AArch64 assembly pack: authenticate return addresses.

ARMv8.3 adds pointer authentication extension, which in this case allows
to ensure that, when offloaded to stack, return address is same at return
as at entry to the subroutine. The new instructions are nops on processors
that don't implement the extension, so that the vetification is backward
compatible.

Reviewed-by: Kurt Roeckx <kurt@roeckx.be>
Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/8205)

(cherry picked from commit 9a18aae5f21efc59da8b697ad67d5d37b95ab322)

diff --git a/crypto/aes/asm/aesv8-armx.pl b/crypto/aes/asm/aesv8-armx.pl
index 8b37cfc452a02d57f83f666b49a4960dc8570464..ffa52ab02e3e156e035d2aa67a1f9cfbb29f53b0 100755 (executable)
--- a/crypto/aes/asm/aesv8-armx.pl
+++ b/crypto/aes/asm/aesv8-armx.pl
@@ -262,6 +262,7 @@ $code.=<<___;
 ${prefix}_set_decrypt_key:
 ___
 $code.=<<___   if ($flavour =~ /64/);
+       .inst   0xd503233f              // paciasp
        stp     x29,x30,[sp,#-16]!
        add     x29,sp,#0
 ___
@@ -305,6 +306,7 @@ $code.=<<___        if ($flavour !~ /64/);
 ___
 $code.=<<___   if ($flavour =~ /64/);
        ldp     x29,x30,[sp],#16
+       .inst   0xd50323bf              // autiasp
        ret
 ___
 $code.=<<___;

diff --git a/crypto/aes/asm/vpaes-armv8.pl b/crypto/aes/asm/vpaes-armv8.pl
index 5131e13a09a29523d3c8c92ae5ecafa679304968..5758133f64cdb77fbdaf41060e453f5762b2ece7 100755 (executable)
--- a/crypto/aes/asm/vpaes-armv8.pl
+++ b/crypto/aes/asm/vpaes-armv8.pl
@@ -255,6 +255,7 @@ _vpaes_encrypt_core:
 .type  vpaes_encrypt,%function
 .align 4
 vpaes_encrypt:
+       .inst   0xd503233f                      // paciasp
        stp     x29,x30,[sp,#-16]!
        add     x29,sp,#0
 
@@ -264,6 +265,7 @@ vpaes_encrypt:
        st1     {v0.16b}, [$out]
 
        ldp     x29,x30,[sp],#16
+       .inst   0xd50323bf                      // autiasp
        ret
 .size  vpaes_encrypt,.-vpaes_encrypt
 
@@ -486,6 +488,7 @@ _vpaes_decrypt_core:
 .type  vpaes_decrypt,%function
 .align 4
 vpaes_decrypt:
+       .inst   0xd503233f                      // paciasp
        stp     x29,x30,[sp,#-16]!
        add     x29,sp,#0
 
@@ -495,6 +498,7 @@ vpaes_decrypt:
        st1     {v0.16b}, [$out]
 
        ldp     x29,x30,[sp],#16
+       .inst   0xd50323bf                      // autiasp
        ret
 .size  vpaes_decrypt,.-vpaes_decrypt
 
@@ -665,6 +669,7 @@ _vpaes_key_preheat:
 .type  _vpaes_schedule_core,%function
 .align 4
 _vpaes_schedule_core:
+       .inst   0xd503233f                      // paciasp
        stp     x29, x30, [sp,#-16]!
        add     x29,sp,#0
 
@@ -829,6 +834,7 @@ _vpaes_schedule_core:
        eor     v6.16b, v6.16b, v6.16b          // vpxor        %xmm6,  %xmm6,  %xmm6
        eor     v7.16b, v7.16b, v7.16b          // vpxor        %xmm7,  %xmm7,  %xmm7
        ldp     x29, x30, [sp],#16
+       .inst   0xd50323bf                      // autiasp
        ret
 .size  _vpaes_schedule_core,.-_vpaes_schedule_core
 
