/*
* SPDX-License-Identifier: BSD-2-Clause
*
* Copyright (c) 2018, 2019 Andrew Turner
*
* This software was developed by SRI International and the University of
* Cambridge Computer Laboratory under DARPA/AFRL contract FA8750-10-C-0237
* ("CTSRD"), as part of the DARPA CRASH research programme.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
* 1. Redistributions of source code must retain the above copyright
*    notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
*    notice, this list of conditions and the following disclaimer in the
*    documentation and/or other materials provided with the distribution.
*
* THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
* ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
* SUCH DAMAGE.
*/
#include <sys/cdefs.h>

#include <sys/param.h>
#include <sys/ioctl.h>
#include <sys/kcov.h>
#include <sys/mman.h>

#include <errno.h>
#include <fcntl.h>
#include <pthread.h>
#include <semaphore.h>
#include <unistd.h>

#include <atf-c.h>

#define PAGE_SIZE sysconf(_SC_PAGESIZE)

static int
open_kcov(void)
{
       int fd;

       fd = open("/dev/kcov", O_RDWR);
       if (fd == -1)
               atf_tc_skip("Failed to open /dev/kcov");

       return fd;
}

static int
pick_unassigned_fd(int greater_than_fd)
{
       int fd2;

       fd2 = greater_than_fd;
       do {
               ++fd2;
       } while (fcntl(fd2, F_GETFL) != -1 || errno != EBADF);

       return fd2;
}

ATF_TC_WITHOUT_HEAD(kcov_dup2);
ATF_TC_BODY(kcov_dup2, tc)
{
       int fd1, fd2;
       fd1 = open_kcov();

       fd2 = pick_unassigned_fd(fd1);

       /* Test the dup2(2) trick used by syzkaller */
       ATF_REQUIRE_EQ(dup2(fd1, fd2), fd2);

       close(fd1);
       close(fd2);
}

ATF_TC_WITHOUT_HEAD(kcov_multiopen);
ATF_TC_BODY(kcov_multiopen, tc)
{
       int fd1, fd2;
       fd1 = open_kcov();

       fd2 = open("/dev/kcov", O_RDWR);
       ATF_REQUIRE(fd2 != -1);

       close(fd1);
       close(fd2);
}

ATF_TC_WITHOUT_HEAD(kcov_open_close_open);
ATF_TC_BODY(kcov_open_close_open, tc)
{
       int fd;

       fd = open_kcov();
       close(fd);
       fd = open("/dev/kcov", O_RDWR);
       ATF_REQUIRE(fd != -1);

       close(fd);
}

ATF_TC_WITHOUT_HEAD(kcov_bufsize);
ATF_TC_BODY(kcov_bufsize, tc)
{
       int fd;
       uint64_t size;
       fd = open_kcov();

       size = 0;
       ATF_CHECK(ioctl(fd, KCOV_IOC_SETBUFSIZE, &size) == -1);
       size = 2;
       ATF_CHECK(ioctl(fd, KCOV_IOC_SETBUFSIZE, &size) == 0);

       close(fd);
}

ATF_TC_WITHOUT_HEAD(kcov_mmap);
ATF_TC_BODY(kcov_mmap, tc)
{
       void *data;
       int fd;
       uint64_t size = 2 * PAGE_SIZE / KCOV_ENTRY_SIZE;

       fd = open_kcov();

       ATF_CHECK(mmap(NULL, PAGE_SIZE, PROT_READ | PROT_WRITE, MAP_SHARED,
           fd, 0) == MAP_FAILED);

       ATF_REQUIRE(ioctl(fd, KCOV_IOC_SETBUFSIZE, &size) == 0);

       ATF_REQUIRE((data = mmap(NULL, 2 * PAGE_SIZE, PROT_READ | PROT_WRITE,
           MAP_SHARED, fd, 0)) != MAP_FAILED);

       munmap(data, 2 * PAGE_SIZE);

       close(fd);
}

/* This shouldn't panic */
ATF_TC_WITHOUT_HEAD(kcov_mmap_no_munmap);
ATF_TC_BODY(kcov_mmap_no_munmap, tc)
{
       int fd;
       uint64_t size = PAGE_SIZE / KCOV_ENTRY_SIZE;

       fd = open_kcov();

