1 /*- 2 * SPDX-License-Identifier: BSD-2-Clause 3 * 4 * Copyright (C) 2018 The FreeBSD Foundation. All rights reserved. 5 * Copyright (C) 2018, 2019 Andrew Turner 6 * 7 * This software was developed by Mitchell Horne under sponsorship of 8 * the FreeBSD Foundation. 9 * 10 * This software was developed by SRI International and the University of 11 * Cambridge Computer Laboratory under DARPA/AFRL contract FA8750-10-C-0237 12 * ("CTSRD"), as part of the DARPA CRASH research programme. 13 * 14 * Redistribution and use in source and binary forms, with or without 15 * modification, are permitted provided that the following conditions 16 * are met: 17 * 1. Redistributions of source code must retain the above copyright 18 * notice, this list of conditions and the following disclaimer. 19 * 2. Redistributions in binary form must reproduce the above copyright 20 * notice, this list of conditions and the following disclaimer in the 21 * documentation and/or other materials provided with the distribution. 22 * 23 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 24 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 25 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 26 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 27 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 28 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 29 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 30 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 31 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 32 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 33 * SUCH DAMAGE. 34 */ 35 36 #ifdef SAN_NEEDS_INTERCEPTORS 37 #define SAN_RUNTIME 38 #endif 39 40 #include <sys/param.h> 41 #include <sys/coverage.h> 42 43 #include <machine/atomic.h> 44 45 void __sanitizer_cov_trace_pc(void); 46 void __sanitizer_cov_trace_cmp1(uint8_t, uint8_t); 47 void __sanitizer_cov_trace_cmp2(uint16_t, uint16_t); 48 void __sanitizer_cov_trace_cmp4(uint32_t, uint32_t); 49 void __sanitizer_cov_trace_cmp8(uint64_t, uint64_t); 50 void __sanitizer_cov_trace_const_cmp1(uint8_t, uint8_t); 51 void __sanitizer_cov_trace_const_cmp2(uint16_t, uint16_t); 52 void __sanitizer_cov_trace_const_cmp4(uint32_t, uint32_t); 53 void __sanitizer_cov_trace_const_cmp8(uint64_t, uint64_t); 54 void __sanitizer_cov_trace_switch(uint64_t, uint64_t *); 55 56 static cov_trace_pc_t cov_trace_pc; 57 static cov_trace_cmp_t cov_trace_cmp; 58 59 void 60 cov_register_pc(cov_trace_pc_t trace_pc) 61 { 62 63 atomic_store_ptr(&cov_trace_pc, trace_pc); 64 } 65 66 void 67 cov_unregister_pc(void) 68 { 69 70 atomic_store_ptr(&cov_trace_pc, NULL); 71 } 72 73 void 74 cov_register_cmp(cov_trace_cmp_t trace_cmp) 75 { 76 77 atomic_store_ptr(&cov_trace_cmp, trace_cmp); 78 } 79 80 void 81 cov_unregister_cmp(void) 82 { 83 84 atomic_store_ptr(&cov_trace_cmp, NULL); 85 } 86 87 /* 88 * Main entry point. A call to this function will be inserted 89 * at every edge, and if coverage is enabled for the thread 90 * this function will add the PC to the buffer. 91 */ 92 void 93 __sanitizer_cov_trace_pc(void) 94 { 95 cov_trace_pc_t trace_pc; 96 97 trace_pc = atomic_load_ptr(&cov_trace_pc); 98 if (trace_pc != NULL) 99 trace_pc((uint64_t)__builtin_return_address(0)); 100 } 101 102 /* 103 * Comparison entry points. When the kernel performs a comparison 104 * operation the compiler inserts a call to one of the following 105 * functions to record the operation. 