WIP [randstruct] Add randomize structure layout support

[void]

Summary

The Randstruct feature is a compile-time hardening technique that
randomizes the field layout for designated structures of a code base.
Admittedly, this is mostly useful for closed-source releases of code,
since the randomization seed would need to be available for public and
open source applications.

Why implement it? This patch set enhances Clang’s feature parity with
that of GCC which already has the Randstruct feature. It's used by the
Linux kernel in certain structures to help thwart attacks that depend on
structure layouts in memory.

This patch set is a from-scratch reimplementation of the Randstruct
feature that was originally ported to GCC. The patches for the GCC
implementation can be found here:

https://www.openwall.com/lists/kernel-hardening/2017/04/06/14

Link: https://lists.llvm.org/pipermail/cfe-dev/2019-March/061607.html
Co-authored-by: Cole Nixon <[e-mail]>
Co-authored-by: Connor Kuehl <[e-mail]>
Co-authored-by: James Foster <[e-mail]>
Co-authored-by: Jeff Takahashi <[e-mail]>
Co-authored-by: Jordan Cantrell <[e-mail]>
Co-authored-by: Nikk Forbus <[e-mail]>
Co-authored-by: Tim Pugh <[e-mail]>
Co-authored-by: Bill Wendling <[e-mail]>
Signed-off-by: Bill Wendling <[e-mail]>

[void]

Update with coding style.

[void]

Fix assert from use of null pointer.

[void]

Don't warn on multiple attributes. Instead, use the last one to indicate whether to randomize the layout or not.

[void]

Don't call little-used function in DeclContext to re-link the record decls.

[void]

Place the randomization call where it'll actually work. :-)

[void]

@connorkuehl This is almost ready to unleash upon the whole community. I wanted to give you the first chance to review it. Please let me know what you think! Hopefully I didn't mess your code up too badly.

[void]

Improve bad cast warning message.

[aaron.ballman]

This seems like a duplicate of https://reviews.llvm.org/D121556 -- should this review be abandoned?

[void]

In D120857#3389022, @aaron.ballman wrote:

This seems like a duplicate of https://reviews.llvm.org/D121556 -- should this review be abandoned?

Yes. Thanks :-)

clang/include/clang/AST/Decl.h

public:
   }
 };
 
 /// Represents a member of a struct/union/class.
 class FieldDecl : public DeclaratorDecl, public Mergeable<FieldDecl> {
   unsigned BitField : 1;
   unsigned Mutable : 1;
   mutable unsigned CachedFieldIndex : 30;
+  mutable unsigned OriginalFieldIndex : 30;
 
   /// The kinds of value we can store in InitializerOrBitWidth.
   ///
   /// Note that this is compatible with InClassInitStyle except for
   /// ISK_CapturedVLAType.
   enum InitStorageKind {
     /// If the pointer is null, there's nothing special.  Otherwise,
     /// this is a bitfield and the pointer is the Expr* storing the
class FieldDecl : public DeclaratorDecl, public Mergeable<FieldDecl> {
   /// field has an in-class initializer that has not yet been parsed
   /// and attached.
   // FIXME: Tail-allocate this to reduce the size of FieldDecl in the
   // overwhelmingly common case that we have none of these things.
   llvm::PointerIntPair<void *, 2, InitStorageKind> InitStorage;
 
 protected:
   FieldDecl(Kind DK, DeclContext *DC, SourceLocation StartLoc,
-            SourceLocation IdLoc, IdentifierInfo *Id,
-            QualType T, TypeSourceInfo *TInfo, Expr *BW, bool Mutable,
+            SourceLocation IdLoc, IdentifierInfo *Id, QualType T,
+            TypeSourceInfo *TInfo, Expr *BW, bool Mutable,
             InClassInitStyle InitStyle)
-    : DeclaratorDecl(DK, DC, IdLoc, Id, T, TInfo, StartLoc),
-      BitField(false), Mutable(Mutable), CachedFieldIndex(0),
-      InitStorage(nullptr, (InitStorageKind) InitStyle) {
+      : DeclaratorDecl(DK, DC, IdLoc, Id, T, TInfo, StartLoc), BitField(false),
+        Mutable(Mutable), CachedFieldIndex(0), OriginalFieldIndex(0),
+        InitStorage(nullptr, (InitStorageKind)InitStyle) {
     if (BW)
       setBitWidth(BW);
   }
 
 public:
   friend class ASTDeclReader;
   friend class ASTDeclWriter;
 
   static FieldDecl *Create(const ASTContext &C, DeclContext *DC,
                            SourceLocation StartLoc, SourceLocation IdLoc,
                            IdentifierInfo *Id, QualType T,
                            TypeSourceInfo *TInfo, Expr *BW, bool Mutable,
                            InClassInitStyle InitStyle);
 
   static FieldDecl *CreateDeserialized(ASTContext &C, unsigned ID);
 
   /// Returns the index of this field within its record,
   /// as appropriate for passing to ASTRecordLayout::getFieldOffset.
   unsigned getFieldIndex() const;
 
+  /// For struct field reorg, this is the original index, 1-based, or
+  /// 0 if reorg did not happen.
+  unsigned getOriginalFieldIndex() const { return OriginalFieldIndex; }
+
+  /// For struct field reorg, sets a 1-based index.
+  void setOriginalFieldIndex(unsigned Idx) {
+    assert(Idx && "Invalid original field index");
+    OriginalFieldIndex = Idx;
+  }
+
   /// Determines whether this field is mutable (C++ only).
   bool isMutable() const { return Mutable; }
 
   /// Determines whether this field is a bitfield.
   bool isBitField() const { return BitField; }
 
   /// Determines whether this is an unnamed bitfield.
   bool isUnnamedBitfield() const { return isBitField() && !getDeclName(); }
public:
   bool isParamDestroyedInCallee() const {
     return RecordDeclBits.ParamDestroyedInCallee;
   }
 
   void setParamDestroyedInCallee(bool V) {
     RecordDeclBits.ParamDestroyedInCallee = V;
   }
 
+  bool isRandomized() const { return RecordDeclBits.IsRandomized; }
+
+  void setIsRandomized(bool V) const { RecordDeclBits.IsRandomized = V; }
+
   /// Determines whether this declaration represents the
   /// injected class name.
   ///
   /// The injected class name in C++ is the name of the class that
   /// appears inside the class itself. For example:
   ///
   /// \code
   /// struct C {

clang/include/clang/AST/DeclBase.h

class RecordDeclBitfields {
     uint64_t HasNonTrivialToPrimitiveDestructCUnion : 1;
     uint64_t HasNonTrivialToPrimitiveCopyCUnion : 1;
 
     /// Indicates whether this struct is destroyed in the callee.
     uint64_t ParamDestroyedInCallee : 1;
 
     /// Represents the way this type is passed to a function.
     uint64_t ArgPassingRestrictions : 2;
+
+    /// Indicates whether this struct has had its field layout randomized.
+    mutable uint64_t IsRandomized : 1;
   };
 
   /// Number of non-inherited bits in RecordDeclBitfields.
-  enum { NumRecordDeclBits = 14 };
+  enum { NumRecordDeclBits = 15 };
 
