[sanitizers] trace buffer API to use user-allocated buffer.

[aizatsky]

nits

[kcc]

include/sanitizer/coverage_interface.h

67

Is this really what you want?
Why do you need to reset the entire coverage just to rest the pc_buffer?
Sounds like an overkill.

[aizatsky]

include/sanitizer/coverage_interface.h

67

I don't have a separate counter for the length at this point. I'm using the same counter that is already available because I don't want to add more synchronization. Quite easy to add though. WDYT?

[kcc]

LGTM

include/sanitizer/coverage_interface.h

#endif
   // Reset the basic-block (edge) coverage to the initial state.
   // Useful for in-process fuzzing to start collecting coverage from scratch.
   // Experimental, will likely not work for multi-threaded process.
   void __sanitizer_reset_coverage();
   // Set *data to the array of covered PCs and return the size of that array.
   // Some of the entries in *data will be zero.
   uintptr_t __sanitizer_get_coverage_guards(uintptr_t **data);
 
-  // Set *data to the growing buffer with covered PCs and return the size
-  // of the buffer. The entries are never zero.
-  // When only unique pcs are collected, the size is equal to
-  // __sanitizer_get_total_unique_coverage.
-  // WARNING: EXPERIMENTAL API.
-  uintptr_t __sanitizer_get_coverage_pc_buffer(uintptr_t **data);
-
   // The coverage instrumentation may optionally provide imprecise counters.
   // Rather than exposing the counter values to the user we instead map
   // the counters to a bitset.
   // Every counter is associated with 8 bits in the bitset.
   // We define 8 value ranges: 1, 2, 3, 4-7, 8-15, 16-31, 32-127, 128+
   // The i-th bit is set to 1 if the counter value is in the i-th range.
   // This counter-based coverage implementation is *not* thread-safe.
 
   // Returns the number of registered coverage counters.
   uintptr_t __sanitizer_get_number_of_counters();
   // Updates the counter 'bitset', clears the counters and returns the number of
   // new bits in 'bitset'.
   // If 'bitset' is nullptr, only clears the counters.
   // Otherwise 'bitset' should be at least
   // __sanitizer_get_number_of_counters bytes long and 8-aligned.
   uintptr_t
   __sanitizer_update_counter_bitset_and_clear_counters(uint8_t *bitset);
+
+  //
+  //
+  //
+  //
+  // EXPERIMENTAL API
+  // Set an allocated buffer to record new coverage PCs as they are executed.
+  // Buffer length is specified in uptrs.
+  void __sanitizer_set_coverage_pc_buffer(uintptr_t *buffer, uintptr_t length);
+  // Number of pcs recorded in the buffer.
+  // Reset by __sanitizer_reset_coverage();
+  uintptr_t __sanitizer_get_coverage_pc_buffer_pos();
+
 #ifdef __cplusplus
 }  // extern "C"
 #endif
 
