//===--- SanitizerArgs.cpp - Arguments for sanitizer tools  ---------------===//

//

// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.

// See https://llvm.org/LICENSE.txt for license information.

// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception

//

//===----------------------------------------------------------------------===//

#include "clang/Driver/SanitizerArgs.h"

#include "ToolChains/CommonArgs.h"

#include "clang/Basic/Sanitizers.h"

#include "clang/Driver/Driver.h"

#include "clang/Driver/DriverDiagnostic.h"

#include "clang/Driver/Options.h"

#include "clang/Driver/ToolChain.h"

#include "llvm/ADT/StringExtras.h"

#include "llvm/ADT/StringRef.h"

#include "llvm/ADT/StringSwitch.h"

#include "llvm/Support/Path.h"

#include "llvm/Support/SpecialCaseList.h"

#include "llvm/Support/VirtualFileSystem.h"

#include "llvm/TargetParser/AArch64TargetParser.h"

#include "llvm/TargetParser/RISCVTargetParser.h"

#include "llvm/TargetParser/TargetParser.h"

#include "llvm/Transforms/Instrumentation/AddressSanitizerOptions.h"

#include <memory>

using namespace clang;

using namespace clang::driver;

using namespace llvm::opt;

static const SanitizerMask NeedsUbsanRt =

    SanitizerKind::Undefined | SanitizerKind::Integer |

    SanitizerKind::ImplicitConversion | SanitizerKind::Nullability |

    SanitizerKind::CFI | SanitizerKind::FloatDivideByZero |

    SanitizerKind::ObjCCast;

static const SanitizerMask NeedsUbsanCxxRt =

    SanitizerKind::Vptr | SanitizerKind::CFI;

static const SanitizerMask NotAllowedWithTrap = SanitizerKind::Vptr;

static const SanitizerMask NotAllowedWithMinimalRuntime = SanitizerKind::Vptr;

static const SanitizerMask NotAllowedWithExecuteOnly =

    SanitizerKind::Function | SanitizerKind::KCFI;

static const SanitizerMask NeedsUnwindTables =

    SanitizerKind::Address | SanitizerKind::HWAddress | SanitizerKind::Thread |

    SanitizerKind::Memory | SanitizerKind::DataFlow;

static const SanitizerMask SupportsCoverage =

    SanitizerKind::Address | SanitizerKind::HWAddress |

    SanitizerKind::KernelAddress | SanitizerKind::KernelHWAddress |

    SanitizerKind::MemtagStack | SanitizerKind::MemtagHeap |

    SanitizerKind::MemtagGlobals | SanitizerKind::Memory |

    SanitizerKind::KernelMemory | SanitizerKind::Leak |

    SanitizerKind::Undefined | SanitizerKind::Integer | SanitizerKind::Bounds |

    SanitizerKind::ImplicitConversion | SanitizerKind::Nullability |

    SanitizerKind::DataFlow | SanitizerKind::Fuzzer |

    SanitizerKind::FuzzerNoLink | SanitizerKind::FloatDivideByZero |

    SanitizerKind::SafeStack | SanitizerKind::ShadowCallStack |

    SanitizerKind::Thread | SanitizerKind::ObjCCast | SanitizerKind::KCFI;

static const SanitizerMask RecoverableByDefault =

    SanitizerKind::Undefined | SanitizerKind::Integer |

    SanitizerKind::ImplicitConversion | SanitizerKind::Nullability |

    SanitizerKind::FloatDivideByZero | SanitizerKind::ObjCCast;

static const SanitizerMask Unrecoverable =

    SanitizerKind::Unreachable | SanitizerKind::Return;

static const SanitizerMask AlwaysRecoverable = SanitizerKind::KernelAddress |

                                               SanitizerKind::KernelHWAddress |

                                               SanitizerKind::KCFI;

static const SanitizerMask NeedsLTO = SanitizerKind::CFI;

static const SanitizerMask TrappingSupported =

    (SanitizerKind::Undefined & ~SanitizerKind::Vptr) | SanitizerKind::Integer |

    SanitizerKind::Nullability | SanitizerKind::LocalBounds |

    SanitizerKind::CFI | SanitizerKind::FloatDivideByZero |

    SanitizerKind::ObjCCast;

static const SanitizerMask TrappingDefault = SanitizerKind::CFI;

static const SanitizerMask CFIClasses =

    SanitizerKind::CFIVCall | SanitizerKind::CFINVCall |

    SanitizerKind::CFIMFCall | SanitizerKind::CFIDerivedCast |

    SanitizerKind::CFIUnrelatedCast;

static const SanitizerMask CompatibleWithMinimalRuntime =

    TrappingSupported | SanitizerKind::Scudo | SanitizerKind::ShadowCallStack |

    SanitizerKind::MemtagStack | SanitizerKind::MemtagHeap |

    SanitizerKind::MemtagGlobals | SanitizerKind::KCFI;

enum CoverageFeature {

  CoverageFunc = 1 << 0,

  CoverageBB = 1 << 1,

  CoverageEdge = 1 << 2,

  CoverageIndirCall = 1 << 3,

  CoverageTraceBB = 1 << 4, // Deprecated.

  CoverageTraceCmp = 1 << 5,

  CoverageTraceDiv = 1 << 6,

  CoverageTraceGep = 1 << 7,

  Coverage8bitCounters = 1 << 8, // Deprecated.

