/*
* SPDX-License-Identifier: BSD-2-Clause
*
* Copyright (c) 2018, 2019 Andrew Turner
*
* This software was developed by SRI International and the University of
* Cambridge Computer Laboratory under DARPA/AFRL contract FA8750-10-C-0237
* ("CTSRD"), as part of the DARPA CRASH research programme.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
* 1. Redistributions of source code must retain the above copyright
*    notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
*    notice, this list of conditions and the following disclaimer in the
*    documentation and/or other materials provided with the distribution.
*
* THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
* ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
* SUCH DAMAGE.
*/
#include <sys/cdefs.h>

#include <sys/param.h>
#include <sys/ioctl.h>
#include <sys/kcov.h>
#include <sys/mman.h>

#include <errno.h>
#include <fcntl.h>
#include <pthread.h>
#include <semaphore.h>
#include <unistd.h>

#include <atf-c.h>

#define PAGE_SIZE sysconf(_SC_PAGESIZE)

static int
open_kcov(void)
{
       int fd;

       fd = open("/dev/kcov", O_RDWR);
       if (fd == -1)
               atf_tc_skip("Failed to open /dev/kcov");

       return fd;
}

static int
pick_unassigned_fd(int greater_than_fd)
{
       int fd2;

       fd2 = greater_than_fd;
       do {
               ++fd2;
       } while (fcntl(fd2, F_GETFL) != -1 || errno != EBADF);

       return fd2;
}

ATF_TC_WITHOUT_HEAD(kcov_dup2);
ATF_TC_BODY(kcov_dup2, tc)
{
       int fd1, fd2;
       fd1 = open_kcov();

       fd2 = pick_unassigned_fd(fd1);

       /* Test the dup2(2) trick used by syzkaller */
       ATF_REQUIRE_EQ(dup2(fd1, fd2), fd2);

       close(fd1);
       close(fd2);
}

ATF_TC_WITHOUT_HEAD(kcov_multiopen);
ATF_TC_BODY(kcov_multiopen, tc)
{
       int fd1, fd2;
       fd1 = open_kcov();

       fd2 = open("/dev/kcov", O_RDWR);
       ATF_REQUIRE(fd2 != -1);

       close(fd1);
       close(fd2);
}

ATF_TC_WITHOUT_HEAD(kcov_open_close_open);
ATF_TC_BODY(kcov_open_close_open, tc)
{
       int fd;

       fd = open_kcov();
       close(fd);
       fd = open("/dev/kcov", O_RDWR);
       ATF_REQUIRE(fd != -1);

       close(fd);
}

ATF_TC_WITHOUT_HEAD(kcov_bufsize);
ATF_TC_BODY(kcov_bufsize, tc)
{
       int fd;
       uint64_t size;
       fd = open_kcov();

       size = 0;
       ATF_CHECK(ioctl(fd, KCOV_IOC_SETBUFSIZE, &size) == -1);
       size = 2;
       ATF_CHECK(ioctl(fd, KCOV_IOC_SETBUFSIZE, &size) == 0);

       close(fd);
}

ATF_TC_WITHOUT_HEAD(kcov_mmap);
ATF_TC_BODY(kcov_mmap, tc)
{
       void *data;
       int fd;
       uint64_t size = 2 * PAGE_SIZE / KCOV_ENTRY_SIZE;

       fd = open_kcov();

       ATF_CHECK(mmap(NULL, PAGE_SIZE, PROT_READ | PROT_WRITE, MAP_SHARED,
           fd, 0) == MAP_FAILED);

       ATF_REQUIRE(ioctl(fd, KCOV_IOC_SETBUFSIZE, &size) == 0);

