Syringe clang support

[paulkirth]

Summary

This is a prototype for some improvements to Syringe that address some of its shortcomings by improving frontend support. It still requires templates to be instantiated manually, but otherwise works fairly well. There are some assertion errors that still need to be ironed out through appropriate bitcasts. Modification to adopt the direct call approach may relieve some of that trouble, and allow this design to work as intended.

The last major pain point is that, ideally a payload for a template function or dependent class will be instantiated automatically by the frontend. However, even though the template gets instantiated, it never reaches codegen. Some work needs to be done to identify a good way to force this instantiation.

clang/include/clang/Basic/Attr.td

 }
 
 def Artificial : InheritableAttr {
   let Spellings = [GCC<"artificial">];
   let Subjects = SubjectList<[InlineFunction], WarnDiag>;
   let Documentation = [ArtificialDocs];
 }
 
+def SyringeInjectionSite : InheritableAttr {
+  let Spellings = [Clang<"syringe_injection_site">];
+  let Subjects = SubjectList<[Function, ObjCMethod]>;
+  let Documentation = [SyringeDocs];
+}
+
+def SyringePayload : InheritableAttr {
+  let Spellings = [Clang<"syringe_payload">];
+  let Subjects = SubjectList<[Function, ObjCMethod]>;
+  let Args = [FunctionArgument<"SyringeTargetFunction">];
+  /*let Args = [StringArgument<"SyringeTargetFunction">];*/
+  let Documentation = [SyringeDocs];
+}
+
+def SyringeClassPayload : InheritableAttr {
+  let Spellings = [Clang<"syringe_class_payload">];
+  let Subjects = SubjectList<[Function, ObjCMethod]>;
+  let Args = [IdentifierArgument<"SyringeTargetClass">];
+  /*let Args = [StringArgument<"SyringeTargetFunction">];*/
+  let Documentation = [SyringeDocs];
+}
 def XRayInstrument : InheritableAttr {
   let Spellings = [Clang<"xray_always_instrument">,
                    Clang<"xray_never_instrument">];
   let Subjects = SubjectList<[Function, ObjCMethod]>;
   let Accessors = [Accessor<"alwaysXRayInstrument",
                      [Clang<"xray_always_instrument">]>,
                    Accessor<"neverXRayInstrument",
                      [Clang<"xray_never_instrument">]>];

clang/include/clang/Basic/AttrDocs.td

 computations.  The RenderScript runtime efficiently parallelizes ``kernel``
 functions to run on computational resources such as multi-core CPUs and GPUs.
 See the RenderScript_ documentation for more information.
 
 .. _RenderScript: https://developer.android.com/guide/topics/renderscript/compute.html
   }];
 }
 
+def SyringeDocs : Documentation {
+  let Category = DocCatFunction;
+  let Heading = "syringe_injection_site (clang::syringe_injection_site), syringe_injection_payload (clang::syringe_injection_payload)";
+  let Content = [{
+``__attribute__((syringe_injection_site))`` or ``[[clang::syringe_injection_site]]`` is used to mark member functions (in C++), methods (in Objective C), and free functions (in C, C++, and Objective C) to have new behaviors injected by Syringe. This will allow the Syringe runtime to modify the function's behavior dynamically as the program runs.
+
+``__attribute__((syringe_injection_payload(TARGET_FUNCTION)))`` or ``[[clang::syringe_injection_payload(TARGET_FUNCTION)]]`` is used to demark the payload function that Syringe will inject into invocations of TARGET_FUNCTION.
+
+If a function has neither of these attributes, they are ignored by the Syringe passes and runtime.
+  }];
+}
+
 def XRayDocs : Documentation {
   let Category = DocCatFunction;
   let Heading = "xray_always_instrument (clang::xray_always_instrument), xray_never_instrument (clang::xray_never_instrument), xray_log_args (clang::xray_log_args)";
   let Content = [{
 ``__attribute__((xray_always_instrument))`` or ``[[clang::xray_always_instrument]]`` is used to mark member functions (in C++), methods (in Objective C), and free functions (in C, C++, and Objective C) to be instrumented with XRay. This will cause the function to always have space at the beginning and exit points to allow for runtime patching.
 
 Conversely, ``__attribute__((xray_never_instrument))`` or ``[[clang::xray_never_instrument]]`` will inhibit the insertion of these instrumentation points.
 

clang/include/clang/Basic/DiagnosticSemaKinds.td

 def warn_param_typestate_mismatch : Warning<
   "argument not in expected state; expected '%0', observed '%1'">,
   InGroup<Consumed>, DefaultIgnore;
 
 // no_sanitize attribute
 def warn_unknown_sanitizer_ignored : Warning<
   "unknown sanitizer '%0' ignored">, InGroup<UnknownSanitizers>;
 
+// syringe_payload attribute
+def err_attribute_syringe_payload_arg_not_function : Error<
+  "'syringe_payload' argument %select{|%1 |%1 }0is not a %select{||single }0function">;
+
 def warn_impcast_vector_scalar : Warning<
   "implicit conversion turns vector to scalar: %0 to %1">,
   InGroup<Conversion>, DefaultIgnore;
 def warn_impcast_complex_scalar : Warning<
   "implicit conversion discards imaginary component: %0 to %1">,
   InGroup<Conversion>, DefaultIgnore;
 def err_impcast_complex_scalar : Error<
   "implicit conversion from %0 to %1 is not permitted in C++">;

clang/include/clang/Basic/Features.def

 FEATURE(enumerator_attributes, true)
 FEATURE(nullability, true)
 FEATURE(nullability_on_arrays, true)
 FEATURE(memory_sanitizer, LangOpts.Sanitize.has(SanitizerKind::Memory))
 FEATURE(thread_sanitizer, LangOpts.Sanitize.has(SanitizerKind::Thread))
 FEATURE(dataflow_sanitizer, LangOpts.Sanitize.has(SanitizerKind::DataFlow))
 FEATURE(efficiency_sanitizer,
         LangOpts.Sanitize.hasOneOf(SanitizerKind::Efficiency))
+FEATURE(syringe, LangOpts.SyringeInject)
 FEATURE(scudo, LangOpts.Sanitize.hasOneOf(SanitizerKind::Scudo))
 // Objective-C features
 FEATURE(objc_arr, LangOpts.ObjCAutoRefCount) // FIXME: REMOVE?
 FEATURE(objc_arc, LangOpts.ObjCAutoRefCount)
 FEATURE(objc_arc_fields, true)
 FEATURE(objc_arc_weak, LangOpts.ObjCWeak)
 FEATURE(objc_default_synthesize_properties, LangOpts.ObjC2)
 FEATURE(objc_fixed_enum, LangOpts.ObjC2)

clang/include/clang/Basic/LangOptions.h

public:
   /// WARNING: This is a deprecated field and will go away in the future.
   std::vector<std::string> XRayNeverInstrumentFiles;
 
   /// Paths to the XRay attribute list files, specifying which objects
   /// (files, functions, variables) should be imbued with the appropriate XRay
   /// attribute(s).
   std::vector<std::string> XRayAttrListFiles;
 
+  /// Paths to the Syringe attribute list files, specifying which objects
+  /// (files, functions, variables) should be imbued with the appropriate Syringe
+  /// attribute(s).
+  std::vector<std::string> SyringeConfigFiles;
+
+
   clang::ObjCRuntime ObjCRuntime;
 
   std::string ObjCConstantStringClass;
 
   /// The name of the handler function to be called when -ftrapv is
   /// specified.
   ///
   /// If none is specified, abort (GCC-compatible behaviour).

clang/include/clang/Basic/LangOptions.def

 LANGOPT(XRayInstrument, 1, 0, "controls whether to do XRay instrumentation")
 LANGOPT(XRayAlwaysEmitCustomEvents, 1, 0,
         "controls whether to always emit intrinsic calls to "
         "__xray_customevent(...) builtin.")
 LANGOPT(XRayAlwaysEmitTypedEvents, 1, 0,
         "controls whether to always emit intrinsic calls to "
         "__xray_typedevent(...) builtin.")
 
+LANGOPT(SyringeInject, 1, 0, "controls whether to enable Syringe behavior injection")
+
 LANGOPT(ForceEmitVTables, 1, 0, "whether to emit all vtables")
 
 BENIGN_LANGOPT(AllowEditorPlaceholders, 1, 0,
                "allow editor placeholders in source")
 
 ENUM_LANGOPT(ClangABICompat, ClangABI, 4, ClangABI::Latest,
              "version of Clang that we should attempt to be ABI-compatible "
              "with")

clang/include/clang/Driver/Options.td

 def finstrument_function_entry_bare : Flag<["-"], "finstrument-function-entry-bare">, Group<f_Group>, Flags<[CC1Option]>,
   HelpText<"Instrument function entry only, after inlining, without arguments to the instrumentation call">;
 def fcf_protection_EQ : Joined<["-"], "fcf-protection=">, Flags<[CoreOption, CC1Option]>, Group<f_Group>,
   HelpText<"Instrument control-flow architecture protection. Options: return, branch, full, none.">, Values<"return,branch,full,none">;
 def fcf_protection : Flag<["-"], "fcf-protection">, Group<f_Group>, Flags<[CoreOption, CC1Option]>,
   Alias<fcf_protection_EQ>, AliasArgs<["full"]>,
   HelpText<"Enable cf-protection in 'full' mode">;
 
+def fsyringe : Flag<["-"], "fsyringe">, Group<f_Group>,
+  Flags<[CC1Option]>,
+  HelpText<"Generate stub functions and indirect calls for Syringe to perform behavior injection">;
+def fnosyringe : Flag<["-"], "fno-syringe">, Group<f_Group>,
+  Flags<[CC1Option]>;
+
+def fsyringe_link_deps : Flag<["-"], "fsyringe-link-deps">, Group<f_Group>,
+  Flags<[CC1Option]>,
+  HelpText<"Tells clang to add the link dependencies for Syringe.">;
+def fnosyringe_link_deps : Flag<["-"], "fnosyringe-link-deps">, Group<f_Group>,
+  Flags<[CC1Option]>;
+
+def fsyringe_config_file :
+  JoinedOrSeparate<["-"], "fsyringe-config-file=">,
+  Group<f_Group>, Flags<[CC1Option]>,
+  HelpText<"Filename defining Syringe Injeciton sites and payloads in YAML.">;
+
 def fxray_instrument : Flag<["-"], "fxray-instrument">, Group<f_Group>,
   Flags<[CC1Option]>,
   HelpText<"Generate XRay instrumentation sleds on function entry and exit">;
 def fnoxray_instrument : Flag<["-"], "fno-xray-instrument">, Group<f_Group>,
   Flags<[CC1Option]>;
 
 def fxray_instruction_threshold_EQ :
   JoinedOrSeparate<["-"], "fxray-instruction-threshold=">,

clang/include/clang/Driver/SyringeArgs.h

+//===--- SyringeArgs.h - Arguments for Syringe ------------------*- C++ -*-===//
+//
+//                     The LLVM Compiler Infrastructure
+//
+// This file is distributed under the University of Illinois Open Source
+// License. See LICENSE.TXT for details.
+//
+//===----------------------------------------------------------------------===//
+#ifndef LLVM_CLANG_DRIVER_SYRINGEARGS_H
+#define LLVM_CLANG_DRIVER_SYRINGEARGS_H
+
+#include "clang/Driver/Types.h"
+#include "llvm/Option/Arg.h"
+#include "llvm/Option/ArgList.h"
+
+#include <string>
+#include <vector>
+
+namespace clang {
+namespace driver {
+
+class ToolChain;
+
+class SyringeArgs {
+  bool SyringeInject = false;
+  bool SyringeRT = true;
+  std::vector<std::string> ConfigFiles;
+
+public:
+  /// Parses the Syringe arguments from an argument list.
+  SyringeArgs(const ToolChain &TC, const llvm::opt::ArgList &Args);
+  void addArgs(const ToolChain &TC, const llvm::opt::ArgList &Args,
+               llvm::opt::ArgStringList &CmdArgs, types::ID InputType) const;
+
+  /// Checks if the Syringe Runtime is required
+  bool needsSyringeRt() const { return SyringeInject && SyringeRT; }
+  std::vector<std::string> &getConfigFiles() { return ConfigFiles; }
+};
+
+} // namespace driver
+} // namespace clang
+
+#endif // LLVM_CLANG_DRIVER_SYRINGEARGS_H

clang/include/clang/Driver/ToolChain.h

 
 namespace driver {
 
 class Driver;
 class InputInfo;
 class SanitizerArgs;
 class Tool;
 class XRayArgs;
+class SyringeArgs;
 
 /// Helper structure used to pass information extracted from clang executable
 /// name such as `i686-linux-android-g++`.
 struct ParsedClangName {
   /// Target part of the executable name, as `i686-linux-android`.
   std::string TargetPrefix;
 
   /// Driver mode part of the executable name, as `g++`.
private:
   Tool *getClang() const;
   Tool *getAssemble() const;
   Tool *getLink() const;
   Tool *getClangAs() const;
   Tool *getOffloadBundler() const;
 
   mutable std::unique_ptr<SanitizerArgs> SanitizerArguments;
   mutable std::unique_ptr<XRayArgs> XRayArguments;
+  mutable std::unique_ptr<SyringeArgs> SyringeArguments;
 
   /// The effective clang triple for the current Job.
   mutable llvm::Triple EffectiveTriple;
 
   /// Set the toolchain's effective clang triple.
   void setEffectiveTriple(llvm::Triple ET) const {
     EffectiveTriple = std::move(ET);
   }
public:
   const path_list &getProgramPaths() const { return ProgramPaths; }
 
   const MultilibSet &getMultilibs() const { return Multilibs; }
 
   const SanitizerArgs& getSanitizerArgs() const;
 
   const XRayArgs& getXRayArgs() const;
 
+  const SyringeArgs& getSyringeArgs() const;
+
   // Returns the Arg * that explicitly turned on/off rtti, or nullptr.
   const llvm::opt::Arg *getRTTIArg() const { return CachedRTTIArg; }
 
   // Returns the RTTIMode for the toolchain with the current arguments.
   RTTIMode getRTTIMode() const { return CachedRTTIMode; }
 
   /// Return any implicit target and/or mode flag for an invocation of
   /// the compiler driver as `ProgName`.

clang/include/clang/Frontend/CodeGenOptions.def

 CODEGENOPT(CFProtectionReturn , 1, 0) ///< if -fcf-protection is
                                       ///< set to full or return.
 CODEGENOPT(CFProtectionBranch , 1, 0) ///< if -fcf-protection is
                                       ///< set to full or branch.
 CODEGENOPT(XRayInstrumentFunctions , 1, 0) ///< Set when -fxray-instrument is
                                            ///< enabled.
 CODEGENOPT(StackSizeSection  , 1, 0) ///< Set when -fstack-size-section is enabled.
 
+CODEGENOPT(SyringeInjectBehaviors  , 1, 0) ///< Set when -fsyringe is enabled.
+
 ///< Set when -fxray-always-emit-customevents is enabled.
 CODEGENOPT(XRayAlwaysEmitCustomEvents , 1, 0)
 
 ///< Set when -fxray-always-emit-typedevents is enabled.
 CODEGENOPT(XRayAlwaysEmitTypedEvents , 1, 0)
 
 ///< Set the minimum number of instructions in a function to determine selective
 ///< XRay instrumentation.

clang/include/clang/Sema/Sema.h

class Sema {
   }
   bool shouldLinkPossiblyHiddenDecl(LookupResult &Old, const NamedDecl *New);
 
 public:
   typedef OpaquePtr<DeclGroupRef> DeclGroupPtrTy;
   typedef OpaquePtr<TemplateName> TemplateTy;
   typedef OpaquePtr<QualType> TypeTy;
 
+  std::vector<FunctionDecl*> FnDeclList;
+
   OpenCLOptions OpenCLFeatures;
   FPOptions FPFeatures;
 
   const LangOptions &LangOpts;
   Preprocessor &PP;
   ASTContext &Context;
   ASTConsumer &Consumer;
   DiagnosticsEngine &Diags;

clang/lib/CodeGen/BackendUtil.cpp

 #include "llvm/Support/PrettyStackTrace.h"
 #include "llvm/Support/TargetRegistry.h"
 #include "llvm/Support/Timer.h"
 #include "llvm/Support/raw_ostream.h"
 #include "llvm/Target/TargetMachine.h"
 #include "llvm/Target/TargetOptions.h"
 #include "llvm/Transforms/Coroutines.h"
 #include "llvm/Transforms/IPO.h"
+#include "llvm/Transforms/Syringe.h"
 #include "llvm/Transforms/IPO/AlwaysInliner.h"
 #include "llvm/Transforms/IPO/PassManagerBuilder.h"
 #include "llvm/Transforms/IPO/ThinLTOBitcodeWriter.h"
 #include "llvm/Transforms/InstCombine/InstCombine.h"
 #include "llvm/Transforms/Instrumentation.h"
 #include "llvm/Transforms/Instrumentation/BoundsChecking.h"
 #include "llvm/Transforms/Instrumentation/GCOVProfiler.h"
 #include "llvm/Transforms/ObjCARC.h"
static void addEfficiencySanitizerPass(const PassManagerBuilder &Builder,
   EfficiencySanitizerOptions Opts;
   if (LangOpts.Sanitize.has(SanitizerKind::EfficiencyCacheFrag))
     Opts.ToolType = EfficiencySanitizerOptions::ESAN_CacheFrag;
   else if (LangOpts.Sanitize.has(SanitizerKind::EfficiencyWorkingSet))
     Opts.ToolType = EfficiencySanitizerOptions::ESAN_WorkingSet;
   PM.add(createEfficiencySanitizerPass(Opts));
 }
 
+static void addSyringePass(const PassManagerBuilder &Builder,
+                                       legacy::PassManagerBase &PM) {
+  const PassManagerBuilderWrapper &BuilderWrapper =
+      static_cast<const PassManagerBuilderWrapper&>(Builder);
+  const LangOptions &LangOpts = BuilderWrapper.getLangOpts();
+  auto P = static_cast<SyringeLegacyPass*>(createSyringe());
+  auto FileList = LangOpts.SyringeConfigFiles;
+  for(auto& FileName : FileList)
+  {
+    P->parse(FileName);
+  }
+
+  PM.add(P);
+}
+
 static TargetLibraryInfoImpl *createTLII(llvm::Triple &TargetTriple,
                                          const CodeGenOptions &CodeGenOpts) {
   TargetLibraryInfoImpl *TLII = new TargetLibraryInfoImpl(TargetTriple);
   if (!CodeGenOpts.SimplifyLibCalls)
     TLII->disableAllFunctions();
   else {
     // Disable individual libc/libm calls in TargetLibraryInfo.
     LibFunc F;
void EmitAssemblyHelper::CreatePasses(legacy::PassManager &MPM,
   }
 
   if (CodeGenOpts.hasProfileClangInstr()) {
     InstrProfOptions Options;
     Options.NoRedZone = CodeGenOpts.DisableRedZone;
     Options.InstrProfileOutput = CodeGenOpts.InstrProfileOutput;
     MPM.add(createInstrProfilingLegacyPass(Options));
   }
+
+  if (LangOpts.SyringeInject) {
+    addSyringePass(PMBuilder, MPM);
+  }
+
   if (CodeGenOpts.hasProfileIRInstr()) {
     PMBuilder.EnablePGOInstrGen = true;
     if (!CodeGenOpts.InstrProfileOutput.empty())
       PMBuilder.PGOInstrGen = CodeGenOpts.InstrProfileOutput;
     else
       PMBuilder.PGOInstrGen = DefaultProfileGenName;
   }
   if (CodeGenOpts.hasProfileIRUse())

clang/lib/CodeGen/CGCall.cpp

if (TargetDecl) {
     if (TargetDecl->hasAttr<NoReturnAttr>())
       FuncAttrs.addAttribute(llvm::Attribute::NoReturn);
     if (TargetDecl->hasAttr<ColdAttr>())
       FuncAttrs.addAttribute(llvm::Attribute::Cold);
     if (TargetDecl->hasAttr<NoDuplicateAttr>())
       FuncAttrs.addAttribute(llvm::Attribute::NoDuplicate);
     if (TargetDecl->hasAttr<ConvergentAttr>())
       FuncAttrs.addAttribute(llvm::Attribute::Convergent);
-
     if (const FunctionDecl *Fn = dyn_cast<FunctionDecl>(TargetDecl)) {
       AddAttributesFromFunctionProtoType(
           getContext(), FuncAttrs, Fn->getType()->getAs<FunctionProtoType>());
       // Don't use [[noreturn]] or _Noreturn for a call to a virtual function.
       // These attributes are not inherited by overloads.
       const CXXMethodDecl *MD = dyn_cast<CXXMethodDecl>(Fn);
       if (Fn->isNoReturn() && !(AttrOnCallSite && MD && MD->isVirtual()))
         FuncAttrs.addAttribute(llvm::Attribute::NoReturn);

clang/lib/CodeGen/CMakeLists.txt

set(LLVM_LINK_COMPONENTS
   LTO
   Linker
   MC
   ObjCARCOpts
   Object
   Passes
   ProfileData
   ScalarOpts
+  Syringe
   Support
   Target
   TransformUtils
   )
 
 # In a standard Clang+LLVM build, we need to generate intrinsics before
 # building codegen. In a standalone build, LLVM is already built and we don't
 # need this dependency. Furthermore, LLVM doesn't export it so we can't have

clang/lib/CodeGen/CodeGenFunction.h

public:
   /// ShouldInstrumentFunction - Return true if the current function should be
   /// instrumented with __cyg_profile_func_* calls
   bool ShouldInstrumentFunction();
 
   /// ShouldXRayInstrument - Return true if the current function should be
   /// instrumented with XRay nop sleds.
   bool ShouldXRayInstrumentFunction() const;
 
+  /// ShouldXRayInstrument - Return true if the current function should be
+  /// instrumented with XRay nop sleds.
+  bool ShouldSyringeInject() const;
+
   /// AlwaysEmitXRayCustomEvents - Return true if we must unconditionally emit
   /// XRay custom event handling calls.
   bool AlwaysEmitXRayCustomEvents() const;
 
   /// AlwaysEmitXRayTypedEvents - Return true if clang must unconditionally emit
   /// XRay typed event handling calls.
   bool AlwaysEmitXRayTypedEvents() const;
 

clang/lib/CodeGen/CodeGenFunction.cpp

 }
 
 /// ShouldXRayInstrument - Return true if the current function should be
 /// instrumented with XRay nop sleds.
 bool CodeGenFunction::ShouldXRayInstrumentFunction() const {
   return CGM.getCodeGenOpts().XRayInstrumentFunctions;
 }
 
