1 /*- 2 * SPDX-License-Identifier: BSD-2-Clause 3 * 4 * Copyright (C) 2018 The FreeBSD Foundation. All rights reserved. 5 * Copyright (C) 2018, 2019 Andrew Turner 6 * 7 * This software was developed by Mitchell Horne under sponsorship of 8 * the FreeBSD Foundation. 9 * 10 * This software was developed by SRI International and the University of 11 * Cambridge Computer Laboratory under DARPA/AFRL contract FA8750-10-C-0237 12 * ("CTSRD"), as part of the DARPA CRASH research programme. 13 * 14 * Redistribution and use in source and binary forms, with or without 15 * modification, are permitted provided that the following conditions 16 * are met: 17 * 1. Redistributions of source code must retain the above copyright 18 * notice, this list of conditions and the following disclaimer. 19 * 2. Redistributions in binary form must reproduce the above copyright 20 * notice, this list of conditions and the following disclaimer in the 21 * documentation and/or other materials provided with the distribution. 22 * 23 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 24 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 25 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 26 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 27 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 28 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 29 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 30 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 31 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 32 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 33 * SUCH DAMAGE. 34 */ 35 36 #ifdef SAN_NEEDS_INTERCEPTORS 37 #define SAN_RUNTIME 38 #endif 39 40 #include <sys/cdefs.h> 41 #include <sys/param.h> 42 #include <sys/coverage.h> 43 44 #include <machine/atomic.h> 45 46 void __sanitizer_cov_trace_pc(void); 47 void __sanitizer_cov_trace_cmp1(uint8_t, uint8_t); 48 void __sanitizer_cov_trace_cmp2(uint16_t, uint16_t); 49 void __sanitizer_cov_trace_cmp4(uint32_t, uint32_t); 50 void __sanitizer_cov_trace_cmp8(uint64_t, uint64_t); 51 void __sanitizer_cov_trace_const_cmp1(uint8_t, uint8_t); 52 void __sanitizer_cov_trace_const_cmp2(uint16_t, uint16_t); 53 void __sanitizer_cov_trace_const_cmp4(uint32_t, uint32_t); 54 void __sanitizer_cov_trace_const_cmp8(uint64_t, uint64_t); 55 void __sanitizer_cov_trace_switch(uint64_t, uint64_t *); 56 57 static cov_trace_pc_t cov_trace_pc; 58 static cov_trace_cmp_t cov_trace_cmp; 59 60 void 61 cov_register_pc(cov_trace_pc_t trace_pc) 62 { 63 64 atomic_store_ptr(&cov_trace_pc, trace_pc); 65 } 66 67 void 68 cov_unregister_pc(void) 69 { 70 71 atomic_store_ptr(&cov_trace_pc, NULL); 72 } 73 74 void 75 cov_register_cmp(cov_trace_cmp_t trace_cmp) 76 { 77 78 atomic_store_ptr(&cov_trace_cmp, trace_cmp); 79 } 80 81 void 82 cov_unregister_cmp(void) 83 { 84 85 atomic_store_ptr(&cov_trace_cmp, NULL); 86 } 87 88 /* 89 * Main entry point. A call to this function will be inserted 90 * at every edge, and if coverage is enabled for the thread 91 * this function will add the PC to the buffer. 92 */ 93 void 94 __sanitizer_cov_trace_pc(void) 95 { 96 cov_trace_pc_t trace_pc; 97 98 trace_pc = atomic_load_ptr(&cov_trace_pc); 99 if (trace_pc != NULL) 100 trace_pc((uint64_t)__builtin_return_address(0)); 101 } 102 103 /* 104 * Comparison entry points. When the kernel performs a comparison 105 * operation the compiler inserts a call to one of the following 106 * functions to record the operation. 