AArch64 assembly pack: authenticate return addresses.

ARMv8.3 adds pointer authentication extension, which in this case allows
to ensure that, when offloaded to stack, return address is same at return
as at entry to the subroutine. The new instructions are nops on processors
that don't implement the extension, so that the vetification is backward
compatible.

Reviewed-by: Kurt Roeckx <kurt@roeckx.be>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/8205)

diff --git a/crypto/aes/asm/aesv8-armx.pl b/crypto/aes/asm/aesv8-armx.pl
index b61bdbae810421bb63a165b5ed1c225ceb1cb1c3..9ab2158c7db724c512ef41b1b0b3bfa886e8635a 100755 (executable)
--- a/crypto/aes/asm/aesv8-armx.pl
+++ b/crypto/aes/asm/aesv8-armx.pl
@@ -262,6 +262,7 @@ $code.=<<___;
 ${prefix}_set_decrypt_key:
 ___
 $code.=<<___   if ($flavour =~ /64/);
+       .inst   0xd503233f              // paciasp
        stp     x29,x30,[sp,#-16]!
        add     x29,sp,#0
 ___
@@ -305,6 +306,7 @@ $code.=<<___        if ($flavour !~ /64/);
 ___
 $code.=<<___   if ($flavour =~ /64/);
        ldp     x29,x30,[sp],#16
+       .inst   0xd50323bf              // autiasp
        ret
 ___
 $code.=<<___;

diff --git a/crypto/aes/asm/vpaes-armv8.pl b/crypto/aes/asm/vpaes-armv8.pl
index 1fce0c5a4d387573d4a89483a1f565d083b28427..ece9f20bec61385143ff761e5cb11f967bb391c9 100755 (executable)
--- a/crypto/aes/asm/vpaes-armv8.pl
+++ b/crypto/aes/asm/vpaes-armv8.pl
@@ -255,6 +255,7 @@ _vpaes_encrypt_core:
 .type  vpaes_encrypt,%function
 .align 4
 vpaes_encrypt:
+       .inst   0xd503233f                      // paciasp
        stp     x29,x30,[sp,#-16]!
        add     x29,sp,#0
 
@@ -264,6 +265,7 @@ vpaes_encrypt:
        st1     {v0.16b}, [$out]
 
        ldp     x29,x30,[sp],#16
+       .inst   0xd50323bf                      // autiasp
        ret
 .size  vpaes_encrypt,.-vpaes_encrypt
 
@@ -486,6 +488,7 @@ _vpaes_decrypt_core:
 .type  vpaes_decrypt,%function
 .align 4
 vpaes_decrypt:
+       .inst   0xd503233f                      // paciasp
        stp     x29,x30,[sp,#-16]!
        add     x29,sp,#0
 
@@ -495,6 +498,7 @@ vpaes_decrypt:
        st1     {v0.16b}, [$out]
 
        ldp     x29,x30,[sp],#16
+       .inst   0xd50323bf                      // autiasp
        ret
 .size  vpaes_decrypt,.-vpaes_decrypt
 
@@ -665,6 +669,7 @@ _vpaes_key_preheat:
 .type  _vpaes_schedule_core,%function
 .align 4
 _vpaes_schedule_core:
+       .inst   0xd503233f                      // paciasp
        stp     x29, x30, [sp,#-16]!
        add     x29,sp,#0
 
@@ -829,6 +834,7 @@ _vpaes_schedule_core:
        eor     v6.16b, v6.16b, v6.16b          // vpxor        %xmm6,  %xmm6,  %xmm6
        eor     v7.16b, v7.16b, v7.16b          // vpxor        %xmm7,  %xmm7,  %xmm7
        ldp     x29, x30, [sp],#16
+       .inst   0xd50323bf                      // autiasp
        ret
 .size  _vpaes_schedule_core,.-_vpaes_schedule_core
 
@@ -1041,6 +1047,7 @@ _vpaes_schedule_mangle:
 .type  vpaes_set_encrypt_key,%function
 .align 4
 vpaes_set_encrypt_key:
+       .inst   0xd503233f              // paciasp
        stp     x29,x30,[sp,#-16]!
        add     x29,sp,#0
        stp     d8,d9,[sp,#-16]!        // ABI spec says so
@@ -1056,6 +1063,7 @@ vpaes_set_encrypt_key:
 
        ldp     d8,d9,[sp],#16
        ldp     x29,x30,[sp],#16
+       .inst   0xd50323bf              // autiasp
        ret
 .size  vpaes_set_encrypt_key,.-vpaes_set_encrypt_key
 
