diff options
-rw-r--r-- | lib/Transforms/Instrumentation/AddressSanitizer.cpp | 79 | ||||
-rw-r--r-- | test/Instrumentation/AddressSanitizer/coverage.ll | 35 |
2 files changed, 74 insertions, 40 deletions
diff --git a/lib/Transforms/Instrumentation/AddressSanitizer.cpp b/lib/Transforms/Instrumentation/AddressSanitizer.cpp index c03075c9ea..fe875192f5 100644 --- a/lib/Transforms/Instrumentation/AddressSanitizer.cpp +++ b/lib/Transforms/Instrumentation/AddressSanitizer.cpp @@ -33,6 +33,7 @@ #include "llvm/IR/InlineAsm.h" #include "llvm/IR/IntrinsicInst.h" #include "llvm/IR/LLVMContext.h" +#include "llvm/IR/MDBuilder.h" #include "llvm/IR/Module.h" #include "llvm/IR/Type.h" #include "llvm/InstVisitor.h" @@ -130,8 +131,9 @@ static cl::opt<bool> ClUseAfterReturn("asan-use-after-return", // This flag may need to be replaced with -f[no]asan-globals. static cl::opt<bool> ClGlobals("asan-globals", cl::desc("Handle global objects"), cl::Hidden, cl::init(true)); -static cl::opt<bool> ClCoverage("asan-coverage", - cl::desc("ASan coverage"), cl::Hidden, cl::init(false)); +static cl::opt<int> ClCoverage("asan-coverage", + cl::desc("ASan coverage. 0: none, 1: entry block, 2: all blocks"), + cl::Hidden, cl::init(false)); static cl::opt<bool> ClInitializers("asan-initialization-order", cl::desc("Handle C++ initializer order"), cl::Hidden, cl::init(false)); static cl::opt<bool> ClMemIntrin("asan-memintrin", @@ -320,7 +322,8 @@ struct AddressSanitizer : public FunctionPass { bool LooksLikeCodeInBug11395(Instruction *I); void FindDynamicInitializers(Module &M); bool GlobalIsLinkerInitialized(GlobalVariable *G); - bool InjectCoverage(Function &F); + bool InjectCoverage(Function &F, const ArrayRef<BasicBlock*> AllBlocks); + void InjectCoverageAtBlock(Function &F, BasicBlock &BB); bool CheckInitOrder; bool CheckUseAfterReturn; @@ -1076,7 +1079,7 @@ void AddressSanitizer::initializeCallbacks(Module &M) { AsanHandleNoReturnFunc = checkInterfaceFunction(M.getOrInsertFunction( kAsanHandleNoReturnName, IRB.getVoidTy(), NULL)); AsanCovFunction = checkInterfaceFunction(M.getOrInsertFunction( - kAsanCovName, IRB.getVoidTy(), IntptrTy, NULL)); + kAsanCovName, IRB.getVoidTy(), NULL)); // We insert an empty inline asm after __asan_report* to avoid callback merge. EmptyAsm = InlineAsm::get(FunctionType::get(IRB.getVoidTy(), false), StringRef(""), StringRef(""), @@ -1148,33 +1151,11 @@ bool AddressSanitizer::maybeInsertAsanInitAtFunctionEntry(Function &F) { return false; } -// Poor man's coverage that works with ASan. -// We create a Guard boolean variable with the same linkage -// as the function and inject this code into the entry block: -// if (*Guard) { -// __sanitizer_cov(&F); -// *Guard = 1; -// } -// The accesses to Guard are atomic. The rest of the logic is -// in __sanitizer_cov (it's fine to call it more than once). -// -// This coverage implementation provides very limited data: -// it only tells if a given function was ever executed. -// No counters, no per-basic-block or per-edge data. -// But for many use cases this is what we need and the added slowdown -// is negligible. This simple implementation will probably be obsoleted -// by the upcoming Clang-based coverage implementation. -// By having it here and now we hope to -// a) get the functionality to users earlier and -// b) collect usage statistics to help improve Clang coverage design. -bool AddressSanitizer::InjectCoverage(Function &F) { - if (!ClCoverage) return false; - +void AddressSanitizer::InjectCoverageAtBlock(Function &F, BasicBlock &BB) { + BasicBlock::iterator IP = BB.getFirstInsertionPt(), BE = BB.end(); // Skip static allocas at the top of the entry block so they don't become // dynamic when we split the block. If we used our optimized stack layout, // then there will only be one alloca and it will come first. - BasicBlock &Entry = F.getEntryBlock(); - BasicBlock::iterator IP = Entry.getFirstInsertionPt(), BE = Entry.end(); for (; IP != BE; ++IP) { AllocaInst *AI = dyn_cast<AllocaInst>(IP); if (!AI || !AI->isStaticAlloca()) @@ -1190,14 +1171,48 @@ bool AddressSanitizer::InjectCoverage(Function &F) { Load->setAtomic(Monotonic); Load->setAlignment(1); Value *Cmp = IRB.CreateICmpEQ(Constant::getNullValue(Int8Ty), Load); - Instruction *Ins = SplitBlockAndInsertIfThen(Cmp, IP, false); + Instruction *Ins = SplitBlockAndInsertIfThen( + Cmp, IP, false, MDBuilder(*C).createBranchWeights(1, 100000)); IRB.SetInsertPoint(Ins); // We