  CoverageTracePC = 1 << 9,

  CoverageTracePCGuard = 1 << 10,

  CoverageNoPrune = 1 << 11,

  CoverageInline8bitCounters = 1 << 12,

  CoveragePCTable = 1 << 13,

  CoverageStackDepth = 1 << 14,

  CoverageInlineBoolFlag = 1 << 15,

  CoverageTraceLoads = 1 << 16,

  CoverageTraceStores = 1 << 17,

  CoverageControlFlow = 1 << 18,

};

enum BinaryMetadataFeature {

  BinaryMetadataCovered = 1 << 0,

  BinaryMetadataAtomics = 1 << 1,

  BinaryMetadataUAR = 1 << 2,

};

/// Parse a -fsanitize= or -fno-sanitize= argument's values, diagnosing any

/// invalid components. Returns a SanitizerMask.

static SanitizerMask parseArgValues(const Driver &D, const llvm::opt::Arg *A,

                                    bool DiagnoseErrors);

/// Parse -f(no-)?sanitize-coverage= flag values, diagnosing any invalid

/// components. Returns OR of members of \c CoverageFeature enumeration.

static int parseCoverageFeatures(const Driver &D, const llvm::opt::Arg *A,

                                 bool DiagnoseErrors);

/// Parse -f(no-)?sanitize-metadata= flag values, diagnosing any invalid

/// components. Returns OR of members of \c BinaryMetadataFeature enumeration.

static int parseBinaryMetadataFeatures(const Driver &D, const llvm::opt::Arg *A,

                                       bool DiagnoseErrors);

/// Produce an argument string from ArgList \p Args, which shows how it

/// provides some sanitizer kind from \p Mask. For example, the argument list

/// "-fsanitize=thread,vptr -fsanitize=address" with mask \c NeedsUbsanRt

/// would produce "-fsanitize=vptr".

static std::string lastArgumentForMask(const Driver &D,

                                       const llvm::opt::ArgList &Args,

                                       SanitizerMask Mask);

/// Produce an argument string from argument \p A, which shows how it provides

/// a value in \p Mask. For instance, the argument

/// "-fsanitize=address,alignment" with mask \c NeedsUbsanRt would produce

/// "-fsanitize=alignment".

static std::string describeSanitizeArg(const llvm::opt::Arg *A,

                                       SanitizerMask Mask);

/// Produce a string containing comma-separated names of sanitizers in \p

/// Sanitizers set.

static std::string toString(const clang::SanitizerSet &Sanitizers);

/// Return true if an execute-only target disallows data access to code

/// sections.

static bool isExecuteOnlyTarget(const llvm::Triple &Triple,

                                const llvm::opt::ArgList &Args) {

  if (Triple.isPS5())

    return true;

  return Args.hasFlagNoClaim(options::OPT_mexecute_only,

                             options::OPT_mno_execute_only, false);

}

static void validateSpecialCaseListFormat(const Driver &D,

                                          std::vector<std::string> &SCLFiles,

                                          unsigned MalformedSCLErrorDiagID,

                                          bool DiagnoseErrors) {

  if (SCLFiles.empty())

    return;

  std::string BLError;

  std::unique_ptr<llvm::SpecialCaseList> SCL(

      llvm::SpecialCaseList::create(SCLFiles, D.getVFS(), BLError));

  if (!SCL.get() && DiagnoseErrors)

    D.Diag(MalformedSCLErrorDiagID) << BLError;

}

static void addDefaultIgnorelists(const Driver &D, SanitizerMask Kinds,

                                  std::vector<std::string> &IgnorelistFiles,

                                  bool DiagnoseErrors) {

  struct Ignorelist {

    const char *File;

    SanitizerMask Mask;

  } Ignorelists[] = {{"asan_ignorelist.txt", SanitizerKind::Address},

                     {"hwasan_ignorelist.txt", SanitizerKind::HWAddress},

                     {"memtag_ignorelist.txt", SanitizerKind::MemTag},

                     {"msan_ignorelist.txt", SanitizerKind::Memory},

                     {"tsan_ignorelist.txt", SanitizerKind::Thread},

                     {"dfsan_abilist.txt", SanitizerKind::DataFlow},

                     {"cfi_ignorelist.txt", SanitizerKind::CFI},

                     {"ubsan_ignorelist.txt",

                      SanitizerKind::Undefined | SanitizerKind::Integer |

                          SanitizerKind::Nullability |

                          SanitizerKind::FloatDivideByZero}};

  for (auto BL : Ignorelists) {

    if (!(Kinds & BL.Mask))

      continue;

    clang::SmallString<64> Path(D.ResourceDir);

    llvm::sys::path::append(Path, "share", BL.File);

    if (D.getVFS().exists(Path))

      IgnorelistFiles.push_back(std::string(Path.str()));

    else if (BL.Mask == SanitizerKind::CFI && DiagnoseErrors)

      // If cfi_ignorelist.txt cannot be found in the resource dir, driver

      // should fail.

      D.Diag(clang::diag::err_drv_missing_sanitizer_ignorelist) << Path;

  }

  validateSpecialCaseListFormat(

      D, IgnorelistFiles, clang::diag::err_drv_malformed_sanitizer_ignorelist,

      DiagnoseErrors);

}

/// Parse -f(no-)?sanitize-(coverage-)?(allow|ignore)list argument's values,

/// diagnosing any invalid file paths and validating special case list format.

static void parseSpecialCaseListArg(const Driver &D,

                                    const llvm::opt::ArgList &Args,

                                    std::vector<std::string> &SCLFiles,

                                    llvm::opt::OptSpecifier SCLOptionID,

                                    llvm::opt::OptSpecifier NoSCLOptionID,

                                    unsigned MalformedSCLErrorDiagID,

                                    bool DiagnoseErrors) {

  for (const auto *Arg : Args) {

    // Match -fsanitize-(coverage-)?(allow|ignore)list.

    if (Arg->getOption().matches(SCLOptionID)) {

      Arg->claim();

      std::string SCLPath = Arg->getValue();

      if (D.getVFS().exists(SCLPath)) {

        SCLFiles.push_back(SCLPath);

      } else if (DiagnoseErrors) {

        D.Diag(clang::diag::err_drv_no_such_file) << SCLPath;

      }

      // Match -fno-sanitize-ignorelist.

