Re: [PATCH v5 5/5] Add sancov plugin

[Dmitry Vyukov]

On Mon, Mar 7, 2016 at 10:07 PM, Kees Cook  wrote:
> On Sun, Mar 6, 2016 at 3:07 PM, Emese Revfy  wrote:
>> The sancov gcc plugin inserts a __sanitizer_cov_trace_pc() call
>> at the start of basic blocks.
>>
>> This plugin is a helper plugin for the kcov feature. It supports
>> all gcc versions with plugin support (from gcc-4.5 on).
>> It is based on the gcc commit "Add fuzzing coverage support" by Dmitry Vyukov
>> (https://gcc.gnu.org/viewcvs/gcc?limit_changes=0=revision=231296).
>
> Very cool! Dmitry, is this something you could put to good use?

I am using gcc with sancov as a regular pass, so I don't a good use
for this right now. Maybe it will help with deployment for Android. I
don't know. Though, it will require backporting this plugin support.

Re: [PATCH v5 5/5] Add sancov plugin

[Dmitry Vyukov]

On Mon, Mar 7, 2016 at 10:07 PM, Kees Cook  wrote:
> On Sun, Mar 6, 2016 at 3:07 PM, Emese Revfy  wrote:
>> The sancov gcc plugin inserts a __sanitizer_cov_trace_pc() call
>> at the start of basic blocks.
>>
>> This plugin is a helper plugin for the kcov feature. It supports
>> all gcc versions with plugin support (from gcc-4.5 on).
>> It is based on the gcc commit "Add fuzzing coverage support" by Dmitry Vyukov
>> (https://gcc.gnu.org/viewcvs/gcc?limit_changes=0=revision=231296).
>
> Very cool! Dmitry, is this something you could put to good use?

I am using gcc with sancov as a regular pass, so I don't a good use
for this right now. Maybe it will help with deployment for Android. I
don't know. Though, it will require backporting this plugin support.

Re: [PATCH v5 5/5] Add sancov plugin

[Emese Revfy]

On Mon, 7 Mar 2016 13:07:32 -0800
Kees Cook  wrote:

> > diff --git a/tools/gcc/sancov_plugin.c b/tools/gcc/sancov_plugin.c
> > new file mode 100644
> > index 000..5a9179b
> > --- /dev/null
> > +++ b/tools/gcc/sancov_plugin.c
> > @@ -0,0 +1,133 @@
> > +/*
> > + * Copyright 2011-2016 by Emese Revfy 
> > + * Licensed under the GPL v2, or (at your option) v3
> > + *
> > + * Homepage:
> > + * https://github.com/ephox-gcc-plugins/sancov
> > + *
> > + * This plugin inserts a __sanitizer_cov_trace_pc() call at the start of 
> > basic blocks.
> > + * It supports all gcc versions with plugin support (from gcc-4.5 on).
> > + * It is based on the commit "Add fuzzing coverage support" by Dmitry 
> > Vyukov .
> > + *
> > + * You can read about it more here:
> > + *  
> > https://gcc.gnu.org/viewcvs/gcc?limit_changes=0=revision=231296
> > + *  http://lwn.net/Articles/674854/
> > + *  https://github.com/google/syzkaller
> > + *  https://lwn.net/Articles/677764/
> > + *
> > + * Usage:
> > + * make run
> 
> Is this accurate? Wouldn't it just be selected from CONFIGs during kernel 
> build?

This is just a usage example when someone clones the plugin from github. Every 
plugin written by me contains this. :)

For now it can be enabled from menuconfig for testing because I'm waiting for 
the reactions.
Later I think the best way would be when kcov is enabled that it also enables 
the plugin automatically
if the target gcc version doesn't support the -fsanitize-coverage=trace-pc 
option but it supports plugins.

