1 //===-- SanitizerCoverage.cpp - coverage instrumentation for sanitizers ---===// 2 // 3 // The LLVM Compiler Infrastructure 4 // 5 // This file is distributed under the University of Illinois Open Source 6 // License. See LICENSE.TXT for details. 7 // 8 //===----------------------------------------------------------------------===// 9 // 10 // Coverage instrumentation that works with AddressSanitizer 11 // and potentially with other Sanitizers. 12 // 13 // We create a Guard variable with the same linkage 14 // as the function and inject this code into the entry block (SCK_Function) 15 // or all blocks (SCK_BB): 16 // if (Guard < 0) { 17 // __sanitizer_cov(&Guard); 18 // } 19 // The accesses to Guard are atomic. The rest of the logic is 20 // in __sanitizer_cov (it's fine to call it more than once). 21 // 22 // With SCK_Edge we also split critical edges this effectively 23 // instrumenting all edges. 24 // 25 // This coverage implementation provides very limited data: 26 // it only tells if a given function (block) was ever executed. No counters. 27 // But for many use cases this is what we need and the added slowdown small. 28 // 29 //===----------------------------------------------------------------------===// 30 31 #include "llvm/ADT/ArrayRef.h" 32 #include "llvm/ADT/SmallVector.h" 33 #include "llvm/Analysis/EHPersonalities.h" 34 #include "llvm/Analysis/PostDominators.h" 35 #include "llvm/IR/CFG.h" 36 #include "llvm/IR/CallSite.h" 37 #include "llvm/IR/DataLayout.h" 38 #include "llvm/IR/DebugInfo.h" 39 #include "llvm/IR/Dominators.h" 40 #include "llvm/IR/Function.h" 41 #include "llvm/IR/IRBuilder.h" 42 #include "llvm/IR/InlineAsm.h" 43 #include "llvm/IR/LLVMContext.h" 44 #include "llvm/IR/MDBuilder.h" 45 #include "llvm/IR/Module.h" 46 #include "llvm/IR/Type.h" 47 #include "llvm/Support/CommandLine.h" 48 #include "llvm/Support/Debug.h" 49 #include "llvm/Support/raw_ostream.h" 50 #include "llvm/Transforms/Instrumentation.h" 51 #include "llvm/Transforms/Scalar.h" 52 #include "llvm/Transforms/Utils/BasicBlockUtils.h" 53 #include "llvm/Transforms/Utils/ModuleUtils.h" 54 55 using namespace llvm; 56 57 #define DEBUG_TYPE "sancov" 58 59 static const char *const SanCovModuleInitName = "__sanitizer_cov_module_init"; 60 static const char *const SanCovName = "__sanitizer_cov"; 61 static const char *const SanCovWithCheckName = "__sanitizer_cov_with_check"; 62 static const char *const SanCovIndirCallName = "__sanitizer_cov_indir_call16"; 63 static const char *const SanCovTracePCIndirName = 64 "__sanitizer_cov_trace_pc_indir"; 65 static const char *const SanCovTraceEnterName = 66 "__sanitizer_cov_trace_func_enter"; 67 static const char *const SanCovTracePCName = "__sanitizer_cov_trace_pc"; 68 static const char *const SanCovTraceCmp1 = "__sanitizer_cov_trace_cmp1"; 69 static const char *const SanCovTraceCmp2 = "__sanitizer_cov_trace_cmp2"; 70 static const char *const SanCovTraceCmp4 = "__sanitizer_cov_trace_cmp4"; 71 static const char *const SanCovTraceCmp8 = "__sanitizer_cov_trace_cmp8"; 72 static const char *const SanCovTraceDiv4 = "__sanitizer_cov_trace_div4"; 73 static const char *const SanCovTraceDiv8 = "__sanitizer_cov_trace_div8"; 74 static const char *const SanCovTraceGep = "__sanitizer_cov_trace_gep"; 75 static const char *const SanCovTraceSwitchName = "__sanitizer_cov_trace_switch"; 76 static const char *const SanCovModuleCtorName = "sancov.module_ctor"; 77 static const uint64_t SanCtorAndDtorPriority = 2; 78 79 static const char *const SanCovTracePCGuardName = 80 "__sanitizer_cov_trace_pc_guard"; 81 static const char *const SanCovTracePCGuardInitName = 82 "__sanitizer_cov_trace_pc_guard_init"; 83 84 static cl::opt<int> ClCoverageLevel( 85 "sanitizer-coverage-level", 86 cl::desc("Sanitizer Coverage. 