1 //===-- sanitizer_coverage_libcdep_new.cpp --------------------------------===//
2 //
3 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4 // See https://llvm.org/LICENSE.txt for license information.
5 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6 //
7 //===----------------------------------------------------------------------===//
8 // Sanitizer Coverage Controller for Trace PC Guard.
9
10 #include "sanitizer_platform.h"
11
12 #if !SANITIZER_FUCHSIA
13 #include "sancov_flags.h"
14 #include "sanitizer_allocator_internal.h"
15 #include "sanitizer_atomic.h"
16 #include "sanitizer_common.h"
17 #include "sanitizer_file.h"
18
19 using namespace __sanitizer;
20
21 using AddressRange = LoadedModule::AddressRange;
22
23 namespace __sancov {
24 namespace {
25
26 static const u64 Magic64 = 0xC0BFFFFFFFFFFF64ULL;
27 static const u64 Magic32 = 0xC0BFFFFFFFFFFF32ULL;
28 static const u64 Magic = SANITIZER_WORDSIZE == 64 ? Magic64 : Magic32;
29
OpenFile(const char * path)30 static fd_t OpenFile(const char* path) {
31 error_t err;
32 fd_t fd = OpenFile(path, WrOnly, &err);
33 if (fd == kInvalidFd)
34 Report("SanitizerCoverage: failed to open %s for writing (reason: %d)\n",
35 path, err);
36 return fd;
37 }
38
GetCoverageFilename(char * path,const char * name,const char * extension)39 static void GetCoverageFilename(char* path, const char* name,
40 const char* extension) {
41 CHECK(name);
42 internal_snprintf(path, kMaxPathLength, "%s/%s.%zd.%s",
43 common_flags()->coverage_dir, name, internal_getpid(),
44 extension);
45 }
46
WriteModuleCoverage(char * file_path,const char * module_name,const uptr * pcs,uptr len)47 static void WriteModuleCoverage(char* file_path, const char* module_name,
48 const uptr* pcs, uptr len) {
49 GetCoverageFilename(file_path, StripModuleName(module_name), "sancov");
50 fd_t fd = OpenFile(file_path);
51 WriteToFile(fd, &Magic, sizeof(Magic));
52 WriteToFile(fd, pcs, len * sizeof(*pcs));
53 CloseFile(fd);
54 Printf("SanitizerCoverage: %s: %zd PCs written\n", file_path, len);
55 }
56
SanitizerDumpCoverage(const uptr * unsorted_pcs,uptr len)57 static void SanitizerDumpCoverage(const uptr* unsorted_pcs, uptr len) {
58 if (!len) return;
59
60 char* file_path = static_cast<char*>(InternalAlloc(kMaxPathLength));
61 char* module_name = static_cast<char*>(InternalAlloc(kMaxPathLength));
62 uptr* pcs = static_cast<uptr*>(InternalAlloc(len * sizeof(uptr)));
63
64 internal_memcpy(pcs, unsorted_pcs, len * sizeof(uptr));
65 Sort(pcs, len);
66
67 bool module_found = false;
68 uptr last_base = 0;
69 uptr module_start_idx = 0;
70
71 for (uptr i = 0; i < len; ++i) {
72 const uptr pc = pcs[i];
73 if (!pc) continue;
74
75 if (!__sanitizer_get_module_and_offset_for_pc(pc, nullptr, 0, &pcs[i])) {
76 Printf("ERROR: unknown pc 0x%zx (may happen if dlclose is used)\n", pc);
77 continue;
78 }
79 uptr module_base = pc - pcs[i];
80
81 if (module_base != last_base || !module_found) {
82 if (module_found) {
83 WriteModuleCoverage(file_path, module_name, &pcs[module_start_idx],
84 i - module_start_idx);
85 }
86
87 last_base = module_base;
88 module_start_idx = i;
89 module_found = true;
90 __sanitizer_get_module_and_offset_for_pc(pc, module_name, kMaxPathLength,
91 &pcs[i]);
92 }
93 }
94
95 if (module_found) {
96 WriteModuleCoverage(file_path, module_name, &pcs[module_start_idx],
97 len - module_start_idx);
98 }
99
100 InternalFree(file_path);
101 InternalFree(module_name);
102 InternalFree(pcs);
103 }
104
105 // Collects trace-pc guard coverage.
