[HWASan] Add aliasing flag and enable HWASan to use it.

[morehouse]

Summary

-fsanitize-hwaddress-experimental-aliasing is intended to distinguish
aliasing mode from LAM mode on x86_64. check-hwasan is configured
to use aliasing mode while check-hwasan-lam is configured to use LAM
mode.

The current patch doesn't actually do anything differently in the two
modes. A subsequent patch will actually build the separate runtimes
and use them in each mode.

Currently LAM mode tests must be run in an emulator that
has LAM support. To ensure LAM mode isn't broken by future patches, I
will next set up a QEMU buildbot to run the HWASan tests in LAM.

[vitalybuka]

clang/include/clang/Basic/Sanitizers.def

55–59 ↗

(On Diff #344598)

if it's experimental, why not just "-fsanitize=hwaddress -mllvm -havasan-lam=1" ?

[xiangzhangllvm]

compiler-rt/test/hwasan/TestCases/Linux/vfork.c

7

What does here XFAIL mean, do not test in x86_64 ?

[morehouse]

clang/include/clang/Basic/Sanitizers.def

55–59 ↗

(On Diff #344598)

Well, -mllvm indicates a flag for LLVM, but we need to change the Clang behavior to link with the LAM-enabled HWASan runtime. It seems to me that we should use a flag directed to Clang for this.

Maybe it's possible to parse the -mllvm flag before the point where we need to choose a runtime (I'm not sure), but it seems simpler to do it this way.

compiler-rt/test/hwasan/TestCases/Linux/vfork.c

7

It means the test will run in x86_64 and is expected to fail.

Under LAM the test actually passes, since manually tagging the upper bits in the stack pointers succeeds. So we need to distinguish between x86 LAM mode and x86 aliasing mode, which we do with the new pointer-tagging feature.

[vitalybuka]

clang/include/clang/Basic/Sanitizers.def

55–59 ↗

(On Diff #344598)

I see, I expected you convince you to keep same runtime lib, but I see your reasoning on the another patch.

What do you thing about still keeping it hwasan and add hwasan internal flag like we added for asan
e.g. -fsanitize-hwasan-use-lam=1. Later when -mlam is available we will drop this flag.

[eugenis]

clang/include/clang/Basic/Sanitizers.def

55–59 ↗

(On Diff #344598)

I agree, this is not a new "sanitizer", just a different kind of hwasan.

Can we simply add "-mlam" right now, with the single purpose of selecting the new hwasan mode? It can grow more functionality later.

[morehouse]

• Use -mlam option instead of -fsanitize=lam.

[eugenis]

clang/include/clang/Driver/Options.td

4182

Hmm this might be a good argument to go with something else for now.
What would -mlam actually affect, besides hwasan? Significant bits computation?

If we see LAM as future production mode for HWASan, and aliasing - more of a temporary, proof-of-concept thing, then how about -fexperimental-sanitize-hwaddress-aliasing flag?

[morehouse]

• Remove diffbase.
• Use -fexperimental-sanitize-hwaddress-aliasing instead of -mlam.

clang/include/clang/Driver/Options.td

4182

Hmm this might be a good argument to go with something else for now.
What would -mlam actually affect, besides hwasan? Significant bits computation?

Not sure. I could imagine at least defining a preprocessor guard for conditional compilation (similar to -mavx).

If we see LAM as future production mode for HWASan, and aliasing - more of a temporary, proof-of-concept thing, then how about -fexperimental-sanitize-hwaddress-aliasing flag?

Sounds good, done.

[vitalybuka]

clang/include/clang/Driver/Options.td

1551

Please switch to fsanitize-hwaddress-experimental-aliasing for consistency with other "fsanitize-<sanitizer>" flags

[morehouse]

• Rename flag to -fsanitize-hwaddress-experimental-aliasing.

[vitalybuka]

LGTM

compiler-rt/test/hwasan/lit.site.cfg.py.in

10

ENABLE_ALIASES -> HWASAB_ENABLE_ALIASES for consistency?

[morehouse]

