1 //===-- sanitizer_coverage_fuchsia.cpp ------------------------------------===//
2 //
3 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4 // See https://llvm.org/LICENSE.txt for license information.
5 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6 //
7 //===----------------------------------------------------------------------===//
8 //
9 // Sanitizer Coverage Controller for Trace PC Guard, Fuchsia-specific version.
10 //
11 // This Fuchsia-specific implementation uses the same basic scheme and the
12 // same simple '.sancov' file format as the generic implementation.  The
13 // difference is that we just produce a single blob of output for the whole
14 // program, not a separate one per DSO.  We do not sort the PC table and do
15 // not prune the zeros, so the resulting file is always as large as it
16 // would be to report 100% coverage.  Implicit tracing information about
17 // the address ranges of DSOs allows offline tools to split the one big
18 // blob into separate files that the 'sancov' tool can understand.
19 //
20 // Unlike the traditional implementation that uses an atexit hook to write
21 // out data files at the end, the results on Fuchsia do not go into a file
22 // per se.  The 'coverage_dir' option is ignored.  Instead, they are stored
23 // directly into a shared memory object (a Zircon VMO).  At exit, that VMO
24 // is handed over to a system service that's responsible for getting the
25 // data out to somewhere that it can be fed into the sancov tool (where and
26 // how is not our problem).
27 
28 #include "sanitizer_platform.h"
29 #if SANITIZER_FUCHSIA
30 #include <zircon/process.h>
31 #include <zircon/sanitizer.h>
32 #include <zircon/syscalls.h>
33 
34 #include "sanitizer_atomic.h"
35 #include "sanitizer_common.h"
36 #include "sanitizer_internal_defs.h"
37 #include "sanitizer_symbolizer_fuchsia.h"
38 
39 using namespace __sanitizer;
40 
41 namespace __sancov {
42 namespace {
43 
44 // TODO(mcgrathr): Move the constant into a header shared with other impls.
45 constexpr u64 Magic64 = 0xC0BFFFFFFFFFFF64ULL;
46 static_assert(SANITIZER_WORDSIZE == 64, "Fuchsia is always LP64");
47 
48 constexpr const char kSancovSinkName[] = "sancov";
49 
50 // Collects trace-pc guard coverage.
51 // This class relies on zero-initialization.
52 class TracePcGuardController final {
53  public:
54   constexpr TracePcGuardController() {}
55 
56   // For each PC location being tracked, there is a u32 reserved in global
57   // data called the "guard".  At startup, we assign each guard slot a
58   // unique index into the big results array.  Later during runtime, the
59   // first call to TracePcGuard (below) will store the corresponding PC at
60   // that index in the array.  (Each later call with the same guard slot is
61   // presumed to be from the same PC.)  Then it clears the guard slot back
62   // to zero, which tells the compiler not to bother calling in again.  At
63   // the end of the run, we have a big array where each element is either
64   // zero or is a tracked PC location that was hit in the trace.
65 
66   // This is called from global constructors.  Each translation unit has a
67   // contiguous array of guard slots, and a constructor that calls here
68   // with the bounds of its array.  Those constructors are allowed to call
69   // here more than once for the same array.  Usually all of these
70   // constructors run in the initial thread, but it's possible that a
71   // dlopen call on a secondary thread will run constructors that get here.
72   void InitTracePcGuard(u32 *start, u32 *end) {
73     if (end > start && *start == 0 && common_flags()->coverage) {
74       // Complete the setup before filling in any guards with indices.
75       // This avoids the possibility of code called from Setup reentering
76       // TracePcGuard.
77       u32 idx = Setup(end - start);
78       for (u32 *p = start; p < end; ++p) {
79         *p = idx++;
80       }
81     }
82   }
83 
84   void TracePcGuard(u32 *guard, uptr pc) {
85     atomic_uint32_t *guard_ptr = reinterpret_cast<atomic_uint32_t *>(guard);
86     u32 idx = atomic_exchange(guard_ptr, 0, memory_order_relaxed);
87     if (idx > 0)
88       array_[idx] = pc;
89   }
90 
91   void Dump() {
92     Lock locked(&setup_lock_);
93     if (array_) {
94       CHECK_NE(vmo_, ZX_HANDLE_INVALID);
95 
96       // Publish the VMO to the system, where it can be collected and
97       // analyzed after this process exits.  This always consumes the VMO
98       // handle.  Any failure is just logged and not indicated to us.
