[MSan] add _nosanitize versions for memory intrinsic implementations

[glider]

Summary

Instrumentation of memory intrinsics in non-instrumented functions should differ from that in instrumented functions.
This is done by calling versions of __msan_memXXX() functions with _nosanitize suffixes.

[eugenis]

LGTM

[glider]

We've decided to abandon this revision, as non-instrumented functions must still unpoison shadow.

lib/Transforms/Instrumentation/MemorySanitizer.cpp

private:
   Value *MsanPoisonStackFn;
 
   /// Run-time helper that records a store (or any event) of an
   /// uninitialized value and returns an updated origin id encoding this info.
   Value *MsanChainOriginFn;
 
   /// MSan runtime replacements for memmove, memcpy and memset.
   Value *MemmoveFn, *MemcpyFn, *MemsetFn;
+  /// _nosanitize variants of memmove, memcpy and memset for use in
+  /// non-sanitized functions.
+  Value *MemmoveNosanFn, *MemcpyNosanFn, *MemsetNosanFn;
 
   /// KMSAN callback for task-local function argument shadow.
   Value *MsanGetContextStateFn;
 
   /// Functions for poisoning/unpoisoning local variables
   Value *MsanPoisonAllocaFn, *MsanUnpoisonAllocaFn;
 
   /// Each of the MsanMetadataPtrXxx functions returns a pair of shadow/origin
MemmoveFn = M.getOrInsertFunction(
     "__msan_memmove", IRB.getInt8PtrTy(), IRB.getInt8PtrTy(),
     IRB.getInt8PtrTy(), IntptrTy);
   MemcpyFn = M.getOrInsertFunction(
     "__msan_memcpy", IRB.getInt8PtrTy(), IRB.getInt8PtrTy(), IRB.getInt8PtrTy(),
     IntptrTy);
   MemsetFn = M.getOrInsertFunction(
     "__msan_memset", IRB.getInt8PtrTy(), IRB.getInt8PtrTy(), IRB.getInt32Ty(),
     IntptrTy);
+
+  MemmoveNosanFn =
+      M.getOrInsertFunction("__msan_memmove_nosanitize", IRB.getInt8PtrTy(),
+                            IRB.getInt8PtrTy(), IRB.getInt8PtrTy(), IntptrTy);
+  MemcpyNosanFn =
+      M.getOrInsertFunction("__msan_memcpy_nosanitize", IRB.getInt8PtrTy(),
+                            IRB.getInt8PtrTy(), IRB.getInt8PtrTy(), IntptrTy);
+  MemsetNosanFn =
+      M.getOrInsertFunction("__msan_memset_nosanitize", IRB.getInt8PtrTy(),
+                            IRB.getInt8PtrTy(), IRB.getInt32Ty(), IntptrTy);
+
   // We insert an empty inline asm after __msan_report* to avoid callback merge.
   EmptyAsm = InlineAsm::get(FunctionType::get(IRB.getVoidTy(), false),
                             StringRef(""), StringRef(""),
                             /*hasSideEffects=*/true);
 
   MsanInstrumentAsmStoreFn =
       M.getOrInsertFunction("__msan_instrument_asm_store", IRB.getVoidTy(),
                             PointerType::get(IRB.getInt8Ty(), 0), IntptrTy);
struct MemorySanitizerVisitor : public InstVisitor<MemorySanitizerVisitor> {
   std::unique_ptr<VarArgHelper> VAHelper;
   const TargetLibraryInfo *TLI;
   BasicBlock *ActualFnStart;
 
   // The following flags disable parts of MSan instrumentation based on
   // blacklist contents and command-line options.
   bool InsertChecks;
   bool PropagateShadow;
+  bool InstrumentMemIntrinsics;
   bool PoisonStack;
   bool PoisonUndef;
   bool CheckReturnValue;
 
   struct ShadowOriginAndInsertPoint {
     Value *Shadow;
     Value *Origin;
     Instruction *OrigIns;
 
     ShadowOriginAndInsertPoint(Value *S, Value *O, Instruction *I)
       : Shadow(S), Origin(O), OrigIns(I) {}
   };
   SmallVector<ShadowOriginAndInsertPoint, 16> InstrumentationList;
   SmallVector<StoreInst *, 16> StoreList;
 
   MemorySanitizerVisitor(Function &F, MemorySanitizer &MS)
       : F(F), MS(MS), VAHelper(CreateVarArgHelper(F, MS, *this)) {
     bool SanitizeFunction = F.hasFnAttribute(Attribute::SanitizeMemory);
     InsertChecks = SanitizeFunction;
     PropagateShadow = SanitizeFunction;
+    InstrumentMemIntrinsics = SanitizeFunction;
     PoisonStack = SanitizeFunction && ClPoisonStack;
     PoisonUndef = SanitizeFunction && ClPoisonUndef;
     // FIXME: Consider using SpecialCaseList to specify a list of functions that
     // must always return fully initialized values. For now, we hardcode "main".
     CheckReturnValue = SanitizeFunction && (F.getName() == "main");
     TLI = &MS.getAnalysis<TargetLibraryInfoWrapperPass>().getTLI();
 
     MS.initializeCallbacks(*F.getParent());
#endif
   /// If we instrument the call here, but it does not get inlined,
   /// we will memove the shadow twice: which is bad in case
   /// of overlapping regions. So, we simply lower the intrinsic to a call.
   ///
   /// Similar situation exists for memcpy and memset.
   void visitMemMoveInst(MemMoveInst &I) {
     IRBuilder<> IRB(&I);
     IRB.CreateCall(
-        MS.MemmoveFn,
+        InstrumentMemIntrinsics ? MS.MemmoveFn : MS.MemmoveNosanFn,
         {IRB.CreatePointerCast(I.getArgOperand(0), IRB.getInt8PtrTy()),
          IRB.CreatePointerCast(I.getArgOperand(1), IRB.getInt8PtrTy()),
          IRB.CreateIntCast(I.getArgOperand(2), MS.IntptrTy, false)});
     I.eraseFromParent();
   }
 
