1 /*
2 *
3 * honggfuzz - architecture dependent code (LINUX/PERF)
4 * -----------------------------------------
5 *
6 * Author: Robert Swiecki <swiecki@google.com>
7 *
8 * Copyright 2010-2015 by Google Inc. All Rights Reserved.
9 *
10 * Licensed under the Apache License, Version 2.0 (the "License"); you may
11 * not use this file except in compliance with the License. You may obtain
12 * a copy of the License at
13 *
14 * http://www.apache.org/licenses/LICENSE-2.0
15 *
16 * Unless required by applicable law or agreed to in writing, software
17 * distributed under the License is distributed on an "AS IS" BASIS,
18 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
19 * implied. See the License for the specific language governing
20 * permissions and limitations under the License.
21 *
22 */
23
24 #include "perf.h"
25
26 #include <asm/mman.h>
27 #include <errno.h>
28 #include <fcntl.h>
29 #include <inttypes.h>
30 #include <linux/hw_breakpoint.h>
31 #include <linux/perf_event.h>
32 #include <linux/sysctl.h>
33 #include <signal.h>
34 #include <stdlib.h>
35 #include <string.h>
36 #include <sys/ioctl.h>
37 #include <sys/mman.h>
38 #include <sys/poll.h>
39 #include <sys/ptrace.h>
40 #include <sys/syscall.h>
41 #include <unistd.h>
42
43 #include "libcommon/common.h"
44 #include "libcommon/files.h"
45 #include "libcommon/log.h"
46 #include "libcommon/util.h"
47 #include "pt.h"
48
49 #define _HF_PERF_MAP_SZ (1024 * 512)
50 #define _HF_PERF_AUX_SZ (1024 * 1024)
51 /* PERF_TYPE for Intel_PT/BTS -1 if none */
52 static int32_t perfIntelPtPerfType = -1;
53 static int32_t perfIntelBtsPerfType = -1;
54
55 #if defined(PERF_ATTR_SIZE_VER5)
arch_perfBtsCount(run_t * run)56 __attribute__((hot)) static inline void arch_perfBtsCount(run_t* run) {
57 struct perf_event_mmap_page* pem = (struct perf_event_mmap_page*)run->linux.perfMmapBuf;
58 struct bts_branch {
59 uint64_t from;
60 uint64_t to;
61 uint64_t misc;
62 };
63
64 uint64_t aux_head = ATOMIC_GET(pem->aux_head);
65 struct bts_branch* br = (struct bts_branch*)run->linux.perfMmapAux;
66 for (; br < ((struct bts_branch*)(run->linux.perfMmapAux + aux_head)); br++) {
67 /*
68 * Kernel sometimes reports branches from the kernel (iret), we are not interested in that
69 * as it makes the whole concept of unique branch counting less predictable
70 */
71 if (run->global->linux.kernelOnly == false &&
72 (__builtin_expect(br->from > 0xFFFFFFFF00000000, false) ||
73 __builtin_expect(br->to > 0xFFFFFFFF00000000, false))) {
74 LOG_D("Adding branch %#018" PRIx64 " - %#018" PRIx64, br->from, br->to);
75 continue;
76 }
77 if (br->from >= run->global->linux.dynamicCutOffAddr ||
78 br->to >= run->global->linux.dynamicCutOffAddr) {
79 continue;
80 }
81
