cfi-icall: Add -fsanitize-cfi-promotion-aliases

[samitolvanen]

Summary

Inline assembly refererences to static functions with ThinLTO+CFI were
fixed in D104058 by creating aliases for promoted functions. Creating
the aliases unconditionally resulted in an unexpected size increase in
a Chrome helper binary:

https://bugs.chromium.org/p/chromium/issues/detail?id=1261715

As promotion aliases are only required for very specific use cases,
such as compiling the Linux kernel with CFI, add a command line flag
to allow users to create these aliases only when needed.

[nickdesaulniers]

please don't forget to run git-clang-format HEAD~. Thanks for the patch, LGTM!

[pcc]

I asked @samitolvanen out-of-band to check whether this really needs a flag since it seems like there could be some underlying issue that needs to be resolved so that we can do this unconditionally.

[samitolvanen]

See https://reviews.llvm.org/D113613.

clang/docs/ClangCommandLineReference.rst

 .. option:: -fsanitize-cfi-cross-dso, -fno-sanitize-cfi-cross-dso
 
 Enable control flow integrity (CFI) checks for cross-DSO calls.
 
 .. option:: -fsanitize-cfi-icall-generalize-pointers
 
 Generalize pointers in CFI indirect call type signature checks
 
+.. option:: -fsanitize-cfi-promotion-aliases
+
+Create aliases for promoted static functions to allow them to be referenced from inline assembly
+
 .. option:: -fsanitize-coverage-allowlist=<arg>, -fsanitize-coverage-whitelist=<arg>
 
 Restrict sanitizer coverage instrumentation exclusively to modules and functions that match the provided special case list, except the blocked ones
 
 .. option:: -fsanitize-coverage-ignorelist=<arg>, -fsanitize-coverage-blacklist=<arg>
 
 Disable sanitizer coverage instrumentation for modules and functions that match the provided special case list, even the allowed ones
 

clang/docs/ControlFlowIntegrity.rst

 Furthermore, it is occasionally necessary for code not compiled with
 ``-fsanitize=cfi-icall`` to take a function address that is valid
 for CFI. For example, this is necessary when a function's address
 is taken by assembly code and then called by CFI-checking C code. The
 ``__attribute__((cfi_canonical_jump_table))`` attribute may be used to make
 the jump table entry of a specific function canonical so that the external
 code will end up taking an address for the function that will pass CFI checks.
 
+``-fsanitize-cfi-promotion-aliases``
+--------------------------------------------
+
+With ``-flto=thin`` and CFI, static functions are renamed when they are promoted
+to global visibility, which breaks references to them from inline assembly. With
+``-fsanitize-cfi-promotion-aliases`` the compiler creates local aliases with the
+original name to allow static functions to be referenced from inline assembly.
+
+
 ``-fsanitize=cfi-icall`` and ``-fsanitize=function``
 ----------------------------------------------------
 
 This tool is similar to ``-fsanitize=function`` in that both tools check
 the types of function calls. However, the two tools occupy different points
 on the design space; ``-fsanitize=function`` is a developer tool designed
 to find bugs in local development builds, whereas ``-fsanitize=cfi-icall``
 is a security hardening mechanism designed to be deployed in release builds.

clang/docs/UsersManual.rst

.. option:: -fsanitize-cfi-cross-dso
    of cross-DSO virtual and indirect calls.
 
 .. option:: -fsanitize-cfi-icall-generalize-pointers
 
    Generalize pointers in return and argument types in function type signatures
    checked by Control Flow Integrity indirect call checking. See
    :doc:`ControlFlowIntegrity` for more details.
 
+.. option:: -fsanitize-cfi-promotion-aliases
+
+   Create aliases with the original name for local functions that are renamed
+   when they are promoted to global visibility, so they can be referenced from
+   inline assembly.
+
 .. option:: -fstrict-vtable-pointers
 
    Enable optimizations based on the strict rules for overwriting polymorphic
    C++ objects, i.e. the vptr is invariant during an object's lifetime.
    This enables better devirtualization. Turned off by default, because it is
    still experimental.
 
