[IR] make stack-protector-guard-* flags into module attrs

[nickdesaulniers]

Summary

D88631 added initial support for:

• -mstack-protector-guard=
• -mstack-protector-guard-reg=
• -mstack-protector-guard-offset=

flags, and D100919 extended these to AArch64. Unfortunately, these flags
aren't retained for LTO. Make them module attributes rather than
TargetOptions.

Link: https://github.com/ClangBuiltLinux/linux/issues/1378

[nickdesaulniers]

Obviously needs work/cleanup, changes to x86, and tests, but posting for early feedback about module level attributes vs function level attributes, or possibly something else. I tested this quickly with thin LTO of the Linux kernel and it worked.

[nickdesaulniers]

• remove TargetOption members, update tests

[nickdesaulniers]

clang/lib/CodeGen/CodeGenModule.cpp

780–787

I should add tests for these; that clang emits these module attributes as expected.

[nickdesaulniers]

llvm/include/llvm/IR/Module.h

898

TODO: delete this comment

[nickdesaulniers]

• add cc1 test

[nickdesaulniers]

• remove spurious comment

[nickdesaulniers]

• fix lints

[tejohnson]

In D102742#2767569, @nickdesaulniers wrote:

Obviously needs work/cleanup, changes to x86, and tests, but posting for early feedback about module level attributes vs function level attributes, or possibly something else. I tested this quickly with thin LTO of the Linux kernel and it worked.

I haven't looked through in too much detail, but I see you have the module flag type set as Warning on conflict. I guess the answer to module level vs function level depends on whether it is valid to link together files compiled with different values of these flags and if so what the expected behavior should be. How does this work on non-LTO? If it works just fine, i.e. the functions from the modules with one value are compiled ok with that value and linked with functions compiled effectively with another value, then that would point to a function attribute so you can mimic the mix-and-match behavior. If it is unexpected, then perhaps better to keep as a module flag but Error? With Warning, the value from the first module being linked is used - would that be surprising?

[nickdesaulniers]

In D102742#2773954, @tejohnson wrote:

In D102742#2767569, @nickdesaulniers wrote:

Obviously needs work/cleanup, changes to x86, and tests, but posting for early feedback about module level attributes vs function level attributes, or possibly something else. I tested this quickly with thin LTO of the Linux kernel and it worked.

I haven't looked through in too much detail, but I see you have the module flag type set as Warning on conflict. I guess the answer to module level vs function level depends on whether it is valid to link together files compiled with different values of these flags and if so what the expected behavior should be. How does this work on non-LTO? If it works just fine, i.e. the functions from the modules with one value are compiled ok with that value and linked with functions compiled effectively with another value, then that would point to a function attribute so you can mimic the mix-and-match behavior. If it is unexpected, then perhaps better to keep as a module flag but Error? With Warning, the value from the first module being linked is used - would that be surprising?

Good point; it won't work as intended on mismatch. Let me upgrade that to Error.

[nickdesaulniers]

• upgrade module merge strategy to Error

[tejohnson]

In D102742#2774185, @nickdesaulniers wrote:

• upgrade module merge strategy to Error

Probably want a test using llvm-link or llvm-lto to check this behavior (that alike flags are getting propagated as expected and that conflicting ones error)

clang/include/clang/Driver/Options.td

3429

What's the effect of or reason for this change?

clang/test/CodeGen/stack-protector-guard.c

5

Perhaps add a check that the module flags not added without these options

llvm/include/llvm/IR/Module.h

898

add a doxygen comment like the ones for the other interfaces here

[nickdesaulniers]

• doxygen comments, test that module flags aren't emitted without flags

[nickdesaulniers]

In D102742#2774562, @tejohnson wrote:

In D102742#2774185, @nickdesaulniers wrote:

• upgrade module merge strategy to Error

Probably want a test using llvm-link or llvm-lto to check this behavior (that alike flags are getting propagated as expected and that conflicting ones error)

Not many tests under llvm/test/LTO or llvm/test/ThinLTO use llvm-link; is there a more appropriate subdir for such a test for conflicting module attributes?

clang/include/clang/Driver/Options.td

3429

Of the 3 options added in D88631 (mstack_protector_guard_EQ, mstack_protector_guard_offset_EQ, mstack_protector_guard_reg_EQ) 2 are strings (mstack_protector_guard_EQ and mstack_protector_guard_reg_EQ). It was inconsistent that one could be unspecified, where as the other could be unspecified or "none" (but those 2 values were equivalent).

Without this change, in clang/lib/CodeGen/CodeGenModule.cpp I'd need to check that StackProtectorGuardReg != "none" rather than !StackProtectorGuardReg.empty() below.

I can change it back, but I think the asymmetry between mstack_protector_guard_EQ and mstack_protector_guard_reg_EQ in D88631, and I missed that in code review.

I don't think there would be any other observers of such a change.

[tejohnson]

In D102742#2774639, @nickdesaulniers wrote:

In D102742#2774562, @tejohnson wrote:

In D102742#2774185, @nickdesaulniers wrote:

• upgrade module merge strategy to Error

Probably want a test using llvm-link or llvm-lto to check this behavior (that alike flags are getting propagated as expected and that conflicting ones error)

Not many tests under llvm/test/LTO or llvm/test/ThinLTO use llvm-link; is there a more appropriate subdir for such a test for conflicting module attributes?

Hmm, maybe in llvm/test/Linker? Or you could presumably use llvm-lto.

clang/include/clang/Driver/Options.td

3429

I see. Does unspecified mean something like just "-mstack-protector-guard-reg=" with nothing after the =? I didn't realize that was supported.

[nickdesaulniers]

Will work on explicit LTO tests.

clang/include/clang/Driver/Options.td

3429

It looks like we validate for that case in the front end already. Specifically, RenderAnalyzerOptions in clang/lib/Driver/ToolChains/Clang.cpp.

$ clang -mstack-protector-guard-reg= ...
clang-13: error: invalid value '' in 'mstack-protector-guard-reg='

[tejohnson]

clang/include/clang/Driver/Options.td

3429

Does that mean that without the "none" handling there is no way to disable? I.e. overriding an earlier value. Not sure how important this is.

[nickdesaulniers]

• add llvm/tests/LTO/AArch64/ and test case for module attr mismatch.

