Pointer authentication config and user facing options by jchlanda · Pull Request #156712 · rust-lang/rust

jchlanda · 2026-05-18T13:03:50Z

This patch brings:

unified handling of pointer authentication options through:
-Zpointer-authentication, with possible values:
aarch64-jump-table-hardening, auth-traps, calls, elf-got,
function-pointer-type-discrimination, indirect-gotos, init-fini,
init-fini-address-discrimination, return-addresses. Toggled with
+/-.
centralized handling of pointer authentication features. Session holds
pointer_auth_config: Option<PointerAuthConfig>
encapsulation of schema for function pointers and init/fini through
PointerAuthSchema. This allowed for retiring of PacMetadata.
refactor enabling of pointer authentication in code, instead of
relying on the target (pauthtest) use the session

jchlanda · 2026-05-19T12:17:23Z

@davidtwco, @folkertdev, @tgross35, @madsmtm FWI this is a follow up to #155722 and #156548
This will have to be rebased once the above are merged.

rustbot · 2026-05-19T12:17:28Z

This PR modifies src/bootstrap/src/core/config.

If appropriate, please update CONFIG_CHANGE_HISTORY in src/bootstrap/src/utils/change_tracker.rs.

Some changes occurred in src/tools/compiletest

cc @jieyouxu

The GCC codegen subtree was changed

cc @antoyo, @GuillaumeGomez

compiletest directives have been modified. Please add or update docs for the
new or modified directive in src/doc/rustc-dev-guide/.

Some changes occurred in src/doc/rustc/src/platform-support

cc @Noratrieb

This PR modifies tests/auxiliary/minicore.rs.

cc @jieyouxu

These commits modify compiler targets.
(See the Target Tier Policy.)

rustbot · 2026-05-19T12:17:31Z

r? @mejrs

rustbot has assigned @mejrs.
They will have a look at your PR within the next two weeks and either review your PR or reassign to another reviewer.

Use r? to explicitly pick a reviewer

Why was this reviewer chosen?

The reviewer was selected based on:

Owners of files modified in this PR: compiler
compiler expanded to 73 candidates
Random selection from 20 candidates

mejrs · 2026-05-24T15:46:34Z

Hi, I am not qualified to review this.

r? madsmtm or reroll maybe

rustbot · 2026-06-30T11:56:32Z

This PR was rebased onto a different main commit. Here's a range-diff highlighting what actually changed.

Rebasing is a normal part of keeping PRs up to date, so no action is needed—this note is just to help reviewers.

jchlanda · 2026-07-01T14:52:49Z

Hi all (@davidtwco, @folkertdev, @tgross35, @madsmtm, @bjorn3),

The PR introducing the pauthtest target has been merged into main. I'd be very grateful if we could move this one forward as well.

Thank you!

bjorn3 · 2026-07-01T14:56:59Z

        layout: abi::Scalar,
        llty: Self::Type,
-        pac: Option<PacMetadata>,
+        schema: Option<&PointerAuthSchema>,


Don't know if it got lost or I commented this on another PR, but it should be possible for both the builder and the codegen context to get this info from the session they store.

View changes since the review

While you are right that PointerAuthSchema can be accessed through the session from both places, it is unfortunately a bit more complicated than that.

The key point is that the only place the schema is actually used is in maybe_sign_fn_ptr. That function effectively “consumes” the schema, and it is only a helper for get_fn_addr.

However, at the point where we obtain the function address, we have already lost the contextual information about which signing schema should be used. Note that (for now) there are two schemas defined in the session:

init/fini

default function pointer

As a result, it is up to the callers of get_fn_addr to provide the correct schema. The complication is that the information about whether a value will be emitted into init/fini arrays is only known at const_alloc_to_llvm time, which then calls into the scalar-to-backend routine (whose signature had to be also extended).

As a side note, the current implementation is a simplification. We deliberately assume only two schema choices: init/fini or default function pointer. Both are provided as a constant snapshot in the session. In reality, it should be possible for the schema to change throughout the compilation pipeline, which means we will likely need to move away from relying on the session as the source of truth. This is reflected in my WIP PR that you commented on.

davidtwco · 2026-07-02T16:24:15Z

        "whether to use the PLT when calling into shared libraries;
        only has effect for PIC code on systems with ELF binaries
        (default: PLT is disabled if full relro is enabled on x86_64)"),
+    pointer_authentication: Vec<(PointerAuthOption, bool)> = (Vec::new(), parse_pointer_authentication_list_with_polarity, [TRACKED],


Should this be a target modifier?

