| //===-- sanitizer_coverage_libcdep_new.cpp --------------------------------===// |
| // |
| // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions. |
| // See https://llvm.org/LICENSE.txt for license information. |
| // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception |
| // |
| //===----------------------------------------------------------------------===// |
| // Sanitizer Coverage Controller for Trace PC Guard. |
| |
| #include "sanitizer_platform.h" |
| |
| #if !SANITIZER_FUCHSIA |
| # include "sancov_flags.h" |
| # include "sanitizer_allocator_internal.h" |
| # include "sanitizer_atomic.h" |
| # include "sanitizer_common.h" |
| # include "sanitizer_common/sanitizer_stacktrace.h" |
| # include "sanitizer_file.h" |
| # include "sanitizer_interface_internal.h" |
| |
| using namespace __sanitizer; |
| |
| using AddressRange = LoadedModule::AddressRange; |
| |
| namespace __sancov { |
| namespace { |
| |
| static const u64 Magic64 = 0xC0BFFFFFFFFFFF64ULL; |
| static const u64 Magic32 = 0xC0BFFFFFFFFFFF32ULL; |
| static const u64 Magic = SANITIZER_WORDSIZE == 64 ? Magic64 : Magic32; |
| |
| static fd_t OpenFile(const char* path) { |
| error_t err; |
| fd_t fd = OpenFile(path, WrOnly, &err); |
| if (fd == kInvalidFd) |
| Report("SanitizerCoverage: failed to open %s for writing (reason: %d)\n", |
| path, err); |
| return fd; |
| } |
| |
| static void GetCoverageFilename(char* path, const char* name, |
| const char* extension) { |
| CHECK(name); |
| internal_snprintf(path, kMaxPathLength, "%s/%s.%zd.%s", |
| common_flags()->coverage_dir, name, internal_getpid(), |
| extension); |
| } |
| |
| static void WriteModuleCoverage(char* file_path, const char* module_name, |
| const uptr* pcs, uptr len) { |
| GetCoverageFilename(file_path, StripModuleName(module_name), "sancov"); |
| fd_t fd = OpenFile(file_path); |
| WriteToFile(fd, &Magic, sizeof(Magic)); |
| WriteToFile(fd, pcs, len * sizeof(*pcs)); |
| CloseFile(fd); |
| Printf("SanitizerCoverage: %s: %zd PCs written\n", file_path, len); |
| } |
| |
| static void SanitizerDumpCoverage(const uptr* unsorted_pcs, uptr len) { |
| if (!len) return; |
| |
| char* file_path = static_cast<char*>(InternalAlloc(kMaxPathLength)); |
| char* module_name = static_cast<char*>(InternalAlloc(kMaxPathLength)); |
| uptr* pcs = static_cast<uptr*>(InternalAlloc(len * sizeof(uptr))); |
| |
| internal_memcpy(pcs, unsorted_pcs, len * sizeof(uptr)); |
| Sort(pcs, len); |
| |
| bool module_found = false; |
| uptr last_base = 0; |
| uptr module_start_idx = 0; |
| |
| for (uptr i = 0; i < len; ++i) { |
| const uptr pc = pcs[i]; |
| if (!pc) continue; |
| |
| if (!GetModuleAndOffsetForPc(pc, nullptr, 0, &pcs[i])) { |
| Printf("ERROR: unknown pc %p (may happen if dlclose is used)\n", |
| (void*)pc); |
| continue; |
| } |
| uptr module_base = pc - pcs[i]; |
| |
| if (module_base != last_base || !module_found) { |
| if (module_found) { |
| WriteModuleCoverage(file_path, module_name, &pcs[module_start_idx], |
| i - module_start_idx); |
| } |
| |
| last_base = module_base; |
| module_start_idx = i; |
| module_found = true; |
| GetModuleAndOffsetForPc(pc, module_name, kMaxPathLength, &pcs[i]); |
| } |
| } |
| |
| if (module_found) { |
| WriteModuleCoverage(file_path, module_name, &pcs[module_start_idx], |
| len - module_start_idx); |
| } |
| |
| InternalFree(file_path); |
| InternalFree(module_name); |
| InternalFree(pcs); |
| } |
| |
| // Collects trace-pc guard coverage. |
| // This class relies on zero-initialization. |
| class TracePcGuardController { |
| public: |
| void Initialize() { |
| CHECK(!initialized); |
| |
