Skip to content

Introduce aarch64-unknown-linux-pauthtest target#155722

Open
jchlanda wants to merge 10 commits intorust-lang:mainfrom
jchlanda:jakub/pac
Open

Introduce aarch64-unknown-linux-pauthtest target#155722
jchlanda wants to merge 10 commits intorust-lang:mainfrom
jchlanda:jakub/pac

Conversation

@jchlanda
Copy link
Copy Markdown

@jchlanda jchlanda commented Apr 24, 2026

View all comments

This target enables Pointer Authentication Code (PAC) support in Rust on AArch64
ELF-based Linux systems. It uses the aarch64-unknown-linux-pauthtest LLVM
target and a pointer-authentication-enabled sysroot with a custom musl as a
reference libc implementation. Dynamic linking is required, with a dynamic
linker acting as the ELF interpreter that can resolve pauth relocations and
enforce pointer authentication constraints.

Supported features include:

  • authentication of signed function pointers for extern "C" calls (corresponds
    to LLVM's -fptrauth-calls)
  • signing of return addresses before spilling to the stack and authentication
    after restoring for non-leaf functions (corresponds to -fptrauth-returns)
  • trapping on authentication failure when the FPAC feature is not present
    (corresponds to -fptrauth-auth-traps)
  • signing of init/fini array entries using the LLVM-defined pointer
    authentication scheme (corresponds to -fptrauth-init-fini and
    -fptrauth-init-fini-address-discrimination)
  • non-ABI-affecting indirect control-flow hardening features as implemented in
    LLVM (corresponds to -faarch64-jump-table-hardening and
    -fptrauth-indirect-gotos)
  • signed ELF GOT entries (gated behind -Z ptrauth-elf-got, off by default)

Existing compiler support, such as enabling branch authentication instructions
(i.e.: -Z branch-protection) provide limited functionality, mainly signing
return addresses (pac-ret). The new target goes further by enabling ABI-level
pointer authentication support.

This target does not define a new ABI; it builds on the existing C/C++ language
ABI with pointer authentication support added. However, different authentication
features, encoded in the signing schema, are not ABI-compatible with one
another.

Useful links:

Tier 3 check list

  • A tier 3 target must have a designated developer or developers (the "target
    maintainers") on record to be CCed when issues arise regarding the target.
    (The mechanism to track and CC such developers may evolve over time.)

I pledge to do my best maintaining it.

  • Targets must use naming consistent with any existing targets; for instance, a
    target for the same CPU or OS as an existing Rust target should use the same
    name for that CPU or OS. Targets should normally use the same names and
    naming conventions as used elsewhere in the broader ecosystem beyond Rust
    (such as in other toolchains), unless they have a very good reason to
    diverge. Changing the name of a target can be highly disruptive, especially
    once the target reaches a higher tier, so getting the name right is important
    even for a tier 3 target.

The name chosen for the target is aarch64-unknown-linux-pauthtest which
mirrors the LLVM target naming.

  • Target names should not introduce undue confusion or ambiguity unless
    absolutely necessary to maintain ecosystem compatibility. For example, if
    the name of the target makes people extremely likely to form incorrect
    beliefs about what it targets, the name should be changed or augmented to
    disambiguate it.

There should be no confusion, the name follows naming convention and is
descriptive.

  • If possible, use only letters, numbers, dashes and underscores for the name.
    Periods (.) are known to cause issues in Cargo.

Letters, numbers and dashes only.

  • Tier 3 targets may have unusual requirements to build or use, but must not
    create legal issues or impose onerous legal terms for the Rust project or for
    Rust developers or users.

The target requires system clang and lld available as well as custom libc
(musl based) and sysroot, provided through the build scripts.

  • The target must not introduce license incompatibilities.

There are no license implications.

  • Anything added to the Rust repository must be under the standard Rust
    license (MIT OR Apache-2.0).

Understood.

  • The target must not cause the Rust tools or libraries built for any other
    host (even when supporting cross-compilation to the target) to depend
    on any new dependency less permissive than the Rust licensing policy. This
    applies whether the dependency is a Rust crate that would require adding
    new license exceptions (as specified by the tidy tool in the
    rust-lang/rust repository), or whether the dependency is a native library
    or binary. In other words, the introduction of the target must not cause a
    user installing or running a version of Rust or the Rust tools to be
    subject to any new license requirements.