[nickdesaulniers]

llvm/test/LTO/AArch64/stack-protector-guard-module-attrs.ll

2–5 ↗

(On Diff #347124)

I used llvm-link here, but please let me know if it would be preferable to convert these to use llvm-lto2 instead?

Also, is there any issue with this new dir, llvm/test/LTO/AArch64/? Do I need to modify any lit cfg files so that the tests don't run for non-aarch64?

Also, I guess this test isn't really specific to aarch64; I don't do any codegen and don't specify the target triple (though, these module attributes only will be emitted from the front end for x86 and aarch64 at the moment; perhaps riscv and ppc64le in the future).

[nickdesaulniers]

clang/include/clang/Driver/Options.td

3429

Oh, that's a great point. I guess I'm not really sure of the intention of "none" then, @xiangzhangllvm can you comment whether that was the intention?

A quick test in GCC shows that GCC does not accept the value "none" for either -mstack-protector-guard= or -mstack-protector-guard-reg=.

We could strive to support disabling the command line flag once respecified, but I'd rather do it for both of the above two flags, not just -mstack-protector-guard-reg=.

[nickdesaulniers]

llvm/test/LTO/AArch64/stack-protector-guard-module-attrs.ll

2–5 ↗

(On Diff #347124)

Perhaps I should move this test under llvm/test/tools/llvm-link/ or llvm/test/Linker/ ? llvm/test/Linker/ has lots of tests that invoke llvm-link.

[nickdesaulniers]

• moved module attr mismatch test to llvm/test/Linker/

[tejohnson]

clang/include/clang/Driver/Options.td

3429

Yeah and it doesn't look like gcc supports anything like -mno-stack-...
So this seems fine the way you have changed it, unless @xiangzhangllvm has a different opinion, but perhaps that could be resolved later and consistently between all the options as you note.

llvm/test/LTO/AArch64/stack-protector-guard-module-attrs.ll

2–5 ↗

(On Diff #347124)

Yeah I think you will want to add the aarch64 equivalent of llvm/test/LTO/X86/lit.local.cfg, even if not needed for this initial test.

2–5 ↗

(On Diff #347124)

That would be fine too, I don't have a strong opinion either way. I suppose since you don't need any code gen putting it under Linker would be fine (I think I'd prefer that to it going under tools/llvm-link since you aren't testing that tool specifically but rather the module linker behavior.

[tejohnson]

lgtm

[nickdesaulniers]

clang/include/clang/Driver/Options.td

3429

Sure, I'm happy to follow up on this if I got it wrong here. In the meantime, this will help our CI go back green, so I've merged it. Thank you much for the review!

clang/include/clang/Driver/Options.td

 def mstack_protector_guard_EQ : Joined<["-"], "mstack-protector-guard=">, Group<m_Group>, Flags<[CC1Option]>,
   HelpText<"Use the given guard (global, tls) for addressing the stack-protector guard">,
   MarshallingInfoString<CodeGenOpts<"StackProtectorGuard">>;
 def mstack_protector_guard_offset_EQ : Joined<["-"], "mstack-protector-guard-offset=">, Group<m_Group>, Flags<[CC1Option]>,
   HelpText<"Use the given offset for addressing the stack-protector guard">,
   MarshallingInfoInt<CodeGenOpts<"StackProtectorGuardOffset">, "INT_MAX", "int">;
 def mstack_protector_guard_reg_EQ : Joined<["-"], "mstack-protector-guard-reg=">, Group<m_Group>, Flags<[CC1Option]>,
   HelpText<"Use the given reg for addressing the stack-protector guard">,
-  MarshallingInfoString<CodeGenOpts<"StackProtectorGuardReg">, [{"none"}]>;
+  MarshallingInfoString<CodeGenOpts<"StackProtectorGuardReg">>;
 def mfentry : Flag<["-"], "mfentry">, HelpText<"Insert calls to fentry at function entry (x86/SystemZ only)">,
   Flags<[CC1Option]>, Group<m_Group>,
   MarshallingInfoFlag<CodeGenOpts<"CallFEntry">>;
 def mnop_mcount : Flag<["-"], "mnop-mcount">, HelpText<"Generate mcount/__fentry__ calls as nops. To activate they need to be patched in.">,
   Flags<[CC1Option]>, Group<m_Group>,
   MarshallingInfoFlag<CodeGenOpts<"MNopMCount">>;
 def mrecord_mcount : Flag<["-"], "mrecord-mcount">, HelpText<"Generate a __mcount_loc section entry for each __fentry__ call.">,
   Flags<[CC1Option]>, Group<m_Group>,

clang/lib/CodeGen/BackendUtil.cpp

static bool initTargetOptions(DiagnosticsEngine &Diags,
 
   Options.EnableMachineFunctionSplitter = CodeGenOpts.SplitMachineFunctions;
   Options.FunctionSections = CodeGenOpts.FunctionSections;
   Options.DataSections = CodeGenOpts.DataSections;
   Options.IgnoreXCOFFVisibility = LangOpts.IgnoreXCOFFVisibility;
   Options.UniqueSectionNames = CodeGenOpts.UniqueSectionNames;
   Options.UniqueBasicBlockSectionNames =
       CodeGenOpts.UniqueBasicBlockSectionNames;
-  Options.StackProtectorGuard =
-      llvm::StringSwitch<llvm::StackProtectorGuards>(
-          CodeGenOpts.StackProtectorGuard)
-          .Case("tls", llvm::StackProtectorGuards::TLS)
-          .Case("global", llvm::StackProtectorGuards::Global)
-          .Case("sysreg", llvm::StackProtectorGuards::SysReg)
-          .Default(llvm::StackProtectorGuards::None);
-  Options.StackProtectorGuardOffset = CodeGenOpts.StackProtectorGuardOffset;
-  Options.StackProtectorGuardReg = CodeGenOpts.StackProtectorGuardReg;
   Options.TLSSize = CodeGenOpts.TLSSize;
   Options.EmulatedTLS = CodeGenOpts.EmulatedTLS;
   Options.ExplicitEmulatedTLS = CodeGenOpts.ExplicitEmulatedTLS;
   Options.DebuggerTuning = CodeGenOpts.getDebuggerTuning();
   Options.EmitStackSizeSection = CodeGenOpts.StackSizeSection;
   Options.StackUsageOutput = CodeGenOpts.StackUsageOutput;
   Options.EmitAddrsig = CodeGenOpts.Addrsig;
   Options.ForceDwarfFrameSection = CodeGenOpts.ForceDwarfFrameSection;

clang/lib/CodeGen/CodeGenModule.cpp

if (CGDebugInfo *DI = getModuleDebugInfo())
     DI->finalize();
 
   if (getCodeGenOpts().EmitVersionIdentMetadata)
     EmitVersionIdentMetadata();
 
   if (!getCodeGenOpts().RecordCommandLine.empty())
     EmitCommandLineMetadata();
 
