Initial Syringe Prototype

[paulkirth]

Summary

This patch contains a simple prototype for Syringe, an LLVM based framework for behavior injection. The goal of this work is to allow developers to change how a program can behave at runtime by allowing them to dynamically change how targeted functions behave. We accomplish this by modifying a targeted function's body to make an indirect call through a runtime controlled implementation pointer, which can point to either the original function body or to an alternate function determined at compile time. This allows us to dynamically enable and disable different functionality as the program runs, without limiting the variety of new behaviors supported by our tool. We add new annotations to mark the targets for injection, and their alternate behaviors. Additionally, we support configuration through YAML files, to avoid changing existing source code. One nice aspect of our approach is that injection sites(targets for new behaviors), and injection payloads(the new behaviors) can exist in separate translation units, and have their interactions codified at link time. While Syringe is designed to be somewhat general, its main use case is for supporting out of production use for activities like dynamic fault injection.

See the RFC on CFE-dev for more information: http://lists.llvm.org/pipermail/cfe-dev/2018-September/059260.html

[paulkirth]

I've added support to Syringe for dispatching injected behaviors using direct calls, which follows the advice of Kostya Serebryany on CFE-dev http://lists.llvm.org/pipermail/cfe-dev/2018-September/059312.html

This approach requires some extra code, since we now must manipulate LLVM IR ourselves rather than relying on ORC to handle all the transforms on our behalf.

clang/include/clang/Basic/Attr.td

 }
 
 def Artificial : InheritableAttr {
   let Spellings = [GCC<"artificial">];
   let Subjects = SubjectList<[InlineFunction], WarnDiag>;
   let Documentation = [ArtificialDocs];
 }
 
+def SyringeInjectionSite : InheritableAttr {
+  let Spellings = [Clang<"syringe_injection_site">];
+  let Subjects = SubjectList<[Function, ObjCMethod]>;
+  let Documentation = [SyringeDocs];
+}
+
+def SyringePayload : InheritableAttr {
+  let Spellings = [Clang<"syringe_payload">];
+  let Subjects = SubjectList<[Function, ObjCMethod]>;
+  let Args = [StringArgument<"SyringeTargetFunction">];
+  let Documentation = [SyringeDocs];
+}
+
 def XRayInstrument : InheritableAttr {
   let Spellings = [Clang<"xray_always_instrument">,
                    Clang<"xray_never_instrument">];
   let Subjects = SubjectList<[Function, ObjCMethod]>;
   let Accessors = [Accessor<"alwaysXRayInstrument",
                      [Clang<"xray_always_instrument">]>,
                    Accessor<"neverXRayInstrument",
                      [Clang<"xray_never_instrument">]>];

clang/include/clang/Basic/AttrDocs.td

 computations.  The RenderScript runtime efficiently parallelizes ``kernel``
 functions to run on computational resources such as multi-core CPUs and GPUs.
 See the RenderScript_ documentation for more information.
 
 .. _RenderScript: https://developer.android.com/guide/topics/renderscript/compute.html
   }];
 }
 
+def SyringeDocs : Documentation {
+  let Category = DocCatFunction;
+  let Heading = "syringe_injection_site (clang::syringe_injection_site), syringe_injection_payload (clang::syringe_injection_payload)";
+  let Content = [{
+``__attribute__((syringe_injection_site))`` or ``[[clang::syringe_injection_site]]`` is used to mark member functions (in C++), methods (in Objective C), and free functions (in C, C++, and Objective C) to have new behaviors injected by Syringe. This will allow the Syringe runtime to modify the function's behavior dynamically as the program runs.
+
+``__attribute__((syringe_injection_payload(TARGET_FUNCTION)))`` or ``[[clang::syringe_injection_payload(TARGET_FUNCTION)]]`` is used to demark the payload function that Syringe will inject into invocations of TARGET_FUNCTION.
+
+If a function has neither of these attributes, they are ignored by the Syringe passes and runtime.
+  }];
+}
+
 def XRayDocs : Documentation {
   let Category = DocCatFunction;
   let Heading = "xray_always_instrument (clang::xray_always_instrument), xray_never_instrument (clang::xray_never_instrument), xray_log_args (clang::xray_log_args)";
   let Content = [{
 ``__attribute__((xray_always_instrument))`` or ``[[clang::xray_always_instrument]]`` is used to mark member functions (in C++), methods (in Objective C), and free functions (in C, C++, and Objective C) to be instrumented with XRay. This will cause the function to always have space at the beginning and exit points to allow for runtime patching.
 
 Conversely, ``__attribute__((xray_never_instrument))`` or ``[[clang::xray_never_instrument]]`` will inhibit the insertion of these instrumentation points.
 

clang/include/clang/Basic/Features.def

 FEATURE(enumerator_attributes, true)
 FEATURE(nullability, true)
 FEATURE(nullability_on_arrays, true)
 FEATURE(memory_sanitizer, LangOpts.Sanitize.has(SanitizerKind::Memory))
 FEATURE(thread_sanitizer, LangOpts.Sanitize.has(SanitizerKind::Thread))
 FEATURE(dataflow_sanitizer, LangOpts.Sanitize.has(SanitizerKind::DataFlow))
 FEATURE(efficiency_sanitizer,
         LangOpts.Sanitize.hasOneOf(SanitizerKind::Efficiency))
+FEATURE(syringe, LangOpts.SyringeInject)
 FEATURE(scudo, LangOpts.Sanitize.hasOneOf(SanitizerKind::Scudo))
 // Objective-C features
 FEATURE(objc_arr, LangOpts.ObjCAutoRefCount) // FIXME: REMOVE?
 FEATURE(objc_arc, LangOpts.ObjCAutoRefCount)
 FEATURE(objc_arc_fields, true)
 FEATURE(objc_arc_weak, LangOpts.ObjCWeak)
 FEATURE(objc_default_synthesize_properties, LangOpts.ObjC2)
 FEATURE(objc_fixed_enum, LangOpts.ObjC2)

clang/include/clang/Basic/LangOptions.h

public:
   /// WARNING: This is a deprecated field and will go away in the future.
   std::vector<std::string> XRayNeverInstrumentFiles;
 
   /// Paths to the XRay attribute list files, specifying which objects
   /// (files, functions, variables) should be imbued with the appropriate XRay
   /// attribute(s).
   std::vector<std::string> XRayAttrListFiles;
 
+  /// Paths to the Syringe attribute list files, specifying which objects
+  /// (files, functions, variables) should be imbued with the appropriate Syringe
+  /// attribute(s).
+  std::vector<std::string> SyringeConfigFiles;
+
+
   clang::ObjCRuntime ObjCRuntime;
 
   std::string ObjCConstantStringClass;
 
   /// The name of the handler function to be called when -ftrapv is
   /// specified.
   ///
   /// If none is specified, abort (GCC-compatible behaviour).

clang/include/clang/Basic/LangOptions.def

 LANGOPT(XRayInstrument, 1, 0, "controls whether to do XRay instrumentation")
 LANGOPT(XRayAlwaysEmitCustomEvents, 1, 0,
         "controls whether to always emit intrinsic calls to "
         "__xray_customevent(...) builtin.")
 LANGOPT(XRayAlwaysEmitTypedEvents, 1, 0,
         "controls whether to always emit intrinsic calls to "
         "__xray_typedevent(...) builtin.")
 
+LANGOPT(SyringeInject, 1, 0, "controls whether to enable Syringe behavior injection")
+
 LANGOPT(ForceEmitVTables, 1, 0, "whether to emit all vtables")
 
 BENIGN_LANGOPT(AllowEditorPlaceholders, 1, 0,
                "allow editor placeholders in source")
 
 ENUM_LANGOPT(ClangABICompat, ClangABI, 4, ClangABI::Latest,
              "version of Clang that we should attempt to be ABI-compatible "
              "with")

clang/include/clang/Driver/Options.td

 def finstrument_function_entry_bare : Flag<["-"], "finstrument-function-entry-bare">, Group<f_Group>, Flags<[CC1Option]>,
   HelpText<"Instrument function entry only, after inlining, without arguments to the instrumentation call">;
 def fcf_protection_EQ : Joined<["-"], "fcf-protection=">, Flags<[CoreOption, CC1Option]>, Group<f_Group>,
   HelpText<"Instrument control-flow architecture protection. Options: return, branch, full, none.">, Values<"return,branch,full,none">;
 def fcf_protection : Flag<["-"], "fcf-protection">, Group<f_Group>, Flags<[CoreOption, CC1Option]>,
   Alias<fcf_protection_EQ>, AliasArgs<["full"]>,
   HelpText<"Enable cf-protection in 'full' mode">;
 
+def fsyringe : Flag<["-"], "fsyringe">, Group<f_Group>,
+  Flags<[CC1Option]>,
+  HelpText<"Generate stub functions and indirect calls for Syringe to perform behavior injection">;
+def fnosyringe : Flag<["-"], "fno-syringe">, Group<f_Group>,
+  Flags<[CC1Option]>;
+
+def fsyringe_link_deps : Flag<["-"], "fsyringe-link-deps">, Group<f_Group>,
+  Flags<[CC1Option]>,
+  HelpText<"Tells clang to add the link dependencies for Syringe.">;
+def fnosyringe_link_deps : Flag<["-"], "fnosyringe-link-deps">, Group<f_Group>,
+  Flags<[CC1Option]>;
+
+def fsyringe_config_file :
+  JoinedOrSeparate<["-"], "fsyringe-config-file=">,
+  Group<f_Group>, Flags<[CC1Option]>,
+  HelpText<"Filename defining Syringe Injeciton sites and payloads in YAML.">;
+
 def fxray_instrument : Flag<["-"], "fxray-instrument">, Group<f_Group>,
   Flags<[CC1Option]>,
   HelpText<"Generate XRay instrumentation sleds on function entry and exit">;
 def fnoxray_instrument : Flag<["-"], "fno-xray-instrument">, Group<f_Group>,
   Flags<[CC1Option]>;
 
 def fxray_instruction_threshold_EQ :
   JoinedOrSeparate<["-"], "fxray-instruction-threshold=">,

clang/include/clang/Driver/SyringeArgs.h

+//===--- SyringeArgs.h - Arguments for Syringe ------------------*- C++ -*-===//
+//
+//                     The LLVM Compiler Infrastructure
+//
+// This file is distributed under the University of Illinois Open Source
+// License. See LICENSE.TXT for details.
+//
+//===----------------------------------------------------------------------===//
+#ifndef LLVM_CLANG_DRIVER_SYRINGEARGS_H
+#define LLVM_CLANG_DRIVER_SYRINGEARGS_H
+
+#include "clang/Driver/Types.h"
+#include "llvm/Option/Arg.h"
+#include "llvm/Option/ArgList.h"
+
+#include <string>
+#include <vector>
+
+namespace clang {
+namespace driver {
+
+class ToolChain;
+
+class SyringeArgs {
+  bool SyringeInject = false;
+  bool SyringeRT = true;
+  std::vector<std::string> ConfigFiles;
+
+public:
+  /// Parses the Syringe arguments from an argument list.
+  SyringeArgs(const ToolChain &TC, const llvm::opt::ArgList &Args);
+  void addArgs(const ToolChain &TC, const llvm::opt::ArgList &Args,
+               llvm::opt::ArgStringList &CmdArgs, types::ID InputType) const;
+
+  /// Checks if the Syringe Runtime is required
+  bool needsSyringeRt() const { return SyringeInject && SyringeRT; }
+  std::vector<std::string> &getConfigFiles() { return ConfigFiles; }
+};
+
+} // namespace driver
+} // namespace clang
+
+#endif // LLVM_CLANG_DRIVER_SYRINGEARGS_H

clang/include/clang/Driver/ToolChain.h

 
 namespace driver {
 
 class Driver;
 class InputInfo;
 class SanitizerArgs;
 class Tool;
 class XRayArgs;
+class SyringeArgs;
 
 /// Helper structure used to pass information extracted from clang executable
 /// name such as `i686-linux-android-g++`.
 struct ParsedClangName {
   /// Target part of the executable name, as `i686-linux-android`.
   std::string TargetPrefix;
 
   /// Driver mode part of the executable name, as `g++`.
private:
   Tool *getClang() const;
   Tool *getAssemble() const;
   Tool *getLink() const;
   Tool *getClangAs() const;
   Tool *getOffloadBundler() const;
 
   mutable std::unique_ptr<SanitizerArgs> SanitizerArguments;
   mutable std::unique_ptr<XRayArgs> XRayArguments;
+  mutable std::unique_ptr<SyringeArgs> SyringeArguments;
 
   /// The effective clang triple for the current Job.
   mutable llvm::Triple EffectiveTriple;
 
   /// Set the toolchain's effective clang triple.
   void setEffectiveTriple(llvm::Triple ET) const {
     EffectiveTriple = std::move(ET);
   }
public:
   const path_list &getProgramPaths() const { return ProgramPaths; }
 
   const MultilibSet &getMultilibs() const { return Multilibs; }
 
   const SanitizerArgs& getSanitizerArgs() const;
 
   const XRayArgs& getXRayArgs() const;
 
+  const SyringeArgs& getSyringeArgs() const;
+
   // Returns the Arg * that explicitly turned on/off rtti, or nullptr.
   const llvm::opt::Arg *getRTTIArg() const { return CachedRTTIArg; }
 
   // Returns the RTTIMode for the toolchain with the current arguments.
   RTTIMode getRTTIMode() const { return CachedRTTIMode; }
 
   /// Return any implicit target and/or mode flag for an invocation of
   /// the compiler driver as `ProgName`.

clang/include/clang/Frontend/CodeGenOptions.def

 CODEGENOPT(CFProtectionReturn , 1, 0) ///< if -fcf-protection is
                                       ///< set to full or return.
 CODEGENOPT(CFProtectionBranch , 1, 0) ///< if -fcf-protection is
                                       ///< set to full or branch.
 CODEGENOPT(XRayInstrumentFunctions , 1, 0) ///< Set when -fxray-instrument is
                                            ///< enabled.
 CODEGENOPT(StackSizeSection  , 1, 0) ///< Set when -fstack-size-section is enabled.
 
+CODEGENOPT(SyringeInjectBehaviors  , 1, 0) ///< Set when -fsyringe is enabled.
+
 ///< Set when -fxray-always-emit-customevents is enabled.
 CODEGENOPT(XRayAlwaysEmitCustomEvents , 1, 0)
 
 ///< Set when -fxray-always-emit-typedevents is enabled.
 CODEGENOPT(XRayAlwaysEmitTypedEvents , 1, 0)
 
 ///< Set the minimum number of instructions in a function to determine selective
 ///< XRay instrumentation.

clang/lib/CodeGen/BackendUtil.cpp

 #include "llvm/Support/PrettyStackTrace.h"
 #include "llvm/Support/TargetRegistry.h"
 #include "llvm/Support/Timer.h"
 #include "llvm/Support/raw_ostream.h"
 #include "llvm/Target/TargetMachine.h"
 #include "llvm/Target/TargetOptions.h"
 #include "llvm/Transforms/Coroutines.h"
 #include "llvm/Transforms/IPO.h"
+#include "llvm/Transforms/Syringe.h"
 #include "llvm/Transforms/IPO/AlwaysInliner.h"
 #include "llvm/Transforms/IPO/PassManagerBuilder.h"
 #include "llvm/Transforms/IPO/ThinLTOBitcodeWriter.h"
 #include "llvm/Transforms/InstCombine/InstCombine.h"
 #include "llvm/Transforms/Instrumentation.h"
 #include "llvm/Transforms/Instrumentation/BoundsChecking.h"
 #include "llvm/Transforms/Instrumentation/GCOVProfiler.h"
 #include "llvm/Transforms/ObjCARC.h"
static void addEfficiencySanitizerPass(const PassManagerBuilder &Builder,
   EfficiencySanitizerOptions Opts;
   if (LangOpts.Sanitize.has(SanitizerKind::EfficiencyCacheFrag))
     Opts.ToolType = EfficiencySanitizerOptions::ESAN_CacheFrag;
   else if (LangOpts.Sanitize.has(SanitizerKind::EfficiencyWorkingSet))
     Opts.ToolType = EfficiencySanitizerOptions::ESAN_WorkingSet;
   PM.add(createEfficiencySanitizerPass(Opts));
 }
 
