608 lines · plain
1// RUN: %clang %cflags -Wl,--entry=_custom_start -march=armv8.3-a %s -o %t.exe2// RUN: llvm-bolt-binary-analysis --scanners=pacret %t.exe 2>&1 | FileCheck -check-prefix=PACRET %s3// RUN: llvm-bolt-binary-analysis --scanners=pauth --auth-traps-on-failure %t.exe 2>&1 | FileCheck -check-prefixes=CHECK,FPAC %s4// RUN: llvm-bolt-binary-analysis --scanners=pauth %t.exe 2>&1 | FileCheck -check-prefixes=CHECK,NOFPAC %s5 6// PACRET-NOT: untrusted link register found before tail call7 8 .text9 10 .globl callee11 .type callee,@function12callee:13 ret14 .size callee, .-callee15 16 .globl good_direct_tailcall_no_clobber17 .type good_direct_tailcall_no_clobber,@function18good_direct_tailcall_no_clobber:19// CHECK-NOT: good_direct_tailcall_no_clobber20 b callee21 .size good_direct_tailcall_no_clobber, .-good_direct_tailcall_no_clobber22 23 .globl good_plt_tailcall_no_clobber24 .type good_plt_tailcall_no_clobber,@function25good_plt_tailcall_no_clobber:26// CHECK-NOT: good_plt_tailcall_no_clobber27 b callee_ext28 .size good_plt_tailcall_no_clobber, .-good_plt_tailcall_no_clobber29 30 .globl good_indirect_tailcall_no_clobber31 .type good_indirect_tailcall_no_clobber,@function32good_indirect_tailcall_no_clobber:33// CHECK-NOT: good_indirect_tailcall_no_clobber34 autia x0, x135 br x036 .size good_indirect_tailcall_no_clobber, .-good_indirect_tailcall_no_clobber37 38 .globl bad_direct_tailcall_not_auted39 .type bad_direct_tailcall_not_auted,@function40bad_direct_tailcall_not_auted:41// CHECK-LABEL: GS-PAUTH: untrusted link register found before tail call in function bad_direct_tailcall_not_auted, basic block {{[^,]+}}, at address42// CHECK-NEXT: The instruction is {{[0-9a-f]+}}: b callee # TAILCALL43// CHECK-NEXT: The 1 instructions that write to the affected registers after any authentication are:44// CHECK-NEXT: 1. {{[0-9a-f]+}}: ldp x29, x30, [sp], #0x1045// CHECK-NEXT: This happens in the following basic block:46// CHECK-NEXT: {{[0-9a-f]+}}: stp x29, x30, [sp, #-0x10]!47// CHECK-NEXT: {{[0-9a-f]+}}: ldp x29, x30, [sp], #0x1048// CHECK-NEXT: {{[0-9a-f]+}}: b callee # TAILCALL49 stp x29, x30, [sp, #-0x10]!50 ldp x29, x30, [sp], #0x1051 b callee52 .size bad_direct_tailcall_not_auted, .-bad_direct_tailcall_not_auted53 54 .globl bad_plt_tailcall_not_auted55 .type bad_plt_tailcall_not_auted,@function56bad_plt_tailcall_not_auted:57// FIXME: Calls via PLT are disassembled incorrectly. Nevertheless, they are58// still detected as tail calls.59// CHECK-LABEL: GS-PAUTH: untrusted link register found before tail call in function bad_plt_tailcall_not_auted, basic block {{[^,]+}}, at address60// CHECK-NEXT: The instruction is {{[0-9a-f]+}}: b bad_indirect_tailcall_not_auted # TAILCALL61// CHECK-NEXT: The 1 instructions that write to the affected registers after any authentication are:62// CHECK-NEXT: 1. {{[0-9a-f]+}}: ldp x29, x30, [sp], #0x1063// CHECK-NEXT: This happens in the following basic block:64// CHECK-NEXT: {{[0-9a-f]+}}: stp x29, x30, [sp, #-0x10]!65// CHECK-NEXT: {{[0-9a-f]+}}: ldp x29, x30, [sp], #0x1066// CHECK-NEXT: {{[0-9a-f]+}}: b bad_indirect_tailcall_not_auted # TAILCALL67 stp x29, x30, [sp, #-0x10]!68 ldp x29, x30, [sp], #0x1069 b callee_ext70 .size bad_plt_tailcall_not_auted, .