sanitizer_coverage_libcdep.cc revision 2d1fdb26e458c4ddc04155c1d421bced3ba90cd0
1//===-- sanitizer_coverage.cc ---------------------------------------------===// 2// 3// The LLVM Compiler Infrastructure 4// 5// This file is distributed under the University of Illinois Open Source 6// License. See LICENSE.TXT for details. 7// 8//===----------------------------------------------------------------------===// 9// 10// Sanitizer Coverage. 11// This file implements run-time support for a poor man's coverage tool. 12// 13// Compiler instrumentation: 14// For every interesting basic block the compiler injects the following code: 15// if (*Guard) { 16// __sanitizer_cov(); 17// *Guard = 1; 18// } 19// It's fine to call __sanitizer_cov more than once for a given block. 20// 21// Run-time: 22// - __sanitizer_cov(): record that we've executed the PC (GET_CALLER_PC). 23// - __sanitizer_cov_dump: dump the coverage data to disk. 24// For every module of the current process that has coverage data 25// this will create a file module_name.PID.sancov. The file format is simple: 26// it's just a sorted sequence of 4-byte offsets in the module. 27// 28// Eventually, this coverage implementation should be obsoleted by a more 29// powerful general purpose Clang/LLVM coverage instrumentation. 30// Consider this implementation as prototype. 31// 32// FIXME: support (or at least test with) dlclose. 33//===----------------------------------------------------------------------===// 34 35#include "sanitizer_allocator_internal.h" 36#include "sanitizer_common.h" 37#include "sanitizer_libc.h" 38#include "sanitizer_mutex.h" 39#include "sanitizer_procmaps.h" 40#include "sanitizer_stacktrace.h" 41#include "sanitizer_flags.h" 42 43atomic_uint32_t dump_once_guard; // Ensure that CovDump runs only once. 44 45// pc_array is the array containing the covered PCs. 46// To make the pc_array thread- and async-signal-safe it has to be large enough. 47// 128M counters "ought to be enough for anybody" (4M on 32-bit). 48 49// With coverage_direct=1 in ASAN_OPTIONS, pc_array memory is mapped to a file. 50// In this mode, __sanitizer_cov_dump does nothing, and CovUpdateMapping() 51// dump current memory layout to another file. 52 53static bool cov_sandboxed = false; 54static int cov_fd = kInvalidFd; 55static unsigned int cov_max_block_size = 0; 56 57namespace __sanitizer { 58 59class CoverageData { 60 public: 61 void Init(); 62 void Extend(uptr npcs); 63 void Add(uptr pc); 64 65 uptr *data(); 66 uptr size(); 67 68 private: 69 // Maximal size pc array may ever grow. 70 // We MmapNoReserve this space to ensure that the array is contiguous. 71 static const uptr kPcArrayMaxSize = FIRST_32_SECOND_64(1 << 22, 1 << 27); 72 // The amount file mapping for the pc array is grown by. 73 static const uptr kPcArrayMmapSize = 64 * 1024; 74 75 // pc_array is allocated with MmapNoReserveOrDie and so it uses only as 76 // much RAM as it really needs. 77 uptr *pc_array; 78 // Index of the first available pc_array slot. 79 atomic_uintptr_t pc_array_index; 80 // Array size. 81 atomic_uintptr_t pc_array_size; 82 // Current file mapped size of the pc array. 83 uptr pc_array_mapped_size; 84 // Descriptor of the file mapped pc array. 85 int pc_fd; 86 StaticSpinMutex mu; 87 88 void DirectInit(); 89}; 90 91static CoverageData coverage_data; 92 93void CoverageData::DirectInit() { 94 InternalScopedString path(64); 95 internal_snprintf((char *)path.data(), path.size(), "%zd.sancov.raw", 96 internal_getpid()); 97 pc_fd = OpenFile(path.data(), true); 98 if (internal_iserror(pc_fd)) { 99 Report(" Coverage: failed to open %s for writing\n", path.data()); 100 Die(); 101 } 102 103 atomic_store(&pc_array_size, 0, memory_order_relaxed); 104 pc_array_mapped_size = 0; 105 106 CovUpdateMapping(); 107} 108 109void CoverageData::Init() { 110 pc_array = reinterpret_cast<uptr *>( 111 MmapNoReserveOrDie(sizeof(uptr) * kPcArrayMaxSize, "CovInit")); 112 if (common_flags()->coverage_direct) { 113 DirectInit(); 114 } else { 115 pc_fd = 0; 116 atomic_store(&pc_array_size, kPcArrayMaxSize, memory_order_relaxed); 117 } 118} 119 120// Extend coverage PC array to fit additional npcs elements. 