1 //===-- SanitizerCoverage.cpp - coverage instrumentation for sanitizers ---===// 2 // 3 // The LLVM Compiler Infrastructure 4 // 5 // This file is distributed under the University of Illinois Open Source 6 // License. See LICENSE.TXT for details. 7 // 8 //===----------------------------------------------------------------------===// 9 // 10 // Coverage instrumentation that works with AddressSanitizer 11 // and potentially with other Sanitizers. 12 // 13 // We create a Guard variable with the same linkage 14 // as the function and inject this code into the entry block (SCK_Function) 15 // or all blocks (SCK_BB): 16 // if (Guard < 0) { 17 // __sanitizer_cov(&Guard); 18 // } 19 // The accesses to Guard are atomic. The rest of the logic is 20 // in __sanitizer_cov (it's fine to call it more than once). 21 // 22 // With SCK_Edge we also split critical edges this effectively 23 // instrumenting all edges. 24 // 25 // This coverage implementation provides very limited data: 26 // it only tells if a given function (block) was ever executed. No counters. 27 // But for many use cases this is what we need and the added slowdown small. 28 // 29 //===----------------------------------------------------------------------===// 30 31 #include "llvm/ADT/ArrayRef.h" 32 #include "llvm/ADT/SmallVector.h" 33 #include "llvm/Analysis/EHPersonalities.h" 34 #include "llvm/Analysis/PostDominators.h" 35 #include "llvm/IR/CFG.h" 36 #include "llvm/IR/CallSite.h" 37 #include "llvm/IR/DataLayout.h" 38 #include "llvm/IR/DebugInfo.h" 39 #include "llvm/IR/Dominators.h" 40 #include "llvm/IR/Function.h" 41 #include "llvm/IR/IRBuilder.h" 42 #include "llvm/IR/InlineAsm.h" 43 #include "llvm/IR/LLVMContext.h" 44 #include "llvm/IR/MDBuilder.h" 45 #include "llvm/IR/Module.h" 46 #include "llvm/IR/Type.h" 47 #include "llvm/Support/CommandLine.h" 48 #include "llvm/Support/Debug.h" 49 #include "llvm/Support/raw_ostream.h" 50 #include "llvm/Transforms/Instrumentation.h" 51 #include "llvm/Transforms/Scalar.h" 52 #include "llvm/Transforms/Utils/BasicBlockUtils.h" 53 #include "llvm/Transforms/Utils/ModuleUtils.h" 54 55 using namespace llvm; 56 57 #define DEBUG_TYPE "sancov" 58 59 static const char *const SanCovModuleInitName = "__sanitizer_cov_module_init"; 60 static const char *const SanCovName = "__sanitizer_cov"; 61 static const char *const SanCovWithCheckName = "__sanitizer_cov_with_check"; 62 static const char *const SanCovIndirCallName = "__sanitizer_cov_indir_call16"; 63 static const char *const SanCovTracePCIndirName = 64 "__sanitizer_cov_trace_pc_indir"; 65 static const char *const SanCovTracePCName = "__sanitizer_cov_trace_pc"; 66 static const char *const SanCovTraceCmp1 = "__sanitizer_cov_trace_cmp1"; 67 static const char *const SanCovTraceCmp2 = "__sanitizer_cov_trace_cmp2"; 68 static const char *const SanCovTraceCmp4 = "__sanitizer_cov_trace_cmp4"; 69 static const char *const SanCovTraceCmp8 = "__sanitizer_cov_trace_cmp8"; 70 static const char *const SanCovTraceDiv4 = "__sanitizer_cov_trace_div4"; 71 static const char *const SanCovTraceDiv8 = "__sanitizer_cov_trace_div8"; 72 static const char *const SanCovTraceGep = "__sanitizer_cov_trace_gep"; 73 static const char *const SanCovTraceSwitchName = "__sanitizer_cov_trace_switch"; 74 static const char *const SanCovModuleCtorName = "sancov.module_ctor"; 75 static const uint64_t SanCtorAndDtorPriority = 2; 76 77 static const char *const SanCovTracePCGuardName = 78 "__sanitizer_cov_trace_pc_guard"; 79 static const char *const SanCovTracePCGuardInitName = 80 "__sanitizer_cov_trace_pc_guard_init"; 81 82 static cl::opt<int> ClCoverageLevel( 83 "sanitizer-coverage-level", 84 cl::desc("Sanitizer Coverage. 