derek.holloway
7502bf64a4
CodeQL / Analyze (actions) (push) Canceled after 0s
CodeQL / Analyze (python) (push) Canceled after 0s
pre-commit / pre-commit (push) Canceled after 0s
Multi-Arch CI / setup (push) Canceled after 0s
Publish build_manylinux_x86_64 images / publish_build_manylinux_x86_64 (push) Canceled after 0s
Setup (Multi-Arch) / setup (push) Canceled after 0s
Multi-Arch CI / Linux::${{ fromJSON(needs.setup.outputs.linux_build_config || '{}').build_variant_label || 'skip' }} (push) Canceled after 0s
Publish TheRock Docker image / build-and-push-image (push) Canceled after 0s
Publish no_rocm_image_ubi10 image / publish_no_rocm_image_ubi10 (push) Canceled after 0s
Multi-Arch CI / Windows::${{ fromJSON(needs.setup.outputs.windows_build_config || '{}').build_variant_label || 'skip' }} (push) Canceled after 0s
Publish TheRock Docker image / build-and-push-image (push) Canceled after 0s
Multi-Arch CI / Manifest Diff (push) Canceled after 0s
TheRock Manifest Diff Report / Generate Manifest Diff Report (push) Canceled after 0s
Multi-Arch CI / CI Summary (push) Canceled after 0s
Publish no_rocm_image_ubuntu24_04 images / publish_no_rocm_image_ubuntu24_04 (push) Canceled after 0s
Publish no_rocm_image_ubuntu24_04_ocl_rt images / publish_no_rocm_image_ubuntu24_04_ocl_rt (push) Canceled after 0s
Publish TheRock Docker image / build-and-push-image (push) Canceled after 0s
Publish TheRock Docker image / build-and-push-image (push) Canceled after 0s
Publish no_rocm_image_ubuntu24_04 images / publish_no_rocm_image_ubuntu24_04_rocgdb (push) Canceled after 0s
Publish no_rocm_image_ubuntu24_04_rocgdb images / publish_no_rocm_image_ubuntu24_04_rocgdb (push) Canceled after 0s
Publish no_rocm_image_ubuntu24_04 images / publish_no_rocm_image_ubuntu24_04_ocl_rt (push) Canceled after 0s
Publish TheRock Docker image / build-and-push-image (push) Canceled after 0s
Unit Tests / Unit Tests :: ubuntu-24.04 (push) Canceled after 0s
Unit Tests / Unit Tests :: windows-2022 (push) Canceled after 0s
Publish no_rocm_image_ubuntu24_04 images / publish_no_rocm_image_ubuntu24_04_media (push) Canceled after 0s
Unit Tests / Unit Tests Summary (push) Canceled after 0s
Publish no_rocm_image_ubuntu24_04 images / publish_no_rocm_image_ubuntu24_04_openmpi (push) Canceled after 0s
974 lines
34 KiB
ArmAsm
974 lines
34 KiB
ArmAsm
// RUN: %clang %cflags -march=armv9.5-a+pauth-lr -mbranch-protection=pac-ret %s %p/../../Inputs/asm_main.c -o %t.exe
|
|
// RUN: llvm-bolt-binary-analysis --scanners=ptrauth-pac-ret %t.exe 2>&1 | FileCheck %s
|
|
|
|
.text
|
|
|
|
.globl f1
|
|
.type f1,@function
|
|
f1:
|
|
paciasp
|
|
stp x29, x30, [sp, #-16]!
|
|
mov x29, sp
|
|
bl g
|
|
add x0, x0, #3
|
|
ldp x29, x30, [sp], #16
|
|
// autiasp
|
|
// CHECK-LABEL: GS-PAUTH: non-protected ret found in function f1, basic block {{[0-9a-zA-Z.]+}}, at address
|
|
// CHECK-NEXT: The instruction is {{[0-9a-f]+}}: ret
|
|
// CHECK-NEXT: The 1 instructions that write to the affected registers after any authentication are:
|
|
// CHECK-NEXT: 1. {{[0-9a-f]+}}: ldp x29, x30, [sp], #0x10
|
|
// CHECK-NEXT: This happens in the following basic block:
|
|
// CHECK-NEXT: {{[0-9a-f]+}}: paciasp
|
|
// CHECK-NEXT: {{[0-9a-f]+}}: stp x29, x30, [sp, #-0x10]!
|
|
// CHECK-NEXT: {{[0-9a-f]+}}: mov x29, sp
|
|
// CHECK-NEXT: {{[0-9a-f]+}}: bl g
|
|
// CHECK-NEXT: {{[0-9a-f]+}}: add x0, x0, #0x3
|
|
// CHECK-NEXT: {{[0-9a-f]+}}: ldp x29, x30, [sp], #0x10
|
|
// CHECK-NEXT: {{[0-9a-f]+}}: ret
|
|
ret
|
|
.size f1, .-f1
|
|
|
|
|
|
.globl f_intermediate_overwrite1
|
|
.type f_intermediate_overwrite1,@function
|
|
f_intermediate_overwrite1:
|
|
paciasp
|
|
stp x29, x30, [sp, #-16]!
|
|
mov x29, sp
|
|
bl g
|
|
add x0, x0, #3
|
|
autiasp
|
|
ldp x29, x30, [sp], #16
|
|
// CHECK-LABEL: GS-PAUTH: non-protected ret found in function f_intermediate_overwrite1, basic block {{[0-9a-zA-Z.]+}}
|
|
// CHECK-NEXT: The instruction is {{[0-9a-f]+}}: ret
|
|
// CHECK-NEXT: The 1 instructions that write to the affected registers after any authentication are:
|
|
// CHECK-NEXT: 1. {{[0-9a-f]+}}: ldp x29, x30, [sp], #0x10
|
|
// CHECK-NEXT: This happens in the following basic block:
|
|
// CHECK-NEXT: {{[0-9a-f]+}}: paciasp
|
|
// CHECK-NEXT: {{[0-9a-f]+}}: stp x29, x30, [sp, #-0x10]!
|
|
// CHECK-NEXT: {{[0-9a-f]+}}: mov x29, sp
|
|
// CHECK-NEXT: {{[0-9a-f]+}}: bl g
|
|
// CHECK-NEXT: {{[0-9a-f]+}}: add x0, x0, #0x3
|
|
// CHECK-NEXT: {{[0-9a-f]+}}: autiasp
|
|
// CHECK-NEXT: {{[0-9a-f]+}}: ldp x29, x30, [sp], #0x10
|
|
// CHECK-NEXT: {{[0-9a-f]+}}: ret
|
|
ret
|
|
.size f_intermediate_overwrite1, .-f_intermediate_overwrite1
|
|
|
|
.globl f_intermediate_overwrite2
|
|
.type f_intermediate_overwrite2,@function
|
|
f_intermediate_overwrite2:
|
|
paciasp
|
|
stp x29, x30, [sp, #-16]!
