[lld-macho] add code signature for native arm64 macOS

[gkm]

Summary

ARM64 macOS requires that a program have an ad hoc signature, otherwise the system will immediately reject it.

[int3]

hm is this that much more convenient than invoking codesign after LLD finishes running in whatever build we're testing?

[thakis]

I think codesign -s also doesn't set the magic "codesigned by linker" bit that makes strip etc work better (and if doesn't work in cross builds from non-mac hosts). I kind of agree that putting this in as is isn't super useful.

(Don't know if you've seen it, but golang has a from scratch impl of this for 1.16 -- and there's ld64 too of course.)

[gkm]

In D96164#2546549, @int3 wrote:

hm is this that much more convenient than invoking codesign after LLD finishes running in whatever build we're testing?

ld64 signs automatically. Config & build systems of all kinds assume that linked programs are runnable. On arm64 macOS, if lld doesn't sign, then programs don't run without explicit codesign -s - ..., and every config & build system needs to be taught that. No thank you.

In D96164#2546586, @thakis wrote:

I think codesign -s also doesn't set the magic "codesigned by linker" bit that makes strip etc work better (and if doesn't work in cross builds from non-mac hosts). I kind of agree that putting this in as is isn't super useful.

FYI, it is super useful for testing self-hosted native arm64 macOS builds of LLVM and other packages (e.g., GNU coreutils). If you don't want it committed to LLVM, that's fine with me. I have been using it productively as a local change and others who want to work on native arm64 macOS can place it at the base of their local diff stacks too.

(Don't know if you've seen it, but golang has a from scratch impl of this for 1.16 -- and there's ld64 too of course.)

I briefly looked at ld64-530 (the most recent Apple code drop), and could not find any code that generates LC_CODE_SIGNATURE. I will look harder this weekend.

[tschuett]

https://go-review.googlesource.com/c/scratch/+/271866/5/cherry/codesign.go

https://go-review.googlesource.com/c/go/+/272256/

[gkm]

In order to perform ad-hoc codesign, I will need to compute sha256 of the program's pages. I see no other part of LLVM that uses a sha256 library. What library should I use?

[tschuett]

Some cmake magic to look for OpenSSL? If you can't find it, give a warning and disable code-signing?

"strip and install_name_tool are aware that what they do will invalidate a code signature, so if they’re operating on a linker-signed Mach-O file, they’ll generate a new linker-signed signature."
https://github.com/golang/go/issues/42684#issuecomment-731594886

The code-signing functionality has to end up being in LLVM eventually for llvm-install-name-tool?

[thakis]

In D96164#2547158, @gkm wrote:

In order to perform ad-hoc codesign, I will need to compute sha256 of the program's pages. I see no other part of LLVM that uses a sha256 library. What library should I use?

LLVM tries to not depend on external libraries if possible. Given that sha256 isn't that much code (https://golang.org/src/crypto/sha256/), just adding a fresh implementation of it (to lld/MachO for now) is probably the way to go.

[smeenai]

In D96164#2547390, @thakis wrote:

In D96164#2547158, @gkm wrote:

In order to perform ad-hoc codesign, I will need to compute sha256 of the program's pages. I see no other part of LLVM that uses a sha256 library. What library should I use?

LLVM tries to not depend on external libraries if possible. Given that sha256 isn't that much code (https://golang.org/src/crypto/sha256/), just adding a fresh implementation of it (to lld/MachO for now) is probably the way to go.

Agreed. There's some prior art here too ... LLVM has a SHA1 implementation in llvm/include/llvm/Support/SHA1.h and llvm/lib/Support/SHA1.cpp. That was adapted from an existing public-domain implementation, and we could do the same here (find a SHA256 implementation with a license that allows it to copied into LLVM).

[gkm]

df>>! In D96164#2547480, @smeenai wrote:

In D96164#2547390, @thakis wrote:

LLVM tries to not depend on external libraries if possible. Given that sha256 isn't that much code (https://golang.org/src/crypto/sha256/), just adding a fresh implementation of it (to lld/MachO for now) is probably the way to go.

Agreed. There's some prior art here too ... LLVM has a SHA1 implementation in llvm/include/llvm/Support/SHA1.h and llvm/lib/Support/SHA1.cpp. That was adapted from an existing public-domain implementation, and we could do the same here (find a SHA256 implementation with a license that allows it to copied into LLVM).

Openssl has a C implementation of sha256 with Apache 2.0 license. Unless someone knows of a better candidate, I'll go with that.

[cynecx]

This comment was removed by cynecx.

[cynecx]

Perhaps this might help: SHA256 impl for LLVM. This is based on botan's sha256 implementation and mimics the current SHA1 api design. It should be compatible with LLVM's license since it's based on botan's implementation, which is BSD-2 licensed.

[gkm]

In D96164#2546586, @thakis wrote:

I think codesign -s also doesn't set the magic "codesigned by linker" bit that makes strip etc work better (and if doesn't work in cross builds from non-mac hosts). I kind of agree that putting this in as is isn't super useful.

Where can I learn about thsi magic "codesigned by linker" bit? My searches are coming-up dry.

[kristof.beyls]

In D96164#2547858, @gkm wrote:

df>>! In D96164#2547480, @smeenai wrote:

In D96164#2547390, @thakis wrote:

LLVM tries to not depend on external libraries if possible. Given that sha256 isn't that much code (https://golang.org/src/crypto/sha256/), just adding a fresh implementation of it (to lld/MachO for now) is probably the way to go.

Agreed. There's some prior art here too ... LLVM has a SHA1 implementation in llvm/include/llvm/Support/SHA1.h and llvm/lib/Support/SHA1.cpp. That was adapted from an existing public-domain implementation, and we could do the same here (find a SHA256 implementation with a license that allows it to copied into LLVM).

Openssl has a C implementation of sha256 with Apache 2.0 license. Unless someone knows of a better candidate, I'll go with that.

I'm afraid that just copying an Apache-2.0 licensed implementation is not an option.

As described at https://llvm.org/docs/DeveloperPolicy.html#relicensing, "....In the interim, all contributions to the project will be made under the terms of both the new license and the legacy license scheme...", so code contributions must be covered by both the new and legacy license scheme.
The SPDX identifier for the new license is "Apache-2.0 WITH LLVM-exception"; for the legacy license it is "NCSA".

Therefore, just copying code that is covered by an Apache-2.0 license into the LLVM code base is not an option I'm afraid.
Apache-2.0 is a different license to "Apache-2.0 with LLVM exception" and to "NCSA".
I guess the most obvious options to get a sha256 implementation into the code base are:

1. get the copyright holder of an existing implementation to contribute it to LLVM, under both the "Apache-2.0 WITH LLVM-exception" and "NCSA" license.
2. write an implementation from scratch and contribute that.

[gkm]

In D96164#2555222, @cynecx wrote:

Perhaps this might help: SHA256 impl for LLVM. This is based on botan's sha256 implementation and mimics the current SHA1 api design. It should be compatible with LLVM's license since it's based on botan's implementation, which is BSD-2 licensed.

This is super helpful! Is it ready to import into LLVM as-is alongside SHA1 ?

[cynecx]

@gkm Is it okay for you if I post a patch which adds a SHA-256 implementation to LLVM? I actually have a patchset ready here. But to answer your question, yes it should be possible to simply drop the files into the right locations.

