[libFuzzer] Port to Windows

[metzman]

Summary

Port libFuzzer to windows-msvc.
This patch allows libFuzzer targets to be built and run on Windows, using -fsanitize=fuzzer and/or fsanitize=fuzzer-no-link. It allows these forms of coverage instrumentation to work on Windows as well.
It does not fix all issues, such as those with -fsanitize-coverage=stack-depth, which is not usable on Windows as of this patch.
It also does not fix any libFuzzer integration tests. Nearly all of them fail to compile, fixing them will come in a later patch, so libFuzzer tests are disabled on Windows until them.

[metzman]

Run clang-format

[metzman]

@morehouse Can you please take a look?

llvm/test/Instrumentation/SanitizerCoverage/coff-pc-table-inline-8bit-counters.ll

1 ↗

(On Diff #161783)

@kcc I wrote a lit test for a basic sanity check.
I think the instrumentation on windows is also worth testing in check-fuzzer, but I didn't add a test there because check-fuzzer is still broken on Windows.
I will add the test there with my patch fixing check-fuzzer.

[morehouse]

llvm/lib/Transforms/Instrumentation/SanitizerCoverage.cpp

815

Nit: else is unnecessary.

[morehouse]

compiler-rt/lib/fuzzer/FuzzerTracePC.cpp

35

Can we make an OS-specific macro for __attribute__((tls_model("initial-exec"))) and/or thread_local instead?

compiler-rt/lib/sanitizer_common/sanitizer_coverage_win_sections.cc

23

What happens without align(1) and uint64_t?

llvm/test/Instrumentation/SanitizerCoverage/coff-pc-table-inline-8bit-counters.ll

23 ↗

(On Diff #161797)

Does body of foo matter for this test? Can it just return?

[metzman]

Fix nit (remove unnecessary else) and minimize integration test.

[metzman]

compiler-rt/lib/fuzzer/FuzzerTracePC.cpp

35

I'm looking into this, but it looks a bit complicated to get this working, as there are two problems here:

1. How to share the symbol with sanitizer_coverage_libcdep_new.cc (I assume techniques from sanitizer_win_defs.h can work).
2. How to combine thread_local with ATTRIBUTE_INTERFACE (__declspec(dllexport)) on windows since this isn't allowed (I think solution will be not using dllexport for __sancov_lowest_stack).

Will investigate this further.

compiler-rt/lib/sanitizer_common/sanitizer_coverage_win_sections.cc

23

Without align(1) the arrays get aligned so that in between __start___sancov_cntrs and __stop___sancov_cntrs and in between __start___sancov_pcs and __stop___sancov_pcs there are padding bytes, causing libFuzzer to think there is an incorrect number of PCs and counters, which causes an early exit.
Without uint64_t (but with align(1)) sancov_pcs gets word aligned (ie: there is a 4 byte gap between __start_sancov_pcs and the first element in the array), causing the same issue.

tl;dr without either (or without incremental:no) I get:

ERROR: The size of coverage PC tables does not match the
number of instrumented PCs. This might be a compiler bug,
please contact the libFuzzer developers.
Also check https://bugs.llvm.org/show_bug.cgi?id=34636
for possible workarounds (tl;dr: don't use the old GNU ld)

llvm/lib/Transforms/Instrumentation/SanitizerCoverage.cpp

815

Done.

llvm/test/Instrumentation/SanitizerCoverage/coff-pc-table-inline-8bit-counters.ll

23 ↗

(On Diff #161797)

No. Yes it can return.
Good catch, I've fixed this.

[morehouse]

llvm/test/Instrumentation/SanitizerCoverage/coff-pc-table-inline-8bit-counters.ll

23 ↗

(On Diff #161797)

Can it be simplified more? For example, inline-8bit-counters.ll does:

define void @foo() {
entry:
  ret void
}

[metzman]

Make lit test minimal

[metzman]

llvm/test/Instrumentation/SanitizerCoverage/coff-pc-table-inline-8bit-counters.ll

23 ↗

(On Diff #161797)

Ah my bad. I think it is minimal now.

[metzman]

Replace solution for stack-depth with a prettier one.

[morehouse]

compiler-rt/lib/fuzzer/FuzzerTracePC.cpp

527

Rather than having these ifdefs, can we adjust the parameters passed to these init functions (i.e. modify SecStart and SecEnd in SanitizerCoverage.cpp)?

Then users of SanCov won't have to do this manual adjustment for Windows either.

[metzman]

compiler-rt/lib/fuzzer/FuzzerTracePC.cpp

527

I don't think we can adjust the parameters using the current approach.
Under the current approach __start___sancov_pcs (pcs_beg) doesnt point to the start of the pc array on windows, it points to data that comes before the array.
I'm pretty sure this was an issue with the initial port that used guards (ie: it should have added to the parameters), just no one noticed because there was no check to tell if the array size was correct.

