1 //! Generate a configuration for both Wasmtime and the Wasm module to execute. 2 3 use super::{ 4 AsyncConfig, CodegenSettings, InstanceAllocationStrategy, MemoryConfig, ModuleConfig, 5 NormalMemoryConfig, UnalignedMemoryCreator, 6 }; 7 use crate::oracles::{StoreLimits, Timeout}; 8 use anyhow::Result; 9 use arbitrary::{Arbitrary, Unstructured}; 10 use std::sync::Arc; 11 use std::time::Duration; 12 use wasmtime::{Engine, Module, Store}; 13 14 /// Configuration for `wasmtime::Config` and generated modules for a session of 15 /// fuzzing. 16 /// 17 /// This configuration guides what modules are generated, how wasmtime 18 /// configuration is generated, and is typically itself generated through a call 19 /// to `Arbitrary` which allows for a form of "swarm testing". 20 #[derive(Debug, Clone)] 21 pub struct Config { 22 /// Configuration related to the `wasmtime::Config`. 23 pub wasmtime: WasmtimeConfig, 24 /// Configuration related to generated modules. 25 pub module_config: ModuleConfig, 26 } 27 28 impl Config { 29 /// Indicates that this configuration is being used for differential 30 /// execution. 31 /// 32 /// The purpose of this function is to update the configuration which was 33 /// generated to be compatible with execution in multiple engines. The goal 34 /// is to produce the exact same result in all engines so we need to paper 35 /// over things like nan differences and memory/table behavior differences. 36 pub fn set_differential_config(&mut self) { 37 let config = &mut self.module_config.config; 38 39 // Make it more likely that there are types available to generate a 40 // function with. 41 config.min_types = config.min_types.max(1); 42 config.max_types = config.max_types.max(1); 43 44 // Generate at least one function 45 config.min_funcs = config.min_funcs.max(1); 46 config.max_funcs = config.max_funcs.max(1); 47 48 // Allow a memory to be generated, but don't let it get too large. 49 // Additionally require the maximum size to guarantee that the growth 50 // behavior is consistent across engines. 51 config.max_memory32_bytes = 10 << 16; 52 config.max_memory64_bytes = 10 << 16; 53 config.memory_max_size_required = true; 54 55 // If tables are generated make sure they don't get too large to avoid 56 // hitting any engine-specific limit. Additionally ensure that the 57 // maximum size is required to guarantee consistent growth across 58 // engines. 59 // 60 // Note that while reference types are disabled below, only allow one 61 // table. 62 config.max_table_elements = 1_000; 63 config.table_max_size_required = true; 64 65 // Don't allow any imports 66 config.max_imports = 0; 67 68 // Try to get the function and the memory exported 69 config.export_everything = true; 70 71 // NaN is canonicalized at the wasm level for differential fuzzing so we 72 // can paper over NaN differences between engines. 73 config.canonicalize_nans = true; 74 75 // If using the pooling allocator, update the instance limits too 76 if let InstanceAllocationStrategy::Pooling(pooling) = &mut self.wasmtime.strategy { 77 // One single-page memory 78 pooling.total_memories = config.max_memories as u32; 79 pooling.max_memory_size = 10 << 16; 80 pooling.max_memories_per_module = config.max_memories as u32; 81 82 pooling.total_tables = config.max_tables as u32; 83 pooling.table_elements = 1_000; 84 pooling.max_tables_per_module = config.max_tables as u32; 85 86 pooling.core_instance_size = 1_000_000; 87 88 if let MemoryConfig::Normal(cfg) = &mut self.wasmtime.memory_config { 89 match &mut cfg.static_memory_maximum_size { 90 Some(size) => *size = (*size).max(pooling.max_memory_size as u64), 91 other @ None => *other = Some(pooling.max_memory_size as u64), 92 } 93 } 94 } 95 } 96 97 /// Uses this configuration and the supplied source of data to generate 98 /// a wasm module. 