• Home
  • Line#
  • Scopes#
  • Navigate#
  • Raw
  • Download
1# Copyright 2014 The Chromium Authors. All rights reserved.
2# Use of this source code is governed by a BSD-style license that can be
3# found in the LICENSE file.
4
5import("//build/config/clang/clang.gni")
6import("//build/config/ohos/config.gni")
7import("//build/config/sanitizers/sanitizers.gni")
8import("//build/misc/overrides/build.gni")
9import("//build/ohos_var.gni")
10import("//build/toolchain/toolchain.gni")
11
12# Contains the dependencies needed for sanitizers to link into executables and
13# shared_libraries.
14group("deps") {
15  if (using_sanitizer && !is_mingw) {
16    public_configs = [
17      ":sanitizer_options_link_helper",
18
19      # Even when a target removes default_sanitizer_flags, it may be depending
20      # on a library that did not remove default_sanitizer_flags. Thus, we need
21      # to add the ldflags here as well as in default_sanitizer_flags.
22      ":default_sanitizer_ldflags",
23    ]
24    if (use_musl) {
25      public_configs -= [ ":sanitizer_options_link_helper" ]
26      public_configs -= [ ":default_sanitizer_ldflags" ]
27    }
28    deps = [ ":options_sources" ]
29    if (is_win) {
30      exe = ".exe"
31    } else {
32      exe = ""
33    }
34    data = [
35      "//tools/valgrind/asan/",
36      "$clang_base_path/bin/llvm-symbolizer${exe}",
37    ]
38    if (use_prebuilt_instrumented_libraries ||
39        use_locally_built_instrumented_libraries) {
40      deps += [ "//third_party/instrumented_libraries:deps" ]
41    }
42
43    # ASAN is supported on iOS but the runtime library depends on the compiler
44    # used (Chromium version of clang versus Xcode version of clang). Only copy
45    # the ASAN runtime on iOS if building with Chromium clang.
46    if (is_win || is_mac || !use_xcode_clang) {
47      data_deps = [ ":copy_asan_runtime" ]
48    }
49    if (is_mac || !use_xcode_clang) {
50      public_deps = [ ":asan_runtime_bundle_data" ]
51    }
52  }
53}
54
55if ((is_mac || is_win || !use_xcode_clang || is_ohos) && using_sanitizer) {
56  if (is_mac) {
57    _clang_rt_dso_path = "darwin/libclang_rt.asan_osx_dynamic.dylib"
58  } else if (is_win && target_cpu == "x86") {
59    _clang_rt_dso_path = "windows/clang_rt.asan_dynamic-i386.dll"
60  } else if (is_win && target_cpu == "x64") {
61    _clang_rt_dso_path = "windows/clang_rt.asan_dynamic-x86_64.dll"
62  } else if (is_ohos) {
63    if (target_cpu == "arm64") {
64      if (use_hwasan) {
65        _clang_rt_dso_path = "aarch64-linux-ohos/libclang_rt.hwasan.so"
66      } else {
67        _clang_rt_dso_path = "aarch64-linux-ohos/libclang_rt.asan.so"
68      }
69    } else if (target_cpu == "arm") {
70      _clang_rt_dso_path = "arm-linux-ohos/libclang_rt.asan.so"
71    } else if (target_cpu == "x86_64") {
72      _clang_rt_dso_path = "x86_64-linux-ohos/libclang_rt.asan.so"
73    } else if (target_cpu == "riscv64") {
74      _clang_rt_dso_path = "riscv64-linux-ohos/libclang_rt.asan.so"
75    } else if (target_cpu == "loongarch64") {
76      _clang_rt_dso_path = "loongarch64-linux-ohos/libclang_rt.asan.so"
77    }
78  }
79
80  if (is_tsan && target_cpu == "arm64" && current_os == "ohos" && !is_mingw &&
81      !is_win) {
82    _clang_rt_dso_path = "aarch64-linux-ohos/libclang_rt.tsan.so"
83  }
84
85  _clang_rt_dso_full_path =
86      "$clang_base_path/lib/clang/$clang_version/lib/$_clang_rt_dso_path"
87
88  copy("copy_asan_runtime") {
89    sources = [ _clang_rt_dso_full_path ]
90    outputs = [ "$root_out_dir/{{source_file_part}}" ]
91  }
92
93  if (is_mac || !use_xcode_clang) {
94    bundle_data("asan_runtime_bundle_data") {
95      sources = get_target_outputs(":copy_asan_runtime")
96      outputs = [ "{{bundle_executable_dir}}/{{source_file_part}}" ]
97      public_deps = [ ":copy_asan_runtime" ]
98    }
99  }
100}
101
102config("sanitizer_options_link_helper") {
103  if (is_mac) {
104    ldflags = [ "-Wl,-U,_sanitizer_options_link_helper" ]
105  } else if (!is_win && !is_mingw) {
106    ldflags = [ "-Wl,-u_sanitizer_options_link_helper" ]
107  }
108}
109
110static_library("options_sources") {
111  # This is a static_library instead of a source_set, as it shouldn't be
112  # unconditionally linked into targets.
