// RUN: %clang %cflags -march=armv9.5-a+pauth-lr -mbranch-protection=pac-ret %s %p/../../Inputs/asm_main.c -o %t.exe
// RUN: llvm-bolt-binary-analysis --scanners=ptrauth-pac-ret %t.exe 2>&1 | FileCheck %s

        .text

        .globl  f1
        .type   f1,@function
f1:
        paciasp
        stp     x29, x30, [sp, #-16]!
        mov     x29, sp
        bl      g
        add     x0, x0, #3
        ldp     x29, x30, [sp], #16
        // autiasp
// CHECK-LABEL: GS-PAUTH: non-protected ret found in function f1, basic block {{[0-9a-zA-Z.]+}}, at address
// CHECK-NEXT:    The instruction is     {{[0-9a-f]+}}:       ret
// CHECK-NEXT:    The 1 instructions that write to the affected registers after any authentication are:
// CHECK-NEXT:    1. {{[0-9a-f]+}}: ldp     x29, x30, [sp], #0x10
// CHECK-NEXT:  This happens in the following basic block:
// CHECK-NEXT: {{[0-9a-f]+}}:   paciasp
// CHECK-NEXT: {{[0-9a-f]+}}:   stp     x29, x30, [sp, #-0x10]!
// CHECK-NEXT: {{[0-9a-f]+}}:   mov     x29, sp
// CHECK-NEXT: {{[0-9a-f]+}}:   bl      g
// CHECK-NEXT: {{[0-9a-f]+}}:   add     x0, x0, #0x3
// CHECK-NEXT: {{[0-9a-f]+}}:   ldp     x29, x30, [sp], #0x10
// CHECK-NEXT: {{[0-9a-f]+}}:   ret
        ret
        .size f1, .-f1


        .globl  f_intermediate_overwrite1
        .type   f_intermediate_overwrite1,@function
f_intermediate_overwrite1:
        paciasp
        stp     x29, x30, [sp, #-16]!
        mov     x29, sp
        bl      g
        add     x0, x0, #3
        autiasp
        ldp     x29, x30, [sp], #16
// CHECK-LABEL: GS-PAUTH: non-protected ret found in function f_intermediate_overwrite1, basic block {{[0-9a-zA-Z.]+}}
// CHECK-NEXT:    The instruction is     {{[0-9a-f]+}}:       ret
// CHECK-NEXT:    The 1 instructions that write to the affected registers after any authentication are:
// CHECK-NEXT:    1. {{[0-9a-f]+}}: ldp     x29, x30, [sp], #0x10
// CHECK-NEXT:  This happens in the following basic block:
// CHECK-NEXT: {{[0-9a-f]+}}:   paciasp
// CHECK-NEXT: {{[0-9a-f]+}}:   stp     x29, x30, [sp, #-0x10]!
// CHECK-NEXT: {{[0-9a-f]+}}:   mov     x29, sp
// CHECK-NEXT: {{[0-9a-f]+}}:   bl      g
// CHECK-NEXT: {{[0-9a-f]+}}:   add     x0, x0, #0x3
// CHECK-NEXT: {{[0-9a-f]+}}:   autiasp
// CHECK-NEXT: {{[0-9a-f]+}}:   ldp     x29, x30, [sp], #0x10
// CHECK-NEXT: {{[0-9a-f]+}}:   ret
        ret
        .size f_intermediate_overwrite1, .-f_intermediate_overwrite1

        .globl  f_intermediate_overwrite2
        .type   f_intermediate_overwrite2,@function
f_intermediate_overwrite2:
        paciasp
        stp     x29, x30, [sp, #-16]!
        mov     x29, sp
        bl      g
        add     x0, x0, #3
        ldp     x29, x30, [sp], #16
        autiasp
        mov     x30, x0
// CHECK-LABEL: GS-PAUTH: non-protected ret found in function f_intermediate_overwrite2, basic block {{[0-9a-zA-Z.]+}}, at address
// CHECK-NEXT:    The instruction is     {{[0-9a-f]+}}:       ret
// CHECK-NEXT:    The 1 instructions that write to the affected registers after any authentication are:
// CHECK-NEXT:    1. {{[0-9a-f]+}}: mov     x30, x0
// CHECK-NEXT:  This happens in the following basic block:
// CHECK-NEXT: {{[0-9a-f]+}}:   paciasp
// CHECK-NEXT: {{[0-9a-f]+}}:   stp     x29, x30, [sp, #-0x10]!
// CHECK-NEXT: {{[0-9a-f]+}}:   mov     x29, sp
// CHECK-NEXT: {{[0-9a-f]+}}:   bl      g
// CHECK-NEXT: {{[0-9a-f]+}}:   add     x0, x0, #0x3
// CHECK-NEXT: {{[0-9a-f]+}}:   ldp     x29, x30, [sp], #0x10
// CHECK-NEXT: {{[0-9a-f]+}}:   autiasp
// CHECK-NEXT: {{[0-9a-f]+}}:   mov     x30, x0
// CHECK-NEXT: {{[0-9a-f]+}}:   ret
        ret
        .size f_intermediate_overwrite2, .-f_intermediate_overwrite2

        .globl  f_intermediate_read
        .type   f_intermediate_read,@function
f_intermediate_read:
        paciasp
        stp     x29, x30, [sp, #-16]!
        mov     x29, sp
        bl      g
        add     x0, x0, #3
        ldp     x29, x30, [sp], #16
        autiasp
        mov     x0, x30
// CHECK-NOT: function f_intermediate_read
        ret
        .size f_intermediate_read, .-f_intermediate_read

