1//===- FuzzerUtilFuchsia.cpp - Misc utils for Fuchsia. --------------------===//
2//
3//                     The LLVM Compiler Infrastructure
4//
5// This file is distributed under the University of Illinois Open Source
6// License. See LICENSE.TXT for details.
7//
8//===----------------------------------------------------------------------===//
9// Misc utils implementation using Fuchsia/Zircon APIs.
10//===----------------------------------------------------------------------===//
11#include "FuzzerDefs.h"
12
13#if LIBFUZZER_FUCHSIA
14
15#include "FuzzerInternal.h"
16#include "FuzzerUtil.h"
17#include <cerrno>
18#include <cinttypes>
19#include <cstdint>
20#include <fcntl.h>
21#include <lib/fdio/spawn.h>
22#include <string>
23#include <sys/select.h>
24#include <thread>
25#include <unistd.h>
26#include <zircon/errors.h>
27#include <zircon/process.h>
28#include <zircon/sanitizer.h>
29#include <zircon/status.h>
30#include <zircon/syscalls.h>
31#include <zircon/syscalls/debug.h>
32#include <zircon/syscalls/exception.h>
33#include <zircon/syscalls/port.h>
34#include <zircon/types.h>
35
36namespace fuzzer {
37
38// Given that Fuchsia doesn't have the POSIX signals that libFuzzer was written
39// around, the general approach is to spin up dedicated threads to watch for
40// each requested condition (alarm, interrupt, crash).  Of these, the crash
41// handler is the most involved, as it requires resuming the crashed thread in
42// order to invoke the sanitizers to get the needed state.
43
44// Forward declaration of assembly trampoline needed to resume crashed threads.
45// This appears to have external linkage to  C++, which is why it's not in the
46// anonymous namespace.  The assembly definition inside MakeTrampoline()
47// actually defines the symbol with internal linkage only.
48void CrashTrampolineAsm() __asm__("CrashTrampolineAsm");
49
50namespace {
51
52// A magic value for the Zircon exception port, chosen to spell 'FUZZING'
53// when interpreted as a byte sequence on little-endian platforms.
54const uint64_t kFuzzingCrash = 0x474e495a5a5546;
55
56// Helper function to handle Zircon syscall failures.
57void ExitOnErr(zx_status_t Status, const char *Syscall) {
58  if (Status != ZX_OK) {
59    Printf("libFuzzer: %s failed: %s\n", Syscall,
60           _zx_status_get_string(Status));
61    exit(1);
62  }
63}
64
65void AlarmHandler(int Seconds) {
66  while (true) {
67    SleepSeconds(Seconds);
68    Fuzzer::StaticAlarmCallback();
69  }
70}
71
72void InterruptHandler() {
73  fd_set readfds;
74  // Ctrl-C sends ETX in Zircon.
75  do {
76    FD_ZERO(&readfds);
77    FD_SET(STDIN_FILENO, &readfds);
78    select(STDIN_FILENO + 1, &readfds, nullptr, nullptr, nullptr);
79  } while(!FD_ISSET(STDIN_FILENO, &readfds) || getchar() != 0x03);
80  Fuzzer::StaticInterruptCallback();
81}
82
83// For the crash handler, we need to call Fuzzer::StaticCrashSignalCallback
84// without POSIX signal handlers.  To achieve this, we use an assembly function
85// to add the necessary CFI unwinding information and a C function to bridge
86// from that back into C++.
87
88// FIXME: This works as a short-term solution, but this code really shouldn't be
89// architecture dependent. A better long term solution is to implement remote
90// unwinding and expose the necessary APIs through sanitizer_common and/or ASAN
91// to allow the exception handling thread to gather the crash state directly.
92//
93// Alternatively, Fuchsia may in future actually implement basic signal
94// handling for the machine trap signals.
