1//===--- CGPointerAuth.cpp - IR generation for pointer authentication -----===//
2//
3// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4// See https://llvm.org/LICENSE.txt for license information.
5// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6//
7//===----------------------------------------------------------------------===//
8//
9// This file contains common routines relating to the emission of
10// pointer authentication operations.
11//
12//===----------------------------------------------------------------------===//
13
14#include "CGCXXABI.h"
15#include "CodeGenFunction.h"
16#include "CodeGenModule.h"
17#include "clang/AST/Attr.h"
18#include "clang/CodeGen/CodeGenABITypes.h"
19#include "clang/CodeGen/ConstantInitBuilder.h"
20#include "llvm/Analysis/ValueTracking.h"
21#include "llvm/Support/SipHash.h"
22
23using namespace clang;
24using namespace CodeGen;
25
26/// Given a pointer-authentication schema, return a concrete "other"
27/// discriminator for it.
28llvm::ConstantInt *CodeGenModule::getPointerAuthOtherDiscriminator(
29 const PointerAuthSchema &Schema, GlobalDecl Decl, QualType Type) {
30 switch (Schema.getOtherDiscrimination()) {
31 case PointerAuthSchema::Discrimination::None:
32 return nullptr;
33
34 case PointerAuthSchema::Discrimination::Type:
35 assert(!Type.isNull() && "type not provided for type-discriminated schema");
36 return llvm::ConstantInt::get(
37 Ty: IntPtrTy, V: getContext().getPointerAuthTypeDiscriminator(T: Type));
38
39 case PointerAuthSchema::Discrimination::Decl:
40 assert(Decl.getDecl() &&
41 "declaration not provided for decl-discriminated schema");
42 return llvm::ConstantInt::get(Ty: IntPtrTy,
43 V: getPointerAuthDeclDiscriminator(GD: Decl));
44
45 case PointerAuthSchema::Discrimination::Constant:
46 return llvm::ConstantInt::get(Ty: IntPtrTy, V: Schema.getConstantDiscrimination());
47 }
48 llvm_unreachable("bad discrimination kind");
49}
50
51uint16_t CodeGen::getPointerAuthTypeDiscriminator(CodeGenModule &CGM,
52 QualType FunctionType) {
53 return CGM.getContext().getPointerAuthTypeDiscriminator(T: FunctionType);
54}
55
56uint16_t CodeGen::getPointerAuthDeclDiscriminator(CodeGenModule &CGM,
57 GlobalDecl Declaration) {
58 return CGM.getPointerAuthDeclDiscriminator(GD: Declaration);
59}
60
61/// Return the "other" decl-specific discriminator for the given decl.
62uint16_t
63CodeGenModule::getPointerAuthDeclDiscriminator(GlobalDecl Declaration) {
64 uint16_t &EntityHash = PtrAuthDiscriminatorHashes[Declaration];
65
66 if (EntityHash == 0) {
67 const auto *ND = cast<NamedDecl>(Val: Declaration.getDecl());
68 if (ND->hasAttr<AsmLabelAttr>() &&
69 ND->getAttr<AsmLabelAttr>()->getLabel().starts_with(
70 Prefix: LLDBManglingABI::FunctionLabelPrefix)) {
71 // If the declaration comes from LLDB, the asm label has a prefix that
72 // would producing a different discriminator. Compute the real C++ mangled
73 // name instead so the discriminator matches what the original translation
74 // unit used.
75 SmallString<256> Buffer;
76 llvm::raw_svector_ostream Out(Buffer);
77 getCXXABI().getMangleContext().mangleCXXName(GD: Declaration, Out);
78 EntityHash = llvm::getPointerAuthStableSipHash(S: Out.str());
79 } else {
80 StringRef Name = getMangledName(GD: Declaration);
81 EntityHash = llvm::getPointerAuthStableSipHash(S: Name);
82 }
83 }
84
85 return EntityHash;
86}
87
88/// Return the abstract pointer authentication schema for a pointer to the given
89/// function type.
90CGPointerAuthInfo CodeGenModule::getFunctionPointerAuthInfo(QualType T) {
91 const auto &Schema = getCodeGenOpts().PointerAuth.FunctionPointers;
92 if (!Schema)
93 return CGPointerAuthInfo();
94
95 assert(!Schema.isAddressDiscriminated() &&
96 "function pointers cannot use address-specific discrimination");
97
98 llvm::Constant *Discriminator = nullptr;
99 if (T->isFunctionPointerType() || T->isFunctionReferenceType())
100 T = T->getPointeeType();
101 if (T->isFunctionType())
102 Discriminator = getPointerAuthOtherDiscriminator(Schema, Decl: GlobalDecl(), Type: T);
103
104 return CGPointerAuthInfo(Schema.getKey(), Schema.getAuthenticationMode(),
105 /*IsaPointer=*/false, /*AuthenticatesNull=*/false,
106 Discriminator);
107}
108
109llvm::Value *
110CodeGenFunction::EmitPointerAuthBlendDiscriminator(llvm::Value *StorageAddress,
111 llvm::Value *Discriminator) {
112 StorageAddress = Builder.CreatePtrToInt(V: StorageAddress, DestTy: IntPtrTy);
113 auto Intrinsic = CGM.getIntrinsic(IID: llvm::Intrinsic::ptrauth_blend);
114 return Builder.CreateCall(Callee: Intrinsic, Args: {StorageAddress, Discriminator});
115}
116
117/// Emit the concrete pointer authentication informaton for the
118/// given authentication schema.