99 /// 100 /// If a `default_fuel` is provided, the resulting module will be configured 101 /// to ensure termination; as doing so will add an additional global to the module, 102 /// the pooling allocator, if configured, will also have its globals limit updated. 103 pub fn generate( 104 &self, 105 input: &mut Unstructured<'_>, 106 default_fuel: Option<u32>, 107 ) -> arbitrary::Result<wasm_smith::Module> { 108 self.module_config.generate(input, default_fuel) 109 } 110 111 /// Tests whether this configuration is capable of running all wast tests. 112 pub fn is_wast_test_compliant(&self) -> bool { 113 let config = &self.module_config.config; 114 115 // Check for wasm features that must be disabled to run spec tests 116 if config.memory64_enabled { 117 return false; 118 } 119 120 // Check for wasm features that must be enabled to run spec tests 121 if !config.bulk_memory_enabled 122 || !config.reference_types_enabled 123 || !config.multi_value_enabled 124 || !config.simd_enabled 125 || !config.threads_enabled 126 || config.max_memories <= 1 127 { 128 return false; 129 } 130 131 // Make sure the runtime limits allow for the instantiation of all spec 132 // tests. Note that the max memories must be precisely one since 0 won't 133 // instantiate spec tests and more than one is multi-memory which is 134 // disabled for spec tests. 135 if config.max_memories != 1 || config.max_tables < 5 { 136 return false; 137 } 138 139 if let InstanceAllocationStrategy::Pooling(pooling) = &self.wasmtime.strategy { 140 // Check to see if any item limit is less than the required 141 // threshold to execute the spec tests. 142 if pooling.total_memories < 1 143 || pooling.total_tables < 5 144 || pooling.table_elements < 1_000 145 || pooling.max_memory_size < (900 << 16) 146 || pooling.total_core_instances < 500 147 || pooling.core_instance_size < 64 * 1024 148 { 149 return false; 150 } 151 } 152 153 true 154 } 155 156 /// Converts this to a `wasmtime::Config` object 157 pub fn to_wasmtime(&self) -> wasmtime::Config { 158 crate::init_fuzzing(); 159 log::debug!("creating wasmtime config with {:#?}", self.wasmtime); 160 161 let mut cfg = wasmtime::Config::new(); 162 cfg.wasm_bulk_memory(true) 163 .wasm_reference_types(true) 164 .wasm_multi_value(self.module_config.config.multi_value_enabled) 165 .wasm_multi_memory(self.module_config.config.max_memories > 1) 166 .wasm_simd(self.module_config.config.simd_enabled) 167 .wasm_memory64(self.module_config.config.memory64_enabled) 168 .wasm_tail_call(self.module_config.config.tail_call_enabled) 169 .wasm_custom_page_sizes(self.module_config.config.custom_page_sizes_enabled) 170 .wasm_threads(self.module_config.config.threads_enabled) 171 .native_unwind_info(cfg!(target_os = "windows") || self.wasmtime.native_unwind_info) 172 .cranelift_nan_canonicalization(self.wasmtime.canonicalize_nans) 173 .cranelift_opt_level(self.wasmtime.opt_level.to_wasmtime()) 174 .consume_fuel(self.wasmtime.consume_fuel) 175 .epoch_interruption(self.wasmtime.epoch_interruption) 176 .memory_guaranteed_dense_image_size(std::cmp::min( 177 // Clamp this at 16MiB so we don't get huge in-memory 178 // images during fuzzing. 