There are no new dependencies or requirements.

  • Compiling, linking, and emitting functional binaries, libraries, or other
    code for the target (whether hosted on the target itself or cross-compiling
    from another target) must not depend on proprietary (non-FOSS) libraries.
    Host tools built for the target itself may depend on the ordinary runtime
    libraries supplied by the platform and commonly used by other applications
    built for the target, but those libraries must not be required for code
    generation for the target; cross-compilation to the target must not require
    such libraries at all. For instance, rustc built for the target may
    depend on a common proprietary C runtime library or console output library,
    but must not depend on a proprietary code generation library or code
    optimization library. Rust's license permits such combinations, but the
    Rust project has no interest in maintaining such combinations within the
    scope of Rust itself, even at tier 3.

The target only relies on open source tools.

  • "onerous" here is an intentionally subjective term. At a minimum, "onerous"
    legal/licensing terms include but are not limited to: non-disclosure
    requirements, non-compete requirements, contributor license agreements
    (CLAs) or equivalent, "non-commercial"/"research-only"/etc terms,
    requirements conditional on the employer or employment of any particular
    Rust developers, revocable terms, any requirements that create liability
    for the Rust project or its developers or users, or any requirements that
    adversely affect the livelihood or prospects of the Rust project or its
    developers or users.

No such terms present.

  • Neither this policy nor any decisions made regarding targets shall create any
    binding agreement or estoppel by any party. If any member of an approving
    Rust team serves as one of the maintainers of a target, or has any legal or
    employment requirement (explicit or implicit) that might affect their
    decisions regarding a target, they must recuse themselves from any approval
    decisions regarding the target's tier status, though they may otherwise
    participate in discussions.

Understood.

  • This requirement does not prevent part or all of this policy from being
    cited in an explicit contract or work agreement (e.g. to implement or
    maintain support for a target). This requirement exists to ensure that a
    developer or team responsible for reviewing and approving a target does not
    face any legal threats or obligations that would prevent them from freely
    exercising their judgment in such approval, even if such judgment involves
    subjective matters or goes beyond the letter of these requirements.

Understood.

  • Tier 3 targets should attempt to implement as much of the standard libraries
    as possible and appropriate (core for most targets, alloc for targets
    that can support dynamic memory allocation, std for targets with an
    operating system or equivalent layer of system-provided functionality), but
    may leave some code unimplemented (either unavailable or stubbed out as
    appropriate), whether because the target makes it impossible to implement or
    challenging to implement. The authors of pull requests are not obligated to
    avoid calling any portions of the standard library on the basis of a tier 3
    target not implementing those portions.

aarch64-unknown-linux-pauthtest target has std library support, moreover all
library tests pass for the target.

  • The target must provide documentation for the Rust community explaining how
    to build for the target, using cross-compilation if possible. If the target
    supports running binaries, or running tests (even if they do not pass), the
    documentation must explain how to run such binaries or tests for the target,
    using emulation if possible or dedicated hardware if necessary.

Platform support document covers building instructions.

  • Tier 3 targets must not impose burden on the authors of pull requests, or
    other developers in the community, to maintain the target. In particular,
    do not post comments (automated or manual) on a PR that derail or suggest a
    block on the PR based on a tier 3 target. Do not send automated messages or
    notifications (via any medium, including via @) to a PR author or others
    involved with a PR regarding a tier 3 target, unless they have opted into
    such messages.

Understood.

  • Backlinks such as those generated by the issue/PR tracker when linking to
    an issue or PR are not considered a violation of this policy, within
    reason. However, such messages (even on a separate repository) must not
    generate notifications to anyone involved with a PR who has not requested
    such notifications.

Understood.

  • Patches adding or updating tier 3 targets must not break any existing tier 2
    or tier 1 target, and must not knowingly break another tier 3 target without
    approval of either the compiler team or the maintainers of the other tier 3
    target.

Understood.