+//// ShouldSyringeInject - Return true if the current function should use
+/// Syringe to modify runtime behavior.
+bool CodeGenFunction::ShouldSyringeInject() const {
+  return CGM.getCodeGenOpts().SyringeInjectBehaviors;
+}
+
 /// AlwaysEmitXRayCustomEvents - Return true if we should emit IR for calls to
 /// the __xray_customevent(...) builtin calls, when doing XRay instrumentation.
 bool CodeGenFunction::AlwaysEmitXRayCustomEvents() const {
   return CGM.getCodeGenOpts().XRayInstrumentFunctions &&
          (CGM.getCodeGenOpts().XRayAlwaysEmitCustomEvents ||
           CGM.getCodeGenOpts().XRayInstrumentationBundle.Mask ==
               XRayInstrKind::Custom);
 }
#undef SANITIZER
   // Ignore unrelated casts in STL allocate() since the allocator must cast
   // from void* to T* before object initialization completes. Don't match on the
   // namespace because not all allocators are in std::
   if (D && SanOpts.has(SanitizerKind::CFIUnrelatedCast)) {
     if (matchesStlAllocatorFn(D, getContext()))
       SanOpts.Mask &= ~SanitizerKind::CFIUnrelatedCast;
   }
 
+  // Handle Syringe annotations
+  if (D && ShouldSyringeInject()) {
+    //https://stackoverflow.com/questions/40740604/how-do-i-get-the-mangled-name-of-a-nameddecl-in-clang
+    const auto getMangledName = [&](FunctionDecl *decl) {
+      auto mangleContext = decl->getASTContext().createMangleContext();
+
+      if (!mangleContext->shouldMangleDeclName(decl)) {
+        return decl->getNameInfo().getName().getAsString();
+      }
+      std::string mangledName;
+      llvm::raw_string_ostream ostream(mangledName);
+      mangleContext->mangleName(decl, ostream);
+      ostream.flush();
+      delete mangleContext;
+      return mangledName;
+    };
+
+    if (const auto *SyringeAttr = D->getAttr<SyringeInjectionSiteAttr>()) {
+      Fn->addFnAttr("syringe-injection-site");
+    } else if (auto TD = D->getAsFunction()->getPrimaryTemplate()) {
+      if (auto SyringeAttr = TD->getAsFunction()->getAttr<SyringeInjectionSiteAttr>()) {
+        Fn->addFnAttr("syringe-injection-site");
+      }
+    }
+
+    if (const auto *SyringeAttr = D->getAttr<SyringePayloadAttr>()) {
+      if (Fn->hasFnAttribute("syringe-injection-site")) {
+        // don't do anything for injection sites
+      } else {
+        Fn->addFnAttr("syringe-payload");
+        auto fnDecl = SyringeAttr->getSyringeTargetFunction();
+
+        if (auto tempDecl = fnDecl->getPrimaryTemplate()) {
+          auto curFnDcl = dyn_cast<FunctionDecl>(const_cast<Decl*>(GD.getDecl()));
+          auto tempArgs = curFnDcl->getTemplateSpecializationArgs();
+          void *InsertPos = nullptr;
+
+          ArrayRef<TemplateArgument> Innermost = tempArgs->asArray();
+          FunctionDecl *SpecFunc =
+              tempDecl->findSpecialization(Innermost, InsertPos);
+
+          // If we already have a function template specialization, return it.
+          if (SpecFunc) {
+            curFnDcl->dropAttr<SyringePayloadAttr>();
+            curFnDcl->addAttr(::new SyringePayloadAttr(
+                SyringeAttr->getRange(), curFnDcl->getASTContext(), SpecFunc,
+                SyringeAttr->getSpellingListIndex()));
+            fnDecl = SpecFunc;
+          }
+        }
+        Fn->addFnAttr("syringe-target-function", getMangledName(fnDecl));
+      }
+    } else if (const auto *SyringeAttr =
+                   D->getAttr<SyringeClassPayloadAttr>()) {
+      auto curFnDcl = dyn_cast<FunctionDecl>(D);
+      auto method = dyn_cast<CXXMethodDecl>(curFnDcl);
+      if (method) {
+        auto parent = method->getParent();
+        auto base_range = parent->bases();
+        for (auto base : base_range) {
+          if (auto bt = base.getType().getBaseTypeIdentifier()) {
+
+            if (bt == SyringeAttr->getSyringeTargetClass()) {
+              for (auto meth :
+                   base.getType()->getAsCXXRecordDecl()->methods()) {
+                if (curFnDcl->getNameAsString() == meth->getNameAsString()) {
+                  Fn->addFnAttr("syringe-payload");
+                  Fn->addFnAttr("syringe-target-function",
+                                getMangledName(meth));
+                }
+              }
+            }
+          }
+        }
+      }
+    }
+  }
+
   // Apply xray attributes to the function (as a string, for now)
   bool InstrumentXray = ShouldXRayInstrumentFunction() &&
                         CGM.getCodeGenOpts().XRayInstrumentationBundle.has(
                             XRayInstrKind::Function);
   if (D && InstrumentXray) {
     if (const auto *XRayAttr = D->getAttr<XRayInstrumentAttr>()) {
       if (XRayAttr->alwaysXRayInstrument())
         Fn->addFnAttr("function-instrument", "xray-always");

clang/lib/CodeGen/CodeGenModule.h

bool isInSanitizerBlacklist(llvm::GlobalVariable *GV, SourceLocation Loc,
                               StringRef Category = StringRef()) const;
 
   /// Imbue XRay attributes to a function, applying the always/never attribute
   /// lists in the process. Returns true if we did imbue attributes this way,
   /// false otherwise.
   bool imbueXRayAttrs(llvm::Function *Fn, SourceLocation Loc,
                       StringRef Category = StringRef()) const;
 
+
+  /// Imbue Syringe attributes to a function.
+  /// Returns true if we did imbue attributes this way, false otherwise.
+  bool imbueSyringeAttrs(llvm::Function *Fn) const;
+
   SanitizerMetadata *getSanitizerMetadata() {
     return SanitizerMD.get();
   }
 
   void addDeferredVTable(const CXXRecordDecl *RD) {
     DeferredVTables.push_back(RD);
   }
 

clang/lib/CodeGen/CodeGenModule.cpp

bool CodeGenModule::MustBeEmitted(const ValueDecl *Global) {
   if (LangOpts.EmitAllDecls)
     return true;
 
   return getContext().DeclMustBeEmitted(Global);
 }
 
 bool CodeGenModule::MayBeEmittedEagerly(const ValueDecl *Global) {
   if (const auto *FD = dyn_cast<FunctionDecl>(Global))
-    if (FD->getTemplateSpecializationKind() == TSK_ImplicitInstantiation)
+    if (FD->getTemplateSpecializationKind() == TSK_ImplicitInstantiation || FD->getAttr<SyringePayloadAttr>())
       // Implicit template instantiations may change linkage if they are later
       // explicitly instantiated, so they should not be emitted eagerly.
       return false;
   if (const auto *VD = dyn_cast<VarDecl>(Global))
     if (Context.getInlineVariableDefinitionKind(VD) ==
         ASTContext::InlineVariableDefinitionKind::WeakUnknown)
       // A definition of an inline constexpr static data member may change
       // linkage later if it's redeclared outside the class.
if (const auto *Method = dyn_cast<CXXMethodDecl>(D)) {
         EmitGlobalFunctionDefinition(GD, GV);
 
       if (Method->isVirtual())
         getVTables().EmitThunks(GD);
 
       return;
     }
 
+    if(auto *Func = dyn_cast<FunctionDecl>(D))
+    {
+      if(auto * SyringeAttr = Func->getAttr<SyringePayloadAttr>())
+      {
+        llvm::errs() << "Found Payload Global Definition\n";
+        Func->dump();
+        llvm::errs() << "Payload Global Value:\n";
+        if (GV)
+          GV->print(llvm::errs());
+      }
+    }
+
     return EmitGlobalFunctionDefinition(GD, GV);
   }
 
   if (const auto *VD = dyn_cast<VarDecl>(D))
     return EmitGlobalVarDefinition(VD, !VD->hasDefinition());
 
   llvm_unreachable("Invalid argument to EmitGlobalDefinition()");
 }

 }
 
 void CodeGenModule::ClearUnusedCoverageMapping(const Decl *D) {
   // Do we need to generate coverage mapping?
   if (!CodeGenOpts.CoverageMapping)
     return;
   if (const auto *Fn = dyn_cast<FunctionDecl>(D)) {
     if (Fn->isTemplateInstantiation())
+      if(!Fn->getAttr<SyringePayloadAttr>())
         ClearUnusedCoverageMapping(Fn->getTemplateInstantiationPattern());
   }
   auto I = DeferredEmptyCoverageMappingDecls.find(D);
   if (I == DeferredEmptyCoverageMappingDecls.end())
     DeferredEmptyCoverageMappingDecls[D] = false;
   else
     I->second = false;
 }
 

clang/lib/Driver/CMakeLists.txt

add_clang_library(clangDriver
   Compilation.cpp
   Distro.cpp
   Driver.cpp
   DriverOptions.cpp
   Job.cpp
   Multilib.cpp
   Phases.cpp
   SanitizerArgs.cpp
+  SyringeArgs.cpp
   Tool.cpp
   ToolChain.cpp
   ToolChains/Arch/AArch64.cpp
   ToolChains/Arch/ARM.cpp
   ToolChains/Arch/Mips.cpp
   ToolChains/Arch/PPC.cpp
   ToolChains/Arch/RISCV.cpp
   ToolChains/Arch/Sparc.cpp

clang/lib/Driver/SyringeArgs.cpp

+//===--- SyringeArgs.cpp - Arguments for Syringe --------------------------===//
+//
+//                     The LLVM Compiler Infrastructure
+//
+// This file is distributed under the University of Illinois Open Source
+// License. See LICENSE.TXT for details.
+//
+//===----------------------------------------------------------------------===//
+#include "clang/Driver/SyringeArgs.h"
+#include "ToolChains/CommonArgs.h"
+#include "clang/Driver/Driver.h"
+#include "clang/Driver/DriverDiagnostic.h"
+#include "clang/Driver/Options.h"
+#include "llvm/Support/FileSystem.h"
+#include "llvm/Support/Path.h"
+
+using namespace clang;
+using namespace clang::driver;
+using namespace llvm::opt;
+
+namespace {
+constexpr char SyringeInstrumentOption[] = "-fsyringe";
+constexpr char SyringeConfigOption[] = "-fsyringe-config-file=";
+} // namespace
+
+SyringeArgs::SyringeArgs(const ToolChain &TC, const ArgList &Args) {
+  const Driver &D = TC.getDriver();
+  const llvm::Triple &Triple = TC.getTriple();
+  if (Args.hasFlag(options::OPT_fsyringe, options::OPT_fnosyringe, false)) {
+    if (Triple.getOS() == llvm::Triple::Linux ||
+        Triple.getOS() == llvm::Triple::Fuchsia) {
+      switch (Triple.getArch()) {
+      case llvm::Triple::x86_64:
+      case llvm::Triple::arm:
+      case llvm::Triple::aarch64:
+      case llvm::Triple::ppc64le:
+      case llvm::Triple::mips:
+      case llvm::Triple::mipsel:
+      case llvm::Triple::mips64:
+      case llvm::Triple::mips64el:
+        break;
+      default:
+        D.Diag(diag::err_drv_clang_unsupported)
+            << (std::string(SyringeInstrumentOption) + " on " + Triple.str());
+      }
+    } else if (Triple.getOS() == llvm::Triple::FreeBSD ||
+               Triple.getOS() == llvm::Triple::OpenBSD ||
+               Triple.getOS() == llvm::Triple::Darwin ||
+               Triple.getOS() == llvm::Triple::NetBSD) {
+      if (Triple.getArch() != llvm::Triple::x86_64) {
+        D.Diag(diag::err_drv_clang_unsupported)
+            << (std::string(SyringeInstrumentOption) + " on " + Triple.str());
+      }
+    } else {
+      D.Diag(diag::err_drv_clang_unsupported)
+          << (std::string(SyringeInstrumentOption) + " on " + Triple.str());
+    }
+
+    SyringeInject = true;
+
+    if (!Args.hasFlag(options::OPT_fsyringe_link_deps,
+                      options::OPT_fnosyringe_link_deps, true))
+      SyringeRT = false;
+
+    for (const auto &Filename :
+         Args.getAllArgValues(options::OPT_fsyringe_config_file)) {
+      if (llvm::sys::fs::exists(Filename)) {
+        ConfigFiles.push_back(Filename);
+        // ExtraDeps.push_back(Filename);
+      } else
+        D.Diag(clang::diag::err_drv_no_such_file) << Filename;
+    }
+  }
+}
+
+void SyringeArgs::addArgs(const ToolChain &TC, const ArgList &Args,
+                          ArgStringList &CmdArgs, types::ID InputType) const {
+  if (!SyringeInject)
+    return;
+
+  CmdArgs.push_back(SyringeInstrumentOption);
+  for (const auto &Config : ConfigFiles) {
+    SmallString<64> ConfigFileOpt(SyringeConfigOption);
+    ConfigFileOpt += Config;
+    CmdArgs.push_back(Args.MakeArgString(ConfigFileOpt));
+  }
+}

clang/lib/Driver/ToolChain.cpp

 #include "clang/Basic/VirtualFileSystem.h"
 #include "clang/Config/config.h"
 #include "clang/Driver/Action.h"
 #include "clang/Driver/Driver.h"
 #include "clang/Driver/DriverDiagnostic.h"
 #include "clang/Driver/Job.h"
 #include "clang/Driver/Options.h"
 #include "clang/Driver/SanitizerArgs.h"
+#include "clang/Driver/SyringeArgs.h"
 #include "clang/Driver/XRayArgs.h"
 #include "llvm/ADT/STLExtras.h"
 #include "llvm/ADT/SmallString.h"
 #include "llvm/ADT/StringRef.h"
 #include "llvm/ADT/Triple.h"
 #include "llvm/ADT/Twine.h"
 #include "llvm/Config/llvm-config.h"
 #include "llvm/MC/MCTargetOptions.h"

 }
 
 const XRayArgs& ToolChain::getXRayArgs() const {
   if (!XRayArguments.get())
     XRayArguments.reset(new XRayArgs(*this, Args));
   return *XRayArguments.get();
 }
 
+const SyringeArgs& ToolChain::getSyringeArgs() const {
+  if (!SyringeArguments.get())
+    SyringeArguments.reset(new SyringeArgs(*this, Args));
+  return *SyringeArguments.get();
+}
+
 namespace {
 
 struct DriverSuffix {
   const char *Suffix;
   const char *ModeFlag;
 };
 
 } // namespace

clang/lib/Driver/ToolChains/Clang.cpp

 #include "clang/Basic/CharInfo.h"
 #include "clang/Basic/LangOptions.h"
 #include "clang/Basic/ObjCRuntime.h"
 #include "clang/Basic/Version.h"
 #include "clang/Driver/DriverDiagnostic.h"
 #include "clang/Driver/Options.h"
 #include "clang/Driver/SanitizerArgs.h"
 #include "clang/Driver/XRayArgs.h"
+#include "clang/Driver/SyringeArgs.h"
 #include "llvm/ADT/StringExtras.h"
 #include "llvm/Config/llvm-config.h"
 #include "llvm/Option/ArgList.h"
 #include "llvm/Support/CodeGen.h"
 #include "llvm/Support/Compression.h"
 #include "llvm/Support/FileSystem.h"
 #include "llvm/Support/Path.h"
 #include "llvm/Support/Process.h"
#endif
   }
 
   const SanitizerArgs &Sanitize = getToolChain().getSanitizerArgs();
   Sanitize.addArgs(getToolChain(), Args, CmdArgs, InputType);
 
   const XRayArgs &XRay = getToolChain().getXRayArgs();
   XRay.addArgs(getToolChain(), Args, CmdArgs, InputType);
 
+  const SyringeArgs &Syringe = getToolChain().getSyringeArgs();
+  Syringe.addArgs(getToolChain(), Args, CmdArgs, InputType);
+
   if (getToolChain().SupportsProfiling())
     Args.AddLastArg(CmdArgs, options::OPT_pg);
 
   if (getToolChain().SupportsProfiling())
     Args.AddLastArg(CmdArgs, options::OPT_mfentry);
 
   // -flax-vector-conversions is default.
   if (!Args.hasFlag(options::OPT_flax_vector_conversions,
#endif
 
   if (Args.hasFlag(options::OPT_fgnu89_inline, options::OPT_fno_gnu89_inline,
                    false))
     CmdArgs.push_back("-fgnu89-inline");
 
   if (Args.hasArg(options::OPT_fno_inline))
     CmdArgs.push_back("-fno-inline");
 
+  if (Args.hasArg(options::OPT_fnosyringe))
+    CmdArgs.push_back("-fno-syringe");
+
+  if (Args.hasArg(options::OPT_fsyringe))
+    CmdArgs.push_back("-fsyringe");
+
   if (Arg* InlineArg = Args.getLastArg(options::OPT_finline_functions,
                                        options::OPT_finline_hint_functions,
                                        options::OPT_fno_inline_functions))
     InlineArg->render(Args, CmdArgs);
 
   Args.AddLastArg(CmdArgs, options::OPT_fexperimental_new_pass_manager,
                   options::OPT_fno_experimental_new_pass_manager);
 

clang/lib/Driver/ToolChains/CommonArgs.h

void linkSanitizerRuntimeDeps(const ToolChain &TC,
                               llvm::opt::ArgStringList &CmdArgs);
 
 bool addXRayRuntime(const ToolChain &TC, const llvm::opt::ArgList &Args,
                     llvm::opt::ArgStringList &CmdArgs);
 
 void linkXRayRuntimeDeps(const ToolChain &TC,
                          llvm::opt::ArgStringList &CmdArgs);
 
+bool addSyringeRuntime(const ToolChain &TC, const llvm::opt::ArgList &Args,
+                    llvm::opt::ArgStringList &CmdArgs);
+
+void linkSyringeRuntimeDeps(const ToolChain &TC,
+                         llvm::opt::ArgStringList &CmdArgs);
+
 void AddRunTimeLibs(const ToolChain &TC, const Driver &D,
                     llvm::opt::ArgStringList &CmdArgs,
                     const llvm::opt::ArgList &Args);
 
 void AddOpenMPLinkerScript(const ToolChain &TC, Compilation &C,
                            const InputInfo &Output,
                            const InputInfoList &Inputs,
                            const llvm::opt::ArgList &Args,

clang/lib/Driver/ToolChains/CommonArgs.cpp

 #include "clang/Driver/Driver.h"
 #include "clang/Driver/DriverDiagnostic.h"
 #include "clang/Driver/Job.h"
 #include "clang/Driver/Options.h"
 #include "clang/Driver/SanitizerArgs.h"
 #include "clang/Driver/ToolChain.h"
 #include "clang/Driver/Util.h"
 #include "clang/Driver/XRayArgs.h"
+#include "clang/Driver/SyringeArgs.h"
 #include "llvm/ADT/STLExtras.h"
 #include "llvm/ADT/SmallString.h"
 #include "llvm/ADT/StringExtras.h"
 #include "llvm/ADT/StringSwitch.h"
 #include "llvm/ADT/Twine.h"
 #include "llvm/Option/Arg.h"
 #include "llvm/Option/ArgList.h"
 #include "llvm/Option/Option.h"
bool tools::addSanitizerRuntimes(const ToolChain &TC, const ArgList &Args,
 
   const SanitizerArgs &SanArgs = TC.getSanitizerArgs();
   if (SanArgs.hasCrossDsoCfi() && !AddExportDynamic)
     CmdArgs.push_back("-export-dynamic-symbol=__cfi_check");
 
   return !StaticRuntimes.empty() || !NonWholeStaticRuntimes.empty();
 }
 
-bool tools::addXRayRuntime(const ToolChain&TC, const ArgList &Args, ArgStringList &CmdArgs) {
+bool tools::addSyringeRuntime(const ToolChain &TC, const ArgList &Args,
+                              ArgStringList &CmdArgs) {
+  if (Args.hasArg(options::OPT_shared))
+    return false;
+
+  if (TC.getSyringeArgs().needsSyringeRt()) {
+    CmdArgs.push_back("-whole-archive");
+    CmdArgs.push_back(TC.getCompilerRTArgString(Args, "syringe", false));
+    CmdArgs.push_back("-no-whole-archive");
+    return true;
+  }
+
+  return false;
+}
+
+void tools::linkSyringeRuntimeDeps(const ToolChain &TC,
+                                   ArgStringList &CmdArgs) {
+  CmdArgs.push_back("--no-as-needed");
+  CmdArgs.push_back("-lpthread");
+  if (TC.getTriple().getOS() != llvm::Triple::OpenBSD)
+    CmdArgs.push_back("-lrt");
+  CmdArgs.push_back("-lm");
+
+  if (TC.getTriple().getOS() != llvm::Triple::FreeBSD &&
+      TC.getTriple().getOS() != llvm::Triple::NetBSD &&
+      TC.getTriple().getOS() != llvm::Triple::OpenBSD)
+    CmdArgs.push_back("-ldl");
+}
+
+bool tools::addXRayRuntime(const ToolChain& TC, const ArgList &Args, ArgStringList &CmdArgs) {
   if (Args.hasArg(options::OPT_shared))
     return false;
 
   if (TC.getXRayArgs().needsXRayRt()) {
     CmdArgs.push_back("-whole-archive");
     CmdArgs.push_back(TC.getCompilerRTArgString(Args, "xray", false));
     for (const auto &Mode : TC.getXRayArgs().modeList())
       CmdArgs.push_back(TC.getCompilerRTArgString(Args, Mode, false));

clang/lib/Driver/ToolChains/Darwin.h

public:
 
   /// }
 
 private:
   void AddLinkSanitizerLibArgs(const llvm::opt::ArgList &Args,
                                llvm::opt::ArgStringList &CmdArgs,
                                StringRef Sanitizer,
                                bool shared = true) const;
+
+  void addSyringeRTLibArgs(const llvm::opt::ArgList &Args,
+                           llvm::opt::ArgStringList &CmdArgs,
+                           bool shared = true) const;
 };
 
 } // end namespace toolchains
 } // end namespace driver
 } // end namespace clang
 
