sanitizer: add support for trace coverage

[dvyukov]

Summary

Trace coverage mode collects all covered PCs into a per-thread, in-memory buffer. This mode replaces experimental and unused basic block tracing.
No logic is inlined into instrumented code, compiler only inserts callbacks into runtime.
This mode is meant to be used at least for Linux kernel, but can be useful for user-space as well.

[dvyukov]

I did not implement actual user-space runtime support, as we don't have agreement on this part yet. Kernel does not require any runtime support, it will have its own. I've sketched what I would do include/sanitizer/coverage_interface.h, but I don't have any concrete plans regarding user-space usage at the moment.

[kcc]

LGTM with two nits.
Thanks!

include/sanitizer/coverage_interface.h

69

here and below use int instead of bool.
This API can theoretically be used in C

lib/Transforms/Instrumentation/SanitizerCoverage.cpp

80

typo: Tacing

[kcc]

I see you have not submitted this yet...
And I have an afterthought....

The tracing that we have now (https://github.com/google/sanitizers/wiki/AddressSanitizerBasicBlockTracing)
is more complex but it actually provides more functionality at almost same cost.

1. It uses consecutive BB ids instead of PCs. This will buy us cheaper analysis because with consecutive ids we can use a bit set.

2. It will allow us to implement coverage frontier:

at compile time, we create a static table that stores the Control Flow Graph of the function using the pairs of IDs.
at run-time, we load this table and we can find the edges that belong to the frontier (i.e. the edges that were never executed but that have one preceding edge that was executed)
(I have a patch for that lying somewhere).
This will be much harder to achieve with raw PCs.

[dvyukov]

In D14572#288470, @kcc wrote:

I see you have not submitted this yet...
And I have an afterthought....

The tracing that we have now (https://github.com/google/sanitizers/wiki/AddressSanitizerBasicBlockTracing)
is more complex but it actually provides more functionality at almost same cost.

1. It uses consecutive BB ids instead of PCs. This will buy us cheaper analysis because with consecutive ids we can use a bit set.

2. It will allow us to implement coverage frontier:

at compile time, we create a static table that stores the Control Flow Graph of the function using the pairs of IDs.
at run-time, we load this table and we can find the edges that belong to the frontier (i.e. the edges that were never executed but that have one preceding edge that was executed)
(I have a patch for that lying somewhere).
This will be much harder to achieve with raw PCs.

... and what do you propose?

[kcc]

In D14572#289032, @dvyukov wrote:

In D14572#288470, @kcc wrote:

I see you have not submitted this yet...
And I have an afterthought....

The tracing that we have now (https://github.com/google/sanitizers/wiki/AddressSanitizerBasicBlockTracing)
is more complex but it actually provides more functionality at almost same cost.

1. It uses consecutive BB ids instead of PCs. This will buy us cheaper analysis because with consecutive ids we can use a bit set.

2. It will allow us to implement coverage frontier:

at compile time, we create a static table that stores the Control Flow Graph of the function using the pairs of IDs.
at run-time, we load this table and we can find the edges that belong to the frontier (i.e. the edges that were never executed but that have one preceding edge that was executed)
(I have a patch for that lying somewhere).
This will be much harder to achieve with raw PCs.

... and what do you propose?

More like asking your opinion: can we implement tracing that produces IDs instead of PCs such that

• it works for your use case in the kernel
• reasonably simple to implement (probably simpler than my current code)
• also allows to implement coverage frontier

include/clang/Driver/CC1Options.td

def vectorize_slp_aggressive : Flag<["-"], "vectorize-slp-aggressive">,
   HelpText<"Run the BB vectorization passes">;
 def dependent_lib : Joined<["--"], "dependent-lib=">,
   HelpText<"Add dependent library">;
 def fsanitize_coverage_type : Joined<["-"], "fsanitize-coverage-type=">,
                               HelpText<"Sanitizer coverage type">;
 def fsanitize_coverage_indirect_calls
     : Flag<["-"], "fsanitize-coverage-indirect-calls">,
       HelpText<"Enable sanitizer coverage for indirect calls">;
-def fsanitize_coverage_trace_bb
-    : Flag<["-"], "fsanitize-coverage-trace-bb">,
-      HelpText<"Enable basic block tracing in sanitizer coverage">;
+def fsanitize_coverage_trace
+    : Flag<["-"], "fsanitize-coverage-trace">,
+      HelpText<"Enable tracing in sanitizer coverage">;
 def fsanitize_coverage_trace_cmp
     : Flag<["-"], "fsanitize-coverage-trace-cmp">,
       HelpText<"Enable cmp instruction tracing in sanitizer coverage">;
 def fsanitize_coverage_8bit_counters
     : Flag<["-"], "fsanitize-coverage-8bit-counters">,
       HelpText<"Enable frequency counters in sanitizer coverage">;
 
 //===----------------------------------------------------------------------===//

include/clang/Frontend/CodeGenOptions.def

 CODEGENOPT(SanitizeMemoryTrackOrigins, 2, 0) ///< Enable tracking origins in
                                              ///< MemorySanitizer
 CODEGENOPT(SanitizeMemoryUseAfterDtor, 1, 0) ///< Enable use-after-delete detection
                                              ///< in MemorySanitizer
 CODEGENOPT(SanitizeCoverageType, 2, 0) ///< Type of sanitizer coverage
                                        ///< instrumentation.
 CODEGENOPT(SanitizeCoverageIndirectCalls, 1, 0) ///< Enable sanitizer coverage
                                                 ///< for indirect calls.
-CODEGENOPT(SanitizeCoverageTraceBB, 1, 0) ///< Enable basic block tracing in
-                                          ///< in sanitizer coverage.
+CODEGENOPT(SanitizeCoverageTrace, 1, 0) ///< Enable tracing in sanitizer coverage.
 CODEGENOPT(SanitizeCoverageTraceCmp, 1, 0) ///< Enable cmp instruction tracing
                                            ///< in sanitizer coverage.
 CODEGENOPT(SanitizeCoverage8bitCounters, 1, 0) ///< Use 8-bit frequency counters
                                                ///< in sanitizer coverage.
 CODEGENOPT(SimplifyLibCalls  , 1, 1) ///< Set when -fbuiltin is enabled.
 CODEGENOPT(SoftFloat         , 1, 0) ///< -soft-float.
 CODEGENOPT(StrictEnums       , 1, 0) ///< Optimize based on strict enum definition.
 CODEGENOPT(StrictVTablePointers, 1, 0) ///< Optimize based on the strict vtable pointers

