| // SPDX-License-Identifier: GPL-2.0+ |
| /* |
| * Copyright (c) 2011 The Chromium OS Authors. |
| */ |
| |
| #define _GNU_SOURCE |
| |
| #include <dirent.h> |
| #include <errno.h> |
| #include <fcntl.h> |
| #include <pthread.h> |
| #include <getopt.h> |
| #include <setjmp.h> |
| #include <signal.h> |
| #include <stdarg.h> |
| #include <stdio.h> |
| #include <stdint.h> |
| #include <stdlib.h> |
| #include <string.h> |
| #include <termios.h> |
| #include <time.h> |
| #include <ucontext.h> |
| #include <unistd.h> |
| #include <sys/mman.h> |
| #include <sys/stat.h> |
| #include <sys/time.h> |
| #include <sys/types.h> |
| #include <linux/compiler_attributes.h> |
| #include <linux/types.h> |
| |
| #include <asm/fuzzing_engine.h> |
| #include <asm/getopt.h> |
| #include <asm/main.h> |
| #include <asm/sections.h> |
| #include <asm/state.h> |
| #include <os.h> |
| #include <rtc_def.h> |
| |
| /* Environment variable for time offset */ |
| #define ENV_TIME_OFFSET "UBOOT_SB_TIME_OFFSET" |
| |
| /* Operating System Interface */ |
| |
| struct os_mem_hdr { |
| size_t length; /* number of bytes in the block */ |
| }; |
| |
| ssize_t os_read(int fd, void *buf, size_t count) |
| { |
| return read(fd, buf, count); |
| } |
| |
| ssize_t os_write(int fd, const void *buf, size_t count) |
| { |
| return write(fd, buf, count); |
| } |
| |
| int os_printf(const char *fmt, ...) |
| { |
| va_list args; |
| int i; |
| |
| va_start(args, fmt); |
| i = vfprintf(stdout, fmt, args); |
| va_end(args); |
| |
| return i; |
| } |
| |
| off_t os_lseek(int fd, off_t offset, int whence) |
| { |
| if (whence == OS_SEEK_SET) |
| whence = SEEK_SET; |
| else if (whence == OS_SEEK_CUR) |
| whence = SEEK_CUR; |
| else if (whence == OS_SEEK_END) |
| whence = SEEK_END; |
| else |
| os_exit(1); |
| return lseek(fd, offset, whence); |
| } |
| |
| int os_open(const char *pathname, int os_flags) |
| { |
| int flags; |
| |
| switch (os_flags & OS_O_MASK) { |
| case OS_O_RDONLY: |
| default: |
| flags = O_RDONLY; |
| break; |
| |
| case OS_O_WRONLY: |
| flags = O_WRONLY; |
| break; |
| |
| case OS_O_RDWR: |
| flags = O_RDWR; |
| break; |
| } |
| |
| if (os_flags & OS_O_CREAT) |
| flags |= O_CREAT; |
| if (os_flags & OS_O_TRUNC) |
| flags |= O_TRUNC; |
| /* |
| * During a cold reset execv() is used to relaunch the U-Boot binary. |
| * We must ensure that all files are closed in this case. |
| */ |
| flags |= O_CLOEXEC; |
| |
| return open(pathname, flags, 0777); |
| } |
| |
| int os_close(int fd) |
| { |
| /* Do not close the console input */ |
| if (fd) |
| return close(fd); |
| return -1; |
| } |
| |
| int os_unlink(const char *pathname) |
| { |
| return unlink(pathname); |
| } |
| |
| void os_exit(int exit_code) |
| { |
| exit(exit_code); |
| } |
| |
| unsigned int os_alarm(unsigned int seconds) |
| { |
| return alarm(seconds); |
| } |
| |
| void os_set_alarm_handler(void (*handler)(int)) |
| { |
| if (!handler) |
| handler = SIG_DFL; |
| signal(SIGALRM, handler); |
| } |
| |
| void os_raise_sigalrm(void) |
| { |
| raise(SIGALRM); |
| } |
| |
| int os_write_file(const char *fname, const void *buf, int size) |
| { |
| int fd; |
| |
| fd = os_open(fname, OS_O_WRONLY | OS_O_CREAT | OS_O_TRUNC); |
| if (fd < 0) { |
| printf("Cannot open file '%s'\n", fname); |
| return -EIO; |
| } |
| if (os_write(fd, buf, size) != size) { |
| printf("Cannot write to file '%s'\n", fname); |
| os_close(fd); |
| return -EIO; |
| } |
