[IR] Define llvm.ptrauth wrapper globals

[atrosinenko]

Summary

Define wrapper globals conveying a signing schema for a constant pointer
that can be used in contexts where ptrauth intrinsics are not available.

Co-authored-by: Ahmed Bougacha <[e-mail]>

[ab]

Please don’t. I’ll send out updated patches.

[nikic]

You need to introduce a new constant type like DSOLocalEquivalent or NoCFIValue.

[asl]

In D152620#4411674, @ab wrote:

Please don’t. I’ll send out updated patches.

Do you by any chance have some timeline about this? Maybe @atrosinenko can help you with updating the patches so the upstreaming process could go faster? AFAIK, he already has your branch rebased onto mainline.

[atrosinenko]

Here is the rebased branch: https://github.com/access-softek/llvm-project/tree/rebased-ptrauth. Some tests might fail as it is work-in-progress.

llvm/docs/PointerAuth.md

 # Pointer Authentication
 
 ## Introduction
 
 Pointer Authentication is a mechanism by which certain pointers are signed.
 When a pointer gets signed, a cryptographic hash of its value and other values
 (pepper and salt) is stored in unused bits of that pointer.
 
 Before the pointer is used, it needs to be authenticated, i.e., have its
 signature checked.  This prevents pointer values of unknown origin from being
 used to replace the signed pointer value.
 
 At the IR level, it is represented using:
 
 * a [set of intrinsics](#intrinsics) (to sign/authenticate pointers)
 * a [call operand bundle](#operand-bundle) (to authenticate called pointers)
+* a [special section and relocation](#authenticated-global-relocation)
+  (to sign globals)
 
 The current implementation leverages the
 [Armv8.3-A PAuth/Pointer Authentication Code](#armv8-3-a-pauth-pointer-authentication-code)
 instructions in the [AArch64 backend](#aarch64-support).
 This support is used to implement the Darwin arm64e ABI, as well as the
 [PAuth ABI Extension to ELF](https://github.com/ARM-software/abi-aa/blob/main/pauthabielf64/pauthabielf64.rst).
 