0: none, 1: entry block, 2: all blocks, " 87 "3: all blocks and critical edges, " 88 "4: above plus indirect calls"), 89 cl::Hidden, cl::init(0)); 90 91 static cl::opt<unsigned> ClCoverageBlockThreshold( 92 "sanitizer-coverage-block-threshold", 93 cl::desc("Use a callback with a guard check inside it if there are" 94 " more than this number of blocks."), 95 cl::Hidden, cl::init(0)); 96 97 static cl::opt<bool> ClExperimentalTracePC("sanitizer-coverage-trace-pc", 98 cl::desc("Experimental pc tracing"), 99 cl::Hidden, cl::init(false)); 100 101 static cl::opt<bool> ClTracePCGuard("sanitizer-coverage-trace-pc-guard", 102 cl::desc("pc tracing with a guard"), 103 cl::Hidden, cl::init(false)); 104 105 static cl::opt<bool> 106 ClCMPTracing("sanitizer-coverage-trace-compares", 107 cl::desc("Tracing of CMP and similar instructions"), 108 cl::Hidden, cl::init(false)); 109 110 static cl::opt<bool> ClDIVTracing("sanitizer-coverage-trace-divs", 111 cl::desc("Tracing of DIV instructions"), 112 cl::Hidden, cl::init(false)); 113 114 static cl::opt<bool> ClGEPTracing("sanitizer-coverage-trace-geps", 115 cl::desc("Tracing of GEP instructions"), 116 cl::Hidden, cl::init(false)); 117 118 static cl::opt<bool> 119 ClPruneBlocks("sanitizer-coverage-prune-blocks", 120 cl::desc("Reduce the number of instrumented blocks"), 121 cl::Hidden, cl::init(true)); 122 123 namespace { 124 125 SanitizerCoverageOptions getOptions(int LegacyCoverageLevel) { 126 SanitizerCoverageOptions Res; 127 switch (LegacyCoverageLevel) { 128 case 0: 129 Res.CoverageType = SanitizerCoverageOptions::SCK_None; 130 break; 131 case 1: 132 Res.CoverageType = SanitizerCoverageOptions::SCK_Function; 133 break; 134 case 2: 135 Res.CoverageType = SanitizerCoverageOptions::SCK_BB; 136 break; 137 case 3: 138 Res.CoverageType = SanitizerCoverageOptions::SCK_Edge; 139 break; 140 case 4: 141 Res.CoverageType = SanitizerCoverageOptions::SCK_Edge; 142 Res.IndirectCalls = true; 143 break; 144 } 145 return Res; 146 } 147 148 SanitizerCoverageOptions OverrideFromCL(SanitizerCoverageOptions Options) { 149 // Sets CoverageType and IndirectCalls. 150 SanitizerCoverageOptions CLOpts = getOptions(ClCoverageLevel); 151 Options.CoverageType = std::max(Options.CoverageType, CLOpts.CoverageType); 152 Options.IndirectCalls |= CLOpts.IndirectCalls; 153 Options.TraceCmp |= ClCMPTracing; 154 Options.TraceDiv |= ClDIVTracing; 155 Options.TraceGep |= ClGEPTracing; 156 Options.TracePC |= ClExperimentalTracePC; 157 Options.TracePCGuard |= ClTracePCGuard; 158 return Options; 159 } 160 161 class SanitizerCoverageModule : public ModulePass { 162 public: 163 SanitizerCoverageModule( 164 const SanitizerCoverageOptions &Options = SanitizerCoverageOptions()) 165 : ModulePass(ID), Options(OverrideFromCL(Options)) { 166 initializeSanitizerCoverageModulePass(*PassRegistry::getPassRegistry()); 167 } 168 bool runOnModule(Module &M) override; 169 bool runOnFunction(Function &F); 170 static char ID; // Pass identification, replacement for typeid 171 StringRef getPassName() const override { return "SanitizerCoverageModule"; } 172 173 void getAnalysisUsage(AnalysisUsage &AU) const override { 174 AU.addRequired<DominatorTreeWrapperPass>(); 175 AU.addRequired<PostDominatorTreeWrapperPass>(); 176 } 177 178 private: 179 void InjectCoverageForIndirectCalls(Function &F, 180 ArrayRef<Instruction *> IndirCalls); 181 void InjectTraceForCmp(Function &F, ArrayRef<Instruction *> CmpTraceTargets); 182 void InjectTraceForDiv(Function &F, 183 ArrayRef<BinaryOperator *> DivTraceTargets); 184 void InjectTraceForGep(Function &F, 185 ArrayRef<GetElementPtrInst *> GepTraceTargets); 186 void InjectTraceForSwitch(Function &F, 187 ArrayRef<Instruction *> SwitchTraceTargets); 188 bool InjectCoverage(Function &F, ArrayRef<BasicBlock *> AllBlocks); 189 void CreateFunctionGuardArray(size_t NumGuards, Function &F); 190 void SetNoSanitizeMetadata(Instruction *I); 191 void InjectCoverageAtBlock(Function &F, BasicBlock &BB, size_t Idx, 192 bool UseCalls); 193 unsigned NumberOfInstrumentedBlocks() { 194 return SanCovFunction->getNumUses() + 195 SanCovWithCheckFunction->getNumUses(); 196 } 197 StringRef getSanCovTracePCGuardSection() const; 198 StringRef getSanCovTracePCGuardSectionStart() const; 199 StringRef getSanCovTracePCGuardSectionEnd() const; 200 Function *SanCovFunction; 201 Function *SanCovWithCheckFunction; 202 Function *SanCovIndirCallFunction, *SanCovTracePCIndir; 203 Function *SanCovTracePC, *SanCovTracePCGuard; 204 Function *SanCovTraceCmpFunction[4]; 205 Function *SanCovTraceDivFunction[2]; 206 Function *SanCovTraceGepFunction; 207 Function *SanCovTraceSwitchFunction; 208 InlineAsm *EmptyAsm; 209 Type *IntptrTy, *IntptrPtrTy, *Int64Ty, *Int64PtrTy, *Int32Ty, *Int32PtrTy; 210 Module *CurModule; 211 Triple TargetTriple; 212 LLVMContext *C; 213 const DataLayout *DL; 214 215 GlobalVariable *GuardArray; 216 GlobalVariable *FunctionGuardArray; // for trace-pc-guard. 217 bool HasSancovGuardsSection; 218 219 SanitizerCoverageOptions Options; 220 }; 221 222 } // namespace 223 224 bool SanitizerCoverageModule::runOnModule(Module &M) { 225 if (Options.CoverageType == SanitizerCoverageOptions::SCK_None) 226 return false; 227 C = &(M.getContext()); 228 DL = &M.getDataLayout(); 229 CurModule = &M; 230 TargetTriple = Triple(M.getTargetTriple()); 231 HasSancovGuardsSection = false; 232 IntptrTy = Type::getIntNTy(*C, DL->getPointerSizeInBits()); 233 IntptrPtrTy = PointerType::getUnqual(IntptrTy); 234 Type *VoidTy = Type::getVoidTy(*C); 235 IRBuilder<> IRB(*C); 236 Type *Int8PtrTy = PointerType::getUnqual(IRB.getInt8Ty()); 237 Int64PtrTy = PointerType::getUnqual(IRB.getInt64Ty()); 238 Int32PtrTy = PointerType::getUnqual(IRB.getInt32Ty()); 239 Int64Ty = IRB.getInt64Ty(); 240 Int32Ty = IRB.getInt32Ty(); 241 242 SanCovFunction = checkSanitizerInterfaceFunction( 243 M.getOrInsertFunction(SanCovName, VoidTy, Int32PtrTy)); 244 SanCovWithCheckFunction = checkSanitizerInterfaceFunction( 245 M.getOrInsertFunction(SanCovWithCheckName, VoidTy, Int32PtrTy)); 246 SanCovTracePCIndir = checkSanitizerInterfaceFunction( 247 M.getOrInsertFunction(SanCovTracePCIndirName, VoidTy, IntptrTy)); 248 SanCovIndirCallFunction = 249 checkSanitizerInterfaceFunction(M.getOrInsertFunction( 250 SanCovIndirCallName, VoidTy, IntptrTy, IntptrTy)); 251 SanCovTraceCmpFunction[0] = 252 checkSanitizerInterfaceFunction(M.getOrInsertFunction( 253 SanCovTraceCmp1, VoidTy, IRB.getInt8Ty(), IRB.getInt8Ty())); 254 SanCovTraceCmpFunction[1] = checkSanitizerInterfaceFunction( 255 M.getOrInsertFunction(SanCovTraceCmp2, VoidTy, IRB.getInt16Ty(), 256 IRB.getInt16Ty())); 257 SanCovTraceCmpFunction[2] = checkSanitizerInterfaceFunction( 258 M.getOrInsertFunction(SanCovTraceCmp4, VoidTy, IRB.getInt32Ty(), 259 IRB.getInt32Ty())); 260 SanCovTraceCmpFunction[3] = 261 checkSanitizerInterfaceFunction(M.getOrInsertFunction( 262 SanCovTraceCmp8, VoidTy, Int64Ty, Int64Ty)); 263 264 SanCovTraceDivFunction[0] = 265 checkSanitizerInterfaceFunction(M.getOrInsertFunction( 266 SanCovTraceDiv4, VoidTy, IRB.getInt32Ty())); 267 SanCovTraceDivFunction[1] = 268 checkSanitizerInterfaceFunction(M.getOrInsertFunction( 269 SanCovTraceDiv8, VoidTy, Int64Ty)); 270 SanCovTraceGepFunction = 271 checkSanitizerInterfaceFunction(M.getOrInsertFunction( 272 SanCovTraceGep, VoidTy, IntptrTy)); 273 SanCovTraceSwitchFunction = 274 checkSanitizerInterfaceFunction(M.getOrInsertFunction( 275 SanCovTraceSwitchName, VoidTy, Int64Ty, Int64PtrTy)); 276 277 // We insert an empty inline asm after cov callbacks to avoid callback merge. 