[metzman]

compiler-rt/lib/fuzzer/FuzzerTracePC.cpp

527

Actually, I have an idea for how to do this. I'll get back to you.

[metzman]

Use less #ifdefs and fix issue with guards (because of failing lit test)

[metzman]

Update comments

[metzman]

compiler-rt/lib/fuzzer/FuzzerTracePC.cpp

527

I now do this addition in SanitizerCoverage.cpp as you suggested. There are no more #ifdefs in this file.

Thank you for helping me figure out how to do this offline.

[metzman]

Reid could you please take a look.
This patch gets libFuzzer working on Windows.
Most functionality seems to work, a few features are not yet supported and the tests don't yet work. I plan on fixing these issues soon.

[rnk]

compiler-rt/lib/fuzzer/tests/FuzzerUnittest.cpp

33–38

Basename should be fixed to handle / and \ on windows.

compiler-rt/lib/sanitizer_common/sanitizer_coverage_win_sections.cc

23

I'm not sure align(1) really addresses this problem. The Microsoft linker will add padding either way for incremental links. For ASan global metadata registration, we had to teach the runtime to tolerate zero padding.

llvm/lib/Transforms/Instrumentation/SanitizerCoverage.cpp

276–281

I kind of prefer ifdefs in runtime C code over platform-specific instrumentation. @morehouse, wdyt?

814

I would recommend naming your sections:
.SCOV$CM
.SCOV$PM
.SCOV$GM

Your start markers and end markers will work just the same as .SCOV$[CPG][AZ].

You should also add a /merge:.SCOV=.data flag with #pragma comment linker in the sanitizer coverage runtime. That way the final PE file won't have a .SCOV section, it'll all be in .data, laid out the way you want.

[metzman]

@rnk thank you for the feedback.
I will fix the issues you have raised shortly, but I have some questions on the feedback you left.

compiler-rt/lib/sanitizer_common/sanitizer_coverage_win_sections.cc

23

Ouch.
Wouldn't incremental:no (which I set in MSVC.cpp) prevent incremental links?
Or is this insufficient since people should be able to link outside of clang?
(I assume it is not sufficient, since I got that idea from ASan).

I will take a look at what ASAN does to handle padding and try to implement something similar.

llvm/lib/Transforms/Instrumentation/SanitizerCoverage.cpp

814

Can the PCTable which is constant go into .data?
Initially I tried having one section but if I recall correctly PCTable being constant caused issues.
I can look into this further though, maybe the solution is to make PCTable non-constant on windows

[metzman]

Fix BaseName to handle '/' and '\' on Windows.

[morehouse]

llvm/lib/Transforms/Instrumentation/SanitizerCoverage.cpp

276–281

Why would you prefer that way?

My reasoning is that its better to fix this in one place rather than expect every client of SanCov to place ifdefs for Windows in their code.

[metzman]

Undo unnecessary change to unittests.

[metzman]

compiler-rt/lib/sanitizer_common/sanitizer_coverage_win_sections.cc

23

@rnk and @kcc (assuming we can't prevent incremental links and need to deal with padding):
Does searching for a magic string at runtime (and adding one during instrumentation) seem like a good way to determine the start and end of the array in spite of padding?
I don't think I can simply skip over zero bytes because of the PC Table. The PC Table can legitimately start with zeros since each entry in the table starts with an address.
The end of the PCTable can be determined without a magic string but the end of the guard and counter arrays cannot, unless they are initialized to something other than 0, so I think using magic strings to determine start and end of all arrays makes most sense.

[rnk]

compiler-rt/lib/sanitizer_common/sanitizer_coverage_win_sections.cc

23

I'm not sure we can. I think if your approach works, we might want to commit it and then debug the problems in alternative VC link configurations. It might be OK if libfuzzer only works on windows with lld.

llvm/lib/Transforms/Instrumentation/SanitizerCoverage.cpp

814

I see, I checked and I thought I didn't see any constant data. That should use a separate section, maybe .SCOVP$M as originally designed. The important thing isn't having less COFF sections, it's having fewer PE sections. You can check that they get eliminated with dumpbin /summary on a libfuzzer exe.

[metzman]

Merge guard and counter sections with .data section.
Also add better comments.

[metzman]

compiler-rt/lib/sanitizer_common/sanitizer_coverage_win_sections.cc

23

I've merged the guard and counter array with the .data section.
The PCTable which is constant, is in its own section.