@@ -1063,6 +1071,7 @@ vpaes_set_encrypt_key:
 .type  vpaes_set_decrypt_key,%function
 .align 4
 vpaes_set_decrypt_key:
+       .inst   0xd503233f              // paciasp
        stp     x29,x30,[sp,#-16]!
        add     x29,sp,#0
        stp     d8,d9,[sp,#-16]!        // ABI spec says so
@@ -1082,6 +1091,7 @@ vpaes_set_decrypt_key:
 
        ldp     d8,d9,[sp],#16
        ldp     x29,x30,[sp],#16
+       .inst   0xd50323bf              // autiasp
        ret
 .size  vpaes_set_decrypt_key,.-vpaes_set_decrypt_key
 ___
@@ -1098,6 +1108,7 @@ vpaes_cbc_encrypt:
        cmp     w5, #0                  // check direction
        b.eq    vpaes_cbc_decrypt
 
+       .inst   0xd503233f              // paciasp
        stp     x29,x30,[sp,#-16]!
        add     x29,sp,#0
 
@@ -1120,6 +1131,7 @@ vpaes_cbc_encrypt:
        st1     {v0.16b}, [$ivec]       // write ivec
 
        ldp     x29,x30,[sp],#16
+       .inst   0xd50323bf              // autiasp
 .Lcbc_abort:
        ret
 .size  vpaes_cbc_encrypt,.-vpaes_cbc_encrypt
@@ -1127,6 +1139,7 @@ vpaes_cbc_encrypt:
 .type  vpaes_cbc_decrypt,%function
 .align 4
 vpaes_cbc_decrypt:
+       .inst   0xd503233f              // paciasp
        stp     x29,x30,[sp,#-16]!
        add     x29,sp,#0
        stp     d8,d9,[sp,#-16]!        // ABI spec says so
@@ -1168,6 +1181,7 @@ vpaes_cbc_decrypt:
        ldp     d10,d11,[sp],#16
        ldp     d8,d9,[sp],#16
        ldp     x29,x30,[sp],#16
+       .inst   0xd50323bf              // autiasp
        ret
 .size  vpaes_cbc_decrypt,.-vpaes_cbc_decrypt
 ___
@@ -1177,6 +1191,7 @@ $code.=<<___;
 .type  vpaes_ecb_encrypt,%function
 .align 4
 vpaes_ecb_encrypt:
+       .inst   0xd503233f              // paciasp
        stp     x29,x30,[sp,#-16]!
        add     x29,sp,#0
        stp     d8,d9,[sp,#-16]!        // ABI spec says so
@@ -1210,6 +1225,7 @@ vpaes_ecb_encrypt:
        ldp     d10,d11,[sp],#16
        ldp     d8,d9,[sp],#16
        ldp     x29,x30,[sp],#16
+       .inst   0xd50323bf              // autiasp
        ret
 .size  vpaes_ecb_encrypt,.-vpaes_ecb_encrypt
 
@@ -1217,6 +1233,7 @@ vpaes_ecb_encrypt:
 .type  vpaes_ecb_decrypt,%function
 .align 4
 vpaes_ecb_decrypt:
+       .inst   0xd503233f              // paciasp
        stp     x29,x30,[sp,#-16]!
        add     x29,sp,#0
        stp     d8,d9,[sp,#-16]!        // ABI spec says so
@@ -1250,6 +1267,7 @@ vpaes_ecb_decrypt:
        ldp     d10,d11,[sp],#16
        ldp     d8,d9,[sp],#16
        ldp     x29,x30,[sp],#16
+       .inst   0xd50323bf              // autiasp
        ret
 .size  vpaes_ecb_decrypt,.-vpaes_ecb_decrypt
 ___