278 EmptyAsm = InlineAsm::get(FunctionType::get(IRB.getVoidTy(), false), 279 StringRef(""), StringRef(""), 280 /*hasSideEffects=*/true); 281 282 SanCovTracePC = checkSanitizerInterfaceFunction( 283 M.getOrInsertFunction(SanCovTracePCName, VoidTy)); 284 SanCovTracePCGuard = checkSanitizerInterfaceFunction(M.getOrInsertFunction( 285 SanCovTracePCGuardName, VoidTy, Int32PtrTy)); 286 287 // At this point we create a dummy array of guards because we don't 288 // know how many elements we will need. 289 Type *Int32Ty = IRB.getInt32Ty(); 290 Type *Int8Ty = IRB.getInt8Ty(); 291 292 if (!Options.TracePCGuard) 293 GuardArray = 294 new GlobalVariable(M, Int32Ty, false, GlobalValue::ExternalLinkage, 295 nullptr, "__sancov_gen_cov_tmp"); 296 297 for (auto &F : M) 298 runOnFunction(F); 299 300 auto N = NumberOfInstrumentedBlocks(); 301 302 GlobalVariable *RealGuardArray = nullptr; 303 if (!Options.TracePCGuard) { 304 // Now we know how many elements we need. Create an array of guards 305 // with one extra element at the beginning for the size. 306 Type *Int32ArrayNTy = ArrayType::get(Int32Ty, N + 1); 307 RealGuardArray = new GlobalVariable( 308 M, Int32ArrayNTy, false, GlobalValue::PrivateLinkage, 309 Constant::getNullValue(Int32ArrayNTy), "__sancov_gen_cov"); 310 311 // Replace the dummy array with the real one. 312 GuardArray->replaceAllUsesWith( 313 IRB.CreatePointerCast(RealGuardArray, Int32PtrTy)); 314 GuardArray->eraseFromParent(); 315 } 316 317 // Create variable for module (compilation unit) name 318 Constant *ModNameStrConst = 319 ConstantDataArray::getString(M.getContext(), M.getName(), true); 320 GlobalVariable *ModuleName = new GlobalVariable( 321 M, ModNameStrConst->getType(), true, GlobalValue::PrivateLinkage, 322 ModNameStrConst, "__sancov_gen_modname"); 323 if (Options.TracePCGuard) { 324 if (HasSancovGuardsSection) { 325 Function *CtorFunc; 326 GlobalVariable *SecStart = new GlobalVariable( 327 M, Int32PtrTy, false, GlobalVariable::ExternalLinkage, nullptr, 328 getSanCovTracePCGuardSectionStart()); 329 SecStart->setVisibility(GlobalValue::HiddenVisibility); 330 GlobalVariable *SecEnd = new GlobalVariable( 331 M, Int32PtrTy, false, GlobalVariable::ExternalLinkage, nullptr, 332 getSanCovTracePCGuardSectionEnd()); 333 SecEnd->setVisibility(GlobalValue::HiddenVisibility); 334 335 std::tie(CtorFunc, std::ignore) = createSanitizerCtorAndInitFunctions( 336 M, SanCovModuleCtorName, SanCovTracePCGuardInitName, 337 {Int32PtrTy, Int32PtrTy}, 338 {IRB.CreatePointerCast(SecStart, Int32PtrTy), 339 IRB.CreatePointerCast(SecEnd, Int32PtrTy)}); 340 341 if (TargetTriple.supportsCOMDAT()) { 342 // Use comdat to dedup CtorFunc. 343 CtorFunc->setComdat(M.getOrInsertComdat(SanCovModuleCtorName)); 344 appendToGlobalCtors(M, CtorFunc, SanCtorAndDtorPriority, CtorFunc); 345 } else { 346 appendToGlobalCtors(M, CtorFunc, SanCtorAndDtorPriority); 347 } 348 } 349 } else if (!Options.TracePC) { 350 Function *CtorFunc; 351 std::tie(CtorFunc, std::ignore) = createSanitizerCtorAndInitFunctions( 352 M, SanCovModuleCtorName, SanCovModuleInitName, 353 {Int32PtrTy, IntptrTy, Int8PtrTy, Int8PtrTy}, 354 {IRB.CreatePointerCast(RealGuardArray, Int32PtrTy), 355 ConstantInt::get(IntptrTy, N), Constant::getNullValue(Int8PtrTy), 356 IRB.CreatePointerCast(ModuleName, Int8PtrTy)}); 357 358 appendToGlobalCtors(M, CtorFunc, SanCtorAndDtorPriority); 359 } 360 361 return true; 362 } 363 364 // True