1 //===--- SanitizerArgs.cpp - Arguments for sanitizer tools  ---------------===//
2 //
3 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4 // See https://llvm.org/LICENSE.txt for license information.
5 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6 //
7 //===----------------------------------------------------------------------===//
8 #include "clang/Driver/SanitizerArgs.h"
9 #include "ToolChains/CommonArgs.h"
10 #include "clang/Basic/Sanitizers.h"
11 #include "clang/Driver/Driver.h"
12 #include "clang/Driver/DriverDiagnostic.h"
13 #include "clang/Driver/Options.h"
14 #include "clang/Driver/ToolChain.h"
15 #include "llvm/ADT/StringExtras.h"
16 #include "llvm/ADT/StringSwitch.h"
17 #include "llvm/Support/Path.h"
18 #include "llvm/Support/SpecialCaseList.h"
19 #include "llvm/Support/TargetParser.h"
20 #include "llvm/Support/VirtualFileSystem.h"
21 #include <memory>
22 
23 using namespace clang;
24 using namespace clang::driver;
25 using namespace llvm::opt;
26 
27 static const SanitizerMask NeedsUbsanRt =
28     SanitizerKind::Undefined | SanitizerKind::Integer |
29     SanitizerKind::ImplicitConversion | SanitizerKind::Nullability |
30     SanitizerKind::CFI | SanitizerKind::FloatDivideByZero |
31     SanitizerKind::ObjCCast;
32 static const SanitizerMask NeedsUbsanCxxRt =
33     SanitizerKind::Vptr | SanitizerKind::CFI;
34 static const SanitizerMask NotAllowedWithTrap = SanitizerKind::Vptr;
35 static const SanitizerMask NotAllowedWithMinimalRuntime =
36     SanitizerKind::Function | SanitizerKind::Vptr;
37 static const SanitizerMask RequiresPIE =
38     SanitizerKind::DataFlow | SanitizerKind::HWAddress | SanitizerKind::Scudo;
39 static const SanitizerMask NeedsUnwindTables =
40     SanitizerKind::Address | SanitizerKind::HWAddress | SanitizerKind::Thread |
41     SanitizerKind::Memory | SanitizerKind::DataFlow;
42 static const SanitizerMask SupportsCoverage =
43     SanitizerKind::Address | SanitizerKind::HWAddress |
44     SanitizerKind::KernelAddress | SanitizerKind::KernelHWAddress |
45     SanitizerKind::MemTag | SanitizerKind::Memory |
46     SanitizerKind::KernelMemory | SanitizerKind::Leak |
47     SanitizerKind::Undefined | SanitizerKind::Integer | SanitizerKind::Bounds |
48     SanitizerKind::ImplicitConversion | SanitizerKind::Nullability |
49     SanitizerKind::DataFlow | SanitizerKind::Fuzzer |
50     SanitizerKind::FuzzerNoLink | SanitizerKind::FloatDivideByZero |
51     SanitizerKind::SafeStack | SanitizerKind::ShadowCallStack |
52     SanitizerKind::Thread | SanitizerKind::ObjCCast;
53 static const SanitizerMask RecoverableByDefault =
54     SanitizerKind::Undefined | SanitizerKind::Integer |
55     SanitizerKind::ImplicitConversion | SanitizerKind::Nullability |
56     SanitizerKind::FloatDivideByZero | SanitizerKind::ObjCCast;
57 static const SanitizerMask Unrecoverable =
58     SanitizerKind::Unreachable | SanitizerKind::Return;
59 static const SanitizerMask AlwaysRecoverable =
60     SanitizerKind::KernelAddress | SanitizerKind::KernelHWAddress;
61 static const SanitizerMask NeedsLTO = SanitizerKind::CFI;
62 static const SanitizerMask TrappingSupported =
63     (SanitizerKind::Undefined & ~SanitizerKind::Vptr) |
64     SanitizerKind::UnsignedIntegerOverflow | SanitizerKind::ImplicitConversion |
65     SanitizerKind::Nullability | SanitizerKind::LocalBounds |
66     SanitizerKind::CFI | SanitizerKind::FloatDivideByZero |
67     SanitizerKind::ObjCCast;
68 static const SanitizerMask TrappingDefault = SanitizerKind::CFI;
69 static const SanitizerMask CFIClasses =
70     SanitizerKind::CFIVCall | SanitizerKind::CFINVCall |
71     SanitizerKind::CFIMFCall | SanitizerKind::CFIDerivedCast |
72     SanitizerKind::CFIUnrelatedCast;
73 static const SanitizerMask CompatibleWithMinimalRuntime =
74     TrappingSupported | SanitizerKind::Scudo | SanitizerKind::ShadowCallStack |
75     SanitizerKind::MemTag;
76 
77 enum CoverageFeature {
78   CoverageFunc = 1 << 0,
79   CoverageBB = 1 << 1,
80   CoverageEdge = 1 << 2,
81   CoverageIndirCall = 1 << 3,
82   CoverageTraceBB = 1 << 4, // Deprecated.
83   CoverageTraceCmp = 1 << 5,
84   CoverageTraceDiv = 1 << 6,
85   CoverageTraceGep = 1 << 7,
86   Coverage8bitCounters = 1 << 8, // Deprecated.
87   CoverageTracePC = 1 << 9,
88   CoverageTracePCGuard = 1 << 10,
89   CoverageNoPrune = 1 << 11,
90   CoverageInline8bitCounters = 1 << 12,
91   CoveragePCTable = 1 << 13,
92   CoverageStackDepth = 1 << 14,
93   CoverageInlineBoolFlag = 1 << 15,
94 };
95 
96 /// Parse a -fsanitize= or -fno-sanitize= argument's values, diagnosing any
97 /// invalid components. Returns a SanitizerMask.
98 static SanitizerMask parseArgValues(const Driver &D, const llvm::opt::Arg *A,
99                                     bool DiagnoseErrors);
100 
101 /// Parse -f(no-)?sanitize-coverage= flag values, diagnosing any invalid
102 /// components. Returns OR of members of \c CoverageFeature enumeration.
103 static int parseCoverageFeatures(const Driver &D, const llvm::opt::Arg *A);
104 
105 /// Produce an argument string from ArgList \p Args, which shows how it
106 /// provides some sanitizer kind from \p Mask. For example, the argument list
107 /// "-fsanitize=thread,vptr -fsanitize=address" with mask \c NeedsUbsanRt
108 /// would produce "-fsanitize=vptr".
109 static std::string lastArgumentForMask(const Driver &D,
110                                        const llvm::opt::ArgList &Args,
111                                        SanitizerMask Mask);
112 
113 /// Produce an argument string from argument \p A, which shows how it provides
114 /// a value in \p Mask. For instance, the argument
115 /// "-fsanitize=address,alignment" with mask \c NeedsUbsanRt would produce
116 /// "-fsanitize=alignment".
117 static std::string describeSanitizeArg(const llvm::opt::Arg *A,
118                                        SanitizerMask Mask);
119 
120 /// Produce a string containing comma-separated names of sanitizers in \p
121 /// Sanitizers set.
