1 //===-- SanitizerCoverage.cpp - coverage instrumentation for sanitizers ---===// 2 // 3 // The LLVM Compiler Infrastructure 4 // 5 // This file is distributed under the University of Illinois Open Source 6 // License. See LICENSE.TXT for details. 7 // 8 //===----------------------------------------------------------------------===// 9 // 10 // Coverage instrumentation that works with AddressSanitizer 11 // and potentially with other Sanitizers. 12 // 13 // We create a Guard variable with the same linkage 14 // as the function and inject this code into the entry block (SCK_Function) 15 // or all blocks (SCK_BB): 16 // if (Guard < 0) { 17 // __sanitizer_cov(&Guard); 18 // } 19 // The accesses to Guard are atomic. The rest of the logic is 20 // in __sanitizer_cov (it's fine to call it more than once). 21 // 22 // With SCK_Edge we also split critical edges this effectively 23 // instrumenting all edges. 24 // 25 // This coverage implementation provides very limited data: 26 // it only tells if a given function (block) was ever executed. No counters. 27 // But for many use cases this is what we need and the added slowdown small. 28 // 29 //===----------------------------------------------------------------------===// 30 31 #include "llvm/ADT/ArrayRef.h" 32 #include "llvm/ADT/SmallVector.h" 33 #include "llvm/Analysis/EHPersonalities.h" 34 #include "llvm/Analysis/PostDominators.h" 35 #include "llvm/IR/CFG.h" 36 #include "llvm/IR/CallSite.h" 37 #include "llvm/IR/DataLayout.h" 38 #include "llvm/IR/DebugInfo.h" 39 #include "llvm/IR/Dominators.h" 40 #include "llvm/IR/Function.h" 41 #include "llvm/IR/IRBuilder.h" 42 #include "llvm/IR/InlineAsm.h" 43 #include "llvm/IR/LLVMContext.h" 44 #include "llvm/IR/MDBuilder.h" 45 #include "llvm/IR/Module.h" 46 #include "llvm/IR/Type.h" 47 #include "llvm/Support/CommandLine.h" 48 #include "llvm/Support/Debug.h" 49 #include "llvm/Support/raw_ostream.h" 50 #include "llvm/Transforms/Instrumentation.h" 51 #include "llvm/Transforms/Scalar.h" 52 #include "llvm/Transforms/Utils/BasicBlockUtils.h" 53 #include "llvm/Transforms/Utils/ModuleUtils.h" 54 55 using namespace llvm; 56 57 #define DEBUG_TYPE "sancov" 58 59 static const char *const SanCovModuleInitName = "__sanitizer_cov_module_init"; 60 static const char *const SanCovName = "__sanitizer_cov"; 61 static const char *const SanCovWithCheckName = "__sanitizer_cov_with_check"; 62 static const char *const SanCovIndirCallName = "__sanitizer_cov_indir_call16"; 63 static const char *const SanCovTracePCIndirName = 64 "__sanitizer_cov_trace_pc_indir"; 65 static const char *const SanCovTraceEnterName = 66 "__sanitizer_cov_trace_func_enter"; 67 static const char *const SanCovTraceBBName = 68 "__sanitizer_cov_trace_basic_block"; 69 static const char *const SanCovTracePCName = "__sanitizer_cov_trace_pc"; 70 static const char *const SanCovTraceCmpName = "__sanitizer_cov_trace_cmp"; 71 static const char *const SanCovTraceSwitchName = "__sanitizer_cov_trace_switch"; 72 static const char *const SanCovModuleCtorName = "sancov.module_ctor"; 73 static const uint64_t SanCtorAndDtorPriority = 2; 74 75 static cl::opt<int> ClCoverageLevel( 76 "sanitizer-coverage-level", 77 cl::desc("Sanitizer Coverage. 