179 16 << 20, 180 self.wasmtime.memory_guaranteed_dense_image_size, 181 )) 182 .allocation_strategy(self.wasmtime.strategy.to_wasmtime()) 183 .generate_address_map(self.wasmtime.generate_address_map); 184 185 if !self.module_config.config.simd_enabled { 186 cfg.wasm_relaxed_simd(false); 187 } 188 189 let compiler_strategy = &self.wasmtime.compiler_strategy; 190 let cranelift_strategy = *compiler_strategy == CompilerStrategy::Cranelift; 191 cfg.strategy(self.wasmtime.compiler_strategy.to_wasmtime()); 192 193 self.wasmtime.codegen.configure(&mut cfg); 194 195 // Determine whether we will actually enable PCC -- this is 196 // disabled if the module requires memory64, which is not yet 197 // compatible (due to the need for dynamic checks). 198 let pcc = cfg!(feature = "fuzz-pcc") 199 && self.wasmtime.pcc 200 && !self.module_config.config.memory64_enabled; 201 202 // Only set cranelift specific flags when the Cranelift strategy is 203 // chosen. 204 if cranelift_strategy { 205 // If the wasm-smith-generated module use nan canonicalization then we 206 // don't need to enable it, but if it doesn't enable it already then we 207 // enable this codegen option. 208 cfg.cranelift_nan_canonicalization(!self.module_config.config.canonicalize_nans); 209 210 // Enabling the verifier will at-least-double compilation time, which 211 // with a 20-30x slowdown in fuzzing can cause issues related to 212 // timeouts. If generated modules can have more than a small handful of 213 // functions then disable the verifier when fuzzing to try to lessen the 214 // impact of timeouts. 215 if self.module_config.config.max_funcs > 10 { 216 cfg.cranelift_debug_verifier(false); 217 } 218 219 if self.wasmtime.force_jump_veneers { 220 unsafe { 221 cfg.cranelift_flag_set("wasmtime_linkopt_force_jump_veneer", "true"); 222 } 223 } 224 225 if let Some(pad) = self.wasmtime.padding_between_functions { 226 unsafe { 227 cfg.cranelift_flag_set( 228 "wasmtime_linkopt_padding_between_functions", 229 &pad.to_string(), 230 ); 231 } 232 } 233 234 cfg.cranelift_pcc(pcc); 235 236 // Eager init is currently only supported on Cranelift, not Winch. 237 cfg.table_lazy_init(self.wasmtime.table_lazy_init); 238 } 239 240 self.wasmtime.async_config.configure(&mut cfg); 241 242 // Vary the memory configuration, but only if threads are not enabled. 243 // When the threads proposal is enabled we might generate shared memory, 244 // which is less amenable to different memory configurations: 245 // - shared memories are required to be "static" so fuzzing the various 246 // memory configurations will mostly result in uninteresting errors. 247 // The interesting part about shared memories is the runtime so we 248 // don't fuzz non-default settings. 249 // - shared memories are required to be aligned which means that the 250 // `CustomUnaligned` variant isn't actually safe to use with a shared 251 // memory. 252 if !self.module_config.config.threads_enabled { 253 // If PCC is enabled, force other options to be compatible: PCC is currently only 254 // supported when bounds checks are elided. 255 let memory_config = if pcc { 256 MemoryConfig::Normal(NormalMemoryConfig { 257 static_memory_maximum_size: Some(4 << 30), // 4 GiB 258 static_memory_guard_size: Some(2 << 30), // 2 GiB 259 dynamic_memory_guard_size: Some(0), 260 dynamic_memory_reserved_for_growth: Some(0), 261 guard_before_linear_memory: false, 262 memory_init_cow: true, 263 // Doesn't matter, only using virtual memory. 264 cranelift_enable_heap_access_spectre_mitigations: None, 265 }) 266 } else { 267 self.wasmtime.memory_config.clone() 268 }; 269 270 match &memory_config { 271 MemoryConfig::Normal(memory_config) => { 272 memory_config.apply_to(&mut cfg); 273 } 274 MemoryConfig::CustomUnaligned => { 275 cfg.with_host_memory(Arc::new(UnalignedMemoryCreator)) 276 .static_memory_maximum_size(0) 277 .dynamic_memory_guard_size(0) 278 .dynamic_memory_reserved_for_growth(0) 279 .static_memory_guard_size(0) 280 .guard_before_linear_memory(false) 281 .memory_init_cow(false); 282 } 283 } 284 } 285 286 return cfg; 287 } 288 289 /// Convenience function for generating a `Store<T>` using this 290 /// configuration. 