+  if (!getCodeGenOpts().StackProtectorGuard.empty())
+    getModule().setStackProtectorGuard(getCodeGenOpts().StackProtectorGuard);
+  if (!getCodeGenOpts().StackProtectorGuardReg.empty())
+    getModule().setStackProtectorGuardReg(
+        getCodeGenOpts().StackProtectorGuardReg);
+  if (getCodeGenOpts().StackProtectorGuardOffset != INT_MAX)
+    getModule().setStackProtectorGuardOffset(
+        getCodeGenOpts().StackProtectorGuardOffset);
+
   getTargetCodeGenInfo().emitTargetMetadata(*this, MangledDeclNames);
 
   EmitBackendOptionsMetadata(getCodeGenOpts());
 
   // Set visibility from DLL storage class
   // We do this at the end of LLVM IR generation; after any operation
   // that might affect the DLL storage class or the visibility, and
   // before anything that might act on these.

clang/test/CodeGen/stack-protector-guard.c

+// RUN: %clang_cc1 -mstack-protector-guard=sysreg \
+// RUN:            -mstack-protector-guard-reg=sp_el0 \
+// RUN:            -mstack-protector-guard-offset=1024 \
+// RUN:            -emit-llvm %s -o - | FileCheck %s
+// RUN: %clang_cc1 -emit-llvm %s -o - | FileCheck --check-prefix=CHECK-NONE %s
+void foo(int*);
+void bar(int x) {
+  int baz[x];
+  foo(baz);
+}
+
+// CHECK: !llvm.module.flags = !{{{.*}}[[ATTR1:![0-9]+]], [[ATTR2:![0-9]+]], [[ATTR3:![0-9]+]]}
+// CHECK: [[ATTR1]] = !{i32 1, !"stack-protector-guard", !"sysreg"}
+// CHECK: [[ATTR2]] = !{i32 1, !"stack-protector-guard-reg", !"sp_el0"}
+// CHECK: [[ATTR3]] = !{i32 1, !"stack-protector-guard-offset", i32 1024}
+// CHECK-NONE-NOT: !"stack-protector-guard

llvm/include/llvm/CodeGen/CommandFlags.h

 Optional<bool> getExplicitFunctionSections();
 
 bool getIgnoreXCOFFVisibility();
 
 bool getXCOFFTracebackTable();
 
 std::string getBBSections();
 
-std::string getStackProtectorGuard();
-int getStackProtectorGuardOffset();
-std::string getStackProtectorGuardReg();
-
 unsigned getTLSSize();
 
 bool getEmulatedTLS();
 
 bool getUniqueSectionNames();
 
 bool getUniqueBasicBlockSectionNames();
 

 /// Create this object with static storage to register codegen-related command
 /// line options.
 struct RegisterCodeGenFlags {
   RegisterCodeGenFlags();
 };
 
 llvm::BasicBlockSection getBBSectionsMode(llvm::TargetOptions &Options);
 
-llvm::StackProtectorGuards
-getStackProtectorGuardMode(llvm::TargetOptions &Options);
-
 /// Common utility function tightly tied to the options listed here. Initializes
 /// a TargetOptions object with CodeGen flags and returns it.
 /// \p TheTriple is used to determine the default value for options if
 ///    options are not explicitly specified. If those triple dependant options
 ///    value do not have effect for your component, a default Triple() could be
 ///    passed in.
 TargetOptions InitTargetOptionsFromCodeGenFlags(const llvm::Triple &TheTriple);
 

llvm/include/llvm/IR/Module.h

/// @}
   bool getUwtable() const;
   void setUwtable();
 
   /// Get/set whether synthesized functions should get the "frame-pointer"
   /// attribute.
   FramePointerKind getFramePointer() const;
   void setFramePointer(FramePointerKind Kind);
 
+  /// Get/set what kind of stack protector guard to use.
+  StringRef getStackProtectorGuard() const;
+  void setStackProtectorGuard(StringRef Kind);
+
+  /// Get/set which register to use as the stack protector guard register. The
+  /// empty string is equivalent to "global". Other values may be "tls" or
+  /// "sysreg".
+  StringRef getStackProtectorGuardReg() const;
+  void setStackProtectorGuardReg(StringRef Reg);
+
+  /// Get/set what offset from the stack protector to use.
+  int getStackProtectorGuardOffset() const;
+  void setStackProtectorGuardOffset(int Offset);
+
   /// @name Utility functions for querying and setting the build SDK version
   /// @{
 
   /// Attach a build SDK version metadata to this module.
   void setSDKVersion(const VersionTuple &V);
 
   /// Get the build SDK version metadata.
   ///

llvm/include/llvm/Target/TargetOptions.h

Labels, // Do not use Basic Block Sections but label basic blocks.  This
             // is useful when associating profile counts from virtual addresses
             // to basic blocks.
     Preset, // Similar to list but the blocks are identified by passes which
             // seek to use Basic Block Sections, e.g. MachineFunctionSplitter.
             // This option cannot be set via the command line.
     None    // Do not use Basic Block Sections.
   };
 
-  enum class StackProtectorGuards { None, TLS, Global, SysReg };
-
   enum class EABI {
     Unknown,
     Default, // Default means not specified
     EABI4,   // Target-specific (either 4, 5 or gnu depending on triple).
     EABI5,
     GNU
   };
 
public:
 
     /// Emit XRay Function Index section
     unsigned XRayOmitFunctionIndex : 1;
 
     /// When set to true, don't use DWARF extensions in later DWARF versions.
     /// By default, it is set to false.
     unsigned DebugStrictDwarf : 1;
 
-    /// Stack protector guard offset to use.
-    int StackProtectorGuardOffset = INT_MAX;
-
-    /// Stack protector guard mode to use, e.g. tls, global, sysreg.
-    StackProtectorGuards StackProtectorGuard =
-                                         StackProtectorGuards::None;
-
-    /// Stack protector guard reg to use, e.g. usually fs or gs in X86.
-    std::string StackProtectorGuardReg = "None";
-
     /// Name of the stack usage file (i.e., .su file) if user passes
     /// -fstack-usage. If empty, it can be implied that -fstack-usage is not
     /// passed on the command line.
     std::string StackUsageOutput;
 
