aboutsummaryrefslogtreecommitdiff
path: root/clang/lib/Frontend/CompilerInvocation.cpp
AgeCommit message (Collapse)AuthorFilesLines
2025-01-07[analyzer][NFC] Simplify PositiveAnalyzerOption handling (#121910)Balazs Benics1-3/+1
This simplifies #120239 Addresses my comment at: https://github.com/llvm/llvm-project/pull/120239#issuecomment-2574600543 CPP-5920
2025-01-06[analyzer] Retry UNDEF Z3 queries 2 times by default (#120239)Balazs Benics1-0/+19
If we have a refutation Z3 query timed out (UNDEF), allow a couple of retries to improve stability of the query. By default allow 2 retries, which will give us in maximum of 3 solve attempts per query. Retries should help mitigating flaky Z3 queries. See the details in the following RFC: https://discourse.llvm.org/t/analyzer-rfc-retry-z3-crosscheck-queries-on-timeout/83711 Note that with each attempt, we spend more time per query. Currently, we have a 15 seconds timeout per query - which are also in effect for the retry attempts. --- Why should this help? In short, retrying queries should bring stability because if a query runs long it's more likely that it did so due to some runtime anomaly than it's on the edge of succeeding. This is because most queries run quick, and the queries that run long, usually run long by a fair amount. Consequently, retries should improve the stability of the outcome of the Z3 query. In general, the retries shouldn't increase the overall analysis time because it's really rare we hit the 0.1% of the cases when we would do retries. But keep in mind that the retry attempts can add up if many retries are allowed, or the individual query timeout is large. CPP-5920
2025-01-02[gcov] Bump default version to 11.1Fangrui Song1-2/+1
The gcov version is set to 11.1 (compatible with gcov 9) even if `-Xclang -coverage-version=` specified version is less than 11.1. Therefore, we can drop producer support for version < 11.1.
2025-01-02[Driver][clang-linker-wrapper] Add initial support for OpenMP offloading to ↵Nick Sarnie1-0/+1
generic SPIR-V (#120145) This is the first of a series of patches to add support for OpenMP offloading to SPIR-V through liboffload with the first intended target being Intel GPUs. This patch implements the basic driver and `clang-linker-wrapper` work for JIT mode. There are still many missing pieces, so this is not yet usable. We introduce `spirv64-intel-unknown` as the only currently supported triple. The user-facing argument to enable offloading will be `-fopenmp -fopenmp-targets=spirv64-intel` Add a new `SPIRVOpenMPToolChain` toolchain based on the existing general SPIR-V toolchain which will call all the required SPIR-V tools (and eventually the SPIR-V backend) as well as add the corresponding device RTL as an argument to the linker. We can't get through the front end consistently yet, so it's difficult to add any LIT tests that execute any tools, but front end changes are planned very shortly, and then we can add those tests. --------- Signed-off-by: Sarnie, Nick <nick.sarnie@intel.com>
2024-12-18Reapply "[ubsan] Add -fsanitize-merge (and -fno-sanitize-merge) ↵Thurston Dang1-0/+7
(#120…464)" (#120511) This reverts commit 2691b964150c77a9e6967423383ad14a7693095e. This reapply fixes the buildbot breakage of the original patch, by updating clang/test/CodeGen/ubsan-trap-debugloc.c to specify -fsanitize-merge (the default, which is merge, is applied by the driver but not clang_cc1). This reapply also expands clang/test/CodeGen/ubsan-trap-merge.c. ---- Original commit message: '-mllvm -ubsan-unique-traps' (https://github.com/llvm/llvm-project/pull/65972) applies to all UBSan checks. This patch introduces -fsanitize-merge (defaults to on, maintaining the status quo behavior) and -fno-sanitize-merge (equivalent to '-mllvm -ubsan-unique-traps'), with the option to selectively applying non-merged handlers to a subset of UBSan checks (e.g., -fno-sanitize-merge=bool,enum). N.B. we do not use "trap" in the argument name since https://github.com/llvm/llvm-project/pull/119302 has generalized -ubsan-unique-traps to work for non-trap modes (min-rt and regular rt). This patch does not remove the -ubsan-unique-traps flag; that will override -f(no-)sanitize-merge.