107 */ 108 void 109 __sanitizer_cov_trace_cmp1(uint8_t arg1, uint8_t arg2) 110 { 111 cov_trace_cmp_t trace_cmp; 112 113 trace_cmp = atomic_load_ptr(&cov_trace_cmp); 114 if (trace_cmp != NULL) 115 trace_cmp(COV_CMP_SIZE(0), arg1, arg2, 116 (uint64_t)__builtin_return_address(0)); 117 } 118 119 void 120 __sanitizer_cov_trace_cmp2(uint16_t arg1, uint16_t arg2) 121 { 122 cov_trace_cmp_t trace_cmp; 123 124 trace_cmp = atomic_load_ptr(&cov_trace_cmp); 125 if (trace_cmp != NULL) 126 trace_cmp(COV_CMP_SIZE(1), arg1, arg2, 127 (uint64_t)__builtin_return_address(0)); 128 } 129 130 void 131 __sanitizer_cov_trace_cmp4(uint32_t arg1, uint32_t arg2) 132 { 133 cov_trace_cmp_t trace_cmp; 134 135 trace_cmp = atomic_load_ptr(&cov_trace_cmp); 136 if (trace_cmp != NULL) 137 trace_cmp(COV_CMP_SIZE(2), arg1, arg2, 138 (uint64_t)__builtin_return_address(0)); 139 } 140 141 void 142 __sanitizer_cov_trace_cmp8(uint64_t arg1, uint64_t arg2) 143 { 144 cov_trace_cmp_t trace_cmp; 145 146 trace_cmp = atomic_load_ptr(&cov_trace_cmp); 147 if (trace_cmp != NULL) 148 trace_cmp(COV_CMP_SIZE(3), arg1, arg2, 149 (uint64_t)__builtin_return_address(0)); 150 } 151 152 void 153 __sanitizer_cov_trace_const_cmp1(uint8_t arg1, uint8_t arg2) 154 { 155 cov_trace_cmp_t trace_cmp; 156 157 trace_cmp = atomic_load_ptr(&cov_trace_cmp); 158 if (trace_cmp != NULL) 159 trace_cmp(COV_CMP_SIZE(0) | COV_CMP_CONST, arg1, arg2, 160 (uint64_t)__builtin_return_address(0)); 161 } 162 163 void 164 __sanitizer_cov_trace_const_cmp2(uint16_t arg1, uint16_t arg2) 165 { 166 cov_trace_cmp_t trace_cmp; 167 168 trace_cmp = atomic_load_ptr(&cov_trace_cmp); 169 if (trace_cmp != NULL) 170 trace_cmp(COV_CMP_SIZE(1) | COV_CMP_CONST, arg1, arg2, 171 (uint64_t)__builtin_return_address(0)); 172 } 173 174 void 175 __sanitizer_cov_trace_const_cmp4(uint32_t arg1, uint32_t arg2) 176 { 177 cov_trace_cmp_t trace_cmp; 178 179 trace_cmp = atomic_load_ptr(&cov_trace_cmp); 180 if (trace_cmp != NULL) 181 trace_cmp(COV_CMP_SIZE(2) | COV_CMP_CONST, arg1, arg2, 182 (uint64_t)__builtin_return_address(0)); 183 } 184 185 void 186 __sanitizer_cov_trace_const_cmp8(uint64_t arg1, uint64_t arg2) 187 { 188 cov_trace_cmp_t trace_cmp; 189 190 trace_cmp = atomic_load_ptr(&cov_trace_cmp); 191 if (trace_cmp != NULL) 192 trace_cmp(COV_CMP_SIZE(3) | COV_CMP_CONST, arg1, arg2, 193 (uint64_t)__builtin_return_address(0)); 194 } 195 196 /* 197 * val is the switch operand 198 * cases[0] is the number of case constants 199 * cases[1] is the size of val in bits 200 * cases[2..n] are the case constants 201 */ 202 void 203 __sanitizer_cov_trace_switch(uint64_t val, uint64_t *cases) 204 { 205 uint64_t i, count, ret, type; 206 cov_trace_cmp_t trace_cmp; 207 208 trace_cmp = atomic_load_ptr(&cov_trace_cmp); 209 if (trace_cmp == NULL) 210 return; 211 212 count = cases[0]; 213 ret = (uint64_t)__builtin_return_address(0); 214 215 switch (cases[1]) { 216 case 8: 217 type = COV_CMP_SIZE(0); 218 break; 219 case 16: 220 type = COV_CMP_SIZE(1); 221 break; 222 case 32: 223 type = COV_CMP_SIZE(2); 224 break; 225 case 64: 226 type = COV_CMP_SIZE(3); 227 break; 228 default: 229 return; 230 } 231 232 val |= COV_CMP_CONST; 233 234 for (i = 0; i < count; i++) 235 if (!trace_cmp(type, val, cases[i + 2], ret)) 236 return; 237 } 238