include/llvm/Transforms/Instrumentation.h

 // Insert DataFlowSanitizer (dynamic data flow analysis) instrumentation
 ModulePass *createDataFlowSanitizerPass(
     const std::vector<std::string> &ABIListFiles = std::vector<std::string>(),
     void *(*getArgTLS)() = nullptr, void *(*getRetValTLS)() = nullptr);
 
 // Options for sanitizer coverage instrumentation.
 struct SanitizerCoverageOptions {
   SanitizerCoverageOptions()
-      : CoverageType(SCK_None), IndirectCalls(false), TraceBB(false),
+      : CoverageType(SCK_None), IndirectCalls(false), Trace(false),
         TraceCmp(false), Use8bitCounters(false) {}
 
   enum Type {
     SCK_None = 0,
     SCK_Function,
     SCK_BB,
     SCK_Edge
   } CoverageType;
   bool IndirectCalls;
-  bool TraceBB;
+  bool Trace;
   bool TraceCmp;
   bool Use8bitCounters;
 };
 
 // Insert SanitizerCoverage instrumentation.
 ModulePass *createSanitizerCoverageModulePass(
     const SanitizerCoverageOptions &Options = SanitizerCoverageOptions());
 

include/sanitizer/coverage_interface.h

#endif
   uintptr_t __sanitizer_get_number_of_counters();
   // Updates the counter 'bitset', clears the counters and returns the number of
   // new bits in 'bitset'.
   // If 'bitset' is nullptr, only clears the counters.
   // Otherwise 'bitset' should be at least
   // __sanitizer_get_number_of_counters bytes long and 8-aligned.
   uintptr_t
   __sanitizer_update_counter_bitset_and_clear_counters(uint8_t *bitset);
+
+  // Per-thread, in-memory trace coverage.
+  // Code must be compiled with -fsanitize-coverage=trace.
+
+  // Enable tracing for the current thread with buffer for size PCs.
+  // Size must be a power-of-two.
+  // Fails if tracing is already enabled, size is not a power of two or
+  // out of memory.
+  bool __sanitizer_trace_enable(uintptr_t size);
+  // Disable tracing for the current thread and free all associated resources.
+  // Fails if tracing is not enabled for the current thread.
+  bool __sanitizer_trace_disable();
+  // Reset trace for the current thread.
+  // Fails if tracing is not enabled for the current thread.
+  bool __sanitizer_trace_reset();
+  // Read trace of the current thread.
+  // Trace is set to point to an array of traced PCs, size is set to number
+  // of PCs in the trace. Trace memory is owned by sanitizer library, and
+  // is valid until call to __sanitizer_trace_disable() in this thread.
+  // However, the trace buffer can be overwritten if the thread executes
+  // instrumented code.
+  // Fails if tracing is not enabled for the current thread.
+  bool __sanitizer_trace_read(uintptr_t **trace, uintptr_t *size);
 #ifdef __cplusplus
 }  // extern "C"
 #endif
 
 #endif  // SANITIZER_COVERAG_INTERFACE_H

lib/CodeGen/BackendUtil.cpp

static void addSanitizerCoveragePass(const PassManagerBuilder &Builder,
                                      legacy::PassManagerBase &PM) {
   const PassManagerBuilderWrapper &BuilderWrapper =
       static_cast<const PassManagerBuilderWrapper&>(Builder);
   const CodeGenOptions &CGOpts = BuilderWrapper.getCGOpts();
   SanitizerCoverageOptions Opts;
   Opts.CoverageType =
       static_cast<SanitizerCoverageOptions::Type>(CGOpts.SanitizeCoverageType);
   Opts.IndirectCalls = CGOpts.SanitizeCoverageIndirectCalls;
-  Opts.TraceBB = CGOpts.SanitizeCoverageTraceBB;
+  Opts.Trace = CGOpts.SanitizeCoverageTrace;
   Opts.TraceCmp = CGOpts.SanitizeCoverageTraceCmp;
   Opts.Use8bitCounters = CGOpts.SanitizeCoverage8bitCounters;
   PM.add(createSanitizerCoverageModulePass(Opts));
 }
 
 static void addAddressSanitizerPasses(const PassManagerBuilder &Builder,
                                       legacy::PassManagerBase &PM) {
   const PassManagerBuilderWrapper &BuilderWrapper =

lib/Driver/SanitizerArgs.cpp

enum : SanitizerMask {
   TrappingDefault = CFI,
 };
 
 enum CoverageFeature {
   CoverageFunc = 1 << 0,
   CoverageBB = 1 << 1,
   CoverageEdge = 1 << 2,
   CoverageIndirCall = 1 << 3,
-  CoverageTraceBB = 1 << 4,
+  CoverageTrace = 1 << 4,
   CoverageTraceCmp = 1 << 5,
   Coverage8bitCounters = 1 << 6,
 };
 
