157 Commits

Author SHA1 Message Date
Kostya Serebryany
be07cfbcbd [sanitizer-coverage] rename sanitizer-coverage-create-pc-table into sanitizer-coverage-pc-table and add plumbing for a clang flag
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@309337 91177308-0d34-0410-b5e6-96231b3b80d8
2017-07-28 00:09:29 +00:00
Kostya Serebryany
19b3038223 [sanitizer-coverage] add a feature sanitizer-coverage-create-pc-table=1 (works with trace-pc-guard and inline-8bit-counters) that adds a static table of instrumented PCs to be used at run-time
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@309335 91177308-0d34-0410-b5e6-96231b3b80d8
2017-07-27 23:36:49 +00:00
Kostya Serebryany
977be98e0f [sanitizer-coverage] simplify the code, NFC
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@308944 91177308-0d34-0410-b5e6-96231b3b80d8
2017-07-25 02:07:38 +00:00
Alexander Potapenko
886a32baf7 [sancov] Fix PR33732
Coverage hooks that take less-than-64-bit-integers as parameters need the
zeroext parameter attribute (http://llvm.org/docs/LangRef.html#paramattrs)
to make sure they are properly extended by the x86_64 ABI.


git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@308296 91177308-0d34-0410-b5e6-96231b3b80d8
2017-07-18 11:47:56 +00:00
George Karpenkov
4cbdf0eab2 Fixing section name for Darwin platforms for sanitizer coverage
On Darwin, section names have a 16char length limit.

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@305429 91177308-0d34-0410-b5e6-96231b3b80d8
2017-06-14 23:40:25 +00:00
Kostya Serebryany
be95f5eddf [sanitizer-coverage] one more flavor of coverage: -fsanitize-coverage=inline-8bit-counters. Experimental so far, not documenting yet. Reapplying revisions 304630, 304631, 304632, 304673, see PR33308
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@305026 91177308-0d34-0410-b5e6-96231b3b80d8
2017-06-08 22:58:19 +00:00
Renato Golin
3b482e4bca Revert "[sanitizer-coverage] one more flavor of coverage: -fsanitize-coverage=inline-8bit-counters. Experimental so far, not documenting yet."
This reverts commit r304630, as it broke ARM/AArch64 bots for 2 days.

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@304698 91177308-0d34-0410-b5e6-96231b3b80d8
2017-06-05 07:35:52 +00:00
Kostya Serebryany
111f62d417 [sanitizer-coverage] one more flavor of coverage: -fsanitize-coverage=inline-8bit-counters. Experimental so far, not documenting yet.
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@304630 91177308-0d34-0410-b5e6-96231b3b80d8
2017-06-03 01:35:47 +00:00
Kostya Serebryany
fef6c49a5c [sanitizer-coverage] refactor the code to make it easier to add more sections in future. NFC
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@304610 91177308-0d34-0410-b5e6-96231b3b80d8
2017-06-02 23:13:44 +00:00
Kostya Serebryany
8ea517852a [sanitizer-coverage] remove stale code (old coverage); llvm part
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@304319 91177308-0d34-0410-b5e6-96231b3b80d8
2017-05-31 18:27:33 +00:00
George Karpenkov
f6cb509385 Fix coverage check for full post-dominator basic blocks.
Coverage instrumentation which does not instrument full post-dominators
and full-dominators may skip valid paths, as the reasoning for skipping
blocks may become circular.
This patch fixes that, by only skipping
full post-dominators with multiple predecessors, as such predecessors by
definition can not be full-dominators.

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@303827 91177308-0d34-0410-b5e6-96231b3b80d8
2017-05-25 01:41:46 +00:00
George Karpenkov
c49b255f5f Revert "Disable coverage opt-out for strong postdominator blocks."
This reverts commit 2ed06f05fc10869dd1239cff96fcdea2ee8bf4ef.
Buildbots do not like this on Linux.

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@303710 91177308-0d34-0410-b5e6-96231b3b80d8
2017-05-24 00:29:12 +00:00
George Karpenkov
fe601fedc1 Disable coverage opt-out for strong postdominator blocks.
Coverage instrumentation has an optimization not to instrument extra
blocks, if the pass is already "accounted for" by a
successor/predecessor basic block.
However (https://github.com/google/sanitizers/issues/783) this
reasoning may become circular, which stops valid paths from having
coverage.
In the worst case this can cause fuzzing to stop working entirely.

