[llvm] r279027 - [sanitizer-coverage/libFuzzer] instrument comparisons with __sanitizer_cov_trace_cmp[1248] instead of __sanitizer_cov_trace_cmp, don't pass the comparison type to save a bit performance. Use these new callbacks in libFuzzer
Kostya Serebryany via llvm-commits
llvm-commits at lists.llvm.org
Wed Aug 17 18:25:29 PDT 2016
Author: kcc
Date: Wed Aug 17 20:25:28 2016
New Revision: 279027
URL: http://llvm.org/viewvc/llvm-project?rev=279027&view=rev
Log:
[sanitizer-coverage/libFuzzer] instrument comparisons with __sanitizer_cov_trace_cmp[1248] instead of __sanitizer_cov_trace_cmp, don't pass the comparison type to save a bit performance. Use these new callbacks in libFuzzer
Modified:
llvm/trunk/lib/Fuzzer/FuzzerTraceState.cpp
llvm/trunk/lib/Fuzzer/test/value-profile-cmp.test
llvm/trunk/lib/Transforms/Instrumentation/SanitizerCoverage.cpp
llvm/trunk/test/Instrumentation/SanitizerCoverage/cmp-tracing.ll
Modified: llvm/trunk/lib/Fuzzer/FuzzerTraceState.cpp
URL: http://llvm.org/viewvc/llvm-project/llvm/trunk/lib/Fuzzer/FuzzerTraceState.cpp?rev=279027&r1=279026&r2=279027&view=diff
==============================================================================
--- llvm/trunk/lib/Fuzzer/FuzzerTraceState.cpp (original)
+++ llvm/trunk/lib/Fuzzer/FuzzerTraceState.cpp Wed Aug 17 20:25:28 2016
@@ -575,7 +575,8 @@ static void AddValueForStrcmp(void *call
}
__attribute__((target("popcnt")))
-static void AddValueForCmp(uintptr_t PC, uint64_t Arg1, uint64_t Arg2) {
+static void AddValueForCmp(void *PCptr, uint64_t Arg1, uint64_t Arg2) {
+ uintptr_t PC = reinterpret_cast<uintptr_t>(PCptr);
VP.AddValue((PC & 4095) | (__builtin_popcountl(Arg1 ^ Arg2) << 12));
}
@@ -598,6 +599,21 @@ void __dfsw___sanitizer_cov_trace_cmp(ui
TS->DFSanCmpCallback(PC, CmpSize, Type, Arg1, Arg2, L1, L2);
}
+#define DFSAN_CMP_CALLBACK(N) \
+ void __dfsw___sanitizer_cov_trace_cmp##N(uint64_t Arg1, uint64_t Arg2, \
+ dfsan_label L1, dfsan_label L2) { \
+ if (RecordingTraces) \
+ TS->DFSanCmpCallback( \
+ reinterpret_cast<uintptr_t>(__builtin_return_address(0)), N, \
+ fuzzer::ICMP_EQ, Arg1, Arg2, L1, L2); \
+ }
+
+DFSAN_CMP_CALLBACK(1)
+DFSAN_CMP_CALLBACK(2)
+DFSAN_CMP_CALLBACK(4)
+DFSAN_CMP_CALLBACK(8)
+#undef DFSAN_CMP_CALLBACK
+
void __dfsw___sanitizer_cov_trace_switch(uint64_t Val, uint64_t *Cases,
dfsan_label L1, dfsan_label L2) {
if (!RecordingTraces) return;
@@ -710,6 +726,7 @@ void __sanitizer_weak_hook_memmem(void *
#endif // LLVM_FUZZER_DEFINES_SANITIZER_WEAK_HOOOKS
+// TODO: this one will not be used with the newest clang. Remove it.
__attribute__((visibility("default")))
void __sanitizer_cov_trace_cmp(uint64_t SizeAndType, uint64_t Arg1,
uint64_t Arg2) {
@@ -720,8 +737,36 @@ void __sanitizer_cov_trace_cmp(uint64_t
TS->TraceCmpCallback(PC, CmpSize, Type, Arg1, Arg2);
}
if (RecordingValueProfile)
- fuzzer::AddValueForCmp(
- reinterpret_cast<uintptr_t>(__builtin_return_address(0)), Arg1, Arg2);
+ fuzzer::AddValueForCmp(__builtin_return_address(0), Arg1, Arg2);
+}
+
+// Adding if(RecordingTraces){...} slows down the VP callbacks.