+static void addSyringePass(const PassManagerBuilder &Builder,
+                                       legacy::PassManagerBase &PM) {
+  const PassManagerBuilderWrapper &BuilderWrapper =
+      static_cast<const PassManagerBuilderWrapper&>(Builder);
+  const LangOptions &LangOpts = BuilderWrapper.getLangOpts();
+  auto P = static_cast<SyringeLegacyPass*>(createSyringe());
+  auto FileList = LangOpts.SyringeConfigFiles;
+  for(auto& FileName : FileList)
+  {
+    P->parse(FileName);
+  }
+
+  PM.add(P);
+}
+
 static TargetLibraryInfoImpl *createTLII(llvm::Triple &TargetTriple,
                                          const CodeGenOptions &CodeGenOpts) {
   TargetLibraryInfoImpl *TLII = new TargetLibraryInfoImpl(TargetTriple);
   if (!CodeGenOpts.SimplifyLibCalls)
     TLII->disableAllFunctions();
   else {
     // Disable individual libc/libm calls in TargetLibraryInfo.
     LibFunc F;
void EmitAssemblyHelper::CreatePasses(legacy::PassManager &MPM,
   }
 
   if (CodeGenOpts.hasProfileClangInstr()) {
     InstrProfOptions Options;
     Options.NoRedZone = CodeGenOpts.DisableRedZone;
     Options.InstrProfileOutput = CodeGenOpts.InstrProfileOutput;
     MPM.add(createInstrProfilingLegacyPass(Options));
   }
+
+  if (LangOpts.SyringeInject) {
+    addSyringePass(PMBuilder, MPM);
+  }
+
   if (CodeGenOpts.hasProfileIRInstr()) {
     PMBuilder.EnablePGOInstrGen = true;
     if (!CodeGenOpts.InstrProfileOutput.empty())
       PMBuilder.PGOInstrGen = CodeGenOpts.InstrProfileOutput;
     else
       PMBuilder.PGOInstrGen = DefaultProfileGenName;
   }
   if (CodeGenOpts.hasProfileIRUse())

clang/lib/CodeGen/CGCall.cpp

if (TargetDecl) {
     if (TargetDecl->hasAttr<NoReturnAttr>())
       FuncAttrs.addAttribute(llvm::Attribute::NoReturn);
     if (TargetDecl->hasAttr<ColdAttr>())
       FuncAttrs.addAttribute(llvm::Attribute::Cold);
     if (TargetDecl->hasAttr<NoDuplicateAttr>())
       FuncAttrs.addAttribute(llvm::Attribute::NoDuplicate);
     if (TargetDecl->hasAttr<ConvergentAttr>())
       FuncAttrs.addAttribute(llvm::Attribute::Convergent);
-
     if (const FunctionDecl *Fn = dyn_cast<FunctionDecl>(TargetDecl)) {
       AddAttributesFromFunctionProtoType(
           getContext(), FuncAttrs, Fn->getType()->getAs<FunctionProtoType>());
       // Don't use [[noreturn]] or _Noreturn for a call to a virtual function.
       // These attributes are not inherited by overloads.
       const CXXMethodDecl *MD = dyn_cast<CXXMethodDecl>(Fn);
       if (Fn->isNoReturn() && !(AttrOnCallSite && MD && MD->isVirtual()))
         FuncAttrs.addAttribute(llvm::Attribute::NoReturn);

clang/lib/CodeGen/CMakeLists.txt

set(LLVM_LINK_COMPONENTS
   LTO
   Linker
   MC
   ObjCARCOpts
   Object
   Passes
   ProfileData
   ScalarOpts
+  Syringe
   Support
   Target
   TransformUtils
   )
 
 # In a standard Clang+LLVM build, we need to generate intrinsics before
 # building codegen. In a standalone build, LLVM is already built and we don't
 # need this dependency. Furthermore, LLVM doesn't export it so we can't have

clang/lib/CodeGen/CodeGenFunction.h

public:
   /// ShouldInstrumentFunction - Return true if the current function should be
   /// instrumented with __cyg_profile_func_* calls
   bool ShouldInstrumentFunction();
 
   /// ShouldXRayInstrument - Return true if the current function should be
   /// instrumented with XRay nop sleds.
   bool ShouldXRayInstrumentFunction() const;
 
+  /// ShouldXRayInstrument - Return true if the current function should be
+  /// instrumented with XRay nop sleds.
+  bool ShouldSyringeInject() const;
+
   /// AlwaysEmitXRayCustomEvents - Return true if we must unconditionally emit
   /// XRay custom event handling calls.
   bool AlwaysEmitXRayCustomEvents() const;
 
   /// AlwaysEmitXRayTypedEvents - Return true if clang must unconditionally emit
   /// XRay typed event handling calls.
   bool AlwaysEmitXRayTypedEvents() const;
 

clang/lib/CodeGen/CodeGenFunction.cpp

 }
 
 /// ShouldXRayInstrument - Return true if the current function should be
 /// instrumented with XRay nop sleds.
 bool CodeGenFunction::ShouldXRayInstrumentFunction() const {
   return CGM.getCodeGenOpts().XRayInstrumentFunctions;
 }
 
+//// ShouldSyringeInject - Return true if the current function should use
+/// Syringe to modify runtime behavior.
+bool CodeGenFunction::ShouldSyringeInject() const {
+  return CGM.getCodeGenOpts().SyringeInjectBehaviors;
+}
+
 /// AlwaysEmitXRayCustomEvents - Return true if we should emit IR for calls to
 /// the __xray_customevent(...) builtin calls, when doing XRay instrumentation.
 bool CodeGenFunction::AlwaysEmitXRayCustomEvents() const {
   return CGM.getCodeGenOpts().XRayInstrumentFunctions &&
          (CGM.getCodeGenOpts().XRayAlwaysEmitCustomEvents ||
           CGM.getCodeGenOpts().XRayInstrumentationBundle.Mask ==
               XRayInstrKind::Custom);
 }
#undef SANITIZER
   // Ignore unrelated casts in STL allocate() since the allocator must cast
   // from void* to T* before object initialization completes. Don't match on the
   // namespace because not all allocators are in std::
   if (D && SanOpts.has(SanitizerKind::CFIUnrelatedCast)) {
     if (matchesStlAllocatorFn(D, getContext()))
       SanOpts.Mask &= ~SanitizerKind::CFIUnrelatedCast;
   }
 
+  // Handle Syringe annotations
+  if (D && ShouldSyringeInject()) {
+    if (const auto *SyringeAttr = D->getAttr<SyringeInjectionSiteAttr>()) {
+      Fn->addFnAttr("syringe-injection-site");
+    }
+
+    if (const auto *SyringeAttr = D->getAttr<SyringePayloadAttr>()) {
+      Fn->addFnAttr("syringe-payload");
+      auto fnName = SyringeAttr->getSyringeTargetFunction();
+      Fn->addFnAttr("syringe-target-function", fnName);
+    }
+
+  }
+
   // Apply xray attributes to the function (as a string, for now)
   bool InstrumentXray = ShouldXRayInstrumentFunction() &&
                         CGM.getCodeGenOpts().XRayInstrumentationBundle.has(
                             XRayInstrKind::Function);
   if (D && InstrumentXray) {
     if (const auto *XRayAttr = D->getAttr<XRayInstrumentAttr>()) {
       if (XRayAttr->alwaysXRayInstrument())
         Fn->addFnAttr("function-instrument", "xray-always");

clang/lib/CodeGen/CodeGenModule.h

bool isInSanitizerBlacklist(llvm::GlobalVariable *GV, SourceLocation Loc,
                               StringRef Category = StringRef()) const;
 
   /// Imbue XRay attributes to a function, applying the always/never attribute
   /// lists in the process. Returns true if we did imbue attributes this way,
   /// false otherwise.
   bool imbueXRayAttrs(llvm::Function *Fn, SourceLocation Loc,
                       StringRef Category = StringRef()) const;
 
+
+  /// Imbue Syringe attributes to a function.
+  /// Returns true if we did imbue attributes this way, false otherwise.
+  bool imbueSyringeAttrs(llvm::Function *Fn) const;
+
   SanitizerMetadata *getSanitizerMetadata() {
     return SanitizerMD.get();
   }
 
   void addDeferredVTable(const CXXRecordDecl *RD) {
     DeferredVTables.push_back(RD);
   }
 

clang/lib/Driver/CMakeLists.txt

add_clang_library(clangDriver
   Compilation.cpp
   Distro.cpp
   Driver.cpp
   DriverOptions.cpp
   Job.cpp
   Multilib.cpp
   Phases.cpp
   SanitizerArgs.cpp
+  SyringeArgs.cpp
   Tool.cpp
   ToolChain.cpp
   ToolChains/Arch/AArch64.cpp
   ToolChains/Arch/ARM.cpp
   ToolChains/Arch/Mips.cpp
   ToolChains/Arch/PPC.cpp
   ToolChains/Arch/RISCV.cpp
   ToolChains/Arch/Sparc.cpp

clang/lib/Driver/SyringeArgs.cpp

+//===--- SyringeArgs.cpp - Arguments for Syringe --------------------------===//
+//
+//                     The LLVM Compiler Infrastructure
+//
+// This file is distributed under the University of Illinois Open Source
+// License. See LICENSE.TXT for details.
+//
+//===----------------------------------------------------------------------===//
+#include "clang/Driver/SyringeArgs.h"
+#include "ToolChains/CommonArgs.h"
+#include "clang/Driver/Driver.h"
+#include "clang/Driver/DriverDiagnostic.h"
+#include "clang/Driver/Options.h"
+#include "llvm/Support/FileSystem.h"
+#include "llvm/Support/Path.h"
+
+using namespace clang;
+using namespace clang::driver;
+using namespace llvm::opt;
+
+namespace {
+constexpr char SyringeInstrumentOption[] = "-fsyringe";
+constexpr char SyringeConfigOption[] = "-fsyringe-config-file=";
+} // namespace
+
+SyringeArgs::SyringeArgs(const ToolChain &TC, const ArgList &Args) {
+  const Driver &D = TC.getDriver();
+  const llvm::Triple &Triple = TC.getTriple();
+  if (Args.hasFlag(options::OPT_fsyringe, options::OPT_fnosyringe, false)) {
+    if (Triple.getOS() == llvm::Triple::Linux ||
+        Triple.getOS() == llvm::Triple::Fuchsia) {
+      switch (Triple.getArch()) {
+      case llvm::Triple::x86_64:
+      case llvm::Triple::arm:
+      case llvm::Triple::aarch64:
+      case llvm::Triple::ppc64le:
+      case llvm::Triple::mips:
+      case llvm::Triple::mipsel:
+      case llvm::Triple::mips64:
+      case llvm::Triple::mips64el:
+        break;
+      default:
+        D.Diag(diag::err_drv_clang_unsupported)
+            << (std::string(SyringeInstrumentOption) + " on " + Triple.str());
+      }
+    } else if (Triple.getOS() == llvm::Triple::FreeBSD ||
+               Triple.getOS() == llvm::Triple::OpenBSD ||
+               Triple.getOS() == llvm::Triple::Darwin ||
+               Triple.getOS() == llvm::Triple::NetBSD) {
+      if (Triple.getArch() != llvm::Triple::x86_64) {
+        D.Diag(diag::err_drv_clang_unsupported)
+            << (std::string(SyringeInstrumentOption) + " on " + Triple.str());
+      }
+    } else {
+      D.Diag(diag::err_drv_clang_unsupported)
+          << (std::string(SyringeInstrumentOption) + " on " + Triple.str());
+    }
+
+    SyringeInject = true;
+
+    if (!Args.hasFlag(options::OPT_fsyringe_link_deps,
+                      options::OPT_fnosyringe_link_deps, true))
+      SyringeRT = false;
+
+    for (const auto &Filename :
+         Args.getAllArgValues(options::OPT_fsyringe_config_file)) {
+      if (llvm::sys::fs::exists(Filename)) {
+        ConfigFiles.push_back(Filename);
+        // ExtraDeps.push_back(Filename);
+      } else
+        D.Diag(clang::diag::err_drv_no_such_file) << Filename;
+    }
+  }
+}
+
+void SyringeArgs::addArgs(const ToolChain &TC, const ArgList &Args,
+                          ArgStringList &CmdArgs, types::ID InputType) const {
+  if (!SyringeInject)
+    return;
+
+  CmdArgs.push_back(SyringeInstrumentOption);
+  for (const auto &Config : ConfigFiles) {
+    SmallString<64> ConfigFileOpt(SyringeConfigOption);
+    ConfigFileOpt += Config;
+    CmdArgs.push_back(Args.MakeArgString(ConfigFileOpt));
+  }
+}

clang/lib/Driver/ToolChain.cpp

 #include "clang/Basic/VirtualFileSystem.h"
 #include "clang/Config/config.h"
 #include "clang/Driver/Action.h"
 #include "clang/Driver/Driver.h"
 #include "clang/Driver/DriverDiagnostic.h"
 #include "clang/Driver/Job.h"
 #include "clang/Driver/Options.h"
 #include "clang/Driver/SanitizerArgs.h"
+#include "clang/Driver/SyringeArgs.h"
 #include "clang/Driver/XRayArgs.h"
 #include "llvm/ADT/STLExtras.h"
 #include "llvm/ADT/SmallString.h"
 #include "llvm/ADT/StringRef.h"
 #include "llvm/ADT/Triple.h"
 #include "llvm/ADT/Twine.h"
 #include "llvm/Config/llvm-config.h"
 #include "llvm/MC/MCTargetOptions.h"

 }
 
 const XRayArgs& ToolChain::getXRayArgs() const {
   if (!XRayArguments.get())
     XRayArguments.reset(new XRayArgs(*this, Args));
   return *XRayArguments.get();
 }
 
+const SyringeArgs& ToolChain::getSyringeArgs() const {
+  if (!SyringeArguments.get())
+    SyringeArguments.reset(new SyringeArgs(*this, Args));
+  return *SyringeArguments.get();
+}
+
 namespace {
 
 struct DriverSuffix {
   const char *Suffix;
   const char *ModeFlag;
 };
 
 } // namespace

clang/lib/Driver/ToolChains/Clang.cpp

 #include "clang/Basic/CharInfo.h"
 #include "clang/Basic/LangOptions.h"
 #include "clang/Basic/ObjCRuntime.h"
 #include "clang/Basic/Version.h"
 #include "clang/Driver/DriverDiagnostic.h"
 #include "clang/Driver/Options.h"
 #include "clang/Driver/SanitizerArgs.h"
 #include "clang/Driver/XRayArgs.h"
+#include "clang/Driver/SyringeArgs.h"
 #include "llvm/ADT/StringExtras.h"
 #include "llvm/Config/llvm-config.h"
 #include "llvm/Option/ArgList.h"
 #include "llvm/Support/CodeGen.h"
 #include "llvm/Support/Compression.h"
 #include "llvm/Support/FileSystem.h"
 #include "llvm/Support/Path.h"
 #include "llvm/Support/Process.h"
#endif
   }
 
   const SanitizerArgs &Sanitize = getToolChain().getSanitizerArgs();
   Sanitize.addArgs(getToolChain(), Args, CmdArgs, InputType);
 
   const XRayArgs &XRay = getToolChain().getXRayArgs();
   XRay.addArgs(getToolChain(), Args, CmdArgs, InputType);
 
+  const SyringeArgs &Syringe = getToolChain().getSyringeArgs();
+  Syringe.addArgs(getToolChain(), Args, CmdArgs, InputType);
+
   if (getToolChain().SupportsProfiling())
     Args.AddLastArg(CmdArgs, options::OPT_pg);
 
   if (getToolChain().SupportsProfiling())
     Args.AddLastArg(CmdArgs, options::OPT_mfentry);
 
   // -flax-vector-conversions is default.
   if (!Args.hasFlag(options::OPT_flax_vector_conversions,
#endif
 
   if (Args.hasFlag(options::OPT_fgnu89_inline, options::OPT_fno_gnu89_inline,
                    false))
     CmdArgs.push_back("-fgnu89-inline");
 
   if (Args.hasArg(options::OPT_fno_inline))
     CmdArgs.push_back("-fno-inline");
 
+  if (Args.hasArg(options::OPT_fnosyringe))
+    CmdArgs.push_back("-fno-syringe");
+
+  if (Args.hasArg(options::OPT_fsyringe))
+    CmdArgs.push_back("-fsyringe");
+
   if (Arg* InlineArg = Args.getLastArg(options::OPT_finline_functions,
                                        options::OPT_finline_hint_functions,
                                        options::OPT_fno_inline_functions))
     InlineArg->render(Args, CmdArgs);
 
   Args.AddLastArg(CmdArgs, options::OPT_fexperimental_new_pass_manager,
                   options::OPT_fno_experimental_new_pass_manager);
 

clang/lib/Driver/ToolChains/CommonArgs.h

void linkSanitizerRuntimeDeps(const ToolChain &TC,
                               llvm::opt::ArgStringList &CmdArgs);
 
 bool addXRayRuntime(const ToolChain &TC, const llvm::opt::ArgList &Args,
                     llvm::opt::ArgStringList &CmdArgs);
 
 void linkXRayRuntimeDeps(const ToolChain &TC,
                          llvm::opt::ArgStringList &CmdArgs);
 
