Implement -fsemantic-interposition

[serge-sans-paille]

Summary

First attempt at implementing -fsemantic-interposition.

Rely on GlobalValue::isInterposable that already captures most of the expected behavior.

Rely on a ModuleFlag to state whether we should respect SemanticInterposition or not. The default remains no.

[serge-sans-paille]

@MaskRay no example yet, I'd like your opinion on the approach first. It has the advantage of being non intrusive to the code base...

[merge_guards_bot]

Unit tests: pass. 61912 tests passed, 0 failed and 783 were skipped.

clang-tidy: unknown.

clang-format: pass.

Build artifacts: diff.json, clang-format.patch, CMakeCache.txt, console-log.txt, test-results.xml

[MaskRay]

The logic looks good to me.

Linkages which were not interposable before and can be interposable now: available_externally, linkonce_odr, weak_odr, external, and appending.

isDefinitionExact returned true for external before, and can return false if SemanticInterposition is set.

clang/include/clang/Driver/Options.td

3287

fno_semantic_interposition does not need to have the CC1Option flag.

In clangDriver you'll need to do:

if (Args.hasFlag(options::OPT_fsemantic_interposition, options::OPT_fno_semantic_interposition, false))

llvm/include/llvm/IR/GlobalValue.h

287

It seems that this utility is not very necessary.

llvm/lib/Analysis/InlineCost.cpp

1845 ↗

(On Diff #238443)

Why this change?

llvm/lib/IR/Globals.cpp

101

Checking isInterposableLinkage(getLinkage()) first may be more efficient.

101

if (!isInterposableLinkage(getLinkage())) return false;

[serge-sans-paille]

Take into account review

[serge-sans-paille]

Linkages which were not interposable before and can be interposable now: available_externally, linkonce_odr, weak_odr, external, and appending.

@MaskRay I understand the motivation behind that sentence, but do we want that change to be non-conditional, i.e. not guarded by -fsemantic-interposition ?

[merge_guards_bot]

Unit tests: pass. 62055 tests passed, 0 failed and 784 were skipped.

clang-tidy: unknown.

clang-format: pass.

Build artifacts: diff.json, clang-format.patch, CMakeCache.txt, console-log.txt, test-results.xml

[MaskRay]

llvm/lib/IR/Globals.cpp

101

if (!isInterposableLinkage(getLinkage()))
  return false;
return getParent() && getParent()->getSemanticInterposition() && !isDSOLocal();

llvm/lib/IR/Module.cpp

565

A test/llvm/Verifier/ test checking "SemanticInterposition" must be a ConstantInt will be nice.

[MaskRay]

In D72829#1831017, @serge-sans-paille wrote:

Linkages which were not interposable before and can be interposable now: available_externally, linkonce_odr, weak_odr, external, and appending.

@MaskRay I understand the motivation behind that sentence, but do we want that change to be non-conditional, i.e. not guarded by -fsemantic-interposition ?

I tried modifying GlobalValue::maybeSetDsoLocal: setDSOLocal(true) for ExternalLinkage. Unfortunately that will break 1337 tests. If not so many tests need fixing, I wish we can place getParent() && getParent()->getSemanticInterposition() logic in maybeSetDsoLocal and simplify isInterposable.

if (!isInterposableLinkage(getLinkage()))
  return false;
- return getParent() && getParent()->getSemanticInterposition() && !isDSOLocal();
+ return !isDSOLocal();

[serge-sans-paille]

• extra test case

[serge-sans-paille]

I tried modifying GlobalValue::maybeSetDsoLocal: setDSOLocal(true) for ExternalLinkage. Unfortunately that will break 1337 tests. If not so many tests need fixing, I wish we can place getParent() && getParent()->getSemanticInterposition() logic in maybeSetDsoLocal and simplify isInterposable.

Tried that and ended up with various check failures.
I also tried to update isInterposableLinkage to either

• set more linkage type as interposable unconditionnaly, and with no surprise, it triggers plenty check failures
• accept a mandatory « HonorSemanticInterposition argument, so that both isInterposableLinkage and isInterposable are consistent, but in some cases, isInterposableLinkage doesn't have a module reference to gather the ModuleFlag from...

[merge_guards_bot]

Unit tests: pass. 62107 tests passed, 0 failed and 808 were skipped.

clang-tidy: unknown.

clang-format: pass.

Build artifacts: diff.json, clang-format.patch, CMakeCache.txt, console-log.txt, test-results.xml

[MaskRay]

llvm/include/llvm/IR/GlobalValue.h

287

isDSOPreemptable is not used in the new patch. Forgot to remove?

llvm/include/llvm/IR/Module.h

851

It does not seem that we use @{ @} nowadays... They don't add much documentation value so they can probably be removed.

