1 //===--- SanitizerArgs.cpp - Arguments for sanitizer tools  ---------------===//
2 //
3 //                     The LLVM Compiler Infrastructure
4 //
5 // This file is distributed under the University of Illinois Open Source
6 // License. See LICENSE.TXT for details.
7 //
8 //===----------------------------------------------------------------------===//
9 #include "clang/Driver/SanitizerArgs.h"
10 #include "Tools.h"
11 #include "clang/Basic/Sanitizers.h"
12 #include "clang/Driver/Driver.h"
13 #include "clang/Driver/DriverDiagnostic.h"
14 #include "clang/Driver/Options.h"
15 #include "clang/Driver/ToolChain.h"
16 #include "llvm/ADT/StringExtras.h"
17 #include "llvm/ADT/StringSwitch.h"
18 #include "llvm/Support/FileSystem.h"
19 #include "llvm/Support/Path.h"
20 #include "llvm/Support/SpecialCaseList.h"
21 #include <memory>
22 
23 using namespace clang;
24 using namespace clang::SanitizerKind;
25 using namespace clang::driver;
26 using namespace llvm::opt;
27 
28 enum : SanitizerMask {
29   NeedsUbsanRt = Undefined | Integer | CFI,
30   NeedsUbsanCxxRt = Vptr | CFI,
31   NotAllowedWithTrap = Vptr,
32   RequiresPIE = DataFlow,
33   NeedsUnwindTables = Address | Thread | Memory | DataFlow,
34   SupportsCoverage = Address | Memory | Leak | Undefined | Integer | DataFlow,
35   RecoverableByDefault = Undefined | Integer,
36   Unrecoverable = Unreachable | Return,
37   LegacyFsanitizeRecoverMask = Undefined | Integer,
38   NeedsLTO = CFI,
39   TrappingSupported =
40       (Undefined & ~Vptr) | UnsignedIntegerOverflow | LocalBounds | CFI,
41   TrappingDefault = CFI,
42 };
43 
44 enum CoverageFeature {
45   CoverageFunc = 1 << 0,
46   CoverageBB = 1 << 1,
47   CoverageEdge = 1 << 2,
48   CoverageIndirCall = 1 << 3,
49   CoverageTraceBB = 1 << 4,
50   CoverageTraceCmp = 1 << 5,
51   Coverage8bitCounters = 1 << 6,
52   CoverageTracePC = 1 << 7,
53 };
54 
55 /// Parse a -fsanitize= or -fno-sanitize= argument's values, diagnosing any
56 /// invalid components. Returns a SanitizerMask.
57 static SanitizerMask parseArgValues(const Driver &D, const llvm::opt::Arg *A,
58                                     bool DiagnoseErrors);
59 
60 /// Parse -f(no-)?sanitize-coverage= flag values, diagnosing any invalid
61 /// components. Returns OR of members of \c CoverageFeature enumeration.
62 static int parseCoverageFeatures(const Driver &D, const llvm::opt::Arg *A);
63 
64 /// Produce an argument string from ArgList \p Args, which shows how it
65 /// provides some sanitizer kind from \p Mask. For example, the argument list
66 /// "-fsanitize=thread,vptr -fsanitize=address" with mask \c NeedsUbsanRt
67 /// would produce "-fsanitize=vptr".
68 static std::string lastArgumentForMask(const Driver &D,
69                                        const llvm::opt::ArgList &Args,
70                                        SanitizerMask Mask);
71 
72 /// Produce an argument string from argument \p A, which shows how it provides
73 /// a value in \p Mask. For instance, the argument
74 /// "-fsanitize=address,alignment" with mask \c NeedsUbsanRt would produce
75 /// "-fsanitize=alignment".
76 static std::string describeSanitizeArg(const llvm::opt::Arg *A,
77                                        SanitizerMask Mask);
78 
79 /// Produce a string containing comma-separated names of sanitizers in \p
80 /// Sanitizers set.
81 static std::string toString(const clang::SanitizerSet &Sanitizers);
82 
83 static bool getDefaultBlacklist(const Driver &D, SanitizerMask Kinds,
84                                 std::string &BLPath) {
85   const char *BlacklistFile = nullptr;
86   if (Kinds & Address)
87     BlacklistFile = "asan_blacklist.txt";
88   else if (Kinds & Memory)
89     BlacklistFile = "msan_blacklist.txt";
90   else if (Kinds & Thread)
91     BlacklistFile = "tsan_blacklist.txt";
92   else if (Kinds & DataFlow)
93     BlacklistFile = "dfsan_abilist.txt";
94   else if (Kinds & CFI)
95     BlacklistFile = "cfi_blacklist.txt";
96 
97   if (BlacklistFile) {
98     clang::SmallString<64> Path(D.ResourceDir);
99     llvm::sys::path::append(Path, BlacklistFile);
100     BLPath = Path.str();
101     return true;
102   }
103   return false;
104 }
105 
106 /// Sets group bits for every group that has at least one representative already
107 /// enabled in \p Kinds.
