2 * SPDX-License-Identifier: BSD-2-Clause-FreeBSD
4 * Copyright (C) 2018 The FreeBSD Foundation. All rights reserved.
5 * Copyright (C) 2018, 2019 Andrew Turner
7 * This software was developed by Mitchell Horne under sponsorship of
8 * the FreeBSD Foundation.
10 * This software was developed by SRI International and the University of
11 * Cambridge Computer Laboratory under DARPA/AFRL contract FA8750-10-C-0237
12 * ("CTSRD"), as part of the DARPA CRASH research programme.
14 * Redistribution and use in source and binary forms, with or without
15 * modification, are permitted provided that the following conditions
17 * 1. Redistributions of source code must retain the above copyright
18 * notice, this list of conditions and the following disclaimer.
19 * 2. Redistributions in binary form must reproduce the above copyright
20 * notice, this list of conditions and the following disclaimer in the
21 * documentation and/or other materials provided with the distribution.
23 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
24 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
25 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
26 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
27 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
28 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
29 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
30 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
31 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
32 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
38 #ifdef SAN_NEEDS_INTERCEPTORS
42 #include <sys/cdefs.h>
43 __FBSDID("$FreeBSD$");
45 #include <sys/param.h>
46 #include <sys/coverage.h>
48 #include <machine/atomic.h>
50 void __sanitizer_cov_trace_pc(void);
51 void __sanitizer_cov_trace_cmp1(uint8_t, uint8_t);
52 void __sanitizer_cov_trace_cmp2(uint16_t, uint16_t);
53 void __sanitizer_cov_trace_cmp4(uint32_t, uint32_t);
54 void __sanitizer_cov_trace_cmp8(uint64_t, uint64_t);
55 void __sanitizer_cov_trace_const_cmp1(uint8_t, uint8_t);
56 void __sanitizer_cov_trace_const_cmp2(uint16_t, uint16_t);
57 void __sanitizer_cov_trace_const_cmp4(uint32_t, uint32_t);
58 void __sanitizer_cov_trace_const_cmp8(uint64_t, uint64_t);
59 void __sanitizer_cov_trace_switch(uint64_t, uint64_t *);
61 static cov_trace_pc_t cov_trace_pc;
62 static cov_trace_cmp_t cov_trace_cmp;
65 cov_register_pc(cov_trace_pc_t trace_pc)
68 atomic_store_ptr(&cov_trace_pc, trace_pc);
72 cov_unregister_pc(void)
75 atomic_store_ptr(&cov_trace_pc, NULL);
79 cov_register_cmp(cov_trace_cmp_t trace_cmp)
82 atomic_store_ptr(&cov_trace_cmp, trace_cmp);
86 cov_unregister_cmp(void)
89 atomic_store_ptr(&cov_trace_cmp, NULL);
93 * Main entry point. A call to this function will be inserted
94 * at every edge, and if coverage is enabled for the thread
95 * this function will add the PC to the buffer.
98 __sanitizer_cov_trace_pc(void)
100 cov_trace_pc_t trace_pc;
102 trace_pc = atomic_load_ptr(&cov_trace_pc);
103 if (trace_pc != NULL)
104 trace_pc((uint64_t)__builtin_return_address(0));
108 * Comparison entry points. When the kernel performs a comparison
109 * operation the compiler inserts a call to one of the following
110 * functions to record the operation.
113 __sanitizer_cov_trace_cmp1(uint8_t arg1, uint8_t arg2)
115 cov_trace_cmp_t trace_cmp;
117 trace_cmp = atomic_load_ptr(&cov_trace_cmp);
118 if (trace_cmp != NULL)
119 trace_cmp(COV_CMP_SIZE(0), arg1, arg2,
120 (uint64_t)__builtin_return_address(0));
124 __sanitizer_cov_trace_cmp2(uint16_t arg1, uint16_t arg2)
126 cov_trace_cmp_t trace_cmp;
128 trace_cmp = atomic_load_ptr(&cov_trace_cmp);
129 if (trace_cmp != NULL)
130 trace_cmp(COV_CMP_SIZE(1), arg1, arg2,
131 (uint64_t)__builtin_return_address(0));
135 __sanitizer_cov_trace_cmp4(uint32_t arg1, uint32_t arg2)
137 cov_trace_cmp_t trace_cmp;
139 trace_cmp = atomic_load_ptr(&cov_trace_cmp);
140 if (trace_cmp != NULL)
141 trace_cmp(COV_CMP_SIZE(2), arg1, arg2,
142 (uint64_t)__builtin_return_address(0));
146 __sanitizer_cov_trace_cmp8(uint64_t arg1, uint64_t arg2)
148 cov_trace_cmp_t trace_cmp;
150 trace_cmp = atomic_load_ptr(&cov_trace_cmp);
151 if (trace_cmp != NULL)
152 trace_cmp(COV_CMP_SIZE(3), arg1, arg2,
153 (uint64_t)__builtin_return_address(0));
157 __sanitizer_cov_trace_const_cmp1(uint8_t arg1, uint8_t arg2)
159 cov_trace_cmp_t trace_cmp;
161 trace_cmp = atomic_load_ptr(&cov_trace_cmp);
162 if (trace_cmp != NULL)
163 trace_cmp(COV_CMP_SIZE(0) | COV_CMP_CONST, arg1, arg2,
164 (uint64_t)__builtin_return_address(0));
168 __sanitizer_cov_trace_const_cmp2(uint16_t arg1, uint16_t arg2)
170 cov_trace_cmp_t trace_cmp;
172 trace_cmp = atomic_load_ptr(&cov_trace_cmp);
173 if (trace_cmp != NULL)
174 trace_cmp(COV_CMP_SIZE(1) | COV_CMP_CONST, arg1, arg2,
175 (uint64_t)__builtin_return_address(0));
179 __sanitizer_cov_trace_const_cmp4(uint32_t arg1, uint32_t arg2)
181 cov_trace_cmp_t trace_cmp;
183 trace_cmp = atomic_load_ptr(&cov_trace_cmp);
184 if (trace_cmp != NULL)
185 trace_cmp(COV_CMP_SIZE(2) | COV_CMP_CONST, arg1, arg2,
186 (uint64_t)__builtin_return_address(0));
190 __sanitizer_cov_trace_const_cmp8(uint64_t arg1, uint64_t arg2)
192 cov_trace_cmp_t trace_cmp;
194 trace_cmp = atomic_load_ptr(&cov_trace_cmp);
195 if (trace_cmp != NULL)
196 trace_cmp(COV_CMP_SIZE(3) | COV_CMP_CONST, arg1, arg2,
197 (uint64_t)__builtin_return_address(0));
201 * val is the switch operand
202 * cases[0] is the number of case constants
203 * cases[1] is the size of val in bits
204 * cases[2..n] are the case constants
207 __sanitizer_cov_trace_switch(uint64_t val, uint64_t *cases)
209 uint64_t i, count, ret, type;
210 cov_trace_cmp_t trace_cmp;
212 trace_cmp = atomic_load_ptr(&cov_trace_cmp);
213 if (trace_cmp == NULL)
217 ret = (uint64_t)__builtin_return_address(0);
221 type = COV_CMP_SIZE(0);
224 type = COV_CMP_SIZE(1);
227 type = COV_CMP_SIZE(2);
230 type = COV_CMP_SIZE(3);
236 val |= COV_CMP_CONST;
238 for (i = 0; i < count; i++)
239 if (!trace_cmp(type, val, cases[i + 2], ret))