@@ -1041,6 +1047,7 @@ _vpaes_schedule_mangle:
 .type  vpaes_set_encrypt_key,%function
 .align 4
 vpaes_set_encrypt_key:
+       .inst   0xd503233f              // paciasp
        stp     x29,x30,[sp,#-16]!
        add     x29,sp,#0
        stp     d8,d9,[sp,#-16]!        // ABI spec says so
@@ -1056,6 +1063,7 @@ vpaes_set_encrypt_key:
 
        ldp     d8,d9,[sp],#16
        ldp     x29,x30,[sp],#16
+       .inst   0xd50323bf              // autiasp
        ret
 .size  vpaes_set_encrypt_key,.-vpaes_set_encrypt_key
 
@@ -1063,6 +1071,7 @@ vpaes_set_encrypt_key:
 .type  vpaes_set_decrypt_key,%function
 .align 4
 vpaes_set_decrypt_key:
+       .inst   0xd503233f              // paciasp
        stp     x29,x30,[sp,#-16]!
        add     x29,sp,#0
        stp     d8,d9,[sp,#-16]!        // ABI spec says so
@@ -1082,6 +1091,7 @@ vpaes_set_decrypt_key:
 
        ldp     d8,d9,[sp],#16
        ldp     x29,x30,[sp],#16
+       .inst   0xd50323bf              // autiasp
        ret
 .size  vpaes_set_decrypt_key,.-vpaes_set_decrypt_key
 ___
@@ -1098,6 +1108,7 @@ vpaes_cbc_encrypt:
        cmp     w5, #0                  // check direction
        b.eq    vpaes_cbc_decrypt
 
+       .inst   0xd503233f              // paciasp
        stp     x29,x30,[sp,#-16]!
        add     x29,sp,#0
 
@@ -1120,6 +1131,7 @@ vpaes_cbc_encrypt:
        st1     {v0.16b}, [$ivec]       // write ivec
 
        ldp     x29,x30,[sp],#16
+       .inst   0xd50323bf              // autiasp
 .Lcbc_abort:
        ret
 .size  vpaes_cbc_encrypt,.-vpaes_cbc_encrypt
@@ -1127,6 +1139,7 @@ vpaes_cbc_encrypt:
 .type  vpaes_cbc_decrypt,%function
 .align 4
 vpaes_cbc_decrypt:
+       .inst   0xd503233f              // paciasp
        stp     x29,x30,[sp,#-16]!
        add     x29,sp,#0
        stp     d8,d9,[sp,#-16]!        // ABI spec says so
@@ -1168,6 +1181,7 @@ vpaes_cbc_decrypt:
        ldp     d10,d11,[sp],#16
        ldp     d8,d9,[sp],#16
        ldp     x29,x30,[sp],#16
+       .inst   0xd50323bf              // autiasp
        ret
 .size  vpaes_cbc_decrypt,.-vpaes_cbc_decrypt
 ___
@@ -1177,6 +1191,7 @@ $code.=<<___;
 .type  vpaes_ecb_encrypt,%function
 .align 4
 vpaes_ecb_encrypt:
+       .inst   0xd503233f              // paciasp
        stp     x29,x30,[sp,#-16]!
        add     x29,sp,#0
        stp     d8,d9,[sp,#-16]!        // ABI spec says so
@@ -1210,6 +1225,7 @@ vpaes_ecb_encrypt:
        ldp     d10,d11,[sp],#16
        ldp     d8,d9,[sp],#16
        ldp     x29,x30,[sp],#16
+       .inst   0xd50323bf              // autiasp
        ret
 .size  vpaes_ecb_encrypt,.-vpaes_ecb_encrypt
 
@@ -1217,6 +1233,7 @@ vpaes_ecb_encrypt:
 .type  vpaes_ecb_decrypt,%function
 .align 4
 vpaes_ecb_decrypt:
+       .inst   0xd503233f              // paciasp
        stp     x29,x30,[sp,#-16]!
        add     x29,sp,#0
        stp     d8,d9,[sp,#-16]!        // ABI spec says so
@@ -1250,6 +1267,7 @@ vpaes_ecb_decrypt:
        ldp     d10,d11,[sp],#16
        ldp     d8,d9,[sp],#16
        ldp     x29,x30,[sp],#16
+       .inst   0xd50323bf              // autiasp
        ret
 .size  vpaes_ecb_decrypt,.-vpaes_ecb_decrypt
 ___