[grimar]

llvm/lib/IR/Module.cpp

559

A minor nit about style:
This probably would be nicer as

if (auto *Val = cast_or_null<ConstantAsMetadata>(
        getModuleFlag("SemanticInterposition")))
  return cast<ConstantInt>(Val->getValue())->getZExtValue();
return false;

[serge-sans-paille]

Take review into account

[merge_guards_bot]

Unit tests: pass. 62134 tests passed, 0 failed and 808 were skipped.

clang-tidy: pass.

clang-format: pass.

Build artifacts: diff.json, clang-tidy.txt, clang-format.patch, CMakeCache.txt, console-log.txt, test-results.xml

[serge-sans-paille]

Formatting.

[merge_guards_bot]

Unit tests: pass. 62132 tests passed, 0 failed and 808 were skipped.

clang-tidy: pass.

clang-format: pass.

Build artifacts: diff.json, clang-tidy.txt, clang-format.patch, CMakeCache.txt, console-log.txt, test-results.xml

[serge-sans-paille]

Add Release note and doc. @MaskRay can you confirm current state is ok?

[merge_guards_bot]

Unit tests: pass. 62135 tests passed, 0 failed and 808 were skipped.

clang-tidy: pass.

clang-format: pass.

Build artifacts: diff.json, clang-tidy.txt, clang-format.patch, CMakeCache.txt, console-log.txt, test-results.xml

Pre-merge checks is in beta. Report issue. Please | join beta or | enable it for your project.

[MaskRay]

In D72829#1835933, @serge-sans-paille wrote:

Add Release note and doc. @MaskRay can you confirm current state is ok?

I feel that we are still behind a complete -fsemantic-interposition... I don't know whether we should mention that the option is experimental.

clang/lib/CodeGen/CodeGenModule.cpp

487

This should also check -fno-pic -fpie vs -fpic.

In GCC, only -fpic -fPIC enable semantic interposition.

-fsemantic-interpositions seems a no-op with -fno-pic or -fpie.

[serge-sans-paille]

I feel that we are still behind a complete -fsemantic-interposition... I don't know whether we should mention that the option is experimental.

So do I. I can mention that in the -help output and in the changelog.

[serge-sans-paille]

Take into account pie/pic interaction with semantic-interposition
More test case
Remove premature release note entry

[MaskRay]

clang/lib/CodeGen/CodeGenModule.cpp

488

The parentheses can be deleted.

[merge_guards_bot]

Unit tests: fail. 62147 tests passed, 5 failed and 811 were skipped.

failed: libc++.std/language_support/cmp/cmp_partialord/partialord.pass.cpp
failed: libc++.std/language_support/cmp/cmp_strongeq/cmp.strongeq.pass.cpp
failed: libc++.std/language_support/cmp/cmp_strongord/strongord.pass.cpp
failed: libc++.std/language_support/cmp/cmp_weakeq/cmp.weakeq.pass.cpp
failed: libc++.std/language_support/cmp/cmp_weakord/weakord.pass.cpp

clang-tidy: pass.

clang-format: pass.

Build artifacts: diff.json, clang-tidy.txt, clang-format.patch, CMakeCache.txt, console-log.txt, test-results.xml

Pre-merge checks is in beta. Report issue. Please join beta or enable it for your project.

[serge-sans-paille]

Formatting nits + rebase

[merge_guards_bot]

Unit tests: fail. 62155 tests passed, 5 failed and 811 were skipped.

failed: libc++.std/language_support/cmp/cmp_partialord/partialord.pass.cpp
failed: libc++.std/language_support/cmp/cmp_strongeq/cmp.strongeq.pass.cpp
failed: libc++.std/language_support/cmp/cmp_strongord/strongord.pass.cpp
failed: libc++.std/language_support/cmp/cmp_weakeq/cmp.weakeq.pass.cpp
failed: libc++.std/language_support/cmp/cmp_weakord/weakord.pass.cpp

clang-tidy: pass.

clang-format: pass.

Build artifacts: diff.json, clang-tidy.txt, clang-format.patch, CMakeCache.txt, console-log.txt, test-results.xml

Pre-merge checks is in beta. Report issue. Please join beta or enable it for your project.

[merge_guards_bot]

Unit tests: fail. 62174 tests passed, 5 failed and 813 were skipped.

failed: libc++.std/language_support/cmp/cmp_partialord/partialord.pass.cpp
failed: libc++.std/language_support/cmp/cmp_strongeq/cmp.strongeq.pass.cpp
failed: libc++.std/language_support/cmp/cmp_strongord/strongord.pass.cpp
failed: libc++.std/language_support/cmp/cmp_weakeq/cmp.weakeq.pass.cpp
failed: libc++.std/language_support/cmp/cmp_weakord/weakord.pass.cpp

clang-tidy: pass.

clang-format: pass.