82 register size_t pos = ((br->from << 12) ^ (br->to & 0xFFF));
83 pos &= _HF_PERF_BITMAP_BITSZ_MASK;
84 register uint8_t prev = ATOMIC_BTS(run->global->feedback->bbMapPc, pos);
85 if (!prev) {
86 run->linux.hwCnts.newBBCnt++;
87 }
88 }
89 }
90 #endif /* defined(PERF_ATTR_SIZE_VER5) */
91
arch_perfMmapParse(run_t * run UNUSED)92 static inline void arch_perfMmapParse(run_t* run UNUSED) {
93 #if defined(PERF_ATTR_SIZE_VER5)
94 struct perf_event_mmap_page* pem = (struct perf_event_mmap_page*)run->linux.perfMmapBuf;
95 if (pem->aux_head == pem->aux_tail) {
96 return;
97 }
98 if (pem->aux_head < pem->aux_tail) {
99 LOG_F("The PERF AUX data has been overwritten. The AUX buffer is too small");
100 }
101 if (run->global->dynFileMethod & _HF_DYNFILE_BTS_EDGE) {
102 arch_perfBtsCount(run);
103 }
104 if (run->global->dynFileMethod & _HF_DYNFILE_IPT_BLOCK) {
105 arch_ptAnalyze(run);
106 }
107 #endif /* defined(PERF_ATTR_SIZE_VER5) */
108 }
109
perf_event_open(struct perf_event_attr * hw_event,pid_t pid,int cpu,int group_fd,unsigned long flags)110 static long perf_event_open(
111 struct perf_event_attr* hw_event, pid_t pid, int cpu, int group_fd, unsigned long flags) {
112 return syscall(__NR_perf_event_open, hw_event, (uintptr_t)pid, (uintptr_t)cpu,
113 (uintptr_t)group_fd, (uintptr_t)flags);
114 }
115
arch_perfCreate(run_t * run,pid_t pid,dynFileMethod_t method,int * perfFd)116 static bool arch_perfCreate(run_t* run, pid_t pid, dynFileMethod_t method, int* perfFd) {
117 LOG_D("Enabling PERF for PID=%d method=%x", pid, method);
118
119 if (*perfFd != -1) {
120 LOG_F("The PERF FD is already initialized, possibly conflicting perf types enabled");
121 }
122
123 if ((method & _HF_DYNFILE_BTS_EDGE) && perfIntelBtsPerfType == -1) {
124 LOG_F("Intel BTS events (new type) are not supported on this platform");
125 }
126 if ((method & _HF_DYNFILE_IPT_BLOCK) && perfIntelPtPerfType == -1) {
127 LOG_F("Intel PT events are not supported on this platform");
128 }
129
130 struct perf_event_attr pe;
131 memset(&pe, 0, sizeof(struct perf_event_attr));
132 pe.size = sizeof(struct perf_event_attr);
133 if (run->global->linux.kernelOnly) {
134 pe.exclude_user = 1;
135 } else {
136 pe.exclude_kernel = 1;
137 }
138 if (run->global->linux.pid > 0 || run->global->persistent == true) {
139 pe.disabled = 0;
140 pe.enable_on_exec = 0;
141 } else {
142 pe.disabled = 1;
143 pe.enable_on_exec = 1;
144 }
145 pe.type = PERF_TYPE_HARDWARE;
146
147 switch (method) {
148 case _HF_DYNFILE_INSTR_COUNT:
149 LOG_D("Using: PERF_COUNT_HW_INSTRUCTIONS for PID: %d", pid);
150 pe.config = PERF_COUNT_HW_INSTRUCTIONS;
151 pe.inherit = 1;
152 break;
153 case _HF_DYNFILE_BRANCH_COUNT:
154 LOG_D("Using: PERF_COUNT_HW_BRANCH_INSTRUCTIONS for PID: %d", pid);
