6502/llvm-6502
1
0 Fork 0
mirror of https://github.com/c64scene-ar/llvm-6502.git synced 2026-04-27 04:18:42 +00:00
Code Issues Projects Releases Wiki Activity
117,063 Commits 39 Branches 0 Tags
0cdb698aaef899bf6a5550f5e2ab60219fda677e
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Kostya Serebryany 0cdb698aae [lib/Fuzzer] add a trace-based mutatation logic. Same idea as with DFSan-based mutator, but instead of relying on taint tracking, try to find the data directly in the input. More (logic and comments) to go. 
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@237043 91177308-0d34-0410-b5e6-96231b3b80d8
 2015-05-11 20:51:19 +00:00
Kostya Serebryany 5ba2a0b8b0 [lib/Fuzzer] build tests that work well with dfsan also w/o dfsan 
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@236909 91177308-0d34-0410-b5e6-96231b3b80d8
 2015-05-08 21:45:19 +00:00
Kostya Serebryany 8ae273d380 [lib/Fuzzer] use -fsanitize-coverage=trace-cmp when building LLVM with LLVM_USE_SANITIZE_COVERAGE; in lib/Fuzzer try to reload the corpus to pick up new units from other processes 
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@236906 91177308-0d34-0410-b5e6-96231b3b80d8
 2015-05-08 21:30:55 +00:00
Kostya Serebryany 6564ee8933 [lib/Fuzzer] change the way we use taint information for fuzzing. Now, we run a single unit and collect suggested mutations based on tracing+taint data, then apply the suggested mutations one by one. The previous scheme was slower and more complex. 
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@236772 91177308-0d34-0410-b5e6-96231b3b80d8
 2015-05-07 21:02:11 +00:00
Kostya Serebryany 46fa0aabcb [lib/Fuzzer] minor refactoring/simplification, NFC 
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@236757 91177308-0d34-0410-b5e6-96231b3b80d8
 2015-05-07 18:32:29 +00:00
Kostya Serebryany 49204878d7 [lib/Fuzzer] add dfsan_weak_hook_memcmp, enable the test that uses it, simplify the test runner 
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@236683 91177308-0d34-0410-b5e6-96231b3b80d8
 2015-05-07 00:11:33 +00:00
Kostya Serebryany 8434a039e2 [lib/Fuzzer] remove dfsan_fuzzer_abi.list -- its contents are now moved to dfsan proper 
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@236659 91177308-0d34-0410-b5e6-96231b3b80d8
 2015-05-06 22:47:24 +00:00
Kostya Serebryany b350776f03 [lib/Fuzzer] add a fuzzer test for memcmp (does not work yet) 
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@236656 91177308-0d34-0410-b5e6-96231b3b80d8
 2015-05-06 22:36:00 +00:00
Kostya Serebryany b6ca45c39f [lib/Fuzzer] rename TestOneInput to LLVMFuzzerTestOneInput to make it more unique 
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@236652 91177308-0d34-0410-b5e6-96231b3b80d8
 2015-05-06 22:19:00 +00:00
Kostya Serebryany 605f316258 [lib/Fuzzer] on crash print the contents of the crashy input as base64 
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@236548 91177308-0d34-0410-b5e6-96231b3b80d8
 2015-05-05 21:59:51 +00:00
Kostya Serebryany 3784f79d64 [lib/Fuzzer] use handle_abort=1 by default so that when assert() fires we save the test case 
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@236476 91177308-0d34-0410-b5e6-96231b3b80d8
 2015-05-05 01:42:55 +00:00
Kostya Serebryany f3a664fc2e [lib/Fuzzer] Section: How good is my fuzzer? 
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@234571 91177308-0d34-0410-b5e6-96231b3b80d8
 2015-04-10 06:32:29 +00:00
Kostya Serebryany 3e35db6c50 [lib/Fuzzer] explain compatibility with AFL 
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@234570 91177308-0d34-0410-b5e6-96231b3b80d8
 2015-04-10 05:44:43 +00:00
Kostya Serebryany e32bb4cb81 [lib/Fuzzer] show how to find Heartbleed with LibFuzzer 
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@234391 91177308-0d34-0410-b5e6-96231b3b80d8
 2015-04-08 06:16:11 +00:00
Kostya Serebryany 01055ec7e3 [fuzzer] document the -tokens flag. Also change the diagnostic output 
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@233842 91177308-0d34-0410-b5e6-96231b3b80d8
 2015-04-01 21:33:20 +00:00
Kostya Serebryany 58bc60892e [fuzzer] more documentation 
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@233763 91177308-0d34-0410-b5e6-96231b3b80d8
 2015-03-31 21:39:38 +00:00
Kostya Serebryany 3399e1fd73 [fuzzer] Add support for token-based fuzzing (e.g. for C++). Allow string flags. 
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@233745 91177308-0d34-0410-b5e6-96231b3b80d8
 2015-03-31 20:13:20 +00:00
Kostya Serebryany 3506457311 Move lib/Fuzzer docs from a README.txt to a proper .rst file. 
Summary:
Move lib/Fuzzer docs from a README.txt to a proper .rst file.
This change does not add any content, just formatting.

