ACPR/android_system_core
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Merge changes Ie9da525c,I9911f02c,Iad18af1f,I5f432a3d am: 41c2e6286e

Browse source 
Original change: https://android-review.googlesource.com/c/platform/system/core/+/1506636

Change-Id: Ibb572370e1fe3daeb242916b4a8c28713f5544bb
This commit is contained in:
Treehugger Robot 2020-12-01 20:35:05 +00:00 • committed by Automerger Merge Worker
commit e52cdbc760
11 changed files with 679 additions and 6 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

45
trusty/coverage/Android.bp Normal file
View file

@ -0,0 +1,45 @@
// Copyright (C) 2020 The Android Open-Source Project
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
// http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.
cc_library {
name: "libtrusty_coverage",
srcs: [
"coverage.cpp",
],
export_include_dirs: [
"include",
],
static_libs: [
"libtrusty_test",
],
shared_libs: [
"libbase",
"liblog",
],
}
cc_test {
name: "libtrusty_coverage_test",
srcs: [
"coverage_test.cpp",
],
static_libs: [
"libtrusty_coverage",
"libtrusty_test",
],
shared_libs: [
"libbase",
"liblog",
],
}

172
trusty/coverage/coverage.cpp Normal file
View file

@ -0,0 +1,172 @@
/*
* Copyright (C) 2020 The Android Open Sourete Project
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
#define LOG_TAG "coverage"
#include <android-base/logging.h>
#include <android-base/unique_fd.h>
#include <assert.h>
#include <sys/mman.h>
#include <sys/uio.h>
#include <trusty/coverage/coverage.h>
#include <trusty/coverage/tipc.h>
#include <trusty/tipc.h>
#define COVERAGE_CLIENT_PORT "com.android.trusty.coverage.client"
namespace android {
namespace trusty {
namespace coverage {
using android::base::ErrnoError;
using android::base::Error;
using std::string;
static inline uintptr_t RoundPageUp(uintptr_t val) {
return (val + (PAGE_SIZE - 1)) & ~(PAGE_SIZE - 1);
}
CoverageRecord::CoverageRecord(string tipc_dev, struct uuid* uuid)
: tipc_dev_(std::move(tipc_dev)),
coverage_srv_fd_(-1),
uuid_(*uuid),
record_len_(0),
shm_(NULL),
shm_len_(0) {}
CoverageRecord::~CoverageRecord() {
if (shm_) {
munmap((void*)shm_, shm_len_);
}
}
Result<void> CoverageRecord::Rpc(coverage_client_req* req, int req_fd, coverage_client_resp* resp) {
int rc;
if (req_fd < 0) {
rc = write(coverage_srv_fd_, req, sizeof(*req));
} else {
iovec iov = {
.iov_base = req,
.iov_len = sizeof(*req),
};
trusty_shm shm = {
.fd = req_fd,
.transfer = TRUSTY_SHARE,
};
rc = tipc_send(coverage_srv_fd_, &iov, 1, &shm, 1);
}
if (rc != (int)sizeof(*req)) {
return ErrnoError() << "failed to send request to coverage server: ";
}
rc = read(coverage_srv_fd_, resp, sizeof(*resp));
if (rc != (int)sizeof(*resp)) {
return ErrnoError() << "failed to read reply from coverage server: ";
}
if (resp->hdr.cmd != (req->hdr.cmd | COVERAGE_CLIENT_CMD_RESP_BIT)) {
return ErrnoError() << "unknown response cmd: " << resp->hdr.cmd;
}
return {};
}
Result<void> CoverageRecord::Open() {
coverage_client_req req;
coverage_client_resp resp;
if (shm_) {
return {}; /* already initialized */
}
int fd = tipc_connect(tipc_dev_.c_str(), COVERAGE_CLIENT_PORT);
if (fd < 0) {
return ErrnoError() << "failed to connect to Trusty coverarge server: ";
}
coverage_srv_fd_.reset(fd);
req.hdr.cmd = COVERAGE_CLIENT_CMD_OPEN;
req.open_args.uuid = uuid_;
auto ret = Rpc(&req, -1, &resp);
if (!ret.ok()) {
return Error() << "failed to open coverage client: ";
}
record_len_ = resp.open_args.record_len;
shm_len_ = RoundPageUp(record_len_);
fd = memfd_create("trusty-coverage", 0);
if (fd < 0) {
return ErrnoError() << "failed to create memfd: ";
}
unique_fd memfd(fd);
if (ftruncate(memfd, shm_len_) < 0) {
return ErrnoError() << "failed to resize memfd: ";
}
void* shm = mmap(0, shm_len_, PROT_READ | PROT_WRITE, MAP_SHARED, memfd, 0);
if (shm == MAP_FAILED) {
return ErrnoError() << "failed to map memfd: ";
}
req.hdr.cmd = COVERAGE_CLIENT_CMD_SHARE_RECORD;
req.share_record_args.shm_len = shm_len_;
ret = Rpc(&req, memfd, &resp);
if (!ret.ok()) {
return Error() << "failed to send shared memory: ";
}
shm_ = shm;
return {};
}
void CoverageRecord::Reset() {
for (size_t i = 0; i < shm_len_; i++) {
*((volatile uint8_t*)shm_ + i) = 0;
}
}
void CoverageRecord::GetRawData(volatile void** begin, volatile void** end) {
assert(shm_);
*begin = shm_;
*end = (uint8_t*)(*begin) + record_len_;
}
uint64_t CoverageRecord::CountEdges() {
assert(shm_);
uint64_t counter = 0;
volatile uint8_t* begin = NULL;
volatile uint8_t* end = NULL;
GetRawData((volatile void**)&begin, (volatile void**)&end);
for (volatile uint8_t* x = begin; x < end; x++) {
counter += *x;
}
return counter;
}
} // namespace coverage
} // namespace trusty
} // namespace android