[cynecx]

@gkm Re: the linker flag. I think they were talking about this (linkerSigned):

	cdir := CodeDirectory{
		magic:        CSMAGIC_CODEDIRECTORY,
		length:       uint32(sz) - uint32(unsafe.Sizeof(SuperBlob{})+unsafe.Sizeof(Blob{})),
		version:      0x20400,
		flags:        0x20002, // adhoc | linkerSigned (0b10)
		hashOffset:   uint32(hashOff),
		identOffset:  uint32(idOff),
		nCodeSlots:   uint32(nhashes),
		codeLimit:    uint32(sigOff),
		hashSize:     sha256.Size,
		hashType:     kSecCodeSignatureHashSHA256,
		pageSize:     uint8(pageSizeBits),
		execSegBase:  textSeg.Offset,
		execSegLimit: textSeg.Filesz,
	}

https://go-review.googlesource.com/c/scratch/+/271866/5/cherry/codesign.go#293

[tschuett]

flags:        0x20002, // adhoc | linkerSigned (0b10)

from cs_blobs.h

#define CS_ADHOC                    0x00000002  /* ad hoc signed */
#define CS_LINKER_SIGNED            0x00020000  /* Automatically signed by the linker */

[cynecx]

SHA256 patch is up here: https://reviews.llvm.org/D96540.

[gkm]

• drop the fork+exec of /usr/bin/codesign and rewrite in C++

[gkm]

• remove SHA256, which is added separately in D96540

[tschuett]

lld/MachO/SyntheticSections.cpp

925

Would it help readability to change this to:
CS_ADHOC | CS_LINKER_SIGNED ?

[tschuett]

Does codesign.go make any differences?

[cynecx]

Hmm, this is indeed very weird. I have seen "similar" behavior with codesign. codesign can actually fail. The only way to "get it working" again is to copy the file and codesign the copy, then replacing the original file (a different inode fixes codesigning).

Does the segfault happen with each linking step?

[gkm]

In D96164#2562426, @cynecx wrote:

Hmm, this is indeed very weird. I have seen "similar" behavior with codesign. codesign can actually fail. The only way to "get it working" again is to copy the file and codesign the copy, then replacing the original file (a different inode fixes codesigning).

Does the segfault happen with each linking step?

Not a segfault. SIGKILL, presumably dyld doing kill(0, SIGKILL) though I haven't yet run it under lldb to confirm.

[gkm]

In D96164#2562311, @tschuett wrote:

Does codesign.go make any differences?

I haven't tried, but I expect it would work. Resigning with /usr/bin/codesign works. Heck, just copying the binary causes it to work!

lld/MachO/SyntheticSections.cpp

925

Those are good things. I intend to find & import headers with those enums.

[thakis]

Re the copy stuff: See the CL desc and openradar link in https://reviews.llvm.org/rGba3bc2fd41b8428904fc779e353d3769074d8982

[gkm]

In D96164#2562655, @thakis wrote:

Re the copy stuff: See the CL desc and openradar link in https://reviews.llvm.org/rGba3bc2fd41b8428904fc779e353d3769074d8982

That is good to know. This case differs: LLD is not overwriting an existing file, so is not reusing an vnode.

There is something funky in FileOutputBuffer, which creates the LLD output file via mmap(2). When I force it to avoid mmap, all is well. For now, I will work-around by passing the flag F_no_mmap when signing.

[gkm]

In D96164#2562701, @gkm wrote:

In D96164#2562655, @thakis wrote:

Re the copy stuff: See the CL desc and openradar link in https://reviews.llvm.org/rGba3bc2fd41b8428904fc779e353d3769074d8982

That is good to know. This case differs: LLD is not overwriting an existing file, so is not reusing an vnode. There is something funky in FileOutputBuffer, which creates the LLD output file via mmap(2).

Travis Hill <[e-mail]> fed me the answer. The Go peeps had the same problem: https://go-review.googlesource.com/c/go/+/272258
The Darwin kernel caches signature verification results by vnode. mmap(2) creates the cache entry, before we have written anything to the output. The fix is to invalidate the cache after writing via msync(..., MS_INVALIDATE);

[gkm]

• Invalidate signature-verification cache after writing hashes.
• replace CodeSigningTypes.h with augmented cs_blobs.h
• use appropriate constant symbols from cs_blobs.h rather than magic integers

[thakis]

In D96164#2562720, @gkm wrote:

In D96164#2562701, @gkm wrote:

In D96164#2562655, @thakis wrote:

Re the copy stuff: See the CL desc and openradar link in https://reviews.llvm.org/rGba3bc2fd41b8428904fc779e353d3769074d8982

That is good to know. This case differs: LLD is not overwriting an existing file, so is not reusing an vnode. There is something funky in FileOutputBuffer, which creates the LLD output file via mmap(2).

Travis Hill <[e-mail]> fed me the answer. The Go peeps had the same problem: https://go-review.googlesource.com/c/go/+/272258
The Darwin kernel caches signature verification results by vnode. mmap(2) creates the cache entry, before we have written anything to the output. The fix is to invalidate the cache after writing via msync(..., MS_INVALIDATE);

Ah, the mmap one is https://openradar.appspot.com/FB8914231 :)

[gkm]

I could use some advice regarding import of the the Apple C (not C++) header cs_blobs.h:

• Some struct decls contain zero-length array members as offset markers. These are invalid C++, and LLD doesn't need them.
• Some struct decls contain flexible array members. These are invalid C++, and LLD doesn't need them.
• Some flag bit sets are specified via sequences of #define. LLVM prefers enum.
• All struct decls have __attribute__((aligned(1))). LLD does not need or want these.
• Struct definition pattern is typedef struct __TAG { ... } NAME; C++ prefers struct NAME { ... };
• The linter complains about case style for struct names.

Questions:

• Should we make minimal edits to get proper compilation & semantics and leave all the other warts as-is?
• Or, should we be boldly invasive and make it conform to C++ and LLVM style, silencing the linter?
• What is best practice regarding header imports that require surgery? It seems wise to import the unaltered Apple header first via a preparatory commit (without a diff? unreviewed?), and then commit this diff with the changes to make it conform to C++ & LLVM style.

[tschuett]

Feel free to ignore me, but:
https://github.com/llvm/llvm-project/blob/main/llvm/include/llvm/BinaryFormat/MachO.h
seems to be inspired by the Apple headers. It is not a one-to-one copy.

[gkm]

In D96164#2563794, @tschuett wrote:

https://github.com/llvm/llvm-project/blob/main/llvm/include/llvm/BinaryFormat/MachO.h
seems to be inspired by the Apple headers. It is not a one-to-one copy.

This seems like a good option to me: don't import cs_blobs.h at all, but rather adapt & append the necessary codesigning definitions to existing llvm/include/llvm/BinaryFormat/MachO.h.

[thakis]

• What is best practice regarding header imports that require surgery? It seems wise to import the unaltered Apple header first via a preparatory commit (without a diff? unreviewed?), and then commit this diff with the changes to make it conform to C++ & LLVM style.

There are currently 0 hits for APPLE_LICENSE_HEADER in llvm's codebase. I'm guessing that's not a coincidence :)

[gkm]

• import code signing structs & enums into llvm/include/llvm/BinaryFormat/MachO.h

[cynecx]

lld/MachO/SyntheticSections.h

490

constexpr?

492

Since we are currently hard-wiring sha256, we should just use the appropriate constant here.

llvm/include/llvm/BinaryFormat/MachO.h

2151 ↗

(On Diff #324048)

Can we add some static_asserts for these structs to ensure that they have the correct size? (In case the compiler does weird things)

[cynecx]

lld/MachO/SyntheticSections.h

492

Oh crap. The constant is actually private. Nvm then. Perhaps add a comment then?

[gkm]

lld/MachO/SyntheticSections.h

492

SHA256::HASH_LENGTH is defined as 20, which is 160 bits. I am confused.