  • In particular, this may come up when working on closely related targets,
    such as variations of the same architecture with different features. Avoid
    introducing unconditional uses of features that another variation of the
    target may not have; use conditional compilation or runtime detection, as
    appropriate, to let each target run code supported by that target.

Understood.

  • Tier 3 targets must be able to produce assembly using at least one of
    rustc's supported backends from any host target. (Having support in a fork
    of the backend is not sufficient, it must be upstream.)

It is expected that the target should be able to compile binaries on any systems
that are capable of compiling aarch64 code.

}
}

if sess.target.env == Env::Pauthtest {
Copy link
Copy Markdown
Author

@jchlanda jchlanda Apr 24, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

For a full context I'm going to bring comments from a draft PR into this one:

@asl
Note that pauthtest in clang is an interim thing. How we can enable pauth on, say, bare-metal platform? Or on some downstream platform?

@jchlanda
While there is already code gated by Env in codegen llvm, pauthtest is an outlier, such that all its functionality is behind the environment checks. Handling it earlier in the pipeline would make for a better design, one that decouples target/triple specifics from pauth logic. Maybe Session would be a good candidate to hold that info?

Clang does just that by solving platform/environment specifics on the driver level and later on basing the logic on language flags that are there regardless of the platform. Finally the flags are resolved to a concrete signing schema.

@tgross35

Note that pauthtest in clang is an interim thing. How we can enable pauth on, say, bare-metal platform? Or on some downstream platform?

Specifically for this bit, I suggested on libc that env could be set to musl since that's what most libraries will care about, and then use the TargetOptions.cfg_abi field for pauthtest. Which means that you can cfg(target_abi = "pauthtest") regardless of whether it's musl or bare metal.

Either way, it could also be encapsulated in an .should_emit_pauth() -> bool function that can do the relevant checks in one place.

View changes since the review

Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I've created a follow up task to unify handling of pointer authentication features.

Copy link
Copy Markdown
Author

@jchlanda jchlanda Apr 24, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

For a full context I'm going to bring comments from a draft PR into this one:

@tgross35
Mentioned this elsewhere but the target should land as no-std first. The initial support should only be the bare minimum to get core building via --target, everything else can come as a followup.

(Fine to keep this PR around as a WIP of course)

View changes since the review

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Landing as no-std first makes sense - smaller incremental step are always welcome :)

Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@davidtwco, @tgross35 I've extracted away all the library changes from this PR and created a follow up here. I'll update the branches on the new PR once this one lands.

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Feel free to submit it as a draft PR to rust-lang/rust, that makes it easier to reference.

Comment thread tests/codegen-llvm/pauth/pauth-attr-special-funcs.rs
Copy link
Copy Markdown
Author

@jchlanda jchlanda Apr 24, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

For a full context I'm going to bring comments from a draft PR into this one:

@tgross35
Could pauth-quicksort-*-driver be combined into one run-make test that builds/runs two different things in main? Since they can probably share some docs or reuse some code, and it saves the per-test overhead.

View changes since the review

Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@tgross35, not without some serious code juggling; conceptually those two tests perform identical tasks. However, the problem is that pauth-quicksort-c-driver creates a C executable that links against a Rust library. While pauth-quicksort-rust-driver does the opposite, creating a Rust executable that is linked against a C library.

I could put all the sources in one directory and handle compilations from one build script, but am not sure if that would make for a clear, easy to follow test?

@jchlanda
Copy link
Copy Markdown
Author

r? compiler

@rustbot rustbot added the T-compiler Relevant to the compiler team, which will review and decide on the PR/issue. label Apr 24, 2026
@jchlanda
Copy link
Copy Markdown
Author

cc: @davidtwco

arch: Arch::AArch64,

options: TargetOptions {
env: Env::Pauthtest,
Copy link
Copy Markdown
Contributor

@madsmtm madsmtm Apr 24, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I tend to think this should set target_abi = "pauth" instead of target_env = "pauth"? Or maybe an entirely new cfg(target_has_pointer_authentication)?

My motivation is that arm64e Apple targets have pointer authentication as well, but there target_env is used for things like Mac Catalyst too (target_env = "macabi").

