[PAC][clang] Add new features to pauthtest ABI #113150

kovdan01 · 2024-10-21T10:43:14Z

Enable init/fini address discrimination, type info vtable pointer
discrimination and AArch64 jump table hardening as part of pauthtest ABI.

kovdan01 · 2024-10-21T10:43:23Z

This stack of pull requests is managed by Graphite. Learn more about stacking.

llvmbot · 2024-10-21T17:41:12Z

@llvm/pr-subscribers-clang

Author: Daniil Kovalev (kovdan01)

Changes

Enable init/fini address discrimination, type info vtable pointer
discrimination and AArch64 jump table hardening as part of pauthtest ABI.

Full diff: https://github.com/llvm/llvm-project/pull/113150.diff

2 Files Affected:

(modified) clang/lib/Driver/ToolChains/Clang.cpp (+14)
(modified) clang/test/Driver/aarch64-ptrauth.c (+8-3)

diff --git a/clang/lib/Driver/ToolChains/Clang.cpp b/clang/lib/Driver/ToolChains/Clang.cpp
index 94175f81d4c24e..c3ad28ac388c61 100644
--- a/clang/lib/Driver/ToolChains/Clang.cpp
+++ b/clang/lib/Driver/ToolChains/Clang.cpp
@@ -1507,6 +1507,11 @@ static void handlePAuthABI(const ArgList &DriverArgs, ArgStringList &CC1Args) {
           options::OPT_fno_ptrauth_vtable_pointer_type_discrimination))
     CC1Args.push_back("-fptrauth-vtable-pointer-type-discrimination");
 
+  if (!DriverArgs.hasArg(
+          options::OPT_fptrauth_type_info_vtable_pointer_discrimination,
+          options::OPT_fno_ptrauth_type_info_vtable_pointer_discrimination))
+    CC1Args.push_back("-fptrauth-type-info-vtable-pointer-discrimination");
+
   if (!DriverArgs.hasArg(options::OPT_fptrauth_indirect_gotos,
                          options::OPT_fno_ptrauth_indirect_gotos))
     CC1Args.push_back("-fptrauth-indirect-gotos");
@@ -1514,6 +1519,15 @@ static void handlePAuthABI(const ArgList &DriverArgs, ArgStringList &CC1Args) {
   if (!DriverArgs.hasArg(options::OPT_fptrauth_init_fini,
                          options::OPT_fno_ptrauth_init_fini))
     CC1Args.push_back("-fptrauth-init-fini");
+
+  if (!DriverArgs.hasArg(
+          options::OPT_fptrauth_init_fini_address_discrimination,
+          options::OPT_fno_ptrauth_init_fini_address_discrimination))
+    CC1Args.push_back("-fptrauth-init-fini-address-discrimination");
+
+  if (!DriverArgs.hasArg(options::OPT_faarch64_jump_table_hardening,
+                         options::OPT_fno_aarch64_jump_table_hardening))
+    CC1Args.push_back("-faarch64-jump-table-hardening");
 }
 
 static void CollectARMPACBTIOptions(const ToolChain &TC, const ArgList &Args,
diff --git a/clang/test/Driver/aarch64-ptrauth.c b/clang/test/Driver/aarch64-ptrauth.c
index d036189e614983..32acd83480849c 100644
--- a/clang/test/Driver/aarch64-ptrauth.c
+++ b/clang/test/Driver/aarch64-ptrauth.c
@@ -23,18 +23,23 @@
 // RUN: %clang -### -c --target=aarch64-linux-pauthtest %s 2>&1 | FileCheck %s --check-prefix=PAUTHABI1
 // PAUTHABI1:      "-cc1"{{.*}} "-triple" "aarch64-unknown-linux-pauthtest"
 // PAUTHABI1-SAME: "-target-abi" "pauthtest"
-// PAUTHABI1-SAME: "-fptrauth-intrinsics" "-fptrauth-calls" "-fptrauth-returns" "-fptrauth-auth-traps" "-fptrauth-vtable-pointer-address-discrimination" "-fptrauth-vtable-pointer-type-discrimination" "-fptrauth-indirect-gotos" "-fptrauth-init-fini"
+// PAUTHABI1-SAME: "-fptrauth-intrinsics" "-fptrauth-calls" "-fptrauth-returns" "-fptrauth-auth-traps" "-fptrauth-vtable-pointer-address-discrimination" "-fptrauth-vtable-pointer-type-discrimination" "-fptrauth-type-info-vtable-pointer-discrimination" "-fptrauth-indirect-gotos" "-fptrauth-init-fini" "-fptrauth-init-fini-address-discrimination" "-faarch64-jump-table-hardening"
 