Test Plan: n/a

Reviewers: samsonov

Reviewed By: samsonov

Subscribers: llvm-commits

Differential Revision: http://reviews.llvm.org/D8710

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@233638 91177308-0d34-0410-b5e6-96231b3b80d8
 2015-03-30 23:05:30 +00:00
Kostya Serebryany e6d25ad0e0 [fuzzer] when a single unit takes over 1 second to run and it is the slowest one so far, print it. 
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@233637 91177308-0d34-0410-b5e6-96231b3b80d8
 2015-03-30 23:04:35 +00:00
Kostya Serebryany b0b7c53ee4 [fuzzer] print various stats in a unified way 
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@233624 91177308-0d34-0410-b5e6-96231b3b80d8
 2015-03-30 22:44:03 +00:00
Kostya Serebryany 29c6bd6e4f DFSan-based fuzzer (proof of concept). 
Summary:
This adds a simple DFSan-based (i.e. taint-guided) fuzzer mutator,
see the comments for details.

Test Plan: a test added

Reviewers: samsonov, pcc

Reviewed By: samsonov, pcc

Subscribers: llvm-commits

Differential Revision: http://reviews.llvm.org/D8669

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@233613 91177308-0d34-0410-b5e6-96231b3b80d8
 2015-03-30 22:09:51 +00:00
Kostya Serebryany a1ea57a185 [sanitizer] experimental tracing for cmp instructions 
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@232873 91177308-0d34-0410-b5e6-96231b3b80d8
 2015-03-21 01:29:36 +00:00
Kostya Serebryany 0e5ec02e1e [asan] remove redundant ifndefs. NFC 
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@232521 91177308-0d34-0410-b5e6-96231b3b80d8
 2015-03-17 19:13:23 +00:00
Kostya Serebryany 935a3aa5bc [sanitizer] fix instrumentation with -mllvm -sanitizer-coverage-block-threshold=0 to actually do something useful. 
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@231736 91177308-0d34-0410-b5e6-96231b3b80d8
 2015-03-10 01:58:27 +00:00
Kostya Serebryany a7b107bc82 [sanitizer] decrease sanitizer-coverage-block-threshold from 1000 to 500 as another horrible workaround for PR17409 
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@231733 91177308-0d34-0410-b5e6-96231b3b80d8
 2015-03-10 01:11:53 +00:00
Kostya Serebryany c2f4077b88 [sanitizer] add nosanitize metadata to more coverage instrumentation instructions 
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@231333 91177308-0d34-0410-b5e6-96231b3b80d8
 2015-03-05 01:20:05 +00:00
Kostya Serebryany ae0620c4e9 [sanitizer/coverage] Add AFL-style coverage counters (search heuristic for fuzzing). 
Introduce -mllvm -sanitizer-coverage-8bit-counters=1
which adds imprecise thread-unfriendly 8-bit coverage counters.

The run-time library maps these 8-bit counters to 8-bit bitsets in the same way
AFL (http://lcamtuf.coredump.cx/afl/technical_details.txt) does:
counter values are divided into 8 ranges and based on the counter
value one of the bits in the bitset is set.
The AFL ranges are used here: 1, 2, 3, 4-7, 8-15, 16-31, 32-127, 128+.

These counters provide a search heuristic for single-threaded
coverage-guided fuzzers, we do not expect them to be useful for other purposes.