if block has successors and it dominates all of them. 365 static bool isFullDominator(const BasicBlock *BB, const DominatorTree *DT) { 366 if (succ_begin(BB) == succ_end(BB)) 367 return false; 368 369 for (const BasicBlock *SUCC : make_range(succ_begin(BB), succ_end(BB))) { 370 if (!DT->dominates(BB, SUCC)) 371 return false; 372 } 373 374 return true; 375 } 376 377 // True if block has predecessors and it postdominates all of them. 378 static bool isFullPostDominator(const BasicBlock *BB, 379 const PostDominatorTree *PDT) { 380 if (pred_begin(BB) == pred_end(BB)) 381 return false; 382 383 for (const BasicBlock *PRED : make_range(pred_begin(BB), pred_end(BB))) { 384 if (!PDT->dominates(BB, PRED)) 385 return false; 386 } 387 388 return true; 389 } 390 391 static bool shouldInstrumentBlock(const Function& F, const BasicBlock *BB, const DominatorTree *DT, 392 const PostDominatorTree *PDT) { 393 // Don't insert coverage for unreachable blocks: we will never call 394 // __sanitizer_cov() for them, so counting them in 395 // NumberOfInstrumentedBlocks() might complicate calculation of code coverage 396 // percentage. Also, unreachable instructions frequently have no debug 397 // locations. 398 if (isa<UnreachableInst>(BB->getTerminator())) 399 return false; 400 401 // Don't insert coverage into blocks without a valid insertion point 402 // (catchswitch blocks). 403 if (BB->getFirstInsertionPt() == BB->end()) 404 return false; 405 406 if (!ClPruneBlocks || &F.getEntryBlock() == BB) 407 return true; 408 409 return !(isFullDominator(BB, DT) || isFullPostDominator(BB, PDT)); 410 } 411 412 bool SanitizerCoverageModule::runOnFunction(Function &F) { 413 if (F.empty()) 414 return false; 415 if (F.getName().find(".module_ctor") != std::string::npos) 416 return false; // Should not instrument sanitizer init functions. 417 if (F.getName().startswith("__sanitizer_")) 418 return false; // Don't instrument __sanitizer_* callbacks. 419 // Don't instrument MSVC CRT configuration helpers. They may run before normal 420 // initialization. 421 if (F.getName() == "__local_stdio_printf_options" || 422 F.getName() == "__local_stdio_scanf_options") 423 return false; 424 // Don't instrument functions using SEH for now. Splitting basic blocks like 425 // we do for coverage breaks WinEHPrepare. 426 // FIXME: Remove this when SEH no longer uses landingpad pattern matching. 427 if (F.hasPersonalityFn() && 428 isAsynchronousEHPersonality(classifyEHPersonality(F.getPersonalityFn()))) 429 return false; 430 if (Options.CoverageType >= SanitizerCoverageOptions::SCK_Edge) 431 SplitAllCriticalEdges(F); 432 SmallVector<Instruction *, 8> IndirCalls; 433 SmallVector<BasicBlock *, 16> BlocksToInstrument; 434 SmallVector<Instruction *, 8> CmpTraceTargets; 435 SmallVector<Instruction *, 8> SwitchTraceTargets; 436 SmallVector<BinaryOperator *, 8> DivTraceTargets; 437 SmallVector<GetElementPtrInst *, 8> GepTraceTargets; 438 439 const DominatorTree *DT = 440 &getAnalysis<DominatorTreeWrapperPass>(F).getDomTree(); 441 const PostDominatorTree *PDT = 442 &getAnalysis<PostDominatorTreeWrapperPass>(F).getPostDomTree(); 443 444 for (auto &BB : F) { 445 if (shouldInstrumentBlock(F, &BB, DT, PDT)) 446 BlocksToInstrument.push_back(&BB); 447 for (auto &Inst : BB) { 448 if (Options.IndirectCalls) { 449 CallSite CS(&Inst); 450 if (CS && !CS.getCalledFunction()) 451 IndirCalls.push_back(&Inst); 452 } 453 if (Options.TraceCmp) { 454 if (isa<ICmpInst>(&Inst)) 455 CmpTraceTargets.push_back(&Inst); 456 if (isa<SwitchInst>(&Inst)) 457 SwitchTraceTargets.push_back(&Inst); 458 } 459 if (Options.TraceDiv) 460 if (BinaryOperator *BO = dyn_cast<BinaryOperator>(&Inst)) 461 if (BO->getOpcode() == Instruction::SDiv || 462 BO->getOpcode() == Instruction::UDiv) 463 DivTraceTargets.push_back(BO); 464 if (Options.TraceGep) 465 if (GetElementPtrInst *GEP = dyn_cast<GetElementPtrInst>(&Inst)) 466 GepTraceTargets.push_back(GEP); 467 } 468 } 469 470 InjectCoverage(F, BlocksToInstrument); 471 InjectCoverageForIndirectCalls(F, IndirCalls); 472 InjectTraceForCmp(F, CmpTraceTargets); 473 InjectTraceForSwitch(F, SwitchTraceTargets); 474 InjectTraceForDiv(F, DivTraceTargets); 475 InjectTraceForGep(F, GepTraceTargets); 476 return true; 477 } 478 void SanitizerCoverageModule::CreateFunctionGuardArray(size_t NumGuards, 479 Function &F) { 480 if (!Options.TracePCGuard) return; 481 HasSancovGuardsSection = true; 482 ArrayType *ArrayOfInt32Ty = ArrayType::get(Int32Ty, NumGuards); 483 FunctionGuardArray = new GlobalVariable( 484 *CurModule, ArrayOfInt32Ty, false, GlobalVariable::PrivateLinkage, 485 Constant::getNullValue(ArrayOfInt32Ty), "__sancov_gen_"); 486 if (auto Comdat = F.getComdat()) 487 FunctionGuardArray->setComdat(Comdat); 488 FunctionGuardArray->setSection(getSanCovTracePCGuardSection()); 489 } 490 491 bool SanitizerCoverageModule::InjectCoverage(Function &F, 492 ArrayRef<BasicBlock *> AllBlocks) { 493 if (AllBlocks.empty()) return false; 494 switch (Options.CoverageType) { 495 case SanitizerCoverageOptions::SCK_None: 496 return false; 497 case SanitizerCoverageOptions::SCK_Function: 498 CreateFunctionGuardArray(1, F); 499 InjectCoverageAtBlock(F, F.getEntryBlock(), 0, false); 500 return true; 501 default: { 502 bool UseCalls = ClCoverageBlockThreshold < AllBlocks.size(); 503 CreateFunctionGuardArray(AllBlocks.size(), F); 504 for (size_t i = 0, N = AllBlocks.size(); i < N; i++) 505 InjectCoverageAtBlock(F, *AllBlocks[i], i, UseCalls); 506 return true; 507 } 508 } 509 } 510 511 // On every indirect call we call a run-time function 512 // __sanitizer_cov_indir_call* with two parameters: 513 // - callee address, 514 // - global cache array that contains CacheSize pointers (zero-initialized). 515 // The cache is used to speed up recording the caller-callee pairs. 516 // The address of the caller is passed implicitly via caller PC. 517 // CacheSize is encoded in the name of the run-time function. 518 void SanitizerCoverageModule::InjectCoverageForIndirectCalls( 519 Function &F, ArrayRef<Instruction *> IndirCalls) { 520 if (IndirCalls.empty()) 521 return; 522 const int CacheSize = 16; 523 const int CacheAlignment = 64; // Align for better performance. 524 Type *Ty = ArrayType::get(IntptrTy, CacheSize); 525 for (auto I : IndirCalls) { 526 IRBuilder<> IRB(I); 527 CallSite CS(I); 528 Value *Callee = CS.getCalledValue(); 529 if (isa<InlineAsm>(Callee)) 530 continue; 531 GlobalVariable *CalleeCache = new GlobalVariable( 532 *F.getParent(), Ty, false, GlobalValue::PrivateLinkage, 533 Constant::getNullValue(Ty), "__sancov_gen_callee_cache"); 534 CalleeCache->setAlignment(CacheAlignment); 535 if (Options.TracePC || Options.TracePCGuard) 536 IRB.CreateCall(SanCovTracePCIndir, 537 IRB.CreatePointerCast(Callee, IntptrTy)); 538 else 539 IRB.CreateCall(SanCovIndirCallFunction, 540 {IRB.CreatePointerCast(Callee, IntptrTy), 541 IRB.CreatePointerCast(CalleeCache, IntptrTy)}); 542 } 543 } 544 545 // For every switch statement we insert a call: 546 // __sanitizer_cov_trace_switch(CondValue, 547 // {NumCases, ValueSizeInBits, Case0Value, Case1Value, Case2Value, ... }) 548 549 void SanitizerCoverageModule::InjectTraceForSwitch( 550 Function &, ArrayRef<Instruction *> SwitchTraceTargets) { 551 for (auto I : SwitchTraceTargets) { 552 if (SwitchInst *SI = dyn_cast<SwitchInst>(I)) { 553 IRBuilder<> IRB(I); 554 SmallVector<Constant *, 