| os_close(fd); |
| |
| return 0; |
| } |
| |
| off_t os_filesize(int fd) |
| { |
| off_t size; |
| |
| size = os_lseek(fd, 0, OS_SEEK_END); |
| if (size < 0) |
| return -errno; |
| if (os_lseek(fd, 0, OS_SEEK_SET) < 0) |
| return -errno; |
| |
| return size; |
| } |
| |
| int os_read_file(const char *fname, void **bufp, int *sizep) |
| { |
| off_t size; |
| int ret = -EIO; |
| int fd; |
| |
| fd = os_open(fname, OS_O_RDONLY); |
| if (fd < 0) { |
| printf("Cannot open file '%s'\n", fname); |
| goto err; |
| } |
| size = os_filesize(fd); |
| if (size < 0) { |
| printf("Cannot get file size of '%s'\n", fname); |
| goto err; |
| } |
| |
| *bufp = os_malloc(size); |
| if (!*bufp) { |
| printf("Not enough memory to read file '%s'\n", fname); |
| ret = -ENOMEM; |
| goto err; |
| } |
| if (os_read(fd, *bufp, size) != size) { |
| printf("Cannot read from file '%s'\n", fname); |
| goto err; |
| } |
| os_close(fd); |
| *sizep = size; |
| |
| return 0; |
| err: |
| os_close(fd); |
| return ret; |
| } |
| |
| int os_map_file(const char *pathname, int os_flags, void **bufp, int *sizep) |
| { |
| void *ptr; |
| off_t size; |
| int ifd, ret = 0; |
| |
| ifd = os_open(pathname, os_flags); |
| if (ifd < 0) { |
| printf("Cannot open file '%s'\n", pathname); |
| return -EIO; |
| } |
| size = os_filesize(ifd); |
| if (size < 0) { |
| printf("Cannot get file size of '%s'\n", pathname); |
| ret = -EIO; |
| goto out; |
| } |
| if ((unsigned long long)size > (unsigned long long)SIZE_MAX) { |
| printf("File '%s' too large to map\n", pathname); |
| ret = -EIO; |
| goto out; |
| } |
| |
| ptr = mmap(0, size, PROT_READ | PROT_WRITE, MAP_SHARED, ifd, 0); |
| if (ptr == MAP_FAILED) { |
| printf("Can't map file '%s': %s\n", pathname, strerror(errno)); |
| ret = -EPERM; |
| goto out; |
| } |
| |
| *bufp = ptr; |
| *sizep = size; |
| |
| out: |
| os_close(ifd); |
| return ret; |
| } |
| |
| int os_unmap(void *buf, int size) |
| { |
| if (munmap(buf, size)) { |
| printf("Can't unmap %p %x\n", buf, size); |
| return -EIO; |
| } |
| |
| return 0; |
| } |
| |
| int os_persistent_file(char *buf, int maxsize, const char *fname) |
| { |
| const char *dirname = getenv("U_BOOT_PERSISTENT_DATA_DIR"); |
| char *ptr; |
| int len; |
| |
| len = strlen(fname) + (dirname ? strlen(dirname) + 1 : 0) + 1; |
| if (len > maxsize) |
| return -ENOSPC; |
| |
| ptr = buf; |
| if (dirname) { |
| strcpy(ptr, dirname); |
| ptr += strlen(dirname); |
| *ptr++ = '/'; |
| } |
| strcpy(ptr, fname); |
| |
| if (access(buf, F_OK) == -1) |
| return -ENOENT; |
| |
| return 0; |
| } |
| |
| int os_mktemp(char *fname, off_t size) |
| { |
| int fd; |
| |
| fd = mkostemp(fname, O_CLOEXEC); |
| if (fd < 0) |
| return -errno; |
| |
| if (unlink(fname) < 0) |
| return -errno; |
| |
| if (ftruncate(fd, size)) |
| return -errno; |
| |
| return fd; |
| } |
| |
| /* Restore tty state when we exit */ |
| static struct termios orig_term; |
| static bool term_setup; |
| static bool term_nonblock; |
| |
| void os_fd_restore(void) |
| { |
| if (term_setup) { |
| int flags; |
| |
| tcsetattr(0, TCSANOW, &orig_term); |
| if (term_nonblock) { |
| flags = fcntl(0, F_GETFL, 0); |
| fcntl(0, F_SETFL, flags & ~O_NONBLOCK); |
| } |
| term_setup = false; |
| } |
| } |
| |
| static void os_sigint_handler(int sig) |
| { |
| os_fd_restore(); |
| signal(SIGINT, SIG_DFL); |
| raise(SIGINT); |
| } |
| |
| static void os_signal_handler(int sig, siginfo_t *info, void *con) |
| { |