diff --git a/crypto/bn/asm/armv8-mont.pl b/crypto/bn/asm/armv8-mont.pl
index 5d5af1b6be259800dcce4236534e02c7b9c6d092..ed419c3d0e62bb4b61cacdc1cba426985558db9a 100755 (executable)
--- a/crypto/bn/asm/armv8-mont.pl
+++ b/crypto/bn/asm/armv8-mont.pl
@@ -287,6 +287,7 @@ __bn_sqr8x_mont:
        cmp     $ap,$bp
        b.ne    __bn_mul4x_mont
 .Lsqr8x_mont:
+       .inst   0xd503233f              // paciasp
        stp     x29,x30,[sp,#-128]!
        add     x29,sp,#0
        stp     x19,x20,[sp,#16]
@@ -1040,6 +1041,7 @@ $code.=<<___;
        ldp     x25,x26,[x29,#64]
        ldp     x27,x28,[x29,#80]
        ldr     x29,[sp],#128
+       .inst   0xd50323bf              // autiasp
        ret
 .size  __bn_sqr8x_mont,.-__bn_sqr8x_mont
 ___
@@ -1063,6 +1065,7 @@ $code.=<<___;
 .type  __bn_mul4x_mont,%function
 .align 5
 __bn_mul4x_mont:
+       .inst   0xd503233f              // paciasp
        stp     x29,x30,[sp,#-128]!
        add     x29,sp,#0
        stp     x19,x20,[sp,#16]
@@ -1496,6 +1499,7 @@ __bn_mul4x_mont:
        ldp     x25,x26,[x29,#64]
        ldp     x27,x28,[x29,#80]
        ldr     x29,[sp],#128
+       .inst   0xd50323bf              // autiasp
        ret
 .size  __bn_mul4x_mont,.-__bn_mul4x_mont
 ___

diff --git a/crypto/chacha/asm/chacha-armv8.pl b/crypto/chacha/asm/chacha-armv8.pl
index 4a838bc2b32e204e0d0f3a3f7176a3f5b8e57dce..ae50fc98ae9b120986840444d3ac36c95af9fd07 100755 (executable)
--- a/crypto/chacha/asm/chacha-armv8.pl
+++ b/crypto/chacha/asm/chacha-armv8.pl
@@ -157,6 +157,7 @@ ChaCha20_ctr32:
        b.ne    ChaCha20_neon
 
 .Lshort:
+       .inst   0xd503233f                      // paciasp
        stp     x29,x30,[sp,#-96]!
        add     x29,sp,#0
 
@@ -276,6 +277,7 @@ $code.=<<___;
        ldp     x25,x26,[x29,#64]
        ldp     x27,x28,[x29,#80]
        ldp     x29,x30,[sp],#96
+       .inst   0xd50323bf                      // autiasp
 .Labort:
        ret
 
@@ -332,6 +334,7 @@ $code.=<<___;
        ldp     x25,x26,[x29,#64]
        ldp     x27,x28,[x29,#80]
        ldp     x29,x30,[sp],#96
+       .inst   0xd50323bf                      // autiasp
        ret
 .size  ChaCha20_ctr32,.-ChaCha20_ctr32
 ___
@@ -377,6 +380,7 @@ $code.=<<___;
 .type  ChaCha20_neon,%function
 .align 5
 ChaCha20_neon:
+       .inst   0xd503233f                      // paciasp
        stp     x29,x30,[sp,#-96]!
        add     x29,sp,#0
 
@@ -575,6 +579,7 @@ $code.=<<___;
        ldp     x25,x26,[x29,#64]
        ldp     x27,x28,[x29,#80]
        ldp     x29,x30,[sp],#96
+       .inst   0xd50323bf                      // autiasp
        ret
 
 .Ltail_neon:
@@ -684,6 +689,7 @@ $code.=<<___;
        ldp     x25,x26,[x29,#64]
        ldp     x27,x28,[x29,#80]
        ldp     x29,x30,[sp],#96
+       .inst   0xd50323bf                      // autiasp
        ret
 .size  ChaCha20_neon,.-ChaCha20_neon
 ___
@@ -696,6 +702,7 @@ $code.=<<___;
 .type  ChaCha20_512_neon,%function
 .align 5
 ChaCha20_512_neon:
+       .inst   0xd503233f                      // paciasp
        stp     x29,x30,[sp,#-96]!
        add     x29,sp,#0
 
