// -Wl,--no-relax prevents converting ADRP+ADD pairs into NOP+ADR.
// RUN: %clang %cflags -march=armv8.3-a -Wl,--no-relax %s -o %t.exe
// RUN: llvm-bolt-binary-analysis --scanners=pauth %t.exe 2>&1 | FileCheck %s

// Test various patterns that should or should not be considered safe
// materialization of PC-relative addresses.
//
// Note that while "instructions that write to the affected registers"
// section of the report is still technically correct, it does not necessarily
// mention the instructions that are used incorrectly.

        .text

// Define a function that is reachable by ADR instruction.
        .type   sym,@function
sym:
        ret
        .size   sym, .-sym

        .globl  good_adr
        .type   good_adr,@function
good_adr:
// CHECK-NOT: good_adr
        adr     x0, sym
        paciza  x0
        ret
        .size   good_adr, .-good_adr

        .globl  good_adrp
        .type   good_adrp,@function
good_adrp:
// CHECK-NOT: good_adrp
        adrp    x0, sym
        paciza  x0
        ret
        .size   good_adrp, .-good_adrp

        .globl  good_adrp_add
        .type   good_adrp_add,@function
good_adrp_add:
// CHECK-NOT: good_adrp_add
        adrp    x0, sym
        add     x0, x0, :lo12:sym
        paciza  x0
        ret
        .size   good_adrp_add, .-good_adrp_add

        .globl  good_adrp_add_with_const_offset
        .type   good_adrp_add_with_const_offset,@function
good_adrp_add_with_const_offset:
// CHECK-NOT: good_adrp_add_with_const_offset
        adrp    x0, sym
        add     x0, x0, :lo12:sym
        add     x0, x0, #8
        paciza  x0
        ret
        .size   good_adrp_add_with_const_offset, .-good_adrp_add_with_const_offset

        .globl  bad_adrp_with_nonconst_offset
        .type   bad_adrp_with_nonconst_offset,@function
bad_adrp_with_nonconst_offset:
// CHECK-LABEL: GS-PAUTH: signing oracle found in function bad_adrp_with_nonconst_offset, basic block {{[^,]+}}, at address
// CHECK-NEXT:  The instruction is     {{[0-9a-f]+}}:      paciza  x0
// CHECK-NEXT:  The 1 instructions that write to the affected registers after any authentication are:
// CHECK-NEXT:  1.     {{[0-9a-f]+}}:      add     x0, x0, x1
// CHECK-NEXT:  This happens in the following basic block:
// CHECK-NEXT:  {{[0-9a-f]+}}:   adrp    x0, #{{.*}}
// CHECK-NEXT:  {{[0-9a-f]+}}:   add     x0, x0, x1
// CHECK-NEXT:  {{[0-9a-f]+}}:   paciza  x0
// CHECK-NEXT:  {{[0-9a-f]+}}:   ret
        adrp    x0, sym
        add     x0, x0, x1
        paciza  x0
        ret
        .size   bad_adrp_with_nonconst_offset, .-bad_adrp_with_nonconst_offset

        .globl  bad_split_adrp
        .type   bad_split_adrp,@function
bad_split_adrp:
// CHECK-LABEL: GS-PAUTH: signing oracle found in function bad_split_adrp, basic block {{[^,]+}}, at address
// CHECK-NEXT:  The instruction is     {{[0-9a-f]+}}:      paciza  x0
// CHECK-NEXT:  The 1 instructions that write to the affected registers after any authentication are:
// CHECK-NEXT:  1.     {{[0-9a-f]+}}:      add     x0, x0, #0x{{[0-9a-f]+}}
// CHECK-NEXT:  This happens in the following basic block:
// CHECK-NEXT:  {{[0-9a-f]+}}:   add     x0, x0, #0x{{[0-9a-f]+}}
// CHECK-NEXT:  {{[0-9a-f]+}}:   paciza  x0
// CHECK-NEXT:  {{[0-9a-f]+}}:   ret
        cbz     x2, 1f
        adrp    x0, sym
1:
        add     x0, x0, :lo12:sym
        paciza  x0
        ret
        .size   bad_split_adrp, .-bad_split_adrp

// Materialization of absolute addresses is not handled, as it is not expected
// to be used by real-world code, but can be supported if needed.