2024-12-18Revert "[ubsan] Add -fsanitize-merge (and -fno-sanitize-merge) (#120464)"Thurston Dang1-7/+0
This reverts commit 7eaf4708098c216bf432fc7e0bc79c3771e793a4. Reason: buildbot breakage (e.g., https://lab.llvm.org/buildbot/#/builders/144/builds/14299/steps/6/logs/FAIL__Clang__ubsan-trap-debugloc_c)
2024-12-18[ubsan] Add -fsanitize-merge (and -fno-sanitize-merge) (#120464)Thurston Dang1-0/+7
'-mllvm -ubsan-unique-traps' (https://github.com/llvm/llvm-project/pull/65972) applies to all UBSan checks. This patch introduces -fsanitize-merge (defaults to on, maintaining the status quo behavior) and -fno-sanitize-merge (equivalent to '-mllvm -ubsan-unique-traps'), with the option to selectively applying non-merged handlers to a subset of UBSan checks (e.g., -fno-sanitize-merge=bool,enum). N.B. we do not use "trap" in the argument name since https://github.com/llvm/llvm-project/pull/119302 has generalized -ubsan-unique-traps to work for non-trap modes (min-rt and regular rt). This patch does not remove the -ubsan-unique-traps flag; that will override -f(no-)sanitize-merge.
2024-12-17[Offload] Add support for loongarch64 to host pluginwanglei1-0/+1
This adds support for the loongarch64 architecture to the offload host plugin. Similar to #115773 To fix some test issues, I've had to add the LoongArch64 target to: - CompilerInvocation::ParseLangArgs - linkDevice in ClangLinuxWrapper.cpp - OMPContext::OMPContext (to set the device_kind_cpu trait) Reviewed By: jhuber6 Pull Request: https://github.com/llvm/llvm-project/pull/120173
2024-12-11Rework the `Option` library to reduce dynamic relocations (#119198)Chandler Carruth1-20/+43
Apologies for the large change, I looked for ways to break this up and all of the ones I saw added real complexity. This change focuses on the option's prefixed names and the array of prefixes. These are present in every option and the dominant source of dynamic relocations for PIE or PIC users of LLVM and Clang tooling. In some cases, 100s or 1000s of them for the Clang driver which has a huge number of options. This PR addresses this by building a string table and a prefixes table that can be referenced with indices rather than pointers that require dynamic relocations. This removes almost 7k dynmaic relocations from the `clang` binary, roughly 8% of the remaining dynmaic relocations outside of vtables. For busy-boxing use cases where many different option tables are linked into the same binary, the savings add up a bit more. The string table is a straightforward mechanism, but the prefixes required some subtlety. They are encoded in a Pascal-string fashion with a size followed by a sequence of offsets. This works relatively well for the small realistic prefixes arrays in use. Lots of code has to change in order to land this though: both all the option library code has to be updated to use the string table and prefixes table, and all the users of the options library have to be updated to correctly instantiate the objects. Some follow-up patches in the works to provide an abstraction for this style of code, and to start using the same technique for some of the other strings here now that the infrastructure is in place.
2024-12-05[PAC][Driver] Add `-faarch64-jump-table-hardening` flag (#113149)Daniil Kovalev1-1/+7
The flag is placed together with pointer authentication flags since they serve the same security purpose of protecting against attacks on control flow. The flag is not ABI-affecting and might be enabled separately if needed, but it's also intended to be enabled as part of pauth-enabled environments (e.g. pauthtest). See also codegen implementation #97666.
2024-11-19[PAC][clang] Add signed GOT cc1 flag (#96160)Daniil Kovalev1-0/+3
Add `-fptrauth-elf-got` clang cc1 flag and set `ptrauth_elf_got` preprocessor feature and `PointerAuthELFGOT` LangOption correspondingly. No additional checks like ensuring OS binary format is ELF are performed: it should be done on clang driver level when a pauth-enabled environment implying signed GOT enabled is requested. If the cc1 flag is passed, "ptrauth-elf-got" IR module flag is set.
2024-11-13Reapply "[clang] Introduce diagnostics suppression mappings (#112517)"Kadir Cetinkaya1-0/+8
This reverts commit 5f140ba54794fe6ca379362b133eb27780e363d7.
2024-11-12Revert "[clang] Introduce diagnostics suppression mappings (#112517)"Kadir Cetinkaya1-8/+0
This reverts commit 12e3ed8de8c6063b15916b3faf67c8c9cd17df1f. This reverts commit 41e3919ded78d8870f7c95e9181c7f7e29aa3cc4. There are some buildbot breakages in https://lab.llvm.org/buildbot/#/builders/18/builds/6832.
2024-11-12[clang] Introduce diagnostics suppression mappings (#112517)kadir çetinkaya1-0/+8
This implements https://discourse.llvm.org/t/rfc-add-support-for-controlling-diagnostics-severities-at-file-level-granularity-through-command-line/81292. Users now can suppress warnings for certain headers by providing a mapping with globs, a sample file looks like: ``` [unused] src:* src:*clang/*=emit ``` This will suppress warnings from `-Wunused` group in all files that aren't under `clang/` directory. This mapping file can be passed to clang via `--warning-suppression-mappings=foo.txt`. At a high level, mapping file is stored in DiagnosticOptions and then processed with rest of the warning flags when creating a DiagnosticsEngine. This is a functor that uses SpecialCaseLists underneath to match against globs coming from the mappings file. This implies processing warning options now performs IO, relevant interfaces are updated to take in a VFS, falling back to RealFileSystem when one is not available.