 /// Parse a -fsanitize= or -fno-sanitize= argument's values, diagnosing any
 /// invalid components. Returns a SanitizerMask.
 static SanitizerMask parseArgValues(const Driver &D, const llvm::opt::Arg *A,
                                     bool DiagnoseErrors);
SanitizerArgs::SanitizerArgs(const ToolChain &TC,
   if ((CoverageFeatures & CoverageFunc) && (CoverageFeatures & CoverageEdge))
     D.Diag(clang::diag::err_drv_argument_not_allowed_with)
         << "-fsanitize-coverage=func"
         << "-fsanitize-coverage=edge";
   if ((CoverageFeatures & CoverageBB) && (CoverageFeatures & CoverageEdge))
     D.Diag(clang::diag::err_drv_argument_not_allowed_with)
         << "-fsanitize-coverage=bb"
         << "-fsanitize-coverage=edge";
-  // Basic block tracing and 8-bit counters require some type of coverage
-  // enabled.
-  int CoverageTypes = CoverageFunc | CoverageBB | CoverageEdge;
-  if ((CoverageFeatures & CoverageTraceBB) &&
-      !(CoverageFeatures & CoverageTypes))
-    D.Diag(clang::diag::err_drv_argument_only_allowed_with)
-        << "-fsanitize-coverage=trace-bb"
-        << "-fsanitize-coverage=(func|bb|edge)";
-  if ((CoverageFeatures & Coverage8bitCounters) &&
-      !(CoverageFeatures & CoverageTypes))
-    D.Diag(clang::diag::err_drv_argument_only_allowed_with)
-        << "-fsanitize-coverage=8bit-counters"
-        << "-fsanitize-coverage=(func|bb|edge)";
+  // Tracing and 8-bit counters require some type of coverage enabled.
+  // Enable edge by default.
+  if (((CoverageFeatures & CoverageTrace) ||
+      (CoverageFeatures & Coverage8bitCounters)) &&
+      !(CoverageFeatures & (CoverageFunc | CoverageBB | CoverageEdge)))
+    CoverageFeatures |= CoverageEdge;
 
   if (AllAddedKinds & Address) {
     AsanSharedRuntime =
         Args.hasArg(options::OPT_shared_libasan) || TC.getTriple().isAndroid();
     NeedPIE |= TC.getTriple().isAndroid();
     if (Arg *A =
             Args.getLastArg(options::OPT_fsanitize_address_field_padding)) {
         StringRef S = A->getValue();
if (AsanFieldPadding)
     CmdArgs.push_back(Args.MakeArgString("-fsanitize-address-field-padding=" +
                                          llvm::utostr(AsanFieldPadding)));
   // Translate available CoverageFeatures to corresponding clang-cc1 flags.
   std::pair<int, const char *> CoverageFlags[] = {
     std::make_pair(CoverageFunc, "-fsanitize-coverage-type=1"),
     std::make_pair(CoverageBB, "-fsanitize-coverage-type=2"),
     std::make_pair(CoverageEdge, "-fsanitize-coverage-type=3"),
     std::make_pair(CoverageIndirCall, "-fsanitize-coverage-indirect-calls"),
-    std::make_pair(CoverageTraceBB, "-fsanitize-coverage-trace-bb"),
+    std::make_pair(CoverageTrace, "-fsanitize-coverage-trace"),
     std::make_pair(CoverageTraceCmp, "-fsanitize-coverage-trace-cmp"),
     std::make_pair(Coverage8bitCounters, "-fsanitize-coverage-8bit-counters")};
   for (auto F : CoverageFlags) {
     if (CoverageFeatures & F.first)
       CmdArgs.push_back(Args.MakeArgString(F.second));
   }
 
 
int parseCoverageFeatures(const Driver &D, const llvm::opt::Arg *A) {
   int Features = 0;
   for (int i = 0, n = A->getNumValues(); i != n; ++i) {
     const char *Value = A->getValue(i);
     int F = llvm::StringSwitch<int>(Value)
         .Case("func", CoverageFunc)
         .Case("bb", CoverageBB)
         .Case("edge", CoverageEdge)
         .Case("indirect-calls", CoverageIndirCall)
-        .Case("trace-bb", CoverageTraceBB)
+        .Case("trace", CoverageTrace)
         .Case("trace-cmp", CoverageTraceCmp)
         .Case("8bit-counters", Coverage8bitCounters)
         .Default(0);
     if (F == 0)
       D.Diag(clang::diag::err_drv_unsupported_option_argument)
           << A->getOption().getName() << Value;
     Features |= F;
   }

lib/Frontend/CompilerInvocation.cpp

if (A->getOption().matches(OPT_mlink_cuda_bitcode))
       LinkFlags = llvm::Linker::Flags::LinkOnlyNeeded |
                   llvm::Linker::Flags::InternalizeLinkedSymbols;
     Opts.LinkBitcodeFiles.push_back(std::make_pair(LinkFlags, A->getValue()));
   }
   Opts.SanitizeCoverageType =
       getLastArgIntValue(Args, OPT_fsanitize_coverage_type, 0, Diags);
   Opts.SanitizeCoverageIndirectCalls =
       Args.hasArg(OPT_fsanitize_coverage_indirect_calls);
-  Opts.SanitizeCoverageTraceBB = Args.hasArg(OPT_fsanitize_coverage_trace_bb);
+  Opts.SanitizeCoverageTrace = Args.hasArg(OPT_fsanitize_coverage_trace);
   Opts.SanitizeCoverageTraceCmp = Args.hasArg(OPT_fsanitize_coverage_trace_cmp);
   Opts.SanitizeCoverage8bitCounters =
       Args.hasArg(OPT_fsanitize_coverage_8bit_counters);
   Opts.SanitizeMemoryTrackOrigins =
       getLastArgIntValue(Args, OPT_fsanitize_memory_track_origins_EQ, 0, Diags);
   Opts.SanitizeMemoryUseAfterDtor =
       Args.hasArg(OPT_fsanitize_memory_use_after_dtor);
   Opts.SSPBufferSize =

lib/Transforms/Instrumentation/SanitizerCoverage.cpp

 using namespace llvm;
 