   /// Stores the bits used by OMPDeclareReductionDecl.
   /// If modified NumOMPDeclareReductionDeclBits and the accessor
   /// methods in OMPDeclareReductionDecl should be updated appropriately.
   class OMPDeclareReductionDeclBitfields {
     friend class OMPDeclareReductionDecl;
     /// For the bits in DeclContextBitfields
     uint64_t : NumDeclContextBits;

clang/include/clang/AST/Randstruct.h

+//===- Randstruct.h - Interfact for structure randomization -------*- C++ -*-=//
+//
+// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
+// See https://llvm.org/LICENSE.txt for license information.
+// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
+//
+//===----------------------------------------------------------------------===//
+//
+// This file contains the interface for Clang's structure field layout
+// randomization.
+//
+//===----------------------------------------------------------------------===//
+
+#ifndef LLVM_CLANG_AST_RANDSTRUCT_H
+#define LLVM_CLANG_AST_RANDSTRUCT_H
+
+#include <string>
+
+namespace llvm {
+template <typename T> class SmallVectorImpl;
+} // end namespace llvm
+
+namespace clang {
+
+class ASTContext;
+class Decl;
+class FieldDecl;
+class RecordDecl;
+
+namespace randstruct {
+
+using llvm::SmallVectorImpl;
+
+extern std::string SEED;
+
+bool shouldRandomize(const ASTContext &Context, const RecordDecl *RD);
+void randomizeStructureLayout(const ASTContext &Context, const RecordDecl *RD,
+                              SmallVectorImpl<Decl *> &FinalOrdering);
+
+} // namespace randstruct
+} // namespace clang
+
+#endif // LLVM_CLANG_AST_RANDSTRUCT_H

clang/include/clang/Basic/Attr.td

 def Error : InheritableAttr {
   let Spellings = [GCC<"error">, GCC<"warning">];
   let Accessors = [Accessor<"isError", [GCC<"error">]>,
                    Accessor<"isWarning", [GCC<"warning">]>];
   let Args = [StringArgument<"UserDiagnostic">];
   let Subjects = SubjectList<[Function], ErrorDiag>;
   let Documentation = [ErrorAttrDocs];
 }
+
+def RandomizeLayout : InheritableAttr {
+  let Spellings = [GCC<"randomize_layout">, Declspec<"randomize_layout">,
+    Keyword<"randomize_layout">];
+  let Subjects = SubjectList<[Record]>;
+  let Documentation = [ClangRandstructDocs];
+  let LangOpts = [COnly];
+}
+
+// The "no_randomize_layout" attribute isn't added to a Decl. Instead, it's
+// used to drop the "randomize_layout" attribute.
+def NoRandomizeLayout : InheritableAttr {
+  let Spellings = [GCC<"no_randomize_layout">, Declspec<"no_randomize_layout">,
+    Keyword<"no_randomize_layout">];
+  let Subjects = SubjectList<[Record]>;
+  let Documentation = [ClangRandstructDocs];
+  let LangOpts = [COnly];
+}

clang/include/clang/Basic/AttrDocs.td

- ``all-gpr-arg`` zeros all call-used GPR registers used to pass arguments to
   the function.
 
 The default for the attribute is contolled by the ``-fzero-call-used-regs``
 flag.
 
 .. _Return-Oriented Programming: https://en.wikipedia.org/wiki/Return-oriented_programming
   }];
 }
+
+def ClangRandstructDocs : Documentation {
+  let Category = DocCatVariable;
+  let Heading = "randomize_layout, no_randomize_layout";
+  let Content = [{
+The attribute ``randomize_layout`` can be added to a record-type definition to
+select it for structure layout field randomization; a compile-time hardening
+technique.
+
+The attribute ``no_randomize_layout`` can be added to a record-type definition
+to instruct the compiler that this structure should not have its field layout
+randomized.
+  }];
+}

clang/include/clang/Basic/DiagnosticDriverKinds.td

 def err_drv_argument_only_allowed_with : Error<
   "invalid argument '%0' only allowed with '%1'">;
 def err_drv_minws_unsupported_input_type : Error<
   "'-fminimize-whitespace' invalid for input of type %0">;
 def err_drv_amdgpu_ieee_without_no_honor_nans : Error<
   "invalid argument '-mno-amdgpu-ieee' only allowed with relaxed NaN handling">;
 def err_drv_argument_not_allowed_with : Error<
   "invalid argument '%0' not allowed with '%1'">;
+def err_drv_cannot_open_randstruct_seed_filename : Error<
+  "cannot read randstruct seed file '%0'">;
 def err_drv_invalid_version_number : Error<
   "invalid version number in '%0'">;
 def err_drv_no_linker_llvm_support : Error<
   "'%0': unable to pass LLVM bit-code files to linker">;
 def err_drv_no_ast_support : Error<
   "'%0': unable to use AST files with this tool">;
 def err_drv_no_module_support : Error<
   "'%0': unable to use module files with this tool">;

clang/include/clang/Basic/DiagnosticSemaKinds.td

def warn_tcb_enforcement_violation : Warning<
   "calling %0 is a violation of trusted computing base '%1'">,
   InGroup<DiagGroup<"tcb-enforcement">>;
 
 // RISC-V builtin required extension warning
 def err_riscv_builtin_requires_extension : Error<
   "builtin requires at least one of the following extensions support to be enabled : %0">;
 def err_riscv_builtin_invalid_lmul : Error<
   "LMUL argument must be in the range [0,3] or [5,7]">;
+
+// Layout randomization warning.
+def cast_from_randomized_struct : Error<
+  "casting from randomized structure pointer type %0 to %1">;
 } // end of sema component.

clang/include/clang/Driver/Options.td

def fmacro_backtrace_limit_EQ : Joined<["-"], "fmacro-backtrace-limit=">,
                                 Group<f_Group>, Flags<[NoXarchOption, CoreOption]>;
 defm merge_all_constants : BoolFOption<"merge-all-constants",
   CodeGenOpts<"MergeAllConstants">, DefaultFalse,
   PosFlag<SetTrue, [CC1Option, CoreOption], "Allow">, NegFlag<SetFalse, [], "Disallow">,
   BothFlags<[], " merging of constants">>;
 def fmessage_length_EQ : Joined<["-"], "fmessage-length=">, Group<f_Group>, Flags<[CC1Option]>,
   HelpText<"Format message diagnostics so that they fit within N columns">,
   MarshallingInfoInt<DiagnosticOpts<"MessageLength">>;
+def frandstruct_seed_EQ
+    : Joined<["-"], "frandstruct-seed=">,
+      Group<f_clang_Group>,
+      Flags<[CC1Option, CoreOption]>;
+def frandstruct_seed_filename_EQ
+    : Joined<["-"], "frandstruct-seed-filename=">,
+      Group<f_clang_Group>,
+      Flags<[CC1Option, CoreOption]>;
 def fms_compatibility : Flag<["-"], "fms-compatibility">, Group<f_Group>, Flags<[CC1Option, CoreOption]>,
   HelpText<"Enable full Microsoft Visual C++ compatibility">,
   MarshallingInfoFlag<LangOpts<"MSVCCompat">>;
 def fms_extensions : Flag<["-"], "fms-extensions">, Group<f_Group>, Flags<[CC1Option, CoreOption]>,
   HelpText<"Accept some non-standard constructs supported by the Microsoft compiler">,
   MarshallingInfoFlag<LangOpts<"MicrosoftExt">>, ImpliedByAnyOf<[fms_compatibility.KeyPath]>;
 defm asm_blocks : BoolFOption<"asm-blocks",
   LangOpts<"AsmBlocks">, Default<fms_extensions.KeyPath>,

clang/lib/AST/CMakeLists.txt

add_clang_library(clangAST
   NestedNameSpecifier.cpp
   NSAPI.cpp
   ODRHash.cpp
   OpenMPClause.cpp
   OSLog.cpp
   ParentMap.cpp
   PrintfFormatString.cpp
   QualTypeNames.cpp
+  Randstruct.cpp
   RawCommentList.cpp
   RecordLayout.cpp
   RecordLayoutBuilder.cpp
   ScanfFormatString.cpp
   SelectorLocationsKind.cpp
   Stmt.cpp
   StmtCXX.cpp
   StmtIterator.cpp

