2017-08-22 07:25:50 +08:00
|
|
|
//===- FuzzerTracePC.h - Internal header for the Fuzzer ---------*- C++ -* ===//
|
|
|
|
//
|
2019-01-19 16:50:56 +08:00
|
|
|
// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
|
|
|
|
// See https://llvm.org/LICENSE.txt for license information.
|
|
|
|
// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
|
2017-08-22 07:25:50 +08:00
|
|
|
//
|
|
|
|
//===----------------------------------------------------------------------===//
|
|
|
|
// fuzzer::TracePC
|
|
|
|
//===----------------------------------------------------------------------===//
|
|
|
|
|
|
|
|
#ifndef LLVM_FUZZER_TRACE_PC
|
|
|
|
#define LLVM_FUZZER_TRACE_PC
|
|
|
|
|
|
|
|
#include "FuzzerDefs.h"
|
|
|
|
#include "FuzzerDictionary.h"
|
|
|
|
#include "FuzzerValueBitMap.h"
|
|
|
|
|
|
|
|
#include <set>
|
2018-07-20 06:00:48 +08:00
|
|
|
#include <unordered_map>
|
2017-08-22 07:25:50 +08:00
|
|
|
|
|
|
|
namespace fuzzer {
|
|
|
|
|
|
|
|
// TableOfRecentCompares (TORC) remembers the most recently performed
|
|
|
|
// comparisons of type T.
|
|
|
|
// We record the arguments of CMP instructions in this table unconditionally
|
|
|
|
// because it seems cheaper this way than to compute some expensive
|
|
|
|
// conditions inside __sanitizer_cov_trace_cmp*.
|
|
|
|
// After the unit has been executed we may decide to use the contents of
|
|
|
|
// this table to populate a Dictionary.
|
|
|
|
template<class T, size_t kSizeT>
|
|
|
|
struct TableOfRecentCompares {
|
|
|
|
static const size_t kSize = kSizeT;
|
|
|
|
struct Pair {
|
|
|
|
T A, B;
|
|
|
|
};
|
|
|
|
ATTRIBUTE_NO_SANITIZE_ALL
|
|
|
|
void Insert(size_t Idx, const T &Arg1, const T &Arg2) {
|
|
|
|
Idx = Idx % kSize;
|
|
|
|
Table[Idx].A = Arg1;
|
|
|
|
Table[Idx].B = Arg2;
|
|
|
|
}
|
|
|
|
|
|
|
|
Pair Get(size_t I) { return Table[I % kSize]; }
|
|
|
|
|
|
|
|
Pair Table[kSize];
|
|
|
|
};
|
|
|
|
|
|
|
|
template <size_t kSizeT>
|
|
|
|
struct MemMemTable {
|
|
|
|
static const size_t kSize = kSizeT;
|
|
|
|
Word MemMemWords[kSize];
|
|
|
|
Word EmptyWord;
|
|
|
|
|
|
|
|
void Add(const uint8_t *Data, size_t Size) {
|
|
|
|
if (Size <= 2) return;
|
|
|
|
Size = std::min(Size, Word::GetMaxSize());
|
|
|
|
size_t Idx = SimpleFastHash(Data, Size) % kSize;
|
|
|
|
MemMemWords[Idx].Set(Data, Size);
|
|
|
|
}
|
|
|
|
const Word &Get(size_t Idx) {
|
|
|
|
for (size_t i = 0; i < kSize; i++) {
|
|
|
|
const Word &W = MemMemWords[(Idx + i) % kSize];
|
|
|
|
if (W.size()) return W;
|
|
|
|
}
|
|
|
|
EmptyWord.Set(nullptr, 0);
|
|
|
|
return EmptyWord;
|
|
|
|
}
|
|
|
|
};
|
|
|
|
|
|
|
|
class TracePC {
|
2018-07-16 23:15:34 +08:00
|
|
|
public:
|
2017-08-22 07:25:50 +08:00
|
|
|
void HandleInline8bitCountersInit(uint8_t *Start, uint8_t *Stop);
