blob: 75130840ce0218fdeffd9c141e0d19e845d45791 [file] [log] [blame]
george.karpenkov29efa6d2017-08-21 23:25:50 +00001//===- FuzzerTracePC.cpp - PC tracing--------------------------------------===//
2//
3// The LLVM Compiler Infrastructure
4//
5// This file is distributed under the University of Illinois Open Source
6// License. See LICENSE.TXT for details.
7//
8//===----------------------------------------------------------------------===//
9// Trace PCs.
10// This module implements __sanitizer_cov_trace_pc_guard[_init],
11// the callback required for -fsanitize-coverage=trace-pc-guard instrumentation.
12//
13//===----------------------------------------------------------------------===//
14
15#include "FuzzerTracePC.h"
16#include "FuzzerCorpus.h"
17#include "FuzzerDefs.h"
18#include "FuzzerDictionary.h"
19#include "FuzzerExtFunctions.h"
20#include "FuzzerIO.h"
21#include "FuzzerUtil.h"
22#include "FuzzerValueBitMap.h"
23#include <set>
24
25// The coverage counters and PCs.
26// These are declared as global variables named "__sancov_*" to simplify
27// experiments with inlined instrumentation.
28alignas(64) ATTRIBUTE_INTERFACE
29uint8_t __sancov_trace_pc_guard_8bit_counters[fuzzer::TracePC::kNumPCs];
30
31ATTRIBUTE_INTERFACE
32uintptr_t __sancov_trace_pc_pcs[fuzzer::TracePC::kNumPCs];
33
kcc1c0379f2017-08-22 01:28:32 +000034// Used by -fsanitize-coverage=stack-depth to track stack depth
morehouse40c623a2018-08-29 18:08:34 +000035ATTRIBUTES_INTERFACE_TLS_INITIAL_EXEC uintptr_t __sancov_lowest_stack;
kcc1c0379f2017-08-22 01:28:32 +000036
george.karpenkov29efa6d2017-08-21 23:25:50 +000037namespace fuzzer {
38
39TracePC TPC;
40
george.karpenkov29efa6d2017-08-21 23:25:50 +000041uint8_t *TracePC::Counters() const {
42 return __sancov_trace_pc_guard_8bit_counters;
43}
44
45uintptr_t *TracePC::PCs() const {
46 return __sancov_trace_pc_pcs;
47}
48
49size_t TracePC::GetTotalPCCoverage() {
50 if (ObservedPCs.size())
51 return ObservedPCs.size();
52 size_t Res = 0;
53 for (size_t i = 1, N = GetNumPCs(); i < N; i++)
54 if (PCs()[i])
55 Res++;
56 return Res;
57}
58
dor1sd7197f42018-07-18 17:03:27 +000059template<class CallBack>
60void TracePC::IterateInline8bitCounters(CallBack CB) const {
dor1sbb933292018-07-16 16:01:31 +000061 if (NumInline8bitCounters && NumInline8bitCounters == NumPCsInPCTables) {
dor1sd7197f42018-07-18 17:03:27 +000062 size_t CounterIdx = 0;
dor1sbb933292018-07-16 16:01:31 +000063 for (size_t i = 0; i < NumModulesWithInline8bitCounters; i++) {
64 uint8_t *Beg = ModuleCounters[i].Start;
65 size_t Size = ModuleCounters[i].Stop - Beg;
66 assert(Size == (size_t)(ModulePCTable[i].Stop - ModulePCTable[i].Start));
dor1sd7197f42018-07-18 17:03:27 +000067 for (size_t j = 0; j < Size; j++, CounterIdx++)
68 CB(i, j, CounterIdx);
dor1sbb933292018-07-16 16:01:31 +000069 }
70 }
71}
72
dor1sd7197f42018-07-18 17:03:27 +000073// Initializes unstable counters by copying Inline8bitCounters to unstable
74// counters.
75void TracePC::InitializeUnstableCounters() {
76 IterateInline8bitCounters([&](int i, int j, int UnstableIdx) {
dor1sf50b3bb2018-07-23 14:20:52 +000077 UnstableCounters[UnstableIdx].Counter = ModuleCounters[i].Start[j];
dor1sd7197f42018-07-18 17:03:27 +000078 });
79}
80
dor1sbb933292018-07-16 16:01:31 +000081// Compares the current counters with counters from previous runs
82// and records differences as unstable edges.