 #endif // LLVM_CLANG_LIB_DRIVER_TOOLCHAINS_DARWIN_H

clang/lib/Driver/ToolChains/Darwin.cpp

 #include "clang/Basic/AlignedAllocation.h"
 #include "clang/Basic/ObjCRuntime.h"
 #include "clang/Basic/VirtualFileSystem.h"
 #include "clang/Driver/Compilation.h"
 #include "clang/Driver/Driver.h"
 #include "clang/Driver/DriverDiagnostic.h"
 #include "clang/Driver/Options.h"
 #include "clang/Driver/SanitizerArgs.h"
+#include "clang/Driver/SyringeArgs.h"
 #include "llvm/ADT/StringSwitch.h"
 #include "llvm/Option/ArgList.h"
 #include "llvm/Support/Path.h"
 #include "llvm/Support/ScopedPrinter.h"
 #include "llvm/Support/TargetParser.h"
 #include <cstdlib> // ::getenv
 
 using namespace clang::driver;
void DarwinClang::AddLinkSanitizerLibArgs(const ArgList &Args,
   AddLinkRuntimeLib(Args, CmdArgs,
                     (Twine("libclang_rt.") + Sanitizer + "_" +
                      getOSLibraryNameSuffix() +
                      (Shared ? "_dynamic.dylib" : ".a"))
                         .str(),
                     RLO);
 }
 
+void DarwinClang::addSyringeRTLibArgs(const llvm::opt::ArgList &Args,
+                                      llvm::opt::ArgStringList &CmdArgs,
+                                      bool Shared) const {
+  auto RLO = RuntimeLinkOptions(RLO_AlwaysLink | (Shared ? RLO_AddRPath : 0U));
+  AddLinkRuntimeLib(Args, CmdArgs,
+                    (Twine("libclang_rt.syringe_") + getOSLibraryNameSuffix() +
+                     (Shared ? "_dynamic.dylib" : ".a"))
+                        .str(),
+                    RLO);
+}
+
 ToolChain::RuntimeLibType DarwinClang::GetRuntimeLibType(
     const ArgList &Args) const {
   if (Arg* A = Args.getLastArg(options::OPT_rtlib_EQ)) {
     StringRef Value = A->getValue();
     if (Value != "compiler-rt")
       getDriver().Diag(clang::diag::err_drv_unsupported_rtlib_for_platform)
           << Value << "darwin";
   }
void DarwinClang::AddLinkRuntimeLibArgs(const ArgList &Args,
   // Reject -static-libgcc for now, we can deal with this when and if someone
   // cares. This is useful in situations where someone wants to statically link
   // something like libstdc++, and needs its runtime support routines.
   if (const Arg *A = Args.getLastArg(options::OPT_static_libgcc)) {
     getDriver().Diag(diag::err_drv_unsupported_opt) << A->getAsString(Args);
     return;
   }
 
+  if (getSyringeArgs().needsSyringeRt()) {
+    addSyringeRTLibArgs(Args, CmdArgs, false);
+  }
+
   const SanitizerArgs &Sanitize = getSanitizerArgs();
   if (Sanitize.needsAsanRt())
     AddLinkSanitizerLibArgs(Args, CmdArgs, "asan");
   if (Sanitize.needsLsanRt())
     AddLinkSanitizerLibArgs(Args, CmdArgs, "lsan");
   if (Sanitize.needsUbsanRt())
     AddLinkSanitizerLibArgs(Args, CmdArgs,
                             Sanitize.requiresMinimalRuntime() ? "ubsan_minimal"

clang/lib/Driver/ToolChains/FreeBSD.cpp

void freebsd::Linker::ConstructJob(Compilation &C, const JobAction &JA,
   if (D.isUsingLTO()) {
     assert(!Inputs.empty() && "Must have at least one input.");
     AddGoldPlugin(ToolChain, Args, CmdArgs, Output, Inputs[0],
                   D.getLTOMode() == LTOK_Thin);
   }
 
   bool NeedsSanitizerDeps = addSanitizerRuntimes(ToolChain, Args, CmdArgs);
   bool NeedsXRayDeps = addXRayRuntime(ToolChain, Args, CmdArgs);
+  bool NeedsSyringeDeps = addSyringeRuntime(ToolChain, Args, CmdArgs);
   AddLinkerInputs(ToolChain, Inputs, Args, CmdArgs, JA);
 
   if (!Args.hasArg(options::OPT_nostdlib, options::OPT_nodefaultlibs)) {
     addOpenMPRuntime(CmdArgs, ToolChain, Args);
     if (D.CCCIsCXX()) {
       if (ToolChain.ShouldLinkCXXStdlib(Args))
         ToolChain.AddCXXStdlibLibArgs(Args, CmdArgs);
       if (Args.hasArg(options::OPT_pg))
         CmdArgs.push_back("-lm_p");
       else
         CmdArgs.push_back("-lm");
     }
     if (NeedsSanitizerDeps)
       linkSanitizerRuntimeDeps(ToolChain, CmdArgs);
     if (NeedsXRayDeps)
       linkXRayRuntimeDeps(ToolChain, CmdArgs);
+    if (NeedsSyringeDeps)
+      linkSyringeRuntimeDeps(ToolChain, CmdArgs);
     // FIXME: For some reason GCC passes -lgcc and -lgcc_s before adding
     // the default system libraries. Just mimic this for now.
     if (Args.hasArg(options::OPT_pg))
       CmdArgs.push_back("-lgcc_p");
     else
       CmdArgs.push_back("-lgcc");
     if (Args.hasArg(options::OPT_static)) {
       CmdArgs.push_back("-lgcc_eh");

clang/lib/Driver/ToolChains/Gnu.cpp

AddGoldPlugin(ToolChain, Args, CmdArgs, Output, Inputs[0],
                   D.getLTOMode() == LTOK_Thin);
   }
 
   if (Args.hasArg(options::OPT_Z_Xlinker__no_demangle))
     CmdArgs.push_back("--no-demangle");
 
   bool NeedsSanitizerDeps = addSanitizerRuntimes(ToolChain, Args, CmdArgs);
   bool NeedsXRayDeps = addXRayRuntime(ToolChain, Args, CmdArgs);
+  bool NeedsSyringeDeps = addSyringeRuntime(ToolChain, Args, CmdArgs);
   AddLinkerInputs(ToolChain, Inputs, Args, CmdArgs, JA);
   // The profile runtime also needs access to system libraries.
   getToolChain().addProfileRTLibs(Args, CmdArgs);
 
   if (D.CCCIsCXX() &&
       !Args.hasArg(options::OPT_nostdlib, options::OPT_nodefaultlibs)) {
     if (ToolChain.ShouldLinkCXXStdlib(Args)) {
       bool OnlyLibstdcxxStatic = Args.hasArg(options::OPT_static_libstdcxx) &&
if (!Args.hasArg(options::OPT_nodefaultlibs)) {
         CmdArgs.push_back("--start-group");
 
       if (NeedsSanitizerDeps)
         linkSanitizerRuntimeDeps(ToolChain, CmdArgs);
 
       if (NeedsXRayDeps)
         linkXRayRuntimeDeps(ToolChain, CmdArgs);
 
+      if (NeedsSyringeDeps)
+        linkSyringeRuntimeDeps(ToolChain, CmdArgs);
+
       bool WantPthread = Args.hasArg(options::OPT_pthread) ||
                          Args.hasArg(options::OPT_pthreads);
 
       // FIXME: Only pass GompNeedsRT = true for platforms with libgomp that
       // require librt. Most modern Linux platforms do, but some may not.
       if (addOpenMPRuntime(CmdArgs, ToolChain, Args,
                            JA.isHostOffloading(Action::OFK_OpenMP),
                            /* GompNeedsRT= */ true))

clang/lib/Driver/ToolChains/NetBSD.cpp

void netbsd::Linker::ConstructJob(Compilation &C, const JobAction &JA,
   Args.AddAllArgs(CmdArgs, options::OPT_e);
   Args.AddAllArgs(CmdArgs, options::OPT_s);
   Args.AddAllArgs(CmdArgs, options::OPT_t);
   Args.AddAllArgs(CmdArgs, options::OPT_Z_Flag);
   Args.AddAllArgs(CmdArgs, options::OPT_r);
 
   bool NeedsSanitizerDeps = addSanitizerRuntimes(getToolChain(), Args, CmdArgs);
   bool NeedsXRayDeps = addXRayRuntime(ToolChain, Args, CmdArgs);
+  bool NeedsSyringeDeps = addSyringeRuntime(ToolChain, Args, CmdArgs);
   AddLinkerInputs(getToolChain(), Inputs, Args, CmdArgs, JA);
 
   unsigned Major, Minor, Micro;
   ToolChain.getTriple().getOSVersion(Major, Minor, Micro);
   bool useLibgcc = true;
   if (Major >= 7 || Major == 0) {
     switch (ToolChain.getArch()) {
     case llvm::Triple::aarch64:
if (D.CCCIsCXX()) {
       if (ToolChain.ShouldLinkCXXStdlib(Args))
         ToolChain.AddCXXStdlibLibArgs(Args, CmdArgs);
       CmdArgs.push_back("-lm");
     }
     if (NeedsSanitizerDeps)
       linkSanitizerRuntimeDeps(getToolChain(), CmdArgs);
     if (NeedsXRayDeps)
       linkXRayRuntimeDeps(ToolChain, CmdArgs);
+    if (NeedsSyringeDeps)
+      linkSyringeRuntimeDeps(ToolChain, CmdArgs);
     if (Args.hasArg(options::OPT_pthread))
       CmdArgs.push_back("-lpthread");
     CmdArgs.push_back("-lc");
 
     if (useLibgcc) {
       if (Args.hasArg(options::OPT_static)) {
         // libgcc_eh depends on libc, so resolve as much as possible,
         // pull in any new requirements from libc and then get the rest

clang/lib/Driver/ToolChains/OpenBSD.cpp

void openbsd::Linker::ConstructJob(Compilation &C, const JobAction &JA,
   CmdArgs.push_back(Args.MakeArgString("-L/usr/lib"));
 
   Args.AddAllArgs(CmdArgs, {options::OPT_L, options::OPT_T_Group,
                             options::OPT_e, options::OPT_s, options::OPT_t,
                             options::OPT_Z_Flag, options::OPT_r});
 
   bool NeedsSanitizerDeps = addSanitizerRuntimes(ToolChain, Args, CmdArgs);
   bool NeedsXRayDeps = addXRayRuntime(ToolChain, Args, CmdArgs);
+  bool NeedsSyringeDeps = addSyringeRuntime(ToolChain, Args, CmdArgs);
   AddLinkerInputs(getToolChain(), Inputs, Args, CmdArgs, JA);
 
   if (!Args.hasArg(options::OPT_nostdlib, options::OPT_nodefaultlibs)) {
     if (D.CCCIsCXX()) {
       if (getToolChain().ShouldLinkCXXStdlib(Args))
         getToolChain().AddCXXStdlibLibArgs(Args, CmdArgs);
       if (Args.hasArg(options::OPT_pg))
         CmdArgs.push_back("-lm_p");
       else
         CmdArgs.push_back("-lm");
     }
     if (NeedsSanitizerDeps) {
       CmdArgs.push_back(ToolChain.getCompilerRTArgString(Args, "builtins", false));
       linkSanitizerRuntimeDeps(ToolChain, CmdArgs);
     }
     if (NeedsXRayDeps) {
       CmdArgs.push_back(ToolChain.getCompilerRTArgString(Args, "builtins", false));
       linkXRayRuntimeDeps(ToolChain, CmdArgs);
     }
+    if (NeedsSyringeDeps) {
+      CmdArgs.push_back(ToolChain.getCompilerRTArgString(Args, "builtins", false));
+      linkSyringeRuntimeDeps(ToolChain, CmdArgs);
+    }
     // FIXME: For some reason GCC passes -lgcc before adding
     // the default system libraries. Just mimic this for now.
     CmdArgs.push_back("-lgcc");
 
     if (Args.hasArg(options::OPT_pthread)) {
       if (!Args.hasArg(options::OPT_shared) && Args.hasArg(options::OPT_pg))
         CmdArgs.push_back("-lpthread_p");
       else

clang/lib/Frontend/CompilerInvocation.cpp

static bool ParseCodeGenArgs(CodeGenOptions &Opts, ArgList &Args, InputKind IK,
   }
 
   Opts.PreserveVec3Type = Args.hasArg(OPT_fpreserve_vec3_type);
   Opts.InstrumentFunctions = Args.hasArg(OPT_finstrument_functions);
   Opts.InstrumentFunctionsAfterInlining =
       Args.hasArg(OPT_finstrument_functions_after_inlining);
   Opts.InstrumentFunctionEntryBare =
       Args.hasArg(OPT_finstrument_function_entry_bare);
-
   Opts.XRayInstrumentFunctions =
       Args.hasArg(OPT_fxray_instrument);
   Opts.XRayAlwaysEmitCustomEvents =
       Args.hasArg(OPT_fxray_always_emit_customevents);
   Opts.XRayAlwaysEmitTypedEvents =
       Args.hasArg(OPT_fxray_always_emit_typedevents);
   Opts.XRayInstructionThreshold =
       getLastArgIntValue(Args, OPT_fxray_instruction_threshold_EQ, 200, Diags);
+  Opts.SyringeInjectBehaviors = Args.hasArg(OPT_fsyringe);
 
   auto XRayInstrBundles =
       Args.getAllArgValues(OPT_fxray_instrumentation_bundle);
   if (XRayInstrBundles.empty())
     Opts.XRayInstrumentationBundle.Mask = XRayInstrKind::All;
   else
     for (const auto &A : XRayInstrBundles)
       parseXRayInstrumentationBundle("-fxray-instrumentation-bundle=", A, Args,
#include "clang/Frontend/LangStandards.def"
 
   // -fxray-{always,never}-instrument= filenames.
   Opts.XRayAlwaysInstrumentFiles =
       Args.getAllArgValues(OPT_fxray_always_instrument);
   Opts.XRayNeverInstrumentFiles =
       Args.getAllArgValues(OPT_fxray_never_instrument);
   Opts.XRayAttrListFiles = Args.getAllArgValues(OPT_fxray_attr_list);
 
+  // -fsyringe
+  Opts.SyringeInject = Args.hasArg(OPT_fsyringe, OPT_fnosyringe, false);
+  Opts.SyringeConfigFiles = Args.getAllArgValues(OPT_fsyringe_config_file);
+
   // -fforce-emit-vtables
   Opts.ForceEmitVTables = Args.hasArg(OPT_fforce_emit_vtables);
 
   // -fallow-editor-placeholders
   Opts.AllowEditorPlaceholders = Args.hasArg(OPT_fallow_editor_placeholders);
 
   if (Arg *A = Args.getLastArg(OPT_fclang_abi_compat_EQ)) {
     Opts.setClangABICompat(LangOptions::ClangABI::Latest);

clang/lib/Sema/SemaDecl.cpp

Sema::ActOnFunctionDeclarator(Scope *S, Declarator &D, DeclContext *DC,
   bool isVirtualOkay = false;
 
   DeclContext *OriginalDC = DC;
   bool IsLocalExternDecl = adjustContextForLocalExternDecl(DC);
 
   FunctionDecl *NewFD = CreateNewFunctionDecl(*this, D, DC, R, TInfo, SC,
                                               isVirtualOkay);
   if (!NewFD) return nullptr;
+  FnDeclList.push_back(NewFD);
 
   if (OriginalLexicalContext && OriginalLexicalContext->isObjCContainer())
     NewFD->setTopLevelDeclInObjCContainer();
 
   // Set the lexical context. If this is a function-scope declaration, or has a
   // C++ scope specifier, or is the object of a friend declaration, the lexical
   // context will be different from the semantic context.
   NewFD->setLexicalDeclContext(CurContext);

clang/lib/Sema/SemaDeclAttr.cpp

static void handleSimpleAttributeWithExclusions(Sema &S, Decl *D,
                                                 const ParsedAttr &AL) {
   if (checkAttrMutualExclusion<IncompatibleAttrType>(S, D, AL.getRange(),
                                                      AL.getName()))
     return;
   handleSimpleAttributeWithExclusions<AttrType, IncompatibleAttrTypes...>(S, D,
                                                                           AL);
 }
 
+/// Apply the Syringe Class Payload Attribure and set the target base class
+static void handleSyringeClassPayloadAttribute(Sema &S, Decl *D,
+                                               const ParsedAttr &AL) {
+  IdentifierLoc *Parm = AL.isArgIdent(0) ? AL.getArgAsIdent(0) : nullptr;
+
+  if (!Parm) {
+    S.Diag(D->getLocStart(), diag::err_objc_attr_not_id) << AL.getName() << 0;
+    return;
+  }
+  D->addAttr(::new (S.Context)
+                 SyringeClassPayloadAttr(AL.getRange(), S.Context, Parm->Ident,
+                                         AL.getAttributeSpellingListIndex()));
+}
+
+/// Applies the Syringe Payload Attribute and sets the payload target string
+static void handleSyringePayloadAttr(Sema &S, Decl *D, const ParsedAttr &AL) {
+  Expr *E = AL.getArgAsExpr(0);
+  SourceLocation Loc = E->getExprLoc();
+  FunctionDecl *FD = nullptr;
+  DeclarationNameInfo NI;
+
+  // gcc only allows for simple identifiers. Since we support more than gcc,
+  // we will warn the user.
+  if (auto *DRE = dyn_cast<DeclRefExpr>(E)) {
+    if (DRE->hasQualifier()) {
+      S.Diag(Loc, diag::warn_cleanup_ext);
+    }
+    FD = dyn_cast<FunctionDecl>(DRE->getDecl());
+    NI = DRE->getNameInfo();
+    if (!FD) {
+      S.Diag(Loc, diag::err_attribute_syringe_payload_arg_not_function)
+          << 1 << DRE->getNameInfo().getName();
+      return;
+    }
+  } else if (auto *ULE = dyn_cast<UnresolvedLookupExpr>(E)) {
+    FD = S.ResolveSingleFunctionTemplateSpecialization(ULE, true);
+    NI = ULE->getNameInfo();
+    if (!FD) {
+      S.Diag(Loc, diag::err_attribute_cleanup_arg_not_function)
+          << 2 << NI.getName();
+      if (ULE->getType() == S.Context.OverloadTy)
+        S.NoteAllOverloadCandidates(ULE);
+      return;
+    }
+  } else {
+    llvm::errs() << "Something wrong with: "
+                 << "\n";
+    E->dump();
+    llvm::errs() << "\nUnknown Error Here!!!!<--------\n\n";
+    S.Diag(Loc, diag::err_attribute_cleanup_arg_not_function) << 0;
+    return;
+  }
+
+  D->addAttr(::new (S.Context) SyringePayloadAttr(
+      AL.getRange(), S.Context, FD, AL.getAttributeSpellingListIndex()));
+}
+
 /// Check if the passed-in expression is of type int or bool.
 static bool isIntOrBool(Expr *Exp) {
   QualType QT = Exp->getType();
   return QT->isBooleanType() || QT->isIntegerType();
 }
 
 
 // Check to see if the type is a smart pointer of some kind.  We assume
case ParsedAttr::AT_RenderScriptKernel:
     break;
   // XRay attributes.
   case ParsedAttr::AT_XRayInstrument:
     handleSimpleAttribute<XRayInstrumentAttr>(S, D, AL);
     break;
   case ParsedAttr::AT_XRayLogArgs:
     handleXRayLogArgsAttr(S, D, AL);
     break;
+  case ParsedAttr::AT_SyringeInjectionSite:
+    handleSimpleAttribute<SyringeInjectionSiteAttr>(S, D, AL);
+    break;
+  case ParsedAttr::AT_SyringeClassPayload:
+    handleSyringeClassPayloadAttribute(S, D, AL);
+    break;
+  case ParsedAttr::AT_SyringePayload:
+    handleSyringePayloadAttr(S, D, AL);
+    break;
   }
 }
 
 /// ProcessDeclAttributeList - Apply all the decl attributes in the specified
 /// attribute list to the specified decl, ignoring any type attributes.
 void Sema::ProcessDeclAttributeList(Scope *S, Decl *D,
                                     const ParsedAttributesView &AttrList,
                                     bool IncludeCXX11Attributes) {

clang/lib/Sema/SemaTemplateInstantiateDecl.cpp

 #include "clang/AST/ASTConsumer.h"
 #include "clang/AST/ASTContext.h"
 #include "clang/AST/ASTMutationListener.h"
 #include "clang/AST/DeclTemplate.h"
 #include "clang/AST/DeclVisitor.h"
 #include "clang/AST/DependentDiagnostic.h"
 #include "clang/AST/Expr.h"
 #include "clang/AST/ExprCXX.h"
+#include "clang/AST/Mangle.h"
 #include "clang/AST/PrettyDeclStackTrace.h"
 #include "clang/AST/TypeLoc.h"
 #include "clang/Sema/Initialization.h"
 #include "clang/Sema/Lookup.h"
 #include "clang/Sema/Template.h"
 #include "clang/Sema/TemplateInstCallback.h"
 
 using namespace clang;
TemplateDeclInstantiator::VisitFunctionTemplateDecl(FunctionTemplateDecl *D) {
   // itself.
   LocalInstantiationScope Scope(SemaRef);
 
   TemplateParameterList *TempParams = D->getTemplateParameters();
   TemplateParameterList *InstParams = SubstTemplateParams(TempParams);
   if (!InstParams)
     return nullptr;
 
+  // create some pointers usful for syringe instrumentation of template
+  // injection sites
   FunctionDecl *Instantiated = nullptr;
+  FunctionDecl *PayloadInstantiated = nullptr;
+  FunctionDecl *PayloadPtr = nullptr;
+  FunctionTemplateDecl *payload_template = nullptr;
+  SyringePayloadAttr *SyringePayload = nullptr;
   if (CXXMethodDecl *DMethod = dyn_cast<CXXMethodDecl>(D->getTemplatedDecl()))
-    Instantiated = cast_or_null<FunctionDecl>(VisitCXXMethodDecl(DMethod,
-                                                                 InstParams));
-  else
-    Instantiated = cast_or_null<FunctionDecl>(VisitFunctionDecl(
-                                                          D->getTemplatedDecl(),
-                                                                InstParams));
+    Instantiated =
+        cast_or_null<FunctionDecl>(VisitCXXMethodDecl(DMethod, InstParams));
+  else {
+    Instantiated = cast_or_null<FunctionDecl>(
+        VisitFunctionDecl(D->getTemplatedDecl(), InstParams));
+
+    const auto *SyringeAttr = D->getAttr<SyringeInjectionSiteAttr>();
+    if (SyringeAttr) {
+      for (auto &payload : SemaRef.FnDeclList) {
+        SyringePayload = payload->getAttr<SyringePayloadAttr>();
+        if (SyringePayload) {
+          payload_template =
+              SyringePayload->getSyringeTargetFunction()->getPrimaryTemplate();
+
+          if (payload_template && payload_template == D) {
+            PayloadPtr = payload;
+            break;
+          }
+        }
+      }
+    }
 