95#if defined(__x86_64__)
96#define FOREACH_REGISTER(OP_REG, OP_NUM) \
97  OP_REG(rax)                            \
98  OP_REG(rbx)                            \
99  OP_REG(rcx)                            \
100  OP_REG(rdx)                            \
101  OP_REG(rsi)                            \
102  OP_REG(rdi)                            \
103  OP_REG(rbp)                            \
104  OP_REG(rsp)                            \
105  OP_REG(r8)                             \
106  OP_REG(r9)                             \
107  OP_REG(r10)                            \
108  OP_REG(r11)                            \
109  OP_REG(r12)                            \
110  OP_REG(r13)                            \
111  OP_REG(r14)                            \
112  OP_REG(r15)                            \
113  OP_REG(rip)
114
115#elif defined(__aarch64__)
116#define FOREACH_REGISTER(OP_REG, OP_NUM) \
117  OP_NUM(0)                              \
118  OP_NUM(1)                              \
119  OP_NUM(2)                              \
120  OP_NUM(3)                              \
121  OP_NUM(4)                              \
122  OP_NUM(5)                              \
123  OP_NUM(6)                              \
124  OP_NUM(7)                              \
125  OP_NUM(8)                              \
126  OP_NUM(9)                              \
127  OP_NUM(10)                             \
128  OP_NUM(11)                             \
129  OP_NUM(12)                             \
130  OP_NUM(13)                             \
131  OP_NUM(14)                             \
132  OP_NUM(15)                             \
133  OP_NUM(16)                             \
134  OP_NUM(17)                             \
135  OP_NUM(18)                             \
136  OP_NUM(19)                             \
137  OP_NUM(20)                             \
138  OP_NUM(21)                             \
139  OP_NUM(22)                             \
140  OP_NUM(23)                             \
141  OP_NUM(24)                             \
142  OP_NUM(25)                             \
143  OP_NUM(26)                             \
144  OP_NUM(27)                             \
145  OP_NUM(28)                             \
146  OP_NUM(29)                             \
147  OP_NUM(30)                             \
148  OP_REG(sp)
149
150#else
151#error "Unsupported architecture for fuzzing on Fuchsia"
152#endif
153
154// Produces a CFI directive for the named or numbered register.
155#define CFI_OFFSET_REG(reg) ".cfi_offset " #reg ", %c[" #reg "]\n"
156#define CFI_OFFSET_NUM(num) CFI_OFFSET_REG(r##num)
157
158// Produces an assembler input operand for the named or numbered register.
159#define ASM_OPERAND_REG(reg) \
160  [reg] "i"(offsetof(zx_thread_state_general_regs_t, reg)),
161#define ASM_OPERAND_NUM(num)                                 \
162  [r##num] "i"(offsetof(zx_thread_state_general_regs_t, r[num])),
163
164// Trampoline to bridge from the assembly below to the static C++ crash
165// callback.
166__attribute__((noreturn))
167static void StaticCrashHandler() {
168  Fuzzer::StaticCrashSignalCallback();
169  for (;;) {
170    _Exit(1);
171  }
172}
173
174// Creates the trampoline with the necessary CFI information to unwind through
175// to the crashing call stack.  The attribute is necessary because the function
176// is never called; it's just a container around the assembly to allow it to
177// use operands for compile-time computed constants.
178__attribute__((used))
179void MakeTrampoline() {
180  __asm__(".cfi_endproc\n"
181    ".pushsection .text.CrashTrampolineAsm\n"
182    ".type CrashTrampolineAsm,STT_FUNC\n"
183"CrashTrampolineAsm:\n"
184    ".cfi_startproc simple\n"
185    ".cfi_signal_frame\n"
186#if defined(__x86_64__)
187    ".cfi_return_column rip\n"
188    ".cfi_def_cfa rsp, 0\n"
189    FOREACH_REGISTER(CFI_OFFSET_REG, CFI_OFFSET_NUM)
190    "call %c[StaticCrashHandler]\n"
191    "ud2\n"
192#elif defined(__aarch64__)
193    ".cfi_return_column 33\n"
194    ".cfi_def_cfa sp, 0\n"
195    ".cfi_offset 33, %c[pc]\n"
196    FOREACH_REGISTER(CFI_OFFSET_REG, CFI_OFFSET_NUM)
197    "bl %[StaticCrashHandler]\n"
198#else
199#error "Unsupported architecture for fuzzing on Fuchsia"
200#endif
201    ".cfi_endproc\n"
202    ".size CrashTrampolineAsm, . - CrashTrampolineAsm\n"
203    ".popsection\n"
204    ".cfi_startproc\n"
205    : // No outputs
206    : FOREACH_REGISTER(ASM_OPERAND_REG, ASM_OPERAND_NUM)
207#if defined(__aarch64__)
208      ASM_OPERAND_REG(pc)
209#endif
210      [StaticCrashHandler] "i" (StaticCrashHandler));
211}
212
213void CrashHandler(zx_handle_t *Event) {
214  // This structure is used to ensure we close handles to objects we create in
215  // this handler.