 #define DEBUG_TYPE "sancov"
 
 static const char *const kSanCovModuleInitName = "__sanitizer_cov_module_init";
 static const char *const kSanCovName = "__sanitizer_cov";
 static const char *const kSanCovWithCheckName = "__sanitizer_cov_with_check";
 static const char *const kSanCovIndirCallName = "__sanitizer_cov_indir_call16";
-static const char *const kSanCovTraceEnter = "__sanitizer_cov_trace_func_enter";
-static const char *const kSanCovTraceBB = "__sanitizer_cov_trace_basic_block";
+static const char *const kSanCovTrace = "__sanitizer_cov_trace";
 static const char *const kSanCovTraceCmp = "__sanitizer_cov_trace_cmp";
 static const char *const kSanCovTraceSwitch = "__sanitizer_cov_trace_switch";
 static const char *const kSanCovModuleCtorName = "sancov.module_ctor";
 static const uint64_t    kSanCtorAndDtorPriority = 2;
 
 static cl::opt<int> ClCoverageLevel("sanitizer-coverage-level",
        cl::desc("Sanitizer Coverage. 0: none, 1: entry block, 2: all blocks, "
                 "3: all blocks and critical edges, "
                 "4: above plus indirect calls"),
        cl::Hidden, cl::init(0));
 
 static cl::opt<unsigned> ClCoverageBlockThreshold(
     "sanitizer-coverage-block-threshold",
     cl::desc("Use a callback with a guard check inside it if there are"
              " more than this number of blocks."),
     cl::Hidden, cl::init(500));
 
 static cl::opt<bool>
-    ClExperimentalTracing("sanitizer-coverage-experimental-tracing",
-                          cl::desc("Experimental basic-block tracing: insert "
-                                   "callbacks at every basic block"),
+    ClTracing("sanitizer-coverage-trace",
+                          cl::desc("Tacing: insert callbacks at every basic"
+                                   " function/block/edge"),
                           cl::Hidden, cl::init(false));
 
 static cl::opt<bool>
     ClExperimentalCMPTracing("sanitizer-coverage-experimental-trace-compares",
                              cl::desc("Experimental tracing of CMP and similar "
                                       "instructions"),
                              cl::Hidden, cl::init(false));
 
SanitizerCoverageOptions getOptions(int LegacyCoverageLevel) {
   return Res;
 }
 
 SanitizerCoverageOptions OverrideFromCL(SanitizerCoverageOptions Options) {
   // Sets CoverageType and IndirectCalls.
   SanitizerCoverageOptions CLOpts = getOptions(ClCoverageLevel);
   Options.CoverageType = std::max(Options.CoverageType, CLOpts.CoverageType);
   Options.IndirectCalls |= CLOpts.IndirectCalls;
-  Options.TraceBB |= ClExperimentalTracing;
+  Options.Trace |= ClTracing;
   Options.TraceCmp |= ClExperimentalCMPTracing;
   Options.Use8bitCounters |= ClUse8bitCounters;
   return Options;
 }
 
 class SanitizerCoverageModule : public ModulePass {
  public:
   SanitizerCoverageModule(
private:
   void SetNoSanitizeMetadata(Instruction *I);
   void InjectCoverageAtBlock(Function &F, BasicBlock &BB, bool UseCalls);
   unsigned NumberOfInstrumentedBlocks() {
     return SanCovFunction->getNumUses() + SanCovWithCheckFunction->getNumUses();
   }
   Function *SanCovFunction;
   Function *SanCovWithCheckFunction;
   Function *SanCovIndirCallFunction;
-  Function *SanCovTraceEnter, *SanCovTraceBB;
+  Function *SanCovTrace;
   Function *SanCovTraceCmpFunction;
   Function *SanCovTraceSwitchFunction;
   InlineAsm *EmptyAsm;
   Type *IntptrTy, *Int64Ty, *Int64PtrTy;
   Module *CurModule;
   LLVMContext *C;
   const DataLayout *DL;
 
SanCovTraceSwitchFunction =
       checkSanitizerInterfaceFunction(M.getOrInsertFunction(
           kSanCovTraceSwitch, VoidTy, Int64Ty, Int64PtrTy, nullptr));
 
   // We insert an empty inline asm after cov callbacks to avoid callback merge.
   EmptyAsm = InlineAsm::get(FunctionType::get(IRB.getVoidTy(), false),
                             StringRef(""), StringRef(""),
                             /*hasSideEffects=*/true);
 
-  if (Options.TraceBB) {
-    SanCovTraceEnter = checkSanitizerInterfaceFunction(
-        M.getOrInsertFunction(kSanCovTraceEnter, VoidTy, Int32PtrTy, nullptr));
-    SanCovTraceBB = checkSanitizerInterfaceFunction(
-        M.getOrInsertFunction(kSanCovTraceBB, VoidTy, Int32PtrTy, nullptr));
-  }
+  if (Options.Trace)
+    SanCovTrace = checkSanitizerInterfaceFunction(
+        M.getOrInsertFunction(kSanCovTrace, VoidTy, nullptr));
 
   // At this point we create a dummy array of guards because we don't
   // know how many elements we will need.
   Type *Int32Ty = IRB.getInt32Ty();
   Type *Int8Ty = IRB.getInt8Ty();
 
   GuardArray =
       new GlobalVariable(M, Int32Ty, false, GlobalValue::ExternalLinkage,
if (Options.Use8bitCounters) {
     P = IRB.CreateIntToPtr(P, IRB.getInt8PtrTy());
     LoadInst *LI = IRB.CreateLoad(P);
     Value *Inc = IRB.CreateAdd(LI, ConstantInt::get(IRB.getInt8Ty(), 1));
     StoreInst *SI = IRB.CreateStore(Inc, P);
     SetNoSanitizeMetadata(LI);
     SetNoSanitizeMetadata(SI);
   }
 