16> Initializers; 555 Value *Cond = SI->getCondition(); 556 if (Cond->getType()->getScalarSizeInBits() > 557 Int64Ty->getScalarSizeInBits()) 558 continue; 559 Initializers.push_back(ConstantInt::get(Int64Ty, SI->getNumCases())); 560 Initializers.push_back( 561 ConstantInt::get(Int64Ty, Cond->getType()->getScalarSizeInBits())); 562 if (Cond->getType()->getScalarSizeInBits() < 563 Int64Ty->getScalarSizeInBits()) 564 Cond = IRB.CreateIntCast(Cond, Int64Ty, false); 565 for (auto It : SI->cases()) { 566 Constant *C = It.getCaseValue(); 567 if (C->getType()->getScalarSizeInBits() < 568 Int64Ty->getScalarSizeInBits()) 569 C = ConstantExpr::getCast(CastInst::ZExt, It.getCaseValue(), Int64Ty); 570 Initializers.push_back(C); 571 } 572 std::sort(Initializers.begin() + 2, Initializers.end(), 573 [](const Constant *A, const Constant *B) { 574 return cast<ConstantInt>(A)->getLimitedValue() < 575 cast<ConstantInt>(B)->getLimitedValue(); 576 }); 577 ArrayType *ArrayOfInt64Ty = ArrayType::get(Int64Ty, Initializers.size()); 578 GlobalVariable *GV = new GlobalVariable( 579 *CurModule, ArrayOfInt64Ty, false, GlobalVariable::InternalLinkage, 580 ConstantArray::get(ArrayOfInt64Ty, Initializers), 581 "__sancov_gen_cov_switch_values"); 582 IRB.CreateCall(SanCovTraceSwitchFunction, 583 {Cond, IRB.CreatePointerCast(GV, Int64PtrTy)}); 584 } 585 } 586 } 587 588 void SanitizerCoverageModule::InjectTraceForDiv( 589 Function &, ArrayRef<BinaryOperator *> DivTraceTargets) { 590 for (auto BO : DivTraceTargets) { 591 IRBuilder<> IRB(BO); 592 Value *A1 = BO->getOperand(1); 593 if (isa<ConstantInt>(A1)) continue; 594 if (!A1->getType()->isIntegerTy()) 595 continue; 596 uint64_t TypeSize = DL->getTypeStoreSizeInBits(A1->getType()); 597 int CallbackIdx = TypeSize == 32 ? 0 : 598 TypeSize == 64 ? 1 : -1; 599 if (CallbackIdx < 0) continue; 600 auto Ty = Type::getIntNTy(*C, TypeSize); 601 IRB.CreateCall(SanCovTraceDivFunction[CallbackIdx], 602 {IRB.CreateIntCast(A1, Ty, true)}); 603 } 604 } 605 606 void SanitizerCoverageModule::InjectTraceForGep( 607 Function &, ArrayRef<GetElementPtrInst *> GepTraceTargets) { 608 for (auto GEP : GepTraceTargets) { 609 IRBuilder<> IRB(GEP); 610 for (auto I = GEP->idx_begin(); I != GEP->idx_end(); ++I) 611 if (!isa<ConstantInt>(*I) && (*I)->getType()->isIntegerTy()) 612 IRB.CreateCall(SanCovTraceGepFunction, 613 {IRB.CreateIntCast(*I, IntptrTy, true)}); 614 } 615 } 616 617 void SanitizerCoverageModule::InjectTraceForCmp( 618 Function &, ArrayRef<Instruction *> CmpTraceTargets) { 619 for (auto I : CmpTraceTargets) { 620 if (ICmpInst *ICMP = dyn_cast<ICmpInst>(I)) { 621 IRBuilder<> IRB(ICMP); 622 Value *A0 = ICMP->getOperand(0); 623 Value *A1 = ICMP->getOperand(1); 624 if (!A0->getType()->isIntegerTy()) 625 continue; 626 uint64_t TypeSize = DL->getTypeStoreSizeInBits(A0->getType()); 627 int CallbackIdx = TypeSize == 8 ? 0 : 628 TypeSize == 16 ? 1 : 629 TypeSize == 32 ? 2 : 630 TypeSize == 64 ? 3 : -1; 631 if (CallbackIdx < 0) continue; 632 // __sanitizer_cov_trace_cmp((type_size << 32) | predicate, A0, A1); 633 auto Ty = Type::getIntNTy(*C, TypeSize); 634 IRB.CreateCall( 635 SanCovTraceCmpFunction[CallbackIdx], 636 {IRB.CreateIntCast(A0, Ty, true), IRB.CreateIntCast(A1, Ty, true)}); 637 } 638 } 639 } 640 641 void SanitizerCoverageModule::SetNoSanitizeMetadata(Instruction *I) { 642 I->setMetadata(I->getModule()->getMDKindID("nosanitize"), 643 MDNode::get(*C, None)); 644 } 645 646 void SanitizerCoverageModule::InjectCoverageAtBlock(Function &F, BasicBlock &BB, 647 size_t Idx, bool UseCalls) { 648 BasicBlock::iterator IP = BB.getFirstInsertionPt(); 649 bool IsEntryBB = &BB == &F.getEntryBlock(); 650 DebugLoc EntryLoc; 651 if (IsEntryBB) { 652 if (auto SP = F.getSubprogram()) 653 EntryLoc = DebugLoc::get(SP->getScopeLine(), 0, SP); 654 // Keep static allocas and llvm.localescape calls in the entry block. Even 655 // if we aren't splitting the block, it's nice for allocas to be before 656 // calls. 