+    if (PayloadPtr)
+      PayloadInstantiated = cast_or_null<FunctionDecl>(
+          VisitFunctionDecl(payload_template->getTemplatedDecl(), InstParams));
+  }
   if (!Instantiated)
     return nullptr;
 
   // Link the instantiated function template declaration to the function
   // template from which it was instantiated.
   FunctionTemplateDecl *InstTemplate
     = Instantiated->getDescribedFunctionTemplate();
+
+  FunctionTemplateDecl *PayloadInstTemplate = nullptr;
+  if (PayloadInstantiated)
+    PayloadInstTemplate = PayloadInstantiated->getDescribedFunctionTemplate();
+
+  if (PayloadInstTemplate)
+    PayloadInstTemplate->setAccess(PayloadPtr->getAccess());
+
   InstTemplate->setAccess(D->getAccess());
   assert(InstTemplate &&
          "VisitFunctionDecl/CXXMethodDecl didn't create a template!");
 
   bool isFriend = (InstTemplate->getFriendObjectKind() != Decl::FOK_None);
 
   // Link the instantiation back to the pattern *unless* this is a
   // non-definition friend declaration.
Decl *TemplateDeclInstantiator::VisitFunctionDecl(FunctionDecl *D,
   bool MergeWithParentScope = (TemplateParams != nullptr) ||
     Owner->isFunctionOrMethod() ||
     !(isa<Decl>(Owner) &&
       cast<Decl>(Owner)->isDefinedOutsideFunctionOrMethod());
   LocalInstantiationScope Scope(SemaRef, MergeWithParentScope);
 
   SmallVector<ParmVarDecl *, 4> Params;
   TypeSourceInfo *TInfo = SubstFunctionType(D, Params);
     if (!TInfo)
     return nullptr;
   QualType T = adjustFunctionTypeForInstantiation(SemaRef.Context, D, TInfo);
 
   NestedNameSpecifierLoc QualifierLoc = D->getQualifierLoc();
   if (QualifierLoc) {
     QualifierLoc = SemaRef.SubstNestedNameSpecifierLoc(QualifierLoc,
                                                        TemplateArgs);
     if (!QualifierLoc)
Decl *TemplateDeclInstantiator::VisitFunctionDecl(FunctionDecl *D,
   } else {
     DC = SemaRef.FindInstantiatedContext(D->getLocation(), D->getDeclContext(),
                                          TemplateArgs);
   }
 
   DeclarationNameInfo NameInfo
     = SemaRef.SubstDeclarationNameInfo(D->getNameInfo(), TemplateArgs);
 
+  SmallVector<ParmVarDecl *, 4> NewParams;
+  const auto *SyringeAttr = D->getAttr<SyringeInjectionSiteAttr>();
+  FunctionDecl *PayloadPtr = nullptr;
+  FunctionDecl *NewPayloadPtr = nullptr;
+  SyringePayloadAttr *SyringePayload = nullptr;
+
+  if (SyringeAttr) {
+    for (auto &payload : SemaRef.FnDeclList) {
+      SyringePayload = payload->getAttr<SyringePayloadAttr>();
+      if (SyringePayload) {
+        auto payload_template =
+            SyringePayload->getSyringeTargetFunction()->getPrimaryTemplate();
+        if (payload_template && payload_template == FunctionTemplate) {
+          PayloadPtr = payload;
+          break;
+        }
+      }
+    }
+  }
+  FunctionTemplateDecl *PayloadFunctionTemplate = nullptr;
+  TypeSourceInfo *PayloadTInfo = nullptr;
+  QualType *PayloadT = nullptr;
+  DeclContext *PayloadDC = nullptr;
+  if (PayloadPtr) {
+    PayloadTInfo = SubstFunctionType(PayloadPtr, NewParams);
+    if (D->isLocalExternDecl()) {
+      PayloadDC = Owner;
+      SemaRef.adjustContextForLocalExternDecl(PayloadDC);
+    } else if (isFriend && QualifierLoc) {
+      CXXScopeSpec SS;
+      SS.Adopt(QualifierLoc);
+      PayloadDC = SemaRef.computeDeclContext(SS);
+    } else {
+      PayloadDC = SemaRef.FindInstantiatedContext(PayloadPtr->getLocation(),
+                                                  PayloadPtr->getDeclContext(),
+                                                  TemplateArgs);
+    }
+  }
+
+  DeclarationNameInfo PayloadNameInfo;
+  QualType Junk;
+  if (PayloadPtr) {
+    PayloadFunctionTemplate = PayloadPtr->getDescribedFunctionTemplate();
+    PayloadNameInfo = SemaRef.SubstDeclarationNameInfo(
+        PayloadPtr->getNameInfo(), TemplateArgs);
+    Junk = adjustFunctionTypeForInstantiation(SemaRef.Context, PayloadPtr,
+                                              PayloadTInfo);
+    PayloadT = &Junk;
+  }
+
   FunctionDecl *Function;
   if (auto *DGuide = dyn_cast<CXXDeductionGuideDecl>(D)) {
     Function = CXXDeductionGuideDecl::Create(
       SemaRef.Context, DC, D->getInnerLocStart(), DGuide->isExplicit(),
       NameInfo, T, TInfo, D->getSourceRange().getEnd());
     if (DGuide->isCopyDeductionCandidate())
       cast<CXXDeductionGuideDecl>(Function)->setIsCopyDeductionCandidate();
     Function->setAccess(D->getAccess());
+
+    if (PayloadPtr) {
+      NewPayloadPtr = CXXDeductionGuideDecl::Create(
+          SemaRef.Context, PayloadDC, PayloadPtr->getInnerLocStart(),
+          DGuide->isExplicit(), PayloadNameInfo, *PayloadT, PayloadTInfo,
+          PayloadPtr->getSourceRange().getEnd());
+      if (DGuide->isCopyDeductionCandidate())
+        cast<CXXDeductionGuideDecl>(NewPayloadPtr)
+            ->setIsCopyDeductionCandidate();
+      NewPayloadPtr->setAccess(PayloadPtr->getAccess());
+    }
   } else {
     Function = FunctionDecl::Create(
         SemaRef.Context, DC, D->getInnerLocStart(), NameInfo, T, TInfo,
         D->getCanonicalDecl()->getStorageClass(), D->isInlineSpecified(),
         D->hasWrittenPrototype(), D->isConstexpr());
     Function->setRangeEnd(D->getSourceRange().getEnd());
+
+    if (PayloadPtr) {
+      NewPayloadPtr = FunctionDecl::Create(
+          SemaRef.Context, PayloadDC, PayloadPtr->getInnerLocStart(),
+          PayloadNameInfo, *PayloadT, PayloadTInfo,
+          PayloadPtr->getCanonicalDecl()->getStorageClass(),
+          PayloadPtr->isInlineSpecified(), PayloadPtr->hasWrittenPrototype(),
+          PayloadPtr->isConstexpr());
+      NewPayloadPtr->setRangeEnd(PayloadPtr->getSourceRange().getEnd());
+    }
   }
 
-  if (D->isInlined())
+  if (D->isInlined()) {
     Function->setImplicitlyInline();
+    if (PayloadPtr) {
+      NewPayloadPtr->setImplicitlyInline();
+    }
+  }
 
-  if (QualifierLoc)
+  if (QualifierLoc) {
     Function->setQualifierInfo(QualifierLoc);
+    NewPayloadPtr->setQualifierInfo(QualifierLoc);
+  }
 
-  if (D->isLocalExternDecl())
+  if (D->isLocalExternDecl()) {
     Function->setLocalExternDecl();
+    NewPayloadPtr->setLocalExternDecl();
+  }
 
   DeclContext *LexicalDC = Owner;
   if (!isFriend && D->isOutOfLine() && !D->isLocalExternDecl()) {
     assert(D->getDeclContext()->isFileContext());
     LexicalDC = D->getDeclContext();
   }
 
   Function->setLexicalDeclContext(LexicalDC);
+  if (PayloadPtr)
+    NewPayloadPtr->setLexicalDeclContext(LexicalDC);
 
   // Attach the parameters
   for (unsigned P = 0; P < Params.size(); ++P)
     if (Params[P])
       Params[P]->setOwningFunction(Function);
   Function->setParams(Params);
 
+  if (PayloadPtr) {
+    for (unsigned P = 0; P < Params.size(); ++P)
+      if (NewParams[P]){
+        NewParams[P]->setOwningFunction(NewPayloadPtr);
+        //NewParams[P]->dump();
+      }
+
+    NewPayloadPtr->setParams(NewParams);
+  }
+
   if (TemplateParams) {
     // Our resulting instantiation is actually a function template, since we
     // are substituting only the outer template parameters. For example, given
     //
     //   template<typename T>
     //   struct X {
     //     template<typename U> friend void f(T, U);
     //   };
     //
     //   X<int> x;
     //
     // We are instantiating the friend function template "f" within X<int>,
     // which means substituting int for T, but leaving "f" as a friend function
     // template.
     // Build the function template itself.
     FunctionTemplate = FunctionTemplateDecl::Create(SemaRef.Context, DC,
                                                     Function->getLocation(),
                                                     Function->getDeclName(),
                                                     TemplateParams, Function);
     Function->setDescribedFunctionTemplate(FunctionTemplate);
 
     FunctionTemplate->setLexicalDeclContext(LexicalDC);
 
+    if (PayloadPtr) {
+      PayloadFunctionTemplate = FunctionTemplateDecl::Create(
+          SemaRef.Context, PayloadDC, NewPayloadPtr->getLocation(),
+          NewPayloadPtr->getDeclName(), TemplateParams, NewPayloadPtr);
+
+      NewPayloadPtr->setDescribedFunctionTemplate(PayloadFunctionTemplate);
+      PayloadFunctionTemplate->setLexicalDeclContext(LexicalDC);
+
+      if (isFriend && PayloadPtr->isThisDeclarationADefinition()) {
+        PayloadFunctionTemplate->setInstantiatedFromMemberTemplate(
+            PayloadPtr->getDescribedFunctionTemplate());
+      }
+    }
+
     if (isFriend && D->isThisDeclarationADefinition()) {
       FunctionTemplate->setInstantiatedFromMemberTemplate(
                                            D->getDescribedFunctionTemplate());
     }
   } else if (FunctionTemplate) {
     // Record this function template specialization.
     ArrayRef<TemplateArgument> Innermost = TemplateArgs.getInnermost();
     Function->setFunctionTemplateSpecialization(FunctionTemplate,
                             TemplateArgumentList::CreateCopy(SemaRef.Context,
                                                              Innermost),
                                                 /*InsertPos=*/nullptr);
+    if (PayloadPtr) {
+      NewPayloadPtr->setFunctionTemplateSpecialization(
+          PayloadFunctionTemplate,
+          TemplateArgumentList::CreateCopy(SemaRef.Context, Innermost),
+          /*InsertPos=*/nullptr);
+    }
   } else if (isFriend && D->isThisDeclarationADefinition()) {
     // Do not connect the friend to the template unless it's actually a
     // definition. We don't want non-template functions to be marked as being
     // template instantiations.
     Function->setInstantiationOfMemberFunction(D, TSK_ImplicitInstantiation);
+    if (PayloadPtr) {
+      NewPayloadPtr->setInstantiationOfMemberFunction(
+          PayloadPtr, TSK_ImplicitInstantiation);
+    }
   }
 
   if (InitFunctionInstantiation(Function, D))
     Function->setInvalidDecl();
 
+
   bool isExplicitSpecialization = false;
 
   LookupResult Previous(
       SemaRef, Function->getDeclName(), SourceLocation(),
       D->isLocalExternDecl() ? Sema::LookupRedeclarationWithLinkage
                              : Sema::LookupOrdinaryName,
       D->isLocalExternDecl() ? Sema::ForExternalRedeclaration
                              : SemaRef.forRedeclarationInCurContext());
Decl *TemplateDeclInstantiator::VisitFunctionDecl(FunctionDecl *D,
 
   if (Function->isLocalExternDecl() && !Function->getPreviousDecl())
     DC->makeDeclVisibleInContext(PrincipalDecl);
 
   if (Function->isOverloadedOperator() && !DC->isRecord() &&
       PrincipalDecl->isInIdentifierNamespace(Decl::IDNS_Ordinary))
     PrincipalDecl->setNonMemberOperator();
 
+  const auto getMangledName = [&](FunctionDecl *decl) {
+    auto mangleContext = decl->getASTContext().createMangleContext();
+
+    if (!mangleContext->shouldMangleDeclName(decl)) {
+      return decl->getNameInfo().getName().getAsString();
+    }
+    std::string mangledName;
+    llvm::raw_string_ostream ostream(mangledName);
+    mangleContext->mangleName(decl, ostream);
+    ostream.flush();
+    delete mangleContext;
+    return mangledName;
+  };
+
+  if (PayloadFunctionTemplate && !TemplateParams) {
+    ArrayRef<TemplateArgument> Innermost = TemplateArgs.getInnermost();
+
+    void *InsertPos = nullptr;
+    FunctionDecl *SpecFunc =
+        PayloadFunctionTemplate->findSpecialization(Innermost, InsertPos);
+
+    // If we already have a function template specialization, return it.
+    if (SpecFunc) {
+      SpecFunc->dropAttr<SyringePayloadAttr>();
+      SpecFunc->addAttr(::new SyringePayloadAttr(
+          SyringeAttr->getRange(), SemaRef.Context, Function,
+          SyringeAttr->getSpellingListIndex()));
+
+      // TODO: address the way that we decide to perform syringe duties in this
+      // function.
+      // disable the rest of the insturmentation, since we've already emited
+      // this template for Syringe
+      PayloadPtr = nullptr;
+    }
+  }
+
+  if (PayloadPtr) {
+    if (InitFunctionInstantiation(NewPayloadPtr, PayloadPtr))
+      NewPayloadPtr->setInvalidDecl();
+    auto payload_template =
+        SyringePayload->getSyringeTargetFunction()->getPrimaryTemplate();
+    if (payload_template &&
+        payload_template == Function->getPrimaryTemplate()) {
+      NewPayloadPtr->setInstantiationIsPending(true);
+      NewPayloadPtr->dropAttr<SyringePayloadAttr>();
+      NewPayloadPtr->addAttr(::new SyringePayloadAttr(
+          SyringeAttr->getRange(), SemaRef.Context, Function,
+          SyringeAttr->getSpellingListIndex()));
+      PayloadPtr->setIsUsed();
+      NewPayloadPtr->setIsUsed();
+
+      SemaRef.PendingInstantiations.push_back(std::make_pair(
+          NewPayloadPtr, PayloadPtr->getSourceRange().getBegin()));
+    }
+  }
+
   assert(!D->isDefaulted() && "only methods should be defaulted");
   return Function;
 }
 
 Decl *
 TemplateDeclInstantiator::VisitCXXMethodDecl(CXXMethodDecl *D,
                                       TemplateParameterList *TemplateParams,
                                       bool IsClassScopeSpecialization) {

clang/test/CodeGen/syringe-imbue.cpp

+// RUN: echo "- filename: %s"    > %t.syringe-imbue.yml
+// RUN: echo "  targets:"                       >> %t.syringe-imbue.yml
+// RUN: echo "  - name: _Z3foov"                >> %t.syringe-imbue.yml
+// RUN: echo "    enable: ALWAYS"               >> %t.syringe-imbue.yml
+// RUN: echo "    disable: NEVER"               >> %t.syringe-imbue.yml
+// RUN: echo "  payloads:"                      >> %t.syringe-imbue.yml
+// RUN: echo "  - name: _Z3barv"                >> %t.syringe-imbue.yml
+// RUN: echo "    target: _Z3foov"              >> %t.syringe-imbue.yml
+// RUN: %clang -fsyringe -fsyringe-config-file=%t.syringe-imbue.yml \
+// RUN:     -x c++ -std=c++11 -emit-llvm -S  %s  -o - | FileCheck %s
+
+void foo(){}
+
+void bar(){}
+
+// CHECK: define dso_local void @_Z3foov() #[[FOO:[0-9]+]] {
+// CHECK: define dso_local void @_Z3barv() #[[BAR:[0-9]+]] {
+
+// CHECK: attributes #[[FOO]] = {{.*}}"syringe-injection-site"{{.*}}
+// CHECK: attributes #[[BAR]] = {{.*}} "syringe-payload" {{.*}}"syringe-target-function"="_Z3foov"

clang/test/CodeGen/syringe-injection-site.cpp

+// RUN: %clang_cc1 %s -fsyringe -std=c++11 -x c++ -emit-llvm -o - -triple x86_64-unknown-linux-gnu | FileCheck %s
+
+// CHECK: @"_Z3fooi$syringe_impl_ptr" = dso_local externally_initialized global void (i32)* @"_Z3fooi$syringe_impl"
+// CHECK: @llvm.global_ctors = appending global [1 x { i32, void ()*, i8* }]
+
+// CHECK: @"_Z3fooi$detour_impl" = alias void (i32), void (i32)* @_Z3bari
+
+// Make sure that the LLVM attribute for Syringe-annotated functions do show up.
+[[clang::syringe_injection_site]] void foo(int a) {
+// CHECK: define void @_Z3fooi(i32 %a) #0
+// CHECK: %0 = load void (i32)*, void (i32)** @"_Z3fooi$syringe_impl_ptr"
+// CHECK-NEXT: tail call void %0(i32 %a) #0
+// CHECK-NEXT: ret void
+};
+
+[[clang::syringe_payload("_Z3fooi")]] void bar(int a) {
+// CHECK: define void @_Z3bari(i32 %a) #1 {
+};
+
+// CHECK: define void @"_Z3fooi$syringe_impl"(i32) #2
+
+
+// CHECK: define internal void @"syringe.module_ctor{{.*}}syringe-injection-site.cpp"()
+// CHECK-NEXT: call void @__syringe_register(void (i32)* @_Z3fooi, void (i32)* @"_Z3fooi$syringe_impl", void (i32)* @_Z3bari, void (i32)** @"_Z3fooi$syringe_impl_ptr")
+// CHECK-NEXT: ret void
+
+// CHECK: declare void @__syringe_register(void (i32)*, void (i32)*, void (i32)*, void (i32)**)
+
+
+// CHECK: #0 = {{.*}}"syringe-injection-site"{{.*}}
+// CHECK: #1 = {{.*}}"syringe-payload"{{.*}}"syringe-target-function"="_Z3fooi"

clang/test/CodeGen/syringe-inline-function.cpp

+
+// RUN: %clang_cc1 %s -fsyringe -std=c++11 -x c++ -emit-llvm -o - -triple x86_64-unknown-linux-gnu | FileCheck %s
+
+[[clang::syringe_injection_site]] int __attribute((always_inline)) foo(int a) {
+  // CHECK: %0 = load i32 (i32)*, i32 (i32)** @"_Z3fooi$syringe_impl_ptr"
+  // CHECK-NEXT: tail call i32 %0(i32 %a) #0
+  // CHECK-NEXT: ret i32 %1
+  return a + 1;
+}
+
+[[clang::syringe_payload("_Z3fooi")]] int bar(int a) {
+  // CHECK: define i32 @_Z3bari(i32 %a) #1 {
+  return a - 1;
+}
+
+// CHECK-NOT: call i32 @_Z3foov()
+// CHECK: %[[REG1:[0-9]+]] = load i32 (i32)*, i32 (i32)** @"_Z3fooi$syringe_impl_ptr"
+// CHECK-NEXT: %[[REG2:[0-9]+]] = call i32 %[[REG1]](i32 1)
+// CHECK-NEXT: store i32 %[[REG2]], i32*
+// CHECK: ret i32
+// CHECK-NOT: call i32 @_Z3foov()
+
+int main() {
+  auto j = foo(1);
+  return j;
+}

clang/test/Sema/syringe-injection-site-attr.c

+// RUN: %clang_cc1 %s -verify -fsyntax-only -std=c11
+void foo() __attribute__((syringe_injection_site)) ;
+
+struct __attribute__((syringe_injection_site)) a { int x; }; // expected-warning {{'syringe_injection_site' attribute only applies to functions and Objective-C methods}}
+
+void bar() __attribute__((syringe_injection_site("not-supported"))); // expected-error {{'syringe_injection_site' attribute takes no arguments}}

clang/test/Sema/syringe-injection-site-attr.cpp

+// RUN: %clang_cc1 %s -verify -fsyntax-only -std=c++11 -x c++
+void foo [[clang::syringe_injection_site]] ();
+
+struct [[clang::syringe_injection_site]] a { int x; }; // expected-warning {{'syringe_injection_site' attribute only applies to functions and Objective-C methods}}
+
+class b {
+ void c [[clang::syringe_injection_site]] ();
+};
+
+void baz [[clang::syringe_injection_site("not-supported")]] (); // expected-error {{'syringe_injection_site' attribute takes no arguments}}

clang/test/Sema/syringe-payload-attr.c

+// RUN: %clang_cc1 %s -verify -fsyntax-only -std=c11
+void foo() __attribute__((syringe_payload)) ; // expected-error {{'syringe_payload' attribute takes one argument}}
+
+struct __attribute__((syringe_payload)) a { int x; }; // expected-warning {{'syringe_payload' attribute only applies to functions and Objective-C methods}}
+
+void bar() __attribute__((syringe_payload("foo"))); 

clang/test/Sema/syringe-payload-attr.cpp

+// RUN: %clang_cc1 %s -verify -fsyntax-only -std=c++11 -x c++
+void foo [[clang::syringe_payload]] ();  // expected-error {{'syringe_payload' attribute takes one argument}}
+
+struct [[clang::syringe_payload]] a { int x; }; // expected-warning {{'syringe_payload' attribute only applies to functions and Objective-C methods}}
+
+class b {
+ void c [[clang::syringe_payload("_Z3foov")]] ();
+};
+
+void baz [[clang::syringe_payload("foo")]] (); 

compiler-rt/CMakeLists.txt

 include(CompilerRTUtils)
 
 option(COMPILER_RT_BUILD_BUILTINS "Build builtins" ON)
 mark_as_advanced(COMPILER_RT_BUILD_BUILTINS)
 option(COMPILER_RT_BUILD_SANITIZERS "Build sanitizers" ON)
 mark_as_advanced(COMPILER_RT_BUILD_SANITIZERS)
 option(COMPILER_RT_BUILD_XRAY "Build xray" ON)
 mark_as_advanced(COMPILER_RT_BUILD_XRAY)
+option(COMPILER_RT_BUILD_SYRINGE "Build syringe" ON)
+mark_as_advanced(COMPILER_RT_BUILD_SYRINGE)
 option(COMPILER_RT_BUILD_LIBFUZZER "Build libFuzzer" ON)
 mark_as_advanced(COMPILER_RT_BUILD_LIBFUZZER)
 option(COMPILER_RT_BUILD_PROFILE "Build profile runtime" ON)
 mark_as_advanced(COMPILER_RT_BUILD_PROFILE)
 option(COMPILER_RT_BUILD_XRAY_NO_PREINIT "Build xray with no preinit patching" OFF)
 mark_as_advanced(COMPILER_RT_BUILD_XRAY_NO_PREINIT)
 
 set(COMPILER_RT_ASAN_SHADOW_SCALE ""

compiler-rt/cmake/builtin-config-ix.cmake

 include(BuiltinTests)
 include(CheckCSourceCompiles)
 