clang/lib/AST/Decl.cpp

 #include "clang/AST/DeclTemplate.h"
 #include "clang/AST/DeclarationName.h"
 #include "clang/AST/Expr.h"
 #include "clang/AST/ExprCXX.h"
 #include "clang/AST/ExternalASTSource.h"
 #include "clang/AST/ODRHash.h"
 #include "clang/AST/PrettyDeclStackTrace.h"
 #include "clang/AST/PrettyPrinter.h"
+#include "clang/AST/Randstruct.h"
 #include "clang/AST/Redeclarable.h"
 #include "clang/AST/Stmt.h"
 #include "clang/AST/TemplateBase.h"
 #include "clang/AST/Type.h"
 #include "clang/AST/TypeLoc.h"
 #include "clang/Basic/Builtins.h"
 #include "clang/Basic/IdentifierTable.h"
 #include "clang/Basic/LLVM.h"
RecordDecl::RecordDecl(Kind DK, TagKind TK, const ASTContext &C,
   setNonTrivialToPrimitiveDefaultInitialize(false);
   setNonTrivialToPrimitiveCopy(false);
   setNonTrivialToPrimitiveDestroy(false);
   setHasNonTrivialToPrimitiveDefaultInitializeCUnion(false);
   setHasNonTrivialToPrimitiveDestructCUnion(false);
   setHasNonTrivialToPrimitiveCopyCUnion(false);
   setParamDestroyedInCallee(false);
   setArgPassingRestrictions(APK_CanPassInRegs);
+  setIsRandomized(false);
 }
 
 RecordDecl *RecordDecl::Create(const ASTContext &C, TagKind TK, DeclContext *DC,
                                SourceLocation StartLoc, SourceLocation IdLoc,
                                IdentifierInfo *Id, RecordDecl* PrevDecl) {
   RecordDecl *R = new (C, DC) RecordDecl(Record, TK, C, DC,
                                          StartLoc, IdLoc, Id, PrevDecl);
   R->setMayHaveOutOfDateDef(C.getLangOpts().Modules);

clang/lib/AST/DeclBase.cpp

 #include "clang/AST/DeclCXX.h"
 #include "clang/AST/DeclContextInternals.h"
 #include "clang/AST/DeclFriend.h"
 #include "clang/AST/DeclObjC.h"
 #include "clang/AST/DeclOpenMP.h"
 #include "clang/AST/DeclTemplate.h"
 #include "clang/AST/DependentDiagnostic.h"
 #include "clang/AST/ExternalASTSource.h"
+#include "clang/AST/Randstruct.h"
 #include "clang/AST/Stmt.h"
 #include "clang/AST/Type.h"
 #include "clang/Basic/IdentifierTable.h"
 #include "clang/Basic/LLVM.h"
 #include "clang/Basic/LangOptions.h"
 #include "clang/Basic/ObjCRuntime.h"
 #include "clang/Basic/PartialDiagnostic.h"
 #include "clang/Basic/SourceLocation.h"

clang/lib/AST/Randstruct.cpp

+//===--- Randstruct.cpp ---------------------------------------------------===//
+//
+// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
+// See https://llvm.org/LICENSE.txt for license information.
+// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
+//
+//===----------------------------------------------------------------------===//
+//
+// This file contains the implementation for Clang's structure field layout
+// randomization.
+//
+//===----------------------------------------------------------------------===//
+
+#include "clang/AST/Randstruct.h"
+#include "clang/AST/ASTContext.h"
+#include "clang/AST/ASTDiagnostic.h"
+#include "clang/AST/Attr.h"
+#include "clang/Basic/Diagnostic.h"
+#include "llvm/ADT/SmallVector.h"
+
+#include <algorithm>
+#include <random>
+#include <set>
+#include <sstream>
+#include <string>
+
+namespace clang {
+namespace randstruct {
+
+std::string SEED;
+
+// FIXME: Replace this with some discovery once that mechanism exists.
+enum { CACHE_LINE = 64 };
+
+// The Bucket class holds the struct fields we're trying to fill to a
+// cache-line.
+class Bucket {
+  SmallVector<FieldDecl *, 64> Fields;
+  int Size = 0;
+
+public:
+  virtual ~Bucket() = default;
+
+  SmallVector<FieldDecl *, 64> &fields() { return Fields; }
+  void addField(FieldDecl *Field, int FieldSize);
+  virtual bool canFit(int FieldSize) const {
+    return Size + FieldSize <= CACHE_LINE;
+  }
+  virtual bool isBitfieldRun() const { return false; }
+  bool full() const { return Size >= CACHE_LINE; }
+};
+
+void Bucket::addField(FieldDecl *Field, int FieldSize) {
+  Size += FieldSize;
+  Fields.push_back(Field);
+}
+
+struct BitfieldRunBucket : public Bucket {
+  bool canFit(int FieldSize) const override { return true; }
+  bool isBitfieldRun() const override { return true; }
+};
+
+bool shouldRandomize(const ASTContext &Context, const RecordDecl *RD) {
+  return Context.getLangOpts().C99 && !SEED.empty() && !RD->isUnion() &&
+         RD->hasAttr<RandomizeLayoutAttr>();
+}
+
+void randomizeStructureLayoutImpl(const ASTContext &Context,
+                                  SmallVectorImpl<FieldDecl *> &FieldsOut,
+                                  std::mt19937 &RNG) {
+  // All of the Buckets produced by best-effort cache-line algorithm.
+  // TODO: Figure out a better initial size.
+  SmallVector<std::unique_ptr<randstruct::Bucket>, 16> Buckets;
+
+  // The current bucket of fields that we are trying to fill to a cache-line.
+  std::unique_ptr<randstruct::Bucket> CurrentBucket = nullptr;
+
+  // The current bucket containing the run of adjacent bitfields to ensure they
+  // remain adjacent.
+  std::unique_ptr<randstruct::Bucket> CurrentBitfieldRun = nullptr;
+
+  // Tracks the number of fields that we failed to fit to the current bucket,
+  // and thus still need to be added later.
+  size_t Skipped = 0;
+
+  while (!FieldsOut.empty()) {
+    // If we've Skipped more fields than we have remaining to place, that means
+    // that they can't fit in our current bucket, and we need to start a new
+    // one.
+    if (Skipped >= FieldsOut.size()) {
+      Skipped = 0;
+      Buckets.push_back(std::move(CurrentBucket));
+    }
+
+    // Take the first field that needs to be put in a bucket.
+    auto FieldIter = FieldsOut.begin();
+    FieldDecl *FD = *FieldIter;
+
+    if (FD->isBitField() && !FD->isZeroLengthBitField(Context)) {
+      // Start a bitfield run if this is the first bitfield we have found.
+      if (!CurrentBitfieldRun)
+        CurrentBitfieldRun = std::make_unique<randstruct::BitfieldRunBucket>();
+
+      // We've placed the field, and can remove it from the "awaiting Buckets"
+      // vector called "Fields."
+      CurrentBitfieldRun->addField(FD, /*FieldSize is irrelevant here*/ 1);
+      FieldsOut.erase(FieldIter);
+      continue;
+    }
+
+    // Else, current field is not a bitfield. If we were previously in a
+    // bitfield run, end it.
+    if (CurrentBitfieldRun)
+      Buckets.push_back(std::move(CurrentBitfieldRun));
+
+    // If we don't have a bucket, make one.
+    if (!CurrentBucket)
+      CurrentBucket = std::make_unique<randstruct::Bucket>();
+
+    uint64_t Width = Context.getTypeInfo(FD->getType()).Width;
+    if (Width >= randstruct::CACHE_LINE) {
+      std::unique_ptr<randstruct::Bucket> OverSized =
+          std::make_unique<randstruct::Bucket>();
+      OverSized->addField(FD, Width);
+      FieldsOut.erase(FieldIter);
+      Buckets.push_back(std::move(OverSized));
+      continue;
+    }
+
+    // If it fits, add it.
+    if (CurrentBucket->canFit(Width)) {
+      CurrentBucket->addField(FD, Width);
+      FieldsOut.erase(FieldIter);
+
+      // If it's now full, tie off the bucket.
+      if (CurrentBucket->full()) {
+        Skipped = 0;
+        Buckets.push_back(std::move(CurrentBucket));
+      }
+    } else {
+      // We can't fit it in our current bucket. Move to the end for processing
+      // later.
+      ++Skipped; // Mark it skipped.
+      FieldsOut.push_back(FD);
+      FieldsOut.erase(FieldIter);
+    }
+  }
+
+  // Done processing the fields awaiting a bucket.
+
+  // If we were filling a bucket, tie it off.
+  if (CurrentBucket)
+    Buckets.push_back(std::move(CurrentBucket));
+
+  // If we were processing a bitfield run bucket, tie it off.
+  if (CurrentBitfieldRun)
+    Buckets.push_back(std::move(CurrentBitfieldRun));
+
+  std::shuffle(std::begin(Buckets), std::end(Buckets), RNG);
+
+  // Produce the new ordering of the elements from the Buckets.
+  SmallVector<FieldDecl *, 16> FinalOrder;
+  for (const std::unique_ptr<randstruct::Bucket> &B : Buckets) {
+    SmallVectorImpl<FieldDecl *> &RandFields = B->fields();
+    if (!B->isBitfieldRun())
+      std::shuffle(std::begin(RandFields), std::end(RandFields), RNG);
+
+    FinalOrder.insert(FinalOrder.end(), RandFields.begin(), RandFields.end());
+  }
+
+  FieldsOut = FinalOrder;
+}
+
+void randomizeStructureLayout(const ASTContext &Context, const RecordDecl *RD,
+                              SmallVectorImpl<Decl *> &FinalOrdering) {
+  if (!shouldRandomize(Context, RD))
+    return;
+
+  SmallVector<FieldDecl *, 64> RandomizedFields;
+
+  unsigned Index = 1;
+  unsigned TotalNumFields = 0;
+  for (Decl *D : RD->decls()) {
+    ++TotalNumFields;
+    if (auto FD = dyn_cast<FieldDecl>(D)) {
+      FD->setOriginalFieldIndex(Index++);
+      RandomizedFields.push_back(FD);
+    } else {
+      FinalOrdering.push_back(D);
+    }
+  }
+
+  if (RandomizedFields.empty())
+    return;
+
+  // Struct might end with a variable-length array or an array of size 0 or 1,
+  // in which case we don't want to randomize it.
+  FieldDecl *VLA = nullptr;
+  const auto *CA =
+      dyn_cast<ConstantArrayType>(RandomizedFields.back()->getType());
+  if ((CA && (CA->getSize().sle(2) || CA->isIncompleteArrayType())) ||
+      RD->hasFlexibleArrayMember())
+    VLA = RandomizedFields.pop_back_val();
+
+  std::string Seed = SEED + RD->getNameAsString();
+  std::seed_seq SeedSeq(Seed.begin(), Seed.end());
+  std::mt19937 RNG(SeedSeq);
+
+  randomizeStructureLayoutImpl(Context, RandomizedFields, RNG);
+  if (VLA)
+    RandomizedFields.push_back(VLA);
+
+  FinalOrdering.insert(FinalOrdering.end(), RandomizedFields.begin(),
+                       RandomizedFields.end());
+
+  assert(TotalNumFields == FinalOrdering.size() &&
+         "Decl count has been altered after Randstruct randomization!");
+
+  RD->setIsRandomized(true);
+}
+
+} // end namespace randstruct
+} // end namespace clang

