[lld/mac] ad-hoc sign dylibs and bundles on arm64 by default, support -(no_)adhoc_codesign flags

[thakis]

Summary

Previously, lld/mac only ad-hoc codesigned executables on arm64.

Matches ld64 behavior. Part of PR49443. Fixes 14 of 17 failures when running
check-llvm with lld as host linker on an M1 MBP.

[gkm]

LGTM

[thakis]

Thanks!

[smeenai]

lld/MachO/Driver.cpp

848

Should we be setting this for all arm64 binaries, or only arm64 binaries targeting macOS?

[smeenai]

lld/MachO/Driver.cpp

848

ld64 appears to only ad-hoc sign macOS binaries.

lld/MachO/Config.h

struct Configuration {
   bool implicitDylibs = false;
   bool isPic = false;
   bool headerPadMaxInstallNames = false;
   bool ltoNewPassManager = LLVM_ENABLE_NEW_PASS_MANAGER;
   bool printEachFile = false;
   bool printWhyLoad = false;
   bool searchDylibsFirst = false;
   bool saveTemps = false;
+  bool adhocCodesign = false;
   uint32_t headerPad;
   uint32_t dylibCompatibilityVersion = 0;
   uint32_t dylibCurrentVersion = 0;
   llvm::StringRef installName;
   llvm::StringRef outputFile;
   llvm::StringRef ltoObjPath;
   bool demangle = false;
   llvm::MachO::Target target;

lld/MachO/Driver.cpp

bool macho::link(ArrayRef<const char *> argsArr, bool canExitEarly,
   }
   for (opt::Arg *arg : args.filtered(OPT_rename_segment)) {
     config->segmentRenameMap[validName(arg->getValue(0))] =
         validName(arg->getValue(1));
   }
 
   config->saveTemps = args.hasArg(OPT_save_temps);
 
+  config->adhocCodesign =
+      args.hasFlag(OPT_adhoc_codesign, OPT_no_adhoc_codesign,
+                   config->target.Arch == AK_arm64 ||
+                   config->target.Arch == AK_arm64e);
+
   if (args.hasArg(OPT_v)) {
     message(getLLDVersion());
     message(StringRef("Library search paths:") +
             (config->librarySearchPaths.size()
                  ? "\n\t" + join(config->librarySearchPaths, "\n\t")
                  : ""));
     message(StringRef("Framework search paths:") +
             (config->frameworkSearchPaths.size()

lld/MachO/Options.td

def bitcode_symbol_map : Separate<["-"], "bitcode_symbol_map">,
      Group<grp_bitcode>;
 
 def grp_rare : OptionGroup<"rare">, HelpText<"RARELY USED">;
 
 def v : Flag<["-"], "v">,
      HelpText<"Print the linker version and search paths in addition to linking">,
      Group<grp_rare>;
 def adhoc_codesign : Flag<["-"], "adhoc_codesign">,
-     HelpText<"Write an ad-hoc code signature to the output file.">,
-     Flags<[HelpHidden]>,
+     HelpText<"Write an ad-hoc code signature to the output file (default for arm64 binaries)">,
      Group<grp_rare>;
 def no_adhoc_codesign : Flag<["-"], "no_adhoc_codesign">,
-     HelpText<"Do not write an ad-hoc code signature to the output file.">,
+     HelpText<"Do not write an ad-hoc code signature to the output file (default for x86_64 binaries)">,
      Group<grp_rare>;
 def version_details : Flag<["-"], "version_details">,
      HelpText<"Print the linker version in JSON form">,
      Flags<[HelpHidden]>,
      Group<grp_rare>;
 def no_weak_imports : Flag<["-"], "no_weak_imports">,
      HelpText<"Fail if any symbols are weak imports, allowed to be NULL at runtime">,
      Flags<[HelpHidden]>,

lld/MachO/Writer.cpp

 }
 
 void Writer::createOutputSections() {
   // First, create hidden sections
   stringTableSection = make<StringTableSection>();
   unwindInfoSection = make<UnwindInfoSection>(); // TODO(gkm): only when no -r
   symtabSection = make<SymtabSection>(*stringTableSection);
   indirectSymtabSection = make<IndirectSymtabSection>();
-  if (config->outputType == MH_EXECUTE &&
-      (config->target.Arch == AK_arm64 || config->target.Arch == AK_arm64e))
+  if (config->adhocCodesign)
     codeSignatureSection = make<CodeSignatureSection>();
 
   switch (config->outputType) {
   case MH_EXECUTE:
     make<PageZeroSection>();
     break;
   case MH_DYLIB:
   case MH_BUNDLE:

lld/test/MachO/adhoc-codesign.s

+# REQUIRES: x86, aarch64
+
+# RUN: rm -rf %t
+# RUN: split-file %s %t
+
+
+# RUN: llvm-mc -filetype=obj -triple=arm64-apple-macos -o %t/main-arm64.o %t/main.s
+# RUN: llvm-mc -filetype=obj -triple=x86_64-apple-macos -o %t/main-x86_64.o %t/main.s
+# RUN: llvm-mc -filetype=obj -triple=arm64-apple-macos -o %t/foo-arm64.o %t/foo.s
+# RUN: llvm-mc -filetype=obj -triple=x86_64-apple-macos -o %t/foo-x86_64.o %t/foo.s
+
+# Exhaustive test for:
+# (x86_64, arm64) x (default, -adhoc_codesign, -no_adhoc-codesign) x (execute, dylib, bundle)
+
+# RUN: %lld -lSystem -arch x86_64 -execute -o %t/out %t/main-x86_64.o
+# RUN: llvm-objdump --macho --all-headers %t/out | FileCheck --check-prefix=NO-ADHOC %s
+# RUN: %lld -arch x86_64 -dylib   -o %t/out %t/foo-x86_64.o
+# RUN: llvm-objdump --macho --all-headers  %t/out| FileCheck --check-prefix=NO-ADHOC %s
+# RUN: %lld -arch x86_64 -bundle  -o %t/out %t/foo-x86_64.o
+# RUN: llvm-objdump --macho --all-headers  %t/out| FileCheck --check-prefix=NO-ADHOC %s
+
+# RUN: %lld -lSystem -arch x86_64 -execute -adhoc_codesign -o %t/out %t/main-x86_64.o
+# RUN: llvm-objdump --macho --all-headers %t/out| FileCheck --check-prefix=ADHOC %s
+# RUN: %lld -arch x86_64 -dylib   -adhoc_codesign -o %t/out %t/foo-x86_64.o
+# RUN: llvm-objdump --macho --all-headers %t/out| FileCheck --check-prefix=ADHOC %s
+# RUN: %lld -arch x86_64 -bundle  -adhoc_codesign -o %t/out %t/foo-x86_64.o
+# RUN: llvm-objdump --macho --all-headers %t/out| FileCheck --check-prefix=ADHOC %s
+
+# RUN: %lld -lSystem -arch x86_64 -execute -no_adhoc_codesign -o %t/out %t/main-x86_64.o
+# RUN: llvm-objdump --macho --all-headers %t/out| FileCheck --check-prefix=NO-ADHOC %s
+# RUN: %lld -arch x86_64 -dylib   -no_adhoc_codesign -o %t/out %t/foo-x86_64.o
+# RUN: llvm-objdump --macho --all-headers %t/out| FileCheck --check-prefix=NO-ADHOC %s
+# RUN: %lld -arch x86_64 -bundle  -no_adhoc_codesign -o %t/out %t/foo-x86_64.o
+# RUN: llvm-objdump --macho --all-headers %t/out| FileCheck --check-prefix=NO-ADHOC %s
+
+
+# RUN: %lld -lSystem -arch arm64 -execute -o %t/out %t/main-arm64.o
+# RUN: llvm-objdump --macho --all-headers %t/out | FileCheck --check-prefix=ADHOC %s
+# RUN: %lld -arch arm64 -dylib   -o %t/out %t/foo-arm64.o
+# RUN: llvm-objdump --macho --all-headers  %t/out| FileCheck --check-prefix=ADHOC %s
+# RUN: %lld -arch arm64 -bundle  -o %t/out %t/foo-arm64.o
+# RUN: llvm-objdump --macho --all-headers  %t/out| FileCheck --check-prefix=ADHOC %s
+
+# RUN: %lld -lSystem -arch arm64 -execute -adhoc_codesign -o %t/out %t/main-arm64.o
+# RUN: llvm-objdump --macho --all-headers %t/out| FileCheck --check-prefix=ADHOC %s
+# RUN: %lld -arch arm64 -dylib   -adhoc_codesign -o %t/out %t/foo-arm64.o
+# RUN: llvm-objdump --macho --all-headers %t/out| FileCheck --check-prefix=ADHOC %s
+# RUN: %lld -arch arm64 -bundle  -adhoc_codesign -o %t/out %t/foo-arm64.o
+# RUN: llvm-objdump --macho --all-headers %t/out| FileCheck --check-prefix=ADHOC %s
+
+# RUN: %lld -lSystem -arch arm64 -execute -no_adhoc_codesign -o %t/out %t/main-arm64.o
+# RUN: llvm-objdump --macho --all-headers %t/out| FileCheck --check-prefix=NO-ADHOC %s
+# RUN: %lld -arch arm64 -dylib   -no_adhoc_codesign -o %t/out %t/foo-arm64.o
+# RUN: llvm-objdump --macho --all-headers %t/out| FileCheck --check-prefix=NO-ADHOC %s
+# RUN: %lld -arch arm64 -bundle  -no_adhoc_codesign -o %t/out %t/foo-arm64.o
+# RUN: llvm-objdump --macho --all-headers %t/out| FileCheck --check-prefix=NO-ADHOC %s
+
+# ADHOC:          cmd LC_CODE_SIGNATURE
+# ADHOC-NEXT: cmdsize 16
+
+# NO-ADHOC-NOT:          cmd LC_CODE_SIGNATURE
+
+#--- foo.s
+.globl _foo
+_foo:
+  ret
+
+#--- main.s
+.globl _main
+_main:
+  ret