zephyr.diff

diff --git a/Kconfig.zephyr b/Kconfig.zephyr
index 2d8031260ce..7e1a5f0ffd4 100644
--- a/Kconfig.zephyr
+++ b/Kconfig.zephyr
@@ -477,6 +477,12 @@ config NATIVE_APPLICATION
 	  resources and libraries provided by the host. This option is deprecated
 	  and will be removed in Zephyr v4.3
 
+config SHMEM_COVERAGE
+	bool "Record coverage to shared memory"
+	default n
+	help
+		Introduces helper code for recording coverage to shared memory
+
 config NATIVE_LIBRARY
 	bool
 	select NATIVE_BUILD
diff --git a/arch/posix/core/CMakeLists.txt b/arch/posix/core/CMakeLists.txt
index 8c46147bc0a..27f56fbb176 100644
--- a/arch/posix/core/CMakeLists.txt
+++ b/arch/posix/core/CMakeLists.txt
@@ -31,6 +31,12 @@ if(CONFIG_NATIVE_APPLICATION)
 		${ZEPHYR_BASE}/scripts/native_simulator/common/src/nsi_host_trampolines.c
 	)
 
+	if(CONFIG_SHMEM_COVERAGE)
+		zephyr_library_sources(
+			${ZEPHYR_BASE}/scripts/native_simulator/common/src/coverage.c
+		)
+	endif()
+
 	zephyr_library_compile_definitions(_POSIX_C_SOURCE=200809L _XOPEN_SOURCE=600 _XOPEN_SOURCE_EXTENDED)
 else()
 	zephyr_library_sources(
diff --git a/drivers/ethernet/CMakeLists.txt b/drivers/ethernet/CMakeLists.txt
index 65ce8a45332..b98650d2fd5 100644
--- a/drivers/ethernet/CMakeLists.txt
+++ b/drivers/ethernet/CMakeLists.txt
@@ -60,15 +60,24 @@ zephyr_library_sources_ifdef(CONFIG_ETH_NUMAKER		eth_numaker.c)
 
 if(CONFIG_ETH_NATIVE_POSIX)
   if (CONFIG_NATIVE_APPLICATION)
-    set(native_posix_source_files eth_native_posix.c eth_native_posix_adapt.c)
+    if(CONFIG_ETH_NATIVE_POSIX_TAP)
+      set(native_posix_source_files eth_native_posix.c eth_native_posix_adapt.c)
+    elseif(CONFIG_ETH_NATIVE_POSIX_SHMEM)
+      set(native_posix_source_files eth_shmem.c eth_shmem_adapt.c)
+    endif()
     set_source_files_properties(${native_posix_source_files}
       PROPERTIES COMPILE_DEFINITIONS
       "NO_POSIX_CHEATS;_BSD_SOURCE;_DEFAULT_SOURCE"
     )
     zephyr_library_sources(${native_posix_source_files})
   else()
-    zephyr_library_sources(eth_native_posix.c)
-    target_sources(native_simulator INTERFACE eth_native_posix_adapt.c)
+    if(CONFIG_ETH_NATIVE_POSIX_TAP)
+      zephyr_library_sources(eth_native_posix.c)
+      target_sources(native_simulator INTERFACE eth_native_posix_adapt.c)
+    elseif(CONFIG_ETH_NATIVE_POSIX_SHMEM)
+      zephyr_library_sources(eth_shmem.c)
+      target_sources(native_simulator INTERFACE eth_shmem_adapt.c)
+    endif()
   endif()
 endif()
 
diff --git a/drivers/ethernet/Kconfig.native_posix b/drivers/ethernet/Kconfig.native_posix
index d4c065fbdde..6aeb1f9cc51 100644
--- a/drivers/ethernet/Kconfig.native_posix
+++ b/drivers/ethernet/Kconfig.native_posix
@@ -10,6 +10,24 @@ menuconfig ETH_NATIVE_POSIX
 	  Enable native posix ethernet driver. Note, this driver is run inside
 	  a process in your host system.
 