0: none, 1: entry block, 2: all blocks, " 85 "3: all blocks and critical edges, " 86 "4: above plus indirect calls"), 87 cl::Hidden, cl::init(0)); 88 89 static cl::opt<unsigned> ClCoverageBlockThreshold( 90 "sanitizer-coverage-block-threshold", 91 cl::desc("Use a callback with a guard check inside it if there are" 92 " more than this number of blocks."), 93 cl::Hidden, cl::init(0)); 94 95 static cl::opt<bool> ClExperimentalTracePC("sanitizer-coverage-trace-pc", 96 cl::desc("Experimental pc tracing"), 97 cl::Hidden, cl::init(false)); 98 99 static cl::opt<bool> ClTracePCGuard("sanitizer-coverage-trace-pc-guard", 100 cl::desc("pc tracing with a guard"), 101 cl::Hidden, cl::init(false)); 102 103 static cl::opt<bool> 104 ClCMPTracing("sanitizer-coverage-trace-compares", 105 cl::desc("Tracing of CMP and similar instructions"), 106 cl::Hidden, cl::init(false)); 107 108 static cl::opt<bool> ClDIVTracing("sanitizer-coverage-trace-divs", 109 cl::desc("Tracing of DIV instructions"), 110 cl::Hidden, cl::init(false)); 111 112 static cl::opt<bool> ClGEPTracing("sanitizer-coverage-trace-geps", 113 cl::desc("Tracing of GEP instructions"), 114 cl::Hidden, cl::init(false)); 115 116 static cl::opt<bool> 117 ClPruneBlocks("sanitizer-coverage-prune-blocks", 118 cl::desc("Reduce the number of instrumented blocks"), 119 cl::Hidden, cl::init(true)); 120 121 namespace { 122 123 SanitizerCoverageOptions getOptions(int LegacyCoverageLevel) { 124 SanitizerCoverageOptions Res; 125 switch (LegacyCoverageLevel) { 126 case 0: 127 Res.CoverageType = SanitizerCoverageOptions::SCK_None; 128 break; 129 case 1: 130 Res.CoverageType = SanitizerCoverageOptions::SCK_Function; 131 break; 132 case 2: 133 Res.CoverageType = SanitizerCoverageOptions::SCK_BB; 134 break; 135 case 3: 136 Res.CoverageType = SanitizerCoverageOptions::SCK_Edge; 137 break; 138 case 4: 139 Res.CoverageType = SanitizerCoverageOptions::SCK_Edge; 140 Res.IndirectCalls = true; 141 break; 142 } 143 return Res; 144 } 145 146 SanitizerCoverageOptions OverrideFromCL(SanitizerCoverageOptions Options) { 147 // Sets CoverageType and IndirectCalls. 148 SanitizerCoverageOptions CLOpts = getOptions(ClCoverageLevel); 149 Options.CoverageType = std::max(Options.CoverageType, CLOpts.CoverageType); 150 Options.IndirectCalls |= CLOpts.IndirectCalls; 151 Options.TraceCmp |= ClCMPTracing; 152 Options.TraceDiv |= ClDIVTracing; 153 Options.TraceGep |= ClGEPTracing; 154 Options.TracePC |= ClExperimentalTracePC; 155 Options.TracePCGuard |= ClTracePCGuard; 156 return Options; 157 } 158 159 class SanitizerCoverageModule : public ModulePass { 160 public: 161 SanitizerCoverageModule( 162 const SanitizerCoverageOptions &Options = SanitizerCoverageOptions()) 163 : ModulePass(ID), Options(OverrideFromCL(Options)) { 164 initializeSanitizerCoverageModulePass(*PassRegistry::getPassRegistry()); 165 } 166 bool runOnModule(Module &M) override; 167 bool runOnFunction(Function &F); 168 static char ID; // Pass identification, replacement for typeid 169 StringRef getPassName() const override { return "SanitizerCoverageModule"; } 170 171 void getAnalysisUsage(AnalysisUsage &AU) const override { 172 AU.addRequired<DominatorTreeWrapperPass>(); 173 AU.addRequired<PostDominatorTreeWrapperPass>(); 174 } 175 176 private: 177 void InjectCoverageForIndirectCalls(Function &F, 178 ArrayRef<Instruction *> IndirCalls); 179 void InjectTraceForCmp(Function &F, ArrayRef<Instruction *> CmpTraceTargets); 180 void InjectTraceForDiv(Function &F, 181 ArrayRef<BinaryOperator *> DivTraceTargets); 182 void InjectTraceForGep(Function &F, 183 ArrayRef<GetElementPtrInst *> GepTraceTargets); 184 void InjectTraceForSwitch(Function &F, 185 ArrayRef<Instruction *> SwitchTraceTargets); 186 bool InjectCoverage(Function &F, ArrayRef<BasicBlock *> AllBlocks); 187 void CreateFunctionGuardArray(size_t NumGuards, Function &F); 188 void SetNoSanitizeMetadata(Instruction *I); 189 void InjectCoverageAtBlock(Function &F, BasicBlock &BB, size_t Idx, 190 bool UseCalls); 191 unsigned NumberOfInstrumentedBlocks() { 192 return SanCovFunction->getNumUses() + 193 SanCovWithCheckFunction->getNumUses(); 194 } 195 StringRef getSanCovTracePCGuardSection() const; 196 StringRef getSanCovTracePCGuardSectionStart() const; 197 StringRef getSanCovTracePCGuardSectionEnd() const; 198 Function *SanCovFunction; 199 Function *SanCovWithCheckFunction; 200 Function *SanCovIndirCallFunction, *SanCovTracePCIndir; 201 Function *SanCovTracePC, *SanCovTracePCGuard; 202 Function *SanCovTraceCmpFunction[4]; 203 Function *SanCovTraceDivFunction[2]; 204 Function *SanCovTraceGepFunction; 205 Function *SanCovTraceSwitchFunction; 206 InlineAsm *EmptyAsm; 207 Type *IntptrTy, *IntptrPtrTy, *Int64Ty, *Int64PtrTy, *Int32Ty, *Int32PtrTy; 208 Module *CurModule; 209 Triple TargetTriple; 210 LLVMContext *C; 211 const DataLayout *DL; 212 213 GlobalVariable *GuardArray; 214 GlobalVariable *FunctionGuardArray; // for trace-pc-guard. 215 bool HasSancovGuardsSection; 216 217 SanitizerCoverageOptions Options; 218 }; 219 220 } // namespace 221 222 bool SanitizerCoverageModule::runOnModule(Module &M) { 223 if (Options.CoverageType == SanitizerCoverageOptions::SCK_None) 224 return false; 225 C = &(M.getContext()); 226 DL = &M.getDataLayout(); 227 CurModule = &M; 228 TargetTriple = Triple(M.getTargetTriple()); 229 HasSancovGuardsSection = false; 230 IntptrTy = Type::getIntNTy(*C, DL->getPointerSizeInBits()); 231 IntptrPtrTy = PointerType::getUnqual(IntptrTy); 232 Type *VoidTy = Type::getVoidTy(*C); 233 IRBuilder<> IRB(*C); 234 Type *Int8PtrTy = PointerType::getUnqual(IRB.getInt8Ty()); 235 Int64PtrTy = PointerType::getUnqual(IRB.getInt64Ty()); 236 Int32PtrTy = PointerType::getUnqual(IRB.getInt32Ty()); 237 Int64Ty = IRB.getInt64Ty(); 238 Int32Ty = IRB.getInt32Ty(); 239 240 SanCovFunction = checkSanitizerInterfaceFunction( 241 M.getOrInsertFunction(SanCovName, VoidTy, Int32PtrTy)); 242 SanCovWithCheckFunction = checkSanitizerInterfaceFunction( 243 M.getOrInsertFunction(SanCovWithCheckName, VoidTy, Int32PtrTy)); 244 SanCovTracePCIndir = checkSanitizerInterfaceFunction( 245 M.getOrInsertFunction(SanCovTracePCIndirName, VoidTy, IntptrTy)); 246 SanCovIndirCallFunction = 247 checkSanitizerInterfaceFunction(M.getOrInsertFunction( 248 SanCovIndirCallName, VoidTy, IntptrTy, IntptrTy)); 249 SanCovTraceCmpFunction[0] = 250 checkSanitizerInterfaceFunction(M.getOrInsertFunction( 251 SanCovTraceCmp1, VoidTy, IRB.getInt8Ty(), IRB.getInt8Ty())); 252 SanCovTraceCmpFunction[1] = checkSanitizerInterfaceFunction( 253 M.getOrInsertFunction(SanCovTraceCmp2, VoidTy, IRB.getInt16Ty(), 254 IRB.getInt16Ty())); 255 SanCovTraceCmpFunction[2] = checkSanitizerInterfaceFunction( 256 M.getOrInsertFunction(SanCovTraceCmp4, VoidTy, IRB.getInt32Ty(), 257 IRB.getInt32Ty())); 258 SanCovTraceCmpFunction[3] = 259 checkSanitizerInterfaceFunction(M.getOrInsertFunction( 260 SanCovTraceCmp8, VoidTy, Int64Ty, Int64Ty)); 261 262 SanCovTraceDivFunction[0] = 263 checkSanitizerInterfaceFunction(M.getOrInsertFunction( 264 SanCovTraceDiv4, VoidTy, IRB.getInt32Ty())); 265 SanCovTraceDivFunction[1] = 266 checkSanitizerInterfaceFunction(M.getOrInsertFunction( 267 SanCovTraceDiv8, VoidTy, Int64Ty)); 268 SanCovTraceGepFunction = 269 checkSanitizerInterfaceFunction(M.getOrInsertFunction( 270 SanCovTraceGep, VoidTy, IntptrTy)); 271 SanCovTraceSwitchFunction = 272 checkSanitizerInterfaceFunction(M.getOrInsertFunction( 273 SanCovTraceSwitchName, VoidTy, Int64Ty, Int64PtrTy)); 274 275 // We insert an empty inline asm after cov callbacks to avoid callback merge. 