dor1s658ff782018-08-08 14:32:46 +000083bool TracePC::UpdateUnstableCounters(int UnstableMode) {
84 bool Updated = false;
dor1sd7197f42018-07-18 17:03:27 +000085 IterateInline8bitCounters([&](int i, int j, int UnstableIdx) {
dor1sd6266262018-07-24 21:02:44 +000086 if (ModuleCounters[i].Start[j] != UnstableCounters[UnstableIdx].Counter) {
dor1s658ff782018-08-08 14:32:46 +000087 Updated = true;
dor1sf50b3bb2018-07-23 14:20:52 +000088 UnstableCounters[UnstableIdx].IsUnstable = true;
dor1sd6266262018-07-24 21:02:44 +000089 if (UnstableMode == ZeroUnstable)
90 UnstableCounters[UnstableIdx].Counter = 0;
91 else if (UnstableMode == MinUnstable)
92 UnstableCounters[UnstableIdx].Counter = std::min(
93 ModuleCounters[i].Start[j], UnstableCounters[UnstableIdx].Counter);
94 }
dor1sf50b3bb2018-07-23 14:20:52 +000095 });
dor1s658ff782018-08-08 14:32:46 +000096 return Updated;
dor1sf50b3bb2018-07-23 14:20:52 +000097}
98
dor1s658ff782018-08-08 14:32:46 +000099// Updates and applies unstable counters to ModuleCounters in single iteration
100void TracePC::UpdateAndApplyUnstableCounters(int UnstableMode) {
dor1sf50b3bb2018-07-23 14:20:52 +0000101 IterateInline8bitCounters([&](int i, int j, int UnstableIdx) {
dor1s658ff782018-08-08 14:32:46 +0000102 if (ModuleCounters[i].Start[j] != UnstableCounters[UnstableIdx].Counter) {
103 UnstableCounters[UnstableIdx].IsUnstable = true;
104 if (UnstableMode == ZeroUnstable)
105 ModuleCounters[i].Start[j] = 0;
106 else if (UnstableMode == MinUnstable)
107 ModuleCounters[i].Start[j] = std::min(
108 ModuleCounters[i].Start[j], UnstableCounters[UnstableIdx].Counter);
109 }
dor1sd7197f42018-07-18 17:03:27 +0000110 });
dor1sbb933292018-07-16 16:01:31 +0000111}
george.karpenkov29efa6d2017-08-21 23:25:50 +0000112
113void TracePC::HandleInline8bitCountersInit(uint8_t *Start, uint8_t *Stop) {
114 if (Start == Stop) return;
115 if (NumModulesWithInline8bitCounters &&
116 ModuleCounters[NumModulesWithInline8bitCounters-1].Start == Start) return;
117 assert(NumModulesWithInline8bitCounters <
118 sizeof(ModuleCounters) / sizeof(ModuleCounters[0]));
119 ModuleCounters[NumModulesWithInline8bitCounters++] = {Start, Stop};
120 NumInline8bitCounters += Stop - Start;
121}
122
kcc98957a12017-08-25 19:29:47 +0000123void TracePC::HandlePCsInit(const uintptr_t *Start, const uintptr_t *Stop) {
124 const PCTableEntry *B = reinterpret_cast<const PCTableEntry *>(Start);
125 const PCTableEntry *E = reinterpret_cast<const PCTableEntry *>(Stop);
george.karpenkov29efa6d2017-08-21 23:25:50 +0000126 if (NumPCTables && ModulePCTable[NumPCTables - 1].Start == B) return;
127 assert(NumPCTables < sizeof(ModulePCTable) / sizeof(ModulePCTable[0]));
128 ModulePCTable[NumPCTables++] = {B, E};
129 NumPCsInPCTables += E - B;
130}
131
132void TracePC::HandleInit(uint32_t *Start, uint32_t *Stop) {
133 if (Start == Stop || *Start) return;
134 assert(NumModules < sizeof(Modules) / sizeof(Modules[0]));
135 for (uint32_t *P = Start; P < Stop; P++) {
136 NumGuards++;
137 if (NumGuards == kNumPCs) {
138 RawPrint(
139 "WARNING: The binary has too many instrumented PCs.\n"
140 " You may want to reduce the size of the binary\n"
141 " for more efficient fuzzing and precise coverage data\n");
142 }
143 *P = NumGuards % kNumPCs;
144 }
145 Modules[NumModules].Start = Start;
146 Modules[NumModules].Stop = Stop;
147 NumModules++;
148}
149
150void TracePC::PrintModuleInfo() {
151 if (NumGuards) {
152 Printf("INFO: Loaded %zd modules (%zd guards): ", NumModules, NumGuards);
153 for (size_t i = 0; i < NumModules; i++)
154 Printf("%zd [%p, %p), ", Modules[i].Stop - Modules[i].Start,
155 Modules[i].Start, Modules[i].Stop);
156 Printf("\n");
157 }
158 if (NumModulesWithInline8bitCounters) {
159 Printf("INFO: Loaded %zd modules (%zd inline 8-bit counters): ",
160 NumModulesWithInline8bitCounters, NumInline8bitCounters);
161 for (size_t i = 0; i < NumModulesWithInline8bitCounters; i++)
162 Printf("%zd [%p, %p), ", ModuleCounters[i].Stop - ModuleCounters[i].Start,
163 ModuleCounters[i].Start, ModuleCounters[i].Stop);
164 Printf("\n");
165 }
166 if (NumPCTables) {