[cynecx]

lld/MachO/SyntheticSections.h

492

No? See https://github.com/llvm/llvm-project/blob/9fa11201618d8ad3a978815d90d3e64d8e0fa310/llvm/include/llvm/Support/SHA256.h#L65

[gkm]

lld/MachO/SyntheticSections.h

492

Better. I had a stale version of SHA256.cpp loaded in emacs. No clue where that came from.

[gkm]

lld/MachO/SyntheticSections.h

490

Comments elsewhere say that static constexpr members are broken in MSC, so I avoided them.

[cynecx]

lld/MachO/SyntheticSections.h

490

I think those comments are outdated because according to https://llvm.org/docs/GettingStarted.html#host-c-toolchain-both-compiler-and-standard-library, llvm requires >= Visual Studio 2017, which iirc properly supports constexpr. Also there are many places where llvm code utilizes "static constexpr".

[gkm]

• revise according to review feedback

[int3]

lgtm, will like @cynecx sign off

lld/MachO/SyntheticSections.cpp

880

FWIW, StringRef::size() is O(1), so storing it isn't really necessary. But if you did this because it looks more uniform, that's fine too

908–910

would be good to link to https://openradar.appspot.com/FB8914231

915

I think we already included this namespace at the top of the file

941

JFYI, there are several other places in the code that assume that the mmap'ed buf is initialized to all zeroes. I couldn't find any docs that guarantee that behavior, but it seems to work in practice. That said it doesn't hurt to be explicit

lld/MachO/Writer.cpp

788–792

is this necessary? I don't think hashing a few extra zero bytes makes a difference

[gkm]

• revise according to review feedback

[gkm]

• set version as ... s/0x20400/CS_SUPPORTSEXECSEG/

[int3]

lld/MachO/Writer.cpp

788–792

this doesn't seem done

[gkm]

lld/MachO/Writer.cpp

788–792

Yes. codeEnd abuts the code-signature header, which is not hashed. "A few extra bytes" are significant, whether zero or not, and influence the hash. We stop hashing at codeEnd in order to honor the contract between signer and runtime.

788–792

Oh, sorry. I was confused. This is for UUID, not code-signature. I am playing it safe here: only compute UUID for the image as it is before code signature is added.

How do you prefer I handle this?

[cynecx]

lld/MachO/Writer.cpp

788–792

Isn't codesign doing the exact same thing? So, I guess the current approach is alright.

[gkm]

I won't complain if someone accepts the diff! ;)

lld/MachO/Writer.cpp

788–792

The mechanisms are similar:

• LC_UUID has a minimal header and signs with md5
• LC_CODE_SIGNATURE has a more elaborate header and signs with sha256

The precise use(s) of the UUID is unclear to me, due to lack of documentation. As best I can tell, it is used as a unique identifier for program & library content, i.e., it morphs with every code change. I do not see it used to verify content.

[int3]

lld/MachO/Writer.cpp

788–792

@gkm you forgot to hit submit the first time you replied ;)

yeah the UUID is just used to match .dSYM files with their corresponding executables. It doesn't matter what the value is, or how it's computed, as long as it's deterministic. So I think it's fine to just hash the whole buffer, including the unwritten codesign bits.

[gkm]

• revise according to review feedback

[gkm]

• wrap #if defined(__APPLE__) around <sys/mman.h> and msync()

[int3]

lgtm

[gkm]

• expand some comments, improve some alignment expressions

[gkm]

• final alignment & comment tweaks

[thakis]

Did this land without any tests?

[smeenai]

In D96164#2605092, @thakis wrote:

Did this land without any tests?

Yes, this was an oversight. Thanks for adding a test in D97994.

lld/MachO/CodeSigningTypes.h

+/* -*- mode: C++; c-basic-offset: 4; indent-tabs-mode: nil -*-
+ *
+ * Copyright (c) 2015 Apple Inc. All rights reserved.
+ *
+ * @APPLE_LICENSE_HEADER_START@
+ *
+ * This file contains Original Code and/or Modifications of Original Code
+ * as defined in and that are subject to the Apple Public Source License
+ * Version 2.0 (the 'License'). You may not use this file except in
+ * compliance with the License. Please obtain a copy of the License at
+ * http://www.opensource.apple.com/apsl/ and read it before using this
+ * file.
+ *
+ * The Original Code and all software distributed under the License are
+ * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
+ * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
+ * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
+ * Please see the License for the specific language governing rights and
+ * limitations under the License.
+ *
+ * @APPLE_LICENSE_HEADER_END@
+ */
+
+#ifndef _CODE_SIGNING_TYPES_
+#define _CODE_SIGNING_TYPES_
+
+#include <stddef.h>
+#include <stdint.h>
+
+//
+// Magic numbers used by Code Signing
+//
+enum {
+  CSMAGIC_REQUIREMENT = 0xfade0c00, // single Requirement blob
+  CSMAGIC_REQUIREMENTS =
+      0xfade0c01, // Requirements vector (internal requirements)
+  CSMAGIC_CODEDIRECTORY = 0xfade0c02,      // CodeDirectory blob
+  CSMAGIC_EMBEDDED_SIGNATURE = 0xfade0cc0, // embedded form of signature data
+  CSMAGIC_DETACHED_SIGNATURE =
+      0xfade0cc1, // multi-arch collection of embedded signatures
+  CSMAGIC_BLOBWRAPPER = 0xfade0b01, // used for the cms blob
+};
+
+enum {
+  CS_PAGE_SIZE_4K = 4096,
+  CS_PAGE_SIZE_16K = 16384,
+
+  CS_HASHTYPE_SHA1 = 1,
+  CS_HASHTYPE_SHA256 = 2,
+  CS_HASHTYPE_SHA256_TRUNCATED = 3,
+  CS_HASHTYPE_SHA384 = 4,
+
+  CS_HASH_SIZE_SHA1 = 20,
+  CS_HASH_SIZE_SHA256 = 32,
+  CS_HASH_SIZE_SHA256_TRUNCATED = 20,
+
+  CSSLOT_CODEDIRECTORY = 0,
+  CSSLOT_INFOSLOT = 1,
+  CSSLOT_REQUIREMENTS = 2,
+  CSSLOT_RESOURCEDIR = 3,
+  CSSLOT_APPLICATION = 4,
+  CSSLOT_ENTITLEMENTS = 5,
+  CSSLOT_ALTERNATE_CODEDIRECTORIES = 0x1000,
+  CSSLOT_ALTERNATE_CODEDIRECTORY_MAX = 5,
+  CSSLOT_ALTERNATE_CODEDIRECTORY_LIMIT =
+      CSSLOT_ALTERNATE_CODEDIRECTORIES + CSSLOT_ALTERNATE_CODEDIRECTORY_MAX,
+  CSSLOT_CMS_SIGNATURE = 0x10000,
+
+  kSecCodeSignatureAdhoc = 2
+};
+
+enum {
+  CS_REQUIRE_LV = 0x0002000 // require library validation
+};
+
+//
+// Structure of a SuperBlob
+//
+struct CS_BlobIndex {
+  uint32_t type;   // type of entry
+  uint32_t offset; // offset of entry
+};
+
+struct CS_SuperBlob {
+  uint32_t magic;  // magic number
+  uint32_t length; // total length of SuperBlob
+  uint32_t count;  // number of index entries following
+                   // CS_BlobIndex index[];           // (count) entries
+  // followed by Blobs in no particular order as indicated by offsets in index
+};
+
+//
+// C form of a CodeDirectory.
+//
+struct CS_CodeDirectory {
+  uint32_t magic;         // magic number (CSMAGIC_CODEDIRECTORY) */
+  uint32_t length;        // total length of CodeDirectory blob
+  uint32_t version;       // compatibility version
+  uint32_t flags;         // setup and mode flags
+  uint32_t hashOffset;    // offset of hash slot element at index zero
+  uint32_t identOffset;   // offset of identifier string
+  uint32_t nSpecialSlots; // number of special hash slots
+  uint32_t nCodeSlots;    // number of ordinary (code) hash slots
+  uint32_t codeLimit;     // limit to main image signature range
+  uint8_t hashSize;       // size of each hash in bytes
+  uint8_t hashType;       // type of hash (cdHashType* constants)
+  uint8_t platform;       // platform identifier; zero if not platform binary
+  uint8_t pageSize;       // log2(page size in bytes); 0 => infinite
+  uint32_t spare2;        // unused (must be zero)
+
+  // char end_earliest[0];
+
+  /* Version 0x20100 */
+  uint32_t scatterOffset; /* offset of optional scatter vector */
+  // char end_withScatter[0];
+
+  /* Version 0x20200 */
+  uint32_t teamOffset; /* offset of optional team identifier */
+  // char end_withTeam[0];
+
+  /* Version 0x20300 */
+  uint32_t spare3;      /* unused (must be zero) */
+  uint64_t codeLimit64; /* limit to main image signature range, 64 bits */
+  // char end_withCodeLimit64[0];
+
+  /* Version 0x20400 */
+  uint64_t execSegBase;  /* offset of executable segment */
+  uint64_t execSegLimit; /* limit of executable segment */
+  uint64_t execSegFlags; /* exec segment flags */
+                         // char end_withExecSeg[0];
+
+  /* followed by dynamic content as located by offset fields above */
+};
+
+struct CS_Blob {
+  uint32_t magic;  // magic number
+  uint32_t length; // total length of blob
+};
+
+struct CS_RequirementsBlob {
+  uint32_t magic;  // magic number
+  uint32_t length; // total length of blob
+  uint32_t data;   // zero for dyld shared cache
+};
+
+struct CS_Scatter {
+  uint32_t count;        // number of pages; zero for sentinel (only)
+  uint32_t base;         // first page number
+  uint64_t targetOffset; // byte offset in target
+  uint64_t spare;        // reserved (must be zero)
+};
+
+#endif // _CODE_SIGNING_TYPES_

