sys/kern/subr_coverage.c

   1 /*-
   2  * SPDX-License-Identifier: BSD-2-Clause
   3  *
   4  * Copyright (C) 2018 The FreeBSD Foundation. All rights reserved.
   5  * Copyright (C) 2018, 2019 Andrew Turner
   6  *
   7  * This software was developed by Mitchell Horne under sponsorship of
   8  * the FreeBSD Foundation.
   9  *
  10  * This software was developed by SRI International and the University of
  11  * Cambridge Computer Laboratory under DARPA/AFRL contract FA8750-10-C-0237
  12  * ("CTSRD"), as part of the DARPA CRASH research programme.
  13  *
  14  * Redistribution and use in source and binary forms, with or without
  15  * modification, are permitted provided that the following conditions
  16  * are met:
  17  * 1. Redistributions of source code must retain the above copyright
  18  *    notice, this list of conditions and the following disclaimer.
  19  * 2. Redistributions in binary form must reproduce the above copyright
  20  *    notice, this list of conditions and the following disclaimer in the
  21  *    documentation and/or other materials provided with the distribution.
  22  *
  23  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
  24  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  25  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  26  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
  27  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  28  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  29  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  30  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  31  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  32  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  33  * SUCH DAMAGE.
  34  */
  35
  36 #ifdef SAN_NEEDS_INTERCEPTORS
  37 #define SAN_RUNTIME
  38 #endif
  39
  40 #include <sys/param.h>
  41 #include <sys/coverage.h>
  42
  43 #include <machine/atomic.h>
  44
  45 void __sanitizer_cov_trace_pc(void);
  46 void __sanitizer_cov_trace_cmp1(uint8_t, uint8_t);
  47 void __sanitizer_cov_trace_cmp2(uint16_t, uint16_t);
  48 void __sanitizer_cov_trace_cmp4(uint32_t, uint32_t);
  49 void __sanitizer_cov_trace_cmp8(uint64_t, uint64_t);
  50 void __sanitizer_cov_trace_const_cmp1(uint8_t, uint8_t);
  51 void __sanitizer_cov_trace_const_cmp2(uint16_t, uint16_t);
  52 void __sanitizer_cov_trace_const_cmp4(uint32_t, uint32_t);
  53 void __sanitizer_cov_trace_const_cmp8(uint64_t, uint64_t);
  54 void __sanitizer_cov_trace_switch(uint64_t, uint64_t *);
  55
  56 static cov_trace_pc_t cov_trace_pc;
  57 static cov_trace_cmp_t cov_trace_cmp;
  58
  59 void
  60 cov_register_pc(cov_trace_pc_t trace_pc)
  61 {
  62
  63         atomic_store_ptr(&cov_trace_pc, trace_pc);
  64 }
  65
  66 void
  67 cov_unregister_pc(void)
  68 {
  69
  70         atomic_store_ptr(&cov_trace_pc, NULL);
  71 }
  72
  73 void
  74 cov_register_cmp(cov_trace_cmp_t trace_cmp)
  75 {
  76
  77         atomic_store_ptr(&cov_trace_cmp, trace_cmp);
  78 }
  79
  80 void
  81 cov_unregister_cmp(void)
  82 {
  83
  84         atomic_store_ptr(&cov_trace_cmp, NULL);
  85 }
  86
  87 /*
  88  * Main entry point. A call to this function will be inserted
  89  * at every edge, and if coverage is enabled for the thread
  90  * this function will add the PC to the buffer.
  91  */
  92 void
  93 __sanitizer_cov_trace_pc(void)
  94 {
  95         cov_trace_pc_t trace_pc;
  96
  97         trace_pc = atomic_load_ptr(&cov_trace_pc);
  98         if (trace_pc != NULL)
  99                 trace_pc((uint64_t)__builtin_return_address(0));
 100 }
 101
 102 /*
 103  * Comparison entry points. When the kernel performs a comparison
 104  * operation the compiler inserts a call to one of the following
 105  * functions to record the operation.