2024-10-31[clang][lex] Remove `-index-header-map` (#114459)Jan Svoboda1-24/+6
This PR removes the `-index-header-map` functionality from Clang. AFAIK this was only used internally at Apple and is now dead code. The main motivation behind this change is to enable the removal of `HeaderFileInfo::Framework` member and reducing the size of that data structure. rdar://84036149
2024-10-28Remove support for RenderScript (#112916)Aaron Ballman1-7/+0
See https://discourse.llvm.org/t/rfc-deprecate-and-eventually-remove-renderscript-support/81284 for the RFC
2024-10-04[Clang] Automatically enable `-fconvergent-functions` on GPU targets (#111076)Joseph Huber1-9/+9
Summary: This patch causes us to respect the `-fconvergent-functions` and `-fno-convergent-functions` options correctly. GPU targets should have this set all the time, but we now offer `-fno-convergent-functions` to opt-out if you want to test broken behavior. This munged about with a lot of the old weird logic, but I don't think it makes any real changes.
2024-09-29[ItaniumMangle] Add substitutions for record types when mangling vtables ↵tcwzxx1-0/+5
(#109970) Fix #108015 The `mangleNameOrStandardSubstitution` function does not add the RD type into the substitution, which causes the mangling of the \<base type\> to be incorrect. Rename `mangleNameOrStandardSubstitution` to `mangleCXXRecordDecl` and add `Record` as a substitution
2024-09-26[clang][RISCV] Introduce command line options for RISC-V Zicfilp CFIMing-Yi Lai1-0/+40
This patch enables the following command line flags for RISC-V targets: + `-fcf-protection=branch` turns on forward-edge control-flow integrity conditioning + `-mcf-branch-label-scheme=unlabeled|func-sig` selects the label scheme used in the forward-edge CFI conditioning
2024-09-20[HLSL] Warn about incomplete language support (#108894)Chris B1-0/+9
This adds a warning about incomplete language mode support before HLSL 202x. This is the last change in the sequence to fix and make HLSL 202x the default mode for Clang (#108044). Fixes #108044
2024-09-19[clang] Tidy uses of raw_string_ostream (NFC)Youngsuk Kim1-3/+1
As specified in the docs, 1) raw_string_ostream is always unbuffered and 2) the underlying buffer may be used directly ( 65b13610a5226b84889b923bae884ba395ad084d for further reference ) * Don't call raw_string_ostream::flush(), which is essentially a no-op. * Avoid unneeded calls to raw_string_ostream::str(), to avoid excess indirection.
2024-08-26Use CLANG_RESOURCE_DIR more consistently (#103388)Kim Gräsman1-1/+1
When Clang is consumed as a library, the CLANG_RESOURCE_DIR definition is not exported from the CMake system, so external clients will be unable to compute the same resource dir as Clang itself would, because they don't know what to pass for the optional CustomResourceDir argument. All call sites except one would pass CLANG_RESOURCE_DIR to Driver::GetResourcesPath. It seems the one exception in libclang CIndexer was an oversight. Move the use of CLANG_RESOURCE_DIR into GetResourcesPath and remove the optional argument to avoid this inconsistency between internal and external clients.