This change simplifies logic to something which trivially can not have
such circular reasoning, as losing valid paths does not seem like a
good trade-off for a ~15% decrease in the # of instrumented basic blocks.

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@303698 91177308-0d34-0410-b5e6-96231b3b80d8
2017-05-23 21:58:54 +00:00
Kostya Serebryany
9d90a01faf [sanitizer-coverage] implement -fsanitize-coverage=no-prune,... instead of a hidden -mllvm flag. llvm part.
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@302319 91177308-0d34-0410-b5e6-96231b3b80d8
2017-05-05 23:14:40 +00:00
Kostya Serebryany
d89a81f5c9 [sanitizer-coverage] remove some more stale code
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@300778 91177308-0d34-0410-b5e6-96231b3b80d8
2017-04-19 22:42:11 +00:00
Evgeniy Stepanov
11bae79f9c Remove two unused variables (-Werror).
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@300777 91177308-0d34-0410-b5e6-96231b3b80d8
2017-04-19 22:27:23 +00:00
Kostya Serebryany
06c0527072 [sanitizer-coverage] remove stale code
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@300769 91177308-0d34-0410-b5e6-96231b3b80d8
2017-04-19 21:48:09 +00:00
Serge Guelton
9d54400bba Module::getOrInsertFunction is using C-style vararg instead of variadic templates.
From a user prospective, it forces the use of an annoying nullptr to mark the end of the vararg, and there's not type checking on the arguments.
The variadic template is an obvious solution to both issues.

Differential Revision: https://reviews.llvm.org/D31070



git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@299949 91177308-0d34-0410-b5e6-96231b3b80d8
2017-04-11 15:01:18 +00:00
Diana Picus
1d02724c71 Revert "Turn some C-style vararg into variadic templates"
This reverts commit r299925 because it broke the buildbots. See e.g.
http://lab.llvm.org:8011/builders/clang-cmake-armv7-a15/builds/6008

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@299928 91177308-0d34-0410-b5e6-96231b3b80d8
2017-04-11 10:07:12 +00:00
Serge Guelton
ec124b3a6f Turn some C-style vararg into variadic templates
Module::getOrInsertFunction is using C-style vararg instead of
variadic templates.

From a user prospective, it forces the use of an annoying nullptr
to mark the end of the vararg, and there's not type checking on the
arguments. The variadic template is an obvious solution to both
issues.



git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@299925 91177308-0d34-0410-b5e6-96231b3b80d8
2017-04-11 08:36:52 +00:00
Mehdi Amini
8701bbc75d Revert "Turn some C-style vararg into variadic templates"
This reverts commit r299699, the examples needs to be updated.

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@299702 91177308-0d34-0410-b5e6-96231b3b80d8
2017-04-06 20:23:57 +00:00
Mehdi Amini
753bd2a772 Turn some C-style vararg into variadic templates
Module::getOrInsertFunction is using C-style vararg instead of
variadic templates.

From a user prospective, it forces the use of an annoying nullptr
to mark the end of the vararg, and there's not type checking on the
arguments. The variadic template is an obvious solution to both
issues.

Patch by: Serge Guelton <serge.guelton@telecom-bretagne.eu>

Differential Revision: https://reviews.llvm.org/D31070

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@299699 91177308-0d34-0410-b5e6-96231b3b80d8
2017-04-06 20:09:31 +00:00
Reid Kleckner
bef4d671d9 [sancov] Don't instrument blocks with no insertion point
This prevents crashes when attempting to instrument functions containing
C++ try.

Sanitizer coverage will still fail at runtime when an exception is
thrown through a sancov instrumented function, but that seems marginally
better than what we have now. The full solution is to color the blocks
in LLVM IR and only instrument blocks that have an unambiguous color,
using the appropriate token.

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@298662 91177308-0d34-0410-b5e6-96231b3b80d8
2017-03-23 23:30:41 +00:00
Mike Aizatsky
9cf01663e3 [sancov] using comdat only when it is enabled
Differential Revision: https://reviews.llvm.org/D29733

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@294529 91177308-0d34-0410-b5e6-96231b3b80d8
2017-02-08 23:12:46 +00:00
Mike Aizatsky
884f3fe80d [sancov] specifying comdat for sancov constructors
Differential Revision: https://reviews.llvm.org/D29662

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@294517 91177308-0d34-0410-b5e6-96231b3b80d8
2017-02-08 21:20:33 +00:00
Marcos Pividori
045de6fddb [sanitizer coverage] Fix Instrumentation to work on Windows.
On Windows, the symbols "___stop___sancov_guards" and "___start___sancov_guards"
are not defined automatically. So, we need to take a different approach.
We define 3 sections:

 Section ".SCOV$A" will only hold a variable ___start___sancov_guard.
 Section ".SCOV$M" will hold the main data.
 Section ".SCOV$Z" will only hold a variable ___stop___sancov_guards.