Build artifacts: diff.json, clang-tidy.txt, clang-format.patch, CMakeCache.txt, console-log.txt, test-results.xml

Pre-merge checks is in beta. Report issue. Please join beta or enable it for your project.

[MaskRay]

clang/lib/Frontend/CompilerInvocation.cpp

2715

Opts.SemanticInterposition = Args.hasArg(OPT_fsemantic_interposition);

clang/test/CodeGen/semantic-interposition.c

2

Add a file-level comment what configurations produce SemanticInterposition

9

CHECK-NOPIC-NOPIE-NOT and CHECK-PIC-PIE-NOT can be combined (e.g. INTERPOSE: vs NO-INTERPOSE-NOT: )

llvm/test/Transforms/Inline/inline-semantic-interposition.ll

2

excess space

Add a comment what happened here.

[serge-sans-paille]

Improve & comment examples

[serge-sans-paille]

clang/lib/Frontend/CompilerInvocation.cpp

2715

That was on purpose, so that we're backward compatible with existing situation. Without the flag, the genrated .ll doesn't differ. That's less explicit though. Does it make sense to you?

llvm/test/Transforms/Inline/inline-semantic-interposition.ll

2

I'm not sure about the excess space comment, but comment added.

[merge_guards_bot]

Unit tests: pass. 62209 tests passed, 0 failed and 815 were skipped.

clang-tidy: pass.

clang-format: pass.

Build artifacts: diff.json, clang-tidy.txt, clang-format.patch, CMakeCache.txt, console-log.txt, test-results.xml

Pre-merge checks is in beta. Report issue. Please join beta or enable it for your project.

[MaskRay]

clang/lib/CodeGen/CodeGenModule.cpp

488

An alternative is to move the PIC/PIE logic to lib/Frontend/CompilerInvocation.cpp

Then we should be able to use if (Context.getLangOpts().SemanticInterposition) here

llvm/test/Transforms/Inline/inline-semantic-interposition.ll

2

Nit: there are two spaces between -inline and -S.

[serge-sans-paille]

@MaskRay should we add a verifier step to check that pie/pic/semanticinterposition module flags are consistent, or leave that to clang ?

[serge-sans-paille]

clang/lib/CodeGen/CodeGenModule.cpp

488

👍 like that one

[merge_guards_bot]

Unit tests: pass. 62258 tests passed, 0 failed and 827 were skipped.

clang-tidy: pass.

clang-format: fail. Please format your changes with clang-format by running git-clang-format HEAD^ or applying this patch.

Build artifacts: diff.json, clang-tidy.txt, clang-format.patch, CMakeCache.txt, console-log.txt, test-results.xml

Pre-merge checks is in beta. Report issue. Please join beta or enable it for your project.

[MaskRay]

In D72829#1844050, @serge-sans-paille wrote:

@MaskRay should we add a verifier step to check that pie/pic/semanticinterposition module flags are consistent, or leave that to clang ?

I suppose you mean whether "SemanticInterposition" should be invalidated when "PIC Level" does not exist or "PIE Level" exists. I am a bit inclined to make it more flexible/orthogonal in the backend, i.e. SemanticInterposition is in affect even if "PIE Level" is set.

[MaskRay]

clang/lib/Frontend/CompilerInvocation.cpp

3041

Opts.SemanticInterposition is initialized to 0 and is not assigned elsewhere.

Opts.SemanticInterposition = ... should be possible.

[serge-sans-paille]

I suppose you mean whether "SemanticInterposition" should be invalidated when "PIC Level" does not exist or "PIE Level" exists. I am a bit inclined to make it more flexible/orthogonal in the backend, i.e. SemanticInterposition is in affect even if "PIE Level" is set.

OK, looks good as is, then?

[MaskRay]

In D72829#1845396, @serge-sans-paille wrote:

I suppose you mean whether "SemanticInterposition" should be invalidated when "PIC Level" does not exist or "PIE Level" exists. I am a bit inclined to make it more flexible/orthogonal in the backend, i.e. SemanticInterposition is in affect even if "PIE Level" is set.

OK, looks good as is, then?

Yes!

[merge_guards_bot]

Unit tests: pass. 62281 tests passed, 0 failed and 827 were skipped.

clang-tidy: pass.

clang-format: pass.

Build artifacts: diff.json, clang-tidy.txt, clang-format.patch, CMakeCache.txt, console-log.txt, test-results.xml

Pre-merge checks is in beta. Report issue. Please join beta or enable it for your project.

[arichardson]

clang/docs/ClangCommandLineReference.rst

907

This looks like it should be reordered?

[serge-sans-paille]

@arichardson doc updated, any other advice?

[merge_guards_bot]

Unit tests: pass. 62286 tests passed, 0 failed and 827 were skipped.

clang-tidy: pass.

clang-format: pass.