clang/lib/AST/RecordLayoutBuilder.cpp

 //=== RecordLayoutBuilder.cpp - Helper class for building record layouts ---==//
 //
 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
 // See https://llvm.org/LICENSE.txt for license information.
 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
 //
 //===----------------------------------------------------------------------===//
 
 #include "clang/AST/ASTContext.h"
 #include "clang/AST/ASTDiagnostic.h"
 #include "clang/AST/Attr.h"
 #include "clang/AST/CXXInheritance.h"
 #include "clang/AST/Decl.h"
 #include "clang/AST/DeclCXX.h"
 #include "clang/AST/DeclObjC.h"
 #include "clang/AST/Expr.h"
-#include "clang/AST/VTableBuilder.h"
+#include "clang/AST/Randstruct.h"
 #include "clang/AST/RecordLayout.h"
+#include "clang/AST/VTableBuilder.h"
 #include "clang/Basic/TargetInfo.h"
 #include "llvm/ADT/SmallSet.h"
 #include "llvm/Support/Format.h"
 #include "llvm/Support/MathExtras.h"
 
 using namespace clang;
 
 namespace {

clang/lib/Driver/ToolChains/Clang.cpp

if (Arg *A = Args.getLastArg(options::OPT_fmessage_length_EQ)) {
     // If -fmessage-length=N was not specified, determine whether this is a
     // terminal and, if so, implicitly define -fmessage-length appropriately.
     MessageLength = llvm::sys::Process::StandardErrColumns();
   }
   if (MessageLength != 0)
     CmdArgs.push_back(
         Args.MakeArgString("-fmessage-length=" + Twine(MessageLength)));
 
+  if (Arg *A = Args.getLastArg(options::OPT_frandstruct_seed_EQ))
+    CmdArgs.push_back(
+        Args.MakeArgString("-frandstruct-seed=" + Twine(A->getValue(0))));
+
+  if (Arg *A = Args.getLastArg(options::OPT_frandstruct_seed_filename_EQ))
+    CmdArgs.push_back(Args.MakeArgString("-frandstruct-seed-filename=" +
+                                         Twine(A->getValue(0))));
+
   // -fvisibility= and -fvisibility-ms-compat are of a piece.
   if (const Arg *A = Args.getLastArg(options::OPT_fvisibility_EQ,
                                      options::OPT_fvisibility_ms_compat)) {
     if (A->getOption().matches(options::OPT_fvisibility_EQ)) {
       CmdArgs.push_back("-fvisibility");
       CmdArgs.push_back(A->getValue());
     } else {
       assert(A->getOption().matches(options::OPT_fvisibility_ms_compat));

clang/lib/Frontend/CompilerInvocation.cpp

 //===- CompilerInvocation.cpp ---------------------------------------------===//
 //
 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
 // See https://llvm.org/LICENSE.txt for license information.
 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
 //
 //===----------------------------------------------------------------------===//
 
 #include "clang/Frontend/CompilerInvocation.h"
 #include "TestModuleFileExtension.h"
+#include "clang/AST/Randstruct.h"
 #include "clang/Basic/Builtins.h"
 #include "clang/Basic/CharInfo.h"
 #include "clang/Basic/CodeGenOptions.h"
 #include "clang/Basic/CommentOptions.h"
 #include "clang/Basic/DebugInfoOptions.h"
 #include "clang/Basic/Diagnostic.h"
 #include "clang/Basic/DiagnosticDriver.h"
 #include "clang/Basic/DiagnosticOptions.h"

