17 #include "trinity.h" // num_online_cpus
19 static unsigned int get_cpu(void)
26 case 1: return rand() % 4095;
27 case 2: return rand() % 15;
30 return rand() % num_online_cpus
;
35 static unsigned long handle_arg_address(int childno
, int call
, int argnum
)
37 unsigned long addr
= 0;
40 return (unsigned long) get_address();
42 /* Half the time, we look to see if earlier args were also ARG_ADDRESS,
43 * and munge that instead of returning a new one from get_address() */
45 addr
= find_previous_arg_address(argnum
, call
, childno
);
48 case 0: break; /* return unmodified */
51 case 2: addr
+= sizeof(int);
53 case 3: addr
+= sizeof(long);
60 static unsigned long handle_arg_range(unsigned int call
, unsigned int argnum
)
62 struct syscallentry
*entry
;
64 unsigned long low
= 0, high
= 0;
66 entry
= syscalls
[call
].entry
;
69 case 1: low
= entry
->low1range
;
70 high
= entry
->hi1range
;
72 case 2: low
= entry
->low2range
;
73 high
= entry
->hi2range
;
75 case 3: low
= entry
->low3range
;
76 high
= entry
->hi3range
;
78 case 4: low
= entry
->low4range
;
79 high
= entry
->hi4range
;
81 case 5: low
= entry
->low5range
;
82 high
= entry
->hi5range
;
84 case 6: low
= entry
->low6range
;
85 high
= entry
->hi6range
;
90 outputerr("%s forgets to set hirange!\n", entry
->name
);
91 BUG("Fix syscall definition!\n");
94 i
= (unsigned long) rand64() % high
;
102 static unsigned long handle_arg_op(unsigned long call
, unsigned long argnum
)
104 struct syscallentry
*entry
;
105 const unsigned long *values
= NULL
;
106 unsigned int num
= 0;
107 unsigned long mask
= 0;
109 entry
= syscalls
[call
].entry
;
112 case 1: num
= entry
->arg1list
.num
;
113 values
= entry
->arg1list
.values
;
115 case 2: num
= entry
->arg2list
.num
;
116 values
= entry
->arg2list
.values
;
118 case 3: num
= entry
->arg3list
.num
;
119 values
= entry
->arg3list
.values
;
121 case 4: num
= entry
->arg4list
.num
;
122 values
= entry
->arg4list
.values
;
124 case 5: num
= entry
->arg5list
.num
;
125 values
= entry
->arg5list
.values
;
127 case 6: num
= entry
->arg6list
.num
;
128 values
= entry
->arg6list
.values
;
133 BUG("ARG_OP with 0 args. What?\n");
136 BUG("ARG_OP with no values.\n");
138 mask
|= values
[rand() % num
];
142 unsigned long set_rand_bitmask(unsigned int num
, const unsigned long *values
)
145 unsigned long mask
= 0;
148 bits
= (rand() % num
) + 1; /* num of bits to OR */
149 for (i
= 0; i
< bits
; i
++)
150 mask
|= values
[rand() % num
];
155 static unsigned long handle_arg_list(unsigned long call
, unsigned long argnum
)
157 struct syscallentry
*entry
;
158 unsigned long mask
= 0;
159 unsigned int num
= 0;
160 const unsigned long *values
= NULL
;
162 entry
= syscalls
[call
].entry
;
165 case 1: num
= entry
->arg1list
.num
;
166 values
= entry
->arg1list
.values
;
168 case 2: num
= entry
->arg2list
.num
;
169 values
= entry
->arg2list
.values
;
171 case 3: num
= entry
->arg3list
.num
;
172 values
= entry
->arg3list
.values
;
174 case 4: num
= entry
->arg4list
.num
;
175 values
= entry
->arg4list
.values
;
177 case 5: num
= entry
->arg5list
.num
;
178 values
= entry
->arg5list
.values
;
180 case 6: num
= entry
->arg6list
.num
;
181 values
= entry
->arg6list
.values
;
186 BUG("ARG_LIST with 0 args. What?\n");
189 BUG("ARG_LIST with no values.\n");
191 mask
= set_rand_bitmask(num
, values
);
195 static unsigned long handle_arg_randpage(void)
197 /* Because we pass this to something that might overwrite it,
198 * and we want page_allocs to remain unmodified, we copy it to page rand instead.
201 memcpy(page_rand
, page_allocs
, page_size
);
203 return (unsigned long) page_rand
;
206 static unsigned long handle_arg_iovec(int childno
, unsigned long call
, unsigned long argnum
)
208 struct syscallentry
*entry
;
209 unsigned long num_entries
;
211 entry
= syscalls
[call
].entry
;
213 num_entries
= 1 << (rand() % 11);
216 case 1: if (entry
->arg2type
== ARG_IOVECLEN
)
217 shm
->syscall
[childno
].a2
= num_entries
;
219 case 2: if (entry
->arg3type
== ARG_IOVECLEN
)
220 shm
->syscall
[childno
].a3
= num_entries
;
222 case 3: if (entry
->arg4type
== ARG_IOVECLEN
)
223 shm
->syscall
[childno
].a4
= num_entries
;
225 case 4: if (entry
->arg5type
== ARG_IOVECLEN
)
226 shm
->syscall
[childno
].a5
= num_entries
;
228 case 5: if (entry
->arg6type
== ARG_IOVECLEN
)
229 shm
->syscall
[childno
].a6
= num_entries
;
232 return (unsigned long) alloc_iovec(num_entries
);
235 static unsigned long handle_arg_len_already_set(int childno
, unsigned long argnum
)
240 * We already set the len in the ARG_IOVEC/ARG_SOCKADDR case
241 * So here we just return what we had set there.