 #endif  // SANITIZER_COVERAG_INTERFACE_H

lib/asan/asan_win_dll_thunk.cc

 INTERFACE_FUNCTION(__sanitizer_cov_module_init)
 INTERFACE_FUNCTION(__sanitizer_cov_trace_basic_block)
 INTERFACE_FUNCTION(__sanitizer_cov_trace_func_enter)
 INTERFACE_FUNCTION(__sanitizer_cov_trace_cmp)
 INTERFACE_FUNCTION(__sanitizer_cov_trace_switch)
 INTERFACE_FUNCTION(__sanitizer_cov_with_check)
 INTERFACE_FUNCTION(__sanitizer_get_allocated_size)
 INTERFACE_FUNCTION(__sanitizer_get_coverage_guards)
-INTERFACE_FUNCTION(__sanitizer_get_coverage_pc_buffer)
+INTERFACE_FUNCTION(__sanitizer_get_coverage_pc_buffer_pos)
 INTERFACE_FUNCTION(__sanitizer_get_current_allocated_bytes)
 INTERFACE_FUNCTION(__sanitizer_get_estimated_allocated_size)
 INTERFACE_FUNCTION(__sanitizer_get_free_bytes)
 INTERFACE_FUNCTION(__sanitizer_get_heap_size)
 INTERFACE_FUNCTION(__sanitizer_get_ownership)
 INTERFACE_FUNCTION(__sanitizer_get_total_unique_caller_callee_pairs)
 INTERFACE_FUNCTION(__sanitizer_get_total_unique_coverage)
 INTERFACE_FUNCTION(__sanitizer_get_unmapped_bytes)
 INTERFACE_FUNCTION(__sanitizer_maybe_open_cov_file)
 INTERFACE_FUNCTION(__sanitizer_print_stack_trace)
 INTERFACE_FUNCTION(__sanitizer_ptr_cmp)
 INTERFACE_FUNCTION(__sanitizer_ptr_sub)
 INTERFACE_FUNCTION(__sanitizer_report_error_summary)
 INTERFACE_FUNCTION(__sanitizer_reset_coverage)
 INTERFACE_FUNCTION(__sanitizer_get_number_of_counters)
 INTERFACE_FUNCTION(__sanitizer_update_counter_bitset_and_clear_counters)
 INTERFACE_FUNCTION(__sanitizer_sandbox_on_notify)
+INTERFACE_FUNCTION(__sanitizer_set_coverage_pc_buffer)
 INTERFACE_FUNCTION(__sanitizer_set_death_callback)
 INTERFACE_FUNCTION(__sanitizer_set_report_path)
 INTERFACE_FUNCTION(__sanitizer_set_report_fd)
 INTERFACE_FUNCTION(__sanitizer_unaligned_load16)
 INTERFACE_FUNCTION(__sanitizer_unaligned_load32)
 INTERFACE_FUNCTION(__sanitizer_unaligned_load64)
 INTERFACE_FUNCTION(__sanitizer_unaligned_store16)
 INTERFACE_FUNCTION(__sanitizer_unaligned_store32)

lib/sanitizer_common/sanitizer_coverage_libcdep.cc

void InitializeGuards(s32 *guards, uptr n, const char *module_name,
                         uptr caller_pc);
   void InitializeCounters(u8 *counters, uptr n);
   void ReinitializeGuards();
   uptr GetNumberOf8bitCounters();
   uptr Update8bitCounterBitsetAndClearCounters(u8 *bitset);
 
   uptr *data();
   uptr size() const;
-  uptr *buffer() const { return pc_buffer; }
+
+  void SetPcBuffer(uptr* data, uptr length) {
+    pc_buffer = data;
+    pc_buffer_len = length;
+  }
 
  private:
   struct NamedPcRange {
     const char *copied_module_name;
     uptr beg, end; // elements [beg,end) in pc_array.
   };
 
   void DirectOpen();
private:
   // Array size.
   atomic_uintptr_t pc_array_size;
   // Current file mapped size of the pc array.
   uptr pc_array_mapped_size;
   // Descriptor of the file mapped pc array.
   fd_t pc_fd;
 
   uptr *pc_buffer;
+  uptr pc_buffer_len;
 
   // Vector of coverage guard arrays, protected by mu.
   InternalMmapVectorNoCtor<s32*> guard_array_vec;
 
   // Vector of module and compilation unit pc ranges.
   InternalMmapVectorNoCtor<NamedPcRange> comp_unit_name_vec;
   InternalMmapVectorNoCtor<NamedPcRange> module_name_vec;
 
void CoverageData::Enable() {
   atomic_store(&pc_array_index, 0, memory_order_relaxed);
   if (common_flags()->coverage_direct) {
     atomic_store(&pc_array_size, 0, memory_order_relaxed);
   } else {
     atomic_store(&pc_array_size, kPcArrayMaxSize, memory_order_relaxed);
   }
 
   pc_buffer = nullptr;
-  if (common_flags()->coverage_pc_buffer)
-    pc_buffer = reinterpret_cast<uptr *>(MmapNoReserveOrDie(
-        sizeof(uptr) * kPcArrayMaxSize, "CovInit::pc_buffer"));
+  pc_buffer_len = 0;
 
   cc_array = reinterpret_cast<uptr **>(MmapNoReserveOrDie(
       sizeof(uptr *) * kCcArrayMaxSize, "CovInit::cc_array"));
   atomic_store(&cc_array_size, kCcArrayMaxSize, memory_order_relaxed);
   atomic_store(&cc_array_index, 0, memory_order_relaxed);
 