    } else if (Arg->getOption().matches(NoSCLOptionID)) {

      Arg->claim();

      SCLFiles.clear();

    }

  }

  validateSpecialCaseListFormat(D, SCLFiles, MalformedSCLErrorDiagID,

                                DiagnoseErrors);

}

/// Sets group bits for every group that has at least one representative already

/// enabled in \p Kinds.

static SanitizerMask setGroupBits(SanitizerMask Kinds) {

#define SANITIZER(NAME, ID)

#define SANITIZER_GROUP(NAME, ID, ALIAS)                                       \

  if (Kinds & SanitizerKind::ID)                                               \

    Kinds |= SanitizerKind::ID##Group;

#include "clang/Basic/Sanitizers.def"

  return Kinds;

}

static SanitizerMask parseSanitizeTrapArgs(const Driver &D,

                                           const llvm::opt::ArgList &Args,

                                           bool DiagnoseErrors) {

  SanitizerMask TrapRemove; // During the loop below, the accumulated set of

                            // sanitizers disabled by the current sanitizer

                            // argument or any argument after it.

  SanitizerMask TrappingKinds;

  SanitizerMask TrappingSupportedWithGroups = setGroupBits(TrappingSupported);

  for (const llvm::opt::Arg *Arg : llvm::reverse(Args)) {

    if (Arg->getOption().matches(options::OPT_fsanitize_trap_EQ)) {

      Arg->claim();

      SanitizerMask Add = parseArgValues(D, Arg, true);

      Add &= ~TrapRemove;

      SanitizerMask InvalidValues = Add & ~TrappingSupportedWithGroups;

      if (InvalidValues && DiagnoseErrors) {

        SanitizerSet S;

        S.Mask = InvalidValues;

        D.Diag(diag::err_drv_unsupported_option_argument)

            << Arg->getSpelling() << toString(S);

      }

      TrappingKinds |= expandSanitizerGroups(Add) & ~TrapRemove;

    } else if (Arg->getOption().matches(options::OPT_fno_sanitize_trap_EQ)) {

      Arg->claim();

      TrapRemove |=

          expandSanitizerGroups(parseArgValues(D, Arg, DiagnoseErrors));

    }

  }

  // Apply default trapping behavior.

  TrappingKinds |= TrappingDefault & ~TrapRemove;

  return TrappingKinds;

}

bool SanitizerArgs::needsFuzzerInterceptors() const {

  return needsFuzzer() && !needsAsanRt() && !needsTsanRt() && !needsMsanRt();

}

bool SanitizerArgs::needsUbsanRt() const {

  // All of these include ubsan.

  if (needsAsanRt() || needsMsanRt() || needsHwasanRt() || needsTsanRt() ||

      needsDfsanRt() || needsLsanRt() || needsCfiDiagRt() ||

      (needsScudoRt() && !requiresMinimalRuntime()))

    return false;

  return (Sanitizers.Mask & NeedsUbsanRt & ~TrapSanitizers.Mask) ||

         CoverageFeatures;

}

bool SanitizerArgs::needsCfiRt() const {

  return !(Sanitizers.Mask & SanitizerKind::CFI & ~TrapSanitizers.Mask) &&

         CfiCrossDso && !ImplicitCfiRuntime;

}

bool SanitizerArgs::needsCfiDiagRt() const {

  return (Sanitizers.Mask & SanitizerKind::CFI & ~TrapSanitizers.Mask) &&

         CfiCrossDso && !ImplicitCfiRuntime;

}

bool SanitizerArgs::requiresPIE() const { return NeedPIE; }

bool SanitizerArgs::needsUnwindTables() const {

  return static_cast<bool>(Sanitizers.Mask & NeedsUnwindTables);

}

bool SanitizerArgs::needsLTO() const {

  return static_cast<bool>(Sanitizers.Mask & NeedsLTO);

}

SanitizerArgs::SanitizerArgs(const ToolChain &TC,

                             const llvm::opt::ArgList &Args,

                             bool DiagnoseErrors) {

  SanitizerMask AllRemove;      // During the loop below, the accumulated set of

                                // sanitizers disabled by the current sanitizer

                                // argument or any argument after it.

  SanitizerMask AllAddedKinds;  // Mask of all sanitizers ever enabled by

                                // -fsanitize= flags (directly or via group

                                // expansion), some of which may be disabled

                                // later. Used to carefully prune

                                // unused-argument diagnostics.

  SanitizerMask DiagnosedKinds; // All Kinds we have diagnosed up to now.

                                // Used to deduplicate diagnostics.

  SanitizerMask Kinds;

  const SanitizerMask Supported = setGroupBits(TC.getSupportedSanitizers());

  CfiCrossDso = Args.hasFlag(options::OPT_fsanitize_cfi_cross_dso,

                             options::OPT_fno_sanitize_cfi_cross_dso, false);

  ToolChain::RTTIMode RTTIMode = TC.getRTTIMode();

  const Driver &D = TC.getDriver();

  SanitizerMask TrappingKinds = parseSanitizeTrapArgs(D, Args, DiagnoseErrors);

  SanitizerMask InvalidTrappingKinds = TrappingKinds & NotAllowedWithTrap;

  MinimalRuntime =

      Args.hasFlag(options::OPT_fsanitize_minimal_runtime,

                   options::OPT_fno_sanitize_minimal_runtime, MinimalRuntime);

  // The object size sanitizer should not be enabled at -O0.

