Commit Graph

84 Commits

Author SHA1 Message Date
Mike Aizatsky
724efe430b [sancov] using comdat only when it is enabled
Differential Revision: https://reviews.llvm.org/D29733

llvm-svn: 294529
2017-02-08 23:12:46 +00:00
Mike Aizatsky
3deca570e8 [sancov] specifying comdat for sancov constructors
Differential Revision: https://reviews.llvm.org/D29662

llvm-svn: 294517
2017-02-08 21:20:33 +00:00
Marcos Pividori
6bf287b7d1 [sanitizer coverage] Fix Instrumentation to work on Windows.
On Windows, the symbols "___stop___sancov_guards" and "___start___sancov_guards"
are not defined automatically. So, we need to take a different approach.
We define 3 sections:

 Section ".SCOV$A" will only hold a variable ___start___sancov_guard.
 Section ".SCOV$M" will hold the main data.
 Section ".SCOV$Z" will only hold a variable ___stop___sancov_guards.

When linking, they will be merged sorted by the characters after the $, so we
can use the pointers of the variables ___[start|stop]___sancov_guard to know the
actual range of addresses of that section.

In this diff, I updated instrumentation to include all the guard arrays in
section ".SCOV$M".

Differential Revision: https://reviews.llvm.org/D28434

llvm-svn: 293987
2017-02-03 01:08:06 +00:00
Justin Bogner
ae642b4739 SanitizerCoverage: Support sanitizer guard section on darwin
MachO's sections need a segment as well as a section name, and the
section start and end symbols are spelled differently than on ELF.

llvm-svn: 293733
2017-02-01 02:38:39 +00:00
Kostya Serebryany
ddd0879068 [sanitizer-coverage] emit __sanitizer_cov_trace_pc_guard w/o a preceding 'if' by default. Update the docs, also add deprecation notes around other parts of sanitizer coverage
llvm-svn: 292862
2017-01-24 00:57:31 +00:00
Kostya Serebryany
aece9ad2f5 [sanitizer-coverage] sort the switch cases
llvm-svn: 290628
2016-12-27 21:20:06 +00:00
Kostya Serebryany
8568d8ea25 [sanitizer-coverage] use IRB.SetCurrentDebugLocation after IRB.SetInsertPoint
llvm-svn: 288568
2016-12-03 01:43:30 +00:00
Reid Kleckner
7f2f1a4146 [sancov] Name the global containing the main source file name
If the global name doesn't start with __sancov_gen, ASan will insert
unecessary red zones around it.

llvm-svn: 287117
2016-11-16 16:50:43 +00:00
Kostya Serebryany
e0b6dd6efa [sanitizer-coverage] make sure asan does not instrument coverage guards (reported in https://github.com/google/oss-fuzz/issues/84)
llvm-svn: 287030
2016-11-15 21:12:50 +00:00
Reid Kleckner
1200af0389 [sancov] Don't instrument MSVC CRT stdio config helpers
They get called before initialization, which is a problem for winasan.

Test coming in compiler-rt.

llvm-svn: 286615
2016-11-11 19:18:45 +00:00
Kostya Serebryany
cb7566ce29 [sanitizer-coverage] use private linkage for coverage guards, delete old commented-out code.
llvm-svn: 283924
2016-10-11 19:36:50 +00:00
Mehdi Amini
1fef2dd6b7 Use StringRef in Pass/PassManager APIs (NFC)
llvm-svn: 283004
2016-10-01 02:56:57 +00:00
Kostya Serebryany
83752c3be3 [sanitizer-coverage/libFuzzer] make the guards for trace-pc 32-bit; create one array of guards per function, instead of one guard per BB. reorganize the code so that trace-pc-guard does not create unneeded globals
llvm-svn: 282735
2016-09-29 17:43:24 +00:00
Kostya Serebryany
3271dd3f6e [sanitizer-coverage] fix a bug in trace-gep
llvm-svn: 282467
2016-09-27 01:55:08 +00:00
Kostya Serebryany
6db39b63fe [sanitizer-coverage] don't emit the CTOR function if nothing has been instrumented
llvm-svn: 282465
2016-09-27 01:08:33 +00:00
Kostya Serebryany
977e6e2c48 [sanitizer-coverage] add comdat to coverage guards if needed
llvm-svn: 281952
2016-09-20 00:16:54 +00:00
Kostya Serebryany
ad93add26c [libFuzzer] use 'if guard' instead of 'if guard >= 0' with trace-pc; change the guard type to intptr_t; use separate array for 8-bit counters
llvm-svn: 281845
2016-09-18 04:52:23 +00:00
Kostya Serebryany
6f62f4753a [sanitizer-coverage] change trace-pc to use 8-byte guards
llvm-svn: 281809
2016-09-17 05:03:05 +00:00
Kostya Serebryany
96912bcd48 [sanitizer-coverage] make trace-pc-guard and indirect-call work together
llvm-svn: 281665
2016-09-15 22:11:08 +00:00
Kostya Serebryany
562a9d7d62 [sanitizer-coverage] add yet another flavour of coverage instrumentation: trace-pc-guard. The intent is to eventually replace all of {bool coverage, 8bit-counters, trace-pc} with just this one. LLVM part
llvm-svn: 281431
2016-09-14 01:39:35 +00:00
Kostya Serebryany
a0e2bc22aa [sanitizer-coverage] add two more modes of instrumentation: trace-div and trace-gep, mostly usaful for value-profile-based fuzzing; llvm part
llvm-svn: 280043
2016-08-30 01:12:10 +00:00
Kostya Serebryany
03331f9d41 [sanitizer-coverage/libFuzzer] instrument comparisons with __sanitizer_cov_trace_cmp[1248] instead of __sanitizer_cov_trace_cmp, don't pass the comparison type to save a bit performance. Use these new callbacks in libFuzzer
llvm-svn: 279027
2016-08-18 01:25:28 +00:00
Kostya Serebryany
9281d8bfeb [sanitizer-coverage] make sure that calls to __sanitizer_cov_trace_pc are not merged (otherwise different calls get the same PC and confuse fuzzers)
llvm-svn: 275449
2016-07-14 17:59:01 +00:00
Mike Aizatsky
1602c50235 [sancov] enabling coverage edge pruning by default.
Differential Revision: http://reviews.llvm.org/D18844