 .. option:: -fwhole-program-vtables

clang/include/clang/Basic/CodeGenOptions.def

ENUM_CODEGENOPT(SanitizeAddressDtor, llvm::AsanDtorKind, 2,
                                              ///< destructors are emitted.
 CODEGENOPT(SanitizeMemoryUseAfterDtor, 1, 0) ///< Enable use-after-delete detection
                                              ///< in MemorySanitizer
 CODEGENOPT(SanitizeCfiCrossDso, 1, 0) ///< Enable cross-dso support in CFI.
 CODEGENOPT(SanitizeMinimalRuntime, 1, 0) ///< Use "_minimal" sanitizer runtime for
                                          ///< diagnostics.
 CODEGENOPT(SanitizeCfiICallGeneralizePointers, 1, 0) ///< Generalize pointer types in
                                                      ///< CFI icall function signatures
+CODEGENOPT(SanitizeCfiPromotionAliases, 1, 0) ///< Create aliases for promoted local functions
+                                              ///< for inline assembly
 CODEGENOPT(SanitizeCfiCanonicalJumpTables, 1, 0) ///< Make jump table symbols canonical
                                                  ///< instead of creating a local jump table.
 CODEGENOPT(SanitizeCoverageType, 2, 0) ///< Type of sanitizer coverage
                                        ///< instrumentation.
 CODEGENOPT(SanitizeCoverageIndirectCalls, 1, 0) ///< Enable sanitizer coverage
                                                 ///< for indirect calls.
 CODEGENOPT(SanitizeCoverageTraceBB, 1, 0) ///< Enable basic block tracing in
                                           ///< in sanitizer coverage.

clang/include/clang/Driver/Options.td

defm sanitize_cfi_cross_dso : BoolOption<"f", "sanitize-cfi-cross-dso",
   CodeGenOpts<"SanitizeCfiCrossDso">, DefaultFalse,
   PosFlag<SetTrue, [], "Enable">, NegFlag<SetFalse, [CoreOption, NoXarchOption], "Disable">,
   BothFlags<[], " control flow integrity (CFI) checks for cross-DSO calls.">>,
   Group<f_clang_Group>;
 def fsanitize_cfi_icall_generalize_pointers : Flag<["-"], "fsanitize-cfi-icall-generalize-pointers">,
                                               Group<f_clang_Group>,
                                               HelpText<"Generalize pointers in CFI indirect call type signature checks">,
                                               MarshallingInfoFlag<CodeGenOpts<"SanitizeCfiICallGeneralizePointers">>;
+def fsanitize_cfi_promotion_aliases : Flag<["-"], "fsanitize-cfi-promotion-aliases">,
+                                      Group<f_clang_Group>,
+                                      HelpText<"Generate aliases for promoted static functions for inline assembly">,
+                                      MarshallingInfoFlag<CodeGenOpts<"SanitizeCfiPromotionAliases">>;
 defm sanitize_cfi_canonical_jump_tables : BoolOption<"f", "sanitize-cfi-canonical-jump-tables",
   CodeGenOpts<"SanitizeCfiCanonicalJumpTables">, DefaultFalse,
   PosFlag<SetTrue, [], "Make">, NegFlag<SetFalse, [CoreOption, NoXarchOption], "Do not make">,
   BothFlags<[], " the jump table addresses canonical in the symbol table">>,
   Group<f_clang_Group>;
 defm sanitize_stats : BoolOption<"f", "sanitize-stats",
   CodeGenOpts<"SanitizeStats">, DefaultFalse,
   PosFlag<SetTrue, [], "Enable">, NegFlag<SetFalse, [CoreOption, NoXarchOption], "Disable">,

clang/include/clang/Driver/SanitizerArgs.h

class SanitizerArgs {
   std::vector<std::string> CoverageAllowlistFiles;
   std::vector<std::string> CoverageIgnorelistFiles;
   int CoverageFeatures = 0;
   int MsanTrackOrigins = 0;
   bool MsanUseAfterDtor = true;
   bool CfiCrossDso = false;
   bool CfiICallGeneralizePointers = false;
   bool CfiCanonicalJumpTables = false;
+  bool CfiPromotionAliases = false;
   int AsanFieldPadding = 0;
   bool SharedRuntime = false;
   bool AsanUseAfterScope = true;
   bool AsanPoisonCustomArrayCookie = false;
   bool AsanGlobalsDeadStripping = false;
   bool AsanUseOdrIndicator = false;
   bool AsanInvalidPointerCmp = false;
   bool AsanInvalidPointerSub = false;

clang/lib/CodeGen/CodeGenModule.cpp

if (CodeGenOpts.WholeProgramVTables) {
     getModule().addModuleFlag(llvm::Module::Error, "Virtual Function Elim",
                               CodeGenOpts.VirtualFunctionElimination);
   }
 