-- 
Emese

Re: [PATCH v5 5/5] Add sancov plugin

[Emese Revfy]

On Mon, 7 Mar 2016 13:07:32 -0800
Kees Cook  wrote:

> > diff --git a/tools/gcc/sancov_plugin.c b/tools/gcc/sancov_plugin.c
> > new file mode 100644
> > index 000..5a9179b
> > --- /dev/null
> > +++ b/tools/gcc/sancov_plugin.c
> > @@ -0,0 +1,133 @@
> > +/*
> > + * Copyright 2011-2016 by Emese Revfy 
> > + * Licensed under the GPL v2, or (at your option) v3
> > + *
> > + * Homepage:
> > + * https://github.com/ephox-gcc-plugins/sancov
> > + *
> > + * This plugin inserts a __sanitizer_cov_trace_pc() call at the start of 
> > basic blocks.
> > + * It supports all gcc versions with plugin support (from gcc-4.5 on).
> > + * It is based on the commit "Add fuzzing coverage support" by Dmitry 
> > Vyukov .
> > + *
> > + * You can read about it more here:
> > + *  
> > https://gcc.gnu.org/viewcvs/gcc?limit_changes=0=revision=231296
> > + *  http://lwn.net/Articles/674854/
> > + *  https://github.com/google/syzkaller
> > + *  https://lwn.net/Articles/677764/
> > + *
> > + * Usage:
> > + * make run
> 
> Is this accurate? Wouldn't it just be selected from CONFIGs during kernel 
> build?

This is just a usage example when someone clones the plugin from github. Every 
plugin written by me contains this. :)

For now it can be enabled from menuconfig for testing because I'm waiting for 
the reactions.
Later I think the best way would be when kcov is enabled that it also enables 
the plugin automatically
if the target gcc version doesn't support the -fsanitize-coverage=trace-pc 
option but it supports plugins.

-- 
Emese

Re: [PATCH v5 5/5] Add sancov plugin

[Kees Cook]

On Sun, Mar 6, 2016 at 3:07 PM, Emese Revfy  wrote:
> The sancov gcc plugin inserts a __sanitizer_cov_trace_pc() call
> at the start of basic blocks.
>
> This plugin is a helper plugin for the kcov feature. It supports
> all gcc versions with plugin support (from gcc-4.5 on).
> It is based on the gcc commit "Add fuzzing coverage support" by Dmitry Vyukov
> (https://gcc.gnu.org/viewcvs/gcc?limit_changes=0=revision=231296).

Very cool! Dmitry, is this something you could put to good use?

> [...]
> diff --git a/tools/gcc/sancov_plugin.c b/tools/gcc/sancov_plugin.c
> new file mode 100644
> index 000..5a9179b
> --- /dev/null
> +++ b/tools/gcc/sancov_plugin.c
> @@ -0,0 +1,133 @@
> +/*
> + * Copyright 2011-2016 by Emese Revfy 
> + * Licensed under the GPL v2, or (at your option) v3
> + *
> + * Homepage:
> + * https://github.com/ephox-gcc-plugins/sancov
> + *
> + * This plugin inserts a __sanitizer_cov_trace_pc() call at the start of 
> basic blocks.
> + * It supports all gcc versions with plugin support (from gcc-4.5 on).
> + * It is based on the commit "Add fuzzing coverage support" by Dmitry Vyukov 
> .
> + *
> + * You can read about it more here:
> + *  
> https://gcc.gnu.org/viewcvs/gcc?limit_changes=0=revision=231296
> + *  http://lwn.net/Articles/674854/
> + *  https://github.com/google/syzkaller
> + *  https://lwn.net/Articles/677764/
> + *
> + * Usage:
> + * make run

Is this accurate? Wouldn't it just be selected from CONFIGs during kernel build?