 # Make all the tests only check the compiler
 set(TEST_COMPILE_ONLY On)
 
 # Check host compiler support for certain flags
 builtin_check_c_compiler_flag(-fPIC                 COMPILER_RT_HAS_FPIC_FLAG)
 builtin_check_c_compiler_flag(-fPIE                 COMPILER_RT_HAS_FPIE_FLAG)
 builtin_check_c_compiler_flag(-fno-builtin          COMPILER_RT_HAS_FNO_BUILTIN_FLAG)
 builtin_check_c_compiler_flag(-std=c11              COMPILER_RT_HAS_STD_C11_FLAG)
 builtin_check_c_compiler_flag(-fvisibility=hidden   COMPILER_RT_HAS_VISIBILITY_HIDDEN_FLAG)
 builtin_check_c_compiler_flag(-fomit-frame-pointer  COMPILER_RT_HAS_OMIT_FRAME_POINTER_FLAG)
 builtin_check_c_compiler_flag(-ffreestanding        COMPILER_RT_HAS_FREESTANDING_FLAG)
 builtin_check_c_compiler_flag(-fxray-instrument     COMPILER_RT_HAS_XRAY_COMPILER_FLAG)
+builtin_check_c_compiler_flag(-fsyringe             COMPILER_RT_HAS_SYRINGE_COMPILER_FLAG)
 
 builtin_check_c_compiler_source(COMPILER_RT_HAS_ATOMIC_KEYWORD
 "
 int foo(int x, int y) {
  _Atomic int result = x * y;
  return result;
 }
 ")

compiler-rt/cmake/config-ix.cmake

 set(ALL_CFI_SUPPORTED_ARCH ${X86} ${X86_64} ${ARM32} ${ARM64} ${MIPS64})
 set(ALL_ESAN_SUPPORTED_ARCH ${X86_64} ${MIPS64})
 set(ALL_SCUDO_SUPPORTED_ARCH ${X86} ${X86_64} ${ARM32} ${ARM64} ${MIPS32} ${MIPS64} ${PPC64})
 if(APPLE)
 set(ALL_XRAY_SUPPORTED_ARCH ${X86_64})
 else()
 set(ALL_XRAY_SUPPORTED_ARCH ${X86_64} ${ARM32} ${ARM64} ${MIPS32} ${MIPS64} powerpc64le)
 endif()
+if(APPLE)
+set(ALL_SYRINGE_SUPPORTED_ARCH ${X86_64})
+else()
+set(ALL_SYRINGE_SUPPORTED_ARCH ${X86_64} ${ARM32} ${ARM64} ${MIPS32} ${MIPS64} powerpc64le)
+endif()
 set(ALL_SHADOWCALLSTACK_SUPPORTED_ARCH ${X86_64} ${ARM64})
 
 if(APPLE)
   include(CompilerRTDarwinUtils)
 
   find_darwin_sdk_dir(DARWIN_osx_SYSROOT macosx)
   find_darwin_sdk_dir(DARWIN_iossim_SYSROOT iphonesimulator)
   find_darwin_sdk_dir(DARWIN_ios_SYSROOT iphoneos)
if(APPLE)
   endif()
 
   # Note: In order to target x86_64h on OS X the minimum deployment target must
   # be 10.8 or higher.
   set(SANITIZER_COMMON_SUPPORTED_OS osx)
   set(PROFILE_SUPPORTED_OS osx)
   set(TSAN_SUPPORTED_OS osx)
   set(XRAY_SUPPORTED_OS osx)
+  set(SYRINGE_SUPPORTED_OS osx)
   if(NOT SANITIZER_MIN_OSX_VERSION)
     string(REGEX MATCH "-mmacosx-version-min=([.0-9]+)"
            MACOSX_VERSION_MIN_FLAG "${CMAKE_CXX_FLAGS}")
     if(MACOSX_VERSION_MIN_FLAG)
       set(SANITIZER_MIN_OSX_VERSION "${CMAKE_MATCH_1}")
     elseif(CMAKE_OSX_DEPLOYMENT_TARGET)
       set(SANITIZER_MIN_OSX_VERSION ${CMAKE_OSX_DEPLOYMENT_TARGET})
     else()
list_intersect(SCUDO_SUPPORTED_ARCH
     ALL_SCUDO_SUPPORTED_ARCH
     SANITIZER_COMMON_SUPPORTED_ARCH)
   list_intersect(FUZZER_SUPPORTED_ARCH
     ALL_FUZZER_SUPPORTED_ARCH
     SANITIZER_COMMON_SUPPORTED_ARCH)
   list_intersect(XRAY_SUPPORTED_ARCH
     ALL_XRAY_SUPPORTED_ARCH
     SANITIZER_COMMON_SUPPORTED_ARCH)
+  list_intersect(SYRINGE_SUPPORTED_ARCH
+    ALL_SYRINGE_SUPPORTED_ARCH
+    SANITIZER_COMMON_SUPPORTED_ARCH)
   list_intersect(SHADOWCALLSTACK_SUPPORTED_ARCH
     ALL_SHADOWCALLSTACK_SUPPORTED_ARCH
     SANITIZER_COMMON_SUPPORTED_ARCH)
 
 else()
   # Architectures supported by compiler-rt libraries.
   filter_available_targets(SANITIZER_COMMON_SUPPORTED_ARCH
     ${ALL_SANITIZER_COMMON_SUPPORTED_ARCH})
else()
   filter_available_targets(TSAN_SUPPORTED_ARCH ${ALL_TSAN_SUPPORTED_ARCH})
   filter_available_targets(UBSAN_SUPPORTED_ARCH ${ALL_UBSAN_SUPPORTED_ARCH})
   filter_available_targets(SAFESTACK_SUPPORTED_ARCH
     ${ALL_SAFESTACK_SUPPORTED_ARCH})
   filter_available_targets(CFI_SUPPORTED_ARCH ${ALL_CFI_SUPPORTED_ARCH})
   filter_available_targets(ESAN_SUPPORTED_ARCH ${ALL_ESAN_SUPPORTED_ARCH})
   filter_available_targets(SCUDO_SUPPORTED_ARCH ${ALL_SCUDO_SUPPORTED_ARCH})
   filter_available_targets(XRAY_SUPPORTED_ARCH ${ALL_XRAY_SUPPORTED_ARCH})
+  filter_available_targets(SYRINGE_SUPPORTED_ARCH ${ALL_SYRINGE_SUPPORTED_ARCH})
   filter_available_targets(SHADOWCALLSTACK_SUPPORTED_ARCH
     ${ALL_SHADOWCALLSTACK_SUPPORTED_ARCH})
 endif()
 
 if (MSVC)
   # See if the DIA SDK is available and usable.
   set(MSVC_DIA_SDK_DIR "$ENV{VSINSTALLDIR}DIA SDK")
   if (IS_DIRECTORY ${MSVC_DIA_SDK_DIR})

 
 if (COMPILER_RT_HAS_SANITIZER_COMMON AND XRAY_SUPPORTED_ARCH AND
     OS_NAME MATCHES "Darwin|Linux|FreeBSD|NetBSD|OpenBSD")
   set(COMPILER_RT_HAS_XRAY TRUE)
 else()
   set(COMPILER_RT_HAS_XRAY FALSE)
 endif()
 
+if (COMPILER_RT_HAS_SANITIZER_COMMON AND SYRINGE_SUPPORTED_ARCH AND
+    OS_NAME MATCHES "Darwin|Linux|FreeBSD|NetBSD|OpenBSD")
+  set(COMPILER_RT_HAS_SYRINGE TRUE)
+else()
+  set(COMPILER_RT_HAS_SYRINGE FALSE)
+endif()
+
 if (COMPILER_RT_HAS_SANITIZER_COMMON AND FUZZER_SUPPORTED_ARCH AND
     OS_NAME MATCHES "Android|Darwin|Linux|NetBSD|FreeBSD|OpenBSD|Fuchsia")
   set(COMPILER_RT_HAS_FUZZER TRUE)
 else()
   set(COMPILER_RT_HAS_FUZZER FALSE)
 endif()
 
 if (COMPILER_RT_HAS_SANITIZER_COMMON AND SHADOWCALLSTACK_SUPPORTED_ARCH AND
     OS_NAME MATCHES "Linux|Android")
   set(COMPILER_RT_HAS_SHADOWCALLSTACK TRUE)
 else()
   set(COMPILER_RT_HAS_SHADOWCALLSTACK FALSE)
 endif()

compiler-rt/include/CMakeLists.txt

 endif(COMPILER_RT_BUILD_SANITIZERS)
 
 if (COMPILER_RT_BUILD_XRAY)
   set(XRAY_HEADERS
     xray/xray_interface.h
     xray/xray_log_interface.h)
 endif(COMPILER_RT_BUILD_XRAY)
 
+if (COMPILER_RT_BUILD_SYRINGE)
+  set(SYRINGE_HEADERS
+    syringe/injection_data.h
+    syringe/syringe_rt.h
+    syringe/syringe_rt_cxx.h
+    )
+endif(COMPILER_RT_BUILD_SYRINGE)
+
+
 set(COMPILER_RT_HEADERS
   ${SANITIZER_HEADERS}
-  ${XRAY_HEADERS})
+  ${XRAY_HEADERS}
+  ${SYRINGE_HEADERS}
+  )
 
 set(output_dir ${COMPILER_RT_OUTPUT_DIR}/include)
 
 # Copy compiler-rt headers to the build tree.
 set(out_files)
 foreach( f ${COMPILER_RT_HEADERS} )
   set( src ${CMAKE_CURRENT_SOURCE_DIR}/${f} )
   set( dst ${output_dir}/${f} )
install(FILES ${SANITIZER_HEADERS}
   COMPONENT compiler-rt-headers
   PERMISSIONS OWNER_READ OWNER_WRITE GROUP_READ WORLD_READ
   DESTINATION ${COMPILER_RT_INSTALL_PATH}/include/sanitizer)
 # Install xray headers.
 install(FILES ${XRAY_HEADERS}
   COMPONENT compiler-rt-headers
   PERMISSIONS OWNER_READ OWNER_WRITE GROUP_READ WORLD_READ
   DESTINATION ${COMPILER_RT_INSTALL_PATH}/include/xray)
+# Install syringe headers.
+install(FILES ${SYRINGE_HEADERS}
+  COMPONENT compiler-rt-headers
+  PERMISSIONS OWNER_READ OWNER_WRITE GROUP_READ WORLD_READ
+  DESTINATION ${COMPILER_RT_INSTALL_PATH}/include/syringe)
+
 
 if (NOT CMAKE_CONFIGURATION_TYPES) # don't add this for IDEs.
   add_custom_target(install-compiler-rt-headers
                     DEPENDS compiler-rt-headers
                     COMMAND "${CMAKE_COMMAND}"
                             -DCMAKE_INSTALL_COMPONENT="compiler-rt-headers"
                             -P "${CMAKE_BINARY_DIR}/cmake_install.cmake"
                     USES_TERMINAL)
   add_custom_target(install-compiler-rt-headers-stripped
                     DEPENDS compiler-rt-headers
                     COMMAND "${CMAKE_COMMAND}"
                             -DCMAKE_INSTALL_COMPONENT="compiler-rt-headers"
                             -DCMAKE_INSTALL_DO_STRIP=1
                             -P "${CMAKE_BINARY_DIR}/cmake_install.cmake"
                     USES_TERMINAL)
 endif()

compiler-rt/include/syringe/injection_data.h

+//===- injection_data.h -----------------------------------------*- C++ -*-===//
+//
+//                     The LLVM Compiler Infrastructure
+//
+// This file is distributed under the University of Illinois Open Source
+// License. See LICENSE.TXT for details.
+//
+//===----------------------------------------------------------------------===//
+//
+// This file is a part of Syringe, a dynamic behavior injection system.
+//
+// Data structures used by the syringe runtime.
+//===----------------------------------------------------------------------===//
+
+
+#ifndef SYRINGE_INJECTION_DATA_H
+#define SYRINGE_INJECTION_DATA_H 1
+
+#include <stddef.h>
+
+// Outside of namespace for C compatibility
+typedef void (*fptr_t)(void);
+
+namespace __syringe {
+
+struct InjectionData {
+  fptr_t OrigFunc;
+  fptr_t StubImpl;
+  fptr_t DetourFunc;
+  fptr_t *ImplPtr;
+  template <typename T, typename R>
+  InjectionData(T OrigFunction, T StubImplementation, T DetourFunction,
+                R ImplPointer)
+      : OrigFunc((fptr_t)OrigFunction), StubImpl((fptr_t)StubImplementation),
+        DetourFunc((fptr_t)DetourFunction), ImplPtr((fptr_t *)ImplPointer) {}
+};
+
+struct mPtrTy {
+  ptrdiff_t ptr;
+  ptrdiff_t adj;
+};
+
+} // namespace __syringe
+#endif // SYRINGE_INJECTION_DATA_H

compiler-rt/include/syringe/syringe_rt.h

+//===- syringe_rt.h -----------------------------------------*- C++ -*-===//
+//
+//                     The LLVM Compiler Infrastructure
+//
+// This file is distributed under the University of Illinois Open Source
+// License. See LICENSE.TXT for details.
+//
+//===----------------------------------------------------------------------===//
+//
+// This file is a part of Syringe, a dynamic behavior injection system.
+//
+// APIs for using the Syringe Runtime.
+//===----------------------------------------------------------------------===//
+
+#ifndef SYRINGE_SYRINGE_RT_H
+#define SYRINGE_SYRINGE_RT_H 1
+
+#include <stdbool.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+typedef void (*fptr_t)(void);
+
+bool toggleImpl(fptr_t OrigFunc);
+
+bool changeImpl(fptr_t OrigFunc, fptr_t NewImpl);
+
+void printSyringeData();
+
+void __syringe_register(void *OrigFunc, void *StubImpl, void *DetourFunc,
+                        void **ImplPtr);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif // SYRINGE_SYRINGE_RT_H

compiler-rt/include/syringe/syringe_rt_cxx.h

+//===- syringe_rt_cxx.h -----------------------------------------*- C++ -*-===//
+//
+//                     The LLVM Compiler Infrastructure
+//
+// This file is distributed under the University of Illinois Open Source
+// License. See LICENSE.TXT for details.
+//
+//===----------------------------------------------------------------------===//
+//
+// This file is a part of Syringe, a dynamic behavior injection system.
+//
+// APIs for using the Syringe Runtime.
+//===----------------------------------------------------------------------===//
+
+#ifndef SYRINGE_SYRINGE_RT_CXX_H
+#define SYRINGE_SYRINGE_RT_CXX_H 1
+
+#include "syringe/injection_data.h"
+
+#include <algorithm>
+#include <cstdint>
+#include <type_traits>
+#include <vector>
+#include <cstdio>
+
+namespace __syringe {
+
+extern std::vector<InjectionData> GlobalSyringeData;
+
+template <typename T> fptr_t convertMemberPtr(T foo) {
+  union {
+    T mfunc;
+    fptr_t addr;
+  };
+  mfunc = foo;
+  return addr;
+}
+
+InjectionData *findImplPointerImpl(fptr_t target);
+
+template <typename T> InjectionData *findImplPointer(T OrigFunc) {
+  fptr_t target;
+  target = convertMemberPtr(OrigFunc);
+
+  return findImplPointerImpl(target);
+}
+
+template <typename T, typename R>
+void registerInjection(T OrigFunc, T StubImpl, T DetourFunc, R ImplPtr) {
+  assert(findImplPointer(OrigFunc) == nullptr &&
+         "Cannot register two payloads for the same injection site!");
+  GlobalSyringeData.emplace_back(OrigFunc, StubImpl, DetourFunc, ImplPtr);
+}
+
+template <typename T> bool toggleImplPtr(T OrigFunc) {
+  auto Ptr = findImplPointer(OrigFunc);
+  if (!Ptr) {
+    //fprintf(stderr, "Target for Syringe injection(%p) not found!\n", OrigFunc);
+    //exit(1);
+    return false;
+  }
+
+  if (*(Ptr->ImplPtr) == Ptr->StubImpl) {
+    *(Ptr->ImplPtr) = Ptr->DetourFunc;
+  } else {
+    *(Ptr->ImplPtr) = Ptr->StubImpl;
+  }
+  return true;
+}
+
+/// Toggle virutal function implementation
+/// Currently only works for Itanium ABI
+/// @OrigFunc pointer to the member function
+/// @Instance address of an instance of the class in question
+template <typename T, typename R>
+bool toggleVirtualImpl(T OrigFunc, R Instance) {
+  // use char * to represent vtbl address for easy indexing
+  typedef char *vtblptr_t;
+
+  // convert the OrigFunc to a member function pointer type
+  mPtrTy *MemberFnPtr = (mPtrTy *)&OrigFunc;
+
+  // get the vtbl for the passed in instance
+  vtblptr_t *PtrToVtblPtr = (vtblptr_t *)Instance;
+
+  // on itanium the vtable pointer is the at the instance's address
+  auto VtblPtr = *PtrToVtblPtr;
+
+  // TODO: do we need the adjustment?
+  // calculate the offset of into the vtable for the target function
+  auto FnOffset = MemberFnPtr->ptr + MemberFnPtr->adj - 1;
+  auto TargetAddr =
+      static_cast<void **>(static_cast<void *>(VtblPtr + FnOffset));
+
+  auto Ptr = findImplPointer(*TargetAddr);
+  if (!Ptr) {
+    return false;
+  }
+
+  if (*(Ptr->ImplPtr) == Ptr->StubImpl) {
+    *(Ptr->ImplPtr) = Ptr->DetourFunc;
+  } else {
+    *(Ptr->ImplPtr) = Ptr->StubImpl;
+  }
+  return true;
+}
+
+template <typename T> bool changeImpl(T OrigFunc, T NewImpl) {
+  auto Ptr = findImplPointer(OrigFunc);
+  if (!Ptr) {
+    return false;
+  }
+
+  *(Ptr->ImplPtr) = NewImpl;
+  return true;
+}
+
+template <typename T> fptr_t lookupMemberFunctionAddr(T FPtr) {
+  assert(FPtr != nullptr &&
+         "Syringe Member Function Lookup was passed a nullptr!");
+  mPtrTy *j = (mPtrTy *)FPtr;
+  return (fptr_t)(j->ptr);
+}
+
+} // end namespace __syringe
+
+#endif // SYRINGE_SYRINGE_RT_H

compiler-rt/lib/CMakeLists.txt

 # First, add the subdirectories which contain feature-based runtime libraries
 # and several convenience helper libraries.
 
 include(AddCompilerRT)
 include(SanitizerUtils)
 
 # Hoist the building of sanitizer_common on whether we're building either the
 # sanitizers or xray (or both).
 #
 #TODO: Refactor sanitizer_common into smaller pieces (e.g. flag parsing, utils).
 if (COMPILER_RT_HAS_SANITIZER_COMMON AND
-    (COMPILER_RT_BUILD_SANITIZERS OR COMPILER_RT_BUILD_XRAY))
+        (COMPILER_RT_BUILD_SANITIZERS OR COMPILER_RT_BUILD_XRAY
+        OR COMPILER_RT_BUILD_SYRINGE))
   add_subdirectory(sanitizer_common)
 endif()
 
 if(COMPILER_RT_BUILD_BUILTINS)
   add_subdirectory(builtins)
 endif()
 
 function(compiler_rt_build_runtime runtime)

 if(COMPILER_RT_BUILD_PROFILE AND COMPILER_RT_HAS_PROFILE)
   compiler_rt_build_runtime(profile)
 endif()
 
 if(COMPILER_RT_BUILD_XRAY)
   compiler_rt_build_runtime(xray)
 endif()
 