        .globl  f_intermediate_overwrite3
        .type   f_intermediate_overwrite3,@function
f_intermediate_overwrite3:
        paciasp
        stp     x29, x30, [sp, #-16]!
        mov     x29, sp
        bl      g
        add     x0, x0, #3
        ldp     x29, x30, [sp], #16
        autiasp
        mov     w30, w0
// CHECK-LABEL: GS-PAUTH: non-protected ret found in function f_intermediate_overwrite3, basic block {{[0-9a-zA-Z.]+}}, at address
// CHECK-NEXT:    The instruction is     {{[0-9a-f]+}}:       ret
// CHECK-NEXT:    The 1 instructions that write to the affected registers after any authentication are:
// CHECK-NEXT:    1. {{[0-9a-f]+}}: mov     w30, w0
// CHECK-NEXT:  This happens in the following basic block:
// CHECK-NEXT: {{[0-9a-f]+}}:   paciasp
// CHECK-NEXT: {{[0-9a-f]+}}:   stp     x29, x30, [sp, #-0x10]!
// CHECK-NEXT: {{[0-9a-f]+}}:   mov     x29, sp
// CHECK-NEXT: {{[0-9a-f]+}}:   bl      g
// CHECK-NEXT: {{[0-9a-f]+}}:   add     x0, x0, #0x3
// CHECK-NEXT: {{[0-9a-f]+}}:   ldp     x29, x30, [sp], #0x10
// CHECK-NEXT: {{[0-9a-f]+}}:   autiasp
// CHECK-NEXT: {{[0-9a-f]+}}:   mov     w30, w0
// CHECK-NEXT: {{[0-9a-f]+}}:   ret
        ret
        .size f_intermediate_overwrite3, .-f_intermediate_overwrite3

        .globl  f_nonx30_ret
        .type   f_nonx30_ret,@function
f_nonx30_ret:
        paciasp
        stp     x29, x30, [sp, #-16]!
        mov     x29, sp
        bl      g
        add     x0, x0, #3
        ldp     x29, x30, [sp], #16
        mov     x16, x30
        autiasp
// CHECK-LABEL: GS-PAUTH: non-protected ret found in function f_nonx30_ret, basic block {{[0-9a-zA-Z.]+}}, at address
// CHECK-NEXT:    The instruction is     {{[0-9a-f]+}}:       ret     x16
// CHECK-NEXT:    The 1 instructions that write to the affected registers after any authentication are:
// CHECK-NEXT:    1. {{[0-9a-f]+}}: mov     x16, x30
// CHECK-NEXT:  This happens in the following basic block:
// CHECK-NEXT: {{[0-9a-f]+}}:   paciasp
// CHECK-NEXT: {{[0-9a-f]+}}:   stp     x29, x30, [sp, #-0x10]!
// CHECK-NEXT: {{[0-9a-f]+}}:   mov     x29, sp
// CHECK-NEXT: {{[0-9a-f]+}}:   bl      g
// CHECK-NEXT: {{[0-9a-f]+}}:   add     x0, x0, #0x3
// CHECK-NEXT: {{[0-9a-f]+}}:   ldp     x29, x30, [sp], #0x10
// CHECK-NEXT: {{[0-9a-f]+}}:   mov     x16, x30
// CHECK-NEXT: {{[0-9a-f]+}}:   autiasp
// CHECK-NEXT: {{[0-9a-f]+}}:   ret     x16
        ret     x16
        .size f_nonx30_ret, .-f_nonx30_ret

        .globl  f_nonx30_ret_ok
        .type   f_nonx30_ret_ok,@function
f_nonx30_ret_ok:
        paciasp
        stp     x29, x30, [sp, #-16]!
        mov     x29, sp
        bl      g
        ldp     x29, x30, [sp], #16
        autiasp
        mov     x16, x30
// CHECK-NOT: function f_nonx30_ret_ok
        ret     x16
        .size f_nonx30_ret_ok, .-f_nonx30_ret_ok

        .globl  f_detect_clobbered_x30_passed_to_other
        .type   f_detect_clobbered_x30_passed_to_other,@function
f_detect_clobbered_x30_passed_to_other:
        str x30, [sp]
        ldr x30, [sp]
// FIXME: Ideally, the pac-ret scanner would report on the following instruction, which
// performs a tail call, that x30 might be attacker-controlled.
// CHECK-NOT: function f_detect_clobbered_x30_passed_to_other
        b   f_tail_called
        .size f_detect_clobbered_x30_passed_to_other, .-f_detect_clobbered_x30_passed_to_other

        .globl  f_tail_called
        .type   f_tail_called,@function
f_tail_called:
        ret
        .size f_tail_called, .-f_tail_called

        .globl  f_nonx30_ret_non_auted
        .type   f_nonx30_ret_non_auted,@function
f_nonx30_ret_non_auted:
// x1 is neither authenticated nor implicitly considered safe at function entry.
// Note that we assume it's fine for x30 to not be authenticated before
// returning to, as assuming that x30 is not attacker controlled at function
// entry is part (implicitly) of the pac-ret hardening scheme.
//
// CHECK-LABEL: GS-PAUTH: non-protected ret found in function f_nonx30_ret_non_auted, basic block {{[0-9a-zA-Z.]+}}, at address
// CHECK-NEXT:    The instruction is     {{[0-9a-f]+}}:       ret
// CHECK-NEXT:    The 0 instructions that write to the affected registers after any authentication are:
        ret     x1
        .size f_nonx30_ret_non_auted, .-f_nonx30_ret_non_auted