-bad_plt_tailcall_not_auted71 72 .globl bad_indirect_tailcall_not_auted73 .type bad_indirect_tailcall_not_auted,@function74bad_indirect_tailcall_not_auted:75// CHECK-LABEL: GS-PAUTH: untrusted link register found before tail call in function bad_indirect_tailcall_not_auted, basic block {{[^,]+}}, at address76// CHECK-NEXT: The instruction is {{[0-9a-f]+}}: br x0 # TAILCALL77// CHECK-NEXT: The 1 instructions that write to the affected registers after any authentication are:78// CHECK-NEXT: 1. {{[0-9a-f]+}}: ldp x29, x30, [sp], #0x1079// CHECK-NEXT: This happens in the following basic block:80// CHECK-NEXT: {{[0-9a-f]+}}: stp x29, x30, [sp, #-0x10]!81// CHECK-NEXT: {{[0-9a-f]+}}: ldp x29, x30, [sp], #0x1082// CHECK-NEXT: {{[0-9a-f]+}}: autia x0, x183// CHECK-NEXT: {{[0-9a-f]+}}: br x0 # TAILCALL84 stp x29, x30, [sp, #-0x10]!85 ldp x29, x30, [sp], #0x1086 autia x0, x187 br x088 .size bad_indirect_tailcall_not_auted, .-bad_indirect_tailcall_not_auted89 90 .globl bad_direct_tailcall_untrusted91 .type bad_direct_tailcall_untrusted,@function92bad_direct_tailcall_untrusted:93// FPAC-NOT: bad_direct_tailcall_untrusted94// NOFPAC-LABEL: GS-PAUTH: untrusted link register found before tail call in function bad_direct_tailcall_untrusted, basic block {{[^,]+}}, at address95// NOFPAC-NEXT: The instruction is {{[0-9a-f]+}}: b callee # TAILCALL96// NOFPAC-NEXT: The 0 instructions that write to the affected registers after any authentication are:97// NOFPAC-LABEL: GS-PAUTH: authentication oracle found in function bad_direct_tailcall_untrusted, basic block {{[^,]+}}, at address98// NOFPAC-NEXT: The instruction is {{[0-9a-f]+}}: autiasp99// NOFPAC-NEXT: The 1 instructions that leak the affected registers are:100// NOFPAC-NEXT: 1. {{[0-9a-f]+}}: b callee # TAILCALL101// NOFPAC-NEXT: This happens in the following basic block:102// NOFPAC-NEXT: {{[0-9a-f]+}}: paciasp103// NOFPAC-NEXT: {{[0-9a-f]+}}: stp x29, x30, [sp, #-0x10]!104// NOFPAC-NEXT: {{[0-9a-f]+}}: ldp x29, x30, [sp], #0x10105// NOFPAC-NEXT: {{[0-9a-f]+}}: autiasp106// NOFPAC-NEXT: {{[0-9a-f]+}}: b callee # TAILCALL107 paciasp108 stp x29, x30, [sp, #-0x10]!109 ldp x29, x30, [sp], #0x10110 autiasp111 b callee112 .size bad_direct_tailcall_untrusted, .-bad_direct_tailcall_untrusted113 114 .globl bad_plt_tailcall_untrusted115 .type bad_plt_tailcall_untrusted,@function116bad_plt_tailcall_untrusted:117// FIXME: Calls via PLT are disassembled incorrectly. Nevertheless, they are118// still detected as tail calls.119// FPAC-NOT: bad_plt_tailcall_untrusted120// NOFPAC-LABEL: GS-PAUTH: untrusted link register found before tail call in function bad_plt_tailcall_untrusted, basic block {{[^,]+}}, at address121// NOFPAC-NEXT: The instruction is {{[0-9a-f]+}}: b bad_indirect_tailcall_untrusted # TAILCALL122// NOFPAC-NEXT: The 0 instructions that write to the affected registers after any authentication are:123// NOFPAC-LABEL: GS-PAUTH: authentication oracle found in function bad_plt_tailcall_untrusted, basic block {{[^,]+}}, at address124// NOFPAC-NEXT: The instruction is {{[0-9a-f]+}}: autiasp125// NOFPAC-NEXT: The 1 instructions that leak the affected registers are:126// NOFPAC-NEXT: 1. {{[0-9a-f]+}}: b bad_indirect_tailcall_untrusted # TAILCALL127// NOFPAC-NEXT: This happens in the following basic block:128// NOFPAC-NEXT: {{[0-9a-f]+}}: paciasp129// NOFPAC-NEXT: {{[0-9a-f]+}}: stp x29, x30, [sp, #-0x10]!130// NOFPAC-NEXT: {{[0-9a-f]+}}: ldp x29, x30, [sp], #0x10131// NOFPAC-NEXT: {{[0-9a-f]+}}: autiasp132// NOFPAC-NEXT: {{[0-9a-f]+}}: b bad_indirect_tailcall_untrusted # TAILCALL133 paciasp134 stp x29, x30, [sp, #-0x10]!135 ldp x29, x30, [sp], #0x10136 autiasp137 b callee_ext138 .size bad_plt_tailcall_untrusted, .