pass &F to __sanitizer_cov. We could avoid this and rely on // GET_CALLER_PC, but having the PC of the first instruction is just nice. - IRB.CreateCall(AsanCovFunction, IRB.CreatePointerCast(&F, IntptrTy)); + Instruction *Call = IRB.CreateCall(AsanCovFunction); + Call->setDebugLoc(IP->getDebugLoc()); StoreInst *Store = IRB.CreateStore(ConstantInt::get(Int8Ty, 1), Guard); Store->setAtomic(Monotonic); Store->setAlignment(1); +} + +// Poor man's coverage that works with ASan. +// We create a Guard boolean variable with the same linkage +// as the function and inject this code into the entry block (-asan-coverage=1) +// or all blocks (-asan-coverage=2): +// if (*Guard) { +// __sanitizer_cov(&F); +// *Guard = 1; +// } +// The accesses to Guard are atomic. The rest of the logic is +// in __sanitizer_cov (it's fine to call it more than once). +// +// This coverage implementation provides very limited data: +// it only tells if a given function (block) was ever executed. +// No counters, no per-edge data. +// But for many use cases this is what we need and the added slowdown +// is negligible. This simple implementation will probably be obsoleted +// by the upcoming Clang-based coverage implementation. +// By having it here and now we hope to +// a) get the functionality to users earlier and +// b) collect usage statistics to help improve Clang coverage design. +bool AddressSanitizer::InjectCoverage(Function &F, + const ArrayRef<BasicBlock *> AllBlocks) { + if (!ClCoverage) return false; + + if (ClCoverage == 1) { + InjectCoverageAtBlock(F, F.getEntryBlock()); + } else { + for (size_t i = 0, n = AllBlocks.size(); i < n; i++) + InjectCoverageAtBlock(F, *AllBlocks[i]); + } return true; } @@ -1222,12 +1237,14 @@ bool AddressSanitizer::runOnFunction(Function &F) { SmallSet<Value*, 16> TempsToInstrument; SmallVector<Instruction*, 16> ToInstrument; SmallVector<Instruction*, 8> NoReturnCalls; + SmallVector<BasicBlock*, 16> AllBlocks; int NumAllocas = 0; bool IsWrite; // Fill the set of memory operations to instrument. for (Function::iterator FI = F.begin(), FE = F.end(); FI != FE; ++FI) { + AllBlocks.push_back(FI); TempsToInstrument.clear(); int NumInsnsPerBB = 0; for (BasicBlock::iterator BI = FI->begin(), BE = FI->end(); @@ -1297,7 +1314,7 @@ bool AddressSanitizer::runOnFunction(Function &F) { bool res = NumInstrumented > 0 || ChangedStack || !NoReturnCalls.empty(); - if (InjectCoverage(F)) + if (InjectCoverage(F, AllBlocks)) res = true; DEBUG(dbgs() << "ASAN done instrumenting: " << res << " " << F << "\n"); diff --git a/test/Instrumentation/AddressSanitizer/coverage.ll b/test/Instrumentation/AddressSanitizer/coverage.ll index 47a54c0ef8..6697f4b0f2 100644 --- a/test/Instrumentation/AddressSanitizer/coverage.ll +++ b/test/Instrumentation/AddressSanitizer/coverage.ll @@ -1,13 +1,30 @@ -; RUN: opt < %s -asan -asan-coverage=1 -S | FileCheck %s +; RUN: opt < %s -asan -asan-coverage=1 -S | FileCheck %s --check-prefix=CHECK1 +; RUN: opt < %s -asan -asan-coverage=2 -S | FileCheck %s --check-prefix=CHECK2 target datalayout = "e-p:64:64:64-i1:8:8-i8:8:8-i16:16:16-i32:32:32-i64:64:64-f32:32:32-f64:64:64-v64:64:64-v128:128:128-a0:0:64-s0:64:64-f80:128:128-n8:16:32:64" target triple = "x86_64-unknown-linux-gnu" -define i32 @foo(i32* %a) sanitize_address { +define void @foo(i32* %a) sanitize_address { entry: - ret i32 0 + %tobool = icmp eq i32* %a, null + br i1 %tobool, label %if.end, label %if.then + + if.then: ; preds = %entry + store i32 0, i32* %a, align 4 + br label %if.end + + if.end: ; preds = %entry, %if.then + ret void } -; CHECK: define i32 @foo(i32* %a) #0 { -; CHECK: %0 = load atomic i8* @__asan_gen_cov_foo monotonic, align 1 -; CHECK: %1 = icmp eq i8 0, %0 -; CHECK: br i1 %1, label %2, label %3 -; CHECK: call void @__sanitizer_cov(i64 ptrtoint (i32 (i32*)* @foo to i64)) -; CHECK: store atomic i8 1, i8* @__asan_gen_cov_foo monotonic, align 1 +; CHECK1-LABEL: define void @foo +; CHECK1: %0 = load atomic i8* @__asan_gen_cov_foo monotonic, align 1 +; CHECK1: %1 = icmp eq i8 0, %0 +; CHECK1: br i1 %1, label %2, label %3 +; CHECK1: call void @__sanitizer_cov +; CHECK1-NOT: call void @__sanitizer_cov +; CHECK1: store atomic i8 1, i8* @__asan_gen_cov_foo monotonic, align 1 + +; CHECK2-LABEL: define void @foo +; CHECK2: call void @__sanitizer_cov +; CHECK2: call void @__sanitizer_cov +; CHECK2: call void @__sanitizer_cov +; CHECK2-NOT: call void @__sanitizer_cov +; CHECK2: ret void |