@@ -1114,6 +1121,7 @@ $code.=<<___;
        ldp     x25,x26,[x29,#64]
        ldp     x27,x28,[x29,#80]
        ldp     x29,x30,[sp],#96
+       .inst   0xd50323bf                      // autiasp
        ret
 .size  ChaCha20_512_neon,.-ChaCha20_512_neon
 ___

diff --git a/crypto/ec/asm/ecp_nistz256-armv8.pl b/crypto/ec/asm/ecp_nistz256-armv8.pl
index 1361cb395ffb207925a8db93909b0cc60198c758..d39bbe14f58995ecb2127d44cef03d09c84bb631 100644 (file)
--- a/crypto/ec/asm/ecp_nistz256-armv8.pl
+++ b/crypto/ec/asm/ecp_nistz256-armv8.pl
@@ -119,6 +119,7 @@ $code.=<<___;
 .type  ecp_nistz256_to_mont,%function
 .align 6
 ecp_nistz256_to_mont:
+       .inst   0xd503233f              // paciasp
        stp     x29,x30,[sp,#-32]!
        add     x29,sp,#0
        stp     x19,x20,[sp,#16]
@@ -134,6 +135,7 @@ ecp_nistz256_to_mont:
 
        ldp     x19,x20,[sp,#16]
        ldp     x29,x30,[sp],#32
+       .inst   0xd50323bf              // autiasp
        ret
 .size  ecp_nistz256_to_mont,.-ecp_nistz256_to_mont
 
@@ -142,6 +144,7 @@ ecp_nistz256_to_mont:
 .type  ecp_nistz256_from_mont,%function
 .align 4
 ecp_nistz256_from_mont:
+       .inst   0xd503233f              // paciasp
        stp     x29,x30,[sp,#-32]!
        add     x29,sp,#0
        stp     x19,x20,[sp,#16]
@@ -157,6 +160,7 @@ ecp_nistz256_from_mont:
 
        ldp     x19,x20,[sp,#16]
        ldp     x29,x30,[sp],#32
+       .inst   0xd50323bf              // autiasp
        ret
 .size  ecp_nistz256_from_mont,.-ecp_nistz256_from_mont
 
@@ -166,6 +170,7 @@ ecp_nistz256_from_mont:
 .type  ecp_nistz256_mul_mont,%function
 .align 4
 ecp_nistz256_mul_mont:
+       .inst   0xd503233f              // paciasp
        stp     x29,x30,[sp,#-32]!
        add     x29,sp,#0
        stp     x19,x20,[sp,#16]
@@ -180,6 +185,7 @@ ecp_nistz256_mul_mont:
 
        ldp     x19,x20,[sp,#16]
        ldp     x29,x30,[sp],#32
+       .inst   0xd50323bf              // autiasp
        ret
 .size  ecp_nistz256_mul_mont,.-ecp_nistz256_mul_mont
 
@@ -188,6 +194,7 @@ ecp_nistz256_mul_mont:
 .type  ecp_nistz256_sqr_mont,%function
 .align 4
 ecp_nistz256_sqr_mont:
+       .inst   0xd503233f              // paciasp
        stp     x29,x30,[sp,#-32]!
        add     x29,sp,#0
        stp     x19,x20,[sp,#16]
@@ -201,6 +208,7 @@ ecp_nistz256_sqr_mont:
 
        ldp     x19,x20,[sp,#16]
        ldp     x29,x30,[sp],#32
+       .inst   0xd50323bf              // autiasp
        ret
 .size  ecp_nistz256_sqr_mont,.-ecp_nistz256_sqr_mont
 
@@ -210,6 +218,7 @@ ecp_nistz256_sqr_mont:
 .type  ecp_nistz256_add,%function
 .align 4
 ecp_nistz256_add:
+       .inst   0xd503233f              // paciasp
        stp     x29,x30,[sp,#-16]!
        add     x29,sp,#0
 
@@ -223,6 +232,7 @@ ecp_nistz256_add:
        bl      __ecp_nistz256_add
 
        ldp     x29,x30,[sp],#16
+       .inst   0xd50323bf              // autiasp
        ret
 .size  ecp_nistz256_add,.-ecp_nistz256_add
 