diff --git a/crypto/bn/asm/armv8-mont.pl b/crypto/bn/asm/armv8-mont.pl
index 9a8ff6b92f07630199e5947bb1fab73f386ab8fd..c09c783e5182bdee901df5106dc644650e8e39da 100755 (executable)
--- a/crypto/bn/asm/armv8-mont.pl
+++ b/crypto/bn/asm/armv8-mont.pl
@@ -287,6 +287,7 @@ __bn_sqr8x_mont:
        cmp     $ap,$bp
        b.ne    __bn_mul4x_mont
 .Lsqr8x_mont:
+       .inst   0xd503233f              // paciasp
        stp     x29,x30,[sp,#-128]!
        add     x29,sp,#0
        stp     x19,x20,[sp,#16]
@@ -1040,6 +1041,7 @@ $code.=<<___;
        ldp     x25,x26,[x29,#64]
        ldp     x27,x28,[x29,#80]
        ldr     x29,[sp],#128
+       .inst   0xd50323bf              // autiasp
        ret
 .size  __bn_sqr8x_mont,.-__bn_sqr8x_mont
 ___
@@ -1063,6 +1065,7 @@ $code.=<<___;
 .type  __bn_mul4x_mont,%function
 .align 5
 __bn_mul4x_mont:
+       .inst   0xd503233f              // paciasp
        stp     x29,x30,[sp,#-128]!
        add     x29,sp,#0
        stp     x19,x20,[sp,#16]
@@ -1496,6 +1499,7 @@ __bn_mul4x_mont:
        ldp     x25,x26,[x29,#64]
        ldp     x27,x28,[x29,#80]
        ldr     x29,[sp],#128
+       .inst   0xd50323bf              // autiasp
        ret
 .size  __bn_mul4x_mont,.-__bn_mul4x_mont
 ___

diff --git a/crypto/chacha/asm/chacha-armv8.pl b/crypto/chacha/asm/chacha-armv8.pl
index 20cd70700b0079d9eefe0f25ecdf0703156e3fba..cee787d4d6514e7e56bf2a8ecda72f285556ca4f 100755 (executable)
--- a/crypto/chacha/asm/chacha-armv8.pl
+++ b/crypto/chacha/asm/chacha-armv8.pl
@@ -157,6 +157,7 @@ ChaCha20_ctr32:
        b.ne    ChaCha20_neon
 
 .Lshort:
+       .inst   0xd503233f                      // paciasp
        stp     x29,x30,[sp,#-96]!
        add     x29,sp,#0
 
@@ -276,6 +277,7 @@ $code.=<<___;
        ldp     x25,x26,[x29,#64]
        ldp     x27,x28,[x29,#80]
        ldp     x29,x30,[sp],#96
+       .inst   0xd50323bf                      // autiasp
 .Labort:
        ret
 
@@ -332,6 +334,7 @@ $code.=<<___;
        ldp     x25,x26,[x29,#64]
        ldp     x27,x28,[x29,#80]
        ldp     x29,x30,[sp],#96
+       .inst   0xd50323bf                      // autiasp
        ret
 .size  ChaCha20_ctr32,.-ChaCha20_ctr32
 ___
@@ -377,6 +380,7 @@ $code.=<<___;
 .type  ChaCha20_neon,%function
 .align 5
 ChaCha20_neon:
+       .inst   0xd503233f                      // paciasp
        stp     x29,x30,[sp,#-96]!
        add     x29,sp,#0
 
@@ -575,6 +579,7 @@ $code.=<<___;
        ldp     x25,x26,[x29,#64]
        ldp     x27,x28,[x29,#80]
        ldp     x29,x30,[sp],#96
+       .inst   0xd50323bf                      // autiasp
        ret
 
 .Ltail_neon:
@@ -684,6 +689,7 @@ $code.=<<___;
        ldp     x25,x26,[x29,#64]
        ldp     x27,x28,[x29,#80]
        ldp     x29,x30,[sp],#96
+       .inst   0xd50323bf                      // autiasp
        ret
 .size  ChaCha20_neon,.-ChaCha20_neon
 ___
@@ -696,6 +702,7 @@ $code.=<<___;
 .type  ChaCha20_512_neon,%function
 .align 5
 ChaCha20_512_neon:
+       .inst   0xd503233f                      // paciasp
        stp     x29,x30,[sp,#-96]!
        add     x29,sp,#0
 