+if(COMPILER_RT_BUILD_SYRINGE)
+  compiler_rt_build_runtime(syringe)
+endif()
+
 if(COMPILER_RT_BUILD_LIBFUZZER)
   compiler_rt_build_runtime(fuzzer)
 endif()

compiler-rt/lib/syringe/CMakeLists.txt

+# Build for all components of the Syinge runtime support library.
+
+# Syinge runtime library implementation files.
+set(SYRINGE_SOURCES
+    syringe_rt.cpp)
+
+set(SYRINGE_HEADERS
+  #syringe_rt.h
+  #syringe_rt_cxx.h
+  )
+
+# Create list of all source files for
+# consumption by tests.
+set(SYRINGE_ALL_SOURCE_FILES
+  ${SYRINGE_SOURCES}
+  ${SYRINGE_HEADERS}
+)
+list(REMOVE_DUPLICATES SYRINGE_ALL_SOURCE_FILES)
+# Make list that uses absolute paths
+set(SYRINGE_ALL_SOURCE_FILES_ABS_PATHS "")
+foreach (src_file ${SYRINGE_ALL_SOURCE_FILES})
+  list(APPEND
+      SYRINGE_ALL_SOURCE_FILES_ABS_PATHS
+    "${CMAKE_CURRENT_SOURCE_DIR}/${src_file}")
+endforeach()
+
+
+# Now put it all together...
+include_directories(..)
+include_directories(../../include)
+
+set(SYRINGE_CFLAGS ${SANITIZER_COMMON_CFLAGS})
+set(SYRINGE_COMMON_DEFINITIONS SYRINGE_HAS_EXCEPTIONS=1)
+
+# We don't need RTTI in Syringe, so turn that off.
+append_rtti_flag(OFF SYRINGE_CFLAGS)
+
+append_list_if(
+    COMPILER_RT_HAS_SYRINGE_COMPILER_FLAG SYRINGE_SUPPORTED=1 SYRINGE_COMMON_DEFINITIONS)
+
+add_compiler_rt_component(syringe)
+
+set(SYRINGE_COMMON_RUNTIME_OBJECT_LIBS
+    RTSanitizerCommon
+    RTSanitizerCommonLibc)
+
+
+if (TARGET cxx-headers OR HAVE_LIBCXX)
+    set(SYRINGE_DEPS cxx-headers)
+endif()
+
+if (APPLE)
+  set(SYRINGE_LINK_LIBS ${SANITIZER_COMMON_LINK_LIBS})
+  add_weak_symbols("sanitizer_common" WEAK_SYMBOL_LINK_FLAGS)
+  #add_weak_symbols("syringe" WEAK_SYMBOL_LINK_FLAGS)
+
+  add_compiler_rt_object_libraries(RTSyringe
+    OS ${SYRINGE_SUPPORTED_OS}
+    ARCHS ${SYRINGE_SUPPORTED_ARCH}
+    SOURCES ${SYRINGE_SOURCES} ${${arch}_SOURCES}
+    ADDITIONAL_HEADERS ${SYRINGE_HEADERS}
+    CFLAGS ${SYRINGE_CFLAGS}
+    DEFS ${SYRINGE_COMMON_DEFINITIONS}
+    DEPS ${SYRINGE_DEPS})
+
+    # We only support running on osx for now.
+  add_compiler_rt_runtime(clang_rt.syringe
+    STATIC
+    OS ${SYRINGE_SUPPORTED_OS}
+    ARCHS ${SYRINGE_SUPPORTED_ARCH}
+    OBJECT_LIBS RTSyringe
+                RTSanitizerCommon
+                RTSanitizerCommonLibc
+    CFLAGS ${SYRINGE_CFLAGS}
+    DEFS ${SYRINGE_COMMON_DEFINITIONS}
+    LINK_FLAGS ${SANITIZER_COMMON_LINK_FLAGS} ${WEAK_SYMBOL_LINK_FLAGS}
+    LINK_LIBS ${SYRINGE_LINK_LIBS}
+    PARENT_TARGET syringe)
+
+else() # not Apple
+  foreach(arch ${SYRINGE_SUPPORTED_ARCH})
+    if(NOT CAN_TARGET_${arch})
+      continue()
+    endif()
+    add_compiler_rt_object_libraries(RTSyringe
+      ARCHS ${arch}
+      SOURCES ${SYRINGE_SOURCES} ${${arch}_SOURCES}
+      ADDITIONAL_HEADERS ${SYRINGE_HEADERS}
+      CFLAGS ${SYRINGE_CFLAGS}
+      DEFS ${SYRINGE_COMMON_DEFINITIONS}
+      DEPS ${SYRINGE_DEPS})
+
+    # Common Syringe archive for instrumented binaries.
+    add_compiler_rt_runtime(clang_rt.syringe
+      STATIC
+      ARCHS ${arch}
+      CFLAGS ${SYRINGE_CFLAGS}
+      DEFS ${SYRINGE_COMMON_DEFINITIONS}
+      OBJECT_LIBS ${SYRINGE_COMMON_RUNTIME_OBJECT_LIBS}  RTSyringe
+      PARENT_TARGET syringe)
+  endforeach()
+endif() # not Apple
+
+if(COMPILER_RT_INCLUDE_TESTS)
+  add_subdirectory(tests)
+endif()

compiler-rt/lib/syringe/syringe_rt.cpp

+//===-- syringe_rt.cpp ------------------------------------------*- C++ -*-===//
+//
+//                     The LLVM Compiler Infrastructure
+//
+// This file is distributed under the University of Illinois Open Source
+// License. See LICENSE.TXT for details.
+//
+//===----------------------------------------------------------------------===//
+//
+// This file is a part of Syringe, a dynamic behavior injection system.
+//
+// APIs for using the Syringe Runtime.
+//===----------------------------------------------------------------------===//
+
+#include <iostream>
+#include <vector>
+#include <stdio.h>
+
+#include "syringe/injection_data.h"
+#include "syringe/syringe_rt.h"
+#include "syringe/syringe_rt_cxx.h"
+
+namespace __syringe {
+
+std::vector<InjectionData> GlobalSyringeData;
+
+InjectionData *findImplPointerImpl(fptr_t target) {
+  auto It = std::find_if(GlobalSyringeData.begin(), GlobalSyringeData.end(),
+                         [target](InjectionData It) -> bool {
+                           return (void *)It.OrigFunc == (void *)target;
+                         });
+
+  if (It == GlobalSyringeData.end()) {
+    //fprintf(stderr, "Target for Syringe injection(%p) not found!\n", target);
+    //exit(1);
+    return nullptr;
+  } else {
+    return &*It;
+  }
+}
+
+} // end namespace __syringe
+
+void printSyringeData() {
+  std::cout << "Syringe Global Data" << std::endl;
+  for (auto &item : __syringe::GlobalSyringeData) {
+    std::cout << "Orig Func: " << (void *)item.OrigFunc
+              << ", StubImpl: " << (void *)item.StubImpl
+              << ", DetourFunc: " << (void *)item.DetourFunc
+              << ", ImplPtr: " << (void *)item.ImplPtr << std::endl;
+  }
+
+  std::cout << std::endl;
+}
+
+bool toggleImpl(fptr_t OrigFunc) { return __syringe::toggleImplPtr(OrigFunc); }
+
+bool changeImpl(fptr_t OrigFunc, fptr_t NewImpl) {
+  return __syringe::changeImpl(OrigFunc, NewImpl);
+};
+
+void __syringe_register(void *OrigFunc, void *StubImpl, void *DetourFunc,
+                        void **ImplPtr) {
+  __syringe::registerInjection((fptr_t)OrigFunc, (fptr_t)StubImpl,
+                               (fptr_t)DetourFunc, (fptr_t *)ImplPtr);
+}

compiler-rt/lib/syringe/tests/CMakeLists.txt

+include_directories(..)
+
+add_custom_target(SyringeUnitTests)
+set_target_properties(SyringeUnitTests PROPERTIES FOLDER "Syringe unittests")
+
+# Sanity check SYRINGE_ALL_SOURCE_FILES_ABS_PATHS
+list(LENGTH SYRINGE_ALL_SOURCE_FILES_ABS_PATHS XASFAP_LENGTH)
+if (${XASFAP_LENGTH} EQUAL 0)
+  message(FATAL_ERROR "SYRINGE_ALL_SOURCE_FILES_ABS_PATHS cannot be empty")
+endif()
+unset(XASFAP_LENGTH)
+foreach (src_file ${SYRINGE_ALL_SOURCE_FILES_ABS_PATHS})
+  if (NOT EXISTS "${src_file}")
+    message(FATAL_ERROR "Source file \"${src_file}\" does not exist")
+  endif()
+endforeach()
+
+set(SYRINGE_UNITTEST_CFLAGS
+  ${SYRINGE_CFLAGS}
+  ${COMPILER_RT_UNITTEST_CFLAGS}
+  ${COMPILER_RT_GTEST_CFLAGS}
+  -I${COMPILER_RT_SOURCE_DIR}/include
+  -I${COMPILER_RT_SOURCE_DIR}/lib/syringe
+  -I${COMPILER_RT_SOURCE_DIR}/lib)
+
+function(add_syringe_lib library)
+  add_library(${library} STATIC ${ARGN})
+  set_target_properties(${library} PROPERTIES
+    ARCHIVE_OUTPUT_DIRECTORY ${CMAKE_CURRENT_BINARY_DIR}
+    FOLDER "Compiler-RT Runtime tests")
+endfunction()
+
+function(get_syringe_lib_for_arch arch lib)
+  if(APPLE)
+    set(tgt_name "RTSyringe.test.osx")
+  else()
+    set(tgt_name "RTSyringe.test.${arch}")
+  endif()
+  set(${lib} "${tgt_name}" PARENT_SCOPE)
+endfunction()
+
+set(SYRINGE_TEST_ARCH ${SYRINGE_SUPPORTED_ARCH})
+set(SYRINGE_UNITTEST_LINK_FLAGS
+  ${CMAKE_THREAD_LIBS_INIT}
+  -l${SANITIZER_CXX_ABI_LIBRARY}
+  -fsyringe
+  )
+if (NOT APPLE)
+  append_list_if(COMPILER_RT_HAS_LIBM -lm SYRINGE_UNITTEST_LINK_FLAGS)
+  append_list_if(COMPILER_RT_HAS_LIBRT -lrt SYRINGE_UNITTEST_LINK_FLAGS)
+  append_list_if(COMPILER_RT_HAS_LIBDL -ldl SYRINGE_UNITTEST_LINK_FLAGS)
+  append_list_if(COMPILER_RT_HAS_LIBPTHREAD -pthread SYRINGE_UNITTEST_LINK_FLAGS)
+endif()
+
+macro(add_syringe_unittest testname)
+  cmake_parse_arguments(TEST "" "" "SOURCES;HEADERS" ${ARGN})
+  if(UNIX AND NOT APPLE)
+    set(CMAKE_DL_LIBS_INIT "")
+    foreach(arch ${SYRINGE_TEST_ARCH})
+      set(TEST_OBJECTS)
+      get_syringe_lib_for_arch(${arch} SYRINGE_RUNTIME_LIBS)
+      generate_compiler_rt_tests(TEST_OBJECTS
+        SyringeUnitTests "${testname}-${arch}-Test" "${arch}"
+        SOURCES ${TEST_SOURCES} ${COMPILER_RT_GTEST_SOURCE}
+        # Note that any change in the implementations will cause all the unit
+        # tests to be re-built. This is by design, but may be cumbersome during
+        # the build/test cycle.
+        COMPILE_DEPS ${TEST_SOURCES} ${COMPILER_RT_GTEST_SOURCE}
+        ${SYRINGE_HEADERS} ${SYRINGE_ALL_SOURCE_FILES_ABS_PATHS}
+        RUNTIME "${SYRINGE_RUNTIME_LIBS}"
+        DEPS gtest syringe llvm-syringe
+        CFLAGS ${SYRINGE_UNITTEST_CFLAGS}
+        LINK_FLAGS ${TARGET_LINK_FLAGS} ${SYRINGE_UNITTEST_LINK_FLAGS})
+      set_target_properties(SyringeUnitTests
+        PROPERTIES RUNTIME_OUTPUT_DIRECTORY ${CMAKE_CURRENT_BINARY_DIR})
+    endforeach()
+  endif()
+endmacro()
+
+if(COMPILER_RT_CAN_EXECUTE_TESTS)
+  if (APPLE)
+    add_syringe_lib("RTSyringe.test.osx"
+      $<TARGET_OBJECTS:RTSyringe.osx>
+      $<TARGET_OBJECTS:RTSanitizerCommon.osx>
+      $<TARGET_OBJECTS:RTSanitizerCommonLibc.osx>)
+  else()
+    foreach(arch ${SYRINGE_SUPPORTED_ARCH})
+      add_syringe_lib("RTSyringe.test.${arch}"
+        $<TARGET_OBJECTS:RTSyringe.${arch}>
+      $<TARGET_OBJECTS:RTSanitizerCommon.${arch}>
+      $<TARGET_OBJECTS:RTSanitizerCommonLibc.${arch}>)
+  endforeach()
+  endif()
+  add_subdirectory(unit)
+endif()

compiler-rt/lib/syringe/tests/unit/CMakeLists.txt

+add_syringe_unittest(SyringeRegistrationTest SOURCES
+  syringe_registration_test.cc syringe_unit_test_main.cc)

compiler-rt/lib/syringe/tests/unit/syringe_registration_test.cc

+//===-- syringe_registration_test.cc
+//-----------------------------------------===//
+//
+//                     The LLVM Compiler Infrastructure
+//
+// This file is distributed under the University of Illinois Open Source
+// License. See LICENSE.TXT for details.
+//
+//===----------------------------------------------------------------------===//
+//
+// This file is a part of Syringe, a behavior injection system.
+//
+//===----------------------------------------------------------------------===//
+#include "gtest/gtest.h"
+
+#include "syringe/syringe_rt.h"
+namespace {
+[[clang::syringe_injeciton_site]] int foo() { return 1; }
+[[clang::syringe_payload("_Z3fooi")]] int bar() { return 0; }
+} // namespace
+
+namespace __syringe {
+
+TEST(RegistrationTest, Simple) {
+  __syringe_register(nullptr, nullptr, nullptr, nullptr);
+  auto data_ptr = findImplPtr(nullptr);
+  ASSERT_NE(nullptr, data_ptr);
+  ASSERT_EQ(nullptr, data_ptr->ImplPtr);
+  ASSERT_GT(GlobalSyringeData.size(), 1);
+}
+
+TEST(RegistrationTest, NoDoubleInsert) {
+  __syringe_register(nullptr, nullptr, nullptr, nullptr);
+  ASSERT_DEATH(__syringe_register(nullptr, nullptr, nullptr, nullptr), "Cannot register two payloads for the same injection site!");
+}
+
+} // namespace __syringe

compiler-rt/lib/syringe/tests/unit/syringe_unit_test_main.cc

+//===-- syringe_unit_test_main.cc --------------------------------------------===//
+//
+//                     The LLVM Compiler Infrastructure
+//
+// This file is distributed under the University of Illinois Open Source
+// License. See LICENSE.TXT for details.
+//
+//===----------------------------------------------------------------------===//
+//
+// This file is a part of Syringe, a behavior injection system.
+//
+//===----------------------------------------------------------------------===//
+#include "gtest/gtest.h"
+
+int main(int argc, char **argv) {
+  testing::InitGoogleTest(&argc, argv);
+  return RUN_ALL_TESTS();
+}

llvm/include/llvm-c/Initialization.h

 void LLVMInitializeInstCombine(LLVMPassRegistryRef R);
 void LLVMInitializeAggressiveInstCombiner(LLVMPassRegistryRef R);
 void LLVMInitializeIPO(LLVMPassRegistryRef R);
 void LLVMInitializeInstrumentation(LLVMPassRegistryRef R);
 void LLVMInitializeAnalysis(LLVMPassRegistryRef R);
 void LLVMInitializeIPA(LLVMPassRegistryRef R);
 void LLVMInitializeCodeGen(LLVMPassRegistryRef R);
 void LLVMInitializeTarget(LLVMPassRegistryRef R);
+void LLVMInitializeSyringe(LLVMPassRegistryRef R);
 
 /**
  * @}
  */
 
 #ifdef __cplusplus
 }
 #endif
 
 #endif

llvm/include/llvm/Bitcode/LLVMBitCodes.h

enum AttributeKindCodes {
   ATTR_KIND_ALLOC_SIZE = 51,
   ATTR_KIND_WRITEONLY = 52,
   ATTR_KIND_SPECULATABLE = 53,
   ATTR_KIND_STRICT_FP = 54,
   ATTR_KIND_SANITIZE_HWADDRESS = 55,
   ATTR_KIND_NOCF_CHECK = 56,
   ATTR_KIND_OPT_FOR_FUZZING = 57,
   ATTR_KIND_SHADOWCALLSTACK = 58,
+  ATTR_KIND_SYRINGE_SITE = 59,
+  ATTR_KIND_SYRINGE_PAYLOAD = 60,
 };
 
 enum ComdatSelectionKindCodes {
   COMDAT_SELECTION_KIND_ANY = 1,
   COMDAT_SELECTION_KIND_EXACT_MATCH = 2,
   COMDAT_SELECTION_KIND_LARGEST = 3,
   COMDAT_SELECTION_KIND_NO_DUPLICATES = 4,
   COMDAT_SELECTION_KIND_SAME_SIZE = 5,

llvm/include/llvm/InitializePasses.h

 void initializeVirtRegMapPass(PassRegistry&);
 void initializeVirtRegRewriterPass(PassRegistry&);
 void initializeWasmEHPreparePass(PassRegistry&);
 void initializeWholeProgramDevirtPass(PassRegistry&);
 void initializeWinEHPreparePass(PassRegistry&);
 void initializeWriteBitcodePassPass(PassRegistry&);
 void initializeWriteThinLTOBitcodePass(PassRegistry&);
 void initializeXRayInstrumentationPass(PassRegistry&);
+void initializeSyringeLegacyPassPass(PassRegistry&);
 
 } // end namespace llvm
 
 #endif // LLVM_INITIALIZEPASSES_H

llvm/include/llvm/LinkAllPasses.h

 #include "llvm/Analysis/TypeBasedAliasAnalysis.h"
 #include "llvm/CodeGen/Passes.h"
 #include "llvm/IR/Function.h"
 #include "llvm/IR/IRPrintingPasses.h"
 #include "llvm/Support/Valgrind.h"
 #include "llvm/Transforms/AggressiveInstCombine/AggressiveInstCombine.h"
 #include "llvm/Transforms/IPO.h"
 #include "llvm/Transforms/IPO/AlwaysInliner.h"
+#include "llvm/Transforms/Syringe.h"
 #include "llvm/Transforms/IPO/FunctionAttrs.h"
 #include "llvm/Transforms/InstCombine/InstCombine.h"
 #include "llvm/Transforms/Instrumentation.h"
 #include "llvm/Transforms/Instrumentation/BoundsChecking.h"
 #include "llvm/Transforms/ObjCARC.h"
 #include "llvm/Transforms/Scalar.h"
 #include "llvm/Transforms/Scalar/GVN.h"
 #include "llvm/Transforms/Scalar/InstSimplifyPass.h"

llvm/include/llvm/SyringeRecord.h

+//===- SyringeRecord.h - Syringe Trace Record
+//-----------------------------------===//
+//
+//                     The LLVM Compiler Infrastructure
+//
+// This file is distributed under the University of Illinois Open Source
+// License. See LICENSE.TXT for details.
+//
+//===----------------------------------------------------------------------===//
+//
+// This file replicates the record definition for Syringe instrumentation.
+//
+//===----------------------------------------------------------------------===//
+#ifndef LLVM_SYRINGE_SYRINGE_RECORD_H
+#define LLVM_SYRINGE_SYRINGE_RECORD_H
+
+#include <cstdint>
+#include <string>
+#include <vector>
+
+namespace llvm {
+namespace syringe {
+
+enum class SyringeTrigger { NONE, NEVER, ALWAYS, COUNT, ONCE };
+
+struct SyringeTarget {
+  std::string Name;
+  SyringeTrigger EnableTrigger;
+  SyringeTrigger DisableTrigger;
+  uint32_t Count = 0;
+};
+
+struct SyringePayload {
+  std::string Name;
+  std::string Target;
+};
+
+struct SyringeRecord {
+  std::string Filename;
+  std::vector<SyringeTarget> Targets;
+  std::vector<SyringePayload> Payloads;
+};
+
+} // namespace syringe
+} // namespace llvm
+
+#endif // LLVM_SYRINGE_SYRINGE_RECORD_H

llvm/include/llvm/Transforms/Syringe.h

+//===- Transforms/Syringe.h - Syringe passes --------------------*- C++ -*-===//
+//
+//                     The LLVM Compiler Infrastructure
+//
+// This file is distributed under the University of Illinois Open Source
+// License. See LICENSE.TXT for details.
+//
+//===----------------------------------------------------------------------===//
+//
+// This file defines constructor functions for Syringe passes.
+//
+//===----------------------------------------------------------------------===//
+
+#ifndef LLVM_TRANSFORMS_SYRINGE_H
+#define LLVM_TRANSFORMS_SYRINGE_H
+
+#include "llvm/ADT/StringRef.h"
+#include "llvm/IR/Module.h"
+#include "llvm/IR/PassManager.h"
+#include "llvm/Pass.h"
+#include "llvm/YAMLSyringeRecord.h"
+
+namespace llvm {
+class ModulePass;
+
+/// Pass to insert Syringe Injection sites.
+class SyringePass : public PassInfoMixin<SyringePass> {
+public:
+  PreservedAnalyses run(Module &M, ModuleAnalysisManager &AM);
+};
+
+ModulePass *createSyringe();
+
+void initializeSyringeLegacyPass(PassRegistry &Registry);
+
+class SyringeLegacyPass : public ModulePass {
+public:
+  /// pass identification
+  static char ID;
+
+  SyringeLegacyPass();
+  virtual ~SyringeLegacyPass() = default;
+
+  /// Specify pass name for debug output
+  StringRef getPassName() const override;
+
+  /// run module pass
+  bool runOnModule(Module &M) override;
+
+  /// create funciton stub for behavior injection
+  bool doBehaviorInjectionForModule(Module &M);
+
+  bool parse(const std::string &MapFile);
+
+private:
+  /* data */
+  std::vector<syringe::YAMLSyringeRecord> Metadata;
+  bool parse(std::unique_ptr<MemoryBuffer> &MapFile);
+};
+} // namespace llvm
+
+#endif // Include Guard

llvm/include/llvm/YAMLSyringeRecord.h

+//===- YAMLXRayRecord.h - XRay Record YAML Support Definitions ------------===//
+//
+//                     The LLVM Compiler Infrastructure
+//
+// This file is distributed under the University of Illinois Open Source
+// License. See LICENSE.TXT for details.
+//
+//===----------------------------------------------------------------------===//
+//
+// Types and traits specialisations for YAML I/O of XRay log entries.
+//
+//===----------------------------------------------------------------------===//
+#ifndef LLVM_SYRINGE_YAML_SYRINGE_RECORD_H
+#define LLVM_SYRINGE_YAML_SYRINGE_RECORD_H
+
+#include <type_traits>
+
+#include "llvm/Support/YAMLTraits.h"
+#include "llvm/SyringeRecord.h"
+
+namespace llvm {
+namespace syringe {
+
+struct YAMLSyringeTarget {
+  std::string Name;
+  SyringeTrigger EnableTrigger;
+  SyringeTrigger DisableTrigger;
+  uint32_t Count = 0;
+};
+
+struct YAMLSyringePayload {
+  std::string Name;
+  std::string Target;
+};
+
+struct YAMLSyringeRecord {
+  std::string Filename;
+  std::vector<YAMLSyringeTarget> Targets;
+  std::vector<YAMLSyringePayload> Payloads;
+};
+
+} // namespace syringe
+
+namespace yaml {
+
+template <typename T> struct MappingTraits;
+
+// YAML Traits
+// -----------
+template <> struct ScalarEnumerationTraits<syringe::SyringeTrigger> {
+  static void enumeration(IO &IO, syringe::SyringeTrigger &Type) {
+    IO.enumCase(Type, "NONE", syringe::SyringeTrigger::NONE);
+    IO.enumCase(Type, "NEVER", syringe::SyringeTrigger::NEVER);
+    IO.enumCase(Type, "ALWAYS", syringe::SyringeTrigger::ALWAYS);
+    IO.enumCase(Type, "COUNT", syringe::SyringeTrigger::COUNT);
+    IO.enumCase(Type, "ONCE", syringe::SyringeTrigger::ONCE);
+  }
+};
+
+template <> struct MappingTraits<syringe::YAMLSyringeTarget> {
+  static void mapping(IO &IO, syringe::YAMLSyringeTarget &Target) {
+    IO.mapRequired("name", Target.Name);
+    IO.mapRequired("enable", Target.EnableTrigger);
+    IO.mapRequired("disable", Target.DisableTrigger);
+    IO.mapOptional("count", Target.Count);
+  }
+};
+
+template <> struct MappingTraits<syringe::YAMLSyringePayload> {
+  static void mapping(IO &IO, syringe::YAMLSyringePayload &Payload) {
+    IO.mapRequired("name", Payload.Name);
+    IO.mapRequired("target", Payload.Target);
+  }
+};
+
+template <> struct MappingTraits<syringe::YAMLSyringeRecord> {
+  static void mapping(IO &IO, syringe::YAMLSyringeRecord &Record) {
+    IO.mapRequired("filename", Record.Filename);
+    IO.mapOptional("targets", Record.Targets);
+    IO.mapOptional("payloads", Record.Payloads);
+  }
+};
+
+} // namespace yaml
+} // namespace llvm
+
+LLVM_YAML_IS_SEQUENCE_VECTOR(syringe::YAMLSyringeTarget)
+LLVM_YAML_IS_SEQUENCE_VECTOR(syringe::YAMLSyringePayload)
+LLVM_YAML_IS_SEQUENCE_VECTOR(syringe::YAMLSyringeRecord)
+
+#endif // LLVM_syringe_YAML_syringe_RECORD_H

llvm/lib/AsmParser/LLLexer.cpp

#define KEYWORD(STR)                                                           \
   KEYWORD(amdgpu_kernel);
 
