1020 lines · plain
1// RUN: %clang %cflags -march=armv8.3-a+pauth-lr -Wl,--no-relax %s -o %t.exe2// RUN: llvm-bolt-binary-analysis --scanners=pacret %t.exe 2>&1 | FileCheck -check-prefix=PACRET %s3// RUN: llvm-bolt-binary-analysis --scanners=pauth %t.exe 2>&1 | FileCheck -check-prefixes=CHECK,NOFPAC %s4// RUN: llvm-bolt-binary-analysis --scanners=pauth --auth-traps-on-failure %t.exe 2>&1 | FileCheck -check-prefixes=CHECK,FPAC %s5 6// The detection of compiler-generated explicit pointer checks is tested in7// gs-pauth-address-checks.s, for that reason only test here "dummy-load" and8// "high-bits-notbi" checkers, as the shortest examples of checkers that are9// detected per-instruction and per-BB.10 11// PACRET-NOT: signing oracle found in function12 13 .text14 15 .type sym,@function16sym:17 ret18 .size sym, .-sym19 20 .globl callee21 .type callee,@function22callee:23 ret24 .size callee, .-callee25 26// Test transitions between register states: none, safe-to-dereference (s-t-d), trusted:27// * trusted right away: safe address materialization28// * trusted as checked s-t-d: two variants of checks29// * untrusted: s-t-d, but not checked30// * untrusted: not s-t-d, but checked31// * untrusted: not even s-t-d - from arg and from memory32// * untrusted: {subreg clobbered, function called} X {between address materialization and use, between auth and check, between check and use}33// * untrusted: first checked then auted, auted then auted, checked then checked34 35 .globl good_sign_addr_mat36 .type good_sign_addr_mat,@function37good_sign_addr_mat:38// CHECK-NOT: good_sign_addr_mat39 adr x0, sym40 pacda x0, x141 ret42 .size good_sign_addr_mat, .-good_sign_addr_mat43 44 .globl good_sign_auted_checked_ldr45 .type good_sign_auted_checked_ldr,@function46good_sign_auted_checked_ldr:47// CHECK-NOT: good_sign_auted_checked_ldr48 autda x0, x249 ldr x2, [x0]50 pacda x0, x151 ret52 .size good_sign_auted_checked_ldr, .-good_sign_auted_checked_ldr53 54 .globl good_sign_auted_checked_brk55 .type good_sign_auted_checked_brk,@function56good_sign_auted_checked_brk:57// CHECK-NOT: good_sign_auted_checked_brk58 autda x0, x259 eor x16, x0, x0, lsl #160 tbz x16, #62, 1f61 brk 0xc472621:63 pacda x0, x164 ret65 .size good_sign_auted_checked_brk, .-good_sign_auted_checked_brk66 67 .globl bad_sign_authed_unchecked68 .type bad_sign_authed_unchecked,@function69bad_sign_authed_unchecked:70// FPAC-NOT: bad_sign_authed_unchecked71// NOFPAC-LABEL: GS-PAUTH: signing oracle found in function bad_sign_authed_unchecked, basic block {{[^,]+}}, at address72// NOFPAC-NEXT: The instruction is {{[0-9a-f]+}}: pacda x0, x173// NOFPAC-NEXT: The 0 instructions that write to the affected registers after any authentication are:74 autda x0, x275 pacda x0, x176 ret77 .size bad_sign_authed_unchecked, .-bad_sign_authed_unchecked78 79 .globl bad_sign_checked_not_auted80 .type bad_sign_checked_not_auted,@function81bad_sign_checked_not_auted:82// CHECK-LABEL: GS-PAUTH: signing oracle found in function bad_sign_checked_not_auted, basic block {{[^,]+}}, at address83// CHECK-NEXT: The instruction is {{[0-9a-f]+}}: pacda x0, x184// CHECK-NEXT: The 0 instructions that write to the affected registers after any authentication are:85 ldr x2, [x0]86 pacda x0, x187 ret88 .size bad_sign_checked_not_auted, .-bad_sign_checked_not_auted89 90 .globl bad_sign_plain_arg91 .type bad_sign_plain_arg,@function92bad_sign_plain_arg:93// CHECK-LABEL: GS-PAUTH: signing oracle found in function bad_sign_plain_arg, basic block {{[^,]+}}, at address94// CHECK-NEXT: The instruction is {{[0-9a-f]+}}: pacda x0, x195// CHECK-NEXT: The 0 instructions that write to the affected registers after any authentication are:96 pacda x0, x197 ret98 .size bad_sign_plain_arg, .-bad_sign_plain_arg99 100 .globl bad_sign_plain_mem101 .type bad_sign_plain_mem,@function102bad_sign_plain_mem:103// CHECK-LABEL: GS-PAUTH: signing oracle found in function bad_sign_plain_mem, basic block {{[^,]+}}, at address104// CHECK-NEXT: The instruction is {{[0-9a-f]+}}: pacda x0, x1105// CHECK-NEXT: The 1 instructions that write to the affected registers after any authentication are:106// CHECK-NEXT: 1. {{[0-9a-f]+}}: ldr x0, [x1]107// CHECK-NEXT: This happens in the following basic block:108// CHECK-NEXT: {{[0-9a-f]+}}: ldr x0, [x1]109// CHECK-NEXT: {{[0-9a-f]+}}: pacda x0, x1110// CHECK-NEXT: {{[0-9a-f]+}}: ret111 ldr x0, [x1]112 pacda x0, x1113 ret114 .size bad_sign_plain_mem, .