        .globl  bad_immediate_constant
        .type   bad_immediate_constant,@function
bad_immediate_constant:
// CHECK-LABEL: GS-PAUTH: signing oracle found in function bad_immediate_constant, basic block {{[^,]+}}, at address
// CHECK-NEXT:  The instruction is     {{[0-9a-f]+}}:      paciza  x0
// CHECK-NEXT:  The 1 instructions that write to the affected registers after any authentication are:
// CHECK-NEXT:  1.     {{[0-9a-f]+}}:      mov     x0, #{{.*}}
// CHECK-NEXT:  This happens in the following basic block:
// CHECK-NEXT:  {{[0-9a-f]+}}:   mov     x0, #{{.*}}
// CHECK-NEXT:  {{[0-9a-f]+}}:   paciza  x0
// CHECK-NEXT:  {{[0-9a-f]+}}:   ret
        movz    x0, #1234
        paciza  x0
        ret
        .size   bad_immediate_constant, .-bad_immediate_constant

// Any ADR or ADRP instruction followed by any number of increments/decrements
// by constant is considered safe.

        .globl  good_adr_with_add
        .type   good_adr_with_add,@function
good_adr_with_add:
// CHECK-NOT: good_adr_with_add
        adr     x0, sym
        add     x0, x0, :lo12:sym
        paciza  x0
        ret
        .size   good_adr_with_add, .-good_adr_with_add

        .globl  good_adrp_with_add_non_consecutive
        .type   good_adrp_with_add_non_consecutive,@function
good_adrp_with_add_non_consecutive:
// CHECK-NOT: good_adrp_with_add_non_consecutive
        adrp    x0, sym
        mul     x1, x2, x3
        add     x0, x0, :lo12:sym
        paciza  x0
        ret
        .size   good_adrp_with_add_non_consecutive, .-good_adrp_with_add_non_consecutive

        .globl  good_many_offsets
        .type   good_many_offsets,@function
good_many_offsets:
// CHECK-NOT: good_many_offsets
        adrp    x0, sym
        add     x1, x0, #8
        add     x2, x1, :lo12:sym
        paciza  x2
        ret
        .size   good_many_offsets, .-good_many_offsets

        .globl  good_negative_offset
        .type   good_negative_offset,@function
good_negative_offset:
// CHECK-NOT: good_negative_offset
        adr     x0, sym
        sub     x1, x0, #8
        paciza  x1
        ret
        .size   good_negative_offset, .-good_negative_offset

// MOV Xd, Xm (which is an alias of ORR Xd, XZR, Xm) is handled as part of
// support for address arithmetics, but ORR in general is not.
// This restriction may be relaxed in the future.

        .globl  good_mov_reg
        .type   good_mov_reg,@function
good_mov_reg:
// CHECK-NOT: good_mov_reg
        adrp    x0, sym
        mov     x1, x0
        orr     x2, xzr, x1 // the same as "mov x2, x1"
        paciza  x2
        ret
        .size   good_mov_reg, .-good_mov_reg

        .globl  bad_orr_not_xzr
        .type   bad_orr_not_xzr,@function
bad_orr_not_xzr:
// CHECK-LABEL: GS-PAUTH: signing oracle found in function bad_orr_not_xzr, basic block {{[^,]+}}, at address
// CHECK-NEXT:  The instruction is     {{[0-9a-f]+}}:      paciza  x2
// CHECK-NEXT:  The 1 instructions that write to the affected registers after any authentication are:
// CHECK-NEXT:  1.     {{[0-9a-f]+}}:      orr     x2, x1, x0
// CHECK-NEXT:  This happens in the following basic block:
// CHECK-NEXT:  {{[0-9a-f]+}}:   adrp    x0, #{{(0x)?[0-9a-f]+}}
// CHECK-NEXT:  {{[0-9a-f]+}}:   mov     x1, #0
// CHECK-NEXT:  {{[0-9a-f]+}}:   orr     x2, x1, x0
// CHECK-NEXT:  {{[0-9a-f]+}}:   paciza  x2
// CHECK-NEXT:  {{[0-9a-f]+}}:   ret
        adrp    x0, sym
        // The generic case of "orr Xd, Xn, Xm" is not allowed so far,
        // even if Xn is known to be safe
        movz    x1, #0
        orr     x2, x1, x0
        paciza  x2
        ret
        .size   bad_orr_not_xzr, .-bad_orr_not_xzr