 // RUN: %clang -### -c --target=aarch64 -mabi=pauthtest -fno-ptrauth-intrinsics \
 // RUN:   -fno-ptrauth-calls -fno-ptrauth-returns -fno-ptrauth-auth-traps \
 // RUN:   -fno-ptrauth-vtable-pointer-address-discrimination -fno-ptrauth-vtable-pointer-type-discrimination \
-// RUN:   -fno-ptrauth-indirect-gotos -fno-ptrauth-init-fini %s 2>&1 | FileCheck %s --check-prefix=PAUTHABI2
+// RUN:   -fno-ptrauth-type-info-vtable-pointer-discrimination -fno-ptrauth-indirect-gotos \
+// RUN:   -fno-ptrauth-init-fini -fno-ptrauth-init-fini-address-discrimination \
+// RUN:   -fno-aarch64-jump-table-hardening %s 2>&1 | FileCheck %s --check-prefix=PAUTHABI2
 // RUN: %clang -### -c --target=aarch64-pauthtest -fno-ptrauth-intrinsics \
 // RUN:   -fno-ptrauth-calls -fno-ptrauth-returns -fno-ptrauth-auth-traps \
 // RUN:   -fno-ptrauth-vtable-pointer-address-discrimination -fno-ptrauth-vtable-pointer-type-discrimination \
-// RUN:   -fno-ptrauth-indirect-gotos -fno-ptrauth-init-fini %s 2>&1 | FileCheck %s --check-prefix=PAUTHABI2
+// RUN:   -fno-ptrauth-type-info-vtable-pointer-discrimination -fno-ptrauth-indirect-gotos \
+// RUN:   -fno-ptrauth-init-fini -fno-ptrauth-init-fini-address-discrimination \
+// RUN:   -fno-aarch64-jump-table-hardening %s 2>&1 | FileCheck %s --check-prefix=PAUTHABI2
 // PAUTHABI2:     "-cc1"
 // PAUTHABI2-NOT: "-fptrauth-
+// PAUTHABI2-NOT: "-faarch64-jump-table-hardening"
 
 // RUN: not %clang -### -c --target=x86_64 -fptrauth-intrinsics -fptrauth-calls -fptrauth-returns -fptrauth-auth-traps \
 // RUN:   -fptrauth-vtable-pointer-address-discrimination -fptrauth-vtable-pointer-type-discrimination \

llvmbot · 2024-10-21T17:41:12Z

@llvm/pr-subscribers-clang-driver

Author: Daniil Kovalev (kovdan01)

Changes

Enable init/fini address discrimination, type info vtable pointer
discrimination and AArch64 jump table hardening as part of pauthtest ABI.

Full diff: https://github.com/llvm/llvm-project/pull/113150.diff

2 Files Affected:

(modified) clang/lib/Driver/ToolChains/Clang.cpp (+14)
(modified) clang/test/Driver/aarch64-ptrauth.c (+8-3)

diff --git a/clang/lib/Driver/ToolChains/Clang.cpp b/clang/lib/Driver/ToolChains/Clang.cpp
index 94175f81d4c24e..c3ad28ac388c61 100644
--- a/clang/lib/Driver/ToolChains/Clang.cpp
+++ b/clang/lib/Driver/ToolChains/Clang.cpp
@@ -1507,6 +1507,11 @@ static void handlePAuthABI(const ArgList &DriverArgs, ArgStringList &CC1Args) {
           options::OPT_fno_ptrauth_vtable_pointer_type_discrimination))
     CC1Args.push_back("-fptrauth-vtable-pointer-type-discrimination");
 