@@ -231,6 +241,7 @@ ecp_nistz256_add:
 .type  ecp_nistz256_div_by_2,%function
 .align 4
 ecp_nistz256_div_by_2:
+       .inst   0xd503233f              // paciasp
        stp     x29,x30,[sp,#-16]!
        add     x29,sp,#0
 
@@ -242,6 +253,7 @@ ecp_nistz256_div_by_2:
        bl      __ecp_nistz256_div_by_2
 
        ldp     x29,x30,[sp],#16
+       .inst   0xd50323bf              //  autiasp
        ret
 .size  ecp_nistz256_div_by_2,.-ecp_nistz256_div_by_2
 
@@ -250,6 +262,7 @@ ecp_nistz256_div_by_2:
 .type  ecp_nistz256_mul_by_2,%function
 .align 4
 ecp_nistz256_mul_by_2:
+       .inst   0xd503233f              // paciasp
        stp     x29,x30,[sp,#-16]!
        add     x29,sp,#0
 
@@ -265,6 +278,7 @@ ecp_nistz256_mul_by_2:
        bl      __ecp_nistz256_add      // ret = a+a    // 2*a
 
        ldp     x29,x30,[sp],#16
+       .inst   0xd50323bf              // autiasp
        ret
 .size  ecp_nistz256_mul_by_2,.-ecp_nistz256_mul_by_2
 
@@ -273,6 +287,7 @@ ecp_nistz256_mul_by_2:
 .type  ecp_nistz256_mul_by_3,%function
 .align 4
 ecp_nistz256_mul_by_3:
+       .inst   0xd503233f              // paciasp
        stp     x29,x30,[sp,#-16]!
        add     x29,sp,#0
 
@@ -299,6 +314,7 @@ ecp_nistz256_mul_by_3:
        bl      __ecp_nistz256_add      // ret += a     // 2*a+a=3*a
 
        ldp     x29,x30,[sp],#16
+       .inst   0xd50323bf              // autiasp
        ret
 .size  ecp_nistz256_mul_by_3,.-ecp_nistz256_mul_by_3
 
@@ -308,6 +324,7 @@ ecp_nistz256_mul_by_3:
 .type  ecp_nistz256_sub,%function
 .align 4
 ecp_nistz256_sub:
+       .inst   0xd503233f              // paciasp
        stp     x29,x30,[sp,#-16]!
        add     x29,sp,#0
 
@@ -319,6 +336,7 @@ ecp_nistz256_sub:
        bl      __ecp_nistz256_sub_from
 
        ldp     x29,x30,[sp],#16
+       .inst   0xd50323bf              // autiasp
        ret
 .size  ecp_nistz256_sub,.-ecp_nistz256_sub
 
@@ -327,6 +345,7 @@ ecp_nistz256_sub:
 .type  ecp_nistz256_neg,%function
 .align 4
 ecp_nistz256_neg:
+       .inst   0xd503233f              // paciasp
        stp     x29,x30,[sp,#-16]!
        add     x29,sp,#0
 
@@ -341,6 +360,7 @@ ecp_nistz256_neg:
        bl      __ecp_nistz256_sub_from
 
        ldp     x29,x30,[sp],#16
+       .inst   0xd50323bf              // autiasp
        ret
 .size  ecp_nistz256_neg,.-ecp_nistz256_neg
 
@@ -701,6 +721,7 @@ $code.=<<___;
 .type  ecp_nistz256_point_double,%function
 .align 5
 ecp_nistz256_point_double:
+       .inst   0xd503233f              // paciasp
        stp     x29,x30,[sp,#-80]!
        add     x29,sp,#0
        stp     x19,x20,[sp,#16]
@@ -835,6 +856,7 @@ ecp_nistz256_point_double:
        ldp     x19,x20,[x29,#16]
        ldp     x21,x22,[x29,#32]
        ldp     x29,x30,[sp],#80
+       .inst   0xd50323bf              // autiasp
        ret
 .size  ecp_nistz256_point_double,.-ecp_nistz256_point_double
 ___
@@ -857,6 +879,7 @@ $code.=<<___;
 .type  ecp_nistz256_point_add,%function
 .align 5
 ecp_nistz256_point_add:
+       .inst   0xd503233f              // paciasp
        stp     x29,x30,[sp,#-80]!
        add     x29,sp,#0
        stp     x19,x20,[sp,#16]
@@ -1094,12 +1117,13 @@ $code.=<<___;
        stp     $acc2,$acc3,[$rp_real,#$i+16]
 
