1/*-
2 * SPDX-License-Identifier: BSD-2-Clause
3 *
4 * Copyright (C) 2018 The FreeBSD Foundation. All rights reserved.
5 * Copyright (C) 2018, 2019 Andrew Turner
6 *
7 * This software was developed by Mitchell Horne under sponsorship of
8 * the FreeBSD Foundation.
9 *
10 * This software was developed by SRI International and the University of
11 * Cambridge Computer Laboratory under DARPA/AFRL contract FA8750-10-C-0237
12 * ("CTSRD"), as part of the DARPA CRASH research programme.
13 *
14 * Redistribution and use in source and binary forms, with or without
15 * modification, are permitted provided that the following conditions
16 * are met:
17 * 1. Redistributions of source code must retain the above copyright
18 *    notice, this list of conditions and the following disclaimer.
19 * 2. Redistributions in binary form must reproduce the above copyright
20 *    notice, this list of conditions and the following disclaimer in the
21 *    documentation and/or other materials provided with the distribution.
22 *
23 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
24 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
25 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
26 * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
27 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
28 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
29 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
30 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
31 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
32 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
33 * SUCH DAMAGE.
34 */
35
36#ifdef SAN_NEEDS_INTERCEPTORS
37#define	SAN_RUNTIME
38#endif
39
40#include <sys/param.h>
41#include <sys/coverage.h>
42
43#include <machine/atomic.h>
44
45void __sanitizer_cov_trace_pc(void);
46void __sanitizer_cov_trace_cmp1(uint8_t, uint8_t);
47void __sanitizer_cov_trace_cmp2(uint16_t, uint16_t);
48void __sanitizer_cov_trace_cmp4(uint32_t, uint32_t);
49void __sanitizer_cov_trace_cmp8(uint64_t, uint64_t);
50void __sanitizer_cov_trace_const_cmp1(uint8_t, uint8_t);
51void __sanitizer_cov_trace_const_cmp2(uint16_t, uint16_t);
52void __sanitizer_cov_trace_const_cmp4(uint32_t, uint32_t);
53void __sanitizer_cov_trace_const_cmp8(uint64_t, uint64_t);
54void __sanitizer_cov_trace_switch(uint64_t, uint64_t *);
55
56static cov_trace_pc_t cov_trace_pc;
57static cov_trace_cmp_t cov_trace_cmp;
58
59void
60cov_register_pc(cov_trace_pc_t trace_pc)
61{
62
63	atomic_store_ptr(&cov_trace_pc, trace_pc);
64}
65
66void
67cov_unregister_pc(void)
68{
69
70	atomic_store_ptr(&cov_trace_pc, NULL);
71}
72
73void
74cov_register_cmp(cov_trace_cmp_t trace_cmp)
75{
76
77	atomic_store_ptr(&cov_trace_cmp, trace_cmp);
78}
79
80void
81cov_unregister_cmp(void)
82{
83
84	atomic_store_ptr(&cov_trace_cmp, NULL);
85}
86
87/*
88 * Main entry point. A call to this function will be inserted
89 * at every edge, and if coverage is enabled for the thread
90 * this function will add the PC to the buffer.
91 */
92void
93__sanitizer_cov_trace_pc(void)
94{
95	cov_trace_pc_t trace_pc;
96
97	trace_pc = atomic_load_ptr(&cov_trace_pc);
98	if (trace_pc != NULL)
99		trace_pc((uint64_t)__builtin_return_address(0));
100}
101
102/*
103 * Comparison entry points. When the kernel performs a comparison
104 * operation the compiler inserts a call to one of the following
105 * functions to record the operation.