108 static SanitizerMask setGroupBits(SanitizerMask Kinds) {
109 #define SANITIZER(NAME, ID)
110 #define SANITIZER_GROUP(NAME, ID, ALIAS)                                       \
111   if (Kinds & SanitizerKind::ID)                                               \
112     Kinds |= SanitizerKind::ID##Group;
113 #include "clang/Basic/Sanitizers.def"
114   return Kinds;
115 }
116 
117 static SanitizerMask parseSanitizeTrapArgs(const Driver &D,
118                                            const llvm::opt::ArgList &Args) {
119   SanitizerMask TrapRemove = 0; // During the loop below, the accumulated set of
120                                 // sanitizers disabled by the current sanitizer
121                                 // argument or any argument after it.
122   SanitizerMask TrappingKinds = 0;
123   SanitizerMask TrappingSupportedWithGroups = setGroupBits(TrappingSupported);
124 
125   for (ArgList::const_reverse_iterator I = Args.rbegin(), E = Args.rend();
126        I != E; ++I) {
127     const auto *Arg = *I;
128     if (Arg->getOption().matches(options::OPT_fsanitize_trap_EQ)) {
129       Arg->claim();
130       SanitizerMask Add = parseArgValues(D, Arg, true);
131       Add &= ~TrapRemove;
132       if (SanitizerMask InvalidValues = Add & ~TrappingSupportedWithGroups) {
133         SanitizerSet S;
134         S.Mask = InvalidValues;
135         D.Diag(diag::err_drv_unsupported_option_argument) << "-fsanitize-trap"
136                                                           << toString(S);
137       }
138       TrappingKinds |= expandSanitizerGroups(Add) & ~TrapRemove;
139     } else if (Arg->getOption().matches(options::OPT_fno_sanitize_trap_EQ)) {
140       Arg->claim();
141       TrapRemove |= expandSanitizerGroups(parseArgValues(D, Arg, true));
142     } else if (Arg->getOption().matches(
143                    options::OPT_fsanitize_undefined_trap_on_error)) {
144       Arg->claim();
145       TrappingKinds |=
146           expandSanitizerGroups(UndefinedGroup & ~TrapRemove) & ~TrapRemove;
147     } else if (Arg->getOption().matches(
148                    options::OPT_fno_sanitize_undefined_trap_on_error)) {
149       Arg->claim();
150       TrapRemove |= expandSanitizerGroups(UndefinedGroup);
151     }
152   }
153 
154   // Apply default trapping behavior.
155   TrappingKinds |= TrappingDefault & ~TrapRemove;
156 
157   return TrappingKinds;
158 }
159 
160 bool SanitizerArgs::needsUbsanRt() const {
161   return (Sanitizers.Mask & NeedsUbsanRt & ~TrapSanitizers.Mask) &&
162          !Sanitizers.has(Address) &&
163          !Sanitizers.has(Memory) &&
164          !Sanitizers.has(Thread) &&
165          !CfiCrossDso;
166 }
167 
168 bool SanitizerArgs::needsCfiRt() const {
169   return !(Sanitizers.Mask & CFI & ~TrapSanitizers.Mask) && CfiCrossDso;
170 }
171 
172 bool SanitizerArgs::needsCfiDiagRt() const {
173   return (Sanitizers.Mask & CFI & ~TrapSanitizers.Mask) && CfiCrossDso;
174 }
175 
176 bool SanitizerArgs::requiresPIE() const {
177   return NeedPIE || (Sanitizers.Mask & RequiresPIE);
178 }
179 
180 bool SanitizerArgs::needsUnwindTables() const {
181   return Sanitizers.Mask & NeedsUnwindTables;
182 }
183 
184 SanitizerArgs::SanitizerArgs(const ToolChain &TC,
185                              const llvm::opt::ArgList &Args) {
186   SanitizerMask AllRemove = 0;  // During the loop below, the accumulated set of
187                                 // sanitizers disabled by the current sanitizer
188                                 // argument or any argument after it.
189   SanitizerMask AllAddedKinds = 0;  // Mask of all sanitizers ever enabled by
190                                     // -fsanitize= flags (directly or via group
191                                     // expansion), some of which may be disabled
192                                     // later. Used to carefully prune
193                                     // unused-argument diagnostics.
194   SanitizerMask DiagnosedKinds = 0;  // All Kinds we have diagnosed up to now.
195                                      // Used to deduplicate diagnostics.