-bad_sign_plain_mem115 116 .globl bad_clobber_between_addr_mat_and_use117 .type bad_clobber_between_addr_mat_and_use,@function118bad_clobber_between_addr_mat_and_use:119// CHECK-LABEL: GS-PAUTH: signing oracle found in function bad_clobber_between_addr_mat_and_use, basic block {{[^,]+}}, at address120// CHECK-NEXT: The instruction is {{[0-9a-f]+}}: pacda x0, x1121// CHECK-NEXT: The 1 instructions that write to the affected registers after any authentication are:122// CHECK-NEXT: 1. {{[0-9a-f]+}}: mov w0, w3123// CHECK-NEXT: This happens in the following basic block:124// CHECK-NEXT: {{[0-9a-f]+}}: adr x0, "sym/1"125// CHECK-NEXT: {{[0-9a-f]+}}: mov w0, w3126// CHECK-NEXT: {{[0-9a-f]+}}: pacda x0, x1127// CHECK-NEXT: {{[0-9a-f]+}}: ret128 adr x0, sym129 mov w0, w3130 pacda x0, x1131 ret132 .size bad_clobber_between_addr_mat_and_use, .-bad_clobber_between_addr_mat_and_use133 134 .globl bad_clobber_between_auted_and_checked135 .type bad_clobber_between_auted_and_checked,@function136bad_clobber_between_auted_and_checked:137// CHECK-LABEL: GS-PAUTH: signing oracle found in function bad_clobber_between_auted_and_checked, basic block {{[^,]+}}, at address138// CHECK-NEXT: The instruction is {{[0-9a-f]+}}: pacda x0, x1139// CHECK-NEXT: The 1 instructions that write to the affected registers after any authentication are:140// CHECK-NEXT: 1. {{[0-9a-f]+}}: mov w0, w3141// CHECK-NEXT: This happens in the following basic block:142// CHECK-NEXT: {{[0-9a-f]+}}: autda x0, x2143// CHECK-NEXT: {{[0-9a-f]+}}: mov w0, w3144// CHECK-NEXT: {{[0-9a-f]+}}: ldr x2, [x0]145// CHECK-NEXT: {{[0-9a-f]+}}: pacda x0, x1146// CHECK-NEXT: {{[0-9a-f]+}}: ret147 autda x0, x2148 mov w0, w3149 ldr x2, [x0]150 pacda x0, x1151 ret152 .size bad_clobber_between_auted_and_checked, .-bad_clobber_between_auted_and_checked153 154 .globl bad_clobber_between_checked_and_used155 .type bad_clobber_between_checked_and_used,@function156bad_clobber_between_checked_and_used:157// CHECK-LABEL: GS-PAUTH: signing oracle found in function bad_clobber_between_checked_and_used, basic block {{[^,]+}}, at address158// CHECK-NEXT: The instruction is {{[0-9a-f]+}}: pacda x0, x1159// CHECK-NEXT: The 1 instructions that write to the affected registers after any authentication are:160// CHECK-NEXT: 1. {{[0-9a-f]+}}: mov w0, w3161// CHECK-NEXT: This happens in the following basic block:162// CHECK-NEXT: {{[0-9a-f]+}}: autda x0, x2163// CHECK-NEXT: {{[0-9a-f]+}}: ldr x2, [x0]164// CHECK-NEXT: {{[0-9a-f]+}}: mov w0, w3165// CHECK-NEXT: {{[0-9a-f]+}}: pacda x0, x1166// CHECK-NEXT: {{[0-9a-f]+}}: ret167 autda x0, x2168 ldr x2, [x0]169 mov w0, w3170 pacda x0, x1171 ret172 .size bad_clobber_between_checked_and_used, .-bad_clobber_between_checked_and_used173 174 .globl bad_call_between_addr_mat_and_use175 .type bad_call_between_addr_mat_and_use,@function176bad_call_between_addr_mat_and_use:177// CHECK-LABEL: GS-PAUTH: signing oracle found in function bad_call_between_addr_mat_and_use, basic block {{[^,]+}}, at address178// CHECK-NEXT: The instruction is {{[0-9a-f]+}}: pacda x0, x1179// CHECK-NEXT: The 1 instructions that write to the affected registers after any authentication are:180// CHECK-NEXT: 1. {{[0-9a-f]+}}: bl callee181// CHECK-NEXT: This happens in the following basic block:182// CHECK-NEXT: {{[0-9a-f]+}}: paciasp183// CHECK-NEXT: {{[0-9a-f]+}}: stp x29, x30, [sp, #-0x10]!184// CHECK-NEXT: {{[0-9a-f]+}}: mov x29, sp185// CHECK-NEXT: {{[0-9a-f]+}}: adr x0, "sym/1"186// CHECK-NEXT: {{[0-9a-f]+}}: bl callee187// CHECK-NEXT: {{[0-9a-f]+}}: pacda x0, x1188// CHECK-NEXT: {{[0-9a-f]+}}: ldp x29, x30, [sp], #0x10189// CHECK-NEXT: {{[0-9a-f]+}}: autiasp190// CHECK-NEXT: {{[0-9a-f]+}}: ret191 paciasp192 stp x29, x30, [sp, #-16]!193 mov x29, sp194 195 adr x0, sym196 bl callee197 pacda x0, x1198 199 ldp x29, x30, [sp], #16200 autiasp201 ret202 .size bad_call_between_addr_mat_and_use, .-bad_call_between_addr_mat_and_use203 204 .globl bad_call_between_auted_and_checked205 .type bad_call_between_auted_and_checked,@function206bad_call_between_auted_and_checked:207// CHECK-LABEL: GS-PAUTH: signing oracle found in function bad_call_between_auted_and_checked, basic block {{[^,]+}}, at address208// CHECK-NEXT: The instruction is {{[0-9a-f]+}}: pacda x0, x1209// CHECK-NEXT: The 1 instructions that write to the affected registers after any authentication are:210// CHECK-NEXT: 1. {{[0-9a-f]+}}: bl callee211// CHECK-NEXT: This happens in the following basic block:212// CHECK-NEXT: {{[0-9a-f]+}}: paciasp213// CHECK-NEXT: {{[0-9a-f]+}}: stp x29, x30, [sp, #-0x10]!214// CHECK-NEXT: {{[0-9a-f]+}}: mov x29, sp215// CHECK-NEXT: {{[0-9a-f]+}}: autda x0, x2216// CHECK-NEXT: {{[0-9a-f]+}}: bl callee217// CHECK-NEXT: {{[0-9a-f]+}}: ldr x2, [x0]218// CHECK-NEXT: {{[0-9a-f]+}}: pacda x0, x1219// CHECK-NEXT: {{[0-9a-f]+}}: ldp x29, x30, [sp], #0x10220// CHECK-NEXT: {{[0-9a-f]+}}: autiasp221// CHECK-NEXT: {{[0-9a-f]+}}: ret222 paciasp223 stp x29, x30, [sp, #-16]!224 mov x29, sp225 226 autda x0, x2227 bl callee228 ldr x2, [x0]229 pacda x0, x1230 231 ldp x29, x30, [sp], #16232 autiasp233 ret234 .size bad_call_between_auted_and_checked, .