Remove 'no_sanitize_memtag'. Add 'sanitize_memtag'.

[hctim]

Summary

For MTE globals, we should have clang emit the attribute for all GV's
that it creates, and then use that in the upcoming AArch64 global
tagging IR pass. We need a positive attribute for this sanitizer (rather
than implicit sanitization of all globals) because it needs to interact
with other parts of LLVM, including:

1. Suppressing certain global optimisations (like merging),
2. Emitting extra directives by the ASM writer, and
3. Putting extra information in the symbol table entries.

While this does technically make the LLVM IR / bitcode format
non-backwards-compatible, nobody should have used this attribute yet,
because it's a no-op.

[hctim]

(friendly ping @eugenis)

[eugenis]

llvm/include/llvm/IR/GlobalValue.h

322

This paragraph explains why we need the include bit, but not the exclude bit.
Why do we need both?
IR backward compatibility?

llvm/test/Assembler/globalvariable-attributes.ll

11

can we ban both attrs on the same global?

[hctim]

llvm/include/llvm/IR/GlobalValue.h

322

no_sanitize_memtag is added by the clang frontend and is used to ignore instrumentation in the upcoming IR pass.

sanitize_memtag is to be added by the IR pass, and is used to make the asm writers / elf object writers add add necessary metadata.

Updated the comments to be a little more clear about this.

llvm/test/Assembler/globalvariable-attributes.ll

11

See Vitaly's comment at https://reviews.llvm.org/D126100?id=434618#inline-1218941

Given that no_sanitize_memtag always overrides (see GlobalValue::isTagged(), which should always be used to check for sanitization), I think it's better to keep the IR reader/writer dumb to the actual semantics.

[hctim]

Small update to comment.

[hctim]

After talking with Evgenii offline, and testing, clearly we don't need an exclude mask. Update the patch to remove the exclude mask, and replace it with an include mask.

[eugenis]

LGTM

llvm/include/llvm/IR/GlobalValue.h

349

return hasSanitizerMetadata() && getSanitizerMetadata().Memtag

[hctim]

Final comments.

clang/lib/CodeGen/SanitizerMetadata.cpp

void SanitizerMetadata::reportGlobal(llvm::GlobalVariable *GV,
   Meta.NoAddress |= NoSanitizeAttrSet.hasOneOf(SanitizerKind::Address);
   Meta.NoAddress |= CGM.isInNoSanitizeList(
       FsanitizeArgument.Mask & SanitizerKind::Address, GV, Loc, Ty);
 
   Meta.NoHWAddress |= NoSanitizeAttrSet.hasOneOf(SanitizerKind::HWAddress);
   Meta.NoHWAddress |= CGM.isInNoSanitizeList(
       FsanitizeArgument.Mask & SanitizerKind::HWAddress, GV, Loc, Ty);
 
-  Meta.NoMemtag |= NoSanitizeAttrSet.hasOneOf(SanitizerKind::MemTag);
-  Meta.NoMemtag |= CGM.isInNoSanitizeList(
+  Meta.Memtag |=
+      static_cast<bool>(FsanitizeArgument.Mask & SanitizerKind::MemtagGlobals);
+  Meta.Memtag &= !NoSanitizeAttrSet.hasOneOf(SanitizerKind::MemTag);
+  Meta.Memtag &= !CGM.isInNoSanitizeList(
       FsanitizeArgument.Mask & SanitizerKind::MemTag, GV, Loc, Ty);
 
   Meta.IsDynInit = IsDynInit && !Meta.NoAddress &&
                    FsanitizeArgument.has(SanitizerKind::Address) &&
                    !CGM.isInNoSanitizeList(SanitizerKind::Address |
                                                SanitizerKind::KernelAddress,
                                            GV, Loc, Ty, "init");
 

clang/test/CodeGen/memtag-globals.cpp

 int __attribute__((disable_sanitizer_instrumentation)) disable_instrumentation_global;
 int ignorelisted_global;
 
 void func() {
   static int static_var = 0;
   const char *literal = "Hello, world!";
 }
 
-// CHECK: @{{.*}}extra_global{{.*}} =
-// CHECK-NOT: no_sanitize_memtag
-// CHECK: @{{.*}}global{{.*}} =
-// CHECK-NOT: no_sanitize_memtag
-// CHECK: @{{.*}}attributed_global{{.*}} ={{.*}} global {{.*}}, no_sanitize_memtag
-// CHECK: @{{.*}}disable_instrumentation_global{{.*}} ={{.*}} global {{.*}}, no_sanitize_memtag
-// CHECK: @{{.*}}ignorelisted_global{{.*}} ={{.*}} global {{.*}}, no_sanitize_memtag
-// CHECK: @{{.*}}static_var{{.*}} =
-// CHECK-NOT: no_sanitize_memtag
-// CHECK: @{{.*}} = {{.*}} c"Hello, world!\00"
-// CHECK-NOT: no_sanitize_memtag
-
-// IGNORELIST: @{{.*}}extra_global{{.*}} ={{.*}} global
-// IGNORELIST-NOT: no_sanitize_memtag
-// IGNORELIST: @{{.*}}global{{.*}} ={{.*}} global {{.*}}, no_sanitize_memtag
-// IGNORELIST: @{{.*}}attributed_global{{.*}} ={{.*}} global {{.*}}, no_sanitize_memtag
-// IGNORELIST: @{{.*}}disable_instrumentation_global{{.*}} ={{.*}} global {{.*}}, no_sanitize_memtag
-// IGNORELIST: @{{.*}}ignorelisted_globa{{.*}} ={{.*}} global {{.*}}, no_sanitize_memtag
-// IGNORELIST: @{{.*}}static_var{{.*}} ={{.*}} global {{.*}}, no_sanitize_memtag
-// IGNORELIST: @{{.*}} = {{.*}} c"Hello, world!\00"{{.*}}, no_sanitize_memtag
+// CHECK: @{{.*}}extra_global{{.*}} ={{.*}} sanitize_memtag
+// CHECK: @{{.*}}global{{.*}} ={{.*}} sanitize_memtag
+
+// CHECK:     @{{.*}}attributed_global{{.*}} =
+// CHECK-NOT: sanitize_memtag
+// CHECK:     @{{.*}}disable_instrumentation_global{{.*}} =
+// CHECK-NOT: sanitize_memtag
+// CHECK:     @{{.*}}ignorelisted_global{{.*}} =
+// CHECK-NOT: sanitize_memtag
+
+// CHECK: @{{.*}}static_var{{.*}} ={{.*}} sanitize_memtag
+// CHECK: @{{.*}} = {{.*}} c"Hello, world!\00"{{.*}} sanitize_memtag
+
+// IGNORELIST: @{{.*}}extra_global{{.*}} ={{.*}} sanitize_memtag
+
+// IGNORELIST:     @{{.*}}global{{.*}} =
+// IGNORELIST-NOT: sanitize_memtag
+// IGNORELIST:     @{{.*}}attributed_global{{.*}} =
+// IGNORELIST-NOT: sanitize_memtag
+// IGNORELIST:     @{{.*}}disable_instrumentation_global{{.*}} =
+// IGNORELIST-NOT: sanitize_memtag
+// IGNORELIST:     @{{.*}}ignorelisted_globa{{.*}} =
+// IGNORELIST-NOT: sanitize_memtag
+// IGNORELIST:     @{{.*}}static_var{{.*}} =
+// IGNORELIST-NOT: sanitize_memtag
+// IGNORELIST:     @{{.*}} = {{.*}} c"Hello, world!\00"{{.*}}
+// IGNORELIST-NOT: sanitize_memtag

clang/test/CodeGen/sanitizer-special-case-list-globals.c

 /// Note: HWASan effectively reorders globals (it puts the unsanitized ones
 /// first), which is hard to check for, as 'CHECK-DAG' doesn't play terribly
 /// nicely with 'CHECK-NOT'. This is why the 'always_ignored' and
 /// 'hwasan_ignored' comes first in this file.
 // RUN: %clang_cc1 -fsanitize=hwaddress -emit-llvm %s -o -\
 // RUN: -fsanitize-ignorelist=%S/Inputs/sanitizer-special-case-list-globals.txt \
 // RUN: | FileCheck %s --check-prefix=HWASAN
 
-/// TODO(hctim): Move over to memtag-globals when it's implemented. For now
-/// though, it's fine, the frontend still annotates based on any memtag sanitizer
-/// being used.
-// RUN: %clang_cc1 -fsanitize=memtag-heap -triple=aarch64-linux-android31 -emit-llvm %s -o -\
+// RUN: %clang_cc1 -fsanitize=memtag-globals -triple=aarch64-linux-android31 \
 // RUN: -fsanitize-ignorelist=%S/Inputs/sanitizer-special-case-list-globals.txt \
-// RUN: | FileCheck %s --check-prefix=MEMTAG
+// RUN: -emit-llvm %s -o - | FileCheck %s --check-prefix=MEMTAG
 
 /// Check that the '[cfi-vcall|cfi-icall] src:*' rule in the ignorelist doesn't change
 /// anything for ASan.
 // RUN: %clang_cc1 -fsanitize=address -emit-llvm %s -o -\
 // RUN: -fsanitize-ignorelist=%S/Inputs/sanitizer-special-case-list-globals.txt \
 // RUN: | FileCheck %s --check-prefix=ASAN
 
 /// Check that -fsanitize=kernel-address picks up the '[address]' groups.
 // RUN: %clang_cc1 -fsanitize=kernel-address -mllvm -hwasan-kernel=1 -emit-llvm %s -o -\
 // RUN: -fsanitize-ignorelist=%S/Inputs/sanitizer-special-case-list-globals.txt \
 // RUN: | FileCheck %s --check-prefix=ASAN
 
 /// KHWASan doesn't instrument global variables.
 // RUN: %clang_cc1 -fsanitize=kernel-hwaddress -mllvm -hwasan-kernel=1 -emit-llvm %s -o -\
 // RUN: -fsanitize-ignorelist=%S/Inputs/sanitizer-special-case-list-globals.txt \
 // RUN: | FileCheck %s --check-prefix=NONE
 
 /// Check that the '[cfi-vcall|cfi-icall] src:*' rule doesnt' emit anything for
 /// GVs.
 // RUN: %clang_cc1 -fsanitize=cfi-vcall,cfi-icall -emit-llvm %s -o -\
 // RUN: -fsanitize-ignorelist=%S/Inputs/sanitizer-special-case-list-globals.txt \
 // RUN: | FileCheck %s --check-prefix=NONE
 
-// NONE:     @always_ignored ={{.*}} global
-// NONE-NOT: no_sanitize
-// ASAN:     @always_ignored ={{.*}} global {{.*}}, no_sanitize_address
-// HWASAN:   @always_ignored ={{.*}} global {{.*}}, no_sanitize_hwaddress
-// MEMTAG:   @always_ignored ={{.*}} global {{.*}}, no_sanitize_memtag
+// NONE:       @always_ignored ={{.*}} global
+// NONE-NOT:   no_sanitize
+// ASAN:       @always_ignored ={{.*}} global {{.*}}, no_sanitize_address
+// HWASAN:     @always_ignored ={{.*}} global {{.*}}, no_sanitize_hwaddress
+// MEMTAG:     @always_ignored ={{.*}} global
+// MEMTAG-NOT: sanitize_memtag
 unsigned always_ignored;
 
 // NONE:       @hwasan_ignored ={{.*}} global
 // NONE-NOT:   no_sanitize
 // ASAN:       @hwasan_ignored ={{.*}} global
 // ASAN-NOT:   no_sanitize_address
 // HWASAN:     @hwasan_ignored ={{.*}} global {{.*}}, no_sanitize_hwaddress
-// MEMTAG:     @hwasan_ignored ={{.*}} global
-// MEMTAG-NOT: no_sanitize_memtag
+// MEMTAG:     @hwasan_ignored ={{.*}} global {{.*}} sanitize_memtag
 unsigned hwasan_ignored;
 
 // NONE:       @asan_ignored ={{.*}} global
 // NONE-NOT:   asan_ignored
 // ASAN:       @asan_ignored ={{.*}} global {{.*}}, no_sanitize_address
 // HWASAN:     @asan_ignored.hwasan = {{.*}} global
 // HWASAN-NOT: no_sanitize_hwaddress
-// MEMTAG:     @asan_ignored ={{.*}} global
-// MEMTAG-NOT: no_sanitize_memtag
+// MEMTAG:     @asan_ignored ={{.*}} global {{.*}} sanitize_memtag
 unsigned asan_ignored;
 
 // NONE:       @memtag_ignored ={{.*}} global
 // NONE-NOT:   memtag_ignored
 // ASAN:       @memtag_ignored ={{.*}} global
 // ASAN-NOT:   no_sanitize_address
 // HWASAN:     @memtag_ignored.hwasan = {{.*}} global
 // HWASAN-NOT: no_sanitize_hwaddress
-// MEMTAG:     @memtag_ignored ={{.*}} global {{.*}}, no_sanitize_memtag
+// MEMTAG:     @memtag_ignored ={{.*}} global
+// MEMTAG-NOT: sanitize_memtag
 unsigned memtag_ignored;
 
 // NONE:       @never_ignored ={{.*}} global
 // NONE-NOT:   never_ignored
 // ASAN:       @never_ignored ={{.*}} global
 // ASAN-NOT:   no_sanitize_address
 // HWASAN:     @never_ignored.hwasan ={{.*}} global
 // HWASAN-NOT: no_sanitize_hwaddress
-// MEMTAG:     @never_ignored ={{.*}} global
-// MEMTAG-NOT: no_sanitize_memtag
+// MEMTAG:     @never_ignored ={{.*}} global {{.*}} sanitize_memtag
 unsigned never_ignored;

llvm/include/llvm/AsmParser/LLToken.h

#include "llvm/IR/Attributes.inc"
   kw_varFlags,
 
   // GV's with __attribute__((no_sanitize("address"))), or things in
   // -fsanitize-ignorelist when built with ASan.
   kw_no_sanitize_address,
   // GV's with __attribute__((no_sanitize("hwaddress"))), or things in
   // -fsanitize-ignorelist when built with HWASan.
   kw_no_sanitize_hwaddress,
-  // GV's with __attribute__((no_sanitize("memtag"))), or things in
-  // -fsanitize-ignorelist when built with memory tagging.
-  kw_no_sanitize_memtag,
   // GV's where the clang++ frontend (when ASan is used) notes that this is
   // dynamically initialized, and thus needs ODR detection.
   kw_sanitize_address_dyninit,
 
   // Unsigned Valued tokens (UIntVal).
   LabelID,    // 42:
   GlobalID,   // @42
   LocalVarID, // %42

llvm/include/llvm/IR/GlobalValue.h

public:
 
   bool hasPartition() const {
     return HasPartition;
   }
   StringRef getPartition() const;
   void setPartition(StringRef Part);
 
   // ASan, HWASan and Memtag sanitizers have some instrumentation that applies
-  // specifically to global variables. This instrumentation is implicitly
-  // applied to all global variables when built with -fsanitize=*. What we need
-  // is a way to persist the information that a certain global variable should
-  // *not* have sanitizers applied, which occurs if:
+  // specifically to global variables.
+  struct SanitizerMetadata {
+    SanitizerMetadata()
+        : NoAddress(false), NoHWAddress(false),
+          Memtag(false), IsDynInit(false) {}
+    // For ASan and HWASan, this instrumentation is implicitly applied to all
+    // global variables when built with -fsanitize=*. What we need is a way to
+    // persist the information that a certain global variable should *not* have
+    // sanitizers applied, which occurs if:
     //   1. The global variable is in the sanitizer ignore list, or
     //   2. The global variable is created by the sanitizers itself for internal
     //      usage, or
     //   3. The global variable has __attribute__((no_sanitize("..."))) or
     //      __attribute__((disable_sanitizer_instrumentation)).
     //
     // This is important, a some IR passes like GlobalMerge can delete global
-  // variables and replace them with new ones. If the old variables were marked
-  // to be unsanitized, then the new ones should also be.
-  struct SanitizerMetadata {
-    SanitizerMetadata()
-        : NoAddress(false), NoHWAddress(false), NoMemtag(false),
-          IsDynInit(false) {}
+    // variables and replace them with new ones. If the old variables were
+    // marked to be unsanitized, then the new ones should also be.
     unsigned NoAddress : 1;
     unsigned NoHWAddress : 1;
-    unsigned NoMemtag : 1;
+
+    // Memtag sanitization works differently: sanitization is requested by clang
+    // when `-fsanitize=memtag-globals` is provided, and the request can be
+    // denied (and the attribute removed) by the AArch64 global tagging pass if
+    // it can't be fulfilled (e.g. the global variable is a TLS variable).
+    // Memtag sanitization has to interact with other parts of LLVM (like
+    // supressing certain optimisations, emitting assembly directives, or
+    // creating special relocation sections).
+    //
+    // Use `GlobalValue::isTagged()` to check whether tagging should be enabled
+    // for a global variable.
+    unsigned Memtag : 1;
 
     // ASan-specific metadata. Is this global variable dynamically initialized
     // (from a C++ language perspective), and should therefore be checked for
     // ODR violations.
     unsigned IsDynInit : 1;
   };
 
   bool hasSanitizerMetadata() const { return HasSanitizerMetadata; }
   const SanitizerMetadata &getSanitizerMetadata() const;
   // Note: Not byref as it's a POD and otherwise it's too easy to call
   // G.setSanitizerMetadata(G2.getSanitizerMetadata()), and the argument becomes
   // dangling when the backing storage allocates the metadata for `G`, as the
   // storage is shared between `G1` and `G2`.
   void setSanitizerMetadata(SanitizerMetadata Meta);
   void removeSanitizerMetadata();
 
+  bool isTagged() const {
+    return hasSanitizerMetadata() && getSanitizerMetadata().Memtag;
+  }
+
   static LinkageTypes getLinkOnceLinkage(bool ODR) {
     return ODR ? LinkOnceODRLinkage : LinkOnceAnyLinkage;
   }
   static LinkageTypes getWeakLinkage(bool ODR) {
     return ODR ? WeakODRLinkage : WeakAnyLinkage;
   }
 
   static bool isExternalLinkage(LinkageTypes Linkage) {

llvm/lib/AsmParser/LLLexer.cpp

#define KEYWORD(STR)                                                           \
   KEYWORD(sideeffect);
   KEYWORD(inteldialect);
   KEYWORD(gc);
   KEYWORD(prefix);
   KEYWORD(prologue);
 
   KEYWORD(no_sanitize_address);
   KEYWORD(no_sanitize_hwaddress);
-  KEYWORD(no_sanitize_memtag);
   KEYWORD(sanitize_address_dyninit);
 
   KEYWORD(ccc);
   KEYWORD(fastcc);
   KEYWORD(coldcc);
   KEYWORD(cfguard_checkcc);
   KEYWORD(x86_stdcallcc);
   KEYWORD(x86_fastcallcc);

llvm/lib/AsmParser/LLParser.cpp

bool LLParser::parseAliasOrIFunc(const std::string &Name, LocTy NameLoc,
 
   return false;
 }
 
 static bool isSanitizer(lltok::Kind Kind) {
   switch (Kind) {
   case lltok::kw_no_sanitize_address:
   case lltok::kw_no_sanitize_hwaddress:
-  case lltok::kw_no_sanitize_memtag:
+  case lltok::kw_sanitize_memtag:
   case lltok::kw_sanitize_address_dyninit:
     return true;
   default:
     return false;
   }
 }
 
 bool LLParser::parseSanitizer(GlobalVariable *GV) {
   using SanitizerMetadata = GlobalValue::SanitizerMetadata;
   SanitizerMetadata Meta;
   if (GV->hasSanitizerMetadata())
     Meta = GV->getSanitizerMetadata();
 
   switch (Lex.getKind()) {
   case lltok::kw_no_sanitize_address:
     Meta.NoAddress = true;
     break;
   case lltok::kw_no_sanitize_hwaddress:
     Meta.NoHWAddress = true;
     break;
-  case lltok::kw_no_sanitize_memtag:
-    Meta.NoMemtag = true;
+  case lltok::kw_sanitize_memtag:
+    Meta.Memtag = true;
     break;
   case lltok::kw_sanitize_address_dyninit:
     Meta.IsDynInit = true;
     break;
   default:
     return tokError("non-sanitizer token passed to LLParser::parseSanitizer()");
   }
   GV->setSanitizerMetadata(Meta);

llvm/lib/Bitcode/Reader/BitcodeReader.cpp

 
 GlobalValue::SanitizerMetadata deserializeSanitizerMetadata(unsigned V) {
   GlobalValue::SanitizerMetadata Meta;
   if (V & (1 << 0))
     Meta.NoAddress = true;
   if (V & (1 << 1))
     Meta.NoHWAddress = true;
   if (V & (1 << 2))
-    Meta.NoMemtag = true;
+    Meta.Memtag = true;
   if (V & (1 << 3))
     Meta.IsDynInit = true;
   return Meta;
 }
 
 Error BitcodeReader::parseGlobalVarRecord(ArrayRef<uint64_t> Record) {
   // v1: [pointer type, isconst, initid, linkage, alignment, section,
   // visibility, threadlocal, unnamed_addr, externally_initialized,

llvm/lib/Bitcode/Writer/BitcodeWriter.cpp

static StringEncoding getStringEncoding(StringRef Str) {
   return SE_Fixed7;
 }
 
 static_assert(sizeof(GlobalValue::SanitizerMetadata) <= sizeof(unsigned),
               "Sanitizer Metadata is too large for naive serialization.");
 static unsigned
 serializeSanitizerMetadata(const GlobalValue::SanitizerMetadata &Meta) {
   return Meta.NoAddress | (Meta.NoHWAddress << 1) |
-         (Meta.NoMemtag << 2) | (Meta.IsDynInit << 3);
+         (Meta.Memtag << 2) | (Meta.IsDynInit << 3);
 }
 
 /// Emit top-level description of module, including target triple, inline asm,
 /// descriptors for global variables, and function prototype info.
 /// Returns the bit offset to backpatch with the location of the real VST.
 void ModuleBitcodeWriter::writeModuleInfo() {
   // Emit various pieces of data attached to a module.
   if (!M.getTargetTriple().empty())

llvm/lib/IR/AsmWriter.cpp

void AssemblyWriter::printGlobal(const GlobalVariable *GV) {
 
   using SanitizerMetadata = llvm::GlobalValue::SanitizerMetadata;
   if (GV->hasSanitizerMetadata()) {
     SanitizerMetadata MD = GV->getSanitizerMetadata();
     if (MD.NoAddress)
       Out << ", no_sanitize_address";
     if (MD.NoHWAddress)
       Out << ", no_sanitize_hwaddress";
-    if (MD.NoMemtag)
-      Out << ", no_sanitize_memtag";
+    if (MD.Memtag)
+      Out << ", sanitize_memtag";
     if (MD.IsDynInit)
       Out << ", sanitize_address_dyninit";
   }
 
   maybePrintComdat(Out, *GV);
   if (MaybeAlign A = GV->getAlign())
     Out << ", align " << A->value();
 

llvm/test/Assembler/globalvariable-attributes.ll

 ; RUN: llvm-as < %s | llvm-dis | llvm-as | llvm-dis | FileCheck %s
 
 @g1 = global i32 7 "key" = "value" "key2" = "value2"
 @g2 = global i32 2, align 4 "key3" = "value3"
 @g3 = global i32 2 #0
 @g4 = global i32 2, align 4 "key5" = "value5" #0
 @g5 = global i32 2, no_sanitize_address, align 4
 @g6 = global i32 2, no_sanitize_hwaddress, align 4
-@g7 = global i32 2, no_sanitize_memtag, align 4
-@g8 = global i32 2, sanitize_address_dyninit, align 4
-@g9 = global i32 2, no_sanitize_address, no_sanitize_hwaddress, no_sanitize_memtag, align 4
+@g7 = global i32 2, sanitize_address_dyninit, align 4
+@g8 = global i32 2, sanitize_memtag, align 4
+@g9 = global i32 2, no_sanitize_address, no_sanitize_hwaddress, sanitize_memtag, align 4
 
 attributes #0 = { "string" = "value" nobuiltin norecurse }
 
 ; CHECK: @g1 = global i32 7 #0
 ; CHECK: @g2 = global i32 2, align 4 #1
 ; CHECK: @g3 = global i32 2 #2
 ; CHECK: @g4 = global i32 2, align 4 #3
 ; CHECK: @g5 = global i32 2, no_sanitize_address, align 4
 ; CHECK: @g6 = global i32 2, no_sanitize_hwaddress, align 4
-; CHECK: @g7 = global i32 2, no_sanitize_memtag, align 4
-; CHECK: @g8 = global i32 2, sanitize_address_dyninit, align 4
-; CHECK: @g9 = global i32 2, no_sanitize_address, no_sanitize_hwaddress, no_sanitize_memtag, align 4
+; CHECK: @g7 = global i32 2, sanitize_address_dyninit, align 4
+; CHECK: @g8 = global i32 2, sanitize_memtag, align 4
+; CHECK: @g9 = global i32 2, no_sanitize_address, no_sanitize_hwaddress, sanitize_memtag, align 4
 
 ; CHECK: attributes #0 = { "key"="value" "key2"="value2" }
 ; CHECK: attributes #1 = { "key3"="value3" }
 ; CHECK: attributes #2 = { nobuiltin norecurse "string"="value" }
 ; CHECK: attributes #3 = { nobuiltin norecurse "key5"="value5" "string"="value" }
 

llvm/test/Bitcode/compatibility.ll

 @llvm.global_ctors = appending global [1 x %pri.func.data] [%pri.func.data { i32 0, void ()* @g.f1, i8* @g.used3 }], section "llvm.metadata"
 ; CHECK: @llvm.global_ctors = appending global [1 x %pri.func.data] [%pri.func.data { i32 0, void ()* @g.f1, i8* @g.used3 }], section "llvm.metadata"
 @llvm.global_dtors = appending global [1 x %pri.func.data] [%pri.func.data { i32 0, void ()* @g.f1, i8* @g.used3 }], section "llvm.metadata"
 ; CHECK: @llvm.global_dtors = appending global [1 x %pri.func.data] [%pri.func.data { i32 0, void ()* @g.f1, i8* @g.used3 }], section "llvm.metadata"
 
 ; Global Variables -- sanitizers
 @g.no_sanitize_address = global i32 0, no_sanitize_address
 @g.no_sanitize_hwaddress = global i32 0, no_sanitize_hwaddress
[e-mail]_sanitize_memtag = global i32 0, no_sanitize_memtag
[e-mail]_sanitize_multiple = global i32 0, no_sanitize_address, no_sanitize_hwaddress, no_sanitize_memtag
[e-mail]_memtag = global i32 0, sanitize_memtag
[e-mail]_sanitize_multiple = global i32 0, no_sanitize_address, no_sanitize_hwaddress
 @g.sanitize_address_dyninit = global i32 0, sanitize_address_dyninit
[e-mail]_multiple = global i32 0, sanitize_memtag, sanitize_address_dyninit
 ; CHECK: @g.no_sanitize_address = global i32 0, no_sanitize_address
 ; CHECK: @g.no_sanitize_hwaddress = global i32 0, no_sanitize_hwaddress
-; CHECK: @g.no_sanitize_memtag = global i32 0, no_sanitize_memtag
-; CHECK: @g.no_sanitize_multiple = global i32 0, no_sanitize_address, no_sanitize_hwaddress, no_sanitize_memtag
+; CHECK: @g.sanitize_memtag = global i32 0, sanitize_memtag
+; CHECK: @g.no_sanitize_multiple = global i32 0, no_sanitize_address, no_sanitize_hwaddress
 ; CHECK: @g.sanitize_address_dyninit = global i32 0, sanitize_address_dyninit
+; CHECK: @g.sanitize_multiple = global i32 0, sanitize_memtag, sanitize_address_dyninit
 
 ;; Aliases
 ; Format: @<Name> = [Linkage] [Visibility] [DLLStorageClass] [ThreadLocal]
 ;                   [unnamed_addr] alias <AliaseeTy> @<Aliasee>
 
 ; Aliases -- Linkage
 @a.private = private alias i32, i32* @g.private
 ; CHECK: @a.private = private alias i32, i32* @g.private