-  if (Options.TraceBB) {
-    // Experimental support for tracing.
-    // Insert a callback with the same guard variable as used for coverage.
+  if (Options.Trace) {
+    // Trace coverage.
     IRB.SetInsertPoint(&*IP);
-    IRB.CreateCall(IsEntryBB ? SanCovTraceEnter : SanCovTraceBB, GuardP);
+    IRB.CreateCall(SanCovTrace);
   }
 }
 
 char SanitizerCoverageModule::ID = 0;
 INITIALIZE_PASS(SanitizerCoverageModule, "sancov",
     "SanitizerCoverage: TODO."
     "ModulePass", false, false)
 ModulePass *llvm::createSanitizerCoverageModulePass(
     const SanitizerCoverageOptions &Options) {
   return new SanitizerCoverageModule(Options);
 }

lib/sanitizer_common/sanitizer_coverage_libcdep.cc

public:
   void DumpCallerCalleePairs();
   void DumpTrace();
   void DumpAsBitSet();
   void DumpCounters();
   void DumpOffsets();
   void DumpAll();
 
   ALWAYS_INLINE
-  void TraceBasicBlock(s32 *id);
+  void TraceBasicBlock(uptr pc);
 
   void InitializeGuardArray(s32 *guards);
   void InitializeGuards(s32 *guards, uptr n, const char *module_name,
                         uptr caller_pc);
   void InitializeCounters(u8 *counters, uptr n);
   void ReinitializeGuards();
   uptr GetNumberOf8bitCounters();
   uptr Update8bitCounterBitsetAndClearCounters(u8 *bitset);
private:
   uptr num_8bit_counters;
 
   // Caller-Callee (cc) array, size and current index.
   static const uptr kCcArrayMaxSize = FIRST_32_SECOND_64(1 << 18, 1 << 24);
   uptr **cc_array;
   atomic_uintptr_t cc_array_index;
   atomic_uintptr_t cc_array_size;
 
-  // Tracing event array, size and current pointer.
-  // We record all events (basic block entries) in a global buffer of u32
-  // values. Each such value is the index in pc_array.
-  // So far the tracing is highly experimental:
-  //   - not thread-safe;
-  //   - does not support long traces;
-  //   - not tuned for performance.
-  static const uptr kTrEventArrayMaxSize = FIRST_32_SECOND_64(1 << 22, 1 << 30);
-  u32 *tr_event_array;
-  uptr tr_event_array_size;
-  u32 *tr_event_pointer;
-  static const uptr kTrPcArrayMaxSize    = FIRST_32_SECOND_64(1 << 22, 1 << 27);
+  uptr tr_size;
 
   StaticSpinMutex mu;
 };
 
 static CoverageData coverage_data;
 
 void CovUpdateMapping(const char *path, uptr caller_pc = 0);
 
if (common_flags()->coverage_direct) {
     atomic_store(&pc_array_size, kPcArrayMaxSize, memory_order_relaxed);
   }
 
   cc_array = reinterpret_cast<uptr **>(MmapNoReserveOrDie(
       sizeof(uptr *) * kCcArrayMaxSize, "CovInit::cc_array"));
   atomic_store(&cc_array_size, kCcArrayMaxSize, memory_order_relaxed);
   atomic_store(&cc_array_index, 0, memory_order_relaxed);
 
-  // Allocate tr_event_array with a guard page at the end.
-  tr_event_array = reinterpret_cast<u32 *>(MmapNoReserveOrDie(
-      sizeof(tr_event_array[0]) * kTrEventArrayMaxSize + GetMmapGranularity(),
-      "CovInit::tr_event_array"));
-  MprotectNoAccess(
-      reinterpret_cast<uptr>(&tr_event_array[kTrEventArrayMaxSize]),
-      GetMmapGranularity());
-  tr_event_array_size = kTrEventArrayMaxSize;
-  tr_event_pointer = tr_event_array;
-
   num_8bit_counters = 0;
 }
 
 void CoverageData::InitializeGuardArray(s32 *guards) {
   Enable();  // Make sure coverage is enabled at this point.
   s32 n = guards[0];
   for (s32 j = 1; j <= n; j++) {
     uptr idx = atomic_load_relaxed(&pc_array_index);
     atomic_store_relaxed(&pc_array_index, idx + 1);
     guards[j] = -static_cast<s32>(idx + 1);
   }
 }
 
 void CoverageData::Disable() {
   if (pc_array) {
     UnmapOrDie(pc_array, sizeof(uptr) * kPcArrayMaxSize);
     pc_array = nullptr;
   }
   if (cc_array) {
     UnmapOrDie(cc_array, sizeof(uptr *) * kCcArrayMaxSize);
     cc_array = nullptr;
   }
-  if (tr_event_array) {
-    UnmapOrDie(tr_event_array,
-               sizeof(tr_event_array[0]) * kTrEventArrayMaxSize +
-                   GetMmapGranularity());
-    tr_event_array = nullptr;
-    tr_event_pointer = nullptr;
-  }
   if (pc_fd != kInvalidFd) {
     CloseFile(pc_fd);
     pc_fd = kInvalidFd;
   }
 }
 
 void CoverageData::ReinitializeGuards() {
   // Assuming single thread.
static fd_t CovOpenFile(InternalScopedString *path, bool packed,
   error_t err;
   fd_t fd = OpenFile(path->data(), WrOnly, &err);
   if (fd == kInvalidFd)
     Report("SanitizerCoverage: failed to open %s for writing (reason: %d)\n",
            path->data(), err);
   return fd;
 }
 