Depending on the value of -fsanitize-coverage=[123] flag,
these counters will be added to the function entry blocks (=1),
every basic block (=2), or every edge (=3).

Use these counters as an optional search heuristic in the Fuzzer library.
Add a test where this heuristic is critical.


git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@231166 91177308-0d34-0410-b5e6-96231b3b80d8
 2015-03-03 23:27:02 +00:00
Kostya Serebryany f7c1020041 [fuzzer] one more experimental search mode: -use_coverage_pairs=1 
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@229957 91177308-0d34-0410-b5e6-96231b3b80d8
 2015-02-20 03:02:37 +00:00
Kostya Serebryany 6a75fe1912 [sanitizer] fix a test broken by r229940 
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@229951 91177308-0d34-0410-b5e6-96231b3b80d8
 2015-02-20 02:12:25 +00:00
Kostya Serebryany 727a6ee223 [sanitizer] when dumping the basic block trace, also dump the module names. Patch by Laszlo Szekeres 
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@229940 91177308-0d34-0410-b5e6-96231b3b80d8
 2015-02-20 00:30:44 +00:00
Kostya Serebryany ce7a848558 [fuzzer] split main() into FuzzerDriver() that takes a callback as a parameter and a tiny main() in a separate file 
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@229882 91177308-0d34-0410-b5e6-96231b3b80d8
 2015-02-19 18:45:37 +00:00
Kostya Serebryany 0b1ec08b77 [fuzzer] properly annotate fallthrough, add one more entry to FAQ 
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@229880 91177308-0d34-0410-b5e6-96231b3b80d8
 2015-02-19 18:21:12 +00:00
Kostya Serebryany 9b13b8c338 [fuzzer] move default sanitizer options to a separate file 
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@228429 91177308-0d34-0410-b5e6-96231b3b80d8
 2015-02-06 19:52:07 +00:00
Kostya Serebryany 5d85a10810 [fuzzer] add flag prefer_small_during_initial_shuffle, be a bit more verbose 
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@228235 91177308-0d34-0410-b5e6-96231b3b80d8
 2015-02-04 23:42:42 +00:00
Kostya Serebryany 46c638cfc8 [fuzzer] add -runs=N to limit the number of runs per session. Also, make sure we do some mutations w/o cross over. 
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@228214 91177308-0d34-0410-b5e6-96231b3b80d8
 2015-02-04 22:20:09 +00:00
Kostya Serebryany eb884daa38 [fuzzer] make multi-process execution more verbose; fix mutation to actually respect mutation depth and to never produce empty units 
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@228170 91177308-0d34-0410-b5e6-96231b3b80d8
 2015-02-04 19:10:20 +00:00
Kostya Serebryany 8fa9947e4d [fuzzer]: fix exit code, add more diagnostics 
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@228103 91177308-0d34-0410-b5e6-96231b3b80d8
 2015-02-04 01:22:57 +00:00
Kostya Serebryany 0013784dd3 [sanitizer] add another workaround for PR 17409: when over a threshold emit coverage instrumentation as calls. 
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@228102 91177308-0d34-0410-b5e6-96231b3b80d8
 2015-02-04 01:21:45 +00:00
Kostya Serebryany 04e540582b [fuzzer] Add proper dependensices to the fuzzer tests 
Summary: Make sure that FileCheck is built when running check-fuzzer

Test Plan:
run on bot:
lab.llvm.org:8011/builders/sanitizer-x86_64-linux-fuzzer

Reviewers: samsonov

Reviewed By: samsonov

Subscribers: llvm-commits

Differential Revision: http://reviews.llvm.org/D7387

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@228045 91177308-0d34-0410-b5e6-96231b3b80d8
 2015-02-03 21:57:32 +00:00
Kostya Serebryany 32a12b924e [fuzzer] update the include line to use the new header name 
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@228018 91177308-0d34-0410-b5e6-96231b3b80d8
 2015-02-03 19:42:05 +00:00
Kostya Serebryany a1667be228 [fuzzer] add flags to run fuzzer in multiple parallel processes 
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@227664 91177308-0d34-0410-b5e6-96231b3b80d8
 2015-01-31 01:14:40 +00:00
Kostya Serebryany 05efde62f5 [fuzzer] Add a gtest-style test 
Summary: Add one gtest-style test.

