github.com/westcoastroms/westcoastroms-build@v0.0.0-20190928114312-2350e5a73030/build/make/core/config_sanitizers.mk (about)

     1  ##############################################
     2  ## Perform configuration steps for sanitizers.
     3  ##############################################
     4  
     5  my_sanitize := $(strip $(LOCAL_SANITIZE))
     6  my_sanitize_diag := $(strip $(LOCAL_SANITIZE_DIAG))
     7  
     8  # SANITIZE_HOST is only in effect if the module is already using clang (host
     9  # modules that haven't set `LOCAL_CLANG := false` and device modules that
    10  # have set `LOCAL_CLANG := true`.
    11  my_global_sanitize :=
    12  my_global_sanitize_diag :=
    13  ifeq ($(my_clang),true)
    14    ifdef LOCAL_IS_HOST_MODULE
    15      my_global_sanitize := $(strip $(SANITIZE_HOST))
    16  
    17      # SANITIZE_HOST=true is a deprecated way to say SANITIZE_HOST=address.
    18      my_global_sanitize := $(subst true,address,$(my_global_sanitize))
    19    else
    20      my_global_sanitize := $(strip $(SANITIZE_TARGET))
    21      my_global_sanitize_diag := $(strip $(SANITIZE_TARGET_DIAG))
    22    endif
    23  endif
    24  
    25  # Disable global integer_overflow in excluded paths.
    26  ifneq ($(filter integer_overflow, $(my_global_sanitize)),)
    27    combined_exclude_paths := $(INTEGER_OVERFLOW_EXCLUDE_PATHS) \
    28                              $(PRODUCT_INTEGER_OVERFLOW_EXCLUDE_PATHS)
    29  
    30    ifneq ($(strip $(foreach dir,$(subst $(comma),$(space),$(combined_exclude_paths)),\
    31           $(filter $(dir)%,$(LOCAL_PATH)))),)
    32      my_global_sanitize := $(filter-out integer_overflow,$(my_global_sanitize))
    33      my_global_sanitize_diag := $(filter-out integer_overflow,$(my_global_sanitize_diag))
    34    endif
    35  endif
    36  
    37  # Disable global CFI in excluded paths
    38  ifneq ($(filter cfi, $(my_global_sanitize)),)
    39    combined_exclude_paths := $(CFI_EXCLUDE_PATHS) \
    40                              $(PRODUCT_CFI_EXCLUDE_PATHS)
    41  
    42    ifneq ($(strip $(foreach dir,$(subst $(comma),$(space),$(combined_exclude_paths)),\
    43           $(filter $(dir)%,$(LOCAL_PATH)))),)
    44      my_global_sanitize := $(filter-out cfi,$(my_global_sanitize))
    45      my_global_sanitize_diag := $(filter-out cfi,$(my_global_sanitize_diag))
    46    endif
    47  endif
    48  
    49  ifneq ($(my_global_sanitize),)
    50    my_sanitize := $(my_global_sanitize) $(my_sanitize)
    51  endif
    52  ifneq ($(my_global_sanitize_diag),)
    53    my_sanitize_diag := $(my_global_sanitize_diag) $(my_sanitize_diag)
    54  endif
    55  
    56  # The sanitizer specified in the product configuration wins over the previous.
    57  ifneq ($(SANITIZER.$(TARGET_PRODUCT).$(LOCAL_MODULE).CONFIG),)
    58    my_sanitize := $(SANITIZER.$(TARGET_PRODUCT).$(LOCAL_MODULE).CONFIG)
    59    ifeq ($(my_sanitize),never)
    60      my_sanitize :=
    61      my_sanitize_diag :=
    62    endif
    63  endif
    64  
    65  ifndef LOCAL_IS_HOST_MODULE
    66    # Add a filter point for 32-bit vs 64-bit sanitization (to lighten the burden)
    67    SANITIZE_TARGET_ARCH ?= $(TARGET_ARCH) $(TARGET_2ND_ARCH)
    68    ifeq ($(filter $(SANITIZE_TARGET_ARCH),$(TARGET_$(LOCAL_2ND_ARCH_VAR_PREFIX)ARCH)),)
    69      my_sanitize :=
    70      my_sanitize_diag :=
    71    endif
    72  endif
    73  
    74  # Add a filter point based on module owner (to lighten the burden). The format is a space- or
    75  # colon-separated list of owner names.