-Kees

-- 
Kees Cook
Chrome OS & Brillo Security

Re: [PATCH v5 5/5] Add sancov plugin

[Kees Cook]

On Sun, Mar 6, 2016 at 3:07 PM, Emese Revfy  wrote:
> The sancov gcc plugin inserts a __sanitizer_cov_trace_pc() call
> at the start of basic blocks.
>
> This plugin is a helper plugin for the kcov feature. It supports
> all gcc versions with plugin support (from gcc-4.5 on).
> It is based on the gcc commit "Add fuzzing coverage support" by Dmitry Vyukov
> (https://gcc.gnu.org/viewcvs/gcc?limit_changes=0=revision=231296).

Very cool! Dmitry, is this something you could put to good use?

> [...]
> diff --git a/tools/gcc/sancov_plugin.c b/tools/gcc/sancov_plugin.c
> new file mode 100644
> index 000..5a9179b
> --- /dev/null
> +++ b/tools/gcc/sancov_plugin.c
> @@ -0,0 +1,133 @@
> +/*
> + * Copyright 2011-2016 by Emese Revfy 
> + * Licensed under the GPL v2, or (at your option) v3
> + *
> + * Homepage:
> + * https://github.com/ephox-gcc-plugins/sancov
> + *
> + * This plugin inserts a __sanitizer_cov_trace_pc() call at the start of 
> basic blocks.
> + * It supports all gcc versions with plugin support (from gcc-4.5 on).
> + * It is based on the commit "Add fuzzing coverage support" by Dmitry Vyukov 
> .
> + *
> + * You can read about it more here:
> + *  
> https://gcc.gnu.org/viewcvs/gcc?limit_changes=0=revision=231296
> + *  http://lwn.net/Articles/674854/
> + *  https://github.com/google/syzkaller
> + *  https://lwn.net/Articles/677764/
> + *
> + * Usage:
> + * make run

Is this accurate? Wouldn't it just be selected from CONFIGs during kernel build?

-Kees

-- 
Kees Cook
Chrome OS & Brillo Security

[PATCH v5 5/5] Add sancov plugin

[Emese Revfy]

The sancov gcc plugin inserts a __sanitizer_cov_trace_pc() call
at the start of basic blocks.

This plugin is a helper plugin for the kcov feature. It supports
all gcc versions with plugin support (from gcc-4.5 on).
It is based on the gcc commit "Add fuzzing coverage support" by Dmitry Vyukov
(https://gcc.gnu.org/viewcvs/gcc?limit_changes=0=revision=231296).

Signed-off-by: Emese Revfy 
---
 arch/Kconfig |   9 +++
 scripts/Makefile.gcc-plugins |   7 ++-
 tools/gcc/Makefile   |   2 +
 tools/gcc/sancov_plugin.c| 133 +++
 4 files changed, 149 insertions(+), 2 deletions(-)
 create mode 100644 tools/gcc/sancov_plugin.c

diff --git a/arch/Kconfig b/arch/Kconfig
index 32583b7..30632fa 100644
--- a/arch/Kconfig
+++ b/arch/Kconfig
@@ -384,6 +384,15 @@ config GCC_PLUGIN_CYC_COMPLEXITY
  N = the number of nodes
  P = the number of connected components (exit nodes).
 