119CGPointerAuthInfo CodeGenFunction::EmitPointerAuthInfo(
120 const PointerAuthSchema &Schema, llvm::Value *StorageAddress,
121 GlobalDecl SchemaDecl, QualType SchemaType) {
122 if (!Schema)
123 return CGPointerAuthInfo();
124
125 llvm::Value *Discriminator =
126 CGM.getPointerAuthOtherDiscriminator(Schema, Decl: SchemaDecl, Type: SchemaType);
127
128 if (Schema.isAddressDiscriminated()) {
129 assert(StorageAddress &&
130 "address not provided for address-discriminated schema");
131
132 if (Discriminator)
133 Discriminator =
134 EmitPointerAuthBlendDiscriminator(StorageAddress, Discriminator);
135 else
136 Discriminator = Builder.CreatePtrToInt(V: StorageAddress, DestTy: IntPtrTy);
137 }
138
139 return CGPointerAuthInfo(Schema.getKey(), Schema.getAuthenticationMode(),
140 Schema.isIsaPointer(),
141 Schema.authenticatesNullValues(), Discriminator);
142}
143
144CGPointerAuthInfo
145CodeGenFunction::EmitPointerAuthInfo(PointerAuthQualifier Qual,
146 Address StorageAddress) {
147 assert(Qual && "don't call this if you don't know that the Qual is present");
148 if (Qual.hasKeyNone())
149 return CGPointerAuthInfo();
150
151 llvm::Value *Discriminator = nullptr;
152 if (unsigned Extra = Qual.getExtraDiscriminator())
153 Discriminator = llvm::ConstantInt::get(Ty: IntPtrTy, V: Extra);
154
155 if (Qual.isAddressDiscriminated()) {
156 assert(StorageAddress.isValid() &&
157 "address discrimination without address");
158 llvm::Value *StoragePtr = StorageAddress.emitRawPointer(CGF&: *this);
159 if (Discriminator)
160 Discriminator =
161 EmitPointerAuthBlendDiscriminator(StorageAddress: StoragePtr, Discriminator);
162 else
163 Discriminator = Builder.CreatePtrToInt(V: StoragePtr, DestTy: IntPtrTy);
164 }
165
166 return CGPointerAuthInfo(Qual.getKey(), Qual.getAuthenticationMode(),
167 Qual.isIsaPointer(), Qual.authenticatesNullValues(),
168 Discriminator);
169}
170
171/// Return the natural pointer authentication for values of the given
172/// pointee type.
173static CGPointerAuthInfo
174getPointerAuthInfoForPointeeType(CodeGenModule &CGM, QualType PointeeType) {
175 if (PointeeType.isNull())
176 return CGPointerAuthInfo();
177
178 // Function pointers use the function-pointer schema by default.
179 if (PointeeType->isFunctionType())
180 return CGM.getFunctionPointerAuthInfo(T: PointeeType);
181
182 // Normal data pointers never use direct pointer authentication by default.
183 return CGPointerAuthInfo();
184}
185
186CGPointerAuthInfo CodeGenModule::getPointerAuthInfoForPointeeType(QualType T) {
187 return ::getPointerAuthInfoForPointeeType(CGM&: *this, PointeeType: T);
188}
189
190/// Return the natural pointer authentication for values of the given
191/// pointer type.
192static CGPointerAuthInfo getPointerAuthInfoForType(CodeGenModule &CGM,
193 QualType PointerType) {
194 assert(PointerType->isSignableType(CGM.getContext()));
195
196 // Block pointers are currently not signed.
197 if (PointerType->isBlockPointerType())
198 return CGPointerAuthInfo();
199
200 auto PointeeType = PointerType->getPointeeType();
201
202 if (PointeeType.isNull())
203 return CGPointerAuthInfo();
204
205 return ::getPointerAuthInfoForPointeeType(CGM, PointeeType);
206}
207
208CGPointerAuthInfo CodeGenModule::getPointerAuthInfoForType(QualType T) {
209 return ::getPointerAuthInfoForType(CGM&: *this, PointerType: T);
210}
211
212static std::pair<llvm::Value *, CGPointerAuthInfo>
213emitLoadOfOrigPointerRValue(CodeGenFunction &CGF, const LValue &LV,
214 SourceLocation Loc) {
215 llvm::Value *Value = CGF.EmitLoadOfScalar(lvalue: LV, Loc);
216 CGPointerAuthInfo AuthInfo;
217 if (PointerAuthQualifier PtrAuth = LV.getQuals().getPointerAuth())
218 AuthInfo = CGF.EmitPointerAuthInfo(Qual: PtrAuth, StorageAddress: LV.getAddress());
219 else
220 AuthInfo = getPointerAuthInfoForType(CGM&: CGF.CGM, PointerType: LV.getType());
221 return {Value, AuthInfo};
222}
223
224/// Retrieve a pointer rvalue and its ptrauth info. When possible, avoid
225/// needlessly resigning the pointer.