   if (LangOpts.Sanitize.has(SanitizerKind::CFIICall)) {
     getModule().addModuleFlag(llvm::Module::Override,
                               "CFI Canonical Jump Tables",
                               CodeGenOpts.SanitizeCfiCanonicalJumpTables);
+    getModule().addModuleFlag(llvm::Module::Override,
+                              "CFI Promotion Aliases",
+                              CodeGenOpts.SanitizeCfiPromotionAliases);
   }
 
   if (CodeGenOpts.CFProtectionReturn &&
       Target.checkCFProtectionReturnSupported(getDiags())) {
     // Indicate that we want to instrument return control flow protection.
     getModule().addModuleFlag(llvm::Module::Override, "cf-protection-return",
                               1);
   }

clang/lib/Driver/SanitizerArgs.cpp

if (AllAddedKinds & SanitizerKind::CFI) {
     if (CfiCrossDso && CfiICallGeneralizePointers)
       D.Diag(diag::err_drv_argument_not_allowed_with)
           << "-fsanitize-cfi-cross-dso"
           << "-fsanitize-cfi-icall-generalize-pointers";
 
     CfiCanonicalJumpTables =
         Args.hasFlag(options::OPT_fsanitize_cfi_canonical_jump_tables,
                      options::OPT_fno_sanitize_cfi_canonical_jump_tables, true);
+
+    CfiPromotionAliases =
+        Args.hasArg(options::OPT_fsanitize_cfi_promotion_aliases);
   }
 
   Stats = Args.hasFlag(options::OPT_fsanitize_stats,
                        options::OPT_fno_sanitize_stats, false);
 
   if (MinimalRuntime) {
     SanitizerMask IncompatibleMask =
         Kinds & ~setGroupBits(CompatibleWithMinimalRuntime);
void SanitizerArgs::addArgs(const ToolChain &TC, const llvm::opt::ArgList &Args,
   }
 
   if (CfiCrossDso)
     CmdArgs.push_back("-fsanitize-cfi-cross-dso");
 
   if (CfiICallGeneralizePointers)
     CmdArgs.push_back("-fsanitize-cfi-icall-generalize-pointers");
 
+  if (CfiPromotionAliases)
+    CmdArgs.push_back("-fsanitize-cfi-promotion-aliases");
+
   if (CfiCanonicalJumpTables)
     CmdArgs.push_back("-fsanitize-cfi-canonical-jump-tables");
 
   if (Stats)
     CmdArgs.push_back("-fsanitize-stats");
 
   if (MinimalRuntime)
     CmdArgs.push_back("-fsanitize-minimal-runtime");

clang/test/CodeGen/cfi-promotion-aliases.c

+// RUN: %clang_cc1 -triple x86_64-unknown-linux -fsanitize=cfi-icall -emit-llvm -o - %s | FileCheck --check-prefixes=NOALIASES %s
+// RUN: %clang_cc1 -triple x86_64-unknown-linux -fsanitize=cfi-icall -fsanitize-cfi-promotion-aliases -emit-llvm -o - %s | FileCheck --check-prefixes=ALIASES %s
+
+void a(void) {}
+
+// NOALIASES: !{i32 4, !"CFI Promotion Aliases", i32 0}
+// ALIASES: !{i32 4, !"CFI Promotion Aliases", i32 1}

clang/test/Driver/fsanitize.c

 // RUN: %clang -target x86_64-linux-gnu -fvisibility=hidden -fsanitize=cfi-mfcall -fsanitize-cfi-cross-dso -flto -c %s -### 2>&1 | FileCheck %s --check-prefix=CHECK-CFI-MFCALL-CROSS-DSO
 // CHECK-CFI-MFCALL-CROSS-DSO: '-fsanitize=cfi-mfcall' not allowed with '-fsanitize-cfi-cross-dso'
 
 // RUN: %clang -target x86_64-linux-gnu -fsanitize=cfi-icall -fsanitize-cfi-icall-generalize-pointers -fvisibility=hidden -flto -c %s -### 2>&1 | FileCheck %s --check-prefix=CHECK-CFI-GENERALIZE-POINTERS
 // RUN: %clang -target x86_64-linux-gnu -fsanitize=cfi-icall -fvisibility=hidden -flto -c %s -### 2>&1 | FileCheck %s --check-prefix=CHECK-NO-CFI-GENERALIZE-POINTERS
 // CHECK-CFI-GENERALIZE-POINTERS: -fsanitize-cfi-icall-generalize-pointers
 // CHECK-NO-CFI-GENERALIZE-POINTERS-NOT: -fsanitize-cfi-icall-generalize-pointers
 
