Index: gcc/asan.c =================================================================== --- gcc/asan.c (revision 251636) +++ gcc/asan.c (working copy) @@ -2709,6 +2709,29 @@ initialize_sanitizer_builtins (void) tree BT_FN_SIZE_CONST_PTR_INT = build_function_type_list (size_type_node, const_ptr_type_node, integer_type_node, NULL_TREE); + + tree BT_FN_VOID_UINT8_UINT8 + = build_function_type_list (void_type_node, unsigned_char_type_node, + unsigned_char_type_node, NULL_TREE); + tree BT_FN_VOID_UINT16_UINT16 + = build_function_type_list (void_type_node, uint16_type_node, + uint16_type_node, NULL_TREE); + tree BT_FN_VOID_UINT32_UINT32 + = build_function_type_list (void_type_node, uint32_type_node, + uint32_type_node, NULL_TREE); + tree BT_FN_VOID_UINT64_UINT64 + = build_function_type_list (void_type_node, uint64_type_node, + uint64_type_node, NULL_TREE); + tree BT_FN_VOID_FLOAT_FLOAT + = build_function_type_list (void_type_node, float_type_node, + float_type_node, NULL_TREE); + tree BT_FN_VOID_DOUBLE_DOUBLE + = build_function_type_list (void_type_node, double_type_node, + double_type_node, NULL_TREE); + tree BT_FN_VOID_UINT64_PTR + = build_function_type_list (void_type_node, uint64_type_node, + ptr_type_node, NULL_TREE); + tree BT_FN_BOOL_VPTR_PTR_IX_INT_INT[5]; tree BT_FN_IX_CONST_VPTR_INT[5]; tree BT_FN_IX_VPTR_IX_INT[5]; Index: gcc/builtin-types.def =================================================================== --- gcc/builtin-types.def (revision 251636) +++ gcc/builtin-types.def (working copy) @@ -338,8 +338,20 @@ DEF_FUNCTION_TYPE_2 (BT_FN_VOID_PTRMODE_PTR, BT_VOID, BT_PTRMODE, BT_PTR) DEF_FUNCTION_TYPE_2 (BT_FN_VOID_PTR_PTRMODE, BT_VOID, BT_PTR, BT_PTRMODE) +DEF_FUNCTION_TYPE_2 (BT_FN_VOID_UINT8_UINT8, + BT_VOID, BT_UINT8, BT_UINT8) +DEF_FUNCTION_TYPE_2 (BT_FN_VOID_UINT16_UINT16, + BT_VOID, BT_UINT16, BT_UINT16) +DEF_FUNCTION_TYPE_2 (BT_FN_VOID_UINT32_UINT32, + BT_VOID, BT_UINT32, BT_UINT32) DEF_FUNCTION_TYPE_2 (BT_FN_VOID_UINT64_UINT64, BT_VOID, BT_UINT64, BT_UINT64) +DEF_FUNCTION_TYPE_2 (BT_FN_VOID_FLOAT_FLOAT, + BT_VOID, BT_FLOAT, BT_FLOAT) +DEF_FUNCTION_TYPE_2 (BT_FN_VOID_DOUBLE_DOUBLE, + BT_VOID, BT_DOUBLE, BT_DOUBLE) +DEF_FUNCTION_TYPE_2 (BT_FN_VOID_UINT64_PTR, + BT_VOID, BT_UINT64, BT_PTR) DEF_FUNCTION_TYPE_2 (BT_FN_VOID_VALIST_REF_VALIST_ARG, BT_VOID, BT_VALIST_REF, BT_VALIST_ARG) DEF_FUNCTION_TYPE_2 (BT_FN_LONG_LONG_LONG, Index: gcc/common.opt =================================================================== --- gcc/common.opt (revision 251636) +++ gcc/common.opt (working copy) @@ -233,10 +233,9 @@ unsigned int flag_sanitize Variable unsigned int flag_sanitize_recover = (SANITIZE_UNDEFINED | SANITIZE_UNDEFINED_NONDEFAULT | SANITIZE_KERNEL_ADDRESS) & ~(SANITIZE_UNREACHABLE | SANITIZE_RETURN) -fsanitize-coverage=trace-pc -Common Report Var(flag_sanitize_coverage) -Enable coverage-guided fuzzing