+choice ETH_NATIVE_POSIX_DRIVER_TYPE
+	prompt "Native posix ethernet driver type"
+	depends on ETH_NATIVE_POSIX
+	default ETH_NATIVE_POSIX_TAP
+
+config ETH_NATIVE_POSIX_TAP
+	bool "TAP device driver"
+	help
+	  Use TAP device for ethernet communication
+
+config ETH_NATIVE_POSIX_SHMEM
+	bool "Shared memory ethernet driver"
+	help
+	  Enable shared memory based ethernet driver. This is useful for
+	  fuzzing and testing where direct network access is not needed.
+
+endchoice
+
 if ETH_NATIVE_POSIX
 
 config ETH_NATIVE_POSIX_INTERFACE_COUNT
@@ -36,6 +54,7 @@ config ETH_NATIVE_POSIX_DRV_NAME
 config ETH_NATIVE_POSIX_DEV_NAME
 	string "Host ethernet TUN/TAP device name"
 	default "/dev/net/tun"
+	depends on ETH_NATIVE_POSIX_TAP
 	help
 	  This option sets the TUN/TAP device name in your host system.
 
@@ -83,4 +102,12 @@ config ETH_NATIVE_POSIX_RX_TIMEOUT
 	  Specify how long the thread sleeps between these checks if no new data
 	  available.
 