 
define void @f(void ()* %fp) {
   ret void
 }
 ```
 
 but with the added guarantee that ``%fp_i``, ``%fp_auth``, and ``%fp_auth_p``
 are not stored to (and reloaded from) memory.
 
 
+### Authenticated Global Relocation
+
+[Intrinsics](#intrinsics) can be used to produce signed pointers dynamically,
+in code, but not for signed pointers referenced by constants, in, e.g., global
+initializers.
+
+The latter are represented using a special kind of global describing an
+authenticated relocation (producing a signed pointer).
+
+These special global must live in section '``llvm.ptrauth``', and have a
+specific type.
+
+```llvm
[e-mail] = constant { ptr, i32, i64, i64 }
+                       { ptr <value>,
+                         i32 <key>,
+                         i64 <address discriminator>,
+                         i64 <integer discriminator>
+                       }, section "llvm.ptrauth"
+```
+
+is equivalent to ``@fp.ptrauth`` being initialized with:
+
+```llvm
+  %disc = call i64 @llvm.ptrauth.blend.i64(i64 <address discriminator>, i64 <integer discriminator>)
+  %fp_i = ptrtoint ptr <value> to i64
+  %signed_fp = call i64 @llvm.ptrauth.sign.i64(i64 %fp_i, i32 <key>, i64 %disc)
+  store i64 %signed_fp, i8* @fp.ptrauth
+```
+
+Note that this is a temporary representation, chosen to minimize the required
+changes.  Ideally, this would simply be a new kind of ConstantExpr.
+
+
+
 ## AArch64 Support
 
 AArch64 is currently the only architecture with full support of the pointer
 authentication primitives, based on Armv8.3-A instructions.
 
 ### Armv8.3-A PAuth Pointer Authentication Code
 
 The Armv8.3-A architecture extension defines the PAuth feature, which provides

llvm/include/llvm/IR/GlobalPtrAuthInfo.h

+//===- GlobalPtrAuthInfo.h - Analysis tools for ptrauth globals -*- C++ -*-===//
+//
+// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
+// See https://llvm.org/LICENSE.txt for license information.
+// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
+//
+//===----------------------------------------------------------------------===//
+/// \file
+/// This file contains a set of utilities to analyze llvm.ptrauth globals, and
+/// to decompose them into key, discriminator, and base pointer.
+///
+//===----------------------------------------------------------------------===//
+
+#ifndef LLVM_IR_GLOBALPTRAUTHINFO_H
+#define LLVM_IR_GLOBALPTRAUTHINFO_H
+
+#include "llvm/IR/Constants.h"
+#include "llvm/IR/GlobalVariable.h"
+#include "llvm/Support/Error.h"
+
+#include <optional>
+
+namespace llvm {
+
+/// Helper class to access the information regarding an "llvm.ptrauth" global.
+/// These globals are of the form:
+///  @sg = constant { ptr, i32, i64, i64 }
+///          { ptr @g,                         ; base pointer
+///            i32 2,                          ; key ID
+///            i64 ptrtoint (ptr @pg to i64),  ; address discriminator
+///            i64 42                          ; discriminator
+///          }, section "llvm.ptrauth"
+///
+class GlobalPtrAuthInfo {
+  const GlobalVariable *GV;
+
+  const ConstantStruct *getInitializer() const {
+    return cast<ConstantStruct>(GV->getInitializer());
+  }
+
+  GlobalPtrAuthInfo(const GlobalVariable *GV) : GV(GV) {}
+
+public:
+  /// Try to analyze \p V as an authenticated global reference, and return its
+  /// information if successful.
+  static std::optional<GlobalPtrAuthInfo> analyze(const Value *V);
+
+  /// Try to analyze \p V as an authenticated global reference, and return its
+  /// information if successful, or an error explaining the failure if not.
+  static Expected<GlobalPtrAuthInfo> tryAnalyze(const Value *V);
+
+  /// Access the information contained in the "llvm.ptrauth" globals.
+  /// @{
+  /// The "llvm.ptrauth" global itself.
+  const GlobalVariable *getGV() const { return GV; }
+
+  /// The pointer that is authenticated in this authenticated global reference.
+  Constant *getPointer() const {
+    return cast<Constant>(getInitializer()->getOperand(0));
+  }
+
+  /// The Key ID, an i32 constant.
+  ConstantInt *getKey() const {
+    return cast<ConstantInt>(getInitializer()->getOperand(1));
+  }
+
+  /// The address discriminator if any, or the null constant.
+  /// If present, this must be a value equivalent to the storage location of
+  /// the only user of the authenticated ptrauth global.
+  Constant *getAddrDiscriminator() const {
+    return cast<Constant>(getInitializer()->getOperand(2));
+  }
+
+  /// Whether there is any non-null address discriminator.