106 */ 107 void 108 __sanitizer_cov_trace_cmp1(uint8_t arg1, uint8_t arg2) 109 { 110 cov_trace_cmp_t trace_cmp; 111 112 trace_cmp = atomic_load_ptr(&cov_trace_cmp); 113 if (trace_cmp != NULL) 114 trace_cmp(COV_CMP_SIZE(0), arg1, arg2, 115 (uint64_t)__builtin_return_address(0)); 116 } 117 118 void 119 __sanitizer_cov_trace_cmp2(uint16_t arg1, uint16_t arg2) 120 { 121 cov_trace_cmp_t trace_cmp; 122 123 trace_cmp = atomic_load_ptr(&cov_trace_cmp); 124 if (trace_cmp != NULL) 125 trace_cmp(COV_CMP_SIZE(1), arg1, arg2, 126 (uint64_t)__builtin_return_address(0)); 127 } 128 129 void 130 __sanitizer_cov_trace_cmp4(uint32_t arg1, uint32_t arg2) 131 { 132 cov_trace_cmp_t trace_cmp; 133 134 trace_cmp = atomic_load_ptr(&cov_trace_cmp); 135 if (trace_cmp != NULL) 136 trace_cmp(COV_CMP_SIZE(2), arg1, arg2, 137 (uint64_t)__builtin_return_address(0)); 138 } 139 140 void 141 __sanitizer_cov_trace_cmp8(uint64_t arg1, uint64_t arg2) 142 { 143 cov_trace_cmp_t trace_cmp; 144 145 trace_cmp = atomic_load_ptr(&cov_trace_cmp); 146 if (trace_cmp != NULL) 147 trace_cmp(COV_CMP_SIZE(3), arg1, arg2, 148 (uint64_t)__builtin_return_address(0)); 149 } 150 151 void 152 __sanitizer_cov_trace_const_cmp1(uint8_t arg1, uint8_t arg2) 153 { 154 cov_trace_cmp_t trace_cmp; 155 156 trace_cmp = atomic_load_ptr(&cov_trace_cmp); 157 if (trace_cmp != NULL) 158 trace_cmp(COV_CMP_SIZE(0) | COV_CMP_CONST, arg1, arg2, 159 (uint64_t)__builtin_return_address(0)); 160 } 161 162 void 163 __sanitizer_cov_trace_const_cmp2(uint16_t arg1, uint16_t arg2) 164 { 165 cov_trace_cmp_t trace_cmp; 166 167 trace_cmp = atomic_load_ptr(&cov_trace_cmp); 168 if (trace_cmp != NULL) 169 trace_cmp(COV_CMP_SIZE(1) | COV_CMP_CONST, arg1, arg2, 170 (uint64_t)__builtin_return_address(0)); 171 } 172 173 void 174 __sanitizer_cov_trace_const_cmp4(uint32_t arg1, uint32_t arg2) 175 { 176 cov_trace_cmp_t trace_cmp; 177 178 trace_cmp = atomic_load_ptr(&cov_trace_cmp); 179 if (trace_cmp != NULL) 180 trace_cmp(COV_CMP_SIZE(2) | COV_CMP_CONST, arg1, arg2, 181 (uint64_t)__builtin_return_address(0)); 182 } 183 184 void 185 __sanitizer_cov_trace_const_cmp8(uint64_t arg1, uint64_t arg2) 186 { 187 cov_trace_cmp_t trace_cmp; 188 189 trace_cmp = atomic_load_ptr(&cov_trace_cmp); 190 if (trace_cmp != NULL) 191 trace_cmp(COV_CMP_SIZE(3) | COV_CMP_CONST, arg1, arg2, 192 (uint64_t)__builtin_return_address(0)); 193 } 194 195 /* 196 * val is the switch operand 197 * cases[0] is the number of case constants 198 * cases[1] is the size of val in bits 199 * cases[2..n] are the case constants 200 */ 201 void 202 __sanitizer_cov_trace_switch(uint64_t val, uint64_t *cases) 203 { 204 uint64_t i, count, ret, type; 205 cov_trace_cmp_t trace_cmp; 206 207 trace_cmp = atomic_load_ptr(&cov_trace_cmp); 208 if (trace_cmp == NULL) 209 return; 210 211 count = cases[0]; 212 ret = (uint64_t)__builtin_return_address(0); 213 214 switch (cases[1]) { 215 case 8: 216 type = COV_CMP_SIZE(0); 217 break; 218 case 16: 219 type = COV_CMP_SIZE(1); 220 break; 221 case 32: 222 type = COV_CMP_SIZE(2); 223 break; 224 case 64: 225 type = COV_CMP_SIZE(3); 226 break; 227 default: 228 return; 229 } 230 231 val |= COV_CMP_CONST; 232 233 for (i = 0; i < count; i++) 234 if (!trace_cmp(type, val, cases[i + 2], ret)) 235 return; 236 } 237