0: none, 1: entry block, 2: all blocks, " 78 "3: all blocks and critical edges, " 79 "4: above plus indirect calls"), 80 cl::Hidden, cl::init(0)); 81 82 static cl::opt<unsigned> ClCoverageBlockThreshold( 83 "sanitizer-coverage-block-threshold", 84 cl::desc("Use a callback with a guard check inside it if there are" 85 " more than this number of blocks."), 86 cl::Hidden, cl::init(500)); 87 88 static cl::opt<bool> 89 ClExperimentalTracing("sanitizer-coverage-experimental-tracing", 90 cl::desc("Experimental basic-block tracing: insert " 91 "callbacks at every basic block"), 92 cl::Hidden, cl::init(false)); 93 94 static cl::opt<bool> ClExperimentalTracePC("sanitizer-coverage-trace-pc", 95 cl::desc("Experimental pc tracing"), 96 cl::Hidden, cl::init(false)); 97 98 static cl::opt<bool> 99 ClExperimentalCMPTracing("sanitizer-coverage-experimental-trace-compares", 100 cl::desc("Experimental tracing of CMP and similar " 101 "instructions"), 102 cl::Hidden, cl::init(false)); 103 104 static cl::opt<bool> ClPruneBlocks( 105 "sanitizer-coverage-prune-blocks", 106 cl::desc("Reduce the number of instrumented blocks (experimental)"), 107 cl::Hidden, cl::init(false)); 108 109 // Experimental 8-bit counters used as an additional search heuristic during 110 // coverage-guided fuzzing. 111 // The counters are not thread-friendly: 112 // - contention on these counters may cause significant slowdown; 113 // - the counter updates are racy and the results may be inaccurate. 114 // They are also inaccurate due to 8-bit integer overflow. 115 static cl::opt<bool> ClUse8bitCounters("sanitizer-coverage-8bit-counters", 116 cl::desc("Experimental 8-bit counters"), 117 cl::Hidden, cl::init(false)); 118 119 namespace { 120 121 SanitizerCoverageOptions getOptions(int LegacyCoverageLevel) { 122 SanitizerCoverageOptions Res; 123 switch (LegacyCoverageLevel) { 124 case 0: 125 Res.CoverageType = SanitizerCoverageOptions::SCK_None; 126 break; 127 case 1: 128 Res.CoverageType = SanitizerCoverageOptions::SCK_Function; 129 break; 130 case 2: 131 Res.CoverageType = SanitizerCoverageOptions::SCK_BB; 132 break; 133 case 3: 134 Res.CoverageType = SanitizerCoverageOptions::SCK_Edge; 135 break; 136 case 4: 137 Res.CoverageType = SanitizerCoverageOptions::SCK_Edge; 138 Res.IndirectCalls = true; 139 break; 140 } 141 return Res; 142 } 143 144 SanitizerCoverageOptions OverrideFromCL(SanitizerCoverageOptions Options) { 145 // Sets CoverageType and IndirectCalls. 146 SanitizerCoverageOptions CLOpts = getOptions(ClCoverageLevel); 147 Options.CoverageType = std::max(Options.CoverageType, CLOpts.CoverageType); 148 Options.IndirectCalls |= CLOpts.IndirectCalls; 149 Options.TraceBB |= ClExperimentalTracing; 150 Options.TraceCmp |= ClExperimentalCMPTracing; 151 Options.Use8bitCounters |= ClUse8bitCounters; 152 Options.TracePC |= ClExperimentalTracePC; 153 return Options; 154 } 155 156 class SanitizerCoverageModule : public ModulePass { 157 public: 158 SanitizerCoverageModule( 159 const SanitizerCoverageOptions &Options = SanitizerCoverageOptions()) 160 : ModulePass(ID), Options(OverrideFromCL(Options)) { 161 initializeSanitizerCoverageModulePass(*PassRegistry::getPassRegistry()); 162 } 163 bool runOnModule(Module &M) override; 164 bool runOnFunction(Function &F); 165 static char ID; // Pass identification, replacement for typeid 166 const char *getPassName() const override { return "SanitizerCoverageModule"; } 167 168 void getAnalysisUsage(AnalysisUsage &AU) const override { 169 AU.addRequired<DominatorTreeWrapperPass>(); 170 AU.addRequired<PostDominatorTreeWrapperPass>(); 171 } 172 173 private: 174 void InjectCoverageForIndirectCalls(Function &F, 175 ArrayRef<Instruction *> IndirCalls); 176 void InjectTraceForCmp(Function &F, ArrayRef<Instruction *> CmpTraceTargets); 177 void InjectTraceForSwitch(Function &F, 178 ArrayRef<Instruction *> SwitchTraceTargets); 179 bool InjectCoverage(Function &F, ArrayRef<BasicBlock *> AllBlocks); 180 void SetNoSanitizeMetadata(Instruction *I); 181 void InjectCoverageAtBlock(Function &F, BasicBlock &BB, bool UseCalls); 182 unsigned NumberOfInstrumentedBlocks() { 183 return SanCovFunction->getNumUses() + 184 SanCovWithCheckFunction->getNumUses() + SanCovTraceBB->getNumUses() + 185 SanCovTraceEnter->getNumUses(); 186 } 187 Function *SanCovFunction; 188 Function *SanCovWithCheckFunction; 189 Function *SanCovIndirCallFunction, *SanCovTracePCIndir; 190 Function *SanCovTraceEnter, *SanCovTraceBB, *SanCovTracePC; 191 Function *SanCovTraceCmpFunction; 192 Function *SanCovTraceSwitchFunction; 193 InlineAsm *EmptyAsm; 194 Type *IntptrTy, *Int64Ty, *Int64PtrTy; 195 Module *CurModule; 196 LLVMContext *C; 197 const DataLayout *DL; 198 199 GlobalVariable *GuardArray; 200 GlobalVariable *EightBitCounterArray; 201 202 SanitizerCoverageOptions Options; 203 }; 204 205 } // namespace 206 207 bool SanitizerCoverageModule::runOnModule(Module &M) { 208 if (Options.CoverageType == SanitizerCoverageOptions::SCK_None) 209 return false; 210 C = &(M.getContext()); 211 DL = &M.getDataLayout(); 212 CurModule = &M; 213 IntptrTy = Type::getIntNTy(*C, DL->getPointerSizeInBits()); 214 Type *VoidTy = Type::getVoidTy(*C); 215 IRBuilder<> IRB(*C); 216 Type *Int8PtrTy = PointerType::getUnqual(IRB.getInt8Ty()); 217 Type *Int32PtrTy = PointerType::getUnqual(IRB.getInt32Ty()); 218 Int64PtrTy = PointerType::getUnqual(IRB.getInt64Ty()); 219 Int64Ty = IRB.getInt64Ty(); 220 221 SanCovFunction = checkSanitizerInterfaceFunction( 222 M.getOrInsertFunction(SanCovName, VoidTy, Int32PtrTy, nullptr)); 223 SanCovWithCheckFunction = checkSanitizerInterfaceFunction( 224 M.getOrInsertFunction(SanCovWithCheckName, VoidTy, Int32PtrTy, nullptr)); 225 SanCovTracePCIndir = checkSanitizerInterfaceFunction( 226 M.getOrInsertFunction(SanCovTracePCIndirName, VoidTy, IntptrTy, nullptr)); 227 SanCovIndirCallFunction = 228 checkSanitizerInterfaceFunction(M.getOrInsertFunction( 229 SanCovIndirCallName, VoidTy, IntptrTy, IntptrTy, nullptr)); 230 SanCovTraceCmpFunction = 231 checkSanitizerInterfaceFunction(M.getOrInsertFunction( 232 SanCovTraceCmpName, VoidTy, Int64Ty, Int64Ty, Int64Ty, nullptr)); 233 SanCovTraceSwitchFunction = 234 checkSanitizerInterfaceFunction(M.getOrInsertFunction( 235 SanCovTraceSwitchName, VoidTy, Int64Ty, Int64PtrTy, nullptr)); 236 237 // We insert an empty inline asm after cov callbacks to avoid callback merge. 