1 //===-- sanitizer_coverage_libcdep_new.cpp --------------------------------===//
2 //
3 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4 // See https://llvm.org/LICENSE.txt for license information.
5 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6 //
7 //===----------------------------------------------------------------------===//
8 // Sanitizer Coverage Controller for Trace PC Guard.
9 
10 #include "sanitizer_platform.h"
11 
12 #if !SANITIZER_FUCHSIA
13 #include "sancov_flags.h"
14 #include "sanitizer_allocator_internal.h"
15 #include "sanitizer_atomic.h"
16 #include "sanitizer_common.h"
17 #include "sanitizer_file.h"
18 
19 using namespace __sanitizer;
20 
21 using AddressRange = LoadedModule::AddressRange;
22 
23 namespace __sancov {
24 namespace {
25 
26 static const u64 Magic64 = 0xC0BFFFFFFFFFFF64ULL;
27 static const u64 Magic32 = 0xC0BFFFFFFFFFFF32ULL;
28 static const u64 Magic = SANITIZER_WORDSIZE == 64 ? Magic64 : Magic32;
29 
30 static fd_t OpenFile(const char* path) {
31   error_t err;
32   fd_t fd = OpenFile(path, WrOnly, &err);
33   if (fd == kInvalidFd)
34     Report("SanitizerCoverage: failed to open %s for writing (reason: %d)\n",
35            path, err);
36   return fd;
37 }
38 
39 static void GetCoverageFilename(char* path, const char* name,
40                                 const char* extension) {
41   CHECK(name);
42   internal_snprintf(path, kMaxPathLength, "%s/%s.%zd.%s",
43                     common_flags()->coverage_dir, name, internal_getpid(),
44                     extension);
45 }
46 
47 static void WriteModuleCoverage(char* file_path, const char* module_name,
48                                 const uptr* pcs, uptr len) {
49   GetCoverageFilename(file_path, StripModuleName(module_name), "sancov");
50   fd_t fd = OpenFile(file_path);
51   WriteToFile(fd, &Magic, sizeof(Magic));
52   WriteToFile(fd, pcs, len * sizeof(*pcs));
53   CloseFile(fd);
54   Printf("SanitizerCoverage: %s: %zd PCs written\n", file_path, len);
55 }
56 
57 static void SanitizerDumpCoverage(const uptr* unsorted_pcs, uptr len) {
58   if (!len) return;
59 
60   char* file_path = static_cast<char*>(InternalAlloc(kMaxPathLength));
61   char* module_name = static_cast<char*>(InternalAlloc(kMaxPathLength));
62   uptr* pcs = static_cast<uptr*>(InternalAlloc(len * sizeof(uptr)));
63 
64   internal_memcpy(pcs, unsorted_pcs, len * sizeof(uptr));
65   Sort(pcs, len);
66 
67   bool module_found = false;
68   uptr last_base = 0;
69   uptr module_start_idx = 0;
70 
71   for (uptr i = 0; i < len; ++i) {
72     const uptr pc = pcs[i];
73     if (!pc) continue;
74 
75     if (!__sanitizer_get_module_and_offset_for_pc(pc, nullptr, 0, &pcs[i])) {
76       Printf("ERROR: unknown pc 0x%zx (may happen if dlclose is used)\n", pc);
77       continue;
78     }
79     uptr module_base = pc - pcs[i];
80 
81     if (module_base != last_base || !module_found) {
82       if (module_found) {
83         WriteModuleCoverage(file_path, module_name, &pcs[module_start_idx],
84                             i - module_start_idx);
85       }
86 
87       last_base = module_base;
88       module_start_idx = i;
89       module_found = true;
90       __sanitizer_get_module_and_offset_for_pc(pc, module_name, kMaxPathLength,
91                                                &pcs[i]);
92     }
93   }
94 
95   if (module_found) {
96     WriteModuleCoverage(file_path, module_name, &pcs[module_start_idx],
97                         len - module_start_idx);
98   }
99 
100   InternalFree(file_path);
101   InternalFree(module_name);
102   InternalFree(pcs);
103 }
104 
105 // Collects trace-pc guard coverage.
