1 // Copyright 2020 the V8 project authors. All rights reserved.
2 // Use of this source code is governed by a BSD-style license that can be
3 // found in the LICENSE file.
4
5 #include "src/d8/cov.h"
6
7 #include <fcntl.h>
8 #include <inttypes.h>
9 #include <stdio.h>
10 #include <stdlib.h>
11 #include <string.h>
12 #include <sys/mman.h>
13 #include <sys/stat.h>
14 #include <sys/wait.h>
15 #include <unistd.h>
16
17 #include "src/base/platform/wrappers.h"
18
19 #define SHM_SIZE 0x100000
20 #define MAX_EDGES ((SHM_SIZE - 4) * 8)
21
22 struct shmem_data {
23 uint32_t num_edges;
24 unsigned char edges[];
25 };
26
27 struct shmem_data* shmem;
28
29 uint32_t *edges_start, *edges_stop;
30 uint32_t builtins_start;
31 uint32_t builtins_edge_count;
32
sanitizer_cov_reset_edgeguards()33 void sanitizer_cov_reset_edgeguards() {
34 uint32_t N = 0;
35 for (uint32_t* x = edges_start; x < edges_stop && N < MAX_EDGES; x++)
36 *x = ++N;
37 }
38
__sanitizer_cov_trace_pc_guard_init(uint32_t * start,uint32_t * stop)39 extern "C" void __sanitizer_cov_trace_pc_guard_init(uint32_t* start,
40 uint32_t* stop) {
41 // Map the shared memory region
42 const char* shm_key = getenv("SHM_ID");
43 if (!shm_key) {
44 puts("[COV] no shared memory bitmap available, skipping");
45 shmem = (struct shmem_data*)v8::base::Malloc(SHM_SIZE);
46 } else {
47 int fd = shm_open(shm_key, O_RDWR, S_IREAD | S_IWRITE);
48 if (fd <= -1) {
49 fprintf(stderr, "[COV] Failed to open shared memory region\n");
50 _exit(-1);
51 }
52
53 shmem = (struct shmem_data*)mmap(0, SHM_SIZE, PROT_READ | PROT_WRITE,
54 MAP_SHARED, fd, 0);
55 if (shmem == MAP_FAILED) {
56 fprintf(stderr, "[COV] Failed to mmap shared memory region\n");
57 _exit(-1);
58 }
59 }
60
61 edges_start = start;
62 edges_stop = stop;
63 sanitizer_cov_reset_edgeguards();
64
65 shmem->num_edges = static_cast<uint32_t>(stop - start);
66 builtins_start = 1 + shmem->num_edges;
67 printf("[COV] edge counters initialized. Shared memory: %s with %u edges\n",
68 shm_key, shmem->num_edges);
69 }
70
sanitizer_cov_count_discovered_edges()71 uint32_t sanitizer_cov_count_discovered_edges() {
72 uint32_t on_edges_counter = 0;
73 for (uint32_t i = 1; i < builtins_start; ++i) {
74 // TODO(ralbovsky): Can be optimized for fewer divisions.
75 if (shmem->edges[i / 8] & (1 << (i % 8))) {
76 ++on_edges_counter;
77 }
78 }
79 return on_edges_counter;
80 }
81
__sanitizer_cov_trace_pc_guard(uint32_t * guard)82 extern "C" void __sanitizer_cov_trace_pc_guard(uint32_t* guard) {
83 // There's a small race condition here: if this function executes in two
84 // threads for the same edge at the same time, the first thread might disable
85 // the edge (by setting the guard to zero) before the second thread fetches
86 // the guard value (and thus the index). However, our instrumentation ignores
87 // the first edge (see libcoverage.c) and so the race is unproblematic.
88 uint32_t index = *guard;
89 shmem->edges[index / 8] |= 1 << (index % 8);
90 *guard = 0;
91 }
92
cov_init_builtins_edges(uint32_t num_edges)93 void cov_init_builtins_edges(uint32_t num_edges) {
94 if (num_edges + shmem->num_edges > MAX_EDGES) {
95 printf(
96 "[COV] Error: Insufficient amount of edges left for builtins "
97 "coverage.\n");
98 exit(-1);
99 }
100 builtins_edge_count = num_edges;
101 builtins_start = 1 + shmem->num_edges;
102 shmem->num_edges += builtins_edge_count;
103 printf("[COV] Additional %d edges for builtins initialized.\n", num_edges);
104 }
105
106 // This function is ran once per REPRL loop. In case of crash the coverage of
107 // crash will not be stored in shared memory. Therefore, it would be useful, if
108 // we could store these coverage information into shared memory in real time.
cov_update_builtins_basic_block_coverage(const std::vector<bool> & cov_map)109 void cov_update_builtins_basic_block_coverage(
110 const std::vector<bool>& cov_map) {
111 if (cov_map.size() != builtins_edge_count) {
112 printf("[COV] Error: Size of builtins cov map changed.\n");
113 exit(-1);
114 }
115 for (uint32_t i = 0; i < cov_map.size(); ++i) {
116 if (cov_map[i]) {
117 // TODO(ralbovsky): Can be optimized for fewer divisions.
118 shmem->edges[(i + builtins_start) / 8] |=
119 (1 << ((i + builtins_start) % 8));
120 }
121 }
122 }
123