196   SanitizerMask Kinds = 0;
197   const SanitizerMask Supported = setGroupBits(TC.getSupportedSanitizers());
198   ToolChain::RTTIMode RTTIMode = TC.getRTTIMode();
199 
200   const Driver &D = TC.getDriver();
201   SanitizerMask TrappingKinds = parseSanitizeTrapArgs(D, Args);
202   SanitizerMask InvalidTrappingKinds = TrappingKinds & NotAllowedWithTrap;
203 
204   for (ArgList::const_reverse_iterator I = Args.rbegin(), E = Args.rend();
205        I != E; ++I) {
206     const auto *Arg = *I;
207     if (Arg->getOption().matches(options::OPT_fsanitize_EQ)) {
208       Arg->claim();
209       SanitizerMask Add = parseArgValues(D, Arg, true);
210       AllAddedKinds |= expandSanitizerGroups(Add);
211 
212       // Avoid diagnosing any sanitizer which is disabled later.
213       Add &= ~AllRemove;
214       // At this point we have not expanded groups, so any unsupported
215       // sanitizers in Add are those which have been explicitly enabled.
216       // Diagnose them.
217       if (SanitizerMask KindsToDiagnose =
218               Add & InvalidTrappingKinds & ~DiagnosedKinds) {
219         std::string Desc = describeSanitizeArg(*I, KindsToDiagnose);
220         D.Diag(diag::err_drv_argument_not_allowed_with)
221             << Desc << "-fsanitize-trap=undefined";
222         DiagnosedKinds |= KindsToDiagnose;
223       }
224       Add &= ~InvalidTrappingKinds;
225       if (SanitizerMask KindsToDiagnose = Add & ~Supported & ~DiagnosedKinds) {
226         std::string Desc = describeSanitizeArg(*I, KindsToDiagnose);
227         D.Diag(diag::err_drv_unsupported_opt_for_target)
228             << Desc << TC.getTriple().str();
229         DiagnosedKinds |= KindsToDiagnose;
230       }
231       Add &= Supported;
232 
233       // Test for -fno-rtti + explicit -fsanitizer=vptr before expanding groups
234       // so we don't error out if -fno-rtti and -fsanitize=undefined were
235       // passed.
236       if (Add & Vptr &&
237           (RTTIMode == ToolChain::RM_DisabledImplicitly ||
238            RTTIMode == ToolChain::RM_DisabledExplicitly)) {
239         if (RTTIMode == ToolChain::RM_DisabledImplicitly)
240           // Warn about not having rtti enabled if the vptr sanitizer is
241           // explicitly enabled
242           D.Diag(diag::warn_drv_disabling_vptr_no_rtti_default);
243         else {
244           const llvm::opt::Arg *NoRTTIArg = TC.getRTTIArg();
245           assert(NoRTTIArg &&
246                  "RTTI disabled explicitly but we have no argument!");
247           D.Diag(diag::err_drv_argument_not_allowed_with)
248               << "-fsanitize=vptr" << NoRTTIArg->getAsString(Args);
249         }
250 
251         // Take out the Vptr sanitizer from the enabled sanitizers
252         AllRemove |= Vptr;
253       }
254 
255       Add = expandSanitizerGroups(Add);
256       // Group expansion may have enabled a sanitizer which is disabled later.
257       Add &= ~AllRemove;
258       // Silently discard any unsupported sanitizers implicitly enabled through
259       // group expansion.
260       Add &= ~InvalidTrappingKinds;
261       Add &= Supported;
262 
263       Kinds |= Add;
264     } else if (Arg->getOption().matches(options::OPT_fno_sanitize_EQ)) {
265       Arg->claim();
266       SanitizerMask Remove = parseArgValues(D, Arg, true);
267       AllRemove |= expandSanitizerGroups(Remove);
268     }
269   }
270 
271   // We disable the vptr sanitizer if it was enabled by group expansion but RTTI
272   // is disabled.
273   if ((Kinds & Vptr) &&
274       (RTTIMode == ToolChain::RM_DisabledImplicitly ||
275        RTTIMode == ToolChain::RM_DisabledExplicitly)) {
276     Kinds &= ~Vptr;
277   }
278 
279   // Check that LTO is enabled if we need it.
280   if ((Kinds & NeedsLTO) && !D.isUsingLTO()) {
281     D.Diag(diag::err_drv_argument_only_allowed_with)
282         << lastArgumentForMask(D, Args, Kinds & NeedsLTO) << "-flto";
283   }
284 
285   // Report error if there are non-trapping sanitizers that require
286   // c++abi-specific  parts of UBSan runtime, and they are not provided by the
287   // toolchain. We don't have a good way to check the latter, so we just
288   // check if the toolchan supports vptr.
289   if (~Supported & Vptr) {
290     SanitizerMask KindsToDiagnose = Kinds & ~TrappingKinds & NeedsUbsanCxxRt;
291     // The runtime library supports the Microsoft C++ ABI, but only well enough
292     // for CFI. FIXME: Remove this once we support vptr on Windows.