@@ -1114,6 +1121,7 @@ $code.=<<___;
        ldp     x25,x26,[x29,#64]
        ldp     x27,x28,[x29,#80]
        ldp     x29,x30,[sp],#96
+       .inst   0xd50323bf                      // autiasp
        ret
 .size  ChaCha20_512_neon,.-ChaCha20_512_neon
 ___

diff --git a/crypto/ec/asm/ecp_nistz256-armv8.pl b/crypto/ec/asm/ecp_nistz256-armv8.pl
index 87364e86474ea21b4a831afb3783838439bd73c4..d84f523cd1b9207e9e16c8f43fe03475f72c39f9 100644 (file)
--- a/crypto/ec/asm/ecp_nistz256-armv8.pl
+++ b/crypto/ec/asm/ecp_nistz256-armv8.pl
@@ -119,6 +119,7 @@ $code.=<<___;
 .type  ecp_nistz256_to_mont,%function
 .align 6
 ecp_nistz256_to_mont:
+       .inst   0xd503233f              // paciasp
        stp     x29,x30,[sp,#-32]!
        add     x29,sp,#0
        stp     x19,x20,[sp,#16]
@@ -134,6 +135,7 @@ ecp_nistz256_to_mont:
 
        ldp     x19,x20,[sp,#16]
        ldp     x29,x30,[sp],#32
+       .inst   0xd50323bf              // autiasp
        ret
 .size  ecp_nistz256_to_mont,.-ecp_nistz256_to_mont
 
@@ -142,6 +144,7 @@ ecp_nistz256_to_mont:
 .type  ecp_nistz256_from_mont,%function
 .align 4
 ecp_nistz256_from_mont:
+       .inst   0xd503233f              // paciasp
        stp     x29,x30,[sp,#-32]!
        add     x29,sp,#0
        stp     x19,x20,[sp,#16]
@@ -157,6 +160,7 @@ ecp_nistz256_from_mont:
 
        ldp     x19,x20,[sp,#16]
        ldp     x29,x30,[sp],#32
+       .inst   0xd50323bf              // autiasp
        ret
 .size  ecp_nistz256_from_mont,.-ecp_nistz256_from_mont
 
@@ -166,6 +170,7 @@ ecp_nistz256_from_mont:
 .type  ecp_nistz256_mul_mont,%function
 .align 4
 ecp_nistz256_mul_mont:
+       .inst   0xd503233f              // paciasp
        stp     x29,x30,[sp,#-32]!
        add     x29,sp,#0
        stp     x19,x20,[sp,#16]
@@ -180,6 +185,7 @@ ecp_nistz256_mul_mont:
 
        ldp     x19,x20,[sp,#16]
        ldp     x29,x30,[sp],#32
+       .inst   0xd50323bf              // autiasp
        ret
 .size  ecp_nistz256_mul_mont,.-ecp_nistz256_mul_mont
 
@@ -188,6 +194,7 @@ ecp_nistz256_mul_mont:
 .type  ecp_nistz256_sqr_mont,%function
 .align 4
 ecp_nistz256_sqr_mont:
+       .inst   0xd503233f              // paciasp
        stp     x29,x30,[sp,#-32]!
        add     x29,sp,#0
        stp     x19,x20,[sp,#16]
@@ -201,6 +208,7 @@ ecp_nistz256_sqr_mont:
 
        ldp     x19,x20,[sp,#16]
        ldp     x29,x30,[sp],#32
+       .inst   0xd50323bf              // autiasp
        ret
 .size  ecp_nistz256_sqr_mont,.-ecp_nistz256_sqr_mont
 
@@ -210,6 +218,7 @@ ecp_nistz256_sqr_mont:
 .type  ecp_nistz256_add,%function
 .align 4
 ecp_nistz256_add:
+       .inst   0xd503233f              // paciasp
        stp     x29,x30,[sp,#-16]!
        add     x29,sp,#0
 
@@ -223,6 +232,7 @@ ecp_nistz256_add:
        bl      __ecp_nistz256_add
 
        ldp     x29,x30,[sp],#16
+       .inst   0xd50323bf              // autiasp
        ret
 .size  ecp_nistz256_add,.-ecp_nistz256_add
 