Build artifacts: diff.json, clang-tidy.txt, clang-format.patch, CMakeCache.txt, console-log.txt, test-results.xml

Pre-merge checks is in beta. Report issue. Please join beta or enable it for your project.

[arichardson]

In D72829#1846157, @serge-sans-paille wrote:

@arichardson doc updated, any other advice?

No comments on the code just wondering if the documentation should be expanded.
I just came across this review by chance and it was not clear to me what "Enable semantic interposition" means.
I had to read the code and look the GCC documentation+llvm mailing list posts to understand it.

As this is user-facing documentation I feel like there should be a slightly longer explaning what the option does.

For comparison here is the GCC command line flag documentation

-fsemantic-interposition
Some object formats, like ELF, allow interposing of symbols by the dynamic linker. This means that for symbols exported from the DSO, the compiler cannot perform interprocedural propagation, inlining and other optimizations in anticipation that the function or variable in question may change. While this feature is useful, for example, to rewrite memory allocation functions by a debugging implementation, it is expensive in the terms of code quality. With -fno-semantic-interposition the compiler assumes that if interposition happens for functions the overwriting function will have precisely the same semantics (and side effects). Similarly if interposition happens for variables, the constructor of the variable will be the same. The flag has no effect for functions explicitly declared inline (where it is never allowed for interposition to change semantics) and for symbols explicitly declared weak.

Other than this, the change looks good to me.

clang/docs/ClangCommandLineReference.rst

907

Sorry I mean that it looks like all other entries are .. option:: followed by the description but here it's the other way around. It seems like this change will make the documention of -fsanitize-* be Enable semantic interposition.

[sfertile]

Aewsome, thanks for implementing this. I was on vacation for a bit and somehow missed this review in my queue when I cam back but having a look at it now.

[serge-sans-paille]

Update user-level documentation.

[serge-sans-paille]

As this is user-facing documentation I feel like there should be a slightly longer explaning what the option does.

done!

[merge_guards_bot]

Unit tests: pass. 62300 tests passed, 0 failed and 837 were skipped.

clang-tidy: pass.

clang-format: pass.

Build artifacts: diff.json, clang-tidy.txt, clang-format.patch, CMakeCache.txt, console-log.txt, test-results.xml

Pre-merge checks is in beta. Report issue. Please join beta or enable it for your project.

[sfertile]

In D72829#1846353, @arichardson wrote:

As this is user-facing documentation I feel like there should be a slightly longer explaning what the option does.

+1 on this, otherwise LGTM. Thanks for implementing this!

llvm/include/llvm/IR/GlobalValue.h

425–426

Minor nit: We have extended this to now determine if a definition can be substituted with an arbitrary definition at link time or load time.

I would suggest changing the first link time to link time or load time, and changing
since the callee can be replaced with something arbitrary at link time. to
since the callee can be replaced with something arbitrary.,

[serge-sans-paille]

take @sfertile review into account.

[merge_guards_bot]

Unit tests: pass. 62312 tests passed, 0 failed and 838 were skipped.

clang-tidy: pass.

clang-format: pass.

Build artifacts: diff.json, clang-tidy.txt, clang-format.patch, CMakeCache.txt, console-log.txt, test-results.xml

Pre-merge checks is in beta. Report issue. Please join beta or enable it for your project.

[arichardson]

Thanks documentation looks much better now.

clang/docs/ClangCommandLineReference.rst

907

It still looks like the documentation here is for the wrong option. I think it should be:

.. option:: -fsanitize=<check>,<arg2>..., -fno-sanitize=<arg1>,<arg2>...

Turn on runtime checks for various forms of undefined or suspicious behavior. See user manual for available checks

.. option:: -fno-semantic-interposition, -fsemantic-interposition

Enable semantic interposition. Semantic interposition allows for the
interposition of a symbol by another at run time, thus preventing a range of
inter-procedural optimisation.

[serge-sans-paille]

Fix documentation ordering, thank goes to @arichardson for spotting that.

[merge_guards_bot]

Unit tests: pass. 62325 tests passed, 0 failed and 838 were skipped.

clang-tidy: pass.

clang-format: pass.

Build artifacts: diff.json, clang-tidy.txt, clang-format.patch, CMakeCache.txt, console-log.txt, test-results.xml

Pre-merge checks is in beta. Report issue. Please join beta or enable it for your project.

clang/docs/ClangCommandLineReference.rst

 Strip (or keep only, if negative) a given number of path components when emitting check metadata.
 
 .. option:: -fsanitize-undefined-trap-on-error, -fno-sanitize-undefined-trap-on-error
 
 .. option:: -fsanitize=<check>,<arg2>..., -fno-sanitize=<arg1>,<arg2>...
 