     /// FloatABIType - This setting is set by -float-abi=xxx option is specfied
     /// on the command line. This setting may either be Default, Soft, or Hard.
     /// Default selects the target's default behavior. Soft selects the ABI for

llvm/lib/CodeGen/CommandFlags.cpp

 CGOPT(std::string, TrapFuncName)
 CGOPT(bool, UseCtors)
 CGOPT(bool, RelaxELFRelocations)
 CGOPT_EXP(bool, DataSections)
 CGOPT_EXP(bool, FunctionSections)
 CGOPT(bool, IgnoreXCOFFVisibility)
 CGOPT(bool, XCOFFTracebackTable)
 CGOPT(std::string, BBSections)
-CGOPT(std::string, StackProtectorGuard)
-CGOPT(int, StackProtectorGuardOffset)
-CGOPT(std::string, StackProtectorGuardReg)
 CGOPT(unsigned, TLSSize)
 CGOPT(bool, EmulatedTLS)
 CGOPT(bool, UniqueSectionNames)
 CGOPT(bool, UniqueBasicBlockSectionNames)
 CGOPT(EABI, EABIVersion)
 CGOPT(DebuggerKind, DebuggerTuningOpt)
 CGOPT(bool, EnableStackSizeSection)
 CGOPT(bool, EnableAddrsig)
#define CGBINDOPT(NAME)                                                        \
 
   static cl::opt<std::string> BBSections(
       "basic-block-sections",
       cl::desc("Emit basic blocks into separate sections"),
       cl::value_desc("all | <function list (file)> | labels | none"),
       cl::init("none"));
   CGBINDOPT(BBSections);
 
-  static cl::opt<std::string> StackProtectorGuard(
-      "stack-protector-guard", cl::desc("Stack protector guard mode"),
-      cl::init("none"));
-  CGBINDOPT(StackProtectorGuard);
-
-  static cl::opt<std::string> StackProtectorGuardReg(
-      "stack-protector-guard-reg", cl::desc("Stack protector guard register"),
-      cl::init("none"));
-  CGBINDOPT(StackProtectorGuardReg);
-
-  static cl::opt<int> StackProtectorGuardOffset(
-      "stack-protector-guard-offset", cl::desc("Stack protector guard offset"),
-      cl::init(INT_MAX));
-  CGBINDOPT(StackProtectorGuardOffset);
-
   static cl::opt<unsigned> TLSSize(
       "tls-size", cl::desc("Bit size of immediate TLS offsets"), cl::init(0));
   CGBINDOPT(TLSSize);
 
   static cl::opt<bool> EmulatedTLS(
       "emulated-tls", cl::desc("Use emulated TLS model"), cl::init(false));
   CGBINDOPT(EmulatedTLS);
 
if (!MBOrErr) {
              << MBOrErr.getError().message() << "\n";
     } else {
       Options.BBSectionsFuncListBuf = std::move(*MBOrErr);
     }
     return BasicBlockSection::List;
   }
 }
 
-llvm::StackProtectorGuards
-codegen::getStackProtectorGuardMode(llvm::TargetOptions &Options) {
-  if (getStackProtectorGuard() == "tls")
-    return StackProtectorGuards::TLS;
-  if (getStackProtectorGuard() == "global")
-    return StackProtectorGuards::Global;
-  if (getStackProtectorGuard() == "sysreg")
-    return StackProtectorGuards::SysReg;
-  if (getStackProtectorGuard() != "none") {
-    ErrorOr<std::unique_ptr<MemoryBuffer>> MBOrErr =
-        MemoryBuffer::getFile(getStackProtectorGuard());
-    if (!MBOrErr)
-      errs() << "error illegal stack protector guard mode: "
-             << MBOrErr.getError().message() << "\n";
-    else
-      Options.BBSectionsFuncListBuf = std::move(*MBOrErr);
-  }
-  return StackProtectorGuards::None;
-}
-
 // Common utility function tightly tied to the options listed here. Initializes
 // a TargetOptions object with CodeGen flags and returns it.
 TargetOptions
 codegen::InitTargetOptionsFromCodeGenFlags(const Triple &TheTriple) {
   TargetOptions Options;
   Options.AllowFPOpFusion = getFuseFPOps();
   Options.UnsafeFPMath = getEnableUnsafeFPMath();
   Options.NoInfsFPMath = getEnableNoInfsFPMath();
codegen::InitTargetOptionsFromCodeGenFlags(const Triple &TheTriple) {
   Options.DataSections =
       getExplicitDataSections().getValueOr(TheTriple.hasDefaultDataSections());
   Options.FunctionSections = getFunctionSections();
   Options.IgnoreXCOFFVisibility = getIgnoreXCOFFVisibility();
   Options.XCOFFTracebackTable = getXCOFFTracebackTable();
   Options.BBSections = getBBSectionsMode(Options);
   Options.UniqueSectionNames = getUniqueSectionNames();
   Options.UniqueBasicBlockSectionNames = getUniqueBasicBlockSectionNames();
-  Options.StackProtectorGuard = getStackProtectorGuardMode(Options);
-  Options.StackProtectorGuardOffset = getStackProtectorGuardOffset();
-  Options.StackProtectorGuardReg = getStackProtectorGuardReg();
   Options.TLSSize = getTLSSize();
   Options.EmulatedTLS = getEmulatedTLS();
   Options.ExplicitEmulatedTLS = EmulatedTLSView->getNumOccurrences() > 0;
   Options.ExceptionModel = getExceptionModel();
   Options.EmitStackSizeSection = getEnableStackSizeSection();
   Options.EnableMachineFunctionSplitter = getEnableMachineFunctionSplitter();
   Options.EmitAddrsig = getEnableAddrsig();
   Options.EmitCallSiteInfo = getEmitCallSiteInfo();

llvm/lib/CodeGen/StackProtector.cpp

 }
 
 /// Create a stack guard loading and populate whether SelectionDAG SSP is
 /// supported.
 static Value *getStackGuard(const TargetLoweringBase *TLI, Module *M,
                             IRBuilder<> &B,
                             bool *SupportsSelectionDAGSP = nullptr) {
   Value *Guard = TLI->getIRStackGuard(B);
-  auto GuardMode = TLI->getTargetMachine().Options.StackProtectorGuard;
-  if ((GuardMode == llvm::StackProtectorGuards::TLS ||
-       GuardMode == llvm::StackProtectorGuards::None) && Guard)
+  StringRef GuardMode = M->getStackProtectorGuard();
+  if ((GuardMode == "tls" || GuardMode.empty()) && Guard)
     return B.CreateLoad(B.getInt8PtrTy(), Guard, true, "StackGuard");
 