2024-08-23[Clang] Overflow Pattern Exclusion - rename some patterns, enhance docs ↵Justin Stitt1-2/+6
(#105709) From @vitalybuka's review on https://github.com/llvm/llvm-project/pull/104889: - [x] remove unused variable in tests - [x] rename `post-decr-while` --> `unsigned-post-decr-while` - [x] split `add-overflow-test` into `add-unsigned-overflow-test` and `add-signed-overflow-test` - [x] be more clear about defaults within docs - [x] add table to docs Here's a screenshot of the rendered table so you don't have to build the html docs yourself to inspect the layout: ![image](https://github.com/user-attachments/assets/5d3497c4-5f5a-4579-b29b-96a0fd192faa) CCs: @vitalybuka --------- Signed-off-by: Justin Stitt <justinstitt@google.com> Co-authored-by: Vitaly Buka <vitalybuka@google.com>
2024-08-20[Clang] Re-land Overflow Pattern Exclusions (#104889)Justin Stitt1-0/+14
Introduce "-fsanitize-undefined-ignore-overflow-pattern=" which can be used to disable sanitizer instrumentation for common overflow-dependent code patterns. For a wide selection of projects, proper overflow sanitization could help catch bugs and solve security vulnerabilities. Unfortunately, in some cases the integer overflow sanitizers are too noisy for their users and are often left disabled. Providing users with a method to disable sanitizer instrumentation of common patterns could mean more projects actually utilize the sanitizers in the first place. One such project that has opted to not use integer overflow (or truncation) sanitizers is the Linux Kernel. There has been some discussion[1] recently concerning mitigation strategies for unexpected arithmetic overflow. This discussion is still ongoing and a succinct article[2] accurately sums up the discussion. In summary, many Kernel developers do not want to introduce more arithmetic wrappers when most developers understand the code patterns as they are. Patterns like: if (base + offset < base) { ... } or while (i--) { ... } or #define SOME -1UL are extremely common in a code base like the Linux Kernel. It is perhaps too much to ask of kernel developers to use arithmetic wrappers in these cases. For example: while (wrapping_post_dec(i)) { ... } which wraps some builtin would not fly. This would incur too many changes to existing code; the code churn would be too much, at least too much to justify turning on overflow sanitizers. Currently, this commit tackles three pervasive idioms: 1. "if (a + b < a)" or some logically-equivalent re-ordering like "if (a > b + a)" 2. "while (i--)" (for unsigned) a post-decrement always overflows here 3. "-1UL, -2UL, etc" negation of unsigned constants will always overflow The patterns that are excluded can be chosen from the following list: - add-overflow-test - post-decr-while - negated-unsigned-const These can be enabled with a comma-separated list: -fsanitize-undefined-ignore-overflow-pattern=add-overflow-test,negated-unsigned-const "all" or "none" may also be used to specify that all patterns should be excluded or that none should be. [1] https://lore.kernel.org/all/202404291502.612E0A10@keescook/ [2] https://lwn.net/Articles/979747/ CCs: @efriedma-quic @kees @jyknight @fmayer @vitalybuka Signed-off-by: Justin Stitt <justinstitt@google.com> Co-authored-by: Bill Wendling <morbo@google.com>
2024-08-15Revert "[Clang] Overflow Pattern Exclusions (#100272)"Thurston Dang1-13/+0
This reverts commit 9a666deecb9ff6ca3a6b12e6c2877e19b74b54da. Reason: broke buildbots e.g., fork-ubsan.test started failing at https://lab.llvm.org/buildbot/#/builders/66/builds/2819/steps/9/logs/stdio Clang :: CodeGen/compound-assign-overflow.c Clang :: CodeGen/sanitize-atomic-int-overflow.c started failing with https://lab.llvm.org/buildbot/#/builders/52/builds/1570
2024-08-15[Clang] Overflow Pattern Exclusions (#100272)Justin Stitt1-0/+13
Introduce "-fsanitize-overflow-pattern-exclusion=" which can be used to disable sanitizer instrumentation for common overflow-dependent code patterns. For a wide selection of projects, proper overflow sanitization could help catch bugs and solve security vulnerabilities. Unfortunately, in some cases the integer overflow sanitizers are too noisy for their users and are often left disabled. Providing users with a method to disable sanitizer instrumentation of common patterns could mean more projects actually utilize the sanitizers in the first place. One such project that has opted to not use integer overflow (or truncation) sanitizers is the Linux Kernel. There has been some discussion[1] recently concerning mitigation strategies for unexpected arithmetic overflow. This discussion is still ongoing and a succinct article[2] accurately sums up the discussion. In summary, many Kernel developers do not want to introduce more arithmetic wrappers when most developers understand the code patterns as they are. Patterns like: if (base + offset < base) { ... } or while (i--) { ... } or #define SOME -1UL are extremely common in a code base like the Linux Kernel. It is perhaps too much to ask of kernel developers to use arithmetic wrappers in these cases. For example: while (wrapping_post_dec(i)) { ... } which wraps some builtin would not fly. This would incur too many changes to existing code; the code churn would be too much, at least too much to justify turning on overflow sanitizers. Currently, this commit tackles three pervasive idioms: 1. "if (a + b < a)" or some logically-equivalent re-ordering like "if (a > b + a)" 2. "while (i--)" (for unsigned) a post-decrement always overflows here 3. "-1UL, -2UL, etc" negation of unsigned constants will always overflow The patterns that are excluded can be chosen from the following list: - add-overflow-test - post-decr-while - negated-unsigned-const These can be enabled with a comma-separated list: -fsanitize-overflow-pattern-exclusion=add-overflow-test,negated-unsigned-const "all" or "none" may also be used to specify that all patterns should be excluded or that none should be. [1] https://lore.kernel.org/all/202404291502.612E0A10@keescook/ [2] https://lwn.net/Articles/979747/ CCs: @efriedma-quic @kees @jyknight @fmayer @vitalybuka Signed-off-by: Justin Stitt <justinstitt@google.com> Co-authored-by: Bill Wendling <morbo@google.com>
2024-08-09[clang] Implement -fptrauth-auth-traps. (#102417)Ahmed Bougacha1-3/+4
This provides -fptrauth-auth-traps, which at the frontend level only controls the addition of the "ptrauth-auth-traps" function attribute. The attribute in turn controls various aspects of backend codegen, by providing the guarantee that every "auth" operation generated will trap on failure. This can either be delegated to the hardware (if AArch64 FPAC is known to be available), in which case this attribute doesn't change codegen. Otherwise, if FPAC isn't available, this asks the backend to emit additional instructions to check and trap on auth failure.