155 pe.config = PERF_COUNT_HW_BRANCH_INSTRUCTIONS;
156 pe.inherit = 1;
157 break;
158 case _HF_DYNFILE_BTS_EDGE:
159 LOG_D("Using: (Intel BTS) type=%" PRIu32 " for PID: %d", perfIntelBtsPerfType, pid);
160 pe.type = perfIntelBtsPerfType;
161 break;
162 case _HF_DYNFILE_IPT_BLOCK:
163 LOG_D("Using: (Intel PT) type=%" PRIu32 " for PID: %d", perfIntelPtPerfType, pid);
164 pe.type = perfIntelPtPerfType;
165 pe.config = (1U << 11); /* Disable RETCompression */
166 break;
167 default:
168 LOG_E("Unknown perf mode: '%d' for PID: %d", method, pid);
169 return false;
170 break;
171 }
172
173 #if !defined(PERF_FLAG_FD_CLOEXEC)
174 #define PERF_FLAG_FD_CLOEXEC 0
175 #endif
176 *perfFd = perf_event_open(&pe, pid, -1, -1, PERF_FLAG_FD_CLOEXEC);
177 if (*perfFd == -1) {
178 PLOG_F("perf_event_open() failed");
179 return false;
180 }
181
182 if (method != _HF_DYNFILE_BTS_EDGE && method != _HF_DYNFILE_IPT_BLOCK) {
183 return true;
184 }
185 #if defined(PERF_ATTR_SIZE_VER5)
186 run->linux.perfMmapBuf =
187 mmap(NULL, _HF_PERF_MAP_SZ + getpagesize(), PROT_READ | PROT_WRITE, MAP_SHARED, *perfFd, 0);
188 if (run->linux.perfMmapBuf == MAP_FAILED) {
189 run->linux.perfMmapBuf = NULL;
190 PLOG_W(
191 "mmap(mmapBuf) failed, sz=%zu, try increasing the kernel.perf_event_mlock_kb sysctl "
192 "(up to even 300000000)",
193 (size_t)_HF_PERF_MAP_SZ + getpagesize());
194 close(*perfFd);
195 *perfFd = -1;
196 return false;
197 }
198
199 struct perf_event_mmap_page* pem = (struct perf_event_mmap_page*)run->linux.perfMmapBuf;
200 pem->aux_offset = pem->data_offset + pem->data_size;
201 pem->aux_size = _HF_PERF_AUX_SZ;
202 run->linux.perfMmapAux =
203 mmap(NULL, pem->aux_size, PROT_READ | PROT_WRITE, MAP_SHARED, *perfFd, pem->aux_offset);
204 if (run->linux.perfMmapAux == MAP_FAILED) {
205 munmap(run->linux.perfMmapBuf, _HF_PERF_MAP_SZ + getpagesize());
206 run->linux.perfMmapBuf = NULL;
207 PLOG_W(
208 "mmap(mmapAuxBuf) failed, try increasing the kernel.perf_event_mlock_kb sysctl (up to "
209 "even 300000000)");
210 close(*perfFd);
211 *perfFd = -1;
212 return false;
213 }
214 #else /* defined(PERF_ATTR_SIZE_VER5) */
215 LOG_F("Your <linux/perf_event.h> includes are too old to support Intel PT/BTS");
216 #endif /* defined(PERF_ATTR_SIZE_VER5) */
217
218 return true;
219 }
220
arch_perfOpen(pid_t pid,run_t * run)221 bool arch_perfOpen(pid_t pid, run_t* run) {
222 if (run->global->dynFileMethod == _HF_DYNFILE_NONE) {
223 return true;
224 }
225
226 if (run->global->dynFileMethod & _HF_DYNFILE_INSTR_COUNT) {
227 if (arch_perfCreate(run, pid, _HF_DYNFILE_INSTR_COUNT, &run->linux.cpuInstrFd) == false) {
228 LOG_E("Cannot set up perf for PID=%d (_HF_DYNFILE_INSTR_COUNT)", pid);
229 goto out;
230 }
231 }
