CodeGen: Optionally emit PAuth relocations as IRELATIVE relocations.

[pcc]

This supports the following use cases:

• ConstantPtrAuth expressions that are unrepresentable using standard PAuth
  relocations such as expressions involving an integer operand or
  deactivation symbols.
• libc implementations that do not support PAuth relocations.

For more information see the RFC:
https://discourse.llvm.org/t/rfc-structure-protection-a-family-of-uaf-mitigation-techniques/85555

[llvmbot]

@llvm/pr-subscribers-backend-aarch64

Author: Peter Collingbourne (pcc)

Changes

This supports the following use cases:

• ConstantPtrAuth expressions that are unrepresentable using standard PAuth
  relocations such as expressions involving an integer operand or
  deactivation symbols.
• libc implementations that do not support PAuth relocations.

For more information see the RFC:
https://discourse.llvm.org/t/rfc-structure-protection-a-family-of-uaf-mitigation-techniques/85555

TODO:

• Add tests.

---

Full diff: https://github.com/llvm/llvm-project/pull/133533.diff

1 Files Affected:

• (modified) llvm/lib/Target/AArch64/AArch64AsmPrinter.cpp (+163-15)

diff --git a/llvm/lib/Target/AArch64/AArch64AsmPrinter.cpp b/llvm/lib/Target/AArch64/AArch64AsmPrinter.cpp
index 8f26e9b791dff..cbff94f4dc227 100644
--- a/llvm/lib/Target/AArch64/AArch64AsmPrinter.cpp
+++ b/llvm/lib/Target/AArch64/AArch64AsmPrinter.cpp
@@ -54,6 +54,7 @@
 #include "llvm/MC/MCSectionMachO.h"
 #include "llvm/MC/MCStreamer.h"
 #include "llvm/MC/MCSymbol.h"
+#include "llvm/MC/MCValue.h"
 #include "llvm/MC/TargetRegistry.h"
 #include "llvm/Support/Casting.h"
 #include "llvm/Support/CommandLine.h"
@@ -84,6 +85,7 @@ class AArch64AsmPrinter : public AsmPrinter {
   bool EnableImportCallOptimization = false;
   DenseMap<MCSection *, std::vector<std::pair<MCSymbol *, MCSymbol *>>>
       SectionToImportedFunctionCalls;
+  unsigned PAuthIFuncNextUniqueID = 1;
 
 public:
   AArch64AsmPrinter(TargetMachine &TM, std::unique_ptr<MCStreamer> Streamer)
@@ -191,6 +193,10 @@ class AArch64AsmPrinter : public AsmPrinter {
   // authenticating)
   void LowerLOADgotAUTH(const MachineInstr &MI);
 
+  const MCExpr *emitPAuthRelocationAsIRelative(
+      const MCExpr *Target, uint16_t Disc, AArch64PACKey::ID KeyID,
+      bool HasAddressDiversity, bool IsDSOLocal);
+
   /// tblgen'erated driver function for lowering simple MI->MC
   /// pseudo instructions.
   bool lowerPseudoInstExpansion(const MachineInstr *MI, MCInst &Inst);
@@ -2218,6 +2224,145 @@ void AArch64AsmPrinter::emitPtrauthBranch(const MachineInstr *MI) {
   EmitToStreamer(*OutStreamer, BRInst);
 }
 