121void CoverageData::Extend(uptr npcs) { 122 // If pc_fd=0, pc array is a huge anonymous mapping that does not need to be 123 // resized. 124 if (!pc_fd) return; 125 SpinMutexLock l(&mu); 126 127 uptr size = atomic_load(&pc_array_size, memory_order_relaxed); 128 size += npcs * sizeof(uptr); 129 130 if (size > pc_array_mapped_size) { 131 uptr new_mapped_size = pc_array_mapped_size; 132 while (size > new_mapped_size) new_mapped_size += kPcArrayMmapSize; 133 134 // Extend the file and map the new space at the end of pc_array. 135 uptr res = internal_ftruncate(pc_fd, new_mapped_size); 136 int err; 137 if (internal_iserror(res, &err)) { 138 Printf("failed to extend raw coverage file: %d\n", err); 139 Die(); 140 } 141 void *p = MapWritableFileToMemory(pc_array + pc_array_mapped_size, 142 new_mapped_size - pc_array_mapped_size, 143 pc_fd, pc_array_mapped_size); 144 CHECK_EQ(p, pc_array + pc_array_mapped_size); 145 pc_array_mapped_size = new_mapped_size; 146 } 147 148 atomic_store(&pc_array_size, size, memory_order_release); 149} 150 151// Simply add the pc into the vector under lock. If the function is called more 152// than once for a given PC it will be inserted multiple times, which is fine. 153void CoverageData::Add(uptr pc) { 154 if (!pc_array) return; 155 uptr idx = atomic_fetch_add(&pc_array_index, 1, memory_order_relaxed); 156 CHECK_LT(idx * sizeof(uptr), 157 atomic_load(&pc_array_size, memory_order_acquire)); 158 pc_array[idx] = pc; 159} 160 161uptr *CoverageData::data() { 162 return pc_array; 163} 164 165uptr CoverageData::size() { 166 return atomic_load(&pc_array_index, memory_order_relaxed); 167} 168 169// Block layout for packed file format: header, followed by module name (no 170// trailing zero), followed by data blob. 171struct CovHeader { 172 int pid; 173 unsigned int module_name_length; 174 unsigned int data_length; 175}; 176 177static void CovWritePacked(int pid, const char *module, const void *blob, 178 unsigned int blob_size) { 179 if (cov_fd < 0) return; 180 unsigned module_name_length = internal_strlen(module); 181 CovHeader header = {pid, module_name_length, blob_size}; 182 183 if (cov_max_block_size == 0) { 184 // Writing to a file. Just go ahead. 185 internal_write(cov_fd, &header, sizeof(header)); 186 internal_write(cov_fd, module, module_name_length); 187 internal_write(cov_fd, blob, blob_size); 188 } else { 189 // Writing to a socket. We want to split the data into appropriately sized 190 // blocks. 191 InternalScopedBuffer<char> block(cov_max_block_size); 192 CHECK_EQ((uptr)block.data(), (uptr)(CovHeader *)block.data()); 193 uptr header_size_with_module = sizeof(header) + module_name_length; 194 CHECK_LT(header_size_with_module, cov_max_block_size); 195 unsigned int max_payload_size = 196 cov_max_block_size - header_size_with_module; 197 char *block_pos = block.data(); 198 internal_memcpy(block_pos, &header, sizeof(header)); 199 block_pos += sizeof(header); 200 internal_memcpy(block_pos, module, module_name_length); 201 block_pos += module_name_length; 202 char *block_data_begin = block_pos; 203 char *blob_pos = (char *)blob; 204 while (blob_size > 0) { 205 unsigned int payload_size = Min(blob_size, max_payload_size); 206 blob_size -= payload_size; 207 internal_memcpy(block_data_begin, blob_pos, payload_size); 208 blob_pos += payload_size; 209 ((CovHeader *)block.data())->data_length = payload_size; 210 internal_write(cov_fd, block.data(), 211 header_size_with_module + payload_size); 212 } 213 } 214} 215 216// If packed = false: <name>.<pid>.<sancov> (name = module name). 217// If packed = true and name == 0: <pid>.<sancov>.<packed>. 218// If packed = true and name != 0: <name>.