216  struct ScopedHandle {
217    ~ScopedHandle() { _zx_handle_close(Handle); }
218    zx_handle_t Handle = ZX_HANDLE_INVALID;
219  };
220
221  // Create and bind the exception port.  We need to claim to be a "debugger" so
222  // the kernel will allow us to modify and resume dying threads (see below).
223  // Once the port is set, we can signal the main thread to continue and wait
224  // for the exception to arrive.
225  ScopedHandle Port;
226  ExitOnErr(_zx_port_create(0, &Port.Handle), "_zx_port_create");
227  zx_handle_t Self = _zx_process_self();
228
229  ExitOnErr(_zx_task_bind_exception_port(Self, Port.Handle, kFuzzingCrash,
230                                         ZX_EXCEPTION_PORT_DEBUGGER),
231            "_zx_task_bind_exception_port");
232
233  ExitOnErr(_zx_object_signal(*Event, 0, ZX_USER_SIGNAL_0),
234            "_zx_object_signal");
235
236  zx_port_packet_t Packet;
237  ExitOnErr(_zx_port_wait(Port.Handle, ZX_TIME_INFINITE, &Packet),
238            "_zx_port_wait");
239
240  // At this point, we want to get the state of the crashing thread, but
241  // libFuzzer and the sanitizers assume this will happen from that same thread
242  // via a POSIX signal handler. "Resurrecting" the thread in the middle of the
243  // appropriate callback is as simple as forcibly setting the instruction
244  // pointer/program counter, provided we NEVER EVER return from that function
245  // (since otherwise our stack will not be valid).
246  ScopedHandle Thread;
247  ExitOnErr(_zx_object_get_child(Self, Packet.exception.tid,
248                                 ZX_RIGHT_SAME_RIGHTS, &Thread.Handle),
249            "_zx_object_get_child");
250
251  zx_thread_state_general_regs_t GeneralRegisters;
252  ExitOnErr(_zx_thread_read_state(Thread.Handle, ZX_THREAD_STATE_GENERAL_REGS,
253                                  &GeneralRegisters, sizeof(GeneralRegisters)),
254            "_zx_thread_read_state");
255
256  // To unwind properly, we need to push the crashing thread's register state
257  // onto the stack and jump into a trampoline with CFI instructions on how
258  // to restore it.
259#if defined(__x86_64__)
260  uintptr_t StackPtr =
261      (GeneralRegisters.rsp - (128 + sizeof(GeneralRegisters))) &
262      -(uintptr_t)16;
263  __unsanitized_memcpy(reinterpret_cast<void *>(StackPtr), &GeneralRegisters,
264         sizeof(GeneralRegisters));
265  GeneralRegisters.rsp = StackPtr;
266  GeneralRegisters.rip = reinterpret_cast<zx_vaddr_t>(CrashTrampolineAsm);
267
268#elif defined(__aarch64__)
269  uintptr_t StackPtr =
270      (GeneralRegisters.sp - sizeof(GeneralRegisters)) & -(uintptr_t)16;
271  __unsanitized_memcpy(reinterpret_cast<void *>(StackPtr), &GeneralRegisters,
272                       sizeof(GeneralRegisters));
273  GeneralRegisters.sp = StackPtr;
274  GeneralRegisters.pc = reinterpret_cast<zx_vaddr_t>(CrashTrampolineAsm);
275
276#else
277#error "Unsupported architecture for fuzzing on Fuchsia"
278#endif
279
280  // Now force the crashing thread's state.