+static void emitAddress(MCStreamer &Streamer, MCRegister Reg,
+                        const MCExpr *Expr, bool DSOLocal,
+                        const MCSubtargetInfo &STI) {
+  MCValue Val;
+  if (!Expr->evaluateAsRelocatable(Val, nullptr))
+    report_fatal_error("emitAddress could not evaluate");
+  if (DSOLocal) {
+    Streamer.emitInstruction(
+        MCInstBuilder(AArch64::ADRP)
+            .addReg(Reg)
+            .addExpr(AArch64MCExpr::create(Expr, AArch64MCExpr::VK_ABS_PAGE,
+                                           Streamer.getContext())),
+        STI);
+    Streamer.emitInstruction(
+        MCInstBuilder(AArch64::ADDXri)
+            .addReg(Reg)
+            .addReg(Reg)
+            .addExpr(AArch64MCExpr::create(Expr, AArch64MCExpr::VK_LO12,
+                                           Streamer.getContext()))
+            .addImm(0),
+        STI);
+  } else {
+    Streamer.emitInstruction(MCInstBuilder(AArch64::ADRP)
+                                 .addReg(Reg)
+                                 .addExpr(AArch64MCExpr::create(
+                                     Val.getSymA(), AArch64MCExpr::VK_GOT_PAGE,
+                                     Streamer.getContext())),
+                             STI);
+    Streamer.emitInstruction(MCInstBuilder(AArch64::LDRXui)
+                                 .addReg(Reg)
+                                 .addReg(Reg)
+                                 .addExpr(AArch64MCExpr::create(
+                                     Val.getSymA(), AArch64MCExpr::VK_GOT_LO12,
+                                     Streamer.getContext())),
+                             STI);
+    if (Val.getConstant())
+      Streamer.emitInstruction(MCInstBuilder(AArch64::ADDXri)
+                                   .addReg(Reg)
+                                   .addReg(Reg)
+                                   .addImm(Val.getConstant())
+                                   .addImm(0),
+                               STI);
+  }
+}
+
+static bool targetSupportsPAuthRelocation(const Triple &TT,
+                                          const MCExpr *Target) {
+  // No released version of glibc supports PAuth relocations.
+  if (TT.isOSGlibc())
+    return false;
+
+  // We emit PAuth constants as IRELATIVE relocations in cases where the
+  // constant cannot be represented as a PAuth relocation:
+  // 1) The signed value is not a symbol.
+  return !isa<MCConstantExpr>(Target);
+}
+
+static bool targetSupportsIRelativeRelocation(const Triple &TT) {
+  // IFUNCs are ELF-only.
+  if (!TT.isOSBinFormatELF())
+    return false;
+
+  // musl doesn't support IFUNCs.
+  if (TT.isMusl())
+    return false;
+
+  return true;
+}
+
+const MCExpr *AArch64AsmPrinter::emitPAuthRelocationAsIRelative(
+    const MCExpr *Target, uint16_t Disc, AArch64PACKey::ID KeyID,
+    bool HasAddressDiversity, bool IsDSOLocal) {
+  const Triple &TT = TM.getTargetTriple();
+
+  // We only emit an IRELATIVE relocation if the target supports IRELATIVE and
+  // does not support the kind of PAuth relocation that we are trying to emit.
+  if (targetSupportsPAuthRelocation(TT, Target, DSExpr) ||
+      !targetSupportsIRelativeRelocation(TT))
+    return nullptr;
+
+  // For now, only the DA key is supported.
+  if (KeyID != AArch64PACKey::DA)
+    return nullptr;
+
+  std::unique_ptr<MCSubtargetInfo> STI(
+      TM.getTarget().createMCSubtargetInfo(TT.str(), "", ""));
+  assert(STI && "Unable to create subtarget info");
+
+  MCSymbol *Place = OutStreamer->getContext().createTempSymbol();
+  OutStreamer->emitLabel(Place);
+  OutStreamer->pushSection();
+
+  OutStreamer->switchSection(OutStreamer->getContext().getELFSection(
+      ".text.startup", ELF::SHT_PROGBITS, ELF::SHF_ALLOC | ELF::SHF_EXECINSTR,
+      0, "", true, PAuthIFuncNextUniqueID++, nullptr));
+
+  MCSymbol *IFuncSym =
+      OutStreamer->getContext().createLinkerPrivateSymbol("pauth_ifunc");
+  OutStreamer->emitSymbolAttribute(IFuncSym, MCSA_ELF_TypeIndFunction);
+  OutStreamer->emitLabel(IFuncSym);
+  if (isa<MCConstantExpr>(Target)) {
+    OutStreamer->emitInstruction(MCInstBuilder(AArch64::MOVZXi)
+                                 .addReg(AArch64::X0)
+                                 .addExpr(Target)
+                                 .addImm(0),
+                             *STI);
+  } else {
+    emitAddress(*OutStreamer, AArch64::X0, Target, IsDSOLocal, *STI);
+  }
+  if (HasAddressDiversity) {
+    auto *PlacePlusDisc = MCBinaryExpr::createAdd(
+        MCSymbolRefExpr::create(Place, OutStreamer->getContext()),
+        MCConstantExpr::create(static_cast<int16_t>(Disc),
+                               OutStreamer->getContext()),
+        OutStreamer->getContext());
+    emitAddress(*OutStreamer, AArch64::X1, PlacePlusDisc, /*IsDSOLocal=*/true,
+                *STI);
+  } else {
+    emitMOVZ(AArch64::X1, Disc, 0);
+  }
+
+  MCSymbol *PrePACInst = OutStreamer->getContext().createTempSymbol();
+  OutStreamer->emitLabel(PrePACInst);
+
+  // We don't know the subtarget because this is being emitted for a global
+  // initializer. Because the performance of IFUNC resolvers is unimportant, we
+  // always call the EmuPAC runtime, which will end up using the PAC instruction
+  // if the target supports PAC.
+  MCSymbol *EmuPAC =
+      OutStreamer->getContext().getOrCreateSymbol("__emupac_pacda");
+  const MCSymbolRefExpr *EmuPACRef =
+      MCSymbolRefExpr::create(EmuPAC, OutStreamer->getContext());
+  OutStreamer->emitInstruction(MCInstBuilder(AArch64::B).addExpr(EmuPACRef),
+                               *STI);
+  OutStreamer->popSection();
+
+  return MCSymbolRefExpr::create(IFuncSym, OutStreamer->getContext());
+}
+
 const MCExpr *
 AArch64AsmPrinter::lowerConstantPtrAuth(const ConstantPtrAuth &CPA) {
   MCContext &Ctx = OutContext;
@@ -2229,23 +2374,20 @@ AArch64AsmPrinter::lowerConstantPtrAuth(const ConstantPtrAuth &CPA) {
 