113  visibility = [
114    ":deps",
115    "//:gn_visibility",
116  ]
117  sources = [ "//build/misc/sanitizers/sanitizer_options.cc" ]
118
119  # Don't compile this target with any sanitizer code. It can be called from
120  # the sanitizer runtimes, so instrumenting these functions could cause
121  # recursive calls into the runtime if there is an error.
122  configs -= [ "//build/config/sanitizers:default_sanitizer_flags" ]
123
124  if (is_asan) {
125    if (!defined(asan_suppressions_file)) {
126      asan_suppressions_file = "//build/misc/sanitizers/asan_suppressions.cc"
127    }
128    sources += [ asan_suppressions_file ]
129  }
130
131  if (is_lsan) {
132    if (!defined(lsan_suppressions_file)) {
133      lsan_suppressions_file = "//build/misc/sanitizers/lsan_suppressions.cc"
134    }
135    sources += [ lsan_suppressions_file ]
136  }
137
138  if (is_tsan) {
139    if (!defined(tsan_suppressions_file)) {
140      tsan_suppressions_file = "//build/misc/sanitizers/tsan_suppressions.cc"
141    }
142    sources += [ tsan_suppressions_file ]
143  }
144}
145
146# Applies linker flags necessary when either :deps or :default_sanitizer_flags
147# are used.
148config("default_sanitizer_ldflags") {
149  visibility = [
150    ":default_sanitizer_flags",
151    ":deps",
152  ]
153
154  if (is_posix && !is_mingw) {
155    ldflags = []
156    if (is_asan) {
157      if (is_mac) {
158        # https://crbug.com/708707
159        ldflags += [ "-fno-sanitize-address-use-after-scope" ]
160      } else {
161        ldflags += [ "-fsanitize-address-use-after-scope" ]
162      }
163      ldflags += [ "-fsanitize-recover=address" ]
164      if (use_libfuzzer) {
165        ldflags += [
166          "-fsanitize=address",
167          "-shared-libasan",
168        ]
169      }
170    }
171    if (is_lsan) {
172      ldflags += [ "-fsanitize=leak" ]
173    }
174    if (is_tsan) {
175      ldflags += [
176        "-fsanitize=thread",
177        "-shared-libsan",
178      ]
179    }
180    if (is_msan) {
181      ldflags += [ "-fsanitize=memory" ]
182    }
183    if (is_ubsan || is_ubsan_security) {
184      ldflags += [ "-fsanitize=undefined" ]
185    }
186    if (is_ubsan_null) {
187      ldflags += [ "-fsanitize=null" ]
188    }
189    if (is_ubsan_vptr) {
190      ldflags += [ "-fsanitize=vptr" ]
191    }
192    if (is_safestack) {
193      ldflags += [ "-fsanitize=safe-stack" ]
194    }
195
196    if (use_sanitizer_coverage) {
197      if (use_libfuzzer && !is_mac) {
198        ldflags += [ "-fsanitize=fuzzer-no-link" ]
199        if (target_cpu == "arm64") {
200          fuzzer_lib_path = rebase_path(
201                  "$clang_base_path/lib/clang/$clang_version/lib/$abi_target/libclang_rt.fuzzer_no_main.a",
202                  root_build_dir)
203        } else if (target_cpu == "arm") {
204          fuzzer_lib_path = rebase_path(
205                  "$clang_base_path/lib/clang/$clang_version/lib/arm-linux-ohos/libclang_rt.fuzzer_no_main.a",