2024-08-09[clang] Wire -fptrauth-returns to "ptrauth-returns" fn attribute. (#102416)Ahmed Bougacha1-1/+3
We already ended up with -fptrauth-returns, the feature macro, the lang opt, and the actual backend lowering. The only part left is threading it all through PointerAuthOptions, to drive the addition of the "ptrauth-returns" attribute to generated functions. While there, do minor cleanup on ptrauth-function-attributes.c. This also adds ptrauth_key_return_address to ptrauth.h.
2024-08-08[SystemZ][z/OS] __ptr32 support for z/OS (#101696)Abhina Sree1-0/+8
Enabling __ptr32 keyword to support in Clang for z/OS. It is represented by addrspace(1) in LLVM IR. Unlike existing implementation, __ptr32 is not mangled into symbol names for z/OS.
2024-08-06[PAC][AArch64] Support init/fini array signing (#96478)Daniil Kovalev1-5/+13
If both `-fptrauth-init-fini` and `-fptrauth-calls` are passed, sign function pointers in `llvm.global_ctors` and `llvm.global_dtors` with constant discriminator 0xD9D4 (`ptrauth_string_discriminator("init_fini")`). Additionally, if `-fptrauth-init-fini-address-discrimination` is passed, address discrimination is used for signing (otherwise, just constant discriminator is used). For address discrimination, we use it's special form since uses of `llvm.global_{c|d}tors` are disallowed (see `Verifier::visitGlobalVariable`) and we can't emit `getelementptr` expressions referencing these special arrays. A signed ctor/dtor pointer with special address discrimination applied looks like the following: ``` ptr ptrauth (ptr @foo, i32 0, i64 55764, ptr inttoptr (i64 1 to ptr)) ```
2024-07-22[AArch64][PAC] Sign block addresses used in indirectbr. (#97647)Ahmed Bougacha1-1/+5
Enabled in clang using: -fptrauth-indirect-gotos and at the IR level using function attribute: "ptrauth-indirect-gotos" Signing uses IA and a per-function integer discriminator. The discriminator isn't ABI-visible, and is currently: ptrauth_string_discriminator("<function_name> blockaddress") A sufficiently sophisticated frontend could benefit from per-indirectbr discrimination, which would need additional machinery, such as allowing "ptrauth" bundles on indirectbr. For our purposes, the simple scheme above is sufficient. This approach doesn't support subtracting label addresses and using the result as offsets, because each label address is signed. Pointer arithmetic on signed pointers corrupts the signature bits, and because label address expressions aren't typed beyond void*, we can't do anything reliably intelligent on the arithmetic exprs. Not signing addresses when used to form offsets would allow easily hijacking control flow by overwriting the offset. This diagnoses the basic cases (`&&lbl2 - &&lbl1`) in the frontend, while we evaluate either alternative implementations (e.g., lowering blockaddress to a bb number, and indirectbr to a checked jump-table), or better diagnostics (both at the frontend level and on unencodable IR constants).