    76  ifneq (,$(SANITIZE_NEVER_BY_OWNER))
    77    ifneq (,$(LOCAL_MODULE_OWNER))
    78      ifneq (,$(filter $(LOCAL_MODULE_OWNER),$(subst :, ,$(SANITIZE_NEVER_BY_OWNER))))
    79        $(warning Not sanitizing $(LOCAL_MODULE) based on module owner.)
    80        my_sanitize :=
    81        my_sanitize_diag :=
    82      endif
    83    endif
    84  endif
    85  
    86  # Don't apply sanitizers to NDK code.
    87  ifdef LOCAL_SDK_VERSION
    88    my_sanitize :=
    89    my_global_sanitize :=
    90    my_sanitize_diag :=
    91  endif
    92  
    93  # Never always wins.
    94  ifeq ($(LOCAL_SANITIZE),never)
    95    my_sanitize :=
    96    my_sanitize_diag :=
    97  endif
    98  
    99  # Enable CFI in included paths (for Arm64 only).
   100  ifeq ($(filter cfi, $(my_sanitize)),)
   101    ifneq ($(filter arm64,$(TARGET_$(LOCAL_2ND_ARCH_VAR_PREFIX)ARCH)),)
   102      combined_include_paths := $(CFI_INCLUDE_PATHS) \
   103                                $(PRODUCT_CFI_INCLUDE_PATHS)
   104  
   105      ifneq ($(strip $(foreach dir,$(subst $(comma),$(space),$(combined_include_paths)),\
   106             $(filter $(dir)%,$(LOCAL_PATH)))),)
   107        my_sanitize := cfi $(my_sanitize)
   108        my_sanitize_diag := cfi $(my_sanitize_diag)
   109      endif
   110    endif
   111  endif
   112  
   113  # If CFI is disabled globally, remove it from my_sanitize.
   114  ifeq ($(strip $(ENABLE_CFI)),false)
   115    my_sanitize := $(filter-out cfi,$(my_sanitize))
   116    my_sanitize_diag := $(filter-out cfi,$(my_sanitize_diag))
   117  endif
   118  
   119  # Disable CFI for arm32 (b/35157333).
   120  ifneq ($(filter arm,$(TARGET_$(LOCAL_2ND_ARCH_VAR_PREFIX)ARCH)),)
   121    my_sanitize := $(filter-out cfi,$(my_sanitize))
   122    my_sanitize_diag := $(filter-out cfi,$(my_sanitize_diag))
   123  endif
   124  
   125  # Also disable CFI if ASAN is enabled.
   126  ifneq ($(filter address,$(my_sanitize)),)
   127    my_sanitize := $(filter-out cfi,$(my_sanitize))
   128    my_sanitize_diag := $(filter-out cfi,$(my_sanitize_diag))
   129  endif
   130  
   131  # CFI needs gold linker, and mips toolchain does not have one.
   132  ifneq ($(filter mips mips64,$(TARGET_$(LOCAL_2ND_ARCH_VAR_PREFIX)ARCH)),)
   133    my_sanitize := $(filter-out cfi,$(my_sanitize))
   134    my_sanitize_diag := $(filter-out cfi,$(my_sanitize_diag))
   135  endif
   136  
   137  # Disable CFI for host targets
   138  ifdef LOCAL_IS_HOST_MODULE
   139    my_sanitize := $(filter-out cfi,$(my_sanitize))
   140    my_sanitize_diag := $(filter-out cfi,$(my_sanitize_diag))
   141  endif
   142  
   143  # Support for local sanitize blacklist paths.
   144  ifneq ($(my_sanitize)$(my_global_sanitize),)
   145    ifneq ($(LOCAL_SANITIZE_BLACKLIST),)
   146      my_cflags += -fsanitize-blacklist=$(LOCAL_PATH)/$(LOCAL_SANITIZE_BLACKLIST)
   147    endif
   148  endif
   149  
   150  # Disable integer_overflow if LOCAL_NOSANITIZE=integer.