| ucontext_t __maybe_unused *context = con; |
| unsigned long pc; |
| |
| #if defined(__x86_64__) |
| pc = context->uc_mcontext.gregs[REG_RIP]; |
| #elif defined(__aarch64__) |
| pc = context->uc_mcontext.pc; |
| #elif defined(__riscv) |
| pc = context->uc_mcontext.__gregs[REG_PC]; |
| #else |
| const char msg[] = |
| "\nUnsupported architecture, cannot read program counter\n"; |
| |
| os_write(1, msg, sizeof(msg)); |
| pc = 0; |
| #endif |
| |
| os_signal_action(sig, pc); |
| } |
| |
| int os_setup_signal_handlers(void) |
| { |
| struct sigaction act; |
| |
| act.sa_sigaction = os_signal_handler; |
| sigemptyset(&act.sa_mask); |
| act.sa_flags = SA_SIGINFO; |
| if (sigaction(SIGILL, &act, NULL) || |
| sigaction(SIGBUS, &act, NULL) || |
| sigaction(SIGSEGV, &act, NULL)) |
| return -1; |
| return 0; |
| } |
| |
| /* Put tty into raw mode so <tab> and <ctrl+c> work */ |
| void os_tty_raw(int fd, bool allow_sigs) |
| { |
| struct termios term; |
| int flags; |
| |
| if (term_setup) |
| return; |
| |
| /* If not a tty, don't complain */ |
| if (tcgetattr(fd, &orig_term)) |
| return; |
| |
| term = orig_term; |
| term.c_iflag = IGNBRK | IGNPAR; |
| term.c_oflag = OPOST | ONLCR; |
| term.c_cflag = CS8 | CREAD | CLOCAL; |
| term.c_lflag = allow_sigs ? ISIG : 0; |
| if (tcsetattr(fd, TCSANOW, &term)) |
| return; |
| |
| flags = fcntl(fd, F_GETFL, 0); |
| if (!(flags & O_NONBLOCK)) { |
| if (fcntl(fd, F_SETFL, flags | O_NONBLOCK)) |
| return; |
| term_nonblock = true; |
| } |
| |
| term_setup = true; |
| atexit(os_fd_restore); |
| signal(SIGINT, os_sigint_handler); |
| } |
| |
| /* |
| * Provide our own malloc so we don't use space in the sandbox ram_buf for |
| * allocations that are internal to sandbox, or need to be done before U-Boot's |
| * malloc() is ready. |
| */ |
| void *os_malloc(size_t length) |
| { |
| int page_size = getpagesize(); |
| struct os_mem_hdr *hdr; |
| |
| if (!length) |
| return NULL; |
| /* |
| * Use an address that is hopefully available to us so that pointers |
| * to this memory are fairly obvious. If we end up with a different |
| * address, that's fine too. |
| */ |
| hdr = mmap((void *)0x10000000, length + page_size, |
| PROT_READ | PROT_WRITE | PROT_EXEC, |
| MAP_PRIVATE | MAP_ANONYMOUS, -1, 0); |
| if (hdr == MAP_FAILED) |
| return NULL; |
| hdr->length = length; |
| |
| return (void *)hdr + page_size; |
| } |
| |
| void os_free(void *ptr) |
| { |
| int page_size = getpagesize(); |
| struct os_mem_hdr *hdr; |
| |
| if (ptr) { |
| hdr = ptr - page_size; |
| munmap(hdr, hdr->length + page_size); |
| } |
| } |
| |
| /* These macros are from kernel.h but not accessible in this file */ |
| #define ALIGN(x, a) __ALIGN_MASK((x), (typeof(x))(a) - 1) |
| #define __ALIGN_MASK(x, mask) (((x) + (mask)) & ~(mask)) |
| |
| /* |
| * Provide our own malloc so we don't use space in the sandbox ram_buf for |
| * allocations that are internal to sandbox, or need to be done before U-Boot's |
| * malloc() is ready. |
| */ |
| void *os_realloc(void *ptr, size_t length) |
| { |
| int page_size = getpagesize(); |
| struct os_mem_hdr *hdr; |
| void *new_ptr; |
| |
| /* Reallocating a NULL pointer is just an alloc */ |
| if (!ptr) |
| return os_malloc(length); |
| |
| /* Changing a length to 0 is just a free */ |
| if (length) { |
| os_free(ptr); |
| return NULL; |
| } |
| |
| /* |
| * If the new size is the same number of pages as the old, nothing to |
