Add msan custom mapping options

[vit9696]

Summary

Similarly to https://reviews.llvm.org/D18865 this adds options to provide custom mapping for msan.
As discussed in http://lists.llvm.org/pipermail/llvm-dev/2018-February/121339.html

[eugenis]

lib/Transforms/Instrumentation/MemorySanitizer.cpp

610 ↗

(On Diff #139910)

This getNumOccurrences() check and the 3 checks below are unnecessary.

618 ↗

(On Diff #139910)

I feel uneasy about modifying global Custom_MemoryMapParams in module-specific initialization. Sure, it will be the same for each module, and it is determined by global cl:opt values anyway, but lets move it inside class MemorySanitizer to be on the safe side.

test/Instrumentation/MemorySanitizer/manual-shadow.ll

4 ↗

(On Diff #139910)

that's a lot of -msan flags

6 ↗

(On Diff #139910)

Could you make the numbers decimal so they can be easily recognized in the IR?

7 ↗

(On Diff #139910)

Please add a test for origin-base.

[vit9696]

Thanks for the review. We are good now, I suppose. Could you merge it for me please?

[eugenis]

Sure. There is still a few extra -msan flags in the tests, I can remove them before commit.

[eugenis]

Actually, no. The test does not pass, not even close.
This check:

; CHECK-BASE-NOT: ret

is tripped by this line:

call void @__msan_warning_noreturn()

This check:

; CHECK-BASE: load{{.*}}3735928559

does not match because we never load from shadow base; we use it in "add".

Please make sure the test passes.

[vit9696]

Hm, I did run tests before uploading the diff and they passed. Perhaps I upped the wrong file. I will recheck tomorrow and resubmit.

[vit9696]

Morning. Ok, it looks like I hardly checked the IR and a ton of passes were left unnoticed making no sense of the tests :D. Sorry, fixed.

[eugenis]

Oh, right. And I removed the extra -msan flags before running the tests. It means you were testing msan^3 before :)

llvm/trunk/lib/Transforms/Instrumentation/MemorySanitizer.cpp

static cl::opt<bool> ClCheckConstantShadow("msan-check-constant-shadow",
        cl::Hidden, cl::init(false));
 
 // This is off by default because of a bug in gold:
 // https://sourceware.org/bugzilla/show_bug.cgi?id=19002
 static cl::opt<bool> ClWithComdat("msan-with-comdat",
        cl::desc("Place MSan constructors in comdat sections"),
        cl::Hidden, cl::init(false));
 
+// These options allow to specify custom memory map parameters
+// See MemoryMapParams for details.
+static cl::opt<unsigned long long> ClAndMask("msan-and-mask",
+       cl::desc("Define custom MSan AndMask"),
+       cl::Hidden, cl::init(0));
+
+static cl::opt<unsigned long long> ClXorMask("msan-xor-mask",
+       cl::desc("Define custom MSan XorMask"),
+       cl::Hidden, cl::init(0));
+
+static cl::opt<unsigned long long> ClShadowBase("msan-shadow-base",
+       cl::desc("Define custom MSan ShadowBase"),
+       cl::Hidden, cl::init(0));
+
+static cl::opt<unsigned long long> ClOriginBase("msan-origin-base",
+       cl::desc("Define custom MSan OriginBase"),
+       cl::Hidden, cl::init(0));
+
 static const char *const kMsanModuleCtorName = "msan.module_ctor";
 static const char *const kMsanInitName = "__msan_init";
 
 namespace {
 
 // Memory map parameters used in application-to-shadow address calculation.
 // Offset = (Addr & ~AndMask) ^ XorMask
 // Shadow = ShadowBase + Offset
private:
   Value *MsanChainOriginFn;
 
   /// \brief MSan runtime replacements for memmove, memcpy and memset.
   Value *MemmoveFn, *MemcpyFn, *MemsetFn;
 
   /// \brief Memory map parameters used in application-to-shadow calculation.
   const MemoryMapParams *MapParams;
 
+  /// \brief Custom memory map parameters used when -msan-shadow-base or
+  // -msan-origin-base is provided.
+  MemoryMapParams CustomMapParams;
+
   MDNode *ColdCallWeights;
 
   /// \brief Branch weights for origin store.
   MDNode *OriginStoreWeights;
 
   /// \brief An empty volatile inline asm that prevents callback merge.
   InlineAsm *EmptyAsm;
 

 }
 
 /// \brief Module-level initialization.
 ///
 /// inserts a call to __msan_init to the module's constructor list.
 bool MemorySanitizer::doInitialization(Module &M) {
   auto &DL = M.getDataLayout();
 