  Arg *OptLevel = Args.getLastArg(options::OPT_O_Group);

  bool RemoveObjectSizeAtO0 =

      !OptLevel || OptLevel->getOption().matches(options::OPT_O0);

  for (const llvm::opt::Arg *Arg : llvm::reverse(Args)) {

    if (Arg->getOption().matches(options::OPT_fsanitize_EQ)) {

      Arg->claim();

      SanitizerMask Add = parseArgValues(D, Arg, DiagnoseErrors);

      if (RemoveObjectSizeAtO0) {

        AllRemove |= SanitizerKind::ObjectSize;

        // The user explicitly enabled the object size sanitizer. Warn

        // that this does nothing at -O0.

        if ((Add & SanitizerKind::ObjectSize) && DiagnoseErrors)

          D.Diag(diag::warn_drv_object_size_disabled_O0)

              << Arg->getAsString(Args);

      }

      AllAddedKinds |= expandSanitizerGroups(Add);

      // Avoid diagnosing any sanitizer which is disabled later.

      Add &= ~AllRemove;

      // At this point we have not expanded groups, so any unsupported

      // sanitizers in Add are those which have been explicitly enabled.

      // Diagnose them.

      if (SanitizerMask KindsToDiagnose =

              Add & InvalidTrappingKinds & ~DiagnosedKinds) {

        if (DiagnoseErrors) {

          std::string Desc = describeSanitizeArg(Arg, KindsToDiagnose);

          D.Diag(diag::err_drv_argument_not_allowed_with)

              << Desc << "-fsanitize-trap=undefined";

        }

        DiagnosedKinds |= KindsToDiagnose;

      }

      Add &= ~InvalidTrappingKinds;

      if (MinimalRuntime) {

        if (SanitizerMask KindsToDiagnose =

                Add & NotAllowedWithMinimalRuntime & ~DiagnosedKinds) {

          if (DiagnoseErrors) {

            std::string Desc = describeSanitizeArg(Arg, KindsToDiagnose);

            D.Diag(diag::err_drv_argument_not_allowed_with)

                << Desc << "-fsanitize-minimal-runtime";

          }

          DiagnosedKinds |= KindsToDiagnose;

        }

        Add &= ~NotAllowedWithMinimalRuntime;

      }

      if (llvm::opt::Arg *A = Args.getLastArg(options::OPT_mcmodel_EQ)) {

        StringRef CM = A->getValue();

        if (CM != "small" &&

            (Add & SanitizerKind::Function & ~DiagnosedKinds)) {

          if (DiagnoseErrors)

            D.Diag(diag::err_drv_argument_only_allowed_with)

                << "-fsanitize=function"

                << "-mcmodel=small";

          Add &= ~SanitizerKind::Function;

          DiagnosedKinds |= SanitizerKind::Function;

        }

      }

      // -fsanitize=function and -fsanitize=kcfi instrument indirect function

      // calls to load a type hash before the function label. Therefore, an

      // execute-only target doesn't support the function and kcfi sanitizers.

      const llvm::Triple &Triple = TC.getTriple();

      if (isExecuteOnlyTarget(Triple, Args)) {

        if (SanitizerMask KindsToDiagnose =

                Add & NotAllowedWithExecuteOnly & ~DiagnosedKinds) {

          if (DiagnoseErrors) {

            std::string Desc = describeSanitizeArg(Arg, KindsToDiagnose);

            D.Diag(diag::err_drv_argument_not_allowed_with)

                << Desc << Triple.str();

          }

          DiagnosedKinds |= KindsToDiagnose;

        }

        Add &= ~NotAllowedWithExecuteOnly;

      }

      // FIXME: Make CFI on member function calls compatible with cross-DSO CFI.

      // There are currently two problems:

      // - Virtual function call checks need to pass a pointer to the function

      //   address to llvm.type.test and a pointer to the address point to the

      //   diagnostic function. Currently we pass the same pointer to both

      //   places.

      // - Non-virtual function call checks may need to check multiple type

      //   identifiers.

      // Fixing both of those may require changes to the cross-DSO CFI

      // interface.

      if (CfiCrossDso && (Add & SanitizerKind::CFIMFCall & ~DiagnosedKinds)) {

        if (DiagnoseErrors)

          D.Diag(diag::err_drv_argument_not_allowed_with)

              << "-fsanitize=cfi-mfcall"

              << "-fsanitize-cfi-cross-dso";

        Add &= ~SanitizerKind::CFIMFCall;

        DiagnosedKinds |= SanitizerKind::CFIMFCall;

      }

      if (SanitizerMask KindsToDiagnose = Add & ~Supported & ~DiagnosedKinds) {

        if (DiagnoseErrors) {

          std::string Desc = describeSanitizeArg(Arg, KindsToDiagnose);

          D.Diag(diag::err_drv_unsupported_opt_for_target)

              << Desc << TC.getTriple().str();

        }

        DiagnosedKinds |= KindsToDiagnose;

      }

      Add &= Supported;

      // Test for -fno-rtti + explicit -fsanitizer=vptr before expanding groups

      // so we don't error out if -fno-rtti and -fsanitize=undefined were

      // passed.