+// RUN: %clang -target x86_64-linux-gnu -fsanitize=cfi-icall -fsanitize-cfi-promotion-aliases -fvisibility=hidden -flto=thin -c %s -### 2>&1 | FileCheck %s --check-prefix=CHECK-CFI-PROMOTION-ALIASES
+// RUN: %clang -target x86_64-linux-gnu -fsanitize=cfi-icall -fvisibility=hidden -flto=thin -c %s -### 2>&1 | FileCheck %s --check-prefix=CHECK-NO-CFI-PROMOTION-ALIASES
+// CHECK-CFI-PROMOTION-ALIASES: -fsanitize-cfi-promotion-aliases
+// CHECK-NO-CFI-PROMOTION-ALIASES-NOT: -fsanitize-cfi-promotion-aliases
+
 // RUN: %clang -target x86_64-linux-gnu -fsanitize=cfi-icall -fsanitize-cfi-icall-generalize-pointers -fsanitize-cfi-cross-dso -fvisibility=hidden -flto -c %s -### 2>&1 | FileCheck %s --check-prefix=CHECK-CFI-GENERALIZE-AND-CROSS-DSO
 // CHECK-CFI-GENERALIZE-AND-CROSS-DSO: error: invalid argument '-fsanitize-cfi-cross-dso' not allowed with '-fsanitize-cfi-icall-generalize-pointers'
 
 // RUN: %clang -target x86_64-linux-gnu -fsanitize=cfi-icall -fsanitize-cfi-canonical-jump-tables -fvisibility=hidden -flto -c %s -### 2>&1 | FileCheck %s --check-prefix=CHECK-CFI-CANONICAL-JUMP-TABLES
 // RUN: %clang -target x86_64-linux-gnu -fsanitize=cfi-icall -fno-sanitize-cfi-canonical-jump-tables -fvisibility=hidden -flto -c %s -### 2>&1 | FileCheck %s --check-prefix=CHECK-NO-CFI-CANONICAL-JUMP-TABLES
 // RUN: %clang -target x86_64-linux-gnu -fsanitize=cfi-icall -fvisibility=hidden -flto -c %s -### 2>&1 | FileCheck %s --check-prefix=CHECK-CFI-CANONICAL-JUMP-TABLES
 // CHECK-CFI-CANONICAL-JUMP-TABLES: -fsanitize-cfi-canonical-jump-tables
 // CHECK-NO-CFI-CANONICAL-JUMP-TABLES-NOT: -fsanitize-cfi-canonical-jump-tables

llvm/lib/Transforms/IPO/ThinLTOBitcodeWriter.cpp

 #include "llvm/Transforms/IPO/FunctionImport.h"
 #include "llvm/Transforms/IPO/LowerTypeTests.h"
 #include "llvm/Transforms/Utils/Cloning.h"
 #include "llvm/Transforms/Utils/ModuleUtils.h"
 using namespace llvm;
 
 namespace {
 
+// Determine if promotion aliases should be created for a module.
+static bool createPromotionAliases(Module &M) {
+  auto *CI = mdconst::extract_or_null<ConstantInt>(
+      M.getModuleFlag("CFI Promotion Aliases"));
+  return (CI && CI->getZExtValue() != 0);
+}
+
 // Determine if a promotion alias should be created for a symbol name.
 static bool allowPromotionAlias(const std::string &Name) {
   // Promotion aliases are used only in inline assembly. It's safe to
   // simply skip unusual names. Subset of MCAsmInfo::isAcceptableChar()
   // and MCAsmInfoXCOFF::isAcceptableChar().
   for (const char &C : Name) {
     if (isAlnum(C) || C == '_' || C == '.')
       continue;
     return false;
   }
   return true;
 }
 
 // Promote each local-linkage entity defined by ExportM and used by ImportM by
 // changing visibility and appending the given ModuleId.
 void promoteInternals(Module &ExportM, Module &ImportM, StringRef ModuleId,
                       SetVector<GlobalValue *> &PromoteExtra) {
   DenseMap<const Comdat *, Comdat *> RenamedComdats;
+  bool CreateAliases = createPromotionAliases(ExportM);
+
   for (auto &ExportGV : ExportM.global_values()) {
     if (!ExportGV.hasLocalLinkage())
       continue;
 
     auto Name = ExportGV.getName();
     GlobalValue *ImportGV = nullptr;
     if (!PromoteExtra.count(&ExportGV)) {
       ImportGV = ImportM.getNamedValue(Name);
for (auto &ExportGV : ExportM.global_values()) {
     ExportGV.setLinkage(GlobalValue::ExternalLinkage);
     ExportGV.setVisibility(GlobalValue::HiddenVisibility);
 
     if (ImportGV) {
       ImportGV->setName(NewName);
       ImportGV->setVisibility(GlobalValue::HiddenVisibility);
     }
 
