1 //===- FuzzerUtilFuchsia.cpp - Misc utils for Fuchsia. --------------------===//
3 // The LLVM Compiler Infrastructure
5 // This file is distributed under the University of Illinois Open Source
6 // License. See LICENSE.TXT for details.
8 //===----------------------------------------------------------------------===//
9 // Misc utils implementation using Fuchsia/Zircon APIs.
10 //===----------------------------------------------------------------------===//
11 #include "FuzzerDefs.h"
15 #include "FuzzerInternal.h"
16 #include "FuzzerUtil.h"
21 #include <lib/fdio/spawn.h>
23 #include <sys/select.h>
26 #include <zircon/errors.h>
27 #include <zircon/process.h>
28 #include <zircon/sanitizer.h>
29 #include <zircon/status.h>
30 #include <zircon/syscalls.h>
31 #include <zircon/syscalls/debug.h>
32 #include <zircon/syscalls/exception.h>
33 #include <zircon/syscalls/port.h>
34 #include <zircon/types.h>
38 // Given that Fuchsia doesn't have the POSIX signals that libFuzzer was written
39 // around, the general approach is to spin up dedicated threads to watch for
40 // each requested condition (alarm, interrupt, crash). Of these, the crash
41 // handler is the most involved, as it requires resuming the crashed thread in
42 // order to invoke the sanitizers to get the needed state.
44 // Forward declaration of assembly trampoline needed to resume crashed threads.
45 // This appears to have external linkage to C++, which is why it's not in the
46 // anonymous namespace. The assembly definition inside MakeTrampoline()
47 // actually defines the symbol with internal linkage only.
48 void CrashTrampolineAsm() __asm__("CrashTrampolineAsm");
52 // TODO(phosek): remove this and replace it with ZX_TIME_INFINITE
53 #define ZX_TIME_INFINITE_OLD INT64_MAX
55 // A magic value for the Zircon exception port, chosen to spell 'FUZZING'
56 // when interpreted as a byte sequence on little-endian platforms.
57 const uint64_t kFuzzingCrash = 0x474e495a5a5546;
59 // Helper function to handle Zircon syscall failures.
60 void ExitOnErr(zx_status_t Status, const char *Syscall) {
61 if (Status != ZX_OK) {
62 Printf("libFuzzer: %s failed: %s\n", Syscall,
63 _zx_status_get_string(Status));
68 void AlarmHandler(int Seconds) {
70 SleepSeconds(Seconds);
71 Fuzzer::StaticAlarmCallback();
75 void InterruptHandler() {
77 // Ctrl-C sends ETX in Zircon.
80 FD_SET(STDIN_FILENO, &readfds);
81 select(STDIN_FILENO + 1, &readfds, nullptr, nullptr, nullptr);
82 } while(!FD_ISSET(STDIN_FILENO, &readfds) || getchar() != 0x03);
83 Fuzzer::StaticInterruptCallback();
86 // For the crash handler, we need to call Fuzzer::StaticCrashSignalCallback
87 // without POSIX signal handlers. To achieve this, we use an assembly function
88 // to add the necessary CFI unwinding information and a C function to bridge
89 // from that back into C++.
91 // FIXME: This works as a short-term solution, but this code really shouldn't be
92 // architecture dependent. A better long term solution is to implement remote
93 // unwinding and expose the necessary APIs through sanitizer_common and/or ASAN
94 // to allow the exception handling thread to gather the crash state directly.
96 // Alternatively, Fuchsia may in future actually implement basic signal
97 // handling for the machine trap signals.
98 #if defined(__x86_64__)
99 #define FOREACH_REGISTER(OP_REG, OP_NUM) \
118 #elif defined(__aarch64__)
119 #define FOREACH_REGISTER(OP_REG, OP_NUM) \
154 #error "Unsupported architecture for fuzzing on Fuchsia"
157 // Produces a CFI directive for the named or numbered register.