 .Ladd_done:
-       add     sp,x29,#0       // destroy frame
+       add     sp,x29,#0               // destroy frame
        ldp     x19,x20,[x29,#16]
        ldp     x21,x22,[x29,#32]
        ldp     x23,x24,[x29,#48]
        ldp     x25,x26,[x29,#64]
        ldp     x29,x30,[sp],#80
+       .inst   0xd50323bf              // autiasp
        ret
 .size  ecp_nistz256_point_add,.-ecp_nistz256_point_add
 ___
@@ -1121,6 +1145,7 @@ $code.=<<___;
 .type  ecp_nistz256_point_add_affine,%function
 .align 5
 ecp_nistz256_point_add_affine:
+       .inst   0xd503233f              // paciasp
        stp     x29,x30,[sp,#-80]!
        add     x29,sp,#0
        stp     x19,x20,[sp,#16]
@@ -1309,6 +1334,7 @@ $code.=<<___;
        ldp     x23,x24,[x29,#48]
        ldp     x25,x26,[x29,#64]
        ldp     x29,x30,[sp],#80
+       .inst   0xd50323bf              // autiasp
        ret
 .size  ecp_nistz256_point_add_affine,.-ecp_nistz256_point_add_affine
 ___

diff --git a/crypto/poly1305/asm/poly1305-armv8.pl b/crypto/poly1305/asm/poly1305-armv8.pl
index ac06457b65301a4dd8b95e8aa30f12f5b02bd389..21897fe1d7a9af3836d9dbf6ce7435422ac614bc 100755 (executable)
--- a/crypto/poly1305/asm/poly1305-armv8.pl
+++ b/crypto/poly1305/asm/poly1305-armv8.pl
@@ -291,6 +291,7 @@ poly1305_blocks_neon:
        cbz     $is_base2_26,poly1305_blocks
 
 .Lblocks_neon:
+       .inst   0xd503233f              // paciasp
        stp     x29,x30,[sp,#-80]!
        add     x29,sp,#0
 
@@ -859,6 +860,7 @@ poly1305_blocks_neon:
        st1     {$ACC4}[0],[$ctx]
 
 .Lno_data_neon:
+       .inst   0xd50323bf              // autiasp
        ldr     x29,[sp],#80
        ret
 .size  poly1305_blocks_neon,.-poly1305_blocks_neon

diff --git a/crypto/sha/asm/keccak1600-armv8.pl b/crypto/sha/asm/keccak1600-armv8.pl
index 704ab4a7e45a875b1887d04bb7f4ea66b5fe6d53..768d0361b809392381c6ba20801adba98924583d 100755 (executable)
--- a/crypto/sha/asm/keccak1600-armv8.pl
+++ b/crypto/sha/asm/keccak1600-armv8.pl
@@ -121,6 +121,7 @@ $code.=<<___;
 .align 5
 KeccakF1600_int:
        adr     $C[2],iotas
+       .inst   0xd503233f                      // paciasp
        stp     $C[2],x30,[sp,#16]              // 32 bytes on top are mine
        b       .Loop
 .align 4
@@ -292,12 +293,14 @@ $code.=<<___;
        bne     .Loop
 
        ldr     x30,[sp,#24]
+       .inst   0xd50323bf                      // autiasp
        ret
 .size  KeccakF1600_int,.-KeccakF1600_int
 
 .type  KeccakF1600,%function
 .align 5
 KeccakF1600:
+       .inst   0xd503233f                      // paciasp
        stp     x29,x30,[sp,#-128]!
        add     x29,sp,#0
        stp     x19,x20,[sp,#16]
@@ -347,6 +350,7 @@ KeccakF1600:
        ldp     x25,x26,[x29,#64]
        ldp     x27,x28,[x29,#80]
        ldp     x29,x30,[sp],#128
+       .inst   0xd50323bf                      // autiasp
        ret
 .size  KeccakF1600,.-KeccakF1600
 