95
trusty/coverage/coverage_test.cpp Normal file
View file

@ -0,0 +1,95 @@
/*
* Copyright (C) 2020 The Android Open Source Project
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
#include <gtest/gtest.h>
#include <trusty/coverage/coverage.h>
#include <trusty/tipc.h>
#include <array>
#include <memory>
using android::base::unique_fd;
using std::array;
using std::make_unique;
using std::unique_ptr;
#define TIPC_DEV "/dev/trusty-ipc-dev0"
#define TEST_SRV_PORT "com.android.trusty.sancov.test.srv"
namespace android {
namespace trusty {
namespace coverage {
/* Test server's UUID is 77f68803-c514-43ba-bdce-3254531c3d24 */
static struct uuid test_srv_uuid = {
0x77f68803,
0xc514,
0x43ba,
{0xbd, 0xce, 0x32, 0x54, 0x53, 0x1c, 0x3d, 0x24},
};
class CoverageTest : public ::testing::Test {
public:
void SetUp() override {
record_ = make_unique<CoverageRecord>(TIPC_DEV, &test_srv_uuid);
auto ret = record_->Open();
ASSERT_TRUE(ret.ok()) << ret.error();
}
void TearDown() override { record_.reset(); }
unique_ptr<CoverageRecord> record_;
};
TEST_F(CoverageTest, CoverageReset) {
record_->Reset();
auto counter = record_->CountEdges();
ASSERT_EQ(counter, 0);
}
TEST_F(CoverageTest, TestServerCoverage) {
unique_fd test_srv(tipc_connect(TIPC_DEV, TEST_SRV_PORT));
ASSERT_GE(test_srv, 0);
uint32_t mask = (uint32_t)-1;
uint32_t magic = 0xdeadbeef;
uint64_t high_watermark = 0;
for (size_t i = 1; i < sizeof(magic) * 8; i++) {
/* Reset coverage */
record_->Reset();
/* Send message to test server */
uint32_t msg = magic & ~(mask << i);
int rc = write(test_srv, &msg, sizeof(msg));
ASSERT_EQ(rc, sizeof(msg));
/* Read message from test server */
rc = read(test_srv, &msg, sizeof(msg));
ASSERT_EQ(rc, sizeof(msg));
/* Count number of non-unique blocks executed */
auto counter = record_->CountEdges();
/* Each consecutive input should exercise more or same blocks */
ASSERT_GE(counter, high_watermark);
high_watermark = counter;
}
ASSERT_GT(high_watermark, 0);
}
} // namespace coverage
} // namespace trusty
} // namespace android

55
trusty/coverage/include/trusty/coverage/coverage.h Normal file
View file

@ -0,0 +1,55 @@
/*
* Copyright (C) 2020 The Android Open Source Project
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
#pragma once
#include <string>
#include <android-base/result.h>
#include <android-base/unique_fd.h>
#include <stdint.h>
#include <trusty/coverage/tipc.h>
namespace android {
namespace trusty {
namespace coverage {
using android::base::Result;
using android::base::unique_fd;
class CoverageRecord {
public:
CoverageRecord(std::string tipc_dev, struct uuid* uuid);
~CoverageRecord();
Result<void> Open();
void Reset();
void GetRawData(volatile void** begin, volatile void** end);
uint64_t CountEdges();
private:
Result<void> Rpc(coverage_client_req* req, int req_fd, coverage_client_resp* resp);
std::string tipc_dev_;
unique_fd coverage_srv_fd_;
struct uuid uuid_;
size_t record_len_;
volatile void* shm_;
size_t shm_len_;
};
} // namespace coverage
} // namespace trusty
} // namespace android