       ATF_REQUIRE((data = mmap(NULL, 2 * PAGE_SIZE, PROT_READ | PROT_WRITE,
           MAP_SHARED, fd, 0)) != MAP_FAILED);

       munmap(data, 2 * PAGE_SIZE);

       close(fd);
}

/* This shouldn't panic */
ATF_TC_WITHOUT_HEAD(kcov_mmap_no_munmap);
ATF_TC_BODY(kcov_mmap_no_munmap, tc)
{
       int fd;
       uint64_t size = PAGE_SIZE / KCOV_ENTRY_SIZE;

       fd = open_kcov();

       ATF_REQUIRE(ioctl(fd, KCOV_IOC_SETBUFSIZE, &size) ==0);

       ATF_CHECK(mmap(NULL, PAGE_SIZE, PROT_READ | PROT_WRITE, MAP_SHARED,
           fd, 0) != MAP_FAILED);

       close(fd);
}

ATF_TC_WITHOUT_HEAD(kcov_mmap_no_munmap_no_close);
ATF_TC_BODY(kcov_mmap_no_munmap_no_close, tc)
{
       int fd;
       uint64_t size = PAGE_SIZE / KCOV_ENTRY_SIZE;

       fd = open_kcov();

       ATF_REQUIRE(ioctl(fd, KCOV_IOC_SETBUFSIZE, &size) ==0);

       ATF_CHECK(mmap(NULL, PAGE_SIZE, PROT_READ | PROT_WRITE, MAP_SHARED,
           fd, 0) != MAP_FAILED);
}

static sem_t sem1, sem2;

static void *
kcov_mmap_enable_thread(void *data)
{
       int fd;
       uint64_t size = PAGE_SIZE / KCOV_ENTRY_SIZE;
       int mode;

       fd = open_kcov();
       *(int *)data = fd;

       ATF_REQUIRE(ioctl(fd, KCOV_IOC_SETBUFSIZE, &size) ==0);
       ATF_CHECK(mmap(NULL, PAGE_SIZE, PROT_READ | PROT_WRITE, MAP_SHARED,
           fd, 0) != MAP_FAILED);
       mode = KCOV_MODE_NONE;
       ATF_CHECK(ioctl(fd, KCOV_IOC_ENABLE, &mode) == 0);

       sem_post(&sem1);
       sem_wait(&sem2);

       return NULL;
}

ATF_TC_WITHOUT_HEAD(kcov_mmap_enable_thread_close);
ATF_TC_BODY(kcov_mmap_enable_thread_close, tc)
{
       pthread_t thread;
       int fd;

       sem_init(&sem1, 0, 0);
       sem_init(&sem2, 0, 0);
       pthread_create(&thread, NULL,
           kcov_mmap_enable_thread, &fd);
       sem_wait(&sem1);
       close(fd);
       sem_post(&sem2);
       pthread_join(thread, NULL);
}

ATF_TC_WITHOUT_HEAD(kcov_enable);
ATF_TC_BODY(kcov_enable, tc)
{
       int fd;
       uint64_t size = PAGE_SIZE / KCOV_ENTRY_SIZE;
       int mode;

       fd = open_kcov();

       mode = KCOV_MODE_NONE;
       ATF_CHECK(ioctl(fd, KCOV_IOC_ENABLE, &mode) == -1);

       ATF_REQUIRE(ioctl(fd, KCOV_IOC_SETBUFSIZE, &size) ==0);

       /* We need to enable before disable */
       ATF_CHECK(ioctl(fd, KCOV_IOC_DISABLE) == -1);

       /* Check enabling works only with a valid trace method */
       ATF_CHECK(ioctl(fd, KCOV_IOC_ENABLE, &mode) == 0);
       ATF_CHECK(ioctl(fd, KCOV_IOC_ENABLE, &mode) == -1);

       /* Disable should only be called once */
       ATF_CHECK(ioctl(fd, KCOV_IOC_DISABLE) == 0);
       ATF_CHECK(ioctl(fd, KCOV_IOC_DISABLE) == -1);