+// Once we prove that VP is as strong as traces, delete this.
+#define MAYBE_RECORD_TRACE(N) \
+ if (RecordingTraces) { \
+ uintptr_t PC = reinterpret_cast<uintptr_t>(__builtin_return_address(0)); \
+ TS->TraceCmpCallback(PC, N, fuzzer::ICMP_EQ, Arg1, Arg2); \
+ }
+
+__attribute__((visibility("default")))
+void __sanitizer_cov_trace_cmp8(uint64_t Arg1, int64_t Arg2) {
+ fuzzer::AddValueForCmp(__builtin_return_address(0), Arg1, Arg2);
+ MAYBE_RECORD_TRACE(8);
+}
+__attribute__((visibility("default")))
+void __sanitizer_cov_trace_cmp4(uint32_t Arg1, int32_t Arg2) {
+ fuzzer::AddValueForCmp(__builtin_return_address(0), Arg1, Arg2);
+ MAYBE_RECORD_TRACE(4);
+}
+__attribute__((visibility("default")))
+void __sanitizer_cov_trace_cmp2(uint16_t Arg1, int16_t Arg2) {
+ fuzzer::AddValueForCmp(__builtin_return_address(0), Arg1, Arg2);
+ MAYBE_RECORD_TRACE(2);
+}
+__attribute__((visibility("default")))
+void __sanitizer_cov_trace_cmp1(uint8_t Arg1, int8_t Arg2) {
+ fuzzer::AddValueForCmp(__builtin_return_address(0), Arg1, Arg2);
+ MAYBE_RECORD_TRACE(1);
}
__attribute__((visibility("default")))
Modified: llvm/trunk/lib/Fuzzer/test/value-profile-cmp.test
URL: http://llvm.org/viewvc/llvm-project/llvm/trunk/lib/Fuzzer/test/value-profile-cmp.test?rev=279027&r1=279026&r2=279027&view=diff
==============================================================================
--- llvm/trunk/lib/Fuzzer/test/value-profile-cmp.test (original)
+++ llvm/trunk/lib/Fuzzer/test/value-profile-cmp.test Wed Aug 17 20:25:28 2016
@@ -1,3 +1,5 @@
CHECK: BINGO
RUN: not LLVMFuzzer-SimpleCmpTest -use_value_profile=1 -runs=100000000 2>&1 | FileCheck %s
+RUN: not LLVMFuzzer-SimpleHashTest -use_value_profile=1 -runs=100000000 2>&1 | FileCheck %s
+
Modified: llvm/trunk/lib/Transforms/Instrumentation/SanitizerCoverage.cpp
URL: http://llvm.org/viewvc/llvm-project/llvm/trunk/lib/Transforms/Instrumentation/SanitizerCoverage.cpp?rev=279027&r1=279026&r2=279027&view=diff
==============================================================================
--- llvm/trunk/lib/Transforms/Instrumentation/SanitizerCoverage.cpp (original)
+++ llvm/trunk/lib/Transforms/Instrumentation/SanitizerCoverage.cpp Wed Aug 17 20:25:28 2016
@@ -67,7 +67,10 @@ static const char *const SanCovTraceEnte
static const char *const SanCovTraceBBName =
"__sanitizer_cov_trace_basic_block";
static const char *const SanCovTracePCName = "__sanitizer_cov_trace_pc";
-static const char *const SanCovTraceCmpName = "__sanitizer_cov_trace_cmp";
+static const char *const SanCovTraceCmp1 = "__sanitizer_cov_trace_cmp1";
+static const char *const SanCovTraceCmp2 = "__sanitizer_cov_trace_cmp2";
+static const char *const SanCovTraceCmp4 = "__sanitizer_cov_trace_cmp4";
+static const char *const SanCovTraceCmp8 = "__sanitizer_cov_trace_cmp8";
static const char *const SanCovTraceSwitchName = "__sanitizer_cov_trace_switch";
static const char *const SanCovModuleCtorName = "sancov.module_ctor";
static const uint64_t SanCtorAndDtorPriority = 2;