106 */
107void
108__sanitizer_cov_trace_cmp1(uint8_t arg1, uint8_t arg2)
109{
110	cov_trace_cmp_t trace_cmp;
111
112	trace_cmp = atomic_load_ptr(&cov_trace_cmp);
113	if (trace_cmp != NULL)
114		trace_cmp(COV_CMP_SIZE(0), arg1, arg2,
115		    (uint64_t)__builtin_return_address(0));
116}
117
118void
119__sanitizer_cov_trace_cmp2(uint16_t arg1, uint16_t arg2)
120{
121	cov_trace_cmp_t trace_cmp;
122
123	trace_cmp = atomic_load_ptr(&cov_trace_cmp);
124	if (trace_cmp != NULL)
125		trace_cmp(COV_CMP_SIZE(1), arg1, arg2,
126		    (uint64_t)__builtin_return_address(0));
127}
128
129void
130__sanitizer_cov_trace_cmp4(uint32_t arg1, uint32_t arg2)
131{
132	cov_trace_cmp_t trace_cmp;
133
134	trace_cmp = atomic_load_ptr(&cov_trace_cmp);
135	if (trace_cmp != NULL)
136		trace_cmp(COV_CMP_SIZE(2), arg1, arg2,
137		    (uint64_t)__builtin_return_address(0));
138}
139
140void
141__sanitizer_cov_trace_cmp8(uint64_t arg1, uint64_t arg2)
142{
143	cov_trace_cmp_t trace_cmp;
144
145	trace_cmp = atomic_load_ptr(&cov_trace_cmp);
146	if (trace_cmp != NULL)
147		trace_cmp(COV_CMP_SIZE(3), arg1, arg2,
148		    (uint64_t)__builtin_return_address(0));
149}
150
151void
152__sanitizer_cov_trace_const_cmp1(uint8_t arg1, uint8_t arg2)
153{
154	cov_trace_cmp_t trace_cmp;
155
156	trace_cmp = atomic_load_ptr(&cov_trace_cmp);
157	if (trace_cmp != NULL)
158		trace_cmp(COV_CMP_SIZE(0) | COV_CMP_CONST, arg1, arg2,
159		    (uint64_t)__builtin_return_address(0));
160}
161
162void
163__sanitizer_cov_trace_const_cmp2(uint16_t arg1, uint16_t arg2)
164{
165	cov_trace_cmp_t trace_cmp;
166
167	trace_cmp = atomic_load_ptr(&cov_trace_cmp);
168	if (trace_cmp != NULL)
169		trace_cmp(COV_CMP_SIZE(1) | COV_CMP_CONST, arg1, arg2,
170		    (uint64_t)__builtin_return_address(0));
171}
172
173void
174__sanitizer_cov_trace_const_cmp4(uint32_t arg1, uint32_t arg2)
175{
176	cov_trace_cmp_t trace_cmp;
177
178	trace_cmp = atomic_load_ptr(&cov_trace_cmp);
179	if (trace_cmp != NULL)
180		trace_cmp(COV_CMP_SIZE(2) | COV_CMP_CONST, arg1, arg2,
181		    (uint64_t)__builtin_return_address(0));
182}
183
184void
185__sanitizer_cov_trace_const_cmp8(uint64_t arg1, uint64_t arg2)
186{
187	cov_trace_cmp_t trace_cmp;
188
189	trace_cmp = atomic_load_ptr(&cov_trace_cmp);
190	if (trace_cmp != NULL)
191		trace_cmp(COV_CMP_SIZE(3) | COV_CMP_CONST, arg1, arg2,
192		    (uint64_t)__builtin_return_address(0));
193}
194
195/*
196 * val is the switch operand
197 * cases[0] is the number of case constants
198 * cases[1] is the size of val in bits
199 * cases[2..n] are the case constants
200 */
201void
202__sanitizer_cov_trace_switch(uint64_t val, uint64_t *cases)
203{
204	uint64_t i, count, ret, type;
205	cov_trace_cmp_t trace_cmp;
206
207	trace_cmp = atomic_load_ptr(&cov_trace_cmp);
208	if (trace_cmp == NULL)
209		return;
210
211	count = cases[0];
212	ret = (uint64_t)__builtin_return_address(0);
213
214	switch (cases[1]) {
215	case 8:
216		type = COV_CMP_SIZE(0);
217		break;
218	case 16:
219		type = COV_CMP_SIZE(1);
220		break;
221	case 32:
222		type = COV_CMP_SIZE(2);
223		break;
224	case 64:
225		type = COV_CMP_SIZE(3);
226		break;
227	default:
228		return;
229	}
230
231	val |= COV_CMP_CONST;
232
233	for (i = 0; i < count; i++)
234		if (!trace_cmp(type, val, cases[i + 2], ret))
235			return;
236}
237