122 static std::string toString(const clang::SanitizerSet &Sanitizers);
123 
124 static void validateSpecialCaseListFormat(const Driver &D,
125                                           std::vector<std::string> &SCLFiles,
126                                           unsigned MalformedSCLErrorDiagID) {
127   if (SCLFiles.empty())
128     return;
129 
130   std::string BLError;
131   std::unique_ptr<llvm::SpecialCaseList> SCL(
132       llvm::SpecialCaseList::create(SCLFiles, D.getVFS(), BLError));
133   if (!SCL.get())
134     D.Diag(MalformedSCLErrorDiagID) << BLError;
135 }
136 
137 static void addDefaultBlacklists(const Driver &D, SanitizerMask Kinds,
138                                  std::vector<std::string> &BlacklistFiles) {
139   struct Blacklist {
140     const char *File;
141     SanitizerMask Mask;
142   } Blacklists[] = {{"asan_blacklist.txt", SanitizerKind::Address},
143                     {"hwasan_blacklist.txt", SanitizerKind::HWAddress},
144                     {"memtag_blacklist.txt", SanitizerKind::MemTag},
145                     {"msan_blacklist.txt", SanitizerKind::Memory},
146                     {"tsan_blacklist.txt", SanitizerKind::Thread},
147                     {"dfsan_abilist.txt", SanitizerKind::DataFlow},
148                     {"cfi_blacklist.txt", SanitizerKind::CFI},
149                     {"ubsan_blacklist.txt",
150                      SanitizerKind::Undefined | SanitizerKind::Integer |
151                          SanitizerKind::Nullability |
152                          SanitizerKind::FloatDivideByZero}};
153 
154   for (auto BL : Blacklists) {
155     if (!(Kinds & BL.Mask))
156       continue;
157 
158     clang::SmallString<64> Path(D.ResourceDir);
159     llvm::sys::path::append(Path, "share", BL.File);
160     if (D.getVFS().exists(Path))
161       BlacklistFiles.push_back(std::string(Path.str()));
162     else if (BL.Mask == SanitizerKind::CFI)
163       // If cfi_blacklist.txt cannot be found in the resource dir, driver
164       // should fail.
165       D.Diag(clang::diag::err_drv_no_such_file) << Path;
166   }
167   validateSpecialCaseListFormat(
168       D, BlacklistFiles, clang::diag::err_drv_malformed_sanitizer_blacklist);
169 }
170 
171 /// Parse -f(no-)?sanitize-(coverage-)?(white|black)list argument's values,
172 /// diagnosing any invalid file paths and validating special case list format.
173 static void parseSpecialCaseListArg(const Driver &D,
174                                     const llvm::opt::ArgList &Args,
175                                     std::vector<std::string> &SCLFiles,
176                                     llvm::opt::OptSpecifier SCLOptionID,
177                                     llvm::opt::OptSpecifier NoSCLOptionID,
178                                     unsigned MalformedSCLErrorDiagID) {
179   for (const auto *Arg : Args) {
180     // Match -fsanitize-(coverage-)?(white|black)list.
181     if (Arg->getOption().matches(SCLOptionID)) {
182       Arg->claim();
183       std::string SCLPath = Arg->getValue();
184       if (D.getVFS().exists(SCLPath)) {
185         SCLFiles.push_back(SCLPath);
186       } else {
187         D.Diag(clang::diag::err_drv_no_such_file) << SCLPath;
188       }
189       // Match -fno-sanitize-blacklist.
190     } else if (Arg->getOption().matches(NoSCLOptionID)) {
191       Arg->claim();
192       SCLFiles.clear();
193     }
194   }
195   validateSpecialCaseListFormat(D, SCLFiles, MalformedSCLErrorDiagID);
196 }
197 
198 /// Sets group bits for every group that has at least one representative already
199 /// enabled in \p Kinds.
200 static SanitizerMask setGroupBits(SanitizerMask Kinds) {
201 #define SANITIZER(NAME, ID)
202 #define SANITIZER_GROUP(NAME, ID, ALIAS)                                       \
203   if (Kinds & SanitizerKind::ID)                                               \
204     Kinds |= SanitizerKind::ID##Group;
205 #include "clang/Basic/Sanitizers.def"
206   return Kinds;
207 }
208 
209 static SanitizerMask parseSanitizeTrapArgs(const Driver &D,
210                                            const llvm::opt::ArgList &Args) {
211   SanitizerMask TrapRemove;     // During the loop below, the accumulated set of
212                                 // sanitizers disabled by the current sanitizer
213                                 // argument or any argument after it.
214   SanitizerMask TrappingKinds;
215   SanitizerMask TrappingSupportedWithGroups = setGroupBits(TrappingSupported);
216 
217   for (ArgList::const_reverse_iterator I = Args.rbegin(), E = Args.rend();
218        I != E; ++I) {
219     const auto *Arg = *I;
220     if (Arg->getOption().matches(options::OPT_fsanitize_trap_EQ)) {
221       Arg->claim();
222       SanitizerMask Add = parseArgValues(D, Arg, true);
223       Add &= ~TrapRemove;
224       if (SanitizerMask InvalidValues = Add & ~TrappingSupportedWithGroups) {
225         SanitizerSet S;
226         S.Mask = InvalidValues;
227         D.Diag(diag::err_drv_unsupported_option_argument) << "-fsanitize-trap"
228                                                           << toString(S);
229       }
230       TrappingKinds |= expandSanitizerGroups(Add) & ~TrapRemove;
231     } else if (Arg->getOption().matches(options::OPT_fno_sanitize_trap_EQ)) {
232       Arg->claim();
233       TrapRemove |= expandSanitizerGroups(parseArgValues(D, Arg, true));
234     }
235   }
236 
237   // Apply default trapping behavior.
238   TrappingKinds |= TrappingDefault & ~TrapRemove;
239 
240   return TrappingKinds;
241 }
242 
243 bool SanitizerArgs::needsFuzzerInterceptors() const {
244   return needsFuzzer() && !needsAsanRt() && !needsTsanRt() && !needsMsanRt();
245 }
246 
247 bool SanitizerArgs::needsUbsanRt() const {
248   // All of these include ubsan.
249   if (needsAsanRt() || needsMsanRt() || needsHwasanRt() || needsTsanRt() ||
250       needsDfsanRt() || needsLsanRt() || needsCfiDiagRt() ||
251       (needsScudoRt() && !requiresMinimalRuntime()))
252     return false;
253 
254   return (Sanitizers.Mask & NeedsUbsanRt & ~TrapSanitizers.Mask) ||
255          CoverageFeatures;
256 }
257 
258 bool SanitizerArgs::needsCfiRt() const {
259   return !(Sanitizers.Mask & SanitizerKind::CFI & ~TrapSanitizers.Mask) &&
260          CfiCrossDso && !ImplicitCfiRuntime;
261 }
262 
263 bool SanitizerArgs::needsCfiDiagRt() const {
264   return (Sanitizers.Mask & SanitizerKind::CFI & ~TrapSanitizers.Mask) &&
265          CfiCrossDso && !ImplicitCfiRuntime;
266 }
267 
268 bool SanitizerArgs::requiresPIE() const {
269   return NeedPIE || (Sanitizers.Mask & RequiresPIE);
270 }
271 
272 bool SanitizerArgs::needsUnwindTables() const {
273   return static_cast<bool>(Sanitizers.Mask & NeedsUnwindTables);
274 }
275 
276 bool SanitizerArgs::needsLTO() const {
277   return static_cast<bool>(Sanitizers.Mask & NeedsLTO);
278 }
279 
280 SanitizerArgs::SanitizerArgs(const ToolChain &TC,
281                              const llvm::opt::ArgList &Args) {
282   SanitizerMask AllRemove;      // During the loop below, the accumulated set of
283                                 // sanitizers disabled by the current sanitizer
284                                 // argument or any argument after it.
285   SanitizerMask AllAddedKinds;      // Mask of all sanitizers ever enabled by
286                                     // -fsanitize= flags (directly or via group
287                                     // expansion), some of which may be disabled
288                                     // later. Used to carefully prune
289                                     // unused-argument diagnostics.
290   SanitizerMask DiagnosedKinds;      // All Kinds we have diagnosed up to now.
291                                      // Used to deduplicate diagnostics.
292   SanitizerMask Kinds;
293   const SanitizerMask Supported = setGroupBits(TC.getSupportedSanitizers());
294 
295   CfiCrossDso = Args.hasFlag(options::OPT_fsanitize_cfi_cross_dso,
296                              options::OPT_fno_sanitize_cfi_cross_dso, false);
297 
298   ToolChain::RTTIMode RTTIMode = TC.getRTTIMode();
299 
300   const Driver &D = TC.getDriver();
301   SanitizerMask TrappingKinds = parseSanitizeTrapArgs(D, Args);
302   SanitizerMask InvalidTrappingKinds = TrappingKinds & NotAllowedWithTrap;
303 
304   MinimalRuntime =
305       Args.hasFlag(options::OPT_fsanitize_minimal_runtime,
306                    options::OPT_fno_sanitize_minimal_runtime, MinimalRuntime);
307 
308   // The object size sanitizer should not be enabled at -O0.