        .globl  f_callclobbered_x30
        .type   f_callclobbered_x30,@function
f_callclobbered_x30:
        bl      g
// CHECK-LABEL: GS-PAUTH: non-protected ret found in function f_callclobbered_x30, basic block {{[0-9a-zA-Z.]+}}, at address
// CHECK-NEXT:    The instruction is     {{[0-9a-f]+}}:       ret
// CHECK-NEXT:    The 1 instructions that write to the affected registers after any authentication are:
// CHECK-NEXT:    1. {{[0-9a-f]+}}: bl
        ret
        .size f_callclobbered_x30, .-f_callclobbered_x30

        .globl  f_callclobbered_calleesaved
        .type   f_callclobbered_calleesaved,@function
f_callclobbered_calleesaved:
        bl      g
// CHECK-LABEL: GS-PAUTH: non-protected ret found in function f_callclobbered_calleesaved, basic block {{[0-9a-zA-Z.]+}}, at address
// CHECK-NEXT:    The instruction is     {{[0-9a-f]+}}:       ret x19
// CHECK-NEXT:    The 1 instructions that write to the affected registers after any authentication are:
// CHECK-NEXT:    1. {{[0-9a-f]+}}: bl
        // x19, according to the Arm ABI (AAPCS) is a callee-saved register.
        // Therefore, if function g respects the AAPCS, it should not write
        // anything to x19. However, we can't know whether function g actually
        // does respect the AAPCS rules, so the scanner should assume x19 can
        // get overwritten, and report a gadget if the code does not properly
        // deal with that.
        // Furthermore, there's a good chance that callee-saved registers have
        // been saved on the stack at some point during execution of the callee,
        // and so should be considered as potentially modified by an
        // attacker/written to.
        ret x19
        .size f_callclobbered_calleesaved, .-f_callclobbered_calleesaved

        .globl  f_unreachable_instruction
        .type   f_unreachable_instruction,@function
f_unreachable_instruction:
// CHECK-LABEL: GS-PAUTH: Warning: possibly imprecise CFG, the analysis quality may be degraded in this function. According to BOLT, unreachable code is found in function f_unreachable_instruction, basic block {{[0-9a-zA-Z.]+}}, at address
// CHECK-NEXT:    The instruction is     {{[0-9a-f]+}}:       add     x0, x1, x2
// CHECK-NOT:   instructions that write to the affected registers after any authentication are:
        b       1f
        add     x0, x1, x2
1:
        ret
        .size f_unreachable_instruction, .-f_unreachable_instruction

// Without CFG, the state is reset at labels, assuming every register that can
// be clobbered in the function was actually clobbered.

        .globl  lr_untouched_nocfg
        .type   lr_untouched_nocfg,@function
lr_untouched_nocfg:
// CHECK-NOT: lr_untouched_nocfg
        adr     x2, 1f
        br      x2
1:
        ret
        .size lr_untouched_nocfg, .-lr_untouched_nocfg

        .globl  lr_clobbered_nocfg
        .type   lr_clobbered_nocfg,@function
lr_clobbered_nocfg:
// CHECK-LABEL: GS-PAUTH: non-protected ret found in function lr_clobbered_nocfg, at address
// CHECK-NEXT:  The instruction is     {{[0-9a-f]+}}:      ret
// CHECK-NEXT:  The 0 instructions that write to the affected registers after any authentication are:
        adr     x2, 1f
        br      x2
1:
        b       2f
        bl      g   // never executed, but affects the expected worst-case scenario
2:
        ret
        .size lr_clobbered_nocfg, .-lr_clobbered_nocfg

/// Now do a basic sanity check on every different Authentication instruction:

        .globl  f_autiasp
        .type   f_autiasp,@function
f_autiasp:
        paciasp
        stp     x29, x30, [sp, #-16]!
        mov     x29, sp
        bl      g
        add     x0, x0, #3
        ldp     x29, x30, [sp], #16
        autiasp
// CHECK-NOT: function f_autiasp
        ret
        .size f_autiasp, .-f_autiasp

        .globl  f_autibsp
        .type   f_autibsp,@function
f_autibsp:
        paciasp
        stp     x29, x30, [sp, #-16]!
        mov     x29, sp
        bl      g
        add     x0, x0, #3
        ldp     x29, x30, [sp], #16
        autibsp
// CHECK-NOT: function f_autibsp
        ret
        .size f_autibsp, .-f_autibsp

        .globl  f_autiaz
        .type   f_autiaz,@function
f_autiaz:
        paciasp
        stp     x29, x30, [sp, #-16]!
        mov     x29, sp
        bl      g
        add     x0, x0, #3
        ldp     x29, x30, [sp], #16
        autiaz
// CHECK-NOT: function f_autiaz
        ret
        .size f_autiaz, .-f_autiaz

        .globl  f_autibz
        .type   f_autibz,@function
f_autibz:
        paciasp
        stp     x29, x30, [sp, #-16]!
        mov     x29, sp
        bl      g
        add     x0, x0, #3
        ldp     x29, x30, [sp], #16
        autibz
// CHECK-NOT: function f_autibz
        ret
        .size f_autibz, .-f_autibz