       ATF_REQUIRE(ioctl(fd, KCOV_IOC_SETBUFSIZE, &size) ==0);

       ATF_CHECK(mmap(NULL, PAGE_SIZE, PROT_READ | PROT_WRITE, MAP_SHARED,
           fd, 0) != MAP_FAILED);

       close(fd);
}

ATF_TC_WITHOUT_HEAD(kcov_mmap_no_munmap_no_close);
ATF_TC_BODY(kcov_mmap_no_munmap_no_close, tc)
{
       int fd;
       uint64_t size = PAGE_SIZE / KCOV_ENTRY_SIZE;

       fd = open_kcov();

       ATF_REQUIRE(ioctl(fd, KCOV_IOC_SETBUFSIZE, &size) ==0);

       ATF_CHECK(mmap(NULL, PAGE_SIZE, PROT_READ | PROT_WRITE, MAP_SHARED,
           fd, 0) != MAP_FAILED);
}

static sem_t sem1, sem2;

static void *
kcov_mmap_enable_thread(void *data)
{
       int fd;
       uint64_t size = PAGE_SIZE / KCOV_ENTRY_SIZE;
       int mode;

       fd = open_kcov();
       *(int *)data = fd;

       ATF_REQUIRE(ioctl(fd, KCOV_IOC_SETBUFSIZE, &size) ==0);
       ATF_CHECK(mmap(NULL, PAGE_SIZE, PROT_READ | PROT_WRITE, MAP_SHARED,
           fd, 0) != MAP_FAILED);
       mode = KCOV_MODE_NONE;
       ATF_CHECK(ioctl(fd, KCOV_IOC_ENABLE, &mode) == 0);

       sem_post(&sem1);
       sem_wait(&sem2);

       return NULL;
}

ATF_TC_WITHOUT_HEAD(kcov_mmap_enable_thread_close);
ATF_TC_BODY(kcov_mmap_enable_thread_close, tc)
{
       pthread_t thread;
       int fd;

       sem_init(&sem1, 0, 0);
       sem_init(&sem2, 0, 0);
       pthread_create(&thread, NULL,
           kcov_mmap_enable_thread, &fd);
       sem_wait(&sem1);
       close(fd);
       sem_post(&sem2);
       pthread_join(thread, NULL);
}

ATF_TC_WITHOUT_HEAD(kcov_enable);
ATF_TC_BODY(kcov_enable, tc)
{
       int fd;
       uint64_t size = PAGE_SIZE / KCOV_ENTRY_SIZE;
       int mode;

       fd = open_kcov();

       mode = KCOV_MODE_NONE;
       ATF_CHECK(ioctl(fd, KCOV_IOC_ENABLE, &mode) == -1);

       ATF_REQUIRE(ioctl(fd, KCOV_IOC_SETBUFSIZE, &size) ==0);

       /* We need to enable before disable */
       ATF_CHECK(ioctl(fd, KCOV_IOC_DISABLE) == -1);

       /* Check enabling works only with a valid trace method */
       ATF_CHECK(ioctl(fd, KCOV_IOC_ENABLE, &mode) == 0);
       ATF_CHECK(ioctl(fd, KCOV_IOC_ENABLE, &mode) == -1);

       /* Disable should only be called once */
       ATF_CHECK(ioctl(fd, KCOV_IOC_DISABLE) == 0);
       ATF_CHECK(ioctl(fd, KCOV_IOC_DISABLE) == -1);

