From 60cdd6113f5c94f2cf076008ff46e024b35da300 Mon Sep 17 00:00:00 2001 From: Kostya Serebryany Date: Wed, 14 Sep 2016 01:39:49 +0000 Subject: [PATCH] [sanitizer-coverage] add yet another flavour of coverage instrumentation: trace-pc-guard. The intent is to eventually replace all of {bool coverage, 8bit-counters, trace-pc} with just this one. Clang part llvm-svn: 281432 --- clang/docs/SanitizerCoverage.rst | 26 +++++++++++++++++++++++++ clang/include/clang/Driver/CC1Options.td | 3 +++ clang/include/clang/Frontend/CodeGenOptions.def | 2 ++ clang/lib/CodeGen/BackendUtil.cpp | 1 + clang/lib/Driver/SanitizerArgs.cpp | 7 +++++-- clang/lib/Frontend/CompilerInvocation.cpp | 2 ++ clang/test/Driver/fsanitize-coverage.c | 8 ++++++++ 7 files changed, 47 insertions(+), 2 deletions(-) diff --git a/clang/docs/SanitizerCoverage.rst b/clang/docs/SanitizerCoverage.rst index 9673416..e4d8567 100644 --- a/clang/docs/SanitizerCoverage.rst +++ b/clang/docs/SanitizerCoverage.rst @@ -321,6 +321,32 @@ by the user. So, these flags do not require the other sanitizer to be used. This mechanism is used for fuzzing the Linux kernel (https://github.com/google/syzkaller) and can be used with `AFL `__. +Tracing PCs with guards +======================= +Another *experimental* feature that tries to combine `trace-pc`, +`8bit-counters` and boolean coverage + +With ``-fsanitize-coverage=trace-pc-guard`` the compiler will insert the following code +on every edge: + +.. code-block:: none + + if (guard_variable != 0xff) + __sanitizer_cov_trace_pc_guard(&guard_variable) + +Every edge will have its own 1-byte `guard_variable`. +All such guard variables will reside in a dedicated section +(i.e. they essentially form an array). + +The compler will also insert a module constructor that will call + +.. code-block:: c++ + + // The guard section is the address range [start, stop). + __sanitizer_cov_trace_pc_guard_init(void *start, void *stop); + +The functions `__sanitizer_cov_trace_pc_guard[_init]` should be defined by the user. + Tracing data flow ================= diff --git a/clang/include/clang/Driver/CC1Options.td b/clang/include/clang/Driver/CC1Options.td index cb22cdf..65abc8f2 100644 --- a/clang/include/clang/Driver/CC1Options.td +++ b/clang/include/clang/Driver/CC1Options.td @@ -289,6 +289,9 @@ def fsanitize_coverage_8bit_counters def fsanitize_coverage_trace_pc : Flag<["-"], "fsanitize-coverage-trace-pc">, HelpText<"Enable PC tracing in sanitizer coverage">; +def fsanitize_coverage_trace_pc_guard + : Flag<["-"], "fsanitize-coverage-trace-pc-guard">, + HelpText<"Enable PC tracing with guard in sanitizer coverage">; def fprofile_instrument_EQ : Joined<["-"], "fprofile-instrument=">, HelpText<"Enable PGO instrumentation. The accepted value is clang, llvm, " "or none">; diff --git a/clang/include/clang/Frontend/CodeGenOptions.def b/clang/include/clang/Frontend/CodeGenOptions.def index 5ebbc2c..81307ac 100644 --- a/clang/include/clang/Frontend/CodeGenOptions.def +++ b/clang/include/clang/Frontend/CodeGenOptions.def @@ -160,6 +160,8 @@ CODEGENOPT(SanitizeCoverage8bitCounters, 1, 0) ///< Use 8-bit frequency counters ///< in sanitizer coverage. CODEGENOPT(SanitizeCoverageTracePC, 1, 0) ///< Enable PC tracing ///< in sanitizer coverage. +CODEGENOPT(SanitizeCoverageTracePCGuard, 1, 0) ///< Enable PC tracing with guard + ///< in sanitizer coverage. CODEGENOPT(SanitizeStats , 1, 0) ///< Collect statistics for sanitizers. CODEGENOPT(SimplifyLibCalls , 1, 1) ///< Set when -fbuiltin is enabled. CODEGENOPT(SoftFloat , 1, 0) ///< -soft-float. diff --git a/clang/lib/CodeGen/BackendUtil.cpp b/clang/lib/CodeGen/BackendUtil.cpp index 91c8ded..886221d 100644 --- a/clang/lib/CodeGen/BackendUtil.cpp +++ b/clang/lib/CodeGen/BackendUtil.cpp @@ -180,6 +180,7 @@ static void addSanitizerCoveragePass(const PassManagerBuilder &Builder, Opts.TraceGep = CGOpts.SanitizeCoverageTraceGep; Opts.Use8bitCounters = CGOpts.SanitizeCoverage8bitCounters; Opts.TracePC = CGOpts.SanitizeCoverageTracePC; + Opts.TracePCGuard = CGOpts.SanitizeCoverageTracePCGuard; PM.add(createSanitizerCoverageModulePass(Opts)); } diff --git a/clang/lib/Driver/SanitizerArgs.cpp b/clang/lib/Driver/SanitizerArgs.cpp index 5c9abd1..8ba8e53 100644 --- a/clang/lib/Driver/SanitizerArgs.cpp +++ b/clang/lib/Driver/SanitizerArgs.cpp @@ -53,6 +53,7 @@ enum CoverageFeature { CoverageTraceGep = 1 << 7, Coverage8bitCounters = 1 << 8, CoverageTracePC = 1 << 9, + CoverageTracePCGuard = 1 << 10, }; /// Parse a -fsanitize= or -fno-sanitize= argument's values, diagnosing any @@ -526,7 +527,7 @@ SanitizerArgs::SanitizerArgs(const ToolChain &TC, << "-fsanitize-coverage=8bit-counters" << "-fsanitize-coverage=(func|bb|edge)"; // trace-pc w/o func/bb/edge implies edge. - if ((CoverageFeatures & CoverageTracePC) && + if ((CoverageFeatures & (CoverageTracePC | CoverageTracePCGuard)) && !(CoverageFeatures & CoverageTypes)) CoverageFeatures |= CoverageEdge; @@ -620,7 +621,8 @@ void SanitizerArgs::addArgs(const ToolChain &TC, const llvm::opt::ArgList &Args, std::make_pair(CoverageTraceDiv, "-fsanitize-coverage-trace-div"), std::make_pair(CoverageTraceGep, "-fsanitize-coverage-trace-gep"), std::make_pair(Coverage8bitCounters, "-fsanitize-coverage-8bit-counters"), - std::make_pair(CoverageTracePC, "-fsanitize-coverage-trace-pc")}; + std::make_pair(CoverageTracePC, "-fsanitize-coverage-trace-pc"), + std::make_pair(CoverageTracePCGuard, "-fsanitize-coverage-trace-pc-guard")}; for (auto F : CoverageFlags) { if (CoverageFeatures & F.first) CmdArgs.push_back(Args.MakeArgString(F.second)); @@ -760,6 +762,7 @@ int parseCoverageFeatures(const Driver &D, const llvm::opt::Arg *A) { .Case("trace-gep", CoverageTraceGep) .Case("8bit-counters", Coverage8bitCounters) .Case("trace-pc", CoverageTracePC) + .Case("trace-pc-guard", CoverageTracePCGuard) .Default(0); if (F == 0) D.Diag(clang::diag::err_drv_unsupported_option_argument) diff --git a/clang/lib/Frontend/CompilerInvocation.cpp b/clang/lib/Frontend/CompilerInvocation.cpp index 1536738..c3fbda1 100644 --- a/clang/lib/Frontend/CompilerInvocation.cpp +++ b/clang/lib/Frontend/CompilerInvocation.cpp @@ -724,6 +724,8 @@ static bool ParseCodeGenArgs(CodeGenOptions &Opts, ArgList &Args, InputKind IK, Opts.SanitizeCoverage8bitCounters = Args.hasArg(OPT_fsanitize_coverage_8bit_counters); Opts.SanitizeCoverageTracePC = Args.hasArg(OPT_fsanitize_coverage_trace_pc); + Opts.SanitizeCoverageTracePCGuard = + Args.hasArg(OPT_fsanitize_coverage_trace_pc_guard); Opts.SanitizeMemoryTrackOrigins = getLastArgIntValue(Args, OPT_fsanitize_memory_track_origins_EQ, 0, Diags); Opts.SanitizeMemoryUseAfterDtor = diff --git a/clang/test/Driver/fsanitize-coverage.c b/clang/test/Driver/fsanitize-coverage.c index 1efb1e4..b04e71e 100644 --- a/clang/test/Driver/fsanitize-coverage.c +++ b/clang/test/Driver/fsanitize-coverage.c @@ -72,6 +72,14 @@ // CHECK-TRACE_PC_FUNC: -fsanitize-coverage-type=1 // CHECK-TRACE_PC_FUNC: -fsanitize-coverage-trace-pc +// RUN: %clang -target x86_64-linux-gnu -fsanitize-coverage=trace-pc-guard %s -### 2>&1 | FileCheck %s --check-prefix=CHECK-TRACE_PC_GUARD_EDGE +// RUN: %clang -target x86_64-linux-gnu -fsanitize-coverage=edge,trace-pc-guard %s -### 2>&1 | FileCheck %s --check-prefix=CHECK-TRACE_PC_GUARD_EDGE +// CHECK-TRACE_PC_GUARD_EDGE: -fsanitize-coverage-type=3 +// CHECK-TRACE_PC_GUARD_EDGE: -fsanitize-coverage-trace-pc-guard +// RUN: %clang -target x86_64-linux-gnu -fsanitize-coverage=func,trace-pc-guard %s -### 2>&1 | FileCheck %s --check-prefix=CHECK-TRACE_PC_GUARD_FUNC +// CHECK-TRACE_PC_GUARD_FUNC: -fsanitize-coverage-type=1 +// CHECK-TRACE_PC_GUARD_FUNC: -fsanitize-coverage-trace-pc-guard + // RUN: %clang -target x86_64-linux-gnu -fsanitize=address -fsanitize-coverage=trace-cmp,indirect-calls %s -### 2>&1 | FileCheck %s --check-prefix=CHECK-NO-TYPE-NECESSARY // CHECK-NO-TYPE-NECESSARY-NOT: error: // CHECK-NO-TYPE-NECESSARY: -fsanitize-coverage-indirect-calls -- 2.7.4