Test Plan: run on bot

Reviewers: samsonov

Reviewed By: samsonov

Subscribers: llvm-commits

Differential Revision: http://reviews.llvm.org/D7287

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@227639 91177308-0d34-0410-b5e6-96231b3b80d8
 2015-01-30 23:26:57 +00:00
Kostya Serebryany 4ac4c33f2d [fuzzer] add -use_full_coverage_set=1 which solves FullCoverageSetTest. This does not scale very well yet, but might be a good start. 
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@227507 91177308-0d34-0410-b5e6-96231b3b80d8
 2015-01-29 23:01:07 +00:00
Kostya Serebryany df31d7bea7 [fuzzer] fix warning in a test 
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@227478 91177308-0d34-0410-b5e6-96231b3b80d8
 2015-01-29 18:13:36 +00:00
Kostya Serebryany c8f69d069e [fuzzer] minor cleanup based on reviews: remove redundant includes, fix a copy-pasto in tests 
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@227468 91177308-0d34-0410-b5e6-96231b3b80d8
 2015-01-29 17:16:23 +00:00
Kostya Serebryany a51685f651 [fuzzer] add FAQ section to the README.txt 
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@227466 91177308-0d34-0410-b5e6-96231b3b80d8
 2015-01-29 17:11:30 +00:00
Kostya Serebryany 1f3043175c [fuzzer] add option -save_minimized_corpus 
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@227395 91177308-0d34-0410-b5e6-96231b3b80d8
 2015-01-28 23:48:39 +00:00
Kostya Serebryany 408796c672 Add lit-style tests for the Fuzzer library 
Summary: Add test targets and the lit-style runner.

Test Plan: Run the tests on bot.

Reviewers: samsonov

Reviewed By: samsonov

Subscribers: llvm-commits

Differential Revision: http://reviews.llvm.org/D7217

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@227389 91177308-0d34-0410-b5e6-96231b3b80d8
 2015-01-28 22:49:25 +00:00
Kostya Serebryany b0f9090173 [fuzzer] instructions for building/running clang-format-fuzzer 
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@227357 91177308-0d34-0410-b5e6-96231b3b80d8
 2015-01-28 19:51:58 +00:00
Kostya Serebryany 556d1a3b80 [fuzzer] properly enable asan's coverage feedback 
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@227254 91177308-0d34-0410-b5e6-96231b3b80d8
 2015-01-27 22:19:55 +00:00
Kostya Serebryany c9baf3befb Add a Fuzzer library 
Summary:
A simple genetic in-process coverage-guided fuzz testing library.

I've used this fuzzer to test clang-format
(it found 12+ bugs, thanks djasper@ for the fixes!)
and it may also help us test other parts of LLVM.
So why not keep it in the LLVM repository?

I plan to add the cmake build rules later (in a separate patch, if that's ok)
and also add a clang-format-fuzzer target.

See README.txt for details.

Test Plan: Tests will follow separately.

Reviewers: djasper, chandlerc, rnk

Reviewed By: rnk

Subscribers: majnemer, ygribov, dblaikie, llvm-commits

Differential Revision: http://reviews.llvm.org/D7184

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@227252 91177308-0d34-0410-b5e6-96231b3b80d8
 2015-01-27 22:08:41 +00:00
Kostya Serebryany ed9cdced00 Add cmake flag LLVM_USE_SANITIZE_COVERAGE 
Summary:
When LLVM_USE_SANITIZE_COVERAGE=YES
and one of the sanitizers is used -fsanitize-coverage=3 will be added
to build flag. This will be used to run a coverage-guided fuzzer on various
llvm libraries.