-bad_call_between_auted_and_checked235 236 .globl bad_call_between_checked_and_used237 .type bad_call_between_checked_and_used,@function238bad_call_between_checked_and_used:239// CHECK-LABEL: GS-PAUTH: signing oracle found in function bad_call_between_checked_and_used, basic block {{[^,]+}}, at address240// CHECK-NEXT: The instruction is {{[0-9a-f]+}}: pacda x0, x1241// CHECK-NEXT: The 1 instructions that write to the affected registers after any authentication are:242// CHECK-NEXT: 1. {{[0-9a-f]+}}: bl callee243// CHECK-NEXT: This happens in the following basic block:244// CHECK-NEXT: {{[0-9a-f]+}}: paciasp245// CHECK-NEXT: {{[0-9a-f]+}}: stp x29, x30, [sp, #-0x10]!246// CHECK-NEXT: {{[0-9a-f]+}}: mov x29, sp247// CHECK-NEXT: {{[0-9a-f]+}}: autda x0, x2248// CHECK-NEXT: {{[0-9a-f]+}}: ldr x2, [x0]249// CHECK-NEXT: {{[0-9a-f]+}}: bl callee250// CHECK-NEXT: {{[0-9a-f]+}}: pacda x0, x1251// CHECK-NEXT: {{[0-9a-f]+}}: ldp x29, x30, [sp], #0x10252// CHECK-NEXT: {{[0-9a-f]+}}: autiasp253// CHECK-NEXT: {{[0-9a-f]+}}: ret254 paciasp255 stp x29, x30, [sp, #-16]!256 mov x29, sp257 258 autda x0, x2259 ldr x2, [x0]260 bl callee261 pacda x0, x1262 263 ldp x29, x30, [sp], #16264 autiasp265 ret266 .size bad_call_between_checked_and_used, .-bad_call_between_checked_and_used267 268 .globl bad_transition_check_then_auth269 .type bad_transition_check_then_auth,@function270bad_transition_check_then_auth:271// FPAC-NOT: bad_transition_check_then_auth272// NOFPAC-LABEL: GS-PAUTH: signing oracle found in function bad_transition_check_then_auth, basic block {{[^,]+}}, at address273// NOFPAC-NEXT: The instruction is {{[0-9a-f]+}}: pacda x0, x1274// NOFPAC-NEXT: The 0 instructions that write to the affected registers after any authentication are:275 ldr x2, [x0]276 autda x0, x2277 pacda x0, x1278 ret279 .size bad_transition_check_then_auth, .-bad_transition_check_then_auth280 281 .globl bad_transition_auth_then_auth282 .type bad_transition_auth_then_auth,@function283bad_transition_auth_then_auth:284// FPAC-NOT: bad_transition_auth_then_auth285// NOFPAC-LABEL: GS-PAUTH: signing oracle found in function bad_transition_auth_then_auth, basic block {{[^,]+}}, at address286// NOFPAC-NEXT: The instruction is {{[0-9a-f]+}}: pacda x0, x1287// NOFPAC-NEXT: The 0 instructions that write to the affected registers after any authentication are:288 autda x0, x2289 autda x0, x2290 pacda x0, x1291 ret292 .size bad_transition_auth_then_auth, .-bad_transition_auth_then_auth293 294 .globl bad_transition_check_then_check295 .type bad_transition_check_then_check,@function296bad_transition_check_then_check:297// CHECK-LABEL: GS-PAUTH: signing oracle found in function bad_transition_check_then_check, basic block {{[^,]+}}, at address298// CHECK-NEXT: The instruction is {{[0-9a-f]+}}: pacda x0, x1299// CHECK-NEXT: The 0 instructions that write to the affected registers after any authentication are:300 ldr x2, [x0]301 ldr x2, [x0]302 pacda x0, x1303 ret304 .size bad_transition_check_then_check, .-bad_transition_check_then_check305 306// Multi-BB test cases.307 308// Test state propagation across multiple basic blocks.309// Test transitions between register states: none, safe-to-dereference (s-t-d), trusted:310// * trusted right away: safe address materialization311// * trusted as checked s-t-d: two variants of checks312// * untrusted: s-t-d, but not *always* checked313// * untrusted: not *always* s-t-d, but checked314// * untrusted: not even s-t-d - from arg and from memory315// * untrusted: subreg clobbered - between address materialization and use, between auth and check, between check and use316// * trusted in both predecessors but for different reasons317// (the one due to address materialization and the other due to s-t-d then checked)318// * untrusted: auted in one predecessor, checked in the other319 320 .globl good_sign_addr_mat_multi_bb321 .type good_sign_addr_mat_multi_bb,@function322good_sign_addr_mat_multi_bb:323// CHECK-NOT: good_sign_addr_mat_multi_bb324 adr x0, sym325 cbz x3, 1f326 nop3271:328 pacda x0, x1329 ret330 .size good_sign_addr_mat_multi_bb, .-good_sign_addr_mat_multi_bb331 332 .globl good_sign_auted_checked_ldr_multi_bb333 .type good_sign_auted_checked_ldr_multi_bb,@function334good_sign_auted_checked_ldr_multi_bb:335// CHECK-NOT: good_sign_auted_checked_ldr_multi_bb336 autda x0, x2337 cbz x3, 1f338 nop3391:340 ldr x2, [x0]341 cbz x4, 2f342 nop3432:344 pacda x0, x1345 ret346 .size good_sign_auted_checked_ldr_multi_bb, .-good_sign_auted_checked_ldr_multi_bb347 348 .globl good_sign_auted_checked_brk_multi_bb349 .type good_sign_auted_checked_brk_multi_bb,@function350good_sign_auted_checked_brk_multi_bb:351// CHECK-NOT: good_sign_auted_checked_brk_multi_bb352 autda x0, x2353 cbz x3, 1f354 nop3551:356 eor x16, x0, x0, lsl #1357 tbz x16, #62, 2f358 brk 0xc4723592:360 cbz x4, 3f361 nop3623:363 pacda x0, x1364 ret365 .size good_sign_auted_checked_brk_multi_bb, .