1 /*
2  *
3  * honggfuzz - architecture dependent code (LINUX/PERF)
4  * -----------------------------------------
5  *
6  * Author: Robert Swiecki <swiecki@google.com>
7  *
8  * Copyright 2010-2015 by Google Inc. All Rights Reserved.
9  *
10  * Licensed under the Apache License, Version 2.0 (the "License"); you may
11  * not use this file except in compliance with the License. You may obtain
12  * a copy of the License at
13  *
14  * http://www.apache.org/licenses/LICENSE-2.0
15  *
16  * Unless required by applicable law or agreed to in writing, software
17  * distributed under the License is distributed on an "AS IS" BASIS,
18  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
19  * implied. See the License for the specific language governing
20  * permissions and limitations under the License.
21  *
22  */
23 
24 #include "perf.h"
25 
26 #include <asm/mman.h>
27 #include <errno.h>
28 #include <fcntl.h>
29 #include <inttypes.h>
30 #include <linux/hw_breakpoint.h>
31 #include <linux/perf_event.h>
32 #include <linux/sysctl.h>
33 #include <signal.h>
34 #include <stdlib.h>
35 #include <string.h>
36 #include <sys/ioctl.h>
37 #include <sys/mman.h>
38 #include <sys/poll.h>
39 #include <sys/ptrace.h>
40 #include <sys/syscall.h>
41 #include <unistd.h>
42 
43 #include "libcommon/common.h"
44 #include "libcommon/files.h"
45 #include "libcommon/log.h"
46 #include "libcommon/util.h"
47 #include "pt.h"
48 
49 #define _HF_PERF_MAP_SZ (1024 * 512)
50 #define _HF_PERF_AUX_SZ (1024 * 1024)
51 /* PERF_TYPE for Intel_PT/BTS -1 if none */
52 static int32_t perfIntelPtPerfType = -1;
53 static int32_t perfIntelBtsPerfType = -1;
54 
55 #if defined(PERF_ATTR_SIZE_VER5)
arch_perfBtsCount(run_t * run)56 __attribute__((hot)) static inline void arch_perfBtsCount(run_t* run) {
57     struct perf_event_mmap_page* pem = (struct perf_event_mmap_page*)run->linux.perfMmapBuf;
58     struct bts_branch {
59         uint64_t from;
60         uint64_t to;
61         uint64_t misc;
62     };
63 
64     uint64_t aux_head = ATOMIC_GET(pem->aux_head);
65     struct bts_branch* br = (struct bts_branch*)run->linux.perfMmapAux;
66     for (; br < ((struct bts_branch*)(run->linux.perfMmapAux + aux_head)); br++) {
67         /*
68          * Kernel sometimes reports branches from the kernel (iret), we are not interested in that
69          * as it makes the whole concept of unique branch counting less predictable
70          */
71         if (run->global->linux.kernelOnly == false &&
72             (__builtin_expect(br->from > 0xFFFFFFFF00000000, false) ||
73                 __builtin_expect(br->to > 0xFFFFFFFF00000000, false))) {
74             LOG_D("Adding branch %#018" PRIx64 " - %#018" PRIx64, br->from, br->to);
75             continue;
76         }
77         if (br->from >= run->global->linux.dynamicCutOffAddr ||
78             br->to >= run->global->linux.dynamicCutOffAddr) {
79             continue;
80         }
81 
82         register size_t pos = ((br->from << 12) ^ (br->to & 0xFFF));
83         pos &= _HF_PERF_BITMAP_BITSZ_MASK;
84         register uint8_t prev = ATOMIC_BTS(run->global->feedback->bbMapPc, pos);