226std::pair<llvm::Value *, CGPointerAuthInfo>
227CodeGenFunction::EmitOrigPointerRValue(const Expr *E) {
228 assert(E->getType()->isSignableType(getContext()));
229
230 E = E->IgnoreParens();
231 if (const auto *Load = dyn_cast<ImplicitCastExpr>(Val: E)) {
232 if (Load->getCastKind() == CK_LValueToRValue) {
233 E = Load->getSubExpr()->IgnoreParens();
234
235 // We're semantically required to not emit loads of certain DREs naively.
236 if (const auto *RefExpr = dyn_cast<DeclRefExpr>(Val: E)) {
237 if (ConstantEmission Result = tryEmitAsConstant(RefExpr)) {
238 // Fold away a use of an intermediate variable.
239 if (!Result.isReference())
240 return {Result.getValue(),
241 getPointerAuthInfoForType(CGM, PointerType: RefExpr->getType())};
242
243 // Fold away a use of an intermediate reference.
244 LValue LV = Result.getReferenceLValue(CGF&: *this, RefExpr);
245 return emitLoadOfOrigPointerRValue(CGF&: *this, LV, Loc: RefExpr->getLocation());
246 }
247 }
248
249 // Otherwise, load and use the pointer
250 LValue LV = EmitCheckedLValue(E, TCK: CodeGenFunction::TCK_Load);
251 return emitLoadOfOrigPointerRValue(CGF&: *this, LV, Loc: E->getExprLoc());
252 }
253 }
254
255 // Fallback: just use the normal rules for the type.
256 llvm::Value *Value = EmitScalarExpr(E);
257 return {Value, getPointerAuthInfoForType(CGM, PointerType: E->getType())};
258}
259
260llvm::Value *
261CodeGenFunction::EmitPointerAuthQualify(PointerAuthQualifier DestQualifier,
262 const Expr *E,
263 Address DestStorageAddress) {
264 assert(DestQualifier);
265 auto [Value, CurAuthInfo] = EmitOrigPointerRValue(E);
266
267 CGPointerAuthInfo DestAuthInfo =
268 EmitPointerAuthInfo(Qual: DestQualifier, StorageAddress: DestStorageAddress);
269 return emitPointerAuthResign(Pointer: Value, PointerType: E->getType(), CurAuthInfo, NewAuthInfo: DestAuthInfo,
270 IsKnownNonNull: isPointerKnownNonNull(E));
271}
272
273llvm::Value *CodeGenFunction::EmitPointerAuthQualify(
274 PointerAuthQualifier DestQualifier, llvm::Value *Value,
275 QualType PointerType, Address DestStorageAddress, bool IsKnownNonNull) {
276 assert(DestQualifier);
277
278 CGPointerAuthInfo CurAuthInfo = getPointerAuthInfoForType(CGM, PointerType);
279 CGPointerAuthInfo DestAuthInfo =
280 EmitPointerAuthInfo(Qual: DestQualifier, StorageAddress: DestStorageAddress);
281 return emitPointerAuthResign(Pointer: Value, PointerType, CurAuthInfo, NewAuthInfo: DestAuthInfo,
282 IsKnownNonNull);
283}
284
285llvm::Value *CodeGenFunction::EmitPointerAuthUnqualify(
286 PointerAuthQualifier CurQualifier, llvm::Value *Value, QualType PointerType,
287 Address CurStorageAddress, bool IsKnownNonNull) {
288 assert(CurQualifier);
289
290 CGPointerAuthInfo CurAuthInfo =
291 EmitPointerAuthInfo(Qual: CurQualifier, StorageAddress: CurStorageAddress);
292 CGPointerAuthInfo DestAuthInfo = getPointerAuthInfoForType(CGM, PointerType);
293 return emitPointerAuthResign(Pointer: Value, PointerType, CurAuthInfo, NewAuthInfo: DestAuthInfo,
294 IsKnownNonNull);
295}
296
297static bool isZeroConstant(const llvm::Value *Value) {
298 if (const auto *CI = dyn_cast<llvm::ConstantInt>(Val: Value))
299 return CI->isZero();
300 return false;
301}
302
303static bool equalAuthPolicies(const CGPointerAuthInfo &Left,
304 const CGPointerAuthInfo &Right) {
305 assert((Left.isSigned() || Right.isSigned()) &&
306 "shouldn't be called if neither is signed");
307 if (Left.isSigned() != Right.isSigned())
308 return false;
309 return Left.getKey() == Right.getKey() &&
310 Left.getAuthenticationMode() == Right.getAuthenticationMode() &&
311 Left.isIsaPointer() == Right.isIsaPointer() &&
312 Left.authenticatesNullValues() == Right.authenticatesNullValues() &&
313 Left.getDiscriminator() == Right.getDiscriminator();
314}
315
316// Return the discriminator or return zero if the discriminator is null.