-bad_plt_tailcall_untrusted139 140 .globl bad_indirect_tailcall_untrusted141 .type bad_indirect_tailcall_untrusted,@function142bad_indirect_tailcall_untrusted:143// FPAC-NOT: bad_indirect_tailcall_untrusted144// NOFPAC-LABEL: GS-PAUTH: untrusted link register found before tail call in function bad_indirect_tailcall_untrusted, basic block {{[^,]+}}, at address145// NOFPAC-NEXT: The instruction is {{[0-9a-f]+}}: br x0 # TAILCALL146// NOFPAC-NEXT: The 0 instructions that write to the affected registers after any authentication are:147// NOFPAC-LABEL: GS-PAUTH: authentication oracle found in function bad_indirect_tailcall_untrusted, basic block {{[^,]+}}, at address148// NOFPAC-NEXT: The instruction is {{[0-9a-f]+}}: autiasp149// NOFPAC-NEXT: The 1 instructions that leak the affected registers are:150// NOFPAC-NEXT: 1. {{[0-9a-f]+}}: br x0 # TAILCALL151// NOFPAC-NEXT: This happens in the following basic block:152// NOFPAC-NEXT: {{[0-9a-f]+}}: paciasp153// NOFPAC-NEXT: {{[0-9a-f]+}}: stp x29, x30, [sp, #-0x10]!154// NOFPAC-NEXT: {{[0-9a-f]+}}: ldp x29, x30, [sp], #0x10155// NOFPAC-NEXT: {{[0-9a-f]+}}: autiasp156// NOFPAC-NEXT: {{[0-9a-f]+}}: autia x0, x1157// NOFPAC-NEXT: {{[0-9a-f]+}}: br x0 # TAILCALL158 paciasp159 stp x29, x30, [sp, #-0x10]!160 ldp x29, x30, [sp], #0x10161 autiasp162 autia x0, x1163 br x0164 .size bad_indirect_tailcall_untrusted, .-bad_indirect_tailcall_untrusted165 166 .globl good_direct_tailcall_trusted167 .type good_direct_tailcall_trusted,@function168good_direct_tailcall_trusted:169// CHECK-NOT: good_direct_tailcall_trusted170 paciasp171 stp x29, x30, [sp, #-0x10]!172 ldp x29, x30, [sp], #0x10173 autiasp174 ldr w2, [x30]175 b callee176 .size good_direct_tailcall_trusted, .-good_direct_tailcall_trusted177 178 .globl good_plt_tailcall_trusted179 .type good_plt_tailcall_trusted,@function180good_plt_tailcall_trusted:181// CHECK-NOT: good_plt_tailcall_trusted182 paciasp183 stp x29, x30, [sp, #-0x10]!184 ldp x29, x30, [sp], #0x10185 autiasp186 ldr w2, [x30]187 b callee_ext188 .size good_plt_tailcall_trusted, .-good_plt_tailcall_trusted189 190 .globl good_indirect_tailcall_trusted191 .type good_indirect_tailcall_trusted,@function192good_indirect_tailcall_trusted:193// CHECK-NOT: good_indirect_tailcall_trusted194 paciasp195 stp x29, x30, [sp, #-0x10]!196 ldp x29, x30, [sp], #0x10197 autiasp198 ldr w2, [x30]199 autia x0, x1200 br x0201 .size good_indirect_tailcall_trusted, .-good_indirect_tailcall_trusted202 203 .globl good_direct_tailcall_no_clobber_multi_bb204 .type good_direct_tailcall_no_clobber_multi_bb,@function205good_direct_tailcall_no_clobber_multi_bb:206// CHECK-NOT: good_direct_tailcall_no_clobber_multi_bb207 b 1f2081:209 b callee210 .size good_direct_tailcall_no_clobber_multi_bb, .-good_direct_tailcall_no_clobber_multi_bb211 212 .globl good_indirect_tailcall_no_clobber_multi_bb213 .type good_indirect_tailcall_no_clobber_multi_bb,@function214good_indirect_tailcall_no_clobber_multi_bb:215// CHECK-NOT: good_indirect_tailcall_no_clobber_multi_bb216 autia x0, x1217 b 1f2181:219 br x0220 .size good_indirect_tailcall_no_clobber_multi_bb_multi_bb, .