167 Printf("INFO: Loaded %zd PC tables (%zd PCs): ", NumPCTables,
168 NumPCsInPCTables);
169 for (size_t i = 0; i < NumPCTables; i++) {
170 Printf("%zd [%p,%p), ", ModulePCTable[i].Stop - ModulePCTable[i].Start,
171 ModulePCTable[i].Start, ModulePCTable[i].Stop);
172 }
173 Printf("\n");
174
175 if ((NumGuards && NumGuards != NumPCsInPCTables) ||
176 (NumInline8bitCounters && NumInline8bitCounters != NumPCsInPCTables)) {
kcce220ebb2017-10-14 00:07:11 +0000177 Printf("ERROR: The size of coverage PC tables does not match the\n"
178 "number of instrumented PCs. This might be a compiler bug,\n"
179 "please contact the libFuzzer developers.\n"
180 "Also check https://bugs.llvm.org/show_bug.cgi?id=34636\n"
181 "for possible workarounds (tl;dr: don't use the old GNU ld)\n");
george.karpenkov29efa6d2017-08-21 23:25:50 +0000182 _Exit(1);
183 }
184 }
delcypherfcd19a82018-04-20 06:46:19 +0000185 if (size_t NumExtraCounters = ExtraCountersEnd() - ExtraCountersBegin())
186 Printf("INFO: %zd Extra Counters\n", NumExtraCounters);
george.karpenkov29efa6d2017-08-21 23:25:50 +0000187}
188
189ATTRIBUTE_NO_SANITIZE_ALL
190void TracePC::HandleCallerCallee(uintptr_t Caller, uintptr_t Callee) {
191 const uintptr_t kBits = 12;
192 const uintptr_t kMask = (1 << kBits) - 1;
193 uintptr_t Idx = (Caller & kMask) | ((Callee & kMask) << kBits);
194 ValueProfileMap.AddValueModPrime(Idx);
195}
196
197void TracePC::UpdateObservedPCs() {
kccec9da662017-08-28 22:52:22 +0000198 Vector<uintptr_t> CoveredFuncs;
kcc00da6482017-08-25 20:09:25 +0000199 auto ObservePC = [&](uintptr_t PC) {
kcc09b3e5f2018-07-06 19:47:00 +0000200 if (ObservedPCs.insert(PC).second && DoPrintNewPCs) {
201 PrintPC("\tNEW_PC: %p %F %L", "\tNEW_PC: %p", PC + 1);
202 Printf("\n");
203 }
kcc1c0379f2017-08-22 01:28:32 +0000204 };
kcc00da6482017-08-25 20:09:25 +0000205
206 auto Observe = [&](const PCTableEntry &TE) {
207 if (TE.PCFlags & 1)
kccb3080d02018-07-19 22:00:48 +0000208 if (++ObservedFuncs[TE.PC] == 1 && NumPrintNewFuncs)
kccec9da662017-08-28 22:52:22 +0000209 CoveredFuncs.push_back(TE.PC);
kcc00da6482017-08-25 20:09:25 +0000210 ObservePC(TE.PC);
211 };
212
george.karpenkov29efa6d2017-08-21 23:25:50 +0000213 if (NumPCsInPCTables) {
george.karpenkov29efa6d2017-08-21 23:25:50 +0000214 if (NumInline8bitCounters == NumPCsInPCTables) {
dor1sd7197f42018-07-18 17:03:27 +0000215 IterateInline8bitCounters([&](int i, int j, int CounterIdx) {
216 if (ModuleCounters[i].Start[j])
217 Observe(ModulePCTable[i].Start[j]);
218 });
george.karpenkov29efa6d2017-08-21 23:25:50 +0000219 } else if (NumGuards == NumPCsInPCTables) {
220 size_t GuardIdx = 1;
221 for (size_t i = 0; i < NumModules; i++) {
222 uint32_t *Beg = Modules[i].Start;
223 size_t Size = Modules[i].Stop - Beg;
224 assert(Size ==
225 (size_t)(ModulePCTable[i].Stop - ModulePCTable[i].Start));
226 for (size_t j = 0; j < Size; j++, GuardIdx++)
227 if (Counters()[GuardIdx])
kcc00da6482017-08-25 20:09:25 +0000228 Observe(ModulePCTable[i].Start[j]);
george.karpenkov29efa6d2017-08-21 23:25:50 +0000229 }
230 }
231 }
kccec9da662017-08-28 22:52:22 +0000232
kccb3080d02018-07-19 22:00:48 +0000233 for (size_t i = 0, N = Min(CoveredFuncs.size(), NumPrintNewFuncs); i < N;
234 i++) {
kcc873dc112018-06-07 21:15:24 +0000235 Printf("\tNEW_FUNC[%zd/%zd]: ", i + 1, CoveredFuncs.size());
kcc09b3e5f2018-07-06 19:47:00 +0000236 PrintPC("%p %F %L", "%p", CoveredFuncs[i] + 1);
237 Printf("\n");
kccec9da662017-08-28 22:52:22 +0000238 }
george.karpenkov29efa6d2017-08-21 23:25:50 +0000239}
240
241inline ALWAYS_INLINE uintptr_t GetPreviousInstructionPc(uintptr_t PC) {
242 // TODO: this implementation is x86 only.
243 // see sanitizer_common GetPreviousInstructionPc for full implementation.
244 return PC - 1;
245}
246
247inline ALWAYS_INLINE uintptr_t GetNextInstructionPc(uintptr_t PC) {
248 // TODO: this implementation is x86 only.
249 // see sanitizer_common GetPreviousInstructionPc for full implementation.
250 return PC + 1;
251}
252
253static std::string GetModuleName(uintptr_t PC) {
254 char ModulePathRaw[4096] = ""; // What's PATH_MAX in portable C++?