-good_sign_auted_checked_brk_multi_bb366 367 .globl bad_sign_authed_unchecked_multi_bb368 .type bad_sign_authed_unchecked_multi_bb,@function369bad_sign_authed_unchecked_multi_bb:370// FPAC-NOT: bad_sign_authed_unchecked_multi_bb371// NOFPAC-LABEL: GS-PAUTH: signing oracle found in function bad_sign_authed_unchecked_multi_bb, basic block {{[^,]+}}, at address372// NOFPAC-NEXT: The instruction is {{[0-9a-f]+}}: pacda x0, x1373// NOFPAC-NEXT: The 0 instructions that write to the affected registers after any authentication are:374 autda x0, x2375 cbz x3, 1f376 ldr x2, [x0]3771:378 pacda x0, x1379 ret380 .size bad_sign_authed_unchecked_multi_bb, .-bad_sign_authed_unchecked_multi_bb381 382 .globl bad_sign_checked_not_auted_multi_bb383 .type bad_sign_checked_not_auted_multi_bb,@function384bad_sign_checked_not_auted_multi_bb:385// CHECK-LABEL: GS-PAUTH: signing oracle found in function bad_sign_checked_not_auted_multi_bb, basic block {{[^,]+}}, at address386// CHECK-NEXT: The instruction is {{[0-9a-f]+}}: pacda x0, x1387// CHECK-NEXT: The 0 instructions that write to the affected registers after any authentication are:388 cbz x3, 1f389 autda x0, x23901:391 ldr x2, [x0]392 pacda x0, x1393 ret394 .size bad_sign_checked_not_auted_multi_bb, .-bad_sign_checked_not_auted_multi_bb395 396 .globl bad_sign_plain_arg_multi_bb397 .type bad_sign_plain_arg_multi_bb,@function398bad_sign_plain_arg_multi_bb:399// CHECK-LABEL: GS-PAUTH: signing oracle found in function bad_sign_plain_arg_multi_bb, basic block {{[^,]+}}, at address400// CHECK-NEXT: The instruction is {{[0-9a-f]+}}: pacda x0, x1401// CHECK-NEXT: The 0 instructions that write to the affected registers after any authentication are:402 cbz x3, 1f403 autda x0, x2404 ldr x2, [x0]4051:406 pacda x0, x1407 ret408 .size bad_sign_plain_arg_multi_bb, .-bad_sign_plain_arg_multi_bb409 410 .globl bad_sign_plain_mem_multi_bb411 .type bad_sign_plain_mem_multi_bb,@function412bad_sign_plain_mem_multi_bb:413// CHECK-LABEL: GS-PAUTH: signing oracle found in function bad_sign_plain_mem_multi_bb, basic block {{[^,]+}}, at address414// CHECK-NEXT: The instruction is {{[0-9a-f]+}}: pacda x0, x1415// CHECK-NEXT: The 1 instructions that write to the affected registers after any authentication are:416// CHECK-NEXT: 1. {{[0-9a-f]+}}: ldr x0, [x1]417 ldr x0, [x1]418 cbz x3, 1f419 autda x0, x2420 ldr x2, [x0]4211:422 pacda x0, x1423 ret424 .size bad_sign_plain_mem_multi_bb, .-bad_sign_plain_mem_multi_bb425 426 .globl bad_clobber_between_addr_mat_and_use_multi_bb427 .type bad_clobber_between_addr_mat_and_use_multi_bb,@function428bad_clobber_between_addr_mat_and_use_multi_bb:429// CHECK-LABEL: GS-PAUTH: signing oracle found in function bad_clobber_between_addr_mat_and_use_multi_bb, basic block {{[^,]+}}, at address430// CHECK-NEXT: The instruction is {{[0-9a-f]+}}: pacda x0, x1431// CHECK-NEXT: The 1 instructions that write to the affected registers after any authentication are:432// CHECK-NEXT: 1. {{[0-9a-f]+}}: mov w0, w3433 adr x0, sym434 cbz x4, 1f435 mov w0, w34361:437 pacda x0, x1438 ret439 .size bad_clobber_between_addr_mat_and_use_multi_bb, .-bad_clobber_between_addr_mat_and_use_multi_bb440 441 .globl bad_clobber_between_auted_and_checked_multi_bb442 .type bad_clobber_between_auted_and_checked_multi_bb,@function443bad_clobber_between_auted_and_checked_multi_bb:444// CHECK-LABEL: GS-PAUTH: signing oracle found in function bad_clobber_between_auted_and_checked_multi_bb, basic block {{[^,]+}}, at address445// CHECK-NEXT: The instruction is {{[0-9a-f]+}}: pacda x0, x1446// CHECK-NEXT: The 1 instructions that write to the affected registers after any authentication are:447// CHECK-NEXT: 1. {{[0-9a-f]+}}: mov w0, w3448 autda x0, x2449 cbz x4, 1f450 mov w0, w34511:452 ldr x2, [x0]453 pacda x0, x1454 ret455 .size bad_clobber_between_auted_and_checked_multi_bb, .-bad_clobber_between_auted_and_checked_multi_bb456 457 .globl bad_clobber_between_checked_and_used_multi_bb458 .type bad_clobber_between_checked_and_used_multi_bb,@function459bad_clobber_between_checked_and_used_multi_bb:460// CHECK-LABEL: GS-PAUTH: signing oracle found in function bad_clobber_between_checked_and_used_multi_bb, basic block {{[^,]+}}, at address461// CHECK-NEXT: The instruction is {{[0-9a-f]+}}: pacda x0, x1462// CHECK-NEXT: The 1 instructions that write to the affected registers after any authentication are:463// CHECK-NEXT: 1. {{[0-9a-f]+}}: mov w0, w3464 autda x0, x2465 ldr x2, [x0]466 cbz x4, 1f467 mov w0, w34681:469 pacda x0, x1470 ret471 .size bad_clobber_between_checked_and_used_multi_bb, .