Test Plan: n/a

Reviewers: rnk

Reviewed By: rnk

Subscribers: llvm-commits

Differential Revision: http://reviews.llvm.org/D7116

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@227216 91177308-0d34-0410-b5e6-96231b3b80d8
 2015-01-27 17:59:28 +00:00
Kostya Serebryany 8c6ae1044a [asan] simplify the tracing code, make it use the same guard variables as coverage 
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@225103 91177308-0d34-0410-b5e6-96231b3b80d8
 2015-01-03 00:54:43 +00:00
Kostya Serebryany dd890d5c5e [asan] change _sanitizer_cov_module_init to accept int* instead of int** 
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@224999 91177308-0d34-0410-b5e6-96231b3b80d8
 2014-12-30 19:29:28 +00:00
Kostya Serebryany b69d796590 [asan] change the coverage collection scheme so that we can easily emit coverage for the entire process as a single bit set, and if coverage_bitset=1 actually emit that bitset 
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@224789 91177308-0d34-0410-b5e6-96231b3b80d8
 2014-12-23 22:32:17 +00:00
Kostya Serebryany 1c97c5e8bd [sanitizer] allow -fsanitize-coverage=N w/ -fsanitize=leak, llvm part 
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@224463 91177308-0d34-0410-b5e6-96231b3b80d8
 2014-12-17 21:50:04 +00:00
Kostya Serebryany 95aa8cab27 [sanitizer] prevent function call merging for sanitizer-coverage callbacks 
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@224372 91177308-0d34-0410-b5e6-96231b3b80d8
 2014-12-16 21:24:15 +00:00
Kostya Serebryany 0fd28b40a4 [msan] allow -fsanitize-coverage=N together with -fsanitize=memory, llvm part 
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@223312 91177308-0d34-0410-b5e6-96231b3b80d8
 2014-12-03 23:28:26 +00:00
Kostya Serebryany 678af17920 [asan/coverage] change the way asan coverage instrumentation is done: instead of setting the guard to 1 in the generated code, pass the pointer to guard to __sanitizer_cov and set it there. No user-visible functionality change expected 
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@222675 91177308-0d34-0410-b5e6-96231b3b80d8
 2014-11-24 18:49:53 +00:00
Kostya Serebryany 57cd7cd77a [asan] remove old experimental code 
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@222586 91177308-0d34-0410-b5e6-96231b3b80d8
 2014-11-21 22:34:29 +00:00
Kostya Serebryany 598c08cf1c [asan] add statistic counter to dynamic alloca instrumentation 
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@222573 91177308-0d34-0410-b5e6-96231b3b80d8
 2014-11-21 21:25:18 +00:00
Kostya Serebryany 0dd5e22d89 [asan] add experimental basic-block tracing to asan-coverage; also fix -fsanitize-coverage=3 which was broken by r221718 
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@222290 91177308-0d34-0410-b5e6-96231b3b80d8
 2014-11-19 00:22:58 +00:00
Kostya Serebryany f82e60f03d Introduce llvm::SplitAllCriticalEdges 
Summary:
move the code from BreakCriticalEdges::runOnFunction()
into a separate utility function llvm::SplitAllCriticalEdges()
so that it can be used independently.
No functionality change intended.

Test Plan: check-llvm

Reviewers: nlewycky

Reviewed By: nlewycky

Subscribers: llvm-commits

Differential Revision: http://reviews.llvm.org/D6313

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@222288 91177308-0d34-0410-b5e6-96231b3b80d8
 2014-11-19 00:17:31 +00:00
Kostya Serebryany d54a2bf8e1 [asan] adding ShadowOffset64 for mips64, patch by Kumar Sukhani 
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@221725 91177308-0d34-0410-b5e6-96231b3b80d8
 2014-11-11 23:02:57 +00:00
Kostya Serebryany abb3335f6d Move asan-coverage into a separate phase. 
Summary:
This change moves asan-coverage instrumentation
into a separate Module pass.
The other part of the change in clang introduces a new flag
-fsanitize-coverage=N.
Another small patch will update tests in compiler-rt.

With this patch no functionality change is expected except for the flag name.
The following changes will make the coverage instrumentation work with tsan/msan

Test Plan: Run regression tests, chromium.