        .globl  f_autia1716
        .type   f_autia1716,@function
f_autia1716:
        paciasp
        stp     x29, x30, [sp, #-16]!
        mov     x29, sp
        bl      g
        add     x0, x0, #3
        ldp     x29, x30, [sp], #16
        autia1716
// CHECK-LABEL: GS-PAUTH: non-protected ret found in function f_autia1716, basic block {{[0-9a-zA-Z.]+}}, at address
// CHECK-NEXT:    The instruction is     {{[0-9a-f]+}}:       ret
// CHECK-NEXT:    The 1 instructions that write to the affected registers after any authentication are:
// CHECK-NEXT:    1. {{[0-9a-f]+}}: ldp     x29, x30, [sp], #0x10
// CHECK-NEXT:  This happens in the following basic block:
// CHECK-NEXT: {{[0-9a-f]+}}:   paciasp
// CHECK-NEXT: {{[0-9a-f]+}}:   stp     x29, x30, [sp, #-0x10]!
// CHECK-NEXT: {{[0-9a-f]+}}:   mov     x29, sp
// CHECK-NEXT: {{[0-9a-f]+}}:   bl      g
// CHECK-NEXT: {{[0-9a-f]+}}:   add     x0, x0, #0x3
// CHECK-NEXT: {{[0-9a-f]+}}:   ldp     x29, x30, [sp], #0x10
// CHECK-NEXT: {{[0-9a-f]+}}:   autia1716
// CHECK-NEXT: {{[0-9a-f]+}}:   ret
        ret
        .size f_autia1716, .-f_autia1716

        .globl  f_autib1716
        .type   f_autib1716,@function
f_autib1716:
        paciasp
        stp     x29, x30, [sp, #-16]!
        mov     x29, sp
        bl      g
        add     x0, x0, #3
        ldp     x29, x30, [sp], #16
        autib1716
// CHECK-LABEL: GS-PAUTH: non-protected ret found in function f_autib1716, basic block {{[0-9a-zA-Z.]+}}, at address
// CHECK-NEXT:    The instruction is     {{[0-9a-f]+}}:       ret
// CHECK-NEXT:    The 1 instructions that write to the affected registers after any authentication are:
// CHECK-NEXT:    1. {{[0-9a-f]+}}: ldp     x29, x30, [sp], #0x10
// CHECK-NEXT:  This happens in the following basic block:
// CHECK-NEXT: {{[0-9a-f]+}}:   paciasp
// CHECK-NEXT: {{[0-9a-f]+}}:   stp     x29, x30, [sp, #-0x10]!
// CHECK-NEXT: {{[0-9a-f]+}}:   mov     x29, sp
// CHECK-NEXT: {{[0-9a-f]+}}:   bl      g
// CHECK-NEXT: {{[0-9a-f]+}}:   add     x0, x0, #0x3
// CHECK-NEXT: {{[0-9a-f]+}}:   ldp     x29, x30, [sp], #0x10
// CHECK-NEXT: {{[0-9a-f]+}}:   autib1716
// CHECK-NEXT: {{[0-9a-f]+}}:   ret
        ret
        .size f_autib1716, .-f_autib1716

        .globl  f_autiax12
        .type   f_autiax12,@function
f_autiax12:
        paciasp
        stp     x29, x30, [sp, #-16]!
        mov     x29, sp
        bl      g
        add     x0, x0, #3
        ldp     x29, x30, [sp], #16
        autia   x12, sp
// CHECK-LABEL: GS-PAUTH: non-protected ret found in function f_autiax12, basic block {{[0-9a-zA-Z.]+}}, at address
// CHECK-NEXT:    The instruction is     {{[0-9a-f]+}}:       ret
// CHECK-NEXT:    The 1 instructions that write to the affected registers after any authentication are:
// CHECK-NEXT:    1. {{[0-9a-f]+}}: ldp     x29, x30, [sp], #0x10
// CHECK-NEXT:  This happens in the following basic block:
// CHECK-NEXT: {{[0-9a-f]+}}:   paciasp
// CHECK-NEXT: {{[0-9a-f]+}}:   stp     x29, x30, [sp, #-0x10]!
// CHECK-NEXT: {{[0-9a-f]+}}:   mov     x29, sp
// CHECK-NEXT: {{[0-9a-f]+}}:   bl      g
// CHECK-NEXT: {{[0-9a-f]+}}:   add     x0, x0, #0x3
// CHECK-NEXT: {{[0-9a-f]+}}:   ldp     x29, x30, [sp], #0x10
// CHECK-NEXT: {{[0-9a-f]+}}:   autia   x12, sp
// CHECK-NEXT: {{[0-9a-f]+}}:   ret
        ret
        .size f_autiax12, .-f_autiax12

        .globl  f_autibx12
        .type   f_autibx12,@function
f_autibx12:
        paciasp
        stp     x29, x30, [sp, #-16]!
        mov     x29, sp
        bl      g
        add     x0, x0, #3
        ldp     x29, x30, [sp], #16
        autib   x12, sp
// CHECK-LABEL: GS-PAUTH: non-protected ret found in function f_autibx12, basic block {{[0-9a-zA-Z.]+}}, at address
// CHECK-NEXT:    The instruction is     {{[0-9a-f]+}}:       ret
// CHECK-NEXT:    The 1 instructions that write to the affected registers after any authentication are:
// CHECK-NEXT:    1. {{[0-9a-f]+}}: ldp     x29, x30, [sp], #0x10
// CHECK-NEXT:  This happens in the following basic block:
// CHECK-NEXT: {{[0-9a-f]+}}:   paciasp
// CHECK-NEXT: {{[0-9a-f]+}}:   stp     x29, x30, [sp, #-0x10]!
// CHECK-NEXT: {{[0-9a-f]+}}:   mov     x29, sp
// CHECK-NEXT: {{[0-9a-f]+}}:   bl      g
// CHECK-NEXT: {{[0-9a-f]+}}:   add     x0, x0, #0x3
// CHECK-NEXT: {{[0-9a-f]+}}:   ldp     x29, x30, [sp], #0x10
// CHECK-NEXT: {{[0-9a-f]+}}:   autib   x12, sp
// CHECK-NEXT: {{[0-9a-f]+}}:   ret
        ret
        .size f_autibx12, .-f_autibx12