99       __sanitizer_publish_data(kSancovSinkName, vmo_);
100       vmo_ = ZX_HANDLE_INVALID;
101 
102       // This will route to __sanitizer_log_write, which will ensure that
103       // information about shared libraries is written out.  This message
104       // uses the `dumpfile` symbolizer markup element to highlight the
105       // dump.  See the explanation for this in:
106       // https://fuchsia.googlesource.com/zircon/+/master/docs/symbolizer_markup.md
107       Printf("SanitizerCoverage: " FORMAT_DUMPFILE " with up to %u PCs\n",
108              kSancovSinkName, vmo_name_, next_index_ - 1);
109     }
110   }
111 
112  private:
113   // We map in the largest possible view into the VMO: one word
114   // for every possible 32-bit index value.  This avoids the need
115   // to change the mapping when increasing the size of the VMO.
116   // We can always spare the 32G of address space.
117   static constexpr size_t MappingSize = sizeof(uptr) << 32;
118 
119   Mutex setup_lock_;
120   uptr *array_ = nullptr;
121   u32 next_index_ = 0;
122   zx_handle_t vmo_ = {};
123   char vmo_name_[ZX_MAX_NAME_LEN] = {};
124 
125   size_t DataSize() const { return next_index_ * sizeof(uintptr_t); }
126 
127   u32 Setup(u32 num_guards) {
128     Lock locked(&setup_lock_);
129     DCHECK(common_flags()->coverage);
130 
131     if (next_index_ == 0) {
132       CHECK_EQ(vmo_, ZX_HANDLE_INVALID);
133       CHECK_EQ(array_, nullptr);
134 
135       // The first sample goes at [1] to reserve [0] for the magic number.
136       next_index_ = 1 + num_guards;
137 
138       zx_status_t status = _zx_vmo_create(DataSize(), ZX_VMO_RESIZABLE, &vmo_);
139       CHECK_EQ(status, ZX_OK);
140 
141       // Give the VMO a name including our process KOID so it's easy to spot.
142       internal_snprintf(vmo_name_, sizeof(vmo_name_), "%s.%zu", kSancovSinkName,
143                         internal_getpid());
144       _zx_object_set_property(vmo_, ZX_PROP_NAME, vmo_name_,
145                               internal_strlen(vmo_name_));
146       uint64_t size = DataSize();
147       status = _zx_object_set_property(vmo_, ZX_PROP_VMO_CONTENT_SIZE, &size,
148                                        sizeof(size));
149       CHECK_EQ(status, ZX_OK);
150 
151       // Map the largest possible view we might need into the VMO.  Later
152       // we might need to increase the VMO's size before we can use larger
153       // indices, but we'll never move the mapping address so we don't have
154       // any multi-thread synchronization issues with that.
155       uintptr_t mapping;
156       status =
157           _zx_vmar_map(_zx_vmar_root_self(), ZX_VM_PERM_READ | ZX_VM_PERM_WRITE,
158                        0, vmo_, 0, MappingSize, &mapping);
159       CHECK_EQ(status, ZX_OK);
160 
161       // Hereafter other threads are free to start storing into
162       // elements [1, next_index_) of the big array.
163       array_ = reinterpret_cast<uptr *>(mapping);
164 
165       // Store the magic number.
166       // Hereafter, the VMO serves as the contents of the '.sancov' file.
167       array_[0] = Magic64;
168 
169       return 1;
170     } else {
171       // The VMO is already mapped in, but it's not big enough to use the
172       // new indices.  So increase the size to cover the new maximum index.