@@ -188,7 +191,7 @@ private:
Function *SanCovWithCheckFunction;
Function *SanCovIndirCallFunction, *SanCovTracePCIndir;
Function *SanCovTraceEnter, *SanCovTraceBB, *SanCovTracePC;
- Function *SanCovTraceCmpFunction;
+ Function *SanCovTraceCmpFunction[4];
Function *SanCovTraceSwitchFunction;
InlineAsm *EmptyAsm;
Type *IntptrTy, *Int64Ty, *Int64PtrTy;
@@ -227,9 +230,18 @@ bool SanitizerCoverageModule::runOnModul
SanCovIndirCallFunction =
checkSanitizerInterfaceFunction(M.getOrInsertFunction(
SanCovIndirCallName, VoidTy, IntptrTy, IntptrTy, nullptr));
- SanCovTraceCmpFunction =
+ SanCovTraceCmpFunction[0] =
checkSanitizerInterfaceFunction(M.getOrInsertFunction(
- SanCovTraceCmpName, VoidTy, Int64Ty, Int64Ty, Int64Ty, nullptr));
+ SanCovTraceCmp1, VoidTy, IRB.getInt8Ty(), IRB.getInt8Ty(), nullptr));
+ SanCovTraceCmpFunction[1] = checkSanitizerInterfaceFunction(
+ M.getOrInsertFunction(SanCovTraceCmp2, VoidTy, IRB.getInt16Ty(),
+ IRB.getInt16Ty(), nullptr));
+ SanCovTraceCmpFunction[2] = checkSanitizerInterfaceFunction(
+ M.getOrInsertFunction(SanCovTraceCmp4, VoidTy, IRB.getInt32Ty(),
+ IRB.getInt32Ty(), nullptr));
+ SanCovTraceCmpFunction[3] =
+ checkSanitizerInterfaceFunction(M.getOrInsertFunction(
+ SanCovTraceCmp8, VoidTy, Int64Ty, Int64Ty, nullptr));
SanCovTraceSwitchFunction =
checkSanitizerInterfaceFunction(M.getOrInsertFunction(
SanCovTraceSwitchName, VoidTy, Int64Ty, Int64PtrTy, nullptr));
@@ -497,12 +509,16 @@ void SanitizerCoverageModule::InjectTrac
if (!A0->getType()->isIntegerTy())
continue;
uint64_t TypeSize = DL->getTypeStoreSizeInBits(A0->getType());
+ int CallbackIdx = TypeSize == 8 ? 0 :
+ TypeSize == 16 ? 1 :
+ TypeSize == 32 ? 2 :
+ TypeSize == 64 ? 3 : -1;
+ if (CallbackIdx < 0) continue;
// __sanitizer_cov_trace_cmp((type_size << 32) | predicate, A0, A1);
+ auto Ty = Type::getIntNTy(*C, TypeSize);
IRB.CreateCall(
- SanCovTraceCmpFunction,
- {ConstantInt::get(Int64Ty, (TypeSize << 32) | ICMP->getPredicate()),
- IRB.CreateIntCast(A0, Int64Ty, true),
- IRB.CreateIntCast(A1, Int64Ty, true)});
+ SanCovTraceCmpFunction[CallbackIdx],
+ {IRB.CreateIntCast(A0, Ty, true), IRB.CreateIntCast(A1, Ty, true)});
}
}
}
Modified: llvm/trunk/test/Instrumentation/SanitizerCoverage/cmp-tracing.ll
URL: http://llvm.org/viewvc/llvm-project/llvm/trunk/test/Instrumentation/SanitizerCoverage/cmp-tracing.ll?rev=279027&r1=279026&r2=279027&view=diff
==============================================================================
--- llvm/trunk/test/Instrumentation/SanitizerCoverage/cmp-tracing.ll (original)
+++ llvm/trunk/test/Instrumentation/SanitizerCoverage/cmp-tracing.ll Wed Aug 17 20:25:28 2016
@@ -6,7 +6,7 @@ target triple = "x86_64-unknown-linux-gn
define i32 @foo(i32 %a, i32 %b) #0 {
entry:
%cmp = icmp slt i32 %a, %b
-; CHECK: call void @__sanitizer_cov_trace_cmp
+; CHECK: call void @__sanitizer_cov_trace_cmp4
; CHECK-NEXT: icmp slt i32 %a, %b
%conv = zext i1 %cmp to i32
ret i32 %conv
More information about the llvm-commits
mailing list