291 pub fn to_store(&self) -> Store<StoreLimits> { 292 let engine = Engine::new(&self.to_wasmtime()).unwrap(); 293 let mut store = Store::new(&engine, StoreLimits::new()); 294 self.configure_store(&mut store); 295 store 296 } 297 298 /// Configures a store based on this configuration. 299 pub fn configure_store(&self, store: &mut Store<StoreLimits>) { 300 store.limiter(|s| s as &mut dyn wasmtime::ResourceLimiter); 301 match self.wasmtime.async_config { 302 AsyncConfig::Disabled => { 303 if self.wasmtime.consume_fuel { 304 store.set_fuel(u64::MAX).unwrap(); 305 } 306 if self.wasmtime.epoch_interruption { 307 store.epoch_deadline_trap(); 308 store.set_epoch_deadline(1); 309 } 310 } 311 AsyncConfig::YieldWithFuel(amt) => { 312 assert!(self.wasmtime.consume_fuel); 313 store.fuel_async_yield_interval(Some(amt)).unwrap(); 314 store.set_fuel(amt).unwrap(); 315 } 316 AsyncConfig::YieldWithEpochs { ticks, .. } => { 317 assert!(self.wasmtime.epoch_interruption); 318 store.set_epoch_deadline(ticks); 319 store.epoch_deadline_async_yield_and_update(ticks); 320 } 321 } 322 } 323 324 /// Generates an arbitrary method of timing out an instance, ensuring that 325 /// this configuration supports the returned timeout. 326 pub fn generate_timeout(&mut self, u: &mut Unstructured<'_>) -> arbitrary::Result<Timeout> { 327 let time_duration = Duration::from_millis(100); 328 let timeout = u 329 .choose(&[Timeout::Fuel(100_000), Timeout::Epoch(time_duration)])? 330 .clone(); 331 match &timeout { 332 Timeout::Fuel(..) => { 333 self.wasmtime.consume_fuel = true; 334 } 335 Timeout::Epoch(..) => { 336 self.wasmtime.epoch_interruption = true; 337 } 338 Timeout::None => unreachable!("Not an option given to choose()"), 339 } 340 Ok(timeout) 341 } 342 343 /// Compiles the `wasm` within the `engine` provided. 344 /// 345 /// This notably will use `Module::{serialize,deserialize_file}` to 346 /// round-trip if configured in the fuzzer. 347 pub fn compile(&self, engine: &Engine, wasm: &[u8]) -> Result<Module> { 348 // Propagate this error in case the caller wants to handle 349 // valid-vs-invalid wasm. 350 let module = Module::new(engine, wasm)?; 351 if !self.wasmtime.use_precompiled_cwasm { 352 return Ok(module); 353 } 354 355 // Don't propagate these errors to prevent them from accidentally being 356 // interpreted as invalid wasm, these should never fail on a 357 // well-behaved host system. 358 let dir = tempfile::TempDir::new().unwrap(); 359 let file = dir.path().join("module.wasm"); 360 std::fs::write(&file, module.serialize().unwrap()).unwrap(); 361 unsafe { Ok(Module::deserialize_file(engine, &file).unwrap()) } 362 } 363 364 /// Winch doesn't support the same set of wasm proposal as Cranelift at 365 /// this time, so if winch is selected be sure to disable wasm proposals 366 /// in `Config` to ensure that Winch can compile the module that 367 /// wasm-smith generates. 368 pub fn disable_unimplemented_winch_proposals(&mut self) { 369 self.module_config.config.simd_enabled = false; 370 self.module_config.config.relaxed_simd_enabled = false; 371 self.module_config.config.gc_enabled = false; 372 self.module_config.config.threads_enabled = false; 373 self.module_config.config.tail_call_enabled = false; 374 self.module_config.config.exceptions_enabled = false; 375 self.module_config.config.reference_types_enabled = false; 376 } 377 378 /// Updates this configuration to forcibly enable async support. Only useful 379 /// in fuzzers which do async calls. 