206                  root_build_dir)
207        } else if (target_cpu == "x86_64") {
208          fuzzer_lib_path = rebase_path(
209                  "$clang_base_path/lib/clang/$clang_version/lib/x86_64-linux-ohos/libclang_rt.fuzzer_no_main.a",
210                  root_build_dir)
211        }
212        ldflags += [
213          "-Wl,--whole-archive",
214          "$fuzzer_lib_path",
215          "-Wl,--no-whole-archive",
216          "-lc++",
217        ]
218      } else {
219        ldflags += [ "-fsanitize-coverage=$sanitizer_coverage_flags" ]
220      }
221    }
222
223    if (is_cfi && current_toolchain == default_toolchain) {
224      ldflags += [ "-fsanitize=cfi-vcall" ]
225      if (use_cfi_cast) {
226        ldflags += [
227          "-fsanitize=cfi-derived-cast",
228          "-fsanitize=cfi-unrelated-cast",
229        ]
230      }
231      if (use_cfi_icall) {
232        ldflags += [ "-fsanitize=cfi-icall" ]
233      }
234      if (use_cfi_diag) {
235        ldflags += [ "-fno-sanitize-trap=cfi" ]
236        if (use_cfi_recover) {
237          ldflags += [ "-fsanitize-recover=cfi" ]
238        }
239      }
240    }
241  } else if (is_win) {
242    # Windows directly calls link.exe instead of the compiler driver when
243    # linking.  Hence, pass the runtime libraries instead of -fsanitize=address
244    # or -fsanitize=fuzzer.
245    if (is_asan && is_component_build) {
246      # In the static-library build, ASan libraries are different for
247      # executables and dlls, see link_executable and link_shared_library below.
248      # This here handles only the component build.
249      if (target_cpu == "x64") {
250        # Windows 64-bit.
251        libs = [
252          "clang_rt.asan_dynamic-x86_64.lib",
253          "clang_rt.asan_dynamic_runtime_thunk-x86_64.lib",
254        ]
255      } else {
256        assert(target_cpu == "x86", "WinASan unsupported architecture")
257        libs = [
258          "clang_rt.asan_dynamic-i386.lib",
259          "clang_rt.asan_dynamic_runtime_thunk-i386.lib",
260        ]
261      }
262    }
263    if (use_libfuzzer) {
264      assert(target_cpu == "x64", "LibFuzzer unsupported architecture")
265      assert(!is_component_build,
266             "LibFuzzer only supports non-component builds on Windows")
267
268      # Incremental linking causes padding that messes up SanitizerCoverage.
269      # Don't do it.
270      ldflags = [ "/INCREMENTAL:NO" ]
271      libs = [ "clang_rt.fuzzer_no_main-x86_64.lib" ]
272    }
273  }
274}
275
276config("common_sanitizer_flags") {
277  cflags = []
278
279  if (using_sanitizer && !is_mingw) {
280    assert(is_clang, "sanitizers only supported with clang")
281    assert(!is_official_build, "sanitizers not supported in official builds")
282
283    cflags += [
284      # Column info in debug data confuses Visual Studio's debugger, so don't
285      # use this by default.  However, clusterfuzz needs it for good
286      # attribution of reports to CLs, so turn it on there.