   // Use SelectionDAG SSP handling, since there isn't an IR guard.
   //
   // This is more or less weird, since we optionally output whether we
   // should perform a SelectionDAG SP here. The reason is that it's strictly
   // defined as !TLI->getIRStackGuard(B), where getIRStackGuard is also
   // mutating. There is no way to get this bit without mutating the IR, so

llvm/lib/IR/Module.cpp

FramePointerKind Module::getFramePointer() const {
   return static_cast<FramePointerKind>(
       Val ? cast<ConstantInt>(Val->getValue())->getZExtValue() : 0);
 }
 
 void Module::setFramePointer(FramePointerKind Kind) {
   addModuleFlag(ModFlagBehavior::Max, "frame-pointer", static_cast<int>(Kind));
 }
 
+StringRef Module::getStackProtectorGuard() const {
+  Metadata *MD = getModuleFlag("stack-protector-guard");
+  if (auto *MDS = dyn_cast_or_null<MDString>(MD))
+    return MDS->getString();
+  return {};
+}
+
+void Module::setStackProtectorGuard(StringRef Kind) {
+  MDString *ID = MDString::get(getContext(), Kind);
+  addModuleFlag(ModFlagBehavior::Error, "stack-protector-guard", ID);
+}
+
+StringRef Module::getStackProtectorGuardReg() const {
+  Metadata *MD = getModuleFlag("stack-protector-guard-reg");
+  if (auto *MDS = dyn_cast_or_null<MDString>(MD))
+    return MDS->getString();
+  return {};
+}
+
+void Module::setStackProtectorGuardReg(StringRef Reg) {
+  MDString *ID = MDString::get(getContext(), Reg);
+  addModuleFlag(ModFlagBehavior::Error, "stack-protector-guard-reg", ID);
+}
+
+int Module::getStackProtectorGuardOffset() const {
+  Metadata *MD = getModuleFlag("stack-protector-guard-offset");
+  if (auto *CI = mdconst::dyn_extract_or_null<ConstantInt>(MD))
+    return CI->getSExtValue();
+  return INT_MAX;
+}
+
+void Module::setStackProtectorGuardOffset(int Offset) {
+  addModuleFlag(ModFlagBehavior::Error, "stack-protector-guard-offset", Offset);
+}
+
 void Module::setSDKVersion(const VersionTuple &V) {
   SmallVector<unsigned, 3> Entries;
   Entries.push_back(V.getMajor());
   if (auto Minor = V.getMinor()) {
     Entries.push_back(*Minor);
     if (auto Subminor = V.getSubminor())
       Entries.push_back(*Subminor);
     // Ignore the 'build' component as it can't be represented in the object

llvm/lib/Target/AArch64/AArch64InstrInfo.cpp

BuildMI(MBB, FirstEpilogSEH, DL, TII->get(AArch64::ADDXri))
         .addReg(AArch64::X0, RegState::Define)
         .addReg(AArch64::X0)
         .addMBB(TargetMBB)
         .addImm(0);
     return true;
   }
 
   Register Reg = MI.getOperand(0).getReg();
-  TargetOptions Options = MI.getParent()->getParent()->getTarget().Options;
-  if (Options.StackProtectorGuard == StackProtectorGuards::SysReg) {
+  Module &M = *MBB.getParent()->getFunction().getParent();
+  if (M.getStackProtectorGuard() == "sysreg") {
     const AArch64SysReg::SysReg *SrcReg =
-        AArch64SysReg::lookupSysRegByName(Options.StackProtectorGuardReg);
+        AArch64SysReg::lookupSysRegByName(M.getStackProtectorGuardReg());
     if (!SrcReg)
       report_fatal_error("Unknown SysReg for Stack Protector Guard Register");
 
     // mrs xN, sysreg
     BuildMI(MBB, MI, DL, get(AArch64::MRS))
         .addDef(Reg, RegState::Renamable)
         .addImm(SrcReg->Encoding);
-    int Offset = Options.StackProtectorGuardOffset;
+    int Offset = M.getStackProtectorGuardOffset();
     if (Offset >= 0 && Offset <= 32760 && Offset % 8 == 0) {
       // ldr xN, [xN, #offset]
       BuildMI(MBB, MI, DL, get(AArch64::LDRXui))
           .addDef(Reg)
           .addUse(Reg, RegState::Kill)
           .addImm(Offset / 8);
     } else if (Offset >= -256 && Offset <= 255) {
       // ldur xN, [xN, #offset]

llvm/lib/Target/X86/X86ISelLowering.cpp

Value *X86TargetLowering::getIRStackGuard(IRBuilder<> &IRB) const {
   // tcbhead_t; use it instead of the usual global variable (see
   // sysdeps/{i386,x86_64}/nptl/tls.h)
   if (hasStackGuardSlotTLS(Subtarget.getTargetTriple())) {
     if (Subtarget.isTargetFuchsia()) {
       // <zircon/tls.h> defines ZX_TLS_STACK_GUARD_OFFSET with this value.
       return SegmentOffset(IRB, 0x10, getAddressSpace());
     } else {
       unsigned AddressSpace = getAddressSpace();
+      Module *M = IRB.GetInsertBlock()->getParent()->getParent();
       // Specially, some users may customize the base reg and offset.
-      int Offset = getTargetMachine().Options.StackProtectorGuardOffset;
+      int Offset = M->getStackProtectorGuardOffset();
       // If we don't set -stack-protector-guard-offset value:
       // %fs:0x28, unless we're using a Kernel code model, in which case
       // it's %gs:0x28.  gs:0x14 on i386.
       if (Offset == INT_MAX)
         Offset = (Subtarget.is64Bit()) ? 0x28 : 0x14;
 
