arm64e/ptrauth: objc isa signing.

Author: ahmedbougacha

clang/CMakeLists.txt

@@ -410,6 +410,8 @@ option(CLANG_ENABLE_ARCMT "Build ARCMT." ON)
 option(CLANG_ENABLE_STATIC_ANALYZER
   "Include static analyzer in clang binary." ON)
 
+option(CLANG_ENABLE_PTRAUTH_OBJC_ISA "Objc isa/super pointer authentication for clang/ptrauth.h: when enabled, can default to sign-and-strip or sign-and-auth based on target" OFF)
+
 option(CLANG_ENABLE_PROTO_FUZZER "Build Clang protobuf fuzzer." OFF)
 
 if(NOT CLANG_ENABLE_STATIC_ANALYZER AND CLANG_ENABLE_ARCMT)

clang/docs/PointerAuthentication.rst

@@ -108,6 +108,8 @@ It is possible to tweak the behaviour of pointer authentication using the `optio
 
 - authentication mode: ``strip``, ``sign-and-strip``, ``sign-and-auth``. These control whether authentication codes are ignored completely (``strip``), whether values are signed but not authenticated (``sign-and-strip``), or the default of full authentication (``sign-and-auth``).
 
+- ``isa-pointer``: This is used to indicate that the target value is an Objective-C isa pointer, and needs to mask out objective-c tag bits prior to signing or authenticating the value.
+
 - ``authenticates-null-values``: Enables full signing and authentication of null values. The default behaviour of pointer authentication is to not sign or authenticate null values. This option ensures that all values, including null values, will always be signed and authenticated.
 
 .. _Signing schemas:
@@ -814,7 +816,10 @@ Objective-C method lists sign methods with the ``IA`` key using address diversit
 
 The Objective-C runtime provides additional protection to methods that have been loaded into the Objective-C method cache; this protection is private to the runtime.
 
-Pointer authentication cannot protect against access-path atacks against the Objective-C ``isa`` pointer, through which all dispatch occurs, because of compatibility requirements and existing and important usage of high bits in the pointer.
+Objective-C ``isa`` and ``super`` pointers
+~~~~~~~~~~~~~~~~~~~~~~~~
+
+Objective-C ``isa`` and ``super`` pointers are both signed with the ``DA`` key with constant discriminators of 0x6AE1 and 0x25DA respectively.
 