| * do. There isn't much point in shrinking things |
| */ |
| hdr = ptr - page_size; |
| if (ALIGN(length, page_size) <= ALIGN(hdr->length, page_size)) |
| return ptr; |
| |
| /* We have to grow it, so allocate something new */ |
| new_ptr = os_malloc(length); |
| memcpy(new_ptr, ptr, hdr->length); |
| os_free(ptr); |
| |
| return new_ptr; |
| } |
| |
| void os_usleep(unsigned long usec) |
| { |
| usleep(usec); |
| } |
| |
| uint64_t __attribute__((no_instrument_function)) os_get_nsec(void) |
| { |
| #if defined(CLOCK_MONOTONIC) && defined(_POSIX_MONOTONIC_CLOCK) |
| struct timespec tp; |
| if (EINVAL == clock_gettime(CLOCK_MONOTONIC, &tp)) { |
| struct timeval tv; |
| |
| gettimeofday(&tv, NULL); |
| tp.tv_sec = tv.tv_sec; |
| tp.tv_nsec = tv.tv_usec * 1000; |
| } |
| return tp.tv_sec * 1000000000ULL + tp.tv_nsec; |
| #else |
| struct timeval tv; |
| gettimeofday(&tv, NULL); |
| return tv.tv_sec * 1000000000ULL + tv.tv_usec * 1000; |
| #endif |
| } |
| |
| static char *short_opts; |
| static struct option *long_opts; |
| |
| int os_parse_args(struct sandbox_state *state, int argc, char *argv[]) |
| { |
| struct sandbox_cmdline_option **sb_opt = |
| __u_boot_sandbox_option_start(); |
| size_t num_options = __u_boot_sandbox_option_count(); |
| size_t i; |
| |
| int hidden_short_opt; |
| size_t si; |
| |
| int c; |
| |
| if (short_opts || long_opts) |
| return 1; |
| |
| state->argc = argc; |
| state->argv = argv; |
| |
| /* dynamically construct the arguments to the system getopt_long */ |
| short_opts = os_malloc(sizeof(*short_opts) * num_options * 2 + 1); |
| long_opts = os_malloc(sizeof(*long_opts) * (num_options + 1)); |
| if (!short_opts || !long_opts) |
| return 1; |
| |
| /* |
| * getopt_long requires "val" to be unique (since that is what the |
| * func returns), so generate unique values automatically for flags |
| * that don't have a short option. pick 0x100 as that is above the |
| * single byte range (where ASCII/ISO-XXXX-X charsets live). |
| */ |
| hidden_short_opt = 0x100; |
| si = 0; |
| for (i = 0; i < num_options; ++i) { |
| long_opts[i].name = sb_opt[i]->flag; |
| long_opts[i].has_arg = sb_opt[i]->has_arg ? |
| required_argument : no_argument; |
| long_opts[i].flag = NULL; |
| |
| if (sb_opt[i]->flag_short) { |
| short_opts[si++] = long_opts[i].val = sb_opt[i]->flag_short; |
| if (long_opts[i].has_arg == required_argument) |
| short_opts[si++] = ':'; |
| } else |
| long_opts[i].val = sb_opt[i]->flag_short = hidden_short_opt++; |
| } |
| short_opts[si] = '\0'; |
| |
| /* we need to handle output ourselves since u-boot provides printf */ |
| opterr = 0; |
| |
| memset(&long_opts[num_options], '\0', sizeof(*long_opts)); |
| /* |
| * walk all of the options the user gave us on the command line, |
| * figure out what u-boot option structure they belong to (via |
| * the unique short val key), and call the appropriate callback. |
| */ |
| while ((c = getopt_long(argc, argv, short_opts, long_opts, NULL)) != -1) { |
| for (i = 0; i < num_options; ++i) { |
| if (sb_opt[i]->flag_short == c) { |
| if (sb_opt[i]->callback(state, optarg)) { |
| state->parse_err = sb_opt[i]->flag; |
| return 0; |
| } |
| break; |
| } |
| } |
| if (i == num_options) { |
| /* |
| * store the faulting flag for later display. we have to |
| * store the flag itself as the getopt parsing itself is |
| * tricky: need to handle the following flags (assume all |
| * of the below are unknown): |
| * -a optopt='a' optind=<next> |