158 #define CFI_OFFSET_REG(reg) ".cfi_offset " #reg ", %c[" #reg "]\n"
159 #define CFI_OFFSET_NUM(num) CFI_OFFSET_REG(r##num)
161 // Produces an assembler input operand for the named or numbered register.
162 #define ASM_OPERAND_REG(reg) \
163 [reg] "i"(offsetof(zx_thread_state_general_regs_t, reg)),
164 #define ASM_OPERAND_NUM(num) \
165 [r##num] "i"(offsetof(zx_thread_state_general_regs_t, r[num])),
167 // Trampoline to bridge from the assembly below to the static C++ crash
169 __attribute__((noreturn))
170 static void StaticCrashHandler() {
171 Fuzzer::StaticCrashSignalCallback();
177 // Creates the trampoline with the necessary CFI information to unwind through
178 // to the crashing call stack. The attribute is necessary because the function
179 // is never called; it's just a container around the assembly to allow it to
180 // use operands for compile-time computed constants.
181 __attribute__((used))
182 void MakeTrampoline() {
183 __asm__(".cfi_endproc\n"
184 ".pushsection .text.CrashTrampolineAsm\n"
185 ".type CrashTrampolineAsm,STT_FUNC\n"
186 "CrashTrampolineAsm:\n"
187 ".cfi_startproc simple\n"
188 ".cfi_signal_frame\n"
189 #if defined(__x86_64__)
190 ".cfi_return_column rip\n"
191 ".cfi_def_cfa rsp, 0\n"
192 FOREACH_REGISTER(CFI_OFFSET_REG, CFI_OFFSET_NUM)
193 "call %c[StaticCrashHandler]\n"
195 #elif defined(__aarch64__)
196 ".cfi_return_column 33\n"
197 ".cfi_def_cfa sp, 0\n"
198 ".cfi_offset 33, %c[pc]\n"
199 FOREACH_REGISTER(CFI_OFFSET_REG, CFI_OFFSET_NUM)
200 "bl %[StaticCrashHandler]\n"
202 #error "Unsupported architecture for fuzzing on Fuchsia"
205 ".size CrashTrampolineAsm, . - CrashTrampolineAsm\n"
209 : FOREACH_REGISTER(ASM_OPERAND_REG, ASM_OPERAND_NUM)
210 #if defined(__aarch64__)
213 [StaticCrashHandler] "i" (StaticCrashHandler));
216 void CrashHandler(zx_handle_t *Event) {
217 // This structure is used to ensure we close handles to objects we create in
219 struct ScopedHandle {
220 ~ScopedHandle() { _zx_handle_close(Handle); }
221 zx_handle_t Handle = ZX_HANDLE_INVALID;
224 // Create and bind the exception port. We need to claim to be a "debugger" so
225 // the kernel will allow us to modify and resume dying threads (see below).
226 // Once the port is set, we can signal the main thread to continue and wait
227 // for the exception to arrive.
229 ExitOnErr(_zx_port_create(0, &Port.Handle), "_zx_port_create");
230 zx_handle_t Self = _zx_process_self();
232 ExitOnErr(_zx_task_bind_exception_port(Self, Port.Handle, kFuzzingCrash,
233 ZX_EXCEPTION_PORT_DEBUGGER),
234 "_zx_task_bind_exception_port");
236 ExitOnErr(_zx_object_signal(*Event, 0, ZX_USER_SIGNAL_0),
237 "_zx_object_signal");
239 zx_port_packet_t Packet;
240 ExitOnErr(_zx_port_wait(Port.Handle, ZX_TIME_INFINITE_OLD, &Packet),
243 // At this point, we want to get the state of the crashing thread, but
244 // libFuzzer and the sanitizers assume this will happen from that same thread
245 // via a POSIX signal handler. "Resurrecting" the thread in the middle of the
246 // appropriate callback is as simple as forcibly setting the instruction
247 // pointer/program counter, provided we NEVER EVER return from that function
248 // (since otherwise our stack will not be valid).