I think if your approach works, we might want to commit it and then debug the problems in alternative VC link configurations

My approach works with a decent amount of examples I've tried (both with use-ld=lld and without). I suppose we will learn more once we start using it in Chrome.

Have you seem the linker adding padding in spite of /incremental:no being used in ASAN builds?

llvm/lib/Transforms/Instrumentation/SanitizerCoverage.cpp

276–281

@rnk do you still want me to change this?

[metzman]

run clang format.

[rnk]

One last thing and I think we can merge this.

compiler-rt/lib/sanitizer_common/sanitizer_coverage_win_sections.cc

23

Any reason not to do add this?

#pragma comment(linker, "/MERGE:.SCOVP=.rdata")

It should get the readonly behavior you want without making an extra PE section.

Have you seem the linker adding padding in spite of /incremental:no being used in ASAN builds?

No, in a non-incremental build, MSVC will only add padding to satisfy the alignment of each entry.

I guess I see why you downgrade the uin64_t's to one byte alignment, it's mainly to avoid the zero entry at the end of the array.

llvm/lib/Transforms/Instrumentation/SanitizerCoverage.cpp

276–281

Normally we follow the principle that the more complexity we can move from instrumentation to runtime code, the better. If there are multiple clients, then keeping it here makes sense.

[metzman]

Merge SCOVP section with .rdata

[rnk]

lgtm

[metzman]

Thank you @rnk and @morehouse for your reviews.

This can't be landed if it causes ninja check-all to fail right?
This is happening on Windows now because of fuzzer test failures (check-all is passing on Linux and check-llvm check-clang and check-asan are passing on Windows).
If it can't be landed because of this then I guess I will disable libFuzzer on Windows from being built (or maybe just all of the fuzzer tests if possible).

Also, could one of you please commit this patch for me? I'm not an LLVM committer so I'm unable to do this myself.
(If it can't be landed then I'll just ping whoever volunteers)

Thanks!

[rnk]

In D51022#1215212, @metzman wrote:

Thank you @rnk and @morehouse for your reviews.

This can't be landed if it causes ninja check-all to fail right?
This is happening on Windows now because of fuzzer test failures (check-all is passing on Linux and check-llvm check-clang and check-asan are passing on Windows).
If it can't be landed because of this then I guess I will disable libFuzzer on Windows from being built (or maybe just all of the fuzzer tests if possible).

I thought we removed libfuzzer from check-all. I'll check the situation.

Also, could one of you please commit this patch for me? I'm not an LLVM committer so I'm unable to do this myself.
(If it can't be landed then I'll just ping whoever volunteers)

Thanks!

[morehouse]

We will need to disable failing tests for Windows. libFuzzer does run as part of check-all now.

[metzman]

Disable libFuzzer tests on Windows.

[metzman]

In D51022#1215225, @morehouse wrote:

We will need to disable failing tests for Windows. libFuzzer does run as part of check-all now.

Pretty much all lit tests are failing.

I've disabled all libFuzzer tests on Windows. check-all passes on Windows now.

[metzman]

Improve comment

[metzman]

Improve comments.

[metzman]

Fix failing assertions by using CreateGEP instead of CreateAdd to add to a pointer.

[metzman]

Trivial NFC to use local variable instead of accessing attribute twice.

[metzman]

• Port libFuzzer to Windows

clang/lib/Driver/ToolChains/MSVC.cpp

void visualstudio::Linker::ConstructJob(Compilation &C, const JobAction &JA,
   if (DLL) {
     CmdArgs.push_back(Args.MakeArgString("-dll"));
 
     SmallString<128> ImplibName(Output.getFilename());
     llvm::sys::path::replace_extension(ImplibName, "lib");
     CmdArgs.push_back(Args.MakeArgString(std::string("-implib:") + ImplibName));
   }
 
+  if (TC.getSanitizerArgs().needsFuzzer()) {
+    if (!Args.hasArg(options::OPT_shared))
+      CmdArgs.push_back(
+          Args.MakeArgString(std::string("-wholearchive:") +
+                             TC.getCompilerRTArgString(Args, "fuzzer", false)));
+    CmdArgs.push_back(Args.MakeArgString("-debug"));
+    // Prevent the linker from padding sections we use for instrumentation
+    // arrays.
+    CmdArgs.push_back(Args.MakeArgString("-incremental:no"));
+  }
+
   if (TC.getSanitizerArgs().needsAsanRt()) {
     CmdArgs.push_back(Args.MakeArgString("-debug"));
     CmdArgs.push_back(Args.MakeArgString("-incremental:no"));
     if (TC.getSanitizerArgs().needsSharedRt() ||
         Args.hasArg(options::OPT__SLASH_MD, options::OPT__SLASH_MDd)) {
       for (const auto &Lib : {"asan_dynamic", "asan_dynamic_runtime_thunk"})
         CmdArgs.push_back(TC.getCompilerRTArgString(Args, Lib));
       // Make sure the dynamic runtime thunk is not optimized out at link time
else
           (Twine("msvc") + MSVT.getAsString() + Twine('-') + ObjFmt).str());
   }
   return Triple.getTriple();
 }
 