       /* Re-enabling and changing mode should also work */
       mode = KCOV_MODE_NONE;
       ATF_CHECK(ioctl(fd, KCOV_IOC_ENABLE, &mode) == 0);
       ATF_CHECK(ioctl(fd, KCOV_IOC_DISABLE) == 0);
       mode = KCOV_MODE_TRACE_PC;
       ATF_CHECK(ioctl(fd, KCOV_IOC_ENABLE, &mode) == 0);
       ATF_CHECK(ioctl(fd, KCOV_IOC_DISABLE) == 0);
       mode = KCOV_MODE_TRACE_CMP;
       ATF_CHECK(ioctl(fd, KCOV_IOC_ENABLE, &mode) == 0);
       ATF_CHECK(ioctl(fd, KCOV_IOC_DISABLE) == 0);

       close(fd);
}

ATF_TC_WITHOUT_HEAD(kcov_enable_no_disable);
ATF_TC_BODY(kcov_enable_no_disable, tc)
{
       int fd;
       uint64_t size = PAGE_SIZE / KCOV_ENTRY_SIZE;
       int mode;

       fd = open_kcov();
       ATF_REQUIRE(ioctl(fd, KCOV_IOC_SETBUFSIZE, &size) ==0);
       mode = KCOV_MODE_NONE;
       ATF_CHECK(ioctl(fd, KCOV_IOC_ENABLE, &mode) == 0);
       close(fd);
}

ATF_TC_WITHOUT_HEAD(kcov_enable_no_disable_no_close);
ATF_TC_BODY(kcov_enable_no_disable_no_close, tc)
{
       int fd;
       uint64_t size = PAGE_SIZE / KCOV_ENTRY_SIZE;
       int mode;

       fd = open_kcov();
       ATF_REQUIRE(ioctl(fd, KCOV_IOC_SETBUFSIZE, &size) ==0);
       mode = KCOV_MODE_NONE;
       ATF_CHECK(ioctl(fd, KCOV_IOC_ENABLE, &mode) == 0);
}

static void *
common_head_raw(bool fd_dup, int *fdp)
{
       void *data;
       int fd, fd2;
       uint64_t size = PAGE_SIZE / KCOV_ENTRY_SIZE;

       fd = open_kcov();

       /* Test the dup2(2) trick used by syzkaller */
       if (fd_dup) {
               fd2 = pick_unassigned_fd(fd);
               ATF_REQUIRE_EQ(dup2(fd, fd2), fd2);
               close(fd);
               fd = fd2;
       }

       ATF_REQUIRE_MSG(ioctl(fd, KCOV_IOC_SETBUFSIZE, &size) == 0,
           "Unable to set the kcov buffer size");

       data = mmap(NULL, PAGE_SIZE, PROT_READ | PROT_WRITE, MAP_SHARED, fd, 0);
       ATF_REQUIRE_MSG(data != MAP_FAILED, "Unable to mmap the kcov buffer");

       *fdp = fd;
       return data;
}

static void *
common_head(int *fdp)
{

       return common_head_raw(false, fdp);
}

static void
common_tail(int fd, kcov_int_t *data)
{

       ATF_REQUIRE_MSG(munmap(__UNVOLATILE(data), PAGE_SIZE) == 0,
           "Unable to unmap the kcov buffer");

       close(fd);
}

static void
kcov_basic(bool fd_dup, int mode)
{
       kcov_int_t *buf;
       int fd;

       buf = common_head_raw(fd_dup, &fd);
       ATF_REQUIRE_MSG(ioctl(fd, KCOV_IOC_ENABLE, &mode) == 0,
           "Unable to enable kcov ");

       buf[0] = 0;

       sleep(0); /* XXX: Is it enough for all trace types? */
       ATF_REQUIRE_MSG(buf[0] != 0, "No records found");