106 // This class relies on zero-initialization.
107 class TracePcGuardController {
108 public:
Initialize()109 void Initialize() {
110 CHECK(!initialized);
111
112 initialized = true;
113 InitializeSancovFlags();
114
115 pc_vector.Initialize(0);
116 }
117
InitTracePcGuard(u32 * start,u32 * end)118 void InitTracePcGuard(u32* start, u32* end) {
119 if (!initialized) Initialize();
120 CHECK(!*start);
121 CHECK_NE(start, end);
122
123 u32 i = pc_vector.size();
124 for (u32* p = start; p < end; p++) *p = ++i;
125 pc_vector.resize(i);
126 }
127
TracePcGuard(u32 * guard,uptr pc)128 void TracePcGuard(u32* guard, uptr pc) {
129 u32 idx = *guard;
130 if (!idx) return;
131 // we start indices from 1.
132 atomic_uintptr_t* pc_ptr =
133 reinterpret_cast<atomic_uintptr_t*>(&pc_vector[idx - 1]);
134 if (atomic_load(pc_ptr, memory_order_relaxed) == 0)
135 atomic_store(pc_ptr, pc, memory_order_relaxed);
136 }
137
Reset()138 void Reset() {
139 internal_memset(&pc_vector[0], 0, sizeof(pc_vector[0]) * pc_vector.size());
140 }
141
Dump()142 void Dump() {
143 if (!initialized || !common_flags()->coverage) return;
144 __sanitizer_dump_coverage(pc_vector.data(), pc_vector.size());
145 }
146
147 private:
148 bool initialized;
149 InternalMmapVectorNoCtor<uptr> pc_vector;
150 };
151
152 static TracePcGuardController pc_guard_controller;
153
154 // A basic default implementation of callbacks for
155 // -fsanitize-coverage=inline-8bit-counters,pc-table.
156 // Use TOOL_OPTIONS (UBSAN_OPTIONS, etc) to dump the coverage data:
157 // * cov_8bit_counters_out=PATH to dump the 8bit counters.
158 // * cov_pcs_out=PATH to dump the pc table.
159 //
160 // Most users will still need to define their own callbacks for greater
161 // flexibility.
162 namespace SingletonCounterCoverage {
163
164 static char *counters_beg, *counters_end;
165 static const uptr *pcs_beg, *pcs_end;
166
DumpCoverage()167 static void DumpCoverage() {
168 const char* file_path = common_flags()->cov_8bit_counters_out;
169 if (file_path && internal_strlen(file_path)) {
170 fd_t fd = OpenFile(file_path);
171 FileCloser file_closer(fd);
172 uptr size = counters_end - counters_beg;
173 WriteToFile(fd, counters_beg, size);
174 if (common_flags()->verbosity)
175 __sanitizer::Printf("cov_8bit_counters_out: written %zd bytes to %s\n",
176 size, file_path);
177 }
178 file_path = common_flags()->cov_pcs_out;
179 if (file_path && internal_strlen(file_path)) {
180 fd_t fd = OpenFile(file_path);
181 FileCloser file_closer(fd);
182 uptr size = (pcs_end - pcs_beg) * sizeof(uptr);
183 WriteToFile(fd, pcs_beg, size);
184 if (common_flags()->verbosity)
185 __sanitizer::Printf("cov_pcs_out: written %zd bytes to %s\n", size,
186 file_path);
187 }
188 }
189
Cov8bitCountersInit(char * beg,char * end)190 static void Cov8bitCountersInit(char* beg, char* end) {
191 counters_beg = beg;
192 counters_end = end;
193 Atexit(DumpCoverage);
194 }
195
CovPcsInit(const uptr * beg,const uptr * end)196 static void CovPcsInit(const uptr* beg, const uptr* end) {
197 pcs_beg = beg;
198 pcs_end = end;
199 }
200
201 } // namespace SingletonCounterCoverage
202
203 } // namespace
204 } // namespace __sancov
205
206 namespace __sanitizer {
InitializeCoverage(bool enabled,const char * dir)207 void InitializeCoverage(bool enabled, const char *dir) {
208 static bool coverage_enabled = false;
209 if (coverage_enabled)
210 return; // May happen if two sanitizer enable coverage in the same process.