+config GCC_PLUGIN_SANCOV
+   bool "Helper plugin for the kcov feature"
+   depends on GCC_PLUGINS
+   help
+ This plugin inserts a __sanitizer_cov_trace_pc() call at the start of
+ basic blocks. It supports all gcc versions with plugin support (from
+ gcc-4.5 on). It is based on the commit "Add fuzzing coverage support"
+ by Dmitry Vyukov .
+
 config HAVE_CC_STACKPROTECTOR
bool
help
diff --git a/scripts/Makefile.gcc-plugins b/scripts/Makefile.gcc-plugins
index dd7b56d..dc11503 100644
--- a/scripts/Makefile.gcc-plugins
+++ b/scripts/Makefile.gcc-plugins
@@ -8,8 +8,11 @@ ifneq ($(PLUGINCC),)
 ifdef CONFIG_GCC_PLUGIN_CYC_COMPLEXITY
 GCC_PLUGIN_CYC_COMPLEXITY_CFLAGS := 
-fplugin=$(objtree)/tools/gcc/cyc_complexity_plugin.so
 endif
-GCC_PLUGINS_CFLAGS := $(GCC_PLUGIN_CYC_COMPLEXITY_CFLAGS)
-export PLUGINCC GCC_PLUGINS_CFLAGS GCC_PLUGINS_AFLAGS GCC_PLUGIN_CYC_COMPLEXITY
+ifdef CONFIG_GCC_PLUGIN_SANCOV
+GCC_PLUGIN_SANCOV_CFLAGS := -fplugin=$(objtree)/tools/gcc/sancov_plugin.so
+endif
+GCC_PLUGINS_CFLAGS := $(GCC_PLUGIN_CYC_COMPLEXITY_CFLAGS) 
$(GCC_PLUGIN_SANCOV_CFLAGS)
+export PLUGINCC GCC_PLUGINS_CFLAGS GCC_PLUGINS_AFLAGS 
GCC_PLUGIN_CYC_COMPLEXITY GCC_PLUGIN_SANCOV
 ifeq ($(KBUILD_EXTMOD),)
 gcc-plugins:
$(Q)$(MAKE) $(build)=tools/gcc
diff --git a/tools/gcc/Makefile b/tools/gcc/Makefile
index 31c72bf..97a923f 100644
--- a/tools/gcc/Makefile
+++ b/tools/gcc/Makefile
@@ -13,7 +13,9 @@ endif
 export GCCPLUGINS_DIR HOSTLIBS
 
 $(HOSTLIBS)-$(CONFIG_GCC_PLUGIN_CYC_COMPLEXITY) := cyc_complexity_plugin.so
+$(HOSTLIBS)-$(CONFIG_GCC_PLUGIN_SANCOV) += sancov_plugin.so
 
 always := $($(HOSTLIBS)-y)
 
 cyc_complexity_plugin-objs := cyc_complexity_plugin.o
+sancov_plugin-objs := sancov_plugin.o
diff --git a/tools/gcc/sancov_plugin.c b/tools/gcc/sancov_plugin.c
new file mode 100644
index 000..5a9179b
--- /dev/null
+++ b/tools/gcc/sancov_plugin.c
@@ -0,0 +1,133 @@
+/*
+ * Copyright 2011-2016 by Emese Revfy 
+ * Licensed under the GPL v2, or (at your option) v3
+ *
+ * Homepage:
+ * https://github.com/ephox-gcc-plugins/sancov
+ *
+ * This plugin inserts a __sanitizer_cov_trace_pc() call at the start of basic 
blocks.
+ * It supports all gcc versions with plugin support (from gcc-4.5 on).
+ * It is based on the commit "Add fuzzing coverage support" by Dmitry Vyukov 
.
+ *
+ * You can read about it more here:
+ *  
https://gcc.gnu.org/viewcvs/gcc?limit_changes=0=revision=231296
+ *  http://lwn.net/Articles/674854/
+ *  https://github.com/google/syzkaller
+ *  https://lwn.net/Articles/677764/
+ *
+ * Usage:
+ * make run
+ */
+
+#include "gcc-common.h"
+
+int plugin_is_GPL_compatible;
+
+tree sancov_fndecl;
+
+static struct plugin_info sancov_plugin_info = {
+   .version= "20160305",
+   .help   = "sancov plugin\n",
+};
+
+static unsigned int sancov_execute(void)
+{
+   basic_block bb;
+
+   /* Remove this line when this plugin and kcov will be in the kernel. */
+   if (!strcmp(DECL_NAME_POINTER(current_function_decl), 
DECL_NAME_POINTER(sancov_fndecl)))
+   return 0;
+
+   FOR_EACH_BB_FN(bb, cfun) {
+   const_gimple stmt;
+   gcall *gcall;
+   gimple_stmt_iterator gsi = gsi_after_labels(bb);
+
+   if (gsi_end_p(gsi))
+   continue;
+
+   stmt = gsi_stmt(gsi);
+   gcall = as_a_gcall(gimple_build_call(sancov_fndecl, 0));
+   gimple_set_location(gcall, gimple_location(stmt));
+   gsi_insert_before(, gcall, GSI_SAME_STMT);
+   }
+   return 0;
+}
+
+#define PASS_NAME sancov
+
+#define NO_GATE
+#define TODO_FLAGS_FINISH TODO_dump_func | TODO_verify_stmts | 
TODO_update_ssa_no_phi | TODO_verify_flow
+
+#include "gcc-generate-gimple-pass.h"
+
+static void sancov_start_unit(void __unused *gcc_data, void __unused 
*user_data)
+{
+   tree leaf_attr, nothrow_attr;
+   tree 

