gcc/sancov.c

   1 /* Code coverage instrumentation for fuzzing.
   2    Copyright (C) 2015-2019 Free Software Foundation, Inc.
   3    Contributed by Dmitry Vyukov <dvyukov@google.com> and
   4    Wish Wu <wishwu007@gmail.com>
   5
   6 This file is part of GCC.
   7
   8 GCC is free software; you can redistribute it and/or modify it under
   9 the terms of the GNU General Public License as published by the Free
  10 Software Foundation; either version 3, or (at your option) any later
  11 version.
  12
  13 GCC is distributed in the hope that it will be useful, but WITHOUT ANY
  14 WARRANTY; without even the implied warranty of MERCHANTABILITY or
  15 FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
  16 for more details.
  17
  18 You should have received a copy of the GNU General Public License
  19 along with GCC; see the file COPYING3.  If not see
  20 <http://www.gnu.org/licenses/>.  */
  21
  22 #include "config.h"
  23 #include "system.h"
  24 #include "coretypes.h"
  25 #include "backend.h"
  26 #include "tree.h"
  27 #include "gimple.h"
  28 #include "basic-block.h"
  29 #include "options.h"
  30 #include "flags.h"
  31 #include "memmodel.h"
  32 #include "tm_p.h"
  33 #include "stmt.h"
  34 #include "gimple-iterator.h"
  35 #include "gimple-builder.h"
  36 #include "tree-cfg.h"
  37 #include "tree-pass.h"
  38 #include "tree-iterator.h"
  39 #include "fold-const.h"
  40 #include "stringpool.h"
  41 #include "attribs.h"
  42 #include "output.h"
  43 #include "cgraph.h"
  44 #include "asan.h"
  45
  46 namespace {
  47
  48 /* Instrument one comparison operation, which compares lhs and rhs.
  49    Call the instrumentation function with the comparison operand.
  50    For integral comparisons if exactly one of the comparison operands is
  51    constant, call __sanitizer_cov_trace_const_cmp* instead of
  52    __sanitizer_cov_trace_cmp*.  */
  53
  54 static void
  55 instrument_comparison (gimple_stmt_iterator *gsi, tree lhs, tree rhs)
  56 {
  57   tree type = TREE_TYPE (lhs);
  58   enum built_in_function fncode = END_BUILTINS;
  59   tree to_type = NULL_TREE;
  60   bool c = false;
  61
  62   if (INTEGRAL_TYPE_P (type))
  63     {
  64       c = (is_gimple_min_invariant (lhs)
  65            ^ is_gimple_min_invariant (rhs));
  66       switch (int_size_in_bytes (type))
  67         {
  68         case 1:
  69           fncode = c ? BUILT_IN_SANITIZER_COV_TRACE_CONST_CMP1
  70                      : BUILT_IN_SANITIZER_COV_TRACE_CMP1;
  71           to_type = unsigned_char_type_node;
  72           break;
  73         case 2:
  74           fncode = c ? BUILT_IN_SANITIZER_COV_TRACE_CONST_CMP2
  75                      : BUILT_IN_SANITIZER_COV_TRACE_CMP2;
  76           to_type = uint16_type_node;
  77           break;
  78         case 4:
  79           fncode = c ? BUILT_IN_SANITIZER_COV_TRACE_CONST_CMP4
  80                      : BUILT_IN_SANITIZER_COV_TRACE_CMP4;
  81           to_type = uint32_type_node;
  82           break;
  83         default:
  84           fncode = c ? BUILT_IN_SANITIZER_COV_TRACE_CONST_CMP8
  85                      : BUILT_IN_SANITIZER_COV_TRACE_CMP8;
  86           to_type = uint64_type_node;
  87           break;
  88         }
  89     }
  90   else if (SCALAR_FLOAT_TYPE_P (type))
  91     {
  92       if (TYPE_MODE (type) == TYPE_MODE (float_type_node))
  93         {
  94           fncode = BUILT_IN_SANITIZER_COV_TRACE_CMPF;
  95           to_type = float_type_node;
  96         }
  97       else if (TYPE_MODE (type) == TYPE_MODE (double_type_node))
  98         {
  99           fncode = BUILT_IN_SANITIZER_COV_TRACE_CMPD;
 100           to_type = double_type_node;
 101         }
 102     }
 103
 104   if (to_type != NULL_TREE)
 105     {
 106       gimple_seq seq = NULL;
 107
 108       if (!useless_type_conversion_p (to_type, type))
 109         {
 110           if (TREE_CODE (lhs) == INTEGER_CST)
 111             lhs = fold_convert (to_type, lhs);
 112           else
 113             {
 114               gimple_seq_add_stmt (&seq, build_type_cast (to_type, lhs));
 115               lhs = gimple_assign_lhs (gimple_seq_last_stmt (seq));
 116             }
 117
 118           if (TREE_CODE (rhs) == INTEGER_CST)
 119             rhs = fold_convert (to_type, rhs);
 120           else
 121             {