276 EmptyAsm = InlineAsm::get(FunctionType::get(IRB.getVoidTy(), false), 277 StringRef(""), StringRef(""), 278 /*hasSideEffects=*/true); 279 280 SanCovTracePC = checkSanitizerInterfaceFunction( 281 M.getOrInsertFunction(SanCovTracePCName, VoidTy)); 282 SanCovTracePCGuard = checkSanitizerInterfaceFunction(M.getOrInsertFunction( 283 SanCovTracePCGuardName, VoidTy, Int32PtrTy)); 284 285 // At this point we create a dummy array of guards because we don't 286 // know how many elements we will need. 287 Type *Int32Ty = IRB.getInt32Ty(); 288 289 if (!Options.TracePCGuard) 290 GuardArray = 291 new GlobalVariable(M, Int32Ty, false, GlobalValue::ExternalLinkage, 292 nullptr, "__sancov_gen_cov_tmp"); 293 294 for (auto &F : M) 295 runOnFunction(F); 296 297 auto N = NumberOfInstrumentedBlocks(); 298 299 GlobalVariable *RealGuardArray = nullptr; 300 if (!Options.TracePCGuard) { 301 // Now we know how many elements we need. Create an array of guards 302 // with one extra element at the beginning for the size. 303 Type *Int32ArrayNTy = ArrayType::get(Int32Ty, N + 1); 304 RealGuardArray = new GlobalVariable( 305 M, Int32ArrayNTy, false, GlobalValue::PrivateLinkage, 306 Constant::getNullValue(Int32ArrayNTy), "__sancov_gen_cov"); 307 308 // Replace the dummy array with the real one. 309 GuardArray->replaceAllUsesWith( 310 IRB.CreatePointerCast(RealGuardArray, Int32PtrTy)); 311 GuardArray->eraseFromParent(); 312 } 313 314 // Create variable for module (compilation unit) name 315 Constant *ModNameStrConst = 316 ConstantDataArray::getString(M.getContext(), M.getName(), true); 317 GlobalVariable *ModuleName = new GlobalVariable( 318 M, ModNameStrConst->getType(), true, GlobalValue::PrivateLinkage, 319 ModNameStrConst, "__sancov_gen_modname"); 320 if (Options.TracePCGuard) { 321 if (HasSancovGuardsSection) { 322 Function *CtorFunc; 323 GlobalVariable *SecStart = new GlobalVariable( 324 M, Int32PtrTy, false, GlobalVariable::ExternalLinkage, nullptr, 325 getSanCovTracePCGuardSectionStart()); 326 SecStart->setVisibility(GlobalValue::HiddenVisibility); 327 GlobalVariable *SecEnd = new GlobalVariable( 328 M, Int32PtrTy, false, GlobalVariable::ExternalLinkage, nullptr, 329 getSanCovTracePCGuardSectionEnd()); 330 SecEnd->setVisibility(GlobalValue::HiddenVisibility); 331 332 std::tie(CtorFunc, std::ignore) = createSanitizerCtorAndInitFunctions( 333 M, SanCovModuleCtorName, SanCovTracePCGuardInitName, 334 {Int32PtrTy, Int32PtrTy}, 335 {IRB.CreatePointerCast(SecStart, Int32PtrTy), 336 IRB.CreatePointerCast(SecEnd, Int32PtrTy)}); 337 338 if (TargetTriple.supportsCOMDAT()) { 339 // Use comdat to dedup CtorFunc. 340 CtorFunc->setComdat(M.getOrInsertComdat(SanCovModuleCtorName)); 341 appendToGlobalCtors(M, CtorFunc, SanCtorAndDtorPriority, CtorFunc); 342 } else { 343 appendToGlobalCtors(M, CtorFunc, SanCtorAndDtorPriority); 344 } 345 } 346 } else if (!Options.TracePC) { 347 Function *CtorFunc; 348 std::tie(CtorFunc, std::ignore) = createSanitizerCtorAndInitFunctions( 349 M, SanCovModuleCtorName, SanCovModuleInitName, 350 {Int32PtrTy, IntptrTy, Int8PtrTy, Int8PtrTy}, 351 {IRB.CreatePointerCast(RealGuardArray, Int32PtrTy), 352 ConstantInt::get(IntptrTy, N), Constant::getNullValue(Int8PtrTy), 353 IRB.CreatePointerCast(ModuleName, Int8PtrTy)}); 354 355 appendToGlobalCtors(M, CtorFunc, SanCtorAndDtorPriority); 356 } 357 358 return true; 359 } 360 361 // True if block has successors and it dominates all of them. 362 static