[PATCH v5 5/5] Add sancov plugin

[Emese Revfy]

The sancov gcc plugin inserts a __sanitizer_cov_trace_pc() call
at the start of basic blocks.

This plugin is a helper plugin for the kcov feature. It supports
all gcc versions with plugin support (from gcc-4.5 on).
It is based on the gcc commit "Add fuzzing coverage support" by Dmitry Vyukov
(https://gcc.gnu.org/viewcvs/gcc?limit_changes=0=revision=231296).

Signed-off-by: Emese Revfy 
---
 arch/Kconfig |   9 +++
 scripts/Makefile.gcc-plugins |   7 ++-
 tools/gcc/Makefile   |   2 +
 tools/gcc/sancov_plugin.c| 133 +++
 4 files changed, 149 insertions(+), 2 deletions(-)
 create mode 100644 tools/gcc/sancov_plugin.c

diff --git a/arch/Kconfig b/arch/Kconfig
index 32583b7..30632fa 100644
--- a/arch/Kconfig
+++ b/arch/Kconfig
@@ -384,6 +384,15 @@ config GCC_PLUGIN_CYC_COMPLEXITY
  N = the number of nodes
  P = the number of connected components (exit nodes).
 
+config GCC_PLUGIN_SANCOV
+   bool "Helper plugin for the kcov feature"
+   depends on GCC_PLUGINS
+   help
+ This plugin inserts a __sanitizer_cov_trace_pc() call at the start of
+ basic blocks. It supports all gcc versions with plugin support (from
+ gcc-4.5 on). It is based on the commit "Add fuzzing coverage support"
+ by Dmitry Vyukov .
+
 config HAVE_CC_STACKPROTECTOR
bool
help
diff --git a/scripts/Makefile.gcc-plugins b/scripts/Makefile.gcc-plugins
index dd7b56d..dc11503 100644
--- a/scripts/Makefile.gcc-plugins
+++ b/scripts/Makefile.gcc-plugins
@@ -8,8 +8,11 @@ ifneq ($(PLUGINCC),)
 ifdef CONFIG_GCC_PLUGIN_CYC_COMPLEXITY
 GCC_PLUGIN_CYC_COMPLEXITY_CFLAGS := 
-fplugin=$(objtree)/tools/gcc/cyc_complexity_plugin.so
 endif
-GCC_PLUGINS_CFLAGS := $(GCC_PLUGIN_CYC_COMPLEXITY_CFLAGS)
-export PLUGINCC GCC_PLUGINS_CFLAGS GCC_PLUGINS_AFLAGS GCC_PLUGIN_CYC_COMPLEXITY
+ifdef CONFIG_GCC_PLUGIN_SANCOV
+GCC_PLUGIN_SANCOV_CFLAGS := -fplugin=$(objtree)/tools/gcc/sancov_plugin.so
+endif
+GCC_PLUGINS_CFLAGS := $(GCC_PLUGIN_CYC_COMPLEXITY_CFLAGS) 
$(GCC_PLUGIN_SANCOV_CFLAGS)
+export PLUGINCC GCC_PLUGINS_CFLAGS GCC_PLUGINS_AFLAGS 
GCC_PLUGIN_CYC_COMPLEXITY GCC_PLUGIN_SANCOV
 ifeq ($(KBUILD_EXTMOD),)
 gcc-plugins:
$(Q)$(MAKE) $(build)=tools/gcc
diff --git a/tools/gcc/Makefile b/tools/gcc/Makefile
index 31c72bf..97a923f 100644
--- a/tools/gcc/Makefile
+++ b/tools/gcc/Makefile
@@ -13,7 +13,9 @@ endif
 export GCCPLUGINS_DIR HOSTLIBS
 