   // Similar to memmove: avoid copying shadow twice.
   // This is somewhat unfortunate as it may slowdown small constant memcpys.
   // FIXME: consider doing manual inline for small constant sizes and proper
   // alignment.
   void visitMemCpyInst(MemCpyInst &I) {
     IRBuilder<> IRB(&I);
     IRB.CreateCall(
-        MS.MemcpyFn,
+        InstrumentMemIntrinsics ? MS.MemcpyFn : MS.MemcpyNosanFn,
         {IRB.CreatePointerCast(I.getArgOperand(0), IRB.getInt8PtrTy()),
          IRB.CreatePointerCast(I.getArgOperand(1), IRB.getInt8PtrTy()),
          IRB.CreateIntCast(I.getArgOperand(2), MS.IntptrTy, false)});
     I.eraseFromParent();
   }
 
   // Same as memcpy.
   void visitMemSetInst(MemSetInst &I) {
     IRBuilder<> IRB(&I);
     IRB.CreateCall(
-        MS.MemsetFn,
+        InstrumentMemIntrinsics ? MS.MemsetFn : MS.MemsetNosanFn,
         {IRB.CreatePointerCast(I.getArgOperand(0), IRB.getInt8PtrTy()),
          IRB.CreateIntCast(I.getArgOperand(1), IRB.getInt32Ty(), false),
          IRB.CreateIntCast(I.getArgOperand(2), MS.IntptrTy, false)});
     I.eraseFromParent();
   }
 
   void visitVAStartInst(VAStartInst &I) {
     VAHelper->visitVAStartInst(I);

test/Instrumentation/MemorySanitizer/msan_basic.ll

 }
 
 declare void @llvm.memset.p0i8.i64(i8* nocapture, i8, i64, i1) nounwind
 
 ; CHECK-LABEL: @MemSet
 ; CHECK: call i8* @__msan_memset
 ; CHECK: ret void
 
+; _nosanitize version of memset
+define void @MemSetNosanitize(i8* nocapture %x) nounwind uwtable {
+entry:
+  call void @llvm.memset.p0i8.i64(i8* %x, i8 42, i64 10, i1 false)
+  ret void
+}
+
+; CHECK-LABEL: @MemSetNosanitize
+; CHECK: call i8* @__msan_memset_nosanitize
+; CHECK: ret void
 
 ; memcpy
 define void @MemCpy(i8* nocapture %x, i8* nocapture %y) nounwind uwtable sanitize_memory {
 entry:
   call void @llvm.memcpy.p0i8.p0i8.i64(i8* %x, i8* %y, i64 10, i1 false)
   ret void
 }
 
 declare void @llvm.memcpy.p0i8.p0i8.i64(i8* nocapture, i8* nocapture, i64, i1) nounwind
 
 ; CHECK-LABEL: @MemCpy
 ; CHECK: call i8* @__msan_memcpy
 ; CHECK: ret void
 
+; _nosanitize version of memcpy
+define void @MemCpyNosanitize(i8* nocapture %x, i8* nocapture %y) nounwind uwtable {
+entry:
+  call void @llvm.memcpy.p0i8.p0i8.i64(i8* %x, i8* %y, i64 10, i1 false)
+  ret void
+}
+
+; CHECK-LABEL: @MemCpyNosanitize
+; CHECK: call i8* @__msan_memcpy_nosanitize
+; CHECK: ret void
 
 ; memmove is lowered to a call
 define void @MemMove(i8* nocapture %x, i8* nocapture %y) nounwind uwtable sanitize_memory {
 entry:
   call void @llvm.memmove.p0i8.p0i8.i64(i8* %x, i8* %y, i64 10, i1 false)
   ret void
 }
 
 declare void @llvm.memmove.p0i8.p0i8.i64(i8* nocapture, i8* nocapture, i64, i1) nounwind
 
 ; CHECK-LABEL: @MemMove
 ; CHECK: call i8* @__msan_memmove
 ; CHECK: ret void
 
+define void @MemMoveNosanitize(i8* nocapture %x, i8* nocapture %y) nounwind uwtable {
+entry:
+  call void @llvm.memmove.p0i8.p0i8.i64(i8* %x, i8* %y, i64 10, i1 false)
+  ret void
+}
+
+; CHECK-LABEL: @MemMoveNosanitize
+; CHECK: call i8* @__msan_memmove_nosanitize
+; CHECK: ret void
+
 ;; ------------
 ;; Placeholder tests that will fail once element atomic @llvm.mem[cpy|move|set] instrinsics have
 ;; been added to the MemIntrinsic class hierarchy. These will act as a reminder to
 ;; verify that MSAN handles these intrinsics properly once they have been
 ;; added to that class hierarchy.
 declare void @llvm.memset.element.unordered.atomic.p0i8.i64(i8* nocapture writeonly, i8, i64, i32) nounwind
 declare void @llvm.memmove.element.unordered.atomic.p0i8.p0i8.i64(i8* nocapture writeonly, i8* nocapture readonly, i64, i32) nounwind
 declare void @llvm.memcpy.element.unordered.atomic.p0i8.p0i8.i64(i8* nocapture writeonly, i8* nocapture readonly, i64, i32) nounwind