      if ((Add & SanitizerKind::Vptr) && (RTTIMode == ToolChain::RM_Disabled)) {

        if (const llvm::opt::Arg *NoRTTIArg = TC.getRTTIArg()) {

          assert(NoRTTIArg->getOption().matches(options::OPT_fno_rtti) &&

                 "RTTI disabled without -fno-rtti option?");

          // The user explicitly passed -fno-rtti with -fsanitize=vptr, but

          // the vptr sanitizer requires RTTI, so this is a user error.

          if (DiagnoseErrors)

            D.Diag(diag::err_drv_argument_not_allowed_with)

                << "-fsanitize=vptr" << NoRTTIArg->getAsString(Args);

        } else {

          // The vptr sanitizer requires RTTI, but RTTI is disabled (by

          // default). Warn that the vptr sanitizer is being disabled.

          if (DiagnoseErrors)

            D.Diag(diag::warn_drv_disabling_vptr_no_rtti_default);

        }

        // Take out the Vptr sanitizer from the enabled sanitizers

        AllRemove |= SanitizerKind::Vptr;

      }

      Add = expandSanitizerGroups(Add);

      // Group expansion may have enabled a sanitizer which is disabled later.

      Add &= ~AllRemove;

      // Silently discard any unsupported sanitizers implicitly enabled through

      // group expansion.

      Add &= ~InvalidTrappingKinds;

      if (MinimalRuntime) {

        Add &= ~NotAllowedWithMinimalRuntime;

      }

      // NotAllowedWithExecuteOnly is silently discarded on an execute-only

      // target if implicitly enabled through group expansion.

      if (isExecuteOnlyTarget(Triple, Args))

        Add &= ~NotAllowedWithExecuteOnly;

      if (CfiCrossDso)

        Add &= ~SanitizerKind::CFIMFCall;

      Add &= Supported;

      if (Add & SanitizerKind::Fuzzer)

        Add |= SanitizerKind::FuzzerNoLink;

      // Enable coverage if the fuzzing flag is set.

      if (Add & SanitizerKind::FuzzerNoLink) {

        CoverageFeatures |= CoverageInline8bitCounters | CoverageIndirCall |

                            CoverageTraceCmp | CoveragePCTable;

        // Due to TLS differences, stack depth tracking is only enabled on Linux

        if (TC.getTriple().isOSLinux())

          CoverageFeatures |= CoverageStackDepth;

      }

      Kinds |= Add;

    } else if (Arg->getOption().matches(options::OPT_fno_sanitize_EQ)) {

      Arg->claim();

      SanitizerMask Remove = parseArgValues(D, Arg, DiagnoseErrors);

      AllRemove |= expandSanitizerGroups(Remove);

    }

  }

  std::pair<SanitizerMask, SanitizerMask> IncompatibleGroups[] = {

      std::make_pair(SanitizerKind::Address,

                     SanitizerKind::Thread | SanitizerKind::Memory),

      std::make_pair(SanitizerKind::Thread, SanitizerKind::Memory),

      std::make_pair(SanitizerKind::Leak,

                     SanitizerKind::Thread | SanitizerKind::Memory),

      std::make_pair(SanitizerKind::KernelAddress,

                     SanitizerKind::Address | SanitizerKind::Leak |

                         SanitizerKind::Thread | SanitizerKind::Memory),

      std::make_pair(SanitizerKind::HWAddress,

                     SanitizerKind::Address | SanitizerKind::Thread |

                         SanitizerKind::Memory | SanitizerKind::KernelAddress),

      std::make_pair(SanitizerKind::Scudo,

                     SanitizerKind::Address | SanitizerKind::HWAddress |

                         SanitizerKind::Leak | SanitizerKind::Thread |

                         SanitizerKind::Memory | SanitizerKind::KernelAddress),

      std::make_pair(SanitizerKind::SafeStack,

                     (TC.getTriple().isOSFuchsia() ? SanitizerMask()

                                                   : SanitizerKind::Leak) |

                         SanitizerKind::Address | SanitizerKind::HWAddress |

                         SanitizerKind::Thread | SanitizerKind::Memory |

                         SanitizerKind::KernelAddress),

      std::make_pair(SanitizerKind::KernelHWAddress,

                     SanitizerKind::Address | SanitizerKind::HWAddress |

                         SanitizerKind::Leak | SanitizerKind::Thread |

                         SanitizerKind::Memory | SanitizerKind::KernelAddress |

                         SanitizerKind::SafeStack),

      std::make_pair(SanitizerKind::KernelMemory,

                     SanitizerKind::Address | SanitizerKind::HWAddress |

                         SanitizerKind::Leak | SanitizerKind::Thread |

                         SanitizerKind::Memory | SanitizerKind::KernelAddress |

                         SanitizerKind::Scudo | SanitizerKind::SafeStack),

      std::make_pair(SanitizerKind::MemTag,

                     SanitizerKind::Address | SanitizerKind::KernelAddress |

                         SanitizerKind::HWAddress |

                         SanitizerKind::KernelHWAddress),

      std::make_pair(SanitizerKind::KCFI, SanitizerKind::Function)};

  // Enable toolchain specific default sanitizers if not explicitly disabled.