   151  ifneq ($(filter integer_overflow, $(my_global_sanitize) $(my_sanitize)),)
   152    ifneq ($(filter integer, $(strip $(LOCAL_NOSANITIZE))),)
   153      my_sanitize := $(filter-out integer_overflow,$(my_sanitize))
   154      my_sanitize_diag := $(filter-out integer_overflow,$(my_sanitize_diag))
   155    endif
   156  endif
   157  
   158  my_nosanitize = $(strip $(LOCAL_NOSANITIZE))
   159  ifneq ($(my_nosanitize),)
   160    my_sanitize := $(filter-out $(my_nosanitize),$(my_sanitize))
   161  endif
   162  
   163  # TSAN is not supported on 32-bit architectures. For non-multilib cases, make
   164  # its use an error. For multilib cases, don't use it for the 32-bit case.
   165  ifneq ($(filter thread,$(my_sanitize)),)
   166    ifeq ($(my_32_64_bit_suffix),32)
   167      ifeq ($(my_module_multilib),both)
   168          my_sanitize := $(filter-out thread,$(my_sanitize))
   169      else
   170          $(error $(LOCAL_PATH): $(LOCAL_MODULE): TSAN cannot be used for 32-bit modules.)
   171      endif
   172    else
   173      my_shared_libraries += $(TSAN_RUNTIME_LIBRARY)
   174    endif
   175  endif
   176  
   177  ifneq ($(filter safe-stack,$(my_sanitize)),)
   178    ifeq ($(my_32_64_bit_suffix),32)
   179      my_sanitize := $(filter-out safe-stack,$(my_sanitize))
   180    endif
   181  endif
   182  
   183  # Undefined symbols can occur if a non-sanitized library links
   184  # sanitized static libraries. That's OK, because the executable
   185  # always depends on the ASan runtime library, which defines these
   186  # symbols.
   187  ifneq ($(filter address thread,$(strip $(SANITIZE_TARGET))),)
   188    ifndef LOCAL_IS_HOST_MODULE
   189      ifeq ($(LOCAL_MODULE_CLASS),SHARED_LIBRARIES)
   190        ifeq ($(my_sanitize),)
   191          my_allow_undefined_symbols := true
   192        endif
   193      endif
   194    endif
   195  endif
   196  
   197  # Sanitizers can only be used with clang.
   198  ifneq ($(my_clang),true)
   199    ifneq ($(my_sanitize),)
   200      $(error $(LOCAL_PATH): $(LOCAL_MODULE): Use of sanitizers requires LOCAL_CLANG := true)
   201    endif
   202  endif
   203  
   204  ifneq ($(filter default-ub,$(my_sanitize)),)
   205    my_sanitize := $(CLANG_DEFAULT_UB_CHECKS)
   206  endif
   207  
   208  ifneq ($(filter coverage,$(my_sanitize)),)
   209    ifeq ($(filter address,$(my_sanitize)),)
   210      $(error $(LOCAL_PATH): $(LOCAL_MODULE): Use of 'coverage' also requires 'address')
   211    endif
   212    my_cflags += -fsanitize-coverage=trace-pc-guard,indirect-calls,trace-cmp
   213    my_sanitize := $(filter-out coverage,$(my_sanitize))
   214  endif
   215  
   216  ifneq ($(filter integer_overflow,$(my_sanitize)),)
   217    ifneq ($(filter SHARED_LIBRARIES EXECUTABLES,$(LOCAL_MODULE_CLASS)),)
   218      ifneq ($(LOCAL_FORCE_STATIC_EXECUTABLE),true)
   219  
   220        # Respect LOCAL_NOSANITIZE for integer-overflow flags.
   221        ifeq ($(filter signed-integer-overflow, $(strip $(LOCAL_NOSANITIZE))),)
   222          my_sanitize += signed-integer-overflow
   223        endif
   224        ifeq ($(filter unsigned-integer-overflow, $(strip $(LOCAL_NOSANITIZE))),)
   225          my_sanitize += unsigned-integer-overflow
   226        endif
   227        my_cflags += $(INTEGER_OVERFLOW_EXTRA_CFLAGS)
   228  
   229        # Check for diagnostics mode (on by default).