|
|
mov x29, sp
|
|
bl g
|
|
add x0, x0, #3
|
|
ldp x29, x30, [sp], #16
|
|
autiasp
|
|
mov x30, x0
|
|
// CHECK-LABEL: GS-PAUTH: non-protected ret found in function f_intermediate_overwrite2, basic block {{[0-9a-zA-Z.]+}}, at address
|
|
// CHECK-NEXT: The instruction is {{[0-9a-f]+}}: ret
|
|
// CHECK-NEXT: The 1 instructions that write to the affected registers after any authentication are:
|
|
// CHECK-NEXT: 1. {{[0-9a-f]+}}: mov x30, x0
|
|
// CHECK-NEXT: This happens in the following basic block:
|
|
// CHECK-NEXT: {{[0-9a-f]+}}: paciasp
|
|
// CHECK-NEXT: {{[0-9a-f]+}}: stp x29, x30, [sp, #-0x10]!
|
|
// CHECK-NEXT: {{[0-9a-f]+}}: mov x29, sp
|
|
// CHECK-NEXT: {{[0-9a-f]+}}: bl g
|
|
// CHECK-NEXT: {{[0-9a-f]+}}: add x0, x0, #0x3
|
|
// CHECK-NEXT: {{[0-9a-f]+}}: ldp x29, x30, [sp], #0x10
|
|
// CHECK-NEXT: {{[0-9a-f]+}}: autiasp
|
|
// CHECK-NEXT: {{[0-9a-f]+}}: mov x30, x0
|
|
// CHECK-NEXT: {{[0-9a-f]+}}: ret
|
|
ret
|
|
.size f_intermediate_overwrite2, .-f_intermediate_overwrite2
|
|
|
|
.globl f_intermediate_read
|
|
.type f_intermediate_read,@function
|
|
f_intermediate_read:
|
|
paciasp
|
|
stp x29, x30, [sp, #-16]!
|
|
mov x29, sp
|
|
bl g
|
|
add x0, x0, #3
|
|
ldp x29, x30, [sp], #16
|
|
autiasp
|
|
mov x0, x30
|
|
// CHECK-NOT: function f_intermediate_read
|
|
ret
|
|
.size f_intermediate_read, .-f_intermediate_read
|
|
|
|
.globl f_intermediate_overwrite3
|
|
.type f_intermediate_overwrite3,@function
|
|
f_intermediate_overwrite3:
|
|
paciasp
|
|
stp x29, x30, [sp, #-16]!
|
|
mov x29, sp
|
|
bl g
|
|
add x0, x0, #3
|
|
ldp x29, x30, [sp], #16
|
|
autiasp
|
|
mov w30, w0
|
|
// CHECK-LABEL: GS-PAUTH: non-protected ret found in function f_intermediate_overwrite3, basic block {{[0-9a-zA-Z.]+}}, at address
|
|
// CHECK-NEXT: The instruction is {{[0-9a-f]+}}: ret
|
|
// CHECK-NEXT: The 1 instructions that write to the affected registers after any authentication are:
|
|
// CHECK-NEXT: 1. {{[0-9a-f]+}}: mov w30, w0
|
|
// CHECK-NEXT: This happens in the following basic block:
|
|
// CHECK-NEXT: {{[0-9a-f]+}}: paciasp
|
|
// CHECK-NEXT: {{[0-9a-f]+}}: stp x29, x30, [sp, #-0x10]!
|
|
// CHECK-NEXT: {{[0-9a-f]+}}: mov x29, sp
|
|
// CHECK-NEXT: {{[0-9a-f]+}}: bl g
|
|
// CHECK-NEXT: {{[0-9a-f]+}}: add x0, x0, #0x3
|
|
// CHECK-NEXT: {{[0-9a-f]+}}: ldp x29, x30, [sp], #0x10
|
|
// CHECK-NEXT: {{[0-9a-f]+}}: autiasp
|
|
// CHECK-NEXT: {{[0-9a-f]+}}: mov w30, w0
|
|
// CHECK-NEXT: {{[0-9a-f]+}}: ret
|
|
ret
|
|
.size f_intermediate_overwrite3, .-f_intermediate_overwrite3
|
|
|
|
.globl f_nonx30_ret
|
|
.type f_nonx30_ret,@function
|
|
f_nonx30_ret:
|
|
paciasp
|
|
stp x29, x30, [sp, #-16]!
|
|
mov x29, sp
|
|
bl g
|
|
add x0, x0, #3
|
|
ldp x29, x30, [sp], #16
|
|
mov x16, x30
|
|
autiasp
|
|
// CHECK-LABEL: GS-PAUTH: non-protected ret found in function f_nonx30_ret, basic block {{[0-9a-zA-Z.]+}}, at address
|
|
// CHECK-NEXT: The instruction is {{[0-9a-f]+}}: ret x16
|
|
// CHECK-NEXT: The 1 instructions that write to the affected registers after any authentication are:
|
|
// CHECK-NEXT: 1. {{[0-9a-f]+}}: mov x16, x30
|
|
// CHECK-NEXT: This happens in the following basic block:
|
|
// CHECK-NEXT: {{[0-9a-f]+}}: paciasp
|
|
// CHECK-NEXT: {{[0-9a-f]+}}: stp x29, x30, [sp, #-0x10]!
|
|
// CHECK-NEXT: {{[0-9a-f]+}}: mov x29, sp
|
|
// CHECK-NEXT: {{[0-9a-f]+}}: bl g
|
|
// CHECK-NEXT: {{[0-9a-f]+}}: add x0, x0, #0x3
|
|
// CHECK-NEXT: {{[0-9a-f]+}}: ldp x29, x30, [sp], #0x10
|
|
// CHECK-NEXT: {{[0-9a-f]+}}: mov x16, x30
|
|
// CHECK-NEXT: {{[0-9a-f]+}}: autiasp
|
|
// CHECK-NEXT: {{[0-9a-f]+}}: ret x16
|
|
ret x16
|
|
.size f_nonx30_ret, .-f_nonx30_ret
|
|
|
|
.globl f_nonx30_ret_ok
|
|
.type f_nonx30_ret_ok,@function
|
|
f_nonx30_ret_ok:
|
|
paciasp
|
|
stp x29, x30, [sp, #-16]!
|
|
mov x29, sp
|
|
bl g
|
|
ldp x29, x30, [sp], #16
|
|
autiasp
|
|
mov x16, x30
|
|
// CHECK-NOT: function f_nonx30_ret_ok
|
|
ret x16
|
|
.size f_nonx30_ret_ok, .-f_nonx30_ret_ok
|
|
|
|
.globl f_detect_clobbered_x30_passed_to_other
|
|
.type f_detect_clobbered_x30_passed_to_other,@function
|
|
f_detect_clobbered_x30_passed_to_other:
|
|
str x30, [sp]
|
|
ldr x30, [sp]
|
|
// FIXME: Ideally, the pac-ret scanner would report on the following instruction, which
|
|
// performs a tail call, that x30 might be attacker-controlled.