-good_indirect_tailcall_no_clobber_multi_bb_multi_bb221 222 .globl bad_direct_tailcall_not_auted_multi_bb223 .type bad_direct_tailcall_not_auted_multi_bb,@function224bad_direct_tailcall_not_auted_multi_bb:225// CHECK-LABEL: GS-PAUTH: untrusted link register found before tail call in function bad_direct_tailcall_not_auted_multi_bb, basic block {{[^,]+}}, at address226// CHECK-NEXT: The instruction is {{[0-9a-f]+}}: b callee # TAILCALL227// CHECK-NEXT: The 1 instructions that write to the affected registers after any authentication are:228// CHECK-NEXT: 1. {{[0-9a-f]+}}: ldp x29, x30, [sp], #0x10229 stp x29, x30, [sp, #-0x10]!230 ldp x29, x30, [sp], #0x10231 cbz x3, 1f232 autiasp233 ldr w2, [x30]2341:235 b callee236 .size bad_direct_tailcall_not_auted_multi_bb, .-bad_direct_tailcall_not_auted_multi_bb237 238 .globl bad_indirect_tailcall_not_auted_multi_bb239 .type bad_indirect_tailcall_not_auted_multi_bb,@function240bad_indirect_tailcall_not_auted_multi_bb:241// CHECK-LABEL: GS-PAUTH: untrusted link register found before tail call in function bad_indirect_tailcall_not_auted_multi_bb, basic block {{[^,]+}}, at address242// CHECK-NEXT: The instruction is {{[0-9a-f]+}}: br x0 # UNKNOWN CONTROL FLOW243// CHECK-NEXT: The 1 instructions that write to the affected registers after any authentication are:244// CHECK-NEXT: 1. {{[0-9a-f]+}}: ldp x29, x30, [sp], #0x10245 stp x29, x30, [sp, #-0x10]!246 ldp x29, x30, [sp], #0x10247 cbz x3, 1f248 autiasp249 ldr w2, [x30]2501:251 autia x0, x1252 br x0253 .size bad_indirect_tailcall_not_auted_multi_bb, .-bad_indirect_tailcall_not_auted_multi_bb254 255 .globl bad_direct_tailcall_untrusted_multi_bb256 .type bad_direct_tailcall_untrusted_multi_bb,@function257bad_direct_tailcall_untrusted_multi_bb:258// FPAC-NOT: bad_direct_tailcall_untrusted_multi_bb259// NOFPAC-LABEL: GS-PAUTH: untrusted link register found before tail call in function bad_direct_tailcall_untrusted_multi_bb, basic block {{[^,]+}}, at address260// NOFPAC-NEXT: The instruction is {{[0-9a-f]+}}: b callee # TAILCALL261// NOFPAC-NEXT: The 0 instructions that write to the affected registers after any authentication are:262// NOFPAC-LABEL: GS-PAUTH: authentication oracle found in function bad_direct_tailcall_untrusted_multi_bb, basic block {{[^,]+}}, at address263// NOFPAC-NEXT: The instruction is {{[0-9a-f]+}}: autiasp264// NOFPAC-NEXT: The 1 instructions that leak the affected registers are:265// NOFPAC-NEXT: 1. {{[0-9a-f]+}}: b callee # TAILCALL266 paciasp267 stp x29, x30, [sp, #-0x10]!268 ldp x29, x30, [sp], #0x10269 autiasp270 cbz x3, 1f271 ldr w2, [x30]2721:273 b callee274 .size bad_direct_tailcall_untrusted_multi_bb, .-bad_direct_tailcall_untrusted_multi_bb275 276 .globl bad_indirect_tailcall_untrusted_multi_bb277 .type bad_indirect_tailcall_untrusted_multi_bb,@function278bad_indirect_tailcall_untrusted_multi_bb:279// FPAC-NOT: bad_indirect_tailcall_untrusted_multi_bb280// NOFPAC-LABEL: GS-PAUTH: untrusted link register found before tail call in function bad_indirect_tailcall_untrusted_multi_bb, basic block {{[^,]+}}, at address281// NOFPAC-NEXT: The instruction is {{[0-9a-f]+}}: br x0 # UNKNOWN CONTROL FLOW282// NOFPAC-NEXT: The 0 instructions that write to the affected registers after any authentication are:283// NOFPAC-LABEL: GS-PAUTH: authentication oracle found in function bad_indirect_tailcall_untrusted_multi_bb, basic block {{[^,]+}}, at address284// NOFPAC-NEXT: The instruction is {{[0-9a-f]+}}: autiasp285// NOFPAC-NEXT: The 0 instructions that leak the affected registers are:286 paciasp287 stp x29, x30, [sp, #-0x10]!288 ldp x29, x30, [sp], #0x10289 autiasp290 cbz x3, 1f291 ldr w2, [x30]2921:293 autia x0, x1294 br x0295 .size bad_indirect_tailcall_untrusted_multi_bb, .