309   Arg *OptLevel = Args.getLastArg(options::OPT_O_Group);
310   bool RemoveObjectSizeAtO0 =
311       !OptLevel || OptLevel->getOption().matches(options::OPT_O0);
312 
313   for (ArgList::const_reverse_iterator I = Args.rbegin(), E = Args.rend();
314        I != E; ++I) {
315     const auto *Arg = *I;
316     if (Arg->getOption().matches(options::OPT_fsanitize_EQ)) {
317       Arg->claim();
318       SanitizerMask Add = parseArgValues(D, Arg, /*AllowGroups=*/true);
319 
320       if (RemoveObjectSizeAtO0) {
321         AllRemove |= SanitizerKind::ObjectSize;
322 
323         // The user explicitly enabled the object size sanitizer. Warn
324         // that this does nothing at -O0.
325         if (Add & SanitizerKind::ObjectSize)
326           D.Diag(diag::warn_drv_object_size_disabled_O0)
327               << Arg->getAsString(Args);
328       }
329 
330       AllAddedKinds |= expandSanitizerGroups(Add);
331 
332       // Avoid diagnosing any sanitizer which is disabled later.
333       Add &= ~AllRemove;
334       // At this point we have not expanded groups, so any unsupported
335       // sanitizers in Add are those which have been explicitly enabled.
336       // Diagnose them.
337       if (SanitizerMask KindsToDiagnose =
338               Add & InvalidTrappingKinds & ~DiagnosedKinds) {
339         std::string Desc = describeSanitizeArg(*I, KindsToDiagnose);
340         D.Diag(diag::err_drv_argument_not_allowed_with)
341             << Desc << "-fsanitize-trap=undefined";
342         DiagnosedKinds |= KindsToDiagnose;
343       }
344       Add &= ~InvalidTrappingKinds;
345 
346       if (MinimalRuntime) {
347         if (SanitizerMask KindsToDiagnose =
348                 Add & NotAllowedWithMinimalRuntime & ~DiagnosedKinds) {
349           std::string Desc = describeSanitizeArg(*I, KindsToDiagnose);
350           D.Diag(diag::err_drv_argument_not_allowed_with)
351               << Desc << "-fsanitize-minimal-runtime";
352           DiagnosedKinds |= KindsToDiagnose;
353         }
354         Add &= ~NotAllowedWithMinimalRuntime;
355       }
356 
357       // FIXME: Make CFI on member function calls compatible with cross-DSO CFI.
358       // There are currently two problems:
359       // - Virtual function call checks need to pass a pointer to the function
360       //   address to llvm.type.test and a pointer to the address point to the
361       //   diagnostic function. Currently we pass the same pointer to both
362       //   places.
363       // - Non-virtual function call checks may need to check multiple type
364       //   identifiers.
365       // Fixing both of those may require changes to the cross-DSO CFI
366       // interface.
367       if (CfiCrossDso && (Add & SanitizerKind::CFIMFCall & ~DiagnosedKinds)) {
368         D.Diag(diag::err_drv_argument_not_allowed_with)
369             << "-fsanitize=cfi-mfcall"
370             << "-fsanitize-cfi-cross-dso";
371         Add &= ~SanitizerKind::CFIMFCall;
372         DiagnosedKinds |= SanitizerKind::CFIMFCall;
373       }
374 
375       if (SanitizerMask KindsToDiagnose = Add & ~Supported & ~DiagnosedKinds) {
376         std::string Desc = describeSanitizeArg(*I, KindsToDiagnose);
377         D.Diag(diag::err_drv_unsupported_opt_for_target)
378             << Desc << TC.getTriple().str();
379         DiagnosedKinds |= KindsToDiagnose;
380       }
381       Add &= Supported;
382 
383       // Test for -fno-rtti + explicit -fsanitizer=vptr before expanding groups
384       // so we don't error out if -fno-rtti and -fsanitize=undefined were
385       // passed.
386       if ((Add & SanitizerKind::Vptr) && (RTTIMode == ToolChain::RM_Disabled)) {
387         if (const llvm::opt::Arg *NoRTTIArg = TC.getRTTIArg()) {
388           assert(NoRTTIArg->getOption().matches(options::OPT_fno_rtti) &&
389                   "RTTI disabled without -fno-rtti option?");
390           // The user explicitly passed -fno-rtti with -fsanitize=vptr, but
391           // the vptr sanitizer requires RTTI, so this is a user error.
392           D.Diag(diag::err_drv_argument_not_allowed_with)
393               << "-fsanitize=vptr" << NoRTTIArg->getAsString(Args);
394         } else {
395           // The vptr sanitizer requires RTTI, but RTTI is disabled (by
396           // default). Warn that the vptr sanitizer is being disabled.
397           D.Diag(diag::warn_drv_disabling_vptr_no_rtti_default);
398         }
399 
400         // Take out the Vptr sanitizer from the enabled sanitizers
401         AllRemove |= SanitizerKind::Vptr;
402       }
403 
404       Add = expandSanitizerGroups(Add);
405       // Group expansion may have enabled a sanitizer which is disabled later.
406       Add &= ~AllRemove;
407       // Silently discard any unsupported sanitizers implicitly enabled through
408       // group expansion.
409       Add &= ~InvalidTrappingKinds;
410       if (MinimalRuntime) {
411         Add &= ~NotAllowedWithMinimalRuntime;
412       }
413       if (CfiCrossDso)
414         Add &= ~SanitizerKind::CFIMFCall;
415       Add &= Supported;
416 
417       if (Add & SanitizerKind::Fuzzer)
418         Add |= SanitizerKind::FuzzerNoLink;
419 
420       // Enable coverage if the fuzzing flag is set.
421       if (Add & SanitizerKind::FuzzerNoLink) {
422         CoverageFeatures |= CoverageInline8bitCounters | CoverageIndirCall |
423                             CoverageTraceCmp | CoveragePCTable;
424         // Due to TLS differences, stack depth tracking is only enabled on Linux
425         if (TC.getTriple().isOSLinux())
426           CoverageFeatures |= CoverageStackDepth;
427       }
428 
429       Kinds |= Add;
430     } else if (Arg->getOption().matches(options::OPT_fno_sanitize_EQ)) {
431       Arg->claim();
432       SanitizerMask Remove = parseArgValues(D, Arg, true);
433       AllRemove |= expandSanitizerGroups(Remove);
434     }
435   }
436 
437   std::pair<SanitizerMask, SanitizerMask> IncompatibleGroups[] = {
438       std::make_pair(SanitizerKind::Address,
439                      SanitizerKind::Thread | SanitizerKind::Memory),
440       std::make_pair(SanitizerKind::Thread, SanitizerKind::Memory),
441       std::make_pair(SanitizerKind::Leak,
442                      SanitizerKind::Thread | SanitizerKind::Memory),
443       std::make_pair(SanitizerKind::KernelAddress,
444                      SanitizerKind::Address | SanitizerKind::Leak |
445                          SanitizerKind::Thread | SanitizerKind::Memory),
446       std::make_pair(SanitizerKind::HWAddress,
447                      SanitizerKind::Address | SanitizerKind::Thread |
448                          SanitizerKind::Memory | SanitizerKind::KernelAddress),
449       std::make_pair(SanitizerKind::Scudo,
450                      SanitizerKind::Address | SanitizerKind::HWAddress |
451                          SanitizerKind::Leak | SanitizerKind::Thread |
452                          SanitizerKind::Memory | SanitizerKind::KernelAddress),
453       std::make_pair(SanitizerKind::SafeStack,
454                      (TC.getTriple().isOSFuchsia() ? SanitizerMask()
455                                                    : SanitizerKind::Leak) |
456                          SanitizerKind::Address | SanitizerKind::HWAddress |
457                          SanitizerKind::Thread | SanitizerKind::Memory |
458                          SanitizerKind::KernelAddress),
459       std::make_pair(SanitizerKind::KernelHWAddress,
460                      SanitizerKind::Address | SanitizerKind::HWAddress |
461                          SanitizerKind::Leak | SanitizerKind::Thread |
462                          SanitizerKind::Memory | SanitizerKind::KernelAddress |
463                          SanitizerKind::SafeStack),
464       std::make_pair(SanitizerKind::KernelMemory,
465                      SanitizerKind::Address | SanitizerKind::HWAddress |
466                          SanitizerKind::Leak | SanitizerKind::Thread |
467                          SanitizerKind::Memory | SanitizerKind::KernelAddress |
468                          SanitizerKind::Scudo | SanitizerKind::SafeStack),
469       std::make_pair(SanitizerKind::MemTag,
470                      SanitizerKind::Address | SanitizerKind::KernelAddress |
471                          SanitizerKind::HWAddress |
472                          SanitizerKind::KernelHWAddress)};
473   // Enable toolchain specific default sanitizers if not explicitly disabled.