+  bool hasAddressDiversity() const {
+    return !getAddrDiscriminator()->isNullValue();
+  }
+
+  /// Whether the address uses a special address discriminator.
+  /// These discriminators can't be used in real pointer-auth values; they
+  /// can only be used in "prototype" values that indicate how some real
+  /// schema is supposed to be produced.
+  bool hasSpecialAddressDiscriminator(uint64_t Value) const {
+    auto *CI = dyn_cast<ConstantInt>(getAddrDiscriminator());
+    return CI && CI->getValue() == Value;
+  }
+
+  /// The discriminator.
+  ConstantInt *getDiscriminator() const {
+    return cast<ConstantInt>(getInitializer()->getOperand(3));
+  }
+  /// @}
+
+  /// Check whether an authentication operation with key \p Key and (possibly
+  /// blended) discriminator \p Discriminator is compatible with this
+  /// authenticated global reference.
+  bool isCompatibleWith(const Value *Key, const Value *Discriminator,
+                        const DataLayout &DL) const;
+
+  /// Produce a "llvm.ptrauth" global that signs a value using the given
+  /// schema.
+  static Constant *create(Module &M, Constant *Pointer, ConstantInt *Key,
+                          Constant *AddrDiscriminator,
+                          ConstantInt *Discriminator);
+
+  /// Produce a new "llvm.ptrauth" global for signing the given value using
+  /// the same schema as is stored in this info.
+  Constant *createWithSameSchema(Module &M, Constant *Pointer) const;
+};
+
+} // end namespace llvm
+
+#endif

llvm/include/llvm/IR/GlobalValue.h

public:
   }
   bool hasWeakLinkage() const { return isWeakLinkage(getLinkage()); }
   bool hasWeakAnyLinkage() const { return isWeakAnyLinkage(getLinkage()); }
   bool hasWeakODRLinkage() const { return isWeakODRLinkage(getLinkage()); }
   bool hasAppendingLinkage() const { return isAppendingLinkage(getLinkage()); }
   bool hasInternalLinkage() const { return isInternalLinkage(getLinkage()); }
   bool hasPrivateLinkage() const { return isPrivateLinkage(getLinkage()); }
   bool hasLocalLinkage() const { return isLocalLinkage(getLinkage()); }
-  bool hasExternalWeakLinkage() const {
-    return isExternalWeakLinkage(getLinkage());
-  }
+  bool hasExternalWeakLinkage() const;
   bool hasCommonLinkage() const { return isCommonLinkage(getLinkage()); }
   bool hasValidDeclarationLinkage() const {
     return isValidDeclarationLinkage(getLinkage());
   }
 
   void setLinkage(LinkageTypes LT) {
     if (isLocalLinkage(LT)) {
       Visibility = DefaultVisibility;

llvm/lib/IR/CMakeLists.txt

add_llvm_component_library(LLVMCore
   DiagnosticInfo.cpp
   DiagnosticPrinter.cpp
   Dominators.cpp
   EHPersonalities.cpp
   FPEnv.cpp
   Function.cpp
   GCStrategy.cpp
   GVMaterializer.cpp
+  GlobalPtrAuthInfo.cpp
   Globals.cpp
   IRBuilder.cpp
   IRPrintingPasses.cpp
   SSAContext.cpp
   InlineAsm.cpp
   Instruction.cpp
   Instructions.cpp
   IntrinsicInst.cpp

llvm/lib/IR/GlobalPtrAuthInfo.cpp

+//===- GlobalPtrAuthInfo.cpp - Analysis tools for ptrauth globals ---------===//
+//
+// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
+// See https://llvm.org/LICENSE.txt for license information.
+// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
+//
+//===----------------------------------------------------------------------===//
+
+#include "llvm/IR/GlobalPtrAuthInfo.h"
+
+#include "llvm/ADT/APInt.h"
+#include "llvm/IR/DataLayout.h"
+#include "llvm/IR/DerivedTypes.h"
+#include "llvm/IR/Instruction.h"
+#include "llvm/IR/IntrinsicInst.h"
+#include "llvm/IR/LLVMContext.h"
+#include "llvm/IR/Module.h"
+#include "llvm/IR/Operator.h"
+
+using namespace llvm;
+
+Expected<GlobalPtrAuthInfo> GlobalPtrAuthInfo::tryAnalyze(const Value *V) {
+  auto Invalid = [](const Twine &Reason) {
+    return make_error<StringError>(Reason, inconvertibleErrorCode());
+  };
+
+  auto &Ctx = V->getContext();
+
+  V = V->stripPointerCasts();
+
+  auto *GV = dyn_cast<GlobalVariable>(V);
+  if (!GV)
+    return Invalid("value isn't a global");
+
+  if (GV->getSection() != "llvm.ptrauth")
+    return Invalid("global isn't in section \"llvm.ptrauth\"");
+
+  if (!GV->hasInitializer())
+    return Invalid("global doesn't have an initializer");
+
+  auto *Init = GV->getInitializer();
+
+  auto *Ty = dyn_cast<StructType>(GV->getInitializer()->getType());
+  if (!Ty)
+    return Invalid("global isn't a struct");
+
+  auto *I64Ty = Type::getInt64Ty(Ctx);
+  auto *I32Ty = Type::getInt32Ty(Ctx);
+  auto *Ptr0Ty = PointerType::getUnqual(Ctx);
+  // Check that the struct matches its expected shape:
+  //   { ptr, i32, i64, i64 }