317static llvm::Value *getDiscriminatorOrZero(const CGPointerAuthInfo &Info,
318 CGBuilderTy &Builder) {
319 llvm::Value *Discriminator = Info.getDiscriminator();
320 return Discriminator ? Discriminator : Builder.getSize(N: 0);
321}
322
323llvm::Value *
324CodeGenFunction::emitPointerAuthResignCall(llvm::Value *Value,
325 const CGPointerAuthInfo &CurAuth,
326 const CGPointerAuthInfo &NewAuth) {
327 assert(CurAuth && NewAuth);
328
329 if (CurAuth.getAuthenticationMode() !=
330 PointerAuthenticationMode::SignAndAuth ||
331 NewAuth.getAuthenticationMode() !=
332 PointerAuthenticationMode::SignAndAuth) {
333 llvm::Value *AuthedValue = EmitPointerAuthAuth(Info: CurAuth, Pointer: Value);
334 return EmitPointerAuthSign(Info: NewAuth, Pointer: AuthedValue);
335 }
336 // Convert the pointer to intptr_t before signing it.
337 auto *OrigType = Value->getType();
338 Value = Builder.CreatePtrToInt(V: Value, DestTy: IntPtrTy);
339
340 auto *CurKey = Builder.getInt32(C: CurAuth.getKey());
341 auto *NewKey = Builder.getInt32(C: NewAuth.getKey());
342
343 llvm::Value *CurDiscriminator = getDiscriminatorOrZero(Info: CurAuth, Builder);
344 llvm::Value *NewDiscriminator = getDiscriminatorOrZero(Info: NewAuth, Builder);
345
346 // call i64 @llvm.ptrauth.resign(i64 %pointer,
347 // i32 %curKey, i64 %curDiscriminator,
348 // i32 %newKey, i64 %newDiscriminator)
349 auto *Intrinsic = CGM.getIntrinsic(IID: llvm::Intrinsic::ptrauth_resign);
350 Value = EmitRuntimeCall(
351 callee: Intrinsic, args: {Value, CurKey, CurDiscriminator, NewKey, NewDiscriminator});
352
353 // Convert back to the original type.
354 Value = Builder.CreateIntToPtr(V: Value, DestTy: OrigType);
355 return Value;
356}
357
358llvm::Value *CodeGenFunction::emitPointerAuthResign(
359 llvm::Value *Value, QualType Type, const CGPointerAuthInfo &CurAuthInfo,
360 const CGPointerAuthInfo &NewAuthInfo, bool IsKnownNonNull) {
361 // Fast path: if neither schema wants a signature, we're done.
362 if (!CurAuthInfo && !NewAuthInfo)
363 return Value;
364
365 llvm::Value *Null = nullptr;
366 // If the value is obviously null, we're done.
367 if (auto *PointerValue = dyn_cast<llvm::PointerType>(Val: Value->getType())) {
368 Null = CGM.getNullPointer(T: PointerValue, QT: Type);
369 } else {
370 assert(Value->getType()->isIntegerTy());
371 Null = llvm::ConstantInt::get(Ty: IntPtrTy, V: 0);
372 }
373 if (Value == Null)
374 return Value;
375
376 // If both schemas sign the same way, we're done.
377 if (equalAuthPolicies(Left: CurAuthInfo, Right: NewAuthInfo)) {
378 const llvm::Value *CurD = CurAuthInfo.getDiscriminator();
379 const llvm::Value *NewD = NewAuthInfo.getDiscriminator();
380 if (CurD == NewD)
381 return Value;
382
383 if ((CurD == nullptr && isZeroConstant(Value: NewD)) ||
384 (NewD == nullptr && isZeroConstant(Value: CurD)))
385 return Value;
386 }
387
388 llvm::BasicBlock *InitBB = Builder.GetInsertBlock();
389 llvm::BasicBlock *ResignBB = nullptr, *ContBB = nullptr;
390
391 // Null pointers have to be mapped to null, and the ptrauth_resign
392 // intrinsic doesn't do that.
393 if (!IsKnownNonNull && !llvm::isKnownNonZero(V: Value, Q: CGM.getDataLayout())) {
394 ContBB = createBasicBlock(name: "resign.cont");
395 ResignBB = createBasicBlock(name: "resign.nonnull");
396
397 auto *IsNonNull = Builder.CreateICmpNE(LHS: Value, RHS: Null);
398 Builder.CreateCondBr(Cond: IsNonNull, True: ResignBB, False: ContBB);
399 EmitBlock(BB: ResignBB);
400 }
401
402 // Perform the auth/sign/resign operation.