474   SanitizerMask Default = TC.getDefaultSanitizers() & ~AllRemove;
475 
476   // Disable default sanitizers that are incompatible with explicitly requested
477   // ones.
478   for (auto G : IncompatibleGroups) {
479     SanitizerMask Group = G.first;
480     if ((Default & Group) && (Kinds & G.second))
481       Default &= ~Group;
482   }
483 
484   Kinds |= Default;
485 
486   // We disable the vptr sanitizer if it was enabled by group expansion but RTTI
487   // is disabled.
488   if ((Kinds & SanitizerKind::Vptr) && (RTTIMode == ToolChain::RM_Disabled)) {
489     Kinds &= ~SanitizerKind::Vptr;
490   }
491 
492   // Check that LTO is enabled if we need it.
493   if ((Kinds & NeedsLTO) && !D.isUsingLTO()) {
494     D.Diag(diag::err_drv_argument_only_allowed_with)
495         << lastArgumentForMask(D, Args, Kinds & NeedsLTO) << "-flto";
496   }
497 
498   if ((Kinds & SanitizerKind::ShadowCallStack) && TC.getTriple().isAArch64() &&
499       !llvm::AArch64::isX18ReservedByDefault(TC.getTriple()) &&
500       !Args.hasArg(options::OPT_ffixed_x18)) {
501     D.Diag(diag::err_drv_argument_only_allowed_with)
502         << lastArgumentForMask(D, Args, Kinds & SanitizerKind::ShadowCallStack)
503         << "-ffixed-x18";
504   }
505 
506   // Report error if there are non-trapping sanitizers that require
507   // c++abi-specific  parts of UBSan runtime, and they are not provided by the
508   // toolchain. We don't have a good way to check the latter, so we just
509   // check if the toolchan supports vptr.
510   if (~Supported & SanitizerKind::Vptr) {
511     SanitizerMask KindsToDiagnose = Kinds & ~TrappingKinds & NeedsUbsanCxxRt;
512     // The runtime library supports the Microsoft C++ ABI, but only well enough
513     // for CFI. FIXME: Remove this once we support vptr on Windows.
514     if (TC.getTriple().isOSWindows())
515       KindsToDiagnose &= ~SanitizerKind::CFI;
516     if (KindsToDiagnose) {
517       SanitizerSet S;
518       S.Mask = KindsToDiagnose;
519       D.Diag(diag::err_drv_unsupported_opt_for_target)
520           << ("-fno-sanitize-trap=" + toString(S)) << TC.getTriple().str();
521       Kinds &= ~KindsToDiagnose;
522     }
523   }
524 
525   // Warn about incompatible groups of sanitizers.
526   for (auto G : IncompatibleGroups) {
527     SanitizerMask Group = G.first;
528     if (Kinds & Group) {
529       if (SanitizerMask Incompatible = Kinds & G.second) {
530         D.Diag(clang::diag::err_drv_argument_not_allowed_with)
531             << lastArgumentForMask(D, Args, Group)
532             << lastArgumentForMask(D, Args, Incompatible);
533         Kinds &= ~Incompatible;
534       }
535     }
536   }
537   // FIXME: Currently -fsanitize=leak is silently ignored in the presence of
538   // -fsanitize=address. Perhaps it should print an error, or perhaps
539   // -f(-no)sanitize=leak should change whether leak detection is enabled by
540   // default in ASan?
541 
542   // Parse -f(no-)?sanitize-recover flags.
543   SanitizerMask RecoverableKinds = RecoverableByDefault | AlwaysRecoverable;
544   SanitizerMask DiagnosedUnrecoverableKinds;
545   SanitizerMask DiagnosedAlwaysRecoverableKinds;
546   for (const auto *Arg : Args) {
547     if (Arg->getOption().matches(options::OPT_fsanitize_recover_EQ)) {
548       SanitizerMask Add = parseArgValues(D, Arg, true);
549       // Report error if user explicitly tries to recover from unrecoverable
550       // sanitizer.
551       if (SanitizerMask KindsToDiagnose =
552               Add & Unrecoverable & ~DiagnosedUnrecoverableKinds) {
553         SanitizerSet SetToDiagnose;
554         SetToDiagnose.Mask |= KindsToDiagnose;
555         D.Diag(diag::err_drv_unsupported_option_argument)
556             << Arg->getOption().getName() << toString(SetToDiagnose);
557         DiagnosedUnrecoverableKinds |= KindsToDiagnose;
558       }
559       RecoverableKinds |= expandSanitizerGroups(Add);
560       Arg->claim();
561     } else if (Arg->getOption().matches(options::OPT_fno_sanitize_recover_EQ)) {
562       SanitizerMask Remove = parseArgValues(D, Arg, true);
563       // Report error if user explicitly tries to disable recovery from
564       // always recoverable sanitizer.
565       if (SanitizerMask KindsToDiagnose =
566               Remove & AlwaysRecoverable & ~DiagnosedAlwaysRecoverableKinds) {
567         SanitizerSet SetToDiagnose;
568         SetToDiagnose.Mask |= KindsToDiagnose;
569         D.Diag(diag::err_drv_unsupported_option_argument)
570             << Arg->getOption().getName() << toString(SetToDiagnose);
571         DiagnosedAlwaysRecoverableKinds |= KindsToDiagnose;
572       }
573       RecoverableKinds &= ~expandSanitizerGroups(Remove);
574       Arg->claim();
575     }
576   }
577   RecoverableKinds &= Kinds;
578   RecoverableKinds &= ~Unrecoverable;
579 
580   TrappingKinds &= Kinds;
581   RecoverableKinds &= ~TrappingKinds;
582 
583   // Setup blacklist files.
584   // Add default blacklist from resource directory for activated sanitizers, and
585   // validate special case lists format.
586   if (!Args.hasArgNoClaim(options::OPT_fno_sanitize_blacklist))
587     addDefaultBlacklists(D, Kinds, SystemBlacklistFiles);
588 
589   // Parse -f(no-)?sanitize-blacklist options.
590   // This also validates special case lists format.
591   parseSpecialCaseListArg(D, Args, UserBlacklistFiles,
592                           options::OPT_fsanitize_blacklist,
593                           options::OPT_fno_sanitize_blacklist,
594                           clang::diag::err_drv_malformed_sanitizer_blacklist);
595 
596   // Parse -f[no-]sanitize-memory-track-origins[=level] options.