llvm-svn: 265615
2016-04-06 23:24:37 +00:00
JF Bastien
f4f5b32f44 NFC: make AtomicOrdering an enum class
Summary:
In the context of http://wg21.link/lwg2445 C++ uses the concept of
'stronger' ordering but doesn't define it properly. This should be fixed
in C++17 barring a small question that's still open.

The code currently plays fast and loose with the AtomicOrdering
enum. Using an enum class is one step towards tightening things. I later
also want to tighten related enums, such as clang's
AtomicOrderingKind (which should be shared with LLVM as a 'C++ ABI'
enum).

This change touches a few lines of code which can be improved later, I'd
like to keep it as NFC for now as it's already quite complex. I have
related changes for clang.

As a follow-up I'll add:
  bool operator<(AtomicOrdering, AtomicOrdering) = delete;
  bool operator>(AtomicOrdering, AtomicOrdering) = delete;
  bool operator<=(AtomicOrdering, AtomicOrdering) = delete;
  bool operator>=(AtomicOrdering, AtomicOrdering) = delete;
This is separate so that clang and LLVM changes don't need to be in sync.

Reviewers: jyknight, reames

Subscribers: jyknight, llvm-commits

Differential Revision: http://reviews.llvm.org/D18775

llvm-svn: 265602
2016-04-06 21:19:33 +00:00
Mike Aizatsky
d56f7940a0 [sancov] save entry block from pruning (it is always full dominator)
llvm-svn: 265168
2016-04-01 18:13:19 +00:00
Mike Aizatsky
f4759b20d0 [sancov] code readability improvement.
Summary: Reply to http://reviews.llvm.org/D18341

Differential Revision: http://reviews.llvm.org/D18406

llvm-svn: 264213
2016-03-23 23:15:03 +00:00
Mike Aizatsky
56af65d844 [sancov] do not instrument nodes that are full pre-dominators
Summary:
Without tree pruning clang has 2,667,552 points.
Wiht only dominators pruning: 1,515,586.
With both dominators & predominators pruning: 1,340,534.

Resubmit of r262103.

Differential Revision: http://reviews.llvm.org/D18341

llvm-svn: 264003
2016-03-21 23:08:16 +00:00
Mike Aizatsky
df25bcc3e2 [sancov] clang-formatting SanitizerCoverage.cpp and fully pleasing clang-tidy.
Differential Revision: http://reviews.llvm.org/D18288

llvm-svn: 263852
2016-03-18 23:29:29 +00:00
Chandler Carruth
0c19258b94 Revert "Revert "[sancov] specifying sanitizer coverage dependencies.""
This reverts commit r263825, re-instating r263797.

llvm-svn: 263847
2016-03-18 22:43:42 +00:00
Chandler Carruth
a761228d20 [sancov] Fix the sancov pass to initialize itself inside its
constructor. This should fix the recent crashes on certain
architectures.

llvm-svn: 263845
2016-03-18 22:35:58 +00:00
Mike Aizatsky
e0b3158eac Revert "[sancov] specifying sanitizer coverage dependencies."
This fails on arm.

This reverts commit 52c8e0f7119d1ea1050c0708565a8c92b73386d2.

llvm-svn: 263825
2016-03-18 20:34:58 +00:00
Mike Aizatsky
d1eb5465a0 [sancov] specifying sanitizer coverage dependencies.
Summary:
These dependencies would be used in the future to reduce the number
of instrumented blocks(http://reviews.llvm.org/rL262103)

This is submitted as a separate CL because of previous problems with
ARM.

