1 /*-
2 * SPDX-License-Identifier: BSD-2-Clause
3 *
4 * Copyright (C) 2018 The FreeBSD Foundation. All rights reserved.
5 * Copyright (C) 2018, 2019 Andrew Turner
6 *
7 * This software was developed by Mitchell Horne under sponsorship of
8 * the FreeBSD Foundation.
9 *
10 * This software was developed by SRI International and the University of
11 * Cambridge Computer Laboratory under DARPA/AFRL contract FA8750-10-C-0237
12 * ("CTSRD"), as part of the DARPA CRASH research programme.
13 *
14 * Redistribution and use in source and binary forms, with or without
15 * modification, are permitted provided that the following conditions
16 * are met:
17 * 1. Redistributions of source code must retain the above copyright
18 * notice, this list of conditions and the following disclaimer.
19 * 2. Redistributions in binary form must reproduce the above copyright
20 * notice, this list of conditions and the following disclaimer in the
21 * documentation and/or other materials provided with the distribution.
22 *
23 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
24 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
25 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
26 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
27 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
28 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
29 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
30 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
31 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
32 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
33 * SUCH DAMAGE.
34 */
35
36 #ifdef KCSAN
37 #define SAN_RUNTIME
38 #endif
39
40 #include <sys/cdefs.h>
41 #include <sys/param.h>
42 #include <sys/coverage.h>
43
44 #include <machine/atomic.h>
45
46 void __sanitizer_cov_trace_pc(void);
47 void __sanitizer_cov_trace_cmp1(uint8_t, uint8_t);
48 void __sanitizer_cov_trace_cmp2(uint16_t, uint16_t);
49 void __sanitizer_cov_trace_cmp4(uint32_t, uint32_t);
50 void __sanitizer_cov_trace_cmp8(uint64_t, uint64_t);
51 void __sanitizer_cov_trace_const_cmp1(uint8_t, uint8_t);
52 void __sanitizer_cov_trace_const_cmp2(uint16_t, uint16_t);
53 void __sanitizer_cov_trace_const_cmp4(uint32_t, uint32_t);
54 void __sanitizer_cov_trace_const_cmp8(uint64_t, uint64_t);
55 void __sanitizer_cov_trace_switch(uint64_t, uint64_t *);
56
57 static cov_trace_pc_t cov_trace_pc;
58 static cov_trace_cmp_t cov_trace_cmp;
59
60 void
cov_register_pc(cov_trace_pc_t trace_pc)61 cov_register_pc(cov_trace_pc_t trace_pc)
62 {
63
64 atomic_store_ptr(&cov_trace_pc, trace_pc);
65 }
66
67 void
cov_unregister_pc(void)68 cov_unregister_pc(void)
69 {
70
71 atomic_store_ptr(&cov_trace_pc, NULL);
72 }
73
74 void
cov_register_cmp(cov_trace_cmp_t trace_cmp)75 cov_register_cmp(cov_trace_cmp_t trace_cmp)
76 {
77
78 atomic_store_ptr(&cov_trace_cmp, trace_cmp);
79 }
80
81 void
cov_unregister_cmp(void)82 cov_unregister_cmp(void)
83 {
84
85 atomic_store_ptr(&cov_trace_cmp, NULL);
86 }
87
88 /*
89 * Main entry point. A call to this function will be inserted
90 * at every edge, and if coverage is enabled for the thread
91 * this function will add the PC to the buffer.
92 */
93 void
__sanitizer_cov_trace_pc(void)94 __sanitizer_cov_trace_pc(void)
95 {
96 cov_trace_pc_t trace_pc;
97
98 trace_pc = atomic_load_ptr(&cov_trace_pc);
99 if (trace_pc != NULL)
100 trace_pc((uint64_t)__builtin_return_address(0));
101 }
102
103 /*
104 * Comparison entry points. When the kernel performs a comparison
105 * operation the compiler inserts a call to one of the following
106 * functions to record the operation.