When linking, they will be merged sorted by the characters after the $, so we
can use the pointers of the variables ___[start|stop]___sancov_guard to know the
actual range of addresses of that section.

In this diff, I updated instrumentation to include all the guard arrays in
section ".SCOV$M".

Differential Revision: https://reviews.llvm.org/D28434

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@293987 91177308-0d34-0410-b5e6-96231b3b80d8
2017-02-03 01:08:06 +00:00
Justin Bogner
770cb8b1b5 SanitizerCoverage: Support sanitizer guard section on darwin
MachO's sections need a segment as well as a section name, and the
section start and end symbols are spelled differently than on ELF.

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@293733 91177308-0d34-0410-b5e6-96231b3b80d8
2017-02-01 02:38:39 +00:00
Kostya Serebryany
42d07d086c [sanitizer-coverage] emit __sanitizer_cov_trace_pc_guard w/o a preceding 'if' by default. Update the docs, also add deprecation notes around other parts of sanitizer coverage
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@292862 91177308-0d34-0410-b5e6-96231b3b80d8
2017-01-24 00:57:31 +00:00
Kostya Serebryany
834b93c09f [sanitizer-coverage] sort the switch cases
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@290628 91177308-0d34-0410-b5e6-96231b3b80d8
2016-12-27 21:20:06 +00:00
Kostya Serebryany
4732785cea [sanitizer-coverage] use IRB.SetCurrentDebugLocation after IRB.SetInsertPoint
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@288568 91177308-0d34-0410-b5e6-96231b3b80d8
2016-12-03 01:43:30 +00:00
Reid Kleckner
195a4bc96d [sancov] Name the global containing the main source file name
If the global name doesn't start with __sancov_gen, ASan will insert
unecessary red zones around it.

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@287117 91177308-0d34-0410-b5e6-96231b3b80d8
2016-11-16 16:50:43 +00:00
Kostya Serebryany
dd850be3cf [sanitizer-coverage] make sure asan does not instrument coverage guards (reported in https://github.com/google/oss-fuzz/issues/84)
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@287030 91177308-0d34-0410-b5e6-96231b3b80d8
2016-11-15 21:12:50 +00:00
Reid Kleckner
d758cd3129 [sancov] Don't instrument MSVC CRT stdio config helpers
They get called before initialization, which is a problem for winasan.

Test coming in compiler-rt.