-bad_clobber_between_checked_and_used_multi_bb472 473 .globl good_both_trusted_multi_bb474 .type good_both_trusted_multi_bb,@function475good_both_trusted_multi_bb:476// CHECK-NOT: good_both_trusted_multi_bb477 cbz x2, 1f478 autdb x0, x1479 ldr x2, [x0]480 b 2f4811:482 adr x0, sym4832:484 pacda x0, x1485 ret486 .size good_both_trusted_multi_bb, .-good_both_trusted_multi_bb487 488 .globl bad_one_auted_one_checked_multi_bb489 .type bad_one_auted_one_checked_multi_bb,@function490bad_one_auted_one_checked_multi_bb:491// CHECK-LABEL: GS-PAUTH: signing oracle found in function bad_one_auted_one_checked_multi_bb, basic block {{[^,]+}}, at address492// CHECK-NEXT: The instruction is {{[0-9a-f]+}}: pacda x0, x1493// CHECK-NEXT: The 0 instructions that write to the affected registers after any authentication are:494 cbz x2, 1f495 autdb x0, x1496 b 2f4971:498 ldr x3, [x0]4992:500 pacda x0, x1501 ret502 .size bad_one_auted_one_checked_multi_bb, .-bad_one_auted_one_checked_multi_bb503 504// Test the detection when no CFG was reconstructed for a function.505// Test transitions between register states: none, safe-to-dereference (s-t-d), trusted:506// * trusted right away: safe address materialization507// * trusted as checked s-t-d: only check by load (FIXME: support BRK-based code sequences)508// * untrusted: s-t-d, but not checked509// * untrusted: not s-t-d, but checked510// * untrusted: not even s-t-d - from arg and from memory511// * untrusted: subreg clobbered - between address materialization and use, between auth and check, between check and use512// * untrusted: first checked then auted, auted then auted, checked then checked513 514 .globl good_sign_addr_mat_nocfg515 .type good_sign_addr_mat_nocfg,@function516good_sign_addr_mat_nocfg:517// CHECK-NOT: good_sign_addr_mat_nocfg518 adr x3, 1f519 br x35201:521 adr x0, sym522 pacda x0, x1523 ret524 .size good_sign_addr_mat_nocfg, .-good_sign_addr_mat_nocfg525 526 .globl good_sign_auted_checked_ldr_nocfg527 .type good_sign_auted_checked_ldr_nocfg,@function528good_sign_auted_checked_ldr_nocfg:529// CHECK-NOT: good_sign_auted_checked_ldr_nocfg530 adr x3, 1f531 br x35321:533 autda x0, x2534 ldr x2, [x0]535 pacda x0, x1536 ret537 .size good_sign_auted_checked_ldr_nocfg, .-good_sign_auted_checked_ldr_nocfg538 539 .globl bad_sign_authed_unchecked_nocfg540 .type bad_sign_authed_unchecked_nocfg,@function541bad_sign_authed_unchecked_nocfg:542// FPAC-NOT: bad_sign_authed_unchecked_nocfg543// NOFPAC-LABEL: GS-PAUTH: signing oracle found in function bad_sign_authed_unchecked_nocfg, at address544// NOFPAC-NEXT: The instruction is {{[0-9a-f]+}}: pacda x0, x1545// NOFPAC-NEXT: The 0 instructions that write to the affected registers after any authentication are:546 adr x3, 1f547 br x35481:549 autda x0, x2550 pacda x0, x1551 ret552 .size bad_sign_authed_unchecked_nocfg, .-bad_sign_authed_unchecked_nocfg553 554 .globl bad_sign_checked_not_auted_nocfg555 .type bad_sign_checked_not_auted_nocfg,@function556bad_sign_checked_not_auted_nocfg:557// CHECK-LABEL: GS-PAUTH: signing oracle found in function bad_sign_checked_not_auted_nocfg, at address558// CHECK-NEXT: The instruction is {{[0-9a-f]+}}: pacda x0, x1559// CHECK-NEXT: The 0 instructions that write to the affected registers after any authentication are:560 adr x3, 1f561 br x35621:563 ldr x2, [x0]564 pacda x0, x1565 ret566 .size bad_sign_checked_not_auted_nocfg, .-bad_sign_checked_not_auted_nocfg567 568 .globl bad_sign_plain_arg_nocfg569 .type bad_sign_plain_arg_nocfg,@function570bad_sign_plain_arg_nocfg:571// CHECK-LABEL: GS-PAUTH: signing oracle found in function bad_sign_plain_arg_nocfg, at address572// CHECK-NEXT: The instruction is {{[0-9a-f]+}}: pacda x0, x1573// CHECK-NEXT: The 0 instructions that write to the affected registers after any authentication are:574 adr x3, 1f575 br x35761:577 pacda x0, x1578 ret579 .size bad_sign_plain_arg_nocfg, .-bad_sign_plain_arg_nocfg580 581 .globl bad_sign_plain_mem_nocfg582 .type bad_sign_plain_mem_nocfg,@function583bad_sign_plain_mem_nocfg:584// CHECK-LABEL: GS-PAUTH: signing oracle found in function bad_sign_plain_mem_nocfg, at address585// CHECK-NEXT: The instruction is {{[0-9a-f]+}}: pacda x0, x1586// CHECK-NEXT: The 1 instructions that write to the affected registers after any authentication are:587// CHECK-NEXT: 1. {{[0-9a-f]+}}: ldr x0, [x1]588 adr x3, 1f589 br x35901:591 ldr x0, [x1]592 pacda x0, x1593 ret594 .size bad_sign_plain_mem_nocfg, .-bad_sign_plain_mem_nocfg595 596 .globl bad_clobber_between_addr_mat_and_use_nocfg597 .type bad_clobber_between_addr_mat_and_use_nocfg,@function598bad_clobber_between_addr_mat_and_use_nocfg:599// CHECK-LABEL: GS-PAUTH: signing oracle found in function bad_clobber_between_addr_mat_and_use_nocfg, at address600// CHECK-NEXT: The instruction is {{[0-9a-f]+}}: pacda x0, x1601// CHECK-NEXT: The 1 instructions that write to the affected registers after any authentication are:602// CHECK-NEXT: 1. {{[0-9a-f]+}}: mov w0, w4603 adr x3, 1f604 br x36051:606 adr x0, sym607 mov w0, w4608 pacda x0, x1609 ret610 .size bad_clobber_between_addr_mat_and_use_nocfg, .