• s/ENABLE_ALIASES/HWASAN_ENABLE_ALIASES

clang/include/clang/Driver/Options.td

def fsanitize_memory_track_origins_EQ : Joined<["-"], "fsanitize-memory-track-origins=">,
                                         MarshallingInfoInt<CodeGenOpts<"SanitizeMemoryTrackOrigins">>;
 def fsanitize_memory_track_origins : Flag<["-"], "fsanitize-memory-track-origins">,
                                      Group<f_clang_Group>,
                                      HelpText<"Enable origins tracking in MemorySanitizer">;
 def fno_sanitize_memory_track_origins : Flag<["-"], "fno-sanitize-memory-track-origins">,
                                         Group<f_clang_Group>,
                                         Flags<[CoreOption, NoXarchOption]>,
                                         HelpText<"Disable origins tracking in MemorySanitizer">;
+def fsanitize_hwaddress_experimental_aliasing
+  : Flag<["-"], "fsanitize-hwaddress-experimental-aliasing">,
+    Group<f_clang_Group>,
+    HelpText<"Enable aliasing mode in HWAddressSanitizer">;
+def fno_sanitize_hwaddress_experimental_aliasing
+  : Flag<["-"], "fno-sanitize-hwaddress-experimental-aliasing">,
+    Group<f_clang_Group>, Flags<[CoreOption, NoXarchOption]>,
+    HelpText<"Disable aliasing mode in HWAddressSanitizer">;
 defm sanitize_memory_use_after_dtor : BoolOption<"f", "sanitize-memory-use-after-dtor",
   CodeGenOpts<"SanitizeMemoryUseAfterDtor">, DefaultFalse,
   PosFlag<SetTrue, [CC1Option], "Enable">, NegFlag<SetFalse, [], "Disable">,
   BothFlags<[], " use-after-destroy detection in MemorySanitizer">>,
   Group<f_clang_Group>;
 def fsanitize_address_field_padding : Joined<["-"], "fsanitize-address-field-padding=">,
                                         Group<f_clang_Group>,
                                         HelpText<"Level of field padding for AddressSanitizer">,

 def mno_shstk : Flag<["-"], "mno-shstk">, Group<m_x86_Features_Group>;
 def mretpoline_external_thunk : Flag<["-"], "mretpoline-external-thunk">, Group<m_x86_Features_Group>;
 def mno_retpoline_external_thunk : Flag<["-"], "mno-retpoline-external-thunk">, Group<m_x86_Features_Group>;
 def mvzeroupper : Flag<["-"], "mvzeroupper">, Group<m_x86_Features_Group>;
 def mno_vzeroupper : Flag<["-"], "mno-vzeroupper">, Group<m_x86_Features_Group>;
 
 // These are legacy user-facing driver-level option spellings. They are always
 // aliases for options that are spelled using the more common Unix / GNU flag
 // style of double-dash and equals-joined flags.
 def gcc_toolchain_legacy_spelling : Separate<["-"], "gcc-toolchain">, Alias<gcc_toolchain>;
 def target_legacy_spelling : Separate<["-"], "target">, Alias<target>;
 
 // Special internal option to handle -Xlinker --no-demangle.
 def Z_Xlinker__no_demangle : Flag<["-"], "Z-Xlinker-no-demangle">,
     Flags<[Unsupported, NoArgumentUnused]>;
 
 // Special internal option to allow forwarding arbitrary arguments to linker.

clang/include/clang/Driver/SanitizerArgs.h

class SanitizerArgs {
   bool Stats = false;
   bool TsanMemoryAccess = true;
   bool TsanFuncEntryExit = true;
   bool TsanAtomics = true;
   bool MinimalRuntime = false;
   // True if cross-dso CFI support if provided by the system (i.e. Android).
   bool ImplicitCfiRuntime = false;
   bool NeedsMemProfRt = false;
+  bool HwasanUseAliases = false;
 
 public:
   /// Parses the sanitizer arguments from an argument list.
   SanitizerArgs(const ToolChain &TC, const llvm::opt::ArgList &Args);
 
   bool needsSharedRt() const { return SharedRuntime; }
 
   bool needsMemProfRt() const { return NeedsMemProfRt; }
   bool needsAsanRt() const { return Sanitizers.has(SanitizerKind::Address); }
   bool needsHwasanRt() const {
     return Sanitizers.has(SanitizerKind::HWAddress);
   }
+  bool needsHwasanAliasesRt() const {
+    return needsHwasanRt() && HwasanUseAliases;
+  }
   bool needsTsanRt() const { return Sanitizers.has(SanitizerKind::Thread); }
   bool needsMsanRt() const { return Sanitizers.has(SanitizerKind::Memory); }
   bool needsFuzzer() const { return Sanitizers.has(SanitizerKind::Fuzzer); }
   bool needsLsanRt() const {
     return Sanitizers.has(SanitizerKind::Leak) &&
            !Sanitizers.has(SanitizerKind::Address) &&
            !Sanitizers.has(SanitizerKind::HWAddress);
   }

clang/lib/Driver/SanitizerArgs.cpp

if (Arg *HwasanAbiArg =
             Args.getLastArg(options::OPT_fsanitize_hwaddress_abi_EQ)) {
       HwasanAbi = HwasanAbiArg->getValue();
       if (HwasanAbi != "platform" && HwasanAbi != "interceptor")
         D.Diag(clang::diag::err_drv_invalid_value)
             << HwasanAbiArg->getAsString(Args) << HwasanAbi;
     } else {
       HwasanAbi = "interceptor";
     }
+    if (TC.getTriple().getArch() == llvm::Triple::x86_64)
+      HwasanUseAliases = Args.hasFlag(
+          options::OPT_fsanitize_hwaddress_experimental_aliasing,
+          options::OPT_fno_sanitize_hwaddress_experimental_aliasing,
+          HwasanUseAliases);
   }
 