597   if (AllAddedKinds & SanitizerKind::Memory) {
598     if (Arg *A =
599             Args.getLastArg(options::OPT_fsanitize_memory_track_origins_EQ,
600                             options::OPT_fsanitize_memory_track_origins,
601                             options::OPT_fno_sanitize_memory_track_origins)) {
602       if (A->getOption().matches(options::OPT_fsanitize_memory_track_origins)) {
603         MsanTrackOrigins = 2;
604       } else if (A->getOption().matches(
605                      options::OPT_fno_sanitize_memory_track_origins)) {
606         MsanTrackOrigins = 0;
607       } else {
608         StringRef S = A->getValue();
609         if (S.getAsInteger(0, MsanTrackOrigins) || MsanTrackOrigins < 0 ||
610             MsanTrackOrigins > 2) {
611           D.Diag(clang::diag::err_drv_invalid_value) << A->getAsString(Args) << S;
612         }
613       }
614     }
615     MsanUseAfterDtor =
616         Args.hasFlag(options::OPT_fsanitize_memory_use_after_dtor,
617                      options::OPT_fno_sanitize_memory_use_after_dtor,
618                      MsanUseAfterDtor);
619     NeedPIE |= !(TC.getTriple().isOSLinux() &&
620                  TC.getTriple().getArch() == llvm::Triple::x86_64);
621   } else {
622     MsanUseAfterDtor = false;
623   }
624 
625   if (AllAddedKinds & SanitizerKind::Thread) {
626     TsanMemoryAccess = Args.hasFlag(
627         options::OPT_fsanitize_thread_memory_access,
628         options::OPT_fno_sanitize_thread_memory_access, TsanMemoryAccess);
629     TsanFuncEntryExit = Args.hasFlag(
630         options::OPT_fsanitize_thread_func_entry_exit,
631         options::OPT_fno_sanitize_thread_func_entry_exit, TsanFuncEntryExit);
632     TsanAtomics =
633         Args.hasFlag(options::OPT_fsanitize_thread_atomics,
634                      options::OPT_fno_sanitize_thread_atomics, TsanAtomics);
635   }
636 
637   if (AllAddedKinds & SanitizerKind::CFI) {
638     // Without PIE, external function address may resolve to a PLT record, which
639     // can not be verified by the target module.
640     NeedPIE |= CfiCrossDso;
641     CfiICallGeneralizePointers =
642         Args.hasArg(options::OPT_fsanitize_cfi_icall_generalize_pointers);
643 
644     if (CfiCrossDso && CfiICallGeneralizePointers)
645       D.Diag(diag::err_drv_argument_not_allowed_with)
646           << "-fsanitize-cfi-cross-dso"
647           << "-fsanitize-cfi-icall-generalize-pointers";
648 
649     CfiCanonicalJumpTables =
650         Args.hasFlag(options::OPT_fsanitize_cfi_canonical_jump_tables,
651                      options::OPT_fno_sanitize_cfi_canonical_jump_tables, true);
652   }
653 
654   Stats = Args.hasFlag(options::OPT_fsanitize_stats,
655                        options::OPT_fno_sanitize_stats, false);
656 
657   if (MinimalRuntime) {
658     SanitizerMask IncompatibleMask =
659         Kinds & ~setGroupBits(CompatibleWithMinimalRuntime);
660     if (IncompatibleMask)
661       D.Diag(clang::diag::err_drv_argument_not_allowed_with)
662           << "-fsanitize-minimal-runtime"
663           << lastArgumentForMask(D, Args, IncompatibleMask);
664 
665     SanitizerMask NonTrappingCfi = Kinds & SanitizerKind::CFI & ~TrappingKinds;
666     if (NonTrappingCfi)
667       D.Diag(clang::diag::err_drv_argument_only_allowed_with)
668           << "fsanitize-minimal-runtime"
669           << "fsanitize-trap=cfi";
670   }
671 
672   // Parse -f(no-)?sanitize-coverage flags if coverage is supported by the
673   // enabled sanitizers.
674   for (const auto *Arg : Args) {
675     if (Arg->getOption().matches(options::OPT_fsanitize_coverage)) {
676       int LegacySanitizeCoverage;
677       if (Arg->getNumValues() == 1 &&
678           !StringRef(Arg->getValue(0))
679                .getAsInteger(0, LegacySanitizeCoverage)) {
680         CoverageFeatures = 0;
681         Arg->claim();
682         if (LegacySanitizeCoverage != 0) {
683           D.Diag(diag::warn_drv_deprecated_arg)
684               << Arg->getAsString(Args) << "-fsanitize-coverage=trace-pc-guard";
685         }
686         continue;
687       }
688       CoverageFeatures |= parseCoverageFeatures(D, Arg);
689 
690       // Disable coverage and not claim the flags if there is at least one
691       // non-supporting sanitizer.
692       if (!(AllAddedKinds & ~AllRemove & ~setGroupBits(SupportsCoverage))) {
693         Arg->claim();
694       } else {
695         CoverageFeatures = 0;
696       }
697     } else if (Arg->getOption().matches(options::OPT_fno_sanitize_coverage)) {
698       Arg->claim();
699       CoverageFeatures &= ~parseCoverageFeatures(D, Arg);
700     }
701   }
702   // Choose at most one coverage type: function, bb, or edge.
703   if ((CoverageFeatures & CoverageFunc) && (CoverageFeatures & CoverageBB))
704     D.Diag(clang::diag::err_drv_argument_not_allowed_with)
705         << "-fsanitize-coverage=func"
706         << "-fsanitize-coverage=bb";
707   if ((CoverageFeatures & CoverageFunc) && (CoverageFeatures & CoverageEdge))
708     D.Diag(clang::diag::err_drv_argument_not_allowed_with)
709         << "-fsanitize-coverage=func"
710         << "-fsanitize-coverage=edge";
711   if ((CoverageFeatures & CoverageBB) && (CoverageFeatures & CoverageEdge))
712     D.Diag(clang::diag::err_drv_argument_not_allowed_with)
713         << "-fsanitize-coverage=bb"
714         << "-fsanitize-coverage=edge";
715   // Basic block tracing and 8-bit counters require some type of coverage
716   // enabled.
717   if (CoverageFeatures & CoverageTraceBB)
718     D.Diag(clang::diag::warn_drv_deprecated_arg)
719         << "-fsanitize-coverage=trace-bb"
720         << "-fsanitize-coverage=trace-pc-guard";
721   if (CoverageFeatures & Coverage8bitCounters)
722     D.Diag(clang::diag::warn_drv_deprecated_arg)
723         << "-fsanitize-coverage=8bit-counters"
724         << "-fsanitize-coverage=trace-pc-guard";
725 
726   int InsertionPointTypes = CoverageFunc | CoverageBB | CoverageEdge;
727   int InstrumentationTypes = CoverageTracePC | CoverageTracePCGuard |
728                              CoverageInline8bitCounters |
729                              CoverageInlineBoolFlag;
730   if ((CoverageFeatures & InsertionPointTypes) &&
731       !(CoverageFeatures & InstrumentationTypes)) {
732     D.Diag(clang::diag::warn_drv_deprecated_arg)
733         << "-fsanitize-coverage=[func|bb|edge]"
734         << "-fsanitize-coverage=[func|bb|edge],[trace-pc-guard|trace-pc]";
735   }
736 
737   // trace-pc w/o func/bb/edge implies edge.
738   if (!(CoverageFeatures & InsertionPointTypes)) {
739     if (CoverageFeatures &
740         (CoverageTracePC | CoverageTracePCGuard | CoverageInline8bitCounters |
741          CoverageInlineBoolFlag))
742       CoverageFeatures |= CoverageEdge;
743 
744     if (CoverageFeatures & CoverageStackDepth)
745       CoverageFeatures |= CoverageFunc;
746   }
747 
748   // Parse -fsanitize-coverage-(black|white)list options if coverage enabled.
749   // This also validates special case lists format.
750   // Here, OptSpecifier() acts as a never-matching command-line argument.
751   // So, there is no way to clear coverage lists but you can append to them.