287      "-gcolumn-info",
288    ]
289
290    # Frame pointers are controlled in //build/config/compiler:default_stack_frames
291  }
292}
293
294config("asan_flags") {
295  cflags = []
296  if (is_asan && !is_mingw && !use_hwasan) {
297    cflags += [ "-fsanitize=address" ]
298    if (!is_mac) {
299      cflags += [ "-fsanitize-address-use-after-scope" ]
300    } else {
301      # https://crbug.com/708707
302      cflags += [ "-fno-sanitize-address-use-after-scope" ]
303    }
304    if (!asan_globals) {
305      cflags += [
306        "-mllvm",
307        "-asan-globals=0",
308      ]
309    }
310    cflags += [ "-fsanitize-recover=address" ]
311  }
312}
313
314config("hwasan_flags") {
315  cflags = []
316  if (is_asan && use_hwasan && !is_mingw && current_cpu == "arm64") {
317    cflags += [
318      "-fsanitize=hwaddress",
319      "-fno-emulated-tls",
320      "-mllvm",
321      "-hwasan-globals=0",
322    ]
323  }
324}
325
326config("link_executable") {
327  if (is_asan && is_win && !is_component_build) {
328    if (target_cpu == "x64") {
329      ldflags = [ "-wholearchive:clang_rt.asan-x86_64.lib" ]
330    } else {
331      assert(target_cpu == "x86", "WinASan unsupported architecture")
332      ldflags = [ "-wholearchive:clang_rt.asan-i386.lib" ]
333    }
334  } else if ((is_asan && is_ohos) || (is_tsan && is_ohos)) {
335    libs = [ "$_clang_rt_dso_full_path" ]
336    if (target_cpu == "arm") {
337      ldflags = [ "-Wl,--dynamic-linker=/lib/ld-musl-arm-asan.so.1" ]
338    } else if (target_cpu == "arm64") {
339      ldflags = [ "-Wl,--dynamic-linker=/lib/ld-musl-aarch64-asan.so.1" ]
340    } else if (target_cpu == "riscv64") {
341      ldflags = [ "-Wl,--dynamic-linker=/lib/ld-musl-riscv64-asan.so.1" ]
342    } else if (target_cpu == "loongarch64") {
343      ldflags = [ "-Wl,--dynamic-linker=/lib/ld-musl-loongarch64-asan.so.1" ]
344    }
345  }
346}
347
348config("link_shared_library") {
349  if (is_asan && is_win && !is_component_build) {
350    if (target_cpu == "x64") {
351      libs = [ "clang_rt.asan_dll_thunk-x86_64.lib" ]
352    } else {
353      assert(target_cpu == "x86", "WinASan unsupported architecture")
354      libs = [ "clang_rt.asan_dll_thunk-i386.lib" ]
355    }
356  } else if (is_asan && is_ohos) {
357    libs = [ "$_clang_rt_dso_full_path" ]
358  } else if (is_tsan && is_ohos && !is_mingw && !is_win) {
359    libs = [ "$_clang_rt_dso_full_path" ]
360  }
361}
362
363config("cfi_flags") {
364  cflags = []
365  if (is_cfi && current_toolchain == default_toolchain) {
366    if (!defined(cfi_blocklist_path)) {
367      cfi_blocklist_path =
368          rebase_path("//tools/cfi/blocklist.txt", root_build_dir)
369    }
370    cflags += [
371      "-fsanitize=cfi-vcall",
372      "-fsanitize-blacklist=$cfi_blocklist_path",
373    ]
374
375    if (use_cfi_cast) {
376      cflags += [
377        "-fsanitize=cfi-derived-cast",
378        "-fsanitize=cfi-unrelated-cast",
379      ]
380    }
381
382    if (use_cfi_icall) {
383      cflags += [ "-fsanitize=cfi-icall" ]
384    }
385
386    if (use_cfi_diag) {
387      cflags += [ "-fno-sanitize-trap=cfi" ]
388      if (is_win) {
389        cflags += [
390          "/Oy-",
391          "/Ob0",
392        ]
393      } else {
394        cflags += [
395          "-fno-inline-functions",
396          "-fno-inline",
397          "-fno-omit-frame-pointer",
398          "-O1",
399        ]
400      }
401      if (use_cfi_recover) {
402        cflags += [ "-fsanitize-recover=cfi" ]
403      }
404    }
405  }
406}
407
408config("coverage_flags") {
409  cflags = []
410  if (use_sanitizer_coverage) {
411    # Used by sandboxing code to allow coverage dump to be written on the disk.
