6 #include "trinity.h" // page_size
18 static unsigned int get_cpu(void)
25 case 1: return rand() % 4095;
26 case 2: return rand() % 15;
29 return rand() % num_online_cpus
;
34 static unsigned long handle_arg_address(int childno
, int call
, int argnum
)
36 unsigned long addr
= 0;
39 return (unsigned long) get_address();
41 /* Half the time, we look to see if earlier args were also ARG_ADDRESS,
42 * and munge that instead of returning a new one from get_address() */
44 addr
= find_previous_arg_address(argnum
, call
, childno
);
47 case 0: break; /* return unmodified */
50 case 2: addr
+= sizeof(int);
52 case 3: addr
+= sizeof(long);
59 static unsigned long handle_arg_range(unsigned int call
, unsigned int argnum
)
61 struct syscallentry
*entry
;
63 unsigned long low
= 0, high
= 0;
65 entry
= syscalls
[call
].entry
;
68 case 1: low
= entry
->low1range
;
69 high
= entry
->hi1range
;
71 case 2: low
= entry
->low2range
;
72 high
= entry
->hi2range
;
74 case 3: low
= entry
->low3range
;
75 high
= entry
->hi3range
;
77 case 4: low
= entry
->low4range
;
78 high
= entry
->hi4range
;
80 case 5: low
= entry
->low5range
;
81 high
= entry
->hi5range
;
83 case 6: low
= entry
->low6range
;
84 high
= entry
->hi6range
;
89 outputerr("%s forgets to set hirange!\n", entry
->name
);
90 BUG("Fix syscall definition!\n");
94 i
= (unsigned long) rand64() % high
;
102 static unsigned long handle_arg_op(unsigned long call
, unsigned long argnum
)
104 struct syscallentry
*entry
;
105 const unsigned int *values
= NULL
;
106 unsigned int num
= 0;
107 unsigned long mask
= 0;
109 entry
= syscalls
[call
].entry
;
112 case 1: num
= entry
->arg1list
.num
;
113 values
= entry
->arg1list
.values
;
115 case 2: num
= entry
->arg2list
.num
;
116 values
= entry
->arg2list
.values
;
118 case 3: num
= entry
->arg3list
.num
;
119 values
= entry
->arg3list
.values
;
121 case 4: num
= entry
->arg4list
.num
;
122 values
= entry
->arg4list
.values
;
124 case 5: num
= entry
->arg5list
.num
;
125 values
= entry
->arg5list
.values
;
127 case 6: num
= entry
->arg6list
.num
;
128 values
= entry
->arg6list
.values
;
133 BUG("ARG_OP with 0 args. What?\n");
136 BUG("ARG_OP with no values.\n");
138 mask
|= values
[rand() % num
];
142 static unsigned long handle_arg_list(unsigned long call
, unsigned long argnum
)
144 struct syscallentry
*entry
;
146 unsigned long mask
= 0;
148 unsigned int num
= 0;
149 const unsigned int *values
= NULL
;
151 entry
= syscalls
[call
].entry
;
154 case 1: num
= entry
->arg1list
.num
;
155 values
= entry
->arg1list
.values
;
157 case 2: num
= entry
->arg2list
.num
;
158 values
= entry
->arg2list
.values
;
160 case 3: num
= entry
->arg3list
.num
;
161 values
= entry
->arg3list
.values
;
163 case 4: num
= entry
->arg4list
.num
;
164 values
= entry
->arg4list
.values
;
166 case 5: num
= entry
->arg5list
.num
;
167 values
= entry
->arg5list
.values
;
169 case 6: num
= entry
->arg6list
.num
;
170 values
= entry
->arg6list
.values
;
175 BUG("ARG_LIST with 0 args. What?\n");
178 BUG("ARG_LIST with no values.\n");
180 bits
= rand() % (num
+ 1); /* num of bits to OR */
181 for (i
= 0; i
< bits
; i
++)
182 mask
|= values
[rand() % num
];
186 static unsigned long handle_arg_randpage(void)
188 /* Because we pass this to something that might overwrite it,
189 * and we want page_allocs to remain unmodified, we copy it to page rand instead.
192 memcpy(page_rand
, page_allocs
, page_size
);
194 return (unsigned long) page_rand
;
197 static unsigned long handle_arg_iovec(int childno
, unsigned long call
, unsigned long argnum
)
199 struct syscallentry
*entry
;
202 entry
= syscalls
[call
].entry
;
204 i
= (rand() % 5) + 1;
207 case 1: if (entry
->arg2type
== ARG_IOVECLEN
)
208 shm
->a2
[childno
] = i
;
210 case 2: if (entry
->arg3type
== ARG_IOVECLEN
)
211 shm
->a3
[childno
] = i
;
213 case 3: if (entry
->arg4type
== ARG_IOVECLEN
)
214 shm
->a4
[childno
] = i
;
216 case 4: if (entry
->arg5type
== ARG_IOVECLEN
)
217 shm
->a5
[childno
] = i
;
219 case 5: if (entry
->arg6type
== ARG_IOVECLEN
)
220 shm
->a6
[childno
] = i
;
223 return (unsigned long) alloc_iovec(i
);
226 static unsigned long handle_arg_len_already_set(int childno
, unsigned long argnum
)
231 * We already set the len in the ARG_IOVEC/ARG_SOCKADDR case
232 * So here we just return what we had set there.