293     if (TC.getTriple().isOSWindows())
294       KindsToDiagnose &= ~CFI;
295     if (KindsToDiagnose) {
296       SanitizerSet S;
297       S.Mask = KindsToDiagnose;
298       D.Diag(diag::err_drv_unsupported_opt_for_target)
299           << ("-fno-sanitize-trap=" + toString(S)) << TC.getTriple().str();
300       Kinds &= ~KindsToDiagnose;
301     }
302   }
303 
304   // Warn about incompatible groups of sanitizers.
305   std::pair<SanitizerMask, SanitizerMask> IncompatibleGroups[] = {
306       std::make_pair(Address, Thread), std::make_pair(Address, Memory),
307       std::make_pair(Thread, Memory), std::make_pair(Leak, Thread),
308       std::make_pair(Leak, Memory), std::make_pair(KernelAddress, Address),
309       std::make_pair(KernelAddress, Leak),
310       std::make_pair(KernelAddress, Thread),
311       std::make_pair(KernelAddress, Memory)};
312   for (auto G : IncompatibleGroups) {
313     SanitizerMask Group = G.first;
314     if (Kinds & Group) {
315       if (SanitizerMask Incompatible = Kinds & G.second) {
316         D.Diag(clang::diag::err_drv_argument_not_allowed_with)
317             << lastArgumentForMask(D, Args, Group)
318             << lastArgumentForMask(D, Args, Incompatible);
319         Kinds &= ~Incompatible;
320       }
321     }
322   }
323   // FIXME: Currently -fsanitize=leak is silently ignored in the presence of
324   // -fsanitize=address. Perhaps it should print an error, or perhaps
325   // -f(-no)sanitize=leak should change whether leak detection is enabled by
326   // default in ASan?
327 
328   // Parse -f(no-)?sanitize-recover flags.
329   SanitizerMask RecoverableKinds = RecoverableByDefault;
330   SanitizerMask DiagnosedUnrecoverableKinds = 0;
331   for (const auto *Arg : Args) {
332     const char *DeprecatedReplacement = nullptr;
333     if (Arg->getOption().matches(options::OPT_fsanitize_recover)) {
334       DeprecatedReplacement = "-fsanitize-recover=undefined,integer";
335       RecoverableKinds |= expandSanitizerGroups(LegacyFsanitizeRecoverMask);
336       Arg->claim();
337     } else if (Arg->getOption().matches(options::OPT_fno_sanitize_recover)) {
338       DeprecatedReplacement = "-fno-sanitize-recover=undefined,integer";
339       RecoverableKinds &= ~expandSanitizerGroups(LegacyFsanitizeRecoverMask);
340       Arg->claim();
341     } else if (Arg->getOption().matches(options::OPT_fsanitize_recover_EQ)) {
342       SanitizerMask Add = parseArgValues(D, Arg, true);
343       // Report error if user explicitly tries to recover from unrecoverable
344       // sanitizer.
345       if (SanitizerMask KindsToDiagnose =
346               Add & Unrecoverable & ~DiagnosedUnrecoverableKinds) {
347         SanitizerSet SetToDiagnose;
348         SetToDiagnose.Mask |= KindsToDiagnose;
349         D.Diag(diag::err_drv_unsupported_option_argument)
350             << Arg->getOption().getName() << toString(SetToDiagnose);
351         DiagnosedUnrecoverableKinds |= KindsToDiagnose;
352       }
353       RecoverableKinds |= expandSanitizerGroups(Add);
354       Arg->claim();
355     } else if (Arg->getOption().matches(options::OPT_fno_sanitize_recover_EQ)) {
356       RecoverableKinds &= ~expandSanitizerGroups(parseArgValues(D, Arg, true));
357       Arg->claim();
358     }
359     if (DeprecatedReplacement) {
360       D.Diag(diag::warn_drv_deprecated_arg) << Arg->getAsString(Args)
361                                             << DeprecatedReplacement;
362     }
363   }
364   RecoverableKinds &= Kinds;
365   RecoverableKinds &= ~Unrecoverable;
366 
367   TrappingKinds &= Kinds;
368 
369   // Setup blacklist files.
370   // Add default blacklist from resource directory.
371   {
372     std::string BLPath;
373     if (getDefaultBlacklist(D, Kinds, BLPath) && llvm::sys::fs::exists(BLPath))
374       BlacklistFiles.push_back(BLPath);
375   }
376   // Parse -f(no-)sanitize-blacklist options.
377   for (const auto *Arg : Args) {
378     if (Arg->getOption().matches(options::OPT_fsanitize_blacklist)) {
379       Arg->claim();
380       std::string BLPath = Arg->getValue();
381       if (llvm::sys::fs::exists(BLPath)) {
382         BlacklistFiles.push_back(BLPath);
383         ExtraDeps.push_back(BLPath);
384       } else
385         D.Diag(clang::diag::err_drv_no_such_file) << BLPath;
386 
387     } else if (Arg->getOption().matches(options::OPT_fno_sanitize_blacklist)) {
388       Arg->claim();
389       BlacklistFiles.clear();
390       ExtraDeps.clear();
391     }
392   }
393   // Validate blacklists format.