        .globl  f_autiax30
        .type   f_autiax30,@function
f_autiax30:
        paciasp
        stp     x29, x30, [sp, #-16]!
        mov     x29, sp
        bl      g
        add     x0, x0, #3
        ldp     x29, x30, [sp], #16
        autia   x30, sp
// CHECK-NOT: function f_autiax30
        ret
        .size f_autiax30, .-f_autiax30

        .globl  f_autibx30
        .type   f_autibx30,@function
f_autibx30:
        paciasp
        stp     x29, x30, [sp, #-16]!
        mov     x29, sp
        bl      g
        add     x0, x0, #3
        ldp     x29, x30, [sp], #16
        autib   x30, sp
// CHECK-NOT: function f_autibx30
        ret
        .size f_autibx30, .-f_autibx30


        .globl  f_autdax12
        .type   f_autdax12,@function
f_autdax12:
        paciasp
        stp     x29, x30, [sp, #-16]!
        mov     x29, sp
        bl      g
        add     x0, x0, #3
        ldp     x29, x30, [sp], #16
        autda   x12, sp
// CHECK-LABEL: GS-PAUTH: non-protected ret found in function f_autdax12, basic block {{[0-9a-zA-Z.]+}}, at address
// CHECK-NEXT:    The instruction is     {{[0-9a-f]+}}:       ret
// CHECK-NEXT:    The 1 instructions that write to the affected registers after any authentication are:
// CHECK-NEXT:    1. {{[0-9a-f]+}}: ldp     x29, x30, [sp], #0x10
// CHECK-NEXT:  This happens in the following basic block:
// CHECK-NEXT: {{[0-9a-f]+}}:   paciasp
// CHECK-NEXT: {{[0-9a-f]+}}:   stp     x29, x30, [sp, #-0x10]!
// CHECK-NEXT: {{[0-9a-f]+}}:   mov     x29, sp
// CHECK-NEXT: {{[0-9a-f]+}}:   bl      g
// CHECK-NEXT: {{[0-9a-f]+}}:   add     x0, x0, #0x3
// CHECK-NEXT: {{[0-9a-f]+}}:   ldp     x29, x30, [sp], #0x10
// CHECK-NEXT: {{[0-9a-f]+}}:   autda   x12, sp
// CHECK-NEXT: {{[0-9a-f]+}}:   ret
        ret
        .size f_autdax12, .-f_autdax12

        .globl  f_autdbx12
        .type   f_autdbx12,@function
f_autdbx12:
        paciasp
        stp     x29, x30, [sp, #-16]!
        mov     x29, sp
        bl      g
        add     x0, x0, #3
        ldp     x29, x30, [sp], #16
        autdb   x12, sp
// CHECK-LABEL: GS-PAUTH: non-protected ret found in function f_autdbx12, basic block {{[0-9a-zA-Z.]+}}, at address
// CHECK-NEXT:    The instruction is     {{[0-9a-f]+}}:       ret
// CHECK-NEXT:    The 1 instructions that write to the affected registers after any authentication are:
// CHECK-NEXT:    1. {{[0-9a-f]+}}: ldp     x29, x30, [sp], #0x10
// CHECK-NEXT:  This happens in the following basic block:
// CHECK-NEXT: {{[0-9a-f]+}}:   paciasp
// CHECK-NEXT: {{[0-9a-f]+}}:   stp     x29, x30, [sp, #-0x10]!
// CHECK-NEXT: {{[0-9a-f]+}}:   mov     x29, sp
// CHECK-NEXT: {{[0-9a-f]+}}:   bl      g
// CHECK-NEXT: {{[0-9a-f]+}}:   add     x0, x0, #0x3
// CHECK-NEXT: {{[0-9a-f]+}}:   ldp     x29, x30, [sp], #0x10
// CHECK-NEXT: {{[0-9a-f]+}}:   autdb   x12, sp
// CHECK-NEXT: {{[0-9a-f]+}}:   ret
        ret
        .size f_autdbx12, .-f_autdbx12

        .globl  f_autdax30
        .type   f_autdax30,@function
f_autdax30:
        paciasp
        stp     x29, x30, [sp, #-16]!
        mov     x29, sp
        bl      g
        add     x0, x0, #3
        ldp     x29, x30, [sp], #16
        autda   x30, sp
// CHECK-NOT: function f_autdax30
        ret
        .size f_autdax30, .-f_autdax30

        .globl  f_autdbx30
        .type   f_autdbx30,@function
f_autdbx30:
        paciasp
        stp     x29, x30, [sp, #-16]!
        mov     x29, sp
        bl      g
        add     x0, x0, #3
        ldp     x29, x30, [sp], #16
        autdb   x30, sp
// CHECK-NOT: function f_autdbx30
        ret
        .size f_autdbx30, .-f_autdbx30


        .globl  f_autizax12
        .type   f_autizax12,@function
f_autizax12:
        paciasp
        stp     x29, x30, [sp, #-16]!
        mov     x29, sp
        bl      g
        add     x0, x0, #3
        ldp     x29, x30, [sp], #16
        autiza  x12
// CHECK-LABEL: GS-PAUTH: non-protected ret found in function f_autizax12, basic block {{[0-9a-zA-Z.]+}}, at address
// CHECK-NEXT:    The instruction is     {{[0-9a-f]+}}:       ret
// CHECK-NEXT:    The 1 instructions that write to the affected registers after any authentication are:
// CHECK-NEXT:    1. {{[0-9a-f]+}}: ldp     x29, x30, [sp], #0x10
// CHECK-NEXT:  This happens in the following basic block:
// CHECK-NEXT: {{[0-9a-f]+}}:   paciasp
// CHECK-NEXT: {{[0-9a-f]+}}:   stp     x29, x30, [sp, #-0x10]!
// CHECK-NEXT: {{[0-9a-f]+}}:   mov     x29, sp
// CHECK-NEXT: {{[0-9a-f]+}}:   bl      g
// CHECK-NEXT: {{[0-9a-f]+}}:   add     x0, x0, #0x3
// CHECK-NEXT: {{[0-9a-f]+}}:   ldp     x29, x30, [sp], #0x10
// CHECK-NEXT: {{[0-9a-f]+}}:   autiza  x12
// CHECK-NEXT: {{[0-9a-f]+}}:   ret
        ret
        .size f_autizax12, .-f_autizax12