752   if (CoverageFeatures) {
753     parseSpecialCaseListArg(
754         D, Args, CoverageAllowlistFiles,
755         options::OPT_fsanitize_coverage_allowlist, OptSpecifier(),
756         clang::diag::err_drv_malformed_sanitizer_coverage_whitelist);
757     parseSpecialCaseListArg(
758         D, Args, CoverageBlocklistFiles,
759         options::OPT_fsanitize_coverage_blocklist, OptSpecifier(),
760         clang::diag::err_drv_malformed_sanitizer_coverage_blacklist);
761   }
762 
763   SharedRuntime =
764       Args.hasFlag(options::OPT_shared_libsan, options::OPT_static_libsan,
765                    TC.getTriple().isAndroid() || TC.getTriple().isOSFuchsia() ||
766                        TC.getTriple().isOSDarwin());
767 
768   ImplicitCfiRuntime = TC.getTriple().isAndroid();
769 
770   if (AllAddedKinds & SanitizerKind::Address) {
771     NeedPIE |= TC.getTriple().isOSFuchsia();
772     if (Arg *A =
773             Args.getLastArg(options::OPT_fsanitize_address_field_padding)) {
774         StringRef S = A->getValue();
775         // Legal values are 0 and 1, 2, but in future we may add more levels.
776         if (S.getAsInteger(0, AsanFieldPadding) || AsanFieldPadding < 0 ||
777             AsanFieldPadding > 2) {
778           D.Diag(clang::diag::err_drv_invalid_value) << A->getAsString(Args) << S;
779         }
780     }
781 
782     if (Arg *WindowsDebugRTArg =
783             Args.getLastArg(options::OPT__SLASH_MTd, options::OPT__SLASH_MT,
784                             options::OPT__SLASH_MDd, options::OPT__SLASH_MD,
785                             options::OPT__SLASH_LDd, options::OPT__SLASH_LD)) {
786       switch (WindowsDebugRTArg->getOption().getID()) {
787       case options::OPT__SLASH_MTd:
788       case options::OPT__SLASH_MDd:
789       case options::OPT__SLASH_LDd:
790         D.Diag(clang::diag::err_drv_argument_not_allowed_with)
791             << WindowsDebugRTArg->getAsString(Args)
792             << lastArgumentForMask(D, Args, SanitizerKind::Address);
793         D.Diag(clang::diag::note_drv_address_sanitizer_debug_runtime);
794       }
795     }
796 
797     AsanUseAfterScope = Args.hasFlag(
798         options::OPT_fsanitize_address_use_after_scope,
799         options::OPT_fno_sanitize_address_use_after_scope, AsanUseAfterScope);
800 
801     AsanPoisonCustomArrayCookie = Args.hasFlag(
802         options::OPT_fsanitize_address_poison_custom_array_cookie,
803         options::OPT_fno_sanitize_address_poison_custom_array_cookie,
804         AsanPoisonCustomArrayCookie);
805 
806     // As a workaround for a bug in gold 2.26 and earlier, dead stripping of
807     // globals in ASan is disabled by default on ELF targets.
808     // See https://sourceware.org/bugzilla/show_bug.cgi?id=19002
809     AsanGlobalsDeadStripping =
810         !TC.getTriple().isOSBinFormatELF() || TC.getTriple().isOSFuchsia() ||
811         TC.getTriple().isPS4() ||
812         Args.hasArg(options::OPT_fsanitize_address_globals_dead_stripping);
813 
814     AsanUseOdrIndicator =
815         Args.hasFlag(options::OPT_fsanitize_address_use_odr_indicator,
816                      options::OPT_fno_sanitize_address_use_odr_indicator,
817                      AsanUseOdrIndicator);
818 
819     if (AllAddedKinds & SanitizerKind::PointerCompare & ~AllRemove) {
820       AsanInvalidPointerCmp = true;
821     }
822 
823     if (AllAddedKinds & SanitizerKind::PointerSubtract & ~AllRemove) {
824       AsanInvalidPointerSub = true;
825     }
826 
827   } else {
828     AsanUseAfterScope = false;
829     // -fsanitize=pointer-compare/pointer-subtract requires -fsanitize=address.
830     SanitizerMask DetectInvalidPointerPairs =
831         SanitizerKind::PointerCompare | SanitizerKind::PointerSubtract;
832     if (AllAddedKinds & DetectInvalidPointerPairs & ~AllRemove) {
833       TC.getDriver().Diag(clang::diag::err_drv_argument_only_allowed_with)
834           << lastArgumentForMask(D, Args,
835                                  SanitizerKind::PointerCompare |
836                                      SanitizerKind::PointerSubtract)
837           << "-fsanitize=address";
838     }
839   }
840 
841   if (AllAddedKinds & SanitizerKind::HWAddress) {
842     if (Arg *HwasanAbiArg =
843             Args.getLastArg(options::OPT_fsanitize_hwaddress_abi_EQ)) {
844       HwasanAbi = HwasanAbiArg->getValue();
845       if (HwasanAbi != "platform" && HwasanAbi != "interceptor")
846         D.Diag(clang::diag::err_drv_invalid_value)
847             << HwasanAbiArg->getAsString(Args) << HwasanAbi;
848     } else {
849       HwasanAbi = "interceptor";
850     }
851   }
852 
853   if (AllAddedKinds & SanitizerKind::SafeStack) {
854     // SafeStack runtime is built into the system on Android and Fuchsia.
855     SafeStackRuntime =
856         !TC.getTriple().isAndroid() && !TC.getTriple().isOSFuchsia();
857   }
858 
859   LinkRuntimes =
860       Args.hasFlag(options::OPT_fsanitize_link_runtime,
861                    options::OPT_fno_sanitize_link_runtime, LinkRuntimes);
862 
863   // Parse -link-cxx-sanitizer flag.
864   LinkCXXRuntimes = Args.hasArg(options::OPT_fsanitize_link_cxx_runtime,
865                                 options::OPT_fno_sanitize_link_cxx_runtime,
866                                 LinkCXXRuntimes) ||
867                     D.CCCIsCXX();
868 
869   // Finally, initialize the set of available and recoverable sanitizers.
870   Sanitizers.Mask |= Kinds;
871   RecoverableSanitizers.Mask |= RecoverableKinds;
872   TrapSanitizers.Mask |= TrappingKinds;
873   assert(!(RecoverableKinds & TrappingKinds) &&
874          "Overlap between recoverable and trapping sanitizers");
875 }
876 
877 static std::string toString(const clang::SanitizerSet &Sanitizers) {
878   std::string Res;
879 #define SANITIZER(NAME, ID)                                                    \
880   if (Sanitizers.has(SanitizerKind::ID)) {                                     \
881     if (!Res.empty())                                                          \
882       Res += ",";                                                              \
883     Res += NAME;                                                               \
884   }
885 #include "clang/Basic/Sanitizers.def"
886   return Res;
887 }
888 
889 static void addSpecialCaseListOpt(const llvm::opt::ArgList &Args,
890                                   llvm::opt::ArgStringList &CmdArgs,
891                                   const char *SCLOptFlag,
892                                   const std::vector<std::string> &SCLFiles) {
893   for (const auto &SCLPath : SCLFiles) {
894     SmallString<64> SCLOpt(SCLOptFlag);
895     SCLOpt += SCLPath;
896     CmdArgs.push_back(Args.MakeArgString(SCLOpt));
897   }
898 }
899 
900 static void addIncludeLinkerOption(const ToolChain &TC,
901                                    const llvm::opt::ArgList &Args,
902                                    llvm::opt::ArgStringList &CmdArgs,
903                                    StringRef SymbolName) {
904   SmallString<64> LinkerOptionFlag;
905   LinkerOptionFlag = "--linker-option=/include:";
906   if (TC.getTriple().getArch() == llvm::Triple::x86) {
907     // Win32 mangles C function names with a '_' prefix.
908     LinkerOptionFlag += '_';
909   }
910   LinkerOptionFlag += SymbolName;
911   CmdArgs.push_back(Args.MakeArgString(LinkerOptionFlag));
912 }
913 
914 static bool hasTargetFeatureMTE(const llvm::opt::ArgStringList &CmdArgs) {
915   for (auto Start = CmdArgs.begin(), End = CmdArgs.end(); Start != End; ++Start) {
916     auto It = std::find(Start, End, StringRef("+mte"));
917     if (It == End)
918       break;
919     if (It > Start && *std::prev(It) == StringRef("-target-feature"))
920       return true;
921     Start = It;
922   }
923   return false;
924 }
925 
926 void SanitizerArgs::addArgs(const ToolChain &TC, const llvm::opt::ArgList &Args,
927                             llvm::opt::ArgStringList &CmdArgs,
928                             types::ID InputType) const {
929   // NVPTX doesn't currently support sanitizers.  Bailing out here means that
930   // e.g. -fsanitize=address applies only to host code, which is what we want
931   // for now.