394   {
395     std::string BLError;
396     std::unique_ptr<llvm::SpecialCaseList> SCL(
397         llvm::SpecialCaseList::create(BlacklistFiles, BLError));
398     if (!SCL.get())
399       D.Diag(clang::diag::err_drv_malformed_sanitizer_blacklist) << BLError;
400   }
401 
402   // Parse -f[no-]sanitize-memory-track-origins[=level] options.
403   if (AllAddedKinds & Memory) {
404     if (Arg *A =
405             Args.getLastArg(options::OPT_fsanitize_memory_track_origins_EQ,
406                             options::OPT_fsanitize_memory_track_origins,
407                             options::OPT_fno_sanitize_memory_track_origins)) {
408       if (A->getOption().matches(options::OPT_fsanitize_memory_track_origins)) {
409         MsanTrackOrigins = 2;
410       } else if (A->getOption().matches(
411                      options::OPT_fno_sanitize_memory_track_origins)) {
412         MsanTrackOrigins = 0;
413       } else {
414         StringRef S = A->getValue();
415         if (S.getAsInteger(0, MsanTrackOrigins) || MsanTrackOrigins < 0 ||
416             MsanTrackOrigins > 2) {
417           D.Diag(clang::diag::err_drv_invalid_value) << A->getAsString(Args) << S;
418         }
419       }
420     }
421     MsanUseAfterDtor =
422         Args.hasArg(options::OPT_fsanitize_memory_use_after_dtor);
423     NeedPIE |= !(TC.getTriple().isOSLinux() &&
424                  TC.getTriple().getArch() == llvm::Triple::x86_64);
425   }
426 
427   if (AllAddedKinds & CFI) {
428     CfiCrossDso = Args.hasFlag(options::OPT_fsanitize_cfi_cross_dso,
429                                options::OPT_fno_sanitize_cfi_cross_dso, false);
430     // Without PIE, external function address may resolve to a PLT record, which
431     // can not be verified by the target module.
432     NeedPIE |= CfiCrossDso;
433   }
434 
435   Stats = Args.hasFlag(options::OPT_fsanitize_stats,
436                        options::OPT_fno_sanitize_stats, false);
437 
438   // Parse -f(no-)?sanitize-coverage flags if coverage is supported by the
439   // enabled sanitizers.
440   for (const auto *Arg : Args) {
441     if (Arg->getOption().matches(options::OPT_fsanitize_coverage)) {
442       int LegacySanitizeCoverage;
443       if (Arg->getNumValues() == 1 &&
444           !StringRef(Arg->getValue(0))
445                .getAsInteger(0, LegacySanitizeCoverage) &&
446           LegacySanitizeCoverage >= 0 && LegacySanitizeCoverage <= 4) {
447         switch (LegacySanitizeCoverage) {
448         case 0:
449           D.Diag(diag::warn_drv_deprecated_arg) << Arg->getAsString(Args)
450                                                 << "-fsanitize-coverage=";
451           CoverageFeatures = 0;
452           break;
453         case 1:
454           D.Diag(diag::warn_drv_deprecated_arg) << Arg->getAsString(Args)
455                                                 << "-fsanitize-coverage=func";
456           CoverageFeatures = CoverageFunc;
457           break;
458         case 2:
459           D.Diag(diag::warn_drv_deprecated_arg) << Arg->getAsString(Args)
460                                                 << "-fsanitize-coverage=bb";
461           CoverageFeatures = CoverageBB;
462           break;
463         case 3:
464           D.Diag(diag::warn_drv_deprecated_arg) << Arg->getAsString(Args)
465                                                 << "-fsanitize-coverage=edge";
466           CoverageFeatures = CoverageEdge;
467           break;
468         case 4:
469           D.Diag(diag::warn_drv_deprecated_arg)
470               << Arg->getAsString(Args)
471               << "-fsanitize-coverage=edge,indirect-calls";
472           CoverageFeatures = CoverageEdge | CoverageIndirCall;
473           break;
474         }
475         continue;
476       }
477       CoverageFeatures |= parseCoverageFeatures(D, Arg);
478       // If there is trace-pc, allow it w/o any of the sanitizers.
479       // Otherwise, require that one of the supported sanitizers is present.
480       if ((CoverageFeatures & CoverageTracePC) ||
481           (AllAddedKinds & SupportsCoverage)) {
482         Arg->claim();
483       }
484     } else if (Arg->getOption().matches(options::OPT_fno_sanitize_coverage)) {
485       Arg->claim();
486       CoverageFeatures &= ~parseCoverageFeatures(D, Arg);
487     }
488   }
489   // Choose at most one coverage type: function, bb, or edge.