|
|
// CHECK-NOT: function f_detect_clobbered_x30_passed_to_other
|
|
b f_tail_called
|
|
.size f_detect_clobbered_x30_passed_to_other, .-f_detect_clobbered_x30_passed_to_other
|
|
|
|
.globl f_tail_called
|
|
.type f_tail_called,@function
|
|
f_tail_called:
|
|
ret
|
|
.size f_tail_called, .-f_tail_called
|
|
|
|
.globl f_nonx30_ret_non_auted
|
|
.type f_nonx30_ret_non_auted,@function
|
|
f_nonx30_ret_non_auted:
|
|
// x1 is neither authenticated nor implicitly considered safe at function entry.
|
|
// Note that we assume it's fine for x30 to not be authenticated before
|
|
// returning to, as assuming that x30 is not attacker controlled at function
|
|
// entry is part (implicitly) of the pac-ret hardening scheme.
|
|
//
|
|
// CHECK-LABEL: GS-PAUTH: non-protected ret found in function f_nonx30_ret_non_auted, basic block {{[0-9a-zA-Z.]+}}, at address
|
|
// CHECK-NEXT: The instruction is {{[0-9a-f]+}}: ret
|
|
// CHECK-NEXT: The 0 instructions that write to the affected registers after any authentication are:
|
|
ret x1
|
|
.size f_nonx30_ret_non_auted, .-f_nonx30_ret_non_auted
|
|
|
|
|
|
.globl f_callclobbered_x30
|
|
.type f_callclobbered_x30,@function
|
|
f_callclobbered_x30:
|
|
bl g
|
|
// CHECK-LABEL: GS-PAUTH: non-protected ret found in function f_callclobbered_x30, basic block {{[0-9a-zA-Z.]+}}, at address
|
|
// CHECK-NEXT: The instruction is {{[0-9a-f]+}}: ret
|
|
// CHECK-NEXT: The 1 instructions that write to the affected registers after any authentication are:
|
|
// CHECK-NEXT: 1. {{[0-9a-f]+}}: bl
|
|
ret
|
|
.size f_callclobbered_x30, .-f_callclobbered_x30
|
|
|
|
.globl f_callclobbered_calleesaved
|
|
.type f_callclobbered_calleesaved,@function
|
|
f_callclobbered_calleesaved:
|
|
bl g
|
|
// CHECK-LABEL: GS-PAUTH: non-protected ret found in function f_callclobbered_calleesaved, basic block {{[0-9a-zA-Z.]+}}, at address
|
|
// CHECK-NEXT: The instruction is {{[0-9a-f]+}}: ret x19
|
|
// CHECK-NEXT: The 1 instructions that write to the affected registers after any authentication are:
|
|
// CHECK-NEXT: 1. {{[0-9a-f]+}}: bl
|
|
// x19, according to the Arm ABI (AAPCS) is a callee-saved register.
|
|
// Therefore, if function g respects the AAPCS, it should not write
|
|
// anything to x19. However, we can't know whether function g actually
|
|
// does respect the AAPCS rules, so the scanner should assume x19 can
|
|
// get overwritten, and report a gadget if the code does not properly
|
|
// deal with that.
|
|
// Furthermore, there's a good chance that callee-saved registers have
|
|
// been saved on the stack at some point during execution of the callee,
|
|
// and so should be considered as potentially modified by an
|
|
// attacker/written to.
|
|
ret x19
|
|
.size f_callclobbered_calleesaved, .-f_callclobbered_calleesaved
|
|
|
|
.globl f_unreachable_instruction
|
|
.type f_unreachable_instruction,@function
|
|
f_unreachable_instruction:
|
|
// CHECK-LABEL: GS-PAUTH: Warning: possibly imprecise CFG, the analysis quality may be degraded in this function. According to BOLT, unreachable code is found in function f_unreachable_instruction, basic block {{[0-9a-zA-Z.]+}}, at address
|
|
// CHECK-NEXT: The instruction is {{[0-9a-f]+}}: add x0, x1, x2
|
|
// CHECK-NOT: instructions that write to the affected registers after any authentication are:
|
|
b 1f
|
|
add x0, x1, x2
|
|
1:
|
|
ret
|
|
.size f_unreachable_instruction, .-f_unreachable_instruction
|
|
|
|
// Without CFG, the state is reset at labels, assuming every register that can
|
|
// be clobbered in the function was actually clobbered.
|
|
|
|
.globl lr_untouched_nocfg
|
|
.type lr_untouched_nocfg,@function
|
|
lr_untouched_nocfg:
|
|
// CHECK-NOT: lr_untouched_nocfg
|
|
adr x2, 1f
|
|
br x2
|
|
1:
|
|
ret
|
|
.size lr_untouched_nocfg, .-lr_untouched_nocfg
|
|
|
|
.globl lr_clobbered_nocfg
|
|
.type lr_clobbered_nocfg,@function
|
|
lr_clobbered_nocfg:
|
|
// CHECK-LABEL: GS-PAUTH: non-protected ret found in function lr_clobbered_nocfg, at address
|
|
// CHECK-NEXT: The instruction is {{[0-9a-f]+}}: ret
|
|
// CHECK-NEXT: The 0 instructions that write to the affected registers after any authentication are:
|
|
adr x2, 1f
|
|
br x2
|
|
1:
|
|
b 2f
|
|
bl g // never executed, but affects the expected worst-case scenario
|
|
2:
|
|
ret
|
|
.size lr_clobbered_nocfg, .-lr_clobbered_nocfg
|
|
|
|
/// Now do a basic sanity check on every different Authentication instruction:
|
|
|
|
.globl f_autiasp
|
|
.type f_autiasp,@function
|
|
f_autiasp:
|
|
paciasp
|
|
stp x29, x30, [sp, #-16]!
|
|
mov x29, sp
|
|
bl g
|
|
add x0, x0, #3
|
|
ldp x29, x30, [sp], #16
|
|
autiasp
|
|
// CHECK-NOT: function f_autiasp
|
|
ret
|
|
.size f_autiasp, .-f_autiasp
|
|
|
|
.globl f_autibsp
|
|
.type f_autibsp,@function
|
|
f_autibsp:
|
|
paciasp
|
|
stp x29, x30, [sp, #-16]!
|
|
mov x29, sp
|
|
bl g
|
|
add x0, x0, #3
|
|
ldp x29, x30, [sp], #16
|
|
autibsp
|
|
// CHECK-NOT: function f_autibsp
|
|
ret
|
|
.size f_autibsp, .-f_autibsp
|
|
|
|
.globl f_autiaz
|
|
.type f_autiaz,@function
|
|
f_autiaz:
|
|
paciasp
|
|
stp x29, x30, [sp, #-16]!