238 EmptyAsm = InlineAsm::get(FunctionType::get(IRB.getVoidTy(), false), 239 StringRef(""), StringRef(""), 240 /*hasSideEffects=*/true); 241 242 SanCovTracePC = checkSanitizerInterfaceFunction( 243 M.getOrInsertFunction(SanCovTracePCName, VoidTy, nullptr)); 244 SanCovTraceEnter = checkSanitizerInterfaceFunction( 245 M.getOrInsertFunction(SanCovTraceEnterName, VoidTy, Int32PtrTy, nullptr)); 246 SanCovTraceBB = checkSanitizerInterfaceFunction( 247 M.getOrInsertFunction(SanCovTraceBBName, VoidTy, Int32PtrTy, nullptr)); 248 249 // At this point we create a dummy array of guards because we don't 250 // know how many elements we will need. 251 Type *Int32Ty = IRB.getInt32Ty(); 252 Type *Int8Ty = IRB.getInt8Ty(); 253 254 GuardArray = 255 new GlobalVariable(M, Int32Ty, false, GlobalValue::ExternalLinkage, 256 nullptr, "__sancov_gen_cov_tmp"); 257 if (Options.Use8bitCounters) 258 EightBitCounterArray = 259 new GlobalVariable(M, Int8Ty, false, GlobalVariable::ExternalLinkage, 260 nullptr, "__sancov_gen_cov_tmp"); 261 262 for (auto &F : M) 263 runOnFunction(F); 264 265 auto N = NumberOfInstrumentedBlocks(); 266 267 // Now we know how many elements we need. Create an array of guards 268 // with one extra element at the beginning for the size. 269 Type *Int32ArrayNTy = ArrayType::get(Int32Ty, N + 1); 270 GlobalVariable *RealGuardArray = new GlobalVariable( 271 M, Int32ArrayNTy, false, GlobalValue::PrivateLinkage, 272 Constant::getNullValue(Int32ArrayNTy), "__sancov_gen_cov"); 273 274 // Replace the dummy array with the real one. 275 GuardArray->replaceAllUsesWith( 276 IRB.CreatePointerCast(RealGuardArray, Int32PtrTy)); 277 GuardArray->eraseFromParent(); 278 279 GlobalVariable *RealEightBitCounterArray; 280 if (Options.Use8bitCounters) { 281 // Make sure the array is 16-aligned. 282 static const int CounterAlignment = 16; 283 Type *Int8ArrayNTy = ArrayType::get(Int8Ty, alignTo(N, CounterAlignment)); 284 RealEightBitCounterArray = new GlobalVariable( 285 M, Int8ArrayNTy, false, GlobalValue::PrivateLinkage, 286 Constant::getNullValue(Int8ArrayNTy), "__sancov_gen_cov_counter"); 287 RealEightBitCounterArray->setAlignment(CounterAlignment); 288 EightBitCounterArray->replaceAllUsesWith( 289 IRB.CreatePointerCast(RealEightBitCounterArray, Int8PtrTy)); 290 EightBitCounterArray->eraseFromParent(); 291 } 292 293 // Create variable for module (compilation unit) name 294 Constant *ModNameStrConst = 295 ConstantDataArray::getString(M.getContext(), M.getName(), true); 296 GlobalVariable *ModuleName = 297 new GlobalVariable(M, ModNameStrConst->getType(), true, 298 GlobalValue::PrivateLinkage, ModNameStrConst); 299 300 if (!Options.TracePC) { 301 Function *CtorFunc; 302 std::tie(CtorFunc, std::ignore) = createSanitizerCtorAndInitFunctions( 303 M, SanCovModuleCtorName, SanCovModuleInitName, 304 {Int32PtrTy, IntptrTy, Int8PtrTy, Int8PtrTy}, 305 {IRB.CreatePointerCast(RealGuardArray, Int32PtrTy), 306 ConstantInt::get(IntptrTy, N), 307 Options.Use8bitCounters 308 ? IRB.CreatePointerCast(RealEightBitCounterArray, Int8PtrTy) 309 : Constant::getNullValue(Int8PtrTy), 310 IRB.CreatePointerCast(ModuleName, Int8PtrTy)}); 311 312 appendToGlobalCtors(M, CtorFunc, SanCtorAndDtorPriority); 313 } 314 315 return true; 316 } 317 318 static bool shouldInstrumentBlock(const BasicBlock *BB, 319 const DominatorTree *DT) { 320 if (!ClPruneBlocks) 321 return true; 322 if (succ_begin(BB) == succ_end(BB)) 323 return true; 324 325 // Check if BB dominates all its successors. 