235 case 1: r
= shm
->a1
[childno
]; break;
236 case 2: r
= shm
->a2
[childno
]; break;
237 case 3: r
= shm
->a3
[childno
]; break;
238 case 4: r
= shm
->a4
[childno
]; break;
239 case 5: r
= shm
->a5
[childno
]; break;
240 case 6: r
= shm
->a6
[childno
]; break;
245 static unsigned long handle_arg_sockaddr(int childno
, unsigned long call
, unsigned long argnum
)
247 struct syscallentry
*entry
;
248 struct sockaddr
*sockaddr
= NULL
;
249 socklen_t sockaddrlen
= 0;
251 entry
= syscalls
[call
].entry
;
253 generate_sockaddr((struct sockaddr
**)&sockaddr
, &sockaddrlen
, PF_NOHINT
);
256 case 1: if (entry
->arg2type
== ARG_SOCKADDRLEN
)
257 shm
->a2
[childno
] = sockaddrlen
;
259 case 2: if (entry
->arg3type
== ARG_SOCKADDRLEN
)
260 shm
->a3
[childno
] = sockaddrlen
;
262 case 3: if (entry
->arg4type
== ARG_SOCKADDRLEN
)
263 shm
->a4
[childno
] = sockaddrlen
;
265 case 4: if (entry
->arg5type
== ARG_SOCKADDRLEN
)
266 shm
->a5
[childno
] = sockaddrlen
;
268 case 5: if (entry
->arg6type
== ARG_SOCKADDRLEN
)
269 shm
->a6
[childno
] = sockaddrlen
;
274 return (unsigned long) sockaddr
;
277 static unsigned long handle_arg_mode_t(void)
279 unsigned int i
, count
;
284 for (i
= 0; i
< count
; i
++) {
291 case 0: mode
|= S_IRUSR
; break;
292 case 1: mode
|= S_IWUSR
; break;
293 case 2: mode
|= S_IXUSR
; break;
294 case 3: mode
|= S_IRGRP
; break;
295 case 4: mode
|= S_IWGRP
; break;
296 case 5: mode
|= S_IXGRP
; break;
297 case 6: mode
|= S_IROTH
; break;
298 case 7: mode
|= S_IWOTH
; break;
299 case 8: mode
|= S_IXOTH
; break;
300 case 9: mode
|= S_ISUID
; break;
301 case 10: mode
|= S_ISGID
; break;
302 case 11: mode
|= S_ISVTX
; break;
309 static unsigned long fill_arg(int childno
, int call
, unsigned int argnum
)
311 struct syscallentry
*entry
;
312 enum argtype argtype
= 0;
314 entry
= syscalls
[call
].entry
;
316 if (argnum
> entry
->num_args
)
320 case 1: argtype
= entry
->arg1type
;
322 case 2: argtype
= entry
->arg2type
;
324 case 3: argtype
= entry
->arg3type
;
326 case 4: argtype
= entry
->arg4type
;
328 case 5: argtype
= entry
->arg5type
;
330 case 6: argtype
= entry
->arg6type
;
336 case ARG_RANDOM_LONG
:
337 return (unsigned long) rand64();
340 return get_random_fd();
343 return (unsigned long) get_len();
346 return handle_arg_address(childno
, call
, argnum
);
348 case ARG_NON_NULL_ADDRESS
:
349 return (unsigned long) get_non_null_address();
352 return (unsigned long) get_map();
355 return (unsigned long) get_pid();
358 return handle_arg_range(call
, argnum
);
360 case ARG_OP
: /* Like ARG_LIST, but just a single value. */
361 return handle_arg_op(call
, argnum
);
364 return handle_arg_list(call
, argnum
);
367 return handle_arg_randpage();
370 return (unsigned long) get_cpu();
373 return (unsigned long) generate_pathname();
376 return handle_arg_iovec(childno
, call
, argnum
);
379 case ARG_SOCKADDRLEN
:
380 return handle_arg_len_already_set(childno
, argnum
);
383 return handle_arg_sockaddr(childno
, call
, argnum
);
386 return handle_arg_mode_t();
389 BUG("unreachable!\n");
390 return 0x5a5a5a5a; /* Should never happen */
393 void generic_sanitise(int childno
)
395 struct syscallentry
*entry
;
396 unsigned int call
= shm
->syscallno
[childno
];
398 entry
= syscalls
[call
].entry
;
400 if (entry
->arg1type
!= 0)
401 shm
->a1
[childno
] = fill_arg(childno
, call
, 1);
402 if (entry
->arg2type
!= 0)
403 shm
->a2
[childno
] = fill_arg(childno
, call
, 2);
404 if (entry
->arg3type
!= 0)
405 shm
->a3
[childno
] = fill_arg(childno
, call
, 3);
406 if (entry
->arg4type
!= 0)
407 shm
->a4
[childno
] = fill_arg(childno
, call
, 4);
408 if (entry
->arg5type
!= 0)
409 shm
->a5
[childno
] = fill_arg(childno
, call
, 5);
410 if (entry
->arg6type
!= 0)
411 shm
->a6
[childno
] = fill_arg(childno
, call
, 6);