106 // This class relies on zero-initialization.
107 class TracePcGuardController {
108  public:
109   void Initialize() {
110     CHECK(!initialized);
111 
112     initialized = true;
113     InitializeSancovFlags();
114 
115     pc_vector.Initialize(0);
116   }
117 
118   void InitTracePcGuard(u32* start, u32* end) {
119     if (!initialized) Initialize();
120     CHECK(!*start);
121     CHECK_NE(start, end);
122 
123     u32 i = pc_vector.size();
124     for (u32* p = start; p < end; p++) *p = ++i;
125     pc_vector.resize(i);
126   }
127 
128   void TracePcGuard(u32* guard, uptr pc) {
129     u32 idx = *guard;
130     if (!idx) return;
131     // we start indices from 1.
132     atomic_uintptr_t* pc_ptr =
133         reinterpret_cast<atomic_uintptr_t*>(&pc_vector[idx - 1]);
134     if (atomic_load(pc_ptr, memory_order_relaxed) == 0)
135       atomic_store(pc_ptr, pc, memory_order_relaxed);
136   }
137 
138   void Reset() {
139     internal_memset(&pc_vector[0], 0, sizeof(pc_vector[0]) * pc_vector.size());
140   }
141 
142   void Dump() {
143     if (!initialized || !common_flags()->coverage) return;
144     __sanitizer_dump_coverage(pc_vector.data(), pc_vector.size());
145   }
146 
147  private:
148   bool initialized;
149   InternalMmapVectorNoCtor<uptr> pc_vector;
150 };
151 
152 static TracePcGuardController pc_guard_controller;
153 
154 // A basic default implementation of callbacks for
155 // -fsanitize-coverage=inline-8bit-counters,pc-table.
156 // Use TOOL_OPTIONS (UBSAN_OPTIONS, etc) to dump the coverage data:
157 // * cov_8bit_counters_out=PATH to dump the 8bit counters.
158 // * cov_pcs_out=PATH to dump the pc table.
159 //
160 // Most users will still need to define their own callbacks for greater
161 // flexibility.
162 namespace SingletonCounterCoverage {
163 
164 static char *counters_start, *counters_end;
165 
166 static void DumpCoverage() {
167   const char* file_path = common_flags()->cov_8bit_counters_out;
168   if (!file_path || !internal_strlen(file_path))
169     return;
170   fd_t fd = OpenFile(file_path);
171   FileCloser file_closer(fd);
172   WriteToFile(fd, counters_start, counters_end - counters_start);
173 }
174 
175 static void Cov8bitCountersInit(char* beg, char* end) {
176   counters_start = beg;
177   counters_end = end;
178   Atexit(DumpCoverage);
179 }
180 
181 static void CovPcsInit(const uptr* pcs_beg, const uptr* pcs_end) {
182   const char* file_path = common_flags()->cov_pcs_out;
183   if (!file_path || !internal_strlen(file_path))
184     return;
185   fd_t fd = OpenFile(file_path);
186   FileCloser file_closer(fd);
187   WriteToFile(fd, pcs_beg, (pcs_end - pcs_beg) * sizeof(uptr));
188 }
189 
190 }  // namespace SingletonCounterCoverage
191 
192 }  // namespace
193 }  // namespace __sancov
194 
195 namespace __sanitizer {
196 void InitializeCoverage(bool enabled, const char *dir) {
197   static bool coverage_enabled = false;
198   if (coverage_enabled)
199     return;  // May happen if two sanitizer enable coverage in the same process.