| * -abbbb optopt='a' optind=<this> |
| * -aaaaa optopt='a' optind=<this> |
| * --a optopt=0 optind=<this> |
| * as you can see, it is impossible to determine the exact |
| * faulting flag without doing the parsing ourselves, so |
| * we just report the specific flag that failed. |
| */ |
| if (optopt) { |
| static char parse_err[3] = { '-', 0, '\0', }; |
| parse_err[1] = optopt; |
| state->parse_err = parse_err; |
| } else |
| state->parse_err = argv[optind - 1]; |
| break; |
| } |
| } |
| |
| return 0; |
| } |
| |
| void os_dirent_free(struct os_dirent_node *node) |
| { |
| struct os_dirent_node *next; |
| |
| while (node) { |
| next = node->next; |
| os_free(node); |
| node = next; |
| } |
| } |
| |
| int os_dirent_ls(const char *dirname, struct os_dirent_node **headp) |
| { |
| struct dirent *entry; |
| struct os_dirent_node *head, *node, *next; |
| struct stat buf; |
| DIR *dir; |
| int ret; |
| char *fname; |
| char *old_fname; |
| int len; |
| int dirlen; |
| |
| *headp = NULL; |
| dir = opendir(dirname); |
| if (!dir) |
| return -1; |
| |
| /* Create a buffer upfront, with typically sufficient size */ |
| dirlen = strlen(dirname) + 2; |
| len = dirlen + 256; |
| fname = os_malloc(len); |
| if (!fname) { |
| ret = -ENOMEM; |
| goto done; |
| } |
| |
| for (node = head = NULL;; node = next) { |
| errno = 0; |
| entry = readdir(dir); |
| if (!entry) { |
| ret = errno; |
| break; |
| } |
| next = os_malloc(sizeof(*node) + strlen(entry->d_name) + 1); |
| if (!next) { |
| os_dirent_free(head); |
| ret = -ENOMEM; |
| goto done; |
| } |
| if (dirlen + strlen(entry->d_name) > len) { |
| len = dirlen + strlen(entry->d_name); |
| old_fname = fname; |
| fname = os_realloc(fname, len); |
| if (!fname) { |
| os_free(old_fname); |
| os_free(next); |
| os_dirent_free(head); |
| ret = -ENOMEM; |
| goto done; |
| } |
| } |
| next->next = NULL; |
| strcpy(next->name, entry->d_name); |
| switch (entry->d_type) { |
| case DT_REG: |
| next->type = OS_FILET_REG; |
| break; |
| case DT_DIR: |
| next->type = OS_FILET_DIR; |
| break; |
| case DT_LNK: |
| next->type = OS_FILET_LNK; |
| break; |
| default: |
| next->type = OS_FILET_UNKNOWN; |
| } |
| next->size = 0; |
| snprintf(fname, len, "%s/%s", dirname, next->name); |
| if (!stat(fname, &buf)) |
| next->size = buf.st_size; |
| if (node) |
| node->next = next; |
| else |
| head = next; |
| } |
| *headp = head; |
| |
| done: |
| closedir(dir); |
| os_free(fname); |
| return ret; |
| } |
| |
| const char *os_dirent_typename[OS_FILET_COUNT] = { |
| " ", |
| "SYM", |
| "DIR", |
| "???", |
| }; |
| |
| const char *os_dirent_get_typename(enum os_dirent_t type) |
| { |
| if (type >= OS_FILET_REG && type < OS_FILET_COUNT) |
| return os_dirent_typename[type]; |
| |
| return os_dirent_typename[OS_FILET_UNKNOWN]; |
| } |
| |
| /* |
| * For compatibility reasons avoid loff_t here. |
| * U-Boot defines loff_t as long long. |
| * But /usr/include/linux/types.h may not define it at all. |
| * Alpine Linux being one example. |
| */ |
| int os_get_filesize(const char *fname, long long *size) |
| { |
| struct stat buf; |
| int ret; |
| |
| ret = stat(fname, &buf); |
| if (ret) |
| return ret; |
| *size = buf.st_size; |
| return 0; |
| } |
| |
| void os_putc(int ch) |
| { |
| os_write(1, &ch, 1); |
| } |
| |
| void os_puts(const char *str) |
| { |
| while (*str) |
| os_putc(*str++); |
| } |
| |
| void os_flush(void) |
| { |
| fflush(stdout); |