| initialized = true; |
| InitializeSancovFlags(); |
| |
| pc_vector.Initialize(0); |
| } |
| |
| void InitTracePcGuard(u32* start, u32* end) { |
| if (!initialized) Initialize(); |
| CHECK(!*start); |
| CHECK_NE(start, end); |
| |
| u32 i = pc_vector.size(); |
| for (u32* p = start; p < end; p++) *p = ++i; |
| pc_vector.resize(i); |
| } |
| |
| void TracePcGuard(u32* guard, uptr pc) { |
| u32 idx = *guard; |
| if (!idx) return; |
| // we start indices from 1. |
| atomic_uintptr_t* pc_ptr = |
| reinterpret_cast<atomic_uintptr_t*>(&pc_vector[idx - 1]); |
| if (atomic_load(pc_ptr, memory_order_relaxed) == 0) |
| atomic_store(pc_ptr, pc, memory_order_relaxed); |
| } |
| |
| void Reset() { |
| internal_memset(&pc_vector[0], 0, sizeof(pc_vector[0]) * pc_vector.size()); |
| } |
| |
| void Dump() { |
| if (!initialized || !common_flags()->coverage) return; |
| __sanitizer_dump_coverage(pc_vector.data(), pc_vector.size()); |
| } |
| |
| private: |
| bool initialized; |
| InternalMmapVectorNoCtor<uptr> pc_vector; |
| }; |
| |
| static TracePcGuardController pc_guard_controller; |
| |
| // A basic default implementation of callbacks for |
| // -fsanitize-coverage=inline-8bit-counters,pc-table. |
| // Use TOOL_OPTIONS (UBSAN_OPTIONS, etc) to dump the coverage data: |
| // * cov_8bit_counters_out=PATH to dump the 8bit counters. |
| // * cov_pcs_out=PATH to dump the pc table. |
| // |
| // Most users will still need to define their own callbacks for greater |
| // flexibility. |
| namespace SingletonCounterCoverage { |
| |
| static char *counters_beg, *counters_end; |
| static const uptr *pcs_beg, *pcs_end; |
| |
| static void DumpCoverage() { |
| const char* file_path = common_flags()->cov_8bit_counters_out; |
| if (file_path && internal_strlen(file_path)) { |
| fd_t fd = OpenFile(file_path); |
| FileCloser file_closer(fd); |
| uptr size = counters_end - counters_beg; |
| WriteToFile(fd, counters_beg, size); |
| if (common_flags()->verbosity) |
| __sanitizer::Printf("cov_8bit_counters_out: written %zd bytes to %s\n", |
| size, file_path); |
| } |
| file_path = common_flags()->cov_pcs_out; |
| if (file_path && internal_strlen(file_path)) { |
| fd_t fd = OpenFile(file_path); |
| FileCloser file_closer(fd); |
| uptr size = (pcs_end - pcs_beg) * sizeof(uptr); |
| WriteToFile(fd, pcs_beg, size); |
| if (common_flags()->verbosity) |
| __sanitizer::Printf("cov_pcs_out: written %zd bytes to %s\n", size, |
| file_path); |
| } |
| } |
| |
| static void Cov8bitCountersInit(char* beg, char* end) { |
| counters_beg = beg; |
| counters_end = end; |
| Atexit(DumpCoverage); |
| } |
| |
| static void CovPcsInit(const uptr* beg, const uptr* end) { |
| pcs_beg = beg; |
| pcs_end = end; |
| } |
| |
| } // namespace SingletonCounterCoverage |
| |
| } // namespace |
| } // namespace __sancov |
| |
| namespace __sanitizer { |
| void InitializeCoverage(bool enabled, const char *dir) { |
| static bool coverage_enabled = false; |
| if (coverage_enabled) |
| return; // May happen if two sanitizer enable coverage in the same process. |
| coverage_enabled = enabled; |
| Atexit(__sanitizer_cov_dump); |
| AddDieCallback(__sanitizer_cov_dump); |
| } |
| } // namespace __sanitizer |
| |
| extern "C" { |
| SANITIZER_INTERFACE_ATTRIBUTE void __sanitizer_dump_coverage(const uptr* pcs, |
| uptr len) { |
| return __sancov::SanitizerDumpCoverage(pcs, len); |
| } |
| |
| SANITIZER_INTERFACE_WEAK_DEF(void, __sanitizer_cov_trace_pc_guard, u32* guard) { |
| if (!*guard) return; |
| __sancov::pc_guard_controller.TracePcGuard( |
| guard, StackTrace::GetPreviousInstructionPc(GET_CALLER_PC())); |
| } |
| |