   230        ifneq ($(filter integer_overflow,$(my_sanitize_diag)),)
   231          my_sanitize_diag += signed-integer-overflow
   232          my_sanitize_diag += unsigned-integer-overflow
   233        endif
   234      endif
   235    endif
   236    my_sanitize := $(filter-out integer_overflow,$(my_sanitize))
   237  endif
   238  
   239  # Makes sure integer_overflow diagnostics is removed from the diagnostics list
   240  # even if integer_overflow is not set for some reason.
   241  ifneq ($(filter integer_overflow,$(my_sanitize_diag)),)
   242    my_sanitize_diag := $(filter-out integer_overflow,$(my_sanitize_diag))
   243  endif
   244  
   245  ifneq ($(my_sanitize),)
   246    fsanitize_arg := $(subst $(space),$(comma),$(my_sanitize))
   247    my_cflags += -fsanitize=$(fsanitize_arg)
   248  
   249    ifdef LOCAL_IS_HOST_MODULE
   250      my_cflags += -fno-sanitize-recover=all
   251      my_ldflags += -fsanitize=$(fsanitize_arg)
   252    else
   253      my_cflags += -fsanitize-trap=all
   254      my_cflags += -ftrap-function=abort
   255      ifneq ($(filter address thread,$(my_sanitize)),)
   256        my_cflags += -fno-sanitize-trap=address,thread
   257        my_shared_libraries += libdl
   258      endif
   259    endif
   260  endif
   261  
   262  ifneq ($(filter cfi,$(my_sanitize)),)
   263    # __cfi_check needs to be built as Thumb (see the code in linker_cfi.cpp).
   264    # LLVM is not set up to do this on a function basis, so force Thumb on the
   265    # entire module.
   266    LOCAL_ARM_MODE := thumb
   267    my_cflags += $(CFI_EXTRA_CFLAGS)
   268    # Only append the default visibility flag if -fvisibility has not already been
   269    # set to hidden.
   270    ifeq ($(filter -fvisibility=hidden,$(LOCAL_CFLAGS)),)
   271      my_cflags += -fvisibility=default
   272    endif
   273    my_ldflags += $(CFI_EXTRA_LDFLAGS)
   274    my_arflags += --plugin $(LLVM_PREBUILTS_PATH)/../lib64/LLVMgold.so
   275  
   276    ifeq ($(LOCAL_FORCE_STATIC_EXECUTABLE),true)
   277          my_ldflags := $(filter-out -fsanitize-cfi-cross-dso,$(my_ldflags))
   278          my_cflags := $(filter-out -fsanitize-cfi-cross-dso,$(my_cflags))
   279    else
   280          # Apply the version script to non-static executables
   281          my_ldflags += -Wl,--version-script,build/soong/cc/config/cfi_exports.map
   282          LOCAL_ADDITIONAL_DEPENDENCIES += build/soong/cc/config/cfi_exports.map
   283    endif
   284  endif
   285  
   286  # If local or global modules need ASAN, add linker flags.
   287  ifneq ($(filter address,$(my_global_sanitize) $(my_sanitize)),)
   288    my_ldflags += $(ADDRESS_SANITIZER_CONFIG_EXTRA_LDFLAGS)
   289    ifdef LOCAL_IS_HOST_MODULE
   290      # -nodefaultlibs (provided with libc++) prevents the driver from linking
   291      # libraries needed with -fsanitize=address. http://b/18650275 (WAI)
   292      my_ldflags += -Wl,--no-as-needed
   293    else
   294      # Add asan libraries unless LOCAL_MODULE is the asan library.
   295      # ASan runtime library must be the first in the link order.
   296      ifeq (,$(filter $(LOCAL_MODULE),$($(LOCAL_2ND_ARCH_VAR_PREFIX)ADDRESS_SANITIZER_RUNTIME_LIBRARY)))
   297        my_shared_libraries := $($(LOCAL_2ND_ARCH_VAR_PREFIX)ADDRESS_SANITIZER_RUNTIME_LIBRARY) \
   298                               $(my_shared_libraries)
   299      endif
   300      ifeq (,$(filter $(LOCAL_MODULE),$(ADDRESS_SANITIZER_CONFIG_EXTRA_STATIC_LIBRARIES)))
   301        my_static_libraries += $(ADDRESS_SANITIZER_CONFIG_EXTRA_STATIC_LIBRARIES)
   302      endif
   303  
   304      # Do not add unnecessary dependency in shared libraries.