 Turn on runtime checks for various forms of undefined or suspicious behavior. See user manual for available checks
 
+.. option:: -fno-semantic-interposition, -fsemantic-interposition
+
+Enable semantic interposition. Semantic interposition allows for the
+interposition of a symbol by another at runtime, thus preventing a range of
+inter-procedural optimisation.
+
 .. option:: -moutline, -mno-outline
 
 Enable function outlining (AArch64 only)
 
 .. option:: --param <arg>, --param=<arg>
 
 .. option:: -std=<arg>, --std=<arg>, --std <arg>
 

clang/include/clang/Basic/LangOptions.def

 
 ENUM_LANGOPT(GC, GCMode, 2, NonGC, "Objective-C Garbage Collection mode")
 ENUM_LANGOPT(ValueVisibilityMode, Visibility, 3, DefaultVisibility,
              "default visibility for functions and variables [-fvisibility]")
 ENUM_LANGOPT(TypeVisibilityMode, Visibility, 3, DefaultVisibility,
              "default visibility for types [-ftype-visibility]")
 LANGOPT(SetVisibilityForExternDecls, 1, 0,
         "apply global symbol visibility to external declarations without an explicit visibility")
+BENIGN_LANGOPT(SemanticInterposition        , 1, 0, "semantic interposition")
 ENUM_LANGOPT(StackProtector, StackProtectorMode, 2, SSPOff,
              "stack protector mode")
 ENUM_LANGOPT(TrivialAutoVarInit, TrivialAutoVarInitKind, 2, TrivialAutoVarInitKind::Uninitialized,
              "trivial automatic variable initialization")
 ENUM_LANGOPT(SignedOverflowBehavior, SignedOverflowBehaviorTy, 2, SOB_Undefined,
              "signed integer overflow handling")
 
 BENIGN_LANGOPT(ArrowDepth, 32, 256,

clang/include/clang/Driver/Options.td

defm inline_functions_called_once : BooleanFFlag<"inline-functions-called-once">,
     Group<clang_ignored_gcc_optimization_f_Group>;
 def finline_limit_EQ : Joined<["-"], "finline-limit=">, Group<clang_ignored_gcc_optimization_f_Group>;
 defm finline_limit : BooleanFFlag<"inline-limit">, Group<clang_ignored_gcc_optimization_f_Group>;
 defm inline_small_functions : BooleanFFlag<"inline-small-functions">,
     Group<clang_ignored_gcc_optimization_f_Group>;
 defm ipa_cp : BooleanFFlag<"ipa-cp">,
     Group<clang_ignored_gcc_optimization_f_Group>;
 defm ivopts : BooleanFFlag<"ivopts">, Group<clang_ignored_gcc_optimization_f_Group>;
-def : Flag<["-"], "fno-semantic-interposition">, Group<clang_ignored_f_Group>;
+def fsemantic_interposition : Flag<["-"], "fsemantic-interposition">, Group<f_Group>, Flags<[CC1Option]>;
+def fno_semantic_interposition: Flag<["-"], "fno-semantic-interposition">, Group<f_Group>;
 defm non_call_exceptions : BooleanFFlag<"non-call-exceptions">, Group<clang_ignored_f_Group>;
 defm peel_loops : BooleanFFlag<"peel-loops">, Group<clang_ignored_gcc_optimization_f_Group>;
 defm permissive : BooleanFFlag<"permissive">, Group<clang_ignored_f_Group>;
 defm prefetch_loop_arrays : BooleanFFlag<"prefetch-loop-arrays">, Group<clang_ignored_gcc_optimization_f_Group>;
 defm printf : BooleanFFlag<"printf">, Group<clang_ignored_f_Group>;
 defm profile : BooleanFFlag<"profile">, Group<clang_ignored_f_Group>;
 defm profile_correction : BooleanFFlag<"profile-correction">, Group<clang_ignored_gcc_optimization_f_Group>;
 defm profile_generate_sampling : BooleanFFlag<"profile-generate-sampling">, Group<clang_ignored_f_Group>;

clang/lib/CodeGen/CodeGenModule.cpp

void CodeGenModule::Release() {
   if (Context.getTargetInfo().getTriple().getArch() == llvm::Triple::x86)
     getModule().addModuleFlag(llvm::Module::Error, "NumRegisterParameters",
                               CodeGenOpts.NumRegisterParameters);
 
   if (CodeGenOpts.DwarfVersion) {
     getModule().addModuleFlag(llvm::Module::Max, "Dwarf Version",
                               CodeGenOpts.DwarfVersion);
   }
+
+  if (Context.getLangOpts().SemanticInterposition)
+    // Require various optimization to respect semantic interposition.
+    getModule().setSemanticInterposition(1);
+
   if (CodeGenOpts.EmitCodeView) {
     // Indicate that we want CodeView in the metadata.
     getModule().addModuleFlag(llvm::Module::Warning, "CodeView", 1);
   }
   if (CodeGenOpts.CodeViewGHash) {
     getModule().addModuleFlag(llvm::Module::Warning, "CodeViewGHash", 1);
   }
   if (CodeGenOpts.ControlFlowGuard) {
if (!Var->isThreadLocal() &&
       return true;
 