-bad_indirect_tailcall_untrusted_multi_bb296 297 .globl good_direct_tailcall_trusted_multi_bb298 .type good_direct_tailcall_trusted_multi_bb,@function299good_direct_tailcall_trusted_multi_bb:300// CHECK-NOT: good_direct_tailcall_trusted_multi_bb301 paciasp302 stp x29, x30, [sp, #-0x10]!303 ldp x29, x30, [sp], #0x10304 autiasp305 ldr w2, [x30]306 b 1f3071:308 b callee309 .size good_direct_tailcall_trusted_multi_bb, .-good_direct_tailcall_trusted_multi_bb310 311 .globl good_indirect_tailcall_trusted_multi_bb312 .type good_indirect_tailcall_trusted_multi_bb,@function313good_indirect_tailcall_trusted_multi_bb:314// CHECK-NOT: good_indirect_tailcall_trusted_multi_bb315 paciasp316 stp x29, x30, [sp, #-0x10]!317 ldp x29, x30, [sp], #0x10318 autiasp319 ldr w2, [x30]320 b 1f3211:322 autia x0, x1323 br x0324 .size good_indirect_tailcall_trusted_multi_bb, .-good_indirect_tailcall_trusted_multi_bb325 326 .globl good_direct_tailcall_no_clobber_nocfg327 .type good_direct_tailcall_no_clobber_nocfg,@function328good_direct_tailcall_no_clobber_nocfg:329// CHECK-NOT: good_direct_tailcall_no_clobber_nocfg330 adr x3, 1f331 br x33321:333 b callee334 .size good_direct_tailcall_no_clobber_nocfg, .-good_direct_tailcall_no_clobber_nocfg335 336 .globl good_plt_tailcall_no_clobber_nocfg337 .type good_plt_tailcall_no_clobber_nocfg,@function338good_plt_tailcall_no_clobber_nocfg:339// CHECK-NOT: good_plt_tailcall_no_clobber_nocfg340 adr x3, 1f341 br x33421:343 b callee_ext344 .size good_plt_tailcall_no_clobber_nocfg, .-good_plt_tailcall_no_clobber_nocfg345 346 .globl good_indirect_tailcall_no_clobber_nocfg347 .type good_indirect_tailcall_no_clobber_nocfg,@function348good_indirect_tailcall_no_clobber_nocfg:349// CHECK-NOT: good_indirect_tailcall_no_clobber_nocfg350 adr x3, 1f351 br x33521:353 autia x0, x1354 br x0355 .size good_indirect_tailcall_no_clobber_nocfg, .-good_indirect_tailcall_no_clobber_nocfg356 357 .globl bad_direct_tailcall_not_auted_nocfg358 .type bad_direct_tailcall_not_auted_nocfg,@function359bad_direct_tailcall_not_auted_nocfg:360// CHECK-LABEL: GS-PAUTH: untrusted link register found before tail call in function bad_direct_tailcall_not_auted_nocfg, at address361// CHECK-NEXT: The instruction is {{[0-9a-f]+}}: b callee # TAILCALL362// CHECK-NEXT: The 1 instructions that write to the affected registers after any authentication are:363// CHECK-NEXT: 1. {{[0-9a-f]+}}: ldp x29, x30, [sp], #0x10364 stp x29, x30, [sp, #-0x10]!365 adr x3, 1f366 br x33671:368 ldp x29, x30, [sp], #0x10369 b callee370 .size bad_direct_tailcall_not_auted_nocfg, .