-// Dump trace PCs and trace events into two separate files.
 void CoverageData::DumpTrace() {
-  uptr max_idx = tr_event_pointer - tr_event_array;
-  if (!max_idx) return;
-  auto sym = Symbolizer::GetOrInit();
-  if (!sym)
+  if (tr_size == 0)
     return;
-  InternalScopedString out(32 << 20);
-  for (uptr i = 0, n = size(); i < n; i++) {
-    const char *module_name = "<unknown>";
-    uptr module_address = 0;
-    sym->GetModuleNameAndOffsetForPC(UnbundlePc(pc_array[i]), &module_name,
-                                     &module_address);
-    out.append("%s 0x%zx\n", module_name, module_address);
-  }
-  InternalScopedString path(kMaxPathLength);
-  fd_t fd = CovOpenFile(&path, false, "trace-points");
-  if (fd == kInvalidFd) return;
-  WriteToFile(fd, out.data(), out.length());
-  CloseFile(fd);
-
-  fd = CovOpenFile(&path, false, "trace-compunits");
-  if (fd == kInvalidFd) return;
-  out.clear();
-  for (uptr i = 0; i < comp_unit_name_vec.size(); i++)
-    out.append("%s\n", comp_unit_name_vec[i].copied_module_name);
-  WriteToFile(fd, out.data(), out.length());
-  CloseFile(fd);
-
-  fd = CovOpenFile(&path, false, "trace-events");
-  if (fd == kInvalidFd) return;
-  uptr bytes_to_write = max_idx * sizeof(tr_event_array[0]);
-  u8 *event_bytes = reinterpret_cast<u8*>(tr_event_array);
-  // The trace file could be huge, and may not be written with a single syscall.
-  while (bytes_to_write) {
-    uptr actually_written;
-    if (WriteToFile(fd, event_bytes, bytes_to_write, &actually_written) &&
-        actually_written <= bytes_to_write) {
-      bytes_to_write -= actually_written;
-      event_bytes += actually_written;
-    } else {
-      break;
-    }
-  }
-  CloseFile(fd);
   VReport(1, " CovDump: Trace: %zd PCs written\n", size());
-  VReport(1, " CovDump: Trace: %zd Events written\n", max_idx);
+  VReport(1, " CovDump: Trace: %zd Events written\n", tr_size);
 }
 
 // This function dumps the caller=>callee pairs into a file as a sequence of
 // lines like "module_name offset".
 void CoverageData::DumpCallerCalleePairs() {
   uptr max_idx = atomic_load(&cc_array_index, memory_order_relaxed);
   if (!max_idx) return;
   auto sym = Symbolizer::GetOrInit();
void CoverageData::DumpCallerCalleePairs() {
   fd_t fd = CovOpenFile(&path, false, "caller-callee");
   if (fd == kInvalidFd) return;
   WriteToFile(fd, out.data(), out.length());
   CloseFile(fd);
   VReport(1, " CovDump: %zd caller-callee pairs written\n", total);
 }
 
 // Record the current PC into the event buffer.
-// Every event is a u32 value (index in tr_pc_array_index) so we compute
-// it once and then cache in the provided 'cache' storage.
-//
-// This function will eventually be inlined by the compiler.
-void CoverageData::TraceBasicBlock(s32 *id) {
-  // Will trap here if
-  //  1. coverage is not enabled at run-time.
-  //  2. The array tr_event_array is full.
-  *tr_event_pointer = static_cast<u32>(*id - 1);
-  tr_event_pointer++;
+void CoverageData::TraceBasicBlock(uptr pc) {
+  tr_size++;
 }
 
 void CoverageData::DumpCounters() {
   if (!common_flags()->coverage_counters) return;
   uptr n = coverage_data.GetNumberOf8bitCounters();
   if (!n) return;
   InternalScopedBuffer<u8> bitset(n);
   coverage_data.Update8bitCounterBitsetAndClearCounters(bitset.data());

 }
 
 SANITIZER_INTERFACE_ATTRIBUTE
 uptr __sanitizer_get_total_unique_caller_callee_pairs() {
   return atomic_load(&caller_callee_counter, memory_order_relaxed);
 }
 
 SANITIZER_INTERFACE_ATTRIBUTE
-void __sanitizer_cov_trace_func_enter(s32 *id) {
-  coverage_data.TraceBasicBlock(id);
-}
-SANITIZER_INTERFACE_ATTRIBUTE
-void __sanitizer_cov_trace_basic_block(s32 *id) {
-  coverage_data.TraceBasicBlock(id);
+void __sanitizer_cov_trace() {
+  // TBD
+  coverage_data.TraceBasicBlock(GET_CALLER_PC());
 }
 SANITIZER_INTERFACE_ATTRIBUTE
 void __sanitizer_reset_coverage() {
   coverage_data.ReinitializeGuards();
   internal_bzero_aligned16(
       coverage_data.data(),
       RoundUpTo(coverage_data.size() * sizeof(coverage_data.data()[0]), 16));
 }

test/Driver/fsanitize-coverage.c

 
 // RUN: %clang -target x86_64-linux-gnu -fsanitize=thread   -fsanitize-coverage=1 %s -### 2>&1 | FileCheck %s --check-prefix=CHECK-SANITIZE-COVERAGE-UNUSED
 // RUN: %clang -target x86_64-linux-gnu                     -fsanitize-coverage=1 %s -### 2>&1 | FileCheck %s --check-prefix=CHECK-SANITIZE-COVERAGE-UNUSED
 // CHECK-SANITIZE-COVERAGE-UNUSED: argument unused during compilation: '-fsanitize-coverage=1'
 
 // RUN: %clang -target x86_64-linux-gnu -fsanitize=address -fsanitize-coverage=1 -fno-sanitize=address %s -### 2>&1 | FileCheck %s --check-prefix=CHECK-SANITIZE-COVERAGE-SAN-DISABLED
 // CHECK-SANITIZE-COVERAGE-SAN-DISABLED-NOT: argument unused
 