View changes since the review

Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Target triple, aarch64-unknown-linux-pauthtest, mimics exactly what LLVM defines. With pauthtest being llvm::Triple::EnvironmentType.

What I don't like about explicitly using target_abi is that it might set an incorrect expectation. While it is true, that different authentication features, encoded in the signing schema, are not ABI-compatible with one another, pauthtest is not a new ABI, it follows C/C++ language ABI, with pointer authentication features. Also, while LLVM allows for -mabi=pauthtest (i.e.: calng --target=aarch64-linux -mabi=pauthtest) it is then normalized to environment part of the triple effective re-creating aarch64-unknown-linux-pauthtest.

WRT other targets supporting pointer authentication features. I have a follow up task to abstract that away. Clang handles it gracefully, where platform/environment is normalized to a set of language features, that are then used to create a concrete signing schema.

Copy link
Copy Markdown
Contributor

@madsmtm madsmtm Apr 27, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

What I don't like about explicitly using target_abi is that it might set an incorrect expectation. While it is true, that different authentication features, encoded in the signing schema, are not ABI-compatible with one another, pauthtest is not a new ABI, it follows C/C++ language ABI, with pointer authentication features.

That still feels like it can fit under the definition of "new ABI" IMO? At least if you take the view "if it's not compatible, it's a new ABI".

Anyhow, my primary argument here comes after reading the libc PR, it feels like being able to set target_env = "musl" would make things a lot simpler in most user code?

EDIT: I see now that you've also discussed that with @tgross35.

(If we do that, I'd probably lean towards this target being called aarch64-unknown-linux-muslpauth and it setting target_env = "musl" and target_abi = "pauth", because that would make cc-rs' parsing easier too).

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Currently musl is just an implementation detail and we do not want to set this in the stone. It is just a reference proof-of-concept libc implementation that was done on top of musl in the downstream patch, however, this does not imply that:

  • Upstream musl will support pauth anytime soon (and frankly speaking, the real-world implementation should be done a bit differently to ensure e.g. there are no exploitable signing oracles)
  • There might be other standard libraries supporting pauth (I am thinking about bare-metal world here mostly)
  • Still, some requirements would likely hold for any standard library implementations (e.g. while static link is in theory possible, in reality it would require lots of weird things especially when address discrimination is involved).

To add more on top of it – we're currently discussing ways how we can modify pauthtest approach in Clang/LLVM. So the target triple with environment is an interim solution (this was the motivation of test in the name) that will go away but for now we'd need it in some form :)

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

My gut instincts with regards to the target name match @madsmtm's. It's relatively easy for us to change, remove or add new targets with different triples for other standard libraries or environments, so we can make this target as descriptive as possible for the environment is corresponds to.

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

From a libs perspective I'd rather have target_env = "musl" as well if that tells us the API we are allowed to use. Otherwise this target is always going to be playing catch up when something gets gated on target_env = "musl" but doesn't account for pauthtest. I also don't know that we need to mirror LLVM if we could do something that's an improvement. (It's fine IMO to not say "musl" in the target triple but still specify that in the env, if that's one of the concerns.)

Perhaps worth a Zulip thread?

Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.


pub(crate) fn target() -> Target {
Target {
llvm_target: "aarch64-unknown-linux-pauthtest".into(),
Copy link
Copy Markdown
Contributor

@madsmtm madsmtm Apr 24, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I feel like the motivation for having "test" in the name is somewhat weak? If the intention is that the target is unstable, we have better ways of enforcing that (such as a check that you're on the nightly channel before using the target).

View changes since the review

Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

pauthtest mimics what LLVM uses: llvm::Triple::EnvironmentType.

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yeah, I understand that, but I'm not convinced we should carry that forwards? Do you have a link to the original motivation for that name in LLVM?

I guess it depends on how widely you expect to see usage of this target? If there's any point where libraries are going to do target_env = "pauthtest", where it would need to be updated to target_env = "pauth" or smth in the future, then I think it's a bad idea?

Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

There is an ongoing discussion as to how to move forward with the naming on the LLVM side (see the round table report). My preference would be to stick with pauthtest and wait for LLVM to come up with their new name, which I'll be happy to adopt here.

