add code coverage support

CMakeLists.txt

@@ -34,6 +34,7 @@ version of libcrypto by interning the code and hiding symbols. This also enables
 loaded in an application with an otherwise conflicting libcrypto version." OFF)
 option(S2N_LTO, "Enables link time optimizations when building s2n-tls." OFF)
 option(S2N_STACKTRACE "Enables stacktrace functionality in s2n-tls." ON)
+option(COVERAGE "Enable profiling collection for code coverage calculation" OFF)
 
 # Turn BUILD_TESTING=ON by default
 include(CTest)
@@ -116,7 +117,7 @@ else()
     # supports it and set proper compiler flags to be added later to the
     # Kyber compilation units.
     if(${CMAKE_SYSTEM_PROCESSOR} MATCHES "^(x86_64|amd64|AMD64)$")
-    
+
         set(KYBER512R3_AVX2_BMI2_FLAGS "-mavx2 -mavx -mbmi2")
         try_compile(KYBER512R3_AVX2_BMI2_SUPPORTED
             ${CMAKE_BINARY_DIR}
@@ -366,6 +367,18 @@ if (NOT $ENV{S2N_LIBCRYPTO} STREQUAL "awslc")
     target_compile_options(${PROJECT_NAME} PRIVATE -Wcast-qual)
 endif()
 
+if (COVERAGE)
+    # https://cmake.org/cmake/help/latest/variable/CMAKE_LANG_COMPILER_ID.html
+    # Coverage is done using LLVM source based coverage. This is only supported
+    # on LLVM compilers. GCC would fail with "unrecognized compile options"
+    # on -fprofile-instr-generate -fcoverage-mapping flags.
+    if (NOT ${CMAKE_C_COMPILER_ID} MATCHES Clang)
+        message(FATAL_ERROR "This project requires clang for coverage support")
+    endif()
+    target_compile_options(${PROJECT_NAME} PUBLIC -fprofile-instr-generate -fcoverage-mapping)
+    target_link_options(${PROJECT_NAME} PUBLIC -fprofile-instr-generate -fcoverage-mapping)
+endif()
+
 # For interning, we need to find the static libcrypto library. Cmake configs
 # can branch on the variable BUILD_SHARED_LIBS to e.g. avoid having to define
 # multiple targets. An example is AWS-LC:

codebuild/bin/coverage_build.sh

@@ -0,0 +1,29 @@
+#!/bin/bash
+# Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License").
+# You may not use this file except in compliance with the License.
+# A copy of the License is located at
+#
+#  http://aws.amazon.com/apache2.0
+#
+# or in the "license" file accompanying this file. This file is distributed
+# on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either
+# express or implied. See the License for the specific language governing
+# permissions and limitations under the License.
+
+set -e
+
+source codebuild/bin/s2n_setup_env.sh
+
+# LLVM complains about corrupt coverage information
+# for static targets, so compile to a shared lib
+# instead.
+cmake . -Bbuild \
+    -DCOVERAGE=ON \
+    -DCMAKE_PREFIX_PATH=$LIBCRYPTO_ROOT \
+    -DBUILD_SHARED_LIBS=ON
+
+cmake --build ./build -- -j $(nproc)
+
+echo "done with the build"

codebuild/bin/coverage_report.sh

@@ -0,0 +1,34 @@
+#!/bin/bash
+# Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License").
+# You may not use this file except in compliance with the License.
+# A copy of the License is located at
+#
+#  http://aws.amazon.com/apache2.0
+#
+# or in the "license" file accompanying this file. This file is distributed
+# on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either
+# express or implied. See the License for the specific language governing
+# permissions and limitations under the License.
+
+set -e
+
+# merge profiling data
+llvm-profdata merge -sparse tests/unit/ut_*.profraw -o merged.profdata
+
+# generate file-level summary
+llvm-cov report build/lib/libs2n.so \
+    -instr-profile=merged.profdata \
+    > coverage_summary.txt
+
+# convert llvm information to lcov format for genhtml
+llvm-cov export build/lib/libs2n.so \
+    -instr-profile=merged.profdata \
+    -format=lcov \
+    > unit_test_coverage.info
+
+# generate html report with annotated source files
+genhtml unit_test_coverage.info \
+    --branch-coverage \
+    -o coverage_report