code instrumentation. -Inserts call to __sanitizer_cov_trace_pc into every basic block. +; What the coverage sanitizers should instrument +Variable +unsigned int flag_sanitize_coverage ; Flag whether a prefix has been added to dump_base_name Variable @@ -982,6 +981,10 @@ fsanitize= Common Driver Report Joined Select what to sanitize. +fsanitize-coverage= +Common Report Joined +Select what to coverage sanitize. + fasan-shadow-offset= Common Joined RejectNegative Var(common_deferred_options) Defer -fasan-shadow-offset= Use custom shadow memory offset. Index: gcc/flag-types.h =================================================================== --- gcc/flag-types.h (revision 251636) +++ gcc/flag-types.h (working copy) @@ -252,6 +252,14 @@ enum sanitize_code { | SANITIZE_BOUNDS_STRICT }; +/* Different trace modes. */ +enum sanitize_coverage_code { + /* Trace PC. */ + SANITIZE_COV_TRACE_PC = 1 << 0, + /* Trace Comparison. */ + SANITIZE_COV_TRACE_CMP = 1 << 1 +}; + /* flag_vtable_verify initialization levels. */ enum vtv_priority { VTV_NO_PRIORITY = 0, /* i.E. Do NOT do vtable verification. */ Index: gcc/opts.c =================================================================== --- gcc/opts.c (revision 251636) +++ gcc/opts.c (working copy) @@ -1526,6 +1526,17 @@ const struct sanitizer_opts_s sanitizer_opts[] = { NULL, 0U, 0UL, false } }; +/* -f{,no-}sanitize-coverage= suboptions. */ +const struct sanitizer_opts_s coverage_sanitizer_opts[] = +{ +#define COVERAGE_SANITIZER_OPT(name, flags) \ + { #name, flags, sizeof #name - 1, true } + COVERAGE_SANITIZER_OPT (trace-pc, SANITIZE_COV_TRACE_PC), + COVERAGE_SANITIZER_OPT (trace-cmp, SANITIZE_COV_TRACE_CMP), +#undef COVERAGE_SANITIZER_OPT + { NULL, 0U, 0UL, false } +}; + /* A struct for describing a run of chars within a string. */ struct string_fragment @@ -1556,19 +1567,22 @@ struct edit_distance_traits option is not valid"); - } + if (value) + flags |= opts[i].flag; else - flags |= ~(SANITIZE_THREAD | SANITIZE_LEAK - | SANITIZE_UNREACHABLE | SANITIZE_RETURN); + flags &= ~opts[i].flag; + found = true; + break; } - else if (value) + else { - /* Do not enable -fsanitize-recover=unreachable and - -fsanitize-recover=return if -fsanitize-recover=undefined - is selected. */ - if (code == OPT_fsanitize_recover_ - && sanitizer_opts[i].flag == SANITIZE_UNDEFINED) - flags |= (SANITIZE_UNDEFINED - & ~(SANITIZE_UNREACHABLE | SANITIZE_RETURN)); + /* Handle both -fsanitize and -fno-sanitize cases. */ + if (value && opts[i].flag == ~0U) + { + if (code == OPT_fsanitize_) + { + if (complain) + error_at (loc, + "%<-fsanitize=all%> option is not valid"); + } + else + flags |= ~(SANITIZE_THREAD | SANITIZE_LEAK + | SANITIZE_UNREACHABLE | SANITIZE_RETURN); + } + else if (value) + { + /* Do not enable -fsanitize-recover=unreachable and + -fsanitize-recover=return if -fsanitize-recover=undefined + is selected. */ + if (code == OPT_fsanitize_recover_ + && opts[i].flag == SANITIZE_UNDEFINED) + flags |= (SANITIZE_UNDEFINED + & ~(SANITIZE_UNREACHABLE | SANITIZE_RETURN)); + else + flags |= opts[i].flag; + } else - flags |= sanitizer_opts[i].flag; + flags &= ~opts[i].flag; + found = true; + break; } - else - flags &= ~sanitizer_opts[i].flag; - found = true; - break; } if (! found && complain) @@ -1649,21 +1682,27 @@ parse_sanitizer_options (const char *p, location_t { const char *hint = get_closest_sanitizer_option (string_fragment (p, len), - code, value); + opts, code, value); + const char *suffix; + if (code == OPT_fsanitize_recover_) + suffix = "-recover"; + else if (code == OPT_fsanitize_coverage_) + suffix = "-coverage"; + else + suffix = ""; + if (hint) error_at (loc, "unrecognized argument to -f%ssanitize%s= option: %q.*s;" " did you mean %qs?", value ? "" : "no-", - code == OPT_fsanitize_ ? "" : "-recover", - (int) len, p, hint); + suffix, (int) len, p, hint); else error_at (loc, "unrecognized argument to -f%ssanitize%s= option: %q.*s", value ? "" : "no-", - code == OPT_fsanitize_ ? "" : "-recover", - (int) len, p); + suffix, (int) len, p); } if (comma == NULL) @@ -1956,6 +1995,12 @@ common_handle_option (struct gcc_options *opts, &= ~(SANITIZE_UNDEFINED | SANITIZE_UNDEFINED_NONDEFAULT); break; + case OPT_fsanitize_coverage_: + opts->x_flag_sanitize_coverage + = parse_sanitizer_options (arg, loc, code, + opts->x_flag_sanitize_coverage, value, true); + break; + case OPT_O: case OPT_Os: case OPT_Ofast: Index: gcc/sancov.c =================================================================== --- gcc/sancov.c (revision 251636) +++ gcc/sancov.c (working copy) @@ -1,6 +1,7 @@ /* Code coverage instrumentation for fuzzing. Copyright (C) 2015-2017 Free Software Foundation, Inc. - Contributed by Dmitry Vyukov + Contributed by Dmitry Vyukov and + Wish Wu This file is part of GCC. @@ -29,33 +30,219 @@ along with GCC; see the file COPYING3. If not see #include "flags.h" #include "stmt.h" #include "gimple-iterator.h" +#include "gimple-builder.h" #include "tree-cfg.h" #include "tree-pass.h" #include "tree-iterator.h" +#include "fold-const.h" #include "stringpool.h" #include "attribs.h" +#include "output.h" +#include "cgraph.h" #include "asan.h" namespace { +static void +instrument_cond (gimple_stmt_iterator *gsi, gimple *stmt) +{ + tree lhs = gimple_cond_lhs (stmt); + tree rhs = gimple_cond_rhs (stmt); + tree lhs_type = TREE_TYPE (lhs); + tree rhs_type = TREE_TYPE (rhs); + + HOST_WIDE_INT size_in_bytes = MAX (int_size_in_bytes (lhs_type), + int_size_in_bytes (rhs_type)); + if (size_in_bytes == -1) + return; + + enum built_in_function fncode; + tree to_type = NULL_TREE; + + if (INTEGRAL_TYPE_P (lhs_type) || INTEGRAL_TYPE_P (rhs_type)) + { + switch (size_in_bytes) + { + case 1: + fncode = BUILT_IN_SANITIZER_COV_TRACE_CMP1; + to_type = unsigned_char_type_node; + break; + + case 2: + fncode = BUILT_IN_SANITIZER_COV_TRACE_CMP2; + to_type = uint16_type_node; + break; + + case 4: + fncode = BUILT_IN_SANITIZER_COV_TRACE_CMP4; + to_type = uint32_type_node; + break; + + case 8: + fncode = BUILT_IN_SANITIZER_COV_TRACE_CMP8; + to_type = uint64_type_node; + break; + + default: + return; + } + } + else if (SCALAR_FLOAT_TYPE_P (lhs_type) && SCALAR_FLOAT_TYPE_P (rhs_type)) + { + if (TYPE_MODE (lhs_type) == TYPE_MODE (double_type_node) + || TYPE_MODE (rhs_type) == TYPE_MODE (double_type_node)) + { + fncode = BUILT_IN_SANITIZER_COV_TRACE_CMPD; + to_type = double_type_node; + } + else if (TYPE_MODE (lhs_type) == TYPE_MODE (float_type_node) + || TYPE_MODE (rhs_type) == TYPE_MODE (float_type_node)) + { + fncode = BUILT_IN_SANITIZER_COV_TRACE_CMPF; + to_type = float_type_node; + } + + } + if (to_type != NULL_TREE) + { + gimple_seq seq = NULL; + + gimple_seq_add_stmt (&seq, build_type_cast (to_type, lhs)); + tree clhs = gimple_assign_lhs (gimple_seq_last_stmt (seq)); + + gimple_seq_add_stmt (&seq, build_type_cast (to_type, rhs)); + tree crhs = gimple_assign_lhs (gimple_seq_last_stmt (seq)); + + tree fndecl = builtin_decl_implicit (fncode); + gimple *gcall = gimple_build_call (fndecl, 2, clhs, crhs); + gimple_seq_add_stmt (&seq, gcall); + + gimple_seq_set_location (seq, gimple_location (stmt)); + gsi_insert_seq_before (gsi, seq, GSI_CONTINUE_LINKING); + } +} + +static void +instrument_switch (gimple_stmt_iterator *gsi, gimple *stmt, function *fun) +{ + gswitch *switch_stmt = as_a (stmt); + tree index = gimple_switch_index (switch_stmt); + + HOST_WIDE_INT size_in_bytes = int_size_in_bytes (TREE_TYPE (index)); + if (size_in_bytes == -1) + return; + + unsigned i, n = gimple_switch_num_labels (switch_stmt), num = 0; + for (i = 0; i < n; ++i) + { + tree label = gimple_switch_label (switch_stmt, i); + tree low_case = CASE_LOW (label); + if (low_case != NULL_TREE) + num++; + tree high_case = CASE_HIGH (label); + if (high_case != NULL_TREE) + num++; + } + + tree case_array_type + = build_array_type (build_type_variant (uint64_type_node, 1, 0), + build_index_type (size_int (num + 2 - 1))); + + char name[64]; + static size_t case_array_count = 0; + ASM_GENERATE_INTERNAL_LABEL (name, "LCASEARRAY", case_array_count++); + tree case_array_var = build_decl (UNKNOWN_LOCATION, VAR_DECL, + get_identifier (name), case_array_type); + TREE_STATIC (case_array_var) = 1; + TREE_PUBLIC (case_array_var) = 0; + TREE_CONSTANT (case_array_var) = 1; + TREE_READONLY (case_array_var) = 1; + DECL_EXTERNAL (case_array_var) = 0; + DECL_ARTIFICIAL (case_array_var) = 1; + DECL_IGNORED_P (case_array_var) = 1; + + vec *v = NULL; + vec_alloc (v, num + 2); + CONSTRUCTOR_APPEND_ELT (v, NULL_TREE, + build_int_cst (uint64_type_node, num)); + CONSTRUCTOR_APPEND_ELT (v, NULL_TREE, + build_int_cst (uint64_type_node, + size_in_bytes * 8)); + for (i = 0; i < n; ++i) + { + tree label = gimple_switch_label (switch_stmt, i); + + tree low_case = CASE_LOW (label); + if (low_case != NULL_TREE) + CONSTRUCTOR_APPEND_ELT (v, NULL_TREE, + fold_convert (uint64_type_node, low_case)); + + tree high_case = CASE_HIGH (label); + if (high_case != NULL_TREE) + CONSTRUCTOR_APPEND_ELT (v, NULL_TREE, + fold_convert (uint64_type_node, high_case)); + } + tree ctor = build_constructor (case_array_type, v); + TREE_STATIC (ctor) = 1; + TREE_PUBLIC (ctor) = 0; + TREE_CONSTANT (ctor) = 1; + TREE_READONLY (ctor) = 1; + DECL_INITIAL (case_array_var) = ctor; + varpool_node::finalize_decl (case_array_var); + + tree case_array_var_ref = build_fold_addr_expr (case_array_var); + add_local_decl (fun, case_array_var); + tree fndecl = builtin_decl_implicit (BUILT_IN_SANITIZER_COV_TRACE_SWITCH); + gimple *gcall = gimple_build_call (fndecl, 2, index, case_array_var_ref); + gimple_set_location (gcall, gimple_location (stmt)); + gsi_insert_before (gsi, gcall, GSI_SAME_STMT); +} + unsigned sancov_pass (function *fun) { initialize_sanitizer_builtins (); + basic_block bb; + /* Insert callback into beginning of every BB. */ - tree fndecl = builtin_decl_implicit (BUILT_IN_SANITIZER_COV_TRACE_PC); - basic_block bb; - FOR_EACH_BB_FN (bb, fun) + if (flag_sanitize_coverage & SANITIZE_COV_TRACE_PC) { - gimple_stmt_iterator gsi = gsi_start_nondebug_after_labels_bb (bb); - if (gsi_end_p (gsi)) - continue; - gimple *stmt = gsi_stmt (gsi); - gimple *gcall = gimple_build_call (fndecl, 0); - gimple_set_location (gcall, gimple_location (stmt)); - gsi_insert_before (&gsi, gcall, GSI_SAME_STMT); + tree fndecl = builtin_decl_implicit (BUILT_IN_SANITIZER_COV_TRACE_PC); + FOR_EACH_BB_FN (bb, fun) + { + gimple_stmt_iterator gsi = gsi_start_nondebug_after_labels_bb (bb); + if (gsi_end_p (gsi)) + continue; + gimple *stmt = gsi_stmt (gsi); + gimple *gcall = gimple_build_call (fndecl, 0); + gimple_set_location (gcall, gimple_location (stmt)); + gsi_insert_before (&gsi, gcall, GSI_SAME_STMT); + } } + + /* Insert callback to every compare statments. */ + if (flag_sanitize_coverage & SANITIZE_COV_TRACE_CMP) + { + FOR_EACH_BB_FN (bb, fun) + { + gimple_stmt_iterator gsi = gsi_last_bb (bb); + gimple *stmt = gsi_stmt (gsi); + switch (gimple_code (stmt)) + { + case GIMPLE_COND: + instrument_cond (&gsi, stmt); + break; + + case GIMPLE_SWITCH: + instrument_switch (&gsi, stmt, fun); + break; + + default: + break; + } + } + } return 0; } Index: gcc/sanitizer.def =================================================================== --- gcc/sanitizer.def (revision 251636) +++ gcc/sanitizer.def (working copy) @@ -537,6 +537,27 @@ DEF_SANITIZER_BUILTIN(BUILT_IN_UBSAN_HANDLE_DYNAMI