107 */
108 void
__sanitizer_cov_trace_cmp1(uint8_t arg1,uint8_t arg2)109 __sanitizer_cov_trace_cmp1(uint8_t arg1, uint8_t arg2)
110 {
111 cov_trace_cmp_t trace_cmp;
112
113 trace_cmp = atomic_load_ptr(&cov_trace_cmp);
114 if (trace_cmp != NULL)
115 trace_cmp(COV_CMP_SIZE(0), arg1, arg2,
116 (uint64_t)__builtin_return_address(0));
117 }
118
119 void
__sanitizer_cov_trace_cmp2(uint16_t arg1,uint16_t arg2)120 __sanitizer_cov_trace_cmp2(uint16_t arg1, uint16_t arg2)
121 {
122 cov_trace_cmp_t trace_cmp;
123
124 trace_cmp = atomic_load_ptr(&cov_trace_cmp);
125 if (trace_cmp != NULL)
126 trace_cmp(COV_CMP_SIZE(1), arg1, arg2,
127 (uint64_t)__builtin_return_address(0));
128 }
129
130 void
__sanitizer_cov_trace_cmp4(uint32_t arg1,uint32_t arg2)131 __sanitizer_cov_trace_cmp4(uint32_t arg1, uint32_t arg2)
132 {
133 cov_trace_cmp_t trace_cmp;
134
135 trace_cmp = atomic_load_ptr(&cov_trace_cmp);
136 if (trace_cmp != NULL)
137 trace_cmp(COV_CMP_SIZE(2), arg1, arg2,
138 (uint64_t)__builtin_return_address(0));
139 }
140
141 void
__sanitizer_cov_trace_cmp8(uint64_t arg1,uint64_t arg2)142 __sanitizer_cov_trace_cmp8(uint64_t arg1, uint64_t arg2)
143 {
144 cov_trace_cmp_t trace_cmp;
145
146 trace_cmp = atomic_load_ptr(&cov_trace_cmp);
147 if (trace_cmp != NULL)
148 trace_cmp(COV_CMP_SIZE(3), arg1, arg2,
149 (uint64_t)__builtin_return_address(0));
150 }
151
152 void
__sanitizer_cov_trace_const_cmp1(uint8_t arg1,uint8_t arg2)153 __sanitizer_cov_trace_const_cmp1(uint8_t arg1, uint8_t arg2)
154 {
155 cov_trace_cmp_t trace_cmp;
156
157 trace_cmp = atomic_load_ptr(&cov_trace_cmp);
158 if (trace_cmp != NULL)
159 trace_cmp(COV_CMP_SIZE(0) | COV_CMP_CONST, arg1, arg2,
160 (uint64_t)__builtin_return_address(0));
161 }
162
163 void
__sanitizer_cov_trace_const_cmp2(uint16_t arg1,uint16_t arg2)164 __sanitizer_cov_trace_const_cmp2(uint16_t arg1, uint16_t arg2)
165 {
166 cov_trace_cmp_t trace_cmp;
167
168 trace_cmp = atomic_load_ptr(&cov_trace_cmp);
169 if (trace_cmp != NULL)
170 trace_cmp(COV_CMP_SIZE(1) | COV_CMP_CONST, arg1, arg2,
171 (uint64_t)__builtin_return_address(0));
172 }
173
174 void
__sanitizer_cov_trace_const_cmp4(uint32_t arg1,uint32_t arg2)175 __sanitizer_cov_trace_const_cmp4(uint32_t arg1, uint32_t arg2)
176 {
177 cov_trace_cmp_t trace_cmp;
178
179 trace_cmp = atomic_load_ptr(&cov_trace_cmp);
180 if (trace_cmp != NULL)
181 trace_cmp(COV_CMP_SIZE(2) | COV_CMP_CONST, arg1, arg2,
182 (uint64_t)__builtin_return_address(0));
183 }
184
185 void
__sanitizer_cov_trace_const_cmp8(uint64_t arg1,uint64_t arg2)186 __sanitizer_cov_trace_const_cmp8(uint64_t arg1, uint64_t arg2)
187 {
188 cov_trace_cmp_t trace_cmp;
189
190 trace_cmp = atomic_load_ptr(&cov_trace_cmp);
191 if (trace_cmp != NULL)
192 trace_cmp(COV_CMP_SIZE(3) | COV_CMP_CONST, arg1, arg2,
193 (uint64_t)__builtin_return_address(0));
194 }
195
196 /*
197 * val is the switch operand
198 * cases[0] is the number of case constants
199 * cases[1] is the size of val in bits
200 * cases[2..n] are the case constants
201 */
202 void
__sanitizer_cov_trace_switch(uint64_t val,uint64_t * cases)203 __sanitizer_cov_trace_switch(uint64_t val, uint64_t *cases)
204 {
205 uint64_t i, count, ret, type;
206 cov_trace_cmp_t trace_cmp;
207
208 trace_cmp = atomic_load_ptr(&cov_trace_cmp);
209 if (trace_cmp == NULL)
210 return;
211
212 count = cases[0];
213 ret = (uint64_t)__builtin_return_address(0);
214
215 switch (cases[1]) {
216 case 8:
217 type = COV_CMP_SIZE(0);
218 break;
219 case 16:
220 type = COV_CMP_SIZE(1);
221 break;
222 case 32:
223 type = COV_CMP_SIZE(2);
224 break;
225 case 64:
226 type = COV_CMP_SIZE(3);
227 break;
228 default:
229 return;
230 }
231
232 val |= COV_CMP_CONST;
233
234 for (i = 0; i < count; i++)
235 if (!trace_cmp(type, val, cases[i + 2], ret))
236 return;
237 }
238