        .globl  f_autizbx12
        .type   f_autizbx12,@function
f_autizbx12:
        paciasp
        stp     x29, x30, [sp, #-16]!
        mov     x29, sp
        bl      g
        add     x0, x0, #3
        ldp     x29, x30, [sp], #16
        autizb  x12
// CHECK-LABEL: GS-PAUTH: non-protected ret found in function f_autizbx12, basic block {{[0-9a-zA-Z.]+}}, at address
// CHECK-NEXT:    The instruction is     {{[0-9a-f]+}}:       ret
// CHECK-NEXT:    The 1 instructions that write to the affected registers after any authentication are:
// CHECK-NEXT:    1. {{[0-9a-f]+}}: ldp     x29, x30, [sp], #0x10
// CHECK-NEXT:  This happens in the following basic block:
// CHECK-NEXT: {{[0-9a-f]+}}:   paciasp
// CHECK-NEXT: {{[0-9a-f]+}}:   stp     x29, x30, [sp, #-0x10]!
// CHECK-NEXT: {{[0-9a-f]+}}:   mov     x29, sp
// CHECK-NEXT: {{[0-9a-f]+}}:   bl      g
// CHECK-NEXT: {{[0-9a-f]+}}:   add     x0, x0, #0x3
// CHECK-NEXT: {{[0-9a-f]+}}:   ldp     x29, x30, [sp], #0x10
// CHECK-NEXT: {{[0-9a-f]+}}:   autizb  x12
// CHECK-NEXT: {{[0-9a-f]+}}:   ret
        ret
        .size f_autizbx12, .-f_autizbx12

        .globl  f_autizax30
        .type   f_autizax30,@function
f_autizax30:
        paciasp
        stp     x29, x30, [sp, #-16]!
        mov     x29, sp
        bl      g
        add     x0, x0, #3
        ldp     x29, x30, [sp], #16
        autiza  x30
// CHECK-NOT: function f_autizax30
        ret
        .size f_autizax30, .-f_autizax30

        .globl  f_autizbx30
        .type   f_autizbx30,@function
f_autizbx30:
        paciasp
        stp     x29, x30, [sp, #-16]!
        mov     x29, sp
        bl      g
        add     x0, x0, #3
        ldp     x29, x30, [sp], #16
        autizb  x30
// CHECK-NOT: function f_autizbx30
        ret
        .size f_autizbx30, .-f_autizbx30


        .globl  f_autdzax12
        .type   f_autdzax12,@function
f_autdzax12:
        paciasp
        stp     x29, x30, [sp, #-16]!
        mov     x29, sp
        bl      g
        add     x0, x0, #3
        ldp     x29, x30, [sp], #16
        autdza  x12
// CHECK-LABEL: GS-PAUTH: non-protected ret found in function f_autdzax12, basic block {{[0-9a-zA-Z.]+}}, at address
// CHECK-NEXT:    The instruction is     {{[0-9a-f]+}}:       ret
// CHECK-NEXT:    The 1 instructions that write to the affected registers after any authentication are:
// CHECK-NEXT:    1. {{[0-9a-f]+}}: ldp     x29, x30, [sp], #0x10
// CHECK-NEXT:  This happens in the following basic block:
// CHECK-NEXT: {{[0-9a-f]+}}:   paciasp
// CHECK-NEXT: {{[0-9a-f]+}}:   stp     x29, x30, [sp, #-0x10]!
// CHECK-NEXT: {{[0-9a-f]+}}:   mov     x29, sp
// CHECK-NEXT: {{[0-9a-f]+}}:   bl      g
// CHECK-NEXT: {{[0-9a-f]+}}:   add     x0, x0, #0x3
// CHECK-NEXT: {{[0-9a-f]+}}:   ldp     x29, x30, [sp], #0x10
// CHECK-NEXT: {{[0-9a-f]+}}:   autdza  x12
// CHECK-NEXT: {{[0-9a-f]+}}:   ret
        ret
        .size f_autdzax12, .-f_autdzax12

        .globl  f_autdzbx12
        .type   f_autdzbx12,@function
f_autdzbx12:
        paciasp
        stp     x29, x30, [sp, #-16]!
        mov     x29, sp
        bl      g
        add     x0, x0, #3
        ldp     x29, x30, [sp], #16
        autdzb  x12
// CHECK-LABEL: GS-PAUTH: non-protected ret found in function f_autdzbx12, basic block {{[0-9a-zA-Z.]+}}, at address
// CHECK-NEXT:    The instruction is     {{[0-9a-f]+}}:       ret
// CHECK-NEXT:    The 1 instructions that write to the affected registers after any authentication are:
// CHECK-NEXT:    1. {{[0-9a-f]+}}: ldp     x29, x30, [sp], #0x10
// CHECK-NEXT:  This happens in the following basic block:
// CHECK-NEXT: {{[0-9a-f]+}}:   paciasp
// CHECK-NEXT: {{[0-9a-f]+}}:   stp     x29, x30, [sp, #-0x10]!
// CHECK-NEXT: {{[0-9a-f]+}}:   mov     x29, sp
// CHECK-NEXT: {{[0-9a-f]+}}:   bl      g
// CHECK-NEXT: {{[0-9a-f]+}}:   add     x0, x0, #0x3
// CHECK-NEXT: {{[0-9a-f]+}}:   ldp     x29, x30, [sp], #0x10
// CHECK-NEXT: {{[0-9a-f]+}}:   autdzb  x12
// CHECK-NEXT: {{[0-9a-f]+}}:   ret
        ret
        .size f_autdzbx12, .-f_autdzbx12

