Ressurect helper-rust integration coverage (mostly)

Author: cataphract

.gitlab/generate-appsec.php

@@ -263,6 +263,65 @@
         - appsec/tests/integration/build/*.tar.gz
         - .gradle-home/wrapper/dists/
 
+"helper-rust integration coverage":
+  stage: test
+  image: 486234852809.dkr.ecr.us-east-1.amazonaws.com/docker:29.4.0-noble
+  tags: [ "docker-in-docker:amd64" ]
+  interruptible: true
+  rules:
+    - if: $CI_COMMIT_BRANCH == "master"
+      interruptible: false
+    - when: on_success
+  variables:
+    KUBERNETES_CPU_REQUEST: 8
+    KUBERNETES_MEMORY_REQUEST: 24Gi
+    KUBERNETES_MEMORY_LIMIT: 30Gi
+    ARCH: amd64
+    GRADLE_USER_HOME: "$CI_PROJECT_DIR/.gradle-home"
+  before_script:
+<?php echo $ecrLoginSnippet, "\n"; ?>
+<?php dockerhub_login() ?>
+  script:
+    - apt update && apt install -y openjdk-17-jre
+    - |
+      cd appsec/tests/integration
+      CACHE_PATH=build/php-appsec-volume-caches-${ARCH}.tar.gz
+      if [ -f "$CACHE_PATH" ]; then
+        echo "Loading cache from $CACHE_PATH"
+        TERM=dumb ./gradlew loadCaches --info
+      fi
+
+      TERM=dumb ./gradlew buildPortableLibdatadogPhp \
+        --info -Pbuildscan --scan -PuseHelperRustCoverage
+      TERM=dumb ./gradlew test8.3-release-ssi test8.4-release-zts-ssi \
+        --info -Pbuildscan --scan -PcheckCoreDumps -PuseHelperRustCoverage
+      TERM=dumb ./gradlew saveCaches --info
+    - |
+      cd "$CI_PROJECT_DIR"
+      DD_COVERAGE_FLAGS=helper-rust-integration-8.3-release-ssi \
+        .gitlab/upload-code-coverage-to-datadog.sh \
+          appsec/tests/integration/build/reports/coverage/8.3-release-ssi/helper-rust-integration.lcov
+      DD_COVERAGE_FLAGS=helper-rust-integration-8.4-release-zts-ssi \
+        .gitlab/upload-code-coverage-to-datadog.sh \
+          appsec/tests/integration/build/reports/coverage/8.4-release-zts-ssi/helper-rust-integration.lcov
+  after_script:
+    - mkdir -p "${CI_PROJECT_DIR}/artifacts"
+    - find appsec/tests/integration/build/test-results -name "*.xml" -exec cp --parents '{}' "${CI_PROJECT_DIR}/artifacts/" \; || true
+    - cp -r appsec/tests/integration/build/test-logs "${CI_PROJECT_DIR}/artifacts/" 2>/dev/null || true
+    - .gitlab/silent-upload-junit-to-datadog.sh "test.source.file:appsec/"
+  artifacts:
+    reports:
+      junit: "artifacts/**/test-results/**/TEST-*.xml"
+    paths:
+      - "artifacts/"
+      - appsec/tests/integration/build/reports/coverage/*/helper-rust-integration.lcov
+    when: always
+  cache:
+    - key: "appsec int test cache"
+      paths:
+        - appsec/tests/integration/build/*.tar.gz
+        - .gradle-home/wrapper/dists/
+
 "appsec code coverage":
   stage: test
   extends: .appsec_test

Cargo.lock

@@ -4,40 +4,16 @@ use std::path::PathBuf;
 fn main() {
     println!("cargo::rustc-check-cfg=cfg(tokio_unstable)");
 
-    let target = env::var("TARGET").expect("TARGET environment variable not set");
     let has_coverage = env::var("CARGO_FEATURE_COVERAGE").is_ok();
 
-    // When building with coverage instrumentation, compile coverage initialization code
-    // that configures LLVM profiling runtime at library load time
+    // When building with coverage instrumentation, compile the code used by
+    // the sidecar entrypoint to initialize the LLVM profiling runtime.
     if has_coverage {
-        let out_dir = env::var("OUT_DIR").expect("OUT_DIR not set");
-
         cc::Build::new()
             .file("coverage_init.c")
             .define("COVERAGE_BUILD", None)
             .compile("coverage_init");
 