211 coverage_enabled = enabled;
212 Atexit(__sanitizer_cov_dump);
213 AddDieCallback(__sanitizer_cov_dump);
214 }
215 } // namespace __sanitizer
216
217 extern "C" {
__sanitizer_dump_coverage(const uptr * pcs,uptr len)218 SANITIZER_INTERFACE_ATTRIBUTE void __sanitizer_dump_coverage(const uptr* pcs,
219 uptr len) {
220 return __sancov::SanitizerDumpCoverage(pcs, len);
221 }
222
SANITIZER_INTERFACE_WEAK_DEF(void,__sanitizer_cov_trace_pc_guard,u32 * guard)223 SANITIZER_INTERFACE_WEAK_DEF(void, __sanitizer_cov_trace_pc_guard, u32* guard) {
224 if (!*guard) return;
225 __sancov::pc_guard_controller.TracePcGuard(guard, GET_CALLER_PC() - 1);
226 }
227
SANITIZER_INTERFACE_WEAK_DEF(void,__sanitizer_cov_trace_pc_guard_init,u32 * start,u32 * end)228 SANITIZER_INTERFACE_WEAK_DEF(void, __sanitizer_cov_trace_pc_guard_init,
229 u32* start, u32* end) {
230 if (start == end || *start) return;
231 __sancov::pc_guard_controller.InitTracePcGuard(start, end);
232 }
233
__sanitizer_dump_trace_pc_guard_coverage()234 SANITIZER_INTERFACE_ATTRIBUTE void __sanitizer_dump_trace_pc_guard_coverage() {
235 __sancov::pc_guard_controller.Dump();
236 }
__sanitizer_cov_dump()237 SANITIZER_INTERFACE_ATTRIBUTE void __sanitizer_cov_dump() {
238 __sanitizer_dump_trace_pc_guard_coverage();
239 }
__sanitizer_cov_reset()240 SANITIZER_INTERFACE_ATTRIBUTE void __sanitizer_cov_reset() {
241 __sancov::pc_guard_controller.Reset();
242 }
243 // Default implementations (weak).
244 // Either empty or very simple.
245 // Most users should redefine them.