412    defines = [ "SANITIZER_COVERAGE" ]
413
414    if (use_libfuzzer && !is_mac) {
415      # Adding -fsanitize=fuzzer-no-link will add -fsanitize-coverage=inline-8bit-counters,
416      # indirect-calls, trace-cmp, pc-table
417      cflags += [ "-fsanitize=fuzzer-no-link" ]
418    } else {
419      cflags += [
420        "-fsanitize-coverage=$sanitizer_coverage_flags",
421        "-mllvm",
422        "-sanitizer-coverage-prune-blocks=1",
423      ]
424      if (current_cpu == "arm") {
425        # http://crbug.com/517105
426        cflags += [
427          "-mllvm",
428          "-sanitizer-coverage-block-threshold=0",
429        ]
430      }
431    }
432  }
433}
434
435config("lsan_flags") {
436  if (is_lsan) {
437    cflags = [ "-fsanitize=leak" ]
438  }
439}
440
441config("msan_flags") {
442  if (is_msan) {
443    assert(is_linux, "msan only supported on linux x86_64")
444    if (!defined(msan_blocklist_path)) {
445      msan_blocklist_path =
446          rebase_path("//tools/msan/blocklist.txt", root_build_dir)
447    }
448    cflags = [
449      "-fsanitize=memory",
450      "-fsanitize-memory-track-origins=$msan_track_origins",
451      "-fsanitize-blacklist=$msan_blocklist_path",
452    ]
453  }
454}
455
456config("safestack_flags") {
457  if (is_safestack) {
458    cflags = [ "-fsanitize=safe-stack" ]
459  }
460}
461
462config("tsan_flags") {
463  if (is_tsan && target_cpu == "arm64" && !is_mingw && !is_win) {
464    cflags = [
465      "-fsanitize=thread",
466      "-shared-libsan",
467    ]
468    if (defined(tsan_blocklist_path)) {
469      cflags += [
470        "-fsanitize-blacklist=$tsan_blocklist_path",
471      ]
472    }
473  }
474}
475
476config("ubsan_flags") {
477  cflags = []
478  if (is_ubsan) {
479    if (!defined(ubsan_blocklist_path)) {
480      ubsan_blocklist_path =
481          rebase_path("//tools/ubsan/blocklist.txt", root_build_dir)
482    }
483    cflags += [
484      # Yasm dies with an "Illegal instruction" error when bounds checking is
485      # enabled. See http://crbug.com/489901
486      # "-fsanitize=bounds",
487      "-fsanitize=float-divide-by-zero",
488      "-fsanitize=integer-divide-by-zero",
489      "-fsanitize=null",
490      "-fsanitize=object-size",
491      "-fsanitize=pointer-overflow",
492      "-fsanitize=return",
493      "-fsanitize=returns-nonnull-attribute",
494      "-fsanitize=shift-exponent",
495      "-fsanitize=signed-integer-overflow",
496      "-fsanitize=unreachable",
497      "-fsanitize=vla-bound",
498      "-fsanitize-blacklist=$ubsan_blocklist_path",
499    ]
500
501    # Chromecast ubsan builds fail to compile with these
502    # experimental flags, so only add them to non-chromecast ubsan builds.
503    if (!is_chromecast) {
504      cflags += [
505        # Employ the experimental PBQP register allocator to avoid slow
506        # compilation on files with too many basic blocks.
507        # See http://crbug.com/426271.
508        "-mllvm",
509        "-regalloc=pbqp",
510
511        # Speculatively use coalescing to slightly improve the code generated
512        # by PBQP regallocator. May increase compile time.