   KEYWORD(cc);
   KEYWORD(c);
 
   KEYWORD(attributes);
 
   KEYWORD(alwaysinline);
+  KEYWORD(syringe_site);
+  KEYWORD(syringe_payload);
   KEYWORD(allocsize);
   KEYWORD(argmemonly);
   KEYWORD(builtin);
   KEYWORD(byval);
   KEYWORD(inalloca);
   KEYWORD(cold);
   KEYWORD(convergent);
   KEYWORD(dereferenceable);

llvm/lib/AsmParser/LLParser.cpp

case lltok::kw_allocsize: {
       unsigned ElemSizeArg;
       Optional<unsigned> NumElemsArg;
       // inAttrGrp doesn't matter; we only support allocsize(a[, b])
       if (parseAllocSizeArguments(ElemSizeArg, NumElemsArg))
         return true;
       B.addAllocSizeAttr(ElemSizeArg, NumElemsArg);
       continue;
     }
+
     case lltok::kw_alwaysinline: B.addAttribute(Attribute::AlwaysInline); break;
     case lltok::kw_argmemonly: B.addAttribute(Attribute::ArgMemOnly); break;
     case lltok::kw_builtin: B.addAttribute(Attribute::Builtin); break;
     case lltok::kw_cold: B.addAttribute(Attribute::Cold); break;
     case lltok::kw_convergent: B.addAttribute(Attribute::Convergent); break;
     case lltok::kw_inaccessiblememonly:
       B.addAttribute(Attribute::InaccessibleMemOnly); break;
     case lltok::kw_inaccessiblemem_or_argmemonly:

llvm/lib/AsmParser/LLToken.h

enum Kind {
   kw_amdgpu_ps,
   kw_amdgpu_cs,
   kw_amdgpu_kernel,
 
   // Attributes:
   kw_attributes,
   kw_allocsize,
   kw_alwaysinline,
+  kw_syringe_site,
+  kw_syringe_payload,
   kw_argmemonly,
   kw_sanitize_address,
   kw_sanitize_hwaddress,
   kw_builtin,
   kw_byval,
   kw_inalloca,
   kw_cold,
   kw_convergent,

llvm/lib/ExecutionEngine/Orc/IndirectionUtils.cpp

void moveFunctionBody(Function &OrigF, ValueToValueMapTy &VMap,
                       ValueMaterializer *Materializer,
                       Function *NewF) {
   assert(!OrigF.isDeclaration() && "Nothing to move");
   if (!NewF)
     NewF = cast<Function>(VMap[&OrigF]);
   else
     assert(VMap[&OrigF] == NewF && "Incorrect function mapping in VMap.");
   assert(NewF && "Function mapping missing from VMap.");
-  assert(NewF->getParent() != OrigF.getParent() &&
-         "moveFunctionBody should only be used to move bodies between "
-         "modules.");
+  //assert(NewF->getParent() != OrigF.getParent() &&
+         //"moveFunctionBody should only be used to move bodies between "
+         //"modules.");
 
   SmallVector<ReturnInst *, 8> Returns; // Ignore returns cloned.
   CloneFunctionInto(NewF, &OrigF, VMap, /*ModuleLevelChanges=*/true, Returns,
                     "", nullptr, nullptr, Materializer);
   OrigF.deleteBody();
 }
 
 GlobalVariable* cloneGlobalVariableDecl(Module &Dst, const GlobalVariable &GV,

llvm/lib/IR/Instructions.cpp

assert(getNumOperands() == Args.size() + CountBundleInputs(Bundles) + 1 &&
          "NumOperands not set up?");
   Op<-1>() = Func;
 
 #ifndef NDEBUG
   assert((Args.size() == FTy->getNumParams() ||
           (FTy->isVarArg() && Args.size() > FTy->getNumParams())) &&
          "Calling a function with bad signature!");
 
-  for (unsigned i = 0; i != Args.size(); ++i)
-    assert((i >= FTy->getNumParams() ||
-            FTy->getParamType(i) == Args[i]->getType()) &&
-           "Calling a function with a bad signature!");
+  //for (unsigned i = 0; i != Args.size(); ++i)
+    //assert((i >= FTy->getNumParams() ||
+            //FTy->getParamType(i) == Args[i]->getType()) &&
+           //"Calling a function with a bad signature!");
 #endif
 
   std::copy(Args.begin(), Args.end(), op_begin());
 
   auto It = populateBundleOperandInfos(Bundles, Args.size());
   (void)It;
   assert(It + 1 == op_end() && "Should add up!");
 

llvm/lib/IR/Verifier.cpp

void Verifier::verifyFunctionAttrs(FunctionType *FT, AttributeList Attrs,
   Assert(!(Attrs.hasFnAttribute(Attribute::ReadNone) &&
            Attrs.hasFnAttribute(Attribute::InaccessibleMemOnly)),
          "Attributes 'readnone and inaccessiblememonly' are incompatible!", V);
 
   Assert(!(Attrs.hasFnAttribute(Attribute::NoInline) &&
            Attrs.hasFnAttribute(Attribute::AlwaysInline)),
          "Attributes 'noinline and alwaysinline' are incompatible!", V);
 
+  //Assert(!(Attrs.hasFnAttribute(Attribute::SyringeInjectionSite) &&
+           //Attrs.hasFnAttribute(Attribute::SyringePayload)),
+         //"Attributes 'syringe-site and syringe-payload' are incompatible!", V);
+
   if (Attrs.hasFnAttribute(Attribute::OptimizeNone)) {
     Assert(Attrs.hasFnAttribute(Attribute::NoInline),
            "Attribute 'optnone' requires 'noinline'!", V);
 
     Assert(!Attrs.hasFnAttribute(Attribute::OptimizeForSize),
            "Attributes 'optsize and optnone' are incompatible!", V);
 
     Assert(!Attrs.hasFnAttribute(Attribute::MinSize),
void Verifier::verifyCallSite(CallSite CS) {
   if (FTy->isVarArg())
     Assert(CS.arg_size() >= FTy->getNumParams(),
            "Called function requires more parameters than were provided!", I);
   else
     Assert(CS.arg_size() == FTy->getNumParams(),
            "Incorrect number of arguments passed to called function!", I);
 
   // Verify that all arguments to the call match the function type.
-  for (unsigned i = 0, e = FTy->getNumParams(); i != e; ++i)
-    Assert(CS.getArgument(i)->getType() == FTy->getParamType(i),
-           "Call parameter type does not match function signature!",
-           CS.getArgument(i), FTy->getParamType(i), I);
+  //for (unsigned i = 0, e = FTy->getNumParams(); i != e; ++i)
+    //Assert(CS.getArgument(i)->getType() == FTy->getParamType(i),
+           //"Call parameter type does not match function signature!",
+           //CS.getArgument(i), FTy->getParamType(i), I);
 
   AttributeList Attrs = CS.getAttributes();
 
   Assert(verifyAttributeCount(Attrs, CS.arg_size()),
          "Attribute after last parameter!", I);
 
   if (Attrs.hasAttribute(AttributeList::FunctionIndex, Attribute::Speculatable)) {
     // Don't allow speculatable on call sites, unless the underlying function

llvm/lib/Passes/LLVMBuild.txt

 ;   http://llvm.org/docs/LLVMBuild.html
 ;
 ;===------------------------------------------------------------------------===;
 
 [component_0]
 type = Library
 name = Passes
 parent = Libraries
-required_libraries = AggressiveInstCombine Analysis CodeGen Core IPO InstCombine Scalar Support Target TransformUtils Vectorize Instrumentation
+required_libraries = AggressiveInstCombine Analysis CodeGen Core IPO InstCombine Scalar Support Target TransformUtils Vectorize Instrumentation Syringe

llvm/lib/Passes/PassBuilder.cpp

 #include "llvm/IR/IRPrintingPasses.h"
 #include "llvm/IR/PassManager.h"
 #include "llvm/IR/Verifier.h"
 #include "llvm/Support/Debug.h"
 #include "llvm/Support/Regex.h"
 #include "llvm/Target/TargetMachine.h"
 #include "llvm/Transforms/AggressiveInstCombine/AggressiveInstCombine.h"
 #include "llvm/Transforms/Instrumentation/CGProfile.h"
+#include "llvm/Transforms/Syringe.h"
 #include "llvm/Transforms/IPO/AlwaysInliner.h"
 #include "llvm/Transforms/IPO/ArgumentPromotion.h"
 #include "llvm/Transforms/IPO/CalledValuePropagation.h"
 #include "llvm/Transforms/IPO/ConstantMerge.h"
 #include "llvm/Transforms/IPO/CrossDSOCFI.h"
 #include "llvm/Transforms/IPO/DeadArgumentElimination.h"
 #include "llvm/Transforms/IPO/ElimAvailExtern.h"
 #include "llvm/Transforms/IPO/ForceFunctionAttrs.h"

llvm/lib/Passes/PassRegistry.def

 MODULE_ALIAS_ANALYSIS("globals-aa", GlobalsAA())
 #undef MODULE_ALIAS_ANALYSIS
 #undef MODULE_ANALYSIS
 
 #ifndef MODULE_PASS
 #define MODULE_PASS(NAME, CREATE_PASS)
 #endif
 MODULE_PASS("always-inline", AlwaysInlinerPass())
+MODULE_PASS("syringe", SyringePass())
 MODULE_PASS("called-value-propagation", CalledValuePropagationPass())
 MODULE_PASS("cg-profile", CGProfilePass())
 MODULE_PASS("constmerge", ConstantMergePass())
 MODULE_PASS("cross-dso-cfi", CrossDSOCFIPass())
 MODULE_PASS("deadargelim", DeadArgumentEliminationPass())
 MODULE_PASS("elim-avail-extern", EliminateAvailableExternallyPass())
 MODULE_PASS("forceattrs", ForceFunctionAttrsPass())
 MODULE_PASS("function-import", FunctionImportPass())

llvm/lib/Transforms/CMakeLists.txt

 add_subdirectory(Utils)
 add_subdirectory(Instrumentation)
 add_subdirectory(AggressiveInstCombine)
 add_subdirectory(InstCombine)
 add_subdirectory(Scalar)
 add_subdirectory(IPO)
 add_subdirectory(Vectorize)
 add_subdirectory(Hello)
 add_subdirectory(ObjCARC)
 add_subdirectory(Coroutines)
+add_subdirectory(Syringe)

llvm/lib/Transforms/LLVMBuild.txt

 ;
 ; For more information on the LLVMBuild system, please see:
 ;
 ;   http://llvm.org/docs/LLVMBuild.html
 ;
 ;===------------------------------------------------------------------------===;
 
 [common]
-subdirectories = AggressiveInstCombine Coroutines IPO InstCombine Instrumentation Scalar Utils Vectorize ObjCARC
+subdirectories = AggressiveInstCombine Coroutines IPO InstCombine Instrumentation Scalar Utils Vectorize ObjCARC Syringe
 
 [component_0]
 type = Group
 name = Transforms
 parent = Libraries

llvm/lib/Transforms/Syringe/CMakeLists.txt

+add_llvm_library(LLVMSyringe
+  Syringe.cpp
+
+  ADDITIONAL_HEADER_DIRS
+  ${LLVM_MAIN_INCLUDE_DIR}/llvm/Syringe
+
+  DEPENDS
+  intrinsics_gen
+  )

llvm/lib/Transforms/Syringe/LLVMBuild.txt

+;===- ./lib/Transforms/Instrumentation/LLVMBuild.txt -----------*- Conf -*--===;
+;
+;                     The LLVM Compiler Infrastructure
+;
+; This file is distributed under the University of Illinois Open Source
+; License. See LICENSE.TXT for details.
+;
+;===------------------------------------------------------------------------===;
+;
+; This is an LLVMBuild description file for the components in this subdirectory.
+;
+; For more information on the LLVMBuild system, please see:
+;
+;   http://llvm.org/docs/LLVMBuild.html
+;
+;===------------------------------------------------------------------------===;
+
+[component_0]
+type = Library
+name = Syringe
+parent = Transforms
+required_libraries = Analysis Core MC Support TransformUtils ProfileData OrcJIT

llvm/lib/Transforms/Syringe/Syringe.cpp

+//===-- Syringe.cpp - Syringe Infrastructure ---------------===//
+//
+//                     The LLVM Compiler Infrastructure
+//
+// This file is distributed under the University of Illinois Open Source
+// License. See LICENSE.TXT for details.
+//
+//===----------------------------------------------------------------------===//
+//
+// This file defines the common initialization infrastructure for the
+// Syringe library.
+//
+//===----------------------------------------------------------------------===//
+
+#include "llvm/Transforms/Syringe.h"
+#include "llvm-c/Initialization.h"
+#include "llvm/ADT/ArrayRef.h"
+#include "llvm/ADT/SmallVector.h"
+#include "llvm/ExecutionEngine/Orc/IndirectionUtils.h"
+#include "llvm/IR/Attributes.h"
+#include "llvm/IR/Function.h"
+#include "llvm/IR/GlobalAlias.h"
+#include "llvm/IR/GlobalIFunc.h"
+#include "llvm/IR/GlobalValue.h"
+#include "llvm/IR/IRBuilder.h"
+#include "llvm/IR/Module.h"
+#include "llvm/InitializePasses.h"
+#include "llvm/Pass.h"
+#include "llvm/PassRegistry.h"
+#include "llvm/Support/raw_ostream.h"
+#include "llvm/SyringeRecord.h"
+#include "llvm/Transforms/Utils/Cloning.h"
+#include "llvm/Transforms/Utils/ModuleUtils.h"
+
+using namespace llvm;
+
+// Strings for Syringe names and Suffix
+static const char *const SyringeModuleCtorName = "syringe.module_ctor";
+static const char *const SyringeInitName = "__syringe_register";
+static const char *const SyringeStubImplSuffix = "$syringe_impl";
+static const char *const SyringeDetourImplSuffix = "$detour_impl";
+static const char *const SyringeImplPtrSuffix = "$syringe_impl_ptr";
+
+namespace {
+
+// contains data used for registratin function
+struct SyringeInitData {
+  // the address of the original function, serves as key for runtime lookups
+  Function *Target;
+  // the address of the new stub impl (the moved body of the origianl function)
+  Function *Stub;
+  // the address of the function whose behavior we wish to inject
+  Function *Detour;
+  // the global function pointer used in the stub for indirect calls
+  GlobalValue *SyringePtr;
+};
+
+} // namespace
+
+// create a single ctor function for the module, whose body should consist of a
+// series of calls to the registration function. One call per injection site.
+// We create the function, add a basic block to it, and then insert calls to the
+// registration function for each injection site in the module.
+//
+// example ctor function:
+//
+// void ctor_func_name(){
+//      register(original_func, stub_impl, detour_impl, impl_ptr);
+//      register(original_func2, stub_impl2, detour_impl2, impl_ptr2);
+//      ....
+// }
+//
+static void createCtorInit(Module &M,
+                           SmallVector<SyringeInitData, 8> &InitData) {
+
+  // create a ctor to register all injection sites
+  Function *Ctor = Function::Create(
+      FunctionType::get(Type::getVoidTy(M.getContext()), false),
+      GlobalValue::InternalLinkage, SyringeModuleCtorName + M.getName(), &M);
+  BasicBlock *CtorBB = BasicBlock::Create(M.getContext(), "", Ctor);
+  IRBuilder<> IRB(ReturnInst::Create(M.getContext(), CtorBB));
+
+  for (auto SID : InitData) {
+    auto Target = SID.Target;
+    auto Stub = SID.Stub;
+    auto Detour = SID.Detour;
+    auto SyringePtr = SID.SyringePtr;
+
+    // target function types
+    auto FuncTy = Target->getType();
+
+    // the parameter types of the registration function
+    Type *ParamTypes[] = {FuncTy, FuncTy, FuncTy, SyringePtr->getType()};
+    auto ParamTypesRef = makeArrayRef(ParamTypes, 4);
+
+    // actual parameters
+    Value *ParamArgs[] = {Target, Stub, Detour, SyringePtr};
+    auto ParamArgsRef = makeArrayRef(ParamArgs, 4);
+
+    // assert that these are the same size incase we are ever change the
+    // implementation
+    assert(ParamArgsRef.size() == ParamTypesRef.size());
+
+    // void return type
+    auto RetTy = Type::getVoidTy(M.getContext());
+
+    // the type of the registration function
+    auto RegFnTy = FunctionType::get(RetTy, ParamTypesRef, false);
+
+    // create or find the registration function
+    auto ConstFn = M.getOrInsertFunction(SyringeInitName, RegFnTy);
+    auto RegFunc = M.getFunction(SyringeInitName);
+
+    // set its linkage
+    RegFunc->setLinkage(GlobalValue::LinkageTypes::ExternalLinkage);
+
+    // add a call to the registration function w/ our target arguments
+    IRB.CreateCall(ConstFn, ParamArgsRef);
+  }
+
+  // FIXME: the magic constant is in parts of clang as well, should we move to a
+  // const int? follow Clang's example for setting priority for global ctors
+  appendToGlobalCtors(M, Ctor, 65535);
+}
+
+// Naming APIs
+
+static std::string createSuffixedName(StringRef BaseName, StringRef Suffix) {
+  return (BaseName + Suffix).str();
+}
+
+static std::string createStubNameFromBase(StringRef BaseName) {
+  return createSuffixedName(BaseName, SyringeStubImplSuffix);
+}
+
+static std::string createImplPtrNameFromBase(StringRef BaseName) {
+  return createSuffixedName(BaseName, SyringeImplPtrSuffix);
+}
+
+static std::string createAliasNameFromBase(StringRef BaseName) {
+  return createSuffixedName(BaseName, SyringeDetourImplSuffix);
+}
+
+bool SyringeLegacyPass::parse(std::unique_ptr<MemoryBuffer> &MapFile) {
+  bool status = false;
+  yaml::Input yin(MapFile->getBuffer());
+
+  yin >> Metadata;
+  if (yin.error())
+    return false;
+
+  if (!Metadata.empty())
+    status = true;
+
+  for (syringe::YAMLSyringeRecord Rec : Metadata) {
+    Metadata.push_back(Rec);
+  }
+  return status;
+}
+
+bool SyringeLegacyPass::parse(const std::string &MapFile) {
+  ErrorOr<std::unique_ptr<MemoryBuffer>> Mapping =
+      MemoryBuffer::getFile(MapFile);
+
+  if (!Mapping)
+    report_fatal_error("unable to read rewrite map '" + MapFile +
+                       "': " + Mapping.getError().message());
+
+  if (!parse(*Mapping))
+    report_fatal_error("unable to parse rewrite map '" + MapFile + "'");
+
+  return true;
+}
+
+// Module APIs
+
+// check if the module needs the Syringe Pass
+static bool doInjectionForModule(Module &M) {
+  for (Function &F : M) {
+    if (F.hasFnAttribute("syringe-payload") ||
+        F.hasFnAttribute("syringe-injection-site")) {
+      return true;
+    }
+  }
+  return false;
+}
+
+// run the syringe pass
+PreservedAnalyses SyringePass::run(Module &M, ModuleAnalysisManager &AM) {
+  if (!doInjectionForModule(M))
+    return PreservedAnalyses::all();
+
+  return PreservedAnalyses::none();
+}
+
+/// initializeSyringe - Initialize all passes in the Syringe library.
+void initializeSyringeLegacyPass(PassRegistry &Registry) {
+  initializeSyringeLegacyPassPass(Registry);
+}
+
+/// LLVMInitializeSyringe - C binding for initializeSyringe.
+void LLVMInitializeSyringe(LLVMPassRegistryRef R) {
+  initializeSyringeLegacyPassPass(*unwrap(R));
+}
+
+SyringeLegacyPass::SyringeLegacyPass() : ModulePass(ID) {}
+
+/// Specify pass name for debug output
+StringRef SyringeLegacyPass::getPassName() const {
+  return "Syringe Instrumentation";
+}
+
+/// run module pass
+bool SyringeLegacyPass::runOnModule(Module &M) {
+  if (skipModule(M)) {
+    return false;
+  }
+
+  // If there is a config file, go through it and annotate Syringe functions
+  for (auto &Rec : Metadata) {
+    if (M.getName() == Rec.Filename) {
+      // Annotate targets
+      for (auto &Target : Rec.Targets) {
+        auto F = M.getFunction(Target.Name);
+        if (F != nullptr) {
+          F->addFnAttr("syringe-injection-site");
+          break;
+        }
+      }
+
+      // Annotate payloads
+      for (auto &Payload : Rec.Payloads) {
+        auto F = M.getFunction(Payload.Name);
+        if (F != nullptr) {
+          F->addFnAttr("syringe-payload");
+          F->addFnAttr("syringe-target-function", Payload.Target);
+        }
+      }
+    }
+  }
+  return doBehaviorInjectionForModule(M);
+}
+
+/// create funciton stub for behavior injection
+// Algorithm:
+// examine the functions in the module.
+// First process any payloads
+// -- makes processing injection sites in the same translation unit easier
+// -- also create any aliases required
+// Next process the injection sites
+// -- create any declarations needed for the payload/alias
+// -- copy the function body of the injeciton site into a new function
+// -- replace the target functions's body with a stub that makes an indirect
+// tail call through an implementation pointer
+// -- record the data required for registering the initialization function
+// -- if any changes to the injection site were made, register the init data
+// in a ctor
+bool SyringeLegacyPass::doBehaviorInjectionForModule(Module &M) {
+  bool ChangedPayload = false;
+  bool ChangedInjection = false;
+  SmallVector<SyringeInitData, 8> InitData;
+
+  for (Function &F : M) {
+    ChangedPayload = true;
+    if (F.hasFnAttribute("syringe-payload")) {
+
+      if (F.hasFnAttribute("syringe-target-function")) {
+        auto TargetName =
+            F.getFnAttribute("syringe-target-function").getValueAsString();
+
+        // create alias
+        auto NewAlias =
+            GlobalAlias::create(createAliasNameFromBase(TargetName), &F);
+        NewAlias->setVisibility(
+            GlobalValue::VisibilityTypes::DefaultVisibility);
+      }
+    }
+  }
+
+  for (Function &F : M) {
+    if (F.hasFnAttribute("syringe-injection-site")) {
+      ChangedInjection = true;
+      ValueToValueMapTy VMap;
+
+      // clone function
+      auto *CloneDecl = orc::cloneFunctionDecl(M, F, &VMap);
+      auto AliasName = createAliasNameFromBase(F.getName());
+
+      Function *DetourFunction;
+      auto *InternalAlias = M.getNamedAlias(AliasName);
+
+      if (InternalAlias == nullptr) {
+        auto AliasDecl = orc::cloneFunctionDecl(M, F, nullptr);
+        AliasDecl->setName(AliasName);
+        AliasDecl->removeFnAttr("syringe-injection-site");
+        AliasDecl->setLinkage(GlobalValue::LinkageTypes::ExternalLinkage);
+        DetourFunction = AliasDecl;
+      } else {
+        DetourFunction = dyn_cast<Function>(InternalAlias->getAliasee());
+      }
+
+      CloneDecl->setName(createStubNameFromBase(F.getName()));
+      orc::moveFunctionBody(F, VMap, nullptr, CloneDecl);
+      CloneDecl->removeFnAttr("syringe-injection-site");
+      auto Stub = CloneDecl;
+
+      // create impl pointer
+      auto SyringePtr = orc::createImplPointer(
+          *F.getType(), M, createImplPtrNameFromBase(F.getName()), CloneDecl);
+      SyringePtr->setVisibility(GlobalValue::DefaultVisibility);
+      auto Target = &F;
+
+      // create stub body for original call
+      orc::makeStub(F, *SyringePtr);
+      InitData.push_back({Target, Stub, DetourFunction, SyringePtr});
+    }
+  }
+
+  // if we've made a modification to the injection site, add a global ctor
+  // entry for the function
+  if (ChangedInjection) {
+    createCtorInit(M, InitData);
+  }
+
+  return ChangedPayload || ChangedInjection;
+}
+
+ModulePass *llvm::createSyringe() { return new SyringeLegacyPass(); }
+char SyringeLegacyPass::ID;
+
+INITIALIZE_PASS(SyringeLegacyPass, "syringe",
+                "Syringe: dynamic behavior injection.", false, false)

llvm/tools/opt/CMakeLists.txt

set(LLVM_LINK_COMPONENTS
   InstCombine
   Instrumentation
   MC
   ObjCARCOpts
   ScalarOpts
   Support
   Target
   TransformUtils
+  Syringe
   Vectorize
   Passes
   )
 