   // If we can use a plt entry as the symbol address we can assume it
   // is local.
   // FIXME: This should work for PIE, but the gold linker doesn't support it.
   if (isa<llvm::Function>(GV) && !CGOpts.NoPLT && RM == llvm::Reloc::Static)
     return true;
 
-  // Otherwise don't assue it is local.
+  // Otherwise don't assume it is local.
   return false;
 }
 
 void CodeGenModule::setDSOLocal(llvm::GlobalValue *GV) const {
   GV->setDSOLocal(shouldAssumeDSOLocal(*this, GV));
 }
 
 void CodeGenModule::setDLLImportDLLExport(llvm::GlobalValue *GV,

clang/lib/Driver/ToolChains/Clang.cpp

#endif
   Args.AddLastArg(CmdArgs, options::OPT_femit_all_decls);
   Args.AddLastArg(CmdArgs, options::OPT_fheinous_gnu_extensions);
   Args.AddLastArg(CmdArgs, options::OPT_fdigraphs, options::OPT_fno_digraphs);
   Args.AddLastArg(CmdArgs, options::OPT_fno_operator_names);
   Args.AddLastArg(CmdArgs, options::OPT_femulated_tls,
                   options::OPT_fno_emulated_tls);
   Args.AddLastArg(CmdArgs, options::OPT_fkeep_static_consts);
 
+  if (Args.hasFlag(options::OPT_fsemantic_interposition,
+                   options::OPT_fno_semantic_interposition, false))
+    CmdArgs.push_back("-fsemantic-interposition");
+
   // AltiVec-like language extensions aren't relevant for assembling.
   if (!isa<PreprocessJobAction>(JA) || Output.getType() != types::TY_PP_Asm)
     Args.AddLastArg(CmdArgs, options::OPT_fzvector);
 
   Args.AddLastArg(CmdArgs, options::OPT_fdiagnostics_show_template_tree);
   Args.AddLastArg(CmdArgs, options::OPT_fno_elide_type);
 
   // Forward flags for OpenMP. We don't do this if the current action is an

clang/lib/Frontend/CompilerInvocation.cpp

#include "clang/Basic/LangStandards.def"
   // The value-visibility mode defaults to "default".
   if (Arg *visOpt = Args.getLastArg(OPT_fvisibility)) {
     Opts.setValueVisibilityMode(parseVisibility(visOpt, Args, Diags));
   } else {
     Opts.setValueVisibilityMode(DefaultVisibility);
   }
 
   // The type-visibility mode defaults to the value-visibility mode.
   if (Arg *typeVisOpt = Args.getLastArg(OPT_ftype_visibility)) {
     Opts.setTypeVisibilityMode(parseVisibility(typeVisOpt, Args, Diags));
   } else {
     Opts.setTypeVisibilityMode(Opts.getValueVisibilityMode());
   }
 
   if (Args.hasArg(OPT_fvisibility_inlines_hidden))
     Opts.InlineVisibilityHidden = 1;
 
emitError |= (DefaultCC == LangOptions::DCC_VectorCall ||
                  !T.isX86();
     if (emitError)
       Diags.Report(diag::err_drv_argument_not_allowed_with)
           << A->getSpelling() << T.getTriple();
     else
       Opts.setDefaultCallingConv(DefaultCC);
   }
 
+  // -fsemantic-interposition
+  Opts.SemanticInterposition =
+      Args.hasArg(OPT_fsemantic_interposition) && Opts.PICLevel && !Opts.PIE;
+
   // -mrtd option
   if (Arg *A = Args.getLastArg(OPT_mrtd)) {
     if (Opts.getDefaultCallingConv() != LangOptions::DCC_None)
       Diags.Report(diag::err_drv_argument_not_allowed_with)
           << A->getSpelling() << "-fdefault-calling-conv";
     else {
       llvm::Triple T(TargetOpts.Triple);
       if (T.getArch() != llvm::Triple::x86)