403 if (!NewAuthInfo)
404 Value = EmitPointerAuthAuth(Info: CurAuthInfo, Pointer: Value);
405 else if (!CurAuthInfo)
406 Value = EmitPointerAuthSign(Info: NewAuthInfo, Pointer: Value);
407 else
408 Value = emitPointerAuthResignCall(Value, CurAuth: CurAuthInfo, NewAuth: NewAuthInfo);
409
410 // Clean up with a phi if we branched before.
411 if (ContBB) {
412 EmitBlock(BB: ContBB);
413 auto *Phi = Builder.CreatePHI(Ty: Value->getType(), NumReservedValues: 2);
414 Phi->addIncoming(V: Null, BB: InitBB);
415 Phi->addIncoming(V: Value, BB: ResignBB);
416 Value = Phi;
417 }
418
419 return Value;
420}
421
422void CodeGenFunction::EmitPointerAuthCopy(PointerAuthQualifier Qual, QualType T,
423 Address DestAddress,
424 Address SrcAddress) {
425 assert(Qual);
426 llvm::Value *Value = Builder.CreateLoad(Addr: SrcAddress);
427
428 // If we're using address-discrimination, we have to re-sign the value.
429 if (Qual.isAddressDiscriminated()) {
430 CGPointerAuthInfo SrcPtrAuth = EmitPointerAuthInfo(Qual, StorageAddress: SrcAddress);
431 CGPointerAuthInfo DestPtrAuth = EmitPointerAuthInfo(Qual, StorageAddress: DestAddress);
432 Value = emitPointerAuthResign(Value, Type: T, CurAuthInfo: SrcPtrAuth, NewAuthInfo: DestPtrAuth,
433 /*IsKnownNonNull=*/false);
434 }
435
436 Builder.CreateStore(Val: Value, Addr: DestAddress);
437}
438
439llvm::Constant *
440CodeGenModule::getConstantSignedPointer(llvm::Constant *Pointer, unsigned Key,
441 llvm::Constant *StorageAddress,
442 llvm::ConstantInt *OtherDiscriminator) {
443 llvm::Constant *AddressDiscriminator;
444 if (StorageAddress) {
445 assert(StorageAddress->getType() == DefaultPtrTy);
446 AddressDiscriminator = StorageAddress;
447 } else {
448 AddressDiscriminator = llvm::Constant::getNullValue(Ty: DefaultPtrTy);
449 }
450
451 llvm::ConstantInt *IntegerDiscriminator;
452 if (OtherDiscriminator) {
453 assert(OtherDiscriminator->getType() == Int64Ty);
454 IntegerDiscriminator = OtherDiscriminator;
455 } else {
456 IntegerDiscriminator = llvm::ConstantInt::get(Ty: Int64Ty, V: 0);
457 }
458
459 return llvm::ConstantPtrAuth::get(
460 Ptr: Pointer, Key: llvm::ConstantInt::get(Ty: Int32Ty, V: Key), Disc: IntegerDiscriminator,
461 AddrDisc: AddressDiscriminator,
462 /*DeactivationSymbol=*/llvm::Constant::getNullValue(Ty: DefaultPtrTy));
463}
464
465/// Does a given PointerAuthScheme require us to sign a value
466bool CodeGenModule::shouldSignPointer(const PointerAuthSchema &Schema) {
467 auto AuthenticationMode = Schema.getAuthenticationMode();
468 return AuthenticationMode == PointerAuthenticationMode::SignAndStrip ||
469 AuthenticationMode == PointerAuthenticationMode::SignAndAuth;
470}
471
472/// Sign a constant pointer using the given scheme, producing a constant
473/// with the same IR type.
474llvm::Constant *CodeGenModule::getConstantSignedPointer(
475 llvm::Constant *Pointer, const PointerAuthSchema &Schema,
476 llvm::Constant *StorageAddress, GlobalDecl SchemaDecl,
477 QualType SchemaType) {
478 assert(shouldSignPointer(Schema));
479 llvm::ConstantInt *OtherDiscriminator =
480 getPointerAuthOtherDiscriminator(Schema, Decl: SchemaDecl, Type: SchemaType);
481
482 return getConstantSignedPointer(Pointer, Key: Schema.getKey(), StorageAddress,
483 OtherDiscriminator);
484}
485
486llvm::Constant *
487CodeGen::getConstantSignedPointer(CodeGenModule &CGM, llvm::Constant *Pointer,
488 unsigned Key, llvm::Constant *StorageAddress,
489 llvm::ConstantInt *OtherDiscriminator) {
490 return CGM.getConstantSignedPointer(Pointer, Key, StorageAddress,
491 OtherDiscriminator);
492}
493
494/// If applicable, sign a given constant function pointer with the ABI rules for
495/// functionType.