lld/MachO/OutputSegment.h

void sortOutputSections(
       llvm::function_ref<bool(OutputSection *, OutputSection *)> comparator) {
     llvm::stable_sort(sections, comparator);
   }
 
   const std::vector<OutputSection *> &getSections() const { return sections; }
   size_t numNonHiddenSections() const;
 
   uint64_t fileOff = 0;
+  uint64_t fileSize = 0;
   StringRef name;
   uint32_t maxProt = 0;
   uint32_t initProt = 0;
   uint8_t index;
 
 private:
   std::vector<OutputSection *> sections;
 };

lld/MachO/SyntheticSections.h

 //===- SyntheticSections.h -------------------------------------*- C++ -*-===//
 //
 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
 // See https://llvm.org/LICENSE.txt for license information.
 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
 //
 //===----------------------------------------------------------------------===//
 
 #ifndef LLD_MACHO_SYNTHETIC_SECTIONS_H
 #define LLD_MACHO_SYNTHETIC_SECTIONS_H
 
+#include "CodeSigningTypes.h"
 #include "Config.h"
 #include "ExportTrie.h"
 #include "InputSection.h"
 #include "OutputSection.h"
 #include "OutputSegment.h"
 #include "Target.h"
 
 #include "llvm/ADT/PointerUnion.h"

 constexpr const char rebase[] = "__rebase";
 constexpr const char binding[] = "__binding";
 constexpr const char weakBinding[] = "__weak_binding";
 constexpr const char lazyBinding[] = "__lazy_binding";
 constexpr const char export_[] = "__export";
 constexpr const char symbolTable[] = "__symbol_table";
 constexpr const char indirectSymbolTable[] = "__ind_sym_tab";
 constexpr const char stringTable[] = "__string_table";
+constexpr const char codeSignature[] = "__code_signature";
 constexpr const char got[] = "__got";
 constexpr const char threadPtrs[] = "__thread_ptrs";
 constexpr const char unwindInfo[] = "__unwind_info";
 // these are not synthetic, but in service of synthetic __unwind_info
 constexpr const char compactUnwind[] = "__compact_unwind";
 constexpr const char ehFrame[] = "__eh_frame";
 // these are not synthetic, but need to be sorted
 constexpr const char text[] = "__text";
public:
 
   // codesign (or more specifically libstuff) checks that each section in
   // __LINKEDIT ends where the next one starts -- no gaps are permitted. We
   // therefore align every section's start and end points to WordSize.
   //
   // NOTE: This assumes that the extra bytes required for alignment can be
   // zero-valued bytes.
   uint64_t getSize() const override final {
-    return llvm::alignTo(getRawSize(), WordSize);
+    return llvm::alignTo(getRawSize(), align);
   }
 };
 
 // The header of the Mach-O file, which must have a file offset of zero.
 class MachHeaderSection : public SyntheticSection {
 public:
   MachHeaderSection();
   void addLoadCommand(LoadCommand *);
public:
   uint32_t getNumSymbols() const;
   uint64_t getRawSize() const override {
     return getNumSymbols() * sizeof(uint32_t);
   }
   bool isNeeded() const override;
   void writeTo(uint8_t *buf) const override;
 };
 
+// The code signature comes at the very end of the linked output file.
+class CodeSignatureSection : public LinkEditSection {
+public:
+  const uint8_t blockSizeShift = 12;
+  const ssize_t blockSize = (1 << blockSizeShift); // 4 KiB
+  const size_t hashSize = 256 / 8;
+  const uint32_t blobHeadersSize = sizeof(CS_SuperBlob) + sizeof(CS_BlobIndex);
+  const uint32_t fixedHeadersSize = blobHeadersSize + sizeof(CS_CodeDirectory);
+
+  uint32_t fileNameSize = 0;
+  uint32_t fileNamePad = 0;
+  uint32_t allHeadersSize = 0;
+  StringRef fileName;
+
+  CodeSignatureSection();
+  uint64_t getRawSize() const override;
+  bool isNeeded() const override { return true; }
+  void writeTo(uint8_t *buf) const override;
+  uint32_t getBlockCount() const;
+  void writeHashes(uint8_t *buf) const;
+};
+
 struct InStruct {
   MachHeaderSection *header = nullptr;
   RebaseSection *rebase = nullptr;
   BindingSection *binding = nullptr;
   WeakBindingSection *weakBinding = nullptr;
   LazyBindingSection *lazyBinding = nullptr;
   ExportSection *exports = nullptr;
   GotSection *got = nullptr;

lld/MachO/SyntheticSections.cpp

 
 #include "lld/Common/ErrorHandler.h"
 #include "lld/Common/Memory.h"
 #include "llvm/ADT/STLExtras.h"
 #include "llvm/Support/EndianStream.h"
 #include "llvm/Support/FileSystem.h"
 #include "llvm/Support/LEB128.h"
 #include "llvm/Support/Path.h"
+#include "llvm/Support/SHA256.h"
 
 using namespace llvm;
 using namespace llvm::support;
 using namespace llvm::support::endian;
 using namespace lld;
 using namespace lld::macho;
 