-// RUN: %clang -target x86_64-linux-gnu -fsanitize=address -fsanitize-coverage=edge,indirect-calls,trace-bb,trace-cmp,8bit-counters %s -### 2>&1 | FileCheck %s --check-prefix=CHECK-SANITIZE-COVERAGE-FEATURES
+// RUN: %clang -target x86_64-linux-gnu -fsanitize=address -fsanitize-coverage=edge,indirect-calls,trace,trace-cmp,8bit-counters %s -### 2>&1 | FileCheck %s --check-prefix=CHECK-SANITIZE-COVERAGE-FEATURES
 // CHECK-SANITIZE-COVERAGE-FEATURES: -fsanitize-coverage-type=3
 // CHECK-SANITIZE-COVERAGE-FEATURES: -fsanitize-coverage-indirect-calls
-// CHECK-SANITIZE-COVERAGE-FEATURES: -fsanitize-coverage-trace-bb
+// CHECK-SANITIZE-COVERAGE-FEATURES: -fsanitize-coverage-trace
 // CHECK-SANITIZE-COVERAGE-FEATURES: -fsanitize-coverage-trace-cmp
 // CHECK-SANITIZE-COVERAGE-FEATURES: -fsanitize-coverage-8bit-counters
 
-// RUN: %clang -target x86_64-linux-gnu -fsanitize=address -fsanitize-coverage=func,edge,indirect-calls,trace-bb,trace-cmp -fno-sanitize-coverage=edge,indirect-calls,trace-bb %s -### 2>&1 | FileCheck %s --check-prefix=CHECK-MASK
+// RUN: %clang -target x86_64-linux-gnu -fsanitize=address -fsanitize-coverage=func,edge,indirect-calls,trace,trace-cmp -fno-sanitize-coverage=edge,indirect-calls,trace %s -### 2>&1 | FileCheck %s --check-prefix=CHECK-MASK
 // CHECK-MASK: -fsanitize-coverage-type=1
 // CHECK-MASK: -fsanitize-coverage-trace-cmp
 // CHECK-MASK-NOT: -fsanitize-coverage-
 
 // RUN: %clang -target x86_64-linux-gnu -fsanitize=address -fsanitize-coverage=foobar %s -### 2>&1 | FileCheck %s --check-prefix=CHECK-INVALID-VALUE
 // CHECK-INVALID-VALUE: error: unsupported argument 'foobar' to option 'fsanitize-coverage='
 
 // RUN: %clang -target x86_64-linux-gnu -fsanitize=address -fsanitize-coverage=func -fsanitize-coverage=edge %s -### 2>&1 | FileCheck %s --check-prefix=CHECK-INCOMPATIBLE
 // CHECK-INCOMPATIBLE: error: invalid argument '-fsanitize-coverage=func' not allowed with '-fsanitize-coverage=edge'
 
+// Driver must enable edge coverage by default.
 // RUN: %clang -target x86_64-linux-gnu -fsanitize=address -fsanitize-coverage=8bit-counters %s -### 2>&1 | FileCheck %s --check-prefix=CHECK-MISSING-TYPE
-// CHECK-MISSING-TYPE: error: invalid argument '-fsanitize-coverage=8bit-counters' only allowed with '-fsanitize-coverage=(func|bb|edge)'
+// RUN: %clang -target x86_64-linux-gnu -fsanitize=address -fsanitize-coverage=trace %s -### 2>&1 | FileCheck %s --check-prefix=CHECK-MISSING-TYPE
+// CHECK-MISSING-TYPE-NOT: error
+// CHECK-MISSING-TYPE-NOT: fsanitize
 
 // RUN: %clang -target x86_64-linux-gnu -fsanitize=address -fsanitize-coverage=trace-cmp,indirect-calls %s -### 2>&1 | FileCheck %s --check-prefix=CHECK-NO-TYPE-NECESSARY
 // CHECK-NO-TYPE-NECESSARY-NOT: error:
 // CHECK-NO-TYPE-NECESSARY: -fsanitize-coverage-indirect-calls
 // CHECK-NO-TYPE-NECESSARY: -fsanitize-coverage-trace-cmp
 
 // RUN: %clang -target x86_64-linux-gnu -fsanitize=address -fsanitize-coverage=1 -fsanitize-coverage=trace-cmp %s -### 2>&1 | FileCheck %s --check-prefix=CHECK-EXTEND-LEGACY
 // CHECK-EXTEND-LEGACY: -fsanitize-coverage-type=1

test/Instrumentation/SanitizerCoverage/tracing.ll

 ; Test -sanitizer-coverage-experimental-tracing
-; RUN: opt < %s -sancov -sanitizer-coverage-level=2 -sanitizer-coverage-experimental-tracing  -S | FileCheck %s --check-prefix=CHECK1
-; RUN: opt < %s -sancov -sanitizer-coverage-level=3 -sanitizer-coverage-experimental-tracing  -S | FileCheck %s --check-prefix=CHECK3
+; RUN: opt < %s -sancov -sanitizer-coverage-level=2 -sanitizer-coverage-trace -S | FileCheck %s --check-prefix=CHECK1
+; RUN: opt < %s -sancov -sanitizer-coverage-level=3 -sanitizer-coverage-trace -S | FileCheck %s --check-prefix=CHECK3
 
 target datalayout = "e-p:64:64:64-i1:8:8-i8:8:8-i16:16:16-i32:32:32-i64:64:64-f32:32:32-f64:64:64-v64:64:64-v128:128:128-a0:0:64-s0:64:64-f80:128:128-n8:16:32:64"
 target triple = "x86_64-unknown-linux-gnu"
 define void @foo(i32* %a) sanitize_address {
 entry:
   %tobool = icmp eq i32* %a, null
   br i1 %tobool, label %if.end, label %if.then
 
   if.then:                                          ; preds = %entry
   store i32 0, i32* %a, align 4
   br label %if.end
 
   if.end:                                           ; preds = %entry, %if.then
   ret void
 }
 