 122               gimple_seq_add_stmt (&seq, build_type_cast (to_type, rhs));
 123               rhs = gimple_assign_lhs (gimple_seq_last_stmt (seq));
 124             }
 125         }
 126
 127       if (c && !is_gimple_min_invariant (lhs))
 128         std::swap (lhs, rhs);
 129
 130       tree fndecl = builtin_decl_implicit (fncode);
 131       gimple *gcall = gimple_build_call (fndecl, 2, lhs, rhs);
 132       gimple_seq_add_stmt (&seq, gcall);
 133
 134       gimple_seq_set_location (seq, gimple_location (gsi_stmt (*gsi)));
 135       gsi_insert_seq_before (gsi, seq, GSI_SAME_STMT);
 136     }
 137 }
 138
 139 /* Instrument switch statement.  Call __sanitizer_cov_trace_switch with
 140    the value of the index and array that contains number of case values,
 141    the bitsize of the index and the case values converted to uint64_t.  */
 142
 143 static void
 144 instrument_switch (gimple_stmt_iterator *gsi, gimple *stmt, function *fun)
 145 {
 146   gswitch *switch_stmt = as_a<gswitch *> (stmt);
 147   tree index = gimple_switch_index (switch_stmt);
 148   HOST_WIDE_INT size_in_bytes = int_size_in_bytes (TREE_TYPE (index));
 149   if (size_in_bytes == -1 || size_in_bytes > 8)
 150     return;
 151
 152   location_t loc = gimple_location (stmt);
 153   unsigned i, n = gimple_switch_num_labels (switch_stmt), num = 0;
 154   for (i = 1; i < n; ++i)
 155     {
 156       tree label = gimple_switch_label (switch_stmt, i);
 157
 158       tree low_case = CASE_LOW (label);
 159       if (low_case != NULL_TREE)
 160         num++;
 161
 162       tree high_case = CASE_HIGH (label);
 163       if (high_case != NULL_TREE)
 164         num++;
 165     }
 166
 167   tree case_array_type
 168    = build_array_type (build_type_variant (uint64_type_node, 1, 0),
 169                        build_index_type (size_int (num + 2 - 1)));
 170
 171   char name[64];
 172   static size_t case_array_count = 0;
 173   ASM_GENERATE_INTERNAL_LABEL (name, "LCASEARRAY", case_array_count++);
 174   tree case_array_var = build_decl (loc, VAR_DECL, get_identifier (name),
 175                                     case_array_type);
 176   TREE_STATIC (case_array_var) = 1;
 177   TREE_PUBLIC (case_array_var) = 0;
 178   TREE_CONSTANT (case_array_var) = 1;
 179   TREE_READONLY (case_array_var) = 1;
 180   DECL_EXTERNAL (case_array_var) = 0;
 181   DECL_ARTIFICIAL (case_array_var) = 1;
 182   DECL_IGNORED_P (case_array_var) = 1;
 183
 184   vec <constructor_elt, va_gc> *v = NULL;
 185   vec_alloc (v, num + 2);
 186   CONSTRUCTOR_APPEND_ELT (v, NULL_TREE,
 187                           build_int_cst (uint64_type_node, num));
 188   CONSTRUCTOR_APPEND_ELT (v, NULL_TREE,
 189                           build_int_cst (uint64_type_node,
 190                                          size_in_bytes * BITS_PER_UNIT));
 191   for (i = 1; i < n; ++i)
 192     {
 193       tree label = gimple_switch_label (switch_stmt, i);
 194
 195       tree low_case = CASE_LOW (label);
 196       if (low_case != NULL_TREE)
 197         CONSTRUCTOR_APPEND_ELT (v, NULL_TREE,
 198                                 fold_convert (uint64_type_node, low_case));
 199
 200       tree high_case = CASE_HIGH (label);
 201       if (high_case != NULL_TREE)
 202         CONSTRUCTOR_APPEND_ELT (v, NULL_TREE,
 203                                 fold_convert (uint64_type_node, high_case));
 204     }
 205   tree ctor = build_constructor (case_array_type, v);
 206   TREE_STATIC (ctor) = 1;
 207   TREE_PUBLIC (ctor) = 0;
 208   TREE_CONSTANT (ctor) = 1;
 209   TREE_READONLY (ctor) = 1;
 210   DECL_INITIAL (case_array_var) = ctor;
 211   varpool_node::finalize_decl (case_array_var);
 212   add_local_decl (fun, case_array_var);
 213
 214   gimple_seq seq = NULL;
 215
 216   if (!useless_type_conversion_p (uint64_type_node, TREE_TYPE (index)))
 217     {
 218       if (TREE_CODE (index) == INTEGER_CST)
 219         index = fold_convert (uint64_type_node, index);
 220       else
 221         {
 222           gimple_seq_add_stmt (&seq, build_type_cast (uint64_type_node, index));
 223           index = gimple_assign_lhs (gimple_seq_last_stmt (seq));
 224         }
 225     }
 226
 227   tree fndecl = builtin_decl_implicit (BUILT_IN_SANITIZER_COV_TRACE_SWITCH);
 228   gimple *gcall = gimple_build_call (fndecl, 2, index,
 229                                      build_fold_addr_expr (case_array_var));