+bool addSyringeRuntime(const ToolChain &TC, const llvm::opt::ArgList &Args,
+                    llvm::opt::ArgStringList &CmdArgs);
+
+void linkSyringeRuntimeDeps(const ToolChain &TC,
+                         llvm::opt::ArgStringList &CmdArgs);
+
 void AddRunTimeLibs(const ToolChain &TC, const Driver &D,
                     llvm::opt::ArgStringList &CmdArgs,
                     const llvm::opt::ArgList &Args);
 
 void AddOpenMPLinkerScript(const ToolChain &TC, Compilation &C,
                            const InputInfo &Output,
                            const InputInfoList &Inputs,
                            const llvm::opt::ArgList &Args,

clang/lib/Driver/ToolChains/CommonArgs.cpp

 #include "clang/Driver/Driver.h"
 #include "clang/Driver/DriverDiagnostic.h"
 #include "clang/Driver/Job.h"
 #include "clang/Driver/Options.h"
 #include "clang/Driver/SanitizerArgs.h"
 #include "clang/Driver/ToolChain.h"
 #include "clang/Driver/Util.h"
 #include "clang/Driver/XRayArgs.h"
+#include "clang/Driver/SyringeArgs.h"
 #include "llvm/ADT/STLExtras.h"
 #include "llvm/ADT/SmallString.h"
 #include "llvm/ADT/StringExtras.h"
 #include "llvm/ADT/StringSwitch.h"
 #include "llvm/ADT/Twine.h"
 #include "llvm/Option/Arg.h"
 #include "llvm/Option/ArgList.h"
 #include "llvm/Option/Option.h"
bool tools::addSanitizerRuntimes(const ToolChain &TC, const ArgList &Args,
 
   const SanitizerArgs &SanArgs = TC.getSanitizerArgs();
   if (SanArgs.hasCrossDsoCfi() && !AddExportDynamic)
     CmdArgs.push_back("-export-dynamic-symbol=__cfi_check");
 
   return !StaticRuntimes.empty() || !NonWholeStaticRuntimes.empty();
 }
 
-bool tools::addXRayRuntime(const ToolChain&TC, const ArgList &Args, ArgStringList &CmdArgs) {
+bool tools::addSyringeRuntime(const ToolChain &TC, const ArgList &Args,
+                              ArgStringList &CmdArgs) {
+  if (Args.hasArg(options::OPT_shared))
+    return false;
+
+  if (TC.getSyringeArgs().needsSyringeRt()) {
+    CmdArgs.push_back("-whole-archive");
+    CmdArgs.push_back(TC.getCompilerRTArgString(Args, "syringe", false));
+    CmdArgs.push_back("-no-whole-archive");
+    return true;
+  }
+
+  return false;
+}
+
+void tools::linkSyringeRuntimeDeps(const ToolChain &TC,
+                                   ArgStringList &CmdArgs) {
+  CmdArgs.push_back("--no-as-needed");
+  CmdArgs.push_back("-lpthread");
+  if (TC.getTriple().getOS() != llvm::Triple::OpenBSD)
+    CmdArgs.push_back("-lrt");
+  CmdArgs.push_back("-lm");
+
+  if (TC.getTriple().getOS() != llvm::Triple::FreeBSD &&
+      TC.getTriple().getOS() != llvm::Triple::NetBSD &&
+      TC.getTriple().getOS() != llvm::Triple::OpenBSD)
+    CmdArgs.push_back("-ldl");
+}
+
+bool tools::addXRayRuntime(const ToolChain& TC, const ArgList &Args, ArgStringList &CmdArgs) {
   if (Args.hasArg(options::OPT_shared))
     return false;
 
   if (TC.getXRayArgs().needsXRayRt()) {
     CmdArgs.push_back("-whole-archive");
     CmdArgs.push_back(TC.getCompilerRTArgString(Args, "xray", false));
     for (const auto &Mode : TC.getXRayArgs().modeList())
       CmdArgs.push_back(TC.getCompilerRTArgString(Args, Mode, false));

clang/lib/Driver/ToolChains/Darwin.h

public:
 
   /// }
 
 private:
   void AddLinkSanitizerLibArgs(const llvm::opt::ArgList &Args,
                                llvm::opt::ArgStringList &CmdArgs,
                                StringRef Sanitizer,
                                bool shared = true) const;
+
+  void addSyringeRTLibArgs(const llvm::opt::ArgList &Args,
+                           llvm::opt::ArgStringList &CmdArgs,
+                           bool shared = true) const;
 };
 
 } // end namespace toolchains
 } // end namespace driver
 } // end namespace clang
 
 #endif // LLVM_CLANG_LIB_DRIVER_TOOLCHAINS_DARWIN_H

clang/lib/Driver/ToolChains/Darwin.cpp

 #include "clang/Basic/AlignedAllocation.h"
 #include "clang/Basic/ObjCRuntime.h"
 #include "clang/Basic/VirtualFileSystem.h"
 #include "clang/Driver/Compilation.h"
 #include "clang/Driver/Driver.h"
 #include "clang/Driver/DriverDiagnostic.h"
 #include "clang/Driver/Options.h"
 #include "clang/Driver/SanitizerArgs.h"
+#include "clang/Driver/SyringeArgs.h"
 #include "llvm/ADT/StringSwitch.h"
 #include "llvm/Option/ArgList.h"
 #include "llvm/Support/Path.h"
 #include "llvm/Support/ScopedPrinter.h"
 #include "llvm/Support/TargetParser.h"
 #include <cstdlib> // ::getenv
 
 using namespace clang::driver;
void DarwinClang::AddLinkSanitizerLibArgs(const ArgList &Args,
   AddLinkRuntimeLib(Args, CmdArgs,
                     (Twine("libclang_rt.") + Sanitizer + "_" +
                      getOSLibraryNameSuffix() +
                      (Shared ? "_dynamic.dylib" : ".a"))
                         .str(),
                     RLO);
 }
 
+void DarwinClang::addSyringeRTLibArgs(const llvm::opt::ArgList &Args,
+                                      llvm::opt::ArgStringList &CmdArgs,
+                                      bool Shared) const {
+  auto RLO = RuntimeLinkOptions(RLO_AlwaysLink | (Shared ? RLO_AddRPath : 0U));
+  AddLinkRuntimeLib(Args, CmdArgs,
+                    (Twine("libclang_rt.syringe_") + getOSLibraryNameSuffix() +
+                     (Shared ? "_dynamic.dylib" : ".a"))
+                        .str(),
+                    RLO);
+}
+
 ToolChain::RuntimeLibType DarwinClang::GetRuntimeLibType(
     const ArgList &Args) const {
   if (Arg* A = Args.getLastArg(options::OPT_rtlib_EQ)) {
     StringRef Value = A->getValue();
     if (Value != "compiler-rt")
       getDriver().Diag(clang::diag::err_drv_unsupported_rtlib_for_platform)
           << Value << "darwin";
   }
void DarwinClang::AddLinkRuntimeLibArgs(const ArgList &Args,
   // Reject -static-libgcc for now, we can deal with this when and if someone
   // cares. This is useful in situations where someone wants to statically link
   // something like libstdc++, and needs its runtime support routines.
   if (const Arg *A = Args.getLastArg(options::OPT_static_libgcc)) {
     getDriver().Diag(diag::err_drv_unsupported_opt) << A->getAsString(Args);
     return;
   }
 
+  if (getSyringeArgs().needsSyringeRt()) {
+    addSyringeRTLibArgs(Args, CmdArgs, false);
+  }
+
   const SanitizerArgs &Sanitize = getSanitizerArgs();
   if (Sanitize.needsAsanRt())
     AddLinkSanitizerLibArgs(Args, CmdArgs, "asan");
   if (Sanitize.needsLsanRt())
     AddLinkSanitizerLibArgs(Args, CmdArgs, "lsan");
   if (Sanitize.needsUbsanRt())
     AddLinkSanitizerLibArgs(Args, CmdArgs,
                             Sanitize.requiresMinimalRuntime() ? "ubsan_minimal"

clang/lib/Driver/ToolChains/FreeBSD.cpp

void freebsd::Linker::ConstructJob(Compilation &C, const JobAction &JA,
   if (D.isUsingLTO()) {
     assert(!Inputs.empty() && "Must have at least one input.");
     AddGoldPlugin(ToolChain, Args, CmdArgs, Output, Inputs[0],
                   D.getLTOMode() == LTOK_Thin);
   }
 
   bool NeedsSanitizerDeps = addSanitizerRuntimes(ToolChain, Args, CmdArgs);
   bool NeedsXRayDeps = addXRayRuntime(ToolChain, Args, CmdArgs);
+  bool NeedsSyringeDeps = addSyringeRuntime(ToolChain, Args, CmdArgs);
   AddLinkerInputs(ToolChain, Inputs, Args, CmdArgs, JA);
 
   if (!Args.hasArg(options::OPT_nostdlib, options::OPT_nodefaultlibs)) {
     addOpenMPRuntime(CmdArgs, ToolChain, Args);
     if (D.CCCIsCXX()) {
       if (ToolChain.ShouldLinkCXXStdlib(Args))
         ToolChain.AddCXXStdlibLibArgs(Args, CmdArgs);
       if (Args.hasArg(options::OPT_pg))
         CmdArgs.push_back("-lm_p");
       else
         CmdArgs.push_back("-lm");
     }
     if (NeedsSanitizerDeps)
       linkSanitizerRuntimeDeps(ToolChain, CmdArgs);
     if (NeedsXRayDeps)
       linkXRayRuntimeDeps(ToolChain, CmdArgs);
+    if (NeedsSyringeDeps)
+      linkSyringeRuntimeDeps(ToolChain, CmdArgs);
     // FIXME: For some reason GCC passes -lgcc and -lgcc_s before adding
     // the default system libraries. Just mimic this for now.
     if (Args.hasArg(options::OPT_pg))
       CmdArgs.push_back("-lgcc_p");
     else
       CmdArgs.push_back("-lgcc");
     if (Args.hasArg(options::OPT_static)) {
       CmdArgs.push_back("-lgcc_eh");

clang/lib/Driver/ToolChains/Gnu.cpp

AddGoldPlugin(ToolChain, Args, CmdArgs, Output, Inputs[0],
                   D.getLTOMode() == LTOK_Thin);
   }
 
   if (Args.hasArg(options::OPT_Z_Xlinker__no_demangle))
     CmdArgs.push_back("--no-demangle");
 
   bool NeedsSanitizerDeps = addSanitizerRuntimes(ToolChain, Args, CmdArgs);
   bool NeedsXRayDeps = addXRayRuntime(ToolChain, Args, CmdArgs);
+  bool NeedsSyringeDeps = addSyringeRuntime(ToolChain, Args, CmdArgs);
   AddLinkerInputs(ToolChain, Inputs, Args, CmdArgs, JA);
   // The profile runtime also needs access to system libraries.
   getToolChain().addProfileRTLibs(Args, CmdArgs);
 
   if (D.CCCIsCXX() &&
       !Args.hasArg(options::OPT_nostdlib, options::OPT_nodefaultlibs)) {
     if (ToolChain.ShouldLinkCXXStdlib(Args)) {
       bool OnlyLibstdcxxStatic = Args.hasArg(options::OPT_static_libstdcxx) &&
if (!Args.hasArg(options::OPT_nodefaultlibs)) {
         CmdArgs.push_back("--start-group");
 
       if (NeedsSanitizerDeps)
         linkSanitizerRuntimeDeps(ToolChain, CmdArgs);
 
       if (NeedsXRayDeps)
         linkXRayRuntimeDeps(ToolChain, CmdArgs);
 
+      if (NeedsSyringeDeps)
+        linkSyringeRuntimeDeps(ToolChain, CmdArgs);
+
       bool WantPthread = Args.hasArg(options::OPT_pthread) ||
                          Args.hasArg(options::OPT_pthreads);
 
       // FIXME: Only pass GompNeedsRT = true for platforms with libgomp that
       // require librt. Most modern Linux platforms do, but some may not.
       if (addOpenMPRuntime(CmdArgs, ToolChain, Args,
                            JA.isHostOffloading(Action::OFK_OpenMP),
                            /* GompNeedsRT= */ true))

clang/lib/Driver/ToolChains/NetBSD.cpp

void netbsd::Linker::ConstructJob(Compilation &C, const JobAction &JA,
   Args.AddAllArgs(CmdArgs, options::OPT_e);
   Args.AddAllArgs(CmdArgs, options::OPT_s);
   Args.AddAllArgs(CmdArgs, options::OPT_t);
   Args.AddAllArgs(CmdArgs, options::OPT_Z_Flag);
   Args.AddAllArgs(CmdArgs, options::OPT_r);
 
   bool NeedsSanitizerDeps = addSanitizerRuntimes(getToolChain(), Args, CmdArgs);
   bool NeedsXRayDeps = addXRayRuntime(ToolChain, Args, CmdArgs);
+  bool NeedsSyringeDeps = addSyringeRuntime(ToolChain, Args, CmdArgs);
   AddLinkerInputs(getToolChain(), Inputs, Args, CmdArgs, JA);
 
   unsigned Major, Minor, Micro;
   ToolChain.getTriple().getOSVersion(Major, Minor, Micro);
   bool useLibgcc = true;
   if (Major >= 7 || Major == 0) {
     switch (ToolChain.getArch()) {
     case llvm::Triple::aarch64:
if (D.CCCIsCXX()) {
       if (ToolChain.ShouldLinkCXXStdlib(Args))
         ToolChain.AddCXXStdlibLibArgs(Args, CmdArgs);
       CmdArgs.push_back("-lm");
     }
     if (NeedsSanitizerDeps)
       linkSanitizerRuntimeDeps(getToolChain(), CmdArgs);
     if (NeedsXRayDeps)
       linkXRayRuntimeDeps(ToolChain, CmdArgs);
+    if (NeedsSyringeDeps)
+      linkSyringeRuntimeDeps(ToolChain, CmdArgs);
     if (Args.hasArg(options::OPT_pthread))
       CmdArgs.push_back("-lpthread");
     CmdArgs.push_back("-lc");
 
     if (useLibgcc) {
       if (Args.hasArg(options::OPT_static)) {
         // libgcc_eh depends on libc, so resolve as much as possible,
         // pull in any new requirements from libc and then get the rest

clang/lib/Driver/ToolChains/OpenBSD.cpp

void openbsd::Linker::ConstructJob(Compilation &C, const JobAction &JA,
   CmdArgs.push_back(Args.MakeArgString("-L/usr/lib"));
 
   Args.AddAllArgs(CmdArgs, {options::OPT_L, options::OPT_T_Group,
                             options::OPT_e, options::OPT_s, options::OPT_t,
                             options::OPT_Z_Flag, options::OPT_r});
 
   bool NeedsSanitizerDeps = addSanitizerRuntimes(ToolChain, Args, CmdArgs);
   bool NeedsXRayDeps = addXRayRuntime(ToolChain, Args, CmdArgs);
+  bool NeedsSyringeDeps = addSyringeRuntime(ToolChain, Args, CmdArgs);
   AddLinkerInputs(getToolChain(), Inputs, Args, CmdArgs, JA);
 
   if (!Args.hasArg(options::OPT_nostdlib, options::OPT_nodefaultlibs)) {
     if (D.CCCIsCXX()) {
       if (getToolChain().ShouldLinkCXXStdlib(Args))
         getToolChain().AddCXXStdlibLibArgs(Args, CmdArgs);
       if (Args.hasArg(options::OPT_pg))
         CmdArgs.push_back("-lm_p");
       else
         CmdArgs.push_back("-lm");
     }
     if (NeedsSanitizerDeps) {
       CmdArgs.push_back(ToolChain.getCompilerRTArgString(Args, "builtins", false));
       linkSanitizerRuntimeDeps(ToolChain, CmdArgs);
     }
     if (NeedsXRayDeps) {
       CmdArgs.push_back(ToolChain.getCompilerRTArgString(Args, "builtins", false));
       linkXRayRuntimeDeps(ToolChain, CmdArgs);
     }
+    if (NeedsSyringeDeps) {
+      CmdArgs.push_back(ToolChain.getCompilerRTArgString(Args, "builtins", false));
+      linkSyringeRuntimeDeps(ToolChain, CmdArgs);
+    }
     // FIXME: For some reason GCC passes -lgcc before adding
     // the default system libraries. Just mimic this for now.
     CmdArgs.push_back("-lgcc");
 
     if (Args.hasArg(options::OPT_pthread)) {
       if (!Args.hasArg(options::OPT_shared) && Args.hasArg(options::OPT_pg))
         CmdArgs.push_back("-lpthread_p");
       else

clang/lib/Frontend/CompilerInvocation.cpp

static bool ParseCodeGenArgs(CodeGenOptions &Opts, ArgList &Args, InputKind IK,
   }
 
   Opts.PreserveVec3Type = Args.hasArg(OPT_fpreserve_vec3_type);
   Opts.InstrumentFunctions = Args.hasArg(OPT_finstrument_functions);
   Opts.InstrumentFunctionsAfterInlining =
       Args.hasArg(OPT_finstrument_functions_after_inlining);
   Opts.InstrumentFunctionEntryBare =
       Args.hasArg(OPT_finstrument_function_entry_bare);
-
   Opts.XRayInstrumentFunctions =
       Args.hasArg(OPT_fxray_instrument);
   Opts.XRayAlwaysEmitCustomEvents =
       Args.hasArg(OPT_fxray_always_emit_customevents);
   Opts.XRayAlwaysEmitTypedEvents =
       Args.hasArg(OPT_fxray_always_emit_typedevents);
   Opts.XRayInstructionThreshold =
       getLastArgIntValue(Args, OPT_fxray_instruction_threshold_EQ, 200, Diags);
+  Opts.SyringeInjectBehaviors = Args.hasArg(OPT_fsyringe);
 
   auto XRayInstrBundles =
       Args.getAllArgValues(OPT_fxray_instrumentation_bundle);
   if (XRayInstrBundles.empty())
     Opts.XRayInstrumentationBundle.Mask = XRayInstrKind::All;
   else
     for (const auto &A : XRayInstrBundles)
       parseXRayInstrumentationBundle("-fxray-instrumentation-bundle=", A, Args,
#include "clang/Frontend/LangStandards.def"
 