+  if (!Ty->isLayoutIdentical(
+          StructType::get(Ctx, {Ptr0Ty, I32Ty, I64Ty, I64Ty})))
+    return Invalid("global doesn't have type '{ ptr, i32, i64, i64 }'");
+
+  auto *Key = dyn_cast<ConstantInt>(Init->getOperand(1));
+  if (!Key)
+    return Invalid("key isn't a constant integer");
+
+  auto *AddrDiscriminator = Init->getOperand(2);
+  if (!isa<ConstantInt>(AddrDiscriminator) &&
+      !isa<ConstantExpr>(AddrDiscriminator))
+    return Invalid("address discriminator isn't a constant integer or expr");
+
+  auto *Discriminator = dyn_cast<ConstantInt>(Init->getOperand(3));
+  if (!Discriminator)
+    return Invalid("discriminator isn't a constant integer");
+
+  return GlobalPtrAuthInfo(GV);
+}
+
+std::optional<GlobalPtrAuthInfo> GlobalPtrAuthInfo::analyze(const Value *V) {
+  return expectedToOptional(tryAnalyze(V));
+}
+
+static bool areEquivalentAddrDiscriminators(const Value *V1, const Value *V2,
+                                            const DataLayout &DL) {
+  APInt V1Off(DL.getPointerSizeInBits(), 0);
+  APInt V2Off(DL.getPointerSizeInBits(), 0);
+
+  if (auto *V1Cast = dyn_cast<PtrToIntOperator>(V1))
+    V1 = V1Cast->getPointerOperand();
+  if (auto *V2Cast = dyn_cast<PtrToIntOperator>(V2))
+    V2 = V2Cast->getPointerOperand();
+  auto *V1Base = V1->stripAndAccumulateConstantOffsets(
+      DL, V1Off, /*AllowNonInbounds=*/true);
+  auto *V2Base = V2->stripAndAccumulateConstantOffsets(
+      DL, V2Off, /*AllowNonInbounds=*/true);
+  return V1Base == V2Base && V1Off == V2Off;
+}
+
+bool GlobalPtrAuthInfo::isCompatibleWith(const Value *Key,
+                                         const Value *Discriminator,
+                                         const DataLayout &DL) const {
+  // If the keys are different, there's no chance for this to be compatible.
+  if (Key != getKey())
+    return false;
+
+  // If Discriminator is dynamically blended, compare its parts.
+  if (auto *DiscBlend = dyn_cast<IntrinsicInst>(Discriminator)) {
+    return DiscBlend->getIntrinsicID() == Intrinsic::ptrauth_blend &&
+           DiscBlend->getOperand(1) == getDiscriminator() &&
+           areEquivalentAddrDiscriminators(DiscBlend->getOperand(0),
+                                           getAddrDiscriminator(), DL);
+  }
+
+  // Otherwise, check for either integer-only or address-only Discriminator.
+
+  if (getAddrDiscriminator()->isNullValue() &&
+      Discriminator == getDiscriminator())
+    return true;
+
+  if (getDiscriminator()->isNullValue() &&
+      areEquivalentAddrDiscriminators(getAddrDiscriminator(), Discriminator,
+                                      DL))
+    return true;
+
+  return false;
+}
+
+Constant *GlobalPtrAuthInfo::createWithSameSchema(Module &M,
+                                                  Constant *Pointer) const {
+  return create(M, Pointer, getKey(), getAddrDiscriminator(),
+                getDiscriminator());
+}
+
+Constant *GlobalPtrAuthInfo::create(Module &M, Constant *Pointer,
+                                    ConstantInt *Key,
+                                    Constant *AddrDiscriminator,
+                                    ConstantInt *Discriminator) {
+  auto *Init = ConstantStruct::getAnon(
+      {Pointer, Key, AddrDiscriminator, Discriminator}, /*packed*/ false);
+
+  // TODO: look for an existing global with the right setup?
+  auto *GV = new GlobalVariable(M, Init->getType(), /*constant*/ true,
+                                GlobalVariable::PrivateLinkage, Init);
+  GV->setSection("llvm.ptrauth");
+
+  assert(analyze(GV) && "invalid ptrauth constant");
+
+  return GV;
+}

llvm/lib/IR/Globals.cpp

 }
 
 void GlobalObject::copyAttributesFrom(const GlobalObject *Src) {
   GlobalValue::copyAttributesFrom(Src);
   setAlignment(Src->getAlign());
   setSection(Src->getSection());
 }
 
+bool GlobalValue::hasExternalWeakLinkage() const {
+  // llvm.ptrauth wrapper globals are tricky: they're always constant defs
+  // with private linkage, but the extern_weak linkage check is almost always
+  // used to check whether the global reference can be null.
+  // llvm.ptrauth references can be, if the underlying global is itself null.
+  // That's only possible if it's extern_weak: look through the initializer.
+  // llvm.ptrauth globals should be thought of as special ConstantExprs.
+  if (auto *GVB = dyn_cast<GlobalVariable>(this)) {
+    if (getSection() == "llvm.ptrauth") {
+      // While llvm.ptrauth globals must have an initializer, this code might
+      // be called early enough that they don't (in particular in LTO,
