[sanitizer coverage] coverage pc buffer

[aizatsky]

test & nits

[kcc]

include/sanitizer/coverage_interface.h

45

.. of the ...
Isn't the return value the same as __sanitizer_get_total_unique_coverage() ?
If so, it should be reflected in the comment or in the interface

lib/sanitizer_common/sanitizer_coverage_libcdep.cc

215

just in case, hide it under a flag (coverage_pc_buffer?).
We can make the flag on by default.

test/asan/TestCases/coverage-pcbuffer.cc

4 ↗

(On Diff #43934)

do you need coverage=1 here?

[aizatsky]

review

[aizatsky]

All done. PTAL.

[aizatsky]

nits

[kcc]

LGTM

lib/sanitizer_common/sanitizer_coverage_libcdep.cc

218

Style: I would prefer
X = nullptr;
if (cond())

X = ...

include/sanitizer/coverage_interface.h

#endif
   // Reset the basic-block (edge) coverage to the initial state.
   // Useful for in-process fuzzing to start collecting coverage from scratch.
   // Experimental, will likely not work for multi-threaded process.
   void __sanitizer_reset_coverage();
   // Set *data to the array of covered PCs and return the size of that array.
   // Some of the entries in *data will be zero.
   uintptr_t __sanitizer_get_coverage_guards(uintptr_t **data);
 
+  // Set *data to the growing buffer with covered PCs and return the size
+  // of the buffer. The entries are never zero.
+  // When only unique pcs are collected, the size is equal to
+  // __sanitizer_get_total_unique_coverage.
+  // WARNING: EXPERIMENTAL API.
+  uintptr_t __sanitizer_get_coverage_pc_buffer(uintptr_t **data);
+
   // The coverage instrumentation may optionally provide imprecise counters.
   // Rather than exposing the counter values to the user we instead map
   // the counters to a bitset.
   // Every counter is associated with 8 bits in the bitset.
   // We define 8 value ranges: 1, 2, 3, 4-7, 8-15, 16-31, 32-127, 128+
   // The i-th bit is set to 1 if the counter value is in the i-th range.
   // This counter-based coverage implementation is *not* thread-safe.
 

lib/sanitizer_common/sanitizer_coverage_libcdep.cc

void InitializeGuards(s32 *guards, uptr n, const char *module_name,
                         uptr caller_pc);
   void InitializeCounters(u8 *counters, uptr n);
   void ReinitializeGuards();
   uptr GetNumberOf8bitCounters();
   uptr Update8bitCounterBitsetAndClearCounters(u8 *bitset);
 
   uptr *data();
   uptr size();
+  uptr *buffer() const { return pc_buffer; }
 
  private:
   void DirectOpen();
   void UpdateModuleNameVec(uptr caller_pc, uptr range_beg, uptr range_end);
 
   // Maximal size pc array may ever grow.
   // We MmapNoReserve this space to ensure that the array is contiguous.
   static const uptr kPcArrayMaxSize = FIRST_32_SECOND_64(
private:
   atomic_uintptr_t pc_array_index;
   // Array size.
   atomic_uintptr_t pc_array_size;
   // Current file mapped size of the pc array.
   uptr pc_array_mapped_size;
   // Descriptor of the file mapped pc array.
   fd_t pc_fd;
 
+  uptr *pc_buffer;
+
   // Vector of coverage guard arrays, protected by mu.
   InternalMmapVectorNoCtor<s32*> guard_array_vec;
 
   struct NamedPcRange {
     const char *copied_module_name;
     uptr beg, end; // elements [beg,end) in pc_array.
   };
 
pc_array = reinterpret_cast<uptr *>(
       MmapNoReserveOrDie(sizeof(uptr) * kPcArrayMaxSize, "CovInit"));
   atomic_store(&pc_array_index, 0, memory_order_relaxed);
   if (common_flags()->coverage_direct) {
     atomic_store(&pc_array_size, 0, memory_order_relaxed);
   } else {
     atomic_store(&pc_array_size, kPcArrayMaxSize, memory_order_relaxed);
   }
 
+  if (common_flags()->coverage_pc_buffer)
+    pc_buffer = reinterpret_cast<uptr *>(MmapNoReserveOrDie(
+        sizeof(uptr) * kPcArrayMaxSize, "CovInit::pc_buffer"));
+  else
+    pc_buffer = nullptr;
+
   cc_array = reinterpret_cast<uptr **>(MmapNoReserveOrDie(
       sizeof(uptr *) * kCcArrayMaxSize, "CovInit::cc_array"));
   atomic_store(&cc_array_size, kCcArrayMaxSize, memory_order_relaxed);
   atomic_store(&cc_array_index, 0, memory_order_relaxed);
 
   // Allocate tr_event_array with a guard page at the end.
   tr_event_array = reinterpret_cast<u32 *>(MmapNoReserveOrDie(
       sizeof(tr_event_array[0]) * kTrEventArrayMaxSize + GetMmapGranularity(),
void CoverageData::Disable() {
   if (pc_array) {
     UnmapOrDie(pc_array, sizeof(uptr) * kPcArrayMaxSize);
     pc_array = nullptr;
   }
   if (cc_array) {
     UnmapOrDie(cc_array, sizeof(uptr *) * kCcArrayMaxSize);
     cc_array = nullptr;
   }
+  if (pc_buffer) {
+    UnmapOrDie(pc_buffer, sizeof(uptr) * kPcArrayMaxSize);
+    pc_buffer = nullptr;
+  }
   if (tr_event_array) {
     UnmapOrDie(tr_event_array,
                sizeof(tr_event_array[0]) * kTrEventArrayMaxSize +
                    GetMmapGranularity());
     tr_event_array = nullptr;
     tr_event_pointer = nullptr;
   }
   if (pc_fd != kInvalidFd) {
void CoverageData::Add(uptr pc, u32 *guard) {
 