bool isFullDominator(const BasicBlock *BB, const DominatorTree *DT) { 363 if (succ_begin(BB) == succ_end(BB)) 364 return false; 365 366 for (const BasicBlock *SUCC : make_range(succ_begin(BB), succ_end(BB))) { 367 if (!DT->dominates(BB, SUCC)) 368 return false; 369 } 370 371 return true; 372 } 373 374 // True if block has predecessors and it postdominates all of them. 375 static bool isFullPostDominator(const BasicBlock *BB, 376 const PostDominatorTree *PDT) { 377 if (pred_begin(BB) == pred_end(BB)) 378 return false; 379 380 for (const BasicBlock *PRED : make_range(pred_begin(BB), pred_end(BB))) { 381 if (!PDT->dominates(BB, PRED)) 382 return false; 383 } 384 385 return true; 386 } 387 388 static bool shouldInstrumentBlock(const Function& F, const BasicBlock *BB, const DominatorTree *DT, 389 const PostDominatorTree *PDT) { 390 // Don't insert coverage for unreachable blocks: we will never call 391 // __sanitizer_cov() for them, so counting them in 392 // NumberOfInstrumentedBlocks() might complicate calculation of code coverage 393 // percentage. Also, unreachable instructions frequently have no debug 394 // locations. 395 if (isa<UnreachableInst>(BB->getTerminator())) 396 return false; 397 398 // Don't insert coverage into blocks without a valid insertion point 399 // (catchswitch blocks). 400 if (BB->getFirstInsertionPt() == BB->end()) 401 return false; 402 403 if (!ClPruneBlocks || &F.getEntryBlock() == BB) 404 return true; 405 406 return !(isFullDominator(BB, DT) || isFullPostDominator(BB, PDT)); 407 } 408 409 bool SanitizerCoverageModule::runOnFunction(Function &F) { 410 if (F.empty()) 411 return false; 412 if (F.getName().find(".module_ctor") != std::string::npos) 413 return false; // Should not instrument sanitizer init functions. 414 if (F.getName().startswith("__sanitizer_")) 415 return false; // Don't instrument __sanitizer_* callbacks. 416 // Don't instrument MSVC CRT configuration helpers. They may run before normal 417 // initialization. 418 if (F.getName() == "__local_stdio_printf_options" || 419 F.getName() == "__local_stdio_scanf_options") 420 return false; 421 // Don't instrument functions using SEH for now. Splitting basic blocks like 422 // we do for coverage breaks WinEHPrepare. 423 // FIXME: Remove this when SEH no longer uses landingpad pattern matching. 424 if (F.hasPersonalityFn() && 425 isAsynchronousEHPersonality(classifyEHPersonality(F.getPersonalityFn()))) 426 return false; 427 if (Options.CoverageType >= SanitizerCoverageOptions::SCK_Edge) 428 SplitAllCriticalEdges(F); 429 SmallVector<Instruction *, 8> IndirCalls; 430 SmallVector<BasicBlock *, 16> BlocksToInstrument; 431 SmallVector<Instruction *, 8> CmpTraceTargets; 432 SmallVector<Instruction *, 8> SwitchTraceTargets; 433 SmallVector<BinaryOperator *, 8> DivTraceTargets; 434 SmallVector<GetElementPtrInst *, 8> GepTraceTargets; 435 436 const DominatorTree *DT = 437 &getAnalysis<DominatorTreeWrapperPass>(F).getDomTree(); 438 const PostDominatorTree *PDT = 439 &getAnalysis<PostDominatorTreeWrapperPass>(F).getPostDomTree(); 440 441 for (auto &BB : F) { 442 if (shouldInstrumentBlock(F, &BB, DT, PDT)) 443 BlocksToInstrument.push_back(&BB); 444 for (auto &Inst : BB) { 445 if (Options.IndirectCalls) { 446 CallSite CS(&Inst); 447 if (CS && !CS.getCalledFunction()) 448 IndirCalls.push_back(&Inst); 449 } 450 if (Options.TraceCmp) { 451 if (isa<ICmpInst>(&Inst)) 452 CmpTraceTargets.push_back(&Inst); 453 if (isa<SwitchInst>(&Inst)) 454 SwitchTraceTargets.push_back(&Inst); 455 } 456 if (Options.TraceDiv) 457 if (BinaryOperator *BO = dyn_cast<BinaryOperator>(&Inst)) 458 if (BO->getOpcode() == Instruction::SDiv || 459 