85         if (!prev) {
86             run->linux.hwCnts.newBBCnt++;
87         }
88     }
89 }
90 #endif /* defined(PERF_ATTR_SIZE_VER5) */
91 
arch_perfMmapParse(run_t * run UNUSED)92 static inline void arch_perfMmapParse(run_t* run UNUSED) {
93 #if defined(PERF_ATTR_SIZE_VER5)
94     struct perf_event_mmap_page* pem = (struct perf_event_mmap_page*)run->linux.perfMmapBuf;
95     if (pem->aux_head == pem->aux_tail) {
96         return;
97     }
98     if (pem->aux_head < pem->aux_tail) {
99         LOG_F("The PERF AUX data has been overwritten. The AUX buffer is too small");
100     }
101     if (run->global->dynFileMethod & _HF_DYNFILE_BTS_EDGE) {
102         arch_perfBtsCount(run);
103     }
104     if (run->global->dynFileMethod & _HF_DYNFILE_IPT_BLOCK) {
105         arch_ptAnalyze(run);
106     }
107 #endif /* defined(PERF_ATTR_SIZE_VER5) */
108 }
109 
perf_event_open(struct perf_event_attr * hw_event,pid_t pid,int cpu,int group_fd,unsigned long flags)110 static long perf_event_open(
111     struct perf_event_attr* hw_event, pid_t pid, int cpu, int group_fd, unsigned long flags) {
112     return syscall(__NR_perf_event_open, hw_event, (uintptr_t)pid, (uintptr_t)cpu,
113         (uintptr_t)group_fd, (uintptr_t)flags);
114 }
115 
arch_perfCreate(run_t * run,pid_t pid,dynFileMethod_t method,int * perfFd)116 static bool arch_perfCreate(run_t* run, pid_t pid, dynFileMethod_t method, int* perfFd) {
117     LOG_D("Enabling PERF for PID=%d method=%x", pid, method);
118 
119     if (*perfFd != -1) {
120         LOG_F("The PERF FD is already initialized, possibly conflicting perf types enabled");
121     }
122 
123     if ((method & _HF_DYNFILE_BTS_EDGE) && perfIntelBtsPerfType == -1) {
124         LOG_F("Intel BTS events (new type) are not supported on this platform");
125     }
126     if ((method & _HF_DYNFILE_IPT_BLOCK) && perfIntelPtPerfType == -1) {
127         LOG_F("Intel PT events are not supported on this platform");
128     }
129 
130     struct perf_event_attr pe;
131     memset(&pe, 0, sizeof(struct perf_event_attr));
132     pe.size = sizeof(struct perf_event_attr);
133     if (run->global->linux.kernelOnly) {
134         pe.exclude_user = 1;
135     } else {
136         pe.exclude_kernel = 1;
137     }
138     if (run->global->linux.pid > 0 || run->global->persistent == true) {
139         pe.disabled = 0;
140         pe.enable_on_exec = 0;
141     } else {
142         pe.disabled = 1;
143         pe.enable_on_exec = 1;
144     }
145     pe.type = PERF_TYPE_HARDWARE;
146 
147     switch (method) {
148         case _HF_DYNFILE_INSTR_COUNT:
149             LOG_D("Using: PERF_COUNT_HW_INSTRUCTIONS for PID: %d", pid);
150             pe.config = PERF_COUNT_HW_INSTRUCTIONS;
151             pe.inherit = 1;
152             break;
153         case _HF_DYNFILE_BRANCH_COUNT:
154             LOG_D("Using: PERF_COUNT_HW_BRANCH_INSTRUCTIONS for PID: %d", pid);
155             pe.config = PERF_COUNT_HW_BRANCH_INSTRUCTIONS;
156             pe.inherit = 1;
157             break;
158         case _HF_DYNFILE_BTS_EDGE:
159             LOG_D("Using: (Intel BTS) type=%" PRIu32 " for PID: %d", perfIntelBtsPerfType, pid);
160             pe.type = perfIntelBtsPerfType;
161             break;
162         case _HF_DYNFILE_IPT_BLOCK:
163             LOG_D("Using: (Intel PT) type=%" PRIu32 " for PID: %d", perfIntelPtPerfType, pid);
164             pe.type = perfIntelPtPerfType;
165             pe.config = (1U << 11); /* Disable RETCompression */
166             break;
167         default:
168             LOG_E("Unknown perf mode: '%d' for PID: %d", method, pid);
169             return false;
170             break;
171     }
172 
173 #if !defined(PERF_FLAG_FD_CLOEXEC)
174 #define PERF_FLAG_FD_CLOEXEC 0
175 #endif
176     *perfFd = perf_event_open(&pe, pid, -1, -1, PERF_FLAG_FD_CLOEXEC);
177     if (*perfFd == -1) {
178         PLOG_F("perf_event_open() failed");
179         return false;
180     }
181 
182     if (method != _HF_DYNFILE_BTS_EDGE && method != _HF_DYNFILE_IPT_BLOCK) {
183         return true;
184     }
185 #if defined(PERF_ATTR_SIZE_VER5)
186     run->linux.perfMmapBuf =
187         mmap(NULL, _HF_PERF_MAP_SZ + getpagesize(), PROT_READ | PROT_WRITE, MAP_SHARED, *perfFd, 0);
188     if (run->linux.perfMmapBuf == MAP_FAILED) {
189         run->linux.perfMmapBuf = NULL;
190         PLOG_W(
191             "mmap(mmapBuf) failed, sz=%zu, try increasing the kernel.perf_event_mlock_kb sysctl "
192             "(up to even 300000000)",
193             (size_t)_HF_PERF_MAP_SZ + getpagesize());
194         close(*perfFd);
195         *perfFd = -1;
196         return false;
197     }
198 
199     struct perf_event_mmap_page* pem = (struct perf_event_mmap_page*)run->linux.perfMmapBuf;
200     pem->aux_offset = pem->data_offset + pem->data_size;
201     pem->aux_size = _HF_PERF_AUX_SZ;
202     run->linux.perfMmapAux =
203         mmap(NULL, pem->aux_size, PROT_READ | PROT_WRITE, MAP_SHARED, *perfFd, pem->aux_offset);
204     if (run->linux.perfMmapAux == MAP_FAILED) {
205         munmap(run->linux.perfMmapBuf, _HF_PERF_MAP_SZ + getpagesize());
206         run->linux.perfMmapBuf = NULL;
207         PLOG_W(
208             "mmap(mmapAuxBuf) failed, try increasing the kernel.perf_event_mlock_kb sysctl (up to "
209             "even 300000000)");
210         close(*perfFd);
211         *perfFd = -1;
212         return false;
213     }
214 #else  /* defined(PERF_ATTR_SIZE_VER5) */
215     LOG_F("Your <linux/perf_event.h> includes are too old to support Intel PT/BTS");
216 #endif /* defined(PERF_ATTR_SIZE_VER5) */
217 
218     return true;
219 }
220 
arch_perfOpen(pid_t pid,run_t * run)221 bool arch_perfOpen(pid_t pid, run_t* run) {
222     if (run->global->dynFileMethod == _HF_DYNFILE_NONE) {
223         return true;
224     }
225 
226     if (run->global->dynFileMethod & _HF_DYNFILE_INSTR_COUNT) {
227         if (arch_perfCreate(run, pid, _HF_DYNFILE_INSTR_COUNT, &run->linux.cpuInstrFd) == false) {
228             LOG_E("Cannot set up perf for PID=%d (_HF_DYNFILE_INSTR_COUNT)", pid);
229             goto out;
230         }
231     }
232     if (run->global->dynFileMethod & _HF_DYNFILE_BRANCH_COUNT) {