496llvm::Constant *CodeGenModule::getFunctionPointer(llvm::Constant *Pointer,
497 QualType FunctionType) {
498 assert(FunctionType->isFunctionType() ||
499 FunctionType->isFunctionReferenceType() ||
500 FunctionType->isFunctionPointerType());
501
502 if (auto PointerAuth = getFunctionPointerAuthInfo(T: FunctionType))
503 return getConstantSignedPointer(
504 Pointer, Key: PointerAuth.getKey(), /*StorageAddress=*/nullptr,
505 OtherDiscriminator: cast_or_null<llvm::ConstantInt>(Val: PointerAuth.getDiscriminator()));
506
507 return Pointer;
508}
509
510llvm::Constant *CodeGenModule::getFunctionPointer(GlobalDecl GD,
511 llvm::Type *Ty) {
512 const auto *FD = cast<FunctionDecl>(Val: GD.getDecl());
513 QualType FuncType = FD->getType();
514
515 // Annoyingly, K&R functions have prototypes in the clang AST, but
516 // expressions referring to them are unprototyped.
517 if (!FD->hasPrototype())
518 if (const auto *Proto = FuncType->getAs<FunctionProtoType>())
519 FuncType = Context.getFunctionNoProtoType(ResultTy: Proto->getReturnType(),
520 Info: Proto->getExtInfo());
521
522 return getFunctionPointer(Pointer: getRawFunctionPointer(GD, Ty), FunctionType: FuncType);
523}
524
525CGPointerAuthInfo CodeGenModule::getMemberFunctionPointerAuthInfo(QualType FT) {
526 assert(FT->getAs<MemberPointerType>() && "MemberPointerType expected");
527 const auto &Schema = getCodeGenOpts().PointerAuth.CXXMemberFunctionPointers;
528 if (!Schema)
529 return CGPointerAuthInfo();
530
531 assert(!Schema.isAddressDiscriminated() &&
532 "function pointers cannot use address-specific discrimination");
533
534 llvm::ConstantInt *Discriminator =
535 getPointerAuthOtherDiscriminator(Schema, Decl: GlobalDecl(), Type: FT);
536 return CGPointerAuthInfo(Schema.getKey(), Schema.getAuthenticationMode(),
537 /* IsIsaPointer */ false,
538 /* AuthenticatesNullValues */ false, Discriminator);
539}
540
541llvm::Constant *CodeGenModule::getMemberFunctionPointer(llvm::Constant *Pointer,
542 QualType FT) {
543 if (CGPointerAuthInfo PointerAuth = getMemberFunctionPointerAuthInfo(FT))
544 return getConstantSignedPointer(
545 Pointer, Key: PointerAuth.getKey(), StorageAddress: nullptr,
546 OtherDiscriminator: cast_or_null<llvm::ConstantInt>(Val: PointerAuth.getDiscriminator()));
547
548 if (const auto *MFT = dyn_cast<MemberPointerType>(Val: FT.getTypePtr())) {
549 if (MFT->hasPointeeToCFIUncheckedCalleeFunctionType())
550 Pointer = llvm::NoCFIValue::get(GV: cast<llvm::GlobalValue>(Val: Pointer));
551 }
552
553 return Pointer;
554}
555
556llvm::Constant *CodeGenModule::getMemberFunctionPointer(const FunctionDecl *FD,
557 llvm::Type *Ty) {
558 QualType FT = FD->getType();
559 FT = getContext().getMemberPointerType(T: FT, /*Qualifier=*/std::nullopt,
560 Cls: cast<CXXMethodDecl>(Val: FD)->getParent());
561 return getMemberFunctionPointer(Pointer: getRawFunctionPointer(GD: FD, Ty), FT);
562}
563
564std::optional<PointerAuthQualifier>
565CodeGenModule::computeVTPointerAuthentication(const CXXRecordDecl *ThisClass,
566 bool IsVTTEntry) {
567 auto DefaultAuthentication =
568 IsVTTEntry ? getCodeGenOpts().PointerAuth.CXXVTTVTablePointers
569 : getCodeGenOpts().PointerAuth.CXXVTablePointers;
570 if (!DefaultAuthentication)
571 return std::nullopt;
572 const CXXRecordDecl *PrimaryBase =
573 Context.baseForVTableAuthentication(ThisClass);
574 const CXXRecordDecl *TypeDiscriminatorClass =
575 IsVTTEntry ? ThisClass : PrimaryBase;
576
577 unsigned Key = DefaultAuthentication.getKey();
578 bool AddressDiscriminated = DefaultAuthentication.isAddressDiscriminated();
579 auto DefaultDiscrimination = DefaultAuthentication.getOtherDiscrimination();
580 unsigned TypeBasedDiscriminator =
581 Context.getPointerAuthVTablePointerDiscriminator(RD: TypeDiscriminatorClass,
582 IsVTTEntry);
583 unsigned Discriminator;
584 if (DefaultDiscrimination == PointerAuthSchema::Discrimination::Type) {
585 Discriminator = TypeBasedDiscriminator;
586 } else if (DefaultDiscrimination ==
587 PointerAuthSchema::Discrimination::Constant) {
588 Discriminator = DefaultAuthentication.getConstantDiscrimination();
589 } else {
590 assert(DefaultDiscrimination == PointerAuthSchema::Discrimination::None);
591 Discriminator = 0;
592 }
593 auto ExplicitAuthentication =
594 PrimaryBase->getAttr<VTablePointerAuthenticationAttr>();
595
596 // TODO: enable explicit authentication path for VTT vtable entries.