255 void *OffsetRaw = nullptr;
256 if (!EF->__sanitizer_get_module_and_offset_for_pc(
257 reinterpret_cast<void *>(PC), ModulePathRaw,
258 sizeof(ModulePathRaw), &OffsetRaw))
259 return "";
260 return ModulePathRaw;
261}
262
kcc85cad3d2018-05-11 01:17:52 +0000263template<class CallBack>
264void TracePC::IterateCoveredFunctions(CallBack CB) {
265 for (size_t i = 0; i < NumPCTables; i++) {
266 auto &M = ModulePCTable[i];
267 assert(M.Start < M.Stop);
268 auto ModuleName = GetModuleName(M.Start->PC);
269 for (auto NextFE = M.Start; NextFE < M.Stop; ) {
270 auto FE = NextFE;
271 assert((FE->PCFlags & 1) && "Not a function entry point");
272 do {
273 NextFE++;
274 } while (NextFE < M.Stop && !(NextFE->PCFlags & 1));
275 if (ObservedFuncs.count(FE->PC))
kccb3080d02018-07-19 22:00:48 +0000276 CB(FE, NextFE, ObservedFuncs[FE->PC]);
kcc85cad3d2018-05-11 01:17:52 +0000277 }
278 }
279}
280
kcc3acbe072018-05-16 23:26:37 +0000281void TracePC::SetFocusFunction(const std::string &FuncName) {
282 // This function should be called once.
283 assert(FocusFunction.first > NumModulesWithInline8bitCounters);
284 if (FuncName.empty())
285 return;
286 for (size_t M = 0; M < NumModulesWithInline8bitCounters; M++) {
287 auto &PCTE = ModulePCTable[M];
288 size_t N = PCTE.Stop - PCTE.Start;
289 for (size_t I = 0; I < N; I++) {
290 if (!(PCTE.Start[I].PCFlags & 1)) continue; // not a function entry.
291 auto Name = DescribePC("%F", GetNextInstructionPc(PCTE.Start[I].PC));
292 if (Name[0] == 'i' && Name[1] == 'n' && Name[2] == ' ')
293 Name = Name.substr(3, std::string::npos);
294 if (FuncName != Name) continue;
295 Printf("INFO: Focus function is set to '%s'\n", Name.c_str());
296 FocusFunction = {M, I};
297 return;
298 }
299 }
300}
301
302bool TracePC::ObservedFocusFunction() {
303 size_t I = FocusFunction.first;
304 size_t J = FocusFunction.second;
305 if (I >= NumModulesWithInline8bitCounters)
306 return false;
307 auto &MC = ModuleCounters[I];
308 size_t Size = MC.Stop - MC.Start;
309 if (J >= Size)
310 return false;
311 return MC.Start[J] != 0;
312}
313
george.karpenkov29efa6d2017-08-21 23:25:50 +0000314void TracePC::PrintCoverage() {
315 if (!EF->__sanitizer_symbolize_pc ||
316 !EF->__sanitizer_get_module_and_offset_for_pc) {
317 Printf("INFO: __sanitizer_symbolize_pc or "
318 "__sanitizer_get_module_and_offset_for_pc is not available,"
319 " not printing coverage\n");
320 return;
321 }
322 Printf("COVERAGE:\n");
kccb3080d02018-07-19 22:00:48 +0000323 auto CoveredFunctionCallback = [&](const PCTableEntry *First,
324 const PCTableEntry *Last,
325 uintptr_t Counter) {
kcc85cad3d2018-05-11 01:17:52 +0000326 assert(First < Last);
327 auto VisualizePC = GetNextInstructionPc(First->PC);
328 std::string FileStr = DescribePC("%s", VisualizePC);
kccb3080d02018-07-19 22:00:48 +0000329 if (!IsInterestingCoverageFile(FileStr))
330 return;
kcc85cad3d2018-05-11 01:17:52 +0000331 std::string FunctionStr = DescribePC("%F", VisualizePC);
kccb3080d02018-07-19 22:00:48 +0000332 if (FunctionStr.find("in ") == 0)
333 FunctionStr = FunctionStr.substr(3);
kcc85cad3d2018-05-11 01:17:52 +0000334 std::string LineStr = DescribePC("%l", VisualizePC);
335 size_t Line = std::stoul(LineStr);
kccb3080d02018-07-19 22:00:48 +0000336 size_t NumEdges = Last - First;
morehousef64b9402018-06-25 15:59:24 +0000337 Vector<uintptr_t> UncoveredPCs;
kcc85cad3d2018-05-11 01:17:52 +0000338 for (auto TE = First; TE < Last; TE++)
339 if (!ObservedPCs.count(TE->PC))
340 UncoveredPCs.push_back(TE->PC);
kccb3080d02018-07-19 22:00:48 +0000341 Printf("COVERED_FUNC: hits: %zd", Counter);
342 Printf(" edges: %zd/%zd", NumEdges - UncoveredPCs.size(), NumEdges);
343 Printf(" %s %s:%zd\n", FunctionStr.c_str(), FileStr.c_str(), Line);
344 for (auto PC: UncoveredPCs)
kcc85cad3d2018-05-11 01:17:52 +0000345 Printf(" UNCOVERED_PC: %s\n",
346 DescribePC("%s:%l", GetNextInstructionPc(PC)).c_str());
george.karpenkov29efa6d2017-08-21 23:25:50 +0000347 };
348