 SanitizerMask MSVCToolChain::getSupportedSanitizers() const {
   SanitizerMask Res = ToolChain::getSupportedSanitizers();
   Res |= SanitizerKind::Address;
+  Res |= SanitizerKind::Fuzzer;
+  Res |= SanitizerKind::FuzzerNoLink;
   Res &= ~SanitizerKind::CFIMFCall;
   return Res;
 }
 
 static void TranslateOptArg(Arg *A, llvm::opt::DerivedArgList &DAL,
                             bool SupportsForcingFramePointer,
                             const char *ExpandChar, const OptTable &Opts) {
   assert(A->getOption().matches(options::OPT__SLASH_O));

compiler-rt/cmake/config-ix.cmake

 if (COMPILER_RT_HAS_SANITIZER_COMMON AND XRAY_SUPPORTED_ARCH AND
     OS_NAME MATCHES "Darwin|Linux|FreeBSD|NetBSD|OpenBSD")
   set(COMPILER_RT_HAS_XRAY TRUE)
 else()
   set(COMPILER_RT_HAS_XRAY FALSE)
 endif()
 
 if (COMPILER_RT_HAS_SANITIZER_COMMON AND FUZZER_SUPPORTED_ARCH AND
-    OS_NAME MATCHES "Android|Darwin|Linux|NetBSD|FreeBSD|OpenBSD|Fuchsia")
+    OS_NAME MATCHES "Android|Darwin|Linux|NetBSD|FreeBSD|OpenBSD|Fuchsia|Windows")
   set(COMPILER_RT_HAS_FUZZER TRUE)
 else()
   set(COMPILER_RT_HAS_FUZZER FALSE)
 endif()
 
 if (COMPILER_RT_HAS_SANITIZER_COMMON AND SHADOWCALLSTACK_SUPPORTED_ARCH AND
     OS_NAME MATCHES "Linux|Android")
   set(COMPILER_RT_HAS_SHADOWCALLSTACK TRUE)
 else()
   set(COMPILER_RT_HAS_SHADOWCALLSTACK FALSE)
 endif()

compiler-rt/lib/fuzzer/FuzzerIOWindows.cpp

if (Att == INVALID_FILE_ATTRIBUTES) {
     Printf("GetFileAttributesA() failed for \"%s\" (Error code: %lu).\n",
         Path.c_str(), GetLastError());
     return false;
   }
 
   return IsFile(Path, Att);
 }
 
+size_t FileSize(const std::string& Path) {
+  WIN32_FILE_ATTRIBUTE_DATA attr;
+  if (!GetFileAttributesExA(Path.c_str(), GetFileExInfoStandard, &attr)) {
+    Printf("GetFileAttributesExA() failed for \"%s\" (Error code: %lu).\n",
+           Path.c_str(), GetLastError());
+    return 0;
+  }
+  ULARGE_INTEGER size;
+  size.HighPart = attr.nFileSizeHigh;
+  size.LowPart = attr.nFileSizeLow;
+  return size.QuadPart;
+}
+
 void ListFilesInDirRecursive(const std::string &Dir, long *Epoch,
                              Vector<std::string> *V, bool TopDir) {
   auto E = GetEpoch(Dir);
   if (Epoch)
     if (E && *Epoch >= E) return;
 
   std::string Path(Dir);
   assert(!Path.empty());

compiler-rt/lib/fuzzer/FuzzerTracePC.cpp

 // These are declared as global variables named "__sancov_*" to simplify
 // experiments with inlined instrumentation.
 alignas(64) ATTRIBUTE_INTERFACE
 uint8_t __sancov_trace_pc_guard_8bit_counters[fuzzer::TracePC::kNumPCs];
 
 ATTRIBUTE_INTERFACE
 uintptr_t __sancov_trace_pc_pcs[fuzzer::TracePC::kNumPCs];
 