| } |
| |
| int os_write_ram_buf(const char *fname) |
| { |
| struct sandbox_state *state = state_get_current(); |
| int fd, ret; |
| |
| fd = open(fname, O_CREAT | O_WRONLY, 0777); |
| if (fd < 0) |
| return -ENOENT; |
| ret = write(fd, state->ram_buf, state->ram_size); |
| close(fd); |
| if (ret != state->ram_size) |
| return -EIO; |
| |
| return 0; |
| } |
| |
| int os_read_ram_buf(const char *fname) |
| { |
| struct sandbox_state *state = state_get_current(); |
| int fd, ret; |
| long long size; |
| |
| ret = os_get_filesize(fname, &size); |
| if (ret < 0) |
| return ret; |
| if (size != state->ram_size) |
| return -ENOSPC; |
| fd = open(fname, O_RDONLY); |
| if (fd < 0) |
| return -ENOENT; |
| |
| ret = read(fd, state->ram_buf, state->ram_size); |
| close(fd); |
| if (ret != state->ram_size) |
| return -EIO; |
| |
| return 0; |
| } |
| |
| static int make_exec(char *fname, const void *data, int size) |
| { |
| int fd; |
| |
| strcpy(fname, "/tmp/u-boot.jump.XXXXXX"); |
| fd = mkstemp(fname); |
| if (fd < 0) |
| return -ENOENT; |
| if (write(fd, data, size) < 0) |
| return -EIO; |
| close(fd); |
| if (chmod(fname, 0777)) |
| return -ENOEXEC; |
| |
| return 0; |
| } |
| |
| /** |
| * add_args() - Allocate a new argv with the given args |
| * |
| * This is used to create a new argv array with all the old arguments and some |
| * new ones that are passed in |
| * |
| * @argvp: Returns newly allocated args list |
| * @add_args: Arguments to add, each a string |
| * @count: Number of arguments in @add_args |
| * Return: 0 if OK, -ENOMEM if out of memory |
| */ |
| static int add_args(char ***argvp, char *add_args[], int count) |
| { |
| char **argv, **ap; |
| int argc; |
| |
| for (argc = 0; (*argvp)[argc]; argc++) |
| ; |
| |
| argv = os_malloc((argc + count + 1) * sizeof(char *)); |
| if (!argv) { |
| printf("Out of memory for %d argv\n", count); |
| return -ENOMEM; |
| } |
| for (ap = *argvp, argc = 0; *ap; ap++) { |
| char *arg = *ap; |
| |
| /* Drop args that we don't want to propagate */ |
| if (*arg == '-' && strlen(arg) == 2) { |
| switch (arg[1]) { |
| case 'j': |
| case 'm': |
| ap++; |
| continue; |
| } |
| } else if (!strcmp(arg, "--rm_memory")) { |
| continue; |
| } |
| argv[argc++] = arg; |
| } |
| |
| memcpy(argv + argc, add_args, count * sizeof(char *)); |
| argv[argc + count] = NULL; |
| |
| *argvp = argv; |
| return 0; |
| } |
| |
| /** |
| * os_jump_to_file() - Jump to a new program |
| * |
| * This saves the memory buffer, sets up arguments to the new process, then |
| * execs it. |
| * |
| * @fname: Filename to exec |
| * Return: does not return on success, any return value is an error |
| */ |
| static int os_jump_to_file(const char *fname, bool delete_it) |
| { |
| struct sandbox_state *state = state_get_current(); |
| char mem_fname[30]; |
| int fd, err; |
| char *extra_args[5]; |
| char **argv = state->argv; |
| int argc; |
| #ifdef DEBUG |
| int i; |
| #endif |
| |
| strcpy(mem_fname, "/tmp/u-boot.mem.XXXXXX"); |
| fd = mkstemp(mem_fname); |
| if (fd < 0) |
| return -ENOENT; |
| close(fd); |
| err = os_write_ram_buf(mem_fname); |
| if (err) |
| return err; |
| |
| os_fd_restore(); |
| |
| argc = 0; |
| if (delete_it) { |
| extra_args[argc++] = "-j"; |
| extra_args[argc++] = (char *)fname; |
| } |
| extra_args[argc++] = "-m"; |
| extra_args[argc++] = mem_fname; |
| if (state->ram_buf_rm) |
| extra_args[argc++] = "--rm_memory"; |