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@286615 91177308-0d34-0410-b5e6-96231b3b80d8
2016-11-11 19:18:45 +00:00
Kostya Serebryany
21fcbebddd [sanitizer-coverage] use private linkage for coverage guards, delete old commented-out code.
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@283924 91177308-0d34-0410-b5e6-96231b3b80d8
2016-10-11 19:36:50 +00:00
Mehdi Amini
67f335d992 Use StringRef in Pass/PassManager APIs (NFC)
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@283004 91177308-0d34-0410-b5e6-96231b3b80d8
2016-10-01 02:56:57 +00:00
Kostya Serebryany
efa54824a3 [sanitizer-coverage/libFuzzer] make the guards for trace-pc 32-bit; create one array of guards per function, instead of one guard per BB. reorganize the code so that trace-pc-guard does not create unneeded globals
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@282735 91177308-0d34-0410-b5e6-96231b3b80d8
2016-09-29 17:43:24 +00:00
Kostya Serebryany
30eb92316c [sanitizer-coverage] fix a bug in trace-gep
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@282467 91177308-0d34-0410-b5e6-96231b3b80d8
2016-09-27 01:55:08 +00:00
Kostya Serebryany
dbadbd797d [sanitizer-coverage] don't emit the CTOR function if nothing has been instrumented
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@282465 91177308-0d34-0410-b5e6-96231b3b80d8
2016-09-27 01:08:33 +00:00
Kostya Serebryany
18f63e47d8 [sanitizer-coverage] add comdat to coverage guards if needed
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@281952 91177308-0d34-0410-b5e6-96231b3b80d8
2016-09-20 00:16:54 +00:00
Kostya Serebryany
2bed90363f [libFuzzer] use 'if guard' instead of 'if guard >= 0' with trace-pc; change the guard type to intptr_t; use separate array for 8-bit counters
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@281845 91177308-0d34-0410-b5e6-96231b3b80d8
2016-09-18 04:52:23 +00:00
Kostya Serebryany
16197d80b6 [sanitizer-coverage] change trace-pc to use 8-byte guards
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@281809 91177308-0d34-0410-b5e6-96231b3b80d8
2016-09-17 05:03:05 +00:00
Kostya Serebryany
31daa34b7b [sanitizer-coverage] make trace-pc-guard and indirect-call work together
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@281665 91177308-0d34-0410-b5e6-96231b3b80d8
2016-09-15 22:11:08 +00:00
Kostya Serebryany
8ea4234809 [sanitizer-coverage] add yet another flavour of coverage instrumentation: trace-pc-guard. The intent is to eventually replace all of {bool coverage, 8bit-counters, trace-pc} with just this one. LLVM part
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@281431 91177308-0d34-0410-b5e6-96231b3b80d8
2016-09-14 01:39:35 +00:00
Kostya Serebryany
8c23b334cd [sanitizer-coverage] add two more modes of instrumentation: trace-div and trace-gep, mostly usaful for value-profile-based fuzzing; llvm part
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@280043 91177308-0d34-0410-b5e6-96231b3b80d8
2016-08-30 01:12:10 +00:00
Kostya Serebryany
aa4e23e1bb [sanitizer-coverage/libFuzzer] instrument comparisons with __sanitizer_cov_trace_cmp[1248] instead of __sanitizer_cov_trace_cmp, don't pass the comparison type to save a bit performance. Use these new callbacks in libFuzzer
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@279027 91177308-0d34-0410-b5e6-96231b3b80d8
2016-08-18 01:25:28 +00:00
Kostya Serebryany
ec8a2f2059 [sanitizer-coverage] make sure that calls to __sanitizer_cov_trace_pc are not merged (otherwise different calls get the same PC and confuse fuzzers)
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@275449 91177308-0d34-0410-b5e6-96231b3b80d8
2016-07-14 17:59:01 +00:00
Mike Aizatsky
f593646d9a [sancov] enabling coverage edge pruning by default.
Differential Revision: http://reviews.llvm.org/D18844

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@265615 91177308-0d34-0410-b5e6-96231b3b80d8
2016-04-06 23:24:37 +00:00
JF Bastien
b36d1a86f1 NFC: make AtomicOrdering an enum class
Summary:
In the context of http://wg21.link/lwg2445 C++ uses the concept of
'stronger' ordering but doesn't define it properly. This should be fixed
in C++17 barring a small question that's still open.

The code currently plays fast and loose with the AtomicOrdering
enum. Using an enum class is one step towards tightening things. I later
also want to tighten related enums, such as clang's
AtomicOrderingKind (which should be shared with LLVM as a 'C++ ABI'
enum).

This change touches a few lines of code which can be improved later, I'd
like to keep it as NFC for now as it's already quite complex. I have
related changes for clang.

As a follow-up I'll add:
  bool operator<(AtomicOrdering, AtomicOrdering) = delete;
  bool operator>(AtomicOrdering, AtomicOrdering) = delete;
  bool operator<=(AtomicOrdering, AtomicOrdering) = delete;
  bool operator>=(AtomicOrdering, AtomicOrdering) = delete;
This is separate so that clang and LLVM changes don't need to be in sync.

Reviewers: jyknight, reames

Subscribers: jyknight, llvm-commits

Differential Revision: http://reviews.llvm.org/D18775

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@265602 91177308-0d34-0410-b5e6-96231b3b80d8
2016-04-06 21:19:33 +00:00
Mike Aizatsky
1ec923a9c5 [sancov] save entry block from pruning (it is always full dominator)
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@265168 91177308-0d34-0410-b5e6-96231b3b80d8
2016-04-01 18:13:19 +00:00
Mike Aizatsky
bbc99ea0f8 [sancov] code readability improvement.
Summary: Reply to http://reviews.llvm.org/D18341

Differential Revision: http://reviews.llvm.org/D18406

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@264213 91177308-0d34-0410-b5e6-96231b3b80d8
2016-03-23 23:15:03 +00:00