 InStruct macho::in;

 
 void StringTableSection::writeTo(uint8_t *buf) const {
   uint32_t off = 0;
   for (StringRef str : strings) {
     memcpy(buf + off, str.data(), str.size());
     off += str.size() + 1; // account for null terminator
   }
 }
+
+CodeSignatureSection::CodeSignatureSection()
+    : LinkEditSection(segment_names::linkEdit, section_names::codeSignature) {
+  align = 16; // required by libstuff
+  fileName = config->outputFile;
+  size_t slashIndex = fileName.rfind("/");
+  if (slashIndex != std::string::npos)
+    fileName = fileName.drop_front(slashIndex + 1);
+  fileNameSize = fileName.size();
+  allHeadersSize = alignTo(fixedHeadersSize + fileNameSize + 1, WordSize);
+  fileNamePad = allHeadersSize - fixedHeadersSize - fileNameSize;
+}
+
+uint32_t CodeSignatureSection::getBlockCount() const {
+  return (fileOff + blockSize - 1) / blockSize;
+}
+
+uint64_t CodeSignatureSection::getRawSize() const {
+  return allHeadersSize + getBlockCount() * hashSize;
+}
+
+void CodeSignatureSection::writeHashes(uint8_t *buf) const {
+  uint8_t *codeEnd = buf + fileOff;
+  uint8_t *hashes = codeEnd + allHeadersSize;
+  while (buf < codeEnd) {
+    StringRef block(reinterpret_cast<char *>(buf),
+                    std::min(codeEnd - buf, blockSize));
+    SHA256 Hasher;
+    Hasher.update(block);
+    StringRef hash = Hasher.final();
+    assert(hash.size() == hashSize);
+    memcpy(hashes, hash.data(), hashSize);
+    buf += blockSize;
+    hashes += hashSize;
+  }
+}
+
+void CodeSignatureSection::writeTo(uint8_t *buf) const {
+  using namespace llvm::support::endian;
+  uint32_t blobHeadersSize = sizeof(CS_SuperBlob) + sizeof(CS_BlobIndex);
+  uint32_t signatureSize = static_cast<uint32_t>(getSize());
+  auto *superBlob = reinterpret_cast<CS_SuperBlob *>(buf);
+  write32be(&superBlob->magic, CSMAGIC_EMBEDDED_SIGNATURE);
+  write32be(&superBlob->length, signatureSize);
+  write32be(&superBlob->count, 1);
+  auto *blobIndex = reinterpret_cast<CS_BlobIndex *>(&superBlob[1]);
+  write32be(&blobIndex->type, CSSLOT_CODEDIRECTORY);
+  write32be(&blobIndex->offset, blobHeadersSize);
+  auto *codeDirectory = reinterpret_cast<CS_CodeDirectory *>(&blobIndex[1]);
+  write32be(&codeDirectory->magic, CSMAGIC_CODEDIRECTORY);
+  write32be(&codeDirectory->length, signatureSize - blobHeadersSize);
+  write32be(&codeDirectory->version, 0x20400);
+  write32be(&codeDirectory->flags,
+            0x20002); // adhoc | linkerSigned
+  write32be(&codeDirectory->hashOffset,
+            sizeof(CS_CodeDirectory) + fileNameSize + fileNamePad);
+  write32be(&codeDirectory->identOffset, sizeof(CS_CodeDirectory));
+  codeDirectory->nSpecialSlots = 0;
+  write32be(&codeDirectory->nCodeSlots, getBlockCount());
+  write32be(&codeDirectory->codeLimit, fileOff);
+  codeDirectory->hashSize = hashSize;
+  codeDirectory->hashType = 2; // kSecCodeSignatureHashSHA256
+  codeDirectory->platform = 0;
+  codeDirectory->pageSize = blockSizeShift;
+  codeDirectory->spare2 = 0;
+  codeDirectory->scatterOffset = 0;
+  codeDirectory->teamOffset = 0;
+  codeDirectory->spare3 = 0;
+  codeDirectory->codeLimit64 = 0;
+  OutputSegment *textSeg = getOrCreateOutputSegment(segment_names::text);
+  write64be(&codeDirectory->execSegBase, textSeg->fileOff);
+  write64be(&codeDirectory->execSegLimit, textSeg->fileSize);
+  write64be(&codeDirectory->execSegFlags,
+            config->outputType == llvm::MachO::MH_EXECUTE
+                ? 1
+                : 0); // CS_EXECSEG_MAIN_BINARY
+  auto *id = reinterpret_cast<char *>(&codeDirectory[1]);
+  memcpy(id, fileName.begin(), fileNameSize);
+  memset(id + fileNameSize, 0, fileNamePad);
+}

lld/MachO/Writer.cpp

public:
 
   std::unique_ptr<FileOutputBuffer> &buffer;
   uint64_t addr = 0;
   uint64_t fileOff = 0;
   MachHeaderSection *header = nullptr;
   StringTableSection *stringTableSection = nullptr;
   SymtabSection *symtabSection = nullptr;
   IndirectSymtabSection *indirectSymtabSection = nullptr;
+  CodeSignatureSection *codeSignatureSection = nullptr;
   UnwindInfoSection *unwindInfoSection = nullptr;
   LCUuid *uuidCommand = nullptr;
 };
 
 // LC_DYLD_INFO_ONLY stores the offsets of symbol import/export information.
 class LCDyldInfo : public LoadCommand {
 public:
   LCDyldInfo(RebaseSection *rebaseSection, BindingSection *bindingSection,
void writeUuid(uint64_t digest) const {
     // bad lie we can put here.
     assert((uuidBuf[6] & 0xf0) == 0x30 && "See RFC 4122 Sections 4.2.2, 4.1.3");
     assert((uuidBuf[8] & 0xc0) == 0x80 && "See RFC 4122 Section 4.2.2");
   }
 
   mutable uint8_t *uuidBuf;
 };
 
+// TODO(gkm): write block comment
+class LCCodeSignature : public LoadCommand {
+public:
+  LCCodeSignature(CodeSignatureSection *section) : section(section) {}
+
+  uint32_t getSize() const override { return sizeof(linkedit_data_command); }
+
+  void writeTo(uint8_t *buf) const override {
+    auto *c = reinterpret_cast<linkedit_data_command *>(buf);
+    c->cmd = LC_CODE_SIGNATURE;
+    c->cmdsize = getSize();
+    c->dataoff = static_cast<uint32_t>(section->fileOff);
+    c->datasize = section->getSize();
+  }
+
+  CodeSignatureSection *section;
+};
+
 } // namespace
 
 static void prepareSymbolRelocation(lld::macho::Symbol *sym,
                                     const InputSection *isec, const Reloc &r) {
   const TargetInfo::RelocAttrs &relocAttrs = target->getRelocAttrs(r.type);
 
   if (relocAttrs.hasAttr(RelocAttrBits::BRANCH)) {
     prepareBranchTarget(sym);
if (auto *dylibFile = dyn_cast<DylibFile>(file)) {
       dylibFile->ordinal = dylibOrdinal++;
 
       if (dylibFile->reexport)
         in.header->addLoadCommand(
             make<LCDylib>(LC_REEXPORT_DYLIB, dylibFile->dylibName));
     }
   }
 
+  if (codeSignatureSection)
+    in.header->addLoadCommand(make<LCCodeSignature>(codeSignatureSection));
+
   const uint32_t MACOS_MAXPATHLEN = 1024;
   config->headerPad = std::max(
       config->headerPad, (config->headerPadMaxInstallNames
                               ? LCDylib::getInstanceCount() * MACOS_MAXPATHLEN
                               : 0));
 }
 
 static size_t getSymbolPriority(const SymbolPriorityEntry &entry,
return StringSwitch<int>(osec->name)
         .Case(section_names::rebase, -8)
         .Case(section_names::binding, -7)
         .Case(section_names::weakBinding, -6)
         .Case(section_names::lazyBinding, -5)
         .Case(section_names::export_, -4)
         .Case(section_names::symbolTable, -3)
         .Case(section_names::indirectSymbolTable, -2)
         .Case(section_names::stringTable, -1)
+        .Case(section_names::codeSignature, std::numeric_limits<int>::max())
         .Default(0);
   }
   // ZeroFill sections must always be the at the end of their segments,
   // otherwise subsequent sections may get overwritten with zeroes at runtime.
   if (sectionType(osec->flags) == S_ZEROFILL)
     return std::numeric_limits<int>::max();
   return 0;
 }

