1 /*- 2 * SPDX-License-Identifier: BSD-2-Clause-FreeBSD 3 * 4 * Copyright (C) 2018 The FreeBSD Foundation. All rights reserved. 5 * Copyright (C) 2018, 2019 Andrew Turner 6 * 7 * This software was developed by Mitchell Horne under sponsorship of 8 * the FreeBSD Foundation. 9 * 10 * This software was developed by SRI International and the University of 11 * Cambridge Computer Laboratory under DARPA/AFRL contract FA8750-10-C-0237 12 * ("CTSRD"), as part of the DARPA CRASH research programme. 13 * 14 * Redistribution and use in source and binary forms, with or without 15 * modification, are permitted provided that the following conditions 16 * are met: 17 * 1. Redistributions of source code must retain the above copyright 18 * notice, this list of conditions and the following disclaimer. 19 * 2. Redistributions in binary form must reproduce the above copyright 20 * notice, this list of conditions and the following disclaimer in the 21 * documentation and/or other materials provided with the distribution. 22 * 23 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 24 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 25 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 26 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 27 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 28 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 29 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 30 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 31 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 32 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 33 * SUCH DAMAGE. 34 * 35 * $FreeBSD$ 36 */ 37 38 #define KCSAN_RUNTIME 39 40 #include <sys/cdefs.h> 41 __FBSDID("$FreeBSD$"); 42 43 #include <sys/param.h> 44 #include <sys/coverage.h> 45 46 #include <machine/atomic.h> 47 48 void __sanitizer_cov_trace_pc(void); 49 void __sanitizer_cov_trace_cmp1(uint8_t, uint8_t); 50 void __sanitizer_cov_trace_cmp2(uint16_t, uint16_t); 51 void __sanitizer_cov_trace_cmp4(uint32_t, uint32_t); 52 void __sanitizer_cov_trace_cmp8(uint64_t, uint64_t); 53 void __sanitizer_cov_trace_const_cmp1(uint8_t, uint8_t); 54 void __sanitizer_cov_trace_const_cmp2(uint16_t, uint16_t); 55 void __sanitizer_cov_trace_const_cmp4(uint32_t, uint32_t); 56 void __sanitizer_cov_trace_const_cmp8(uint64_t, uint64_t); 57 void __sanitizer_cov_trace_switch(uint64_t, uint64_t *); 58 59 static cov_trace_pc_t cov_trace_pc; 60 static cov_trace_cmp_t cov_trace_cmp; 61 62 void 63 cov_register_pc(cov_trace_pc_t trace_pc) 64 { 65 66 atomic_store_ptr(&cov_trace_pc, trace_pc); 67 } 68 69 void 70 cov_unregister_pc(void) 71 { 72 73 atomic_store_ptr(&cov_trace_pc, NULL); 74 } 75 76 void 77 cov_register_cmp(cov_trace_cmp_t trace_cmp) 78 { 79 80 atomic_store_ptr(&cov_trace_cmp, trace_cmp); 81 } 82 83 void 84 cov_unregister_cmp(void) 85 { 86 87 atomic_store_ptr(&cov_trace_cmp, NULL); 88 } 89 90 /* 91 * Main entry point. A call to this function will be inserted 92 * at every edge, and if coverage is enabled for the thread 93 * this function will add the PC to the buffer. 94 */ 95 void 96 __sanitizer_cov_trace_pc(void) 97 { 98 cov_trace_pc_t trace_pc; 99 100 trace_pc = atomic_load_ptr(&cov_trace_pc); 101 if (trace_pc != NULL) 102 trace_pc((uint64_t)__builtin_return_address(0)); 103 } 104 105 /* 106 * Comparison entry points. When the kernel performs a comparison 107 * operation the compiler inserts a call to one of the following 108 * functions to record the operation. 