        .globl  bad_orr_not_lsl0
        .type   bad_orr_not_lsl0,@function
bad_orr_not_lsl0:
// CHECK-LABEL: GS-PAUTH: signing oracle found in function bad_orr_not_lsl0, basic block {{[^,]+}}, at address
// CHECK-NEXT:  The instruction is     {{[0-9a-f]+}}:      paciza  x2
// CHECK-NEXT:  The 1 instructions that write to the affected registers after any authentication are:
// CHECK-NEXT:  1.     {{[0-9a-f]+}}:      orr     x2, xzr, x0, lsl #1
// CHECK-NEXT:  This happens in the following basic block:
// CHECK-NEXT:  {{[0-9a-f]+}}:   adrp    x0, #{{(0x)?[0-9a-f]+}}
// CHECK-NEXT:  {{[0-9a-f]+}}:   orr     x2, xzr, x0, lsl #1
// CHECK-NEXT:  {{[0-9a-f]+}}:   paciza  x2
// CHECK-NEXT:  {{[0-9a-f]+}}:   ret
        adrp    x0, sym
        // Currently, the only allowed form of "orr" is that used by "mov Xd, Xn" alias.
        // This can be relaxed in the future.
        orr     x2, xzr, x0, lsl #1
        paciza  x2
        ret
        .size   bad_orr_not_lsl0, .-bad_orr_not_lsl0

// Check that the input register operands of `add`/`mov` is correct.

        .globl  bad_add_input_reg
        .type   bad_add_input_reg,@function
bad_add_input_reg:
// CHECK-LABEL: GS-PAUTH: signing oracle found in function bad_add_input_reg, basic block {{[^,]+}}, at address
// CHECK-NEXT:  The instruction is     {{[0-9a-f]+}}:      paciza  x0
// CHECK-NEXT:  The 1 instructions that write to the affected registers after any authentication are:
// CHECK-NEXT:  1.     {{[0-9a-f]+}}:      add     x0, x1, #0x{{[0-9a-f]+}}
// CHECK-NEXT:  This happens in the following basic block:
// CHECK-NEXT:  {{[0-9a-f]+}}:   adrp    x0, #{{(0x)?[0-9a-f]+}}
// CHECK-NEXT:  {{[0-9a-f]+}}:   add     x0, x1, #0x{{[0-9a-f]+}}
// CHECK-NEXT:  {{[0-9a-f]+}}:   paciza  x0
// CHECK-NEXT:  {{[0-9a-f]+}}:   ret
        adrp    x0, sym
        add     x0, x1, :lo12:sym
        paciza  x0
        ret
        .size   bad_add_input_reg, .-bad_add_input_reg

        .globl  bad_mov_input_reg
        .type   bad_mov_input_reg,@function
bad_mov_input_reg:
// CHECK-LABEL: GS-PAUTH: signing oracle found in function bad_mov_input_reg, basic block {{[^,]+}}, at address
// CHECK-NEXT:  The instruction is     {{[0-9a-f]+}}:      paciza  x0
// CHECK-NEXT:  The 1 instructions that write to the affected registers after any authentication are:
// CHECK-NEXT:  1.     {{[0-9a-f]+}}:      mov     x0, x1
// CHECK-NEXT:  This happens in the following basic block:
// CHECK-NEXT:  {{[0-9a-f]+}}:   adrp    x0, #{{(0x)?[0-9a-f]+}}
// CHECK-NEXT:  {{[0-9a-f]+}}:   mov     x0, x1
// CHECK-NEXT:  {{[0-9a-f]+}}:   paciza  x0
// CHECK-NEXT:  {{[0-9a-f]+}}:   ret
        adrp    x0, sym
        mov     x0, x1
        paciza  x0
        ret
        .size   bad_mov_input_reg, .-bad_mov_input_reg

        .globl  main
        .type   main,@function
main:
        mov     x0, 0
        ret
        .size   main, .-main