@@ -231,6 +241,7 @@ ecp_nistz256_add:
 .type  ecp_nistz256_div_by_2,%function
 .align 4
 ecp_nistz256_div_by_2:
+       .inst   0xd503233f              // paciasp
        stp     x29,x30,[sp,#-16]!
        add     x29,sp,#0
 
@@ -242,6 +253,7 @@ ecp_nistz256_div_by_2:
        bl      __ecp_nistz256_div_by_2
 
        ldp     x29,x30,[sp],#16
+       .inst   0xd50323bf              //  autiasp
        ret
 .size  ecp_nistz256_div_by_2,.-ecp_nistz256_div_by_2
 
@@ -250,6 +262,7 @@ ecp_nistz256_div_by_2:
 .type  ecp_nistz256_mul_by_2,%function
 .align 4
 ecp_nistz256_mul_by_2:
+       .inst   0xd503233f              // paciasp
        stp     x29,x30,[sp,#-16]!
        add     x29,sp,#0
 
@@ -265,6 +278,7 @@ ecp_nistz256_mul_by_2:
        bl      __ecp_nistz256_add      // ret = a+a    // 2*a
 
        ldp     x29,x30,[sp],#16
+       .inst   0xd50323bf              // autiasp
        ret
 .size  ecp_nistz256_mul_by_2,.-ecp_nistz256_mul_by_2
 
@@ -273,6 +287,7 @@ ecp_nistz256_mul_by_2:
 .type  ecp_nistz256_mul_by_3,%function
 .align 4
 ecp_nistz256_mul_by_3:
+       .inst   0xd503233f              // paciasp
        stp     x29,x30,[sp,#-16]!
        add     x29,sp,#0
 
@@ -299,6 +314,7 @@ ecp_nistz256_mul_by_3:
        bl      __ecp_nistz256_add      // ret += a     // 2*a+a=3*a
 
        ldp     x29,x30,[sp],#16
+       .inst   0xd50323bf              // autiasp
        ret
 .size  ecp_nistz256_mul_by_3,.-ecp_nistz256_mul_by_3
 
@@ -308,6 +324,7 @@ ecp_nistz256_mul_by_3:
 .type  ecp_nistz256_sub,%function
 .align 4
 ecp_nistz256_sub:
+       .inst   0xd503233f              // paciasp
        stp     x29,x30,[sp,#-16]!
        add     x29,sp,#0
 
@@ -319,6 +336,7 @@ ecp_nistz256_sub:
        bl      __ecp_nistz256_sub_from
 
        ldp     x29,x30,[sp],#16
+       .inst   0xd50323bf              // autiasp
        ret
 .size  ecp_nistz256_sub,.-ecp_nistz256_sub
 
@@ -327,6 +345,7 @@ ecp_nistz256_sub:
 .type  ecp_nistz256_neg,%function
 .align 4
 ecp_nistz256_neg:
+       .inst   0xd503233f              // paciasp
        stp     x29,x30,[sp,#-16]!
        add     x29,sp,#0
 
@@ -341,6 +360,7 @@ ecp_nistz256_neg:
        bl      __ecp_nistz256_sub_from
 
        ldp     x29,x30,[sp],#16
+       .inst   0xd50323bf              // autiasp
        ret
 .size  ecp_nistz256_neg,.-ecp_nistz256_neg
 
@@ -701,6 +721,7 @@ $code.=<<___;
 .type  ecp_nistz256_point_double,%function
 .align 5
 ecp_nistz256_point_double:
+       .inst   0xd503233f              // paciasp
        stp     x29,x30,[sp,#-80]!
        add     x29,sp,#0
        stp     x19,x20,[sp,#16]
@@ -835,6 +856,7 @@ ecp_nistz256_point_double:
        ldp     x19,x20,[x29,#16]
        ldp     x21,x22,[x29,#32]
        ldp     x29,x30,[sp],#80
+       .inst   0xd50323bf              // autiasp
        ret
 .size  ecp_nistz256_point_double,.-ecp_nistz256_point_double
 ___
@@ -857,6 +879,7 @@ $code.=<<___;
 .type  ecp_nistz256_point_add,%function
 .align 5
 ecp_nistz256_point_add:
+       .inst   0xd503233f              // paciasp
        stp     x29,x30,[sp,#-80]!
        add     x29,sp,#0
        stp     x19,x20,[sp,#16]
@@ -1094,12 +1117,13 @@ $code.=<<___;
        stp     $acc2,$acc3,[$rp_real,#$i+16]
 