 #include "llvm/Support/VirtualFileSystem.h"
 #include "llvm/Support/raw_ostream.h"
 #include "llvm/Target/TargetOptions.h"
 #include <algorithm>
 #include <atomic>
 #include <cassert>
 #include <cstddef>
 #include <cstring>
+#include <fstream>
 #include <memory>
 #include <string>
 #include <tuple>
 #include <type_traits>
 #include <utility>
 #include <vector>
 
 using namespace clang;
if (const Arg *A = Args.getLastArg(OPT_Action_Group)) {
     Opts.ProgramAction = *ProgramAction;
   }
 
   if (const Arg* A = Args.getLastArg(OPT_plugin)) {
     Opts.Plugins.emplace_back(A->getValue(0));
     Opts.ProgramAction = frontend::PluginAction;
     Opts.ActionName = A->getValue();
   }
+
+  if (const Arg *A = Args.getLastArg(OPT_frandstruct_seed_filename_EQ)) {
+    std::ifstream SeedFile(A->getValue(0));
+
+    if (!SeedFile.is_open())
+      Diags.Report(diag::err_drv_cannot_open_randstruct_seed_filename)
+          << A->getValue(0);
+
+    std::getline(SeedFile, randstruct::SEED);
+  }
+
+  if (const Arg *A = Args.getLastArg(OPT_frandstruct_seed_EQ))
+    randstruct::SEED = A->getValue(0);
+
   for (const auto *AA : Args.filtered(OPT_plugin_arg))
     Opts.PluginArgs[AA->getValue(0)].emplace_back(AA->getValue(1));
 
   for (const std::string &Arg :
          Args.getAllArgValues(OPT_ftest_module_file_extension_EQ)) {
     std::string BlockName;
     unsigned MajorVersion;
     unsigned MinorVersion;

clang/lib/Parse/ParseDeclCXX.cpp

 //===--- ParseDeclCXX.cpp - C++ Declaration Parsing -------------*- C++ -*-===//
 //
 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
 // See https://llvm.org/LICENSE.txt for license information.
 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
 //
 //===----------------------------------------------------------------------===//
 //
 //  This file implements the C++ Declaration portions of the Parser interfaces.
 //
 //===----------------------------------------------------------------------===//
 
-#include "clang/Parse/Parser.h"
 #include "clang/AST/ASTContext.h"
 #include "clang/AST/DeclTemplate.h"
 #include "clang/AST/PrettyDeclStackTrace.h"
+#include "clang/AST/Randstruct.h"
 #include "clang/Basic/Attributes.h"
 #include "clang/Basic/CharInfo.h"
 #include "clang/Basic/OperatorKinds.h"
 #include "clang/Basic/TargetInfo.h"
 #include "clang/Parse/ParseDiagnostic.h"
+#include "clang/Parse/Parser.h"
 #include "clang/Parse/RAIIObjectsForParser.h"
 #include "clang/Sema/DeclSpec.h"
 #include "clang/Sema/ParsedTemplate.h"
 #include "clang/Sema/Scope.h"
 #include "llvm/ADT/SmallString.h"
 #include "llvm/Support/TimeProfiler.h"
 
 using namespace clang;
else {
           !Actions.ActOnDuplicateDefinition(DS, TagOrTempResult.get(),
                                             SkipBody)) {
         DS.SetTypeSpecError();
         return;
       }
     }
   }
 
-  if (!TagOrTempResult.isInvalid())
+  if (!TagOrTempResult.isInvalid()) {
     // Delayed processing of attributes.
     Actions.ProcessDeclAttributeDelayed(TagOrTempResult.get(), attrs);
 
+    RecordDecl *RD = TagOrTempResult.getAs<RecordDecl>();
+    if (randstruct::shouldRandomize(Actions.getASTContext(), RD)) {
+      SmallVector<Decl *, 64> FinalOrdering;
+      randstruct::randomizeStructureLayout(Actions.getASTContext(), RD,
+                                           FinalOrdering);
+      if (RD->isRandomized()) {
+        for (Decl *D : FinalOrdering)
+          RD->removeDecl(D);
+
+        for (Decl *D : FinalOrdering)
+          RD->addDecl(D);
+      }
+    }
+  }
+
   const char *PrevSpec = nullptr;
   unsigned DiagID;
   bool Result;
   if (!TypeResult.isInvalid()) {
     Result = DS.SetTypeSpecType(DeclSpec::TST_typename, StartLoc,
                                 NameLoc.isValid() ? NameLoc : StartLoc,
                                 PrevSpec, DiagID, TypeResult.get(), Policy);
   } else if (!TagOrTempResult.isInvalid()) {

clang/lib/Sema/AnalysisBasedWarnings.cpp

 
 #include "clang/Sema/AnalysisBasedWarnings.h"
 #include "clang/AST/DeclCXX.h"
 #include "clang/AST/DeclObjC.h"
 #include "clang/AST/EvaluatedExprVisitor.h"
 #include "clang/AST/ExprCXX.h"
 #include "clang/AST/ExprObjC.h"
 #include "clang/AST/ParentMap.h"
+#include "clang/AST/Randstruct.h"
 #include "clang/AST/RecursiveASTVisitor.h"
 #include "clang/AST/StmtCXX.h"
 #include "clang/AST/StmtObjC.h"
 #include "clang/AST/StmtVisitor.h"
 #include "clang/Analysis/Analyses/CFGReachabilityAnalysis.h"
 #include "clang/Analysis/Analyses/CalledOnceCheck.h"
 #include "clang/Analysis/Analyses/Consumed.h"
 #include "clang/Analysis/Analyses/ReachableCode.h"
void warnUseInInvalidState(StringRef MethodName, StringRef VariableName,
     Warnings.emplace_back(std::move(Warning), OptionalNotes());
   }
 };
 } // anonymous namespace
 } // namespace consumed
 } // namespace clang
 
 //===----------------------------------------------------------------------===//
+// Checking for bad casts from randomize structs
+//===----------------------------------------------------------------------===//
+
+namespace clang {
+namespace randstruct {
+namespace {
+class BadCastsASTWalk : public RecursiveASTVisitor<BadCastsASTWalk> {
+  Sema &S;
+
+public:
+  BadCastsASTWalk(Sema &S) : S(S){};
+
+  bool VisitCastExpr(const CastExpr *E) {
+    if (E->getCastKind() != CK_BitCast)
+      return true;
+
+    if (const auto *SubExpr = dyn_cast<ImplicitCastExpr>(E->getSubExpr())) {
+      CanQualType ExprTy = S.Context.getCanonicalType(E->getType());
+      CanQualType SubExprTy = S.Context.getCanonicalType(SubExpr->getType());
+
+      if (isa<PointerType>(ExprTy) && isa<PointerType>(SubExprTy)) {
+        const QualType CastTy = cast<PointerType>(ExprTy)->getPointeeType();
+        const QualType BaseTy = cast<PointerType>(SubExprTy)->getPointeeType();
+
+        const RecordDecl *CastRD = CastTy->getAsRecordDecl();
+        const RecordDecl *BaseRD = BaseTy->getAsRecordDecl();
+
+        if (CastRD && BaseRD && CastRD != BaseRD && BaseRD->isRandomized())
+          // The struct we are casting the pointer from was randomized.
+          S.Diag(E->getExprLoc(), diag::cast_from_randomized_struct)
+              << SubExprTy << ExprTy;
+      }
+    }
+
+    return true;
+  }
+};
+
+void checkForBadCasts(Sema &S, AnalysisDeclContext &AC) {
+  BadCastsASTWalk walker(S);
+  walker.TraverseStmt(AC.getBody());
+}
+} // anonymous namespace
+} // namespace randstruct
+} // namespace clang
+
+//===----------------------------------------------------------------------===//
 // AnalysisBasedWarnings - Worker object used by Sema to execute analysis-based
 //  warnings on a function, method, or block.
 //===----------------------------------------------------------------------===//
 