-bad_direct_tailcall_not_auted_nocfg371 372 .globl bad_plt_tailcall_not_auted_nocfg373 .type bad_plt_tailcall_not_auted_nocfg,@function374bad_plt_tailcall_not_auted_nocfg:375// FIXME: Calls via PLT are disassembled incorrectly. Nevertheless, they are376// still detected as tail calls.377// CHECK-LABEL: GS-PAUTH: untrusted link register found before tail call in function bad_plt_tailcall_not_auted_nocfg, at address378// CHECK-NEXT: The instruction is {{[0-9a-f]+}}: b bad_indirect_tailcall_not_auted_nocfg # TAILCALL379// CHECK-NEXT: The 1 instructions that write to the affected registers after any authentication are:380// CHECK-NEXT: 1. {{[0-9a-f]+}}: ldp x29, x30, [sp], #0x10381 stp x29, x30, [sp, #-0x10]!382 adr x3, 1f383 br x33841:385 ldp x29, x30, [sp], #0x10386 b callee_ext387 .size bad_plt_tailcall_not_auted_nocfg, .-bad_plt_tailcall_not_auted_nocfg388 389 .globl bad_indirect_tailcall_not_auted_nocfg390 .type bad_indirect_tailcall_not_auted_nocfg,@function391bad_indirect_tailcall_not_auted_nocfg:392// Known false positive: ignoring UNKNOWN CONTROL FLOW without CFG.393// CHECK-NOT: bad_indirect_tailcall_not_auted_nocfg394 stp x29, x30, [sp, #-0x10]!395 adr x3, 1f396 br x33971:398 ldp x29, x30, [sp], #0x10399 autia x0, x1400 br x0401 .size bad_indirect_tailcall_not_auted_nocfg, .-bad_indirect_tailcall_not_auted_nocfg402 403 .globl bad_direct_tailcall_untrusted_nocfg404 .type bad_direct_tailcall_untrusted_nocfg,@function405bad_direct_tailcall_untrusted_nocfg:406// FPAC-NOT: bad_direct_tailcall_untrusted_nocfg407// NOFPAC-LABEL: GS-PAUTH: untrusted link register found before tail call in function bad_direct_tailcall_untrusted_nocfg, at address408// NOFPAC-NEXT: The instruction is {{[0-9a-f]+}}: b callee # TAILCALL409// NOFPAC-NEXT: The 0 instructions that write to the affected registers after any authentication are:410// NOFPAC-LABEL: GS-PAUTH: authentication oracle found in function bad_direct_tailcall_untrusted_nocfg, at address411// NOFPAC-NEXT: The instruction is {{[0-9a-f]+}}: autiasp412// NOFPAC-NEXT: The 1 instructions that leak the affected registers are:413// NOFPAC-NEXT: 1. {{[0-9a-f]+}}: b callee # TAILCALL414 paciasp415 stp x29, x30, [sp, #-0x10]!416 adr x3, 1f417 br x34181:419 ldp x29, x30, [sp], #0x10420 autiasp421 b callee422 .size bad_direct_tailcall_untrusted_nocfg, .-bad_direct_tailcall_untrusted_nocfg423 424 .globl bad_plt_tailcall_untrusted_nocfg425 .type bad_plt_tailcall_untrusted_nocfg,@function426bad_plt_tailcall_untrusted_nocfg:427// FIXME: Calls via PLT are disassembled incorrectly. Nevertheless, they are428// still detected as tail calls.429// FPAC-NOT: bad_plt_tailcall_untrusted_nocfg430// NOFPAC-LABEL: GS-PAUTH: untrusted link register found before tail call in function bad_plt_tailcall_untrusted_nocfg, at address431// NOFPAC-NEXT: The instruction is {{[0-9a-f]+}}: b bad_indirect_tailcall_untrusted_nocfg # TAILCALL432// NOFPAC-NEXT: The 0 instructions that write to the affected registers after any authentication are:433// NOFPAC-LABEL: GS-PAUTH: authentication oracle found in function bad_plt_tailcall_untrusted_nocfg, at address434// NOFPAC-NEXT: The instruction is {{[0-9a-f]+}}: autiasp435// NOFPAC-NEXT: The 1 instructions that leak the affected registers are:436// NOFPAC-NEXT: 1. {{[0-9a-f]+}}: b bad_indirect_tailcall_untrusted_nocfg # TAILCALL437 paciasp438 stp x29, x30, [sp, #-0x10]!439 adr x3, 1f440 br x34411:442 ldp x29, x30, [sp], #0x10443 autiasp444 b callee_ext445 .size bad_plt_tailcall_untrusted_nocfg, .