 .Ladd_done:
-       add     sp,x29,#0       // destroy frame
+       add     sp,x29,#0               // destroy frame
        ldp     x19,x20,[x29,#16]
        ldp     x21,x22,[x29,#32]
        ldp     x23,x24,[x29,#48]
        ldp     x25,x26,[x29,#64]
        ldp     x29,x30,[sp],#80
+       .inst   0xd50323bf              // autiasp
        ret
 .size  ecp_nistz256_point_add,.-ecp_nistz256_point_add
 ___
@@ -1121,6 +1145,7 @@ $code.=<<___;
 .type  ecp_nistz256_point_add_affine,%function
 .align 5
 ecp_nistz256_point_add_affine:
+       .inst   0xd503233f              // paciasp
        stp     x29,x30,[sp,#-80]!
        add     x29,sp,#0
        stp     x19,x20,[sp,#16]
@@ -1309,6 +1334,7 @@ $code.=<<___;
        ldp     x23,x24,[x29,#48]
        ldp     x25,x26,[x29,#64]
        ldp     x29,x30,[sp],#80
+       .inst   0xd50323bf              // autiasp
        ret
 .size  ecp_nistz256_point_add_affine,.-ecp_nistz256_point_add_affine
 ___

diff --git a/crypto/poly1305/asm/poly1305-armv8.pl b/crypto/poly1305/asm/poly1305-armv8.pl
index 31b3110a25d4c647c04b2a2518bfe7f853a17e3d..1aded5a275a8df59def3ae44dbfcb0d02bdd7b73 100755 (executable)
--- a/crypto/poly1305/asm/poly1305-armv8.pl
+++ b/crypto/poly1305/asm/poly1305-armv8.pl
@@ -291,6 +291,7 @@ poly1305_blocks_neon:
        cbz     $is_base2_26,poly1305_blocks
 
 .Lblocks_neon:
+       .inst   0xd503233f              // paciasp
        stp     x29,x30,[sp,#-80]!
        add     x29,sp,#0
 
@@ -859,6 +860,7 @@ poly1305_blocks_neon:
        st1     {$ACC4}[0],[$ctx]
 
 .Lno_data_neon:
+       .inst   0xd50323bf              // autiasp
        ldr     x29,[sp],#80
        ret
 .size  poly1305_blocks_neon,.-poly1305_blocks_neon

diff --git a/crypto/sha/asm/keccak1600-armv8.pl b/crypto/sha/asm/keccak1600-armv8.pl
index 7baf0468436f48936dcaa4ab74483768e803371c..bd15a52a2eb35597f8eb57772b27f07aa9252e45 100755 (executable)
--- a/crypto/sha/asm/keccak1600-armv8.pl
+++ b/crypto/sha/asm/keccak1600-armv8.pl
@@ -121,6 +121,7 @@ $code.=<<___;
 .align 5
 KeccakF1600_int:
        adr     $C[2],iotas
+       .inst   0xd503233f                      // paciasp
        stp     $C[2],x30,[sp,#16]              // 32 bytes on top are mine
        b       .Loop
 .align 4
@@ -292,12 +293,14 @@ $code.=<<___;
        bne     .Loop
 
        ldr     x30,[sp,#24]
+       .inst   0xd50323bf                      // autiasp
        ret
 .size  KeccakF1600_int,.-KeccakF1600_int
 
 .type  KeccakF1600,%function
 .align 5
 KeccakF1600:
+       .inst   0xd503233f                      // paciasp
        stp     x29,x30,[sp,#-128]!
        add     x29,sp,#0
        stp     x19,x20,[sp,#16]
@@ -347,6 +350,7 @@ KeccakF1600:
        ldp     x25,x26,[x29,#64]
        ldp     x27,x28,[x29,#80]
        ldp     x29,x30,[sp],#128
+       .inst   0xd50323bf                      // autiasp
        ret
 .size  KeccakF1600,.-KeccakF1600
 