+  if (!DriverArgs.hasArg(
+          options::OPT_fptrauth_type_info_vtable_pointer_discrimination,
+          options::OPT_fno_ptrauth_type_info_vtable_pointer_discrimination))
+    CC1Args.push_back("-fptrauth-type-info-vtable-pointer-discrimination");
+
   if (!DriverArgs.hasArg(options::OPT_fptrauth_indirect_gotos,
                          options::OPT_fno_ptrauth_indirect_gotos))
     CC1Args.push_back("-fptrauth-indirect-gotos");
@@ -1514,6 +1519,15 @@ static void handlePAuthABI(const ArgList &DriverArgs, ArgStringList &CC1Args) {
   if (!DriverArgs.hasArg(options::OPT_fptrauth_init_fini,
                          options::OPT_fno_ptrauth_init_fini))
     CC1Args.push_back("-fptrauth-init-fini");
+
+  if (!DriverArgs.hasArg(
+          options::OPT_fptrauth_init_fini_address_discrimination,
+          options::OPT_fno_ptrauth_init_fini_address_discrimination))
+    CC1Args.push_back("-fptrauth-init-fini-address-discrimination");
+
+  if (!DriverArgs.hasArg(options::OPT_faarch64_jump_table_hardening,
+                         options::OPT_fno_aarch64_jump_table_hardening))
+    CC1Args.push_back("-faarch64-jump-table-hardening");
 }
 
 static void CollectARMPACBTIOptions(const ToolChain &TC, const ArgList &Args,
diff --git a/clang/test/Driver/aarch64-ptrauth.c b/clang/test/Driver/aarch64-ptrauth.c
index d036189e614983..32acd83480849c 100644
--- a/clang/test/Driver/aarch64-ptrauth.c
+++ b/clang/test/Driver/aarch64-ptrauth.c
@@ -23,18 +23,23 @@
 // RUN: %clang -### -c --target=aarch64-linux-pauthtest %s 2>&1 | FileCheck %s --check-prefix=PAUTHABI1
 // PAUTHABI1:      "-cc1"{{.*}} "-triple" "aarch64-unknown-linux-pauthtest"
 // PAUTHABI1-SAME: "-target-abi" "pauthtest"
-// PAUTHABI1-SAME: "-fptrauth-intrinsics" "-fptrauth-calls" "-fptrauth-returns" "-fptrauth-auth-traps" "-fptrauth-vtable-pointer-address-discrimination" "-fptrauth-vtable-pointer-type-discrimination" "-fptrauth-indirect-gotos" "-fptrauth-init-fini"
+// PAUTHABI1-SAME: "-fptrauth-intrinsics" "-fptrauth-calls" "-fptrauth-returns" "-fptrauth-auth-traps" "-fptrauth-vtable-pointer-address-discrimination" "-fptrauth-vtable-pointer-type-discrimination" "-fptrauth-type-info-vtable-pointer-discrimination" "-fptrauth-indirect-gotos" "-fptrauth-init-fini" "-fptrauth-init-fini-address-discrimination" "-faarch64-jump-table-hardening"
 
 // RUN: %clang -### -c --target=aarch64 -mabi=pauthtest -fno-ptrauth-intrinsics \
 // RUN:   -fno-ptrauth-calls -fno-ptrauth-returns -fno-ptrauth-auth-traps \
 // RUN:   -fno-ptrauth-vtable-pointer-address-discrimination -fno-ptrauth-vtable-pointer-type-discrimination \
-// RUN:   -fno-ptrauth-indirect-gotos -fno-ptrauth-init-fini %s 2>&1 | FileCheck %s --check-prefix=PAUTHABI2
+// RUN:   -fno-ptrauth-type-info-vtable-pointer-discrimination -fno-ptrauth-indirect-gotos \
+// RUN:   -fno-ptrauth-init-fini -fno-ptrauth-init-fini-address-discrimination \
+// RUN:   -fno-aarch64-jump-table-hardening %s 2>&1 | FileCheck %s --check-prefix=PAUTHABI2
 // RUN: %clang -### -c --target=aarch64-pauthtest -fno-ptrauth-intrinsics \
 // RUN:   -fno-ptrauth-calls -fno-ptrauth-returns -fno-ptrauth-auth-traps \
 // RUN:   -fno-ptrauth-vtable-pointer-address-discrimination -fno-ptrauth-vtable-pointer-type-discrimination \
-// RUN:   -fno-ptrauth-indirect-gotos -fno-ptrauth-init-fini %s 2>&1 | FileCheck %s --check-prefix=PAUTHABI2
+// RUN:   -fno-ptrauth-type-info-vtable-pointer-discrimination -fno-ptrauth-indirect-gotos \
+// RUN:   -fno-ptrauth-init-fini -fno-ptrauth-init-fini-address-discrimination \
+// RUN:   -fno-aarch64-jump-table-hardening %s 2>&1 | FileCheck %s --check-prefix=PAUTHABI2
 // PAUTHABI2:     "-cc1"
 // PAUTHABI2-NOT: "-fptrauth-
+// PAUTHABI2-NOT: "-faarch64-jump-table-hardening"
 