 }
 
 void Writer::createOutputSections() {
   // First, create hidden sections
   stringTableSection = make<StringTableSection>();
   unwindInfoSection = make<UnwindInfoSection>(); // TODO(gkm): only when no -r
   symtabSection = make<SymtabSection>(*stringTableSection);
   indirectSymtabSection = make<IndirectSymtabSection>();
+  if (config->arch == AK_arm64 || config->arch == AK_arm64e)
+    codeSignatureSection = make<CodeSignatureSection>();
 
   switch (config->outputType) {
   case MH_EXECUTE:
     make<PageZeroSection>();
     break;
   case MH_DYLIB:
   case MH_BUNDLE:
     break;
for (OutputSection *osec : seg->getSections()) {
     fileOff = alignTo(fileOff, osec->align);
     osec->addr = addr;
     osec->fileOff = isZeroFill(osec->flags) ? 0 : fileOff;
     osec->finalize();
 
     addr += osec->getSize();
     fileOff += osec->getFileSize();
   }
+  seg->fileSize = fileOff - seg->fileOff;
 }
 
 void Writer::openFile() {
   Expected<std::unique_ptr<FileOutputBuffer>> bufferOrErr =
       FileOutputBuffer::create(config->outputFile, fileOff,
                                FileOutputBuffer::F_executable);
 
   if (!bufferOrErr)
     error("failed to open " + config->outputFile + ": " +
           llvm::toString(bufferOrErr.takeError()));
   else
     buffer = std::move(*bufferOrErr);
 }
 
 void Writer::writeSections() {
   uint8_t *buf = buffer->getBufferStart();
   for (OutputSegment *seg : outputSegments)
     for (OutputSection *osec : seg->getSections())
       osec->writeTo(buf + osec->fileOff);
 }
 
 void Writer::writeUuid() {
-  uint64_t digest =
-      xxHash64({buffer->getBufferStart(), buffer->getBufferEnd()});
+  uint8_t *codeEnd =
+      buffer->getBufferEnd() -
+      (codeSignatureSection ? codeSignatureSection->getSize() : 0);
+  uint64_t digest = xxHash64({buffer->getBufferStart(), codeEnd});
   uuidCommand->writeUuid(digest);
 }
 
 void Writer::run() {
   // dyld requires __LINKEDIT segment to always exist (even if empty).
   OutputSegment *linkEditSegment =
       getOrCreateOutputSegment(segment_names::linkEdit);
 
   prepareBranchTarget(config->entry);
void Writer::run() {
   assignAddresses(linkEditSegment);
 
   openFile();
   if (errorCount())
     return;
 
   writeSections();
   writeUuid();
+  if (codeSignatureSection)
+    codeSignatureSection->writeHashes(buffer->getBufferStart());
 
   if (auto e = buffer->commit())
     error("failed to write to the output file: " + toString(std::move(e)));
 }
 
 void macho::writeResult() { Writer().run(); }
 
 void macho::createSyntheticSections() {

llvm/include/llvm/Support/SHA256.h

+/*
+ *  The SHA-256 Secure Hash Standard was published by NIST in 2002.
+ *
+ *  http://csrc.nist.gov/publications/fips/fips180-2/fips180-2.pdf
+ */
+/*
+    The implementation is based on botans's SHA256 implementation [0].
+
+    [0]
+   https://github.com/randombit/botan/blob/master/src/lib/hash/sha2_32/sha2_32.cpp
+ */
+
+#ifndef LLVM_SUPPORT_SHA2_H
+#define LLVM_SUPPORT_SHA2_H
+
+#include <array>
+#include <cstdint>
+
+namespace llvm {
+
+template <typename T> class ArrayRef;
+class StringRef;
+
+class SHA256 {
+public:
+  explicit SHA256() { init(); }
+
+  /// Reinitialize the internal state
+  void init();
+
+  /// Digest more data.
+  void update(ArrayRef<uint8_t> Data);
+
+  /// Digest more data.
+  void update(StringRef Str);
+
+  /// Return a reference to the current raw 256-bits SHA256 for the digested
+  /// data since the last call to init(). This call will add data to the
+  /// internal state and as such is not suited for getting an intermediate
+  /// result (see result()).
+  StringRef final();
+
+  /// Return a reference to the current raw 256-bits SHA256 for the digested
+  /// data since the last call to init(). This is suitable for getting the
+  /// SHA256 at any time without invalidating the internal state so that more
+  /// calls can be made into update.
+  StringRef result();
+
+  /// Returns a raw 256-bit SHA256 hash for the given data.
+  static std::array<uint8_t, 32> hash(ArrayRef<uint8_t> Data);
+
+private:
+  /// Define some constants.
+  /// "static constexpr" would be cleaner but MSVC does not support it yet.
+  enum { BLOCK_LENGTH = 64 };
+  enum { HASH_LENGTH = 32 };
+
+  // Internal State
+  struct {
+    union {
+      uint8_t C[BLOCK_LENGTH];
+      uint32_t L[BLOCK_LENGTH / 4];
+    } Buffer;
+    uint32_t State[HASH_LENGTH / 4];
+    uint32_t ByteCount;
+    uint8_t BufferOffset;
+  } InternalState;
+
+  // Internal copy of the hash, populated and accessed on calls to result()
+  uint32_t HashResult[HASH_LENGTH / 4];
+
+  // Helper
+  void writebyte(uint8_t data);
+  void hashBlock();
+  void addUncounted(uint8_t data);
+  void pad();
+};
+
+} // namespace llvm
+
+#endif // LLVM_SUPPORT_SHA2_H

llvm/lib/Support/CMakeLists.txt

add_llvm_component_library(LLVMSupport
   PrettyStackTrace.cpp
   RandomNumberGenerator.cpp
   Regex.cpp
   RISCVAttributes.cpp
   RISCVAttributeParser.cpp
   ScaledNumber.cpp
   ScopedPrinter.cpp
   SHA1.cpp
+  SHA256.cpp
   Signposts.cpp
   SmallPtrSet.cpp
   SmallVector.cpp
   SourceMgr.cpp
   SpecialCaseList.cpp
   Statistic.cpp
   StringExtras.cpp
   StringMap.cpp