clang/test/CodeGen/semantic-interposition.c

+// Semantic Interposition is active if
+//  -fsemantic-interposition is set,
+// - pic-level > 0
+// - pic-is-pie is not set
+
+// RUN: %clang_cc1 -emit-llvm -fsemantic-interposition -pic-level 0 %s -o - | FileCheck %s -check-prefix=CHECK-NO-INTERPOSITION
+// RUN: %clang_cc1 -emit-llvm -fsemantic-interposition -pic-level 1 %s -o - | FileCheck %s -check-prefix=CHECK-INTERPOSITION
+// RUN: %clang_cc1 -emit-llvm -fsemantic-interposition -pic-level 2 %s -o - | FileCheck %s -check-prefix=CHECK-INTERPOSITION
+// RUN: %clang_cc1 -emit-llvm -fsemantic-interposition -pic-level 0 %s -o - | FileCheck %s -check-prefix=CHECK-NO-INTERPOSITION
+// RUN: %clang_cc1 -emit-llvm -fsemantic-interposition -pic-level 1 -pic-is-pie %s -o - | FileCheck %s -check-prefix=CHECK-NO-INTERPOSITION
+// RUN: %clang_cc1 -emit-llvm -fsemantic-interposition -pic-level 2 -pic-is-pie %s -o - | FileCheck %s -check-prefix=CHECK-NO-INTERPOSITION
+
+// CHECK-NO-INTERPOSITION-NOT: "SemanticInterposition"
+// CHECK-INTERPOSITION: !{{[0-9]+}} = !{i32 1, !"SemanticInterposition", i32 1}

clang/test/Driver/clang_f_opts.c

 // RUN:     -fgcse -fno-gcse                                                  \
 // RUN:     -fident -fno-ident                                                \
 // RUN:     -fimplicit-templates -fno-implicit-templates                      \
 // RUN:     -finput-charset=UTF-8                                             \
 // RUN:     -fexec-charset=UTF-8                                             \
 // RUN:     -fivopts -fno-ivopts                                              \
 // RUN:     -fnon-call-exceptions -fno-non-call-exceptions                    \
 // RUN:     -fno-semantic-interposition                                       \
+// RUN:     -fsemantic-interposition                                          \
 // RUN:     -fpermissive -fno-permissive                                      \
 // RUN:     -fdefer-pop -fno-defer-pop                                        \
 // RUN:     -fprefetch-loop-arrays -fno-prefetch-loop-arrays                  \
 // RUN:     -fprofile-correction -fno-profile-correction                      \
 // RUN:     -fprofile-values -fno-profile-values                              \
 // RUN:     -frounding-math -fno-rounding-math                                \
 // RUN:     -fsee -fno-see                                                    \
 // RUN:     -ftracer -fno-tracer                                              \

llvm/include/llvm/IR/GlobalValue.h

public:
   Type *getValueType() const { return ValueType; }
 
   void setDSOLocal(bool Local) { IsDSOLocal = Local; }
 
   bool isDSOLocal() const {
     return IsDSOLocal;
   }
 
   bool hasPartition() const {
     return HasPartition;
   }
   StringRef getPartition() const;
   void setPartition(StringRef Part);
 
   static LinkageTypes getLinkOnceLinkage(bool ODR) {
     return ODR ? LinkOnceODRLinkage : LinkOnceAnyLinkage;
   }
bool hasExactDefinition() const {
     // While this computes exactly the same thing as
     // isStrongDefinitionForLinker, the intended uses are different.  This
     // function is intended to help decide if specific inter-procedural
     // transforms are correct, while isStrongDefinitionForLinker's intended use
     // is in low level code generation.
     return !isDeclaration() && isDefinitionExact();
   }
 
   /// Return true if this global's definition can be substituted with an
-  /// *arbitrary* definition at link time.  We cannot do any IPO or inlinining
-  /// across interposable call edges, since the callee can be replaced with
-  /// something arbitrary at link time.
-  bool isInterposable() const { return isInterposableLinkage(getLinkage()); }
+  /// *arbitrary* definition at link time or load time. We cannot do any IPO or
+  /// inlining across interposable call edges, since the callee can be
+  /// replaced with something arbitrary.
+  bool isInterposable() const;
 
   bool hasExternalLinkage() const { return isExternalLinkage(getLinkage()); }
   bool hasAvailableExternallyLinkage() const {
     return isAvailableExternallyLinkage(getLinkage());
   }
   bool hasLinkOnceLinkage() const { return isLinkOnceLinkage(getLinkage()); }
   bool hasLinkOnceODRLinkage() const {
     return isLinkOnceODRLinkage(getLinkage());

llvm/include/llvm/IR/Module.h

/// @}
   /// Attach profile summary metadata to this module.
   void setProfileSummary(Metadata *M, ProfileSummary::Kind Kind);
 
   /// Returns profile summary metadata. When IsCS is true, use the context
   /// sensitive profile summary.
   Metadata *getProfileSummary(bool IsCS);
   /// @}
 
+  /// Returns whether semantic interposition is to be respected.
+  bool getSemanticInterposition() const;
+
+  /// Set whether semantic interposition is to be respected.
+  void setSemanticInterposition(bool);
+
   /// Returns true if PLT should be avoided for RTLib calls.
   bool getRtLibUseGOT() const;
 
   /// Set that PLT should be avoid for RTLib calls.
   void setRtLibUseGOT();
 