-        // On aarch64, the LLVM profiler runtime requires outline-atomic functions
-        // that aren't available in older glibc versions
-        let needs_outline_atomics = target.contains("aarch64");
-        if needs_outline_atomics {
-            cc::Build::new()
-                .file("outline_atomics.c")
-                .compile("outline_atomics");
-            println!("cargo::rerun-if-changed=outline_atomics.c");
-        }
-
-        // Force the linker to include coverage_init.a and outline_atomics.a in their
-        // entirety, even though nothing in Rust references their symbols directly.
-        // coverage_init.c has constructor/destructor functions for flushing coverage.
-        // outline_atomics.c provides atomic helpers needed by the profiler runtime.
-        println!("cargo::rustc-link-arg=-Wl,--whole-archive");
-        println!("cargo::rustc-link-arg={}/libcoverage_init.a", out_dir);
-        if needs_outline_atomics {
-            println!("cargo::rustc-link-arg={}/liboutline_atomics.a", out_dir);
-        }
-        println!("cargo::rustc-link-arg=-Wl,--no-whole-archive");
-
         println!("cargo::rerun-if-changed=coverage_init.c");
     }
 

appsec/helper-rust/build.rs

@@ -1,8 +1,7 @@
 // LLVM coverage profiling initialization for helper-rust
 //
-// This module sets up the LLVM profiling environment when the helper is
-// loaded by sidecar. It reinitializes the LLVM profiling runtime to use
-// the correct output path.
+// The embedded sidecar calls this module explicitly from its entrypoint. It
+// reinitializes the LLVM profiling runtime to use the correct output path.
 //
 // Coverage data is flushed when the process receives SIGUSR1, as well as
 // at normal process exit via atexit handler.
@@ -21,6 +20,7 @@
 
 // LLVM profiling runtime API (from compiler-rt/lib/profile/)
 extern void __llvm_profile_initialize_file(void);
+extern void __llvm_profile_set_filename(const char *);
 extern int __llvm_profile_write_file(void);
 extern const char *__llvm_profile_get_filename(void);
 
@@ -82,21 +82,20 @@ static void coverage_signal_handler(int signo) {
     coverage_log("__llvm_profile_write_file() returned %d", ret);
 }
 
-__attribute__((constructor))
-static void coverage_init(void) {
-    coverage_log("coverage_init() constructor called");
+void ddappsec_helper_coverage_init(void) {
+    coverage_log("ddappsec_helper_coverage_init() called");
 
-    const char *env_profile = getenv("LLVM_PROFILE_FILE");
-    coverage_log("LLVM_PROFILE_FILE env = %s", env_profile ? env_profile : "(null)");
+    const char *profile_path = getenv("_DD_HELPER_RUST_COVERAGE_FILE");
+    if (!profile_path) {
+        profile_path = "/helper-rust/coverage/helper-%h-%p-%m.profraw";
+    }
+    coverage_log("Helper coverage profile = %s", profile_path);
 
     const char *filename_before = __llvm_profile_get_filename();
     coverage_log("Profile filename BEFORE reinit: %s",
                  filename_before ? filename_before : "(null)");
 
-    const char *profile_path = "/helper-rust/coverage/helper-%p-%m.profraw";
-    coverage_log("Setting LLVM_PROFILE_FILE to: %s", profile_path);
-    setenv("LLVM_PROFILE_FILE", profile_path, 1);
-
+    __llvm_profile_set_filename(profile_path);
     coverage_log("Calling __llvm_profile_initialize_file()");
     __llvm_profile_initialize_file();
 
@@ -110,17 +109,7 @@ static void coverage_init(void) {
     atexit(coverage_atexit);
     coverage_log("Registered atexit handler");
 
-    coverage_log("coverage_init() completed");
-}
-
-__attribute__((destructor))
-static void coverage_fini(void) {
-    coverage_log("coverage_fini() destructor called");
-    coverage_flush();
-    if (log_fd >= 0 && log_fd != STDERR_FILENO) {
-        close(log_fd);
-        log_fd = -1;
-    }
+    coverage_log("ddappsec_helper_coverage_init() completed");
 }
 
 #endif // COVERAGE_BUILD

appsec/helper-rust/coverage_init.c

@@ -17,6 +17,17 @@ use datadog_sidecar::service::telemetry::InProcessTelemetryClientFactory;
 
 pub use client::{on_disconnect, on_message, MessageResponse};
 
+#[cfg(feature = "coverage")]
+pub fn initialize_coverage() {
+    unsafe extern "C" {
+        fn ddappsec_helper_coverage_init();
+    }
+
+    unsafe {
+        ddappsec_helper_coverage_init();
+    }
+}
+
 pub struct AppSecHelper {
     cancel_token: CancellationToken,
     client_task_tracker: TaskTracker,