/* * * honggfuzz - Intel PT decoder * ----------------------------------------- * * Author: Robert Swiecki * * Copyright 2010-2016 by Google Inc. All Rights Reserved. * * Licensed under the Apache License, Version 2.0 (the "License"); you may * not use this file except in compliance with the License. You may obtain * a copy of the License at * * http://www.apache.org/licenses/LICENSE-2.0 * * Unless required by applicable law or agreed to in writing, software * distributed under the License is distributed on an "AS IS" BASIS, * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or * implied. See the License for the specific language governing * permissions and limitations under the License. * */ #include "libcommon/common.h" #include #include #include "libcommon/log.h" #include "libcommon/util.h" #include "pt.h" #ifdef _HF_LINUX_INTEL_PT_LIB #include /* Sign-extend a uint64_t value. */ inline static uint64_t sext(uint64_t val, uint8_t sign) { uint64_t signbit, mask; signbit = 1ull << (sign - 1); mask = ~0ull << sign; return val & signbit ? val | mask : val & ~mask; } inline static void perf_ptAnalyzePkt(run_t* run, struct pt_packet* packet) { if (packet->type != ppt_tip) { return; } uint64_t ip; if (packet->payload.ip.ipc == pt_ipc_sext_48) { ip = sext(packet->payload.ip.ip, 48); } else if (packet->payload.ip.ipc == pt_ipc_full) { ip = packet->payload.ip.ip; } else { return; } ip &= _HF_PERF_BITMAP_BITSZ_MASK; register uint8_t prev = ATOMIC_BTS(run->global->feedback->bbMapPc, ip); if (!prev) { run->linux.hwCnts.newBBCnt++; } return; } void arch_ptAnalyze(run_t* run) { struct perf_event_mmap_page* pem = (struct perf_event_mmap_page*)run->linux.perfMmapBuf; uint64_t aux_tail = ATOMIC_GET(pem->aux_tail); uint64_t aux_head = ATOMIC_GET(pem->aux_head); struct pt_config ptc; pt_config_init(&ptc); ptc.begin = &run->linux.perfMmapAux[aux_tail]; ptc.end = &run->linux.perfMmapAux[aux_head - 1]; int errcode = pt_cpu_errata(&ptc.errata, &ptc.cpu); if (errcode < 0) { LOG_F("pt_errata() failed: %s", pt_errstr(errcode)); } struct pt_packet_decoder* ptd = pt_pkt_alloc_decoder(&ptc); if (ptd == NULL) { LOG_F("pt_pkt_alloc_decoder() failed"); } defer { pt_pkt_free_decoder(ptd); }; errcode = pt_pkt_sync_forward(ptd); if (errcode < 0) { LOG_W("pt_pkt_sync_forward() failed: %s", pt_errstr(errcode)); return; } for (;;) { struct pt_packet packet; errcode = pt_pkt_next(ptd, &packet, sizeof(packet)); if (errcode == -pte_eos) { break; } if (errcode < 0) { LOG_W("pt_pkt_next() failed: %s", pt_errstr(errcode)); break; } perf_ptAnalyzePkt(run, &packet); } } #else /* _HF_LINUX_INTEL_PT_LIB */ void arch_ptAnalyze(run_t* fuzzer UNUSED) { LOG_F( "The program has not been linked against the Intel's Processor Trace Library (libipt.so)"); } #endif /* _HF_LINUX_INTEL_PT_LIB */