   // -fxray-{always,never}-instrument= filenames.
   Opts.XRayAlwaysInstrumentFiles =
       Args.getAllArgValues(OPT_fxray_always_instrument);
   Opts.XRayNeverInstrumentFiles =
       Args.getAllArgValues(OPT_fxray_never_instrument);
   Opts.XRayAttrListFiles = Args.getAllArgValues(OPT_fxray_attr_list);
 
+  // -fsyringe
+  Opts.SyringeInject = Args.hasArg(OPT_fsyringe, OPT_fnosyringe, false);
+  Opts.SyringeConfigFiles = Args.getAllArgValues(OPT_fsyringe_config_file);
+
   // -fforce-emit-vtables
   Opts.ForceEmitVTables = Args.hasArg(OPT_fforce_emit_vtables);
 
   // -fallow-editor-placeholders
   Opts.AllowEditorPlaceholders = Args.hasArg(OPT_fallow_editor_placeholders);
 
   if (Arg *A = Args.getLastArg(OPT_fclang_abi_compat_EQ)) {
     Opts.setClangABICompat(LangOptions::ClangABI::Latest);

clang/lib/Sema/SemaDeclAttr.cpp

static void handleSimpleAttributeWithExclusions(Sema &S, Decl *D,
                                                 const ParsedAttr &AL) {
   if (checkAttrMutualExclusion<IncompatibleAttrType>(S, D, AL.getRange(),
                                                      AL.getName()))
     return;
   handleSimpleAttributeWithExclusions<AttrType, IncompatibleAttrTypes...>(S, D,
                                                                           AL);
 }
 
+/// Applies the Syringe Payload Attribute and sets the payload target string
+static void handleSyringePayloadAttr(Sema &S, Decl *D, const ParsedAttr &AL) {
+  StringRef Model;
+  SourceLocation LiteralLoc;
+  if (!S.checkStringLiteralArgumentAttr(AL, 0, Model, &LiteralLoc))
+    return;
+
+  D->addAttr(::new (S.Context) SyringePayloadAttr(
+      AL.getRange(), S.Context, Model, AL.getAttributeSpellingListIndex()));
+}
+
 /// Check if the passed-in expression is of type int or bool.
 static bool isIntOrBool(Expr *Exp) {
   QualType QT = Exp->getType();
   return QT->isBooleanType() || QT->isIntegerType();
 }
 
 
 // Check to see if the type is a smart pointer of some kind.  We assume
case ParsedAttr::AT_RenderScriptKernel:
     break;
   // XRay attributes.
   case ParsedAttr::AT_XRayInstrument:
     handleSimpleAttribute<XRayInstrumentAttr>(S, D, AL);
     break;
   case ParsedAttr::AT_XRayLogArgs:
     handleXRayLogArgsAttr(S, D, AL);
     break;
+  case ParsedAttr::AT_SyringeInjectionSite:
+    handleSimpleAttribute<SyringeInjectionSiteAttr>(S, D, AL);
+    break;
+  case ParsedAttr::AT_SyringePayload:
+    handleSyringePayloadAttr(S, D, AL);
+    break;
   }
 }
 
 /// ProcessDeclAttributeList - Apply all the decl attributes in the specified
 /// attribute list to the specified decl, ignoring any type attributes.
 void Sema::ProcessDeclAttributeList(Scope *S, Decl *D,
                                     const ParsedAttributesView &AttrList,
                                     bool IncludeCXX11Attributes) {

clang/test/CodeGen/syringe-imbue.cpp

+// RUN: echo "- filename: %s"    > %t.syringe-imbue.yml
+// RUN: echo "  targets:"                       >> %t.syringe-imbue.yml
+// RUN: echo "  - name: _Z3foov"                >> %t.syringe-imbue.yml
+// RUN: echo "    enable: ALWAYS"               >> %t.syringe-imbue.yml
+// RUN: echo "    disable: NEVER"               >> %t.syringe-imbue.yml
+// RUN: echo "  payloads:"                      >> %t.syringe-imbue.yml
+// RUN: echo "  - name: _Z3barv"                >> %t.syringe-imbue.yml
+// RUN: echo "    target: _Z3foov"              >> %t.syringe-imbue.yml
+// RUN: %clang -fsyringe -fsyringe-config-file=%t.syringe-imbue.yml \
+// RUN:     -x c++ -std=c++11 -emit-llvm -S  %s  -o - | FileCheck %s
+
+void foo(){}
+
+void bar(){}
+
+// CHECK: define dso_local void @_Z3foov() #[[FOO:[0-9]+]] {
+// CHECK: define dso_local void @_Z3barv() #[[BAR:[0-9]+]] {
+
+// CHECK: attributes #[[FOO]] = {{.*}}"syringe-injection-site"{{.*}}
+// CHECK: attributes #[[BAR]] = {{.*}} "syringe-payload" {{.*}}"syringe-target-function"="_Z3foov"

clang/test/CodeGen/syringe-injection-site.cpp

+// RUN: %clang_cc1 %s -fsyringe -std=c++11 -x c++ -emit-llvm -o - -triple x86_64-unknown-linux-gnu  | FileCheck %s
+
+// CHECK: @"_Z3fooi$syringe_bool" = global i8 0
+// CHECK: @llvm.global_ctors = appending global [1 x { i32, void ()*, i8* }]
+
+// CHECK: @"_Z3fooi$detour_impl" = alias void (i32), void (i32)* @_Z3bari
+
+// Make sure that the LLVM attribute for Syringe-annotated functions do show up.
+[[clang::syringe_injection_site]] void foo(int a) {
+// CHECK: define void @_Z3fooi(i32 %a) #0
+// CHECK-DAG: %"_Z3fooi$syringe_bool" = load i8, i8* @"_Z3fooi$syringe_bool"
+// CHECK-DAG: [[REG2:%[0-9]+]] = trunc i8 %"_Z3fooi$syringe_bool" to i1
+// CHECK: br i1 [[REG2]], label %syringe_inject, label %entry
+// CHECK:  tail call void @_Z3bari(i32 %a)
+// CHECK-NEXT: ret void
+};
+
+[[clang::syringe_payload("_Z3fooi")]] void bar(int a) {
+// CHECK: define void @_Z3bari(i32 %a) #1 {
+};
+
+
+// CHECK: define internal void @"syringe.module_ctor{{.*}}syringe-injection-site.cpp"()
+// CHECK-NEXT: call void @__syringe_register(void (i32)* @_Z3fooi, i8* @"_Z3fooi$syringe_bool")
+// CHECK-NEXT: ret void
+
+// CHECK: declare void @__syringe_register(void (i32)*, i8*)
+
+
+// CHECK: #0 = {{.*}}"syringe-injection-site"{{.*}}
+// CHECK: #1 = {{.*}}"syringe-payload"{{.*}}"syringe-target-function"="_Z3fooi"

clang/test/CodeGen/syringe-inline-function.cpp

+
+// RUN: %clang_cc1 %s -fsyringe -std=c++11 -x c++ -emit-llvm -o - -triple x86_64-unknown-linux-gnu | FileCheck %s
+
+[[clang::syringe_injection_site]] int __attribute((always_inline)) foo(int a) {
+  // CHECK: %"_Z3fooi$syringe_bool" = load i8, i8* @"_Z3fooi$syringe_bool"
+  // CHECK_NEXT: %0 = trunc i8 %"_Z3fooi$syringe_bool" to i1
+  // CHECK_NEXT: br i1 %0, label %syringe_inject, label %entry
+  return a + 1;
+}
+
+[[clang::syringe_payload("_Z3fooi")]] int bar(int a) {
+  // CHECK: define i32 @_Z3bari(i32 %a) #1 {
+  return a - 1;
+}
+
+// CHECK: define i32 @main()
+// CHECK: entry:
+// CHECK:   %retval = alloca i32, align 4
+// CHECK:   %j = alloca i32, align 4
+// CHECK:   store i32 0, i32* %retval, align 4
+// CHECK:   %savedstack = call i8* @llvm.stacksave()
+// CHECK:   %"_Z3fooi$syringe_bool.i" = load i8, i8* @"_Z3fooi$syringe_bool"
+// CHECK:   %0 = trunc i8 %"_Z3fooi$syringe_bool.i" to i1
+// CHECK:   br i1 %0, label %syringe_inject.i, label %entry.i
+// CHECK: entry.i:
+// CHECK:   %a.addr.i = alloca i32, align 4
+// CHECK:   store i32 1, i32* %a.addr.i, align 4
+// CHECK:   %1 = load i32, i32* %a.addr.i, align 4
+// CHECK:   %add.i = add nsw i32 %1, 1
+// CHECK:   call void @llvm.stackrestore(i8* %savedstack)
+// CHECK:   br label %_Z3fooi.exit
+// CHECK: syringe_inject.i:
+// CHECK:   %2 = call i32 @_Z3bari(i32 1) #3
+// CHECK:   call void @llvm.stackrestore(i8* %savedstack)
+// CHECK:   br label %_Z3fooi.exit
+// CHECK: _Z3fooi.exit:
+// CHECK:   %call1 = phi i32 [ %add.i, %entry.i ], [ %2, %syringe_inject.i ]
+// CHECK:   store i32 %call1, i32* %j, align 4
+// CHECK:   %3 = load i32, i32* %j, align 4
+// CHECK:   ret i32 %3
+
+
+
+int main() {
+  auto j = foo(1);
+  return j;
+}
+///usr/local/google/home/paulkirth/workspace/llvm-dev/build/bin/clang -cc1 -internal-isystem /usr/local/google/home/paulkirth/workspace/llvm-dev/build/lib/clang/8.0.0/include -nostdsysteminc /usr/local/google/home/paulkirth/workspace/llvm-dev/clang/test/CodeGen/syringe-inline-function.cpp -fsyringe -std=c++11 -x c++ -emit-llvm -o - -triple x86_64-unknown-linux-gnu

clang/test/Sema/syringe-injection-site-attr.c

+// RUN: %clang_cc1 %s -verify -fsyntax-only -std=c11
+void foo() __attribute__((syringe_injection_site)) ;
+
+struct __attribute__((syringe_injection_site)) a { int x; }; // expected-warning {{'syringe_injection_site' attribute only applies to functions and Objective-C methods}}
+
+void bar() __attribute__((syringe_injection_site("not-supported"))); // expected-error {{'syringe_injection_site' attribute takes no arguments}}

clang/test/Sema/syringe-injection-site-attr.cpp

+// RUN: %clang_cc1 %s -verify -fsyntax-only -std=c++11 -x c++
+void foo [[clang::syringe_injection_site]] ();
+
+struct [[clang::syringe_injection_site]] a { int x; }; // expected-warning {{'syringe_injection_site' attribute only applies to functions and Objective-C methods}}
+
+class b {
+ void c [[clang::syringe_injection_site]] ();
+};
+
+void baz [[clang::syringe_injection_site("not-supported")]] (); // expected-error {{'syringe_injection_site' attribute takes no arguments}}

clang/test/Sema/syringe-payload-attr.c

+// RUN: %clang_cc1 %s -verify -fsyntax-only -std=c11
+void foo() __attribute__((syringe_payload)) ; // expected-error {{'syringe_payload' attribute takes one argument}}
+
+struct __attribute__((syringe_payload)) a { int x; }; // expected-warning {{'syringe_payload' attribute only applies to functions and Objective-C methods}}
+
+void bar() __attribute__((syringe_payload("foo"))); 

clang/test/Sema/syringe-payload-attr.cpp

+// RUN: %clang_cc1 %s -verify -fsyntax-only -std=c++11 -x c++
+void foo [[clang::syringe_payload]] ();  // expected-error {{'syringe_payload' attribute takes one argument}}
+
+struct [[clang::syringe_payload]] a { int x; }; // expected-warning {{'syringe_payload' attribute only applies to functions and Objective-C methods}}
+
+class b {
+ void c [[clang::syringe_payload("_Z3foov")]] ();
+};
+
+void baz [[clang::syringe_payload("foo")]] (); 

compiler-rt/CMakeLists.txt

 include(CompilerRTUtils)
 
 option(COMPILER_RT_BUILD_BUILTINS "Build builtins" ON)
 mark_as_advanced(COMPILER_RT_BUILD_BUILTINS)
 option(COMPILER_RT_BUILD_SANITIZERS "Build sanitizers" ON)
 mark_as_advanced(COMPILER_RT_BUILD_SANITIZERS)
 option(COMPILER_RT_BUILD_XRAY "Build xray" ON)
 mark_as_advanced(COMPILER_RT_BUILD_XRAY)
+option(COMPILER_RT_BUILD_SYRINGE "Build syringe" ON)
+mark_as_advanced(COMPILER_RT_BUILD_SYRINGE)
 option(COMPILER_RT_BUILD_LIBFUZZER "Build libFuzzer" ON)
 mark_as_advanced(COMPILER_RT_BUILD_LIBFUZZER)
 option(COMPILER_RT_BUILD_PROFILE "Build profile runtime" ON)
 mark_as_advanced(COMPILER_RT_BUILD_PROFILE)
 option(COMPILER_RT_BUILD_XRAY_NO_PREINIT "Build xray with no preinit patching" OFF)
 mark_as_advanced(COMPILER_RT_BUILD_XRAY_NO_PREINIT)
 
 set(COMPILER_RT_ASAN_SHADOW_SCALE ""

compiler-rt/cmake/builtin-config-ix.cmake

 include(BuiltinTests)
 include(CheckCSourceCompiles)
 
 # Make all the tests only check the compiler
 set(TEST_COMPILE_ONLY On)
 
 # Check host compiler support for certain flags
 builtin_check_c_compiler_flag(-fPIC                 COMPILER_RT_HAS_FPIC_FLAG)
 builtin_check_c_compiler_flag(-fPIE                 COMPILER_RT_HAS_FPIE_FLAG)
 builtin_check_c_compiler_flag(-fno-builtin          COMPILER_RT_HAS_FNO_BUILTIN_FLAG)
 builtin_check_c_compiler_flag(-std=c11              COMPILER_RT_HAS_STD_C11_FLAG)
 builtin_check_c_compiler_flag(-fvisibility=hidden   COMPILER_RT_HAS_VISIBILITY_HIDDEN_FLAG)
 builtin_check_c_compiler_flag(-fomit-frame-pointer  COMPILER_RT_HAS_OMIT_FRAME_POINTER_FLAG)
 builtin_check_c_compiler_flag(-ffreestanding        COMPILER_RT_HAS_FREESTANDING_FLAG)
 builtin_check_c_compiler_flag(-fxray-instrument     COMPILER_RT_HAS_XRAY_COMPILER_FLAG)
+builtin_check_c_compiler_flag(-fsyringe             COMPILER_RT_HAS_SYRINGE_COMPILER_FLAG)
 
 builtin_check_c_compiler_source(COMPILER_RT_HAS_ATOMIC_KEYWORD
 "
 int foo(int x, int y) {
  _Atomic int result = x * y;
  return result;
 }
 ")

compiler-rt/cmake/config-ix.cmake

 set(ALL_CFI_SUPPORTED_ARCH ${X86} ${X86_64} ${ARM32} ${ARM64} ${MIPS64})
 set(ALL_ESAN_SUPPORTED_ARCH ${X86_64} ${MIPS64})
 set(ALL_SCUDO_SUPPORTED_ARCH ${X86} ${X86_64} ${ARM32} ${ARM64} ${MIPS32} ${MIPS64} ${PPC64})
 if(APPLE)
 set(ALL_XRAY_SUPPORTED_ARCH ${X86_64})
 else()
 set(ALL_XRAY_SUPPORTED_ARCH ${X86_64} ${ARM32} ${ARM64} ${MIPS32} ${MIPS64} powerpc64le)
 endif()
+if(APPLE)
+set(ALL_SYRINGE_SUPPORTED_ARCH ${X86_64})
+else()
+set(ALL_SYRINGE_SUPPORTED_ARCH ${X86_64} ${ARM32} ${ARM64} ${MIPS32} ${MIPS64} powerpc64le)
+endif()
 set(ALL_SHADOWCALLSTACK_SUPPORTED_ARCH ${X86_64} ${ARM64})
 
 if(APPLE)
   include(CompilerRTDarwinUtils)
 
   find_darwin_sdk_dir(DARWIN_osx_SYSROOT macosx)
   find_darwin_sdk_dir(DARWIN_iossim_SYSROOT iphonesimulator)
   find_darwin_sdk_dir(DARWIN_ios_SYSROOT iphoneos)
if(APPLE)
   endif()
 