+// Disable on Windows since it is not a main feature and causes a compilation error.
+#if !LIBFUZZER_WINDOWS
 // Used by -fsanitize-coverage=stack-depth to track stack depth
 ATTRIBUTE_INTERFACE __attribute__((tls_model("initial-exec")))
 thread_local uintptr_t __sancov_lowest_stack;
+#endif
 
 namespace fuzzer {
 
 TracePC TPC;
 
 uint8_t *TracePC::Counters() const {
   return __sancov_trace_pc_guard_8bit_counters;
 }
for (size_t i = 0; i < NumModulesWithInline8bitCounters; i++) {
     uint8_t *Beg = ModuleCounters[i].Start;
     size_t Size = ModuleCounters[i].Stop - Beg;
     memset(Beg, 0, Size);
   }
 }
 
 ATTRIBUTE_NO_SANITIZE_ALL
 void TracePC::RecordInitialStack() {
+#if !LIBFUZZER_WINDOWS
   int stack;
   __sancov_lowest_stack = InitialStack = reinterpret_cast<uintptr_t>(&stack);
+#endif
 }
 
 uintptr_t TracePC::GetMaxStackOffset() const {
+#if !LIBFUZZER_WINDOWS
   return InitialStack - __sancov_lowest_stack;  // Stack grows down
+#else
+  return 0;
+#endif
 }
 
 } // namespace fuzzer
 
 extern "C" {
 ATTRIBUTE_INTERFACE
 ATTRIBUTE_NO_SANITIZE_ALL
 void __sanitizer_cov_trace_pc_guard(uint32_t *Guard) {

 
 ATTRIBUTE_INTERFACE
 void __sanitizer_cov_trace_pc_guard_init(uint32_t *Start, uint32_t *Stop) {
   fuzzer::TPC.HandleInit(Start, Stop);
 }
 
 ATTRIBUTE_INTERFACE
 void __sanitizer_cov_8bit_counters_init(uint8_t *Start, uint8_t *Stop) {
+  // On Windows, Start actually points to a uint64_t located before the counter
+  // array (see sanitizer_coverage_win_sections.cc for why). So we need to
+  // to update Start to point to the counter array.
+#if LIBFUZZER_WINDOWS
+  Start += sizeof(uint64_t);
+#endif
   fuzzer::TPC.HandleInline8bitCountersInit(Start, Stop);
 }
 
 ATTRIBUTE_INTERFACE
 void __sanitizer_cov_pcs_init(const uintptr_t *pcs_beg,
                               const uintptr_t *pcs_end) {
+  // On Windows, pcs_beg actually points to a uint64_t located before the pc
+  // array (see sanitizer_coverage_win_sections.cc for why). So we need to
+  // to update pcs_beg to point to the pc array.
+#if LIBFUZZER_WINDOWS
+  const uint8_t *pcs_beg_8bit = (const uint8_t *)pcs_beg;
+  pcs_beg_8bit += sizeof(uint64_t);
+  pcs_beg = (const uintptr_t *)pcs_beg_8bit;
+#endif
   fuzzer::TPC.HandlePCsInit(pcs_beg, pcs_end);
 }
 
 ATTRIBUTE_INTERFACE
 ATTRIBUTE_NO_SANITIZE_ALL
 void __sanitizer_cov_trace_pc_indir(uintptr_t Callee) {
   uintptr_t PC = reinterpret_cast<uintptr_t>(__builtin_return_address(0));
   fuzzer::TPC.HandleCallerCallee(PC, Callee);

compiler-rt/lib/fuzzer/FuzzerUtilWindows.cpp

const void *SearchMemory(const void *Data, size_t DataLen, const void *Patt,
   for (const char *It = Cdata; It < End; ++It)
     if (It[0] == Cpatt[0] && memcmp(It, Cpatt, PattLen) == 0)
       return It;
 
   return NULL;
 }
 
 std::string DisassembleCmd(const std::string &FileName) {
-  if (ExecuteCommand("dumpbin /summary > nul") == 0)
+  Vector<std::string> command_vector;
+  command_vector.push_back("dumpbin /summary > nul");
+  if (ExecuteCommand(Command(command_vector)) == 0)
     return "dumpbin /disasm " + FileName;
   Printf("libFuzzer: couldn't find tool to disassemble (dumpbin)\n");
   exit(1);
 }
 
 std::string SearchRegexCmd(const std::string &Regex) {
   return "findstr /r \"" + Regex + "\"";
 }
 