Comment thread tests/ui/abi/cross-crate/auxiliary/anon-extern-mod-cross-crate-1.rs Outdated
@JohnTitor
Copy link
Copy Markdown
Member

r? madsmtm

@rustbot rustbot assigned madsmtm and unassigned JohnTitor Apr 26, 2026
@rustbot
Copy link
Copy Markdown
Collaborator

rustbot commented Apr 26, 2026

madsmtm is currently at their maximum review capacity.
They may take a while to respond.

@rustbot
Copy link
Copy Markdown
Collaborator

rustbot commented Apr 27, 2026

Some changes occurred in compiler/rustc_codegen_gcc

cc @antoyo, @GuillaumeGomez

This PR modifies tests/auxiliary/minicore.rs.

cc @jieyouxu

This PR modifies src/bootstrap/src/core/config.

If appropriate, please update CONFIG_CHANGE_HISTORY in src/bootstrap/src/utils/change_tracker.rs.

These commits modify compiler targets.
(See the Target Tier Policy.)

compiletest directives have been modified. Please add or update docs for the
new or modified directive in src/doc/rustc-dev-guide/.

Some changes occurred in src/tools/compiletest

cc @jieyouxu

Some changes occurred in std_detect

cc @Amanieu, @folkertdev, @sayantn

Some changes occurred in src/doc/rustc/src/platform-support

cc @Noratrieb

@rustbot rustbot added A-compiletest Area: The compiletest test runner A-LLVM Area: Code generation parts specific to LLVM. Both correctness bugs and optimization-related issues. A-run-make Area: port run-make Makefiles to rmake.rs A-test-infra-minicore Area: `minicore` test auxiliary and `//@ add-core-stubs` A-testsuite Area: The testsuite used to check the correctness of rustc O-unix Operating system: Unix-like T-bootstrap Relevant to the bootstrap subteam: Rust's build system (x.py and src/bootstrap) labels Apr 27, 2026
valid_range: WrappingRange::full(pointer_size),
},
cx.type_ptr_ext(address_space),
pac_metadata,
Copy link
Copy Markdown
Contributor

@folkertdev folkertdev Apr 27, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
pac_metadata,
Some(pac_metadata),

and just have let pac_metadata not be wrapped in an option?

View changes since the review

Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm not sure, ideally we should only be signing function pointers (addresses, not values), so having the metadata wrapped works as a binary switch. It is true that now, for codegen llvm, we sign everything, but that is a workaround (more info here: #152532).

Comment thread compiler/rustc_codegen_llvm/src/llvm_util.rs Outdated
Comment thread compiler/rustc_codegen_ssa/src/traits/misc.rs
Comment thread compiler/rustc_codegen_llvm/src/llvm/ffi.rs Outdated

fn get_fn_addr(&self, instance: Instance<'tcx>) -> &'ll Value {
get_fn(self, instance)
fn get_fn_addr(&self, instance: Instance<'tcx>, pac: Option<PacMetadata>) -> &'ll Value {
Copy link
Copy Markdown
Contributor

@folkertdev folkertdev Apr 27, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This function should document the difference between using None versus Some(PacMetadata::default()). When is None allowed, versus when should the default be used?

View changes since the review

Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Done.

Comment thread tests/codegen-llvm/pauth/pauth-extern-c-direct-indirect-call.rs Outdated
Comment thread tests/codegen-llvm/pauth/pauth-extern-c-direct-indirect-call.rs Outdated
Comment thread tests/codegen-llvm/pauth/pauth-init-fini.rs
jchlanda and others added 2 commits May 4, 2026 08:02
Co-authored-by: Daniil Kovalev <dkovalev@accesssoftek.com>
`const_ptr_auth` wraps aroudn `LLVMRustConstPtrAuth`, which provides a
way to decorate a function pointer in `ConstPtrAuth`.
jchlanda added 7 commits May 4, 2026 08:02
Allow PAC metadata to be passed to `get_fn_addr` and related API
changes.
The set of supported attributes is:
function
* "aarch64-jump-table-hardening"
* "ptrauth-auth-traps"
* "ptrauth-calls"
* "ptrauth-indirect-gotos"
* "ptrauth-returns"
module
* "ptrauth-elf-got"
* "ptrauth-sign-personality"
Also:
* update tests to force dynamic library when targetting pauthtest
* various test fixes
* introduce end-to-end tests for pauthtest (in run-make)
@rust-bors
Copy link
Copy Markdown
Contributor

rust-bors Bot commented May 7, 2026

☔ The latest upstream changes (presumably #149509) made this pull request unmergeable. Please resolve the merge conflicts.