597 if (!IsVTTEntry && ExplicitAuthentication) {
598 auto ExplicitAddressDiscrimination =
599 ExplicitAuthentication->getAddressDiscrimination();
600 auto ExplicitDiscriminator =
601 ExplicitAuthentication->getExtraDiscrimination();
602
603 unsigned ExplicitKey = ExplicitAuthentication->getKey();
604 if (ExplicitKey == VTablePointerAuthenticationAttr::NoKey)
605 return std::nullopt;
606
607 if (ExplicitKey != VTablePointerAuthenticationAttr::DefaultKey) {
608 if (ExplicitKey == VTablePointerAuthenticationAttr::ProcessIndependent)
609 Key = (unsigned)PointerAuthSchema::ARM8_3Key::ASDA;
610 else {
611 assert(ExplicitKey ==
612 VTablePointerAuthenticationAttr::ProcessDependent);
613 Key = (unsigned)PointerAuthSchema::ARM8_3Key::ASDB;
614 }
615 }
616
617 if (ExplicitAddressDiscrimination !=
618 VTablePointerAuthenticationAttr::DefaultAddressDiscrimination)
619 AddressDiscriminated =
620 ExplicitAddressDiscrimination ==
621 VTablePointerAuthenticationAttr::AddressDiscrimination;
622
623 if (ExplicitDiscriminator ==
624 VTablePointerAuthenticationAttr::TypeDiscrimination)
625 Discriminator = TypeBasedDiscriminator;
626 else if (ExplicitDiscriminator ==
627 VTablePointerAuthenticationAttr::CustomDiscrimination)
628 Discriminator = ExplicitAuthentication->getCustomDiscriminationValue();
629 else if (ExplicitDiscriminator ==
630 VTablePointerAuthenticationAttr::NoExtraDiscrimination)
631 Discriminator = 0;
632 }
633 return PointerAuthQualifier::Create(Key, IsAddressDiscriminated: AddressDiscriminated, ExtraDiscriminator: Discriminator,
634 AuthenticationMode: PointerAuthenticationMode::SignAndAuth,
635 /* IsIsaPointer */ false,
636 /* AuthenticatesNullValues */ false);
637}
638
639std::optional<PointerAuthQualifier>
640CodeGenModule::getVTablePointerAuthentication(const CXXRecordDecl *Record,
641 bool IsVTTEntry) {
642 if (!Record->getDefinition() || !Record->isPolymorphic())
643 return std::nullopt;
644
645 if (IsVTTEntry)
646 return computeVTPointerAuthentication(ThisClass: Record, IsVTTEntry);
647
648 auto Existing = VTablePtrAuthInfos.find(Val: Record);
649 if (Existing != VTablePtrAuthInfos.end())
650 return Existing->getSecond();
651
652 std::optional<PointerAuthQualifier> Authentication =
653 computeVTPointerAuthentication(ThisClass: Record, IsVTTEntry);
654 VTablePtrAuthInfos.insert(KV: std::make_pair(x&: Record, y&: Authentication));
655 return Authentication;
656}
657
658std::optional<CGPointerAuthInfo> CodeGenModule::getVTablePointerAuthInfo(
659 CodeGenFunction *CGF, const CXXRecordDecl *Record,
660 llvm::Value *StorageAddress, bool IsVTTEntry) {
661 auto Authentication = getVTablePointerAuthentication(Record, IsVTTEntry);
662 if (!Authentication)
663 return std::nullopt;
664
665 llvm::Value *Discriminator = nullptr;
666 if (auto ExtraDiscriminator = Authentication->getExtraDiscriminator())
667 Discriminator = llvm::ConstantInt::get(Ty: IntPtrTy, V: ExtraDiscriminator);
668
669 if (Authentication->isAddressDiscriminated()) {
670 assert(StorageAddress &&
671 "address not provided for address-discriminated schema");
672 if (Discriminator)
673 Discriminator =
674 CGF->EmitPointerAuthBlendDiscriminator(StorageAddress, Discriminator);
675 else
676 Discriminator = CGF->Builder.CreatePtrToInt(V: StorageAddress, DestTy: IntPtrTy);
677 }
678
679 return CGPointerAuthInfo(Authentication->getKey(),
680 PointerAuthenticationMode::SignAndAuth,
681 /* IsIsaPointer */ false,
682 /* AuthenticatesNullValues */ false, Discriminator);
683}
684
685llvm::Value *CodeGenFunction::authPointerToPointerCast(llvm::Value *ResultPtr,
686 QualType SourceType,
687 QualType DestType) {
688 CGPointerAuthInfo CurAuthInfo, NewAuthInfo;
689 if (SourceType->isSignableType(Ctx: getContext()))
690 CurAuthInfo = getPointerAuthInfoForType(CGM, PointerType: SourceType);
691
692 if (DestType->isSignableType(Ctx: getContext()))
693 NewAuthInfo = getPointerAuthInfoForType(CGM, PointerType: DestType);
694
695 if (!CurAuthInfo && !NewAuthInfo)
696 return ResultPtr;
697
698 // If only one side of the cast is a function pointer, then we still need to
699 // resign to handle casts to/from opaque pointers.
