Allow -fsanitize=function on all targets

[MaskRay]

Summary

Functions instrumented with -fsanitize=function have two words before
the function label: a signature and a RTTI proxy.
Instrumented call sites check the signature first to skip checks
for uninstrumented callees.

The code is generic and works for all targets supporting C++ RTTI.
Change clangDriver to allow all targets. Add tests for Armv8.5
Branch Target Identification and -fpatchable-function-entry=.

[peter.smith]

As it stands I think this may have problems with -mbranch-protection. In that case we'll need a BTI c to be the target of the indirect branch. I'm guessing something like:

_Z3funv
BTI C ; In hint space
B . + 8 
.word .L__llvm_rtti_proxy-_Z3funv

Otherwise when the indirect call is made then it will fail on a system with BTI enabled.

Not too sure how much of a problem this is for the implementation. The BTI c can't be used as a signature, I guess the code in the caller could check the value at _z3funv + 4 . The feature could be marked as incompatible with -mbranch-protection. I guess it may not work well with patchable functions either.

I would expect the emitGlobalConstant to emit data. This would be visible in the object file as we'd have:

$d
<signature>
<rtti>
$x
instructions.

At the moment I don't think that this would affect anything except disassemblers, and the LLD cortex-a53 eratta work around which excludes $d from the disassembly. It is something that it could be worth fixing, expecially if there is a BTI C involved.

[peter.smith]

One other small thing. The docs page https://clang.llvm.org/docs/UndefinedBehaviorSanitizer.html would need the supported architectures updating:

-fsanitize=function: Indirect call of a function through a function pointer of the wrong type (Darwin/Linux, C++ and x86/x86_64 only).

[MaskRay]

In D148573#4277573, @peter.smith wrote:

As it stands I think this may have problems with -mbranch-protection. In that case we'll need a BTI c to be the target of the indirect branch. I'm guessing something like:

_Z3funv
BTI C ; In hint space
B . + 8 
.word .L__llvm_rtti_proxy-_Z3funv

Otherwise when the indirect call is made then it will fail on a system with BTI enabled.

Not too sure how much of a problem this is for the implementation. The BTI c can't be used as a signature, I guess the code in the caller could check the value at _z3funv + 4 . The feature could be marked as incompatible with -mbranch-protection. I guess it may not work well with patchable functions either.

I would expect the emitGlobalConstant to emit data. This would be visible in the object file as we'd have:

$d
<signature>
<rtti>
$x
instructions.

At the moment I don't think that this would affect anything except disassemblers, and the LLD cortex-a53 eratta work around which excludes $d from the disassembly. It is something that it could be worth fixing, expecially if there is a BTI C involved.

Thanks. I forgot to check this interaction with -mbranch-protection=bti. x86 -fcf-protection=branch has a similar problem.

The current AArch64 bti instrumentation always adds a bti (even for local linkage functions that are not taken addresses) to accommodate range extension thunks, but I can think of possible improvement to make bti optional in more cases in the future.

I think -fsanitize=function has to do something similar to -fsanitize=kcfi by moving the two words before the function entry: D148665

[MaskRay]

Make -mbranch-protection=bti -fsanitize=function work.

[peter.smith]

With moving the signature before the function entry this looks good to me. I'm not so familiar with the code in https://reviews.llvm.org/D148665 would ideally find someone a bit more experienced to take a look at that part. If I'm the only one available I can take a look but may take a bit more time.

We're looking to clarify when a BTI is required in the ABI https://github.com/ARM-software/abi-aa/issues/196 starting with some design options.

[MaskRay]

In D148573#4280335, @peter.smith wrote:

With moving the signature before the function entry this looks good to me. I'm not so familiar with the code in https://reviews.llvm.org/D148665 would ideally find someone a bit more experienced to take a look at that part. If I'm the only one available I can take a look but may take a bit more time.

We're looking to clarify when a BTI is required in the ABI https://github.com/ARM-software/abi-aa/issues/196 starting with some design options.

Thank you!

For folks curious about -fsanitize=function, I added some paragraphs to https://maskray.me/blog/2022-12-18-control-flow-integrity#fsanitizefunction

[MaskRay]

allow all targets

[vitalybuka]

These bots are broken after the patch
https://lab.llvm.org/buildbot/#/builders/77/builds/26834
https://lab.llvm.org/buildbot/#/builders/18/builds/9073

[MaskRay]

In D148573#4358899, @vitalybuka wrote:

These bots are broken after the patch
https://lab.llvm.org/buildbot/#/builders/77/builds/26834
https://lab.llvm.org/buildbot/#/builders/18/builds/9073

The ppc64le has other unrelated failures.

The aarch64 android bot failed due to being unable to link the executable, which seems an infrastructure issue? :) I think we can disable the test by modifying compiler-rt/test/ubsan/TestCases/TypeCheck/Function/lit.local.cfg.py

[sbc100]

This change seems to be causing problems on the emscripten auto-roller: https://ci.chromium.org/ui/p/emscripten-releases/builders/try/linux/b8780394114149321217/overview

Failures show up in ubsan tests and look like this:

error: symbol '_Z4testi' unsupported subtraction expression used in relocation in code section.
error: symbol '__main_argc_argv' unsupported subtraction expression used in relocation in code section.
fatal error: error in backend: function sections must contain one function each

It seems like enabling this sanitizer perhaps uses features we don't yet support? I will keep investigating but perhaps we can find a way to revert he effect on the wasm backend for now?

[sbc100]

(I guess this also mean we are lacking some upstream testing for ubsan + wasm + mc?)

[MaskRay]

In D148573#4361396, @sbc100 wrote:

This change seems to be causing problems on the emscripten auto-roller: https://ci.chromium.org/ui/p/emscripten-releases/builders/try/linux/b8780394114149321217/overview

Failures show up in ubsan tests and look like this:

error: symbol '_Z4testi' unsupported subtraction expression used in relocation in code section.
error: symbol '__main_argc_argv' unsupported subtraction expression used in relocation in code section.
fatal error: error in backend: function sections must contain one function each

It seems like enabling this sanitizer perhaps uses features we don't yet support? I will keep investigating but perhaps we can find a way to revert he effect on the wasm backend for now?

wasm seems to use -fsanitize=undefined, which includes -fsanitize=function.
wasm doesn't allow data words before the function entry, so we need to unsupport -fsanitize=function for wasm...

[sbc100]

In D148573#4361509, @MaskRay wrote:

In D148573#4361396, @sbc100 wrote:

This change seems to be causing problems on the emscripten auto-roller: https://ci.chromium.org/ui/p/emscripten-releases/builders/try/linux/b8780394114149321217/overview

Failures show up in ubsan tests and look like this:

error: symbol '_Z4testi' unsupported subtraction expression used in relocation in code section.
error: symbol '__main_argc_argv' unsupported subtraction expression used in relocation in code section.
fatal error: error in backend: function sections must contain one function each

It seems like enabling this sanitizer perhaps uses features we don't yet support? I will keep investigating but perhaps we can find a way to revert he effect on the wasm backend for now?

wasm seems to use -fsanitize=undefined, which includes -fsanitize=function.
wasm doesn't allow data words before the function entry, so we need to unsupport -fsanitize=function for wasm...

That makes sense to me. The wasm specification (and therefore the wasm runtimes) already enforce signature checking for indirect function calls so there should be no need for this sanitizer there anyway. Do you want to make that change or should I?

[MaskRay]

In D148573#4361894, @sbc100 wrote:

In D148573#4361509, @MaskRay wrote:

In D148573#4361396, @sbc100 wrote:

This change seems to be causing problems on the emscripten auto-roller: https://ci.chromium.org/ui/p/emscripten-releases/builders/try/linux/b8780394114149321217/overview

Failures show up in ubsan tests and look like this:

error: symbol '_Z4testi' unsupported subtraction expression used in relocation in code section.
error: symbol '__main_argc_argv' unsupported subtraction expression used in relocation in code section.
fatal error: error in backend: function sections must contain one function each

It seems like enabling this sanitizer perhaps uses features we don't yet support? I will keep investigating but perhaps we can find a way to revert he effect on the wasm backend for now?

wasm seems to use -fsanitize=undefined, which includes -fsanitize=function.
wasm doesn't allow data words before the function entry, so we need to unsupport -fsanitize=function for wasm...

That makes sense to me. The wasm specification (and therefore the wasm runtimes) already enforce signature checking for indirect function calls so there should be no need for this sanitizer there anyway. Do you want to make that change or should I?

Thanks for the additional context (and I shall learn about it). Having been done in 39ba913d13ab15c76cb6b5aa066fa111ddfe944b

clang/docs/UndefinedBehaviorSanitizer.rst

-  ``-fsanitize=float-cast-overflow``: Conversion to, from, or
      destination. Because the range of representable values for all
      floating-point types supported by Clang is [-inf, +inf], the only
      cases detected are conversions from floating point to integer types.
   -  ``-fsanitize=float-divide-by-zero``: Floating point division by
      zero. This is undefined per the C and C++ standards, but is defined
      by Clang (and by ISO/IEC/IEEE 60559 / IEEE 754) as producing either an
      infinity or NaN value, so is not included in ``-fsanitize=undefined``.
   -  ``-fsanitize=function``: Indirect call of a function through a
-     function pointer of the wrong type (Darwin/Linux, C++ and x86/x86_64
-     only).
+     function pointer of the wrong type (C++ only).
   -  ``-fsanitize=implicit-unsigned-integer-truncation``,
      ``-fsanitize=implicit-signed-integer-truncation``: Implicit conversion from
      integer of larger bit width to smaller bit width, if that results in data
      loss. That is, if the demoted value, after casting back to the original
      width, is not equal to the original value before the downcast.
      The ``-fsanitize=implicit-unsigned-integer-truncation`` handles conversions
      between two ``unsigned`` types, while
      ``-fsanitize=implicit-signed-integer-truncation`` handles the rest of the

clang/lib/Driver/ToolChain.cpp

ToolChain::getSystemGPUArchs(const llvm::opt::ArgList &Args) const {
   return SmallVector<std::string>();
 }
 
 SanitizerMask ToolChain::getSupportedSanitizers() const {
   // Return sanitizers which don't require runtime support and are not
   // platform dependent.
 
   SanitizerMask Res =
-      (SanitizerKind::Undefined & ~SanitizerKind::Vptr &
-       ~SanitizerKind::Function) |
+      (SanitizerKind::Undefined & ~SanitizerKind::Vptr) |
       (SanitizerKind::CFI & ~SanitizerKind::CFIICall) |
       SanitizerKind::CFICastStrict | SanitizerKind::FloatDivideByZero |
       SanitizerKind::KCFI | SanitizerKind::UnsignedIntegerOverflow |
       SanitizerKind::UnsignedShiftBase | SanitizerKind::ImplicitConversion |
       SanitizerKind::Nullability | SanitizerKind::LocalBounds;
   if (getTriple().getArch() == llvm::Triple::x86 ||
       getTriple().getArch() == llvm::Triple::x86_64 ||
       getTriple().getArch() == llvm::Triple::arm || getTriple().isWasm() ||

clang/lib/Driver/ToolChains/Darwin.cpp

SanitizerMask Darwin::getSupportedSanitizers() const {
   const bool IsAArch64 = getTriple().getArch() == llvm::Triple::aarch64;
   SanitizerMask Res = ToolChain::getSupportedSanitizers();
   Res |= SanitizerKind::Address;
   Res |= SanitizerKind::PointerCompare;
   Res |= SanitizerKind::PointerSubtract;
   Res |= SanitizerKind::Leak;
   Res |= SanitizerKind::Fuzzer;
   Res |= SanitizerKind::FuzzerNoLink;
-  Res |= SanitizerKind::Function;
   Res |= SanitizerKind::ObjCCast;
 
   // Prior to 10.9, macOS shipped a version of the C++ standard library without
   // C++11 support. The same is true of iOS prior to version 5. These OS'es are
   // incompatible with -fsanitize=vptr.
   if (!(isTargetMacOSBased() && isMacosxVersionLT(10, 9)) &&
       !(isTargetIPhoneOS() && isIPhoneOSVersionLT(5, 0)))
     Res |= SanitizerKind::Vptr;

clang/lib/Driver/ToolChains/FreeBSD.cpp

SanitizerMask FreeBSD::getSupportedSanitizers() const {
   Res |= SanitizerKind::Address;
   Res |= SanitizerKind::PointerCompare;
   Res |= SanitizerKind::PointerSubtract;
   Res |= SanitizerKind::Vptr;
   if (IsAArch64 || IsX86_64 || IsMIPS64) {
     Res |= SanitizerKind::Leak;
     Res |= SanitizerKind::Thread;
   }
-  if (IsX86 || IsX86_64) {
-    Res |= SanitizerKind::Function;
-  }
   if (IsAArch64 || IsX86 || IsX86_64) {
     Res |= SanitizerKind::SafeStack;
     Res |= SanitizerKind::Fuzzer;
     Res |= SanitizerKind::FuzzerNoLink;
   }
   if (IsAArch64 || IsX86_64) {
     Res |= SanitizerKind::KernelAddress;
     Res |= SanitizerKind::KernelMemory;

clang/lib/Driver/ToolChains/Linux.cpp

SanitizerMask Linux::getSupportedSanitizers() const {
   if (IsX86_64 || IsMIPS64 || IsAArch64 || IsX86 || IsArmArch || IsPowerPC64 ||
       IsRISCV64 || IsSystemZ || IsHexagon || IsLoongArch64)
     Res |= SanitizerKind::Leak;
   if (IsX86_64 || IsMIPS64 || IsAArch64 || IsPowerPC64 || IsSystemZ ||
       IsLoongArch64)
     Res |= SanitizerKind::Thread;
   if (IsX86_64 || IsSystemZ)
     Res |= SanitizerKind::KernelMemory;
-  if (IsX86 || IsX86_64)
-    Res |= SanitizerKind::Function;
   if (IsX86_64 || IsMIPS64 || IsAArch64 || IsX86 || IsMIPS || IsArmArch ||
       IsPowerPC64 || IsHexagon || IsLoongArch64 || IsRISCV64)
     Res |= SanitizerKind::Scudo;
   if (IsX86_64 || IsAArch64 || IsRISCV64) {
     Res |= SanitizerKind::HWAddress;
   }
   if (IsX86_64 || IsAArch64) {
     Res |= SanitizerKind::KernelHWAddress;

clang/lib/Driver/ToolChains/NetBSD.cpp

 SanitizerMask NetBSD::getSupportedSanitizers() const {
   const bool IsX86 = getTriple().getArch() == llvm::Triple::x86;
   const bool IsX86_64 = getTriple().getArch() == llvm::Triple::x86_64;
   SanitizerMask Res = ToolChain::getSupportedSanitizers();
   if (IsX86 || IsX86_64) {
     Res |= SanitizerKind::Address;
     Res |= SanitizerKind::PointerCompare;
     Res |= SanitizerKind::PointerSubtract;
-    Res |= SanitizerKind::Function;
     Res |= SanitizerKind::Leak;
     Res |= SanitizerKind::SafeStack;
     Res |= SanitizerKind::Scudo;
     Res |= SanitizerKind::Vptr;
   }
   if (IsX86_64) {
     Res |= SanitizerKind::DataFlow;
     Res |= SanitizerKind::Fuzzer;

clang/lib/Driver/ToolChains/Solaris.cpp

Solaris::Solaris(const Driver &D, const llvm::Triple &Triple,
   if (StringRef(D.Dir).startswith(D.SysRoot))
     addPathIfExists(D, D.Dir + "/../lib", Paths);
 
   addPathIfExists(D, D.SysRoot + "/usr/lib" + LibSuffix, Paths);
 }
 
 SanitizerMask Solaris::getSupportedSanitizers() const {
   const bool IsX86 = getTriple().getArch() == llvm::Triple::x86;
-  const bool IsX86_64 = getTriple().getArch() == llvm::Triple::x86_64;
   SanitizerMask Res = ToolChain::getSupportedSanitizers();
   // FIXME: Omit X86_64 until 64-bit support is figured out.
   if (IsX86) {
     Res |= SanitizerKind::Address;
     Res |= SanitizerKind::PointerCompare;
     Res |= SanitizerKind::PointerSubtract;
   }
-  if (IsX86 || IsX86_64)
-    Res |= SanitizerKind::Function;
   Res |= SanitizerKind::Vptr;
   return Res;
 }
 
 Tool *Solaris::buildAssembler() const {
   return new tools::solaris::Assembler(*this);
 }
 

clang/test/CodeGen/ubsan-function.cpp

 // RUN: %clang_cc1 -triple x86_64-linux-gnu -emit-llvm -o - %s -fsanitize=function -fno-sanitize-recover=all | FileCheck %s
+// RUN: %clang_cc1 -triple aarch64-linux-gnu -emit-llvm -o - %s -fsanitize=function -fno-sanitize-recover=all | FileCheck %s
+// RUN: %clang_cc1 -triple aarch64_be-linux-gnu -emit-llvm -o - %s -fsanitize=function -fno-sanitize-recover=all | FileCheck %s
 
 // CHECK: @[[PROXY:.*]] = private unnamed_addr constant ptr @_ZTIFvvE
 // CHECK: define{{.*}} void @_Z3funv() #0 !func_sanitize ![[FUNCSAN:.*]] {
 void fun() {}
 
 // CHECK-LABEL: define{{.*}} void @_Z6callerPFvvE(ptr noundef %f)
 // CHECK: getelementptr <{ i32, i32 }>, ptr {{.*}}, i32 -1, i32 0, !nosanitize
 // CHECK: load i32, ptr {{.*}}, align {{.*}}, !nosanitize

clang/test/Driver/fsanitize.c

 // RUN: %clang --target=i386-pc-win32 -fsanitize=undefined -x c++ %s -### 2>&1 | FileCheck %s --check-prefixes=CHECK-UNDEFINED-WIN32,CHECK-UNDEFINED-WIN-CXX,CHECK-UNDEFINED-MSVC
 // RUN: %clang --target=x86_64-pc-win32 -fsanitize=undefined %s -### 2>&1 | FileCheck %s --check-prefixes=CHECK-UNDEFINED-WIN64,CHECK-UNDEFINED-MSVC
 // RUN: %clang --target=x86_64-w64-mingw32 -fsanitize=undefined %s -### 2>&1 | FileCheck %s --check-prefix=CHECK-UNDEFINED-WIN64-MINGW
 // RUN: %clang --target=x86_64-pc-win32 -fsanitize=undefined -x c++ %s -### 2>&1 | FileCheck %s --check-prefixes=CHECK-UNDEFINED-WIN64,CHECK-UNDEFINED-WIN-CXX,CHECK-UNDEFINED-MSVC
 // CHECK-UNDEFINED-WIN32: "--dependent-lib={{[^"]*}}ubsan_standalone{{(-i386)?}}.lib"
 // CHECK-UNDEFINED-WIN64: "--dependent-lib={{[^"]*}}ubsan_standalone{{(-x86_64)?}}.lib"
 // CHECK-UNDEFINED-WIN64-MINGW: "--dependent-lib={{[^"]*}}libclang_rt.ubsan_standalone{{(-x86_64)?}}.a"
 // CHECK-UNDEFINED-WIN-CXX: "--dependent-lib={{[^"]*}}ubsan_standalone_cxx{{[^"]*}}.lib"
-// CHECK-UNDEFINED-MSVC-SAME: "-fsanitize={{((signed-integer-overflow|integer-divide-by-zero|shift-base|shift-exponent|unreachable|return|vla-bound|alignment|null|pointer-overflow|float-cast-overflow|array-bounds|enum|bool|builtin|returns-nonnull-attribute|nonnull-attribute),?){17}"}}
-// CHECK-UNDEFINED-WIN64-MINGW-SAME: "-fsanitize={{((signed-integer-overflow|integer-divide-by-zero|shift-base|shift-exponent|unreachable|return|vla-bound|alignment|null|pointer-overflow|float-cast-overflow|array-bounds|enum|bool|builtin|returns-nonnull-attribute|nonnull-attribute|vptr),?){18}"}}
+// CHECK-UNDEFINED-MSVC-SAME: "-fsanitize={{((signed-integer-overflow|integer-divide-by-zero|shift-base|shift-exponent|unreachable|return|vla-bound|alignment|null|pointer-overflow|float-cast-overflow|array-bounds|enum|bool|builtin|returns-nonnull-attribute|nonnull-attribute|function),?){18}"}}
+// CHECK-UNDEFINED-WIN64-MINGW-SAME: "-fsanitize={{((signed-integer-overflow|integer-divide-by-zero|shift-base|shift-exponent|unreachable|return|vla-bound|alignment|null|pointer-overflow|float-cast-overflow|array-bounds|enum|bool|builtin|returns-nonnull-attribute|nonnull-attribute|function|vptr),?){19}"}}
 
 // RUN: %clang --target=i386-pc-win32 -fsanitize-coverage=bb %s -### 2>&1 | FileCheck %s --check-prefix=CHECK-COVERAGE-WIN32
 // CHECK-COVERAGE-WIN32: "--dependent-lib={{[^"]*}}ubsan_standalone{{(-i386)?}}.lib"
 // RUN: %clang --target=x86_64-pc-win32 -fsanitize-coverage=bb %s -### 2>&1 | FileCheck %s --check-prefix=CHECK-COVERAGE-WIN64
 // CHECK-COVERAGE-WIN64: "--dependent-lib={{[^"]*}}ubsan_standalone{{(-x86_64)?}}.lib"
 
 // RUN: %clang --target=%itanium_abi_triple -fsanitize=integer %s -### 2>&1 | FileCheck %s --check-prefix=CHECK-INTEGER -implicit-check-not="-fsanitize-address-use-after-scope"
 // CHECK-INTEGER: "-fsanitize={{((signed-integer-overflow|unsigned-integer-overflow|integer-divide-by-zero|shift-base|shift-exponent|implicit-unsigned-integer-truncation|implicit-signed-integer-truncation|implicit-integer-sign-change|unsigned-shift-base),?){9}"}}

 // CHECK-TSAN-ATOMICS-NOT: -cc1{{.*}}tsan-instrument-atomics=0
 // RUN: %clang --target=x86_64-linux-gnu -fsanitize=thread -fno-sanitize-thread-atomics %s -### 2>&1 | FileCheck %s --check-prefix=CHECK-TSAN-ATOMICS-OFF
 // CHECK-TSAN-ATOMICS-OFF: -cc1{{.*}}tsan-instrument-atomics=0
 // RUN: %clang --target=x86_64-linux-gnu -fsanitize=thread -fno-sanitize-thread-atomics -fsanitize-thread-atomics %s -### 2>&1 | FileCheck %s --check-prefix=CHECK-TSAN-ATOMICS-BOTH
 // CHECK-TSAN-ATOMICS-BOTH-NOT: -cc1{{.*}}tsan-instrument-atomics=0
 // RUN: %clang --target=x86_64-linux-gnu -fsanitize=thread -fsanitize-thread-atomics -fno-sanitize-thread-atomics %s -### 2>&1 | FileCheck %s --check-prefix=CHECK-TSAN-ATOMICS-BOTH-OFF
 // CHECK-TSAN-ATOMICS-BOTH-OFF: -cc1{{.*}}tsan-instrument-atomics=0
 
-// RUN: %clang --target=x86_64-apple-darwin10 -fsanitize=function %s -### 2>&1 | FileCheck %s --check-prefix=CHECK-FSAN-DARWIN
-// RUN: %clang --target=i386-apple-darwin10 -fsanitize=function %s -### 2>&1 | FileCheck %s --check-prefix=CHECK-FSAN-DARWIN
-// CHECK-FSAN-DARWIN: -cc1{{.*}}"-fsanitize=function" "-fsanitize-recover=function"
+// RUN: %clang --target=x86_64-apple-darwin10 -fsanitize=function %s -### 2>&1 | FileCheck %s --check-prefix=CHECK-FUNCTION
+// RUN: %clang --target=aarch64-unknown-linux-gnu -fsanitize=function %s -### 2>&1 | FileCheck %s --check-prefix=CHECK-FUNCTION
+// RUN: %clang --target=riscv64-pc-freebsd -fsanitize=function %s -### 2>&1 | FileCheck %s --check-prefix=CHECK-FUNCTION
+// CHECK-FUNCTION: -cc1{{.*}}"-fsanitize=function" "-fsanitize-recover=function"
 
 // RUN: %clang --target=x86_64-apple-darwin10 -mmacosx-version-min=10.8 -fsanitize=vptr %s -### 2>&1 | FileCheck %s --check-prefix=CHECK-VPTR-DARWIN-OLD
 // CHECK-VPTR-DARWIN-OLD: unsupported option '-fsanitize=vptr' for target 'x86_64-apple-darwin10'
 
 // RUN: %clang --target=arm-apple-ios4 -fsanitize=vptr %s -### 2>&1 | FileCheck %s --check-prefix=CHECK-VPTR-IOS-OLD
 // CHECK-VPTR-IOS-OLD: unsupported option '-fsanitize=vptr' for target 'arm-apple-ios4'
 
 // RUN: %clang --target=aarch64-apple-darwin15.0.0 -fsanitize=vptr %s -### 2>&1

 // RUN: %clang --target=x86_64--netbsd -fsanitize=scudo %s -### 2>&1 | FileCheck %s -check-prefix=SCUDO-NETBSD
 // SCUDO-NETBSD: "-fsanitize=scudo"
 
 // RUN: %clang --target=i386--solaris -fsanitize=function %s -### 2>&1 | FileCheck %s -check-prefix=FUNCTION-SOLARIS
 // RUN: %clang --target=x86_64--solaris -fsanitize=function %s -### 2>&1 | FileCheck %s -check-prefix=FUNCTION-SOLARIS
 // FUNCTION-SOLARIS: "-fsanitize=function"
 
 
-// RUN: %clang --target=x86_64-scei-ps4 -fsanitize=function -fsanitize=undefined %s -### 2>&1 | FileCheck %s --check-prefix=CHECK-FSAN-UBSAN-PS4
-// CHECK-FSAN-UBSAN-PS4: unsupported option '-fsanitize=function' for target 'x86_64-scei-ps4'
-// RUN: %clang --target=x86_64-scei-ps4 -fsanitize=function %s -### 2>&1 | FileCheck %s --check-prefix=CHECK-FSAN-PS4
-// CHECK-FSAN-PS4: unsupported option '-fsanitize=function' for target 'x86_64-scei-ps4'
 // RUN: %clang --target=x86_64-scei-ps4 -fsanitize=dataflow %s -### 2>&1 | FileCheck %s --check-prefix=CHECK-DFSAN-PS4
 // CHECK-DFSAN-PS4: unsupported option '-fsanitize=dataflow' for target 'x86_64-scei-ps4'
 // RUN: %clang --target=x86_64-scei-ps4 -fsanitize=leak %s -### 2>&1 | FileCheck %s --check-prefix=CHECK-LSAN-PS4
 // CHECK-LSAN-PS4: unsupported option '-fsanitize=leak' for target 'x86_64-scei-ps4'
 // RUN: %clang --target=x86_64-scei-ps4 -fsanitize=memory %s -### 2>&1 | FileCheck %s --check-prefix=CHECK-MSAN-PS4
 // CHECK-MSAN-PS4: unsupported option '-fsanitize=memory' for target 'x86_64-scei-ps4'
 // RUN: %clang --target=x86_64-scei-ps4 -fsanitize=thread %s -### 2>&1 | FileCheck %s --check-prefix=CHECK-TSAN-PS4
 // CHECK-TSAN-PS4: unsupported option '-fsanitize=thread' for target 'x86_64-scei-ps4'

compiler-rt/test/ubsan/TestCases/TypeCheck/Function/function.cpp

 // RUN: %clangxx -DDETERMINE_UNIQUE %s -o %t-unique
 // RUN: %clangxx -std=c++17 -fsanitize=function %s -O3 -g -DSHARED_LIB -fPIC -shared -o %t-so.so
 // RUN: %clangxx -std=c++17 -fsanitize=function %s -O3 -g -o %t %t-so.so
 // RUN: %run %t 2>&1 | FileCheck %s --check-prefix=CHECK $(%run %t-unique UNIQUE)
 // Verify that we can disable symbolization if needed:
 // RUN: %env_ubsan_opts=symbolize=0 %run %t 2>&1 | FileCheck %s --check-prefix=NOSYM $(%run %t-unique NOSYM-UNIQUE)
-// XFAIL: target={{.*windows.*}}
-// Unsupported function flag
-// UNSUPPORTED: target={{.*openbsd.*}}
 
 #ifdef DETERMINE_UNIQUE
 
 #include <iostream>
 
 #include "../../../../../lib/sanitizer_common/sanitizer_platform.h"
 
 int main(int, char **argv) {

compiler-rt/test/ubsan/TestCases/TypeCheck/Function/lit.local.cfg.py

-# The function type checker is only supported on x86 and x86_64 for now.
-if config.target_arch not in ['x86', 'x86_64']:
+if config.host_os not in ['Darwin', 'FreeBSD', 'Linux', 'NetBSD']:
   config.unsupported = True

llvm/test/CodeGen/AArch64/func-sanitizer.ll

+; RUN: llc -mtriple=aarch64-unknown-linux-gnu < %s | FileCheck %s
+
+; CHECK-LABEL: .type _Z3funv,@function
+; CHECK-NEXT:    .word   3238382334  // 0xc105cafe
+; CHECK-NEXT:    .word   .L__llvm_rtti_proxy-_Z3funv
+; CHECK-NEXT:  _Z3funv:
+; CHECK-NEXT:  // %bb.0:
+; CHECK-NEXT:    ret
+
+; CHECK:       .section .rodata,"a",@progbits
+; CHECK-LABEL: .L__llvm_rtti_proxy:
+; CHECK-NEXT:    .xword  _ZTIFvvE
+; CHECK-NEXT:    .size   .L__llvm_rtti_proxy, 8
+
+@_ZTIFvvE = linkonce_odr constant i32 1
+@__llvm_rtti_proxy = private unnamed_addr constant ptr @_ZTIFvvE
+
+define dso_local void @_Z3funv() nounwind !func_sanitize !0 {
+  ret void
+}
+
+!0 = !{i32 3238382334, ptr @__llvm_rtti_proxy}

llvm/test/CodeGen/AArch64/patchable-function-entry-bti.ll

 ; RUN: llc -mtriple=aarch64 %s -o - | FileCheck %s
 
+@_ZTIFvvE = linkonce_odr constant i32 2
+@__llvm_rtti_proxy = private unnamed_addr constant ptr @_ZTIFvvE
+
 define void @f0() "patchable-function-entry"="0" "branch-target-enforcement"="true" {
 ; CHECK-LABEL: f0:
 ; CHECK-NEXT: .Lfunc_begin0:
 ; CHECK:      // %bb.0:
 ; CHECK-NEXT:  hint #34
 ; CHECK-NEXT:  ret
 ; CHECK-NOT:  .section __patchable_function_entries
   ret void
sw.bb2:
   ret void
 sw.bb3:
   call void asm sideeffect "", ""()
   ret void
 sw.bb4:
   call void asm sideeffect "", ""()
   ret void
 }
+
+;; Test the interaction with -fsanitize=function.
+; CHECK:      .type sanitize_function,@function
+; CHECK-NEXT: .Ltmp{{.*}}:
+; CHECK-NEXT:   nop
+; CHECK-NEXT:   .word   3238382334  // 0xc105cafe
+; CHECK-NEXT:   .word   .L__llvm_rtti_proxy-sanitize_function
+; CHECK-NEXT: sanitize_function:
+; CHECK-NEXT: .Lfunc_begin{{.*}}:
+; CHECK-NEXT:   .cfi_startproc
+; CHECK-NEXT:   // %bb.0:
+; CHECK-NEXT:   hint #34
+; CHECK-NEXT:   nop
+; CHECK-NEXT:   ret
+define void @sanitize_function(ptr noundef %x) "patchable-function-prefix"="1" "patchable-function-entry"="1" "branch-target-enforcement"="true" !func_sanitize !0 {
+  ret void
+}
+
+!0 = !{i32 3238382334, ptr @__llvm_rtti_proxy}