 // RUN: not %clang -### -c --target=x86_64 -fptrauth-intrinsics -fptrauth-calls -fptrauth-returns -fptrauth-auth-traps \
 // RUN:   -fptrauth-vtable-pointer-address-discrimination -fptrauth-vtable-pointer-type-discrimination \

kovdan01 · 2024-10-28T13:48:32Z

Would be glad to see everyone's feedback on the changes.

kovdan01 · 2024-11-09T16:55:36Z

Would be glad to see everyone's feedback on the changes.

kovdan01 · 2024-11-18T16:40:06Z

Would be glad to see everyone's feedback on the changes.

kovdan01 · 2024-11-26T15:09:24Z

@MaskRay Would be glad to see your feedback on the changes

Enable init/fini address discrimination, type info vtable pointer discrimination and AArch64 jump table hardening as part of pauthtest ABI.

kovdan01 · 2025-06-23T19:35:28Z

@MaskRay Would be glad to see your feedback on the changes. It would be nice if we could merge this before release.

MaskRay · 2025-06-26T03:47:34Z

Sorry, I haven't closely followed the AArch64 PAuth work. Driver options need to have some stability guarantee, while CC1 options can be more freely changed. So I'd be concerned if we commit to certain forms of driver options with known ergonomics issues. The Clang driver options should come last in the patch stack, with other patches reviewed first. If cc1 options are already available, it's not a blocker for end users to use them (experimental feature).

For driver options, I don't know whether a bunch of -fptrauth-* is a good idea. We had a similar scenario with -mbranches-within-32B-boundaries (an umbrella option): the individual options are essentially never used. Have you thought about -fptrauth-something=call,return,indirect-goto?

kovdan01 · 2025-06-26T06:06:23Z

Driver options need to have some stability guarantee, while CC1 options can be more freely changed. So I'd be concerned if we commit to certain forms of driver options with known ergonomics issues. The Clang driver options should come last in the patch stack, with other patches reviewed first. If cc1 options are already available, it's not a blocker for end users to use them (experimental feature).

@MaskRay I totally get your point, but the actual option implementation, cc1 flags and even driver flags are already available in mainline for pretty long time. The only thing this patch does is making several options (which are already implemented at all the stages) enabled as part of pauthtest ABI.

Have you thought about -fptrauth-something=call,return,indirect-goto?

We have an old issue for discussing that #97320, but it seems that there was no actual discussion. I don't mind using the approach you've suggested, but it needs to be discussed with guys from Apple since they are a big user of pauth stuff.

Given that this particular patch changes behavior only for pauthtest ABI (which is, by definition, intended to be used in test purposes), I believe it should be safe to merge that. I would be happy to discuss different approaches to implementing driver options in #97320, it just seems a bit unrelated to this particular PR.

kovdan01 · 2025-07-04T05:50:04Z

@MaskRay Could you please give a feedback (considering my latest comment above)?

kovdan01 · 2025-07-10T08:42:15Z

@MaskRay Would be glad to see your feedback considering the info from my comments above

kovdan01 · 2025-07-21T03:47:13Z

@MaskRay Would be glad to see your feedback considering the info from my comments above

This was referenced Oct 21, 2024

[PAC][Driver] Add -faarch64-jump-table-hardening flag #113149

Merged

[PAC][clang] Handle pauthtest environment and ABI in Linux-specific code #113151

Open

[PAC][Driver] Support ptrauth flags only on ARM64 Darwin or with pauthtest ABI #113152