281  ExitOnErr(_zx_thread_write_state(Thread.Handle, ZX_THREAD_STATE_GENERAL_REGS,
282                                   &GeneralRegisters, sizeof(GeneralRegisters)),
283            "_zx_thread_write_state");
284
285  ExitOnErr(_zx_task_resume_from_exception(Thread.Handle, Port.Handle, 0),
286            "_zx_task_resume_from_exception");
287}
288
289} // namespace
290
291// Platform specific functions.
292void SetSignalHandler(const FuzzingOptions &Options) {
293  // Set up alarm handler if needed.
294  if (Options.UnitTimeoutSec > 0) {
295    std::thread T(AlarmHandler, Options.UnitTimeoutSec / 2 + 1);
296    T.detach();
297  }
298
299  // Set up interrupt handler if needed.
300  if (Options.HandleInt || Options.HandleTerm) {
301    std::thread T(InterruptHandler);
302    T.detach();
303  }
304
305  // Early exit if no crash handler needed.
306  if (!Options.HandleSegv && !Options.HandleBus && !Options.HandleIll &&
307      !Options.HandleFpe && !Options.HandleAbrt)
308    return;
309
310  // Set up the crash handler and wait until it is ready before proceeding.
311  zx_handle_t Event;
312  ExitOnErr(_zx_event_create(0, &Event), "_zx_event_create");
313
314  std::thread T(CrashHandler, &Event);
315  zx_status_t Status =
316      _zx_object_wait_one(Event, ZX_USER_SIGNAL_0, ZX_TIME_INFINITE, nullptr);
317  _zx_handle_close(Event);
318  ExitOnErr(Status, "_zx_object_wait_one");
319
320  T.detach();
321}
322
323void SleepSeconds(int Seconds) {
324  _zx_nanosleep(_zx_deadline_after(ZX_SEC(Seconds)));
325}
326
327unsigned long GetPid() {
328  zx_status_t rc;
329  zx_info_handle_basic_t Info;
330  if ((rc = _zx_object_get_info(_zx_process_self(), ZX_INFO_HANDLE_BASIC, &Info,
331                                sizeof(Info), NULL, NULL)) != ZX_OK) {
332    Printf("libFuzzer: unable to get info about self: %s\n",
333           _zx_status_get_string(rc));
334    exit(1);
335  }
336  return Info.koid;
337}
338
339size_t GetPeakRSSMb() {
340  zx_status_t rc;
341  zx_info_task_stats_t Info;
342  if ((rc = _zx_object_get_info(_zx_process_self(), ZX_INFO_TASK_STATS, &Info,
343                                sizeof(Info), NULL, NULL)) != ZX_OK) {
344    Printf("libFuzzer: unable to get info about self: %s\n",
345           _zx_status_get_string(rc));
346    exit(1);
347  }
348  return (Info.mem_private_bytes + Info.mem_shared_bytes) >> 20;
349}
350
351template <typename Fn>
352class RunOnDestruction {
353 public:
354  explicit RunOnDestruction(Fn fn) : fn_(fn) {}
355  ~RunOnDestruction() { fn_(); }
356
357 private:
358  Fn fn_;
359};
360
361template <typename Fn>
362RunOnDestruction<Fn> at_scope_exit(Fn fn) {
363  return RunOnDestruction<Fn>(fn);
364}
365
366int ExecuteCommand(const Command &Cmd) {
367  zx_status_t rc;
368
369  // Convert arguments to C array
370  auto Args = Cmd.getArguments();
371  size_t Argc = Args.size();
372  assert(Argc != 0);
373  std::unique_ptr<const char *[]> Argv(new const char *[Argc + 1]);
374  for (size_t i = 0; i < Argc; ++i)
375    Argv[i] = Args[i].c_str();
376  Argv[Argc] = nullptr;
377
378  // Determine output.  On Fuchsia, the fuzzer is typically run as a component
379  // that lacks a mutable working directory. Fortunately, when this is the case
380  // a mutable output directory must be specified using "-artifact_prefix=...",
381  // so write the log file(s) there.