380 pub fn enable_async(&mut self, u: &mut Unstructured<'_>) -> arbitrary::Result<()> { 381 if self.wasmtime.consume_fuel || u.arbitrary()? { 382 self.wasmtime.async_config = 383 AsyncConfig::YieldWithFuel(u.int_in_range(1000..=100_000)?); 384 self.wasmtime.consume_fuel = true; 385 } else { 386 self.wasmtime.async_config = AsyncConfig::YieldWithEpochs { 387 dur: Duration::from_millis(u.int_in_range(1..=10)?), 388 ticks: u.int_in_range(1..=10)?, 389 }; 390 self.wasmtime.epoch_interruption = true; 391 } 392 Ok(()) 393 } 394 } 395 396 impl<'a> Arbitrary<'a> for Config { 397 fn arbitrary(u: &mut Unstructured<'a>) -> arbitrary::Result<Self> { 398 let mut config = Self { 399 wasmtime: u.arbitrary()?, 400 module_config: u.arbitrary()?, 401 }; 402 403 if let CompilerStrategy::Winch = config.wasmtime.compiler_strategy { 404 config.disable_unimplemented_winch_proposals(); 405 } 406 407 // Wasm-smith implements the most up-to-date version of memory64 where 408 // it supports 64-bit tables as well, but Wasmtime doesn't support that 409 // yet, so disable the memory64 proposal in fuzzing for now. 410 config.module_config.config.memory64_enabled = false; 411 412 // If using the pooling allocator, constrain the memory and module configurations 413 // to the module limits. 414 if let InstanceAllocationStrategy::Pooling(pooling) = &mut config.wasmtime.strategy { 415 // Forcibly don't use the `CustomUnaligned` memory configuration 416 // with the pooling allocator active. 417 if let MemoryConfig::CustomUnaligned = config.wasmtime.memory_config { 418 config.wasmtime.memory_config = MemoryConfig::Normal(u.arbitrary()?); 419 } 420 421 let cfg = &mut config.module_config.config; 422 // If the pooling allocator is used, do not allow shared memory to 423 // be created. FIXME: see 424 // https://github.com/bytecodealliance/wasmtime/issues/4244. 425 cfg.threads_enabled = false; 426 427 // Ensure the pooling allocator can support the maximal size of 428 // memory, picking the smaller of the two to win. 429 let min_bytes = cfg 430 .max_memory32_bytes 431 // memory64_bytes is a u128, but since we are taking the min 432 // we can truncate it down to a u64. 433 .min(cfg.max_memory64_bytes.try_into().unwrap_or(u64::MAX)); 434 let mut min = min_bytes.min(pooling.max_memory_size as u64); 435 if let MemoryConfig::Normal(cfg) = &config.wasmtime.memory_config { 436 min = min.min(cfg.static_memory_maximum_size.unwrap_or(0)); 437 } 438 pooling.max_memory_size = min as usize; 439 cfg.max_memory32_bytes = min; 440 cfg.max_memory64_bytes = min as u128; 441 442 // If traps are disallowed then memories must have at least one page 443 // of memory so if we still are only allowing 0 pages of memory then 444 // increase that to one here. 445 if cfg.disallow_traps { 446 if pooling.max_memory_size < (1 << 16) { 447 pooling.max_memory_size = 1 << 16; 448 cfg.max_memory32_bytes = 1 << 16; 449 cfg.max_memory64_bytes = 1 << 16; 450 if let MemoryConfig::Normal(cfg) = &mut config.wasmtime.memory_config { 451 match &mut cfg.static_memory_maximum_size { 452 Some(size) => *size = (*size).max(pooling.max_memory_size as u64), 453 size @ None => *size = Some(pooling.max_memory_size as u64), 454 } 455 } 456 } 457 // .. additionally update tables 458 if pooling.table_elements == 0 { 459 pooling.table_elements = 1; 460 } 461 } 462 463 // Don't allow too many linear memories per instance since massive 464 // virtual mappings can fail to get allocated. 465 cfg.min_memories = cfg.min_memories.min(10); 466 cfg.max_memories = cfg.max_memories.min(10); 467 468 // Force this pooling allocator to always be able to accommodate the 469 // module that may be generated. 