        .globl  f_autdzax30
        .type   f_autdzax30,@function
f_autdzax30:
        paciasp
        stp     x29, x30, [sp, #-16]!
        mov     x29, sp
        bl      g
        add     x0, x0, #3
        ldp     x29, x30, [sp], #16
        autdza  x30
// CHECK-NOT: function f_autdzax30
        ret
        .size f_autdzax30, .-f_autdzax30

        .globl  f_autdzbx30
        .type   f_autdzbx30,@function
f_autdzbx30:
        paciasp
        stp     x29, x30, [sp, #-16]!
        mov     x29, sp
        bl      g
        add     x0, x0, #3
        ldp     x29, x30, [sp], #16
        autdzb  x30
// CHECK-NOT: function f_autdzbx30
        ret
        .size f_autdzbx30, .-f_autdzbx30

        .globl  f_retaa
        .type   f_retaa,@function
f_retaa:
        paciasp
        stp     x29, x30, [sp, #-16]!
        mov     x29, sp
        bl      g
        add     x0, x0, #3
        ldp     x29, x30, [sp], #16
// CHECK-NOT: function f_retaa
        retaa
        .size f_retaa, .-f_retaa

        .globl  f_retab
        .type   f_retab,@function
f_retab:
        paciasp
        stp     x29, x30, [sp, #-16]!
        mov     x29, sp
        bl      g
        add     x0, x0, #3
        ldp     x29, x30, [sp], #16
// CHECK-NOT: function f_retab
        retab
        .size f_retab, .-f_retab

        .globl  f_eretaa
        .type   f_eretaa,@function
f_eretaa:
        paciasp
        stp     x29, x30, [sp, #-16]!
        mov     x29, sp
        bl      g
        add     x0, x0, #3
        ldp     x29, x30, [sp], #16
// CHECK-LABEL: GS-PAUTH: Warning: pac-ret analysis could not analyze this return instruction in function f_eretaa, basic block {{[0-9a-zA-Z.]+}}, at address
// CHECK-NEXT:   The instruction is     {{[0-9a-f]+}}:       eretaa
        eretaa
        .size f_eretaa, .-f_eretaa

        .globl  f_eretab
        .type   f_eretab,@function
f_eretab:
        paciasp
        stp     x29, x30, [sp, #-16]!
        mov     x29, sp
        bl      g
        add     x0, x0, #3
        ldp     x29, x30, [sp], #16
// CHECK-LABEL: GS-PAUTH: Warning: pac-ret analysis could not analyze this return instruction in function f_eretab, basic block {{[0-9a-zA-Z.]+}}, at address
// CHECK-NEXT:   The instruction is     {{[0-9a-f]+}}:       eretab
        eretab
        .size f_eretab, .-f_eretab

        .globl  f_eret
        .type   f_eret,@function
f_eret:
        paciasp
        stp     x29, x30, [sp, #-16]!
        mov     x29, sp
        bl      g
        add     x0, x0, #3
        ldp     x29, x30, [sp], #16
// CHECK-LABEL: GS-PAUTH: Warning: pac-ret analysis could not analyze this return instruction in function f_eret, basic block {{[0-9a-zA-Z.]+}}, at address
// CHECK-NEXT:   The instruction is     {{[0-9a-f]+}}:       eret
        eret
        .size f_eret, .-f_eret

        .globl f_movx30reg
        .type   f_movx30reg,@function
f_movx30reg:
// CHECK-LABEL: GS-PAUTH: non-protected ret found in function f_movx30reg, basic block {{[0-9a-zA-Z.]+}}, at address
// CHECK-NEXT:    The instruction is     {{[0-9a-f]+}}:       ret
// CHECK-NEXT:    The 1 instructions that write to the affected registers after any authentication are:
// CHECK-NEXT:    1. {{[0-9a-f]+}}: mov x30, x22
// CHECK-NEXT:  This happens in the following basic block:
// CHECK-NEXT: {{[0-9a-f]+}}:   mov     x30, x22
// CHECK-NEXT: {{[0-9a-f]+}}:   ret
        mov     x30, x22
        ret
        .size f_movx30reg, .-f_movx30reg

        .globl  f_autiasppci
        .type   f_autiasppci,@function
f_autiasppci:
0:
        pacnbiasppc
        paciasp
        stp     x29, x30, [sp, #-16]!
        mov     x29, sp
        bl      g
        add     x0, x0, #3
        ldp     x29, x30, [sp], #16
        autiasppc 0b
// CHECK-NOT: function f_autiasppci
        ret
        .size f_autiasppci, .-f_autiasppci

        .globl  f_autibsppci
        .type   f_autibsppci,@function
f_autibsppci:
0:
        pacnbibsppc
        paciasp
        stp     x29, x30, [sp, #-16]!
        mov     x29, sp
        bl      g
        add     x0, x0, #3
        ldp     x29, x30, [sp], #16
        autibsppc 0b
// CHECK-NOT: function f_autibsppci
        ret
        .size f_autibsppci, .-f_autibsppci

