Fix the description, add a test case

Author: atrosinenko

bolt/include/bolt/Core/MCPlusBuilder.h

@@ -640,12 +640,19 @@ class MCPlusBuilder {
   /// it may be important for the compiler to check the address explicitly not
   /// to introduce a signing or authentication oracle.
   ///
-  /// If this function returns a (Reg, Inst) pair and before execution of Inst
+  /// This function is intended to detect a complex, multi-instruction pointer-
+  /// checking sequence spanning a contiguous range of instructions at the end
+  /// of the basic block (as these sequences are expected to end with a
+  /// conditional branch - this is how they are implemented on AArch64 by LLVM).
+  /// If a (Reg, FirstInst) pair is returned and before execution of FirstInst
   /// Reg was last written to by an authentication instruction, then it is known
   /// that in any successor of BB either
   /// * the authentication instruction that last wrote to Reg succeeded, or
   /// * the program is terminated abnormally without introducing any signing
   ///   or authentication oracles
+  ///
+  /// Note that this function is not expected to repeat the results returned
+  /// by getAuthCheckedReg(Inst, MayOverwrite) function below.
   virtual std::optional<std::pair<MCPhysReg, MCInst *>>
   getAuthCheckedReg(BinaryBasicBlock &BB) const {
     llvm_unreachable("not implemented");
@@ -660,6 +667,9 @@ class MCPlusBuilder {
   ///
   /// Additionally, if MayOverwrite is false, it is known that the authenticated
   /// pointer is not clobbered by Inst itself.
+  ///
+  /// Use this function for simple, single-instruction patterns instead of
+  /// its getAuthCheckedReg(BB) counterpart.
   virtual MCPhysReg getAuthCheckedReg(const MCInst &Inst,
                                       bool MayOverwrite) const {
     llvm_unreachable("not implemented");

bolt/test/binary-analysis/AArch64/gs-pauth-address-checks.s

@@ -629,6 +629,33 @@ resign_load_unscaled_good:
         ret
         .size resign_load_unscaled_good, .-resign_load_unscaled_good
 
+// Any basic block can check at most one register using a multi-instruction
+// pointer-checking sequence, but it can contain an arbitrary number of single-
+// instruction pointer checks.
+
+        .globl  many_checked_regs
+        .type   many_checked_regs,@function
+many_checked_regs:
+// CHECK-NOT: many_checked_regs
+        autdzb  x0
+        autdzb  x1
+        autdzb  x2
+        b       1f
+1:
+        ldr     w3, [x0]  // single-instruction check
+        ldr     w3, [x1]  // single-instruction check
+        mov     x16, x2   // start of multi-instruction checker sequence
+        xpacd   x16       // ...
+        cmp     x2, x16   // ...
+        b.eq    2f        // end of basic block
+        brk     0x1234
+2:
+        pacdza  x0
+        pacdza  x1
+        pacdza  x2
+        ret
+        .size many_checked_regs, .-many_checked_regs
+
         .globl  main
         .type   main,@function
 main: