[asan] add option to set shadow mapping offset

[aaronc]

Summary

Allowing overriding the default ASAN shadow mapping offset with the` -asan-shadow-offset` option, and allow zero to be specified for both offset and scale. This is useful for bootstrapping or stand-alone ASAN implementations.

[rgov]

LGTM.

[kcc]

Please add a test

lib/Transforms/Instrumentation/AddressSanitizer.cpp

212

Please add something like "only for experiments, not fully supported" to the cl::desc

410

What would be the meaning of scale = 0?

[aaronc]

Added experimental warning to mapping-offset option, and add unit test.

[kcc]

LGTM

[aaronc]

Missed llvm-commits@. Resending with same diff.

[filcab]

This was removed back in r202033 by Kostya.
It's mostly only useful when starting to port ASan, AFAICT.

I'm curious, what do you mean with "stand-alone ASAN implementations"?

Thank you,

Filipe

[rgov]

Committed as r268586. git-svn lost the authorship information, sorry Aaron!

[rgov]

Not sure if I can re-open the revision. We got a failure on one of the PS4 buildbots:

opt: for the -asan-mapping-offset option: Cannot find option named '0xdeadbeef'!
FileCheck error: '-' is empty.

lib/Transforms/Instrumentation/AddressSanitizer.cpp

static cl::opt<bool> ClInstrumentAllocas("asan-instrument-allocas",
                                          cl::Hidden, cl::init(true));
 static cl::opt<bool> ClSkipPromotableAllocas(
     "asan-skip-promotable-allocas",
     cl::desc("Do not instrument promotable allocas"), cl::Hidden,
     cl::init(true));
 
 // These flags allow to change the shadow mapping.
 // The shadow mapping looks like
-//    Shadow = (Mem >> scale) + (1 << offset_log)
+//    Shadow = (Mem >> scale) + offset
 static cl::opt<int> ClMappingScale("asan-mapping-scale",
                                    cl::desc("scale of asan shadow mapping"),
                                    cl::Hidden, cl::init(0));
+static cl::opt<uint64_t> ClMappingOffset("asan-mapping-offset",
+                                   cl::desc("offset of asan shadow mapping [EXPERIMENTAL]"),
+                                   cl::Hidden, cl::init(0));
 
 // Optimization flags. Not user visible, used mostly for testing
 // and benchmarking the tool.
 static cl::opt<bool> ClOpt("asan-opt", cl::desc("Optimize instrumentation"),
                            cl::Hidden, cl::init(true));
 static cl::opt<bool> ClOptSameTemp(
     "asan-opt-same-temp", cl::desc("Instrument the same temp just once"),
     cl::Hidden, cl::init(true));
else if (IsIOS)
       Mapping.Offset = IsX86_64 ? kIOSSimShadowOffset64 : kIOSShadowOffset64;
     else if (IsAArch64)
       Mapping.Offset = kAArch64_ShadowOffset64;
     else
       Mapping.Offset = kDefaultShadowOffset64;
   }
 
   Mapping.Scale = kDefaultShadowScale;
-  if (ClMappingScale) {
+  if (ClMappingScale.getNumOccurrences() > 0) {
     Mapping.Scale = ClMappingScale;
   }
 
+  if (ClMappingOffset.getNumOccurrences() > 0) {
+    Mapping.Offset = ClMappingOffset;
+  }
+
   // OR-ing shadow offset if more efficient (at least on x86) if the offset
   // is a power of two, but on ppc64 we have to use add since the shadow
   // offset is not necessary 1/8-th of the address space.  On SystemZ,
   // we could OR the constant in a single instruction, but it's more
   // efficient to load it once and use indexed addressing.
   Mapping.OrShadowOffset = !IsAArch64 && !IsPPC64 && !IsSystemZ
                            && !(Mapping.Offset & (Mapping.Offset - 1));
 

test/Instrumentation/AddressSanitizer/scale-offset.ll

+; Test that the scale (-asan-mapping-scale) and offset (-asan-mapping-offset) command-line options work as expected
+;
+; RUN: opt < %s -asan -asan-module -asan-mapping-offset 0xdeadbeef -S | FileCheck --check-prefix=CHECK-OFFSET %s
+; RUN: opt < %s -asan -asan-module -asan-mapping-scale 1 -S | FileCheck --check-prefix=CHECK-SCALE %s
+; RUN: opt < %s -asan -asan-module -asan-mapping-offset 0xc0ffee -asan-mapping-scale 0 -S | FileCheck --check-prefix=CHECK-BOTH %s
+target triple = "x86_64-unknown-linux-gnu"
+
+define i32 @read_offset(i32* %a) sanitize_address {
+entry:
+  %tmp1 = load i32, i32* %a, align 4
+  ret i32 %tmp1
+}
+; CHECK-OFFSET-LABEL: @read_offset
+; CHECK-OFFSET-NOT: ret
+; CHECK-OFFSET: lshr {{.*}} 3
+; CHECK-OFFSET-NEXT: add{{.*}}3735928559
+; CHECK-OFFSET: ret
+
+define i32 @read_scale(i32* %a) sanitize_address {
+entry:
+  %tmp1 = load i32, i32* %a, align 4
+  ret i32 %tmp1
+}
+; CHECK-SCALE-LABEL: @read_scale
+; CHECK-SCALE-NOT: ret
+; CHECK-SCALE: lshr {{.*}} 1
+; CHECK-SCALE-NEXT: add{{.*}}
+; CHECK-SCALE: ret
+
+define i32 @read_both(i32* %a) sanitize_address {
+entry:
+  %tmp1 = load i32, i32* %a, align 4
+  ret i32 %tmp1
+}
+; CHECK-BOTH-LABEL: @read_both
+; CHECK-BOTH-NOT: ret
+; CHECK-BOTH: lshr {{.*}} 0
+; CHECK-BOTH-NEXT: add{{.*}}12648430
+; CHECK-BOTH: ret