+      // via ConstantFold, before the initializer has been mapped).
+      if (!GVB->hasInitializer())
+        return true;
+      auto *Base = GVB->getInitializer()->getOperand(0);
+      APInt Offset(64, 0);
+      Base = Base->stripAndAccumulateConstantOffsets(
+          getParent()->getDataLayout(), Offset, /*AllowNonInbounds=*/true);
+      if (auto *BaseGV = dyn_cast<GlobalValue>(Base))
+        return BaseGV->hasExternalWeakLinkage();
+      return true;
+    }
+  }
+  return isExternalWeakLinkage(getLinkage());
+}
+
 std::string GlobalValue::getGlobalIdentifier(StringRef Name,
                                              GlobalValue::LinkageTypes Linkage,
                                              StringRef FileName) {
 
   // Value names may be prefixed with a binary '1' to indicate
   // that the backend should not modify the symbols due to any platform
   // naming convention. Do not include that '1' in the PGO profile name.
   if (Name[0] == '\1')

llvm/lib/IR/Verifier.cpp

 #include "llvm/IR/DebugInfoMetadata.h"
 #include "llvm/IR/DebugLoc.h"
 #include "llvm/IR/DerivedTypes.h"
 #include "llvm/IR/Dominators.h"
 #include "llvm/IR/EHPersonalities.h"
 #include "llvm/IR/Function.h"
 #include "llvm/IR/GCStrategy.h"
 #include "llvm/IR/GlobalAlias.h"
+#include "llvm/IR/GlobalPtrAuthInfo.h"
 #include "llvm/IR/GlobalValue.h"
 #include "llvm/IR/GlobalVariable.h"
 #include "llvm/IR/InlineAsm.h"
 #include "llvm/IR/InstVisitor.h"
 #include "llvm/IR/InstrTypes.h"
 #include "llvm/IR/Instruction.h"
 #include "llvm/IR/Instructions.h"
 #include "llvm/IR/IntrinsicInst.h"
if (ArrayType *ATy = dyn_cast<ArrayType>(GVType)) {
                 Twine("invalid ") + GV.getName() + " member", V);
           Check(V->hasName(),
                 Twine("members of ") + GV.getName() + " must be named", V);
         }
       }
     }
   }
 
+  if (GV.getSection() == "llvm.ptrauth") {
+    if (auto Err = GlobalPtrAuthInfo::tryAnalyze(&GV).takeError()) {
+      CheckFailed("invalid llvm.ptrauth global: " + toString(std::move(Err)),
+                  &GV);
+      return;
+    }
+  }
+
   // Visit any debug info attachments.
   SmallVector<MDNode *, 1> MDs;
   GV.getMetadata(LLVMContext::MD_dbg, MDs);
   for (auto *MD : MDs) {
     if (auto *GVE = dyn_cast<DIGlobalVariableExpression>(MD))
       visitDIGlobalVariableExpression(*GVE);
     else
       CheckDI(false, "!dbg attachment of global variable must be a "

llvm/lib/Linker/IRMover.cpp

IRLinker::linkAppendingVarProto(GlobalVariable *DstGV,
 
   return Ret;
 }
 
 bool IRLinker::shouldLink(GlobalValue *DGV, GlobalValue &SGV) {
   if (ValuesToLink.count(&SGV) || SGV.hasLocalLinkage())
     return true;
 
+  // ptrauth wrapper globals can't be prototypes.
+  if (auto *GV = dyn_cast<GlobalVariable>(&SGV))
+    if (GV->getSection() == "llvm.ptrauth")
+      return true;
+
   if (DGV && !DGV->isDeclarationForLinker())
     return false;
 
   if (SGV.isDeclaration() || DoneLinkingBodies)
     return false;
 
   // Callback to the client to give a chance to lazily add the Global to the
   // list of value to link.

llvm/lib/Transforms/IPO/ExtractGV.cpp

bool Delete = deleteStuff == (bool)Named.count(&GV) &&
                   !GV.isDeclaration() && (!GV.isConstant() || !keepConstInit);
     if (!Delete) {
       if (GV.hasAvailableExternallyLinkage())
         continue;
       if (GV.getName() == "llvm.global_ctors")
         continue;
     }
 
+    if (GV.getSection() == "llvm.ptrauth")
+      continue;
+
     makeVisible(GV, Delete);
 
     if (Delete) {
       // Make this a declaration and drop it's comdat.
       GV.setInitializer(nullptr);
       GV.setComdat(nullptr);
     }
   }

llvm/lib/Transforms/IPO/FunctionImport.cpp

 bool llvm::convertToDeclaration(GlobalValue &GV) {
   LLVM_DEBUG(dbgs() << "Converting to a declaration: `" << GV.getName()
                     << "\n");
   if (Function *F = dyn_cast<Function>(&GV)) {
     F->deleteBody();
     F->clearMetadata();
     F->setComdat(nullptr);
   } else if (GlobalVariable *V = dyn_cast<GlobalVariable>(&GV)) {
+    if (V->getSection() == "llvm.ptrauth")
+      report_fatal_error("can't convert llvm.ptrauth to declaration!");
     V->setInitializer(nullptr);
     V->setLinkage(GlobalValue::ExternalLinkage);
     V->clearMetadata();
     V->setComdat(nullptr);
   } else {
     GlobalValue *NewGV;
     if (GV.getValueType()->isFunctionTy())
       NewGV =

llvm/lib/Transforms/Instrumentation/AddressSanitizer.cpp

if (G->hasSection()) {
