//===- FuzzerTracePC.cpp - PC tracing--------------------------------------===// // // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions. // See https://llvm.org/LICENSE.txt for license information. // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception // //===----------------------------------------------------------------------===// // Trace PCs. // This module implements __sanitizer_cov_trace_pc_guard[_init], // the callback required for -fsanitize-coverage=trace-pc-guard instrumentation. // //===----------------------------------------------------------------------===// #include "FuzzerTracePC.h" #include "FuzzerBuiltins.h" #include "FuzzerBuiltinsMsvc.h" #include "FuzzerCorpus.h" #include "FuzzerDefs.h" #include "FuzzerDictionary.h" #include "FuzzerExtFunctions.h" #include "FuzzerIO.h" #include "FuzzerPlatform.h" #include "FuzzerUtil.h" #include "FuzzerValueBitMap.h" #include <set> // Used by -fsanitize-coverage=stack-depth to track stack depth ATTRIBUTES_INTERFACE_TLS_INITIAL_EXEC uintptr_t __sancov_lowest_stack; namespace fuzzer { TracePC TPC; size_t TracePC::GetTotalPCCoverage() { … } void TracePC::HandleInline8bitCountersInit(uint8_t *Start, uint8_t *Stop) { … } void TracePC::HandlePCsInit(const uintptr_t *Start, const uintptr_t *Stop) { … } void TracePC::PrintModuleInfo() { … } ATTRIBUTE_NO_SANITIZE_ALL void TracePC::HandleCallerCallee(uintptr_t Caller, uintptr_t Callee) { … } /// \return the address of the previous instruction. /// Note: the logic is copied from `sanitizer_common/sanitizer_stacktrace.h` inline ALWAYS_INLINE uintptr_t GetPreviousInstructionPc(uintptr_t PC) { … } /// \return the address of the next instruction. /// Note: the logic is copied from `sanitizer_common/sanitizer_stacktrace.cpp` ALWAYS_INLINE uintptr_t TracePC::GetNextInstructionPc(uintptr_t PC) { … } void TracePC::UpdateObservedPCs() { … } uintptr_t TracePC::PCTableEntryIdx(const PCTableEntry *TE) { … } const TracePC::PCTableEntry *TracePC::PCTableEntryByIdx(uintptr_t Idx) { … } static std::string GetModuleName(uintptr_t PC) { … } template<class CallBack> void TracePC::IterateCoveredFunctions(CallBack CB) { … } void TracePC::SetFocusFunction(const std::string &FuncName) { … } bool TracePC::ObservedFocusFunction() { … } void TracePC::PrintCoverage(bool PrintAllCounters) { … } // Value profile. // We keep track of various values that affect control flow. // These values are inserted into a bit-set-based hash map. // Every new bit in the map is treated as a new coverage. // // For memcmp/strcmp/etc the interesting value is the length of the common // prefix of the parameters. // For cmp instructions the interesting value is a XOR of the parameters. // The interesting value is mixed up with the PC and is then added to the map. ATTRIBUTE_NO_SANITIZE_ALL void TracePC::AddValueForMemcmp(void *caller_pc, const void *s1, const void *s2, size_t n, bool StopAtZero) { … } template <class T> ATTRIBUTE_TARGET_POPCNT ALWAYS_INLINE ATTRIBUTE_NO_SANITIZE_ALL void TracePC::HandleCmp(uintptr_t PC, T Arg1, T Arg2) { … } ATTRIBUTE_NO_SANITIZE_MEMORY static size_t InternalStrnlen(const char *S, size_t MaxLen) { … } // Finds min of (strlen(S1), strlen(S2)). // Needed because one of these strings may actually be non-zero terminated. ATTRIBUTE_NO_SANITIZE_MEMORY static size_t InternalStrnlen2(const char *S1, const char *S2) { … } void TracePC::ClearInlineCounters() { … } ATTRIBUTE_NO_SANITIZE_ALL void TracePC::RecordInitialStack() { … } uintptr_t TracePC::GetMaxStackOffset() const { … } void WarnAboutDeprecatedInstrumentation(const char *flag) { … } } // namespace fuzzer extern "C" { ATTRIBUTE_INTERFACE ATTRIBUTE_NO_SANITIZE_ALL void __sanitizer_cov_trace_pc_guard(uint32_t *Guard) { … } // Best-effort