   305      ifeq ($(LOCAL_MODULE_CLASS),SHARED_LIBRARIES)
   306        my_ldflags += -Wl,--as-needed
   307      endif
   308  
   309      ifeq ($(LOCAL_MODULE_CLASS),EXECUTABLES)
   310        ifneq ($(LOCAL_FORCE_STATIC_EXECUTABLE),true)
   311          my_linker := $($(LOCAL_2ND_ARCH_VAR_PREFIX)ADDRESS_SANITIZER_LINKER)
   312          # Make sure linker_asan get installed.
   313          $(LOCAL_INSTALLED_MODULE) : | $(PRODUCT_OUT)$($(LOCAL_2ND_ARCH_VAR_PREFIX)ADDRESS_SANITIZER_LINKER)
   314        endif
   315      endif
   316    endif
   317  endif
   318  
   319  # If local module needs ASAN, add compiler flags.
   320  ifneq ($(filter address,$(my_sanitize)),)
   321    # Frame pointer based unwinder in ASan requires ARM frame setup.
   322    LOCAL_ARM_MODE := arm
   323    my_cflags += $(ADDRESS_SANITIZER_CONFIG_EXTRA_CFLAGS)
   324    ifndef LOCAL_IS_HOST_MODULE
   325      my_cflags += -mllvm -asan-globals=0
   326    endif
   327  endif
   328  
   329  # Use minimal diagnostics when integer overflow is enabled; never do it for HOST or AUX modules
   330  ifeq ($(LOCAL_IS_HOST_MODULE)$(LOCAL_IS_AUX_MODULE),)
   331    # Pre-emptively add UBSAN minimal runtime incase a static library dependency requires it
   332    ifeq ($(filter STATIC_LIBRARIES,$(LOCAL_MODULE_CLASS)),)
   333      ifndef LOCAL_SDK_VERSION
   334        my_static_libraries += $($(LOCAL_2ND_ARCH_VAR_PREFIX)UBSAN_MINIMAL_RUNTIME_LIBRARY)
   335        my_ldflags += -Wl,--exclude-libs,$($(LOCAL_2ND_ARCH_VAR_PREFIX)UBSAN_MINIMAL_RUNTIME_LIBRARY).a
   336      endif
   337    endif
   338    ifneq ($(filter unsigned-integer-overflow signed-integer-overflow integer,$(my_sanitize)),)
   339      ifeq ($(filter unsigned-integer-overflow signed-integer overflow integer,$(my_sanitize_diag)),)
   340        ifeq ($(filter cfi,$(my_sanitize_diag)),)
   341          ifeq ($(filter address,$(my_sanitize)),)
   342            my_cflags += -fsanitize-minimal-runtime
   343            my_cflags += -fno-sanitize-trap=integer
   344            my_cflags += -fno-sanitize-recover=integer
   345          endif
   346        endif
   347      endif
   348    endif
   349  endif
   350  
   351  ifneq ($(strip $(LOCAL_SANITIZE_RECOVER)),)
   352    recover_arg := $(subst $(space),$(comma),$(LOCAL_SANITIZE_RECOVER)),
   353    my_cflags += -fsanitize-recover=$(recover_arg)
   354  endif
   355  
   356  ifneq ($(my_sanitize_diag),)
   357    # TODO(vishwath): Add diagnostic support for static executables once
   358    # we switch to clang-4393122 (which adds the static ubsan runtime
   359    # that this depends on)
   360    ifneq ($(LOCAL_FORCE_STATIC_EXECUTABLE),true)
   361      notrap_arg := $(subst $(space),$(comma),$(my_sanitize_diag)),
   362      my_cflags += -fno-sanitize-trap=$(notrap_arg)
   363      # Diagnostic requires a runtime library, unless ASan or TSan are also enabled.
   364      ifeq ($(filter address thread,$(my_sanitize)),)
   365        # Does not have to be the first DT_NEEDED unlike ASan.
   366        my_shared_libraries += $($(LOCAL_2ND_ARCH_VAR_PREFIX)UBSAN_RUNTIME_LIBRARY)
   367      endif
   368    endif
   369  endif