kcc85cad3d2018-05-11 01:17:52 +0000349 IterateCoveredFunctions(CoveredFunctionCallback);
george.karpenkov29efa6d2017-08-21 23:25:50 +0000350}
351
kcca7dd2a92018-05-21 19:47:00 +0000352void TracePC::DumpCoverage() {
353 if (EF->__sanitizer_dump_coverage) {
354 Vector<uintptr_t> PCsCopy(GetNumPCs());
355 for (size_t i = 0; i < GetNumPCs(); i++)
356 PCsCopy[i] = PCs()[i] ? GetPreviousInstructionPc(PCs()[i]) : 0;
357 EF->__sanitizer_dump_coverage(PCsCopy.data(), PCsCopy.size());
358 }
359}
360
dor1sbb933292018-07-16 16:01:31 +0000361void TracePC::PrintUnstableStats() {
362 size_t count = 0;
dor1s72667772018-08-06 23:14:13 +0000363 Printf("UNSTABLE_FUNCTIONS:\n");
364 IterateInline8bitCounters([&](int i, int j, int UnstableIdx) {
365 const PCTableEntry &TE = ModulePCTable[i].Start[j];
366 if (UnstableCounters[UnstableIdx].IsUnstable) {
dor1sbb933292018-07-16 16:01:31 +0000367 count++;
dor1s72667772018-08-06 23:14:13 +0000368 if (ObservedFuncs.count(TE.PC)) {
369 auto VisualizePC = GetNextInstructionPc(TE.PC);
370 std::string FunctionStr = DescribePC("%F", VisualizePC);
371 if (FunctionStr.find("in ") == 0)
372 FunctionStr = FunctionStr.substr(3);
373 Printf("%s\n", FunctionStr.c_str());
374 }
375 }
376 });
377
dor1sbb933292018-07-16 16:01:31 +0000378 Printf("stat::stability_rate: %.2f\n",
379 100 - static_cast<float>(count * 100) / NumInline8bitCounters);
380}
381
george.karpenkov29efa6d2017-08-21 23:25:50 +0000382// Value profile.
383// We keep track of various values that affect control flow.
384// These values are inserted into a bit-set-based hash map.
385// Every new bit in the map is treated as a new coverage.
386//
387// For memcmp/strcmp/etc the interesting value is the length of the common
388// prefix of the parameters.
389// For cmp instructions the interesting value is a XOR of the parameters.
390// The interesting value is mixed up with the PC and is then added to the map.
391
392ATTRIBUTE_NO_SANITIZE_ALL
393void TracePC::AddValueForMemcmp(void *caller_pc, const void *s1, const void *s2,
394 size_t n, bool StopAtZero) {
395 if (!n) return;
396 size_t Len = std::min(n, Word::GetMaxSize());
397 const uint8_t *A1 = reinterpret_cast<const uint8_t *>(s1);
398 const uint8_t *A2 = reinterpret_cast<const uint8_t *>(s2);
399 uint8_t B1[Word::kMaxSize];
400 uint8_t B2[Word::kMaxSize];
401 // Copy the data into locals in this non-msan-instrumented function
402 // to avoid msan complaining further.
403 size_t Hash = 0; // Compute some simple hash of both strings.
404 for (size_t i = 0; i < Len; i++) {
405 B1[i] = A1[i];
406 B2[i] = A2[i];
407 size_t T = B1[i];
408 Hash ^= (T << 8) | B2[i];
409 }
410 size_t I = 0;
411 for (; I < Len; I++)
412 if (B1[I] != B2[I] || (StopAtZero && B1[I] == 0))
413 break;
414 size_t PC = reinterpret_cast<size_t>(caller_pc);
415 size_t Idx = (PC & 4095) | (I << 12);
416 ValueProfileMap.AddValue(Idx);
417 TORCW.Insert(Idx ^ Hash, Word(B1, Len), Word(B2, Len));
418}
419
420template <class T>
421ATTRIBUTE_TARGET_POPCNT ALWAYS_INLINE
422ATTRIBUTE_NO_SANITIZE_ALL
423void TracePC::HandleCmp(uintptr_t PC, T Arg1, T Arg2) {
424 uint64_t ArgXor = Arg1 ^ Arg2;
george.karpenkov29efa6d2017-08-21 23:25:50 +0000425 if (sizeof(T) == 4)
dor1se6729cb2018-07-16 15:15:34 +0000426 TORC4.Insert(ArgXor, Arg1, Arg2);
george.karpenkov29efa6d2017-08-21 23:25:50 +0000427 else if (sizeof(T) == 8)
dor1se6729cb2018-07-16 15:15:34 +0000428 TORC8.Insert(ArgXor, Arg1, Arg2);
kcc6d3b8e92018-08-02 00:24:49 +0000429 uint64_t HammingDistance = __builtin_popcountll(ArgXor); // [0,64]
430 uint64_t AbsoluteDistance =
431 (Arg1 == Arg2 ? 0 : __builtin_clzll(Arg1 - Arg2) + 1);
432 ValueProfileMap.AddValue(PC * 128 + HammingDistance);
433 ValueProfileMap.AddValue(PC * 128 + 64 + AbsoluteDistance);
george.karpenkov29efa6d2017-08-21 23:25:50 +0000434}
435
436static size_t InternalStrnlen(const char *S, size_t MaxLen) {
437 size_t Len = 0;
438 for (; Len < MaxLen && S[Len]; Len++) {}
439 return Len;
440}
441
442// Finds min of (strlen(S1), strlen(S2)).