BO->getOpcode() == Instruction::UDiv) 460 DivTraceTargets.push_back(BO); 461 if (Options.TraceGep) 462 if (GetElementPtrInst *GEP = dyn_cast<GetElementPtrInst>(&Inst)) 463 GepTraceTargets.push_back(GEP); 464 } 465 } 466 467 InjectCoverage(F, BlocksToInstrument); 468 InjectCoverageForIndirectCalls(F, IndirCalls); 469 InjectTraceForCmp(F, CmpTraceTargets); 470 InjectTraceForSwitch(F, SwitchTraceTargets); 471 InjectTraceForDiv(F, DivTraceTargets); 472 InjectTraceForGep(F, GepTraceTargets); 473 return true; 474 } 475 void SanitizerCoverageModule::CreateFunctionGuardArray(size_t NumGuards, 476 Function &F) { 477 if (!Options.TracePCGuard) return; 478 HasSancovGuardsSection = true; 479 ArrayType *ArrayOfInt32Ty = ArrayType::get(Int32Ty, NumGuards); 480 FunctionGuardArray = new GlobalVariable( 481 *CurModule, ArrayOfInt32Ty, false, GlobalVariable::PrivateLinkage, 482 Constant::getNullValue(ArrayOfInt32Ty), "__sancov_gen_"); 483 if (auto Comdat = F.getComdat()) 484 FunctionGuardArray->setComdat(Comdat); 485 FunctionGuardArray->setSection(getSanCovTracePCGuardSection()); 486 } 487 488 bool SanitizerCoverageModule::InjectCoverage(Function &F, 489 ArrayRef<BasicBlock *> AllBlocks) { 490 if (AllBlocks.empty()) return false; 491 switch (Options.CoverageType) { 492 case SanitizerCoverageOptions::SCK_None: 493 return false; 494 case SanitizerCoverageOptions::SCK_Function: 495 CreateFunctionGuardArray(1, F); 496 InjectCoverageAtBlock(F, F.getEntryBlock(), 0, false); 497 return true; 498 default: { 499 bool UseCalls = ClCoverageBlockThreshold < AllBlocks.size(); 500 CreateFunctionGuardArray(AllBlocks.size(), F); 501 for (size_t i = 0, N = AllBlocks.size(); i < N; i++) 502 InjectCoverageAtBlock(F, *AllBlocks[i], i, UseCalls); 503 return true; 504 } 505 } 506 } 507 508 // On every indirect call we call a run-time function 509 // __sanitizer_cov_indir_call* with two parameters: 510 // - callee address, 511 // - global cache array that contains CacheSize pointers (zero-initialized). 512 // The cache is used to speed up recording the caller-callee pairs. 513 // The address of the caller is passed implicitly via caller PC. 514 // CacheSize is encoded in the name of the run-time function. 515 void SanitizerCoverageModule::InjectCoverageForIndirectCalls( 516 Function &F, ArrayRef<Instruction *> IndirCalls) { 517 if (IndirCalls.empty()) 518 return; 519 const int CacheSize = 16; 520 const int CacheAlignment = 64; // Align for better performance. 521 Type *Ty = ArrayType::get(IntptrTy, CacheSize); 522 for (auto I : IndirCalls) { 523 IRBuilder<> IRB(I); 524 CallSite CS(I); 525 Value *Callee = CS.getCalledValue(); 526 if (isa<InlineAsm>(Callee)) 527 continue; 528 GlobalVariable *CalleeCache = new GlobalVariable( 529 *F.getParent(), Ty, false, GlobalValue::PrivateLinkage, 530 Constant::getNullValue(Ty), "__sancov_gen_callee_cache"); 531 CalleeCache->setAlignment(CacheAlignment); 532 if (Options.TracePC || Options.TracePCGuard) 533 IRB.CreateCall(SanCovTracePCIndir, 534 IRB.CreatePointerCast(Callee, IntptrTy)); 535 else 536 IRB.CreateCall(SanCovIndirCallFunction, 537 {IRB.CreatePointerCast(Callee, IntptrTy), 538 IRB.CreatePointerCast(CalleeCache, IntptrTy)}); 539 } 540 } 541 542 // For every switch statement we insert a call: 543 // __sanitizer_cov_trace_switch(CondValue, 544 // {NumCases, ValueSizeInBits, Case0Value, Case1Value, Case2Value, ... }) 545 546 void SanitizerCoverageModule::InjectTraceForSwitch( 547 Function &, ArrayRef<Instruction *> SwitchTraceTargets) { 548 for (auto I : SwitchTraceTargets) { 549 if (SwitchInst *SI = dyn_cast<SwitchInst>(I)) { 550 IRBuilder<> IRB(I); 551 SmallVector<Constant *, 16> Initializers; 552 Value *Cond = SI->getCondition(); 553 if (Cond->getType()->getScalarSizeInBits() > 554 Int64Ty->getScalarSizeInBits()) 555 continue; 556 Initializers.push_back(ConstantInt::get(Int64Ty, SI->getNumCases())); 557 Initializers.push_back( 558 ConstantInt::get(Int64Ty, Cond->getType()->getScalarSizeInBits())); 559 if (Cond->getType()->getScalarSizeInBits() < 560 Int64Ty->getScalarSizeInBits()) 561 Cond = IRB.CreateIntCast(Cond, Int64Ty, false); 562 for (auto It : SI->cases()) { 563 Constant *C = It.getCaseValue(); 564 if (C->getType()->getScalarSizeInBits() < 565 Int64Ty->getScalarSizeInBits()) 566 C = ConstantExpr::getCast(CastInst::ZExt, It.getCaseValue(), Int64Ty); 567 Initializers.push_back(C); 568 } 569 std::sort(Initializers.begin() + 2, Initializers.end(), 570 [](const Constant *A, const Constant *B) { 571 return cast<ConstantInt>(A)->getLimitedValue() < 572 cast<ConstantInt>(B)->getLimitedValue(); 573 }); 574 ArrayType *ArrayOfInt64Ty = ArrayType::get(Int64Ty, Initializers.size()); 575 GlobalVariable *GV = new GlobalVariable( 576 *CurModule, ArrayOfInt64Ty, false, GlobalVariable::InternalLinkage, 577 ConstantArray::get(ArrayOfInt64Ty, Initializers), 578 "__sancov_gen_cov_switch_values"); 579 IRB.CreateCall(SanCovTraceSwitchFunction, 580 {Cond, IRB.CreatePointerCast(GV, Int64PtrTy)}); 581 } 582 } 583 } 584 585 void SanitizerCoverageModule::InjectTraceForDiv( 586 Function &, ArrayRef<BinaryOperator *> DivTraceTargets) { 587 for (auto BO : DivTraceTargets) { 588 IRBuilder<> IRB(BO); 589 Value *A1 = BO->getOperand(1); 590 if (isa<ConstantInt>(A1)) continue; 591 if (!A1->getType()->isIntegerTy()) 592 continue; 593 uint64_t TypeSize = DL->getTypeStoreSizeInBits(A1->getType()); 594 int CallbackIdx = TypeSize == 32 ? 0 : 595 TypeSize == 64 ? 1 : -1; 596 if (CallbackIdx < 0) continue; 597 auto Ty = Type::getIntNTy(*C, TypeSize); 598 IRB.CreateCall(SanCovTraceDivFunction[CallbackIdx], 599 {IRB.CreateIntCast(A1, Ty, true)}); 600 } 601 } 602 603 void SanitizerCoverageModule::InjectTraceForGep( 604 Function &, ArrayRef<GetElementPtrInst *> GepTraceTargets) { 605 for (auto GEP : GepTraceTargets) { 606 IRBuilder<> IRB(GEP); 607 for (auto I = GEP->idx_begin(); I != GEP->idx_end(); ++I) 608 if (!isa<ConstantInt>(*I) && (*I)->getType()->isIntegerTy()) 609 IRB.CreateCall(SanCovTraceGepFunction, 610 {IRB.CreateIntCast(*I, IntptrTy, true)}); 611 } 612 } 613 614 void SanitizerCoverageModule::InjectTraceForCmp( 615 Function &, ArrayRef<Instruction *> CmpTraceTargets) { 616 for (auto I : CmpTraceTargets) { 617 if (ICmpInst *ICMP = dyn_cast<ICmpInst>(I)) { 618 IRBuilder<> IRB(ICMP); 619 Value *A0 = ICMP->getOperand(0); 620 Value *A1 = ICMP->getOperand(1); 621 if (!A0->getType()->isIntegerTy()) 622 continue; 623 uint64_t TypeSize = DL->getTypeStoreSizeInBits(A0->getType()); 624 int CallbackIdx = TypeSize == 8 ? 0 : 625 TypeSize == 16 ? 1 : 626 TypeSize == 32 ? 2 : 627 TypeSize == 64 ? 3 : -1; 628 if (CallbackIdx < 0) continue; 629 // __sanitizer_cov_trace_cmp((type_size << 32) | predicate, A0, A1); 630 auto Ty = Type::getIntNTy(*C, TypeSize); 631 IRB.CreateCall( 632 SanCovTraceCmpFunction[CallbackIdx], 633 {IRB.CreateIntCast(A0, Ty, true), IRB.CreateIntCast(A1, Ty, true)}); 634 } 635 } 636 } 637 638 void SanitizerCoverageModule::SetNoSanitizeMetadata(Instruction *I) { 639 I->setMetadata(I->getModule()->getMDKindID("nosanitize"), 640 MDNode::get(*C, None)); 641 } 642 643 void SanitizerCoverageModule::InjectCoverageAtBlock(Function &F, BasicBlock &BB, 644 size_t Idx, bool UseCalls) { 645 BasicBlock::iterator IP = BB.getFirstInsertionPt(); 646 bool IsEntryBB = &BB == &F.getEntryBlock(); 647 DebugLoc EntryLoc; 648 if (IsEntryBB) { 649 if (auto SP = F.getSubprogram()) 650 EntryLoc = DebugLoc::get(SP->getScopeLine(), 0, SP); 651 // Keep static allocas and llvm.localescape calls in the entry block. Even 652 // if we aren't splitting the block, it's nice for allocas to be before 653 // calls. 