-    if (isa<Function>(&ExportGV) && allowPromotionAlias(OldName)) {
+    if (CreateAliases && isa<Function>(&ExportGV) &&
+        allowPromotionAlias(OldName)) {
       // Create a local alias with the original name to avoid breaking
       // references from inline assembly.
       std::string Alias = ".set " + OldName + "," + NewName + "\n";
       ExportM.appendModuleInlineAsm(Alias);
     }
   }
 
   if (!RenamedComdats.empty())

llvm/test/ThinLTO/X86/devirt2.ll

 ; RUN:   -r=%t1.o,_ZTV1B, \
 ; RUN:   -r=%t1.o,_ZTV1C, \
 ; RUN:   -r=%t1.o,_ZTV1D, \
 ; RUN:   -r=%t1.o,_ZTV1D, \
 ; RUN:   -r=%t1.o,_ZN1D1mEi, \
 ; RUN:   -r=%t1.o,_ZN1D1mEi, \
 ; RUN:   -r=%t1.o,test2, \
 ; RUN:   -r=%t2.o,_ZN1A1nEi,p \
-; RUN:   -r=%t2.o,_ZN1A1nEi, \
 ; RUN:   -r=%t2.o,_ZN1B1fEi,p \
 ; RUN:   -r=%t2.o,_ZN1C1fEi,p \
 ; RUN:   -r=%t2.o,_ZN1D1mEi,p \
 ; RUN:   -r=%t2.o,_ZN1E1mEi,p \
-; RUN:   -r=%t2.o,_ZN1E1mEi, \
 ; RUN:   -r=%t2.o,_ZTV1B, \
 ; RUN:   -r=%t2.o,_ZTV1C, \
 ; RUN:   -r=%t2.o,_ZTV1D, \
 ; RUN:   -r=%t2.o,_ZTV1E, \
 ; RUN:   -r=%t2.o,test2,px \
 ; RUN:   -r=%t2.o,_ZN1A1nEi, \
 ; RUN:   -r=%t2.o,_ZN1B1fEi, \
 ; RUN:   -r=%t2.o,_ZN1C1fEi, \

 ; RUN:   -r=%t1.o,_ZTV1B, \
 ; RUN:   -r=%t1.o,_ZTV1C, \
 ; RUN:   -r=%t1.o,_ZTV1D, \
 ; RUN:   -r=%t1.o,_ZTV1D, \
 ; RUN:   -r=%t1.o,_ZN1D1mEi, \
 ; RUN:   -r=%t1.o,_ZN1D1mEi, \
 ; RUN:   -r=%t1.o,test2, \
 ; RUN:   -r=%t2.o,_ZN1A1nEi,p \
-; RUN:   -r=%t2.o,_ZN1A1nEi, \
 ; RUN:   -r=%t2.o,_ZN1B1fEi,p \
 ; RUN:   -r=%t2.o,_ZN1C1fEi,p \
 ; RUN:   -r=%t2.o,_ZN1D1mEi,p \
 ; RUN:   -r=%t2.o,_ZN1E1mEi,p \
-; RUN:   -r=%t2.o,_ZN1E1mEi, \
 ; RUN:   -r=%t2.o,_ZTV1B, \
 ; RUN:   -r=%t2.o,_ZTV1C, \
 ; RUN:   -r=%t2.o,_ZTV1D, \
 ; RUN:   -r=%t2.o,_ZTV1E, \
 ; RUN:   -r=%t2.o,test2,px \
 ; RUN:   -r=%t2.o,_ZN1A1nEi, \
 ; RUN:   -r=%t2.o,_ZN1B1fEi, \
 ; RUN:   -r=%t2.o,_ZN1C1fEi, \

llvm/test/Transforms/ThinLTOBitcodeWriter/cfi-icall-static-inline-asm.ll

define void @b() {
   ret void
 }
 
 ; CHECK: define{{.*}} @a.[[HASH]](){{.*}} !type
 define internal void @a() !type !0 {
   ret void
 }
 
+!llvm.module.flags = !{!1}
+
 !0 = !{i64 0, !"typeid1"}
+!1 = !{i32 4, !"CFI Promotion Aliases", i32 1}