-      const auto &GuardReg = getTargetMachine().Options.StackProtectorGuardReg;
+      StringRef GuardReg = M->getStackProtectorGuardReg();
       if (GuardReg == "fs")
         AddressSpace = X86AS::FS;
       else if (GuardReg == "gs")
         AddressSpace = X86AS::GS;
       return SegmentOffset(IRB, Offset, AddressSpace);
     }
   }
   return TargetLowering::getIRStackGuard(IRB);
FunctionCallee SecurityCheckCookie = M.getOrInsertFunction(
         Type::getInt8PtrTy(M.getContext()));
     if (Function *F = dyn_cast<Function>(SecurityCheckCookie.getCallee())) {
       F->setCallingConv(CallingConv::X86_FastCall);
       F->addAttribute(1, Attribute::AttrKind::InReg);
     }
     return;
   }
 
-  auto GuardMode = getTargetMachine().Options.StackProtectorGuard;
+  StringRef GuardMode = M.getStackProtectorGuard();
 
   // glibc, bionic, and Fuchsia have a special slot for the stack guard.
-  if ((GuardMode == llvm::StackProtectorGuards::TLS ||
-       GuardMode == llvm::StackProtectorGuards::None)
-      && hasStackGuardSlotTLS(Subtarget.getTargetTriple()))
+  if ((GuardMode == "tls" || GuardMode.empty()) &&
+      hasStackGuardSlotTLS(Subtarget.getTargetTriple()))
     return;
   TargetLowering::insertSSPDeclarations(M);
 }
 
 Value *X86TargetLowering::getSDagStackGuard(const Module &M) const {
   // MSVC CRT has a global variable holding security cookie.
   if (Subtarget.getTargetTriple().isWindowsMSVCEnvironment() ||
       Subtarget.getTargetTriple().isWindowsItaniumEnvironment()) {

llvm/test/CodeGen/AArch64/stack-guard-sysreg.ll

-; RUN: llc %s --stack-protector-guard=sysreg \
-; RUN:   --stack-protector-guard-reg=sp_el0 \
-; RUN:   --stack-protector-guard-offset=0 -verify-machineinstrs -o - | \
+; RUN: split-file %s %t
+; RUN: cat %t/main.ll %t/a.ll > %t/a2.ll
+; RUN: cat %t/main.ll %t/b.ll > %t/b2.ll
+; RUN: cat %t/main.ll %t/c.ll > %t/c2.ll
+; RUN: cat %t/main.ll %t/d.ll > %t/d2.ll
+; RUN: cat %t/main.ll %t/e.ll > %t/e2.ll
+; RUN: cat %t/main.ll %t/f.ll > %t/f2.ll
+; RUN: cat %t/main.ll %t/g.ll > %t/g2.ll
+; RUN: cat %t/main.ll %t/h.ll > %t/h2.ll
+; RUN: cat %t/main.ll %t/i.ll > %t/i2.ll
+; RUN: cat %t/main.ll %t/j.ll > %t/j2.ll
+; RUN: llc %t/a2.ll -verify-machineinstrs -o - | \
 ; RUN: FileCheck --check-prefix=CHECK --check-prefix=CHECK-NO-OFFSET %s
-; RUN: llc %s --stack-protector-guard=sysreg \
-; RUN:   --stack-protector-guard-reg=sp_el0 \
-; RUN:   --stack-protector-guard-offset=8 -verify-machineinstrs -o - | \
+; RUN: llc %t/b2.ll -verify-machineinstrs -o - | \
 ; RUN: FileCheck --check-prefix=CHECK --check-prefix=CHECK-POSITIVE-OFFSET %s
-; RUN: llc %s --stack-protector-guard=sysreg \
-; RUN:   --stack-protector-guard-reg=sp_el0 \
-; RUN:   --stack-protector-guard-offset=-8 -verify-machineinstrs -o - | \
+; RUN: llc %t/c2.ll -verify-machineinstrs -o - | \
 ; RUN: FileCheck --check-prefix=CHECK --check-prefix=CHECK-NEGATIVE-OFFSET %s
-; RUN: llc %s --stack-protector-guard=sysreg \
-; RUN:   --stack-protector-guard-reg=sp_el0 \
-; RUN:   --stack-protector-guard-offset=1 -verify-machineinstrs -o - | \
+; RUN: llc %t/d2.ll -verify-machineinstrs -o - | \
 ; RUN: FileCheck --check-prefix=CHECK --check-prefix=CHECK-NPOT-OFFSET %s
-; RUN: llc %s --stack-protector-guard=sysreg \
-; RUN:   --stack-protector-guard-reg=sp_el0 \
-; RUN:   --stack-protector-guard-offset=-1 -verify-machineinstrs -o - | \
+; RUN: llc %t/e2.ll -verify-machineinstrs -o - | \
 ; RUN: FileCheck --check-prefix=CHECK --check-prefix=CHECK-NPOT-NEG-OFFSET %s
-; RUN: llc %s --stack-protector-guard=sysreg \
-; RUN:   --stack-protector-guard-reg=sp_el0 \
-; RUN:   --stack-protector-guard-offset=257 -verify-machineinstrs -o - | \
+; RUN: llc %t/f2.ll -verify-machineinstrs -o - | \
 ; RUN: FileCheck --check-prefix=CHECK --check-prefix=CHECK-257-OFFSET %s
-; RUN: llc %s --stack-protector-guard=sysreg \
-; RUN:   --stack-protector-guard-reg=sp_el0 \
-; RUN:   --stack-protector-guard-offset=-257 -verify-machineinstrs -o - | \
+; RUN: llc %t/g2.ll -verify-machineinstrs -o - | \
 ; RUN: FileCheck --check-prefix=CHECK --check-prefix=CHECK-MINUS-257-OFFSET %s
 
 ; XFAIL
-; RUN: not --crash llc %s --stack-protector-guard=sysreg \
-; RUN:   --stack-protector-guard-reg=sp_el0 \
-; RUN:   --stack-protector-guard-offset=32761 -o - 2>&1 | \
+; RUN: not --crash llc %t/h2.ll -o - 2>&1 | \
 ; RUN: FileCheck --check-prefix=CHECK-BAD-OFFSET %s
-; RUN: not --crash llc %s --stack-protector-guard=sysreg \
-; RUN:   --stack-protector-guard-reg=sp_el0 \
-; RUN:   --stack-protector-guard-offset=-4096 -o - 2>&1 | \
+; RUN: not --crash llc %t/i2.ll -o - 2>&1 | \
 ; RUN: FileCheck --check-prefix=CHECK-BAD-OFFSET %s
-; RUN: not --crash llc %s --stack-protector-guard=sysreg \
-; RUN:   --stack-protector-guard-reg=sp_el0 \
-; RUN:   --stack-protector-guard-offset=4097 -o - 2>&1 | \
+; RUN: not --crash llc %t/j2.ll -o - 2>&1 | \
 ; RUN: FileCheck --check-prefix=CHECK-BAD-OFFSET %s
 
