<table border="1" cellspacing="0" cellpadding="8">
    <tr>
        <th>Issue</th>
        <td>
            <a href=https://github.com/llvm/llvm-project/issues/58072>58072</a>
        </td>
    </tr>

    <tr>
        <th>Summary</th>
        <td>
            Miscompilation with ShadowCallStack + PAC-RET + -march=armv8.3a
        </td>
    </tr>

    <tr>
      <th>Labels</th>
      <td>
      </td>
    </tr>

    <tr>
      <th>Assignees</th>
      <td>
      </td>
    </tr>

    <tr>
      <th>Reporter</th>
      <td>
          pcc
      </td>
    </tr>
</table>

<pre>
    ```
> echo 'void g(void); int f(void) { g(); return 0; }' | ra/bin/clang -fsanitize=shadow-call-stack -ffixed-x18 -march=armv8.3a -mbranch-protection=pac-ret -target aarch64-linux -S -o - -x c -
        .text
        .section        .note.gnu.property,"a",@note
        .p2align        3, 0x0
        .word   4
        .word   16
        .word   5
        .asciz  "GNU"
        .word   3221225472
        .word   4
        .word   2
        .word   0
.Lsec_end0:
        .text
        .file   "-"
        .globl  f                               // -- Begin function f
        .p2align        2
        .type   f,@function
f:                                      // @f
        .cfi_startproc
// %bb.0:                               // %entry
        str     x30, [x18], #8
        .cfi_escape 0x16, 0x12, 0x02, 0x82, 0x78 // 
        pacia   x30, sp
        .cfi_negate_ra_state
        stp     x29, x30, [sp, #-16]!           // 16-byte Folded Spill
        .cfi_def_cfa_offset 16
        mov     x29, sp
        .cfi_def_cfa w29, 16
        .cfi_offset w30, -8
        .cfi_offset w29, -16
        bl      g
        mov     w0, wzr
        .cfi_def_cfa wsp, 16
        ldp     x29, x30, [sp], #16             // 16-byte Folded Reload
        .cfi_def_cfa_offset 0
        ldr     x30, [x18, #-8]!
        .cfi_restore w18
        .cfi_restore w30
        .cfi_restore w29
        retaa
.Lfunc_end0:
        .size   f, .Lfunc_end0-f
        .cfi_endproc
                                        // -- End function
        .ident  "clang version 16.0.0"
        .section        ".note.GNU-stack","",@progbits
        .addrsig
        .addrsig_sym g
```
On return an unsigned pointer is being loaded from the shadow call stack and authenticated, which will fail because it is unsigned. The compiler should at least be using AUTIASP before the SCS load instead of RETAA, but given that the signing operation here is almost completely useless since we're using a return address loaded from the SCS instead of the one loaded from the stack it would probably be better to arrange for the pointer on the SCS to be signed instead.
</pre>
<img width="1px" height="1px" alt="" src="http://email.email.llvm.org/o/eJyNVluvozgM_jX0xQJx6YU-9KHnMquV9jKannmuAhjIbpqgJJy28-vXAVpoe87MVhUJdvz5i2M7ZKo4b7xlOPzDFy_ceskrYF4r8OLVu-IFVF6cuokXr73kCbi0UI4i8FZP3ZJBrdG2WkLo5t7qhUBoeAbNvPhLxiU9c8FkBX5pmOSW_0AveTE1K9TRz5kQvrEs_5fUJT9h4Z-iFPwD03lNy5g-vKdBwkiSaSbz2m-0sphbriSpG5b75B58y3RFI3Nmy7kvuGxP4O_AV-CDf4Ic_GGv4TqweLLjmxnQaCoJOqhkG5CTBrU9e_GzF8e0kdjN5qFbMFo2MRO8cpYJqSE8haPuqHRB4_xBEi0fRItRwkzOf9CEPP7213fn935xEsdRHC_mq0fVo7PHNQPF4A_a9h5lQae2_SwyJRfYc_FvmFRCZYImJfz8RydPf_B9eMKKSyhb2YWakumDGE4c2HPjHJd90C9mvb4kwr_we-veIYzQecn3lG_a0hHng3hYFy-yLAh_DT-uR2n1-YptrKbnKQldMniLJ0pkb_HSvcRJeksBTc4apJShdOhSJ4qHFBrGdBhX6dXfBYCSnrPRk2luoSVWzOJeM7fPSboa2zgjqlkyGlmSec_QJyqObvS41WjpZ2eL8EWJAgvYNVyIW6cFlvu8ZHtVlobqcJLkB_U-ur3nOpjBsVdPa8OpB7RjT9ZPP9b2tv7EuMvO6o7CsQM5_tCfUOgDMUERxWcBu55qtPwoM-7C9Q2FYsVP4xVOnD4m0XA-fTZFt0AajVUa4RilnyiS8BMFbeyioB7K2KUzuHp7bA3G9e2-JmGyxr-rLZKNlfX_6nTaKF5lAbf17oB5QZXWd6L-KnlHbVwjiZZBSCU7bU5jOydx39Gpk_Z3zNDH3XNo6MS1yrg1kw5cFIRdPQj25nyAi_j2_vxbXu5AJqGVtFjSsTeK7k3UwA1kyIm0ywKSl1odwNYI_RUI7gqE_gpktHvWkk5anlPtFl3G1jyv4UglByXjgsBy1hoEbh30xV0AbwSZqwPVJjk1tWoFgVkQyIwlI2iNI7H9_vb7dveVBKVLAsdj97zruNE9byzSqEr49vq23TrvWWuh4u8oaSmhdbzJoYNyVyTr-nmNBEVkmDgocuZYCLQozuQUBRpDNjKnlEP6ONAXKuwaNYqwW3QfIEdswsmJlMTHOHaxo3Acuz3TkWYsI9-05wytOwKrgGn6fKgQaNed0eV0lLy6olVZvzu8xiKY4SZaLufz9Xq5SmfFJinWyZrNLLcCN39y00e8D8OR2xp23ak-06HuOl5e_ARft88-RbSbP3zazFotNrW1jXH11lVCRUBtFhA2vQjxfhncx88_lN_0yo1p0dBkkYareFZv0vmiWMbLcF6uMJ8v2GIdpnOMcZ6kRYoRmwmWoTAb6inUR2Z8E4dxTJ8TYRiFUZQGeZqzNUaLsExCVqQpFQceKN8C5zhQuprpTcchaytDSsGNNaOSmS5weMF3aaz0psnzWUd10_H8D_n2BCA">