1 //! Generate a configuration for both Wasmtime and the Wasm module to execute. 2 3 use super::{AsyncConfig, CodegenSettings, InstanceAllocationStrategy, MemoryConfig, ModuleConfig}; 4 use crate::oracles::{StoreLimits, Timeout}; 5 use anyhow::Result; 6 use arbitrary::{Arbitrary, Unstructured}; 7 use std::time::Duration; 8 use wasmtime::{Engine, Module, MpkEnabled, Store}; 9 use wasmtime_test_util::wast::{WastConfig, WastTest, limits}; 10 11 /// Configuration for `wasmtime::Config` and generated modules for a session of 12 /// fuzzing. 13 /// 14 /// This configuration guides what modules are generated, how wasmtime 15 /// configuration is generated, and is typically itself generated through a call 16 /// to `Arbitrary` which allows for a form of "swarm testing". 17 #[derive(Debug, Clone)] 18 pub struct Config { 19 /// Configuration related to the `wasmtime::Config`. 20 pub wasmtime: WasmtimeConfig, 21 /// Configuration related to generated modules. 22 pub module_config: ModuleConfig, 23 } 24 25 impl Config { 26 /// Indicates that this configuration is being used for differential 27 /// execution. 28 /// 29 /// The purpose of this function is to update the configuration which was 30 /// generated to be compatible with execution in multiple engines. The goal 31 /// is to produce the exact same result in all engines so we need to paper 32 /// over things like nan differences and memory/table behavior differences. 33 pub fn set_differential_config(&mut self) { 34 let config = &mut self.module_config.config; 35 36 // Make it more likely that there are types available to generate a 37 // function with. 38 config.min_types = config.min_types.max(1); 39 config.max_types = config.max_types.max(1); 40 41 // Generate at least one function 42 config.min_funcs = config.min_funcs.max(1); 43 config.max_funcs = config.max_funcs.max(1); 44 45 // Allow a memory to be generated, but don't let it get too large. 46 // Additionally require the maximum size to guarantee that the growth 47 // behavior is consistent across engines. 48 config.max_memory32_bytes = 10 << 16; 49 config.max_memory64_bytes = 10 << 16; 50 config.memory_max_size_required = true; 51 52 // If tables are generated make sure they don't get too large to avoid 53 // hitting any engine-specific limit. Additionally ensure that the 54 // maximum size is required to guarantee consistent growth across 55 // engines. 56 // 57 // Note that while reference types are disabled below, only allow one 58 // table. 59 config.max_table_elements = 1_000; 60 config.table_max_size_required = true; 61 62 // Don't allow any imports 63 config.max_imports = 0; 64 65 // Try to get the function and the memory exported 66 config.export_everything = true; 67 68 // NaN is canonicalized at the wasm level for differential fuzzing so we 69 // can paper over NaN differences between engines. 70 config.canonicalize_nans = true; 71 72 // If using the pooling allocator, update the instance limits too 73 if let InstanceAllocationStrategy::Pooling(pooling) = &mut self.wasmtime.strategy { 74 // One single-page memory 75 pooling.total_memories = config.max_memories as u32; 76 pooling.max_memory_size = 10 << 16; 77 pooling.max_memories_per_module = config.max_memories as u32; 78 if pooling.memory_protection_keys == MpkEnabled::Auto 79 && pooling.max_memory_protection_keys > 1 80 { 81 pooling.total_memories = 82 pooling.total_memories * (pooling.max_memory_protection_keys as u32); 83 } 84 85 pooling.total_tables = config.max_tables as u32; 86 pooling.table_elements = 1_000; 87 pooling.max_tables_per_module = config.max_tables as u32; 88 89 pooling.core_instance_size = 1_000_000; 90 91 let cfg = &mut self.wasmtime.memory_config; 92 match &mut cfg.memory_reservation { 93 Some(size) => *size = (*size).max(pooling.max_memory_size as u64), 94 other @ None => *other = Some(pooling.max_memory_size as u64), 95 } 96 } 97 98 // These instructions are explicitly not expected to be exactly the same 99 // across engines. Don't fuzz them. 100 config.relaxed_simd_enabled = false; 101 } 102 103 /// Uses this configuration and the supplied source of data to generate 104 /// a wasm module. 105 /// 106 /// If a `default_fuel` is provided, the resulting module will be configured 107 /// to ensure termination; as doing so will add an additional global to the module, 108 /// the pooling allocator, if configured, will also have its globals limit updated. 