|
|
mov x29, sp
|
|
bl g
|
|
add x0, x0, #3
|
|
ldp x29, x30, [sp], #16
|
|
autiaz
|
|
// CHECK-NOT: function f_autiaz
|
|
ret
|
|
.size f_autiaz, .-f_autiaz
|
|
|
|
.globl f_autibz
|
|
.type f_autibz,@function
|
|
f_autibz:
|
|
paciasp
|
|
stp x29, x30, [sp, #-16]!
|
|
mov x29, sp
|
|
bl g
|
|
add x0, x0, #3
|
|
ldp x29, x30, [sp], #16
|
|
autibz
|
|
// CHECK-NOT: function f_autibz
|
|
ret
|
|
.size f_autibz, .-f_autibz
|
|
|
|
.globl f_autia1716
|
|
.type f_autia1716,@function
|
|
f_autia1716:
|
|
paciasp
|
|
stp x29, x30, [sp, #-16]!
|
|
mov x29, sp
|
|
bl g
|
|
add x0, x0, #3
|
|
ldp x29, x30, [sp], #16
|
|
autia1716
|
|
// CHECK-LABEL: GS-PAUTH: non-protected ret found in function f_autia1716, basic block {{[0-9a-zA-Z.]+}}, at address
|
|
// CHECK-NEXT: The instruction is {{[0-9a-f]+}}: ret
|
|
// CHECK-NEXT: The 1 instructions that write to the affected registers after any authentication are:
|
|
// CHECK-NEXT: 1. {{[0-9a-f]+}}: ldp x29, x30, [sp], #0x10
|
|
// CHECK-NEXT: This happens in the following basic block:
|
|
// CHECK-NEXT: {{[0-9a-f]+}}: paciasp
|
|
// CHECK-NEXT: {{[0-9a-f]+}}: stp x29, x30, [sp, #-0x10]!
|
|
// CHECK-NEXT: {{[0-9a-f]+}}: mov x29, sp
|
|
// CHECK-NEXT: {{[0-9a-f]+}}: bl g
|
|
// CHECK-NEXT: {{[0-9a-f]+}}: add x0, x0, #0x3
|
|
// CHECK-NEXT: {{[0-9a-f]+}}: ldp x29, x30, [sp], #0x10
|
|
// CHECK-NEXT: {{[0-9a-f]+}}: autia1716
|
|
// CHECK-NEXT: {{[0-9a-f]+}}: ret
|
|
ret
|
|
.size f_autia1716, .-f_autia1716
|
|
|
|
.globl f_autib1716
|
|
.type f_autib1716,@function
|
|
f_autib1716:
|
|
paciasp
|
|
stp x29, x30, [sp, #-16]!
|
|
mov x29, sp
|
|
bl g
|
|
add x0, x0, #3
|
|
ldp x29, x30, [sp], #16
|
|
autib1716
|
|
// CHECK-LABEL: GS-PAUTH: non-protected ret found in function f_autib1716, basic block {{[0-9a-zA-Z.]+}}, at address
|
|
// CHECK-NEXT: The instruction is {{[0-9a-f]+}}: ret
|
|
// CHECK-NEXT: The 1 instructions that write to the affected registers after any authentication are:
|
|
// CHECK-NEXT: 1. {{[0-9a-f]+}}: ldp x29, x30, [sp], #0x10
|
|
// CHECK-NEXT: This happens in the following basic block:
|
|
// CHECK-NEXT: {{[0-9a-f]+}}: paciasp
|
|
// CHECK-NEXT: {{[0-9a-f]+}}: stp x29, x30, [sp, #-0x10]!
|
|
// CHECK-NEXT: {{[0-9a-f]+}}: mov x29, sp
|
|
// CHECK-NEXT: {{[0-9a-f]+}}: bl g
|
|
// CHECK-NEXT: {{[0-9a-f]+}}: add x0, x0, #0x3
|
|
// CHECK-NEXT: {{[0-9a-f]+}}: ldp x29, x30, [sp], #0x10
|
|
// CHECK-NEXT: {{[0-9a-f]+}}: autib1716
|
|
// CHECK-NEXT: {{[0-9a-f]+}}: ret
|
|
ret
|
|
.size f_autib1716, .-f_autib1716
|
|
|
|
.globl f_autiax12
|
|
.type f_autiax12,@function
|
|
f_autiax12:
|
|
paciasp
|
|
stp x29, x30, [sp, #-16]!
|
|
mov x29, sp
|
|
bl g
|
|
add x0, x0, #3
|
|
ldp x29, x30, [sp], #16
|
|
autia x12, sp
|
|
// CHECK-LABEL: GS-PAUTH: non-protected ret found in function f_autiax12, basic block {{[0-9a-zA-Z.]+}}, at address
|
|
// CHECK-NEXT: The instruction is {{[0-9a-f]+}}: ret
|
|
// CHECK-NEXT: The 1 instructions that write to the affected registers after any authentication are:
|
|
// CHECK-NEXT: 1. {{[0-9a-f]+}}: ldp x29, x30, [sp], #0x10
|
|
// CHECK-NEXT: This happens in the following basic block:
|
|
// CHECK-NEXT: {{[0-9a-f]+}}: paciasp
|
|
// CHECK-NEXT: {{[0-9a-f]+}}: stp x29, x30, [sp, #-0x10]!
|
|
// CHECK-NEXT: {{[0-9a-f]+}}: mov x29, sp
|
|
// CHECK-NEXT: {{[0-9a-f]+}}: bl g
|
|
// CHECK-NEXT: {{[0-9a-f]+}}: add x0, x0, #0x3
|
|
// CHECK-NEXT: {{[0-9a-f]+}}: ldp x29, x30, [sp], #0x10
|
|
// CHECK-NEXT: {{[0-9a-f]+}}: autia x12, sp
|
|
// CHECK-NEXT: {{[0-9a-f]+}}: ret
|
|
ret
|
|
.size f_autiax12, .-f_autiax12
|
|
|
|
.globl f_autibx12
|
|
.type f_autibx12,@function
|
|
f_autibx12:
|
|
paciasp
|
|
stp x29, x30, [sp, #-16]!
|
|
mov x29, sp
|
|
bl g
|
|
add x0, x0, #3
|
|
ldp x29, x30, [sp], #16
|
|
autib x12, sp
|
|
// CHECK-LABEL: GS-PAUTH: non-protected ret found in function f_autibx12, basic block {{[0-9a-zA-Z.]+}}, at address
|
|
// CHECK-NEXT: The instruction is {{[0-9a-f]+}}: ret
|
|
// CHECK-NEXT: The 1 instructions that write to the affected registers after any authentication are:
|
|
// CHECK-NEXT: 1. {{[0-9a-f]+}}: ldp x29, x30, [sp], #0x10
|
|
// CHECK-NEXT: This happens in the following basic block:
|
|
// CHECK-NEXT: {{[0-9a-f]+}}: paciasp
|
|
// CHECK-NEXT: {{[0-9a-f]+}}: stp x29, x30, [sp, #-0x10]!