 Swift class methods
 ~~~~~~~~~~~~~~~~~~~

clang/include/clang/AST/Type.h

@@ -153,47 +153,51 @@ class PointerAuthQualifier {
     AuthenticationModeBits = 2,
     AuthenticationModeMask = ((1 << AuthenticationModeBits) - 1)
                              << AuthenticationModeShift,
-    AuthenticatesNullValuesShift = AuthenticationModeShift + AuthenticationModeBits,
+    IsaPointerShift = AuthenticationModeShift + AuthenticationModeBits,
+    IsaPointerBits = 1,
+    IsaPointerMask = ((1 << IsaPointerBits) - 1) << IsaPointerShift,
+    AuthenticatesNullValuesShift = IsaPointerShift + IsaPointerBits,
     AuthenticatesNullValuesBits = 1,
     AuthenticatesNullValuesMask = ((1 << AuthenticatesNullValuesBits) - 1)
                                   << AuthenticatesNullValuesShift,
     KeyShift = AuthenticatesNullValuesShift + AuthenticatesNullValuesBits,
-    KeyBits = 11,
+    KeyBits = 10,
     KeyMask = ((1 << KeyBits) - 1) << KeyShift,
     DiscriminatorShift = KeyShift + KeyBits,
     DiscriminatorBits = 16,
     DiscriminatorMask = ((1 << DiscriminatorBits) - 1) << DiscriminatorShift,
   };
 
-  // bits:     |0      |1      |2..3              |4                |5..15|   16...31   |
-  //           |Enabled|Address|AuthenticationMode|AuthenticatesNull|Key  |Discriminator|
+  // bits:     |0      |1      |2..3              |4          |5                |6..15|   16...31   |
+  //           |Enabled|Address|AuthenticationMode|ISA pointer|AuthenticatesNull|Key  |Discriminator|
   uint32_t Data;
 
   static_assert((EnabledBits + AddressDiscriminatedBits +
-                 AuthenticationModeBits + KeyBits +
-                 AuthenticatesNullValuesBits + DiscriminatorBits) ==
+                 AuthenticationModeBits + IsaPointerBits +
+                 AuthenticatesNullValuesBits + KeyBits + DiscriminatorBits) ==
                     32,
                 "PointerAuthQualifier should be exactly 32 bits");
   static_assert((EnabledMask + AddressDiscriminatedMask +
-                 AuthenticationModeMask + KeyMask +
-                 AuthenticatesNullValuesMask + DiscriminatorMask) ==
+                 AuthenticationModeMask + IsaPointerMask +
+                 AuthenticatesNullValuesMask + KeyMask + DiscriminatorMask) ==
                     0xFFFFFFFF,
                 "All masks should cover the entire bits");
   static_assert((EnabledMask ^ AddressDiscriminatedMask ^
-                 AuthenticationModeMask ^ KeyMask ^
-                 AuthenticatesNullValuesMask ^ DiscriminatorMask) ==
+                 AuthenticationModeMask ^ IsaPointerMask ^
+                 AuthenticatesNullValuesMask ^ KeyMask ^ DiscriminatorMask) ==
                     0xFFFFFFFF,
                 "All masks should cover the entire bits");
 
   PointerAuthQualifier(unsigned key, bool isAddressDiscriminated,
                        unsigned extraDiscriminator,
                        PointerAuthenticationMode authenticationMode,
-                       bool authenticatesNullValues)
+                       bool isIsaPointer, bool authenticatesNullValues)
       : Data(EnabledMask |
              (isAddressDiscriminated ? AddressDiscriminatedMask : 0) |
              (key << KeyShift) |
              (unsigned(authenticationMode) << AuthenticationModeShift) |
              (extraDiscriminator << DiscriminatorShift) |
+             (isIsaPointer << IsaPointerShift) |
              (authenticatesNullValues << AuthenticatesNullValuesShift)) {
     assert(key <= KeyNoneInternal);
     assert(extraDiscriminator <= MaxDiscriminator);
@@ -215,13 +219,13 @@ class PointerAuthQualifier {
 
   static PointerAuthQualifier
   Create(int key, bool isAddressDiscriminated, unsigned extraDiscriminator,
-         PointerAuthenticationMode authenticationMode,