382  int FdOut = STDOUT_FILENO;
383  if (Cmd.hasOutputFile()) {
384    std::string Path;
385    if (Cmd.hasFlag("artifact_prefix"))
386      Path = Cmd.getFlagValue("artifact_prefix") + "/" + Cmd.getOutputFile();
387    else
388      Path = Cmd.getOutputFile();
389    FdOut = open(Path.c_str(), O_WRONLY | O_CREAT | O_TRUNC, 0);
390    if (FdOut == -1) {
391      Printf("libFuzzer: failed to open %s: %s\n", Path.c_str(),
392             strerror(errno));
393      return ZX_ERR_IO;
394    }
395  }
396  auto CloseFdOut = at_scope_exit([FdOut]() {
397    if (FdOut != STDOUT_FILENO)
398      close(FdOut);
399  });
400
401  // Determine stderr
402  int FdErr = STDERR_FILENO;
403  if (Cmd.isOutAndErrCombined())
404    FdErr = FdOut;
405
406  // Clone the file descriptors into the new process
407  fdio_spawn_action_t SpawnAction[] = {
408      {
409          .action = FDIO_SPAWN_ACTION_CLONE_FD,
410          .fd =
411              {
412                  .local_fd = STDIN_FILENO,
413                  .target_fd = STDIN_FILENO,
414              },
415      },
416      {
417          .action = FDIO_SPAWN_ACTION_CLONE_FD,
418          .fd =
419              {
420                  .local_fd = FdOut,
421                  .target_fd = STDOUT_FILENO,
422              },
423      },
424      {
425          .action = FDIO_SPAWN_ACTION_CLONE_FD,
426          .fd =
427              {
428                  .local_fd = FdErr,
429                  .target_fd = STDERR_FILENO,
430              },
431      },
432  };
433
434  // Start the process.
435  char ErrorMsg[FDIO_SPAWN_ERR_MSG_MAX_LENGTH];
436  zx_handle_t ProcessHandle = ZX_HANDLE_INVALID;
437  rc = fdio_spawn_etc(
438      ZX_HANDLE_INVALID, FDIO_SPAWN_CLONE_ALL & (~FDIO_SPAWN_CLONE_STDIO),
439      Argv[0], Argv.get(), nullptr, 3, SpawnAction, &ProcessHandle, ErrorMsg);
440  if (rc != ZX_OK) {
441    Printf("libFuzzer: failed to launch '%s': %s, %s\n", Argv[0], ErrorMsg,
442           _zx_status_get_string(rc));
443    return rc;
444  }
445  auto CloseHandle = at_scope_exit([&]() { _zx_handle_close(ProcessHandle); });
446
447  // Now join the process and return the exit status.
448  if ((rc = _zx_object_wait_one(ProcessHandle, ZX_PROCESS_TERMINATED,
449                                ZX_TIME_INFINITE, nullptr)) != ZX_OK) {
450    Printf("libFuzzer: failed to join '%s': %s\n", Argv[0],
451           _zx_status_get_string(rc));
452    return rc;
453  }
454
455  zx_info_process_t Info;
456  if ((rc = _zx_object_get_info(ProcessHandle, ZX_INFO_PROCESS, &Info,
457                                sizeof(Info), nullptr, nullptr)) != ZX_OK) {
458    Printf("libFuzzer: unable to get return code from '%s': %s\n", Argv[0],
459           _zx_status_get_string(rc));
460    return rc;
461  }
462
463  return Info.return_code;
464}
465
466const void *SearchMemory(const void *Data, size_t DataLen, const void *Patt,
467                         size_t PattLen) {
468  return memmem(Data, DataLen, Patt, PattLen);
469}
470
471} // namespace fuzzer
472
473#endif // LIBFUZZER_FUCHSIA
474