⬢ DragonFlyBSD Kernel Audit
DF-5700 / bcmp_instr.c
← back to finding ↓ download raw 
  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
/*
 * Load-instrumented copy of sys/libkern/bcmp.c — identical control flow,
 * every memory load wrapped by LDB()/LDC() which record the address range
 * against the caller-supplied region [reg_lo, reg_hi) per pointer.
 * Used to MEASURE the by-design longword overread (bcmp.c:53-56).
 */
#include <string.h>
#include <machine/endian.h>

typedef	const void		*cvp;
typedef	const unsigned char	*ustring;
typedef unsigned long		ul;
typedef const unsigned long	*culp;

/* --- instrumentation --- */
unsigned long g_below_start[2], g_past_end[2], g_in[2], g_max_below[2], g_max_past[2];
const unsigned char *g_lo[2], *g_hi[2];
long g_last_outside_case[4]; /* off1,off2,n,side for the max excursion */

#define NOTE(idx, p, sz) do {                                   \
    const unsigned char *_p = (const unsigned char *)(p);       \
    if (_p < g_lo[idx]) {                                       \
        g_below_start[idx]++;                                   \
        unsigned long d = (unsigned long)(g_lo[idx] - _p);      \
        if (d > g_max_below[idx]) g_max_below[idx] = d;         \
    } else if (_p + (sz) > g_hi[idx]) {                         \
        g_past_end[idx]++;                                      \
        unsigned long d = (unsigned long)(_p + (sz) - g_hi[idx]); \
        if (d > g_max_past[idx]) {                              \
            g_max_past[idx] = d;                                \
            g_last_outside_case[0]=g_case[0];                   \
            g_last_outside_case[1]=g_case[1];                   \
            g_last_outside_case[2]=g_case[2];                   \
            g_last_outside_case[3]=idx;                         \
        }                                                       \
    } else g_in[idx]++;                                         \
} while (0)

/* statement-expression loads: record, then perform the exact original load */
#define LDC(idx, e) ({ culp _q = (e); NOTE(idx, _q, sizeof(ul)); *_q; })
#define LDB(idx, e) ({ const unsigned char *_q = (e); NOTE(idx, _q, 1); *_q; })

int g_case[3];
int
bcmp_instr(const void *b1, const void *b2, size_t length)
{
#if BYTE_ORDER == LITTLE_ENDIAN
	int	shl, shr, len = length;
	ustring	p1 = b1, p2 = b2;
	ul	va, vb;

	if (len == 0)
		return (0);

	while ((long)p1 & (sizeof(long) - 1)) {
		if (LDB(0, p1) != LDB(1, p2++)) { p1++; return (1); }
		p1++;
		if (--len <= 0)
			return (0);
	}

	shr = (long)p2 & (sizeof(long) - 1);
	if (shr != 0) {
		p2 -= shr;
		shr <<= 3;
		shl = (sizeof(long) << 3) - shr;

		va = LDC(1, (culp)p2);
		p2 += sizeof(long);

		while ((len -= sizeof(long)) >= 0) {
			vb = LDC(1, (culp)p2);
			p2 += sizeof(long);
			if (LDC(0, (culp)p1) != (va >> shr | vb << shl))
				return (1);
			p1 += sizeof(long);
			va = vb;
		}
		if (!(len += sizeof(long)))
			return (0);

		len <<= 3;
		return ((((va >> shr | ((shl < len) ? LDC(1, (culp)p2) << shl : 0)) ^
		    LDC(0, (culp)p1)) & ((1L << len) - 1)) != 0);
	} else {
		while ((len -= sizeof(long)) >= 0) {
			if (LDC(0, (culp)p1) != LDC(1, (culp)p2))
				return (1);
			p1 += sizeof(long);
			p2 += sizeof(long);
		}

		if (!(len += sizeof(long)))
			return (0);

		return (((LDC(0, (culp)p1) ^ LDC(1, (culp)p2))
			 & ((1L << (len << 3)) - 1)) != 0);
	}
#else
#error instrumented copy built for LITTLE_ENDIAN only (matches DFly targets)
#endif
}