   uptr idx = -guard_value - 1;
   if (idx >= atomic_load(&pc_array_index, memory_order_acquire))
     return;  // May happen after fork when pc_array_index becomes 0.
   CHECK_LT(idx * sizeof(uptr),
            atomic_load(&pc_array_size, memory_order_acquire));
   uptr counter = atomic_fetch_add(&coverage_counter, 1, memory_order_relaxed);
   pc_array[idx] = BundlePcAndCounter(pc, counter);
+  if (pc_buffer) pc_buffer[counter] = pc;
 }
 
 // Registers a pair caller=>callee.
 // When a given caller is seen for the first time, the callee_cache is added
 // to the global array cc_array, callee_cache[0] is set to caller and
 // callee_cache[1] is set to cache_size.
 // Then we are trying to add callee to callee_cache [2,cache_size) if it is
 // not there yet.

 }
 SANITIZER_INTERFACE_ATTRIBUTE
 uptr __sanitizer_get_coverage_guards(uptr **data) {
   *data = coverage_data.data();
   return coverage_data.size();
 }
 
 SANITIZER_INTERFACE_ATTRIBUTE
+uptr __sanitizer_get_coverage_pc_buffer(uptr **data) {
+  *data = coverage_data.buffer();
+  return __sanitizer_get_total_unique_coverage();
+}
+
+SANITIZER_INTERFACE_ATTRIBUTE
 uptr __sanitizer_get_number_of_counters() {
   return coverage_data.GetNumberOf8bitCounters();
 }
 
 SANITIZER_INTERFACE_ATTRIBUTE
 uptr __sanitizer_update_counter_bitset_and_clear_counters(u8 *bitset) {
   return coverage_data.Update8bitCounterBitsetAndClearCounters(bitset);
 }
 // Default empty implementations (weak). Users should redefine them.
 SANITIZER_INTERFACE_ATTRIBUTE SANITIZER_WEAK_ATTRIBUTE
 void __sanitizer_cov_trace_cmp() {}
 SANITIZER_INTERFACE_ATTRIBUTE SANITIZER_WEAK_ATTRIBUTE
 void __sanitizer_cov_trace_switch() {}
 } // extern "C"

lib/sanitizer_common/sanitizer_flags.inc

COMMON_FLAG(bool, coverage_counters, false,
             " to coverage counters will be dumped.")
 COMMON_FLAG(bool, coverage_direct, SANITIZER_ANDROID,
             "If set, coverage information will be dumped directly to a memory "
             "mapped file. This way data is not lost even if the process is "
             "suddenly killed.")
 COMMON_FLAG(const char *, coverage_dir, ".",
             "Target directory for coverage dumps. Defaults to the current "
             "directory.")
+COMMON_FLAG(bool, coverage_pc_buffer, true,
+            "If set (and if 'coverage' is set too), the pcs would be collected "
+            "in a buffer.")
 COMMON_FLAG(bool, full_address_space, false,
             "Sanitize complete address space; "
             "by default kernel area on 32-bit platforms will not be sanitized")
 COMMON_FLAG(bool, print_suppressions, true,
             "Print matched suppressions at exit.")
 COMMON_FLAG(
     bool, disable_coredump, (SANITIZER_WORDSIZE == 64),
     "Disable core dumping. By default, disable_core=1 on 64-bit to avoid "

test/asan/TestCases/coverage-pc-buffer.cc

+// Test __sanitizer_coverage_pc_buffer().
+
+// RUN: %clangxx_asan -fsanitize-coverage=edge %s -o %t && %run %t
+
+// UNSUPPORTED: android
+
+#include <assert.h>
+#include <sanitizer/coverage_interface.h>
+#include <stdio.h>
+
+static volatile int sink;
+__attribute__((noinline)) void bar() { sink = 2; }
+__attribute__((noinline)) void foo() { sink = 1; }
+
+void assertNotZeroPcs(uintptr_t *buf, uintptr_t size) {
+  assert(buf);
+  for (uintptr_t i = 0; i < size; ++i)
+    assert(buf[i]);
+}
+
+int main() {
+  uintptr_t *buf = NULL;
+  uintptr_t sz = __sanitizer_get_coverage_pc_buffer(&buf);
+  assertNotZeroPcs(buf, sz);
+  assert(sz);
+
+  foo();
+  bar();
+  uintptr_t *buf1 = NULL;
+  uintptr_t sz1 = __sanitizer_get_coverage_pc_buffer(&buf1);
+  assertNotZeroPcs(buf1, sz1);
+  assert(buf1 == buf);
+  assert(sz1 > sz);
+
+  bar();
+  uintptr_t *buf2 = NULL;
+  uintptr_t sz2 = __sanitizer_get_coverage_pc_buffer(&buf2);
+  assertNotZeroPcs(buf2, sz2);
+  assert(buf2 == buf);
+  assert(sz2 > sz1);
+
+  __sanitizer_reset_coverage();
+  uintptr_t *buf3 = NULL;
+  uintptr_t sz3 = __sanitizer_get_coverage_pc_buffer(&buf3);
+  assertNotZeroPcs(buf3, sz3);
+  assert(buf3 == buf);
+  assert(sz3 < sz2);
+}