   auto *BaseGVB = dyn_cast<GlobalValue>(BaseGV);
 
-  // If we can't understand the referenced ConstantExpr, there's nothing
-  // else we can do: emit an error.
-  if (!BaseGVB) {
-    BaseGV->getContext().emitError(
-        "cannot resolve target base/addend of ptrauth constant");
-    return nullptr;
+  const MCExpr *Sym;
+  if (BaseGVB) {
+    // If there is an addend, turn that into the appropriate MCExpr.
+    Sym = MCSymbolRefExpr::create(getSymbol(BaseGVB), Ctx);
+    if (Offset.sgt(0))
+      Sym = MCBinaryExpr::createAdd(
+          Sym, MCConstantExpr::create(Offset.getSExtValue(), Ctx), Ctx);
+    else if (Offset.slt(0))
+      Sym = MCBinaryExpr::createSub(
+          Sym, MCConstantExpr::create((-Offset).getSExtValue(), Ctx), Ctx);
+  } else {
+    Sym = MCConstantExpr::create(Offset.getSExtValue(), Ctx);
   }
 
-  // If there is an addend, turn that into the appropriate MCExpr.
-  const MCExpr *Sym = MCSymbolRefExpr::create(getSymbol(BaseGVB), Ctx);
-  if (Offset.sgt(0))
-    Sym = MCBinaryExpr::createAdd(
-        Sym, MCConstantExpr::create(Offset.getSExtValue(), Ctx), Ctx);
-  else if (Offset.slt(0))
-    Sym = MCBinaryExpr::createSub(
-        Sym, MCConstantExpr::create((-Offset).getSExtValue(), Ctx), Ctx);
-
   uint64_t KeyID = CPA.getKey()->getZExtValue();
   // We later rely on valid KeyID value in AArch64PACKeyIDToString call from
   // AArch64AuthMCExpr::printImpl, so fail fast.
@@ -2259,6 +2401,12 @@ AArch64AsmPrinter::lowerConstantPtrAuth(const ConstantPtrAuth &CPA) {
     report_fatal_error("AArch64 PAC Discriminator '" + Twine(Disc) +
                        "' out of range [0, 0xFFFF]");
 