  SanitizerMask Default = TC.getDefaultSanitizers() & ~AllRemove;

  // Disable default sanitizers that are incompatible with explicitly requested

  // ones.

  for (auto G : IncompatibleGroups) {

    SanitizerMask Group = G.first;

    if ((Default & Group) && (Kinds & G.second))

      Default &= ~Group;

  }

  Kinds |= Default;

  // We disable the vptr sanitizer if it was enabled by group expansion but RTTI

  // is disabled.

  if ((Kinds & SanitizerKind::Vptr) && (RTTIMode == ToolChain::RM_Disabled)) {

    Kinds &= ~SanitizerKind::Vptr;

  }

  // Check that LTO is enabled if we need it.

  if ((Kinds & NeedsLTO) && !D.isUsingLTO() && DiagnoseErrors) {

    D.Diag(diag::err_drv_argument_only_allowed_with)

        << lastArgumentForMask(D, Args, Kinds & NeedsLTO) << "-flto";

  }

  if ((Kinds & SanitizerKind::ShadowCallStack) && TC.getTriple().isAArch64() &&

      !llvm::AArch64::isX18ReservedByDefault(TC.getTriple()) &&

      !Args.hasArg(options::OPT_ffixed_x18) && DiagnoseErrors) {

    D.Diag(diag::err_drv_argument_only_allowed_with)

        << lastArgumentForMask(D, Args, Kinds & SanitizerKind::ShadowCallStack)

        << "-ffixed-x18";

  }

  // Report error if there are non-trapping sanitizers that require

  // c++abi-specific  parts of UBSan runtime, and they are not provided by the

  // toolchain. We don't have a good way to check the latter, so we just

  // check if the toolchan supports vptr.

  if (~Supported & SanitizerKind::Vptr) {

    SanitizerMask KindsToDiagnose = Kinds & ~TrappingKinds & NeedsUbsanCxxRt;

    // The runtime library supports the Microsoft C++ ABI, but only well enough

    // for CFI. FIXME: Remove this once we support vptr on Windows.

    if (TC.getTriple().isOSWindows())

      KindsToDiagnose &= ~SanitizerKind::CFI;

    if (KindsToDiagnose) {

      SanitizerSet S;

      S.Mask = KindsToDiagnose;

      if (DiagnoseErrors)

        D.Diag(diag::err_drv_unsupported_opt_for_target)

            << ("-fno-sanitize-trap=" + toString(S)) << TC.getTriple().str();

      Kinds &= ~KindsToDiagnose;

    }

  }

  // Warn about incompatible groups of sanitizers.

  for (auto G : IncompatibleGroups) {

    SanitizerMask Group = G.first;

    if (Kinds & Group) {

      if (SanitizerMask Incompatible = Kinds & G.second) {

        if (DiagnoseErrors)

          D.Diag(clang::diag::err_drv_argument_not_allowed_with)

              << lastArgumentForMask(D, Args, Group)

              << lastArgumentForMask(D, Args, Incompatible);

        Kinds &= ~Incompatible;

      }

    }

  }

  // FIXME: Currently -fsanitize=leak is silently ignored in the presence of

  // -fsanitize=address. Perhaps it should print an error, or perhaps

  // -f(-no)sanitize=leak should change whether leak detection is enabled by

  // default in ASan?

  // Parse -f(no-)?sanitize-recover flags.

  SanitizerMask RecoverableKinds = RecoverableByDefault | AlwaysRecoverable;

  SanitizerMask DiagnosedUnrecoverableKinds;

  SanitizerMask DiagnosedAlwaysRecoverableKinds;

  for (const auto *Arg : Args) {

    if (Arg->getOption().matches(options::OPT_fsanitize_recover_EQ)) {

      SanitizerMask Add = parseArgValues(D, Arg, DiagnoseErrors);

      // Report error if user explicitly tries to recover from unrecoverable

      // sanitizer.

      if (SanitizerMask KindsToDiagnose =

              Add & Unrecoverable & ~DiagnosedUnrecoverableKinds) {

        SanitizerSet SetToDiagnose;

        SetToDiagnose.Mask |= KindsToDiagnose;

        if (DiagnoseErrors)

          D.Diag(diag::err_drv_unsupported_option_argument)

              << Arg->getSpelling() << toString(SetToDiagnose);

        DiagnosedUnrecoverableKinds |= KindsToDiagnose;

      }

      RecoverableKinds |= expandSanitizerGroups(Add);

      Arg->claim();

    } else if (Arg->getOption().matches(options::OPT_fno_sanitize_recover_EQ)) {

      SanitizerMask Remove = parseArgValues(D, Arg, DiagnoseErrors);

      // Report error if user explicitly tries to disable recovery from

      // always recoverable sanitizer.

      if (SanitizerMask KindsToDiagnose =

              Remove & AlwaysRecoverable & ~DiagnosedAlwaysRecoverableKinds) {

        SanitizerSet SetToDiagnose;

        SetToDiagnose.Mask |= KindsToDiagnose;

        if (DiagnoseErrors)

          D.Diag(diag::err_drv_unsupported_option_argument)

              << Arg->getSpelling() << toString(SetToDiagnose);

        DiagnosedAlwaysRecoverableKinds |= KindsToDiagnose;

      }

      RecoverableKinds &= ~expandSanitizerGroups(Remove);

      Arg->claim();

    }

  }

  RecoverableKinds &= Kinds;

  RecoverableKinds &= ~Unrecoverable;

  TrappingKinds &= Kinds;

  RecoverableKinds &= ~TrappingKinds;

  // Setup ignorelist files.

  // Add default ignorelist from resource directory for activated sanitizers,

  // and validate special case lists format.

  if (!Args.hasArgNoClaim(options::OPT_fno_sanitize_ignorelist))

    addDefaultIgnorelists(D, Kinds, SystemIgnorelistFiles, DiagnoseErrors);

  // Parse -f(no-)?sanitize-ignorelist options.