   // Allocate tr_event_array with a guard page at the end.
   tr_event_array = reinterpret_cast<u32 *>(MmapNoReserveOrDie(
void CoverageData::Disable() {
   if (pc_array) {
     UnmapOrDie(pc_array, sizeof(uptr) * kPcArrayMaxSize);
     pc_array = nullptr;
   }
   if (cc_array) {
     UnmapOrDie(cc_array, sizeof(uptr *) * kCcArrayMaxSize);
     cc_array = nullptr;
   }
-  if (pc_buffer) {
-    UnmapOrDie(pc_buffer, sizeof(uptr) * kPcArrayMaxSize);
-    pc_buffer = nullptr;
-  }
   if (tr_event_array) {
     UnmapOrDie(tr_event_array,
                sizeof(tr_event_array[0]) * kTrEventArrayMaxSize +
                    GetMmapGranularity());
     tr_event_array = nullptr;
     tr_event_pointer = nullptr;
   }
   if (pc_fd != kInvalidFd) {
void CoverageData::Add(uptr pc, u32 *guard) {
 
   uptr idx = -guard_value - 1;
   if (idx >= atomic_load(&pc_array_index, memory_order_acquire))
     return;  // May happen after fork when pc_array_index becomes 0.
   CHECK_LT(idx * sizeof(uptr),
            atomic_load(&pc_array_size, memory_order_acquire));
   uptr counter = atomic_fetch_add(&coverage_counter, 1, memory_order_relaxed);
   pc_array[idx] = BundlePcAndCounter(pc, counter);
-  if (pc_buffer) pc_buffer[counter] = pc;
+  if (pc_buffer && counter < pc_buffer_len) pc_buffer[counter] = pc;
 }
 
 // Registers a pair caller=>callee.
 // When a given caller is seen for the first time, the callee_cache is added
 // to the global array cc_array, callee_cache[0] is set to caller and
 // callee_cache[1] is set to cache_size.
 // Then we are trying to add callee to callee_cache [2,cache_size) if it is
 // not there yet.

 }
 SANITIZER_INTERFACE_ATTRIBUTE
 uptr __sanitizer_get_coverage_guards(uptr **data) {
   *data = coverage_data.data();
   return coverage_data.size();
 }
 
 SANITIZER_INTERFACE_ATTRIBUTE
-uptr __sanitizer_get_coverage_pc_buffer(uptr **data) {
-  *data = coverage_data.buffer();
+void __sanitizer_set_coverage_pc_buffer(uptr *data, uptr length) {
+  coverage_data.SetPcBuffer(data, length);
+}
+
+SANITIZER_INTERFACE_ATTRIBUTE
+uptr __sanitizer_get_coverage_pc_buffer_pos() {
   return __sanitizer_get_total_unique_coverage();
 }
 
 SANITIZER_INTERFACE_ATTRIBUTE
 uptr __sanitizer_get_number_of_counters() {
   return coverage_data.GetNumberOf8bitCounters();
 }
 

lib/sanitizer_common/sanitizer_flags.inc

COMMON_FLAG(bool, coverage_counters, false,
             " to coverage counters will be dumped.")
 COMMON_FLAG(bool, coverage_direct, SANITIZER_ANDROID,
             "If set, coverage information will be dumped directly to a memory "
             "mapped file. This way data is not lost even if the process is "
             "suddenly killed.")
 COMMON_FLAG(const char *, coverage_dir, ".",
             "Target directory for coverage dumps. Defaults to the current "
             "directory.")
-COMMON_FLAG(bool, coverage_pc_buffer, true,
-            "If set (and if 'coverage' is set too), the pcs would be collected "
-            "in a buffer.")
 COMMON_FLAG(bool, full_address_space, false,
             "Sanitize complete address space; "
             "by default kernel area on 32-bit platforms will not be sanitized")
 COMMON_FLAG(bool, print_suppressions, true,
             "Print matched suppressions at exit.")
 COMMON_FLAG(
     bool, disable_coredump, (SANITIZER_WORDSIZE == 64),
     "Disable core dumping. By default, disable_core=1 on 64-bit to avoid "

test/asan/TestCases/coverage-pc-buffer.cc

 // Test __sanitizer_coverage_pc_buffer().
 