443// Needed bacause one of these strings may actually be non-zero terminated.
444static size_t InternalStrnlen2(const char *S1, const char *S2) {
445 size_t Len = 0;
446 for (; S1[Len] && S2[Len]; Len++) {}
447 return Len;
448}
449
450void TracePC::ClearInlineCounters() {
451 for (size_t i = 0; i < NumModulesWithInline8bitCounters; i++) {
452 uint8_t *Beg = ModuleCounters[i].Start;
453 size_t Size = ModuleCounters[i].Stop - Beg;
454 memset(Beg, 0, Size);
455 }
456}
457
kcc0f3c0312017-08-22 01:50:00 +0000458ATTRIBUTE_NO_SANITIZE_ALL
kcc1c0379f2017-08-22 01:28:32 +0000459void TracePC::RecordInitialStack() {
kcc0f3c0312017-08-22 01:50:00 +0000460 int stack;
461 __sancov_lowest_stack = InitialStack = reinterpret_cast<uintptr_t>(&stack);
kcc1c0379f2017-08-22 01:28:32 +0000462}
463
464uintptr_t TracePC::GetMaxStackOffset() const {
465 return InitialStack - __sancov_lowest_stack; // Stack grows down
466}
467
george.karpenkov29efa6d2017-08-21 23:25:50 +0000468} // namespace fuzzer
469
470extern "C" {
471ATTRIBUTE_INTERFACE
472ATTRIBUTE_NO_SANITIZE_ALL
473void __sanitizer_cov_trace_pc_guard(uint32_t *Guard) {
474 uintptr_t PC = reinterpret_cast<uintptr_t>(__builtin_return_address(0));
475 uint32_t Idx = *Guard;
476 __sancov_trace_pc_pcs[Idx] = PC;
477 __sancov_trace_pc_guard_8bit_counters[Idx]++;
george.karpenkov29efa6d2017-08-21 23:25:50 +0000478}
479
480// Best-effort support for -fsanitize-coverage=trace-pc, which is available
481// in both Clang and GCC.
482ATTRIBUTE_INTERFACE
483ATTRIBUTE_NO_SANITIZE_ALL
484void __sanitizer_cov_trace_pc() {
485 uintptr_t PC = reinterpret_cast<uintptr_t>(__builtin_return_address(0));
486 uintptr_t Idx = PC & (((uintptr_t)1 << fuzzer::TracePC::kTracePcBits) - 1);
487 __sancov_trace_pc_pcs[Idx] = PC;
488 __sancov_trace_pc_guard_8bit_counters[Idx]++;
489}
490
491ATTRIBUTE_INTERFACE
492void __sanitizer_cov_trace_pc_guard_init(uint32_t *Start, uint32_t *Stop) {
493 fuzzer::TPC.HandleInit(Start, Stop);
494}
495
496ATTRIBUTE_INTERFACE
497void __sanitizer_cov_8bit_counters_init(uint8_t *Start, uint8_t *Stop) {
498 fuzzer::TPC.HandleInline8bitCountersInit(Start, Stop);
499}
500
501ATTRIBUTE_INTERFACE
kcc98957a12017-08-25 19:29:47 +0000502void __sanitizer_cov_pcs_init(const uintptr_t *pcs_beg,
503 const uintptr_t *pcs_end) {
george.karpenkov29efa6d2017-08-21 23:25:50 +0000504 fuzzer::TPC.HandlePCsInit(pcs_beg, pcs_end);
505}
506
507ATTRIBUTE_INTERFACE
508ATTRIBUTE_NO_SANITIZE_ALL
509void __sanitizer_cov_trace_pc_indir(uintptr_t Callee) {
510 uintptr_t PC = reinterpret_cast<uintptr_t>(__builtin_return_address(0));
511 fuzzer::TPC.HandleCallerCallee(PC, Callee);
512}
513
514ATTRIBUTE_INTERFACE
515ATTRIBUTE_NO_SANITIZE_ALL
516ATTRIBUTE_TARGET_POPCNT
517void __sanitizer_cov_trace_cmp8(uint64_t Arg1, uint64_t Arg2) {
518 uintptr_t PC = reinterpret_cast<uintptr_t>(__builtin_return_address(0));
519 fuzzer::TPC.HandleCmp(PC, Arg1, Arg2);
520}
521
522ATTRIBUTE_INTERFACE
523ATTRIBUTE_NO_SANITIZE_ALL
524ATTRIBUTE_TARGET_POPCNT
525// Now the __sanitizer_cov_trace_const_cmp[1248] callbacks just mimic
526// the behaviour of __sanitizer_cov_trace_cmp[1248] ones. This, however,
527// should be changed later to make full use of instrumentation.