     // without redzones, or remove them at link time ("discard.*"), etc.
     if (CompileKernel)
       return false;
 
     StringRef Section = G->getSection();
 
     // Globals from llvm.metadata aren't emitted, do not instrument them.
     if (Section == "llvm.metadata") return false;
+    // Same for globals in llvm.ptrauth.
+    if (Section == "llvm.ptrauth")
+      return false;
     // Do not instrument globals from special LLVM sections.
     if (Section.contains("__llvm") || Section.contains("__LLVM"))
       return false;
 
     // Do not instrument function pointers to initialization and termination
     // routines: dynamic linker will not properly handle redzones.
     if (Section.startswith(".preinit_array") ||
         Section.startswith(".init_array") ||

llvm/lib/Transforms/Utils/Evaluator.cpp

 #include "llvm/Analysis/ConstantFolding.h"
 #include "llvm/IR/BasicBlock.h"
 #include "llvm/IR/Constant.h"
 #include "llvm/IR/Constants.h"
 #include "llvm/IR/DataLayout.h"
 #include "llvm/IR/DerivedTypes.h"
 #include "llvm/IR/Function.h"
 #include "llvm/IR/GlobalAlias.h"
+#include "llvm/IR/GlobalPtrAuthInfo.h"
 #include "llvm/IR/GlobalValue.h"
 #include "llvm/IR/GlobalVariable.h"
 #include "llvm/IR/InstrTypes.h"
 #include "llvm/IR/Instruction.h"
 #include "llvm/IR/Instructions.h"
 #include "llvm/IR/IntrinsicInst.h"
 #include "llvm/IR/Operator.h"
 #include "llvm/IR/Type.h"
 #include "llvm/IR/User.h"
 #include "llvm/IR/Value.h"
 #include "llvm/Support/Casting.h"
 #include "llvm/Support/Debug.h"
 #include "llvm/Support/raw_ostream.h"
 
 #define DEBUG_TYPE "evaluator"
 
 using namespace llvm;
 
 static inline bool
 isSimpleEnoughValueToCommit(Constant *C,
                             SmallPtrSetImpl<Constant *> &SimpleConstants,
                             const DataLayout &DL);
 
+static bool isPtrauthWrapperGlobal(Constant *C) {
+  return GlobalPtrAuthInfo::analyze(C).has_value();
+}
+
 /// Return true if the specified constant can be handled by the code generator.
 /// We don't want to generate something like:
 ///   void *X = &X/42;
 /// because the code generator doesn't have a relocation that can handle that.
 ///
 /// This function should be called if C was not found (but just got inserted)
 /// in SimpleConstants to avoid having to rescan the same constants all the
 /// time.
 static bool
 isSimpleEnoughValueToCommitHelper(Constant *C,
                                   SmallPtrSetImpl<Constant *> &SimpleConstants,
                                   const DataLayout &DL) {
   // Simple global addresses are supported, do not allow dllimport or
   // thread-local globals.
+  // Conservatively disallow any nested llvm.ptrauth global as well.
   if (auto *GV = dyn_cast<GlobalValue>(C))
-    return !GV->hasDLLImportStorageClass() && !GV->isThreadLocal();
+    return !GV->hasDLLImportStorageClass() && !GV->isThreadLocal() &&
+           !isPtrauthWrapperGlobal(GV);
 
   // Simple integer, undef, constant aggregate zero, etc are all supported.
   if (C->getNumOperands() == 0 || isa<BlockAddress>(C))
     return true;
 
   // Aggregate values are safe if all their elements are.
   if (isa<ConstantAggregate>(C)) {
     for (Value *Op : C->operands())
if (StoreInst *SI = dyn_cast<StoreInst>(CurInst)) {
       if (!GV || !GV->hasUniqueInitializer()) {
         LLVM_DEBUG(dbgs() << "Store is not to global with unique initializer: "
                           << *Ptr << "\n");
         return false;
       }
 
       // If this might be too difficult for the backend to handle (e.g. the addr
       // of one global variable divided by another) then we can't commit it.
+      // If it's a simple-enough top-level llvm.ptrauth global, allow it;
+      // we conservatively disallow any nested llvm.ptrauth global usage when
+      // checking the constants.  Make sure to only check the constant if
+      // it's not a ptrauth global, to avoid incorrectly caching it as
+      // simple.
       Constant *Val = getVal(SI->getOperand(0));
-      if (!isSimpleEnoughValueToCommit(Val, SimpleConstants, DL)) {
+      if (!isPtrauthWrapperGlobal(Val) &&
+          !isSimpleEnoughValueToCommit(Val, SimpleConstants, DL)) {
         LLVM_DEBUG(dbgs() << "Store value is too complex to evaluate store. "
                           << *Val << "\n");
         return false;
       }
 
       auto Res = MutatedMemory.try_emplace(GV, GV->getInitializer());
       if (!Res.first->second.write(Val, Offset, DL))
         return false;

llvm/lib/Transforms/Utils/FunctionImportUtils.cpp

void FunctionImportGlobalProcessing::processGlobalForThinLTO(GlobalValue &GV) {