Reviewers: nlewycky, samsonov

Reviewed By: nlewycky, samsonov

Subscribers: llvm-commits

Differential Revision: http://reviews.llvm.org/D6152

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@221718 91177308-0d34-0410-b5e6-96231b3b80d8
 2014-11-11 22:14:37 +00:00
Kostya Serebryany c45da43b26 [asan] [mips] changed ShadowOffset32 for systems having 16kb PageSize; patch by Kumar Sukhani 
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@221288 91177308-0d34-0410-b5e6-96231b3b80d8
 2014-11-04 19:46:15 +00:00
Kostya Serebryany 854432d7e5 [asan] do not treat inline asm calls as indirect calls 
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@220985 91177308-0d34-0410-b5e6-96231b3b80d8
 2014-10-31 18:38:23 +00:00
Kostya Serebryany 96076957ac [asan] fix caller-calee instrumentation to emit new cache for every call site 
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@220973 91177308-0d34-0410-b5e6-96231b3b80d8
 2014-10-31 17:11:27 +00:00
Kostya Serebryany 866ee52df3 [asan] experimental tracing for indirect calls, llvm part. 
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@220699 91177308-0d34-0410-b5e6-96231b3b80d8
 2014-10-27 18:13:56 +00:00
Kostya Serebryany 0e9d114865 [asan] don't instrument module CTORs that may be run before asan.module_ctor. This fixes asan running together -coverage 
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@218421 91177308-0d34-0410-b5e6-96231b3b80d8
 2014-09-24 22:41:55 +00:00
Kostya Serebryany c9b2548b23 [asan] fix debug info produced for asan-coverage=2 
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@217106 91177308-0d34-0410-b5e6-96231b3b80d8
 2014-09-03 23:24:18 +00:00
Kostya Serebryany f12b1d8c7b [asan] add -asan-coverage=3: instrument all blocks and critical edges. 
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@217098 91177308-0d34-0410-b5e6-96231b3b80d8
 2014-09-03 22:37:37 +00:00
Kostya Serebryany 891198b358 [asan] Assign a low branch weight to ASan's slow path, patch by Jonas Wagner. This speeds up asan (at least on SPEC) by 1%-5% or more. Also fix lint in dfsan. 
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@216972 91177308-0d34-0410-b5e6-96231b3b80d8
 2014-09-02 21:46:51 +00:00
Kostya Serebryany 3d150e08ae [asan] decrease asan-instrumentation-with-call-threshold from 10000 to 7000, see PR17409 
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@209623 91177308-0d34-0410-b5e6-96231b3b80d8
 2014-05-26 11:57:16 +00:00
Kostya Serebryany f2938bf8da [asan] properly instrument memory accesses that have small alignment (smaller than min(8,size)) by making two checks instead of one. This may slowdown some cases, e.g. long long on 32-bit or wide loads produced after loop unrolling. The benefit is higher sencitivity. 
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@209508 91177308-0d34-0410-b5e6-96231b3b80d8
 2014-05-23 11:52:07 +00:00
Kostya Serebryany 0f99bc0606 fix -Wunused-variable warning in Release mode 
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@207514 91177308-0d34-0410-b5e6-96231b3b80d8
 2014-04-29 09:33:02 +00:00
Kostya Serebryany 468fabf731 [asan] Support outline instrumentation for wide types and delete dead code, patch by Yuri Gribov 
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@206883 91177308-0d34-0410-b5e6-96231b3b80d8
 2014-04-22 11:19:45 +00:00
Kostya Serebryany f161a918fb [asan] add a run-time flag detect_container_overflow=true/false 
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@206756 91177308-0d34-0410-b5e6-96231b3b80d8
 2014-04-21 14:35:00 +00:00
Kostya Serebryany acbc9cb577 [asan] add llvm-ish test for memset/etc instrumentation 
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@206747 91177308-0d34-0410-b5e6-96231b3b80d8
 2014-04-21 11:57:43 +00:00
Kostya Serebryany 470565b5e4 [asan] instead of inserting inline instrumentation around memset/memcpy/memmove, replace the intrinsic with __asan_memset/etc. This makes the memset/etc handling more complete and consistent with what we do in msan. It may slowdown some cases (when the intrinsic was actually inlined) and speedup other cases (when it was not inlined) 
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@206746 91177308-0d34-0410-b5e6-96231b3b80d8
 2014-04-21 11:50:42 +00:00
Kostya Serebryany 84c70a70ba [asan] temporary disable generating __asan_loadN/__asan_storeN 
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@206741 91177308-0d34-0410-b5e6-96231b3b80d8
 2014-04-21 10:28:13 +00:00
Kostya Serebryany 215fc7d998 [asan] insert __asan_loadN/__asan_storeN as out-lined asan checks, llvm part 
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@206734 91177308-0d34-0410-b5e6-96231b3b80d8
 2014-04-21 07:10:43 +00:00
Kostya Serebryany 40a9c0f58b [asan] one more workaround for PR17409: don't do BB-level coverage instrumentation if there are more than N (=1500) basic blocks. This makes ASanCoverage work on libjpeg_turbo/jchuff.c used by Chrome, which has 1824 BBs 
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@206564 91177308-0d34-0410-b5e6-96231b3b80d8
 2014-04-18 08:02:42 +00:00
Kostya Serebryany 8cc4741d85 [asan] add two new hidden compile-time flags for asan: asan-instrumentation-with-call-threshold and asan-memory-access-callback-prefix. This is part of the workaround for PR17409 (instrument huge functions with callbacks instead of inlined code). These flags will also help us experiment with kasan (kernel-asan) and clang 
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@206383 91177308-0d34-0410-b5e6-96231b3b80d8
 2014-04-16 12:12:19 +00:00
Kostya Serebryany 9aef4445a3 [asan] fix a pair of silly typos 
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@202391 91177308-0d34-0410-b5e6-96231b3b80d8
 2014-02-27 13:13:59 +00:00
Kostya Serebryany 124bbea6cd [asan] disable asan-detect-invalid-pointer-pair (was enabled by mistake) 
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@202390 91177308-0d34-0410-b5e6-96231b3b80d8
 2014-02-27 12:56:20 +00:00
Kostya Serebryany 9b3d3a96a8 [asan] *experimental* implementation of invalid-pointer-pair detector (finds when two unrelated pointers are compared or subtracted). This implementation has both false positives and false negatives and is not tuned for performance. A bug report for a proper implementation will follow. 
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@202389 91177308-0d34-0410-b5e6-96231b3b80d8
 2014-02-27 12:45:36 +00:00
Kostya Serebryany 596d621b57 [asan] remove test that should have been removed in r202033 
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@202034 91177308-0d34-0410-b5e6-96231b3b80d8
 2014-02-24 13:44:24 +00:00
Kostya Serebryany 740a00491b [asan] simplify the code that compute the shadow offset; get rid of two internal flags that allowed to override it. The tests pass, but still this change might break asan on some platform not covered by tests. If you see this, please submit a fix with a test. 
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@202033 91177308-0d34-0410-b5e6-96231b3b80d8
 2014-02-24 13:40:24 +00:00
Kostya Serebryany 8cab11a9f8 [asan] support for FreeBSD, LLVM part. patch by Viktor Kutuzov 
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@201067 91177308-0d34-0410-b5e6-96231b3b80d8
 2014-02-10 07:37:04 +00:00
Kostya Serebryany 06fd4ed4c9 [asan] simplify a test 
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@200378 91177308-0d34-0410-b5e6-96231b3b80d8
 2014-01-29 07:35:43 +00:00
Kostya Serebryany bd2c711cdd [asan] extend asan-coverage (still experimental). 
- add a mode for collecting per-block coverage (-asan-coverage=2).
   So far the implementation is naive (all blocks are instrumented),
   the performance overhead on top of asan could be as high as 30%.
 - Make sure the one-time calls to __sanitizer_cov are moved to function buttom,
   which in turn required to copy the original debug info into the call insn.