@@ -354,6 +358,7 @@ KeccakF1600:
 .type  SHA3_absorb,%function
 .align 5
 SHA3_absorb:
+       .inst   0xd503233f                      // paciasp
        stp     x29,x30,[sp,#-128]!
        add     x29,sp,#0
        stp     x19,x20,[sp,#16]
@@ -451,6 +456,7 @@ $code.=<<___;
        ldp     x25,x26,[x29,#64]
        ldp     x27,x28,[x29,#80]
        ldp     x29,x30,[sp],#128
+       .inst   0xd50323bf                      // autiasp
        ret
 .size  SHA3_absorb,.-SHA3_absorb
 ___
@@ -461,6 +467,7 @@ $code.=<<___;
 .type  SHA3_squeeze,%function
 .align 5
 SHA3_squeeze:
+       .inst   0xd503233f                      // paciasp
        stp     x29,x30,[sp,#-48]!
        add     x29,sp,#0
        stp     x19,x20,[sp,#16]
@@ -523,6 +530,7 @@ SHA3_squeeze:
        ldp     x19,x20,[sp,#16]
        ldp     x21,x22,[sp,#32]
        ldp     x29,x30,[sp],#48
+       .inst   0xd50323bf                      // autiasp
        ret
 .size  SHA3_squeeze,.-SHA3_squeeze
 ___
@@ -641,6 +649,7 @@ KeccakF1600_ce:
 .type  KeccakF1600_cext,%function
 .align 5
 KeccakF1600_cext:
+       .inst   0xd503233f              // paciasp
        stp     x29,x30,[sp,#-80]!
        add     x29,sp,#0
        stp     d8,d9,[sp,#16]          // per ABI requirement
@@ -673,6 +682,7 @@ $code.=<<___;
        ldp     d12,d13,[sp,#48]
        ldp     d14,d15,[sp,#64]
        ldr     x29,[sp],#80
+       .inst   0xd50323bf              // autiasp
        ret
 .size  KeccakF1600_cext,.-KeccakF1600_cext
 ___
@@ -685,6 +695,7 @@ $code.=<<___;
 .type  SHA3_absorb_cext,%function
 .align 5
 SHA3_absorb_cext:
+       .inst   0xd503233f              // paciasp
        stp     x29,x30,[sp,#-80]!
        add     x29,sp,#0
        stp     d8,d9,[sp,#16]          // per ABI requirement
@@ -756,6 +767,7 @@ $code.=<<___;
        ldp     d12,d13,[sp,#48]
        ldp     d14,d15,[sp,#64]
        ldp     x29,x30,[sp],#80
+       .inst   0xd50323bf              // autiasp
        ret
 .size  SHA3_absorb_cext,.-SHA3_absorb_cext
 ___
@@ -767,6 +779,7 @@ $code.=<<___;
 .type  SHA3_squeeze_cext,%function
 .align 5
 SHA3_squeeze_cext:
+       .inst   0xd503233f              // paciasp
        stp     x29,x30,[sp,#-16]!
        add     x29,sp,#0
        mov     x9,$ctx
@@ -822,6 +835,7 @@ SHA3_squeeze_cext:
 
 .Lsqueeze_done_ce:
        ldr     x29,[sp],#16
+       .inst   0xd50323bf              // autiasp
        ret
 .size  SHA3_squeeze_cext,.-SHA3_squeeze_cext
 ___

diff --git a/crypto/sha/asm/sha512-armv8.pl b/crypto/sha/asm/sha512-armv8.pl
index c787ea81e557caa085a172dd8aaed6d2bf07feef..6540a9f3a61e0f3ae9d8ba73670a0d6979ee9645 100644 (file)
--- a/crypto/sha/asm/sha512-armv8.pl
+++ b/crypto/sha/asm/sha512-armv8.pl
@@ -219,6 +219,7 @@ $code.=<<___        if ($SZ==8);
 ___
 $code.=<<___;
 #endif
+       .inst   0xd503233f                              // paciasp
        stp     x29,x30,[sp,#-128]!
        add     x29,sp,#0
 
@@ -280,6 +281,7 @@ $code.=<<___;
        ldp     x25,x26,[x29,#64]
        ldp     x27,x28,[x29,#80]
        ldp     x29,x30,[sp],#128
+       .inst   0xd50323bf                              // autiasp
        ret
 .size  $func,.-$func