+config ETH_NATIVE_POSIX_SHMEM_RX_TIMEOUT
+	int "RX polling timeout"
+	default 10
+	depends on ETH_NATIVE_POSIX_SHMEM
+	help
+	  This option defines how long to wait for the driver to receive
+	  data from shared memory interface.
+
 endif # ETH_NATIVE_POSIX
diff --git a/drivers/ethernet/eth_shmem.c b/drivers/ethernet/eth_shmem.c
new file mode 100644
index 00000000000..def3c2dfd0f
--- /dev/null
+++ b/drivers/ethernet/eth_shmem.c
@@ -0,0 +1,235 @@
+/**
+ * @file
+ * Ethernet driver using shared memory for communication
+ */
+
+#define LOG_MODULE_NAME eth_shmem
+#define LOG_LEVEL CONFIG_ETHERNET_LOG_LEVEL
+
+#include <zephyr/logging/log.h>
+LOG_MODULE_REGISTER(LOG_MODULE_NAME);
+
+#include <zephyr/kernel.h>
+#include <zephyr/net/net_pkt.h>
+#include <zephyr/net/net_if.h>
+#include <zephyr/net/ethernet.h>
+#include <ethernet/eth_stats.h>
+#include <posix_native_task.h>
+#include <cmdline.h>
+
+static const char *if_name_cmd_opt;
+
+#include "coverage.h"
+#include "eth_shmem_priv.h"
+
+#define NET_BUF_TIMEOUT K_MSEC(100)
+
+struct eth_context {
+    uint8_t mac_addr[6];
+    struct net_linkaddr ll_addr;
+    struct net_if *iface;
+    const char *if_name;
+    k_tid_t rx_thread;
+    struct k_thread rx_thread_data;
+    struct z_thread_stack_element *rx_stack;
+    size_t rx_stack_size;
+    bool init_done;
+    uint8_t recv_buffer[NET_ETH_MTU + sizeof(struct net_eth_hdr)];
+};
+
+static int eth_send(const struct device *dev, struct net_pkt *pkt)
+{
+    struct eth_context *ctx = dev->data;
+    int count = net_pkt_get_len(pkt);
+    void *buf = 0;
+
+    if (!net_if_is_up(ctx->iface)) {
+        MY_LOG("eth_send: iface is down\n");
+        return -ENETDOWN;
+    }
+
+    buf = prepare_send_buf(count);
+    while (buf == 0) {
+        k_sleep(K_MSEC(1));
+        buf = prepare_send_buf(count);
+    }
+
+    int ret = net_pkt_read(pkt, buf, count);
+    if (ret) {
+        MY_LOG("eth_send: net_pkt_read failed\n");
+        return ret;
+    }
+
+    send_buf(count);
+    return 0;
+}
+
+static void eth_rx(void *p1, void *p2, void *p3)
+{
+    ARG_UNUSED(p2);
+    ARG_UNUSED(p3);
+
+    struct eth_context *ctx = p1;
+
+    struct net_if *iface = ctx->iface;
+    struct net_pkt *pkt = NULL;
+    int count;
+
+    while (1) {
+        if (net_if_is_up(iface)) {
+            while (incoming_available()) {
+                MY_LOG("incoming_available: true\n");
+                count = read_incoming(ctx->recv_buffer, sizeof(ctx->recv_buffer));
+                if (count <= 0) {
+                    continue;
+                }
+
+                MY_LOG("Received packet of size %d: ", count);
+                for (int i = 0; i < count; i++) {
+                    MY_LOG("%02x ", ctx->recv_buffer[i]);
+                }
+                MY_LOG("\n");
+                if (ctx->recv_buffer[12] == 0x08 && ctx->recv_buffer[13] == 0x00) {
+                    // IP header starts at offset 14
+                    uint8_t ip_proto = ctx->recv_buffer[23];  // Protocol field in IP header
+                    if (ip_proto == 6) {  // TCP
+                        MY_LOG("TCP packet received, len %d\n", count);
+                        // Print TCP flags (offset 14 + 20 + 13 = 47)
+                        MY_LOG("TCP flags: 0x%02x\n", ctx->recv_buffer[47]);
+                    }
+                }
+
+                pkt = net_pkt_rx_alloc_with_buffer(iface, count, 
+                        AF_UNSPEC, 0, NET_BUF_TIMEOUT);
+                if (!pkt) {
+                    continue;
+                }
+
+                if (net_pkt_write(pkt, ctx->recv_buffer, count)) {
+                    net_pkt_unref(pkt);
+                    continue;
+                }
+
+                if (net_recv_data(iface, pkt) < 0) {
+                    net_pkt_unref(pkt);
+                }
+                k_yield();
+            }
+        } else {
+            MY_LOG("attempting to receive packet while iface is down\n");
+        }
+		k_sleep(K_MSEC(10));
+    }
+}
+
+static void eth_iface_init(struct net_if *iface)
+{
+    MY_LOG("initializing interface\n");