244 case 1: r
= shm
->syscall
[childno
].a1
; break;
245 case 2: r
= shm
->syscall
[childno
].a2
; break;
246 case 3: r
= shm
->syscall
[childno
].a3
; break;
247 case 4: r
= shm
->syscall
[childno
].a4
; break;
248 case 5: r
= shm
->syscall
[childno
].a5
; break;
249 case 6: r
= shm
->syscall
[childno
].a6
; break;
254 static unsigned long handle_arg_sockaddr(int childno
, unsigned long call
, unsigned long argnum
)
256 struct syscallentry
*entry
;
257 struct sockaddr
*sockaddr
= NULL
;
258 socklen_t sockaddrlen
= 0;
260 entry
= syscalls
[call
].entry
;
262 generate_sockaddr((struct sockaddr
**)&sockaddr
, &sockaddrlen
, PF_NOHINT
);
265 case 1: if (entry
->arg2type
== ARG_SOCKADDRLEN
)
266 shm
->syscall
[childno
].a2
= sockaddrlen
;
268 case 2: if (entry
->arg3type
== ARG_SOCKADDRLEN
)
269 shm
->syscall
[childno
].a3
= sockaddrlen
;
271 case 3: if (entry
->arg4type
== ARG_SOCKADDRLEN
)
272 shm
->syscall
[childno
].a4
= sockaddrlen
;
274 case 4: if (entry
->arg5type
== ARG_SOCKADDRLEN
)
275 shm
->syscall
[childno
].a5
= sockaddrlen
;
277 case 5: if (entry
->arg6type
== ARG_SOCKADDRLEN
)
278 shm
->syscall
[childno
].a6
= sockaddrlen
;
283 return (unsigned long) sockaddr
;
286 static unsigned long handle_arg_mode_t(void)
288 unsigned int i
, count
;
293 for (i
= 0; i
< count
; i
++) {
300 case 0: mode
|= S_IRUSR
; break;
301 case 1: mode
|= S_IWUSR
; break;
302 case 2: mode
|= S_IXUSR
; break;
303 case 3: mode
|= S_IRGRP
; break;
304 case 4: mode
|= S_IWGRP
; break;
305 case 5: mode
|= S_IXGRP
; break;
306 case 6: mode
|= S_IROTH
; break;
307 case 7: mode
|= S_IWOTH
; break;
308 case 8: mode
|= S_IXOTH
; break;
309 case 9: mode
|= S_ISUID
; break;
310 case 10: mode
|= S_ISGID
; break;
311 case 11: mode
|= S_ISVTX
; break;
318 static unsigned long fill_arg(int childno
, int call
, unsigned int argnum
)
320 struct syscallentry
*entry
;
321 enum argtype argtype
= 0;
323 entry
= syscalls
[call
].entry
;
325 if (argnum
> entry
->num_args
)
329 case 1: argtype
= entry
->arg1type
;
331 case 2: argtype
= entry
->arg2type
;
333 case 3: argtype
= entry
->arg3type
;
335 case 4: argtype
= entry
->arg4type
;
337 case 5: argtype
= entry
->arg5type
;
339 case 6: argtype
= entry
->arg6type
;
345 case ARG_RANDOM_LONG
:
346 return (unsigned long) rand64();
349 return get_random_fd();
352 return (unsigned long) get_len();
355 return handle_arg_address(childno
, call
, argnum
);
357 case ARG_NON_NULL_ADDRESS
:
358 return (unsigned long) get_non_null_address();
361 return (unsigned long) get_map();
364 return (unsigned long) get_pid();
367 return handle_arg_range(call
, argnum
);
369 case ARG_OP
: /* Like ARG_LIST, but just a single value. */
370 return handle_arg_op(call
, argnum
);
373 return handle_arg_list(call
, argnum
);
376 return handle_arg_randpage();
379 return (unsigned long) get_cpu();
382 return (unsigned long) generate_pathname();
385 return handle_arg_iovec(childno
, call
, argnum
);
388 case ARG_SOCKADDRLEN
:
389 return handle_arg_len_already_set(childno
, argnum
);
392 return handle_arg_sockaddr(childno
, call
, argnum
);
395 return handle_arg_mode_t();
398 BUG("unreachable!\n");
401 void generic_sanitise(int childno
)
403 struct syscallentry
*entry
;
404 unsigned int call
= shm
->syscall
[childno
].nr
;
406 entry
= syscalls
[call
].entry
;
408 if (entry
->arg1type
!= 0)
409 shm
->syscall
[childno
].a1
= fill_arg(childno
, call
, 1);
410 if (entry
->arg2type
!= 0)
411 shm
->syscall
[childno
].a2
= fill_arg(childno
, call
, 2);
412 if (entry
->arg3type
!= 0)
413 shm
->syscall
[childno
].a3
= fill_arg(childno
, call
, 3);
414 if (entry
->arg4type
!= 0)
415 shm
->syscall
[childno
].a4
= fill_arg(childno
, call
, 4);
416 if (entry
->arg5type
!= 0)
417 shm
->syscall
[childno
].a5
= fill_arg(childno
, call
, 5);
418 if (entry
->arg6type
!= 0)
419 shm
->syscall
[childno
].a6
= fill_arg(childno
, call
, 6);