|
|
// CHECK-NEXT: {{[0-9a-f]+}}: mov x29, sp
|
|
// CHECK-NEXT: {{[0-9a-f]+}}: bl g
|
|
// CHECK-NEXT: {{[0-9a-f]+}}: add x0, x0, #0x3
|
|
// CHECK-NEXT: {{[0-9a-f]+}}: ldp x29, x30, [sp], #0x10
|
|
// CHECK-NEXT: {{[0-9a-f]+}}: autib x12, sp
|
|
// CHECK-NEXT: {{[0-9a-f]+}}: ret
|
|
ret
|
|
.size f_autibx12, .-f_autibx12
|
|
|
|
.globl f_autiax30
|
|
.type f_autiax30,@function
|
|
f_autiax30:
|
|
paciasp
|
|
stp x29, x30, [sp, #-16]!
|
|
mov x29, sp
|
|
bl g
|
|
add x0, x0, #3
|
|
ldp x29, x30, [sp], #16
|
|
autia x30, sp
|
|
// CHECK-NOT: function f_autiax30
|
|
ret
|
|
.size f_autiax30, .-f_autiax30
|
|
|
|
.globl f_autibx30
|
|
.type f_autibx30,@function
|
|
f_autibx30:
|
|
paciasp
|
|
stp x29, x30, [sp, #-16]!
|
|
mov x29, sp
|
|
bl g
|
|
add x0, x0, #3
|
|
ldp x29, x30, [sp], #16
|
|
autib x30, sp
|
|
// CHECK-NOT: function f_autibx30
|
|
ret
|
|
.size f_autibx30, .-f_autibx30
|
|
|
|
|
|
.globl f_autdax12
|
|
.type f_autdax12,@function
|
|
f_autdax12:
|
|
paciasp
|
|
stp x29, x30, [sp, #-16]!
|
|
mov x29, sp
|
|
bl g
|
|
add x0, x0, #3
|
|
ldp x29, x30, [sp], #16
|
|
autda x12, sp
|
|
// CHECK-LABEL: GS-PAUTH: non-protected ret found in function f_autdax12, basic block {{[0-9a-zA-Z.]+}}, at address
|
|
// CHECK-NEXT: The instruction is {{[0-9a-f]+}}: ret
|
|
// CHECK-NEXT: The 1 instructions that write to the affected registers after any authentication are:
|
|
// CHECK-NEXT: 1. {{[0-9a-f]+}}: ldp x29, x30, [sp], #0x10
|
|
// CHECK-NEXT: This happens in the following basic block:
|
|
// CHECK-NEXT: {{[0-9a-f]+}}: paciasp
|
|
// CHECK-NEXT: {{[0-9a-f]+}}: stp x29, x30, [sp, #-0x10]!
|
|
// CHECK-NEXT: {{[0-9a-f]+}}: mov x29, sp
|
|
// CHECK-NEXT: {{[0-9a-f]+}}: bl g
|
|
// CHECK-NEXT: {{[0-9a-f]+}}: add x0, x0, #0x3
|
|
// CHECK-NEXT: {{[0-9a-f]+}}: ldp x29, x30, [sp], #0x10
|
|
// CHECK-NEXT: {{[0-9a-f]+}}: autda x12, sp
|
|
// CHECK-NEXT: {{[0-9a-f]+}}: ret
|
|
ret
|
|
.size f_autdax12, .-f_autdax12
|
|
|
|
.globl f_autdbx12
|
|
.type f_autdbx12,@function
|
|
f_autdbx12:
|
|
paciasp
|
|
stp x29, x30, [sp, #-16]!
|
|
mov x29, sp
|
|
bl g
|
|
add x0, x0, #3
|
|
ldp x29, x30, [sp], #16
|
|
autdb x12, sp
|
|
// CHECK-LABEL: GS-PAUTH: non-protected ret found in function f_autdbx12, basic block {{[0-9a-zA-Z.]+}}, at address
|
|
// CHECK-NEXT: The instruction is {{[0-9a-f]+}}: ret
|
|
// CHECK-NEXT: The 1 instructions that write to the affected registers after any authentication are:
|
|
// CHECK-NEXT: 1. {{[0-9a-f]+}}: ldp x29, x30, [sp], #0x10
|
|
// CHECK-NEXT: This happens in the following basic block:
|
|
// CHECK-NEXT: {{[0-9a-f]+}}: paciasp
|
|
// CHECK-NEXT: {{[0-9a-f]+}}: stp x29, x30, [sp, #-0x10]!
|
|
// CHECK-NEXT: {{[0-9a-f]+}}: mov x29, sp
|
|
// CHECK-NEXT: {{[0-9a-f]+}}: bl g
|
|
// CHECK-NEXT: {{[0-9a-f]+}}: add x0, x0, #0x3
|
|
// CHECK-NEXT: {{[0-9a-f]+}}: ldp x29, x30, [sp], #0x10
|
|
// CHECK-NEXT: {{[0-9a-f]+}}: autdb x12, sp
|
|
// CHECK-NEXT: {{[0-9a-f]+}}: ret
|
|
ret
|
|
.size f_autdbx12, .-f_autdbx12
|
|
|
|
.globl f_autdax30
|
|
.type f_autdax30,@function
|
|
f_autdax30:
|
|
paciasp
|
|
stp x29, x30, [sp, #-16]!
|
|
mov x29, sp
|
|
bl g
|
|
add x0, x0, #3
|
|
ldp x29, x30, [sp], #16
|
|
autda x30, sp
|
|
// CHECK-NOT: function f_autdax30
|
|
ret
|
|
.size f_autdax30, .-f_autdax30
|
|
|
|
.globl f_autdbx30
|
|
.type f_autdbx30,@function
|
|
f_autdbx30:
|
|
paciasp
|
|
stp x29, x30, [sp, #-16]!
|
|
mov x29, sp
|
|
bl g
|
|
add x0, x0, #3
|
|
ldp x29, x30, [sp], #16
|
|
autdb x30, sp
|
|
// CHECK-NOT: function f_autdbx30
|
|
ret
|
|
.size f_autdbx30, .-f_autdbx30
|
|
|
|
|
|
.globl f_autizax12
|
|
.type f_autizax12,@function
|
|
f_autizax12:
|
|
paciasp
|
|
stp x29, x30, [sp, #-16]!