932   if (TC.getTriple().isNVPTX())
933     return;
934 
935   // Translate available CoverageFeatures to corresponding clang-cc1 flags.
936   // Do it even if Sanitizers.empty() since some forms of coverage don't require
937   // sanitizers.
938   std::pair<int, const char *> CoverageFlags[] = {
939       std::make_pair(CoverageFunc, "-fsanitize-coverage-type=1"),
940       std::make_pair(CoverageBB, "-fsanitize-coverage-type=2"),
941       std::make_pair(CoverageEdge, "-fsanitize-coverage-type=3"),
942       std::make_pair(CoverageIndirCall, "-fsanitize-coverage-indirect-calls"),
943       std::make_pair(CoverageTraceBB, "-fsanitize-coverage-trace-bb"),
944       std::make_pair(CoverageTraceCmp, "-fsanitize-coverage-trace-cmp"),
945       std::make_pair(CoverageTraceDiv, "-fsanitize-coverage-trace-div"),
946       std::make_pair(CoverageTraceGep, "-fsanitize-coverage-trace-gep"),
947       std::make_pair(Coverage8bitCounters, "-fsanitize-coverage-8bit-counters"),
948       std::make_pair(CoverageTracePC, "-fsanitize-coverage-trace-pc"),
949       std::make_pair(CoverageTracePCGuard,
950                      "-fsanitize-coverage-trace-pc-guard"),
951       std::make_pair(CoverageInline8bitCounters,
952                      "-fsanitize-coverage-inline-8bit-counters"),
953       std::make_pair(CoverageInlineBoolFlag,
954                      "-fsanitize-coverage-inline-bool-flag"),
955       std::make_pair(CoveragePCTable, "-fsanitize-coverage-pc-table"),
956       std::make_pair(CoverageNoPrune, "-fsanitize-coverage-no-prune"),
957       std::make_pair(CoverageStackDepth, "-fsanitize-coverage-stack-depth")};
958   for (auto F : CoverageFlags) {
959     if (CoverageFeatures & F.first)
960       CmdArgs.push_back(F.second);
961   }
962   addSpecialCaseListOpt(
963       Args, CmdArgs, "-fsanitize-coverage-allowlist=", CoverageAllowlistFiles);
964   addSpecialCaseListOpt(
965       Args, CmdArgs, "-fsanitize-coverage-blocklist=", CoverageBlocklistFiles);
966 
967   if (TC.getTriple().isOSWindows() && needsUbsanRt()) {
968     // Instruct the code generator to embed linker directives in the object file
969     // that cause the required runtime libraries to be linked.
970     CmdArgs.push_back(
971         Args.MakeArgString("--dependent-lib=" +
972                            TC.getCompilerRTBasename(Args, "ubsan_standalone")));
973     if (types::isCXX(InputType))
974       CmdArgs.push_back(Args.MakeArgString(
975           "--dependent-lib=" +
976           TC.getCompilerRTBasename(Args, "ubsan_standalone_cxx")));
977   }
978   if (TC.getTriple().isOSWindows() && needsStatsRt()) {
979     CmdArgs.push_back(Args.MakeArgString(
980         "--dependent-lib=" + TC.getCompilerRTBasename(Args, "stats_client")));
981 
982     // The main executable must export the stats runtime.
983     // FIXME: Only exporting from the main executable (e.g. based on whether the
984     // translation unit defines main()) would save a little space, but having
985     // multiple copies of the runtime shouldn't hurt.
986     CmdArgs.push_back(Args.MakeArgString(
987         "--dependent-lib=" + TC.getCompilerRTBasename(Args, "stats")));
988     addIncludeLinkerOption(TC, Args, CmdArgs, "__sanitizer_stats_register");
989   }
990 
991   if (Sanitizers.empty())
992     return;
993   CmdArgs.push_back(Args.MakeArgString("-fsanitize=" + toString(Sanitizers)));
994 
995   if (!RecoverableSanitizers.empty())
996     CmdArgs.push_back(Args.MakeArgString("-fsanitize-recover=" +
997                                          toString(RecoverableSanitizers)));
998 
999   if (!TrapSanitizers.empty())
1000     CmdArgs.push_back(
1001         Args.MakeArgString("-fsanitize-trap=" + toString(TrapSanitizers)));
1002 
1003   addSpecialCaseListOpt(Args, CmdArgs,
1004                         "-fsanitize-blacklist=", UserBlacklistFiles);
1005   addSpecialCaseListOpt(Args, CmdArgs,
1006                         "-fsanitize-system-blacklist=", SystemBlacklistFiles);
1007 
1008   if (MsanTrackOrigins)
1009     CmdArgs.push_back(Args.MakeArgString("-fsanitize-memory-track-origins=" +
1010                                          Twine(MsanTrackOrigins)));
1011 
1012   if (MsanUseAfterDtor)
1013     CmdArgs.push_back("-fsanitize-memory-use-after-dtor");
1014 
1015   // FIXME: Pass these parameters as function attributes, not as -llvm flags.
1016   if (!TsanMemoryAccess) {
1017     CmdArgs.push_back("-mllvm");
1018     CmdArgs.push_back("-tsan-instrument-memory-accesses=0");
1019     CmdArgs.push_back("-mllvm");
1020     CmdArgs.push_back("-tsan-instrument-memintrinsics=0");
1021   }
1022   if (!TsanFuncEntryExit) {
1023     CmdArgs.push_back("-mllvm");
1024     CmdArgs.push_back("-tsan-instrument-func-entry-exit=0");
1025   }
1026   if (!TsanAtomics) {
1027     CmdArgs.push_back("-mllvm");
1028     CmdArgs.push_back("-tsan-instrument-atomics=0");
1029   }
1030 
1031   if (CfiCrossDso)
1032     CmdArgs.push_back("-fsanitize-cfi-cross-dso");
1033 
1034   if (CfiICallGeneralizePointers)
1035     CmdArgs.push_back("-fsanitize-cfi-icall-generalize-pointers");
1036 
1037   if (CfiCanonicalJumpTables)
1038     CmdArgs.push_back("-fsanitize-cfi-canonical-jump-tables");
1039 
1040   if (Stats)
1041     CmdArgs.push_back("-fsanitize-stats");
1042 
1043   if (MinimalRuntime)
1044     CmdArgs.push_back("-fsanitize-minimal-runtime");
1045 
1046   if (AsanFieldPadding)
1047     CmdArgs.push_back(Args.MakeArgString("-fsanitize-address-field-padding=" +
1048                                          Twine(AsanFieldPadding)));
1049 
1050   if (AsanUseAfterScope)
1051     CmdArgs.push_back("-fsanitize-address-use-after-scope");
1052 
1053   if (AsanPoisonCustomArrayCookie)
1054     CmdArgs.push_back("-fsanitize-address-poison-custom-array-cookie");
1055 
1056   if (AsanGlobalsDeadStripping)
1057     CmdArgs.push_back("-fsanitize-address-globals-dead-stripping");
1058 
1059   if (AsanUseOdrIndicator)
1060     CmdArgs.push_back("-fsanitize-address-use-odr-indicator");
1061 
1062   if (AsanInvalidPointerCmp) {
1063     CmdArgs.push_back("-mllvm");
1064     CmdArgs.push_back("-asan-detect-invalid-pointer-cmp");
1065   }
1066 
1067   if (AsanInvalidPointerSub) {
1068     CmdArgs.push_back("-mllvm");
1069     CmdArgs.push_back("-asan-detect-invalid-pointer-sub");
1070   }
1071 
1072   if (!HwasanAbi.empty()) {
1073     CmdArgs.push_back("-default-function-attr");
1074     CmdArgs.push_back(Args.MakeArgString("hwasan-abi=" + HwasanAbi));
1075   }
1076 
1077   if (Sanitizers.has(SanitizerKind::HWAddress) && TC.getTriple().isAArch64()) {
1078     CmdArgs.push_back("-target-feature");
1079     CmdArgs.push_back("+tagged-globals");
1080   }
1081 
1082   // MSan: Workaround for PR16386.