-// RUN: %clangxx_asan -fsanitize-coverage=edge %s -o %t && %run %t
+// RUN: %clangxx_asan -fsanitize-coverage=edge -std=c++11 %s -O3 -o %t && %run %t
 
 // UNSUPPORTED: android
 
 #include <assert.h>
+#include <memory>
 #include <sanitizer/coverage_interface.h>
+#include <stdint.h>
 #include <stdio.h>
 
 static volatile int sink;
 __attribute__((noinline)) void bar() { sink = 2; }
 __attribute__((noinline)) void foo() { sink = 1; }
 
 void assertNotZeroPcs(uintptr_t *buf, uintptr_t size) {
   assert(buf);
   for (uintptr_t i = 0; i < size; ++i)
     assert(buf[i]);
 }
 
 int main() {
+  uintptr_t buf_size = 1 << 20;
+  std::unique_ptr<uintptr_t[]> buf(new uintptr_t[buf_size]);
+  __sanitizer_set_coverage_pc_buffer(buf.get(), buf_size);
+
   {
-    uintptr_t *buf = NULL;
-    uintptr_t sz = __sanitizer_get_coverage_pc_buffer(&buf);
-    assertNotZeroPcs(buf, sz);
+    uintptr_t sz = __sanitizer_get_coverage_pc_buffer_pos();
+    assertNotZeroPcs(buf.get(), sz);
     assert(sz);
   }
 
   {
-    uintptr_t *buf = NULL;
-    uintptr_t sz = __sanitizer_get_coverage_pc_buffer(&buf);
+    uintptr_t sz = __sanitizer_get_coverage_pc_buffer_pos();
     // call functions for the first time.
     foo();
     bar();
-    uintptr_t *buf1 = NULL;
-    uintptr_t sz1 = __sanitizer_get_coverage_pc_buffer(&buf1);
-    assertNotZeroPcs(buf1, sz1);
-    assert(buf1 == buf);
+    uintptr_t sz1 = __sanitizer_get_coverage_pc_buffer_pos();
+    assertNotZeroPcs(buf.get(), sz1);
     assert(sz1 > sz);
   }
 
   {
-    uintptr_t *buf = NULL;
-    uintptr_t sz = __sanitizer_get_coverage_pc_buffer(&buf);
+    uintptr_t sz = __sanitizer_get_coverage_pc_buffer_pos();
     // second call shouldn't increase coverage.
     bar();
-    uintptr_t *buf1 = NULL;
-    uintptr_t sz1 = __sanitizer_get_coverage_pc_buffer(&buf1);
-    assertNotZeroPcs(buf1, sz1);
-    assert(buf1 == buf);
+    uintptr_t sz1 = __sanitizer_get_coverage_pc_buffer_pos();
     assert(sz1 == sz);
+    assertNotZeroPcs(buf.get(), sz1);
   }
 
   {
-    uintptr_t *buf = NULL;
-    uintptr_t sz = __sanitizer_get_coverage_pc_buffer(&buf);
+    uintptr_t sz = __sanitizer_get_coverage_pc_buffer_pos();
     // reset coverage to 0.
     __sanitizer_reset_coverage();
-    uintptr_t *buf1 = NULL;
-    uintptr_t sz1 = __sanitizer_get_coverage_pc_buffer(&buf1);
-    assertNotZeroPcs(buf1, sz1);
-    assert(buf1 == buf);
+    uintptr_t sz1 = __sanitizer_get_coverage_pc_buffer_pos();
+    assertNotZeroPcs(buf.get(), sz1);
     assert(sz1 < sz);
   }
 }