       /* Re-enabling and changing mode should also work */
       mode = KCOV_MODE_NONE;
       ATF_CHECK(ioctl(fd, KCOV_IOC_ENABLE, &mode) == 0);
       ATF_CHECK(ioctl(fd, KCOV_IOC_DISABLE) == 0);
       mode = KCOV_MODE_TRACE_PC;
       ATF_CHECK(ioctl(fd, KCOV_IOC_ENABLE, &mode) == 0);
       ATF_CHECK(ioctl(fd, KCOV_IOC_DISABLE) == 0);
       mode = KCOV_MODE_TRACE_CMP;
       ATF_CHECK(ioctl(fd, KCOV_IOC_ENABLE, &mode) == 0);
       ATF_CHECK(ioctl(fd, KCOV_IOC_DISABLE) == 0);

       close(fd);
}

ATF_TC_WITHOUT_HEAD(kcov_enable_no_disable);
ATF_TC_BODY(kcov_enable_no_disable, tc)
{
       int fd;
       uint64_t size = PAGE_SIZE / KCOV_ENTRY_SIZE;
       int mode;

       fd = open_kcov();
       ATF_REQUIRE(ioctl(fd, KCOV_IOC_SETBUFSIZE, &size) ==0);
       mode = KCOV_MODE_NONE;
       ATF_CHECK(ioctl(fd, KCOV_IOC_ENABLE, &mode) == 0);
       close(fd);
}

ATF_TC_WITHOUT_HEAD(kcov_enable_no_disable_no_close);
ATF_TC_BODY(kcov_enable_no_disable_no_close, tc)
{
       int fd;
       uint64_t size = PAGE_SIZE / KCOV_ENTRY_SIZE;
       int mode;

       fd = open_kcov();
       ATF_REQUIRE(ioctl(fd, KCOV_IOC_SETBUFSIZE, &size) ==0);
       mode = KCOV_MODE_NONE;
       ATF_CHECK(ioctl(fd, KCOV_IOC_ENABLE, &mode) == 0);
}

static void *
common_head_raw(bool fd_dup, int *fdp)
{
       void *data;
       int fd, fd2;
       uint64_t size = PAGE_SIZE / KCOV_ENTRY_SIZE;

       fd = open_kcov();

       /* Test the dup2(2) trick used by syzkaller */
       if (fd_dup) {
               fd2 = pick_unassigned_fd(fd);
               ATF_REQUIRE_EQ(dup2(fd, fd2), fd2);
               close(fd);
               fd = fd2;
       }

       ATF_REQUIRE_MSG(ioctl(fd, KCOV_IOC_SETBUFSIZE, &size) == 0,
           "Unable to set the kcov buffer size");

       data = mmap(NULL, PAGE_SIZE, PROT_READ | PROT_WRITE, MAP_SHARED, fd, 0);
       ATF_REQUIRE_MSG(data != MAP_FAILED, "Unable to mmap the kcov buffer");

       *fdp = fd;
       return data;
}

static void *
common_head(int *fdp)
{

       return common_head_raw(false, fdp);
}

static void
common_tail(int fd, kcov_int_t *data)
{

       ATF_REQUIRE_MSG(munmap(__UNVOLATILE(data), PAGE_SIZE) == 0,
           "Unable to unmap the kcov buffer");

       close(fd);
}

static void
kcov_basic(bool fd_dup, int mode)
{
       kcov_int_t *buf;
       int fd;

       buf = common_head_raw(fd_dup, &fd);
       ATF_REQUIRE_MSG(ioctl(fd, KCOV_IOC_ENABLE, &mode) == 0,
           "Unable to enable kcov ");

       buf[0] = 0;

       sleep(0); /* XXX: Is it enough for all trace types? */
       ATF_REQUIRE_MSG(buf[0] != 0, "No records found");