-bad_plt_tailcall_untrusted_nocfg446 447 .globl bad_indirect_tailcall_untrusted_nocfg448 .type bad_indirect_tailcall_untrusted_nocfg,@function449bad_indirect_tailcall_untrusted_nocfg:450// Known false negative: ignoring UNKNOWN CONTROL FLOW without CFG.451// Authentication oracle is found by a generic checker, though.452// FPAC-NOT: bad_indirect_tailcall_untrusted_nocfg453// NOFPAC-NOT: untrusted link register{{.*}}bad_indirect_tailcall_untrusted_nocfg454// NOFPAC-LABEL: GS-PAUTH: authentication oracle found in function bad_indirect_tailcall_untrusted_nocfg, at address455// NOFPAC-NEXT: The instruction is {{[0-9a-f]+}}: autiasp456// NOFPAC-NEXT: The 0 instructions that leak the affected registers are:457// NOFPAC-NOT: untrusted link register{{.*}}bad_indirect_tailcall_untrusted_nocfg458 paciasp459 stp x29, x30, [sp, #-0x10]!460 adr x3, 1f461 br x34621:463 ldp x29, x30, [sp], #0x10464 autiasp465 autia x0, x1466 br x0467 .size bad_indirect_tailcall_untrusted_nocfg, .-bad_indirect_tailcall_untrusted_nocfg468 469 .globl good_direct_tailcall_trusted_nocfg470 .type good_direct_tailcall_trusted_nocfg,@function471good_direct_tailcall_trusted_nocfg:472// CHECK-NOT: good_direct_tailcall_trusted_nocfg473 paciasp474 stp x29, x30, [sp, #-0x10]!475 adr x3, 1f476 br x34771:478 ldp x29, x30, [sp], #0x10479 autiasp480 ldr w2, [x30]481 b callee482 .size good_direct_tailcall_trusted_nocfg, .-good_direct_tailcall_trusted_nocfg483 484 .globl good_plt_tailcall_trusted_nocfg485 .type good_plt_tailcall_trusted_nocfg,@function486good_plt_tailcall_trusted_nocfg:487// CHECK-NOT: good_plt_tailcall_trusted_nocfg488 paciasp489 stp x29, x30, [sp, #-0x10]!490 adr x3, 1f491 br x34921:493 ldp x29, x30, [sp], #0x10494 autiasp495 ldr w2, [x30]496 b callee_ext497 .size good_plt_tailcall_trusted_nocfg, .-good_plt_tailcall_trusted_nocfg498 499 .globl good_indirect_tailcall_trusted_nocfg500 .type good_indirect_tailcall_trusted_nocfg,@function501good_indirect_tailcall_trusted_nocfg:502// CHECK-NOT: good_indirect_tailcall_trusted_nocfg503 paciasp504 stp x29, x30, [sp, #-0x10]!505 adr x3, 1f506 br x35071:508 ldp x29, x30, [sp], #0x10509 autiasp510 ldr w2, [x30]511 autia x0, x1512 br x0513 .size good_indirect_tailcall_trusted_nocfg, .-good_indirect_tailcall_trusted_nocfg514 515// Check Armv8.3-a fused auth+branch instructions.516 517 .globl good_indirect_tailcall_no_clobber_v83518 .type good_indirect_tailcall_no_clobber_v83,@function519good_indirect_tailcall_no_clobber_v83:520// CHECK-NOT: good_indirect_tailcall_no_clobber_v83521 braa x0, x1522 .size good_indirect_tailcall_no_clobber_v83, .-good_indirect_tailcall_no_clobber_v83523 524 .globl bad_indirect_tailcall_untrusted_v83525 .type bad_indirect_tailcall_untrusted_v83,@function526bad_indirect_tailcall_untrusted_v83:527// FPAC-NOT: bad_indirect_tailcall_untrusted_v83528// NOFPAC-LABEL: GS-PAUTH: untrusted link register found before tail call in function bad_indirect_tailcall_untrusted_v83, basic block {{[^,]+}}, at address529// NOFPAC-NEXT: The instruction is {{[0-9a-f]+}}: braa x0, x1 # TAILCALL530// NOFPAC-NEXT: The 0 instructions that write to the affected registers after any authentication are:531// NOFPAC-LABEL: GS-PAUTH: authentication oracle found in function bad_indirect_tailcall_untrusted_v83, basic block {{[^,]+}}, at address532// NOFPAC-NEXT: The instruction is {{[0-9a-f]+}}: autiasp533// NOFPAC-NEXT: The 1 instructions that leak the affected registers are:534// NOFPAC-NEXT: 