   # Note: In order to target x86_64h on OS X the minimum deployment target must
   # be 10.8 or higher.
   set(SANITIZER_COMMON_SUPPORTED_OS osx)
   set(PROFILE_SUPPORTED_OS osx)
   set(TSAN_SUPPORTED_OS osx)
   set(XRAY_SUPPORTED_OS osx)
+  set(SYRINGE_SUPPORTED_OS osx)
   if(NOT SANITIZER_MIN_OSX_VERSION)
     string(REGEX MATCH "-mmacosx-version-min=([.0-9]+)"
            MACOSX_VERSION_MIN_FLAG "${CMAKE_CXX_FLAGS}")
     if(MACOSX_VERSION_MIN_FLAG)
       set(SANITIZER_MIN_OSX_VERSION "${CMAKE_MATCH_1}")
     elseif(CMAKE_OSX_DEPLOYMENT_TARGET)
       set(SANITIZER_MIN_OSX_VERSION ${CMAKE_OSX_DEPLOYMENT_TARGET})
     else()
list_intersect(SCUDO_SUPPORTED_ARCH
     ALL_SCUDO_SUPPORTED_ARCH
     SANITIZER_COMMON_SUPPORTED_ARCH)
   list_intersect(FUZZER_SUPPORTED_ARCH
     ALL_FUZZER_SUPPORTED_ARCH
     SANITIZER_COMMON_SUPPORTED_ARCH)
   list_intersect(XRAY_SUPPORTED_ARCH
     ALL_XRAY_SUPPORTED_ARCH
     SANITIZER_COMMON_SUPPORTED_ARCH)
+  list_intersect(SYRINGE_SUPPORTED_ARCH
+    ALL_SYRINGE_SUPPORTED_ARCH
+    SANITIZER_COMMON_SUPPORTED_ARCH)
   list_intersect(SHADOWCALLSTACK_SUPPORTED_ARCH
     ALL_SHADOWCALLSTACK_SUPPORTED_ARCH
     SANITIZER_COMMON_SUPPORTED_ARCH)
 
 else()
   # Architectures supported by compiler-rt libraries.
   filter_available_targets(SANITIZER_COMMON_SUPPORTED_ARCH
     ${ALL_SANITIZER_COMMON_SUPPORTED_ARCH})
else()
   filter_available_targets(TSAN_SUPPORTED_ARCH ${ALL_TSAN_SUPPORTED_ARCH})
   filter_available_targets(UBSAN_SUPPORTED_ARCH ${ALL_UBSAN_SUPPORTED_ARCH})
   filter_available_targets(SAFESTACK_SUPPORTED_ARCH
     ${ALL_SAFESTACK_SUPPORTED_ARCH})
   filter_available_targets(CFI_SUPPORTED_ARCH ${ALL_CFI_SUPPORTED_ARCH})
   filter_available_targets(ESAN_SUPPORTED_ARCH ${ALL_ESAN_SUPPORTED_ARCH})
   filter_available_targets(SCUDO_SUPPORTED_ARCH ${ALL_SCUDO_SUPPORTED_ARCH})
   filter_available_targets(XRAY_SUPPORTED_ARCH ${ALL_XRAY_SUPPORTED_ARCH})
+  filter_available_targets(SYRINGE_SUPPORTED_ARCH ${ALL_SYRINGE_SUPPORTED_ARCH})
   filter_available_targets(SHADOWCALLSTACK_SUPPORTED_ARCH
     ${ALL_SHADOWCALLSTACK_SUPPORTED_ARCH})
 endif()
 
 if (MSVC)
   # See if the DIA SDK is available and usable.
   set(MSVC_DIA_SDK_DIR "$ENV{VSINSTALLDIR}DIA SDK")
   if (IS_DIRECTORY ${MSVC_DIA_SDK_DIR})

 
 if (COMPILER_RT_HAS_SANITIZER_COMMON AND XRAY_SUPPORTED_ARCH AND
     OS_NAME MATCHES "Darwin|Linux|FreeBSD|NetBSD|OpenBSD")
   set(COMPILER_RT_HAS_XRAY TRUE)
 else()
   set(COMPILER_RT_HAS_XRAY FALSE)
 endif()
 
+if (COMPILER_RT_HAS_SANITIZER_COMMON AND SYRINGE_SUPPORTED_ARCH AND
+    OS_NAME MATCHES "Darwin|Linux|FreeBSD|NetBSD|OpenBSD")
+  set(COMPILER_RT_HAS_SYRINGE TRUE)
+else()
+  set(COMPILER_RT_HAS_SYRINGE FALSE)
+endif()
+
 if (COMPILER_RT_HAS_SANITIZER_COMMON AND FUZZER_SUPPORTED_ARCH AND
     OS_NAME MATCHES "Android|Darwin|Linux|NetBSD|FreeBSD|OpenBSD|Fuchsia")
   set(COMPILER_RT_HAS_FUZZER TRUE)
 else()
   set(COMPILER_RT_HAS_FUZZER FALSE)
 endif()
 
 if (COMPILER_RT_HAS_SANITIZER_COMMON AND SHADOWCALLSTACK_SUPPORTED_ARCH AND
     OS_NAME MATCHES "Linux|Android")
   set(COMPILER_RT_HAS_SHADOWCALLSTACK TRUE)
 else()
   set(COMPILER_RT_HAS_SHADOWCALLSTACK FALSE)
 endif()

compiler-rt/include/CMakeLists.txt

 endif(COMPILER_RT_BUILD_SANITIZERS)
 
 if (COMPILER_RT_BUILD_XRAY)
   set(XRAY_HEADERS
     xray/xray_interface.h
     xray/xray_log_interface.h)
 endif(COMPILER_RT_BUILD_XRAY)
 
+if (COMPILER_RT_BUILD_SYRINGE)
+  set(SYRINGE_HEADERS
+    syringe/injection_data.h
+    syringe/syringe_rt.h
+    syringe/syringe_rt_cxx.h
+    )
+endif(COMPILER_RT_BUILD_SYRINGE)
+
+
 set(COMPILER_RT_HEADERS
   ${SANITIZER_HEADERS}
-  ${XRAY_HEADERS})
+  ${XRAY_HEADERS}
+  ${SYRINGE_HEADERS}
+  )
 
 set(output_dir ${COMPILER_RT_OUTPUT_DIR}/include)
 
 # Copy compiler-rt headers to the build tree.
 set(out_files)
 foreach( f ${COMPILER_RT_HEADERS} )
   set( src ${CMAKE_CURRENT_SOURCE_DIR}/${f} )
   set( dst ${output_dir}/${f} )
install(FILES ${SANITIZER_HEADERS}
   COMPONENT compiler-rt-headers
   PERMISSIONS OWNER_READ OWNER_WRITE GROUP_READ WORLD_READ
   DESTINATION ${COMPILER_RT_INSTALL_PATH}/include/sanitizer)
 # Install xray headers.
 install(FILES ${XRAY_HEADERS}
   COMPONENT compiler-rt-headers
   PERMISSIONS OWNER_READ OWNER_WRITE GROUP_READ WORLD_READ
   DESTINATION ${COMPILER_RT_INSTALL_PATH}/include/xray)
+# Install syringe headers.
+install(FILES ${SYRINGE_HEADERS}
+  COMPONENT compiler-rt-headers
+  PERMISSIONS OWNER_READ OWNER_WRITE GROUP_READ WORLD_READ
+  DESTINATION ${COMPILER_RT_INSTALL_PATH}/include/syringe)
+
 
 if (NOT CMAKE_CONFIGURATION_TYPES) # don't add this for IDEs.
   add_custom_target(install-compiler-rt-headers
                     DEPENDS compiler-rt-headers
                     COMMAND "${CMAKE_COMMAND}"
                             -DCMAKE_INSTALL_COMPONENT="compiler-rt-headers"
                             -P "${CMAKE_BINARY_DIR}/cmake_install.cmake"
                     USES_TERMINAL)
   add_custom_target(install-compiler-rt-headers-stripped
                     DEPENDS compiler-rt-headers
                     COMMAND "${CMAKE_COMMAND}"
                             -DCMAKE_INSTALL_COMPONENT="compiler-rt-headers"
                             -DCMAKE_INSTALL_DO_STRIP=1
                             -P "${CMAKE_BINARY_DIR}/cmake_install.cmake"
                     USES_TERMINAL)
 endif()

compiler-rt/include/syringe/injection_data.h

+//===- injection_data.h -----------------------------------------*- C++ -*-===//
+//
+//                     The LLVM Compiler Infrastructure
+//
+// This file is distributed under the University of Illinois Open Source
+// License. See LICENSE.TXT for details.
+//
+//===----------------------------------------------------------------------===//
+//
+// This file is a part of Syringe, a dynamic behavior injection system.
+//
+// Data structures used by the syringe runtime.
+//===----------------------------------------------------------------------===//
+
+#ifndef SYRINGE_INJECTION_DATA_H
+#define SYRINGE_INJECTION_DATA_H 1
+
+#include <stddef.h>
+
+// Outside of namespace for C compatibility
+typedef void (*fptr_t)(void);
+
+namespace __syringe {
+
+// metadata structure for holding implementation pointer data
+struct InjectionData {
+  fptr_t OrigFunc;
+  fptr_t StubImpl;
+  fptr_t DetourFunc;
+  fptr_t *ImplPtr;
+  template <typename T, typename R>
+  InjectionData(T OrigFunction, T StubImplementation, T DetourFunction,
+                R ImplPointer)
+      : OrigFunc((fptr_t)OrigFunction), StubImpl((fptr_t)StubImplementation),
+        DetourFunc((fptr_t)DetourFunction), ImplPtr((fptr_t *)ImplPointer) {}
+};
+
+// metadata structure for accessing the syringe boolean flag
+struct SimpleInjectionData {
+  fptr_t OrigFunc; // pointer to syringe site
+  bool *InjectionEnabled; // pointer to runtime controled boolead (controls injection)
+
+  template <typename T>
+  SimpleInjectionData(T OrigFunction, bool *InjectionEnabled)
+      : OrigFunc((fptr_t)OrigFunction), InjectionEnabled(InjectionEnabled) {}
+};
+
+// a struct describing class method pointers for itanium ABI
+// See Itanium ABI for more details
+struct mPtrTy {
+  ptrdiff_t ptr; // the pointer value
+                 // for non-virtual methods, this is the
+                 // actual pointer, otherwise its an index into the vtable
+  ptrdiff_t adj; // the adjustment to the pointer
+};
+
+} // namespace __syringe
+#endif // SYRINGE_INJECTION_DATA_H

compiler-rt/include/syringe/syringe_rt.h

+//===- syringe_rt.h -----------------------------------------*- C++ -*-===//
+//
+//                     The LLVM Compiler Infrastructure
+//
+// This file is distributed under the University of Illinois Open Source
+// License. See LICENSE.TXT for details.
+//
+//===----------------------------------------------------------------------===//
+//
+// This file is a part of Syringe, a dynamic behavior injection system.
+//
+// APIs for using the Syringe Runtime.
+//===----------------------------------------------------------------------===//
+
+#ifndef SYRINGE_SYRINGE_RT_H
+#define SYRINGE_SYRINGE_RT_H 1
+
+#include <stdbool.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+// typedef for generic function pointer type to use when casting
+// or manipulating funciton pointers in the runtime.
+typedef void (*fptr_t)(void);
+
+// toggles the current state of injection
+bool toggleImpl(fptr_t OrigFunc);
+
+// prints the addresses of syringe metadata, and their values
+void printSyringeData();
+
+// registers metadata for initialization in the syringe runtime
+void __syringe_register(void *OrigFunc, bool *InjecitonEnabled);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif // SYRINGE_SYRINGE_RT_H

compiler-rt/include/syringe/syringe_rt_cxx.h

+//===- syringe_rt_cxx.h -----------------------------------------*- C++ -*-===//
+//
+//                     The LLVM Compiler Infrastructure
+//
+// This file is distributed under the University of Illinois Open Source
+// License. See LICENSE.TXT for details.
+//
+//===----------------------------------------------------------------------===//
+//
+// This file is a part of Syringe, a dynamic behavior injection system.
+//
+// APIs for using the Syringe Runtime.
+//===----------------------------------------------------------------------===//
+
+#ifndef SYRINGE_SYRINGE_RT_CXX_H
+#define SYRINGE_SYRINGE_RT_CXX_H 1
+
+#include "syringe/injection_data.h"
+
+#include <algorithm>
+#include <cstdint>
+#include <type_traits>
+#include <vector>
+
+namespace __syringe {
+
+/// A container for the Syringe runtime data
+extern std::vector<SimpleInjectionData> GlobalSyringeData;
+
+/// Use a untion to effectivly cast between member function pointers
+/// and normal funciton pointers.
+/// On Itanium a non-virutal member function pointer is the first 8 bytes
+/// of the member function pointer. We can (ab)use that to get its address.
+template <typename T> fptr_t convertMemberPtr(T foo) {
+  union {
+    T mfunc;
+    fptr_t addr;
+  };
+  mfunc = foo;
+  return addr;
+}
+
+/// Look up the metadata associated with target
+/// @target pointer to the target injection site
+SimpleInjectionData *findImplPointerImpl(fptr_t target);
+
+/// look up the memtadata for OrigFunc
+/// @OrigFunc pointer to the target injection site
+/// We use a dirty hack with a union to enable casting between
+/// pointer types (like class method pointers) that are normally not allowed.
+template <typename T> SimpleInjectionData *findImplPointer(T OrigFunc) {
+  fptr_t target;
+  target = convertMemberPtr(OrigFunc);
+
+  return findImplPointerImpl(target);
+}
+
+/// register the metadata about OrigFunc in our global metadata
+/// Creates a tuple binding the address of OrigFunc to its injeciton flag
+/// @OrigFunc pointer to the target function
+/// @InjectionEnabled address the OrigFunc's syringe boolean
+template <typename T>
+void registerInjection(T OrigFunc, bool *InjectionEnabled) {
+  assert(findImplPointer(OrigFunc) == nullptr &&
+         "Cannot register two payloads for the same injection site!");
+  GlobalSyringeData.emplace_back(OrigFunc, InjectionEnabled);
+}
+
+/// Changes if the injected behavior is active or inactive
+/// @OrigFunc pointer to the Syringe Site
+/// @return true if state changed, false when pointer not found
+template <typename T> bool toggleImplPtr(T OrigFunc) {
+  auto Ptr = findImplPointer(OrigFunc);
+  if (!Ptr) {
+    return false;
+  }
+
+  *Ptr->InjectionEnabled = !(*Ptr->InjectionEnabled);
+  return true;
+}
+
+/// Toggle virutal function implementation
+/// Currently only works for Itanium ABI
+/// Relies on horrible ABI hacks to get the address of virtual methods
+/// @OrigFunc pointer to the member function
+/// @Instance address of an instance of the class in question
+template <typename T, typename R>
+bool toggleVirtualImpl(T OrigFunc, R Instance) {
+  // use char * to represent vtbl address for easy indexing
+  typedef char *vtblptr_t;
+
+  // convert the OrigFunc to a pointer to a member function pointer type
+  mPtrTy *MemberFnPtrPtr = (mPtrTy *)&OrigFunc;
+
+  // get a pointer to the vtbl pointer for the passed in instance
+  vtblptr_t *PtrToVtblPtr = (vtblptr_t *)Instance;
+
+  // on itanium the vtable pointer is the at the instance's address
+  auto VtblPtr = *PtrToVtblPtr;
+
+  // TODO: do we need the adjustment?
+  // calculate the offset of into the vtable for the target function
+  auto FnOffset = MemberFnPtrPtr->ptr + MemberFnPtrPtr->adj - 1;
+  auto TargetAddr =
+      static_cast<void **>(static_cast<void *>(VtblPtr + FnOffset));
+
+  return toggleImplPtr(*TargetAddr);
+}
+
+/// Gets the address of a member function
+template <typename T> fptr_t lookupMemberFunctionAddr(T FPtr) {
+  assert(FPtr != nullptr &&
+         "Syringe Member Function Lookup was passed a nullptr!");
+  mPtrTy *j = (mPtrTy *)FPtr;
+  return (fptr_t)(j->ptr);
+}
+
+} // end namespace __syringe
+
+#endif // SYRINGE_SYRINGE_RT_H

compiler-rt/lib/CMakeLists.txt

 # First, add the subdirectories which contain feature-based runtime libraries
 # and several convenience helper libraries.
 
 include(AddCompilerRT)
 include(SanitizerUtils)
 
 # Hoist the building of sanitizer_common on whether we're building either the
 # sanitizers or xray (or both).
 #
 #TODO: Refactor sanitizer_common into smaller pieces (e.g. flag parsing, utils).
 if (COMPILER_RT_HAS_SANITIZER_COMMON AND
-    (COMPILER_RT_BUILD_SANITIZERS OR COMPILER_RT_BUILD_XRAY))
+        (COMPILER_RT_BUILD_SANITIZERS OR COMPILER_RT_BUILD_XRAY
+        OR COMPILER_RT_BUILD_SYRINGE))
   add_subdirectory(sanitizer_common)
 endif()
 
 if(COMPILER_RT_BUILD_BUILTINS)
   add_subdirectory(builtins)
 endif()
 
 function(compiler_rt_build_runtime runtime)

 if(COMPILER_RT_BUILD_PROFILE AND COMPILER_RT_HAS_PROFILE)
   compiler_rt_build_runtime(profile)
 endif()
 
 if(COMPILER_RT_BUILD_XRAY)
   compiler_rt_build_runtime(xray)
 endif()
 