 } // namespace fuzzer
 
 #endif // LIBFUZZER_WINDOWS

compiler-rt/lib/fuzzer/tests/CMakeLists.txt

 add_custom_target(FuzzerUnitTests)
 set_target_properties(FuzzerUnitTests PROPERTIES FOLDER "Compiler-RT Tests")
 
 set(LIBFUZZER_UNITTEST_LINK_FLAGS ${COMPILER_RT_UNITTEST_LINK_FLAGS})
 list(APPEND LIBFUZZER_UNITTEST_LINK_FLAGS --driver-mode=g++)
 
 if(APPLE OR CMAKE_SYSTEM_NAME STREQUAL "FreeBSD")
   list(APPEND LIBFUZZER_UNITTEST_LINK_FLAGS -lc++ -lpthread)
+elseif(WIN32)
+  list(APPEND LIBFUZZER_UNITTEST_LINK_FLAGS -lstdc++)
 else()
   list(APPEND LIBFUZZER_UNITTEST_LINK_FLAGS -lstdc++ -lpthread)
 endif()
 
 if("${CMAKE_SYSTEM_NAME}" STREQUAL "Linux" AND COMPILER_RT_LIBCXX_PATH)
   list(APPEND LIBFUZZER_UNITTEST_CFLAGS -nostdinc++ -D_LIBCPP_ABI_VERSION=Fuzzer)
 endif()
 

compiler-rt/lib/fuzzer/tests/FuzzerUnittest.cpp

 
 // For now, have LLVMFuzzerTestOneInput just to make it link.
 // Later we may want to make unittests that actually call LLVMFuzzerTestOneInput.
 extern "C" int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) {
   abort();
 }
 
 TEST(Fuzzer, Basename) {
-  EXPECT_EQ(Basename("foo/bar"), "bar");
   EXPECT_EQ(Basename("bar"), "bar");
+#if !LIBFUZZER_WINDOWS
+  EXPECT_EQ(Basename("foo/bar"), "bar");
   EXPECT_EQ(Basename("/bar"), "bar");
   EXPECT_EQ(Basename("foo/x"), "x");
   EXPECT_EQ(Basename("foo/"), "");
+#else
+  EXPECT_EQ(Basename("foo\\bar"), "bar");
+  EXPECT_EQ(Basename("\\bar"), "bar");
+  EXPECT_EQ(Basename("foo\\x"), "x");
+  EXPECT_EQ(Basename("foo\\"), "");
+#endif
 }
 
 TEST(Fuzzer, CrossOver) {
   std::unique_ptr<ExternalFunctions> t(new ExternalFunctions());
   fuzzer::EF = t.get();
   Random Rand(0);
   std::unique_ptr<MutationDispatcher> MD(new MutationDispatcher(Rand, {}));
   Unit A({0, 1, 2}), B({5, 6, 7});

compiler-rt/lib/sanitizer_common/sanitizer_coverage_win_sections.cc

 //===-- sanitizer_coverage_win_sections.cc --------------------------------===//
 //
 //                     The LLVM Compiler Infrastructure
 //
 // This file is distributed under the University of Illinois Open Source
 // License. See LICENSE.TXT for details.
 //
 //===----------------------------------------------------------------------===//
 //
 // This file defines delimiters for Sanitizer Coverage's section.
 //===----------------------------------------------------------------------===//
 
 #include "sanitizer_platform.h"
 #if SANITIZER_WINDOWS
 #include <stdint.h>
-#pragma section(".SCOV$A", read, write)  // NOLINT
-#pragma section(".SCOV$Z", read, write)  // NOLINT
 extern "C" {
-__declspec(allocate(".SCOV$A")) uint32_t __start___sancov_guards = 0;
-__declspec(allocate(".SCOV$Z")) uint32_t __stop___sancov_guards = 0;
+#pragma section(".SCOVG$A", read, write)  // NOLINT
+__declspec(allocate(".SCOVG$A")) uint32_t __start___sancov_guards = 0;
+#pragma section(".SCOVG$Z", read, write)  // NOLINT
+__declspec(allocate(".SCOVG$Z")) uint32_t __stop___sancov_guards = 0;
+
+// Use align(1) to avoid adding any padding that will mess up clients trying to
+// determine the start and end of the array.
+#pragma section(".SCOVC$A", read, write)  // NOLINT
+__declspec(allocate(".SCOVC$A")) __declspec(align(1))  uint64_t __start___sancov_cntrs = 0;
+#pragma section(".SCOVC$Z", read, write)  // NOLINT
+__declspec(allocate(".SCOVC$Z")) __declspec(align(1))  uint64_t __stop___sancov_cntrs = 0;
+
+// Use uint64_t so there won't be any issues if the linker tries to word align
+// the pc array.
+#pragma section(".SCOVP$A", read)  // NOLINT
+__declspec(allocate(".SCOVP$A")) __declspec(align(1)) uint64_t __start___sancov_pcs = 0;
+#pragma section(".SCOVP$Z", read)  // NOLINT
+__declspec(allocate(".SCOVP$Z")) __declspec(align(1)) uint64_t __stop___sancov_pcs = 0;
 }
 #endif // SANITIZER_WINDOWS

compiler-rt/test/fuzzer/afl-driver-extra-stats.test

 XFAIL: ios
+# AFL doesn't work on windows.
+UNSUPPORTED: windows
 RUN: %no_fuzzer_cpp_compiler %S/AFLDriverTest.cpp %libfuzzer_src/afl/afl_driver.cpp -o %t-AFLDriverTest
 