1. {{[0-9a-f]+}}: braa x0, x1 # TAILCALL535// NOFPAC-NEXT: This happens in the following basic block:536// NOFPAC-NEXT: {{[0-9a-f]+}}: paciasp537// NOFPAC-NEXT: {{[0-9a-f]+}}: stp x29, x30, [sp, #-0x10]!538// NOFPAC-NEXT: {{[0-9a-f]+}}: ldp x29, x30, [sp], #0x10539// NOFPAC-NEXT: {{[0-9a-f]+}}: autiasp540// NOFPAC-NEXT: {{[0-9a-f]+}}: braa x0, x1 # TAILCALL541 paciasp542 stp x29, x30, [sp, #-0x10]!543 ldp x29, x30, [sp], #0x10544 autiasp545 braa x0, x1546 .size bad_indirect_tailcall_untrusted_v83, .-bad_indirect_tailcall_untrusted_v83547 548// Make sure ELF entry function does not generate false positive reports.549// Additionally, check that the correct entry point is read from ELF header.550 551 .globl _start552 .type _start,@function553_start:554// CHECK-LABEL: GS-PAUTH: untrusted link register found before tail call in function _start, basic block {{[^,]+}}, at address555// CHECK-NEXT: The instruction is {{[0-9a-f]+}}: b callee # TAILCALL556// CHECK-NEXT: The 1 instructions that write to the affected registers after any authentication are:557// CHECK-NEXT: 1. {{[0-9a-f]+}}: mov x30, #0x0558// CHECK-NEXT: This happens in the following basic block:559// CHECK-NEXT: {{[0-9a-f]+}}: mov x30, #0x0560// CHECK-NEXT: {{[0-9a-f]+}}: b callee # TAILCALL561 mov x30, #0562 b callee563 .size _start, .-_start564 565 .globl _custom_start566 .type _custom_start,@function567_custom_start:568// CHECK-NOT: _custom_start569 mov x30, #0570 b callee571 .size _custom_start, .-_custom_start572 573// Test two issues being reported for the same instruction.574 575 .globl bad_non_protected_indirect_tailcall_not_auted576 .type bad_non_protected_indirect_tailcall_not_auted,@function577bad_non_protected_indirect_tailcall_not_auted:578// CHECK-LABEL: GS-PAUTH: untrusted link register found before tail call in function bad_non_protected_indirect_tailcall_not_auted, basic block {{[^,]+}}, at address579// CHECK-NEXT: The instruction is {{[0-9a-f]+}}: br x0 # TAILCALL580// CHECK-NEXT: The 1 instructions that write to the affected registers after any authentication are:581// CHECK-NEXT: 1. {{[0-9a-f]+}}: ldp x29, x30, [sp], #0x10582// CHECK-NEXT: This happens in the following basic block:583// CHECK-NEXT: {{[0-9a-f]+}}: stp x29, x30, [sp, #-0x10]!584// CHECK-NEXT: {{[0-9a-f]+}}: ldp x29, x30, [sp], #0x10585// CHECK-NEXT: {{[0-9a-f]+}}: ldr x0, [x1]586// CHECK-NEXT: {{[0-9a-f]+}}: br x0 # TAILCALL587// CHECK-LABEL: GS-PAUTH: non-protected call found in function bad_non_protected_indirect_tailcall_not_auted, basic block {{[^,]+}}, at address588// CHECK-NEXT: The instruction is {{[0-9a-f]+}}: br x0 # TAILCALL589// CHECK-NEXT: The 1 instructions that write to the affected registers after any authentication are:590// CHECK-NEXT: 1. {{[0-9a-f]+}}: ldr x0, [x1]591// CHECK-NEXT: This happens in the following basic block:592// CHECK-NEXT: {{[0-9a-f]+}}: stp x29, x30, [sp, #-0x10]!593// CHECK-NEXT: {{[0-9a-f]+}}: ldp x29, x30, [sp], #0x10594// CHECK-NEXT: {{[0-9a-f]+}}: ldr x0, [x1]595// CHECK-NEXT: {{[0-9a-f]+}}: br x0 # TAILCALL596 stp x29, x30, [sp, #-0x10]!597 ldp x29, x30, [sp], #0x10598 ldr x0, [x1]599 br x0600 .size bad_non_protected_indirect_tailcall_not_auted, .-bad_non_protected_indirect_tailcall_not_auted601 602 .globl main603 .type main,@function604main:605 mov x0, 0606 ret607 .size main, .-main608