+;--- main.ll
+
 target triple = "aarch64-unknown-linux-gnu"
 
 ; Verify that we `mrs` from `SP_EL0` twice, rather than load from
 ; __stack_chk_guard.
 define dso_local void @foo(i64 %t) local_unnamed_addr #0 {
 ; CHECK-LABEL:   foo:
 ; CHECK:         // %bb.0: // %entry
 ; CHECK-NEXT:    stp x29, x30, [sp, #-16]! // 16-byte Folded Spill

 entry:
   %vla = alloca i32, i64 %t, align 4
   call void @baz(i32* nonnull %vla)
   ret void
 }
 
 declare void @baz(i32*)
 
+; CHECK-BAD-OFFSET: LLVM ERROR: Unable to encode Stack Protector Guard Offset
+
 attributes #0 = { sspstrong }
+!llvm.module.flags = !{!1, !2, !3}
 
-; CHECK-BAD-OFFSET: LLVM ERROR: Unable to encode Stack Protector Guard Offset
+!1 = !{i32 2, !"stack-protector-guard", !"sysreg"}
+!2 = !{i32 2, !"stack-protector-guard-reg", !"sp_el0"}
+
+;--- a.ll
+!3 = !{i32 2, !"stack-protector-guard-offset", i32 0}
+;--- b.ll
+!3 = !{i32 2, !"stack-protector-guard-offset", i32 8}
+;--- c.ll
+!3 = !{i32 2, !"stack-protector-guard-offset", i32 -8}
+;--- d.ll
+!3 = !{i32 2, !"stack-protector-guard-offset", i32 1}
+;--- e.ll
+!3 = !{i32 2, !"stack-protector-guard-offset", i32 -1}
+;--- f.ll
+!3 = !{i32 2, !"stack-protector-guard-offset", i32 257}
+;--- g.ll
+!3 = !{i32 2, !"stack-protector-guard-offset", i32 -257}
+;--- h.ll
+!3 = !{i32 2, !"stack-protector-guard-offset", i32 32761}
+;--- i.ll
+!3 = !{i32 2, !"stack-protector-guard-offset", i32 -4096}
+;--- j.ll
+!3 = !{i32 2, !"stack-protector-guard-offset", i32 4097}

llvm/test/CodeGen/X86/stack-protector-3.ll

-; RUN: llc -mtriple=x86_64-pc-linux-gnu -o - < %s | FileCheck --check-prefix=CHECK-TLS-FS-40 %s
-; RUN: llc -mtriple=x86_64-pc-linux-gnu -stack-protector-guard=tls -o - < %s | FileCheck --check-prefix=CHECK-TLS-FS-40 %s
-; RUN: llc -mtriple=x86_64-pc-linux-gnu -stack-protector-guard=global -o - < %s | FileCheck --check-prefix=CHECK-GLOBAL %s
-; RUN: llc -mtriple=x86_64-pc-linux-gnu -stack-protector-guard-reg=fs -o - < %s | FileCheck --check-prefix=CHECK-TLS-FS-40 %s
-; RUN: llc -mtriple=x86_64-pc-linux-gnu -stack-protector-guard-reg=gs -o - < %s | FileCheck --check-prefix=CHECK-GS %s
-; RUN: llc -mtriple=x86_64-pc-linux-gnu -stack-protector-guard-offset=20 -o - < %s | FileCheck --check-prefix=CHECK-OFFSET %s
-; RUN: llc -mtriple=x86_64-pc-linux-gnu -stack-protector-guard-offset=-20 -o - < %s | FileCheck --check-prefix=CHECK-NEGATIVE-OFFSET %s
+; RUN: split-file %s %t
+; RUN: cat %t/main.ll %t/a.ll > %t/a2.ll
+; RUN: cat %t/main.ll %t/b.ll > %t/b2.ll
+; RUN: cat %t/main.ll %t/c.ll > %t/c2.ll
+; RUN: cat %t/main.ll %t/d.ll > %t/d2.ll
+; RUN: cat %t/main.ll %t/e.ll > %t/e2.ll
+; RUN: cat %t/main.ll %t/f.ll > %t/f2.ll
+; RUN: cat %t/main.ll %t/g.ll > %t/g2.ll
+; RUN: llc -mtriple=x86_64-pc-linux-gnu -o - < %t/a2.ll | FileCheck --check-prefix=CHECK-TLS-FS-40 %s
+; RUN: llc -mtriple=x86_64-pc-linux-gnu -o - < %t/b2.ll | FileCheck --check-prefix=CHECK-TLS-FS-40 %s
+; RUN: llc -mtriple=x86_64-pc-linux-gnu -o - < %t/c2.ll | FileCheck --check-prefix=CHECK-GLOBAL %s
+; RUN: llc -mtriple=x86_64-pc-linux-gnu -o - < %t/d2.ll | FileCheck --check-prefix=CHECK-TLS-FS-40 %s
+; RUN: llc -mtriple=x86_64-pc-linux-gnu -o - < %t/e2.ll | FileCheck --check-prefix=CHECK-GS %s
+; RUN: llc -mtriple=x86_64-pc-linux-gnu -o - < %t/f2.ll | FileCheck --check-prefix=CHECK-OFFSET %s
+; RUN: llc -mtriple=x86_64-pc-linux-gnu -o - < %t/g2.ll | FileCheck --check-prefix=CHECK-NEGATIVE-OFFSET %s
 
 ; CHECK-TLS-FS-40:       movq    %fs:40, %rax
 ; CHECK-TLS-FS-40:       movq    %fs:40, %rax
 ; CHECK-TLS-FS-40-NEXT:  cmpq    16(%rsp), %rax
 ; CHECK-TLS-FS-40-NEXT:  jne     .LBB0_2
 ; CHECK-TLS-FS-40:       .LBB0_2:
 ; CHECK-TLS-FS-40-NEXT:  .cfi_def_cfa_offset 32
 ; CHECK-TLS-FS-40-NEXT:  callq   __stack_chk_fail