|
|
mov x29, sp
|
|
bl g
|
|
add x0, x0, #3
|
|
ldp x29, x30, [sp], #16
|
|
autiza x12
|
|
// CHECK-LABEL: GS-PAUTH: non-protected ret found in function f_autizax12, basic block {{[0-9a-zA-Z.]+}}, at address
|
|
// CHECK-NEXT: The instruction is {{[0-9a-f]+}}: ret
|
|
// CHECK-NEXT: The 1 instructions that write to the affected registers after any authentication are:
|
|
// CHECK-NEXT: 1. {{[0-9a-f]+}}: ldp x29, x30, [sp], #0x10
|
|
// CHECK-NEXT: This happens in the following basic block:
|
|
// CHECK-NEXT: {{[0-9a-f]+}}: paciasp
|
|
// CHECK-NEXT: {{[0-9a-f]+}}: stp x29, x30, [sp, #-0x10]!
|
|
// CHECK-NEXT: {{[0-9a-f]+}}: mov x29, sp
|
|
// CHECK-NEXT: {{[0-9a-f]+}}: bl g
|
|
// CHECK-NEXT: {{[0-9a-f]+}}: add x0, x0, #0x3
|
|
// CHECK-NEXT: {{[0-9a-f]+}}: ldp x29, x30, [sp], #0x10
|
|
// CHECK-NEXT: {{[0-9a-f]+}}: autiza x12
|
|
// CHECK-NEXT: {{[0-9a-f]+}}: ret
|
|
ret
|
|
.size f_autizax12, .-f_autizax12
|
|
|
|
.globl f_autizbx12
|
|
.type f_autizbx12,@function
|
|
f_autizbx12:
|
|
paciasp
|
|
stp x29, x30, [sp, #-16]!
|
|
mov x29, sp
|
|
bl g
|
|
add x0, x0, #3
|
|
ldp x29, x30, [sp], #16
|
|
autizb x12
|
|
// CHECK-LABEL: GS-PAUTH: non-protected ret found in function f_autizbx12, basic block {{[0-9a-zA-Z.]+}}, at address
|
|
// CHECK-NEXT: The instruction is {{[0-9a-f]+}}: ret
|
|
// CHECK-NEXT: The 1 instructions that write to the affected registers after any authentication are:
|
|
// CHECK-NEXT: 1. {{[0-9a-f]+}}: ldp x29, x30, [sp], #0x10
|
|
// CHECK-NEXT: This happens in the following basic block:
|
|
// CHECK-NEXT: {{[0-9a-f]+}}: paciasp
|
|
// CHECK-NEXT: {{[0-9a-f]+}}: stp x29, x30, [sp, #-0x10]!
|
|
// CHECK-NEXT: {{[0-9a-f]+}}: mov x29, sp
|
|
// CHECK-NEXT: {{[0-9a-f]+}}: bl g
|
|
// CHECK-NEXT: {{[0-9a-f]+}}: add x0, x0, #0x3
|
|
// CHECK-NEXT: {{[0-9a-f]+}}: ldp x29, x30, [sp], #0x10
|
|
// CHECK-NEXT: {{[0-9a-f]+}}: autizb x12
|
|
// CHECK-NEXT: {{[0-9a-f]+}}: ret
|
|
ret
|
|
.size f_autizbx12, .-f_autizbx12
|
|
|
|
.globl f_autizax30
|
|
.type f_autizax30,@function
|
|
f_autizax30:
|
|
paciasp
|
|
stp x29, x30, [sp, #-16]!
|
|
mov x29, sp
|
|
bl g
|
|
add x0, x0, #3
|
|
ldp x29, x30, [sp], #16
|
|
autiza x30
|
|
// CHECK-NOT: function f_autizax30
|
|
ret
|
|
.size f_autizax30, .-f_autizax30
|
|
|
|
.globl f_autizbx30
|
|
.type f_autizbx30,@function
|
|
f_autizbx30:
|
|
paciasp
|
|
stp x29, x30, [sp, #-16]!
|
|
mov x29, sp
|
|
bl g
|
|
add x0, x0, #3
|
|
ldp x29, x30, [sp], #16
|
|
autizb x30
|
|
// CHECK-NOT: function f_autizbx30
|
|
ret
|
|
.size f_autizbx30, .-f_autizbx30
|
|
|
|
|
|
.globl f_autdzax12
|
|
.type f_autdzax12,@function
|
|
f_autdzax12:
|
|
paciasp
|
|
stp x29, x30, [sp, #-16]!
|
|
mov x29, sp
|
|
bl g
|
|
add x0, x0, #3
|
|
ldp x29, x30, [sp], #16
|
|
autdza x12
|
|
// CHECK-LABEL: GS-PAUTH: non-protected ret found in function f_autdzax12, basic block {{[0-9a-zA-Z.]+}}, at address
|
|
// CHECK-NEXT: The instruction is {{[0-9a-f]+}}: ret
|
|
// CHECK-NEXT: The 1 instructions that write to the affected registers after any authentication are:
|
|
// CHECK-NEXT: 1. {{[0-9a-f]+}}: ldp x29, x30, [sp], #0x10
|
|
// CHECK-NEXT: This happens in the following basic block:
|
|
// CHECK-NEXT: {{[0-9a-f]+}}: paciasp
|
|
// CHECK-NEXT: {{[0-9a-f]+}}: stp x29, x30, [sp, #-0x10]!
|
|
// CHECK-NEXT: {{[0-9a-f]+}}: mov x29, sp
|
|
// CHECK-NEXT: {{[0-9a-f]+}}: bl g
|
|
// CHECK-NEXT: {{[0-9a-f]+}}: add x0, x0, #0x3
|
|
// CHECK-NEXT: {{[0-9a-f]+}}: ldp x29, x30, [sp], #0x10
|
|
// CHECK-NEXT: {{[0-9a-f]+}}: autdza x12
|
|
// CHECK-NEXT: {{[0-9a-f]+}}: ret
|
|
ret
|
|
.size f_autdzax12, .-f_autdzax12
|
|
|
|
.globl f_autdzbx12
|
|
.type f_autdzbx12,@function
|
|
f_autdzbx12:
|
|
paciasp
|
|
stp x29, x30, [sp, #-16]!
|
|
mov x29, sp
|
|
bl g
|
|
add x0, x0, #3
|
|
ldp x29, x30, [sp], #16
|
|
autdzb x12
|
|
// CHECK-LABEL: GS-PAUTH: non-protected ret found in function f_autdzbx12, basic block {{[0-9a-zA-Z.]+}}, at address
|
|
// CHECK-NEXT: The instruction is {{[0-9a-f]+}}: ret
|
|
// CHECK-NEXT: The 1 instructions that write to the affected registers after any authentication are:
|
|
// CHECK-NEXT: 1. {{[0-9a-f]+}}: ldp x29, x30, [sp], #0x10
|
|
// CHECK-NEXT: This happens in the following basic block:
|
|
// CHECK-NEXT: {{[0-9a-f]+}}: paciasp
|
|
// CHECK-NEXT: {{[0-9a-f]+}}: stp x29, x30, [sp, #-0x10]!