233         if (arch_perfCreate(run, pid, _HF_DYNFILE_BRANCH_COUNT, &run->linux.cpuBranchFd) == false) {
234             LOG_E("Cannot set up perf for PID=%d (_HF_DYNFILE_BRANCH_COUNT)", pid);
235             goto out;
236         }
237     }
238     if (run->global->dynFileMethod & _HF_DYNFILE_BTS_EDGE) {
239         if (arch_perfCreate(run, pid, _HF_DYNFILE_BTS_EDGE, &run->linux.cpuIptBtsFd) == false) {
240             LOG_E("Cannot set up perf for PID=%d (_HF_DYNFILE_BTS_EDGE)", pid);
241             goto out;
242         }
243     }
244     if (run->global->dynFileMethod & _HF_DYNFILE_IPT_BLOCK) {
245         if (arch_perfCreate(run, pid, _HF_DYNFILE_IPT_BLOCK, &run->linux.cpuIptBtsFd) == false) {
246             LOG_E("Cannot set up perf for PID=%d (_HF_DYNFILE_IPT_BLOCK)", pid);
247             goto out;
248         }
249     }
250 
251     return true;
252 
253 out:
254     close(run->linux.cpuInstrFd);
255     run->linux.cpuInstrFd = -1;
256     close(run->linux.cpuBranchFd);
257     run->linux.cpuBranchFd = -1;
258     close(run->linux.cpuIptBtsFd);
259     run->linux.cpuIptBtsFd = 1;
260 
261     return false;
262 }
263 
arch_perfClose(run_t * run)264 void arch_perfClose(run_t* run) {
265     if (run->global->dynFileMethod == _HF_DYNFILE_NONE) {
266         return;
267     }
268 
269     if (run->linux.perfMmapAux != NULL) {
270         munmap(run->linux.perfMmapAux, _HF_PERF_AUX_SZ);
271         run->linux.perfMmapAux = NULL;
272     }
273     if (run->linux.perfMmapBuf != NULL) {
274         munmap(run->linux.perfMmapBuf, _HF_PERF_MAP_SZ + getpagesize());
275         run->linux.perfMmapBuf = NULL;
276     }
277 
278     if (run->global->dynFileMethod & _HF_DYNFILE_INSTR_COUNT) {
279         close(run->linux.cpuInstrFd);
280         run->linux.cpuInstrFd = -1;
281     }
282     if (run->global->dynFileMethod & _HF_DYNFILE_BRANCH_COUNT) {
283         close(run->linux.cpuBranchFd);
284         run->linux.cpuBranchFd = -1;
285     }
286     if (run->global->dynFileMethod & _HF_DYNFILE_BTS_EDGE) {
287         close(run->linux.cpuIptBtsFd);
288         run->linux.cpuIptBtsFd = -1;
289     }
290     if (run->global->dynFileMethod & _HF_DYNFILE_IPT_BLOCK) {
291         close(run->linux.cpuIptBtsFd);
292         run->linux.cpuIptBtsFd = -1;
293     }
294 }
295 
arch_perfEnable(run_t * run)296 bool arch_perfEnable(run_t* run) {
297     if (run->global->dynFileMethod == _HF_DYNFILE_NONE) {
298         return true;
299     }
300 
301     if (run->global->dynFileMethod & _HF_DYNFILE_INSTR_COUNT) {
302         ioctl(run->linux.cpuInstrFd, PERF_EVENT_IOC_ENABLE, 0);
303     }
304     if (run->global->dynFileMethod & _HF_DYNFILE_BRANCH_COUNT) {
305         ioctl(run->linux.cpuBranchFd, PERF_EVENT_IOC_ENABLE, 0);
306     }
307     if (run->global->dynFileMethod & _HF_DYNFILE_BTS_EDGE) {
308         ioctl(run->linux.cpuIptBtsFd, PERF_EVENT_IOC_ENABLE, 0);
309     }
310     if (run->global->dynFileMethod & _HF_DYNFILE_IPT_BLOCK) {
311         ioctl(run->linux.cpuIptBtsFd, PERF_EVENT_IOC_ENABLE, 0);
312     }
313 
314     return true;