 230   gimple_seq_add_stmt (&seq, gcall);
 231
 232   gimple_seq_set_location (seq, loc);
 233   gsi_insert_seq_before (gsi, seq, GSI_SAME_STMT);
 234 }
 235
 236 unsigned
 237 sancov_pass (function *fun)
 238 {
 239   initialize_sanitizer_builtins ();
 240
 241   /* Insert callback into beginning of every BB. */
 242   if (flag_sanitize_coverage & SANITIZE_COV_TRACE_PC)
 243     {
 244       basic_block bb;
 245       tree fndecl = builtin_decl_implicit (BUILT_IN_SANITIZER_COV_TRACE_PC);
 246       FOR_EACH_BB_FN (bb, fun)
 247         {
 248           gimple_stmt_iterator gsi = gsi_start_nondebug_after_labels_bb (bb);
 249           if (gsi_end_p (gsi))
 250             continue;
 251           gimple *stmt = gsi_stmt (gsi);
 252           gimple *gcall = gimple_build_call (fndecl, 0);
 253           gimple_set_location (gcall, gimple_location (stmt));
 254           gsi_insert_before (&gsi, gcall, GSI_SAME_STMT);
 255         }
 256     }
 257
 258   /* Insert callback into every comparison related operation.  */
 259   if (flag_sanitize_coverage & SANITIZE_COV_TRACE_CMP)
 260     {
 261       basic_block bb;
 262       FOR_EACH_BB_FN (bb, fun)
 263         {
 264           gimple_stmt_iterator gsi;
 265           for (gsi = gsi_start_bb (bb); !gsi_end_p (gsi); gsi_next (&gsi))
 266             {
 267               gimple *stmt = gsi_stmt (gsi);
 268               enum tree_code rhs_code;
 269               switch (gimple_code (stmt))
 270                 {
 271                 case GIMPLE_ASSIGN:
 272                   rhs_code = gimple_assign_rhs_code (stmt);
 273                   if (TREE_CODE_CLASS (rhs_code) == tcc_comparison)
 274                     instrument_comparison (&gsi,
 275                                            gimple_assign_rhs1 (stmt),
 276                                            gimple_assign_rhs2 (stmt));
 277                   else if (rhs_code == COND_EXPR
 278                            && COMPARISON_CLASS_P (gimple_assign_rhs1 (stmt)))
 279                     {
 280                       tree cond = gimple_assign_rhs1 (stmt);
 281                       instrument_comparison (&gsi, TREE_OPERAND (cond, 0),
 282                                              TREE_OPERAND (cond, 1));
 283                     }
 284                   break;
 285                 case GIMPLE_COND:
 286                   instrument_comparison (&gsi,
 287                                          gimple_cond_lhs (stmt),
 288                                          gimple_cond_rhs (stmt));
 289                   break;
 290
 291                 case GIMPLE_SWITCH:
 292                   instrument_switch (&gsi, stmt, fun);
 293                   break;
 294
 295                 default:
 296                   break;
 297                 }
 298             }
 299         }
 300     }
 301   return 0;
 302 }
 303
 304 template <bool O0> class pass_sancov : public gimple_opt_pass
 305 {
 306 public:
 307   pass_sancov (gcc::context *ctxt) : gimple_opt_pass (data, ctxt) {}
 308
 309   static const pass_data data;
 310   opt_pass *
 311   clone ()
 312   {
 313     return new pass_sancov<O0> (m_ctxt);
 314   }
 315   virtual bool
 316   gate (function *)
 317   {
 318     return flag_sanitize_coverage && (!O0 || !optimize);
 319   }
 320   virtual unsigned int
 321   execute (function *fun)
 322   {
 323     return sancov_pass (fun);
 324   }
 325 }; // class pass_sancov
 326
 327 template <bool O0>
 328 const pass_data pass_sancov<O0>::data = {
 329   GIMPLE_PASS,                 /* type */
 330   O0 ? "sancov_O0" : "sancov", /* name */
 331   OPTGROUP_NONE,               /* optinfo_flags */
 332   TV_NONE,                     /* tv_id */
 333   (PROP_cfg),                  /* properties_required */
 334   0,                           /* properties_provided */
 335   0,                           /* properties_destroyed */
 336   0,                           /* todo_flags_start */
 337   TODO_update_ssa,           /* todo_flags_finish */
 338 };
 339
 340 } // anon namespace
 341
 342 gimple_opt_pass *
 343 make_pass_sancov (gcc::context *ctxt)
 344 {
 345   return new pass_sancov<false> (ctxt);
 346 }
 347
 348 gimple_opt_pass *
 349 make_pass_sancov_O0 (gcc::context *ctxt)
 350 {
 351   return new pass_sancov<true> (ctxt);
 352 }