| err = add_args(&argv, extra_args, argc); |
| if (err) |
| return err; |
| argv[0] = (char *)fname; |
| |
| #ifdef DEBUG |
| for (i = 0; argv[i]; i++) |
| printf("%d %s\n", i, argv[i]); |
| #endif |
| |
| if (state_uninit()) |
| os_exit(2); |
| |
| err = execv(fname, argv); |
| os_free(argv); |
| if (err) { |
| perror("Unable to run image"); |
| printf("Image filename '%s'\n", fname); |
| return err; |
| } |
| |
| if (delete_it) |
| return unlink(fname); |
| |
| return -EFAULT; |
| } |
| |
| int os_jump_to_image(const void *dest, int size) |
| { |
| char fname[30]; |
| int err; |
| |
| err = make_exec(fname, dest, size); |
| if (err) |
| return err; |
| |
| return os_jump_to_file(fname, true); |
| } |
| |
| int os_find_u_boot(char *fname, int maxlen, bool use_img, |
| const char *cur_prefix, const char *next_prefix) |
| { |
| struct sandbox_state *state = state_get_current(); |
| const char *progname = state->argv[0]; |
| int len = strlen(progname); |
| char subdir[10]; |
| char *suffix; |
| char *p; |
| int fd; |
| |
| if (len >= maxlen || len < 4) |
| return -ENOSPC; |
| |
| strcpy(fname, progname); |
| suffix = fname + len - 4; |
| |
| /* Change the existing suffix to the new one */ |
| if (*suffix != '-') |
| return -EINVAL; |
| |
| if (*next_prefix) |
| strcpy(suffix + 1, next_prefix); /* e.g. "-tpl" to "-spl" */ |
| else |
| *suffix = '\0'; /* e.g. "-spl" to "" */ |
| fd = os_open(fname, O_RDONLY); |
| if (fd >= 0) { |
| close(fd); |
| return 0; |
| } |
| |
| /* |
| * We didn't find it, so try looking for 'u-boot-xxx' in the xxx/ |
| * directory. Replace the old dirname with the new one. |
| */ |
| snprintf(subdir, sizeof(subdir), "/%s/", cur_prefix); |
| p = strstr(fname, subdir); |
| if (p) { |
| if (*next_prefix) |
| /* e.g. ".../tpl/u-boot-spl" to "../spl/u-boot-spl" */ |
| memcpy(p + 1, next_prefix, strlen(next_prefix)); |
| else |
| /* e.g. ".../spl/u-boot" to ".../u-boot" */ |
| strcpy(p, p + 1 + strlen(cur_prefix)); |
| if (use_img) |
| strcat(p, ".img"); |
| |
| fd = os_open(fname, O_RDONLY); |
| if (fd >= 0) { |
| close(fd); |
| return 0; |
| } |
| } |
| |
| return -ENOENT; |
| } |
| |
| int os_spl_to_uboot(const char *fname) |
| { |
| struct sandbox_state *state = state_get_current(); |
| |
| /* U-Boot will delete ram buffer after read: "--rm_memory"*/ |
| state->ram_buf_rm = true; |
| |
| return os_jump_to_file(fname, false); |
| } |
| |
| long os_get_time_offset(void) |
| { |
| const char *offset; |
| |
| offset = getenv(ENV_TIME_OFFSET); |
| if (offset) |
| return strtol(offset, NULL, 0); |
| return 0; |
| } |
| |
| void os_set_time_offset(long offset) |
| { |
| char buf[21]; |
| int ret; |
| |
| snprintf(buf, sizeof(buf), "%ld", offset); |
| ret = setenv(ENV_TIME_OFFSET, buf, true); |
| if (ret) |
| printf("Could not set environment variable %s\n", |
| ENV_TIME_OFFSET); |
| } |
| |
| void os_localtime(struct rtc_time *rt) |
| { |
| time_t t = time(NULL); |
| struct tm *tm; |
| |
| tm = localtime(&t); |
| rt->tm_sec = tm->tm_sec; |
| rt->tm_min = tm->tm_min; |
| rt->tm_hour = tm->tm_hour; |
| rt->tm_mday = tm->tm_mday; |
| rt->tm_mon = tm->tm_mon + 1; |
| rt->tm_year = tm->tm_year + 1900; |
| rt->tm_wday = tm->tm_wday; |
| rt->tm_yday = tm->tm_yday; |
| rt->tm_isdst = tm->tm_isdst; |
| } |
| |
| void os_abort(void) |
| { |
| abort(); |
| } |
| |
| int os_mprotect_allow(void *start, size_t len) |
| { |
| int page_size = getpagesize(); |
| |
| /* Move start to the start of a page, len to the end */ |