-bad_clobber_between_addr_mat_and_use_nocfg611 612 .globl bad_clobber_between_auted_and_checked_nocfg613 .type bad_clobber_between_auted_and_checked_nocfg,@function614bad_clobber_between_auted_and_checked_nocfg:615// CHECK-LABEL: GS-PAUTH: signing oracle found in function bad_clobber_between_auted_and_checked_nocfg, at address616// CHECK-NEXT: The instruction is {{[0-9a-f]+}}: pacda x0, x1617// CHECK-NEXT: The 1 instructions that write to the affected registers after any authentication are:618// CHECK-NEXT: 1. {{[0-9a-f]+}}: mov w0, w4619 adr x3, 1f620 br x36211:622 autda x0, x2623 mov w0, w4624 ldr x2, [x0]625 pacda x0, x1626 ret627 .size bad_clobber_between_auted_and_checked_nocfg, .-bad_clobber_between_auted_and_checked_nocfg628 629 .globl bad_clobber_between_checked_and_used_nocfg630 .type bad_clobber_between_checked_and_used_nocfg,@function631bad_clobber_between_checked_and_used_nocfg:632// CHECK-LABEL: GS-PAUTH: signing oracle found in function bad_clobber_between_checked_and_used_nocfg, at address633// CHECK-NEXT: The instruction is {{[0-9a-f]+}}: pacda x0, x1634// CHECK-NEXT: The 1 instructions that write to the affected registers after any authentication are:635// CHECK-NEXT: 1. {{[0-9a-f]+}}: mov w0, w4636 adr x3, 1f637 br x36381:639 autda x0, x2640 ldr x2, [x0]641 mov w0, w4642 pacda x0, x1643 ret644 .size bad_clobber_between_checked_and_used_nocfg, .-bad_clobber_between_checked_and_used_nocfg645 646 .globl bad_transition_check_then_auth_nocfg647 .type bad_transition_check_then_auth_nocfg,@function648bad_transition_check_then_auth_nocfg:649// FPAC-NOT: bad_transition_check_then_auth_nocfg650// NOFPAC-LABEL: GS-PAUTH: signing oracle found in function bad_transition_check_then_auth_nocfg, at address651// NOFPAC-NEXT: The instruction is {{[0-9a-f]+}}: pacda x0, x1652// NOFPAC-NEXT: The 0 instructions that write to the affected registers after any authentication are:653 adr x3, 1f654 br x36551:656 ldr x2, [x0]657 autda x0, x2658 pacda x0, x1659 ret660 .size bad_transition_check_then_auth_nocfg, .-bad_transition_check_then_auth_nocfg661 662 .globl bad_transition_auth_then_auth_nocfg663 .type bad_transition_auth_then_auth_nocfg,@function664bad_transition_auth_then_auth_nocfg:665// FPAC-NOT: bad_transition_auth_then_auth_nocfg666// NOFPAC-LABEL: GS-PAUTH: signing oracle found in function bad_transition_auth_then_auth_nocfg, at address667// NOFPAC-NEXT: The instruction is {{[0-9a-f]+}}: pacda x0, x1668// NOFPAC-NEXT: The 0 instructions that write to the affected registers after any authentication are:669 adr x3, 1f670 br x36711:672 autda x0, x2673 autda x0, x2674 pacda x0, x1675 ret676 .size bad_transition_auth_then_auth_nocfg, .-bad_transition_auth_then_auth_nocfg677 678 .globl bad_transition_check_then_check_nocfg679 .type bad_transition_check_then_check_nocfg,@function680bad_transition_check_then_check_nocfg:681// CHECK-LABEL: GS-PAUTH: signing oracle found in function bad_transition_check_then_check_nocfg, at address682// CHECK-NEXT: The instruction is {{[0-9a-f]+}}: pacda x0, x1683// CHECK-NEXT: The 0 instructions that write to the affected registers after any authentication are:684 adr x3, 1f685 br x36861:687 ldr x2, [x0]688 ldr x2, [x0]689 pacda x0, x1690 ret691 .size bad_transition_check_then_check_nocfg, .-bad_transition_check_then_check_nocfg692 693// Test resign with offset.694 695 .globl good_resign_with_increment_ldr696 .type good_resign_with_increment_ldr,@function697good_resign_with_increment_ldr:698// CHECK-NOT: good_resign_with_increment_ldr699 autda x0, x2700 add x0, x0, #8701 ldr x2, [x0]702 sub x1, x0, #16703 mov x2, x1704 pacda x2, x3705 ret706 .size good_resign_with_increment_ldr, .-good_resign_with_increment_ldr707 708 .globl good_resign_with_increment_brk709 .type good_resign_with_increment_brk,@function710good_resign_with_increment_brk:711// CHECK-NOT: good_resign_with_increment_brk712 autda x0, x2713 add x0, x0, #8714 eor x16, x0, x0, lsl #1715 tbz x16, #62, 1f716 brk 0xc4727171:718 mov x2, x0719 pacda x2, x1720 ret721 .size good_resign_with_increment_brk, .-good_resign_with_increment_brk722 723 .globl bad_nonconstant_auth_increment_check724 .type bad_nonconstant_auth_increment_check,@function725bad_nonconstant_auth_increment_check:726// CHECK-LABEL: GS-PAUTH: signing oracle found in function bad_nonconstant_auth_increment_check, basic block {{[^,]+}}, at address727// CHECK-NEXT: The instruction is {{[0-9a-f]+}}: pacda x0, x1728// CHECK-NEXT: The 1 instructions that write to the affected registers after any authentication are:729// CHECK-NEXT: 1. {{[0-9a-f]+}}: add x0, x0, x1730// CHECK-NEXT: This happens in the following basic block:731// CHECK-NEXT: {{[0-9a-f]+}}: autda x0, x2732// CHECK-NEXT: {{[0-9a-f]+}}: add x0, x0, x1733// CHECK-NEXT: {{[0-9a-f]+}}: ldr x2, [x0]734// CHECK-NEXT: {{[0-9a-f]+}}: pacda x0, x1735// CHECK-NEXT: {{[0-9a-f]+}}: ret736 autda x0, x2737 add x0, x0, x1738 ldr x2, [x0]739 pacda x0, x1740 ret741 .size bad_nonconstant_auth_increment_check, .