|
2017-08-26 03:29:47 +08:00
|
|
|
void HandlePCsInit(const uintptr_t *Start, const uintptr_t *Stop);
|
2017-08-22 07:25:50 +08:00
|
|
|
void HandleCallerCallee(uintptr_t Caller, uintptr_t Callee);
|
|
|
|
template <class T> void HandleCmp(uintptr_t PC, T Arg1, T Arg2);
|
|
|
|
size_t GetTotalPCCoverage();
|
|
|
|
void SetUseCounters(bool UC) { UseCounters = UC; }
|
2018-07-04 06:33:09 +08:00
|
|
|
void SetUseValueProfileMask(uint32_t VPMask) { UseValueProfileMask = VPMask; }
|
2017-08-22 07:25:50 +08:00
|
|
|
void SetPrintNewPCs(bool P) { DoPrintNewPCs = P; }
|
2017-08-29 06:52:22 +08:00
|
|
|
void SetPrintNewFuncs(size_t P) { NumPrintNewFuncs = P; }
|
2017-08-22 07:25:50 +08:00
|
|
|
void UpdateObservedPCs();
|
|
|
|
template <class Callback> void CollectFeatures(Callback CB) const;
|
|
|
|
|
|
|
|
void ResetMaps() {
|
|
|
|
ValueProfileMap.Reset();
|
|
|
|
ClearExtraCounters();
|
|
|
|
ClearInlineCounters();
|
|
|
|
}
|
|
|
|
|
|
|
|
void ClearInlineCounters();
|
|
|
|
|
|
|
|
void UpdateFeatureSet(size_t CurrentElementIdx, size_t CurrentElementSize);
|
|
|
|
void PrintFeatureSet();
|
|
|
|
|
|
|
|
void PrintModuleInfo();
|
|
|
|
|
|
|
|
void PrintCoverage();
|
|
|
|
|
2018-05-11 09:17:52 +08:00
|
|
|
template<class CallBack>
|
|
|
|
void IterateCoveredFunctions(CallBack CB);
|
|
|
|
|
2017-08-22 07:25:50 +08:00
|
|
|
void AddValueForMemcmp(void *caller_pc, const void *s1, const void *s2,
|
|
|
|
size_t n, bool StopAtZero);
|
|
|
|
|
|
|
|
TableOfRecentCompares<uint32_t, 32> TORC4;
|
|
|
|
TableOfRecentCompares<uint64_t, 32> TORC8;
|
|
|
|
TableOfRecentCompares<Word, 32> TORCW;
|
|
|
|
MemMemTable<1024> MMT;
|
|
|
|
|
2017-08-22 09:28:32 +08:00
|
|
|
void RecordInitialStack();
|
|
|
|
uintptr_t GetMaxStackOffset() const;
|
2017-08-22 07:25:50 +08:00
|
|
|
|
|
|
|
template<class CallBack>
|
|
|
|
void ForEachObservedPC(CallBack CB) {
|
|
|
|
for (auto PC : ObservedPCs)
|
|
|
|
CB(PC);
|
|
|
|
}
|
|
|
|
|
2018-05-17 07:26:37 +08:00
|
|
|
void SetFocusFunction(const std::string &FuncName);
|
|
|
|
bool ObservedFocusFunction();
|
|
|
|
|
2019-01-31 08:09:43 +08:00
|
|
|
void ProtectLazyCounters();
|
|
|
|
bool UnprotectLazyCounters(void *CounterPtr);
|
|
|
|
|
2017-08-22 07:25:50 +08:00
|
|
|
private:
|
|
|
|
bool UseCounters = false;
|
2018-07-04 06:33:09 +08:00
|
|
|
uint32_t UseValueProfileMask = false;
|
2017-08-22 07:25:50 +08:00
|
|
|
bool DoPrintNewPCs = false;
|
2017-08-29 06:52:22 +08:00
|
|
|
size_t NumPrintNewFuncs = 0;
|
2017-08-22 07:25:50 +08:00
|
|
|
|
2019-01-30 14:15:52 +08:00
|
|
|
// Module represents the array of 8-bit counters split into regions
|
|
|
|
// such that every region, except maybe the first and the last one, is one
|
|
|
|
// full page.