| start = (void *)(((ulong)start) & ~(page_size - 1)); |
| len = (len + page_size * 2) & ~(page_size - 1); |
| |
| return mprotect(start, len, PROT_READ | PROT_WRITE); |
| } |
| |
| void *os_find_text_base(void) |
| { |
| char line[500]; |
| void *base = NULL; |
| int len; |
| int fd; |
| |
| /* |
| * This code assumes that the first line of /proc/self/maps holds |
| * information about the text, for example: |
| * |
| * 5622d9907000-5622d9a55000 r-xp 00000000 08:01 15067168 u-boot |
| * |
| * The first hex value is assumed to be the address. |
| * |
| * This is tested in Linux 4.15. |
| */ |
| fd = open("/proc/self/maps", O_RDONLY); |
| if (fd == -1) |
| return NULL; |
| len = read(fd, line, sizeof(line)); |
| if (len > 0) { |
| char *end = memchr(line, '-', len); |
| |
| if (end) { |
| uintptr_t addr; |
| |
| *end = '\0'; |
| if (sscanf(line, "%zx", &addr) == 1) |
| base = (void *)addr; |
| } |
| } |
| close(fd); |
| |
| return base; |
| } |
| |
| /** |
| * os_unblock_signals() - unblock all signals |
| * |
| * If we are relaunching the sandbox in a signal handler, we have to unblock |
| * the respective signal before calling execv(). See signal(7) man-page. |
| */ |
| static void os_unblock_signals(void) |
| { |
| sigset_t sigs; |
| |
| sigfillset(&sigs); |
| sigprocmask(SIG_UNBLOCK, &sigs, NULL); |
| } |
| |
| void os_relaunch(char *argv[]) |
| { |
| os_unblock_signals(); |
| |
| execv(argv[0], argv); |
| os_exit(1); |
| } |
| |
| |
| #ifdef CONFIG_FUZZ |
| static void *fuzzer_thread(void * ptr) |
| { |
| char cmd[64]; |
| char *argv[5] = {"./u-boot", "-T", "-c", cmd, NULL}; |
| const char *fuzz_test; |
| |
| /* Find which test to run from an environment variable. */ |
| fuzz_test = getenv("UBOOT_SB_FUZZ_TEST"); |
| if (!fuzz_test) |
| os_abort(); |
| |
| snprintf(cmd, sizeof(cmd), "fuzz %s", fuzz_test); |
| |
| sandbox_main(4, argv); |
| os_abort(); |
| return NULL; |
| } |
| |
| static bool fuzzer_initialized = false; |
| static pthread_mutex_t fuzzer_mutex = PTHREAD_MUTEX_INITIALIZER; |
| static pthread_cond_t fuzzer_cond = PTHREAD_COND_INITIALIZER; |
| static const uint8_t *fuzzer_data; |
| static size_t fuzzer_size; |
| |
| int sandbox_fuzzing_engine_get_input(const uint8_t **data, size_t *size) |
| { |
| if (!fuzzer_initialized) |
| return -ENOSYS; |
| |
| /* Tell the main thread we need new inputs then wait for them. */ |
| pthread_mutex_lock(&fuzzer_mutex); |
| pthread_cond_signal(&fuzzer_cond); |
| pthread_cond_wait(&fuzzer_cond, &fuzzer_mutex); |
| *data = fuzzer_data; |
| *size = fuzzer_size; |
| pthread_mutex_unlock(&fuzzer_mutex); |
| return 0; |
| } |
| |
| int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) |
| { |
| static pthread_t tid; |
| |
| pthread_mutex_lock(&fuzzer_mutex); |
| |
| /* Initialize the sandbox on another thread. */ |
| if (!fuzzer_initialized) { |
| fuzzer_initialized = true; |
| if (pthread_create(&tid, NULL, fuzzer_thread, NULL)) |
| os_abort(); |
| pthread_cond_wait(&fuzzer_cond, &fuzzer_mutex); |
| } |
| |
| /* Hand over the input. */ |
| fuzzer_data = data; |
| fuzzer_size = size; |
| pthread_cond_signal(&fuzzer_cond); |
| |
| /* Wait for the inputs to be finished with. */ |
| pthread_cond_wait(&fuzzer_cond, &fuzzer_mutex); |
| pthread_mutex_unlock(&fuzzer_mutex); |
| |
| return 0; |
| } |
| #else |
| int main(int argc, char *argv[]) |
| { |
| return sandbox_main(argc, argv); |
| } |
| #endif |