<sancov>.<packed> (name is 219// user-supplied). 220static int CovOpenFile(bool packed, const char* name) { 221 InternalScopedBuffer<char> path(1024); 222 if (!packed) { 223 CHECK(name); 224 internal_snprintf((char *)path.data(), path.size(), "%s.%zd.sancov", 225 name, internal_getpid()); 226 } else { 227 if (!name) 228 internal_snprintf((char *)path.data(), path.size(), "%zd.sancov.packed", 229 internal_getpid()); 230 else 231 internal_snprintf((char *)path.data(), path.size(), "%s.sancov.packed", 232 name); 233 } 234 uptr fd = OpenFile(path.data(), true); 235 if (internal_iserror(fd)) { 236 Report(" SanitizerCoverage: failed to open %s for writing\n", path.data()); 237 return -1; 238 } 239 return fd; 240} 241 242// Dump the coverage on disk. 243static void CovDump() { 244 if (!common_flags()->coverage || common_flags()->coverage_direct) return; 245#if !SANITIZER_WINDOWS 246 if (atomic_fetch_add(&dump_once_guard, 1, memory_order_relaxed)) 247 return; 248 uptr size = coverage_data.size(); 249 InternalMmapVector<u32> offsets(size); 250 uptr *vb = coverage_data.data(); 251 uptr *ve = vb + size; 252 SortArray(vb, size); 253 MemoryMappingLayout proc_maps(/*cache_enabled*/true); 254 uptr mb, me, off, prot; 255 InternalScopedBuffer<char> module(4096); 256 InternalScopedBuffer<char> path(4096 * 2); 257 for (int i = 0; 258 proc_maps.Next(&mb, &me, &off, module.data(), module.size(), &prot); 259 i++) { 260 if ((prot & MemoryMappingLayout::kProtectionExecute) == 0) 261 continue; 262 while (vb < ve && *vb < mb) vb++; 263 if (vb >= ve) break; 264 if (*vb < me) { 265 offsets.clear(); 266 const uptr *old_vb = vb; 267 CHECK_LE(off, *vb); 268 for (; vb < ve && *vb < me; vb++) { 269 uptr diff = *vb - (i ? mb : 0) + off; 270 CHECK_LE(diff, 0xffffffffU); 271 offsets.push_back(static_cast<u32>(diff)); 272 } 273 char *module_name = StripModuleName(module.data()); 274 if (cov_sandboxed) { 275 if (cov_fd >= 0) { 276 CovWritePacked(internal_getpid(), module_name, offsets.data(), 277 offsets.size() * sizeof(u32)); 278 VReport(1, " CovDump: %zd PCs written to packed file\n", vb - old_vb); 279 } 280 } else { 281 // One file per module per process. 282 internal_snprintf((char *)path.data(), path.size(), "%s.%zd.sancov", 283 module_name, internal_getpid()); 284 int fd = CovOpenFile(false /* packed */, module_name); 285 if (fd > 0) { 286 internal_write(fd, offsets.data(), offsets.size() * sizeof(u32)); 287 internal_close(fd); 288 VReport(1, " CovDump: %s: %zd PCs written\n", path.data(), 289 vb - old_vb); 290 } 291 } 292 InternalFree(module_name); 293 } 294 } 295 if (cov_fd >= 0) 296 internal_close(cov_fd); 297#endif // !SANITIZER_WINDOWS 298} 299 300void CovPrepareForSandboxing(__sanitizer_sandbox_arguments *args) { 301 if (!args) return; 302 if (!common_flags()->coverage) return; 303 cov_sandboxed = args->coverage_sandboxed; 304 if (!cov_sandboxed) return; 305 cov_fd = args->coverage_fd; 306 cov_max_block_size = args->coverage_max_block_size; 307 if (cov_fd < 0) 308 // Pre-open the file now. The sandbox won't allow us to do it later. 309 cov_fd = CovOpenFile(true /* packed */, 0); 310} 311 312int MaybeOpenCovFile(const char *name) { 313 CHECK(name); 314 if (!common_flags()->coverage) return -1; 315 return CovOpenFile(true /* packed */, name); 316} 317} // namespace __sanitizer 318 319extern "C" { 320SANITIZER_INTERFACE_ATTRIBUTE void __sanitizer_cov() { 321 coverage_data.Add(StackTrace::GetPreviousInstructionPc(GET_CALLER_PC())); 322} 323SANITIZER_INTERFACE_ATTRIBUTE void __sanitizer_cov_dump() { CovDump(); } 324SANITIZER_INTERFACE_ATTRIBUTE void __sanitizer_cov_init() { 325 coverage_data.Init(); 326} 327SANITIZER_INTERFACE_ATTRIBUTE void __sanitizer_cov_module_init(uptr npcs) { 328 coverage_data.Extend(npcs); 329} 330SANITIZER_INTERFACE_ATTRIBUTE 331sptr __sanitizer_maybe_open_cov_file(const char *name) { 332 return MaybeOpenCovFile(name); 333} 334} // extern "C" 335