+if(COMPILER_RT_BUILD_SYRINGE)
+  compiler_rt_build_runtime(syringe)
+endif()
+
 if(COMPILER_RT_BUILD_LIBFUZZER)
   compiler_rt_build_runtime(fuzzer)
 endif()

compiler-rt/lib/syringe/CMakeLists.txt

+# Build for all components of the Syinge runtime support library.
+
+# Syinge runtime library implementation files.
+set(SYRINGE_SOURCES
+    syringe_rt.cpp)
+
+set(SYRINGE_HEADERS
+  #syringe_rt.h
+  #syringe_rt_cxx.h
+  )
+
+# Create list of all source files for
+# consumption by tests.
+set(SYRINGE_ALL_SOURCE_FILES
+  ${SYRINGE_SOURCES}
+  ${SYRINGE_HEADERS}
+)
+list(REMOVE_DUPLICATES SYRINGE_ALL_SOURCE_FILES)
+# Make list that uses absolute paths
+set(SYRINGE_ALL_SOURCE_FILES_ABS_PATHS "")
+foreach (src_file ${SYRINGE_ALL_SOURCE_FILES})
+  list(APPEND
+      SYRINGE_ALL_SOURCE_FILES_ABS_PATHS
+    "${CMAKE_CURRENT_SOURCE_DIR}/${src_file}")
+endforeach()
+
+
+# Now put it all together...
+include_directories(..)
+include_directories(../../include)
+
+set(SYRINGE_CFLAGS ${SANITIZER_COMMON_CFLAGS})
+set(SYRINGE_COMMON_DEFINITIONS SYRINGE_HAS_EXCEPTIONS=1)
+
+# We don't need RTTI in Syringe, so turn that off.
+append_rtti_flag(OFF SYRINGE_CFLAGS)
+
+append_list_if(
+    COMPILER_RT_HAS_SYRINGE_COMPILER_FLAG SYRINGE_SUPPORTED=1 SYRINGE_COMMON_DEFINITIONS)
+
+add_compiler_rt_component(syringe)
+
+set(SYRINGE_COMMON_RUNTIME_OBJECT_LIBS
+    RTSanitizerCommon
+    RTSanitizerCommonLibc)
+
+
+if (TARGET cxx-headers OR HAVE_LIBCXX)
+    set(SYRINGE_DEPS cxx-headers)
+endif()
+
+if (APPLE)
+  set(SYRINGE_LINK_LIBS ${SANITIZER_COMMON_LINK_LIBS})
+  add_weak_symbols("sanitizer_common" WEAK_SYMBOL_LINK_FLAGS)
+  #add_weak_symbols("syringe" WEAK_SYMBOL_LINK_FLAGS)
+
+  add_compiler_rt_object_libraries(RTSyringe
+    OS ${SYRINGE_SUPPORTED_OS}
+    ARCHS ${SYRINGE_SUPPORTED_ARCH}
+    SOURCES ${SYRINGE_SOURCES} ${${arch}_SOURCES}
+    ADDITIONAL_HEADERS ${SYRINGE_HEADERS}
+    CFLAGS ${SYRINGE_CFLAGS}
+    DEFS ${SYRINGE_COMMON_DEFINITIONS}
+    DEPS ${SYRINGE_DEPS})
+
+    # We only support running on osx for now.
+  add_compiler_rt_runtime(clang_rt.syringe
+    STATIC
+    OS ${SYRINGE_SUPPORTED_OS}
+    ARCHS ${SYRINGE_SUPPORTED_ARCH}
+    OBJECT_LIBS RTSyringe
+                RTSanitizerCommon
+                RTSanitizerCommonLibc
+    CFLAGS ${SYRINGE_CFLAGS}
+    DEFS ${SYRINGE_COMMON_DEFINITIONS}
+    LINK_FLAGS ${SANITIZER_COMMON_LINK_FLAGS} ${WEAK_SYMBOL_LINK_FLAGS}
+    LINK_LIBS ${SYRINGE_LINK_LIBS}
+    PARENT_TARGET syringe)
+
+else() # not Apple
+  foreach(arch ${SYRINGE_SUPPORTED_ARCH})
+    if(NOT CAN_TARGET_${arch})
+      continue()
+    endif()
+    add_compiler_rt_object_libraries(RTSyringe
+      ARCHS ${arch}
+      SOURCES ${SYRINGE_SOURCES} ${${arch}_SOURCES}
+      ADDITIONAL_HEADERS ${SYRINGE_HEADERS}
+      CFLAGS ${SYRINGE_CFLAGS}
+      DEFS ${SYRINGE_COMMON_DEFINITIONS}
+      DEPS ${SYRINGE_DEPS})
+
+    # Common Syringe archive for instrumented binaries.
+    add_compiler_rt_runtime(clang_rt.syringe
+      STATIC
+      ARCHS ${arch}
+      CFLAGS ${SYRINGE_CFLAGS}
+      DEFS ${SYRINGE_COMMON_DEFINITIONS}
+      OBJECT_LIBS ${SYRINGE_COMMON_RUNTIME_OBJECT_LIBS}  RTSyringe
+      PARENT_TARGET syringe)
+  endforeach()
+endif() # not Apple
+
+if(COMPILER_RT_INCLUDE_TESTS)
+  add_subdirectory(tests)
+endif()

compiler-rt/lib/syringe/syringe_rt.cpp

+//===-- syringe_rt.cpp ------------------------------------------*- C++ -*-===//
+//
+//                     The LLVM Compiler Infrastructure
+//
+// This file is distributed under the University of Illinois Open Source
+// License. See LICENSE.TXT for details.
+//
+//===----------------------------------------------------------------------===//
+//
+// This file is a part of Syringe, a dynamic behavior injection system.
+//
+// APIs for using the Syringe Runtime.
+//===----------------------------------------------------------------------===//
+
+#include <iostream>
+#include <vector>
+
+#include "syringe/injection_data.h"
+#include "syringe/syringe_rt.h"
+#include "syringe/syringe_rt_cxx.h"
+
+namespace __syringe {
+
+std::vector<SimpleInjectionData> GlobalSyringeData;
+
+SimpleInjectionData *findImplPointerImpl(fptr_t target) {
+  auto It = std::find_if(GlobalSyringeData.begin(), GlobalSyringeData.end(),
+                         [target](SimpleInjectionData It) -> bool {
+                           return (void *)It.OrigFunc == (void *)target;
+                         });
+
+  if (It == GlobalSyringeData.end()) {
+    return nullptr;
+  } else {
+    return &*It;
+  }
+}
+
+} // end namespace __syringe
+
+void printSyringeData() {
+  std::cout << "Syringe Global Data" << std::endl;
+  for (auto &item : __syringe::GlobalSyringeData) {
+    std::cout << "Orig Func: " << (void *)item.OrigFunc
+              << ", Injection Enabled Addr: " << (void *)item.InjectionEnabled
+              << ", Injection Enabled Value: "
+              << (*item.InjectionEnabled ? "true" : "false") << std::endl;
+  }
+
+  std::cout << std::endl;
+}
+
+bool toggleImpl(fptr_t OrigFunc) { return __syringe::toggleImplPtr(OrigFunc); }
+
+void __syringe_register(void *OrigFunc, bool *InjectionEnabled) {
+  __syringe::registerInjection((fptr_t)OrigFunc, InjectionEnabled);
+}

compiler-rt/lib/syringe/tests/CMakeLists.txt

+include_directories(..)
+
+add_custom_target(SyringeUnitTests)
+set_target_properties(SyringeUnitTests PROPERTIES FOLDER "Syringe unittests")
+
+# Sanity check SYRINGE_ALL_SOURCE_FILES_ABS_PATHS
+list(LENGTH SYRINGE_ALL_SOURCE_FILES_ABS_PATHS XASFAP_LENGTH)
+if (${XASFAP_LENGTH} EQUAL 0)
+  message(FATAL_ERROR "SYRINGE_ALL_SOURCE_FILES_ABS_PATHS cannot be empty")
+endif()
+unset(XASFAP_LENGTH)
+foreach (src_file ${SYRINGE_ALL_SOURCE_FILES_ABS_PATHS})
+  if (NOT EXISTS "${src_file}")
+    message(FATAL_ERROR "Source file \"${src_file}\" does not exist")
+  endif()
+endforeach()
+
+set(SYRINGE_UNITTEST_CFLAGS
+  ${SYRINGE_CFLAGS}
+  ${COMPILER_RT_UNITTEST_CFLAGS}
+  ${COMPILER_RT_GTEST_CFLAGS}
+  -I${COMPILER_RT_SOURCE_DIR}/include
+  -I${COMPILER_RT_SOURCE_DIR}/lib/syringe
+  -I${COMPILER_RT_SOURCE_DIR}/lib)
+
+function(add_syringe_lib library)
+  add_library(${library} STATIC ${ARGN})
+  set_target_properties(${library} PROPERTIES
+    ARCHIVE_OUTPUT_DIRECTORY ${CMAKE_CURRENT_BINARY_DIR}
+    FOLDER "Compiler-RT Runtime tests")
+endfunction()
+
+function(get_syringe_lib_for_arch arch lib)
+  if(APPLE)
+    set(tgt_name "RTSyringe.test.osx")
+  else()
+    set(tgt_name "RTSyringe.test.${arch}")
+  endif()
+  set(${lib} "${tgt_name}" PARENT_SCOPE)
+endfunction()
+
+set(SYRINGE_TEST_ARCH ${SYRINGE_SUPPORTED_ARCH})
+set(SYRINGE_UNITTEST_LINK_FLAGS
+  ${CMAKE_THREAD_LIBS_INIT}
+  -l${SANITIZER_CXX_ABI_LIBRARY}
+  -fsyringe
+  )
+if (NOT APPLE)
+  append_list_if(COMPILER_RT_HAS_LIBM -lm SYRINGE_UNITTEST_LINK_FLAGS)
+  append_list_if(COMPILER_RT_HAS_LIBRT -lrt SYRINGE_UNITTEST_LINK_FLAGS)
+  append_list_if(COMPILER_RT_HAS_LIBDL -ldl SYRINGE_UNITTEST_LINK_FLAGS)
+  append_list_if(COMPILER_RT_HAS_LIBPTHREAD -pthread SYRINGE_UNITTEST_LINK_FLAGS)
+endif()
+
+macro(add_syringe_unittest testname)
+  cmake_parse_arguments(TEST "" "" "SOURCES;HEADERS" ${ARGN})
+  if(UNIX AND NOT APPLE)
+    set(CMAKE_DL_LIBS_INIT "")
+    foreach(arch ${SYRINGE_TEST_ARCH})
+      set(TEST_OBJECTS)
+      get_syringe_lib_for_arch(${arch} SYRINGE_RUNTIME_LIBS)
+      generate_compiler_rt_tests(TEST_OBJECTS
+        SyringeUnitTests "${testname}-${arch}-Test" "${arch}"
+        SOURCES ${TEST_SOURCES} ${COMPILER_RT_GTEST_SOURCE}
+        # Note that any change in the implementations will cause all the unit
+        # tests to be re-built. This is by design, but may be cumbersome during
+        # the build/test cycle.
+        COMPILE_DEPS ${TEST_SOURCES} ${COMPILER_RT_GTEST_SOURCE}
+        ${SYRINGE_HEADERS} ${SYRINGE_ALL_SOURCE_FILES_ABS_PATHS}
+        RUNTIME "${SYRINGE_RUNTIME_LIBS}"
+        DEPS gtest syringe llvm-syringe
+        CFLAGS ${SYRINGE_UNITTEST_CFLAGS}
+        LINK_FLAGS ${TARGET_LINK_FLAGS} ${SYRINGE_UNITTEST_LINK_FLAGS})
+      set_target_properties(SyringeUnitTests
+        PROPERTIES RUNTIME_OUTPUT_DIRECTORY ${CMAKE_CURRENT_BINARY_DIR})
+    endforeach()
+  endif()
+endmacro()
+
+if(COMPILER_RT_CAN_EXECUTE_TESTS)
+  if (APPLE)
+    add_syringe_lib("RTSyringe.test.osx"
+      $<TARGET_OBJECTS:RTSyringe.osx>
+      $<TARGET_OBJECTS:RTSanitizerCommon.osx>
+      $<TARGET_OBJECTS:RTSanitizerCommonLibc.osx>)
+  else()
+    foreach(arch ${SYRINGE_SUPPORTED_ARCH})
+      add_syringe_lib("RTSyringe.test.${arch}"
+        $<TARGET_OBJECTS:RTSyringe.${arch}>
+      $<TARGET_OBJECTS:RTSanitizerCommon.${arch}>
+      $<TARGET_OBJECTS:RTSanitizerCommonLibc.${arch}>)
+  endforeach()
+  endif()
+  add_subdirectory(unit)
+endif()

compiler-rt/lib/syringe/tests/unit/CMakeLists.txt

+add_syringe_unittest(SyringeRegistrationTest SOURCES
+  syringe_registration_test.cc syringe_unit_test_main.cc)

compiler-rt/lib/syringe/tests/unit/syringe_registration_test.cc

+//===-- syringe_registration_test.cc
+//-----------------------------------------===//
+//
+//                     The LLVM Compiler Infrastructure
+//
+// This file is distributed under the University of Illinois Open Source
+// License. See LICENSE.TXT for details.
+//
+//===----------------------------------------------------------------------===//
+//
+// This file is a part of Syringe, a behavior injection system.
+//
+//===----------------------------------------------------------------------===//
+#include "gtest/gtest.h"
+
+#include "syringe/syringe_rt.h"
+#include "syringe/syringe_rt_cxx.h"
+namespace {
+[[clang::syringe_injeciton_site]] int foo() { return 1; }
+[[clang::syringe_payload("_Z3fooi")]] int bar() { return 0; }
+} // namespace
+
+namespace __syringe {
+
+TEST(RegistrationTest, Simple) {
+  __syringe_register(nullptr, nullptr);
+  auto data_ptr = findImplPtr(nullptr);
+  ASSERT_NE(nullptr, data_ptr);
+  ASSERT_EQ(nullptr, data_ptr->ImplPtr);
+  ASSERT_GT(GlobalSyringeData.size(), 1);
+}
+
+TEST(RegistrationTest, NoDoubleInsert) {
+  __syringe_register(nullptr, nullptr);
+  ASSERT_DEATH(__syringe_register(nullptr, nullptr), "Cannot register two payloads for the same injection site!");
+}
+
+} // namespace __syringe

compiler-rt/lib/syringe/tests/unit/syringe_unit_test_main.cc

+//===-- syringe_unit_test_main.cc --------------------------------------------===//
+//
+//                     The LLVM Compiler Infrastructure
+//
+// This file is distributed under the University of Illinois Open Source
+// License. See LICENSE.TXT for details.
+//
+//===----------------------------------------------------------------------===//
+//
+// This file is a part of Syringe, a behavior injection system.
+//
+//===----------------------------------------------------------------------===//
+#include "gtest/gtest.h"
+
+int main(int argc, char **argv) {
+  testing::InitGoogleTest(&argc, argv);
+  return RUN_ALL_TESTS();
+}

llvm/include/llvm-c/Initialization.h

 void LLVMInitializeInstCombine(LLVMPassRegistryRef R);
 void LLVMInitializeAggressiveInstCombiner(LLVMPassRegistryRef R);
 void LLVMInitializeIPO(LLVMPassRegistryRef R);
 void LLVMInitializeInstrumentation(LLVMPassRegistryRef R);
 void LLVMInitializeAnalysis(LLVMPassRegistryRef R);
 void LLVMInitializeIPA(LLVMPassRegistryRef R);
 void LLVMInitializeCodeGen(LLVMPassRegistryRef R);
 void LLVMInitializeTarget(LLVMPassRegistryRef R);
+void LLVMInitializeSyringe(LLVMPassRegistryRef R);
 
 /**
  * @}
  */
 
 #ifdef __cplusplus
 }
 #endif
 
 #endif

llvm/include/llvm/Bitcode/LLVMBitCodes.h

enum AttributeKindCodes {
   ATTR_KIND_ALLOC_SIZE = 51,
   ATTR_KIND_WRITEONLY = 52,
   ATTR_KIND_SPECULATABLE = 53,
   ATTR_KIND_STRICT_FP = 54,
   ATTR_KIND_SANITIZE_HWADDRESS = 55,
   ATTR_KIND_NOCF_CHECK = 56,
   ATTR_KIND_OPT_FOR_FUZZING = 57,
   ATTR_KIND_SHADOWCALLSTACK = 58,
+  ATTR_KIND_SYRINGE_SITE = 59,
+  ATTR_KIND_SYRINGE_PAYLOAD = 60,
 };
 
 enum ComdatSelectionKindCodes {
   COMDAT_SELECTION_KIND_ANY = 1,
   COMDAT_SELECTION_KIND_EXACT_MATCH = 2,
   COMDAT_SELECTION_KIND_LARGEST = 3,
   COMDAT_SELECTION_KIND_NO_DUPLICATES = 4,
   COMDAT_SELECTION_KIND_SAME_SIZE = 5,

llvm/include/llvm/InitializePasses.h

 void initializeVirtRegMapPass(PassRegistry&);
 void initializeVirtRegRewriterPass(PassRegistry&);
 void initializeWasmEHPreparePass(PassRegistry&);
 void initializeWholeProgramDevirtPass(PassRegistry&);
 void initializeWinEHPreparePass(PassRegistry&);
 void initializeWriteBitcodePassPass(PassRegistry&);
 void initializeWriteThinLTOBitcodePass(PassRegistry&);
 void initializeXRayInstrumentationPass(PassRegistry&);
+void initializeSyringeLegacyPassPass(PassRegistry&);
 