 ; Test that not specifying an extra stats file isn't broken.
 RUN: unset AFL_DRIVER_EXTRA_STATS_FILENAME
 RUN: %run %t-AFLDriverTest
 
 ; Test that specifying an invalid extra stats file causes a crash.
 RUN: ASAN_OPTIONS= AFL_DRIVER_EXTRA_STATS_FILENAME=%T not --crash %t-AFLDriverTest

compiler-rt/test/fuzzer/afl-driver-stderr.test

 XFAIL: ios
-UNSUPPORTED: freebsd
+# AFL doesn't work on windows.
+UNSUPPORTED: freebsd, windows
 RUN: %no_fuzzer_cpp_compiler %S/AFLDriverTest.cpp %libfuzzer_src/afl/afl_driver.cpp -o %t-AFLDriverTest
 
 ; Test that not specifying a stderr file isn't broken.
 RUN: unset AFL_DRIVER_STDERR_DUPLICATE_FILENAME
 RUN: %run %t-AFLDriverTest
 
 ; Test that specifying an invalid file causes a crash.
 RUN: ASAN_OPTIONS= AFL_DRIVER_STDERR_DUPLICATE_FILENAME="%T" not --crash %run %t-AFLDriverTest
 
 ; Test that a file is created when specified as the duplicate stderr.
 RUN: AFL_DRIVER_STDERR_DUPLICATE_FILENAME=%t %run %t-AFLDriverTest
 RUN: stat %t

compiler-rt/test/fuzzer/cleanse.test

+# Piping is not available on windows.
+UNSUPPORTED: windows
 RUN: %cpp_compiler %S/CleanseTest.cpp -o %t-CleanseTest
 RUN: echo -n 0123456789ABCDEFGHIZ > %t-in
 RUN: %run %t-CleanseTest -cleanse_crash=1 %t-in -exact_artifact_path=%t-out
 RUN: echo -n ' 1   5    A        Z' | diff - %t-out

compiler-rt/test/fuzzer/coverage.test

-UNSUPPORTED: aarch64
+# -fPIC doesn't work for .exes.
+UNSUPPORTED: aarch64, windows
 RUN: %cpp_compiler -mllvm -use-unknown-locations=Disable  %S/NullDerefTest.cpp -o %t-NullDerefTest
 RUN: %cpp_compiler -mllvm -use-unknown-locations=Disable %S/DSO1.cpp -fPIC %ld_flags_rpath_so1 -shared -o %dynamiclib1
 RUN: %cpp_compiler -mllvm -use-unknown-locations=Disable %S/DSO2.cpp -fPIC %ld_flags_rpath_so2 -shared -o %dynamiclib2
 RUN: %cpp_compiler -mllvm -use-unknown-locations=Disable %S/DSOTestMain.cpp %S/DSOTestExtra.cpp %ld_flags_rpath_exe1 %ld_flags_rpath_exe2 -o %t-DSOTest
 
 CHECK: COVERAGE:
 CHECK: COVERED_FUNC: {{.*}}LLVMFuzzerTestOneInput {{.*}}NullDerefTest.cpp:13
 RUN: not %run %t-NullDerefTest -print_coverage=1 2>&1 | FileCheck %s

compiler-rt/test/fuzzer/dso.test

+# -fPIC doesn't work for .exes.
+UNSUPPORTED: windows
 RUN: %cpp_compiler %S/DSO1.cpp -fPIC %ld_flags_rpath_so1 -shared -o %dynamiclib1
 RUN: %cpp_compiler %S/DSO2.cpp -fPIC %ld_flags_rpath_so2 -shared -o %dynamiclib2
 RUN: %cpp_compiler %S/DSOTestMain.cpp %S/DSOTestExtra.cpp %ld_flags_rpath_exe1 %ld_flags_rpath_exe2 -o %t-DSOTest
 