 sema::AnalysisBasedWarnings::Policy::Policy() {
   enableCheckFallThrough = 1;
   enableCheckUnreachable = 0;
   enableThreadSafetyAnalysis = 0;
if (CFG *cfg = AC.getCFG()) {
       // detail information about it.
       NumCFGBlocks += cfg->getNumBlockIDs();
       MaxCFGBlocksPerFunction = std::max(MaxCFGBlocksPerFunction,
                                          cfg->getNumBlockIDs());
     } else {
       ++NumFunctionsWithBadCFGs;
     }
   }
+
+  // FIXME: Any way to get a handle to a RecordDecl struct here?
+  clang::randstruct::checkForBadCasts(S, AC);
 }
 
 void clang::sema::AnalysisBasedWarnings::PrintStats() const {
   llvm::errs() << "\n*** Analysis Based Warnings Stats:\n";
 
   unsigned NumCFGsBuilt = NumFunctionsAnalyzed - NumFunctionsWithBadCFGs;
   unsigned AvgCFGBlocksPerFunction =
       !NumCFGsBuilt ? 0 : NumCFGBlocks/NumCFGsBuilt;

clang/lib/Sema/SemaDecl.cpp

 #include "clang/AST/CommentDiagnostic.h"
 #include "clang/AST/DeclCXX.h"
 #include "clang/AST/DeclObjC.h"
 #include "clang/AST/DeclTemplate.h"
 #include "clang/AST/EvaluatedExprVisitor.h"
 #include "clang/AST/Expr.h"
 #include "clang/AST/ExprCXX.h"
 #include "clang/AST/NonTrivialTypeVisitor.h"
+#include "clang/AST/Randstruct.h"
 #include "clang/AST/StmtCXX.h"
 #include "clang/Basic/Builtins.h"
 #include "clang/Basic/PartialDiagnostic.h"
 #include "clang/Basic/SourceManager.h"
 #include "clang/Basic/TargetInfo.h"
 #include "clang/Lex/HeaderSearch.h" // TODO: Sema shouldn't depend on Lex
 #include "clang/Lex/Lexer.h" // TODO: Extract static functions to fix layering.
 #include "clang/Lex/ModuleLoader.h" // TODO: Sema shouldn't depend on Lex

clang/lib/Sema/SemaDeclAttr.cpp

case ParsedAttr::AT_Packed:
     handlePackedAttr(S, D, AL);
     break;
   case ParsedAttr::AT_PreferredName:
     handlePreferredName(S, D, AL);
     break;
   case ParsedAttr::AT_Section:
     handleSectionAttr(S, D, AL);
     break;
+  case ParsedAttr::AT_RandomizeLayout:
+    handleSimpleAttribute<RandomizeLayoutAttr>(S, D, AL);
+    break;
+  case ParsedAttr::AT_NoRandomizeLayout:
+    // Drop the "randomize_layout" attribute if it's on the decl.
+    D->dropAttr<RandomizeLayoutAttr>();
+    break;
   case ParsedAttr::AT_CodeSeg:
     handleCodeSegAttr(S, D, AL);
     break;
   case ParsedAttr::AT_Target:
     handleTargetAttr(S, D, AL);
     break;
   case ParsedAttr::AT_TargetClones:
     handleTargetClonesAttr(S, D, AL);

clang/test/Misc/pragma-attribute-supported-attributes-list.test

 // CHECK-NEXT: NoDuplicate (SubjectMatchRule_function)
 // CHECK-NEXT: NoEscape (SubjectMatchRule_variable_is_parameter)
 // CHECK-NEXT: NoInline (SubjectMatchRule_function)
 // CHECK-NEXT: NoInstrumentFunction (SubjectMatchRule_function, SubjectMatchRule_objc_method)
 // CHECK-NEXT: NoMerge (SubjectMatchRule_function)
 // CHECK-NEXT: NoMicroMips (SubjectMatchRule_function)
 // CHECK-NEXT: NoMips16 (SubjectMatchRule_function)
 // CHECK-NEXT: NoProfileFunction (SubjectMatchRule_function)
+// CHECK-NEXT: NoRandomizeLayout (SubjectMatchRule_record)
 // CHECK-NEXT: NoSanitize (SubjectMatchRule_function, SubjectMatchRule_objc_method, SubjectMatchRule_variable_is_global)
 // CHECK-NEXT: NoSanitizeSpecific (SubjectMatchRule_function, SubjectMatchRule_variable_is_global)
 // CHECK-NEXT: NoSpeculativeLoadHardening (SubjectMatchRule_function, SubjectMatchRule_objc_method)
 // CHECK-NEXT: NoSplitStack (SubjectMatchRule_function)
 // CHECK-NEXT: NoStackProtector (SubjectMatchRule_function)
 // CHECK-NEXT: NoThreadSafetyAnalysis (SubjectMatchRule_function)
 // CHECK-NEXT: NoThrow (SubjectMatchRule_hasType_functionType)
 // CHECK-NEXT: NotTailCalled (SubjectMatchRule_function)

 // CHECK-NEXT: OpenCLNoSVM (SubjectMatchRule_variable)
 // CHECK-NEXT: OptimizeNone (SubjectMatchRule_function, SubjectMatchRule_objc_method)
 // CHECK-NEXT: Overloadable (SubjectMatchRule_function)
 // CHECK-NEXT: Owner (SubjectMatchRule_record_not_is_union)
 // CHECK-NEXT: ParamTypestate (SubjectMatchRule_variable_is_parameter)
 // CHECK-NEXT: PassObjectSize (SubjectMatchRule_variable_is_parameter)
 // CHECK-NEXT: PatchableFunctionEntry (SubjectMatchRule_function, SubjectMatchRule_objc_method)
 // CHECK-NEXT: Pointer (SubjectMatchRule_record_not_is_union)
+// CHECK-NEXT: RandomizeLayout (SubjectMatchRule_record)
 // CHECK-NEXT: ReleaseHandle (SubjectMatchRule_variable_is_parameter)
 // CHECK-NEXT: RenderScriptKernel (SubjectMatchRule_function)
 // CHECK-NEXT: ReqdWorkGroupSize (SubjectMatchRule_function)
 // CHECK-NEXT: Restrict (SubjectMatchRule_function)
 // CHECK-NEXT: ReturnTypestate (SubjectMatchRule_function, SubjectMatchRule_variable_is_parameter)
 // CHECK-NEXT: ReturnsNonNull (SubjectMatchRule_objc_method, SubjectMatchRule_function)
 // CHECK-NEXT: ReturnsTwice (SubjectMatchRule_function)
 // CHECK-NEXT: SYCLSpecialClass (SubjectMatchRule_record)

clang/unittests/AST/CMakeLists.txt

add_clang_unittest(ASTTests
   CommentParser.cpp
   CommentTextTest.cpp
   DataCollectionTest.cpp
   DeclPrinterTest.cpp
   DeclTest.cpp
   EvaluateAsRValueTest.cpp
   ExternalASTSourceTest.cpp
   NamedDeclPrinterTest.cpp
+  RandstructTest.cpp
   RecursiveASTVisitorTest.cpp
   SizelessTypesTest.cpp
   SourceLocationTest.cpp
   StmtPrinterTest.cpp
   StructuralEquivalenceTest.cpp
   TypePrinterTest.cpp
   )
 