llvm/lib/Support/SHA256.cpp

+#include "llvm/Support/SHA256.h"
+#include "llvm/ADT/ArrayRef.h"
+#include "llvm/ADT/StringRef.h"
+#include "llvm/Support/Endian.h"
+#include "llvm/Support/Host.h"
+#include <string.h>
+
+#if defined(BYTE_ORDER) && defined(BIG_ENDIAN) && BYTE_ORDER == BIG_ENDIAN
+#define SHA_BIG_ENDIAN
+#endif
+
+namespace llvm {
+
+#define ROTR(x, n) (((x) >> n) | ((x) << (32 - (n))))
+
+#define SHA2_32_F(A, B, C, D, E, F, G, H, M1, M2, M3, M4, magic)               \
+  do {                                                                         \
+    uint32_t A_rho = ROTR(A, 2) ^ ROTR(A, 13) ^ ROTR(A, 22);                   \
+    uint32_t E_rho = ROTR(E, 6) ^ ROTR(E, 11) ^ ROTR(E, 25);                   \
+    uint32_t M2_sigma = ROTR(M2, 17) ^ ROTR(M2, 19) ^ (M2 >> 10);              \
+    uint32_t M4_sigma = ROTR(M4, 7) ^ ROTR(M4, 18) ^ (M4 >> 3);                \
+    H += magic + E_rho + ((E & F) ^ (~E & G)) + M1;                            \
+    D += H;                                                                    \
+    H += A_rho + ((A & B) | ((A | B) & C));                                    \
+    M1 += M2_sigma + M3 + M4_sigma;                                            \
+  } while (0);
+
+void SHA256::init() {
+  InternalState.State[0] = 0x6A09E667;
+  InternalState.State[1] = 0xBB67AE85;
+  InternalState.State[2] = 0x3C6EF372;
+  InternalState.State[3] = 0xA54FF53A;
+  InternalState.State[4] = 0x510E527F;
+  InternalState.State[5] = 0x9B05688C;
+  InternalState.State[6] = 0x1F83D9AB;
+  InternalState.State[7] = 0x5BE0CD19;
+  InternalState.ByteCount = 0;
+  InternalState.BufferOffset = 0;
+}
+
+void SHA256::hashBlock() {
+  uint32_t A = InternalState.State[0];
+  uint32_t B = InternalState.State[1];
+  uint32_t C = InternalState.State[2];
+  uint32_t D = InternalState.State[3];
+  uint32_t E = InternalState.State[4];
+  uint32_t F = InternalState.State[5];
+  uint32_t G = InternalState.State[6];
+  uint32_t H = InternalState.State[7];
+
+  uint32_t W00 = InternalState.Buffer.L[0];
+  uint32_t W01 = InternalState.Buffer.L[1];
+  uint32_t W02 = InternalState.Buffer.L[2];
+  uint32_t W03 = InternalState.Buffer.L[3];
+  uint32_t W04 = InternalState.Buffer.L[4];
+  uint32_t W05 = InternalState.Buffer.L[5];
+  uint32_t W06 = InternalState.Buffer.L[6];
+  uint32_t W07 = InternalState.Buffer.L[7];
+  uint32_t W08 = InternalState.Buffer.L[8];
+  uint32_t W09 = InternalState.Buffer.L[9];
+  uint32_t W10 = InternalState.Buffer.L[10];
+  uint32_t W11 = InternalState.Buffer.L[11];
+  uint32_t W12 = InternalState.Buffer.L[12];
+  uint32_t W13 = InternalState.Buffer.L[13];
+  uint32_t W14 = InternalState.Buffer.L[14];
+  uint32_t W15 = InternalState.Buffer.L[15];
+
+  SHA2_32_F(A, B, C, D, E, F, G, H, W00, W14, W09, W01, 0x428A2F98);
+  SHA2_32_F(H, A, B, C, D, E, F, G, W01, W15, W10, W02, 0x71374491);
+  SHA2_32_F(G, H, A, B, C, D, E, F, W02, W00, W11, W03, 0xB5C0FBCF);
+  SHA2_32_F(F, G, H, A, B, C, D, E, W03, W01, W12, W04, 0xE9B5DBA5);
+  SHA2_32_F(E, F, G, H, A, B, C, D, W04, W02, W13, W05, 0x3956C25B);
+  SHA2_32_F(D, E, F, G, H, A, B, C, W05, W03, W14, W06, 0x59F111F1);
+  SHA2_32_F(C, D, E, F, G, H, A, B, W06, W04, W15, W07, 0x923F82A4);
+  SHA2_32_F(B, C, D, E, F, G, H, A, W07, W05, W00, W08, 0xAB1C5ED5);
+  SHA2_32_F(A, B, C, D, E, F, G, H, W08, W06, W01, W09, 0xD807AA98);
+  SHA2_32_F(H, A, B, C, D, E, F, G, W09, W07, W02, W10, 0x12835B01);
+  SHA2_32_F(G, H, A, B, C, D, E, F, W10, W08, W03, W11, 0x243185BE);
+  SHA2_32_F(F, G, H, A, B, C, D, E, W11, W09, W04, W12, 0x550C7DC3);
+  SHA2_32_F(E, F, G, H, A, B, C, D, W12, W10, W05, W13, 0x72BE5D74);
+  SHA2_32_F(D, E, F, G, H, A, B, C, W13, W11, W06, W14, 0x80DEB1FE);
+  SHA2_32_F(C, D, E, F, G, H, A, B, W14, W12, W07, W15, 0x9BDC06A7);
+  SHA2_32_F(B, C, D, E, F, G, H, A, W15, W13, W08, W00, 0xC19BF174);
+
+  SHA2_32_F(A, B, C, D, E, F, G, H, W00, W14, W09, W01, 0xE49B69C1);
+  SHA2_32_F(H, A, B, C, D, E, F, G, W01, W15, W10, W02, 0xEFBE4786);
+  SHA2_32_F(G, H, A, B, C, D, E, F, W02, W00, W11, W03, 0x0FC19DC6);
+  SHA2_32_F(F, G, H, A, B, C, D, E, W03, W01, W12, W04, 0x240CA1CC);
+  SHA2_32_F(E, F, G, H, A, B, C, D, W04, W02, W13, W05, 0x2DE92C6F);
+  SHA2_32_F(D, E, F, G, H, A, B, C, W05, W03, W14, W06, 0x4A7484AA);
+  SHA2_32_F(C, D, E, F, G, H, A, B, W06, W04, W15, W07, 0x5CB0A9DC);
+  SHA2_32_F(B, C, D, E, F, G, H, A, W07, W05, W00, W08, 0x76F988DA);
+  SHA2_32_F(A, B, C, D, E, F, G, H, W08, W06, W01, W09, 0x983E5152);
+  SHA2_32_F(H, A, B, C, D, E, F, G, W09, W07, W02, W10, 0xA831C66D);
+  SHA2_32_F(G, H, A, B, C, D, E, F, W10, W08, W03, W11, 0xB00327C8);
+  SHA2_32_F(F, G, H, A, B, C, D, E, W11, W09, W04, W12, 0xBF597FC7);
+  SHA2_32_F(E, F, G, H, A, B, C, D, W12, W10, W05, W13, 0xC6E00BF3);
+  SHA2_32_F(D, E, F, G, H, A, B, C, W13, W11, W06, W14, 0xD5A79147);
+  SHA2_32_F(C, D, E, F, G, H, A, B, W14, W12, W07, W15, 0x06CA6351);
+  SHA2_32_F(B, C, D, E, F, G, H, A, W15, W13, W08, W00, 0x14292967);
+
+  SHA2_32_F(A, B, C, D, E, F, G, H, W00, W14, W09, W01, 0x27B70A85);
+  SHA2_32_F(H, A, B, C, D, E, F, G, W01, W15, W10, W02, 0x2E1B2138);
+  SHA2_32_F(G, H, A, B, C, D, E, F, W02, W00, W11, W03, 0x4D2C6DFC);
+  SHA2_32_F(F, G, H, A, B, C, D, E, W03, W01, W12, W04, 0x53380D13);
+  SHA2_32_F(E, F, G, H, A, B, C, D, W04, W02, W13, W05, 0x650A7354);