173 
174       CHECK_NE(vmo_, ZX_HANDLE_INVALID);
175       CHECK_NE(array_, nullptr);
176 
177       uint32_t first_index = next_index_;
178       next_index_ += num_guards;
179 
180       zx_status_t status = _zx_vmo_set_size(vmo_, DataSize());
181       CHECK_EQ(status, ZX_OK);
182       uint64_t size = DataSize();
183       status = _zx_object_set_property(vmo_, ZX_PROP_VMO_CONTENT_SIZE, &size,
184                                        sizeof(size));
185       CHECK_EQ(status, ZX_OK);
186 
187       return first_index;
188     }
189   }
190 };
191 
192 static TracePcGuardController pc_guard_controller;
193 
194 }  // namespace
195 }  // namespace __sancov
196 
197 namespace __sanitizer {
198 void InitializeCoverage(bool enabled, const char *dir) {
199   CHECK_EQ(enabled, common_flags()->coverage);
200   CHECK_EQ(dir, common_flags()->coverage_dir);
201 
202   static bool coverage_enabled = false;
203   if (!coverage_enabled) {
204     coverage_enabled = enabled;
205     Atexit(__sanitizer_cov_dump);
206     AddDieCallback(__sanitizer_cov_dump);
207   }
208 }
209 }  // namespace __sanitizer
210 
211 extern "C" {
212 SANITIZER_INTERFACE_ATTRIBUTE void __sanitizer_dump_coverage(const uptr *pcs,
213                                                              uptr len) {
214   UNIMPLEMENTED();
215 }
216 
217 SANITIZER_INTERFACE_WEAK_DEF(void, __sanitizer_cov_trace_pc_guard, u32 *guard) {
218   if (!*guard)
219     return;
220   __sancov::pc_guard_controller.TracePcGuard(guard, GET_CALLER_PC() - 1);
221 }
222 
223 SANITIZER_INTERFACE_WEAK_DEF(void, __sanitizer_cov_trace_pc_guard_init,
224                              u32 *start, u32 *end) {
225   if (start == end || *start)
226     return;
227   __sancov::pc_guard_controller.InitTracePcGuard(start, end);
228 }
229 
230 SANITIZER_INTERFACE_ATTRIBUTE void __sanitizer_dump_trace_pc_guard_coverage() {
231   __sancov::pc_guard_controller.Dump();
232 }
233 SANITIZER_INTERFACE_ATTRIBUTE void __sanitizer_cov_dump() {
234   __sanitizer_dump_trace_pc_guard_coverage();
235 }
236 // Default empty implementations (weak). Users should redefine them.
237 SANITIZER_INTERFACE_WEAK_DEF(void, __sanitizer_cov_trace_cmp, void) {}
238 SANITIZER_INTERFACE_WEAK_DEF(void, __sanitizer_cov_trace_cmp1, void) {}
239 SANITIZER_INTERFACE_WEAK_DEF(void, __sanitizer_cov_trace_cmp2, void) {}
240 SANITIZER_INTERFACE_WEAK_DEF(void, __sanitizer_cov_trace_cmp4, void) {}
241 SANITIZER_INTERFACE_WEAK_DEF(void, __sanitizer_cov_trace_cmp8, void) {}
242 SANITIZER_INTERFACE_WEAK_DEF(void, __sanitizer_cov_trace_const_cmp1, void) {}
243 SANITIZER_INTERFACE_WEAK_DEF(void, __sanitizer_cov_trace_const_cmp2, void) {}
244 SANITIZER_INTERFACE_WEAK_DEF(void, __sanitizer_cov_trace_const_cmp4, void) {}
245 SANITIZER_INTERFACE_WEAK_DEF(void, __sanitizer_cov_trace_const_cmp8, void) {}
246 SANITIZER_INTERFACE_WEAK_DEF(void, __sanitizer_cov_trace_switch, void) {}
247 SANITIZER_INTERFACE_WEAK_DEF(void, __sanitizer_cov_trace_div4, void) {}
248 SANITIZER_INTERFACE_WEAK_DEF(void, __sanitizer_cov_trace_div8, void) {}
249 SANITIZER_INTERFACE_WEAK_DEF(void, __sanitizer_cov_trace_gep, void) {}
250 SANITIZER_INTERFACE_WEAK_DEF(void, __sanitizer_cov_trace_pc_indir, void) {}
251 }  // extern "C"
252 
253 #endif  // !SANITIZER_FUCHSIA
254