clang/unittests/AST/RandstructTest.cpp

+//===- unittest/AST/RandstructTest.cpp ------------------------------------===//
+//
+// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
+// See https://llvm.org/LICENSE.txt for license information.
+// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
+//
+//===----------------------------------------------------------------------===//
+//
+// This file contains tests for Clang's structure field layout randomization.
+//
+//===----------------------------------------------------------------------===//
+
+/*
+ * Build this test suite by running `make ASTTests` in the build folder.
+ *
+ * Run this test suite by running the following in the build folder:
+ * ` ./tools/clang/unittests/AST/ASTTests
+ * --gtest_filter=StructureLayoutRandomization*`
+ */
+
+#include "clang/AST/Randstruct.h"
+#include "gtest/gtest.h"
+
+#include "DeclMatcher.h"
+#include "clang/AST/RecordLayout.h"
+#include "clang/ASTMatchers/ASTMatchers.h"
+#include "clang/Frontend/ASTUnit.h"
+#include "clang/Testing/CommandLineArgs.h"
+#include "clang/Tooling/Tooling.h"
+
+#include <vector>
+
+using namespace clang;
+using namespace clang::ast_matchers;
+using namespace clang::randstruct;
+
+using field_names = std::vector<std::string>;
+
+namespace {
+
+std::unique_ptr<ASTUnit> makeAST(const std::string &SourceCode) {
+  std::vector<std::string> Args = getCommandLineArgsForTesting(Lang_C99);
+  Args.push_back("-frandstruct-seed=1234567890abcdef");
+  return tooling::buildASTFromCodeWithArgs(SourceCode, Args, "input.cc");
+}
+
+RecordDecl *getRecordDeclFromAST(const ASTContext &C, const std::string &Name) {
+  return FirstDeclMatcher<RecordDecl>().match(C.getTranslationUnitDecl(),
+                                              recordDecl(hasName(Name)));
+}
+
+std::vector<std::string> getFieldNamesFromRecord(const RecordDecl *RD) {
+  std::vector<std::string> Fields;
+
+  Fields.reserve(8);
+  for (auto *Field : RD->fields())
+    Fields.push_back(Field->getNameAsString());
+
+  return Fields;
+}
+
+bool isSubsequence(const field_names &Seq, const field_names &Subseq) {
+  unsigned SeqLen = Seq.size();
+  unsigned SubLen = Subseq.size();
+
+  bool IsSubseq = false;
+  for (unsigned I = 0; I < SeqLen; ++I)
+    if (Seq[I] == Subseq[0]) {
+      IsSubseq = true;
+      for (unsigned J = 0; J + I < SeqLen && J < SubLen; ++J) {
+        if (Seq[J + I] != Subseq[J]) {
+          IsSubseq = false;
+          break;
+        }
+      }
+    }
+
+  return IsSubseq;
+}
+
+} // end anonymous namespace
+
+namespace clang {
+namespace ast_matchers {
+
+#define RANDSTRUCT_TEST_SUITE_TEST StructureLayoutRandomizationTestSuiteTest
+
+TEST(RANDSTRUCT_TEST_SUITE_TEST, CanDetermineIfSubsequenceExists) {
+  const field_names Seq = {"a", "b", "c", "d"};
+
+  ASSERT_TRUE(isSubsequence(Seq, {"b", "c"}));
+  ASSERT_TRUE(isSubsequence(Seq, {"a", "b", "c", "d"}));
+  ASSERT_TRUE(isSubsequence(Seq, {"b", "c", "d"}));
+  ASSERT_TRUE(isSubsequence(Seq, {"a"}));
+  ASSERT_FALSE(isSubsequence(Seq, {"a", "d"}));
+}
+
+#define RANDSTRUCT_TEST StructureLayoutRandomization
+
+TEST(RANDSTRUCT_TEST, UnmarkedStruct) {
+  const std::unique_ptr<ASTUnit> AST = makeAST(R"c(
+    struct test {
+        int bacon;
+        long lettuce;
+        long long tomato;
+        float mayonnaise;
+    };
+  )c");
+
+  const RecordDecl *RD = getRecordDeclFromAST(AST->getASTContext(), "test");
+  const field_names Expected = {"bacon", "lettuce", "tomato", "mayonnaise"};
+
+  ASSERT_FALSE(RD->getAttr<RandomizeLayoutAttr>());
+  ASSERT_FALSE(RD->isRandomized());
+  ASSERT_EQ(Expected, getFieldNamesFromRecord(RD));
+}
+
+TEST(RANDSTRUCT_TEST, MarkedNoRandomize) {
+  const std::unique_ptr<ASTUnit> AST = makeAST(R"c(
+    struct test {
+        int bacon;
+        long lettuce;
+        long long tomato;
+        float mayonnaise;
+    } __attribute__((no_randomize_layout));
+  )c");
+
+  const RecordDecl *RD = getRecordDeclFromAST(AST->getASTContext(), "test");
+  const field_names Expected = {"bacon", "lettuce", "tomato", "mayonnaise"};
+
+  ASSERT_FALSE(RD->getAttr<RandomizeLayoutAttr>());
+  ASSERT_EQ(Expected, getFieldNamesFromRecord(RD));
+}
+
+TEST(RANDSTRUCT_TEST, MarkedRandomize) {
+  const std::unique_ptr<ASTUnit> AST = makeAST(R"c(
+    struct test {
+        int bacon;
+        long lettuce;
+        long long tomato;
+        float mayonnaise;
+    } __attribute__((randomize_layout));
+  )c");
+
+  const RecordDecl *RD = getRecordDeclFromAST(AST->getASTContext(), "test");
+  const field_names Expected = {"mayonnaise", "bacon", "tomato", "lettuce"};
+
+  ASSERT_TRUE(RD->getAttr<RandomizeLayoutAttr>());
+  ASSERT_TRUE(RD->isRandomized());
+  ASSERT_EQ(Expected, getFieldNamesFromRecord(RD));
+}
+
+TEST(RANDSTRUCT_TEST, MultipleAttrsNoRandomize) {
+  const std::unique_ptr<ASTUnit> AST = makeAST(R"c(
+    struct test {
+        int bacon;
+        long lettuce;
+        long long tomato;
+        float mayonnaise;
+    } __attribute__((randomize_layout)) __attribute__((no_randomize_layout));
+  )c");
+
+  const RecordDecl *RD = getRecordDeclFromAST(AST->getASTContext(), "test");
+  const field_names Expected = {"bacon", "lettuce", "tomato", "mayonnaise"};
+
+  ASSERT_FALSE(RD->getAttr<RandomizeLayoutAttr>());
+  ASSERT_EQ(Expected, getFieldNamesFromRecord(RD));
+}
+
+TEST(RANDSTRUCT_TEST, MultipleAttrsRandomize) {
+  const std::unique_ptr<ASTUnit> AST = makeAST(R"c(
+    struct test {
+        int bacon;
+        long lettuce;
+        long long tomato;
+        float mayonnaise;
+    } __attribute__((no_randomize_layout)) __attribute__((randomize_layout));
+  )c");
+
+  const RecordDecl *RD = getRecordDeclFromAST(AST->getASTContext(), "test");
+  const field_names Expected = {"mayonnaise", "bacon", "tomato", "lettuce"};
+
+  ASSERT_TRUE(RD->getAttr<RandomizeLayoutAttr>());
+  ASSERT_EQ(Expected, getFieldNamesFromRecord(RD));
+}
+
+// FIXME: Clang trips an assertion in the DiagnosticsEngine when the warning is
+// emitted while running under the test suite:
+// clang/lib/Frontend/TextDiagnosticPrinter.cpp:150: virtual void
+// clang::TextDiagnosticPrinter::HandleDiagnostic(clang::DiagnosticsEngine::Level,
+// const clang::Diagnostic&): Assertion `TextDiag && "UnExpected diagnostic
+// outside source file processing"' failed.
+//
+// Although the test *technically* is marked as pass; outside of the test suite