|
|
// CHECK-NEXT: {{[0-9a-f]+}}: mov x29, sp
|
|
// CHECK-NEXT: {{[0-9a-f]+}}: bl g
|
|
// CHECK-NEXT: {{[0-9a-f]+}}: add x0, x0, #0x3
|
|
// CHECK-NEXT: {{[0-9a-f]+}}: ldp x29, x30, [sp], #0x10
|
|
// CHECK-NEXT: {{[0-9a-f]+}}: autdzb x12
|
|
// CHECK-NEXT: {{[0-9a-f]+}}: ret
|
|
ret
|
|
.size f_autdzbx12, .-f_autdzbx12
|
|
|
|
.globl f_autdzax30
|
|
.type f_autdzax30,@function
|
|
f_autdzax30:
|
|
paciasp
|
|
stp x29, x30, [sp, #-16]!
|
|
mov x29, sp
|
|
bl g
|
|
add x0, x0, #3
|
|
ldp x29, x30, [sp], #16
|
|
autdza x30
|
|
// CHECK-NOT: function f_autdzax30
|
|
ret
|
|
.size f_autdzax30, .-f_autdzax30
|
|
|
|
.globl f_autdzbx30
|
|
.type f_autdzbx30,@function
|
|
f_autdzbx30:
|
|
paciasp
|
|
stp x29, x30, [sp, #-16]!
|
|
mov x29, sp
|
|
bl g
|
|
add x0, x0, #3
|
|
ldp x29, x30, [sp], #16
|
|
autdzb x30
|
|
// CHECK-NOT: function f_autdzbx30
|
|
ret
|
|
.size f_autdzbx30, .-f_autdzbx30
|
|
|
|
.globl f_retaa
|
|
.type f_retaa,@function
|
|
f_retaa:
|
|
paciasp
|
|
stp x29, x30, [sp, #-16]!
|
|
mov x29, sp
|
|
bl g
|
|
add x0, x0, #3
|
|
ldp x29, x30, [sp], #16
|
|
// CHECK-NOT: function f_retaa
|
|
retaa
|
|
.size f_retaa, .-f_retaa
|
|
|
|
.globl f_retab
|
|
.type f_retab,@function
|
|
f_retab:
|
|
paciasp
|
|
stp x29, x30, [sp, #-16]!
|
|
mov x29, sp
|
|
bl g
|
|
add x0, x0, #3
|
|
ldp x29, x30, [sp], #16
|
|
// CHECK-NOT: function f_retab
|
|
retab
|
|
.size f_retab, .-f_retab
|
|
|
|
.globl f_eretaa
|
|
.type f_eretaa,@function
|
|
f_eretaa:
|
|
paciasp
|
|
stp x29, x30, [sp, #-16]!
|
|
mov x29, sp
|
|
bl g
|
|
add x0, x0, #3
|
|
ldp x29, x30, [sp], #16
|
|
// CHECK-LABEL: GS-PAUTH: Warning: pac-ret analysis could not analyze this return instruction in function f_eretaa, basic block {{[0-9a-zA-Z.]+}}, at address
|
|
// CHECK-NEXT: The instruction is {{[0-9a-f]+}}: eretaa
|
|
eretaa
|
|
.size f_eretaa, .-f_eretaa
|
|
|
|
.globl f_eretab
|
|
.type f_eretab,@function
|
|
f_eretab:
|
|
paciasp
|
|
stp x29, x30, [sp, #-16]!
|
|
mov x29, sp
|
|
bl g
|
|
add x0, x0, #3
|
|
ldp x29, x30, [sp], #16
|
|
// CHECK-LABEL: GS-PAUTH: Warning: pac-ret analysis could not analyze this return instruction in function f_eretab, basic block {{[0-9a-zA-Z.]+}}, at address
|
|
// CHECK-NEXT: The instruction is {{[0-9a-f]+}}: eretab
|
|
eretab
|
|
.size f_eretab, .-f_eretab
|
|
|
|
.globl f_eret
|
|
.type f_eret,@function
|
|
f_eret:
|
|
paciasp
|
|
stp x29, x30, [sp, #-16]!
|
|
mov x29, sp
|
|
bl g
|
|
add x0, x0, #3
|
|
ldp x29, x30, [sp], #16
|
|
// CHECK-LABEL: GS-PAUTH: Warning: pac-ret analysis could not analyze this return instruction in function f_eret, basic block {{[0-9a-zA-Z.]+}}, at address
|
|
// CHECK-NEXT: The instruction is {{[0-9a-f]+}}: eret
|
|
eret
|
|
.size f_eret, .-f_eret
|
|
|
|
.globl f_movx30reg
|
|
.type f_movx30reg,@function
|
|
f_movx30reg:
|
|
// CHECK-LABEL: GS-PAUTH: non-protected ret found in function f_movx30reg, basic block {{[0-9a-zA-Z.]+}}, at address
|
|
// CHECK-NEXT: The instruction is {{[0-9a-f]+}}: ret
|
|
// CHECK-NEXT: The 1 instructions that write to the affected registers after any authentication are:
|
|
// CHECK-NEXT: 1. {{[0-9a-f]+}}: mov x30, x22
|
|
// CHECK-NEXT: This happens in the following basic block:
|
|
// CHECK-NEXT: {{[0-9a-f]+}}: mov x30, x22
|
|
// CHECK-NEXT: {{[0-9a-f]+}}: ret
|
|
mov x30, x22
|
|
ret
|
|
.size f_movx30reg, .-f_movx30reg
|
|
|
|
.globl f_autiasppci
|
|
.type f_autiasppci,@function
|
|
f_autiasppci:
|
|
0:
|
|
pacnbiasppc
|
|
paciasp
|
|
stp x29, x30, [sp, #-16]!
|
|
mov x29, sp
|
|
bl g
|
|
add x0, x0, #3
|
|
ldp x29, x30, [sp], #16
|
|
autiasppc 0b
|
|
// CHECK-NOT: function f_autiasppci
|
|
ret
|
|
.size f_autiasppci, .-f_autiasppci
|
|
|
|
.globl f_autibsppci
|
|
.type f_autibsppci,@function
|
|
f_autibsppci:
|
|
0:
|
|
pacnbibsppc
|
|
paciasp
|
|
stp x29, x30, [sp, #-16]!
|
|
mov x29, sp
|
|
bl g
|
|
add x0, x0, #3
|
|
ldp x29, x30, [sp], #16
|
|
autibsppc 0b
|
|
// CHECK-NOT: function f_autibsppci
|
|
ret
|
|
.size f_autibsppci, .-f_autibsppci
|
|
|
|
.globl f_autiasppcr
|
|
.type f_autiasppcr,@function
|
|
|
|
f_autiasppcr:
|
|
0:
|
|
pacnbiasppc
|
|
paciasp
|
|
stp x29, x30, [sp, #-16]!