       ATF_REQUIRE_MSG(ioctl(fd, KCOV_IOC_DISABLE) == 0,
           "Unable to disable kcov");

       common_tail(fd, buf);
}

ATF_TC_WITHOUT_HEAD(kcov_basic_pc);
ATF_TC_BODY(kcov_basic_pc, tc)
{

       kcov_basic(false, KCOV_MODE_TRACE_PC);
}

ATF_TC_WITHOUT_HEAD(kcov_basic_cmp);
ATF_TC_BODY(kcov_basic_cmp, tc)
{

       atf_tc_skip("XXX: GCC8 needed");

       kcov_basic(false, KCOV_MODE_TRACE_CMP);
}

ATF_TC_WITHOUT_HEAD(kcov_basic_dup2_pc);
ATF_TC_BODY(kcov_basic_dup2_pc, tc)
{

       kcov_basic(true, KCOV_MODE_TRACE_PC);
}

ATF_TC_WITHOUT_HEAD(kcov_basic_dup2_cmp);
ATF_TC_BODY(kcov_basic_dup2_cmp, tc)
{

       atf_tc_skip("XXX: GCC8 needed");

       kcov_basic(true, KCOV_MODE_TRACE_CMP);
}

ATF_TC_WITHOUT_HEAD(kcov_multienable_on_the_same_thread);
ATF_TC_BODY(kcov_multienable_on_the_same_thread, tc)
{
       kcov_int_t *buf1, *buf2;
       int fd1, fd2;
       int mode;

       buf1 = common_head(&fd1);
       buf2 = common_head(&fd2);
       mode = KCOV_MODE_NONE;
       ATF_REQUIRE_MSG(ioctl(fd1, KCOV_IOC_ENABLE, &mode) == 0,
           "Unable to enable kcov");
       ATF_REQUIRE_ERRNO(EBUSY, ioctl(fd2, KCOV_IOC_ENABLE, &mode) != 0);

       ATF_REQUIRE_MSG(ioctl(fd1, KCOV_IOC_DISABLE) == 0,
           "Unable to disable kcov");

       common_tail(fd1, buf1);
       common_tail(fd2, buf2);
}

static void *
thread_buffer_access_test_helper(void *ptr)
{
       kcov_int_t *buf = ptr;

       /* Test mapped buffer access from a custom thread */
       buf[0] = buf[0];

       return NULL;
}

ATF_TC_WITHOUT_HEAD(kcov_buffer_access_from_custom_thread);
ATF_TC_BODY(kcov_buffer_access_from_custom_thread, tc)
{
       pthread_t thread;
       kcov_int_t *buf;
       int fd;
       int mode;

       buf = common_head(&fd);

       mode = KCOV_MODE_TRACE_PC;
       ATF_REQUIRE_MSG(ioctl(fd, KCOV_IOC_ENABLE, &mode) == 0,
           "Unable to enable kcov ");

       pthread_create(&thread, NULL, thread_buffer_access_test_helper,
           __UNVOLATILE(buf));
       pthread_join(thread, NULL);

       ATF_REQUIRE_MSG(ioctl(fd, KCOV_IOC_DISABLE) == 0,
           "Unable to disable kcov");

       common_tail(fd, buf);
}

static void *
thread_test_helper(void *ptr)
{
       volatile int i;

       /* It does not matter what operation is in action. */
       for (i = 0; i < 1000; i++) {
               if (getpid() == 0)
                       break;
       }

       return NULL;
}

ATF_TC_WITHOUT_HEAD(kcov_thread);
ATF_TC_BODY(kcov_thread, tc)
{
       pthread_t thread;
       kcov_int_t *buf;
       int fd;
       int mode;
       volatile int i;

       buf = common_head(&fd);

       mode = KCOV_MODE_TRACE_PC;
       ATF_REQUIRE_MSG(ioctl(fd, KCOV_IOC_ENABLE, &mode) == 0,
           "Unable to enable kcov ");

       /* The thread does something, does not matter what exactly. */
       pthread_create(&thread, NULL, thread_test_helper, __UNVOLATILE(buf));

       buf[0] = 0;
       for (i = 0; i < 10000; i++)
               continue;
       ATF_REQUIRE_EQ_MSG(buf[0], 0,
           "Records changed in blocked thread");

       pthread_join(thread, NULL);