+    struct eth_context *ctx = net_if_get_device(iface)->data;
+    ctx->ll_addr.addr = ctx->mac_addr;
+	ctx->ll_addr.len = sizeof(ctx->mac_addr);
+
+	struct net_linkaddr *ll_addr = &ctx->ll_addr;
+
+    ctx->iface = iface;
+
+    ethernet_init(iface);
+
+    if (ctx->init_done) {
+        return;
+    }
+
+    net_lldp_set_lldpdu(iface);
+
+    ctx->init_done = true;
+    
+
+    BUILD_ASSERT(CONFIG_ETH_NATIVE_POSIX_INTERFACE_COUNT == 1,
+		     "Cannot have static MAC if interface count > 1");
+
+	if (CONFIG_ETH_NATIVE_POSIX_MAC_ADDR[0] != 0) {
+		if (net_bytes_from_str(ctx->mac_addr, sizeof(ctx->mac_addr),
+				       CONFIG_ETH_NATIVE_POSIX_MAC_ADDR) < 0) {
+			LOG_ERR("Invalid MAC address %s",
+				CONFIG_ETH_NATIVE_POSIX_MAC_ADDR);
+		}
+	}
+
+    if (CONFIG_ETH_NATIVE_POSIX_INTERFACE_COUNT == 1) {
+		ctx->if_name = CONFIG_ETH_NATIVE_POSIX_DRV_NAME;
+	}
+
+    if (if_name_cmd_opt != NULL) {
+		ctx->if_name = if_name_cmd_opt;
+	}
+
+
+    /* This must be done before any packets can be received/sent */
+	net_if_set_link_addr(iface, ll_addr->addr, ll_addr->len,
+			     NET_LINK_ETHERNET);
+
+    init_shmem_eth_interface();
+    k_thread_create(&ctx->rx_thread_data, ctx->rx_stack,
+                    ctx->rx_stack_size,
+                    eth_rx, ctx, NULL, NULL,
+                    K_PRIO_COOP(14), 0, K_NO_WAIT);
+    MY_LOG("initialized interface\n");
+}
+
+K_KERNEL_STACK_DEFINE(rx_thread_stack, CONFIG_ARCH_POSIX_RECOMMENDED_STACK_SIZE);
+static struct k_thread rx_thread_data;
+
+static struct eth_context eth_context_data = {
+    .if_name = CONFIG_ETH_NATIVE_POSIX_DRV_NAME,
+    .rx_thread = &rx_thread_data,			     
+    .rx_stack = rx_thread_stack,			     
+    .rx_stack_size = K_KERNEL_STACK_SIZEOF(rx_thread_stack), 
+};
+
+static enum ethernet_hw_caps eth_get_capabilities(const struct device *dev)
+{
+	ARG_UNUSED(dev);
+    MY_LOG("eth_get_capabilities called\n");
+	return ETHERNET_TXTIME;
+}
+
+static int eth_set_config(const struct device *dev,
+			 enum ethernet_config_type type,
+			 const struct ethernet_config *config)
+{
+	ARG_UNUSED(dev);
+	ARG_UNUSED(type); 
+	ARG_UNUSED(config);
+
+    MY_LOG("eth_set_config called\n");
+
+	return 0;
+}
+
+static const struct ethernet_api eth_if_api = {
+	.iface_api.init = eth_iface_init,
+	.get_capabilities = eth_get_capabilities,
+	.set_config = eth_set_config,
+	.send = eth_send,
+};
+
+ETH_NET_DEVICE_INIT(eth_shmem, "ETH_SHMEM", NULL, NULL, &eth_context_data, NULL, CONFIG_KERNEL_INIT_PRIORITY_DEFAULT, &eth_if_api, NET_ETH_MTU)
+
+static void add_native_posix_options(void)
+{
+	static struct args_struct_t eth_native_posix_options[] = {
+		{
+			.is_mandatory = false,
+			.option = "eth-if",
+			.name = "name",
+			.type = 's',
+			.dest = (void *)&if_name_cmd_opt,
+			.descript = "Name of the eth interface to use",
+		},
+		ARG_TABLE_ENDMARKER,
+	};
+
+	native_add_command_line_opts(eth_native_posix_options);
+}
+
+NATIVE_TASK(add_native_posix_options, PRE_BOOT_1, 10);
diff --git a/drivers/ethernet/eth_shmem_adapt.c b/drivers/ethernet/eth_shmem_adapt.c
new file mode 100644
index 00000000000..085f27d340c
--- /dev/null
+++ b/drivers/ethernet/eth_shmem_adapt.c
@@ -0,0 +1,140 @@
+/**
+ * @file
+ * Shared memory adaptation layer for Ethernet driver
+ */
+
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <stdarg.h>
+#include <errno.h>
+#include <string.h>
+#include <stdbool.h>
+#include <unistd.h>
+#include <fcntl.h>
+#include <sys/ioctl.h>
+#include <sys/socket.h>
+#include <sys/select.h>
+#include <net/if.h>
+#include <time.h>
+#include <inttypes.h>
+#include <nsi_tracing.h>
+#include <stddef.h>
+#include <stdint.h>
+#include <sys/mman.h>
+#include <sys/stat.h>
+#include <dlfcn.h>
+
+#include "coverage.h" // for MY_LOG and custom_panic
+
+static int net_shmem_fd = 0;
+static bool net_shmem_init = false;
+static char* net_shmem_name = 0;
+static size_t net_shmem_size = 0;
+static int32_t* net_shmem_ptr_rx = 0;
+static int32_t* net_shmem_ptr_tx = 0;
+
+void init_shmem_eth_interface(void) {
+	if (!net_shmem_init) {
+		MY_LOG("initializing shmem interface ");