   if (AllAddedKinds & SanitizerKind::SafeStack) {
     // SafeStack runtime is built into the system on Android and Fuchsia.
     SafeStackRuntime =
         !TC.getTriple().isAndroid() && !TC.getTriple().isOSFuchsia();
   }
 

compiler-rt/test/hwasan/CMakeLists.txt

if (TARGET lld)
       list(APPEND HWASAN_TEST_DEPS lld)
     endif()
   endif()
 endif()
 
 add_lit_testsuite(check-hwasan "Running the HWAddressSanitizer tests"
   ${HWASAN_TESTSUITES}
   DEPENDS ${HWASAN_TEST_DEPS}
+  PARAMS "HWASAN_ENABLE_ALIASES=1"
   )
 set_target_properties(check-hwasan PROPERTIES FOLDER "Compiler-RT Misc")
+
+add_lit_testsuite(check-hwasan-lam
+  "Running the HWAddressSanitizer tests with Intel LAM"
+  ${HWASAN_TESTSUITES}
+  DEPENDS ${HWASAN_TEST_DEPS}
+  PARAMS "HWASAN_ENABLE_ALIASES=0"
+  EXCLUDE_FROM_CHECK_ALL
+  )
+set_target_properties(check-hwasan-lam PROPERTIES FOLDER "Compiler-RT Misc")

compiler-rt/test/hwasan/TestCases/Linux/vfork.c

 // https://github.com/google/sanitizers/issues/925
 // RUN: %clang_hwasan -O0 %s -o %t && %run %t 2>&1
 
 // REQUIRES: aarch64-target-arch || x86_64-target-arch
-
-// Aliasing mode does not support stack tagging.
-// XFAIL: x86_64
+// REQUIRES: pointer-tagging
 
 #include <assert.h>
 #include <sys/types.h>
 #include <sys/wait.h>
 #include <unistd.h>
 #include <stdio.h>
 #include <sanitizer/hwasan_interface.h>
 

compiler-rt/test/hwasan/lit.cfg.py

 # -*- Python -*-
 
 import os
 
 # Setup config name.
 config.name = 'HWAddressSanitizer' + getattr(config, 'name_suffix', 'default')
 
 # Setup source root.
 config.test_source_root = os.path.dirname(__file__)
 
 # Setup default compiler flags used with -fsanitize=memory option.
 clang_cflags = [config.target_cflags] + config.debug_info_flags
 clang_cxxflags = config.cxx_mode_flags + clang_cflags
 clang_hwasan_common_cflags = clang_cflags + ["-fsanitize=hwaddress", "-fuse-ld=lld"]
+
+if config.target_arch == 'x86_64' and config.enable_aliases == '1':
+  clang_hwasan_common_cflags += ["-fsanitize-hwaddress-experimental-aliasing"]
+if config.enable_aliases != '1':
+  config.available_features.add('pointer-tagging')
 if config.target_arch == 'x86_64':
   # This does basically the same thing as tagged-globals on aarch64. Because
   # the x86_64 implementation is for testing purposes only there is no
   # equivalent target feature implemented on x86_64.
   clang_hwasan_common_cflags += ["-mcmodel=large"]
 clang_hwasan_cflags = clang_hwasan_common_cflags + ["-mllvm", "-hwasan-globals",
                                                    "-mllvm", "-hwasan-use-short-granules",
                                                    "-mllvm", "-hwasan-instrument-landing-pads=0",

compiler-rt/test/hwasan/lit.site.cfg.py.in

 @LIT_SITE_CFG_IN_HEADER@
 
 # Tool-specific config options.
 config.name_suffix = "@HWASAN_TEST_CONFIG_SUFFIX@"
 config.target_cflags = "@HWASAN_TEST_TARGET_CFLAGS@"
 config.target_arch = "@HWASAN_TEST_TARGET_ARCH@"
 config.android_files_to_push = @HWASAN_ANDROID_FILES_TO_PUSH@
 
+# Whether to use -mlam or not.
+config.enable_aliases = lit_config.params.get("HWASAN_ENABLE_ALIASES", "@HWASAN_ENABLE_ALIASES@")
+
 # Load common config for all compiler-rt lit tests.
 lit_config.load_config(config, "@COMPILER_RT_BINARY_DIR@/test/lit.common.configured")
 
 # Load tool-specific config that would do the real work.
 lit_config.load_config(config, "@HWASAN_LIT_SOURCE_DIR@/lit.cfg.py")