  // This also validates special case lists format.

  parseSpecialCaseListArg(

      D, Args, UserIgnorelistFiles, options::OPT_fsanitize_ignorelist_EQ,

      options::OPT_fno_sanitize_ignorelist,

      clang::diag::err_drv_malformed_sanitizer_ignorelist, DiagnoseErrors);

  // Parse -f[no-]sanitize-memory-track-origins[=level] options.

  if (AllAddedKinds & SanitizerKind::Memory) {

    if (Arg *A =

            Args.getLastArg(options::OPT_fsanitize_memory_track_origins_EQ,

                            options::OPT_fno_sanitize_memory_track_origins)) {

      if (!A->getOption().matches(

              options::OPT_fno_sanitize_memory_track_origins)) {

        StringRef S = A->getValue();

        if (S.getAsInteger(0, MsanTrackOrigins) || MsanTrackOrigins < 0 ||

            MsanTrackOrigins > 2) {

          if (DiagnoseErrors)

            D.Diag(clang::diag::err_drv_invalid_value)

                << A->getAsString(Args) << S;

        }

      }

    }

    MsanUseAfterDtor = Args.hasFlag(

        options::OPT_fsanitize_memory_use_after_dtor,

        options::OPT_fno_sanitize_memory_use_after_dtor, MsanUseAfterDtor);

    MsanParamRetval = Args.hasFlag(

        options::OPT_fsanitize_memory_param_retval,

        options::OPT_fno_sanitize_memory_param_retval, MsanParamRetval);

  } else if (AllAddedKinds & SanitizerKind::KernelMemory) {

    MsanUseAfterDtor = false;

    MsanParamRetval = Args.hasFlag(

        options::OPT_fsanitize_memory_param_retval,

        options::OPT_fno_sanitize_memory_param_retval, MsanParamRetval);

  } else {

    MsanUseAfterDtor = false;

    MsanParamRetval = false;

  }

  if (AllAddedKinds & SanitizerKind::MemTag) {

    StringRef S =

        Args.getLastArgValue(options::OPT_fsanitize_memtag_mode_EQ, "sync");

    if (S == "async" || S == "sync") {

      MemtagMode = S.str();

    } else {

      D.Diag(clang::diag::err_drv_invalid_value_with_suggestion)

          << "-fsanitize-memtag-mode=" << S << "{async, sync}";

      MemtagMode = "sync";

    }

  }

  if (AllAddedKinds & SanitizerKind::Thread) {

    TsanMemoryAccess = Args.hasFlag(

        options::OPT_fsanitize_thread_memory_access,

        options::OPT_fno_sanitize_thread_memory_access, TsanMemoryAccess);

    TsanFuncEntryExit = Args.hasFlag(

        options::OPT_fsanitize_thread_func_entry_exit,

        options::OPT_fno_sanitize_thread_func_entry_exit, TsanFuncEntryExit);

    TsanAtomics =

        Args.hasFlag(options::OPT_fsanitize_thread_atomics,

                     options::OPT_fno_sanitize_thread_atomics, TsanAtomics);

  }

  if (AllAddedKinds & SanitizerKind::CFI) {

    // Without PIE, external function address may resolve to a PLT record, which

    // can not be verified by the target module.

    NeedPIE |= CfiCrossDso;

    CfiICallGeneralizePointers =

        Args.hasArg(options::OPT_fsanitize_cfi_icall_generalize_pointers);

    CfiICallNormalizeIntegers =

        Args.hasArg(options::OPT_fsanitize_cfi_icall_normalize_integers);

    if (CfiCrossDso && CfiICallGeneralizePointers && DiagnoseErrors)

      D.Diag(diag::err_drv_argument_not_allowed_with)

          << "-fsanitize-cfi-cross-dso"

          << "-fsanitize-cfi-icall-generalize-pointers";

    CfiCanonicalJumpTables =

        Args.hasFlag(options::OPT_fsanitize_cfi_canonical_jump_tables,

                     options::OPT_fno_sanitize_cfi_canonical_jump_tables, true);

  }

  if (AllAddedKinds & SanitizerKind::KCFI) {

    CfiICallNormalizeIntegers =

        Args.hasArg(options::OPT_fsanitize_cfi_icall_normalize_integers);

    if (AllAddedKinds & SanitizerKind::CFI && DiagnoseErrors)

      D.Diag(diag::err_drv_argument_not_allowed_with)

          << "-fsanitize=kcfi"

          << lastArgumentForMask(D, Args, SanitizerKind::CFI);

  }

  Stats = Args.hasFlag(options::OPT_fsanitize_stats,

                       options::OPT_fno_sanitize_stats, false);

  if (MinimalRuntime) {

    SanitizerMask IncompatibleMask =

        Kinds & ~setGroupBits(CompatibleWithMinimalRuntime);

    if (IncompatibleMask && DiagnoseErrors)

      D.Diag(clang::diag::err_drv_argument_not_allowed_with)

          << "-fsanitize-minimal-runtime"

          << lastArgumentForMask(D, Args, IncompatibleMask);

    SanitizerMask NonTrappingCfi = Kinds & SanitizerKind::CFI & ~TrappingKinds;

    if (NonTrappingCfi && DiagnoseErrors)

      D.Diag(clang::diag::err_drv_argument_only_allowed_with)

          << "fsanitize-minimal-runtime"

          << "fsanitize-trap=cfi";

  }

  // Parse -f(no-)?sanitize-coverage flags if coverage is supported by the

  // enabled sanitizers.

  for (const auto *Arg : Args) {

    if (Arg->getOption().matches(options::OPT_fsanitize_coverage)) {

      int LegacySanitizeCoverage;

      if (Arg->getNumValues() == 1 &&

          !StringRef(Arg->getValue(0))