   // attribute. We can't internalize them now because IRMover will fail
   // to link variable definitions to their external declarations during
   // ThinLTO import. We'll internalize read-only variables later, after
   // import is finished. See internalizeGVsAfterImport.
   //
   // If global value dead stripping is not enabled in summary then
   // propagateConstants hasn't been run. We can't internalize GV
   // in such case.
+  //
+  // Ignore llvm.ptrauth globals:
+  // - we don't need to internalize them (because they're artificial and aren't
+  //   emitted as symbols)
+  // - we can't set their initializer to 'zeroinitializer' (because the
+  //   initializer struct has to be present, because it's interpreted as a list
+  //   of ConstantExpr operands).
   if (!GV.isDeclaration() && VI && ImportIndex.withAttributePropagation()) {
     if (GlobalVariable *V = dyn_cast<GlobalVariable>(&GV)) {
       // We can have more than one local with the same GUID, in the case of
       // same-named locals in different but same-named source files that were
       // compiled in their respective directories (so the source file name
       // and resulting GUID is the same). Find the one in this module.
       // Handle the case where there is no summary found in this module. That
       // can happen in the distributed ThinLTO backend, because the index only
       // contains summaries from the source modules if they are being imported.
       // We might have a non-null VI and get here even in that case if the name
       // matches one in this module (e.g. weak or appending linkage).
       auto *GVS = dyn_cast_or_null<GlobalVarSummary>(
           ImportIndex.findSummaryInModule(VI, M.getModuleIdentifier()));
-      if (GVS &&
+      if (GVS && V->getSection() != "llvm.ptrauth" &&
           (ImportIndex.isReadOnly(GVS) || ImportIndex.isWriteOnly(GVS))) {
         V->addAttribute("thinlto-internalize");
         // Objects referenced by writeonly GV initializer should not be
         // promoted, because there is no any kind of read access to them
         // on behalf of this writeonly GV. To avoid promotion we convert
         // GV initializer to 'zeroinitializer'. This effectively drops
         // references in IR module (not in combined index), so we can
         // ignore them when computing import. We do not export references

llvm/test/Instrumentation/AddressSanitizer/do-not-instrument-ptrauth-globals.ll

+; This test checks that we are not instrumenting llvm.ptrauth globals.
+; RUN: opt < %s -passes=asan -S | FileCheck %s
+
+target datalayout = "e-m:e-i64:64-f80:128-n8:16:32:64-S128"
+target triple = "x86_64-apple-darwin"
+
+declare void @f()
+
[e-mail].42 = private constant { ptr, i32, i64, i64 } { ptr @f, i32 0, i64 0, i64 42 }, section "llvm.ptrauth"
+
+; CHECK: @f.ptrauth.ia.42 = private constant { ptr, i32, i64, i64 } { ptr @f, i32 0, i64 0, i64 42 }, section "llvm.ptrauth"

llvm/test/Transforms/GlobalOpt/evaluate-ptrauth-global.ll

+; RUN: opt -passes=globalopt %s -S -o - | FileCheck %s
+
+target datalayout = "e-m:o-i64:64-i128:128-n32:64-S128"
+target triple = "arm64e-apple-ios13"
+
+; Check that simple references to llvm.ptrauth globals get optimized into
+; constant initializers, but more complex ones don't.
+; CHECK: @llvm.global_ctors = appending global [2 x { i32, ptr, ptr }] [{ i32, ptr, ptr } { i32 65535, ptr @test_init_ptrauth_offset, ptr null }, { i32, ptr, ptr } { i32 65535, ptr @test_init_ptrauth_nested, ptr null }]
[e-mail]_ctors = appending global [3 x { i32, ptr, ptr }] [{ i32, ptr, ptr } { i32 65535, ptr @test_init_ptrauth, ptr null }, { i32, ptr, ptr } { i32 65535, ptr @test_init_ptrauth_offset, ptr null }, { i32, ptr, ptr } { i32 65535, ptr @test_init_ptrauth_nested, ptr null }]
+
[e-mail] = private constant { ptr, i32, i64, i64 } { ptr @f, i32 0, i64 0, i64 0 }, section "llvm.ptrauth", align 8
+
+; CHECK: @fp = local_unnamed_addr global ptr @f.ptrauth, align 8
+@fp = global ptr null, align 8
+
+; CHECK-NOT: @test_init_ptrauth
+define internal void @test_init_ptrauth() {
+  store ptr @f.ptrauth, ptr @fp, align 8
+  ret void
+}
+
+; CHECK: @fp_offset = local_unnamed_addr global ptr null, align 8
+@fp_offset = global ptr null, align 8
+
+; CHECK: @fp_nested = local_unnamed_addr global ptr null, align 8
+@fp_nested = global ptr null, align 8
+
+; CHECK: @fp_nested_offset = local_unnamed_addr global ptr null, align 8
+@fp_nested_offset = global ptr null, align 8
+
+; CHECK: define internal void @test_init_ptrauth_offset()