513        "-mllvm",
514        "-pbqp-coalescing",
515      ]
516    }
517  }
518}
519
520config("ubsan_no_recover") {
521  if (is_ubsan_no_recover) {
522    cflags = [ "-fno-sanitize-recover=undefined" ]
523  }
524}
525
526config("ubsan_security_flags") {
527  if (is_ubsan_security) {
528    if (!defined(ubsan_security_blocklist_path)) {
529      ubsan_security_blocklist_path =
530          rebase_path("//tools/ubsan/security_blocklist.txt", root_build_dir)
531    }
532    cflags = [
533      "-fsanitize=function",
534      "-fsanitize=pointer-overflow",
535      "-fsanitize=shift",
536      "-fsanitize=signed-integer-overflow",
537      "-fsanitize=vla-bound",
538      "-fsanitize=vptr",
539      "-fsanitize-blacklist=$ubsan_security_blocklist_path",
540    ]
541  }
542}
543
544config("ubsan_null_flags") {
545  if (is_ubsan_null) {
546    cflags = [ "-fsanitize=null" ]
547  }
548}
549
550config("ubsan_vptr_flags") {
551  if (is_ubsan_vptr) {
552    if (!defined(ubsan_vptr_blocklist_path)) {
553      ubsan_vptr_blocklist_path =
554          rebase_path("//tools/ubsan/vptr_blocklist.txt", root_build_dir)
555    }
556    cflags = [
557      "-fsanitize=vptr",
558      "-fsanitize-blacklist=$ubsan_vptr_blocklist_path",
559    ]
560  }
561}
562
563config("fuzzing_build_mode") {
564  if (use_fuzzing_engine && optimize_for_fuzzing) {
565    defines = [ "FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION" ]
566  }
567}
568
569all_sanitizer_configs = [
570  ":common_sanitizer_flags",
571  ":coverage_flags",
572  ":default_sanitizer_ldflags",
573  ":asan_flags",
574  ":hwasan_flags",
575  ":cfi_flags",
576  ":lsan_flags",
577  ":msan_flags",
578  ":safestack_flags",
579  ":tsan_flags",
580  ":ubsan_flags",
581  ":ubsan_no_recover",
582  ":ubsan_null_flags",
583  ":ubsan_security_flags",
584  ":ubsan_vptr_flags",
585  ":fuzzing_build_mode",
586]
587
588# This config is applied by default to all targets. It sets the compiler flags
589# for sanitizer usage, or, if no sanitizer is set, does nothing.
590#
591# This needs to be in a separate config so that targets can opt out of
592# sanitizers (by removing the config) if they desire. Even if a target
593# removes this config, executables & shared libraries should still depend on
594# :deps if any of their dependencies have not opted out of sanitizers.
595# Keep this list in sync with default_sanitizer_flags_but_ubsan_vptr.
596config("default_sanitizer_flags") {
597  configs = all_sanitizer_configs
598}
599
600# This config is equivalent to default_sanitizer_flags, but excludes ubsan_vptr.
601# This allows to selectively disable ubsan_vptr, when needed. In particular,
602# if some third_party code is required to be compiled without rtti, which
603# is a requirement for ubsan_vptr.
604config("default_sanitizer_flags_but_ubsan_vptr") {
605  configs = all_sanitizer_configs - [ ":ubsan_vptr_flags" ]
606}
607
608config("default_sanitizer_flags_but_coverage") {
609  configs = all_sanitizer_configs - [ ":coverage_flags" ]
610}
611
612config("sanitizer_trap_all_flags") {
613  cflags = [
614    "-fsanitize-trap=all",
615    "-ftrap-function=abort",
616  ]
617  ldflags = cflags
618}
619
620config("cfi_trap_function_flags") {
621  if (is_ohos && target_cpu == "arm64") {
622    cflags = [ "-fcfi-trap-function=__cfi_fail_report" ]
623    ldflags = [ "-fcfi-trap-function=__cfi_fail_report" ]
624  }
625}
626
627# By default, cfi is in release mode
628config("cfi_config_release") {
629  if (is_ohos) {
630    _cfi_blocklist_path = "//build/config/sanitizers/cfi_blocklist.txt"
631
632    configs = [ "//build/config/gcc:symbol_visibility_default" ]
633    cflags = [
634      "-flto",
635      "-fsanitize=cfi",
636      "-fsanitize-blacklist=" +
637          rebase_path(_cfi_blocklist_path, root_build_dir),
638    ]
639
640    # Remove some platforms because version-script is only meaningful for elf platform that support shared libraries.