|
|
mov x29, sp
|
|
bl g
|
|
add x0, x0, #3
|
|
ldp x29, x30, [sp], #16
|
|
adr x28, 0b
|
|
autiasppcr x28
|
|
// CHECK-NOT: function f_autiasppcr
|
|
ret
|
|
.size f_autiasppcr, .-f_autiasppcr
|
|
|
|
f_autibsppcr:
|
|
0:
|
|
pacnbibsppc
|
|
paciasp
|
|
stp x29, x30, [sp, #-16]!
|
|
mov x29, sp
|
|
bl g
|
|
add x0, x0, #3
|
|
ldp x29, x30, [sp], #16
|
|
adr x28, 0b
|
|
autibsppcr x28
|
|
// CHECK-NOT: function f_autibsppcr
|
|
ret
|
|
.size f_autibsppcr, .-f_autibsppcr
|
|
|
|
.globl f_retaasppci
|
|
.type f_retaasppci,@function
|
|
f_retaasppci:
|
|
0:
|
|
pacnbiasppc
|
|
paciasp
|
|
stp x29, x30, [sp, #-16]!
|
|
mov x29, sp
|
|
bl g
|
|
add x0, x0, #3
|
|
ldp x29, x30, [sp], #16
|
|
// CHECK-NOT: function f_retaasppci
|
|
retaasppc 0b
|
|
.size f_retaasppci, .-f_retaasppci
|
|
|
|
.globl f_retabsppci
|
|
.type f_retabsppci,@function
|
|
f_retabsppci:
|
|
0:
|
|
pacnbibsppc
|
|
paciasp
|
|
stp x29, x30, [sp, #-16]!
|
|
mov x29, sp
|
|
bl g
|
|
add x0, x0, #3
|
|
ldp x29, x30, [sp], #16
|
|
// CHECK-NOT: function f_retabsppci
|
|
retabsppc 0b
|
|
.size f_retabsppci, .-f_retabsppci
|
|
|
|
.globl f_retaasppcr
|
|
.type f_retaasppcr,@function
|
|
|
|
f_retaasppcr:
|
|
0:
|
|
pacnbiasppc
|
|
paciasp
|
|
stp x29, x30, [sp, #-16]!
|
|
mov x29, sp
|
|
bl g
|
|
add x0, x0, #3
|
|
ldp x29, x30, [sp], #16
|
|
adr x28, 0b
|
|
// CHECK-NOT: function f_retaasppcr
|
|
retaasppcr x28
|
|
.size f_retaasppcr, .-f_retaasppcr
|
|
|
|
f_retabsppcr:
|
|
0:
|
|
pacnbibsppc
|
|
paciasp
|
|
stp x29, x30, [sp, #-16]!
|
|
mov x29, sp
|
|
bl g
|
|
add x0, x0, #3
|
|
ldp x29, x30, [sp], #16
|
|
adr x28, 0b
|
|
// CHECK-NOT: function f_retabsppcr
|
|
retabsppcr x28
|
|
.size f_retabsppcr, .-f_retabsppcr
|
|
|
|
.globl f_autia171615
|
|
.type f_autia171615,@function
|
|
f_autia171615:
|
|
paciasp
|
|
stp x29, x30, [sp, #-16]!
|
|
mov x29, sp
|
|
bl g
|
|
add x0, x0, #3
|
|
ldp x29, x30, [sp], #16
|
|
autia171615
|
|
// CHECK-LABEL: GS-PAUTH: non-protected ret found in function f_autia171615, basic block {{[0-9a-zA-Z.]+}}, at address
|
|
// CHECK-NEXT: The instruction is {{[0-9a-f]+}}: ret
|
|
// CHECK-NEXT: The 1 instructions that write to the affected registers after any authentication are:
|
|
// CHECK-NEXT: 1. {{[0-9a-f]+}}: ldp x29, x30, [sp], #0x10
|
|
// CHECK-NEXT: This happens in the following basic block:
|
|
// CHECK-NEXT: {{[0-9a-f]+}}: paciasp
|
|
// CHECK-NEXT: {{[0-9a-f]+}}: stp x29, x30, [sp, #-0x10]!
|
|
// CHECK-NEXT: {{[0-9a-f]+}}: mov x29, sp
|
|
// CHECK-NEXT: {{[0-9a-f]+}}: bl g
|
|
// CHECK-NEXT: {{[0-9a-f]+}}: add x0, x0, #0x3
|
|
// CHECK-NEXT: {{[0-9a-f]+}}: ldp x29, x30, [sp], #0x10
|
|
// CHECK-NEXT: {{[0-9a-f]+}}: autia171615
|
|
// CHECK-NEXT: {{[0-9a-f]+}}: ret
|
|
ret
|
|
.size f_autia171615, .-f_autia171615
|
|
|
|
.globl f_autib171615
|
|
.type f_autib171615,@function
|
|
f_autib171615:
|
|
paciasp
|
|
stp x29, x30, [sp, #-16]!
|
|
mov x29, sp
|
|
bl g
|
|
add x0, x0, #3
|
|
ldp x29, x30, [sp], #16
|
|
autib171615
|
|
// CHECK-LABEL: GS-PAUTH: non-protected ret found in function f_autib171615, basic block {{[0-9a-zA-Z.]+}}, at address
|
|
// CHECK-NEXT: The instruction is {{[0-9a-f]+}}: ret
|
|
// CHECK-NEXT: The 1 instructions that write to the affected registers after any authentication are:
|
|
// CHECK-NEXT: 1. {{[0-9a-f]+}}: ldp x29, x30, [sp], #0x10
|
|
// CHECK-NEXT: This happens in the following basic block:
|
|
// CHECK-NEXT: {{[0-9a-f]+}}: paciasp
|
|
// CHECK-NEXT: {{[0-9a-f]+}}: stp x29, x30, [sp, #-0x10]!
|
|
// CHECK-NEXT: {{[0-9a-f]+}}: mov x29, sp
|
|
// CHECK-NEXT: {{[0-9a-f]+}}: bl g
|
|
// CHECK-NEXT: {{[0-9a-f]+}}: add x0, x0, #0x3
|
|
// CHECK-NEXT: {{[0-9a-f]+}}: ldp x29, x30, [sp], #0x10
|
|
// CHECK-NEXT: {{[0-9a-f]+}}: autib171615
|
|
// CHECK-NEXT: {{[0-9a-f]+}}: ret
|
|
ret
|
|
.size f_autib171615, .-f_autib171615
|
|
|
|
.globl g
|
|
.type g,@function
|
|
g:
|
|
nop
|
|
ret
|
|
.size g, .-g
|