68
trusty/coverage/include/trusty/coverage/tipc.h Normal file
View file

@ -0,0 +1,68 @@
/*
* Copyright (C) 2020 The Android Open Source Project
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
/* This file needs to be kept in-sync with it's counterpart on Trusty side */
#pragma once
#include <stdint.h>
#define COVERAGE_CLIENT_PORT "com.android.trusty.coverage.client"
struct uuid {
uint32_t time_low;
uint16_t time_mid;
uint16_t time_hi_and_version;
uint8_t clock_seq_and_node[8];
};
enum coverage_client_cmd {
COVERAGE_CLIENT_CMD_RESP_BIT = 1U,
COVERAGE_CLIENT_CMD_SHIFT = 1U,
COVERAGE_CLIENT_CMD_OPEN = (1U << COVERAGE_CLIENT_CMD_SHIFT),
COVERAGE_CLIENT_CMD_SHARE_RECORD = (2U << COVERAGE_CLIENT_CMD_SHIFT),
};
struct coverage_client_hdr {
uint32_t cmd;
};
struct coverage_client_open_req {
struct uuid uuid;
};
struct coverage_client_open_resp {
uint32_t record_len;
};
struct coverage_client_share_record_req {
uint32_t shm_len;
};
struct coverage_client_req {
struct coverage_client_hdr hdr;
union {
struct coverage_client_open_req open_args;
struct coverage_client_share_record_req share_record_args;
};
};
struct coverage_client_resp {
struct coverage_client_hdr hdr;
union {
struct coverage_client_open_resp open_args;
};
};

10
trusty/fuzz/Android.bp
View file

@ -15,6 +15,7 @@
cc_defaults {
name: "trusty_fuzzer_defaults",
shared_libs: [
"libtrusty_coverage",
"libtrusty_fuzz_utils",
"libbase",
"liblog",
@ -31,9 +32,16 @@ cc_defaults {
cc_library {
name: "libtrusty_fuzz_utils",
srcs: ["utils.cpp"],
srcs: [
"counters.cpp",
"utils.cpp",
],
export_include_dirs: ["include"],
static_libs: [
"libFuzzer",
],
shared_libs: [
"libtrusty_coverage",
"libtrusty_test",
"libbase",
"liblog",

74
trusty/fuzz/counters.cpp Normal file
View file

@ -0,0 +1,74 @@
/*
* Copyright (C) 2020 The Android Open Sourete Project
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
#define LOG_TAG "trusty-fuzz-counters"
#include <FuzzerDefs.h>
#include <trusty/fuzz/counters.h>
#include <android-base/logging.h>
#include <trusty/coverage/coverage.h>
#include <trusty/coverage/tipc.h>
using android::base::ErrnoError;
using android::base::Error;
using android::base::Result;
/*
* We don't know how many counters the coverage record will contain. So, eyeball
* the size of this section.
*/
__attribute__((section("__libfuzzer_extra_counters"))) volatile uint8_t counters[PAGE_SIZE];
namespace android {
namespace trusty {
namespace fuzz {
ExtraCounters::ExtraCounters(coverage::CoverageRecord* record) : record_(record) {
assert(fuzzer::ExtraCountersBegin());
assert(fuzzer::ExtraCountersEnd());
uint8_t* begin = NULL;
uint8_t* end = NULL;
record_->GetRawData((volatile void**)&begin, (volatile void**)&end);
assert(end - begin <= sizeof(counters));
}
ExtraCounters::~ExtraCounters() {
Flush();
}
void ExtraCounters::Reset() {
record_->Reset();
fuzzer::ClearExtraCounters();
}
void ExtraCounters::Flush() {
volatile uint8_t* begin = NULL;
volatile uint8_t* end = NULL;
record_->GetRawData((volatile void**)&begin, (volatile void**)&end);
size_t num_counters = end - begin;
for (size_t i = 0; i < num_counters; i++) {
*(counters + i) = *(begin + i);
}
}
} // namespace fuzz
} // namespace trusty
} // namespace android