232 if (run->global->dynFileMethod & _HF_DYNFILE_BRANCH_COUNT) {
233 if (arch_perfCreate(run, pid, _HF_DYNFILE_BRANCH_COUNT, &run->linux.cpuBranchFd) == false) {
234 LOG_E("Cannot set up perf for PID=%d (_HF_DYNFILE_BRANCH_COUNT)", pid);
235 goto out;
236 }
237 }
238 if (run->global->dynFileMethod & _HF_DYNFILE_BTS_EDGE) {
239 if (arch_perfCreate(run, pid, _HF_DYNFILE_BTS_EDGE, &run->linux.cpuIptBtsFd) == false) {
240 LOG_E("Cannot set up perf for PID=%d (_HF_DYNFILE_BTS_EDGE)", pid);
241 goto out;
242 }
243 }
244 if (run->global->dynFileMethod & _HF_DYNFILE_IPT_BLOCK) {
245 if (arch_perfCreate(run, pid, _HF_DYNFILE_IPT_BLOCK, &run->linux.cpuIptBtsFd) == false) {
246 LOG_E("Cannot set up perf for PID=%d (_HF_DYNFILE_IPT_BLOCK)", pid);
247 goto out;
248 }
249 }
250
251 return true;
252
253 out:
254 close(run->linux.cpuInstrFd);
255 run->linux.cpuInstrFd = -1;
256 close(run->linux.cpuBranchFd);
257 run->linux.cpuBranchFd = -1;
258 close(run->linux.cpuIptBtsFd);
259 run->linux.cpuIptBtsFd = 1;
260
261 return false;
262 }
263
arch_perfClose(run_t * run)264 void arch_perfClose(run_t* run) {
265 if (run->global->dynFileMethod == _HF_DYNFILE_NONE) {
266 return;
267 }
268
269 if (run->linux.perfMmapAux != NULL) {
270 munmap(run->linux.perfMmapAux, _HF_PERF_AUX_SZ);
271 run->linux.perfMmapAux = NULL;
272 }
273 if (run->linux.perfMmapBuf != NULL) {
274 munmap(run->linux.perfMmapBuf, _HF_PERF_MAP_SZ + getpagesize());
275 run->linux.perfMmapBuf = NULL;
276 }
277
278 if (run->global->dynFileMethod & _HF_DYNFILE_INSTR_COUNT) {
279 close(run->linux.cpuInstrFd);
280 run->linux.cpuInstrFd = -1;
281 }
282 if (run->global->dynFileMethod & _HF_DYNFILE_BRANCH_COUNT) {
283 close(run->linux.cpuBranchFd);
284 run->linux.cpuBranchFd = -1;
285 }
286 if (run->global->dynFileMethod & _HF_DYNFILE_BTS_EDGE) {
287 close(run->linux.cpuIptBtsFd);
288 run->linux.cpuIptBtsFd = -1;
289 }
290 if (run->global->dynFileMethod & _HF_DYNFILE_IPT_BLOCK) {
291 close(run->linux.cpuIptBtsFd);
292 run->linux.cpuIptBtsFd = -1;
293 }
294 }
295
arch_perfEnable(run_t * run)296 bool arch_perfEnable(run_t* run) {
297 if (run->global->dynFileMethod == _HF_DYNFILE_NONE) {
298 return true;
299 }
300
301 if (run->global->dynFileMethod & _HF_DYNFILE_INSTR_COUNT) {
302 ioctl(run->linux.cpuInstrFd, PERF_EVENT_IOC_ENABLE, 0);
303 }
304 if (run->global->dynFileMethod & _HF_DYNFILE_BRANCH_COUNT) {
305 ioctl(run->linux.cpuBranchFd, PERF_EVENT_IOC_ENABLE, 0);
306 }
307 if (run->global->dynFileMethod & _HF_DYNFILE_BTS_EDGE) {
308 ioctl(run->linux.cpuIptBtsFd, PERF_EVENT_IOC_ENABLE, 0);
309 }
310 if (run->global->dynFileMethod & _HF_DYNFILE_IPT_BLOCK) {
311 ioctl(run->linux.cpuIptBtsFd, PERF_EVENT_IOC_ENABLE, 0);
312 }
313
314 return true;
315 }
316