326 for (const BasicBlock *SUCC : make_range(succ_begin(BB), succ_end(BB))) { 327 if (!DT->dominates(BB, SUCC)) 328 return true; 329 } 330 331 return false; 332 } 333 334 bool SanitizerCoverageModule::runOnFunction(Function &F) { 335 if (F.empty()) 336 return false; 337 if (F.getName().find(".module_ctor") != std::string::npos) 338 return false; // Should not instrument sanitizer init functions. 339 // Don't instrument functions using SEH for now. Splitting basic blocks like 340 // we do for coverage breaks WinEHPrepare. 341 // FIXME: Remove this when SEH no longer uses landingpad pattern matching. 342 if (F.hasPersonalityFn() && 343 isAsynchronousEHPersonality(classifyEHPersonality(F.getPersonalityFn()))) 344 return false; 345 if (Options.CoverageType >= SanitizerCoverageOptions::SCK_Edge) 346 SplitAllCriticalEdges(F); 347 SmallVector<Instruction *, 8> IndirCalls; 348 SmallVector<BasicBlock *, 16> BlocksToInstrument; 349 SmallVector<Instruction *, 8> CmpTraceTargets; 350 SmallVector<Instruction *, 8> SwitchTraceTargets; 351 352 DominatorTree DT; 353 DT.recalculate(F); 354 for (auto &BB : F) { 355 if (shouldInstrumentBlock(&BB, &DT)) 356 BlocksToInstrument.push_back(&BB); 357 for (auto &Inst : BB) { 358 if (Options.IndirectCalls) { 359 CallSite CS(&Inst); 360 if (CS && !CS.getCalledFunction()) 361 IndirCalls.push_back(&Inst); 362 } 363 if (Options.TraceCmp) { 364 if (isa<ICmpInst>(&Inst)) 365 CmpTraceTargets.push_back(&Inst); 366 if (isa<SwitchInst>(&Inst)) 367 SwitchTraceTargets.push_back(&Inst); 368 } 369 } 370 } 371 372 InjectCoverage(F, BlocksToInstrument); 373 InjectCoverageForIndirectCalls(F, IndirCalls); 374 InjectTraceForCmp(F, CmpTraceTargets); 375 InjectTraceForSwitch(F, SwitchTraceTargets); 376 return true; 377 } 378 379 bool SanitizerCoverageModule::InjectCoverage(Function &F, 380 ArrayRef<BasicBlock *> AllBlocks) { 381 switch (Options.CoverageType) { 382 case SanitizerCoverageOptions::SCK_None: 383 return false; 384 case SanitizerCoverageOptions::SCK_Function: 385 InjectCoverageAtBlock(F, F.getEntryBlock(), false); 386 return true; 387 default: { 388 bool UseCalls = ClCoverageBlockThreshold < AllBlocks.size(); 389 for (auto BB : AllBlocks) 390 InjectCoverageAtBlock(F, *BB, UseCalls); 391 return true; 392 } 393 } 394 } 395 396 // On every indirect call we call a run-time function 397 // __sanitizer_cov_indir_call* with two parameters: 398 // - callee address, 399 // - global cache array that contains CacheSize pointers (zero-initialized). 400 // The cache is used to speed up recording the caller-callee pairs. 401 // The address of the caller is passed implicitly via caller PC. 402 // CacheSize is encoded in the name of the run-time function. 403 void SanitizerCoverageModule::InjectCoverageForIndirectCalls( 404 Function &F, ArrayRef<Instruction *> IndirCalls) { 405 if (IndirCalls.empty()) 406 return; 407 const int CacheSize = 16; 408 const int CacheAlignment = 64; // Align for better performance. 