|
|
|
|
struct Module {
|
|
|
|
struct Region {
|
|
|
|
uint8_t *Start, *Stop;
|
|
|
|
bool Enabled;
|
|
|
|
bool OneFullPage;
|
|
|
|
};
|
|
|
|
Region *Regions;
|
|
|
|
size_t NumRegions;
|
|
|
|
uint8_t *Start() { return Regions[0].Start; }
|
|
|
|
uint8_t *Stop() { return Regions[NumRegions - 1].Stop; }
|
|
|
|
size_t Size() { return Stop() - Start(); }
|
|
|
|
size_t Idx(uint8_t *P) {
|
|
|
|
assert(P >= Start() && P < Stop());
|
|
|
|
return P - Start();
|
|
|
|
}
|
|
|
|
};
|
|
|
|
|
|
|
|
Module Modules[4096];
|
|
|
|
size_t NumModules; // linker-initialized.
|
2017-08-22 07:25:50 +08:00
|
|
|
size_t NumInline8bitCounters;
|
|
|
|
|
2019-01-30 14:15:52 +08:00
|
|
|
template <class Callback>
|
|
|
|
void IterateCounterRegions(Callback CB) {
|
|
|
|
for (size_t m = 0; m < NumModules; m++)
|
|
|
|
for (size_t r = 0; r < Modules[m].NumRegions; r++)
|
|
|
|
CB(Modules[m].Regions[r]);
|
|
|
|
}
|
|
|
|
|
|
|
|
|
2017-08-26 03:29:47 +08:00
|
|
|
struct PCTableEntry {
|
|
|
|
uintptr_t PC, PCFlags;
|
|
|
|
};
|
|
|
|
|
|
|
|
struct { const PCTableEntry *Start, *Stop; } ModulePCTable[4096];
|
2017-08-22 07:25:50 +08:00
|
|
|
size_t NumPCTables;
|
|
|
|
size_t NumPCsInPCTables;
|
|
|
|
|
2017-08-28 07:20:09 +08:00
|
|
|
Set<uintptr_t> ObservedPCs;
|
2018-07-20 06:00:48 +08:00
|
|
|
std::unordered_map<uintptr_t, uintptr_t> ObservedFuncs; // PC => Counter.
|
2017-08-22 07:25:50 +08:00
|
|
|
|
2019-01-30 14:15:52 +08:00
|
|
|
uint8_t *FocusFunctionCounterPtr = nullptr;
|
2018-05-17 07:26:37 +08:00
|
|
|
|
2017-08-22 07:25:50 +08:00
|
|
|
ValueBitMap ValueProfileMap;
|
2017-08-22 09:28:32 +08:00
|
|
|
uintptr_t InitialStack;
|
2017-08-22 07:25:50 +08:00
|
|
|
};
|
|
|
|
|
|
|
|
template <class Callback>
|
|
|
|
// void Callback(size_t FirstFeature, size_t Idx, uint8_t Value);
|
|
|
|
ATTRIBUTE_NO_SANITIZE_ALL
|
2019-01-30 14:15:52 +08:00
|
|
|
size_t ForEachNonZeroByte(const uint8_t *Begin, const uint8_t *End,
|
2017-08-22 07:25:50 +08:00
|
|
|
size_t FirstFeature, Callback Handle8bitCounter) {
|
|
|
|
typedef uintptr_t LargeType;
|
|
|
|
const size_t Step = sizeof(LargeType) / sizeof(uint8_t);
|
|
|
|
const size_t StepMask = Step - 1;
|
|
|
|
auto P = Begin;
|
|
|
|
// Iterate by 1 byte until either the alignment boundary or the end.
|
|
|
|
for (; reinterpret_cast<uintptr_t>(P) & StepMask && P < End; P++)
|
|
|
|
if (uint8_t V = *P)
|
|
|
|
Handle8bitCounter(FirstFeature, P - Begin, V);
|
|
|
|
|
|
|
|
// Iterate by Step bytes at a time.
|
|
|
|
for (; P < End; P += Step)
|
|
|
|
if (LargeType Bundle = *reinterpret_cast<const LargeType *>(P))
|
|
|
|
for (size_t I = 0; I < Step; I++, Bundle >>= 8)
|
|
|
|
if (uint8_t V = Bundle & 0xff)
|
|
|
|
Handle8bitCounter(FirstFeature, P - Begin + I, V);
|
|
|
|
|
|
|
|
// Iterate by 1 byte until the end.