Copy link
Copy Markdown
Contributor

@madsmtm madsmtm left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Sorry it's taken me a little while, I've read Clang's docs on pointer authentication now, and feel that I have a bit better handle on things now. It's still new to me though, so forgive me if I get things blatantly wrong.


And thanks for splitting out the library parts, that makes this easier to land! Even further, I tend to think you should also split out the new target from the rustc_codegen_* changes - those are harder and need more scrutiny, and also less bikeshed-prone than the target.

Maybe something like Session::c_ptr_auth_abi() that in the beginning returns a simple enum PtrAuthAbi { None }, but which could be expanded with Pauthtest (when the target lands) and perhaps Arm64e in the future?

In any case, it would help me to have more separation between "this adds tooling / setup for doing pointer authentication with LLVM" and "this implements the specific ELF ABI that's in the works", but I get that it may be hard to separate, so don't fret too much if you can't.

View changes since this review

#if LLVM_VERSION_GE(22, 0)
auto *DeactivationSym = llvm::Constant::getNullValue(PtrTy);

return wrap(ConstantPtrAuth::get(C, KeyC, DiscC, AddrDiv, DeactivationSym));
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nit: I think I'd prefer for a wrapper like LLVMRustConstPtrAuth to expose the API to its fullest, could you add the DeactivationSym parameter to it, and pass None from the compiler instead?

With the parameter being unused in lower LLVM versions ofc.

}
// Only C ABI
let abi = cx.tcx.fn_sig(def_id).skip_binder().abi();
if !matches!(abi, ExternAbi::C { .. }) {
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

extern "C[-unwind]" fn() only? What about other platform ABIs like extern "system"?

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actually, I tend to think that we should do it for all function pointers, regardless of ABI and DefKind? This would likely help us uncover issues faster, would have the same opsem implications anyhow (extern "C" function pointers aren't special in that sense IIUC), and would mean Rust has the same protections by default as C.

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

In C, the arm64e ABI at least doesn't use address diversity (the discriminator is always 0), which is why I'm pretty sure it should be valid for us to do.

Rust probably could use address diversity, since it has stricter rules for what functions are ABI compatible (and it would be nice to have this noted in a comment here), but we don't have to decide on this yet: since Rust doesn't have a stable ABI, we can always change this later.

Comment on lines +426 to +428
OperandValue::Immediate(bx.get_fn_addr(instance,
Some(PacMetadata::default()),
))
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nit: formatting seems off here?

for lib in &mut collector.libs {
if tcx.sess.target.env == Env::Pauthtest {
if let NativeLibKind::Static { .. } = lib.kind {
if !tcx.sess.opts.unstable_opts.ui_testing {
Copy link
Copy Markdown
Contributor

@madsmtm madsmtm May 7, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nit: The "proper" way to handle this IIUC would be to make this a lint instead of a warning, and then add it as "-A", "pauthtest_xyz" in src/tools/compiletest/src/runtest.rs? But if it's temporary anyhow, then it's probably fine like this.

View changes since the review

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

A-compiletest Area: The compiletest test runner A-LLVM Area: Code generation parts specific to LLVM. Both correctness bugs and optimization-related issues. A-run-make Area: port run-make Makefiles to rmake.rs A-test-infra-minicore Area: `minicore` test auxiliary and `//@ add-core-stubs` A-testsuite Area: The testsuite used to check the correctness of rustc O-unix Operating system: Unix-like T-bootstrap Relevant to the bootstrap subteam: Rust's build system (x.py and src/bootstrap) T-compiler Relevant to the compiler team, which will review and decide on the PR/issue.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

8 participants