109 */ 110 void 111 __sanitizer_cov_trace_cmp1(uint8_t arg1, uint8_t arg2) 112 { 113 cov_trace_cmp_t trace_cmp; 114 115 trace_cmp = atomic_load_ptr(&cov_trace_cmp); 116 if (trace_cmp != NULL) 117 trace_cmp(COV_CMP_SIZE(0), arg1, arg2, 118 (uint64_t)__builtin_return_address(0)); 119 } 120 121 void 122 __sanitizer_cov_trace_cmp2(uint16_t arg1, uint16_t arg2) 123 { 124 cov_trace_cmp_t trace_cmp; 125 126 trace_cmp = atomic_load_ptr(&cov_trace_cmp); 127 if (trace_cmp != NULL) 128 trace_cmp(COV_CMP_SIZE(1), arg1, arg2, 129 (uint64_t)__builtin_return_address(0)); 130 } 131 132 void 133 __sanitizer_cov_trace_cmp4(uint32_t arg1, uint32_t arg2) 134 { 135 cov_trace_cmp_t trace_cmp; 136 137 trace_cmp = atomic_load_ptr(&cov_trace_cmp); 138 if (trace_cmp != NULL) 139 trace_cmp(COV_CMP_SIZE(2), arg1, arg2, 140 (uint64_t)__builtin_return_address(0)); 141 } 142 143 void 144 __sanitizer_cov_trace_cmp8(uint64_t arg1, uint64_t arg2) 145 { 146 cov_trace_cmp_t trace_cmp; 147 148 trace_cmp = atomic_load_ptr(&cov_trace_cmp); 149 if (trace_cmp != NULL) 150 trace_cmp(COV_CMP_SIZE(3), arg1, arg2, 151 (uint64_t)__builtin_return_address(0)); 152 } 153 154 void 155 __sanitizer_cov_trace_const_cmp1(uint8_t arg1, uint8_t arg2) 156 { 157 cov_trace_cmp_t trace_cmp; 158 159 trace_cmp = atomic_load_ptr(&cov_trace_cmp); 160 if (trace_cmp != NULL) 161 trace_cmp(COV_CMP_SIZE(0) | COV_CMP_CONST, arg1, arg2, 162 (uint64_t)__builtin_return_address(0)); 163 } 164 165 void 166 __sanitizer_cov_trace_const_cmp2(uint16_t arg1, uint16_t arg2) 167 { 168 cov_trace_cmp_t trace_cmp; 169 170 trace_cmp = atomic_load_ptr(&cov_trace_cmp); 171 if (trace_cmp != NULL) 172 trace_cmp(COV_CMP_SIZE(1) | COV_CMP_CONST, arg1, arg2, 173 (uint64_t)__builtin_return_address(0)); 174 } 175 176 void 177 __sanitizer_cov_trace_const_cmp4(uint32_t arg1, uint32_t arg2) 178 { 179 cov_trace_cmp_t trace_cmp; 180 181 trace_cmp = atomic_load_ptr(&cov_trace_cmp); 182 if (trace_cmp != NULL) 183 trace_cmp(COV_CMP_SIZE(2) | COV_CMP_CONST, arg1, arg2, 184 (uint64_t)__builtin_return_address(0)); 185 } 186 187 void 188 __sanitizer_cov_trace_const_cmp8(uint64_t arg1, uint64_t arg2) 189 { 190 cov_trace_cmp_t trace_cmp; 191 192 trace_cmp = atomic_load_ptr(&cov_trace_cmp); 193 if (trace_cmp != NULL) 194 trace_cmp(COV_CMP_SIZE(3) | COV_CMP_CONST, arg1, arg2, 195 (uint64_t)__builtin_return_address(0)); 196 } 197 198 /* 199 * val is the switch operand 200 * cases[0] is the number of case constants 201 * cases[1] is the size of val in bits 202 * cases[2..n] are the case constants 203 */ 204 void 205 __sanitizer_cov_trace_switch(uint64_t val, uint64_t *cases) 206 { 207 uint64_t i, count, ret, type; 208 cov_trace_cmp_t trace_cmp; 209 210 trace_cmp = atomic_load_ptr(&cov_trace_cmp); 211 if (trace_cmp == NULL) 212 return; 213 214 count = cases[0]; 215 ret = (uint64_t)__builtin_return_address(0); 216 217 switch (cases[1]) { 218 case 8: 219 type = COV_CMP_SIZE(0); 220 break; 221 case 16: 222 type = COV_CMP_SIZE(1); 223 break; 224 case 32: 225 type = COV_CMP_SIZE(2); 226 break; 227 case 64: 228 type = COV_CMP_SIZE(3); 229 break; 230 default: 231 return; 232 } 233 234 val |= COV_CMP_CONST; 235 236 for (i = 0; i < count; i++) 237 if (!trace_cmp(type, val, cases[i + 2], ret)) 238 return; 239 } 240