Subscribers: aemerson

Differential Revision: http://reviews.llvm.org/D18227

llvm-svn: 263797
2016-03-18 17:33:21 +00:00
Pete Cooper
3221ed57e7 Remove llvm::getDISubprogram in favor of Function::getSubprogram
llvm::getDISubprogram walks the instructions in a function, looking for one in the scope of the current function, so that it can find the !dbg entry for the subprogram itself.

Now that !dbg is attached to functions, this should not be necessary. This patch changes all uses to just query the subprogram directly on the function.

Ideally this should be NFC, but in reality its possible that a function:

has no !dbg (in which case there's likely a bug somewhere in an opt pass), or
that none of the instructions had a scope referencing the function, so we used to not find the !dbg on the function but now we will

Reviewed by Duncan Exon Smith.

Differential Revision: http://reviews.llvm.org/D18074

llvm-svn: 263184
2016-03-11 02:14:16 +00:00
Renato Golin
e3031ad0db Revert "[sancov] do not instrument nodes that are full pre-dominators"
This reverts commit r262103, as it broke all ARM and AArch64 bots.

llvm-svn: 262139
2016-02-27 14:19:19 +00:00
Mike Aizatsky
5bc3e758d6 [sancov] properly initializing pass.
llvm-svn: 262111
2016-02-27 05:50:40 +00:00
Kostya Serebryany
2e7a6d59f7 [libFuzzer] don't emit callbacks to sanitizer run-time in -fsanitize-coverage=trace-pc mode; update libFuzzer doc for previous commit
llvm-svn: 262110
2016-02-27 05:45:12 +00:00
Mike Aizatsky
efd9fa98d1 [sancov] do not instrument nodes that are full pre-dominators
Summary:
Without tree pruning clang has 2,667,552 points.
Wiht only dominators pruning: 1,515,586.
With both dominators & predominators pruning: 1,340,534.

Differential Revision: http://reviews.llvm.org/D17671

llvm-svn: 262103
2016-02-27 02:10:27 +00:00
Mike Aizatsky
b65bb6da73 [sancov] Pruning full dominator blocks from instrumentation.
Summary:
This is the first simple attempt to reduce number of coverage-
instrumented blocks.

If a basic block dominates all its successors, then its coverage
information is useless to us. Ingore such blocks if
santizer-coverage-prune-tree option is set.

Differential Revision: http://reviews.llvm.org/D17626

llvm-svn: 261949
2016-02-26 01:17:22 +00:00
Kostya Serebryany
4a9b91620a [sanitizer-coverage] implement -fsanitize-coverage=trace-pc. This is similar to trace-bb, but has a different API. We already use the equivalent flag in GCC for Linux kernel fuzzing. We may be able to use this flag with AFL too
llvm-svn: 261159
2016-02-17 21:34:43 +00:00
Rui Ueyama
dca64dbccc Update to use new name alignTo().
llvm-svn: 257804
2016-01-14 21:06:47 +00:00
Sanjay Patel
8312ed978c getParent() ^ 3 == getModule() ; NFCI
llvm-svn: 255511
2015-12-14 17:24:23 +00:00
David Majnemer
56dee65385 Move EH-specific helper functions to a more appropriate place
No functionality change is intended.

llvm-svn: 254562
2015-12-02 23:06:39 +00:00
Kostya Serebryany
766da3696b [sanitizer coverage] when adding a bb trace instrumentation, do it instead, not in addition to, regular coverage. Do the regular coverage in the run-time instead
llvm-svn: 254482
2015-12-02 02:37:13 +00:00
Duncan P. N. Exon Smith
acd584acb3 Instrumentation: Remove ilist iterator implicit conversions, NFC
llvm-svn: 250186
2015-10-13 17:39:10 +00:00
Reid Kleckner
00ea251f01 [sancov] Disable sanitizer coverage on functions using SEH
Splitting basic blocks really messes up WinEHPrepare. We can remove this
change when SEH uses the new EH IR.

llvm-svn: 246799
2015-09-03 20:18:29 +00:00
Justin Bogner
40c0301b05 [sancov] Fix an unused variable warning introduced in r245067
llvm-svn: 245072
2015-08-14 17:03:45 +00:00
Reid Kleckner
575463d985 [sancov] Leave llvm.localescape in the entry block
Summary: Similar to the change we applied to ASan. The same test case works.

Reviewers: samsonov

Subscribers: llvm-commits

Differential Revision: http://reviews.llvm.org/D11961

llvm-svn: 245067
2015-08-14 16:45:42 +00:00
Kostya Serebryany
c88d3123b8 [libFuzzer] don't crash if the condition in a switch has unusual type (e.g. i72)
llvm-svn: 244544
2015-08-11 00:24:39 +00:00
Kostya Serebryany
71a4e8ccbf [libFuzzer] trace switch statements and apply mutations based on the expected case values
llvm-svn: 243726
2015-07-31 01:33:06 +00:00