 RUN: not %run %t-DSOTest 2>&1 | FileCheck %s --check-prefix=DSO
 DSO: INFO: Loaded 3 modules
 DSO: BINGO

compiler-rt/test/fuzzer/dump_coverage.test

-UNSUPPORTED: freebsd
+# -fPIC doesn't work for .exes.
+UNSUPPORTED: freebsd, windows
 RUN: %cpp_compiler -fsanitize-coverage=0 -fsanitize-coverage=trace-pc-guard %S/DSO1.cpp -fPIC -shared -o %dynamiclib1 %ld_flags_rpath_so1
 RUN: %cpp_compiler -fsanitize-coverage=0 -fsanitize-coverage=trace-pc-guard %S/DSO2.cpp -fPIC -shared -o %dynamiclib2 %ld_flags_rpath_so2
 RUN: %cpp_compiler -fsanitize-coverage=0 -fsanitize-coverage=trace-pc-guard %S/DSOTestMain.cpp %S/DSOTestExtra.cpp %ld_flags_rpath_exe1 %ld_flags_rpath_exe2 -o %t-DSOTest
 
 RUN: %cpp_compiler -fsanitize-coverage=0 -fsanitize-coverage=trace-pc-guard %S/NullDerefTest.cpp -o %t-NullDerefTest
 
 RUN: rm -rf %t_workdir && mkdir -p %t_workdir
 RUN: env ASAN_OPTIONS=coverage_dir='"%t_workdir"' not %run %t-NullDerefTest -dump_coverage=1 2>&1 | FileCheck %s

compiler-rt/test/fuzzer/initialize.test

+# memmove is a GNUism and is not available on Windows.
+UNSUPPORTED: windows
 CHECK: BINGO
 RUN: %cpp_compiler %S/InitializeTest.cpp -o %t-InitializeTest
 RUN: not %run %t-InitializeTest -use_value_profile=1 2>&1 | FileCheck %s

compiler-rt/test/fuzzer/standalone.test

+# memmove is a GNUism and is not available on Windows.
+UNSUPPORTED: windows
 RUN: %no_fuzzer_c_compiler %libfuzzer_src/standalone/StandaloneFuzzTargetMain.c -c -o %t_1.o
 RUN: %no_fuzzer_cpp_compiler %S/InitializeTest.cpp -c -o %t_2.o
 
 RUN: %no_fuzzer_cpp_compiler %t_1.o %t_2.o -o %t-StandaloneInitializeTest
 RUN: %run %t-StandaloneInitializeTest %S/hi.txt %S/dict1.txt 2>&1 | FileCheck %s
 CHECK: StandaloneFuzzTargetMain: running 2 inputs
 CHECK: Done:    {{.*}}hi.txt: (3 bytes)
 CHECK: Done:    {{.*}}dict1.txt: (61 bytes)

llvm/lib/Transforms/Instrumentation/SanitizerCoverage.cpp

 Function *SanitizerCoverageModule::CreateInitCallsForSections(
     Module &M, const char *InitFunctionName, Type *Ty,
     const char *Section) {
   IRBuilder<> IRB(M.getContext());
   auto SecStartEnd = CreateSecStartEnd(M, Section, Ty);
   auto SecStart = SecStartEnd.first;
   auto SecEnd = SecStartEnd.second;
   Function *CtorFunc;
   std::tie(CtorFunc, std::ignore) = createSanitizerCtorAndInitFunctions(
       M, SanCovModuleCtorName, InitFunctionName, {Ty, Ty},
       {IRB.CreatePointerCast(SecStart, Ty), IRB.CreatePointerCast(SecEnd, Ty)});
 
   if (TargetTriple.supportsCOMDAT()) {
     // Use comdat to dedup CtorFunc.
     CtorFunc->setComdat(M.getOrInsertComdat(SanCovModuleCtorName));
     appendToGlobalCtors(M, CtorFunc, SanCtorAndDtorPriority, CtorFunc);
   } else {
     appendToGlobalCtors(M, CtorFunc, SanCtorAndDtorPriority);
   }
   return CtorFunc;
 }
 
if (Options.StackDepth && IsEntryBB && !IsLeafFunc) {
     auto Store = ThenIRB.CreateStore(FrameAddrInt, SanCovLowestStack);
     SetNoSanitizeMetadata(LowestStack);
     SetNoSanitizeMetadata(Store);
   }
 }
 
 std::string
 SanitizerCoverageModule::getSectionName(const std::string &Section) const {
-  if (TargetTriple.getObjectFormat() == Triple::COFF)
-    return ".SCOV$M";
+  if (TargetTriple.getObjectFormat() == Triple::COFF) {
+    if (Section == SanCovCountersSectionName)
+      return ".SCOVC$M";
+    else if (Section == SanCovPCsSectionName)
+      return ".SCOVP$M";
+    return ".SCOVG$M";  // For SanCovGuardsSectionName.
+  }
   if (TargetTriple.isOSBinFormatMachO())
     return "__DATA,__" + Section;
   return "__" + Section;
 }
 
 std::string
 SanitizerCoverageModule::getSectionStart(const std::string &Section) const {
   if (TargetTriple.isOSBinFormatMachO())