codebuild/bin/coverage_upload.sh

@@ -0,0 +1,25 @@
+#!/bin/bash
+# Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License").
+# You may not use this file except in compliance with the License.
+# A copy of the License is located at
+#
+#  http://aws.amazon.com/apache2.0
+#
+# or in the "license" file accompanying this file. This file is distributed
+# on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either
+# express or implied. See the License for the specific language governing
+# permissions and limitations under the License.
+#
+
+set -e
+echo "The codebuild source version is ${CODEBUILD_SOURCE_VERSION}"
+
+CLOUDFRONT_DISTRIBUTION="https://dx1inn44oyl7n.cloudfront.net"
+
+aws s3 sync coverage_report      s3://s2n-tls-public-coverage-artifacts/${CODEBUILD_SOURCE_VERSION}/report
+aws s3 cp   coverage_summary.txt s3://s2n-tls-public-coverage-artifacts/${CODEBUILD_SOURCE_VERSION}/summary.txt
+
+echo "report : is at ${CLOUDFRONT_DISTRIBUTION}/${CODEBUILD_SOURCE_VERSION}/report/index.html"
+echo "summary: is at ${CLOUDFRONT_DISTRIBUTION}/${CODEBUILD_SOURCE_VERSION}/summary.txt"

codebuild/spec/buildspec_omnibus.yml

@@ -218,10 +218,18 @@ batch:
         variables:
           BUILD_S2N: true
           GCC_VERSION: 6
-          S2N_COVERAGE: true
           S2N_LIBCRYPTO: openssl-1.1.1
           TESTS: unit
-      identifier: s2nUnitOpenSSL111Gcc6Coverage
+      identifier: s2nUnitOpenSSL111Gcc6
+
+    - identifier: s2nUnitCoverage
+      buildspec: codebuild/spec/buildspec_unit_coverage.yml
+      env:
+        privileged-mode: true
+        compute-type: BUILD_GENERAL1_LARGE
+        image: 024603541914.dkr.ecr.us-west-2.amazonaws.com/docker:ubuntu22codebuild
+        variables:
+          S2N_LIBCRYPTO: openssl-1.1.1
 
     - buildspec: codebuild/spec/buildspec_ubuntu.yml
       env:

codebuild/spec/buildspec_unit_coverage.yml

@@ -0,0 +1,43 @@
+---
+# Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License"). You may not use
+# this file except in compliance with the License. A copy of the License is
+# located at
+#
+# http://aws.amazon.com/apache2.0/
+#
+# or in the "license" file accompanying this file. This file is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+# implied. See the License for the specific language governing permissions and
+# limitations under the License.
+version: 0.2
+
+env:
+  parameter-store:
+    CODECOV_TOKEN : codecov-upload-token
+  variables:
+    # CODEBUILD_ is a reserved namespace.
+    CB_BIN_DIR: "./codebuild/bin"
+    CC: "/usr/bin/clang"
+    CXX: "/usr/bin/clang++"
+
+phases:
+  pre_build:
+    commands:
+      - |
+        if [ -d "third-party-src" ]; then
+          cd third-party-src;
+          ln -s /usr/local $CODEBUILD_SRC_DIR/third-party-src/test-deps;
+        fi
+      - ln -s /usr/local $CODEBUILD_SRC_DIR/test-deps
+  build:
+    on-failure: ABORT
+    commands:
+      - $CB_BIN_DIR/coverage_build.sh
+  post_build:
+    on-failure: ABORT
+    commands:
+      - LLVM_PROFILE_FILE="ut_%p.profraw" CTEST_PARALLEL_LEVEL=$(nproc) make -C build test
+      - $CB_BIN_DIR/coverage_report.sh
+      - $CB_BIN_DIR/coverage_upload.sh