support for -fsanitize-coverage=trace-pc, which is available // in both Clang and GCC. ATTRIBUTE_INTERFACE ATTRIBUTE_NO_SANITIZE_ALL void __sanitizer_cov_trace_pc() { … } ATTRIBUTE_INTERFACE void __sanitizer_cov_trace_pc_guard_init(uint32_t *Start, uint32_t *Stop) { … } ATTRIBUTE_INTERFACE void __sanitizer_cov_8bit_counters_init(uint8_t *Start, uint8_t *Stop) { … } ATTRIBUTE_INTERFACE void __sanitizer_cov_pcs_init(const uintptr_t *pcs_beg, const uintptr_t *pcs_end) { … } ATTRIBUTE_INTERFACE ATTRIBUTE_NO_SANITIZE_ALL void __sanitizer_cov_trace_pc_indir(uintptr_t Callee) { … } ATTRIBUTE_INTERFACE ATTRIBUTE_NO_SANITIZE_ALL ATTRIBUTE_TARGET_POPCNT void __sanitizer_cov_trace_cmp8(uint64_t Arg1, uint64_t Arg2) { … } ATTRIBUTE_INTERFACE ATTRIBUTE_NO_SANITIZE_ALL ATTRIBUTE_TARGET_POPCNT // Now the __sanitizer_cov_trace_const_cmp[1248] callbacks just mimic // the behaviour of __sanitizer_cov_trace_cmp[1248] ones. This, however, // should be changed later to make full use of instrumentation. void __sanitizer_cov_trace_const_cmp8(uint64_t Arg1, uint64_t Arg2) { … } ATTRIBUTE_INTERFACE ATTRIBUTE_NO_SANITIZE_ALL ATTRIBUTE_TARGET_POPCNT void __sanitizer_cov_trace_cmp4(uint32_t Arg1, uint32_t Arg2) { … } ATTRIBUTE_INTERFACE ATTRIBUTE_NO_SANITIZE_ALL ATTRIBUTE_TARGET_POPCNT void __sanitizer_cov_trace_const_cmp4(uint32_t Arg1, uint32_t Arg2) { … } ATTRIBUTE_INTERFACE ATTRIBUTE_NO_SANITIZE_ALL ATTRIBUTE_TARGET_POPCNT void __sanitizer_cov_trace_cmp2(uint16_t Arg1, uint16_t Arg2) { … } ATTRIBUTE_INTERFACE ATTRIBUTE_NO_SANITIZE_ALL ATTRIBUTE_TARGET_POPCNT void __sanitizer_cov_trace_const_cmp2(uint16_t Arg1, uint16_t Arg2) { … } ATTRIBUTE_INTERFACE ATTRIBUTE_NO_SANITIZE_ALL ATTRIBUTE_TARGET_POPCNT void __sanitizer_cov_trace_cmp1(uint8_t Arg1, uint8_t Arg2) { … } ATTRIBUTE_INTERFACE ATTRIBUTE_NO_SANITIZE_ALL ATTRIBUTE_TARGET_POPCNT void __sanitizer_cov_trace_const_cmp1(uint8_t Arg1, uint8_t Arg2) { … } ATTRIBUTE_INTERFACE ATTRIBUTE_NO_SANITIZE_ALL ATTRIBUTE_TARGET_POPCNT void __sanitizer_cov_trace_switch(uint64_t Val, uint64_t *Cases) { … } ATTRIBUTE_INTERFACE ATTRIBUTE_NO_SANITIZE_ALL ATTRIBUTE_TARGET_POPCNT void __sanitizer_cov_trace_div4(uint32_t Val) { … } ATTRIBUTE_INTERFACE ATTRIBUTE_NO_SANITIZE_ALL ATTRIBUTE_TARGET_POPCNT void __sanitizer_cov_trace_div8(uint64_t Val) { … } ATTRIBUTE_INTERFACE ATTRIBUTE_NO_SANITIZE_ALL ATTRIBUTE_TARGET_POPCNT void __sanitizer_cov_trace_gep(uintptr_t Idx) { … } ATTRIBUTE_INTERFACE ATTRIBUTE_NO_SANITIZE_MEMORY void __sanitizer_weak_hook_memcmp(void *caller_pc, const void *s1, const void *s2, size_t n, int result) { … } ATTRIBUTE_INTERFACE ATTRIBUTE_NO_SANITIZE_MEMORY void __sanitizer_weak_hook_strncmp(void *caller_pc, const char *s1, const char *s2, size_t n, int result) { … } ATTRIBUTE_INTERFACE ATTRIBUTE_NO_SANITIZE_MEMORY void __sanitizer_weak_hook_strcmp(void *caller_pc, const char *s1, const char *s2, int result) { … } ATTRIBUTE_INTERFACE ATTRIBUTE_NO_SANITIZE_MEMORY void __sanitizer_weak_hook_strncasecmp(void *called_pc, const char *s1, const char *s2, size_t n, int result) { … } ATTRIBUTE_INTERFACE ATTRIBUTE_NO_SANITIZE_MEMORY void __sanitizer_weak_hook_strcasecmp(void *called_pc, const char *s1, const char *s2, int result) { … } ATTRIBUTE_INTERFACE ATTRIBUTE_NO_SANITIZE_MEMORY void __sanitizer_weak_hook_strstr(void *called_pc, const char *s1, const char *s2, char *result) { … } ATTRIBUTE_INTERFACE ATTRIBUTE_NO_SANITIZE_MEMORY void __sanitizer_weak_hook_strcasestr(void *called_pc, const char *s1, const char *s2, char *result) { … } ATTRIBUTE_INTERFACE ATTRIBUTE_NO_SANITIZE_MEMORY void __sanitizer_weak_hook_memmem(void *called_pc, const void *s1, size_t len1, const void *s2, size_t len2, void *result) { … } } // extern "C"
Codebase Browser
llvm