641    # Add a cfi version script to ensure cfi related symbols can be exported.
642    if (!is_win) {
643      _cfi_version_script =
644          rebase_path("//build/config/sanitizers/cfi.versionscript",
645                      root_build_dir)
646      ldflags = [ "-Wl,--version-script=${_cfi_version_script}" ]
647    }
648  }
649}
650
651# Temporarily skip cfi check of namespace std
652config("cfi_config_skip_std") {
653  if (is_ohos) {
654    _cfi_blocklist_path = "//build/config/sanitizers/cfi_blocklist_std.txt"
655    cflags = [ "-fsanitize-blacklist=" +
656               rebase_path(_cfi_blocklist_path, root_build_dir) ]
657  }
658}
659
660# Debug mode, add no-trap and recover options over release mode
661config("cfi_config_debug") {
662  if (is_ohos) {
663    configs = [ ":cfi_config_release" ]
664    cflags = [
665      "-fno-sanitize-trap=cfi",
666      "-fsanitize-recover=cfi,undefined",
667    ]
668  }
669}
670
671config("cfi_cross_dso_release") {
672  configs = [ ":cfi_config_release" ]
673  cflags = [ "-fsanitize-cfi-cross-dso" ]
674  ldflags = [
675    "-flto",
676    "-fsanitize=cfi",
677    "-fsanitize-cfi-cross-dso",
678  ]
679}
680
681# Disable cfi nvcall
682config("cfi_no_nvcall") {
683  cflags = [ "-fno-sanitize=cfi-nvcall" ]
684  ldflags = [ "-fno-sanitize=cfi-nvcall" ]
685}
686
687# Disable cfi all
688config("cfi_no_all") {
689  cflags = [ "-fno-sanitize=cfi" ]
690  ldflags = [ "-fno-sanitize=cfi" ]
691}
692
693# Enable cfi vcall
694config("cfi_vcall") {
695  if (is_ohos) {
696    cflags = [ "-fsanitize=cfi-vcall" ]
697    ldflags = [ "-fsanitize=cfi-vcall" ]
698  }
699}
700
701# Enable cfi icall
702config("cfi_icall") {
703  if (is_ohos) {
704    cflags = [ "-fsanitize=cfi-icall" ]
705    ldflags = [ "-fsanitize=cfi-icall" ]
706  }
707}
708
709config("cfi_cross_dso_debug") {
710  configs = [ ":cfi_cross_dso_release" ]
711  cflags = [
712    "-fno-sanitize-trap=cfi",
713    "-fsanitize-recover=cfi,undefined",
714  ]
715  ldflags = cflags
716}
717
718config("shadow_call_stack_config") {
719  if (target_cpu == "arm64") {
720    cflags = [
721      # See https://clang.llvm.org/docs/ShadowCallStack.html
722      "-fsanitize=shadow-call-stack",
723    ]
724    ldflags = cflags
725    configs = [ ":sanitizer_trap_all_flags" ]
726  }
727}
728
729template("config_plus_compiler_rt") {
730  forward_variables_from(invoker, [ "compiler_rt_shared_lib_names" ])
731  not_needed([ "compiler_rt_shared_lib_names" ])
732
733  _clang_rt_dso_paths = []
734  if ((host_os == "linux" || host_os == "mac") && target_os == "ohos" &&
735      !is_mingw && is_ohos) {
736    _dso_names = []
737    foreach(dso_name, compiler_rt_shared_lib_names) {
738      # Add runtime shared library support
739      _dso_names += [ "${abi_target}/libclang_rt.${dso_name}.so" ]
740    }
741
742    foreach(rt_lib, _dso_names) {
743      _clang_rt_dso_paths += [ "$clang_lib_base_path/${rt_lib}" ]
744    }
745  }
746
747  config(target_name) {
748    forward_variables_from(invoker,
749                           [
750                             "cflags",
751                             "cflags_cc",
752                             "asmflags",
753                             "ldflags",
754                             "libs",
755                             "configs",