315 }
316 
arch_perfMmapReset(run_t * run)317 static void arch_perfMmapReset(run_t* run) {
318     struct perf_event_mmap_page* pem = (struct perf_event_mmap_page*)run->linux.perfMmapBuf;
319     ATOMIC_SET(pem->data_head, 0);
320     ATOMIC_SET(pem->data_tail, 0);
321 #if defined(PERF_ATTR_SIZE_VER5)
322     ATOMIC_SET(pem->aux_head, 0);
323     ATOMIC_SET(pem->aux_tail, 0);
324 #endif /* defined(PERF_ATTR_SIZE_VER5) */
325     wmb();
326 }
327 
arch_perfAnalyze(run_t * run)328 void arch_perfAnalyze(run_t* run) {
329     if (run->global->dynFileMethod == _HF_DYNFILE_NONE) {
330         return;
331     }
332 
333     uint64_t instrCount = 0;
334     if (run->global->dynFileMethod & _HF_DYNFILE_INSTR_COUNT) {
335         ioctl(run->linux.cpuInstrFd, PERF_EVENT_IOC_DISABLE, 0);
336         if (files_readFromFd(run->linux.cpuInstrFd, (uint8_t*)&instrCount, sizeof(instrCount)) !=
337             sizeof(instrCount)) {
338             PLOG_E("read(perfFd='%d') failed", run->linux.cpuInstrFd);
339         }
340         ioctl(run->linux.cpuInstrFd, PERF_EVENT_IOC_RESET, 0);
341     }
342 
343     uint64_t branchCount = 0;
344     if (run->global->dynFileMethod & _HF_DYNFILE_BRANCH_COUNT) {
345         ioctl(run->linux.cpuBranchFd, PERF_EVENT_IOC_DISABLE, 0);
346         if (files_readFromFd(run->linux.cpuBranchFd, (uint8_t*)&branchCount, sizeof(branchCount)) !=
347             sizeof(branchCount)) {
348             PLOG_E("read(perfFd='%d') failed", run->linux.cpuBranchFd);
349         }
350         ioctl(run->linux.cpuBranchFd, PERF_EVENT_IOC_RESET, 0);
351     }
352 
353     if (run->global->dynFileMethod & _HF_DYNFILE_BTS_EDGE) {
354         ioctl(run->linux.cpuIptBtsFd, PERF_EVENT_IOC_DISABLE, 0);
355         arch_perfMmapParse(run);
356         arch_perfMmapReset(run);
357         ioctl(run->linux.cpuIptBtsFd, PERF_EVENT_IOC_RESET, 0);
358     }
359     if (run->global->dynFileMethod & _HF_DYNFILE_IPT_BLOCK) {
360         ioctl(run->linux.cpuIptBtsFd, PERF_EVENT_IOC_DISABLE, 0);
361         arch_perfMmapParse(run);
362         arch_perfMmapReset(run);
363         ioctl(run->linux.cpuIptBtsFd, PERF_EVENT_IOC_RESET, 0);
364     }
365 
366     run->linux.hwCnts.cpuInstrCnt = instrCount;
367     run->linux.hwCnts.cpuBranchCnt = branchCount;
368 }
369 
arch_perfInit(honggfuzz_t * hfuzz UNUSED)370 bool arch_perfInit(honggfuzz_t* hfuzz UNUSED) {
371     uint8_t buf[PATH_MAX + 1];
372     ssize_t sz =
373         files_readFileToBufMax("/sys/bus/event_source/devices/intel_pt/type", buf, sizeof(buf) - 1);
374     if (sz > 0) {
375         buf[sz] = '\0';
376         perfIntelPtPerfType = (int32_t)strtoul((char*)buf, NULL, 10);
377         LOG_D("perfIntelPtPerfType = %" PRIu32, perfIntelPtPerfType);
378     }
379     sz = files_readFileToBufMax(
380         "/sys/bus/event_source/devices/intel_bts/type", buf, sizeof(buf) - 1);
381     if (sz > 0) {
382         buf[sz] = '\0';
383         perfIntelBtsPerfType = (int32_t)strtoul((char*)buf, NULL, 10);
384         LOG_D("perfIntelBtsPerfType = %" PRIu32, perfIntelBtsPerfType);
385     }
386     return true;
387 }
388