 } // end namespace llvm
 
 #endif // LLVM_INITIALIZEPASSES_H

llvm/include/llvm/LinkAllPasses.h

 #include "llvm/Analysis/TypeBasedAliasAnalysis.h"
 #include "llvm/CodeGen/Passes.h"
 #include "llvm/IR/Function.h"
 #include "llvm/IR/IRPrintingPasses.h"
 #include "llvm/Support/Valgrind.h"
 #include "llvm/Transforms/AggressiveInstCombine/AggressiveInstCombine.h"
 #include "llvm/Transforms/IPO.h"
 #include "llvm/Transforms/IPO/AlwaysInliner.h"
+#include "llvm/Transforms/Syringe.h"
 #include "llvm/Transforms/IPO/FunctionAttrs.h"
 #include "llvm/Transforms/InstCombine/InstCombine.h"
 #include "llvm/Transforms/Instrumentation.h"
 #include "llvm/Transforms/Instrumentation/BoundsChecking.h"
 #include "llvm/Transforms/ObjCARC.h"
 #include "llvm/Transforms/Scalar.h"
 #include "llvm/Transforms/Scalar/GVN.h"
 #include "llvm/Transforms/Scalar/InstSimplifyPass.h"

llvm/include/llvm/SyringeRecord.h

+//===- SyringeRecord.h - Syringe Trace Record
+//-----------------------------------===//
+//
+//                     The LLVM Compiler Infrastructure
+//
+// This file is distributed under the University of Illinois Open Source
+// License. See LICENSE.TXT for details.
+//
+//===----------------------------------------------------------------------===//
+//
+// This file replicates the record definition for Syringe instrumentation.
+//
+//===----------------------------------------------------------------------===//
+#ifndef LLVM_SYRINGE_SYRINGE_RECORD_H
+#define LLVM_SYRINGE_SYRINGE_RECORD_H
+
+#include <cstdint>
+#include <string>
+#include <vector>
+
+namespace llvm {
+namespace syringe {
+
+enum class SyringeTrigger { NONE, NEVER, ALWAYS, COUNT, ONCE };
+
+struct SyringeTarget {
+  std::string Name;
+  SyringeTrigger EnableTrigger;
+  SyringeTrigger DisableTrigger;
+  uint32_t Count = 0;
+};
+
+struct SyringePayload {
+  std::string Name;
+  std::string Target;
+};
+
+struct SyringeRecord {
+  std::string Filename;
+  std::vector<SyringeTarget> Targets;
+  std::vector<SyringePayload> Payloads;
+};
+
+} // namespace syringe
+} // namespace llvm
+
+#endif // LLVM_SYRINGE_SYRINGE_RECORD_H

llvm/include/llvm/Transforms/Syringe.h

+//===- Transforms/Syringe.h - Syringe passes --------------------*- C++ -*-===//
+//
+//                     The LLVM Compiler Infrastructure
+//
+// This file is distributed under the University of Illinois Open Source
+// License. See LICENSE.TXT for details.
+//
+//===----------------------------------------------------------------------===//
+//
+// This file defines constructor functions for Syringe passes.
+//
+//===----------------------------------------------------------------------===//
+
+#ifndef LLVM_TRANSFORMS_SYRINGE_H
+#define LLVM_TRANSFORMS_SYRINGE_H
+
+#include "llvm/ADT/StringRef.h"
+#include "llvm/IR/Module.h"
+#include "llvm/IR/PassManager.h"
+#include "llvm/Pass.h"
+#include "llvm/YAMLSyringeRecord.h"
+
+namespace llvm {
+class ModulePass;
+
+/// Pass to insert Syringe Injection sites.
+class SyringePass : public PassInfoMixin<SyringePass> {
+public:
+  PreservedAnalyses run(Module &M, ModuleAnalysisManager &AM);
+};
+
+ModulePass *createSyringe();
+
+void initializeSyringeLegacyPass(PassRegistry &Registry);
+
+class SyringeLegacyPass : public ModulePass {
+public:
+  /// pass identification
+  static char ID;
+
+  SyringeLegacyPass();
+  virtual ~SyringeLegacyPass() = default;
+
+  /// Specify pass name for debug output
+  StringRef getPassName() const override;
+
+  /// run module pass
+  bool runOnModule(Module &M) override;
+
+  /// create funciton stub for behavior injection
+  bool doBehaviorInjectionForModule(Module &M);
+
+  bool parse(const std::string &MapFile);
+  void modifyFunctionBody(Module& M, Function *Fn, Function* Payload, Value* SyringeBool);
+
+private:
+  /* data */
+  std::vector<syringe::YAMLSyringeRecord> Metadata;
+  bool parse(std::unique_ptr<MemoryBuffer> &MapFile);
+};
+} // namespace llvm
+
+#endif // Include Guard

llvm/include/llvm/YAMLSyringeRecord.h

+//===- YAMLXRayRecord.h - XRay Record YAML Support Definitions ------------===//
+//
+//                     The LLVM Compiler Infrastructure
+//
+// This file is distributed under the University of Illinois Open Source
+// License. See LICENSE.TXT for details.
+//
+//===----------------------------------------------------------------------===//
+//
+// Types and traits specialisations for YAML I/O of XRay log entries.
+//
+//===----------------------------------------------------------------------===//
+#ifndef LLVM_SYRINGE_YAML_SYRINGE_RECORD_H
+#define LLVM_SYRINGE_YAML_SYRINGE_RECORD_H
+
+#include <type_traits>
+
+#include "llvm/Support/YAMLTraits.h"
+#include "llvm/SyringeRecord.h"
+
+namespace llvm {
+namespace syringe {
+
+struct YAMLSyringeTarget {
+  std::string Name;
+  SyringeTrigger EnableTrigger;
+  SyringeTrigger DisableTrigger;
+  uint32_t Count = 0;
+};
+
+struct YAMLSyringePayload {
+  std::string Name;
+  std::string Target;
+};
+
+struct YAMLSyringeRecord {
+  std::string Filename;
+  std::vector<YAMLSyringeTarget> Targets;
+  std::vector<YAMLSyringePayload> Payloads;
+};
+
+} // namespace syringe
+
+namespace yaml {
+
+template <typename T> struct MappingTraits;
+
+// YAML Traits
+// -----------
+template <> struct ScalarEnumerationTraits<syringe::SyringeTrigger> {
+  static void enumeration(IO &IO, syringe::SyringeTrigger &Type) {
+    IO.enumCase(Type, "NONE", syringe::SyringeTrigger::NONE);
+    IO.enumCase(Type, "NEVER", syringe::SyringeTrigger::NEVER);
+    IO.enumCase(Type, "ALWAYS", syringe::SyringeTrigger::ALWAYS);
+    IO.enumCase(Type, "COUNT", syringe::SyringeTrigger::COUNT);
+    IO.enumCase(Type, "ONCE", syringe::SyringeTrigger::ONCE);
+  }
+};
+
+template <> struct MappingTraits<syringe::YAMLSyringeTarget> {
+  static void mapping(IO &IO, syringe::YAMLSyringeTarget &Target) {
+    IO.mapRequired("name", Target.Name);
+    IO.mapRequired("enable", Target.EnableTrigger);
+    IO.mapRequired("disable", Target.DisableTrigger);
+    IO.mapOptional("count", Target.Count);
+  }
+};
+
+template <> struct MappingTraits<syringe::YAMLSyringePayload> {
+  static void mapping(IO &IO, syringe::YAMLSyringePayload &Payload) {
+    IO.mapRequired("name", Payload.Name);
+    IO.mapRequired("target", Payload.Target);
+  }
+};
+
+template <> struct MappingTraits<syringe::YAMLSyringeRecord> {
+  static void mapping(IO &IO, syringe::YAMLSyringeRecord &Record) {
+    IO.mapRequired("filename", Record.Filename);
+    IO.mapOptional("targets", Record.Targets);
+    IO.mapOptional("payloads", Record.Payloads);
+  }
+};
+
+} // namespace yaml
+} // namespace llvm
+
+LLVM_YAML_IS_SEQUENCE_VECTOR(syringe::YAMLSyringeTarget)
+LLVM_YAML_IS_SEQUENCE_VECTOR(syringe::YAMLSyringePayload)
+LLVM_YAML_IS_SEQUENCE_VECTOR(syringe::YAMLSyringeRecord)
+
+#endif // LLVM_syringe_YAML_syringe_RECORD_H

llvm/lib/AsmParser/LLLexer.cpp

#define KEYWORD(STR)                                                           \
   KEYWORD(amdgpu_kernel);
 
   KEYWORD(cc);
   KEYWORD(c);
 
   KEYWORD(attributes);
 
   KEYWORD(alwaysinline);
+  KEYWORD(syringe_site);
+  KEYWORD(syringe_payload);
   KEYWORD(allocsize);
   KEYWORD(argmemonly);
   KEYWORD(builtin);
   KEYWORD(byval);
   KEYWORD(inalloca);
   KEYWORD(cold);
   KEYWORD(convergent);
   KEYWORD(dereferenceable);

llvm/lib/AsmParser/LLParser.cpp

case lltok::kw_allocsize: {
       unsigned ElemSizeArg;
       Optional<unsigned> NumElemsArg;
       // inAttrGrp doesn't matter; we only support allocsize(a[, b])
       if (parseAllocSizeArguments(ElemSizeArg, NumElemsArg))
         return true;
       B.addAllocSizeAttr(ElemSizeArg, NumElemsArg);
       continue;
     }
+
     case lltok::kw_alwaysinline: B.addAttribute(Attribute::AlwaysInline); break;
     case lltok::kw_argmemonly: B.addAttribute(Attribute::ArgMemOnly); break;
     case lltok::kw_builtin: B.addAttribute(Attribute::Builtin); break;
     case lltok::kw_cold: B.addAttribute(Attribute::Cold); break;
     case lltok::kw_convergent: B.addAttribute(Attribute::Convergent); break;
     case lltok::kw_inaccessiblememonly:
       B.addAttribute(Attribute::InaccessibleMemOnly); break;
     case lltok::kw_inaccessiblemem_or_argmemonly:

llvm/lib/AsmParser/LLToken.h

enum Kind {
   kw_amdgpu_ps,
   kw_amdgpu_cs,
   kw_amdgpu_kernel,
 
   // Attributes:
   kw_attributes,
   kw_allocsize,
   kw_alwaysinline,
+  kw_syringe_site,
+  kw_syringe_payload,
   kw_argmemonly,
   kw_sanitize_address,
   kw_sanitize_hwaddress,
   kw_builtin,
   kw_byval,
   kw_inalloca,
   kw_cold,
   kw_convergent,

llvm/lib/Passes/LLVMBuild.txt

 ;   http://llvm.org/docs/LLVMBuild.html
 ;
 ;===------------------------------------------------------------------------===;
 
 [component_0]
 type = Library
 name = Passes
 parent = Libraries
-required_libraries = AggressiveInstCombine Analysis CodeGen Core IPO InstCombine Scalar Support Target TransformUtils Vectorize Instrumentation
+required_libraries = AggressiveInstCombine Analysis CodeGen Core IPO InstCombine Scalar Support Target TransformUtils Vectorize Instrumentation Syringe

llvm/lib/Passes/PassBuilder.cpp

 #include "llvm/IR/IRPrintingPasses.h"
 #include "llvm/IR/PassManager.h"
 #include "llvm/IR/Verifier.h"
 #include "llvm/Support/Debug.h"
 #include "llvm/Support/Regex.h"
 #include "llvm/Target/TargetMachine.h"
 #include "llvm/Transforms/AggressiveInstCombine/AggressiveInstCombine.h"
 #include "llvm/Transforms/Instrumentation/CGProfile.h"
+#include "llvm/Transforms/Syringe.h"
 #include "llvm/Transforms/IPO/AlwaysInliner.h"
 #include "llvm/Transforms/IPO/ArgumentPromotion.h"
 #include "llvm/Transforms/IPO/CalledValuePropagation.h"
 #include "llvm/Transforms/IPO/ConstantMerge.h"
 #include "llvm/Transforms/IPO/CrossDSOCFI.h"
 #include "llvm/Transforms/IPO/DeadArgumentElimination.h"
 #include "llvm/Transforms/IPO/ElimAvailExtern.h"
 #include "llvm/Transforms/IPO/ForceFunctionAttrs.h"

llvm/lib/Passes/PassRegistry.def

 MODULE_ALIAS_ANALYSIS("globals-aa", GlobalsAA())
 #undef MODULE_ALIAS_ANALYSIS
 #undef MODULE_ANALYSIS
 
 #ifndef MODULE_PASS
 #define MODULE_PASS(NAME, CREATE_PASS)
 #endif
 MODULE_PASS("always-inline", AlwaysInlinerPass())
+MODULE_PASS("syringe", SyringePass())
 MODULE_PASS("called-value-propagation", CalledValuePropagationPass())
 MODULE_PASS("cg-profile", CGProfilePass())
 MODULE_PASS("constmerge", ConstantMergePass())
 MODULE_PASS("cross-dso-cfi", CrossDSOCFIPass())
 MODULE_PASS("deadargelim", DeadArgumentEliminationPass())
 MODULE_PASS("elim-avail-extern", EliminateAvailableExternallyPass())
 MODULE_PASS("forceattrs", ForceFunctionAttrsPass())
 MODULE_PASS("function-import", FunctionImportPass())

llvm/lib/Transforms/CMakeLists.txt

 add_subdirectory(Utils)
 add_subdirectory(Instrumentation)
 add_subdirectory(AggressiveInstCombine)
 add_subdirectory(InstCombine)
 add_subdirectory(Scalar)
 add_subdirectory(IPO)
 add_subdirectory(Vectorize)
 add_subdirectory(Hello)
 add_subdirectory(ObjCARC)
 add_subdirectory(Coroutines)
+add_subdirectory(Syringe)

llvm/lib/Transforms/LLVMBuild.txt

 ;
 ; For more information on the LLVMBuild system, please see:
 ;
 ;   http://llvm.org/docs/LLVMBuild.html
 ;
 ;===------------------------------------------------------------------------===;
 
 [common]
-subdirectories = AggressiveInstCombine Coroutines IPO InstCombine Instrumentation Scalar Utils Vectorize ObjCARC
+subdirectories = AggressiveInstCombine Coroutines IPO InstCombine Instrumentation Scalar Utils Vectorize ObjCARC Syringe
 
 [component_0]
 type = Group
 name = Transforms
 parent = Libraries

llvm/lib/Transforms/Syringe/CMakeLists.txt

+add_llvm_library(LLVMSyringe
+  Syringe.cpp
+
+  ADDITIONAL_HEADER_DIRS
+  ${LLVM_MAIN_INCLUDE_DIR}/llvm/Syringe
+
+  DEPENDS
+  intrinsics_gen
+  )

llvm/lib/Transforms/Syringe/LLVMBuild.txt

+;===- ./lib/Transforms/Instrumentation/LLVMBuild.txt -----------*- Conf -*--===;
+;
+;                     The LLVM Compiler Infrastructure
+;
+; This file is distributed under the University of Illinois Open Source
+; License. See LICENSE.TXT for details.
+;
+;===------------------------------------------------------------------------===;
+;
+; This is an LLVMBuild description file for the components in this subdirectory.
+;
+; For more information on the LLVMBuild system, please see:
+;
+;   http://llvm.org/docs/LLVMBuild.html
+;
+;===------------------------------------------------------------------------===;
+
+[component_0]
+type = Library
+name = Syringe
+parent = Transforms
+required_libraries = Analysis Core MC Support TransformUtils ProfileData OrcJIT Instrumentation