+		net_shmem_name = getenv("SHMEM_ETH_INTERFACE_NAME");
+		if (net_shmem_name == 0) custom_panic("\nSHMEM_ETH_INTERFACE_NAME, the path to the mmap based shmem, is not set in the env");
+		MY_LOG("with name %s ", net_shmem_name);
+
+		char* net_shmem_size_str = getenv("SHMEM_ETH_INTERFACE_SIZE");
+		if (net_shmem_size_str == 0) custom_panic("\nSHMEM_ETH_INTERFACE_SIZE, the size of the mmap based shmem, is not set in the env");
+		MY_LOG("and size: %s\n", net_shmem_size_str);
+
+		net_shmem_size = atoi(net_shmem_size_str);
+
+		// Open shared memory object
+		net_shmem_fd = shm_open(net_shmem_name, O_CREAT | O_RDWR, 0666);
+		if (net_shmem_fd == -1) custom_panic("shm_open broke");
+
+		// Configure the size of the shared memory object
+		ftruncate(net_shmem_fd, net_shmem_size);
+
+		// Memory map the shared memory object
+		char* raw_ptr = mmap(0, net_shmem_size, PROT_READ | PROT_WRITE, MAP_SHARED, net_shmem_fd, 0);
+		if (raw_ptr == MAP_FAILED) custom_panic("mmap broke");
+		net_shmem_ptr_rx = (int32_t*) raw_ptr;
+		net_shmem_ptr_tx = (int32_t*) (raw_ptr + net_shmem_size / 2);
+        MY_LOG("initialized shmem interface\n");
+		net_shmem_init = true;
+	} else {
+		printf("Warning: attempting to initialize shmem interface again\n");
+	}
+}
+
+void* prepare_send_buf(size_t size) {
+	if (!net_shmem_init)
+		custom_panic("Not initialized");
+
+	if (size > (net_shmem_size / 2 - 4)) // size needs to fit in half the shmem minus the length of the length field
+		custom_panic("Attempting to send a frame too large");
+
+
+	if ((*net_shmem_ptr_tx) >= 0) { // shmem[0] >= 0 means there is still a packet in the buffer
+		MY_LOG("buffer not ready for packet of size %d, previous packet of size %d\n", size, *net_shmem_ptr_tx);
+		return 0;
+	}
+	
+	return net_shmem_ptr_tx + 1;
+}
+
+void send_buf(size_t size) {
+	MY_LOG("sending packet of size %d\n", size);
+	*net_shmem_ptr_tx = size; // set as sent
+}
+
+bool is_setup(void) {
+	return net_shmem_init;
+}
+
+int read_incoming(void* buf, unsigned long size) {
+	if (!net_shmem_init)
+		custom_panic("Not initialized");
+	
+	int32_t incoming_size = *net_shmem_ptr_rx;
+
+	if (incoming_size < 0) // if no package was sent in this direction
+		return -1;
+		
+	// if (read_u32_from_random() < (1 << 20)) {
+	// 	fprintf(stderr, "Faked null pointer deref in zephyr\n");
+	// 	int* ptr = 0;
+	// 	*ptr = 0;
+	// }
+
+	if (incoming_size > size) // assuming the fuzzer checks sizes, this should be enough checks
+		custom_panic("Incoming too large");
+	
+	void* res = memcpy(buf, (net_shmem_ptr_rx + 1), incoming_size);
+	if (res != buf)
+		custom_panic("Could not copy received data");
+	
+	*net_shmem_ptr_rx = -1; // status = ready
+	MY_LOG("received packet of size %d\n", incoming_size);
+	
+	return incoming_size;
+}
+
+bool incoming_available(void) {
+	if (!net_shmem_init)
+		custom_panic("Not initialized");
+	return (*net_shmem_ptr_rx) >= 0;
+}
+
+uint32_t read_u32_from_random(void) {
+    int fd = open("/dev/random", O_RDONLY);
+    if (fd < 0) custom_panic("Could not open random device");
+
+    uint32_t value;
+    if (read(fd, &value, sizeof(value)) != sizeof(value)) {
+        close(fd);
+        custom_panic("Could not read random value");
+    }
+
+    close(fd);
+    return value;
+}
diff --git a/drivers/ethernet/eth_shmem_priv.h b/drivers/ethernet/eth_shmem_priv.h
new file mode 100644
index 00000000000..89d55b57a04
--- /dev/null
+++ b/drivers/ethernet/eth_shmem_priv.h
@@ -0,0 +1,15 @@
+#ifndef ETH_SHMEM_PRIV_H
+#define ETH_SHMEM_PRIV_H
+
+#include <stdbool.h>
+#include <stddef.h>
+
+bool is_setup(void);
+void send_buf(size_t size);
+void* prepare_send_buf(size_t size);
+void init_shmem_eth_interface(void);
+int read_incoming(void* buf, unsigned long size);
+bool incoming_available(void);
+
+
+#endif /* ETH_SHMEM_PRIV_H */
diff --git a/samples/net/sockets/echo/prj.conf b/samples/net/sockets/echo/prj.conf
index 33729784d8e..028d82dbc8e 100644
--- a/samples/net/sockets/echo/prj.conf
+++ b/samples/net/sockets/echo/prj.conf
@@ -12,6 +12,9 @@ CONFIG_NET_IPV4_MAPPING_TO_IPV6=y
 