 $(HOSTLIBS)-$(CONFIG_GCC_PLUGIN_CYC_COMPLEXITY) := cyc_complexity_plugin.so
+$(HOSTLIBS)-$(CONFIG_GCC_PLUGIN_SANCOV) += sancov_plugin.so
 
 always := $($(HOSTLIBS)-y)
 
 cyc_complexity_plugin-objs := cyc_complexity_plugin.o
+sancov_plugin-objs := sancov_plugin.o
diff --git a/tools/gcc/sancov_plugin.c b/tools/gcc/sancov_plugin.c
new file mode 100644
index 000..5a9179b
--- /dev/null
+++ b/tools/gcc/sancov_plugin.c
@@ -0,0 +1,133 @@
+/*
+ * Copyright 2011-2016 by Emese Revfy 
+ * Licensed under the GPL v2, or (at your option) v3
+ *
+ * Homepage:
+ * https://github.com/ephox-gcc-plugins/sancov
+ *
+ * This plugin inserts a __sanitizer_cov_trace_pc() call at the start of basic 
blocks.
+ * It supports all gcc versions with plugin support (from gcc-4.5 on).
+ * It is based on the commit "Add fuzzing coverage support" by Dmitry Vyukov 
.
+ *
+ * You can read about it more here:
+ *  
https://gcc.gnu.org/viewcvs/gcc?limit_changes=0=revision=231296
+ *  http://lwn.net/Articles/674854/
+ *  https://github.com/google/syzkaller
+ *  https://lwn.net/Articles/677764/
+ *
+ * Usage:
+ * make run
+ */
+
+#include "gcc-common.h"
+
+int plugin_is_GPL_compatible;
+
+tree sancov_fndecl;
+
+static struct plugin_info sancov_plugin_info = {
+   .version= "20160305",
+   .help   = "sancov plugin\n",
+};
+
+static unsigned int sancov_execute(void)
+{
+   basic_block bb;
+
+   /* Remove this line when this plugin and kcov will be in the kernel. */
+   if (!strcmp(DECL_NAME_POINTER(current_function_decl), 
DECL_NAME_POINTER(sancov_fndecl)))
+   return 0;
+
+   FOR_EACH_BB_FN(bb, cfun) {
+   const_gimple stmt;
+   gcall *gcall;
+   gimple_stmt_iterator gsi = gsi_after_labels(bb);
+
+   if (gsi_end_p(gsi))
+   continue;
+
+   stmt = gsi_stmt(gsi);
+   gcall = as_a_gcall(gimple_build_call(sancov_fndecl, 0));
+   gimple_set_location(gcall, gimple_location(stmt));
+   gsi_insert_before(, gcall, GSI_SAME_STMT);
+   }
+   return 0;
+}
+
+#define PASS_NAME sancov
+
+#define NO_GATE
+#define TODO_FLAGS_FINISH TODO_dump_func | TODO_verify_stmts | 
TODO_update_ssa_no_phi | TODO_verify_flow
+
+#include "gcc-generate-gimple-pass.h"
+
+static void sancov_start_unit(void __unused *gcc_data, void __unused 
*user_data)
+{
+   tree leaf_attr, nothrow_attr;
+   tree BT_FN_VOID = build_function_type_list(void_type_node, NULL_TREE);
+
+