490   if ((CoverageFeatures & CoverageFunc) && (CoverageFeatures & CoverageBB))
491     D.Diag(clang::diag::err_drv_argument_not_allowed_with)
492         << "-fsanitize-coverage=func"
493         << "-fsanitize-coverage=bb";
494   if ((CoverageFeatures & CoverageFunc) && (CoverageFeatures & CoverageEdge))
495     D.Diag(clang::diag::err_drv_argument_not_allowed_with)
496         << "-fsanitize-coverage=func"
497         << "-fsanitize-coverage=edge";
498   if ((CoverageFeatures & CoverageBB) && (CoverageFeatures & CoverageEdge))
499     D.Diag(clang::diag::err_drv_argument_not_allowed_with)
500         << "-fsanitize-coverage=bb"
501         << "-fsanitize-coverage=edge";
502   // Basic block tracing and 8-bit counters require some type of coverage
503   // enabled.
504   int CoverageTypes = CoverageFunc | CoverageBB | CoverageEdge;
505   if ((CoverageFeatures & CoverageTraceBB) &&
506       !(CoverageFeatures & CoverageTypes))
507     D.Diag(clang::diag::err_drv_argument_only_allowed_with)
508         << "-fsanitize-coverage=trace-bb"
509         << "-fsanitize-coverage=(func|bb|edge)";
510   if ((CoverageFeatures & Coverage8bitCounters) &&
511       !(CoverageFeatures & CoverageTypes))
512     D.Diag(clang::diag::err_drv_argument_only_allowed_with)
513         << "-fsanitize-coverage=8bit-counters"
514         << "-fsanitize-coverage=(func|bb|edge)";
515   // trace-pc w/o func/bb/edge implies edge.
516   if ((CoverageFeatures & CoverageTracePC) &&
517       !(CoverageFeatures & CoverageTypes))
518     CoverageFeatures |= CoverageEdge;
519 
520   if (AllAddedKinds & Address) {
521     AsanSharedRuntime =
522         Args.hasArg(options::OPT_shared_libasan) || TC.getTriple().isAndroid();
523     NeedPIE |= TC.getTriple().isAndroid();
524     if (Arg *A =
525             Args.getLastArg(options::OPT_fsanitize_address_field_padding)) {
526         StringRef S = A->getValue();
527         // Legal values are 0 and 1, 2, but in future we may add more levels.
528         if (S.getAsInteger(0, AsanFieldPadding) || AsanFieldPadding < 0 ||
529             AsanFieldPadding > 2) {
530           D.Diag(clang::diag::err_drv_invalid_value) << A->getAsString(Args) << S;
531         }
532     }
533 
534     if (Arg *WindowsDebugRTArg =
535             Args.getLastArg(options::OPT__SLASH_MTd, options::OPT__SLASH_MT,
536                             options::OPT__SLASH_MDd, options::OPT__SLASH_MD,
537                             options::OPT__SLASH_LDd, options::OPT__SLASH_LD)) {
538       switch (WindowsDebugRTArg->getOption().getID()) {
539       case options::OPT__SLASH_MTd:
540       case options::OPT__SLASH_MDd:
541       case options::OPT__SLASH_LDd:
542         D.Diag(clang::diag::err_drv_argument_not_allowed_with)
543             << WindowsDebugRTArg->getAsString(Args)
544             << lastArgumentForMask(D, Args, Address);
545         D.Diag(clang::diag::note_drv_address_sanitizer_debug_runtime);
546       }
547     }
548   }
549 
550   // Parse -link-cxx-sanitizer flag.
551   LinkCXXRuntimes =
552       Args.hasArg(options::OPT_fsanitize_link_cxx_runtime) || D.CCCIsCXX();
553 
554   // Finally, initialize the set of available and recoverable sanitizers.
555   Sanitizers.Mask |= Kinds;
556   RecoverableSanitizers.Mask |= RecoverableKinds;
557   TrapSanitizers.Mask |= TrappingKinds;
558 }
559 
560 static std::string toString(const clang::SanitizerSet &Sanitizers) {
561   std::string Res;
562 #define SANITIZER(NAME, ID)                                                    \
563   if (Sanitizers.has(ID)) {                                                    \
564     if (!Res.empty())                                                          \
565       Res += ",";                                                              \
566     Res += NAME;                                                               \
567   }
568 #include "clang/Basic/Sanitizers.def"
569   return Res;
570 }
571 
572 static void addIncludeLinkerOption(const ToolChain &TC,
573                                    const llvm::opt::ArgList &Args,
574                                    llvm::opt::ArgStringList &CmdArgs,
575                                    StringRef SymbolName) {
576   SmallString<64> LinkerOptionFlag;
577   LinkerOptionFlag = "--linker-option=/include:";
578   if (TC.getTriple().getArch() == llvm::Triple::x86) {
579     // Win32 mangles C function names with a '_' prefix.
