}}:219// CHECK-NEXT: 00000008: ret # Offset: 8220// CHECK-NEXT: DWARF CFI Instructions:221// CHECK-NEXT: <empty>222// CHECK-NEXT: End of Function "nocfg"223// CHECK-EMPTY:224// CHECK-NEXT: Running src register safety analysis...225// CHECK-NEXT: SrcSafetyAnalysis::ComputeNext( adr x0, __ENTRY_nocfg@0x[[ENTRY_ADDR]], src-state<SafeToDerefRegs: LR W30 W30_HI , TrustedRegs: LR W30 W30_HI , Insts: >)226// CHECK-NEXT: .. result: (src-state<SafeToDerefRegs: LR W0 W30 X0 W0_HI W30_HI , TrustedRegs: LR W0 W30 X0 W0_HI W30_HI , Insts: >)227// CHECK-NEXT: SrcSafetyAnalysis::ComputeNext( br x0, src-state<SafeToDerefRegs: LR W0 W30 X0 W0_HI W30_HI , TrustedRegs: LR W0 W30 X0 W0_HI W30_HI , Insts: >)228// CHECK-NEXT: .. result: (src-state<SafeToDerefRegs: LR W0 W30 X0 W0_HI W30_HI , TrustedRegs: LR W0 W30 X0 W0_HI W30_HI , Insts: >)229// CHECK-NEXT: Due to label, resetting the state before: 00000000: ret # Offset: 8230// CHECK-NEXT: SrcSafetyAnalysis::ComputeNext( ret x30, src-state<SafeToDerefRegs: LR W30 W30_HI , TrustedRegs: LR W30 W30_HI , Insts: >)231// CHECK-NEXT: .. result: (src-state<SafeToDerefRegs: LR W30 W30_HI , TrustedRegs: LR W30 W30_HI , Insts: >)232// CHECK-NEXT: After src register safety analysis:233// CHECK-NEXT: Binary Function "nocfg" {234// CHECK-NEXT: Number : 3235// CHECK-NEXT: State : disassembled236// ...237// CHECK: Secondary Entry Points : __ENTRY_nocfg@0x[[ENTRY_ADDR]]238// CHECK-NEXT: }239// CHECK-NEXT: .{{[A-Za-z0-9]+}}:240// CHECK-NEXT: 00000000: adr x0, __ENTRY_nocfg@0x[[ENTRY_ADDR]] # CFGUnawareSrcSafetyAnalysis: src-state<SafeToDerefRegs: BitVector, TrustedRegs: BitVector, Insts: >241// CHECK-NEXT: 00000004: br x0 # UNKNOWN CONTROL FLOW # Offset: 4 # CFGUnawareSrcSafetyAnalysis: src-state<SafeToDerefRegs: BitVector, TrustedRegs: BitVector, Insts: >242// CHECK-NEXT: __ENTRY_nocfg@0x[[ENTRY_ADDR]] (Entry Point):243// CHECK-NEXT: .{{[A-Za-z0-9]+}}:244// CHECK-NEXT: 00000008: ret # Offset: 8 # CFGUnawareSrcSafetyAnalysis: src-state<SafeToDerefRegs: BitVector, TrustedRegs: BitVector, Insts: >245// CHECK-NEXT: DWARF CFI Instructions:246// CHECK-NEXT: <empty>247// CHECK-NEXT: End of Function "nocfg"248// CHECK-EMPTY:249// PAUTH-NEXT: Found call inst: 00000000: br x0 # UNKNOWN CONTROL FLOW # Offset: 4 # CFGUnawareSrcSafetyAnalysis: src-state<SafeToDerefRegs: BitVector, TrustedRegs: BitVector, Insts: >250// PAUTH-NEXT: Call destination reg: X0251// PAUTH-NEXT: SafeToDerefRegs: LR W0 W30 X0 W0_HI W30_HI{{[ \t]*$}}252// CHECK-NEXT: Found RET inst: 00000000: ret # Offset: 8 # CFGUnawareSrcSafetyAnalysis: src-state<SafeToDerefRegs: BitVector, TrustedRegs: BitVector, Insts: >253// CHECK-NEXT: RetReg: LR254// CHECK-NEXT: SafeToDerefRegs: LR W30 W30_HI{{[ \t]*$}}255 256 .globl auth_oracle257 .type auth_oracle,@function258auth_oracle:259 autia x0, x1260 ret261 .size auth_oracle, .-auth_oracle262 263// CHECK-LABEL:Analyzing function auth_oracle, AllocatorId = 1264// CHECK-NEXT: Binary Function "auth_oracle" {265// CHECK-NEXT: Number : 4266// CHECK-NEXT: State : CFG constructed267// ...268// CHECK: BB Layout : [[BB0:[0-9a-zA-Z.]+]]269// CHECK-NEXT: }270// CHECK-NEXT: [[BB0]] (2 instructions, align : 1)271// CHECK-NEXT: Entry Point272// CHECK-NEXT: 00000000: autia x0, x1273// CHECK-NEXT: 00000004: ret274// CHECK-EMPTY:275// CHECK-NEXT: DWARF CFI Instructions:276// CHECK-NEXT: <empty>277// CHECK-NEXT: End of Function "auth_oracle"278// CHECK-EMPTY:279// CHECK-NEXT: Running src register safety analysis...280// ...281// CHECK: After src register safety analysis:282// CHECK-NEXT: Binary Function "auth_oracle" {283// ...284// CHECK: End of Function "auth_oracle"285// ...286// FPAC-NOT: Running dst register safety analysis287// FPAC-NOT: DstSafetyAnalysis::ComputeNext288// FPAC-NOT: {{.*dst-state.