diff options
| author | Kostya Serebryany <kcc@google.com> | 2016-02-17 21:34:43 +0000 |
|---|---|---|
| committer | Kostya Serebryany <kcc@google.com> | 2016-02-17 21:34:43 +0000 |
| commit | d4590c7304575702731b00749ae22e1298a98eba (patch) | |
| tree | 7bf5023a60a9e44773fef4c7c704b3c89250b328 /clang/docs/SanitizerCoverage.rst | |
| parent | 2af1e3e963d5af7a674f101cfebbddd7e74460ae (diff) | |
| download | llvm-d4590c7304575702731b00749ae22e1298a98eba.zip llvm-d4590c7304575702731b00749ae22e1298a98eba.tar.gz llvm-d4590c7304575702731b00749ae22e1298a98eba.tar.bz2 | |
[sanitizer-coverage] implement -fsanitize-coverage=trace-pc. This is similar to trace-bb, but has a different API. We already use the equivalent flag in GCC for Linux kernel fuzzing. We may be able to use this flag with AFL too
llvm-svn: 261159
Diffstat (limited to 'clang/docs/SanitizerCoverage.rst')
| -rw-r--r-- | clang/docs/SanitizerCoverage.rst | 11 |
1 files changed, 11 insertions, 0 deletions
diff --git a/clang/docs/SanitizerCoverage.rst b/clang/docs/SanitizerCoverage.rst index 0e49340..6d6e576 100644 --- a/clang/docs/SanitizerCoverage.rst +++ b/clang/docs/SanitizerCoverage.rst @@ -291,6 +291,17 @@ With ``-fsanitize-coverage=trace-bb`` the compiler will insert ``__sanitizer_cov_trace_basic_block(s32 *id)`` before every function, basic block, or edge (depending on the value of ``-fsanitize-coverage=[func,bb,edge]``). +Tracing PCs +=========== +*Experimental* feature similar to tracing basic blocks, but with a different API. +With ``-fsanitize-coverage=[func,bb,edge],trace-pc`` the compiler will insert +``__sanitizer_cov_trace_pc()`` on every function/block/edge. +With and additional ``indirect-calls`` flag +``__sanitizer_cov_trace_pc_indirect(void *callee)`` will be inserted on every indirect call. +These callbacks are not implemented in the Sanitizer run-time and should be defined +by the user. +This mechanism is used for fuzzing the Linux kernel (https://github.com/google/syzkaller). + Tracing data flow ================= |