580     LinkerOptionFlag += '_';
581   }
582   LinkerOptionFlag += SymbolName;
583   CmdArgs.push_back(Args.MakeArgString(LinkerOptionFlag));
584 }
585 
586 void SanitizerArgs::addArgs(const ToolChain &TC, const llvm::opt::ArgList &Args,
587                             llvm::opt::ArgStringList &CmdArgs,
588                             types::ID InputType) const {
589   // Translate available CoverageFeatures to corresponding clang-cc1 flags.
590   // Do it even if Sanitizers.empty() since some forms of coverage don't require
591   // sanitizers.
592   std::pair<int, const char *> CoverageFlags[] = {
593     std::make_pair(CoverageFunc, "-fsanitize-coverage-type=1"),
594     std::make_pair(CoverageBB, "-fsanitize-coverage-type=2"),
595     std::make_pair(CoverageEdge, "-fsanitize-coverage-type=3"),
596     std::make_pair(CoverageIndirCall, "-fsanitize-coverage-indirect-calls"),
597     std::make_pair(CoverageTraceBB, "-fsanitize-coverage-trace-bb"),
598     std::make_pair(CoverageTraceCmp, "-fsanitize-coverage-trace-cmp"),
599     std::make_pair(Coverage8bitCounters, "-fsanitize-coverage-8bit-counters"),
600     std::make_pair(CoverageTracePC, "-fsanitize-coverage-trace-pc")};
601   for (auto F : CoverageFlags) {
602     if (CoverageFeatures & F.first)
603       CmdArgs.push_back(Args.MakeArgString(F.second));
604   }
605 
606   if (Sanitizers.empty())
607     return;
608   CmdArgs.push_back(Args.MakeArgString("-fsanitize=" + toString(Sanitizers)));
609 
610   if (!RecoverableSanitizers.empty())
611     CmdArgs.push_back(Args.MakeArgString("-fsanitize-recover=" +
612                                          toString(RecoverableSanitizers)));
613 
614   if (!TrapSanitizers.empty())
615     CmdArgs.push_back(
616         Args.MakeArgString("-fsanitize-trap=" + toString(TrapSanitizers)));
617 
618   for (const auto &BLPath : BlacklistFiles) {
619     SmallString<64> BlacklistOpt("-fsanitize-blacklist=");
620     BlacklistOpt += BLPath;
621     CmdArgs.push_back(Args.MakeArgString(BlacklistOpt));
622   }
623   for (const auto &Dep : ExtraDeps) {
624     SmallString<64> ExtraDepOpt("-fdepfile-entry=");
625     ExtraDepOpt += Dep;
626     CmdArgs.push_back(Args.MakeArgString(ExtraDepOpt));
627   }
628 
629   if (MsanTrackOrigins)
630     CmdArgs.push_back(Args.MakeArgString("-fsanitize-memory-track-origins=" +
631                                          llvm::utostr(MsanTrackOrigins)));
632 
633   if (MsanUseAfterDtor)
634     CmdArgs.push_back(Args.MakeArgString("-fsanitize-memory-use-after-dtor"));
635 
636   if (CfiCrossDso)
637     CmdArgs.push_back(Args.MakeArgString("-fsanitize-cfi-cross-dso"));
638 
639   if (Stats)
640     CmdArgs.push_back(Args.MakeArgString("-fsanitize-stats"));
641 
642   if (AsanFieldPadding)
643     CmdArgs.push_back(Args.MakeArgString("-fsanitize-address-field-padding=" +
644                                          llvm::utostr(AsanFieldPadding)));
645 
646   // MSan: Workaround for PR16386.
647   // ASan: This is mainly to help LSan with cases such as
648   // https://code.google.com/p/address-sanitizer/issues/detail?id=373
649   // We can't make this conditional on -fsanitize=leak, as that flag shouldn't
650   // affect compilation.
651   if (Sanitizers.has(Memory) || Sanitizers.has(Address))
652     CmdArgs.push_back(Args.MakeArgString("-fno-assume-sane-operator-new"));
653 
654   if (TC.getTriple().isOSWindows() && needsUbsanRt()) {
655     // Instruct the code generator to embed linker directives in the object file
656     // that cause the required runtime libraries to be linked.
657     CmdArgs.push_back(Args.MakeArgString(
658         "--dependent-lib=" + TC.getCompilerRT(Args, "ubsan_standalone")));
659     if (types::isCXX(InputType))
660       CmdArgs.push_back(Args.MakeArgString(
661           "--dependent-lib=" + TC.getCompilerRT(Args, "ubsan_standalone_cxx")));
662   }
663   if (TC.getTriple().isOSWindows() && needsStatsRt()) {
664     CmdArgs.push_back(Args.MakeArgString("--dependent-lib=" +
665                                          TC.getCompilerRT(Args, "stats_client")));
666 
667     // The main executable must export the stats runtime.