409 Type *Ty = ArrayType::get(IntptrTy, CacheSize); 410 for (auto I : IndirCalls) { 411 IRBuilder<> IRB(I); 412 CallSite CS(I); 413 Value *Callee = CS.getCalledValue(); 414 if (isa<InlineAsm>(Callee)) 415 continue; 416 GlobalVariable *CalleeCache = new GlobalVariable( 417 *F.getParent(), Ty, false, GlobalValue::PrivateLinkage, 418 Constant::getNullValue(Ty), "__sancov_gen_callee_cache"); 419 CalleeCache->setAlignment(CacheAlignment); 420 if (Options.TracePC) 421 IRB.CreateCall(SanCovTracePCIndir, 422 IRB.CreatePointerCast(Callee, IntptrTy)); 423 else 424 IRB.CreateCall(SanCovIndirCallFunction, 425 {IRB.CreatePointerCast(Callee, IntptrTy), 426 IRB.CreatePointerCast(CalleeCache, IntptrTy)}); 427 } 428 } 429 430 // For every switch statement we insert a call: 431 // __sanitizer_cov_trace_switch(CondValue, 432 // {NumCases, ValueSizeInBits, Case0Value, Case1Value, Case2Value, ... }) 433 434 void SanitizerCoverageModule::InjectTraceForSwitch( 435 Function &, ArrayRef<Instruction *> SwitchTraceTargets) { 436 for (auto I : SwitchTraceTargets) { 437 if (SwitchInst *SI = dyn_cast<SwitchInst>(I)) { 438 IRBuilder<> IRB(I); 439 SmallVector<Constant *, 16> Initializers; 440 Value *Cond = SI->getCondition(); 441 if (Cond->getType()->getScalarSizeInBits() > 442 Int64Ty->getScalarSizeInBits()) 443 continue; 444 Initializers.push_back(ConstantInt::get(Int64Ty, SI->getNumCases())); 445 Initializers.push_back( 446 ConstantInt::get(Int64Ty, Cond->getType()->getScalarSizeInBits())); 447 if (Cond->getType()->getScalarSizeInBits() < 448 Int64Ty->getScalarSizeInBits()) 449 Cond = IRB.CreateIntCast(Cond, Int64Ty, false); 450 for (auto It : SI->cases()) { 451 Constant *C = It.getCaseValue(); 452 if (C->getType()->getScalarSizeInBits() < 453 Int64Ty->getScalarSizeInBits()) 454 C = ConstantExpr::getCast(CastInst::ZExt, It.getCaseValue(), Int64Ty); 455 Initializers.push_back(C); 456 } 457 ArrayType *ArrayOfInt64Ty = ArrayType::get(Int64Ty, Initializers.size()); 458 GlobalVariable *GV = new GlobalVariable( 459 *CurModule, ArrayOfInt64Ty, false, GlobalVariable::InternalLinkage, 460 ConstantArray::get(ArrayOfInt64Ty, Initializers), 461 "__sancov_gen_cov_switch_values"); 462 IRB.CreateCall(SanCovTraceSwitchFunction, 463 {Cond, IRB.CreatePointerCast(GV, Int64PtrTy)}); 464 } 465 } 466 } 467 468 void SanitizerCoverageModule::InjectTraceForCmp( 469 Function &, ArrayRef<Instruction *> CmpTraceTargets) { 470 for (auto I : CmpTraceTargets) { 471 if (ICmpInst *ICMP = dyn_cast<ICmpInst>(I)) { 472 IRBuilder<> IRB(ICMP); 473 Value *A0 = ICMP->getOperand(0); 474 Value *A1 = ICMP->getOperand(1); 475 if (!A0->getType()->isIntegerTy()) 476 continue; 477 uint64_t TypeSize = DL->getTypeStoreSizeInBits(A0->getType()); 478 // __sanitizer_cov_trace_cmp((type_size << 32) | predicate, A0, A1); 479 IRB.CreateCall( 480 SanCovTraceCmpFunction, 481 {ConstantInt::get(Int64Ty, (TypeSize << 32) | ICMP->getPredicate()), 482 IRB.CreateIntCast(A0, Int64Ty, true), 483 IRB.CreateIntCast(A1, Int64Ty, true)}); 484 } 485 } 486 } 487 488 void SanitizerCoverageModule::SetNoSanitizeMetadata(Instruction *I) { 489 I->setMetadata(I->getModule()->getMDKindID("nosanitize"), 490 MDNode::get(*C, None)); 491 } 492 493 void SanitizerCoverageModule::InjectCoverageAtBlock(Function &F, BasicBlock &BB, 494 bool UseCalls) { 495 // Don't insert coverage for unreachable blocks: we will never call 496 // __sanitizer_cov() for them, so counting them in 497 // NumberOfInstrumentedBlocks() might complicate calculation of code coverage 498 // percentage. Also, unreachable instructions frequently have no debug 499 // locations. 