+         PointerAuthenticationMode authenticationMode, bool isIsaPointer,
          bool authenticatesNullValues) {
     if (key == PointerAuthKeyNone)
       key = KeyNoneInternal;
     assert((key >= 0 && key <= KeyNoneInternal) && "out-of-range key value");
     return PointerAuthQualifier(key, isAddressDiscriminated, extraDiscriminator,
-                                authenticationMode,
+                                authenticationMode, isIsaPointer,
                                 authenticatesNullValues);
   }
 
@@ -255,6 +259,11 @@ class PointerAuthQualifier {
                                      AuthenticationModeShift);
   }
 
+  bool isIsaPointer() const {
+    assert(isPresent());
+    return (Data & IsaPointerMask) >> IsaPointerShift;
+  }
+
   bool authenticatesNullValues() const {
     assert(isPresent());
     return (Data & AuthenticatesNullValuesMask) >> AuthenticatesNullValuesShift;

clang/include/clang/Basic/Features.def

@@ -104,6 +104,12 @@ FEATURE(ptrauth_qualifier, LangOpts.PointerAuthIntrinsics)
 FEATURE(ptrauth_qualifier_authentication_mode, LangOpts.PointerAuthIntrinsics)
 FEATURE(ptrauth_restricted_intptr_qualifier, LangOpts.PointerAuthIntrinsics)
 FEATURE(ptrauth_calls, LangOpts.PointerAuthCalls)
+// While we deploy phases, ptrauth_objc_isa is equivalent to ptrauth_objc_isa_signs, i.e., phase 1 or 2.
+// Long-term, it is intended to be the only feature, once we can get rid of phases.
+FEATURE(ptrauth_objc_isa, LangOpts.getPointerAuthObjcIsaAuthentication() == PointerAuthenticationMode::SignAndStrip || LangOpts.getPointerAuthObjcIsaAuthentication() == PointerAuthenticationMode::SignAndAuth)
+FEATURE(ptrauth_objc_isa_strips, LangOpts.getPointerAuthObjcIsaAuthentication() == PointerAuthenticationMode::Strip || LangOpts.getPointerAuthObjcIsaAuthentication() == PointerAuthenticationMode::SignAndStrip)
+FEATURE(ptrauth_objc_isa_signs, LangOpts.getPointerAuthObjcIsaAuthentication() == PointerAuthenticationMode::SignAndStrip || LangOpts.getPointerAuthObjcIsaAuthentication() == PointerAuthenticationMode::SignAndAuth)
+FEATURE(ptrauth_objc_isa_authenticates, LangOpts.getPointerAuthObjcIsaAuthentication() == PointerAuthenticationMode::SignAndAuth)
 FEATURE(ptrauth_objc_signable_class, true)
 FEATURE(ptrauth_objc_method_list_pointer, LangOpts.PointerAuthCalls)
 FEATURE(ptrauth_vtable_pointer_address_discrimination, LangOpts.PointerAuthVTPtrAddressDiscrimination)
@@ -112,6 +118,7 @@ FEATURE(ptrauth_returns, LangOpts.PointerAuthReturns)
 FEATURE(ptrauth_member_function_pointer_type_discrimination, LangOpts.PointerAuthCalls)
 FEATURE(ptrauth_function_pointer_type_discrimination, LangOpts.FunctionPointerTypeDiscrimination)
 FEATURE(ptrauth_signed_block_descriptors, LangOpts.PointerAuthBlockDescriptorPointers)
+FEATURE(ptrauth_objc_isa_masking, LangOpts.PointerAuthObjcIsaMasking)
 FEATURE(swiftasynccc,
   PP.getTargetInfo().checkCallingConvention(CC_SwiftAsync) ==
   clang::TargetInfo::CCCR_OK)

clang/include/clang/Basic/LangOptions.def

@@ -166,6 +166,9 @@ LANGOPT(PointerAuthReturns, 1, 0, "return pointer authentication")
 LANGOPT(PointerAuthAuthTraps, 1, 0, "pointer authentication failure traps")
 LANGOPT(PointerAuthVTPtrAddressDiscrimination, 1, 0, "incorporate address discrimination in authenticated vtable pointers")
 LANGOPT(PointerAuthVTPtrTypeDiscrimination, 1, 0, "incorporate type discrimination in authenticated vtable pointers")
+ENUM_LANGOPT(PointerAuthObjcIsaAuthentication, PointerAuthenticationMode, 2,
+             PointerAuthenticationMode::None, "authentication mode for objc isa")
+LANGOPT(PointerAuthObjcIsaMasking, 1, 0, "pre- and post-authentication masking for Objective-C isa pointer")
 LANGOPT(SoftPointerAuth   , 1, 0, "software emulation of pointer authentication")