 ; CHECK-GLOBAL:       movq    __stack_chk_guard(%rip), %rax
 ; CHECK-GLOBAL:       movq    __stack_chk_guard(%rip), %rax
 ; CHECK-GLOBAL-NEXT:  cmpq    16(%rsp), %rax
 ; CHECK-GLOBAL-NEXT:  jne     .LBB0_2
 ; CHECK-GLOBAL:       .LBB0_2:
 ; CHECK-GLOBAL-NEXT:  .cfi_def_cfa_offset 32
 ; CHECK-GLOBAL-NEXT:  callq   __stack_chk_fail
 
+;--- main.ll
+
 ; ModuleID = 't.c'
 @.str = private unnamed_addr constant [14 x i8] c"stackoverflow\00", align 1
 @a = dso_local local_unnamed_addr global i8* null, align 8
 
 ; Function Attrs: nounwind sspreq uwtable writeonly
 define dso_local i32 @main() local_unnamed_addr #0 {
 entry:
   %array = alloca [5 x i8], align 1

 declare void @llvm.lifetime.end.p0i8(i64 immarg, i8* nocapture) #1
 
 ; Function Attrs: argmemonly nounwind willreturn
 declare void @llvm.memcpy.p0i8.p0i8.i64(i8* noalias nocapture writeonly, i8* noalias nocapture readonly, i64, i1 immarg) #1
 
 attributes #0 = { nounwind sspreq uwtable writeonly "correctly-rounded-divide-sqrt-fp-math"="false" "disable-tail-calls"="false" "frame-pointer"="none" "less-precise-fpmad"="false" "min-legal-vector-width"="0" "no-infs-fp-math"="false" "no-jump-tables"="false" "no-nans-fp-math"="false" "no-signed-zeros-fp-math"="false" "no-trapping-math"="true" "stack-protector-buffer-size"="8" "target-cpu"="x86-64" "target-features"="+cx8,+fxsr,+mmx,+sse,+sse2,+x87" "tune-cpu"="generic" "unsafe-fp-math"="false" "use-soft-float"="false" }
 attributes #1 = { argmemonly nounwind willreturn }
 attributes #2 = { nounwind }
+
+;--- a.ll
+;--- b.ll
+!llvm.module.flags = !{!1}
+!1 = !{i32 2, !"stack-protector-guard", !"tls"}
+;--- c.ll
+!llvm.module.flags = !{!1}
+!1 = !{i32 2, !"stack-protector-guard", !"global"}
+;--- d.ll
+!llvm.module.flags = !{!1}
+!1 = !{i32 2, !"stack-protector-guard-reg", !"fs"}
+;--- e.ll
+!llvm.module.flags = !{!1}
+!1 = !{i32 2, !"stack-protector-guard-reg", !"gs"}
+;--- f.ll
+!llvm.module.flags = !{!1}
+!1 = !{i32 2, !"stack-protector-guard-offset", i32 20}
+;--- g.ll
+!llvm.module.flags = !{!1}
+!1 = !{i32 2, !"stack-protector-guard-offset", i32 -20}

llvm/test/Linker/stack-protector-guard-module-attrs.ll

+; RUN: split-file %s %t
+; RUN: not llvm-link %t/a.ll %t/b.ll 2>&1 | FileCheck --check-prefix=CHECK-KIND %s
+; RUN: not llvm-link %t/c.ll %t/d.ll 2>&1 | FileCheck --check-prefix=CHECK-REG %s
+; RUN: not llvm-link %t/e.ll %t/f.ll 2>&1 | FileCheck --check-prefix=CHECK-OFFSET %s
+; RUN: llvm-link %t/g.ll %t/h.ll
+
+; CHECK-KIND: error: linking module flags 'stack-protector-guard': IDs have conflicting values
+; CHECK-REG: error: linking module flags 'stack-protector-guard-reg': IDs have conflicting values
+; CHECK-OFFSET: error: linking module flags 'stack-protector-guard-offset': IDs have conflicting values
+
+;--- a.ll
+; Test that different values of stack-protector-guard fail.
+define void @foo() sspstrong {
+  ret void
+}
+!llvm.module.flags = !{!0}
+!0 = !{i32 1, !"stack-protector-guard", !"sysreg"}
+;--- b.ll
+declare void @foo() sspstrong
+define void @bar() sspstrong {
+  call void @foo()
+  ret void
+}
+!llvm.module.flags = !{!0}
+!0 = !{i32 1, !"stack-protector-guard", !"global"}
+
+;--- c.ll
+; Test that different values of stack-protector-guard-reg fail.
+define void @foo() sspstrong {
+  ret void
+}
+!llvm.module.flags = !{!0}
+!0 = !{i32 1, !"stack-protector-guard-reg", !"sp_el0"}
+;--- d.ll
+declare void @foo() sspstrong
+define void @bar() sspstrong {
+  call void @foo()
+  ret void
+}
+!llvm.module.flags = !{!0}
+!0 = !{i32 1, !"stack-protector-guard-reg", !"sp_el1"}
+
+;--- e.ll
+; Test that different values of stack-protector-guard-offset fail.
+define void @foo() sspstrong {
+  ret void
+}
+!llvm.module.flags = !{!0}
+!0 = !{i32 1, !"stack-protector-guard-offset", i32 257}
+;--- f.ll
+declare void @foo() sspstrong
+define void @bar() sspstrong {
+  call void @foo()
+  ret void
+}
+!llvm.module.flags = !{!0}
+!0 = !{i32 1, !"stack-protector-guard-offset", i32 256}
+
+;--- g.ll
+; Test that the same values for the three module attributes succeed.
+define void @foo() sspstrong {
+  ret void
+}
+!llvm.module.flags = !{!0, !1, !2}
+!0 = !{i32 1, !"stack-protector-guard", !"sysreg"}
+!1 = !{i32 1, !"stack-protector-guard-reg", !"sp_el0"}
+!2 = !{i32 1, !"stack-protector-guard-offset", i32 257}
+;--- h.ll
+declare void @foo() sspstrong
+define void @bar() sspstrong {
+  call void @foo()
+  ret void
+}
+!llvm.module.flags = !{!0, !1, !2}
+!0 = !{i32 1, !"stack-protector-guard", !"sysreg"}
+!1 = !{i32 1, !"stack-protector-guard-reg", !"sp_el0"}
+!2 = !{i32 1, !"stack-protector-guard-offset", i32 257}