Here is the performance data on SPEC 2006
(train data, comparing asan with asan-coverage={0,1,2}):

                             asan+cov0     asan+cov1      diff 0-1    asan+cov2       diff 0-2      diff 1-2
       400.perlbench,        65.60,        65.80,         1.00,        76.20,         1.16,         1.16
           401.bzip2,        65.10,        65.50,         1.01,        75.90,         1.17,         1.16
             403.gcc,         1.64,         1.69,         1.03,         2.04,         1.24,         1.21
             429.mcf,        21.90,        22.60,         1.03,        23.20,         1.06,         1.03
           445.gobmk,       166.00,       169.00,         1.02,       205.00,         1.23,         1.21
           456.hmmer,        88.30,        87.90,         1.00,        91.00,         1.03,         1.04
           458.sjeng,       210.00,       222.00,         1.06,       258.00,         1.23,         1.16
      462.libquantum,         1.73,         1.75,         1.01,         2.11,         1.22,         1.21
         464.h264ref,       147.00,       152.00,         1.03,       160.00,         1.09,         1.05
         471.omnetpp,       115.00,       116.00,         1.01,       140.00,         1.22,         1.21
           473.astar,       133.00,       131.00,         0.98,       142.00,         1.07,         1.08
       483.xalancbmk,       118.00,       120.00,         1.02,       154.00,         1.31,         1.28
            433.milc,        19.80,        20.00,         1.01,        20.10,         1.02,         1.01
            444.namd,        16.20,        16.20,         1.00,        17.60,         1.09,         1.09
          447.dealII,        41.80,        42.20,         1.01,        43.50,         1.04,         1.03
          450.soplex,         7.51,         7.82,         1.04,         8.25,         1.10,         1.05
          453.povray,        14.00,        14.40,         1.03,        15.80,         1.13,         1.10
             470.lbm,        33.30,        34.10,         1.02,        34.10,         1.02,         1.00
         482.sphinx3,        12.40,        12.30,         0.99,        13.00,         1.05,         1.06