2024-07-22[PAC] Implement authentication for C++ member function pointers (#99576)Oliver Hunt1-0/+2
Introduces type based signing of member function pointers. To support this discrimination schema we no longer emit member function pointer to virtual methods and indices into a vtable but migrate to using thunks. This does mean member function pointers are no longer necessarily directly comparable, however as such comparisons are UB this is acceptable. We derive the discriminator from the C++ mangling of the type of the pointer being authenticated. Co-Authored-By: Akira Hatanaka ahatanaka@apple.com Co-Authored-By: John McCall rjmccall@apple.com Co-authored-by: Ahmed Bougacha <ahmed@bougacha.org>
2024-07-22[clang] Implement type/address discrimination of type_info vtable. (#99726)Ahmed Bougacha1-2/+15
We want to be able to support full type and address discrimination of type_info on targets that don't have existing ABI compatibility constraints. This patch does not enable such behavior on any platform, it just adds the necessary machinery. In clang we add a new commandline argument to control the type_info vtable ABI: -fptrauth-type-info-vtable-pointer-discrimination and a feature flag to allow source level detection of the ABI: __has_feature(ptrauth_type_info_vtable_pointer_discrimination) Co-authored-by: Oliver Hunt <oliver@apple.com>
2024-07-11[PAC] Implement function pointer type discrimination (#96992)Akira Hatanaka1-2/+8
Give users an option (-fptrauth-function-pointer-type-discrimination) to sign a function pointer using a non-zero discriminator based on the function type. The discriminator is computed by first translating the function type to a string and then computing the hash value of the string. Two function types that are compatible in C must be translated to the same string with the exception of function types that use typedefs of anonymous structs in their return type or parameter types. This patch doesn't have the code to resign function pointers, which is needed when a function pointer is converted to a different function type. That will be implemented in another patch. Co-authored-by: John McCall <rjmccall@apple.com> --------- Co-authored-by: John McCall <rjmccall@apple.com>
2024-07-10[Clang] Allow raw string literals in C as an extension (#88265)Sirraide1-0/+13
This enables raw R"" string literals in C in some language modes and adds an option to disable or enable them explicitly as an extension. Background: GCC supports raw string literals in C in `-gnuXY` modes starting with gnu99. This pr both enables raw string literals in gnu99 mode and later in C and adds an `-f[no-]raw-string-literals` flag to override this behaviour. The decision not to enable raw string literals in gnu89 mode, according to the GCC devs, is intentional as that mode is supposed to be used for ‘old code’ that they don’t want to break; we’ve decided to match GCC’s behaviour here as well. The `-fraw-string-literals` flag can additionally be used to enable raw string literals in modes where they aren’t enabled by default (such as c99—as opposed to gnu99—or even e.g. C++03); conversely, the negated flag can be used to disable them in any gnuXY modes that *do* provide them by default, or to override a previous flag. However, we do *not* support disabling raw string literals (or indeed either of these two options) in C++11 mode and later, because we don’t want to just start supporting disabling features that are actually part of the language in the general case. This fixes #85703.
2024-06-26 [clang] Implement pointer authentication for C++ virtual functions, ↵Oliver Hunt1-0/+11
v-tables, and VTTs (#94056) Virtual function pointer entries in v-tables are signed with address discrimination in addition to declaration-based discrimination, where an integer discriminator the string hash (see `ptrauth_string_discriminator`) of the mangled name of the overridden method. This notably provides diversity based on the full signature of the overridden method, including the method name and parameter types. This patch introduces ItaniumVTableContext logic to find the original declaration of the overridden method. On AArch64, these pointers are signed using the `IA` key (the process-independent code key.) V-table pointers can be signed with either no discrimination, or a similar scheme using address and decl-based discrimination. In this case, the integer discriminator is the string hash of the mangled v-table identifier of the class that originally introduced the vtable pointer. On AArch64, these pointers are signed using the `DA` key (the process-independent data key.) Not using discrimination allows attackers to simply copy valid v-table pointers from one object to another. However, using a uniform discriminator of 0 does have positive performance and code-size implications on AArch64, and diversity for the most important v-table access pattern (virtual dispatch) is already better assured by the signing schemas used on the virtual functions. It is also known that some code in practice copies objects containing v-tables with `memcpy`, and while this is not permitted formally, it is something that may be invasive to eliminate. This is controlled by: ``` -fptrauth-vtable-pointer-type-discrimination -fptrauth-vtable-pointer-address-discrimination ``` In addition, this provides fine-grained controls in the ptrauth_vtable_pointer attribute, which allows overriding the default ptrauth schema for vtable pointers on a given class hierarchy, e.g.: ``` [[clang::ptrauth_vtable_pointer(no_authentication, no_address_discrimination, no_extra_discrimination)]] [[clang::ptrauth_vtable_pointer(default_key, default_address_discrimination, custom_discrimination, 0xf00d)]] ``` The override is then mangled as a parametrized vendor extension: ``` "__vtptrauth" I <key> <addressDiscriminated> <extraDiscriminator> E ``` To support this attribute, this patch adds a small extension to the attribute-emitter tablegen backend. Note that there are known areas where signing is either missing altogether or can be strengthened. Some will be addressed in later changes (e.g., member function pointers, some RTTI). `dynamic_cast` in particular is handled by emitting an artificial v-table pointer load (in a way that always authenticates it) before the runtime call itself, as the runtime doesn't have enough information today to properly authenticate it. Instead, the runtime is currently expected to strip the v-table pointer. --------- Co-authored-by: John McCall <rjmccall@apple.com> Co-authored-by: Ahmed Bougacha <ahmed@bougacha.org>
2024-06-21[clang] Implement function pointer signing and authenticated function calls ↵Ahmed Bougacha1-0/+26
(#93906) The functions are currently always signed/authenticated with zero discriminator. Co-Authored-By: John McCall <rjmccall@apple.com>
2024-06-20Reland [clang][Sema, Lex, Parse] Preprocessor embed in C and C++ (#95802)Mariya Podchishchaeva1-0/+8
This commit implements the entirety of the now-accepted [N3017 -Preprocessor Embed](https://www.open-std.org/jtc1/sc22/wg14/www/docs/n3017.htm) and its sister C++ paper [p1967](https://wg21.link/p1967). It implements everything in the specification, and includes an implementation that drastically improves the time it takes to embed data in specific scenarios (the initialization of character type arrays). The mechanisms used to do this are used under the "as-if" rule, and in general when the system cannot detect it is initializing an array object in a variable declaration, will generate EmbedExpr AST node which will be expanded by AST consumers (CodeGen or constant expression evaluators) or expand embed directive as a comma expression. This reverts commit https://github.com/llvm/llvm-project/commit/682d461d5a231cee54d65910e6341769419a67d7. --------- Co-authored-by: The Phantom Derpstorm <phdofthehouse@gmail.com> Co-authored-by: Aaron Ballman <aaron@aaronballman.com> Co-authored-by: cor3ntin <corentinjabot@gmail.com> Co-authored-by: H. Vetinari <h.vetinari@gmx.com>
2024-06-12Revert "✨ [Sema, Lex, Parse] Preprocessor embed in C and C++ (and Obj-C ↵Vitaly Buka1-8/+0
and Obj-C++ by-proxy)" (#95299) Reverts llvm/llvm-project#68620 Introduce or expose a memory leak and UB, see llvm/llvm-project#68620
2024-06-12[clang][Sema, Lex, Parse] Preprocessor embed in C and C++ (and Obj-C and ↵The Phantom Derpstorm1-0/+8
Obj-C++ by-proxy) (#68620) This commit implements the entirety of the now-accepted [N3017 - Preprocessor Embed](https://www.open-std.org/jtc1/sc22/wg14/www/docs/n3017.htm) and its sister C++ paper [p1967](https://wg21.link/p1967). It implements everything in the specification, and includes an implementation that drastically improves the time it takes to embed data in specific scenarios (the initialization of character type arrays). The mechanisms used to do this are used under the "as-if" rule, and in general when the system cannot detect it is initializing an array object in a variable declaration, will generate EmbedExpr AST node which will be expanded by AST consumers (CodeGen or constant expression evaluators) or expand embed directive as a comma expression. --------- Co-authored-by: Aaron Ballman <aaron@aaronballman.com> Co-authored-by: cor3ntin <corentinjabot@gmail.com> Co-authored-by: H. Vetinari <h.vetinari@gmx.com> Co-authored-by: Podchishchaeva, Mariya <mariya.podchishchaeva@intel.com>
2024-06-04Disable constexpr function body checking in more situations (#94347)Aaron Ballman1-0/+3
Before C++23, we would check a constexpr function body to diagnose if the function can never be evaluated in a constant expression context. This was previously required standards behavior, but C++23 relaxed the restrictions with P2448R2. While this checking is useful, it is also quite expensive, especially in pathological cases (see #92924 for an example), because it means the mere presence of a constexpr function definition will require constant evaluation even if the function is not used within the TU. Clang suppresses diagnostics in system headers by default and system headers (like STL implementations) can be full of constexpr function bodies. Now we suppress the check for a diagnostic if the function definition is in a system header or if the `-Winvalid-constexpr` diagnostic is disabled. This should have some mild compile time performance improvements. Also, the previous implementation would disable the diagnostic in C++23 mode entirely. Due to the benefit of the check, this patch now makes it possible to enable the diagnostic explicitly in C++23 mode.
2024-05-11[clang] Use StringRef::operator== instead of StringRef::equals (NFC) (#91844)Kazu Hirata1-1/+1
I'm planning to remove StringRef::equals in favor of StringRef::operator==. - StringRef::operator==/!= outnumber StringRef::equals by a factor of 24 under clang/ in terms of their usage. - The elimination of StringRef::equals brings StringRef closer to std::string_view, which has operator== but not equals. - S == "foo" is more readable than S.equals("foo"), especially for !Long.Expression.equals("str") vs Long.Expression != "str".