 LANGOPT(PointerAuthBlockDescriptorPointers, 1, 0, "enable signed block descriptors")
 VALUE_LANGOPT(PointerAuthABIVersion, 32, 0, "pointer authentication ABI version")

clang/include/clang/Basic/LangOptions.h

@@ -42,6 +42,8 @@ static constexpr llvm::StringLiteral PointerAuthenticationOptionSignAndStrip =
     "sign-and-strip";
 static constexpr llvm::StringLiteral PointerAuthenticationOptionSignAndAuth =
     "sign-and-auth";
+static constexpr llvm::StringLiteral PointerAuthenticationOptionIsaPointer =
+    "isa-pointer";
 static constexpr llvm::StringLiteral
     PointerAuthenticationOptionAuthenticatesNullValues =
         "authenticates-null-values";

clang/include/clang/Basic/PointerAuthOptions.h

@@ -29,6 +29,14 @@ namespace clang {
 /// ptrauth_string_discriminator("method_list_t")
 constexpr uint16_t MethodListPointerConstantDiscriminator = 0xC310;
 
+/// Constant discriminator to be used with objective-c isa pointers. The value
+/// is ptrauth_string_discriminator("isa")
+constexpr uint16_t IsaPointerConstantDiscriminator = 0x6AE1;
+
+/// Constant discriminator to be used with objective-c superclass pointers.
+/// The value is ptrauth_string_discriminator("objc_class:superclass")
+constexpr uint16_t SuperPointerConstantDiscriminator = 0xB5AB;
+
 /// Constant discriminator to be used with block descriptor pointers. The value
 /// is ptrauth_string_discriminator("block_descriptor")
 constexpr uint16_t BlockDescriptorConstantDiscriminator = 0xC0BB;
@@ -54,7 +62,8 @@ class PointerAuthSchema {
     CXXVirtualFunctionPointers = 5,
     CXXMemberFunctionPointers = 6,
     ObjCMethodListPointer = 7,
-    BlockDescriptorPointers = 8,
+    ObjCIsaPointer = 8,
+    BlockDescriptorPointers = 9,
   };
 
   /// Hardware pointer-signing keys in ARM8.3.
@@ -85,6 +94,7 @@ class PointerAuthSchema {
 private:
   Kind TheKind : 2;
   unsigned IsAddressDiscriminated : 1;
+  unsigned IsIsaPointer : 1;
   unsigned AuthenticatesNullValues : 1;
   PointerAuthenticationMode SelectedAuthenticationMode : 2;
   Discrimination DiscriminationKind : 2;
@@ -98,8 +108,10 @@ class PointerAuthSchema {
                     PointerAuthenticationMode authenticationMode,
                     Discrimination otherDiscrimination,
                     std::optional<uint16_t> constantDiscriminator = std::nullopt,
+                    bool isIsaPointer = false,
                     bool authenticatesNullValues = false)
       : TheKind(Kind::Soft), IsAddressDiscriminated(isAddressDiscriminated),
+        IsIsaPointer(isIsaPointer),
         AuthenticatesNullValues(authenticatesNullValues),
         SelectedAuthenticationMode(authenticationMode),
         DiscriminationKind(otherDiscrimination), Key(unsigned(key)) {
@@ -114,8 +126,10 @@ class PointerAuthSchema {
                     PointerAuthenticationMode authenticationMode,
                     Discrimination otherDiscrimination,
                     std::optional<uint16_t> constantDiscriminator = std::nullopt,
+                    bool isIsaPointer = false,
                     bool authenticatesNullValues = false)
       : TheKind(Kind::ARM8_3), IsAddressDiscriminated(isAddressDiscriminated),
+        IsIsaPointer(isIsaPointer),
         AuthenticatesNullValues(authenticatesNullValues),
         SelectedAuthenticationMode(authenticationMode),
         DiscriminationKind(otherDiscrimination), Key(unsigned(key)) {
@@ -134,16 +148,17 @@ class PointerAuthSchema {
       : PointerAuthSchema(key, isAddressDiscriminated,
                           PointerAuthenticationMode::SignAndAuth,
                           otherDiscrimination, constantDiscriminator,
-                          authenticatesNullValues) {}
+                          isIsaPointer, authenticatesNullValues) {}
 