       ATF_REQUIRE_MSG(ioctl(fd, KCOV_IOC_DISABLE) == 0,
           "Unable to disable kcov");

       common_tail(fd, buf);
}

ATF_TC_WITHOUT_HEAD(kcov_basic_pc);
ATF_TC_BODY(kcov_basic_pc, tc)
{

       kcov_basic(false, KCOV_MODE_TRACE_PC);
}

ATF_TC_WITHOUT_HEAD(kcov_basic_cmp);
ATF_TC_BODY(kcov_basic_cmp, tc)
{

       atf_tc_skip("XXX: GCC8 needed");

       kcov_basic(false, KCOV_MODE_TRACE_CMP);
}

ATF_TC_WITHOUT_HEAD(kcov_basic_dup2_pc);
ATF_TC_BODY(kcov_basic_dup2_pc, tc)
{

       kcov_basic(true, KCOV_MODE_TRACE_PC);
}

ATF_TC_WITHOUT_HEAD(kcov_basic_dup2_cmp);
ATF_TC_BODY(kcov_basic_dup2_cmp, tc)
{

       atf_tc_skip("XXX: GCC8 needed");

       kcov_basic(true, KCOV_MODE_TRACE_CMP);
}

ATF_TC_WITHOUT_HEAD(kcov_multienable_on_the_same_thread);
ATF_TC_BODY(kcov_multienable_on_the_same_thread, tc)
{
       kcov_int_t *buf1, *buf2;
       int fd1, fd2;
       int mode;

       buf1 = common_head(&fd1);
       buf2 = common_head(&fd2);
       mode = KCOV_MODE_NONE;
       ATF_REQUIRE_MSG(ioctl(fd1, KCOV_IOC_ENABLE, &mode) == 0,
           "Unable to enable kcov");
       ATF_REQUIRE_ERRNO(EBUSY, ioctl(fd2, KCOV_IOC_ENABLE, &mode) != 0);

       ATF_REQUIRE_MSG(ioctl(fd1, KCOV_IOC_DISABLE) == 0,
           "Unable to disable kcov");

       common_tail(fd1, buf1);
       common_tail(fd2, buf2);
}

static void *
thread_buffer_access_test_helper(void *ptr)
{
       kcov_int_t *buf = ptr;

       /* Test mapped buffer access from a custom thread */
       buf[0] = buf[0];

       return NULL;
}

ATF_TC_WITHOUT_HEAD(kcov_buffer_access_from_custom_thread);
ATF_TC_BODY(kcov_buffer_access_from_custom_thread, tc)
{
       pthread_t thread;
       kcov_int_t *buf;
       int fd;
       int mode;

       buf = common_head(&fd);

       mode = KCOV_MODE_TRACE_PC;
       ATF_REQUIRE_MSG(ioctl(fd, KCOV_IOC_ENABLE, &mode) == 0,
           "Unable to enable kcov ");

       pthread_create(&thread, NULL, thread_buffer_access_test_helper,
           __UNVOLATILE(buf));
       pthread_join(thread, NULL);

       ATF_REQUIRE_MSG(ioctl(fd, KCOV_IOC_DISABLE) == 0,
           "Unable to disable kcov");

       common_tail(fd, buf);
}

static void *
thread_test_helper(void *ptr)
{
       volatile int i;

       /* It does not matter what operation is in action. */
       for (i = 0; i < 1000; i++) {
               if (getpid() == 0)
                       break;
       }

       return NULL;
}

ATF_TC_WITHOUT_HEAD(kcov_thread);
ATF_TC_BODY(kcov_thread, tc)
{
       pthread_t thread;
       kcov_int_t *buf;
       int fd;
       int mode;
       volatile int i;

       buf = common_head(&fd);

       mode = KCOV_MODE_TRACE_PC;
       ATF_REQUIRE_MSG(ioctl(fd, KCOV_IOC_ENABLE, &mode) == 0,
           "Unable to enable kcov ");

       /* The thread does something, does not matter what exactly. */
       pthread_create(&thread, NULL, thread_test_helper, __UNVOLATILE(buf));

       buf[0] = 0;
       for (i = 0; i < 10000; i++)
               continue;
       ATF_REQUIRE_EQ_MSG(buf[0], 0,
           "Records changed in blocked thread");

       pthread_join(thread, NULL);