       ATF_REQUIRE_EQ_MSG(ioctl(fd, KCOV_IOC_DISABLE), 0,
           "Unable to disable kcov");

       common_tail(fd, buf);
}

static void *
multiple_threads_helper(void *ptr __unused)
{
       kcov_int_t *buf;
       int fd;
       int mode;

       buf = common_head(&fd);
       mode = KCOV_MODE_TRACE_PC;
       ATF_REQUIRE_MSG(ioctl(fd, KCOV_IOC_ENABLE, &mode) == 0,
           "Unable to enable kcov ");

       buf[0] = 0;

       sleep(0);
       ATF_REQUIRE_MSG(buf[0] != 0, "No records found");

       ATF_REQUIRE_MSG(ioctl(fd, KCOV_IOC_DISABLE) == 0,
           "Unable to disable kcov");

       common_tail(fd, buf);

       return NULL;
}

static void
kcov_multiple_threads(size_t N)
{
       pthread_t thread[32];
       size_t i;
       int fd;

       /*
        * Check if /dev/kcov is available, if not bail out.
        * Verifying it on a per-thread basis is flaky.
        */
       fd = open_kcov();
       ATF_REQUIRE(close(fd) == 0);

       ATF_REQUIRE(__arraycount(thread) >= N);

       for (i = 0; i < N; i++)
               pthread_create(&thread[i], NULL, multiple_threads_helper, NULL);

       for (i = 0; i < N; i++)
               pthread_join(thread[i], NULL);
}

#define KCOV_MULTIPLE_THREADS(n)                \
ATF_TC_WITHOUT_HEAD(kcov_multiple_threads##n);  \
ATF_TC_BODY(kcov_multiple_threads##n, tc)       \
{                                               \
                                               \
       kcov_multiple_threads(n);               \
}

KCOV_MULTIPLE_THREADS(2)
KCOV_MULTIPLE_THREADS(4)
KCOV_MULTIPLE_THREADS(8)
KCOV_MULTIPLE_THREADS(16)
KCOV_MULTIPLE_THREADS(32)

ATF_TP_ADD_TCS(tp)
{

       ATF_TP_ADD_TC(tp, kcov_dup2);
       ATF_TP_ADD_TC(tp, kcov_multiopen);
       ATF_TP_ADD_TC(tp, kcov_open_close_open);
       ATF_TP_ADD_TC(tp, kcov_bufsize);
       ATF_TP_ADD_TC(tp, kcov_mmap);
       ATF_TP_ADD_TC(tp, kcov_mmap_no_munmap);
       ATF_TP_ADD_TC(tp, kcov_mmap_no_munmap_no_close);
       ATF_TP_ADD_TC(tp, kcov_enable);
       ATF_TP_ADD_TC(tp, kcov_enable_no_disable);
       ATF_TP_ADD_TC(tp, kcov_enable_no_disable_no_close);
       ATF_TP_ADD_TC(tp, kcov_mmap_enable_thread_close);
       ATF_TP_ADD_TC(tp, kcov_basic_pc);
       ATF_TP_ADD_TC(tp, kcov_basic_cmp);
       ATF_TP_ADD_TC(tp, kcov_basic_dup2_pc);
       ATF_TP_ADD_TC(tp, kcov_basic_dup2_cmp);
       ATF_TP_ADD_TC(tp, kcov_multienable_on_the_same_thread);
       ATF_TP_ADD_TC(tp, kcov_buffer_access_from_custom_thread);
       ATF_TP_ADD_TC(tp, kcov_thread);
       ATF_TP_ADD_TC(tp, kcov_multiple_threads2);
       ATF_TP_ADD_TC(tp, kcov_multiple_threads4);
       ATF_TP_ADD_TC(tp, kcov_multiple_threads8);
       ATF_TP_ADD_TC(tp, kcov_multiple_threads16);
       ATF_TP_ADD_TC(tp, kcov_multiple_threads32);
       return atf_no_error();
}

You are viewing proxied material from ftp.icm.edu.pl. The copyright of proxied material belongs to its original authors. Any comments or complaints in relation to proxied material should be directed to the original authors of the content concerned. Please see the disclaimer for more details.