   PointerAuthSchema(ARM8_3Key key, bool isAddressDiscriminated,
                     Discrimination otherDiscrimination,
                     std::optional<uint16_t> constantDiscriminator = std::nullopt,
+                    bool isIsaPointer = false,
                     bool authenticatesNullValues = false)
       : PointerAuthSchema(key, isAddressDiscriminated,
                           PointerAuthenticationMode::SignAndAuth,
                           otherDiscrimination, constantDiscriminator,
-                          authenticatesNullValues) {}
+                          isIsaPointer, authenticatesNullValues) {}
 
   Kind getKind() const { return TheKind; }
 
@@ -156,6 +171,11 @@ class PointerAuthSchema {
     return IsAddressDiscriminated;
   }
 
+  bool isIsaPointer() const {
+    assert(getKind() != Kind::None);
+    return IsIsaPointer;
+  }
+
   bool authenticatesNullValues() const {
     assert(getKind() != Kind::None);
     return AuthenticatesNullValues;
@@ -251,6 +271,12 @@ struct PointerAuthOptions {
 
   /// The ABI for C++ member function pointers.
   PointerAuthSchema CXXMemberFunctionPointers;
+
+  /// The ABI for Objective-C isa pointers.
+  PointerAuthSchema ObjCIsaPointers;
+
+  /// The ABI for Objective-C superclass pointers.
+  PointerAuthSchema ObjCSuperPointers;
 };
 
 }  // end namespace clang

clang/include/clang/Config/config.h.cmake

@@ -74,6 +74,9 @@
 #cmakedefine01 CLANG_ENABLE_OBJC_REWRITER
 #cmakedefine01 CLANG_ENABLE_STATIC_ANALYZER
 
+/* Enable objc isa signing ptrauth driver support, based on deployment target */
+#cmakedefine01 CLANG_ENABLE_PTRAUTH_OBJC_ISA
+
 /* Spawn a new process clang.exe for the CC1 tool invocation, when necessary */
 #cmakedefine01 CLANG_SPAWN_CC1
 

clang/include/clang/Driver/Options.td

@@ -3893,6 +3893,12 @@ let Group = f_Group in {
       HelpText<"enable signing block descriptors">;
     def fptrauth_function_pointer_type_discrimination : Flag<["-"], "fptrauth-function-pointer-type-discrimination">,
       HelpText<"Enabling type discrimination on C function pointers">;
+    def fptrauth_objc_isa : Flag<["-"], "fptrauth-objc-isa">,
+      HelpText<"Enable signing and authentication of Objective-C object's 'isa' field">;
+    def fptrauth_objc_isa_mode : Joined<["-"], "fptrauth-objc-isa-mode=">,
+      HelpText<"Authentication mode for ObjC isa field. Full auth if unspecified">, Values<"strip,sign-and-strip,sign-and-auth">;
+    def fptrauth_objc_isa_masking : Flag<["-"], "fptrauth-objc-isa-masking">,
+      HelpText<"pre- and post-authentication masking mode of objective-c isa pointers">;
   }
   def fno_ptrauth_intrinsics : Flag<["-"], "fno-ptrauth-intrinsics">;
   def fno_ptrauth_calls : Flag<["-"], "fno-ptrauth-calls">;
@@ -3901,6 +3907,7 @@ let Group = f_Group in {
   def fno_ptrauth_vtable_pointer_address_discrimination : Flag<["-"], "fno-ptrauth-vtable-pointer-address-discrimination">;
   def fno_ptrauth_vtable_pointer_type_discrimination : Flag<["-"], "fno-ptrauth-vtable-pointer-type-discrimination">;
   def fno_ptrauth_soft : Flag<["-"], "fno-ptrauth-soft">;
+  def fno_ptrauth_objc_isa : Flag<["-"], "fno-ptrauth-objc-isa">;
   def fno_ptrauth_block_descriptor_pointers : Flag<["-"], "fno-ptrauth-block-descriptor-pointers">;
   def fno_ptrauth_function_pointer_type_discrimination : Flag<["-"], "fno-ptrauth-function-pointer-type-discrimination">;
 }

clang/lib/AST/TypePrinter.cpp

@@ -2311,6 +2311,13 @@ void PointerAuthQualifier::print(raw_ostream &OS,
   default:
     break;
   }
+  if (isIsaPointer()) {
+    if (hasOptions)
+      StrOS << ",";
+    StrOS << PointerAuthenticationOptionIsaPointer;
+    hasOptions = true;
+  }
+
   if (authenticatesNullValues()) {
     if (hasOptions)
       StrOS << ",";