2024-05-09[AArch64][PAC][clang][ELF] Support PAuth ABI core info (#85235)Daniil Kovalev1-0/+20
Depends on #87545 Emit PAuth ABI compatibility tag values as llvm module flags: - `aarch64-elf-pauthabi-platform` - `aarch64-elf-pauthabi-version` For platform 0x10000002 (llvm_linux), the version value bits correspond to the following LangOptions defined in #85232: - bit 0: `PointerAuthIntrinsics`; - bit 1: `PointerAuthCalls`; - bit 2: `PointerAuthReturns`; - bit 3: `PointerAuthAuthTraps`; - bit 4: `PointerAuthVTPtrAddressDiscrimination`; - bit 5: `PointerAuthVTPtrTypeDiscrimination`; - bit 6: `PointerAuthInitFini`. --------- Co-authored-by: Ahmed Bougacha <ahmed@bougacha.org>
2024-05-07cc1: Report an error for multiple actions unless separated by ↵Fangrui Song1-0/+24
-main-file-name (#91140) When multiple actions are specified, the last one is used and others are overridden. This might lead to confusion if the user is used to driver's `-S -emit-llvm` behavior. ``` %clang_cc1 -S -emit-llvm a.c # -S is overridden %clang_cc1 -emit-llvm -S a.c # -emit-llvm is overridden %clang_cc1 -fsyntax-only -S a.c # -fsyntax-only is overridden ``` However, we want to continue supporting overriding the driver action with -Xclang: * `clang -c -Xclang -ast-dump a.c` (`%clang -cc1 -emit-obj ... -main-file-name a.c ... -ast-dump`) * `clang -c -xc++ -Xclang -emit-module stl.modulemap` As an exception, we allow -ast-dump* options to be composed together (e.g. `-ast-dump -ast-dump-lookups` in AST/ast-dump-lookups.cpp).
2024-04-29[CIR] Add options to emit ClangIR and enable the ClangIR pipelineNathan Lanza1-0/+4
Introduce just the option definitions and support for their existance at a few different points in the frontend. This will be followed soon by functionality that uses it. Reviewers: bcardosolopes, jansvoboda11, AaronBallman, erichkeane, MaskRay Reviewed By: erichkeane Pull Request: https://github.com/llvm/llvm-project/pull/89030
2024-04-19[Clang] Fix the mangling of lambdas (#89204)cor3ntin1-0/+5
Lambdas used in the initializer of a local class were not mangling the name of the member. Fixes #88906
2024-04-18[Clang] Emit DW_TAG_template_alias for template aliases (#87623)Orlando Cazalet-Hyams1-0/+5
Fix issue https://github.com/llvm/llvm-project/issues/54624 Add front end flags -gtemplate-alias (also a cc1 flag) and -gno-template-alias to enable/disable usage of the feature. It's enabled by default in the front end for SCE debugger tuning only. GCC emits DW_TAG_typedef for template aliases (as does Clang with this feature disabled), and GDB and LLDB appear not to support DW_TAG_template_alias. The -Xclang option -gsimple-template-names=mangled is treated the same as =full, which is not a regression from current behaviour for template aliases. The current implementation omits defaulted arguments and as a consequence also omits empty parameter packs that come after defaulted arguments. Again, this isn't a regression as the DW_TAG_typedef name doesn't contain defaulted arguments. LLVM support added in https://github.com/llvm/llvm-project/pull/88943 Added template-alias.cpp - Check the metadata construction & interaction with -gsimple-template-names. Added variadic-template-alias.cpp - Check template parameter packs work. Added defaulted-template-alias.cpp - Check defaulted args (don't) work. Modified debug-options.c - Check Clang generates correct cc1 flags.
2024-04-05Reland "[flang][clang] Add Visibility specific help text for options (#81869)"David Spickett1-8/+8
This reverts commit 67d20412b448533c77f54ac7a1e5d0775d273729. This includes fixes for clanginstallapi.
2024-04-05Revert "[flang][clang] Add Visibility specific help text for options (#81869)"David Spickett1-8/+8
This reverts commit 7e958f64efea6cb824e96ace51e021afbc150922. Failing on multiple bots.
2024-04-05[flang][clang] Add Visibility specific help text for options (#81869)David Spickett1-8/+8
And use it to print the correct default OpenMP version for flang and flang -fc1. This change adds an optional `HelpTextsForVariants` to options. This allows you to change the help text that gets shown in documentation and `--help` based on the program its being generated for. As `OptTable` needs to be constexpr compatible, I have used a std::array of help text variants. Each entry is: (list of visibilities) - > help text string So for the OpenMP version we have (flang, fc1) -> "OpenMP version for flang is...". So you can have multiple visibilities use the same string. The number of entries is currently set to 1, and the number of visibilities per entry is 2, because that's the maximum we need for now. The code is written so we can increase these numbers later, and the unused elements will be initialised. I have not applied this to group descriptions just because I don't know of one that needs changing. It could easily be enabled for those too if needed. There are minor changes to them just to get it all to compile. This approach of storing many help strings per option in the 1 driver library seemed preferable to making a whole new library for Flang (even if that would mostly be including stuff from Clang).