200   coverage_enabled = enabled;
201   Atexit(__sanitizer_cov_dump);
202   AddDieCallback(__sanitizer_cov_dump);
203 }
204 } // namespace __sanitizer
205 
206 extern "C" {
207 SANITIZER_INTERFACE_ATTRIBUTE void __sanitizer_dump_coverage(const uptr* pcs,
208                                                              uptr len) {
209   return __sancov::SanitizerDumpCoverage(pcs, len);
210 }
211 
212 SANITIZER_INTERFACE_WEAK_DEF(void, __sanitizer_cov_trace_pc_guard, u32* guard) {
213   if (!*guard) return;
214   __sancov::pc_guard_controller.TracePcGuard(guard, GET_CALLER_PC() - 1);
215 }
216 
217 SANITIZER_INTERFACE_WEAK_DEF(void, __sanitizer_cov_trace_pc_guard_init,
218                              u32* start, u32* end) {
219   if (start == end || *start) return;
220   __sancov::pc_guard_controller.InitTracePcGuard(start, end);
221 }
222 
223 SANITIZER_INTERFACE_ATTRIBUTE void __sanitizer_dump_trace_pc_guard_coverage() {
224   __sancov::pc_guard_controller.Dump();
225 }
226 SANITIZER_INTERFACE_ATTRIBUTE void __sanitizer_cov_dump() {
227   __sanitizer_dump_trace_pc_guard_coverage();
228 }
229 SANITIZER_INTERFACE_ATTRIBUTE void __sanitizer_cov_reset() {
230   __sancov::pc_guard_controller.Reset();
231 }
232 // Default implementations (weak).
233 // Either empty or very simple.
234 // Most users should redefine them.
235 SANITIZER_INTERFACE_WEAK_DEF(void, __sanitizer_cov_trace_cmp, void) {}
236 SANITIZER_INTERFACE_WEAK_DEF(void, __sanitizer_cov_trace_cmp1, void) {}
237 SANITIZER_INTERFACE_WEAK_DEF(void, __sanitizer_cov_trace_cmp2, void) {}
238 SANITIZER_INTERFACE_WEAK_DEF(void, __sanitizer_cov_trace_cmp4, void) {}
239 SANITIZER_INTERFACE_WEAK_DEF(void, __sanitizer_cov_trace_cmp8, void) {}
240 SANITIZER_INTERFACE_WEAK_DEF(void, __sanitizer_cov_trace_const_cmp1, void) {}
241 SANITIZER_INTERFACE_WEAK_DEF(void, __sanitizer_cov_trace_const_cmp2, void) {}
242 SANITIZER_INTERFACE_WEAK_DEF(void, __sanitizer_cov_trace_const_cmp4, void) {}
243 SANITIZER_INTERFACE_WEAK_DEF(void, __sanitizer_cov_trace_const_cmp8, void) {}
244 SANITIZER_INTERFACE_WEAK_DEF(void, __sanitizer_cov_trace_switch, void) {}
245 SANITIZER_INTERFACE_WEAK_DEF(void, __sanitizer_cov_trace_div4, void) {}
246 SANITIZER_INTERFACE_WEAK_DEF(void, __sanitizer_cov_trace_div8, void) {}
247 SANITIZER_INTERFACE_WEAK_DEF(void, __sanitizer_cov_trace_gep, void) {}
248 SANITIZER_INTERFACE_WEAK_DEF(void, __sanitizer_cov_trace_pc_indir, void) {}
249 SANITIZER_INTERFACE_WEAK_DEF(void, __sanitizer_cov_8bit_counters_init,
250                              char* start, char* end) {
251   __sancov::SingletonCounterCoverage::Cov8bitCountersInit(start, end);
252 }
253 SANITIZER_INTERFACE_WEAK_DEF(void, __sanitizer_cov_bool_flag_init, void) {}
254 SANITIZER_INTERFACE_WEAK_DEF(void, __sanitizer_cov_pcs_init, const uptr* beg,
255                              const uptr* end) {
256   __sancov::SingletonCounterCoverage::CovPcsInit(beg, end);
257 }
258 }  // extern "C"
259 // Weak definition for code instrumented with -fsanitize-coverage=stack-depth
260 // and later linked with code containing a strong definition.
261 // E.g., -fsanitize=fuzzer-no-link
262 SANITIZER_INTERFACE_ATTRIBUTE SANITIZER_WEAK_ATTRIBUTE
263 SANITIZER_TLS_INITIAL_EXEC_ATTRIBUTE uptr __sancov_lowest_stack;
264 
265 #endif  // !SANITIZER_FUCHSIA
266