250 ExitOnErr(_zx_object_get_child(Self, Packet.exception.tid,
251 ZX_RIGHT_SAME_RIGHTS, &Thread.Handle),
252 "_zx_object_get_child");
254 zx_thread_state_general_regs_t GeneralRegisters;
255 ExitOnErr(_zx_thread_read_state(Thread.Handle, ZX_THREAD_STATE_GENERAL_REGS,
256 &GeneralRegisters, sizeof(GeneralRegisters)),
257 "_zx_thread_read_state");
259 // To unwind properly, we need to push the crashing thread's register state
260 // onto the stack and jump into a trampoline with CFI instructions on how
262 #if defined(__x86_64__)
264 (GeneralRegisters.rsp - (128 + sizeof(GeneralRegisters))) &
266 __unsanitized_memcpy(reinterpret_cast<void *>(StackPtr), &GeneralRegisters,
267 sizeof(GeneralRegisters));
268 GeneralRegisters.rsp = StackPtr;
269 GeneralRegisters.rip = reinterpret_cast<zx_vaddr_t>(CrashTrampolineAsm);
271 #elif defined(__aarch64__)
273 (GeneralRegisters.sp - sizeof(GeneralRegisters)) & -(uintptr_t)16;
274 __unsanitized_memcpy(reinterpret_cast<void *>(StackPtr), &GeneralRegisters,
275 sizeof(GeneralRegisters));
276 GeneralRegisters.sp = StackPtr;
277 GeneralRegisters.pc = reinterpret_cast<zx_vaddr_t>(CrashTrampolineAsm);
280 #error "Unsupported architecture for fuzzing on Fuchsia"
283 // Now force the crashing thread's state.
284 ExitOnErr(_zx_thread_write_state(Thread.Handle, ZX_THREAD_STATE_GENERAL_REGS,
285 &GeneralRegisters, sizeof(GeneralRegisters)),
286 "_zx_thread_write_state");
288 ExitOnErr(_zx_task_resume_from_exception(Thread.Handle, Port.Handle, 0),
289 "_zx_task_resume_from_exception");
294 // Platform specific functions.
295 void SetSignalHandler(const FuzzingOptions &Options) {
296 // Set up alarm handler if needed.
297 if (Options.UnitTimeoutSec > 0) {
298 std::thread T(AlarmHandler, Options.UnitTimeoutSec / 2 + 1);
302 // Set up interrupt handler if needed.
303 if (Options.HandleInt || Options.HandleTerm) {
304 std::thread T(InterruptHandler);
308 // Early exit if no crash handler needed.
309 if (!Options.HandleSegv && !Options.HandleBus && !Options.HandleIll &&
310 !Options.HandleFpe && !Options.HandleAbrt)
313 // Set up the crash handler and wait until it is ready before proceeding.