528void __sanitizer_cov_trace_const_cmp8(uint64_t Arg1, uint64_t Arg2) {
529 uintptr_t PC = reinterpret_cast<uintptr_t>(__builtin_return_address(0));
530 fuzzer::TPC.HandleCmp(PC, Arg1, Arg2);
531}
532
533ATTRIBUTE_INTERFACE
534ATTRIBUTE_NO_SANITIZE_ALL
535ATTRIBUTE_TARGET_POPCNT
536void __sanitizer_cov_trace_cmp4(uint32_t Arg1, uint32_t Arg2) {
537 uintptr_t PC = reinterpret_cast<uintptr_t>(__builtin_return_address(0));
538 fuzzer::TPC.HandleCmp(PC, Arg1, Arg2);
539}
540
541ATTRIBUTE_INTERFACE
542ATTRIBUTE_NO_SANITIZE_ALL
543ATTRIBUTE_TARGET_POPCNT
544void __sanitizer_cov_trace_const_cmp4(uint32_t Arg1, uint32_t Arg2) {
545 uintptr_t PC = reinterpret_cast<uintptr_t>(__builtin_return_address(0));
546 fuzzer::TPC.HandleCmp(PC, Arg1, Arg2);
547}
548
549ATTRIBUTE_INTERFACE
550ATTRIBUTE_NO_SANITIZE_ALL
551ATTRIBUTE_TARGET_POPCNT
552void __sanitizer_cov_trace_cmp2(uint16_t Arg1, uint16_t Arg2) {
553 uintptr_t PC = reinterpret_cast<uintptr_t>(__builtin_return_address(0));
554 fuzzer::TPC.HandleCmp(PC, Arg1, Arg2);
555}
556
557ATTRIBUTE_INTERFACE
558ATTRIBUTE_NO_SANITIZE_ALL
559ATTRIBUTE_TARGET_POPCNT
560void __sanitizer_cov_trace_const_cmp2(uint16_t Arg1, uint16_t Arg2) {
561 uintptr_t PC = reinterpret_cast<uintptr_t>(__builtin_return_address(0));
562 fuzzer::TPC.HandleCmp(PC, Arg1, Arg2);
563}
564
565ATTRIBUTE_INTERFACE
566ATTRIBUTE_NO_SANITIZE_ALL
567ATTRIBUTE_TARGET_POPCNT
568void __sanitizer_cov_trace_cmp1(uint8_t Arg1, uint8_t Arg2) {
569 uintptr_t PC = reinterpret_cast<uintptr_t>(__builtin_return_address(0));
570 fuzzer::TPC.HandleCmp(PC, Arg1, Arg2);
571}
572
573ATTRIBUTE_INTERFACE
574ATTRIBUTE_NO_SANITIZE_ALL
575ATTRIBUTE_TARGET_POPCNT
576void __sanitizer_cov_trace_const_cmp1(uint8_t Arg1, uint8_t Arg2) {
577 uintptr_t PC = reinterpret_cast<uintptr_t>(__builtin_return_address(0));
578 fuzzer::TPC.HandleCmp(PC, Arg1, Arg2);
579}
580
581ATTRIBUTE_INTERFACE
582ATTRIBUTE_NO_SANITIZE_ALL
583ATTRIBUTE_TARGET_POPCNT
584void __sanitizer_cov_trace_switch(uint64_t Val, uint64_t *Cases) {
585 uint64_t N = Cases[0];
586 uint64_t ValSizeInBits = Cases[1];
587 uint64_t *Vals = Cases + 2;
588 // Skip the most common and the most boring case.
589 if (Vals[N - 1] < 256 && Val < 256)
590 return;
591 uintptr_t PC = reinterpret_cast<uintptr_t>(__builtin_return_address(0));
592 size_t i;
593 uint64_t Token = 0;
594 for (i = 0; i < N; i++) {
595 Token = Val ^ Vals[i];
596 if (Val < Vals[i])
597 break;
598 }
599
600 if (ValSizeInBits == 16)
601 fuzzer::TPC.HandleCmp(PC + i, static_cast<uint16_t>(Token), (uint16_t)(0));
602 else if (ValSizeInBits == 32)
603 fuzzer::TPC.HandleCmp(PC + i, static_cast<uint32_t>(Token), (uint32_t)(0));
604 else
605 fuzzer::TPC.HandleCmp(PC + i, Token, (uint64_t)(0));
606}
607
608ATTRIBUTE_INTERFACE
609ATTRIBUTE_NO_SANITIZE_ALL
610ATTRIBUTE_TARGET_POPCNT
611void __sanitizer_cov_trace_div4(uint32_t Val) {
612 uintptr_t PC = reinterpret_cast<uintptr_t>(__builtin_return_address(0));
613 fuzzer::TPC.HandleCmp(PC, Val, (uint32_t)0);
614}
615
616ATTRIBUTE_INTERFACE
617ATTRIBUTE_NO_SANITIZE_ALL
618ATTRIBUTE_TARGET_POPCNT
619void __sanitizer_cov_trace_div8(uint64_t Val) {
620 uintptr_t PC = reinterpret_cast<uintptr_t>(__builtin_return_address(0));
621 fuzzer::TPC.HandleCmp(PC, Val, (uint64_t)0);
622}
623
624ATTRIBUTE_INTERFACE
625ATTRIBUTE_NO_SANITIZE_ALL
626ATTRIBUTE_TARGET_POPCNT
627void __sanitizer_cov_trace_gep(uintptr_t Idx) {
628 uintptr_t PC = reinterpret_cast<uintptr_t>(__builtin_return_address(0));
629 fuzzer::TPC.HandleCmp(PC, Idx, (uintptr_t)0);
630}
631
632ATTRIBUTE_INTERFACE ATTRIBUTE_NO_SANITIZE_MEMORY
633void __sanitizer_weak_hook_memcmp(void *caller_pc, const void *s1,
634 const void *s2, size_t n, int result) {
morehousec6ee8752018-07-17 16:12:00 +0000635 if (!fuzzer::RunningUserCallback) return;
george.karpenkov29efa6d2017-08-21 23:25:50 +0000636 if (result == 0) return; // No reason to mutate.