*}}289// AUTH-ORACLES: Running dst register safety analysis...290// AUTH-ORACLES-NEXT: DstSafetyAnalysis::ComputeNext( ret x30, dst-state<CannotEscapeUnchecked: , Insts: >)291// AUTH-ORACLES-NEXT: .. result: (dst-state<CannotEscapeUnchecked: LR W30 W30_HI , Insts: >)292// AUTH-ORACLES-NEXT: DstSafetyAnalysis::ComputeNext( autia x0, x1, dst-state<CannotEscapeUnchecked: LR W30 W30_HI , Insts: >)293// AUTH-ORACLES-NEXT: .. result: (dst-state<CannotEscapeUnchecked: LR W30 W30_HI , Insts: >)294// AUTH-ORACLES-NEXT: After dst register safety analysis:295// AUTH-ORACLES-NEXT: Binary Function "auth_oracle" {296// AUTH-ORACLES-NEXT: Number : 4297// AUTH-ORACLES-NEXT: State : CFG constructed298// ...299// AUTH-ORACLES: BB Layout : [[BB0]]300// AUTH-ORACLES-NEXT: }301// AUTH-ORACLES-NEXT: [[BB0]] (2 instructions, align : 1)302// AUTH-ORACLES-NEXT: Entry Point303// AUTH-ORACLES-NEXT: 00000000: autia x0, x1 # DataflowDstSafetyAnalysis: dst-state<CannotEscapeUnchecked: BitVector, Insts: >304// AUTH-ORACLES-NEXT: 00000004: ret # DataflowDstSafetyAnalysis: dst-state<CannotEscapeUnchecked: BitVector, Insts: >305// AUTH-ORACLES-EMPTY:306// AUTH-ORACLES-NEXT: DWARF CFI Instructions:307// AUTH-ORACLES-NEXT: <empty>308// AUTH-ORACLES-NEXT: End of Function "auth_oracle"309// AUTH-ORACLES-EMPTY:310// AUTH-ORACLES-NEXT: Found auth inst: 00000000: autia x0, x1 # DataflowDstSafetyAnalysis: dst-state<CannotEscapeUnchecked: BitVector, Insts: >311// AUTH-ORACLES-NEXT: Authenticated reg: X0312// AUTH-ORACLES-NEXT: safe output registers: LR W30 W30_HI{{[ \t]*$}}313// AUTH-ORACLES-EMPTY:314// AUTH-ORACLES-NEXT: Running detailed dst register safety analysis...315// AUTH-ORACLES-NEXT: DstSafetyAnalysis::ComputeNext( ret x30, dst-state<CannotEscapeUnchecked: , Insts: [0]()>)316// AUTH-ORACLES-NEXT: .. result: (dst-state<CannotEscapeUnchecked: LR W30 W30_HI , Insts: [0]()>)317// AUTH-ORACLES-NEXT: DstSafetyAnalysis::ComputeNext( autia x0, x1, dst-state<CannotEscapeUnchecked: LR W30 W30_HI , Insts: [0]()>)318// AUTH-ORACLES-NEXT: .. result: (dst-state<CannotEscapeUnchecked: LR W30 W30_HI , Insts: [0](0x{{[0-9a-f]+}})>)319// AUTH-ORACLES-NEXT: After detailed dst register safety analysis:320// AUTH-ORACLES-NEXT: Binary Function "auth_oracle" {321// AUTH-ORACLES-NEXT: Number : 4322// AUTH-ORACLES-NEXT: State : CFG constructed323// ...324// AUTH-ORACLES: BB Layout : [[BB0]]325// AUTH-ORACLES-NEXT: }326// AUTH-ORACLES-NEXT: [[BB0]] (2 instructions, align : 1)327// AUTH-ORACLES-NEXT: Entry Point328// AUTH-ORACLES-NEXT: 00000000: autia x0, x1 # DataflowDstSafetyAnalysis: dst-state<CannotEscapeUnchecked: BitVector, Insts: [0](0x{{[0-9a-f]+}})>329// AUTH-ORACLES-NEXT: 00000004: ret # DataflowDstSafetyAnalysis: dst-state<CannotEscapeUnchecked: BitVector, Insts: [0]()>330// AUTH-ORACLES-EMPTY:331// AUTH-ORACLES-NEXT: DWARF CFI Instructions:332// AUTH-ORACLES-NEXT: <empty>333// AUTH-ORACLES-NEXT: End of Function "auth_oracle"334// AUTH-ORACLES-EMPTY:335// AUTH-ORACLES-NEXT: Attaching leakage info to: 00000000: autia x0, x1 # DataflowDstSafetyAnalysis: dst-state<CannotEscapeUnchecked: BitVector, Insts: [0](0x{{[0-9a-f]+}})>336 337// Gadget scanner should not crash on CFI instructions, including when debug-printing them.338// Note that the particular debug output is not checked, but BOLT should be339// compiled with assertions enabled to support -debug-only argument.340 341 .globl cfi_inst_df342 .type cfi_inst_df,@function343cfi_inst_df:344 .cfi_startproc345 sub sp, sp, #16346 .cfi_def_cfa_offset 16347 add sp, sp, #16348 .cfi_def_cfa_offset 0349 ret350 .size cfi_inst_df, .-cfi_inst_df351 .cfi_endproc352 353 .globl cfi_inst_nocfg354 .type cfi_inst_nocfg,@function355cfi_inst_nocfg:356 .cfi_startproc357 sub sp, sp, #16358 .cfi_def_cfa_offset 16359 360 adr x0, 1f361 br x03621:363 add sp, sp, #16364 .cfi_def_cfa_offset 0365 ret366 .size cfi_inst_nocfg, .-cfi_inst_nocfg367 .cfi_endproc368 369// CHECK-LABEL:Analyzing function main, AllocatorId = 1370 .globl main371 .type main,@function372main:373 ret374 .size main, .-main375