arch_perfMmapReset(run_t * run)317 static void arch_perfMmapReset(run_t* run) {
318 struct perf_event_mmap_page* pem = (struct perf_event_mmap_page*)run->linux.perfMmapBuf;
319 ATOMIC_SET(pem->data_head, 0);
320 ATOMIC_SET(pem->data_tail, 0);
321 #if defined(PERF_ATTR_SIZE_VER5)
322 ATOMIC_SET(pem->aux_head, 0);
323 ATOMIC_SET(pem->aux_tail, 0);
324 #endif /* defined(PERF_ATTR_SIZE_VER5) */
325 wmb();
326 }
327
arch_perfAnalyze(run_t * run)328 void arch_perfAnalyze(run_t* run) {
329 if (run->global->dynFileMethod == _HF_DYNFILE_NONE) {
330 return;
331 }
332
333 uint64_t instrCount = 0;
334 if (run->global->dynFileMethod & _HF_DYNFILE_INSTR_COUNT) {
335 ioctl(run->linux.cpuInstrFd, PERF_EVENT_IOC_DISABLE, 0);
336 if (files_readFromFd(run->linux.cpuInstrFd, (uint8_t*)&instrCount, sizeof(instrCount)) !=
337 sizeof(instrCount)) {
338 PLOG_E("read(perfFd='%d') failed", run->linux.cpuInstrFd);
339 }
340 ioctl(run->linux.cpuInstrFd, PERF_EVENT_IOC_RESET, 0);
341 }
342
343 uint64_t branchCount = 0;
344 if (run->global->dynFileMethod & _HF_DYNFILE_BRANCH_COUNT) {
345 ioctl(run->linux.cpuBranchFd, PERF_EVENT_IOC_DISABLE, 0);
346 if (files_readFromFd(run->linux.cpuBranchFd, (uint8_t*)&branchCount, sizeof(branchCount)) !=
347 sizeof(branchCount)) {
348 PLOG_E("read(perfFd='%d') failed", run->linux.cpuBranchFd);
349 }
350 ioctl(run->linux.cpuBranchFd, PERF_EVENT_IOC_RESET, 0);
351 }
352
353 if (run->global->dynFileMethod & _HF_DYNFILE_BTS_EDGE) {
354 ioctl(run->linux.cpuIptBtsFd, PERF_EVENT_IOC_DISABLE, 0);
355 arch_perfMmapParse(run);
356 arch_perfMmapReset(run);
357 ioctl(run->linux.cpuIptBtsFd, PERF_EVENT_IOC_RESET, 0);
358 }
359 if (run->global->dynFileMethod & _HF_DYNFILE_IPT_BLOCK) {
360 ioctl(run->linux.cpuIptBtsFd, PERF_EVENT_IOC_DISABLE, 0);
361 arch_perfMmapParse(run);
362 arch_perfMmapReset(run);
363 ioctl(run->linux.cpuIptBtsFd, PERF_EVENT_IOC_RESET, 0);
364 }
365
366 run->linux.hwCnts.cpuInstrCnt = instrCount;
367 run->linux.hwCnts.cpuBranchCnt = branchCount;
368 }
369
arch_perfInit(honggfuzz_t * hfuzz UNUSED)370 bool arch_perfInit(honggfuzz_t* hfuzz UNUSED) {
371 uint8_t buf[PATH_MAX + 1];
372 ssize_t sz =
373 files_readFileToBufMax("/sys/bus/event_source/devices/intel_pt/type", buf, sizeof(buf) - 1);
374 if (sz > 0) {
375 buf[sz] = '\0';
376 perfIntelPtPerfType = (int32_t)strtoul((char*)buf, NULL, 10);
377 LOG_D("perfIntelPtPerfType = %" PRIu32, perfIntelPtPerfType);
378 }
379 sz = files_readFileToBufMax(
380 "/sys/bus/event_source/devices/intel_bts/type", buf, sizeof(buf) - 1);
381 if (sz > 0) {
382 buf[sz] = '\0';
383 perfIntelBtsPerfType = (int32_t)strtoul((char*)buf, NULL, 10);
384 LOG_D("perfIntelBtsPerfType = %" PRIu32, perfIntelBtsPerfType);
385 }
386 return true;
387 }
388