756                           ])
757
758    # Link library by its fullpath
759    if (defined(libs)) {
760      libs += _clang_rt_dso_paths
761    } else {
762      libs = _clang_rt_dso_paths
763    }
764  }
765}
766
767config_plus_compiler_rt("scudo_config") {
768  cflags = [ "-fsanitize=scudo" ]
769  configs = [ ":sanitizer_trap_all_flags" ]
770  compiler_rt_shared_lib_names = [ "scudo_minimal" ]
771}
772
773config("all_undefined_behavior_sanitize_config_release") {
774  cflags = [
775    "-fsanitize=undefined",
776    "-fno-sanitize-trap=integer,undefined",
777    "-fno-sanitize-recover=integer,undefined",
778  ]
779}
780
781config("all_undefined_behavior_sanitize_config_debug") {
782  cflags = [
783    "-fsanitize=undefined",
784    "-fno-sanitize-trap=integer,undefined",
785    "-fsanitize-recover=integer,undefined",
786  ]
787}
788
789config("undefined_behavior_sanitize_config_release") {
790  cflags = [
791    "-fsanitize=bool,integer-divide-by-zero,return,returns-nonnull-attribute,shift-exponent,unreachable,vla-bound",
792    "-fno-sanitize-trap=integer,undefined",
793    "-fno-sanitize-recover=integer,undefined",
794    "-fno-sanitize=implicit-integer-sign-change",
795  ]
796}
797
798config("undefined_behavior_sanitize_config_debug") {
799  cflags = [
800    "-fsanitize=bool,integer-divide-by-zero,return,returns-nonnull-attribute,shift-exponent,unreachable,vla-bound",
801    "-fno-sanitize-trap=integer,undefined",
802    "-fsanitize-recover=integer,undefined",
803    "-fno-sanitize=implicit-integer-sign-change",
804  ]
805}
806
807config("boundary_sanitize_config_release") {
808  cflags = [
809    "-fsanitize=bounds",
810    "-fno-sanitize-trap=integer,undefined",
811    "-fno-sanitize-recover=integer,undefined",
812    "-fno-sanitize=implicit-integer-sign-change",
813  ]
814}
815
816config("boundary_sanitize_config_debug") {
817  cflags = [
818    "-fsanitize=bounds",
819    "-fno-sanitize-trap=integer,undefined",
820    "-fsanitize-recover=integer,undefined",
821    "-fno-sanitize=implicit-integer-sign-change",
822  ]
823}
824
825config("common_integer_overflow_config_release") {
826  _integer_overflow_blocklist = "./integer_overflow_blocklist.txt"
827  cflags = [
828    "-fsanitize-blacklist=" +
829        rebase_path(_integer_overflow_blocklist, root_build_dir),
830    "-fno-sanitize-trap=integer,undefined",
831    "-fno-sanitize-recover=integer,undefined",
832  ]
833}
834
835config("common_integer_overflow_config_debug") {
836  _integer_overflow_blocklist = "./integer_overflow_blocklist.txt"
837  cflags = [
838    "-fsanitize-blacklist=" +
839        rebase_path(_integer_overflow_blocklist, root_build_dir),
840    "-fno-sanitize-trap=integer,undefined",
841    "-fsanitize-recover=integer,undefined",
842  ]
843}
844
845config("signed_integer_overflow_config") {
846  cflags = [ "-fsanitize=signed-integer-overflow" ]
847}
848
849config("unsigned_integer_overflow_config") {
850  cflags = [ "-fsanitize=unsigned-integer-overflow" ]
851}
852
853config_plus_compiler_rt("compiler_rt_debug") {
854  compiler_rt_shared_lib_names = [ "ubsan_standalone" ]
855}
856
857config_plus_compiler_rt("compiler_rt_release") {
858  if (!is_tsan) {
859    cflags = [ "-fsanitize-minimal-runtime" ]
860  }
861  compiler_rt_shared_lib_names = [ "ubsan_minimal" ]
862}
863