700 if (!CurAuthInfo && DestType->isFunctionPointerType())
701 CurAuthInfo = CGM.getFunctionPointerAuthInfo(T: SourceType);
702
703 if (!NewAuthInfo && SourceType->isFunctionPointerType())
704 NewAuthInfo = CGM.getFunctionPointerAuthInfo(T: DestType);
705
706 return emitPointerAuthResign(Value: ResultPtr, Type: DestType, CurAuthInfo, NewAuthInfo,
707 /*IsKnownNonNull=*/false);
708}
709
710Address CodeGenFunction::authPointerToPointerCast(Address Ptr,
711 QualType SourceType,
712 QualType DestType) {
713 CGPointerAuthInfo CurAuthInfo, NewAuthInfo;
714 if (SourceType->isSignableType(Ctx: getContext()))
715 CurAuthInfo = getPointerAuthInfoForType(CGM, PointerType: SourceType);
716
717 if (DestType->isSignableType(Ctx: getContext()))
718 NewAuthInfo = getPointerAuthInfoForType(CGM, PointerType: DestType);
719
720 if (!CurAuthInfo && !NewAuthInfo)
721 return Ptr;
722
723 if (!CurAuthInfo && DestType->isFunctionPointerType()) {
724 // When casting a non-signed pointer to a function pointer, just set the
725 // auth info on Ptr to the assumed schema. The pointer will be resigned to
726 // the effective type when used.
727 Ptr.setPointerAuthInfo(CGM.getFunctionPointerAuthInfo(T: SourceType));
728 return Ptr;
729 }
730
731 if (!NewAuthInfo && SourceType->isFunctionPointerType()) {
732 NewAuthInfo = CGM.getFunctionPointerAuthInfo(T: DestType);
733 Ptr = Ptr.getResignedAddress(NewInfo: NewAuthInfo, CGF&: *this);
734 Ptr.setPointerAuthInfo(CGPointerAuthInfo());
735 return Ptr;
736 }
737
738 return Ptr;
739}
740
741Address CodeGenFunction::getAsNaturalAddressOf(Address Addr,
742 QualType PointeeTy) {
743 CGPointerAuthInfo Info =
744 PointeeTy.isNull() ? CGPointerAuthInfo()
745 : CGM.getPointerAuthInfoForPointeeType(T: PointeeTy);
746 return Addr.getResignedAddress(NewInfo: Info, CGF&: *this);
747}
748
749Address Address::getResignedAddress(const CGPointerAuthInfo &NewInfo,
750 CodeGenFunction &CGF) const {
751 assert(isValid() && "pointer isn't valid");
752 CGPointerAuthInfo CurInfo = getPointerAuthInfo();
753 llvm::Value *Val;
754
755 // Nothing to do if neither the current or the new ptrauth info needs signing.
756 if (!CurInfo.isSigned() && !NewInfo.isSigned())
757 return Address(getBasePointer(), getElementType(), getAlignment(),
758 isKnownNonNull());
759
760 assert(ElementType && "Effective type has to be set");
761 assert(!Offset && "unexpected non-null offset");
762
763 // If the current and the new ptrauth infos are the same and the offset is
764 // null, just cast the base pointer to the effective type.
765 if (CurInfo == NewInfo && !hasOffset())
766 Val = getBasePointer();
767 else
768 Val = CGF.emitPointerAuthResign(Value: getBasePointer(), Type: QualType(), CurAuthInfo: CurInfo,
769 NewAuthInfo: NewInfo, IsKnownNonNull: isKnownNonNull());
770
771 return Address(Val, getElementType(), getAlignment(), NewInfo,
772 /*Offset=*/nullptr, isKnownNonNull());
773}
774
775llvm::Value *Address::emitRawPointerSlow(CodeGenFunction &CGF) const {
776 return CGF.getAsNaturalPointerTo(Addr: *this, PointeeType: QualType());
777}
778
779llvm::Value *LValue::getPointer(CodeGenFunction &CGF) const {
780 assert(isSimple());
781 return emitResignedPointer(PointeeTy: getType(), CGF);
782}
783
784llvm::Value *LValue::emitResignedPointer(QualType PointeeTy,
785 CodeGenFunction &CGF) const {
786 assert(isSimple());
787 return CGF.getAsNaturalAddressOf(Addr: Addr, PointeeTy).getBasePointer();
788}
789
790llvm::Value *LValue::emitRawPointer(CodeGenFunction &CGF) const {
791 assert(isSimple());
792 return Addr.isValid() ? Addr.emitRawPointer(CGF) : nullptr;
793}
794