1083   // ASan: This is mainly to help LSan with cases such as
1084   // https://github.com/google/sanitizers/issues/373
1085   // We can't make this conditional on -fsanitize=leak, as that flag shouldn't
1086   // affect compilation.
1087   if (Sanitizers.has(SanitizerKind::Memory) ||
1088       Sanitizers.has(SanitizerKind::Address))
1089     CmdArgs.push_back("-fno-assume-sane-operator-new");
1090 
1091   // libFuzzer wants to intercept calls to certain library functions, so the
1092   // following -fno-builtin-* flags force the compiler to emit interposable
1093   // libcalls to these functions. Other sanitizers effectively do the same thing
1094   // by marking all library call sites with NoBuiltin attribute in their LLVM
1095   // pass. (see llvm::maybeMarkSanitizerLibraryCallNoBuiltin)
1096   if (Sanitizers.has(SanitizerKind::FuzzerNoLink)) {
1097     CmdArgs.push_back("-fno-builtin-bcmp");
1098     CmdArgs.push_back("-fno-builtin-memcmp");
1099     CmdArgs.push_back("-fno-builtin-strncmp");
1100     CmdArgs.push_back("-fno-builtin-strcmp");
1101     CmdArgs.push_back("-fno-builtin-strncasecmp");
1102     CmdArgs.push_back("-fno-builtin-strcasecmp");
1103     CmdArgs.push_back("-fno-builtin-strstr");
1104     CmdArgs.push_back("-fno-builtin-strcasestr");
1105     CmdArgs.push_back("-fno-builtin-memmem");
1106   }
1107 
1108   // Require -fvisibility= flag on non-Windows when compiling if vptr CFI is
1109   // enabled.
1110   if (Sanitizers.hasOneOf(CFIClasses) && !TC.getTriple().isOSWindows() &&
1111       !Args.hasArg(options::OPT_fvisibility_EQ)) {
1112     TC.getDriver().Diag(clang::diag::err_drv_argument_only_allowed_with)
1113         << lastArgumentForMask(TC.getDriver(), Args,
1114                                Sanitizers.Mask & CFIClasses)
1115         << "-fvisibility=";
1116   }
1117 
1118   if (Sanitizers.has(SanitizerKind::MemTag) && !hasTargetFeatureMTE(CmdArgs))
1119     TC.getDriver().Diag(diag::err_stack_tagging_requires_hardware_feature);
1120 }
1121 
1122 SanitizerMask parseArgValues(const Driver &D, const llvm::opt::Arg *A,
1123                              bool DiagnoseErrors) {
1124   assert((A->getOption().matches(options::OPT_fsanitize_EQ) ||
1125           A->getOption().matches(options::OPT_fno_sanitize_EQ) ||
1126           A->getOption().matches(options::OPT_fsanitize_recover_EQ) ||
1127           A->getOption().matches(options::OPT_fno_sanitize_recover_EQ) ||
1128           A->getOption().matches(options::OPT_fsanitize_trap_EQ) ||
1129           A->getOption().matches(options::OPT_fno_sanitize_trap_EQ)) &&
1130          "Invalid argument in parseArgValues!");
1131   SanitizerMask Kinds;
1132   for (int i = 0, n = A->getNumValues(); i != n; ++i) {
1133     const char *Value = A->getValue(i);
1134     SanitizerMask Kind;
1135     // Special case: don't accept -fsanitize=all.
1136     if (A->getOption().matches(options::OPT_fsanitize_EQ) &&
1137         0 == strcmp("all", Value))
1138       Kind = SanitizerMask();
1139     else
1140       Kind = parseSanitizerValue(Value, /*AllowGroups=*/true);
1141 
1142     if (Kind)
1143       Kinds |= Kind;
1144     else if (DiagnoseErrors)
1145       D.Diag(clang::diag::err_drv_unsupported_option_argument)
1146           << A->getOption().getName() << Value;
1147   }
1148   return Kinds;
1149 }
1150 
1151 int parseCoverageFeatures(const Driver &D, const llvm::opt::Arg *A) {
1152   assert(A->getOption().matches(options::OPT_fsanitize_coverage) ||
1153          A->getOption().matches(options::OPT_fno_sanitize_coverage));
1154   int Features = 0;
1155   for (int i = 0, n = A->getNumValues(); i != n; ++i) {
1156     const char *Value = A->getValue(i);
1157     int F = llvm::StringSwitch<int>(Value)
1158                 .Case("func", CoverageFunc)
1159                 .Case("bb", CoverageBB)
1160                 .Case("edge", CoverageEdge)
1161                 .Case("indirect-calls", CoverageIndirCall)
1162                 .Case("trace-bb", CoverageTraceBB)
1163                 .Case("trace-cmp", CoverageTraceCmp)
1164                 .Case("trace-div", CoverageTraceDiv)
1165                 .Case("trace-gep", CoverageTraceGep)
1166                 .Case("8bit-counters", Coverage8bitCounters)
1167                 .Case("trace-pc", CoverageTracePC)
1168                 .Case("trace-pc-guard", CoverageTracePCGuard)
1169                 .Case("no-prune", CoverageNoPrune)
1170                 .Case("inline-8bit-counters", CoverageInline8bitCounters)
1171                 .Case("inline-bool-flag", CoverageInlineBoolFlag)
1172                 .Case("pc-table", CoveragePCTable)
1173                 .Case("stack-depth", CoverageStackDepth)
1174                 .Default(0);
1175     if (F == 0)
1176       D.Diag(clang::diag::err_drv_unsupported_option_argument)
1177           << A->getOption().getName() << Value;
1178     Features |= F;
1179   }
1180   return Features;
1181 }
1182 
1183 std::string lastArgumentForMask(const Driver &D, const llvm::opt::ArgList &Args,
1184                                 SanitizerMask Mask) {
1185   for (llvm::opt::ArgList::const_reverse_iterator I = Args.rbegin(),
1186                                                   E = Args.rend();
1187        I != E; ++I) {
1188     const auto *Arg = *I;
1189     if (Arg->getOption().matches(options::OPT_fsanitize_EQ)) {
1190       SanitizerMask AddKinds =
1191           expandSanitizerGroups(parseArgValues(D, Arg, false));
1192       if (AddKinds & Mask)
1193         return describeSanitizeArg(Arg, Mask);
1194     } else if (Arg->getOption().matches(options::OPT_fno_sanitize_EQ)) {
1195       SanitizerMask RemoveKinds =
1196           expandSanitizerGroups(parseArgValues(D, Arg, false));
1197       Mask &= ~RemoveKinds;
1198     }
1199   }
1200   llvm_unreachable("arg list didn't provide expected value");
1201 }
1202 
1203 std::string describeSanitizeArg(const llvm::opt::Arg *A, SanitizerMask Mask) {
1204   assert(A->getOption().matches(options::OPT_fsanitize_EQ)
1205          && "Invalid argument in describeSanitizerArg!");
1206 
1207   std::string Sanitizers;
1208   for (int i = 0, n = A->getNumValues(); i != n; ++i) {
1209     if (expandSanitizerGroups(
1210             parseSanitizerValue(A->getValue(i), /*AllowGroups=*/true)) &
1211         Mask) {
1212       if (!Sanitizers.empty())
1213         Sanitizers += ",";
1214       Sanitizers += A->getValue(i);
1215     }
1216   }
1217 
1218   assert(!Sanitizers.empty() && "arg didn't provide expected value");
1219   return "-fsanitize=" + Sanitizers;
1220 }
1221