       ATF_REQUIRE_EQ_MSG(ioctl(fd, KCOV_IOC_DISABLE), 0,
           "Unable to disable kcov");

       common_tail(fd, buf);
}

static void *
multiple_threads_helper(void *ptr __unused)
{
       kcov_int_t *buf;
       int fd;
       int mode;

       buf = common_head(&fd);
       mode = KCOV_MODE_TRACE_PC;
       ATF_REQUIRE_MSG(ioctl(fd, KCOV_IOC_ENABLE, &mode) == 0,
           "Unable to enable kcov ");

       buf[0] = 0;

       sleep(0);
       ATF_REQUIRE_MSG(buf[0] != 0, "No records found");

       ATF_REQUIRE_MSG(ioctl(fd, KCOV_IOC_DISABLE) == 0,
           "Unable to disable kcov");

       common_tail(fd, buf);

       return NULL;
}

static void
kcov_multiple_threads(size_t N)
{
       pthread_t thread[32];
       size_t i;
       int fd;

       /*
        * Check if /dev/kcov is available, if not bail out.
        * Verifying it on a per-thread basis is flaky.
        */
       fd = open_kcov();
       ATF_REQUIRE(close(fd) == 0);

       ATF_REQUIRE(__arraycount(thread) >= N);

       for (i = 0; i < N; i++)
               pthread_create(&thread[i], NULL, multiple_threads_helper, NULL);

       for (i = 0; i < N; i++)
               pthread_join(thread[i], NULL);
}

#define KCOV_MULTIPLE_THREADS(n)                \
ATF_TC_WITHOUT_HEAD(kcov_multiple_threads##n);  \
ATF_TC_BODY(kcov_multiple_threads##n, tc)       \
{                                               \
                                               \
       kcov_multiple_threads(n);               \
}

KCOV_MULTIPLE_THREADS(2)
KCOV_MULTIPLE_THREADS(4)
KCOV_MULTIPLE_THREADS(8)
KCOV_MULTIPLE_THREADS(16)
KCOV_MULTIPLE_THREADS(32)

ATF_TP_ADD_TCS(tp)
{

       ATF_TP_ADD_TC(tp, kcov_dup2);
       ATF_TP_ADD_TC(tp, kcov_multiopen);
       ATF_TP_ADD_TC(tp, kcov_open_close_open);
       ATF_TP_ADD_TC(tp, kcov_bufsize);
       ATF_TP_ADD_TC(tp, kcov_mmap);
       ATF_TP_ADD_TC(tp, kcov_mmap_no_munmap);
       ATF_TP_ADD_TC(tp, kcov_mmap_no_munmap_no_close);
       ATF_TP_ADD_TC(tp, kcov_enable);
       ATF_TP_ADD_TC(tp, kcov_enable_no_disable);
       ATF_TP_ADD_TC(tp, kcov_enable_no_disable_no_close);
       ATF_TP_ADD_TC(tp, kcov_mmap_enable_thread_close);
       ATF_TP_ADD_TC(tp, kcov_basic_pc);
       ATF_TP_ADD_TC(tp, kcov_basic_cmp);
       ATF_TP_ADD_TC(tp, kcov_basic_dup2_pc);
       ATF_TP_ADD_TC(tp, kcov_basic_dup2_cmp);
       ATF_TP_ADD_TC(tp, kcov_multienable_on_the_same_thread);
       ATF_TP_ADD_TC(tp, kcov_buffer_access_from_custom_thread);
       ATF_TP_ADD_TC(tp, kcov_thread);
       ATF_TP_ADD_TC(tp, kcov_multiple_threads2);
       ATF_TP_ADD_TC(tp, kcov_multiple_threads4);
       ATF_TP_ADD_TC(tp, kcov_multiple_threads8);
       ATF_TP_ADD_TC(tp, kcov_multiple_threads16);
       ATF_TP_ADD_TC(tp, kcov_multiple_threads32);
       return atf_no_error();
}