DEF_SANITIZER_BUILTIN(BUILT_IN_SANITIZER_COV_TRACE_PC, "__sanitizer_cov_trace_pc", BT_FN_VOID, ATTR_NOTHROW_LEAF_LIST) +DEF_SANITIZER_BUILTIN(BUILT_IN_SANITIZER_COV_TRACE_CMP1, + "__sanitizer_cov_trace_cmp1", + BT_FN_VOID_UINT8_UINT8, ATTR_NOTHROW_LEAF_LIST) +DEF_SANITIZER_BUILTIN(BUILT_IN_SANITIZER_COV_TRACE_CMP2, + "__sanitizer_cov_trace_cmp2", + BT_FN_VOID_UINT16_UINT16, ATTR_NOTHROW_LEAF_LIST) +DEF_SANITIZER_BUILTIN(BUILT_IN_SANITIZER_COV_TRACE_CMP4, + "__sanitizer_cov_trace_cmp4", + BT_FN_VOID_UINT32_UINT32, ATTR_NOTHROW_LEAF_LIST) +DEF_SANITIZER_BUILTIN(BUILT_IN_SANITIZER_COV_TRACE_CMP8, + "__sanitizer_cov_trace_cmp8", + BT_FN_VOID_UINT64_UINT64, ATTR_NOTHROW_LEAF_LIST) +DEF_SANITIZER_BUILTIN(BUILT_IN_SANITIZER_COV_TRACE_CMPF, + "__sanitizer_cov_trace_cmpf", + BT_FN_VOID_FLOAT_FLOAT, ATTR_NOTHROW_LEAF_LIST) +DEF_SANITIZER_BUILTIN(BUILT_IN_SANITIZER_COV_TRACE_CMPD, + "__sanitizer_cov_trace_cmpd", + BT_FN_VOID_DOUBLE_DOUBLE, ATTR_NOTHROW_LEAF_LIST) +DEF_SANITIZER_BUILTIN(BUILT_IN_SANITIZER_COV_TRACE_SWITCH, + "__sanitizer_cov_trace_switch", + BT_FN_VOID_UINT64_PTR, ATTR_NOTHROW_LEAF_LIST) /* This has to come after all the sanitizer builtins. */ DEF_BUILTIN_STUB(END_SANITIZER_BUILTINS, (const char *)0) Index: gcc/testsuite/gcc.dg/sancov/basic3.c =================================================================== --- gcc/testsuite/gcc.dg/sancov/basic3.c (nonexistent) +++ gcc/testsuite/gcc.dg/sancov/basic3.c (working copy) @@ -0,0 +1,69 @@ +/* Basic test on number of inserted callbacks. */ +/* { dg-do compile } */ +/* { dg-options "-fsanitize-coverage=trace-cmp -fdump-tree-optimized" } */ + +void foo(char *a, short *b, int *c, long long *d, float *e, double *f) +{ + if (*a) + *a += 1; + if (*b) + *b = *a; + if (*c) + *c += 1; + if(*d) + *d = *c; + if(*e == *c) + *e = *c; + if(*f == *e) + *f = *e; + switch(*a) + { + case 2: + *b += 2; + break; + case 3: + *b += 3; + break; + case 4: + *b += 4; + break; + case 5: + *b += 5; + break; + case 6: + *b += 6; + break; + case 7: + *b += 7; + break; + default: + break; + } + switch(*d) + { + case 3: + *d += 3; + case -4: + *d -= 4; + case -5: + *d -= 5; + case -6: + *d -= 6; + case -7: + *d -= 7; + case -8: + *d -= 8; + case -9: + *d -= 9; + case -10: + *d -= 10; + } +} + +/* { dg-final { scan-tree-dump-times "__builtin___sanitizer_cov_trace_cmp1 \\(" 1 "optimized" } } */ +/* { dg-final { scan-tree-dump-times "__builtin___sanitizer_cov_trace_cmp2 \\(" 1 "optimized" } } */ +/* { dg-final { scan-tree-dump-times "__builtin___sanitizer_cov_trace_cmp4 \\(" 1 "optimized" } } */ +/* { dg-final { scan-tree-dump-times "__builtin___sanitizer_cov_trace_cmp8 \\(" 1 "optimized" } } */ +/* { dg-final { scan-tree-dump-times "__builtin___sanitizer_cov_trace_cmpf \\(" 1 "optimized" } } */ +/* { dg-final { scan-tree-dump-times "__builtin___sanitizer_cov_trace_cmpd \\(" 1 "optimized" } } */ +/* { dg-final { scan-tree-dump-times "__builtin___sanitizer_cov_trace_switch \\(" 2 "optimized" } } */