 # Network driver config
 CONFIG_TEST_RANDOM_GENERATOR=y
+CONFIG_ETH_NATIVE_POSIX=y
+# CONFIG_ETH_NATIVE_POSIX_TAP=y
+CONFIG_ETH_NATIVE_POSIX_SHMEM=y
 
 # Network address config
 CONFIG_NET_CONFIG_SETTINGS=y
@@ -21,3 +24,12 @@ CONFIG_NET_CONFIG_MY_IPV4_ADDR="192.0.2.1"
 CONFIG_NET_CONFIG_PEER_IPV4_ADDR="192.0.2.2"
 CONFIG_NET_CONFIG_MY_IPV6_ADDR="2001:db8::1"
 CONFIG_NET_CONFIG_PEER_IPV6_ADDR="2001:db8::2"
+
+# MAC address config
+CONFIG_ETH_NATIVE_POSIX_RANDOM_MAC=n
+CONFIG_ETH_NATIVE_POSIX_MAC_ADDR="02:00:5e:00:53:31"
+
+# Coverage config
+CONFIG_SHMEM_COVERAGE=y
+
+CONFIG_ASAN=y
\ No newline at end of file
diff --git a/samples/net/sockets/echo/src/socket_echo.c b/samples/net/sockets/echo/src/socket_echo.c
index c8aad2bb068..5257815a153 100644
--- a/samples/net/sockets/echo/src/socket_echo.c
+++ b/samples/net/sockets/echo/src/socket_echo.c
@@ -19,6 +19,7 @@
 