-bad_nonconstant_auth_increment_check742 743 .globl bad_nonconstant_auth_check_increment744 .type bad_nonconstant_auth_check_increment,@function745bad_nonconstant_auth_check_increment:746// CHECK-LABEL: GS-PAUTH: signing oracle found in function bad_nonconstant_auth_check_increment, basic block {{[^,]+}}, at address747// CHECK-NEXT: The instruction is {{[0-9a-f]+}}: pacda x0, x1748// CHECK-NEXT: The 1 instructions that write to the affected registers after any authentication are:749// CHECK-NEXT: 1. {{[0-9a-f]+}}: add x0, x0, x1750// CHECK-NEXT: This happens in the following basic block:751// CHECK-NEXT: {{[0-9a-f]+}}: autda x0, x2752// CHECK-NEXT: {{[0-9a-f]+}}: ldr x2, [x0]753// CHECK-NEXT: {{[0-9a-f]+}}: add x0, x0, x1754// CHECK-NEXT: {{[0-9a-f]+}}: pacda x0, x1755// CHECK-NEXT: {{[0-9a-f]+}}: ret756 autda x0, x2757 ldr x2, [x0]758 add x0, x0, x1759 pacda x0, x1760 ret761 .size bad_nonconstant_auth_check_increment, .-bad_nonconstant_auth_check_increment762 763// Test that all the expected signing instructions are recornized.764 765 .globl inst_pacda766 .type inst_pacda,@function767inst_pacda:768// CHECK-LABEL: GS-PAUTH: signing oracle found in function inst_pacda, basic block {{[^,]+}}, at address769// CHECK-NEXT: The instruction is {{[0-9a-f]+}}: pacda x0, x1770 pacda x0, x1771 ret772 .size inst_pacda, .-inst_pacda773 774 .globl inst_pacdza775 .type inst_pacdza,@function776inst_pacdza:777// CHECK-LABEL: GS-PAUTH: signing oracle found in function inst_pacdza, basic block {{[^,]+}}, at address778// CHECK-NEXT: The instruction is {{[0-9a-f]+}}: pacdza x0779 pacdza x0780 ret781 .size inst_pacdza, .-inst_pacdza782 783 .globl inst_pacdb784 .type inst_pacdb,@function785inst_pacdb:786// CHECK-LABEL: GS-PAUTH: signing oracle found in function inst_pacdb, basic block {{[^,]+}}, at address787// CHECK-NEXT: The instruction is {{[0-9a-f]+}}: pacdb x0, x1788 pacdb x0, x1789 ret790 .size inst_pacdb, .-inst_pacdb791 792 .globl inst_pacdzb793 .type inst_pacdzb,@function794inst_pacdzb:795// CHECK-LABEL: GS-PAUTH: signing oracle found in function inst_pacdzb, basic block {{[^,]+}}, at address796// CHECK-NEXT: The instruction is {{[0-9a-f]+}}: pacdzb x0797 pacdzb x0798 ret799 .size inst_pacdzb, .-inst_pacdzb800 801 .globl inst_pacia802 .type inst_pacia,@function803inst_pacia:804// CHECK-LABEL: GS-PAUTH: signing oracle found in function inst_pacia, basic block {{[^,]+}}, at address805// CHECK-NEXT: The instruction is {{[0-9a-f]+}}: pacia x0, x1806 pacia x0, x1807 ret808 .size inst_pacia, .-inst_pacia809 810 .globl inst_pacia1716811 .type inst_pacia1716,@function812inst_pacia1716:813// CHECK-LABEL: GS-PAUTH: signing oracle found in function inst_pacia1716, basic block {{[^,]+}}, at address814// CHECK-NEXT: The instruction is {{[0-9a-f]+}}: pacia1716815 pacia1716816 ret817 .size inst_pacia1716, .-inst_pacia1716818 819 .globl inst_paciasp820 .type inst_paciasp,@function821inst_paciasp:822// CHECK-LABEL: GS-PAUTH: signing oracle found in function inst_paciasp, basic block {{[^,]+}}, at address823// CHECK-NEXT: The instruction is {{[0-9a-f]+}}: paciasp824 mov x30, x0825 paciasp // signs LR826 autiasp827 ret828 .size inst_paciasp, .-inst_paciasp829 830 .globl inst_paciaz831 .type inst_paciaz,@function832inst_paciaz:833// CHECK-LABEL: GS-PAUTH: signing oracle found in function inst_paciaz, basic block {{[^,]+}}, at address834// CHECK-NEXT: The instruction is {{[0-9a-f]+}}: paciaz835 mov x30, x0836 paciaz // signs LR837 autiaz838 ret839 .size inst_paciaz, .-inst_paciaz840 841 .globl inst_paciza842 .type inst_paciza,@function843inst_paciza:844// CHECK-LABEL: GS-PAUTH: signing oracle found in function inst_paciza, basic block {{[^,]+}}, at address845// CHECK-NEXT: The instruction is {{[0-9a-f]+}}: paciza x0846 paciza x0847 ret848 .size inst_paciza, .-inst_paciza849 850 .globl inst_pacia171615851 .type inst_pacia171615,@function852inst_pacia171615:853// CHECK-LABEL: GS-PAUTH: signing oracle found in function inst_pacia171615, basic block {{[^,]+}}, at address854// CHECK-NEXT: The instruction is {{[0-9a-f]+}}: pacia171615855 mov x30, x0856 pacia171615 // signs LR857 autia171615858 ret859 .size inst_pacia171615, .-inst_pacia171615860 861 .globl inst_paciasppc862 .type inst_paciasppc,@function863inst_paciasppc:864// CHECK-LABEL: GS-PAUTH: signing oracle found in function inst_paciasppc, at address865// CHECK-NEXT: The instruction is {{[0-9a-f]+}}: paciasppc866 mov x30, x08671:868 paciasppc // signs LR869 autiasppc 1b870 ret871 .size inst_paciasppc, .