        .globl  f_autiasppcr
        .type   f_autiasppcr,@function

f_autiasppcr:
0:
        pacnbiasppc
        paciasp
        stp     x29, x30, [sp, #-16]!
        mov     x29, sp
        bl      g
        add     x0, x0, #3
        ldp     x29, x30, [sp], #16
        adr     x28, 0b
        autiasppcr x28
// CHECK-NOT: function f_autiasppcr
        ret
        .size f_autiasppcr, .-f_autiasppcr

f_autibsppcr:
0:
        pacnbibsppc
        paciasp
        stp     x29, x30, [sp, #-16]!
        mov     x29, sp
        bl      g
        add     x0, x0, #3
        ldp     x29, x30, [sp], #16
        adr     x28, 0b
        autibsppcr x28
// CHECK-NOT: function f_autibsppcr
        ret
        .size f_autibsppcr, .-f_autibsppcr

        .globl  f_retaasppci
        .type   f_retaasppci,@function
f_retaasppci:
0:
        pacnbiasppc
        paciasp
        stp     x29, x30, [sp, #-16]!
        mov     x29, sp
        bl      g
        add     x0, x0, #3
        ldp     x29, x30, [sp], #16
// CHECK-NOT: function f_retaasppci
        retaasppc 0b
        .size f_retaasppci, .-f_retaasppci

        .globl  f_retabsppci
        .type   f_retabsppci,@function
f_retabsppci:
0:
        pacnbibsppc
        paciasp
        stp     x29, x30, [sp, #-16]!
        mov     x29, sp
        bl      g
        add     x0, x0, #3
        ldp     x29, x30, [sp], #16
// CHECK-NOT: function f_retabsppci
        retabsppc 0b
        .size f_retabsppci, .-f_retabsppci

        .globl  f_retaasppcr
        .type   f_retaasppcr,@function

f_retaasppcr:
0:
        pacnbiasppc
        paciasp
        stp     x29, x30, [sp, #-16]!
        mov     x29, sp
        bl      g
        add     x0, x0, #3
        ldp     x29, x30, [sp], #16
        adr     x28, 0b
// CHECK-NOT: function f_retaasppcr
        retaasppcr x28
        .size f_retaasppcr, .-f_retaasppcr

f_retabsppcr:
0:
        pacnbibsppc
        paciasp
        stp     x29, x30, [sp, #-16]!
        mov     x29, sp
        bl      g
        add     x0, x0, #3
        ldp     x29, x30, [sp], #16
        adr     x28, 0b
// CHECK-NOT: function f_retabsppcr
        retabsppcr x28
        .size f_retabsppcr, .-f_retabsppcr

        .globl  f_autia171615
        .type   f_autia171615,@function
f_autia171615:
        paciasp
        stp     x29, x30, [sp, #-16]!
        mov     x29, sp
        bl      g
        add     x0, x0, #3
        ldp     x29, x30, [sp], #16
        autia171615
// CHECK-LABEL: GS-PAUTH: non-protected ret found in function f_autia171615, basic block {{[0-9a-zA-Z.]+}}, at address
// CHECK-NEXT:    The instruction is     {{[0-9a-f]+}}:       ret
// CHECK-NEXT:    The 1 instructions that write to the affected registers after any authentication are:
// CHECK-NEXT:    1. {{[0-9a-f]+}}: ldp     x29, x30, [sp], #0x10
// CHECK-NEXT:  This happens in the following basic block:
// CHECK-NEXT: {{[0-9a-f]+}}:   paciasp
// CHECK-NEXT: {{[0-9a-f]+}}:   stp     x29, x30, [sp, #-0x10]!
// CHECK-NEXT: {{[0-9a-f]+}}:   mov     x29, sp
// CHECK-NEXT: {{[0-9a-f]+}}:   bl      g
// CHECK-NEXT: {{[0-9a-f]+}}:   add     x0, x0, #0x3
// CHECK-NEXT: {{[0-9a-f]+}}:   ldp     x29, x30, [sp], #0x10
// CHECK-NEXT: {{[0-9a-f]+}}:   autia171615
// CHECK-NEXT: {{[0-9a-f]+}}:   ret
        ret
        .size f_autia171615, .-f_autia171615

        .globl  f_autib171615
        .type   f_autib171615,@function
f_autib171615:
        paciasp
        stp     x29, x30, [sp, #-16]!
        mov     x29, sp
        bl      g
        add     x0, x0, #3
        ldp     x29, x30, [sp], #16
        autib171615
// CHECK-LABEL: GS-PAUTH: non-protected ret found in function f_autib171615, basic block {{[0-9a-zA-Z.]+}}, at address
// CHECK-NEXT:    The instruction is     {{[0-9a-f]+}}:       ret
// CHECK-NEXT:    The 1 instructions that write to the affected registers after any authentication are:
// CHECK-NEXT:    1. {{[0-9a-f]+}}: ldp     x29, x30, [sp], #0x10
// CHECK-NEXT:  This happens in the following basic block:
// CHECK-NEXT: {{[0-9a-f]+}}:   paciasp
// CHECK-NEXT: {{[0-9a-f]+}}:   stp     x29, x30, [sp, #-0x10]!
// CHECK-NEXT: {{[0-9a-f]+}}:   mov     x29, sp
// CHECK-NEXT: {{[0-9a-f]+}}:   bl      g
// CHECK-NEXT: {{[0-9a-f]+}}:   add     x0, x0, #0x3
// CHECK-NEXT: {{[0-9a-f]+}}:   ldp     x29, x30, [sp], #0x10
// CHECK-NEXT: {{[0-9a-f]+}}:   autib171615
// CHECK-NEXT: {{[0-9a-f]+}}:   ret
        ret
        .size f_autib171615, .-f_autib171615

        .globl  g
        .type   g,@function
g:
        nop
        ret
        .size g, .-g