               .getAsInteger(0, LegacySanitizeCoverage)) {

        CoverageFeatures = 0;

        Arg->claim();

        if (LegacySanitizeCoverage != 0 && DiagnoseErrors) {

          D.Diag(diag::warn_drv_deprecated_arg)

              << Arg->getAsString(Args) << "-fsanitize-coverage=trace-pc-guard";

        }

        continue;

      }

      CoverageFeatures |= parseCoverageFeatures(D, Arg, DiagnoseErrors);

      // Disable coverage and not claim the flags if there is at least one

      // non-supporting sanitizer.

      if (!(AllAddedKinds & ~AllRemove & ~setGroupBits(SupportsCoverage))) {

        Arg->claim();

      } else {

        CoverageFeatures = 0;

      }

    } else if (Arg->getOption().matches(options::OPT_fno_sanitize_coverage)) {

      Arg->claim();

      CoverageFeatures &= ~parseCoverageFeatures(D, Arg, DiagnoseErrors);

    }

  }

  // Choose at most one coverage type: function, bb, or edge.

  if (DiagnoseErrors) {

    if ((CoverageFeatures & CoverageFunc) && (CoverageFeatures & CoverageBB))

      D.Diag(clang::diag::err_drv_argument_not_allowed_with)

          << "-fsanitize-coverage=func"

          << "-fsanitize-coverage=bb";

    if ((CoverageFeatures & CoverageFunc) && (CoverageFeatures & CoverageEdge))

      D.Diag(clang::diag::err_drv_argument_not_allowed_with)

          << "-fsanitize-coverage=func"

          << "-fsanitize-coverage=edge";

    if ((CoverageFeatures & CoverageBB) && (CoverageFeatures & CoverageEdge))

      D.Diag(clang::diag::err_drv_argument_not_allowed_with)

          << "-fsanitize-coverage=bb"

          << "-fsanitize-coverage=edge";

    // Basic block tracing and 8-bit counters require some type of coverage

    // enabled.

    if (CoverageFeatures & CoverageTraceBB)

      D.Diag(clang::diag::warn_drv_deprecated_arg)

          << "-fsanitize-coverage=trace-bb"

          << "-fsanitize-coverage=trace-pc-guard";

    if (CoverageFeatures & Coverage8bitCounters)

      D.Diag(clang::diag::warn_drv_deprecated_arg)

          << "-fsanitize-coverage=8bit-counters"

          << "-fsanitize-coverage=trace-pc-guard";

  }

  int InsertionPointTypes = CoverageFunc | CoverageBB | CoverageEdge;

  int InstrumentationTypes = CoverageTracePC | CoverageTracePCGuard |

                             CoverageInline8bitCounters | CoverageTraceLoads |

                             CoverageTraceStores | CoverageInlineBoolFlag |

                             CoverageControlFlow;

  if ((CoverageFeatures & InsertionPointTypes) &&

      !(CoverageFeatures & InstrumentationTypes) && DiagnoseErrors) {

    D.Diag(clang::diag::warn_drv_deprecated_arg)

        << "-fsanitize-coverage=[func|bb|edge]"

        << "-fsanitize-coverage=[func|bb|edge],[trace-pc-guard|trace-pc],["

           "control-flow]";

  }

  // trace-pc w/o func/bb/edge implies edge.

  if (!(CoverageFeatures & InsertionPointTypes)) {

    if (CoverageFeatures &

        (CoverageTracePC | CoverageTracePCGuard | CoverageInline8bitCounters |

         CoverageInlineBoolFlag | CoverageControlFlow))

      CoverageFeatures |= CoverageEdge;

    if (CoverageFeatures & CoverageStackDepth)

      CoverageFeatures |= CoverageFunc;

  }

  // Parse -fsanitize-coverage-(allow|ignore)list options if coverage enabled.

  // This also validates special case lists format.

  // Here, OptSpecifier() acts as a never-matching command-line argument.

  // So, there is no way to clear coverage lists but you can append to them.

  if (CoverageFeatures) {

    parseSpecialCaseListArg(

        D, Args, CoverageAllowlistFiles,

        options::OPT_fsanitize_coverage_allowlist, OptSpecifier(),

        clang::diag::err_drv_malformed_sanitizer_coverage_allowlist,

        DiagnoseErrors);

    parseSpecialCaseListArg(

        D, Args, CoverageIgnorelistFiles,

        options::OPT_fsanitize_coverage_ignorelist, OptSpecifier(),

        clang::diag::err_drv_malformed_sanitizer_coverage_ignorelist,

        DiagnoseErrors);

  }

  // Parse -f(no-)?sanitize-metadata.

  for (const auto *Arg :

       Args.filtered(options::OPT_fexperimental_sanitize_metadata_EQ,

                     options::OPT_fno_experimental_sanitize_metadata_EQ)) {

    if (Arg->getOption().matches(

            options::OPT_fexperimental_sanitize_metadata_EQ)) {

      Arg->claim();

      BinaryMetadataFeatures |=

          parseBinaryMetadataFeatures(D, Arg, DiagnoseErrors);

    } else {

      Arg->claim();

      BinaryMetadataFeatures &=

          ~parseBinaryMetadataFeatures(D, Arg, DiagnoseErrors);

    }

  }

  // Parse -fsanitize-metadata-ignorelist option if enabled.

  if (BinaryMetadataFeatures) {

    parseSpecialCaseListArg(

        D, Args, BinaryMetadataIgnorelistFiles,

        options::OPT_fexperimental_sanitize_metadata_ignorelist_EQ,

        OptSpecifier(), // Cannot clear ignore list, only append.