-inst_paciasppc872 873 .globl inst_pacib874 .type inst_pacib,@function875inst_pacib:876// CHECK-LABEL: GS-PAUTH: signing oracle found in function inst_pacib, basic block {{[^,]+}}, at address877// CHECK-NEXT: The instruction is {{[0-9a-f]+}}: pacib x0, x1878 pacib x0, x1879 ret880 .size inst_pacib, .-inst_pacib881 882 .globl inst_pacib1716883 .type inst_pacib1716,@function884inst_pacib1716:885// CHECK-LABEL: GS-PAUTH: signing oracle found in function inst_pacib1716, basic block {{[^,]+}}, at address886// CHECK-NEXT: The instruction is {{[0-9a-f]+}}: pacib1716887 pacib1716888 ret889 .size inst_pacib1716, .-inst_pacib1716890 891 .globl inst_pacibsp892 .type inst_pacibsp,@function893inst_pacibsp:894// CHECK-LABEL: GS-PAUTH: signing oracle found in function inst_pacibsp, basic block {{[^,]+}}, at address895// CHECK-NEXT: The instruction is {{[0-9a-f]+}}: pacibsp896 mov x30, x0897 pacibsp // signs LR898 autibsp899 ret900 .size inst_pacibsp, .-inst_pacibsp901 902 .globl inst_pacibz903 .type inst_pacibz,@function904inst_pacibz:905// CHECK-LABEL: GS-PAUTH: signing oracle found in function inst_pacibz, basic block {{[^,]+}}, at address906// CHECK-NEXT: The instruction is {{[0-9a-f]+}}: pacibz907 mov x30, x0908 pacibz // signs LR909 autibz910 ret911 .size inst_pacibz, .-inst_pacibz912 913 .globl inst_pacizb914 .type inst_pacizb,@function915inst_pacizb:916// CHECK-LABEL: GS-PAUTH: signing oracle found in function inst_pacizb, basic block {{[^,]+}}, at address917// CHECK-NEXT: The instruction is {{[0-9a-f]+}}: pacizb x0918 pacizb x0919 ret920 .size inst_pacizb, .-inst_pacizb921 922 .globl inst_pacib171615923 .type inst_pacib171615,@function924inst_pacib171615:925// CHECK-LABEL: GS-PAUTH: signing oracle found in function inst_pacib171615, basic block {{[^,]+}}, at address926// CHECK-NEXT: The instruction is {{[0-9a-f]+}}: pacib171615927 mov x30, x0928 pacib171615 // signs LR929 autib171615930 ret931 .size inst_pacib171615, .-inst_pacib171615932 933 .globl inst_pacibsppc934 .type inst_pacibsppc,@function935inst_pacibsppc:936// CHECK-LABEL: GS-PAUTH: signing oracle found in function inst_pacibsppc, at address937// CHECK-NEXT: The instruction is {{[0-9a-f]+}}: pacibsppc938 mov x30, x09391:940 pacibsppc // signs LR941 autibsppc 1b942 ret943 .size inst_pacibsppc, .-inst_pacibsppc944 945 .globl inst_pacnbiasppc946 .type inst_pacnbiasppc,@function947inst_pacnbiasppc:948// CHECK-LABEL: GS-PAUTH: signing oracle found in function inst_pacnbiasppc, at address949// CHECK-NEXT: The instruction is {{[0-9a-f]+}}: pacnbiasppc950 mov x30, x09511:952 pacnbiasppc // signs LR953 autiasppc 1b954 ret955 .size inst_pacnbiasppc, .-inst_pacnbiasppc956 957 .globl inst_pacnbibsppc958 .type inst_pacnbibsppc,@function959inst_pacnbibsppc:960// CHECK-LABEL: GS-PAUTH: signing oracle found in function inst_pacnbibsppc, at address961// CHECK-NEXT: The instruction is {{[0-9a-f]+}}: pacnbibsppc962 mov x30, x09631:964 pacnbibsppc // signs LR965 autibsppc 1b966 ret967 .size inst_pacnbibsppc, .-inst_pacnbibsppc968 969// Test that write-back forms of LDRA(A|B) instructions are handled properly.970 971 .globl inst_ldraa_wb972 .type inst_ldraa_wb,@function973inst_ldraa_wb:974// CHECK-NOT: inst_ldraa_wb975 ldraa x2, [x0]!976 pacda x0, x1977 ret978 .size inst_ldraa_wb, .-inst_ldraa_wb979 980 .globl inst_ldrab_wb981 .type inst_ldrab_wb,@function982inst_ldrab_wb:983// CHECK-NOT: inst_ldrab_wb984 ldrab x2, [x0]!985 pacda x0, x1986 ret987 .size inst_ldrab_wb, .-inst_ldrab_wb988 989// Non write-back forms of LDRA(A|B) instructions do not modify the address990// register, and thus do not make it safe.991 992 .globl inst_ldraa_non_wb993 .type inst_ldraa_non_wb,@function994inst_ldraa_non_wb:995// CHECK-LABEL: GS-PAUTH: signing oracle found in function inst_ldraa_non_wb, basic block {{[^,]+}}, at address996// CHECK-NEXT: The instruction is {{[0-9a-f]+}}: pacdb x0, x1997// CHECK-NEXT: The 0 instructions that write to the affected registers after any authentication are:998 ldraa x2, [x0]999 pacdb x0, x11000 ret1001 .size inst_ldraa_non_wb, .-inst_ldraa_non_wb1002 1003 .globl inst_ldrab_non_wb1004 .type inst_ldrab_non_wb,@function1005inst_ldrab_non_wb:1006// CHECK-LABEL: GS-PAUTH: signing oracle found in function inst_ldrab_non_wb, basic block {{[^,]+}}, at address1007// CHECK-NEXT: The instruction is {{[0-9a-f]+}}: pacda x0, x11008// CHECK-NEXT: The 0 instructions that write to the affected registers after any authentication are:1009 ldrab x2, [x0]1010 pacda x0, x11011 ret1012 .size inst_ldrab_non_wb, .-inst_ldrab_non_wb1013 1014 .globl main1015 .type main,@function1016main:1017 mov x0, 01018 ret1019 .size main, .-main1020