git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@199488 91177308-0d34-0410-b5e6-96231b3b80d8
 2014-01-17 11:00:30 +00:00
Kostya Serebryany 3846ce9490 replace LeakSanitizerIsTurnedOffForTheCurrentProcess with __lsan_is_turned_off, but this time hide it under __has_feature(address_sanitizer); also include <sanitizer/lsan_interface.h> 
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@199303 91177308-0d34-0410-b5e6-96231b3b80d8
 2014-01-15 07:59:37 +00:00
Kostya Serebryany ab39685c77 reapply r198858: Disable LeakSanitizer in TableGen binaries, see PR18325; this time LeakSanitizerIsTurnedOffForTheCurrentProcess is used instead of __lsan_is_turned_off 
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@198922 91177308-0d34-0410-b5e6-96231b3b80d8
 2014-01-10 08:05:42 +00:00
Kostya Serebryany c50299bab6 Disable LeakSanitizer in TableGen binaries, see PR18325 
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@198858 91177308-0d34-0410-b5e6-96231b3b80d8
 2014-01-09 09:26:26 +00:00
Kostya Serebryany 26f1d1cbbc [asan] don't unpoison redzones on function exit in use-after-return mode. 
Summary:
Before this change the instrumented code before Ret instructions looked like:
  <Unpoison Frame Redzones>
  if (Frame != OriginalFrame) // I.e. Frame is fake
     <Poison Complete Frame>

Now the instrumented code looks like:
  if (Frame != OriginalFrame) // I.e. Frame is fake
     <Poison Complete Frame>
  else
     <Unpoison Frame Redzones>

Reviewers: eugenis

Reviewed By: eugenis

CC: llvm-commits

Differential Revision: http://llvm-reviews.chandlerc.com/D2458

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@197907 91177308-0d34-0410-b5e6-96231b3b80d8
 2013-12-23 14:15:08 +00:00
Kostya Serebryany 1fe014e5fc [asan] produce fewer stores when poisoning stack shadow 
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@197904 91177308-0d34-0410-b5e6-96231b3b80d8
 2013-12-23 09:24:36 +00:00
Kostya Serebryany 5aafde2d5a [asan] fix ndebug build with strict warnings (-Wunused-variable) 
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@196574 91177308-0d34-0410-b5e6-96231b3b80d8
 2013-12-06 09:26:09 +00:00
Kostya Serebryany daa1bf3b74 [asan] rewrite asan's stack frame layout 
Summary:
Rewrite asan's stack frame layout.
First, most of the stack layout logic is moved into a separte file
to make it more testable and (potentially) useful for other projects.
Second, make the frames more compact by using adaptive redzones
(smaller for small objects, larger for large objects).
Third, try to minimized gaps due to large alignments (this is hypothetical since
today we don't see many stack vars aligned by more than 32).

The frames indeed become more compact, but I'll still need to run more benchmarks
before committing, but I am sking for review now to get early feedback.

This change will be accompanied by a trivial change in compiler-rt tests
to match the new frame sizes.

Reviewers: samsonov, dvyukov

Reviewed By: samsonov

CC: llvm-commits

Differential Revision: http://llvm-reviews.chandlerc.com/D2324

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@196568 91177308-0d34-0410-b5e6-96231b3b80d8
 2013-12-06 09:00:17 +00:00
Kostya Serebryany 64abf5b441 [tsan] fix PR18146: sometimes a variable written into vptr could have an integer type (after other optimizations) 
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@196507 91177308-0d34-0410-b5e6-96231b3b80d8
 2013-12-05 15:03:02 +00:00