 106  */
 107 void
 108 __sanitizer_cov_trace_cmp1(uint8_t arg1, uint8_t arg2)
 109 {
 110         cov_trace_cmp_t trace_cmp;
 111
 112         trace_cmp = atomic_load_ptr(&cov_trace_cmp);
 113         if (trace_cmp != NULL)
 114                 trace_cmp(COV_CMP_SIZE(0), arg1, arg2,
 115                     (uint64_t)__builtin_return_address(0));
 116 }
 117
 118 void
 119 __sanitizer_cov_trace_cmp2(uint16_t arg1, uint16_t arg2)
 120 {
 121         cov_trace_cmp_t trace_cmp;
 122
 123         trace_cmp = atomic_load_ptr(&cov_trace_cmp);
 124         if (trace_cmp != NULL)
 125                 trace_cmp(COV_CMP_SIZE(1), arg1, arg2,
 126                     (uint64_t)__builtin_return_address(0));
 127 }
 128
 129 void
 130 __sanitizer_cov_trace_cmp4(uint32_t arg1, uint32_t arg2)
 131 {
 132         cov_trace_cmp_t trace_cmp;
 133
 134         trace_cmp = atomic_load_ptr(&cov_trace_cmp);
 135         if (trace_cmp != NULL)
 136                 trace_cmp(COV_CMP_SIZE(2), arg1, arg2,
 137                     (uint64_t)__builtin_return_address(0));
 138 }
 139
 140 void
 141 __sanitizer_cov_trace_cmp8(uint64_t arg1, uint64_t arg2)
 142 {
 143         cov_trace_cmp_t trace_cmp;
 144
 145         trace_cmp = atomic_load_ptr(&cov_trace_cmp);
 146         if (trace_cmp != NULL)
 147                 trace_cmp(COV_CMP_SIZE(3), arg1, arg2,
 148                     (uint64_t)__builtin_return_address(0));
 149 }
 150
 151 void
 152 __sanitizer_cov_trace_const_cmp1(uint8_t arg1, uint8_t arg2)
 153 {
 154         cov_trace_cmp_t trace_cmp;
 155
 156         trace_cmp = atomic_load_ptr(&cov_trace_cmp);
 157         if (trace_cmp != NULL)
 158                 trace_cmp(COV_CMP_SIZE(0) | COV_CMP_CONST, arg1, arg2,
 159                     (uint64_t)__builtin_return_address(0));
 160 }
 161
 162 void
 163 __sanitizer_cov_trace_const_cmp2(uint16_t arg1, uint16_t arg2)
 164 {
 165         cov_trace_cmp_t trace_cmp;
 166
 167         trace_cmp = atomic_load_ptr(&cov_trace_cmp);
 168         if (trace_cmp != NULL)
 169                 trace_cmp(COV_CMP_SIZE(1) | COV_CMP_CONST, arg1, arg2,
 170                     (uint64_t)__builtin_return_address(0));
 171 }
 172
 173 void
 174 __sanitizer_cov_trace_const_cmp4(uint32_t arg1, uint32_t arg2)
 175 {
 176         cov_trace_cmp_t trace_cmp;
 177
 178         trace_cmp = atomic_load_ptr(&cov_trace_cmp);
 179         if (trace_cmp != NULL)
 180                 trace_cmp(COV_CMP_SIZE(2) | COV_CMP_CONST, arg1, arg2,
 181                     (uint64_t)__builtin_return_address(0));
 182 }
 183
 184 void
 185 __sanitizer_cov_trace_const_cmp8(uint64_t arg1, uint64_t arg2)
 186 {
 187         cov_trace_cmp_t trace_cmp;
 188
 189         trace_cmp = atomic_load_ptr(&cov_trace_cmp);
 190         if (trace_cmp != NULL)
 191                 trace_cmp(COV_CMP_SIZE(3) | COV_CMP_CONST, arg1, arg2,
 192                     (uint64_t)__builtin_return_address(0));
 193 }
 194
 195 /*
 196  * val is the switch operand
 197  * cases[0] is the number of case constants
 198  * cases[1] is the size of val in bits
 199  * cases[2..n] are the case constants
 200  */
 201 void
 202 __sanitizer_cov_trace_switch(uint64_t val, uint64_t *cases)
 203 {
 204         uint64_t i, count, ret, type;
 205         cov_trace_cmp_t trace_cmp;
 206
 207         trace_cmp = atomic_load_ptr(&cov_trace_cmp);
 208         if (trace_cmp == NULL)
 209                 return;
 210
 211         count = cases[0];
 212         ret = (uint64_t)__builtin_return_address(0);
 213
 214         switch (cases[1]) {
 215         case 8:
 216                 type = COV_CMP_SIZE(0);
 217                 break;
 218         case 16:
 219                 type = COV_CMP_SIZE(1);
 220                 break;
 221         case 32:
 222                 type = COV_CMP_SIZE(2);
 223                 break;
 224         case 64:
 225                 type = COV_CMP_SIZE(3);
 226                 break;
 227         default:
 228                 return;
 229         }
 230
 231         val |= COV_CMP_CONST;
 232
 233         for (i = 0; i < count; i++)
 234                 if (!trace_cmp(type, val, cases[i + 2], ret))
 235                         return;
 236 }