+  bool ShadowPassed = ClShadowBase.getNumOccurrences() > 0;
+  bool OriginPassed = ClOriginBase.getNumOccurrences() > 0;
+  // Check the overrides first
+  if (ShadowPassed || OriginPassed) {
+    CustomMapParams.AndMask = ClAndMask;
+    CustomMapParams.XorMask = ClXorMask;
+    CustomMapParams.ShadowBase = ClShadowBase;
+    CustomMapParams.OriginBase = ClOriginBase;
+    MapParams = &CustomMapParams;
+  } else {
     Triple TargetTriple(M.getTargetTriple());
     switch (TargetTriple.getOS()) {
       case Triple::FreeBSD:
         switch (TargetTriple.getArch()) {
           case Triple::x86_64:
             MapParams = FreeBSD_X86_MemoryMapParams.bits64;
             break;
           case Triple::x86:
             MapParams = FreeBSD_X86_MemoryMapParams.bits32;
             break;
           default:
             report_fatal_error("unsupported architecture");
         }
         break;
       case Triple::NetBSD:
         switch (TargetTriple.getArch()) {
           case Triple::x86_64:
             MapParams = NetBSD_X86_MemoryMapParams.bits64;
             break;
           default:
             report_fatal_error("unsupported architecture");
         }
         break;
       case Triple::Linux:
         switch (TargetTriple.getArch()) {
           case Triple::x86_64:
             MapParams = Linux_X86_MemoryMapParams.bits64;
             break;
           case Triple::x86:
             MapParams = Linux_X86_MemoryMapParams.bits32;
             break;
           case Triple::mips64:
           case Triple::mips64el:
             MapParams = Linux_MIPS_MemoryMapParams.bits64;
             break;
           case Triple::ppc64:
           case Triple::ppc64le:
             MapParams = Linux_PowerPC_MemoryMapParams.bits64;
             break;
           case Triple::aarch64:
           case Triple::aarch64_be:
             MapParams = Linux_ARM_MemoryMapParams.bits64;
             break;
           default:
             report_fatal_error("unsupported architecture");
         }
         break;
       default:
         report_fatal_error("unsupported operating system");
     }
+  }
 
   C = &(M.getContext());
   IRBuilder<> IRB(*C);
   IntptrTy = IRB.getIntPtrTy(DL);
   OriginTy = IRB.getInt32Ty();
 
   ColdCallWeights = MDBuilder(*C).createBranchWeights(1, 1000);
   OriginStoreWeights = MDBuilder(*C).createBranchWeights(1, 1000);

llvm/trunk/test/Instrumentation/MemorySanitizer/manual-shadow.ll

+; Test that the msan layout customization options work as expected
+;
+; RUN: opt < %s -msan -msan-shadow-base 3735928559 -S | FileCheck --check-prefix=CHECK-BASE %s
+; RUN: opt < %s -msan -msan-shadow-base 3735928559 -msan-and-mask 4294901760 -S | FileCheck --check-prefix=CHECK-AND %s
+; RUN: opt < %s -msan -msan-shadow-base 3735928559 -msan-xor-mask 48879 -S | FileCheck --check-prefix=CHECK-XOR %s
+; RUN: opt < %s -msan -msan-shadow-base 3735928559 -msan-xor-mask 48879 -msan-and-mask 4294901760 -S | FileCheck --check-prefix=CHECK-XOR-AND %s
+; RUN: opt < %s -msan -msan-track-origins 1 -msan-origin-base 1777777 -S | FileCheck --check-prefix=CHECK-ORIGIN-BASE %s
+
+target triple = "x86_64-unknown-linux-gnu"
+
+define i32 @read_value(i32* %a) sanitize_memory {
+entry:
+  %tmp1 = load i32, i32* %a, align 4
+  ret i32 %tmp1
+}
+; CHECK-BASE-LABEL: @read_value
+; CHECK-BASE-NOT: ret i32
+; CHECK-BASE: add{{.*}}3735928559
+; CHECK-BASE: ret i32
+
+; CHECK-AND-LABEL: @read_value
+; CHECK-AND-NOT: ret i32
+; CHECK-AND: and{{.*}}-4294901761
+; CHECK-AND-NEXT: add{{.*}}3735928559
+; CHECK-AND: ret i32
+
+; CHECK-XOR-LABEL: @read_value
+; CHECK-XOR-NOT: ret i32
+; CHECK-XOR: xor{{.*}}48879
+; CHECK-XOR-NEXT: add{{.*}}3735928559
+; CHECK-XOR: ret i32
+
+; CHECK-XOR-AND-LABEL: @read_value
+; CHECK-XOR-AND-NOT: ret i32
+; CHECK-XOR-AND: and{{.*}}-4294901761
+; CHECK-XOR-AND-NEXT: xor{{.*}}48879
+; CHECK-XOR-AND-NEXT: add{{.*}}3735928559
+; CHECK-XOR-AND: ret i32
+
+; CHECK-ORIGIN-BASE-LABEL: @read_value
+; CHECK-ORIGIN-BASE-NOT: ret i32
+; CHECK-ORIGIN-BASE: add{{.*}}1777777
+; CHECK-ORIGIN-BASE: ret i32