View changes since the review

I wasn't aware of target_modifiers before, but after reading the docs, I'd say yes. I don't think it makes that much of a difference just now, as the mismatches will always be cough by lld. You'd get something along the lines of:

= note: ld.lld: error: incompatible values of AArch64 PAuth core info found platform: >>> /opt/llvm-pauth/lib/clang/23/lib/aarch64-unknown-linux-pauthtest/clang_rt.crtbegin.o: 0x0000000010000002 >>> /home/jakub/Work/AccessSoftek/rust/build/aarch64-unknown-linux-gnu/test/ui/target_modifiers/incompatible_pauth/auxiliary/pauth.pauth.13435d650a747a4e-cgu.0.rcgu.o: 0x0000000010000002 version: >>> /opt/llvm-pauth/lib/clang/23/lib/aarch64-unknown-linux-pauthtest/clang_rt.crtbegin.o: 0x00000000000006ff >>> /home/jakub/Work/AccessSoftek/rust/build/aarch64-unknown-linux-gnu/test/ui/target_modifiers/incompatible_pauth/auxiliary/pauth.pauth.13435d650a747a4e-cgu.0.rcgu.o: 0x000000000000063f clang: error: linker command failed with exit code 1 (use -v to see invocation)

However, having it explicit, at Rust level, before it hits the linker sounds like a clear win.

Pretty cool feature that.

I've added it in: 1c82b8f

davidtwco · 2026-07-02T16:26:51Z

+        self.pointer_auth_config.is_some()
+    }
+
+    pub fn pointer_authentication_functions(&self) -> bool {


Maybe return the Option<_> here and use is_some() at the callers that need it, then you can use this in a bunch more places where the value is used too, like in the ssa/mir/* changes.

View changes since the review

Good idea, done.

davidtwco · 2026-07-02T16:28:02Z

 pub enum PointerAuthOption {
-    Calls,
-    ReturnAddresses,
+    Aarch64JumpTableHardening,


You can wrap this in // tidy-alphabetical-start and // tidy-alphabetical-end` comments if you want the ordering to stay enforced

View changes since the review

Nice, done.

davidtwco · 2026-07-02T16:36:13Z

+            "vt-ptr-addr-discrimination" => Some(Self::VTPtrAddrDisc),
+            "vt-ptr-type-discrimination" => Some(Self::VTPtrTypeDisc),
+            _ => None,
+        }


I think the options make sense as currently proposed - I don't know that we'd want so many different options like Clang does, and if we don't want that then Clang's names aren't great.

davidtwco · 2026-07-02T16:36:43Z

        "whether to use the PLT when calling into shared libraries;
        only has effect for PIC code on systems with ELF binaries
        (default: PLT is disabled if full relro is enabled on x86_64)"),
+    pointer_authentication: Vec<(PointerAuthOption, bool)> = (Vec::new(), parse_pointer_authentication_list_with_polarity, [TRACKED],


Agreed that question should be part of a tracking issue.

rustbot · 2026-07-02T16:38:14Z

Reminder, once the PR becomes ready for a review, use @rustbot ready.

This patch brings: * unified handling of pointer authentication options through: `-Zpointer-authentication`, with possible values: `aarch64-jump-table-hardening`, `auth-traps`, `calls`, `elf-got`, `function-pointer-type-discrimination`, `indirect-gotos`, `init-fini`, `init-fini-address-discrimination`, `return-addresses`. Toggled with `+`/`-`. * centralized handling of pointer authentication features. Session holds `pointer_auth_config: Option<PointerAuthConfig>` * encapsulation of schema for function pointers and init/fini through `PointerAuthSchema`. This allowed for retiring of `PacMetadata`. * refactor enabling of pointer authentication in code, instead of relying on the target (`pauthtest`) use the session

- warning on unsupported test - error on type discrimination - removal of PointerAuthKind

jchlanda · 2026-07-03T12:52:04Z

@rustbot ready

Also improve the API design of pointer_authentication_functions, by making it return Option<&PointerAuthSchema>, rather than bool.