 #include <zephyr/net/socket.h>
 #include <zephyr/kernel.h>
+#include "coverage.h"
 
 #endif
 
@@ -70,6 +71,8 @@ int main(void)
 
 	printf("Single-threaded TCP echo server waits for a connection on "
 	       "port %d...\n", BIND_PORT);
+	k_sleep(K_MSEC(200)); // wait until all setup code is done, to ensure consistent coverage
+	reset_coverage();
 
 	while (1) {
 		struct sockaddr_in6 client_addr;
@@ -99,6 +102,16 @@ int main(void)
 				break;
 			}
 
+			printf("Received TCP payload (%d bytes): ", len);
+			for (int i = 0; i < len; i++) {
+				printf("%c", buf[i]);  // Print as ASCII
+			}
+			printf(" with bytes: ");
+			for (int i = 0; i < len; i++) {
+				printf("%02x ", (unsigned char) buf[i]);  // Print as hex
+			}
+			printf("\n");
+
 			p = buf;
 			do {
 				out_len = send(client, p, len, 0);
diff --git a/scripts/native_simulator/common/src/coverage.c b/scripts/native_simulator/common/src/coverage.c
new file mode 100644
index 00000000000..61989947260
--- /dev/null
+++ b/scripts/native_simulator/common/src/coverage.c
@@ -0,0 +1,120 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <stdint.h>
+#include <fcntl.h>
+#include <sys/mman.h>
+#include <sys/stat.h>
+#include <unistd.h>
+#include <stdbool.h>
+#include <stdarg.h>
+
+#include "coverage.h"
+
+void custom_panic(const char* format, ...) {
+	va_list args;
+	va_start(args, format);
+	fprintf(stderr, "PANIC in zephyr: ");
+	vfprintf(stderr, format, args);
+	va_end(args);
+	int* ptr = 0;
+	*ptr = 0;
+	exit(1);
+}
+
+static int cov_shmem_fd = 0;
+static bool cov_shmem_init = false;
+static char *cov_shmem_name = 0;
+static size_t cov_shmem_size = 0;
+static uint32_t *cov_shmem_ptr = 0;
+static uint32_t *guard_stop = 0;
+static uint32_t *guard_start = 0;
+
+void init_coverage(void) {
+	if (!cov_shmem_init) {
+		MY_LOG("initializing coverage ");
+		cov_shmem_name = getenv("SHMEM_COVERAGE_NAME");
+		if (cov_shmem_name == 0) custom_panic("SHMEM_COVERAGE_NAME, the path to the mmap based shmem, is not set in the env");
+		MY_LOG("with shmem name %s ", cov_shmem_name);
+
+		char* cov_shmem_size_str = getenv("SHMEM_COVERAGE_SIZE");
+		if (cov_shmem_size_str == 0) custom_panic("SHMEM_COVERAGE_SIZE, the size of the mmap based shmem, is not set in the env");
+		MY_LOG("of size: %s\n", cov_shmem_size_str);
+
+		cov_shmem_size = atoi(cov_shmem_size_str);
+		if (guard_stop == 0) custom_panic("Coverage guards not initialized when initing coverage shmem");
+		uint32_t required_size = (guard_stop - guard_start) * 4;
+		if (cov_shmem_size != required_size) {
+			custom_panic("Received shmem of size %d, needed shmem of size %d\n", cov_shmem_size, required_size);
+		}
+
+		// Open shared memory object
+		cov_shmem_fd = shm_open(cov_shmem_name, O_CREAT | O_RDWR, 0666);
+		if (cov_shmem_fd == -1) custom_panic("shm_open broke");
+
+		// Configure the size of the shared memory object
+		ftruncate(cov_shmem_fd, cov_shmem_size);
+
+		// Memory map the shared memory object
+		cov_shmem_ptr = mmap(0, cov_shmem_size, PROT_READ | PROT_WRITE, MAP_SHARED, cov_shmem_fd, 0);
+		if (cov_shmem_ptr == MAP_FAILED) custom_panic("mmap broke");
+        cov_shmem_init = true;
+	} else {
+		printf("Warning: Calling init_coverage again\n");
+	}
+}
+
+void reset_coverage(void) {
+	if (!cov_shmem_init)
+		custom_panic("attempting to reset non-initialized coverage shmem");
+	memset(cov_shmem_ptr, 0, cov_shmem_size);
+	MY_LOG("reset coverage\n");
+}
+
+
+void __sanitizer_cov_trace_pc_guard_init(uint32_t *start, uint32_t *stop)
+{
+  if (start == stop)
+  {
+    MY_LOG("Skipping initialization\n");
+    return;
+  };
+
+
+  MY_LOG("Coverage initialization\n");
+  guard_start = start;
+  guard_stop = stop;
+
+  memset(guard_start, 0, guard_stop - guard_start);
+
+  init_coverage();
+
+  MY_LOG("Done with initialization\n");
+}
+
+#if defined(COVERAGE_LOG_TO_FILE)
+static int fd = 0;
+#endif
+
+void __sanitizer_cov_trace_pc_guard(uint32_t *guard)
+{
+#if defined(COVERAGE_LOG_TO_FILE)
+	if (!fd) {
+		fd = open("./sanitizer_cov.txt", O_WRONLY | O_CREAT | O_APPEND, 0644);
+		if (fd == -1) {
+			custom_panic("Failed to open sanitizer_cov.txt file\n");
+		}
+	}
+	
+	void *caller_address = __builtin_return_address(0);
+	char buf[128];
+	int len = snprintf(buf, sizeof(buf), "%d: %p\n", (int)(guard - guard_start), caller_address);
+	if (len > 0) {
+		write(fd, buf, len);
+	}
+#endif
+
+	if (!cov_shmem_init) return; // ignore coverage before initialization
+	
+	*(guard - guard_start + cov_shmem_ptr) = 1;
+}
diff --git a/scripts/native_simulator/common/src/include/coverage.h b/scripts/native_simulator/common/src/include/coverage.h
new file mode 100644
index 00000000000..8e82a11b9c4
--- /dev/null
+++ b/scripts/native_simulator/common/src/include/coverage.h
@@ -0,0 +1,14 @@
+#ifndef COVERAGE_H
+#define COVERAGE_H  
+
+// #define COVERAGE_LOG_TO_FILE 1
+
+#define MY_LOG(...)
+// #define MY_LOG(...) printf(__VA_ARGS__);
+
+void custom_panic(const char* format, ...);
+
+void init_coverage(void);
+void reset_coverage(void);
+
+#endif /* COVERAGE_H */