+  SHA2_32_F(D, E, F, G, H, A, B, C, W05, W03, W14, W06, 0x766A0ABB);
+  SHA2_32_F(C, D, E, F, G, H, A, B, W06, W04, W15, W07, 0x81C2C92E);
+  SHA2_32_F(B, C, D, E, F, G, H, A, W07, W05, W00, W08, 0x92722C85);
+  SHA2_32_F(A, B, C, D, E, F, G, H, W08, W06, W01, W09, 0xA2BFE8A1);
+  SHA2_32_F(H, A, B, C, D, E, F, G, W09, W07, W02, W10, 0xA81A664B);
+  SHA2_32_F(G, H, A, B, C, D, E, F, W10, W08, W03, W11, 0xC24B8B70);
+  SHA2_32_F(F, G, H, A, B, C, D, E, W11, W09, W04, W12, 0xC76C51A3);
+  SHA2_32_F(E, F, G, H, A, B, C, D, W12, W10, W05, W13, 0xD192E819);
+  SHA2_32_F(D, E, F, G, H, A, B, C, W13, W11, W06, W14, 0xD6990624);
+  SHA2_32_F(C, D, E, F, G, H, A, B, W14, W12, W07, W15, 0xF40E3585);
+  SHA2_32_F(B, C, D, E, F, G, H, A, W15, W13, W08, W00, 0x106AA070);
+
+  SHA2_32_F(A, B, C, D, E, F, G, H, W00, W14, W09, W01, 0x19A4C116);
+  SHA2_32_F(H, A, B, C, D, E, F, G, W01, W15, W10, W02, 0x1E376C08);
+  SHA2_32_F(G, H, A, B, C, D, E, F, W02, W00, W11, W03, 0x2748774C);
+  SHA2_32_F(F, G, H, A, B, C, D, E, W03, W01, W12, W04, 0x34B0BCB5);
+  SHA2_32_F(E, F, G, H, A, B, C, D, W04, W02, W13, W05, 0x391C0CB3);
+  SHA2_32_F(D, E, F, G, H, A, B, C, W05, W03, W14, W06, 0x4ED8AA4A);
+  SHA2_32_F(C, D, E, F, G, H, A, B, W06, W04, W15, W07, 0x5B9CCA4F);
+  SHA2_32_F(B, C, D, E, F, G, H, A, W07, W05, W00, W08, 0x682E6FF3);
+  SHA2_32_F(A, B, C, D, E, F, G, H, W08, W06, W01, W09, 0x748F82EE);
+  SHA2_32_F(H, A, B, C, D, E, F, G, W09, W07, W02, W10, 0x78A5636F);
+  SHA2_32_F(G, H, A, B, C, D, E, F, W10, W08, W03, W11, 0x84C87814);
+  SHA2_32_F(F, G, H, A, B, C, D, E, W11, W09, W04, W12, 0x8CC70208);
+  SHA2_32_F(E, F, G, H, A, B, C, D, W12, W10, W05, W13, 0x90BEFFFA);
+  SHA2_32_F(D, E, F, G, H, A, B, C, W13, W11, W06, W14, 0xA4506CEB);
+  SHA2_32_F(C, D, E, F, G, H, A, B, W14, W12, W07, W15, 0xBEF9A3F7);
+  SHA2_32_F(B, C, D, E, F, G, H, A, W15, W13, W08, W00, 0xC67178F2);
+
+  InternalState.State[0] += A;
+  InternalState.State[1] += B;
+  InternalState.State[2] += C;
+  InternalState.State[3] += D;
+  InternalState.State[4] += E;
+  InternalState.State[5] += F;
+  InternalState.State[6] += G;
+  InternalState.State[7] += H;
+}
+
+void SHA256::addUncounted(uint8_t Data) {
+#ifdef SHA_BIG_ENDIAN
+  InternalState.Buffer.C[InternalState.BufferOffset] = Data;
+#else
+  InternalState.Buffer.C[InternalState.BufferOffset ^ 3] = Data;
+#endif
+
+  InternalState.BufferOffset++;
+  if (InternalState.BufferOffset == BLOCK_LENGTH) {
+    hashBlock();
+    InternalState.BufferOffset = 0;
+  }
+}
+
+void SHA256::writebyte(uint8_t Data) {
+  ++InternalState.ByteCount;
+  addUncounted(Data);
+}
+
+void SHA256::update(ArrayRef<uint8_t> Data) {
+  InternalState.ByteCount += Data.size();
+
+  // Finish the current block.
+  if (InternalState.BufferOffset > 0) {
+    const size_t Remainder = std::min<size_t>(
+        Data.size(), BLOCK_LENGTH - InternalState.BufferOffset);
+    for (size_t I = 0; I < Remainder; ++I)
+      addUncounted(Data[I]);
+    Data = Data.drop_front(Remainder);
+  }
+
+  // Fast buffer filling for large inputs.
+  while (Data.size() >= BLOCK_LENGTH) {
+    assert(InternalState.BufferOffset == 0);
+    assert(BLOCK_LENGTH % 4 == 0);
+    constexpr size_t BLOCK_LENGTH_32 = BLOCK_LENGTH / 4;
+    for (size_t I = 0; I < BLOCK_LENGTH_32; ++I)
+      InternalState.Buffer.L[I] = support::endian::read32be(&Data[I * 4]);
+    hashBlock();
+    Data = Data.drop_front(BLOCK_LENGTH);
+  }
+
+  // Finish the remainder.
+  for (uint8_t C : Data)
+    addUncounted(C);
+}
+
+void SHA256::update(StringRef Str) {
+  update(
+      ArrayRef<uint8_t>((uint8_t *)const_cast<char *>(Str.data()), Str.size()));
+}
+
+void SHA256::pad() {
+  // Implement SHA-2 padding (fips180-2 5.1.1)
+
+  // Pad with 0x80 followed by 0x00 until the end of the block
+  addUncounted(0x80);
+  while (InternalState.BufferOffset != 56)
+    addUncounted(0x00);
+
+  uint64_t len = InternalState.ByteCount << 3; // bit size
+
+  // Append length in the last 8 bytes big edian encoded
+  addUncounted(len >> 56);
+  addUncounted(len >> 48);
+  addUncounted(len >> 40);
+  addUncounted(len >> 32);
+  addUncounted(len >> 24);
+  addUncounted(len >> 16);
+  addUncounted(len >> 8);
+  addUncounted(len);
+}
+
+StringRef SHA256::final() {
+  // Pad to complete the last block
+  pad();
+
+#ifdef SHA_BIG_ENDIAN
+  // Just copy the current state
+  for (int i = 0; i < 8; i++) {
+    HashResult[i] = InternalState.State[i];
+  }
+#else
+  // Swap byte order back
+  for (int i = 0; i < 8; i++) {
+    HashResult[i] = (((InternalState.State[i]) << 24) & 0xff000000) |
+                    (((InternalState.State[i]) << 8) & 0x00ff0000) |
+                    (((InternalState.State[i]) >> 8) & 0x0000ff00) |
+                    (((InternalState.State[i]) >> 24) & 0x000000ff);
+  }
+#endif
+
+  // Return pointer to hash (32 characters)
+  return StringRef((char *)HashResult, HASH_LENGTH);
+}
+
+StringRef SHA256::result() {
+  auto StateToRestore = InternalState;
+
+  auto Hash = final();
+
+  // Restore the state
+  InternalState = StateToRestore;
+
+  // Return pointer to hash (32 characters)
+  return Hash;
+}
+
+std::array<uint8_t, 32> SHA256::hash(ArrayRef<uint8_t> Data) {
+  SHA256 Hash;
+  Hash.update(Data);
+  StringRef S = Hash.final();
+
+  std::array<uint8_t, 32> Arr;
+  memcpy(Arr.data(), S.data(), S.size());
+  return Arr;
+}
+
+} // namespace llvm