   /// @name Utility functions for querying and setting the build SDK version
   /// @{

llvm/lib/IR/Globals.cpp

case Value::NAME##Val:                                                       \
     return static_cast<NAME *>(this)->eraseFromParent();
 #include "llvm/IR/Value.def"
   default:
     break;
   }
   llvm_unreachable("not a global");
 }
 
+bool GlobalValue::isInterposable() const {
+  if (isInterposableLinkage(getLinkage()))
+    return true;
+  return getParent() && getParent()->getSemanticInterposition() &&
+         !isDSOLocal();
+}
+
 unsigned GlobalValue::getAlignment() const {
   if (auto *GA = dyn_cast<GlobalAlias>(this)) {
     // In general we cannot compute this at the IR level, but we try.
     if (const GlobalObject *GO = GA->getBaseObject())
       return GO->getAlignment();
 
     // FIXME: we should also be able to handle:
     // Alias = Global + Offset

llvm/lib/IR/Module.cpp

else
     addModuleFlag(ModFlagBehavior::Error, "ProfileSummary", M);
 }
 
 Metadata *Module::getProfileSummary(bool IsCS) {
   return (IsCS ? getModuleFlag("CSProfileSummary")
                : getModuleFlag("ProfileSummary"));
 }
 
+bool Module::getSemanticInterposition() const {
+  Metadata *MF = getModuleFlag("SemanticInterposition");
+
+  auto *Val = cast_or_null<ConstantAsMetadata>(MF);
+  if (!Val)
+    return false;
+
+  return cast<ConstantInt>(Val->getValue())->getZExtValue();
+}
+
+void Module::setSemanticInterposition(bool SI) {
+  addModuleFlag(ModFlagBehavior::Error, "SemanticInterposition", SI);
+}
+
 void Module::setOwnedMemoryBuffer(std::unique_ptr<MemoryBuffer> MB) {
   OwnedMemoryBuffer = std::move(MB);
 }
 
 bool Module::getRtLibUseGOT() const {
   auto *Val = cast_or_null<ConstantAsMetadata>(getModuleFlag("RtLibUseGOT"));
   return Val && (cast<ConstantInt>(Val->getValue())->getZExtValue() > 0);
 }

llvm/lib/IR/Verifier.cpp

Verifier::visitModuleFlag(const MDNode *Op,
   if (ID->getString() == "Linker Options") {
     // If the llvm.linker.options named metadata exists, we assume that the
     // bitcode reader has upgraded the module flag. Otherwise the flag might
     // have been created by a client directly.
     Assert(M.getNamedMetadata("llvm.linker.options"),
            "'Linker Options' named metadata no longer supported");
   }
 
+  if (ID->getString() == "SemanticInterposition") {
+    ConstantInt *Value =
+        mdconst::dyn_extract_or_null<ConstantInt>(Op->getOperand(2));
+    Assert(Value,
+           "SemanticInterposition metadata requires constant integer argument");
+  }
+
   if (ID->getString() == "CG Profile") {
     for (const MDOperand &MDO : cast<MDNode>(Op->getOperand(2))->operands())
       visitModuleFlagCGProfileEntry(MDO);
   }
 }
 
 void Verifier::visitModuleFlagCGProfileEntry(const MDOperand &MDO) {
   auto CheckFunction = [&](const MDOperand &FuncMDO) {

llvm/test/Transforms/Inline/inline-semantic-interposition.ll

+; Check that @callee1 gets inlined while @callee2 is not, because of
+; SemanticInterposition.
+
+; RUN: opt < %s -inline -S | FileCheck %s
+
+define internal i32 @callee1(i32 %A) {
+  ret i32 %A
+}
+
+define i32 @callee2(i32 %A) {
+  ret i32 %A
+}
+
+; CHECK-LABEL: @caller
+define i32 @caller(i32 %A) {
+; CHECK-NOT: call i32 @callee1(i32 %A)
+  %A1 = call i32 @callee1(i32 %A)
+; CHECK: %A2 = call i32 @callee2(i32 %A)
+  %A2 = call i32 @callee2(i32 %A)
+; CHECK: add i32 %A, %A2
+  %R = add i32 %A1, %A2
+  ret i32 %R
+}
+
+!llvm.module.flags = !{!0}
+!0 = !{i32 1, !"SemanticInterposition", i32 1}

llvm/test/Verifier/module-flags-semantic-interposition.ll

+; RUN: not llvm-as < %s -o /dev/null 2>&1 | FileCheck %s
+
+target datalayout = "e-m:e-p270:32:32-p271:32:32-p272:64:64-i64:64-f80:128-n8:16:32:64-S128"
+target triple = "x86_64-unknown-linux-gnu"
+
+@foo = dso_local global i32 1, align 4
+
+!llvm.module.flags = !{!0}
+
+!0 = !{i32 1, !"SemanticInterposition", float 1.}
+
+; CHECK: SemanticInterposition metadata requires constant integer argument