 # Support plugins.
 set(LLVM_NO_DEAD_STRIP 1)
 
 add_llvm_tool(opt

llvm/tools/opt/LLVMBuild.txt

  BitWriter
  CodeGen
  IRReader
  IPO
  Instrumentation
  Scalar
  ObjCARC
  Passes
+ Syringe
  all-targets

llvm/tools/opt/opt.cpp

 #include "llvm/Support/SourceMgr.h"
 #include "llvm/Support/SystemUtils.h"
 #include "llvm/Support/TargetRegistry.h"
 #include "llvm/Support/TargetSelect.h"
 #include "llvm/Support/ToolOutputFile.h"
 #include "llvm/Support/YAMLTraits.h"
 #include "llvm/Target/TargetMachine.h"
 #include "llvm/Transforms/Coroutines.h"
+#include "llvm/Transforms/Syringe.h"
 #include "llvm/Transforms/IPO/AlwaysInliner.h"
 #include "llvm/Transforms/IPO/PassManagerBuilder.h"
 #include "llvm/Transforms/Utils/Cloning.h"
 #include <algorithm>
 #include <memory>
 using namespace llvm;
 using namespace opt_tool;
 
int main(int argc, char **argv) {
   initializeObjCARCOpts(Registry);
   initializeVectorization(Registry);
   initializeIPO(Registry);
   initializeAnalysis(Registry);
   initializeTransformUtils(Registry);
   initializeInstCombine(Registry);
   initializeAggressiveInstCombine(Registry);
   initializeInstrumentation(Registry);
+  initializeSyringeLegacyPassPass(Registry);
   initializeTarget(Registry);
   // For codegen passes, only passes that do IR to IR transformation are
   // supported.
   initializeExpandMemCmpPassPass(Registry);
   initializeScalarizeMaskedMemIntrinPass(Registry);
   initializeCodeGenPreparePass(Registry);
   initializeAtomicExpandPass(Registry);
   initializeRewriteSymbolsLegacyPassPass(Registry);

syringe-test/.gitignore

+#==============================================================================#
+# This file specifies intentionally untracked files that git should ignore.
+# See: http://www.kernel.org/pub/software/scm/git/docs/gitignore.html
+#
+# This file is intentionally different from the output of `git svn show-ignore`,
+# as most of those are useless.
+#==============================================================================#
+
+#==============================================================================#
+# File extensions to be ignored anywhere in the tree.
+#==============================================================================#
+# Temp files created by most text editors.
+*~
+# Merge files created by git.
+*.orig
+# Byte compiled python modules.
+*.pyc
+# vim swap files
+.*.sw?
+.sw?
+#OS X specific files.
+.DS_store
+
+# Nested build directory
+/build
+
+#==============================================================================#
+# Explicit files to ignore (only matches one).
+#==============================================================================#
+# Various tag programs
+/tags
+/TAGS
+/GPATH
+/GRTAGS
+/GSYMS
+/GTAGS
+.gitusers
+autom4te.cache
+cscope.files
+cscope.out
+autoconf/aclocal.m4
+autoconf/autom4te.cache
+/compile_commands.json
+
+#==============================================================================#
+# Directories to ignore (do not add trailing '/'s, they skip symlinks).
+#==============================================================================#
+# VS2017 and VSCode config files.
+.vscode
+.vs
+*.o
+*.bc
+*.ll
+syringe_test_opt

syringe-test/config/injection_decl.cpp

+#include <iostream>
+
+extern int injected_count;
+extern int other_counter;
+ void injected() {
+  ++injected_count;
+}

syringe-test/config/main.cpp

+#include "syringe.hpp"
+
+#include <cassert>
+#include <iostream>
+#include <syringe/syringe_rt.h>
+
+int injected_count = 0;
+int hello_count = 0;
+
+int main() {
+  hello(); // normal call to hello()
+  assert(hello_count == 1 && "Hello Count incorrect");
+
+  // switch implementation
+  assert(toggleImpl(hello) && "hello() could not be toggled!");
+  hello(); // should be a call to injected()
+  assert(injected_count == 1 && "Hello Count incorrect");
+
+  // switch implementation again
+  assert(toggleImpl(hello) && "hello() could not be toggled!");
+  hello(); // another call to hello
+  assert(hello_count == 2 && "Hello Count incorrect");
+
+  std::cout << "\n\033[1;32mAll checks have passed!\033[0m" << std::endl;
+  return 0;
+}

syringe-test/config/makefile

+PREFIX=~/clang-dev/bin
+CC=$(PREFIX)/clang
+CXX=$(PREFIX)/clang++
+OPT=$(PREFIX)/opt
+DIS=$(PREFIX)/llvm-dis
+SRC=syringe.cpp
+EMIT_BC=-emit-llvm $(OPTIMIZE) -c
+EMIT_LL=-S -emit-llvm $(OPTIMIZE)
+EMIT_ASM=-S $(OPTIMIZE)
+TARGETS=syringe.bc syringe.s syringe_test syringe_test_opt *.bc *.o *.ll *.a
+FLAGS=-fsyringe -fsyringe-config-file="syringe.yml" $(OPTIMIZE) $(DEBUG) $(VERBOSE)
+#OPTIMIZE=-O0
+#VERBOSE=-v
+DEBUG=-g
+LIBS= -lc++abi -I $(HOME)/clang-dev/include/c++/v1  -L $(HOME)/clang-dev/lib
+STD=-stdlib=libc++
+export LD_LIBRARY_PATH=$(HOME)/clang-dev/lib
+
+.PHONEY: $(TARGETS) test clean opt
+
+all: syringe.ll
+
+injection_decl.o: injection_decl.cpp
+  $(CXX) -c injection_decl.cpp $(FLAGS) $(STD)
+
+%.o: %.cpp
+  $(CXX) $< -c $(FLAGS) $(STD)
+
+%.ll: %.cpp
+  $(CXX) $< $(EMIT_LL) $(FLAGS) $(STD)
+
+%.bc: %.cpp
+  $(CXX) $< $(EMIT_BC) $(FLAGS) $(STD)
+
+%.s: %.cpp
+  $(CXX) $(SRC) $(EMIT_ASM) $(FLAGS) $(STD)
+
+test: syringe_test
+  ./syringe_test
+
+opt-test: syringe_test_opt
+  ./syringe_test_opt
+
+syringe_test_opt: main.o syringe.o injection_decl.o
+  $(CXX) main.o syringe.o injection_decl.o  -o syringe_test_opt $(FLAGS) $(LIBS) $(STD)
+
+main.o: main.cpp
+  $(CXX) main.cpp -c $(FLAGS) $(STD)
+
+clean:
+  rm -f $(TARGETS)

syringe-test/config/syringe.hpp

+#ifndef _SYRINGE_HPP_
+#define _SYRINGE_HPP_
+
+void hello();
+
+void injected();
+
+#endif

syringe-test/config/syringe.cpp

+#include "syringe.hpp"
+#include <iostream>
+
+extern int hello_count;
+
+void hello() { ++hello_count; }
+

syringe-test/config/syringe.yml

+- filename: syringe.cpp
+  targets:
+  - name: _Z5hellov
+    enable: ONCE
+    disable: NEVER
+- filename: injection_decl.cpp
+  payloads:
+  - name: _Z8injectedv
+    target: _Z5hellov

syringe-test/injection_decl.cpp

+#include <iostream>
+
+extern int injected_count;
+extern int other_counter;
+extern void hello();
+
+//[[clang::syringe_payload("_Z5hellov")]] void injected() {
+[[clang::syringe_payload(hello)]] void injected() {
+  ++injected_count;
+}

syringe-test/main.cpp

+#include "syringe.hpp"
+#include "template.hpp"
+
+#include <cassert>
+#include <iostream>
+#include <syringe/syringe_rt.h>
+#include <syringe/syringe_rt_cxx.h>
+
+using namespace __syringe;
+
+int injected_count = 0;
+int hello_count = 0;
+
+template int bad_foo<int>(int a, int b);
+template class BadAdder<int>;
+
+int main() {
+  // ensure that Syringe metadata is initialized
+  assert(!__syringe::GlobalSyringeData.empty());
+  printSyringeData();
+
+  hello(); // normal call to hello()
+  assert(hello_count == 1 && "Hello Count incorrect");
+
+  // switch implementation
+  assert(toggleImpl(hello) && "hello() could not be toggled!");
+  hello(); // should be a call to injected()
+  assert(injected_count == 1 && "Hello Count incorrect");
+
+  // switch implementation again
+  assert(toggleImpl(hello) && "hello() could not be toggled!");
+  hello(); // another call to hello
+  assert(hello_count == 2 && "Hello Count incorrect");
+
+  // check behavior in classes with virtual methods
+
+  // create a base class
+  SyringeBase b;
+
+  // verify its initialization state
+  assert(b.counter == 0);
+  assert(b.other_counter == 0);
+  assert(b.getCounter() == b.counter);
+
+  b.increment(); // b.counter = 1
+  assert(b.counter == 1);
+  assert(b.getCounter() == b.counter);
+
+  // get the member pointer to the target baseclass function
+  mPtrTy *myP = (mPtrTy *)convertMemberPtr(&SyringeBase::increment);
+
+  // switch its implementation
+  assert(toggleVirtualImpl(myP, &b) &&
+         "SyringeBase::increment() could not be toggled!");
+  b.increment(); // other_counter = 1
+  b.increment(); // other_counter = 2
+
+  assert(b.counter == 1);
+  assert(b.other_counter == 2);
+  assert(b.getCounter() != b.other_counter);
+  assert(b.getCounter() == b.counter);
+
+  // test template function
+  assert(foo(1, 1) == 2 && "Problem with original template funciton foo!");
+  toggleImpl((fptr_t)foo<int>);
+  printf("address of foo<int>: %p\n",(void*)(fptr_t)foo<int>);
+  assert(foo(1, 1) == 0 && "injection failed for function foo!");
+
+  Adder<int> a(1);
+  assert(a.data == 1);
+  assert(a.add(1) == 2 && "Problem with original class template Adder::add()!");
+
+  assert(toggleImplPtr(&Adder<int>::add) &&
+         "SyringeBase::increment() could not be toggled!");
+
+  assert(a.add(1) == 0 && "Injection failed for class template Adder::add()!");
+
+  std::cout << "\n\033[1;32mAll checks have passed!\033[0m" << std::endl;
+  return 0;
+}

syringe-test/makefile

+PREFIX=~/clang-dev/bin
+CC=$(PREFIX)/clang
+CXX=$(PREFIX)/clang++
+OPT=$(PREFIX)/opt
+DIS=$(PREFIX)/llvm-dis
+SRC=syringe.cpp
+EMIT_BC=-emit-llvm $(OPTIMIZE) -c
+EMIT_LL=-S -emit-llvm $(OPTIMIZE)
+EMIT_ASM=-S $(OPTIMIZE)
+TARGETS=syringe.bc syringe.s syringe_test syringe_test_opt *.bc *.o *.ll *.a
+FLAGS=-fsyringe $(OPTIMIZE) $(DEBUG) $(VERBOSE)
+#OPTIMIZE=-O0
+#VERBOSE=-v
+DEBUG=-g
+LIBS= -lc++abi -I $(HOME)/clang-dev/include/c++/v1  -L $(HOME)/clang-dev/lib
+STD=-stdlib=libc++
+export LD_LIBRARY_PATH=$(HOME)/clang-dev/lib
+
+.PHONEY: $(TARGETS) test clean opt
+
+all: syringe.ll
+
+#injection_decl.o: injection_decl.cpp
+# $(CXX) -c injection_decl.cpp $(FLAGS) $(STD)
+
+%.o: %.cpp
+  $(CXX) $< -c $(FLAGS) $(STD)
+
+%.ll: %.cpp
+  $(CXX) $< $(EMIT_LL) $(FLAGS) $(STD)
+
+%.bc: %.cpp
+  $(CXX) $< $(EMIT_BC) $(FLAGS) $(STD)
+
+%.s: %.cpp
+  $(CXX) $(SRC) $(EMIT_ASM) $(FLAGS) $(STD)
+
+test: syringe_test
+  ./syringe_test
+
+opt-test: syringe_test_opt
+  ./syringe_test_opt
+
+debug: syringe_test_opt
+  gdb ./syringe_test_opt
+
+syringe_test_opt: main.o syringe.o injection_decl.o
+  $(CXX) main.o syringe.o injection_decl.o  -o syringe_test_opt $(FLAGS) $(LIBS) $(STD)
+
+main.o: main.cpp
+  $(CXX) main.cpp -c $(FLAGS) $(STD)
+
+clean:
+  rm -f $(TARGETS)

syringe-test/plain_c/injection_decl.c

+extern int injected_count;
+extern int other_counter;
+ void injected() {
+  ++injected_count;
+}

syringe-test/plain_c/main.c

+#include "syringe.h"
+
+#include <assert.h>
+#include <stdio.h>
+#include <syringe/syringe_rt.h>
+
+
+int injected_count = 0;
+int hello_count = 0;
+
+
+int main() {
+  // ensure that Syringe metadata is initialized
+
+  hello(); // normal call to hello()
+  /*assert(hello_count == 1 && "Hello Count incorrect");*/
+
+  // switch implementation
+  /*assert(toggleImpl(hello) && "hello() could not be toggled!");*/
+  toggleImpl(hello);
+  hello(); // should be a call to injected()
+  /*assert(injected_count == 1 && "Hello Count incorrect");*/
+
+  // switch implementation again
+  /*assert(toggleImpl(hello) && "hello() could not be toggled!");*/
+  toggleImpl(hello);
+  hello(); // another call to hello
+  /*assert(hello_count == 2 && "Hello Count incorrect");*/
+
+  /*printf( "\n\033[1;32mAll checks have passed!\033[0m\n");*/
+  return 0;
+}

syringe-test/plain_c/makefile

+PREFIX=~/clang-dev/bin
+CC=$(PREFIX)/clang
+CXX=$(PREFIX)/clang++
+OPT=$(PREFIX)/opt
+DIS=$(PREFIX)/llvm-dis
+SRC=syringe.cpp
+EMIT_BC=-emit-llvm $(OPTIMIZE) -c
+EMIT_LL=-S -emit-llvm $(OPTIMIZE)
+EMIT_ASM=-S $(OPTIMIZE)
+TARGETS=syringe.bc syringe.s syringe_test syringe_test_opt *.bc *.o *.ll *.a
+FLAGS=-fsyringe -fsyringe-config-file="syringe.yml" -fuse-ld=lld $(OPTIMIZE) $(DEBUG) $(VERBOSE)
+#OPTIMIZE=-O0
+#VERBOSE=-v
+DEBUG=-g
+LIBS= -lc++abi -I $(HOME)/clang-dev/include/c++/v1  -L $(HOME)/clang-dev/lib
+STD=-stdlib=libc++
+export LD_LIBRARY_PATH=$(HOME)/clang-dev/lib
+
+.PHONEY: $(TARGETS) test clean opt
+
+all: syringe.ll
+
+injection_decl.o: injection_decl.c
+  $(CC) -c injection_decl.c $(FLAGS) $(STD)
+
+%.o: %.c
+  $(CC) $< -c $(FLAGS) $(STD)
+
+%.ll: %.c
+  $(CC) $< $(EMIT_LL) $(FLAGS) $(STD)
+
+%.bc: %.c
+  $(CC) $< $(EMIT_BC) $(FLAGS) $(STD)
+
+%.s: %.c
+  $(CC) $(SRC) $(EMIT_ASM) $(FLAGS) $(STD)
+
+test: syringe_test
+  ./syringe_test
+
+opt-test: syringe_test_opt
+  ./syringe_test_opt
+
+syringe_test_opt: main.o syringe.o injection_decl.o
+  $(CXX) main.o syringe.o injection_decl.o  -o syringe_test_opt $(FLAGS) $(LIBS) $(STD)
+
+main.o: main.c
+  $(CC) main.c -c $(FLAGS) $(STD)
+
+clean:
+  rm -f $(TARGETS)

syringe-test/plain_c/syringe.h

+#ifndef _SYRINGE_HPP_
+#define _SYRINGE_HPP_
+
+void hello();
+
+void injected();
+
+#endif

syringe-test/plain_c/syringe.c

+#include "syringe.h"
+
+extern int hello_count;
+
+void hello() { ++hello_count; }
+

syringe-test/plain_c/syringe.yml

+- filename: syringe.c
+  targets:
+  - name: hello
+    enable: ONCE
+    disable: NEVER
+- filename: injection_decl.c
+  payloads:
+  - name: injected
+    target: hello

syringe-test/syringe.hpp

+#ifndef _SYRINGE_HPP_
+#define _SYRINGE_HPP_
+
+extern int hello_count;
+[[clang::syringe_injection_site]] 
+ inline __attribute__((always_inline))
+  void
+hello() {
+  ++hello_count;
+}
+//[[clang::syringe_injection_site]] void hello();
+
+//[[clang::syringe_payload("_Z5hellov")]] void injected();
+[[clang::syringe_payload(hello)]] void injected();
+
+class SyringeBase {
+public:
+  SyringeBase();
+  virtual ~SyringeBase() = default;
+
+  int counter;
+  int other_counter;
+  [[clang::syringe_injection_site]] void virtual increment();
+  [[clang::syringe_injection_site]] int getCounter();
+  void dumb();
+};
+
+class SyringeDerived : public SyringeBase {
+public:
+  SyringeDerived();
+  virtual ~SyringeDerived() = default;
+  void increment();
+  int getCounter();
+};
+
+#endif

syringe-test/syringe.cpp

+#include "syringe.hpp"
+#include <iostream>
+
+extern int hello_count;
+
+//__attribute__((syringe_injection_site)) void hello() { ++hello_count; }
+
+SyringeBase::SyringeBase() : counter(0), other_counter(0) {}
+
+SyringeDerived::SyringeDerived() {}
+
+[[clang::syringe_injection_site]] int SyringeBase::getCounter() {
+  return counter;
+}
+
+//[[clang::syringe_payload(SyringeBase::getCounter)]]
+__attribute__((syringe_class_payload(SyringeBase))) 
+int SyringeDerived::getCounter() {
+  return other_counter;
+}
+
+[[clang::syringe_injection_site]] void SyringeBase::increment() { ++counter; };
+
+//[[clang::syringe_payload("_ZN11SyringeBase9incrementEv")]] void
+[[clang::syringe_class_payload(SyringeBase)]] void
+SyringeDerived::increment() {
+  ++other_counter;
+}
+
+void SyringeBase::dumb() {}

syringe-test/template.hpp

+#ifndef TEMPLATE_HPP_
+#define TEMPLATE_HPP_ 1
+
+template <typename T>
+[[clang::syringe_injection_site]]
+int foo(T a, T b) {
+  return a + b;
+}
+
+template <typename T>
+[[clang::syringe_payload(foo<T>)]]
+int bad_foo(T a, T b) {
+//[[clang::syringe_payload("_Z3fooIiEiT_S0_")]] int bad_foo(T a, T b) {
+//[[clang::syringe_payload("foo")]] int bad_foo(T a, T b) {
+  return a - b;
+}
+
+template <typename T>
+class Adder {
+
+public:
+  T data;
+  Adder(T initialValue) : data(initialValue) {}
+
+  [[clang::syringe_injection_site]]
+  T add(T a) { return data + a; }
+};
+
+template <typename T> class BadAdder : public Adder<T> {
+public:
+  BadAdder(T initialValue) : Adder<T>(initialValue) {}
+  [[clang::syringe_class_payload(Adder)]]
+    T add(T a) {
+  //[[clang::syringe_payload("_ZN5AdderIiE3addEi")]] T add(T a) {
+    return this->data - a;
+  }
+};
+
+#endif /* ifndef TEMPLATE_HPP_ */