| SANITIZER_INTERFACE_WEAK_DEF(void, __sanitizer_cov_trace_pc_guard_init, |
| u32* start, u32* end) { |
| if (start == end || *start) return; |
| __sancov::pc_guard_controller.InitTracePcGuard(start, end); |
| } |
| |
| SANITIZER_INTERFACE_ATTRIBUTE void __sanitizer_dump_trace_pc_guard_coverage() { |
| __sancov::pc_guard_controller.Dump(); |
| } |
| SANITIZER_INTERFACE_ATTRIBUTE void __sanitizer_cov_dump() { |
| __sanitizer_dump_trace_pc_guard_coverage(); |
| } |
| SANITIZER_INTERFACE_ATTRIBUTE void __sanitizer_cov_reset() { |
| __sancov::pc_guard_controller.Reset(); |
| } |
| // Default implementations (weak). |
| // Either empty or very simple. |
| // Most users should redefine them. |
| SANITIZER_INTERFACE_WEAK_DEF(void, __sanitizer_cov_trace_cmp, void) {} |
| SANITIZER_INTERFACE_WEAK_DEF(void, __sanitizer_cov_trace_cmp1, void) {} |
| SANITIZER_INTERFACE_WEAK_DEF(void, __sanitizer_cov_trace_cmp2, void) {} |
| SANITIZER_INTERFACE_WEAK_DEF(void, __sanitizer_cov_trace_cmp4, void) {} |
| SANITIZER_INTERFACE_WEAK_DEF(void, __sanitizer_cov_trace_cmp8, void) {} |
| SANITIZER_INTERFACE_WEAK_DEF(void, __sanitizer_cov_trace_const_cmp1, void) {} |
| SANITIZER_INTERFACE_WEAK_DEF(void, __sanitizer_cov_trace_const_cmp2, void) {} |
| SANITIZER_INTERFACE_WEAK_DEF(void, __sanitizer_cov_trace_const_cmp4, void) {} |
| SANITIZER_INTERFACE_WEAK_DEF(void, __sanitizer_cov_trace_const_cmp8, void) {} |
| SANITIZER_INTERFACE_WEAK_DEF(void, __sanitizer_cov_trace_switch, void) {} |
| SANITIZER_INTERFACE_WEAK_DEF(void, __sanitizer_cov_trace_div4, void) {} |
| SANITIZER_INTERFACE_WEAK_DEF(void, __sanitizer_cov_trace_div8, void) {} |
| SANITIZER_INTERFACE_WEAK_DEF(void, __sanitizer_cov_trace_gep, void) {} |
| SANITIZER_INTERFACE_WEAK_DEF(void, __sanitizer_cov_trace_pc_indir, void) {} |
| SANITIZER_INTERFACE_WEAK_DEF(void, __sanitizer_cov_load1, void){} |
| SANITIZER_INTERFACE_WEAK_DEF(void, __sanitizer_cov_load2, void){} |
| SANITIZER_INTERFACE_WEAK_DEF(void, __sanitizer_cov_load4, void){} |
| SANITIZER_INTERFACE_WEAK_DEF(void, __sanitizer_cov_load8, void){} |
| SANITIZER_INTERFACE_WEAK_DEF(void, __sanitizer_cov_load16, void){} |
| SANITIZER_INTERFACE_WEAK_DEF(void, __sanitizer_cov_store1, void){} |
| SANITIZER_INTERFACE_WEAK_DEF(void, __sanitizer_cov_store2, void){} |
| SANITIZER_INTERFACE_WEAK_DEF(void, __sanitizer_cov_store4, void){} |
| SANITIZER_INTERFACE_WEAK_DEF(void, __sanitizer_cov_store8, void){} |
| SANITIZER_INTERFACE_WEAK_DEF(void, __sanitizer_cov_store16, void){} |
| SANITIZER_INTERFACE_WEAK_DEF(void, __sanitizer_cov_8bit_counters_init, |
| char* start, char* end) { |
| __sancov::SingletonCounterCoverage::Cov8bitCountersInit(start, end); |
| } |
| SANITIZER_INTERFACE_WEAK_DEF(void, __sanitizer_cov_bool_flag_init, void) {} |
| SANITIZER_INTERFACE_WEAK_DEF(void, __sanitizer_cov_pcs_init, const uptr* beg, |
| const uptr* end) { |
| __sancov::SingletonCounterCoverage::CovPcsInit(beg, end); |
| } |
| } // extern "C" |
| // Weak definition for code instrumented with -fsanitize-coverage=stack-depth |
| // and later linked with code containing a strong definition. |
| // E.g., -fsanitize=fuzzer-no-link |
| // FIXME: Update Apple deployment target so that thread_local is always |
| // supported, and remove the #if. |
| // FIXME: Figure out how this should work on Windows, exported thread_local |
| // symbols are not supported: |
| // "data with thread storage duration may not have dll interface" |
| #if !SANITIZER_APPLE && !SANITIZER_WINDOWS |
| SANITIZER_INTERFACE_ATTRIBUTE SANITIZER_WEAK_ATTRIBUTE |
| thread_local uptr __sancov_lowest_stack; |
| #endif |
| |
| #endif // !SANITIZER_FUCHSIA |