654 IP = PrepareToSplitEntryBlock(BB, IP); 655 } else { 656 EntryLoc = IP->getDebugLoc(); 657 } 658 659 IRBuilder<> IRB(&*IP); 660 IRB.SetCurrentDebugLocation(EntryLoc); 661 if (Options.TracePC) { 662 IRB.CreateCall(SanCovTracePC); // gets the PC using GET_CALLER_PC. 663 IRB.CreateCall(EmptyAsm, {}); // Avoids callback merge. 664 } else if (Options.TracePCGuard) { 665 auto GuardPtr = IRB.CreateIntToPtr( 666 IRB.CreateAdd(IRB.CreatePointerCast(FunctionGuardArray, IntptrTy), 667 ConstantInt::get(IntptrTy, Idx * 4)), 668 Int32PtrTy); 669 if (!UseCalls) { 670 auto GuardLoad = IRB.CreateLoad(GuardPtr); 671 GuardLoad->setAtomic(AtomicOrdering::Monotonic); 672 GuardLoad->setAlignment(8); 673 SetNoSanitizeMetadata(GuardLoad); // Don't instrument with e.g. asan. 674 auto Cmp = IRB.CreateICmpNE( 675 GuardLoad, Constant::getNullValue(GuardLoad->getType())); 676 auto Ins = SplitBlockAndInsertIfThen( 677 Cmp, &*IP, false, MDBuilder(*C).createBranchWeights(1, 100000)); 678 IRB.SetInsertPoint(Ins); 679 IRB.SetCurrentDebugLocation(EntryLoc); 680 } 681 IRB.CreateCall(SanCovTracePCGuard, GuardPtr); 682 IRB.CreateCall(EmptyAsm, {}); // Avoids callback merge. 683 } else { 684 Value *GuardP = IRB.CreateAdd( 685 IRB.CreatePointerCast(GuardArray, IntptrTy), 686 ConstantInt::get(IntptrTy, (1 + NumberOfInstrumentedBlocks()) * 4)); 687 GuardP = IRB.CreateIntToPtr(GuardP, Int32PtrTy); 688 if (UseCalls) { 689 IRB.CreateCall(SanCovWithCheckFunction, GuardP); 690 } else { 691 LoadInst *Load = IRB.CreateLoad(GuardP); 692 Load->setAtomic(AtomicOrdering::Monotonic); 693 Load->setAlignment(4); 694 SetNoSanitizeMetadata(Load); 695 Value *Cmp = 696 IRB.CreateICmpSGE(Constant::getNullValue(Load->getType()), Load); 697 Instruction *Ins = SplitBlockAndInsertIfThen( 698 Cmp, &*IP, false, MDBuilder(*C).createBranchWeights(1, 100000)); 699 IRB.SetInsertPoint(Ins); 700 IRB.SetCurrentDebugLocation(EntryLoc); 701 // __sanitizer_cov gets the PC of the instruction using GET_CALLER_PC. 702 IRB.CreateCall(SanCovFunction, GuardP); 703 IRB.CreateCall(EmptyAsm, {}); // Avoids callback merge. 704 } 705 } 706 } 707 708 StringRef SanitizerCoverageModule::getSanCovTracePCGuardSection() const { 709 if (TargetTriple.getObjectFormat() == Triple::COFF) 710 return ".SCOV$M"; 711 if (TargetTriple.isOSBinFormatMachO()) 712 return "__DATA,__sancov_guards"; 713 return "__sancov_guards"; 714 } 715 716 StringRef SanitizerCoverageModule::getSanCovTracePCGuardSectionStart() const { 717 if (TargetTriple.isOSBinFormatMachO()) 718 return "\1section$start$__DATA$__sancov_guards"; 719 return "__start___sancov_guards"; 720 } 721 722 StringRef SanitizerCoverageModule::getSanCovTracePCGuardSectionEnd() const { 723 if (TargetTriple.isOSBinFormatMachO()) 724 return "\1section$end$__DATA$__sancov_guards"; 725 return "__stop___sancov_guards"; 726 } 727 728 729 char SanitizerCoverageModule::ID = 0; 730 INITIALIZE_PASS_BEGIN(SanitizerCoverageModule, "sancov", 731 "SanitizerCoverage: TODO." 732 "ModulePass", 733 false, false) 734 INITIALIZE_PASS_DEPENDENCY(DominatorTreeWrapperPass) 735 INITIALIZE_PASS_DEPENDENCY(PostDominatorTreeWrapperPass) 736 INITIALIZE_PASS_END(SanitizerCoverageModule, "sancov", 737 "SanitizerCoverage: TODO." 738 "ModulePass", 739 false, false) 740 ModulePass *llvm::createSanitizerCoverageModulePass( 741 const SanitizerCoverageOptions &Options) { 742 return new SanitizerCoverageModule(Options); 743 } 744