@@ -354,6 +358,7 @@ KeccakF1600:
 .type  SHA3_absorb,%function
 .align 5
 SHA3_absorb:
+       .inst   0xd503233f                      // paciasp
        stp     x29,x30,[sp,#-128]!
        add     x29,sp,#0
        stp     x19,x20,[sp,#16]
@@ -451,6 +456,7 @@ $code.=<<___;
        ldp     x25,x26,[x29,#64]
        ldp     x27,x28,[x29,#80]
        ldp     x29,x30,[sp],#128
+       .inst   0xd50323bf                      // autiasp
        ret
 .size  SHA3_absorb,.-SHA3_absorb
 ___
@@ -461,6 +467,7 @@ $code.=<<___;
 .type  SHA3_squeeze,%function
 .align 5
 SHA3_squeeze:
+       .inst   0xd503233f                      // paciasp
        stp     x29,x30,[sp,#-48]!
        add     x29,sp,#0
        stp     x19,x20,[sp,#16]
@@ -523,6 +530,7 @@ SHA3_squeeze:
        ldp     x19,x20,[sp,#16]
        ldp     x21,x22,[sp,#32]
        ldp     x29,x30,[sp],#48
+       .inst   0xd50323bf                      // autiasp
        ret
 .size  SHA3_squeeze,.-SHA3_squeeze
 ___
@@ -649,6 +657,7 @@ $code.=<<___;
 .type  KeccakF1600_cext,%function
 .align 5
 KeccakF1600_cext:
+       .inst   0xd503233f              // paciasp
        stp     x29,x30,[sp,#-80]!
        add     x29,sp,#0
        stp     d8,d9,[sp,#16]          // per ABI requirement
@@ -681,6 +690,7 @@ $code.=<<___;
        ldp     d12,d13,[sp,#48]
        ldp     d14,d15,[sp,#64]
        ldr     x29,[sp],#80
+       .inst   0xd50323bf              // autiasp
        ret
 .size  KeccakF1600_cext,.-KeccakF1600_cext
 ___
@@ -693,6 +703,7 @@ $code.=<<___;
 .type  SHA3_absorb_cext,%function
 .align 5
 SHA3_absorb_cext:
+       .inst   0xd503233f              // paciasp
        stp     x29,x30,[sp,#-80]!
        add     x29,sp,#0
        stp     d8,d9,[sp,#16]          // per ABI requirement
@@ -764,6 +775,7 @@ $code.=<<___;
        ldp     d12,d13,[sp,#48]
        ldp     d14,d15,[sp,#64]
        ldp     x29,x30,[sp],#80
+       .inst   0xd50323bf              // autiasp
        ret
 .size  SHA3_absorb_cext,.-SHA3_absorb_cext
 ___
@@ -775,6 +787,7 @@ $code.=<<___;
 .type  SHA3_squeeze_cext,%function
 .align 5
 SHA3_squeeze_cext:
+       .inst   0xd503233f              // paciasp
        stp     x29,x30,[sp,#-16]!
        add     x29,sp,#0
        mov     x9,$ctx
@@ -830,6 +843,7 @@ SHA3_squeeze_cext:
 
 .Lsqueeze_done_ce:
        ldr     x29,[sp],#16
+       .inst   0xd50323bf              // autiasp
        ret
 .size  SHA3_squeeze_cext,.-SHA3_squeeze_cext
 ___

diff --git a/crypto/sha/asm/sha512-armv8.pl b/crypto/sha/asm/sha512-armv8.pl
index ac84ebb52e4f72c2acac664f37cf8635b8e61a6e..60df899f328d9c9f93a1497cf268f6312ced1221 100644 (file)
--- a/crypto/sha/asm/sha512-armv8.pl
+++ b/crypto/sha/asm/sha512-armv8.pl
@@ -219,6 +219,7 @@ $code.=<<___        if ($SZ==8);
 ___
 $code.=<<___;
 #endif
+       .inst   0xd503233f                              // paciasp
        stp     x29,x30,[sp,#-128]!
        add     x29,sp,#0
 
@@ -280,6 +281,7 @@ $code.=<<___;
        ldp     x25,x26,[x29,#64]
        ldp     x27,x28,[x29,#80]
        ldp     x29,x30,[sp],#128
+       .inst   0xd50323bf                              // autiasp
        ret
 .size  $func,.-$func