SANITIZER_INTERFACE_WEAK_DEF(void,__sanitizer_cov_trace_cmp,void)246 SANITIZER_INTERFACE_WEAK_DEF(void, __sanitizer_cov_trace_cmp, void) {}
SANITIZER_INTERFACE_WEAK_DEF(void,__sanitizer_cov_trace_cmp1,void)247 SANITIZER_INTERFACE_WEAK_DEF(void, __sanitizer_cov_trace_cmp1, void) {}
SANITIZER_INTERFACE_WEAK_DEF(void,__sanitizer_cov_trace_cmp2,void)248 SANITIZER_INTERFACE_WEAK_DEF(void, __sanitizer_cov_trace_cmp2, void) {}
SANITIZER_INTERFACE_WEAK_DEF(void,__sanitizer_cov_trace_cmp4,void)249 SANITIZER_INTERFACE_WEAK_DEF(void, __sanitizer_cov_trace_cmp4, void) {}
SANITIZER_INTERFACE_WEAK_DEF(void,__sanitizer_cov_trace_cmp8,void)250 SANITIZER_INTERFACE_WEAK_DEF(void, __sanitizer_cov_trace_cmp8, void) {}
SANITIZER_INTERFACE_WEAK_DEF(void,__sanitizer_cov_trace_const_cmp1,void)251 SANITIZER_INTERFACE_WEAK_DEF(void, __sanitizer_cov_trace_const_cmp1, void) {}
SANITIZER_INTERFACE_WEAK_DEF(void,__sanitizer_cov_trace_const_cmp2,void)252 SANITIZER_INTERFACE_WEAK_DEF(void, __sanitizer_cov_trace_const_cmp2, void) {}
SANITIZER_INTERFACE_WEAK_DEF(void,__sanitizer_cov_trace_const_cmp4,void)253 SANITIZER_INTERFACE_WEAK_DEF(void, __sanitizer_cov_trace_const_cmp4, void) {}
SANITIZER_INTERFACE_WEAK_DEF(void,__sanitizer_cov_trace_const_cmp8,void)254 SANITIZER_INTERFACE_WEAK_DEF(void, __sanitizer_cov_trace_const_cmp8, void) {}
SANITIZER_INTERFACE_WEAK_DEF(void,__sanitizer_cov_trace_switch,void)255 SANITIZER_INTERFACE_WEAK_DEF(void, __sanitizer_cov_trace_switch, void) {}
SANITIZER_INTERFACE_WEAK_DEF(void,__sanitizer_cov_trace_div4,void)256 SANITIZER_INTERFACE_WEAK_DEF(void, __sanitizer_cov_trace_div4, void) {}
SANITIZER_INTERFACE_WEAK_DEF(void,__sanitizer_cov_trace_div8,void)257 SANITIZER_INTERFACE_WEAK_DEF(void, __sanitizer_cov_trace_div8, void) {}
SANITIZER_INTERFACE_WEAK_DEF(void,__sanitizer_cov_trace_gep,void)258 SANITIZER_INTERFACE_WEAK_DEF(void, __sanitizer_cov_trace_gep, void) {}
SANITIZER_INTERFACE_WEAK_DEF(void,__sanitizer_cov_trace_pc_indir,void)259 SANITIZER_INTERFACE_WEAK_DEF(void, __sanitizer_cov_trace_pc_indir, void) {}
SANITIZER_INTERFACE_WEAK_DEF(void,__sanitizer_cov_8bit_counters_init,char * start,char * end)260 SANITIZER_INTERFACE_WEAK_DEF(void, __sanitizer_cov_8bit_counters_init,
261 char* start, char* end) {
262 __sancov::SingletonCounterCoverage::Cov8bitCountersInit(start, end);
263 }
SANITIZER_INTERFACE_WEAK_DEF(void,__sanitizer_cov_bool_flag_init,void)264 SANITIZER_INTERFACE_WEAK_DEF(void, __sanitizer_cov_bool_flag_init, void) {}
SANITIZER_INTERFACE_WEAK_DEF(void,__sanitizer_cov_pcs_init,const uptr * beg,const uptr * end)265 SANITIZER_INTERFACE_WEAK_DEF(void, __sanitizer_cov_pcs_init, const uptr* beg,
266 const uptr* end) {
267 __sancov::SingletonCounterCoverage::CovPcsInit(beg, end);
268 }
269 } // extern "C"
270 // Weak definition for code instrumented with -fsanitize-coverage=stack-depth
271 // and later linked with code containing a strong definition.
272 // E.g., -fsanitize=fuzzer-no-link
273 SANITIZER_INTERFACE_ATTRIBUTE SANITIZER_WEAK_ATTRIBUTE
274 SANITIZER_TLS_INITIAL_EXEC_ATTRIBUTE uptr __sancov_lowest_stack;
275
276 #endif // !SANITIZER_FUCHSIA
277