+  // Check if we need to represent this with an IRELATIVE and emit it if so.
+  if (auto *IFuncSym = emitPAuthRelocationAsIRelative(
+          Sym, Disc, AArch64PACKey::ID(KeyID), CPA.hasAddressDiscriminator(),
+          BaseGVB && BaseGVB->isDSOLocal()))
+    return IFuncSym;
+
   // Finally build the complete @AUTH expr.
   return AArch64AuthMCExpr::create(Sym, Disc, AArch64PACKey::ID(KeyID),
                                    CPA.hasAddressDiscriminator(), Ctx);

[github-actions]

✅ With the latest revision this PR passed the C/C++ code formatter.

[fmayer]

why is this needed? shouldn't the codegen for things that didn't need IRELATIVE before stay the same?

[pcc]

That's needed because glibc doesn't support the PAuth relocations (so it uses IRELATIVE after this change), so I needed to switch to another triple that does.

[fmayer]

Clarified with Peter: before, this generated PAuth relocations for glibc, even though that wouldn't actually work.

[thurstond]

HWASan bot is failing (https://lab.llvm.org/buildbot/#/builders/55/builds/20677) on CodeGen/AArch64/ptrauth-irelative.ll. (This pull request is the only change.)

[thurstond]

UBSan bot is also failing ("reference binding to null pointer of type 'const MCSubtargetInfo'") https://lab.llvm.org/buildbot/#/builders/85/builds/16113 but it's not clear whether the culprit is this pull request, #133536 or #133537

[pcc]

dab4413 should fix it.

[thurstond]

dab4413 should fix it.

The fix landed in the ASan bot but it's still failing: https://lab.llvm.org/buildbot/#/builders/24/builds/15133

(it did fix the MSan and UBSan bots)

[pcc]

Reproduced here with ASan, taking a look.

[pcc]

Fixed: b3428bb

[thurstond]

Fixed: b3428bb

Thanks!

[hvdijk]

Mentioning the details in here rather than in #171648 where I noticed it:

When the test is updated to use aarch64-linux-gnu, it does not gracefully error out, it crashes instead. To reproduce the problem easily:

$ ninja llc && bin/llvm-lit -sv /path/to/llvm-project/llvm/test/CodeGen/AArch64/ptrauth-reloc.ll && bin/llc -mtriple aarch64-linux-gnu -mattr=+pauth -o - test/CodeGen/AArch64/Output/ptrauth-reloc.ll.tmp/ok.ll
[...]
.Lpauth_ifunc2:
        adrp    x0, :got:g
        ldr     x0, [x0, :got_lo12:g]
        add     x0, x0, llc: /path/to/llvm-project/llvm/lib/Target/AArch64/MCTargetDesc/AArch64InstPrinter.cpp:1337: void llvm::AArch64InstPrinter::printAddSubImm(const llvm::MCInst*, unsigned int, const llvm::MCSubtargetInfo&, llvm::raw_ostream&): Assertion `Val == MO.getImm() && "Add/sub immediate out of range!"' failed.
PLEASE submit a bug report to https://github.com/llvm/llvm-project/issues/ and include the crash backtrace and instructions to reproduce the bug.
Stack dump:
0.      Program arguments: bin/llc -mtriple aarch64-linux-gnu -mattr=+pauth -o - test/CodeGen/AArch64/Output/ptrauth-reloc.ll.tmp/ok.ll
 #0 0x00007f9412515748 llvm::sys::PrintStackTrace(llvm::raw_ostream&, int) /path/to/llvm-project/llvm/lib/Support/Unix/Signals.inc:834:22
 #1 0x00007f9412515c0c PrintStackTraceSignalHandler(void*) /path/to/llvm-project/llvm/lib/Support/Unix/Signals.inc:916:1
 #2 0x00007f9412513148 llvm::sys::RunSignalHandlers() /path/to/llvm-project/llvm/lib/Support/Signals.cpp:104:20
 #3 0x00007f94125150b1 SignalHandler(int, siginfo_t*, void*) /path/to/llvm-project/llvm/lib/Support/Unix/Signals.inc:426:14
 #4 0x00007f9410e49df0 (/lib/x86_64-linux-gnu/libc.so.6+0x3fdf0)
 #5 0x00007f9410e9e95c __pthread_kill_implementation ./nptl/pthread_kill.c:44:76
 #6 0x00007f9410e49cc2 raise ./signal/../sysdeps/posix/raise.c:27:6
 #7 0x00007f9410e324ac abort ./stdlib/abort.c:81:3
 #8 0x00007f9410e32420 __assert_perror_fail ./assert/assert-perr.c:31:1
 #9 0x00007f94170f3593 llvm::AArch64InstPrinter::printAddSubImm(llvm::MCInst const*, unsigned int, llvm::MCSubtargetInfo const&, llvm::raw_ostream&) /path/to/llvm-project/llvm/lib/Target/AArch64/MCTargetDesc/AArch64InstPrinter.cpp:1339:49
#10 0x00007f94170dfcbf llvm::AArch64InstPrinter::printInstruction(llvm::MCInst const*, unsigned long, llvm::MCSubtargetInfo const&, llvm::raw_ostream&) /path/to/llvm-project/build/x86_64-linux-debug/lib/Target/AArch64/AArch64GenAsmWriter.inc:21906:5
#11 0x00007f94170f0b48 llvm::AArch64InstPrinter::printInst(llvm::MCInst const*, unsigned long, llvm::StringRef, llvm::MCSubtargetInfo const&, llvm::raw_ostream&) /path/to/llvm-project/llvm/lib/Target/AArch64/MCTargetDesc/AArch64InstPrinter.cpp:377:18
#12 0x00007f9415ba08cd llvm::MCTargetStreamer::prettyPrintAsm(llvm::MCInstPrinter&, unsigned long, llvm::MCInst const&, llvm::MCSubtargetInfo const&, llvm::raw_ostream&) /path/to/llvm-project/llvm/lib/MC/MCStreamer.cpp:1159:24
#13 0x00007f9415b15dcb (anonymous namespace)::MCAsmStreamer::emitInstruction(llvm::MCInst const&, llvm::MCSubtargetInfo const&) /path/to/llvm-project/llvm/lib/MC/MCAsmStreamer.cpp:2460:40
#14 0x00007f9416cbe7b8 emitAddress(llvm::MCStreamer&, llvm::MCRegister, llvm::MCExpr const*, bool, llvm::MCSubtargetInfo const&) /path/to/llvm-project/llvm/lib/Target/AArch64/AArch64AsmPrinter.cpp:2377:32
#15 0x00007f9416cbed75 (anonymous namespace)::AArch64AsmPrinter::emitPAuthRelocationAsIRelative(llvm::MCExpr const*, unsigned long, llvm::AArch64PACKey::ID, bool, bool, llvm::MCExpr const*) /path/to/llvm-project/llvm/lib/Target/AArch64/AArch64AsmPrinter.cpp:2509:3
#16 0x00007f9416cbf858 (anonymous namespace)::AArch64AsmPrinter::lowerConstantPtrAuth(llvm::ConstantPtrAuth const&) /path/to/llvm-project/llvm/lib/Target/AArch64/AArch64AsmPrinter.cpp:2602:54