llvm/lib/Transforms/Syringe/Syringe.cpp

+//===-- Syringe.cpp - Syringe Infrastructure ---------------===//
+//
+//                     The LLVM Compiler Infrastructure
+//
+// This file is distributed under the University of Illinois Open Source
+// License. See LICENSE.TXT for details.
+//
+//===----------------------------------------------------------------------===//
+//
+// This file defines the common initialization infrastructure for the
+// Syringe library.
+//
+//===----------------------------------------------------------------------===//
+
+#include "llvm/Transforms/Syringe.h"
+#include "llvm-c/Initialization.h"
+#include "llvm/ADT/ArrayRef.h"
+#include "llvm/ADT/SmallVector.h"
+#include "llvm/ExecutionEngine/Orc/IndirectionUtils.h"
+#include "llvm/IR/Attributes.h"
+#include "llvm/IR/DebugInfo.h"
+#include "llvm/IR/Function.h"
+#include "llvm/IR/GlobalAlias.h"
+#include "llvm/IR/GlobalIFunc.h"
+#include "llvm/IR/GlobalValue.h"
+#include "llvm/IR/IRBuilder.h"
+#include "llvm/IR/Module.h"
+#include "llvm/InitializePasses.h"
+#include "llvm/Pass.h"
+#include "llvm/PassRegistry.h"
+#include "llvm/Support/raw_ostream.h"
+#include "llvm/SyringeRecord.h"
+#include "llvm/Transforms/Instrumentation.h"
+#include "llvm/Transforms/Utils/BasicBlockUtils.h"
+#include "llvm/Transforms/Utils/Cloning.h"
+#include "llvm/Transforms/Utils/ModuleUtils.h"
+#include "llvm/Transforms/Utils/UnifyFunctionExitNodes.h"
+
+using namespace llvm;
+
+// Strings for Syringe names and Suffix
+static const char *const SyringeModuleCtorName = "syringe.module_ctor";
+static const char *const SyringeInitName = "__syringe_register";
+static const char *const SyringeDetourImplSuffix = "$detour_impl";
+static const char *const SyringeBoolSuffix = "$syringe_bool";
+
+namespace {
+
+// contains data used for registratin function
+struct SyringeInitData {
+  // the address of the original function, serves as key for runtime lookups
+  Function *Target;
+  // the address of the new stub impl (the moved body of the origianl function)
+  Function *Stub;
+  // the address of the function whose behavior we wish to inject
+  Function *Detour;
+  // the global function pointer used in the stub for indirect calls
+  GlobalValue *SyringePtr;
+};
+
+struct SimpleSyringeInitData {
+  // the address of the original function, serves as key for runtime lookups
+  Function *Target;
+  // the address of the new stub impl (the moved body of the origianl function)
+  GlobalVariable *SyringeBool;
+};
+
+} // namespace
+
+// create a single ctor function for the module, whose body should consist of a
+// series of calls to the registration function. One call per injection site.
+// We create the function, add a basic block to it, and then insert calls to the
+// registration function for each injection site in the module.
+//
+// example ctor function:
+//
+// void ctor_func_name(){
+//      register(original_func, orig_func_bool);
+//      register(original_func2, orig_func_bool2);
+//      ....
+// }
+//
+static void createCtorInit(Module &M,
+                           SmallVector<SimpleSyringeInitData, 8> &InitData) {
+
+  // create a ctor to register all injection sites
+  Function *Ctor = Function::Create(
+      FunctionType::get(Type::getVoidTy(M.getContext()), false),
+      GlobalValue::InternalLinkage, SyringeModuleCtorName + M.getName(), &M);
+  BasicBlock *CtorBB = BasicBlock::Create(M.getContext(), "", Ctor);
+  IRBuilder<> IRB(ReturnInst::Create(M.getContext(), CtorBB));
+
+  for (auto SID : InitData) {
+    auto Target = SID.Target;
+    auto Flag = SID.SyringeBool;
+
+    // target function types
+    auto FuncTy = Target->getType();
+    auto BoolTy = llvm::Type::getInt8PtrTy(M.getContext());
+    // auto BoolTyPtr = static_cast<Type>(BoolTy);
+
+    // the parameter types of the registration function
+    // Type *ParamTypes[] = {FuncTy, BoolTyPtr};
+    Type *ParamTypes[] = {FuncTy, BoolTy};
+    auto ParamTypesRef = makeArrayRef(ParamTypes, 2);
+
+    // actual parameters
+    Value *ParamArgs[] = {Target, Flag};
+    auto ParamArgsRef = makeArrayRef(ParamArgs, 2);
+
+    // assert that these are the same size incase we are ever change the
+    // implementation
+    assert(ParamArgsRef.size() == ParamTypesRef.size());
+
+    // void return type
+    auto RetTy = Type::getVoidTy(M.getContext());
+
+    // the type of the registration function
+    auto RegFnTy = FunctionType::get(RetTy, ParamTypesRef, false);
+
+    // create or find the registration function
+    auto ConstFn = M.getOrInsertFunction(SyringeInitName, RegFnTy);
+    auto RegFunc = M.getFunction(SyringeInitName);
+
+    // set its linkage
+    RegFunc->setLinkage(GlobalValue::LinkageTypes::ExternalLinkage);
+
+    // add a call to the registration function w/ our target arguments
+    IRB.CreateCall(ConstFn, ParamArgsRef);
+  }
+
+  // FIXME: the magic constant is in parts of clang as well, should we move to a
+  // const int? follow Clang's example for setting priority for global ctors
+  appendToGlobalCtors(M, Ctor, 65535);
+}
+
+// Naming APIs
+
+static std::string createSuffixedName(StringRef BaseName, StringRef Suffix) {
+  return (BaseName + Suffix).str();
+}
+
+static std::string createBoolNameFromBase(StringRef BaseName) {
+  return createSuffixedName(BaseName, SyringeBoolSuffix);
+}
+
+static std::string createAliasNameFromBase(StringRef BaseName) {
+  return createSuffixedName(BaseName, SyringeDetourImplSuffix);
+}
+
+bool SyringeLegacyPass::parse(std::unique_ptr<MemoryBuffer> &MapFile) {
+  bool status = false;
+  yaml::Input yin(MapFile->getBuffer());
+
+  yin >> Metadata;
+  if (yin.error())
+    return false;
+
+  if (!Metadata.empty())
+    status = true;
+
+  for (syringe::YAMLSyringeRecord Rec : Metadata) {
+    Metadata.push_back(Rec);
+  }
+  return status;
+}
+
+bool SyringeLegacyPass::parse(const std::string &MapFile) {
+  ErrorOr<std::unique_ptr<MemoryBuffer>> Mapping =
+      MemoryBuffer::getFile(MapFile);
+
+  if (!Mapping)
+    report_fatal_error("unable to read rewrite map '" + MapFile +
+                       "': " + Mapping.getError().message());
+
+  if (!parse(*Mapping))
+    report_fatal_error("unable to parse rewrite map '" + MapFile + "'");
+
+  return true;
+}
+
+// Module APIs
+
+// check if the module needs the Syringe Pass
+static bool doInjectionForModule(Module &M) {
+  for (Function &F : M) {
+    if (F.hasFnAttribute("syringe-payload") ||
+        F.hasFnAttribute("syringe-injection-site")) {
+      return true;
+    }
+  }
+  return false;
+}
+
+// run the syringe pass
+PreservedAnalyses SyringePass::run(Module &M, ModuleAnalysisManager &AM) {
+  if (!doInjectionForModule(M))
+    return PreservedAnalyses::all();
+
+  return PreservedAnalyses::none();
+}
+
+/// initializeSyringe - Initialize all passes in the Syringe library.
+void initializeSyringeLegacyPass(PassRegistry &Registry) {
+  initializeSyringeLegacyPassPass(Registry);
+}
+
+/// LLVMInitializeSyringe - C binding for initializeSyringe.
+void LLVMInitializeSyringe(LLVMPassRegistryRef R) {
+  initializeSyringeLegacyPassPass(*unwrap(R));
+}
+
+SyringeLegacyPass::SyringeLegacyPass() : ModulePass(ID) {}
+
+/// Specify pass name for debug output
+StringRef SyringeLegacyPass::getPassName() const {
+  return "Syringe Instrumentation";
+}
+
+/// run module pass
+bool SyringeLegacyPass::runOnModule(Module &M) {
+  if (skipModule(M)) {
+    return false;
+  }
+
+  // If there is a config file, go through it and annotate Syringe functions
+  for (auto &Rec : Metadata) {
+    if (M.getName() == Rec.Filename) {
+      // Annotate targets
+      for (auto &Target : Rec.Targets) {
+        auto F = M.getFunction(Target.Name);
+        if (F != nullptr) {
+          F->addFnAttr("syringe-injection-site");
+          break;
+        }
+      }
+
+      // Annotate payloads
+      for (auto &Payload : Rec.Payloads) {
+        auto F = M.getFunction(Payload.Name);
+        if (F != nullptr) {
+          F->addFnAttr("syringe-payload");
+          F->addFnAttr("syringe-target-function", Payload.Target);
+        }
+      }
+    }
+  }
+  return doBehaviorInjectionForModule(M);
+}
+
+// Note: this code is from lib/Transforms/IPO/MergeFunctions.cpp
+// -- This may be better to just link in, or refactor into a utility lib
+//
+// Helper for writeThunk,
+// Selects proper bitcast operation,
+// but a bit simpler then CastInst::getCastOpcode.
+static Value *createCast(IRBuilder<> &Builder, Value *V, Type *DestTy) {
+  Type *SrcTy = V->getType();
+  if (SrcTy->isStructTy()) {
+    assert(DestTy->isStructTy());
+    assert(SrcTy->getStructNumElements() == DestTy->getStructNumElements());
+    Value *Result = UndefValue::get(DestTy);
+    for (unsigned int I = 0, E = SrcTy->getStructNumElements(); I < E; ++I) {
+      Value *Element =
+          createCast(Builder, Builder.CreateExtractValue(V, makeArrayRef(I)),
+                     DestTy->getStructElementType(I));
+
+      Result = Builder.CreateInsertValue(Result, Element, makeArrayRef(I));
+    }
+    return Result;
+  }
+  assert(!DestTy->isStructTy());
+  if (SrcTy->isIntegerTy() && DestTy->isPointerTy())
+    return Builder.CreateIntToPtr(V, DestTy);
+  else if (SrcTy->isPointerTy() && DestTy->isIntegerTy())
+    return Builder.CreatePtrToInt(V, DestTy);
+  else
+    return Builder.CreateBitCast(V, DestTy);
+}
+
+/// Adds instrumentation to change target of direct dispatch
+// Transforms the function so that it has this general form
+//
+// if(_syringe_boolean == true)
+//  tail call __syringe__detourFunction
+// else
+//  original funciton body
+//
+void SyringeLegacyPass::modifyFunctionBody(Module &M, Function *Fn,
+                                           Function *Payload,
+                                           Value *SyringeBool) {
+  // cache ref to coontext
+  auto &Context = Fn->getContext();
+  auto EntryBB = &Fn->getEntryBlock();
+
+  BasicBlock *CmpBB =
+      BasicBlock::Create(Context, "syringe_branch", Fn, EntryBB);
+  BasicBlock *InjectBB = BasicBlock::Create(Context, "syringe_inject", Fn);
+
+  // Insert call to the injected payload in the then block
+  IRBuilder<> ThenIRB(InjectBB);
+
+  // get the args in a form we can pass to createcall
+  SmallVector<Value *, 4> ArgsVec;
+  for (auto &item : Fn->args()) {
+    // for class members, make sure that we bitcast the this pointer
+    // this is ensured for us by construction when annotating things in the
+    // frontend
+    if (&item == Fn->arg_begin()) {
+      auto bitcast = ThenIRB.CreateBitCast((Value *)&item,
+                                           Payload->arg_begin()->getType());
+      ArgsVec.push_back(bitcast);
+    } else {
+      ArgsVec.push_back((Value *)&item);
+    }
+  }
+
+  auto Args = makeArrayRef(ArgsVec);
+  auto SyringeCallInst = ThenIRB.CreateCall(Payload, Args);
+
+  // make the injected call a tail call, and give it the appropriate return
+  SyringeCallInst->setTailCall();
+  ReturnInst *RI = nullptr;
+  if (Fn->getReturnType()->isVoidTy()) {
+    RI = ThenIRB.CreateRetVoid();
+  } else {
+    RI = ThenIRB.CreateRet(
+        createCast(ThenIRB, SyringeCallInst, Fn->getReturnType()));
+  }
+
+  // the Syringe bool controls the injected behavior
+  // The logic is 
+  // if true
+  //   do tail call to injected function
+  //  else
+  //    normal funciton body
+  IRBuilder<> IRB(CmpBB);
+  auto loadInst =
+      IRB.CreateLoad(SyringeBool, createBoolNameFromBase(Fn->getName()));
+  auto trunc = IRB.CreateTrunc(loadInst, llvm::Type::getInt1Ty(Context));
+  IRB.CreateCondBr(trunc, InjectBB, EntryBB);
+}
+
+/// create funciton stub for behavior injection
+// Algorithm:
+// examine the functions in the module.
+// First process any payloads
+// -- makes processing injection sites in the same translation unit easier
+// -- also create any aliases required
+// Next process the injection sites
+// -- create any declarations needed for the payload/alias
+// -- copy the function body of the injeciton site into a new function
+// -- replace the target functions's body with a stub that makes an indirect
+// tail call through an implementation pointer
+// -- record the data required for registering the initialization function
+// -- if any changes to the injection site were made, register the init data
+// in a ctor
+bool SyringeLegacyPass::doBehaviorInjectionForModule(Module &M) {
+  auto cleanupPass = static_cast<UnifyFunctionExitNodes *>(
+      llvm::createUnifyFunctionExitNodesPass());
+  bool ChangedPayload = false;
+  bool ChangedInjection = false;
+  SmallVector<SimpleSyringeInitData, 8> InitData;
+
+  for (Function &F : M) {
+    ChangedPayload = true;
+    if (F.hasFnAttribute("syringe-payload")) {
+
+      if (F.hasFnAttribute("syringe-target-function")) {
+        auto TargetName =
+            F.getFnAttribute("syringe-target-function").getValueAsString();
+
+        // create alias
+        auto NewAlias =
+            GlobalAlias::create(createAliasNameFromBase(TargetName), &F);
+        NewAlias->setVisibility(
+            GlobalValue::VisibilityTypes::DefaultVisibility);
+      }
+    }
+  }
+
+  for (Function &F : M) {
+    if (F.hasFnAttribute("syringe-injection-site")) {
+      ChangedInjection = true;
+      ValueToValueMapTy VMap;
+
+      auto AliasName = createAliasNameFromBase(F.getName());
+
+      Function *DetourFunction;
+
+      // lookup the alias from the payload if it is in the same TU
+      auto *InternalAlias = M.getNamedAlias(AliasName);
+
+      if (InternalAlias == nullptr) {
+        // create allias if our lookup failed
+        auto AliasDecl = orc::cloneFunctionDecl(M, F, nullptr);
+        AliasDecl->setName(AliasName);
+        AliasDecl->removeFnAttr("syringe-injection-site");
+        AliasDecl->setLinkage(GlobalValue::LinkageTypes::ExternalLinkage);
+        DetourFunction = AliasDecl;
+      } else {
+        DetourFunction = dyn_cast<Function>(InternalAlias->getAliasee());
+      }
+
+      // Initialize the Syringe Boolean to 0 (false)
+      auto BoolIntializer = ConstantInt::get(M.getContext(), APInt(8, 0));
+      auto SyringeBool = new GlobalVariable(
+          M, BoolIntializer->getType(), false, GlobalValue::ExternalLinkage,
+          BoolIntializer, createBoolNameFromBase(F.getName()), nullptr,
+          GlobalValue::NotThreadLocal, 0, false);
+      // TODO: Default visibility can be removed after we have a builtin or intrinsic
+      SyringeBool->setVisibility(GlobalValue::DefaultVisibility);
+
+      auto Target = &F;
+
+      // modify function body to make direct call to injected alias
+      modifyFunctionBody(M, &F, DetourFunction, SyringeBool);
+      InitData.push_back({Target, SyringeBool});
+
+      // We've added new control flow and returns, make sure they are patched
+      cleanupPass->runOnFunction(F);
+    }
+  }
+
+  // if we've made a modification to the injection site, add a global ctor
+  // entry for the function
+  if (ChangedInjection) {
+    createCtorInit(M, InitData);
+  }
+
+  return ChangedPayload || ChangedInjection;
+}
+
+ModulePass *llvm::createSyringe() { return new SyringeLegacyPass(); }
+char SyringeLegacyPass::ID;
+
+INITIALIZE_PASS(SyringeLegacyPass, "syringe",
+                "Syringe: dynamic behavior injection.", false, false)

llvm/tools/opt/CMakeLists.txt

set(LLVM_LINK_COMPONENTS
   InstCombine
   Instrumentation
   MC
   ObjCARCOpts
   ScalarOpts
   Support
   Target
   TransformUtils
+  Syringe
   Vectorize
   Passes
   )
 
 # Support plugins.
 set(LLVM_NO_DEAD_STRIP 1)
 
 add_llvm_tool(opt

llvm/tools/opt/LLVMBuild.txt

  BitWriter
  CodeGen
  IRReader
  IPO
  Instrumentation
  Scalar
  ObjCARC
  Passes
+ Syringe
  all-targets

llvm/tools/opt/opt.cpp

 #include "llvm/Support/SourceMgr.h"
 #include "llvm/Support/SystemUtils.h"
 #include "llvm/Support/TargetRegistry.h"
 #include "llvm/Support/TargetSelect.h"
 #include "llvm/Support/ToolOutputFile.h"
 #include "llvm/Support/YAMLTraits.h"
 #include "llvm/Target/TargetMachine.h"
 #include "llvm/Transforms/Coroutines.h"
+#include "llvm/Transforms/Syringe.h"
 #include "llvm/Transforms/IPO/AlwaysInliner.h"
 #include "llvm/Transforms/IPO/PassManagerBuilder.h"
 #include "llvm/Transforms/Utils/Cloning.h"
 #include <algorithm>
 #include <memory>
 using namespace llvm;
 using namespace opt_tool;
 
int main(int argc, char **argv) {
   initializeObjCARCOpts(Registry);
   initializeVectorization(Registry);
   initializeIPO(Registry);
   initializeAnalysis(Registry);
   initializeTransformUtils(Registry);
   initializeInstCombine(Registry);
   initializeAggressiveInstCombine(Registry);
   initializeInstrumentation(Registry);
+  initializeSyringeLegacyPassPass(Registry);
   initializeTarget(Registry);
   // For codegen passes, only passes that do IR to IR transformation are
   // supported.
   initializeExpandMemCmpPassPass(Registry);
   initializeScalarizeMaskedMemIntrinPass(Registry);
   initializeCodeGenPreparePass(Registry);
   initializeAtomicExpandPass(Registry);
   initializeRewriteSymbolsLegacyPassPass(Registry);