470 pooling.total_memories = cfg.max_memories as u32; 471 pooling.total_tables = cfg.max_tables as u32; 472 } 473 474 Ok(config) 475 } 476 } 477 478 /// Configuration related to `wasmtime::Config` and the various settings which 479 /// can be tweaked from within. 480 #[derive(Arbitrary, Clone, Debug, Eq, Hash, PartialEq)] 481 pub struct WasmtimeConfig { 482 opt_level: OptLevel, 483 debug_info: bool, 484 canonicalize_nans: bool, 485 interruptable: bool, 486 pub(crate) consume_fuel: bool, 487 pub(crate) epoch_interruption: bool, 488 /// The Wasmtime memory configuration to use. 489 pub memory_config: MemoryConfig, 490 force_jump_veneers: bool, 491 memory_init_cow: bool, 492 memory_guaranteed_dense_image_size: u64, 493 use_precompiled_cwasm: bool, 494 /// Configuration for the instance allocation strategy to use. 495 pub strategy: InstanceAllocationStrategy, 496 codegen: CodegenSettings, 497 padding_between_functions: Option<u16>, 498 generate_address_map: bool, 499 native_unwind_info: bool, 500 /// Configuration for the compiler to use. 501 pub compiler_strategy: CompilerStrategy, 502 table_lazy_init: bool, 503 504 /// Whether or not fuzzing should enable PCC. 505 pcc: bool, 506 507 /// Configuration for whether wasm is invoked in an async fashion and how 508 /// it's cooperatively time-sliced. 509 pub async_config: AsyncConfig, 510 } 511 512 impl WasmtimeConfig { 513 /// Force `self` to be a configuration compatible with `other`. This is 514 /// useful for differential execution to avoid unhelpful fuzz crashes when 515 /// one engine has a feature enabled and the other does not. 516 pub fn make_compatible_with(&mut self, other: &Self) { 517 // Use the same allocation strategy between the two configs. 518 // 519 // Ideally this wouldn't be necessary, but, during differential 520 // evaluation, if the `lhs` is using ondemand and the `rhs` is using the 521 // pooling allocator (or vice versa), then the module may have been 522 // generated in such a way that is incompatible with the other 523 // allocation strategy. 524 // 525 // We can remove this in the future when it's possible to access the 526 // fields of `wasm_smith::Module` to constrain the pooling allocator 527 // based on what was actually generated. 528 self.strategy = other.strategy.clone(); 529 if let InstanceAllocationStrategy::Pooling { .. } = &other.strategy { 530 // Also use the same memory configuration when using the pooling 531 // allocator. 532 self.memory_config = other.memory_config.clone(); 533 } 534 } 535 } 536 537 #[derive(Arbitrary, Clone, Debug, PartialEq, Eq, Hash)] 538 enum OptLevel { 539 None, 540 Speed, 541 SpeedAndSize, 542 } 543 544 impl OptLevel { 545 fn to_wasmtime(&self) -> wasmtime::OptLevel { 546 match self { 547 OptLevel::None => wasmtime::OptLevel::None, 548 OptLevel::Speed => wasmtime::OptLevel::Speed, 549 OptLevel::SpeedAndSize => wasmtime::OptLevel::SpeedAndSize, 550 } 551 } 552 } 553 554 #[derive(Clone, Debug, PartialEq, Eq, Hash)] 555 /// Compiler to use. 556 pub enum CompilerStrategy { 557 /// Cranelift compiler. 558 Cranelift, 559 /// Winch compiler. 560 Winch, 561 } 562 563 impl CompilerStrategy { 564 fn to_wasmtime(&self) -> wasmtime::Strategy { 565 match self { 566 CompilerStrategy::Cranelift => wasmtime::Strategy::Cranelift, 567 CompilerStrategy::Winch => wasmtime::Strategy::Winch, 568 } 569 } 570 } 571 572 impl Arbitrary<'_> for CompilerStrategy { 573 fn arbitrary(_: &mut Unstructured<'_>) -> arbitrary::Result<Self> { 574 // NB: Winch isn't selected here yet as it doesn't yet implement all the 575 // compiler features for things such as trampolines, so it's only used 576 // on fuzz targets that don't need those trampolines. 577 Ok(Self::Cranelift) 578 } 579 } 580