42
trusty/fuzz/include/trusty/fuzz/counters.h Normal file
View file

@ -0,0 +1,42 @@
/*
* Copyright (C) 2020 The Android Open Source Project
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
#pragma once
#include <string>
#include <android-base/result.h>
#include <trusty/coverage/coverage.h>
namespace android {
namespace trusty {
namespace fuzz {
class ExtraCounters {
public:
ExtraCounters(coverage::CoverageRecord* record);
~ExtraCounters();
void Reset();
void Flush();
private:
coverage::CoverageRecord* record_;
};
} // namespace fuzz
} // namespace trusty
} // namespace android

19
trusty/fuzz/test/Android.bp Normal file
View file

@ -0,0 +1,19 @@
// Copyright (C) 2020 The Android Open Source Project
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
// http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.
cc_fuzz {
name: "trusty_test_fuzzer",
defaults: ["trusty_fuzzer_defaults"],
srcs: ["fuzz.cpp"],
}

75
trusty/fuzz/test/fuzz.cpp Normal file
View file

@ -0,0 +1,75 @@
/*
* Copyright (C) 2020 The Android Open Source Project
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
#undef NDEBUG
#include <assert.h>
#include <log/log.h>
#include <stdlib.h>
#include <trusty/coverage/coverage.h>
#include <trusty/fuzz/counters.h>
#include <trusty/fuzz/utils.h>
#include <unistd.h>
using android::trusty::coverage::CoverageRecord;
using android::trusty::fuzz::ExtraCounters;
using android::trusty::fuzz::TrustyApp;
#define TIPC_DEV "/dev/trusty-ipc-dev0"
#define TEST_SRV_PORT "com.android.trusty.sancov.test.srv"
/* Test server's UUID is 77f68803-c514-43ba-bdce-3254531c3d24 */
static struct uuid test_srv_uuid = {
0x77f68803,
0xc514,
0x43ba,
{0xbd, 0xce, 0x32, 0x54, 0x53, 0x1c, 0x3d, 0x24},
};
static CoverageRecord record(TIPC_DEV, &test_srv_uuid);
extern "C" int LLVMFuzzerInitialize(int* /* argc */, char*** /* argv */) {
auto ret = record.Open();
assert(ret.ok());
return 0;
}
extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
static uint8_t buf[TIPC_MAX_MSG_SIZE];
ExtraCounters counters(&record);
counters.Reset();
TrustyApp ta(TIPC_DEV, TEST_SRV_PORT);
auto ret = ta.Connect();
if (!ret.ok()) {
android::trusty::fuzz::Abort();
}
/* Send message to test server */
ret = ta.Write(data, size);
if (!ret.ok()) {
return -1;
}
/* Read message from test server */
ret = ta.Read(&buf, sizeof(buf));
if (!ret.ok()) {
return -1;
}
return 0;
}

30
trusty/gatekeeper/fuzz/fuzz.cpp
View file

@ -19,22 +19,42 @@
#include <assert.h>
#include <log/log.h>
#include <stdlib.h>
#include <trusty/coverage/coverage.h>
#include <trusty/fuzz/counters.h>
#include <trusty/fuzz/utils.h>
#include <unistd.h>
using android::trusty::coverage::CoverageRecord;
using android::trusty::fuzz::ExtraCounters;
using android::trusty::fuzz::TrustyApp;
#define TIPC_DEV "/dev/trusty-ipc-dev0"
#define GATEKEEPER_PORT "com.android.trusty.gatekeeper"
/* Gatekeeper TA's UUID is 38ba0cdc-df0e-11e4-9869-233fb6ae4795 */
static struct uuid gatekeeper_uuid = {
0x38ba0cdc,
0xdf0e,
0x11e4,
{0x98, 0x69, 0x23, 0x3f, 0xb6, 0xae, 0x47, 0x95},
};
static CoverageRecord record(TIPC_DEV, &gatekeeper_uuid);
extern "C" int LLVMFuzzerInitialize(int* /* argc */, char*** /* argv */) {
auto ret = record.Open();
assert(ret.ok());
return 0;
}
extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
static uint8_t buf[TIPC_MAX_MSG_SIZE];
android::trusty::fuzz::TrustyApp ta(TIPC_DEV, GATEKEEPER_PORT);
ExtraCounters counters(&record);
counters.Reset();
android::trusty::fuzz::TrustyApp ta(TIPC_DEV, GATEKEEPER_PORT);
auto ret = ta.Connect();
/*
* If we can't connect, then assume TA crashed.
* TODO: Get some more info, e.g. stacks, to help Haiku dedup crashes.
*/
if (!ret.ok()) {
android::trusty::fuzz::Abort();
}