#17 0x00007f94139c1317 llvm::AsmPrinter::lowerConstant(llvm::Constant const*, llvm::Constant const*, unsigned long) /path/to/llvm-project/llvm/lib/CodeGen/AsmPrinter/AsmPrinter.cpp:3650:32
#18 0x00007f9416cc6e60 (anonymous namespace)::AArch64AsmPrinter::lowerConstant(llvm::Constant const*, llvm::Constant const*, unsigned long) /path/to/llvm-project/llvm/lib/Target/AArch64/AArch64AsmPrinter.cpp:3935:54
#19 0x00007f94139c42aa emitGlobalConstantImpl(llvm::DataLayout const&, llvm::Constant const*, llvm::AsmPrinter&, llvm::Constant const*, unsigned long, llvm::DenseMap<unsigned long, llvm::SmallVector<llvm::GlobalAlias const*, 1u>, llvm::DenseMapInfo<unsigned long, void>, llvm::detail::DenseMapPair<unsigned long, llvm::SmallVector<llvm::GlobalAlias const*, 1u>>>*) /path/to/llvm-project/llvm/lib/CodeGen/AsmPrinter/AsmPrinter.cpp:4313:57
#20 0x00007f94139c43f5 llvm::AsmPrinter::emitGlobalConstant(llvm::DataLayout const&, llvm::Constant const*, llvm::DenseMap<unsigned long, llvm::SmallVector<llvm::GlobalAlias const*, 1u>, llvm::DenseMapInfo<unsigned long, void>, llvm::detail::DenseMapPair<unsigned long, llvm::SmallVector<llvm::GlobalAlias const*, 1u>>>*) /path/to/llvm-project/llvm/lib/CodeGen/AsmPrinter/AsmPrinter.cpp:4329:27
#21 0x00007f94139b2429 llvm::AsmPrinter::emitGlobalVariable(llvm::GlobalVariable const*) /path/to/llvm-project/llvm/lib/CodeGen/AsmPrinter/AsmPrinter.cpp:932:7
#22 0x00007f94139bc54e llvm::AsmPrinter::doFinalization(llvm::Module&) /path/to/llvm-project/llvm/lib/CodeGen/AsmPrinter/AsmPrinter.cpp:2707:34
#23 0x00007f9412866fcf llvm::FPPassManager::doFinalization(llvm::Module&) /path/to/llvm-project/llvm/lib/IR/LegacyPassManager.cpp:1462:13
#24 0x00007f9412867569 (anonymous namespace)::MPPassManager::runOnModule(llvm::Module&) /path/to/llvm-project/llvm/lib/IR/LegacyPassManager.cpp:1549:13
#25 0x00007f9412862a8a llvm::legacy::PassManagerImpl::run(llvm::Module&) /path/to/llvm-project/llvm/lib/IR/LegacyPassManager.cpp:531:13
#26 0x00007f9412867b05 llvm::legacy::PassManager::run(llvm::Module&) /path/to/llvm-project/llvm/lib/IR/LegacyPassManager.cpp:1641:1
#27 0x0000559b200ed7f7 compileModule(char**, llvm::LLVMContext&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>&) /path/to/llvm-project/llvm/tools/llc/llc.cpp:851:34
#28 0x0000559b200eac99 main /path/to/llvm-project/llvm/tools/llc/llc.cpp:450:35
#29 0x00007f9410e33ca8 __libc_start_call_main ./csu/../sysdeps/nptl/libc_start_call_main.h:74:3
#30 0x00007f9410e33d65 call_init ./csu/../csu/libc-start.c:128:20
#31 0x00007f9410e33d65 __libc_start_main ./csu/../csu/libc-start.c:347:5
#32 0x0000559b200e9651 _start (bin/llc+0x16651)
Aborted (core dumped)

[pcc]

This comes from:

@g.big_offset.ref.da.0 = constant ptr ptrauth (ptr getelementptr (i8, ptr @g, i64 add (i64 2147483648, i64 65537)), i32 2)

Looks like we're missing handling for the case where the offset is large enough to not fit into an ADD instruction's immediate operand. So we shouldn't error out but instead should fix the code generator to materialize these large offsets correctly.

[pcc]

This comes from:

@g.big_offset.ref.da.0 = constant ptr ptrauth (ptr getelementptr (i8, ptr @g, i64 add (i64 2147483648, i64 65537)), i32 2)

Looks like we're missing handling for the case where the offset is large enough to not fit into an ADD instruction's immediate operand. So we shouldn't error out but instead should fix the code generator to materialize these large offsets correctly.

Fixed by #171707