+// this functionality works and no assertion is tripped.
+TEST(
+    RANDSTRUCT_TEST,
+    DISABLED_EmitWarningWhenStructureIsMarkedWithBothRandomizeAndNoRandomizeAttributes) {
+  const std::unique_ptr<ASTUnit> AST = makeAST(R"c(
+    struct test_struct {
+        int a;
+        int b;
+        int c;
+    } __attribute__((no_randomize_layout)) __attribute__((randomize_layout));
+  )c");
+
+  ASSERT_EQ(AST->getASTContext().getDiagnostics().getNumWarnings(), 1UL);
+}
+
+// End of FIXME regarding DiagnosticsEngine assertion tests.
+
+TEST(RANDSTRUCT_TEST, CheckAdjacentBitfieldsRemainAdjacentAfterRandomization) {
+  const std::unique_ptr<ASTUnit> AST = makeAST(R"c(
+    struct test {
+        int a;
+        int b;
+        int x : 1;
+        int y : 1;
+        int z : 1;
+        int c;
+    } __attribute__((randomize_layout));
+  )c");
+
+  const RecordDecl *RD = getRecordDeclFromAST(AST->getASTContext(), "test");
+
+  const field_names Expected = {"c", "x", "y", "z", "b", "a"};
+  const field_names Subseq = {"x", "y", "z"};
+  const field_names Actual = getFieldNamesFromRecord(RD);
+
+  ASSERT_TRUE(isSubsequence(Actual, Subseq));
+  ASSERT_EQ(Expected, Actual);
+}
+
+TEST(RANDSTRUCT_TEST, CheckVariableLengthArrayMemberRemainsAtEndOfStructure) {
+  const std::unique_ptr<ASTUnit> AST = makeAST(R"c(
+    struct test {
+        int a;
+        double b;
+        short c;
+        char name[];
+    } __attribute__((randomize_layout));
+  )c");
+
+  const RecordDecl *RD = getRecordDeclFromAST(AST->getASTContext(), "test");
+  const field_names Expected = {"b", "c", "a", "name"};
+
+  ASSERT_EQ(Expected, getFieldNamesFromRecord(RD));
+}
+
+TEST(RANDSTRUCT_TEST, RandstructDoesNotOverrideThePackedAttr) {
+  const std::unique_ptr<ASTUnit> AST = makeAST(R"c(
+    struct test_struct {
+        char a;
+        float b[3];
+        short c;
+        int d;
+    } __attribute__((packed, randomize_layout));
+
+    struct another_struct {
+        char a;
+        char b[5];
+        int c;
+    } __attribute__((packed, randomize_layout));
+
+    struct last_struct {
+        char a;
+        long long b;
+        int c[];
+    } __attribute__((packed, randomize_layout));
+  )c");
+
+  // FIXME (?): calling getASTRecordLayout is probably a necessary evil so that
+  // Clang's RecordBuilders can actually flesh out the information like
+  // alignment, etc.
+  {
+    const RecordDecl *RD =
+        getRecordDeclFromAST(AST->getASTContext(), "test_struct");
+    const ASTRecordLayout *Layout =
+        &AST->getASTContext().getASTRecordLayout(RD);
+    const field_names Expected = {"c", "a", "d", "b"};
+
+    ASSERT_EQ(19, Layout->getSize().getQuantity());
+    ASSERT_EQ(Expected, getFieldNamesFromRecord(RD));
+  }
+
+  {
+    const RecordDecl *RD =
+        getRecordDeclFromAST(AST->getASTContext(), "another_struct");
+    const ASTRecordLayout *Layout =
+        &AST->getASTContext().getASTRecordLayout(RD);
+    const field_names Expected = {"c", "a", "b"};
+
+    ASSERT_EQ(10, Layout->getSize().getQuantity());
+    ASSERT_EQ(Expected, getFieldNamesFromRecord(RD));
+  }
+
+  {
+    const RecordDecl *RD =
+        getRecordDeclFromAST(AST->getASTContext(), "last_struct");
+    const ASTRecordLayout *Layout =
+        &AST->getASTContext().getASTRecordLayout(RD);
+    const field_names Expected = {"b", "a", "c"};
+
+    ASSERT_EQ(9, Layout->getSize().getQuantity());
+    ASSERT_EQ(Expected, getFieldNamesFromRecord(RD));
+  }
+}
+
+TEST(RANDSTRUCT_TEST, ZeroWidthBitfieldsSeparateAllocationUnits) {
+  const std::unique_ptr<ASTUnit> AST = makeAST(R"c(
+    struct test_struct {
+        int a : 1;
+        int   : 0;
+        int b : 1;
+    } __attribute__((randomize_layout));
+  )c");
+
+  const RecordDecl *RD =
+      getRecordDeclFromAST(AST->getASTContext(), "test_struct");
+  const field_names Expected = {"", "a", "b"};
+
+  ASSERT_EQ(Expected, getFieldNamesFromRecord(RD));
+}
+
+TEST(RANDSTRUCT_TEST, RandstructDoesNotRandomizeUnionFieldOrder) {
+  const std::unique_ptr<ASTUnit> AST = makeAST(R"c(
+    union test_union {
+        int a;
+        int b;
+        int c;
+        int d;
+        int e;
+        int f;
+    } __attribute__((randomize_layout));
+  )c");
+
+  const RecordDecl *RD =
+      getRecordDeclFromAST(AST->getASTContext(), "test_union");
+  const field_names Expected = {"a", "b", "c", "d", "e", "f"};
+
+  ASSERT_FALSE(shouldRandomize(AST->getASTContext(), RD));
+  ASSERT_EQ(Expected, getFieldNamesFromRecord(RD));
+}
+
+TEST(RANDSTRUCT_TEST, AnonymousStructsAndUnionsRetainFieldOrder) {
+  const std::unique_ptr<ASTUnit> AST = makeAST(R"c(
+    struct test_struct {
+        int a;
+        struct sub_struct {
+            int b;
+            int c;
+            int d;
+            int e;
+            int f;
+        } __attribute__((randomize_layout)) s;
+        int f;
+        struct {
+            int g;
+            int h;
+            int i;
+            int j;
+            int k;
+        };
+        int l;
+        union {
+            int m;
+            int n;
+            int o;
+            int p;
+            int q;
+        };
+        int r;
+    } __attribute__((randomize_layout));
+  )c");
+
+  const RecordDecl *RD =
+      getRecordDeclFromAST(AST->getASTContext(), "test_struct");
+  const field_names Expected = {"f", "a", "l", "", "", "s", "r"};
+
+  ASSERT_EQ(Expected, getFieldNamesFromRecord(RD));
+
+  bool AnonStructTested = false;
+  bool AnonUnionTested = false;
+  for (const Decl *D : RD->decls())
+    if (const RecordDecl *SubRD = dyn_cast<RecordDecl>(D)) {
+      if (SubRD->isAnonymousStructOrUnion()) {
+        if (SubRD->isUnion()) {
+          const field_names Expected = {"m", "n", "o", "p", "q"};
+
+          ASSERT_EQ(Expected, getFieldNamesFromRecord(SubRD));
+          AnonUnionTested = true;
+        } else {
+          const field_names Expected = {"g", "h", "i", "j", "k"};
+
+          ASSERT_EQ(Expected, getFieldNamesFromRecord(SubRD));
+          AnonStructTested = true;
+        }
+      } else if (SubRD->isStruct()) {
+        const field_names Expected = {"d", "e", "f", "c", "b"};
+        ASSERT_EQ(Expected, getFieldNamesFromRecord(SubRD));
+      }
+    }
+
+  ASSERT_TRUE(AnonStructTested);
+  ASSERT_TRUE(AnonUnionTested);
+}
+
+} // namespace ast_matchers
+} // namespace clang