+; CHECK:   store ptr getelementptr inbounds (i8, ptr @f.ptrauth, i64 1), ptr @fp_offset, align 8
+define internal void @test_init_ptrauth_offset() {
+  store ptr getelementptr inbounds (i8, ptr @f.ptrauth, i64 1), ptr @fp_offset, align 8
+  ret void
+}
+
+; CHECK: define internal void @test_init_ptrauth_nested()
+; CHECK:   store ptr @f.ptrauth, ptr @fp_nested, align 8
+; CHECK:   store ptr getelementptr inbounds (i8, ptr @f.ptrauth, i64 1), ptr @fp_nested_offset, align 8
+define internal void @test_init_ptrauth_nested() {
+  store ptr @f.ptrauth, ptr @fp_nested, align 8
+  store ptr getelementptr inbounds (i8, ptr @f.ptrauth, i64 1), ptr @fp_nested_offset, align 8
+  ret void
+}
+
+declare void @f()

llvm/test/Transforms/InstSimplify/ptrauth-global-compare.ll

+; NOTE: Assertions have been autogenerated by utils/update_test_checks.py
+; RUN: opt < %s -passes=instsimplify -S | FileCheck %s
+
+; Basic global variable
+
+@g = external global i32
[e-mail] = private constant { ptr, i32, i64, i64 } { ptr @g, i32 2, i64 0, i64 0 }, section "llvm.ptrauth"
+
+define i1 @test_external_global() {
+; CHECK-LABEL: @test_external_global(
+; CHECK-NEXT:    ret i1 false
+;
+  %tmp0 = icmp eq ptr @g.ptrauth, null
+  ret i1 %tmp0
+}
+
+; Address discrimination
+
[e-mail] = private constant { ptr, i32, i64, i64 } { ptr getelementptr (i64, ptr @g, i64 16), i32 2, i64 ptrtoint (ptr @g_addr_ref to i64), i64 42 }, section "llvm.ptrauth"
+
+@g_addr_ref = constant ptr @g.ptrauth.addr
+
+define i1 @test_external_global_addrdisc() {
+; CHECK-LABEL: @test_external_global_addrdisc(
+; CHECK-NEXT:    ret i1 false
+;
+  %tmp0 = icmp eq ptr @g.ptrauth.addr, null
+  ret i1 %tmp0
+}
+
+; extern_weak global variable
+
+@g_weak = extern_weak global i32
+@g_weak.ptrauth = private constant { ptr, i32, i64, i64 } { ptr @g_weak, i32 2, i64 0, i64 0 }, section "llvm.ptrauth"
+
+define i1 @test_extern_weak_global() {
+; CHECK-LABEL: @test_extern_weak_global(
+; CHECK-NEXT:    ret i1 icmp eq (ptr @g_weak.ptrauth, ptr null)
+;
+  %tmp0 = icmp eq ptr @g_weak.ptrauth, null
+  ret i1 %tmp0
+}
+
+; Integer constant
+
[e-mail] = private constant { ptr, i32, i64, i64 } { ptr inttoptr (i64 0 to ptr), i32 0, i64 0, i64 42 }, section "llvm.ptrauth"
+
+define i1 @test_constantint() {
+; CHECK-LABEL: @test_constantint(
+; CHECK-NEXT:    ret i1 icmp eq (ptr @two.ptrauth, ptr null)
+;
+  %tmp0 = icmp eq ptr @two.ptrauth, null
+  ret i1 %tmp0
+}

llvm/test/Verifier/ptrauth-global.ll

+; RUN: not opt -S -passes=verify < %s 2>&1 | FileCheck %s
+
+; CHECK: invalid llvm.ptrauth global: global doesn't have an initializer
+@no_init = external global { ptr, i32, i64, i64 }, section "llvm.ptrauth"
+
+; CHECK: invalid llvm.ptrauth global: global isn't a struct
+@not_struct = constant ptr null, section "llvm.ptrauth"
+
+; CHECK: invalid llvm.ptrauth global: global doesn't have type '{ ptr, i32, i64, i64 }'
+@bad_type = constant { ptr, i32, i32, i32 } zeroinitializer, section "llvm.ptrauth"
+
+; CHECK: invalid llvm.ptrauth global: key isn't a constant integer
+@bad_key = constant { ptr, i32, i64, i64 } { ptr null, i32 ptrtoint (ptr @g to i32), i64 0, i64 0}, section "llvm.ptrauth"
+
+; CHECK: invalid llvm.ptrauth global: discriminator isn't a constant integer
+@bad_disc = constant { ptr, i32, i64, i64 } { ptr null, i32 0, i64 0, i64 ptrtoint (ptr @g to i64)}, section "llvm.ptrauth"
+
+; CHECK-NOT: invalid
+@valid = private constant { ptr, i32, i64, i64 } { ptr getelementptr inbounds (i8, ptr @g, i64 2), i32 3, i64 0, i64 0 }, section "llvm.ptrauth"
+
+@g = external global i32

llvm/test/tools/llvm-extract/extract-ptrauth.ll

+; RUN: llvm-extract -S -func test_fn %s | FileCheck %s
+
+@test_gv = external global i32
+@test_gv.ptrauth = private constant { ptr, i32, i64, i64 } { ptr @test_gv, i32 2, i64 0, i64 0 }, section "llvm.ptrauth"
+
+; CHECK: @test_gv = external global i32
+; CHECK: @test_gv.ptrauth = private constant { ptr, i32, i64, i64 } { ptr @test_gv, i32 2, i64 0, i64 0 }, section "llvm.ptrauth"
+
+define ptr @test_fn() {
+  ret ptr @test_gv.ptrauth
+}

llvm/tools/bugpoint/ExtractFunction.cpp

 }
 
 //
 // DeleteGlobalInitializer - "Remove" the global variable by deleting its
 // initializer,
 // making it external.
 //
 void llvm::DeleteGlobalInitializer(GlobalVariable *GV) {
+  if (GV->getSection() == "llvm.ptrauth")
+    return;
   eliminateAliases(GV);
   GV->setInitializer(nullptr);
   GV->setComdat(nullptr);
 }
 
 // DeleteFunctionBody - "Remove" the function by deleting all of its basic
 // blocks, making it external.
 //