668     // FIXME: Only exporting from the main executable (e.g. based on whether the
669     // translation unit defines main()) would save a little space, but having
670     // multiple copies of the runtime shouldn't hurt.
671     CmdArgs.push_back(Args.MakeArgString("--dependent-lib=" +
672                                          TC.getCompilerRT(Args, "stats")));
673     addIncludeLinkerOption(TC, Args, CmdArgs, "__sanitizer_stats_register");
674   }
675 }
676 
677 SanitizerMask parseArgValues(const Driver &D, const llvm::opt::Arg *A,
678                              bool DiagnoseErrors) {
679   assert((A->getOption().matches(options::OPT_fsanitize_EQ) ||
680           A->getOption().matches(options::OPT_fno_sanitize_EQ) ||
681           A->getOption().matches(options::OPT_fsanitize_recover_EQ) ||
682           A->getOption().matches(options::OPT_fno_sanitize_recover_EQ) ||
683           A->getOption().matches(options::OPT_fsanitize_trap_EQ) ||
684           A->getOption().matches(options::OPT_fno_sanitize_trap_EQ)) &&
685          "Invalid argument in parseArgValues!");
686   SanitizerMask Kinds = 0;
687   for (int i = 0, n = A->getNumValues(); i != n; ++i) {
688     const char *Value = A->getValue(i);
689     SanitizerMask Kind;
690     // Special case: don't accept -fsanitize=all.
691     if (A->getOption().matches(options::OPT_fsanitize_EQ) &&
692         0 == strcmp("all", Value))
693       Kind = 0;
694     else
695       Kind = parseSanitizerValue(Value, /*AllowGroups=*/true);
696 
697     if (Kind)
698       Kinds |= Kind;
699     else if (DiagnoseErrors)
700       D.Diag(clang::diag::err_drv_unsupported_option_argument)
701           << A->getOption().getName() << Value;
702   }
703   return Kinds;
704 }
705 
706 int parseCoverageFeatures(const Driver &D, const llvm::opt::Arg *A) {
707   assert(A->getOption().matches(options::OPT_fsanitize_coverage) ||
708          A->getOption().matches(options::OPT_fno_sanitize_coverage));
709   int Features = 0;
710   for (int i = 0, n = A->getNumValues(); i != n; ++i) {
711     const char *Value = A->getValue(i);
712     int F = llvm::StringSwitch<int>(Value)
713         .Case("func", CoverageFunc)
714         .Case("bb", CoverageBB)
715         .Case("edge", CoverageEdge)
716         .Case("indirect-calls", CoverageIndirCall)
717         .Case("trace-bb", CoverageTraceBB)
718         .Case("trace-cmp", CoverageTraceCmp)
719         .Case("8bit-counters", Coverage8bitCounters)
720         .Case("trace-pc", CoverageTracePC)
721         .Default(0);
722     if (F == 0)
723       D.Diag(clang::diag::err_drv_unsupported_option_argument)
724           << A->getOption().getName() << Value;
725     Features |= F;
726   }
727   return Features;
728 }
729 
730 std::string lastArgumentForMask(const Driver &D, const llvm::opt::ArgList &Args,
731                                 SanitizerMask Mask) {
732   for (llvm::opt::ArgList::const_reverse_iterator I = Args.rbegin(),
733                                                   E = Args.rend();
734        I != E; ++I) {
735     const auto *Arg = *I;
736     if (Arg->getOption().matches(options::OPT_fsanitize_EQ)) {
737       SanitizerMask AddKinds =
738           expandSanitizerGroups(parseArgValues(D, Arg, false));
739       if (AddKinds & Mask)
740         return describeSanitizeArg(Arg, Mask);
741     } else if (Arg->getOption().matches(options::OPT_fno_sanitize_EQ)) {
742       SanitizerMask RemoveKinds =
743           expandSanitizerGroups(parseArgValues(D, Arg, false));
744       Mask &= ~RemoveKinds;
745     }
746   }
747   llvm_unreachable("arg list didn't provide expected value");
748 }
749 
750 std::string describeSanitizeArg(const llvm::opt::Arg *A, SanitizerMask Mask) {
751   assert(A->getOption().matches(options::OPT_fsanitize_EQ)
752          && "Invalid argument in describeSanitizerArg!");
753 
754   std::string Sanitizers;
755   for (int i = 0, n = A->getNumValues(); i != n; ++i) {
756     if (expandSanitizerGroups(
757             parseSanitizerValue(A->getValue(i), /*AllowGroups=*/true)) &
758         Mask) {
759       if (!Sanitizers.empty())
760         Sanitizers += ",";
761       Sanitizers += A->getValue(i);
762     }
763   }
764 
765   assert(!Sanitizers.empty() && "arg didn't provide expected value");
766   return "-fsanitize=" + Sanitizers;
767 }
768