500 if (isa<UnreachableInst>(BB.getTerminator())) 501 return; 502 BasicBlock::iterator IP = BB.getFirstInsertionPt(); 503 504 bool IsEntryBB = &BB == &F.getEntryBlock(); 505 DebugLoc EntryLoc; 506 if (IsEntryBB) { 507 if (auto SP = F.getSubprogram()) 508 EntryLoc = DebugLoc::get(SP->getScopeLine(), 0, SP); 509 // Keep static allocas and llvm.localescape calls in the entry block. Even 510 // if we aren't splitting the block, it's nice for allocas to be before 511 // calls. 512 IP = PrepareToSplitEntryBlock(BB, IP); 513 } else { 514 EntryLoc = IP->getDebugLoc(); 515 } 516 517 IRBuilder<> IRB(&*IP); 518 IRB.SetCurrentDebugLocation(EntryLoc); 519 Value *GuardP = IRB.CreateAdd( 520 IRB.CreatePointerCast(GuardArray, IntptrTy), 521 ConstantInt::get(IntptrTy, (1 + NumberOfInstrumentedBlocks()) * 4)); 522 Type *Int32PtrTy = PointerType::getUnqual(IRB.getInt32Ty()); 523 GuardP = IRB.CreateIntToPtr(GuardP, Int32PtrTy); 524 if (Options.TracePC) { 525 IRB.CreateCall(SanCovTracePC); 526 } else if (Options.TraceBB) { 527 IRB.CreateCall(IsEntryBB ? SanCovTraceEnter : SanCovTraceBB, GuardP); 528 } else if (UseCalls) { 529 IRB.CreateCall(SanCovWithCheckFunction, GuardP); 530 } else { 531 LoadInst *Load = IRB.CreateLoad(GuardP); 532 Load->setAtomic(Monotonic); 533 Load->setAlignment(4); 534 SetNoSanitizeMetadata(Load); 535 Value *Cmp = 536 IRB.CreateICmpSGE(Constant::getNullValue(Load->getType()), Load); 537 Instruction *Ins = SplitBlockAndInsertIfThen( 538 Cmp, &*IP, false, MDBuilder(*C).createBranchWeights(1, 100000)); 539 IRB.SetInsertPoint(Ins); 540 IRB.SetCurrentDebugLocation(EntryLoc); 541 // __sanitizer_cov gets the PC of the instruction using GET_CALLER_PC. 542 IRB.CreateCall(SanCovFunction, GuardP); 543 IRB.CreateCall(EmptyAsm, {}); // Avoids callback merge. 544 } 545 546 if (Options.Use8bitCounters) { 547 IRB.SetInsertPoint(&*IP); 548 Value *P = IRB.CreateAdd( 549 IRB.CreatePointerCast(EightBitCounterArray, IntptrTy), 550 ConstantInt::get(IntptrTy, NumberOfInstrumentedBlocks() - 1)); 551 P = IRB.CreateIntToPtr(P, IRB.getInt8PtrTy()); 552 LoadInst *LI = IRB.CreateLoad(P); 553 Value *Inc = IRB.CreateAdd(LI, ConstantInt::get(IRB.getInt8Ty(), 1)); 554 StoreInst *SI = IRB.CreateStore(Inc, P); 555 SetNoSanitizeMetadata(LI); 556 SetNoSanitizeMetadata(SI); 557 } 558 } 559 560 char SanitizerCoverageModule::ID = 0; 561 INITIALIZE_PASS_BEGIN(SanitizerCoverageModule, "sancov", 562 "SanitizerCoverage: TODO." 563 "ModulePass", 564 false, false) 565 INITIALIZE_PASS_DEPENDENCY(DominatorTreeWrapperPass) 566 INITIALIZE_PASS_DEPENDENCY(PostDominatorTreeWrapperPass) 567 INITIALIZE_PASS_END(SanitizerCoverageModule, "sancov", 568 "SanitizerCoverage: TODO." 569 "ModulePass", 570 false, false) 571 ModulePass *llvm::createSanitizerCoverageModulePass( 572 const SanitizerCoverageOptions &Options) { 573 return new SanitizerCoverageModule(Options); 574 } 575