637 if (n <= 1) return; // Not interesting.
638 fuzzer::TPC.AddValueForMemcmp(caller_pc, s1, s2, n, /*StopAtZero*/false);
639}
640
641ATTRIBUTE_INTERFACE ATTRIBUTE_NO_SANITIZE_MEMORY
642void __sanitizer_weak_hook_strncmp(void *caller_pc, const char *s1,
643 const char *s2, size_t n, int result) {
morehousec6ee8752018-07-17 16:12:00 +0000644 if (!fuzzer::RunningUserCallback) return;
george.karpenkov29efa6d2017-08-21 23:25:50 +0000645 if (result == 0) return; // No reason to mutate.
646 size_t Len1 = fuzzer::InternalStrnlen(s1, n);
647 size_t Len2 = fuzzer::InternalStrnlen(s2, n);
648 n = std::min(n, Len1);
649 n = std::min(n, Len2);
650 if (n <= 1) return; // Not interesting.
651 fuzzer::TPC.AddValueForMemcmp(caller_pc, s1, s2, n, /*StopAtZero*/true);
652}
653
654ATTRIBUTE_INTERFACE ATTRIBUTE_NO_SANITIZE_MEMORY
655void __sanitizer_weak_hook_strcmp(void *caller_pc, const char *s1,
dor1se6729cb2018-07-16 15:15:34 +0000656 const char *s2, int result) {
morehousec6ee8752018-07-17 16:12:00 +0000657 if (!fuzzer::RunningUserCallback) return;
george.karpenkov29efa6d2017-08-21 23:25:50 +0000658 if (result == 0) return; // No reason to mutate.
659 size_t N = fuzzer::InternalStrnlen2(s1, s2);
660 if (N <= 1) return; // Not interesting.
661 fuzzer::TPC.AddValueForMemcmp(caller_pc, s1, s2, N, /*StopAtZero*/true);
662}
663
664ATTRIBUTE_INTERFACE ATTRIBUTE_NO_SANITIZE_MEMORY
665void __sanitizer_weak_hook_strncasecmp(void *called_pc, const char *s1,
666 const char *s2, size_t n, int result) {
morehousec6ee8752018-07-17 16:12:00 +0000667 if (!fuzzer::RunningUserCallback) return;
george.karpenkov29efa6d2017-08-21 23:25:50 +0000668 return __sanitizer_weak_hook_strncmp(called_pc, s1, s2, n, result);
669}
670
671ATTRIBUTE_INTERFACE ATTRIBUTE_NO_SANITIZE_MEMORY
672void __sanitizer_weak_hook_strcasecmp(void *called_pc, const char *s1,
673 const char *s2, int result) {
morehousec6ee8752018-07-17 16:12:00 +0000674 if (!fuzzer::RunningUserCallback) return;
george.karpenkov29efa6d2017-08-21 23:25:50 +0000675 return __sanitizer_weak_hook_strcmp(called_pc, s1, s2, result);
676}
677
678ATTRIBUTE_INTERFACE ATTRIBUTE_NO_SANITIZE_MEMORY
679void __sanitizer_weak_hook_strstr(void *called_pc, const char *s1,
680 const char *s2, char *result) {
morehousec6ee8752018-07-17 16:12:00 +0000681 if (!fuzzer::RunningUserCallback) return;
george.karpenkov29efa6d2017-08-21 23:25:50 +0000682 fuzzer::TPC.MMT.Add(reinterpret_cast<const uint8_t *>(s2), strlen(s2));
683}
684
685ATTRIBUTE_INTERFACE ATTRIBUTE_NO_SANITIZE_MEMORY
686void __sanitizer_weak_hook_strcasestr(void *called_pc, const char *s1,
687 const char *s2, char *result) {
morehousec6ee8752018-07-17 16:12:00 +0000688 if (!fuzzer::RunningUserCallback) return;
george.karpenkov29efa6d2017-08-21 23:25:50 +0000689 fuzzer::TPC.MMT.Add(reinterpret_cast<const uint8_t *>(s2), strlen(s2));
690}
691
692ATTRIBUTE_INTERFACE ATTRIBUTE_NO_SANITIZE_MEMORY
693void __sanitizer_weak_hook_memmem(void *called_pc, const void *s1, size_t len1,
694 const void *s2, size_t len2, void *result) {
morehousec6ee8752018-07-17 16:12:00 +0000695 if (!fuzzer::RunningUserCallback) return;
george.karpenkov29efa6d2017-08-21 23:25:50 +0000696 fuzzer::TPC.MMT.Add(reinterpret_cast<const uint8_t *>(s2), len2);
697}
698} // extern "C"