315 ExitOnErr(_zx_event_create(0, &Event), "_zx_event_create");
317 std::thread T(CrashHandler, &Event);
318 zx_status_t Status = _zx_object_wait_one(Event, ZX_USER_SIGNAL_0,
319 ZX_TIME_INFINITE_OLD, nullptr);
320 _zx_handle_close(Event);
321 ExitOnErr(Status, "_zx_object_wait_one");
326 void SleepSeconds(int Seconds) {
327 _zx_nanosleep(_zx_deadline_after(ZX_SEC(Seconds)));
330 unsigned long GetPid() {
332 zx_info_handle_basic_t Info;
333 if ((rc = _zx_object_get_info(_zx_process_self(), ZX_INFO_HANDLE_BASIC, &Info,
334 sizeof(Info), NULL, NULL)) != ZX_OK) {
335 Printf("libFuzzer: unable to get info about self: %s\n",
336 _zx_status_get_string(rc));
342 size_t GetPeakRSSMb() {
344 zx_info_task_stats_t Info;
345 if ((rc = _zx_object_get_info(_zx_process_self(), ZX_INFO_TASK_STATS, &Info,
346 sizeof(Info), NULL, NULL)) != ZX_OK) {
347 Printf("libFuzzer: unable to get info about self: %s\n",
348 _zx_status_get_string(rc));
351 return (Info.mem_private_bytes + Info.mem_shared_bytes) >> 20;
354 template <typename Fn>
355 class RunOnDestruction {
357 explicit RunOnDestruction(Fn fn) : fn_(fn) {}
358 ~RunOnDestruction() { fn_(); }
364 template <typename Fn>
365 RunOnDestruction<Fn> at_scope_exit(Fn fn) {
366 return RunOnDestruction<Fn>(fn);
369 int ExecuteCommand(const Command &Cmd) {
372 // Convert arguments to C array
373 auto Args = Cmd.getArguments();
374 size_t Argc = Args.size();
376 std::unique_ptr<const char *[]> Argv(new const char *[Argc + 1]);
377 for (size_t i = 0; i < Argc; ++i)
378 Argv[i] = Args[i].c_str();
379 Argv[Argc] = nullptr;
382 int FdOut = STDOUT_FILENO;
384 if (Cmd.hasOutputFile()) {
385 auto Filename = Cmd.getOutputFile();
386 FdOut = open(Filename.c_str(), O_WRONLY | O_CREAT | O_TRUNC, 0);
388 Printf("libFuzzer: failed to open %s: %s\n", Filename.c_str(),
393 auto CloseFdOut = at_scope_exit([&]() { close(FdOut); } );
396 int FdErr = STDERR_FILENO;
397 if (Cmd.isOutAndErrCombined())
400 // Clone the file descriptors into the new process
401 fdio_spawn_action_t SpawnAction[] = {
403 .action = FDIO_SPAWN_ACTION_CLONE_FD,
406 .local_fd = STDIN_FILENO,
407 .target_fd = STDIN_FILENO,
411 .action = FDIO_SPAWN_ACTION_CLONE_FD,
415 .target_fd = STDOUT_FILENO,
419 .action = FDIO_SPAWN_ACTION_CLONE_FD,
423 .target_fd = STDERR_FILENO,
428 // Start the process.
429 char ErrorMsg[FDIO_SPAWN_ERR_MSG_MAX_LENGTH];
430 zx_handle_t ProcessHandle = ZX_HANDLE_INVALID;
432 ZX_HANDLE_INVALID, FDIO_SPAWN_CLONE_ALL & (~FDIO_SPAWN_CLONE_STDIO),
433 Argv[0], Argv.get(), nullptr, 3, SpawnAction, &ProcessHandle, ErrorMsg);
435 Printf("libFuzzer: failed to launch '%s': %s, %s\n", Argv[0], ErrorMsg,
436 _zx_status_get_string(rc));
439 auto CloseHandle = at_scope_exit([&]() { _zx_handle_close(ProcessHandle); });
441 // Now join the process and return the exit status.
442 if ((rc = _zx_object_wait_one(ProcessHandle, ZX_PROCESS_TERMINATED,
443 ZX_TIME_INFINITE_OLD, nullptr)) != ZX_OK) {
444 Printf("libFuzzer: failed to join '%s': %s\n", Argv[0],
445 _zx_status_get_string(rc));
449 zx_info_process_t Info;
450 if ((rc = _zx_object_get_info(ProcessHandle, ZX_INFO_PROCESS, &Info,
451 sizeof(Info), nullptr, nullptr)) != ZX_OK) {
452 Printf("libFuzzer: unable to get return code from '%s': %s\n", Argv[0],
453 _zx_status_get_string(rc));
457 return Info.return_code;
460 const void *SearchMemory(const void *Data, size_t DataLen, const void *Patt,
462 return memmem(Data, DataLen, Patt, PattLen);
465 } // namespace fuzzer
467 #endif // LIBFUZZER_FUCHSIA