|
|
|
|
for (; P < End; P++)
|
|
|
|
if (uint8_t V = *P)
|
|
|
|
Handle8bitCounter(FirstFeature, P - Begin, V);
|
2019-01-30 14:15:52 +08:00
|
|
|
return End - Begin;
|
2017-08-22 07:25:50 +08:00
|
|
|
}
|
|
|
|
|
2017-11-29 01:41:58 +08:00
|
|
|
// Given a non-zero Counter returns a number in the range [0,7].
|
2017-08-22 09:28:32 +08:00
|
|
|
template<class T>
|
|
|
|
unsigned CounterToFeature(T Counter) {
|
2018-07-16 23:15:34 +08:00
|
|
|
// Returns a feature number by placing Counters into buckets as illustrated
|
|
|
|
// below.
|
|
|
|
//
|
|
|
|
// Counter bucket: [1] [2] [3] [4-7] [8-15] [16-31] [32-127] [128+]
|
|
|
|
// Feature number: 0 1 2 3 4 5 6 7
|
|
|
|
//
|
|
|
|
// This is a heuristic taken from AFL (see
|
|
|
|
// http://lcamtuf.coredump.cx/afl/technical_details.txt).
|
|
|
|
//
|
|
|
|
// This implementation may change in the future so clients should
|
|
|
|
// not rely on it.
|
|
|
|
assert(Counter);
|
|
|
|
unsigned Bit = 0;
|
|
|
|
/**/ if (Counter >= 128) Bit = 7;
|
|
|
|
else if (Counter >= 32) Bit = 6;
|
|
|
|
else if (Counter >= 16) Bit = 5;
|
|
|
|
else if (Counter >= 8) Bit = 4;
|
|
|
|
else if (Counter >= 4) Bit = 3;
|
|
|
|
else if (Counter >= 3) Bit = 2;
|
|
|
|
else if (Counter >= 2) Bit = 1;
|
|
|
|
return Bit;
|
2017-08-22 09:28:32 +08:00
|
|
|
}
|
|
|
|
|
2017-09-16 06:10:36 +08:00
|
|
|
template <class Callback> // void Callback(size_t Feature)
|
2017-08-22 09:28:32 +08:00
|
|
|
ATTRIBUTE_NO_SANITIZE_ADDRESS
|
2019-01-18 00:36:05 +08:00
|
|
|
ATTRIBUTE_NOINLINE
|
2017-08-22 09:28:32 +08:00
|
|
|
void TracePC::CollectFeatures(Callback HandleFeature) const {
|
|
|
|
auto Handle8bitCounter = [&](size_t FirstFeature,
|
|
|
|
size_t Idx, uint8_t Counter) {
|
2017-12-09 06:21:42 +08:00
|
|
|
if (UseCounters)
|
|
|
|
HandleFeature(FirstFeature + Idx * 8 + CounterToFeature(Counter));
|
|
|
|
else
|
|
|
|
HandleFeature(FirstFeature + Idx);
|
2017-08-22 07:25:50 +08:00
|
|
|
};
|
|
|
|
|
|
|
|
size_t FirstFeature = 0;
|
|
|
|
|
2019-01-30 14:15:52 +08:00
|
|
|
for (size_t i = 0; i < NumModules; i++) {
|
|
|
|
for (size_t r = 0; r < Modules[i].NumRegions; r++) {
|
|
|
|
if (!Modules[i].Regions[r].Enabled) continue;
|
|
|
|
FirstFeature += 8 * ForEachNonZeroByte(Modules[i].Regions[r].Start,
|
|
|
|
Modules[i].Regions[r].Stop,
|
|
|
|
FirstFeature, Handle8bitCounter);
|
2017-08-22 07:25:50 +08:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2019-01-30 14:15:52 +08:00
|
|
|
FirstFeature +=
|
|
|
|
8 * ForEachNonZeroByte(ExtraCountersBegin(), ExtraCountersEnd(),
|
|
|
|
FirstFeature, Handle8bitCounter);
|
2017-08-22 07:25:50 +08:00
|
|
|
|
2018-07-04 06:33:09 +08:00
|
|
|
if (UseValueProfileMask) {
|
2017-08-22 07:25:50 +08:00
|
|
|
ValueProfileMap.ForEach([&](size_t Idx) {
|
|
|
|
HandleFeature(FirstFeature + Idx);
|
|
|
|
});
|
|
|
|
FirstFeature += ValueProfileMap.SizeInBits();
|
|
|
|
}
|
|
|
|
|
2017-12-10 03:18:10 +08:00
|
|
|
// Step function, grows similar to 8 * Log_2(A).