657 IP = PrepareToSplitEntryBlock(BB, IP); 658 } else { 659 EntryLoc = IP->getDebugLoc(); 660 } 661 662 IRBuilder<> IRB(&*IP); 663 IRB.SetCurrentDebugLocation(EntryLoc); 664 if (Options.TracePC) { 665 IRB.CreateCall(SanCovTracePC); // gets the PC using GET_CALLER_PC. 666 IRB.CreateCall(EmptyAsm, {}); // Avoids callback merge. 667 } else if (Options.TracePCGuard) { 668 auto GuardPtr = IRB.CreateIntToPtr( 669 IRB.CreateAdd(IRB.CreatePointerCast(FunctionGuardArray, IntptrTy), 670 ConstantInt::get(IntptrTy, Idx * 4)), 671 Int32PtrTy); 672 if (!UseCalls) { 673 auto GuardLoad = IRB.CreateLoad(GuardPtr); 674 GuardLoad->setAtomic(AtomicOrdering::Monotonic); 675 GuardLoad->setAlignment(8); 676 SetNoSanitizeMetadata(GuardLoad); // Don't instrument with e.g. asan. 677 auto Cmp = IRB.CreateICmpNE( 678 GuardLoad, Constant::getNullValue(GuardLoad->getType())); 679 auto Ins = SplitBlockAndInsertIfThen( 680 Cmp, &*IP, false, MDBuilder(*C).createBranchWeights(1, 100000)); 681 IRB.SetInsertPoint(Ins); 682 IRB.SetCurrentDebugLocation(EntryLoc); 683 } 684 IRB.CreateCall(SanCovTracePCGuard, GuardPtr); 685 IRB.CreateCall(EmptyAsm, {}); // Avoids callback merge. 686 } else { 687 Value *GuardP = IRB.CreateAdd( 688 IRB.CreatePointerCast(GuardArray, IntptrTy), 689 ConstantInt::get(IntptrTy, (1 + NumberOfInstrumentedBlocks()) * 4)); 690 GuardP = IRB.CreateIntToPtr(GuardP, Int32PtrTy); 691 if (UseCalls) { 692 IRB.CreateCall(SanCovWithCheckFunction, GuardP); 693 } else { 694 LoadInst *Load = IRB.CreateLoad(GuardP); 695 Load->setAtomic(AtomicOrdering::Monotonic); 696 Load->setAlignment(4); 697 SetNoSanitizeMetadata(Load); 698 Value *Cmp = 699 IRB.CreateICmpSGE(Constant::getNullValue(Load->getType()), Load); 700 Instruction *Ins = SplitBlockAndInsertIfThen( 701 Cmp, &*IP, false, MDBuilder(*C).createBranchWeights(1, 100000)); 702 IRB.SetInsertPoint(Ins); 703 IRB.SetCurrentDebugLocation(EntryLoc); 704 // __sanitizer_cov gets the PC of the instruction using GET_CALLER_PC. 705 IRB.CreateCall(SanCovFunction, GuardP); 706 IRB.CreateCall(EmptyAsm, {}); // Avoids callback merge. 707 } 708 } 709 } 710 711 StringRef SanitizerCoverageModule::getSanCovTracePCGuardSection() const { 712 if (TargetTriple.getObjectFormat() == Triple::COFF) 713 return ".SCOV$M"; 714 if (TargetTriple.isOSBinFormatMachO()) 715 return "__DATA,__sancov_guards"; 716 return "__sancov_guards"; 717 } 718 719 StringRef SanitizerCoverageModule::getSanCovTracePCGuardSectionStart() const { 720 if (TargetTriple.isOSBinFormatMachO()) 721 return "\1section$start$__DATA$__sancov_guards"; 722 return "__start___sancov_guards"; 723 } 724 725 StringRef SanitizerCoverageModule::getSanCovTracePCGuardSectionEnd() const { 726 if (TargetTriple.isOSBinFormatMachO()) 727 return "\1section$end$__DATA$__sancov_guards"; 728 return "__stop___sancov_guards"; 729 } 730 731 732 char SanitizerCoverageModule::ID = 0; 733 INITIALIZE_PASS_BEGIN(SanitizerCoverageModule, "sancov", 734 "SanitizerCoverage: TODO." 735 "ModulePass", 736 false, false) 737 INITIALIZE_PASS_DEPENDENCY(DominatorTreeWrapperPass) 738 INITIALIZE_PASS_DEPENDENCY(PostDominatorTreeWrapperPass) 739 INITIALIZE_PASS_END(SanitizerCoverageModule, "sancov", 740 "SanitizerCoverage: TODO." 741 "ModulePass", 742 false, false) 743 ModulePass *llvm::createSanitizerCoverageModulePass( 744 const SanitizerCoverageOptions &Options) { 745 return new SanitizerCoverageModule(Options); 746 } 747