 ; CHECK1-LABEL: define void @foo
-; CHECK1: call void @__sanitizer_cov_trace_func_enter
-; CHECK1: call void @__sanitizer_cov_trace_basic_block
-; CHECK1: call void @__sanitizer_cov_trace_basic_block
-; CHECK1-NOT: call void @__sanitizer_cov_trace_basic_block
+; CHECK1: call void @__sanitizer_cov_trace
+; CHECK1: call void @__sanitizer_cov_trace
+; CHECK1: call void @__sanitizer_cov_trace
+; CHECK1-NOT: call void @__sanitizer_cov_trace
 ; CHECK1: ret void
 
 ; CHECK3-LABEL: define void @foo
-; CHECK3: call void @__sanitizer_cov_trace_func_enter
-; CHECK3: call void @__sanitizer_cov_trace_basic_block
-; CHECK3: call void @__sanitizer_cov_trace_basic_block
-; CHECK3: call void @__sanitizer_cov_trace_basic_block
-; CHECK3-NOT: call void @__sanitizer_cov_trace_basic_block
+; CHECK3: call void @__sanitizer_cov_trace
+; CHECK3: call void @__sanitizer_cov_trace
+; CHECK3: call void @__sanitizer_cov_trace
+; CHECK3: call void @__sanitizer_cov_trace
+; CHECK3-NOT: call void @__sanitizer_cov_trace
 ; CHECK3: ret void

test/asan/TestCases/coverage-tracing.cc

-// Test -fsanitize-coverage=trace-bb
+// Test -fsanitize-coverage=trace
 //
-// RUN: %clangxx_asan -O1 -fsanitize-coverage=func,trace-bb %s -o %t
-// RUN: rm -rf   %T/coverage-tracing
-// RUN: mkdir %T/coverage-tracing
-// RUN: cd %T/coverage-tracing
-// RUN:  A=x;   %env_asan_opts=coverage=1:verbosity=1 %run %t $A 1   2>&1 | FileCheck %s --check-prefix=CHECK --check-prefix=CHECK1; mv trace-points.*.sancov $A.points
-// RUN:  A=f;   %env_asan_opts=coverage=1:verbosity=1 %run %t $A 1   2>&1 | FileCheck %s --check-prefix=CHECK --check-prefix=CHECK2; mv trace-points.*.sancov $A.points
-// RUN:  A=b;   %env_asan_opts=coverage=1:verbosity=1 %run %t $A 1   2>&1 | FileCheck %s --check-prefix=CHECK --check-prefix=CHECK2; mv trace-points.*.sancov $A.points
-// RUN:  A=bf;  %env_asan_opts=coverage=1:verbosity=1 %run %t $A 1   2>&1 | FileCheck %s --check-prefix=CHECK --check-prefix=CHECK3; mv trace-points.*.sancov $A.points
-// RUN:  A=fb;  %env_asan_opts=coverage=1:verbosity=1 %run %t $A 1   2>&1 | FileCheck %s --check-prefix=CHECK --check-prefix=CHECK3; mv trace-points.*.sancov $A.points
-// RUN:  A=ffb; %env_asan_opts=coverage=1:verbosity=1 %run %t $A 1   2>&1 | FileCheck %s --check-prefix=CHECK --check-prefix=CHECK4; mv trace-points.*.sancov $A.points
-// RUN:  A=fff; %env_asan_opts=coverage=1:verbosity=1 %run %t $A 1   2>&1 | FileCheck %s --check-prefix=CHECK --check-prefix=CHECK4; mv trace-points.*.sancov $A.points
-// RUN:  A=bbf; %env_asan_opts=coverage=1:verbosity=1 %run %t $A 100 2>&1 | FileCheck %s --check-prefix=CHECK --check-prefix=CHECK301; mv trace-points.*.sancov $A.points
-// RUN: diff f.points fff.points
-// RUN: diff bf.points fb.points
-// RUN: diff bf.points ffb.points
-// RUN: diff bf.points bbf.points
-// RUN: not diff x.points f.points
-// RUN: not diff x.points b.points
-// RUN: not diff x.points bf.points
-// RUN: not diff f.points b.points
-// RUN: not diff f.points bf.points
-// RUN: not diff b.points bf.points
-// RUN: rm -rf   %T/coverage-tracing
+// RUN: %clangxx_asan -O1 -fsanitize-coverage=func,trace %s -o %t
+// RUN:  A=x;   %env_asan_opts=coverage=1:verbosity=1 %run %t $A 1   2>&1 | FileCheck %s --check-prefix=CHECK --check-prefix=CHECK1
+// RUN:  A=f;   %env_asan_opts=coverage=1:verbosity=1 %run %t $A 1   2>&1 | FileCheck %s --check-prefix=CHECK --check-prefix=CHECK2
+// RUN:  A=fb;  %env_asan_opts=coverage=1:verbosity=1 %run %t $A 1   2>&1 | FileCheck %s --check-prefix=CHECK --check-prefix=CHECK3
+// RUN:  A=fff; %env_asan_opts=coverage=1:verbosity=1 %run %t $A 1   2>&1 | FileCheck %s --check-prefix=CHECK --check-prefix=CHECK4
+// RUN:  A=bbf; %env_asan_opts=coverage=1:verbosity=1 %run %t $A 100 2>&1 | FileCheck %s --check-prefix=CHECK --check-prefix=CHECK301
 //
 // REQUIRES: asan-64-bits
 // UNSUPPORTED: android
 
 #include <stdlib.h>
 volatile int sink;
 __attribute__((noinline)) void foo() { sink++; }
 __attribute__((noinline)) void bar() { sink++; }