|
|
|
|
auto StackDepthStepFunction = [](uint32_t A) -> uint32_t {
|
[libfuzzer] Fix UB when calculating Log(0) in StackDepthStepFunction().
Summary:
__builtin_clz used for Log calculation returns an undefined result
when argument is 0. I noticed that issue when was testing some fuzzers:
```
/src/libfuzzer/FuzzerTracePC.h:282:33: runtime error: shift exponent 450349 is too large for 32-bit type 'uint32_t' (aka 'unsigned int')
#0 0x43d83f in operator() /src/libfuzzer/FuzzerTracePC.h:283:33
#1 0x43d83f in void fuzzer::TracePC::CollectFeatures<fuzzer::Fuzzer::RunOne(unsigned char const*, unsigned long, bool, fuzzer::InputInfo*, bool*)::$_1>(fuzzer::Fuzzer::RunOne(unsigned char const*, unsigned long, bool, fuzzer::InputInfo*, bool*)::$_1) const /src/libfuzzer/FuzzerTracePC.h:290
#2 0x43cbd4 in fuzzer::Fuzzer::RunOne(unsigned char const*, unsigned long, bool, fuzzer::InputInfo*, bool*) /src/libfuzzer/FuzzerLoop.cpp:445:7
#3 0x43e5f1 in fuzzer::Fuzzer::ReadAndExecuteSeedCorpora(std::__1::vector<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> >, fuzzer::fuzzer_allocator<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > > > const&) /src/libfuzzer/FuzzerLoop.cpp:706:5
#4 0x43e9e1 in fuzzer::Fuzzer::Loop(std::__1::vector<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> >, fuzzer::fuzzer_allocator<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > > > const&) /src/libfuzzer/FuzzerLoop.cpp:739:3
#5 0x432f8c in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/libfuzzer/FuzzerDriver.cpp:754:6
#6 0x42ee18 in main /src/libfuzzer/FuzzerMain.cpp:20:10
#7 0x7f17ffeb182f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)
#8 0x407838 in _start (/out/rotate_fuzzer+0x407838)
Reviewers: kcc
Reviewed By: kcc
Subscribers: llvm-commits, #sanitizers
Differential Revision: https://reviews.llvm.org/D41457
llvm-svn: 321211
2017-12-21 03:31:51 +08:00
|
|
|
if (!A) return A;
|
2017-12-13 07:11:28 +08:00
|
|
|
uint32_t Log2 = Log(A);
|
2017-12-10 03:18:10 +08:00
|
|
|
if (Log2 < 3) return A;
|
|
|
|
Log2 -= 3;
|
|
|
|
return (Log2 + 1) * 8 + ((A >> Log2) & 7);
|
|
|
|
};
|
|
|
|
assert(StackDepthStepFunction(1024) == 64);
|
|
|
|
assert(StackDepthStepFunction(1024 * 4) == 80);
|
|
|
|
assert(StackDepthStepFunction(1024 * 1024) == 144);
|
|
|
|
|
2017-08-22 07:25:50 +08:00
|
|
|
if (auto MaxStackOffset = GetMaxStackOffset())
|
2017-12-10 03:18:10 +08:00
|
|
|
HandleFeature(FirstFeature + StackDepthStepFunction(MaxStackOffset / 8));
|
2017-08-22 07:25:50 +08:00
|
|
|
}
|
|
|
|
|
|
|
|
extern TracePC TPC;
|
|
|
|
|
|
|
|
} // namespace fuzzer
|
|
|
|
|
|
|
|
#endif // LLVM_FUZZER_TRACE_PC
|