Open

kovdan01 marked this pull request as ready for review October 21, 2024 17:40

llvmbot added clang Clang issues not falling into any other category clang:driver 'clang' and 'clang++' user-facing binaries. Not 'clang-cl' labels Oct 21, 2024

kovdan01 requested review from asl, MaskRay, kbeyls, smithp35 and jh7370 October 21, 2024 17:42

kovdan01 self-assigned this Oct 25, 2024

kovdan01 force-pushed the users/kovdan01/add-aarch64-jump-table-hardening-flag branch from 63c44ae to 270fa9e Compare November 19, 2024 17:52

kovdan01 force-pushed the users/kovdan01/pauthtest-new-features branch from 872c8b9 to c1ad05b Compare November 19, 2024 17:52

kovdan01 force-pushed the users/kovdan01/add-aarch64-jump-table-hardening-flag branch from 270fa9e to 099996b Compare November 24, 2024 21:53

kovdan01 force-pushed the users/kovdan01/pauthtest-new-features branch from c1ad05b to 7abf7b7 Compare November 24, 2024 21:54

kovdan01 force-pushed the users/kovdan01/add-aarch64-jump-table-hardening-flag branch from 099996b to c4c6657 Compare November 25, 2024 07:52

kovdan01 force-pushed the users/kovdan01/pauthtest-new-features branch from 7abf7b7 to 3de3592 Compare November 25, 2024 07:52

Base automatically changed from users/kovdan01/add-aarch64-jump-table-hardening-flag to main December 5, 2024 08:34

kovdan01 force-pushed the users/kovdan01/pauthtest-new-features branch 2 times, most recently from f670756 to 74814fd Compare December 7, 2024 21:16

kovdan01 force-pushed the users/kovdan01/pauthtest-new-features branch from 74814fd to 8384b1d Compare December 16, 2024 08:29

[PAC][clang] Add new features to pauthtest ABI

838b0d0

Enable init/fini address discrimination, type info vtable pointer discrimination and AArch64 jump table hardening as part of pauthtest ABI.

kovdan01 force-pushed the users/kovdan01/pauthtest-new-features branch from 8384b1d to 838b0d0 Compare December 17, 2024 20:29

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

[PAC][clang] Add new features to pauthtest ABI #113150

[PAC][clang] Add new features to pauthtest ABI #113150

kovdan01 commented Oct 21, 2024

Uh oh!

kovdan01 commented Oct 21, 2024 •

edited

Loading

Uh oh!

llvmbot commented Oct 21, 2024

Uh oh!

llvmbot commented Oct 21, 2024

Uh oh!

kovdan01 commented Oct 28, 2024

Uh oh!

kovdan01 commented Nov 9, 2024

Uh oh!

kovdan01 commented Nov 18, 2024

Uh oh!

kovdan01 commented Nov 26, 2024

Uh oh!

kovdan01 commented Jun 23, 2025 •

edited

Loading

Uh oh!

MaskRay commented Jun 26, 2025 •

edited

Loading

Uh oh!

kovdan01 commented Jun 26, 2025

Uh oh!

kovdan01 commented Jul 4, 2025

Uh oh!

kovdan01 commented Jul 10, 2025

Uh oh!

kovdan01 commented Jul 21, 2025

Uh oh!

Uh oh!

[PAC][clang] Add new features to pauthtest ABI #113150

Are you sure you want to change the base?

[PAC][clang] Add new features to pauthtest ABI #113150

Conversation

kovdan01 commented Oct 21, 2024

Uh oh!

kovdan01 commented Oct 21, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

llvmbot commented Oct 21, 2024

Uh oh!

llvmbot commented Oct 21, 2024

Uh oh!

kovdan01 commented Oct 28, 2024

Uh oh!

kovdan01 commented Nov 9, 2024

Uh oh!

kovdan01 commented Nov 18, 2024

Uh oh!

kovdan01 commented Nov 26, 2024

Uh oh!

kovdan01 commented Jun 23, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

MaskRay commented Jun 26, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

kovdan01 commented Jun 26, 2025

Uh oh!

kovdan01 commented Jul 4, 2025

Uh oh!

kovdan01 commented Jul 10, 2025

Uh oh!

kovdan01 commented Jul 21, 2025

Uh oh!

Uh oh!

kovdan01 commented Oct 21, 2024 •

edited

Loading

kovdan01 commented Jun 23, 2025 •

edited

Loading

MaskRay commented Jun 26, 2025 •

edited

Loading