109 pub fn generate( 110 &self, 111 input: &mut Unstructured<'_>, 112 default_fuel: Option<u32>, 113 ) -> arbitrary::Result<wasm_smith::Module> { 114 self.module_config.generate(input, default_fuel) 115 } 116 117 /// Updates this configuration to be able to run the `test` specified. 118 /// 119 /// This primarily updates `self.module_config` to ensure that it enables 120 /// all features and proposals necessary to execute the `test` specified. 121 /// This will additionally update limits in the pooling allocator to be able 122 /// to execute all tests. 123 pub fn make_wast_test_compliant(&mut self, test: &WastTest) -> WastConfig { 124 let wasmtime_test_util::wast::TestConfig { 125 memory64, 126 custom_page_sizes, 127 multi_memory, 128 threads, 129 shared_everything_threads, 130 gc, 131 function_references, 132 relaxed_simd, 133 reference_types, 134 tail_call, 135 extended_const, 136 wide_arithmetic, 137 component_model_async, 138 component_model_async_builtins, 139 component_model_async_stackful, 140 component_model_error_context, 141 component_model_gc, 142 simd, 143 exceptions, 144 legacy_exceptions, 145 146 hogs_memory: _, 147 nan_canonicalization: _, 148 gc_types: _, 149 stack_switching: _, 150 spec_test: _, 151 } = test.config; 152 153 // Enable/disable some proposals that aren't configurable in wasm-smith 154 // but are configurable in Wasmtime. 155 self.module_config.function_references_enabled = 156 function_references.or(gc).unwrap_or(false); 157 self.module_config.component_model_async = component_model_async.unwrap_or(false); 158 self.module_config.component_model_async_builtins = 159 component_model_async_builtins.unwrap_or(false); 160 self.module_config.component_model_async_stackful = 161 component_model_async_stackful.unwrap_or(false); 162 self.module_config.component_model_error_context = 163 component_model_error_context.unwrap_or(false); 164 self.module_config.legacy_exceptions = legacy_exceptions.unwrap_or(false); 165 self.module_config.component_model_gc = component_model_gc.unwrap_or(false); 166 167 // Enable/disable proposals that wasm-smith has knobs for which will be 168 // read when creating `wasmtime::Config`. 169 let config = &mut self.module_config.config; 170 config.bulk_memory_enabled = true; 171 config.multi_value_enabled = true; 172 config.wide_arithmetic_enabled = wide_arithmetic.unwrap_or(false); 173 config.memory64_enabled = memory64.unwrap_or(false); 174 config.relaxed_simd_enabled = relaxed_simd.unwrap_or(false); 175 config.simd_enabled = config.relaxed_simd_enabled || simd.unwrap_or(false); 176 config.tail_call_enabled = tail_call.unwrap_or(false); 177 config.custom_page_sizes_enabled = custom_page_sizes.unwrap_or(false); 178 config.threads_enabled = threads.unwrap_or(false); 179 config.shared_everything_threads_enabled = shared_everything_threads.unwrap_or(false); 180 config.gc_enabled = gc.unwrap_or(false); 181 config.reference_types_enabled = config.gc_enabled 182 || self.module_config.function_references_enabled 183 || reference_types.unwrap_or(false); 184 config.extended_const_enabled = extended_const.unwrap_or(false); 185 config.exceptions_enabled = exceptions.unwrap_or(false); 186 if multi_memory.unwrap_or(false) { 187 config.max_memories = limits::MEMORIES_PER_MODULE as usize; 188 } else { 189 config.max_memories = 1; 190 } 191 192 if let Some(n) = &mut self.wasmtime.memory_config.memory_reservation { 193 *n = (*n).max(limits::MEMORY_SIZE as u64); 194 } 195 196 // FIXME: it might be more ideal to avoid the need for this entirely 197 // and to just let the test fail. If a test fails due to a pooling 198 // allocator resource limit being met we could ideally detect that and 199 // let the fuzz test case pass. That would avoid the need to hardcode 200 // so much here and in theory wouldn't reduce the usefulness of fuzzers 201 // all that much. At this time though we can't easily test this configuration. 202 if let InstanceAllocationStrategy::Pooling(pooling) = &mut self.wasmtime.strategy { 203 // Clamp protection keys between 1 & 2 to reduce the number of 204 // slots and then multiply the total memories by the number of keys 205 // we have since a single store has access to only one key. 206 pooling.max_memory_protection_keys = pooling.max_memory_protection_keys.max(1).min(2); 207 pooling.total_memories = pooling 208 .total_memories 209 .max(limits::MEMORIES * (pooling.max_memory_protection_keys as u32)); 210 211 // For other limits make sure they meet the minimum threshold 212 // required for our wast tests. 213 pooling.total_component_instances = pooling 214 .total_component_instances 215 .max(limits::COMPONENT_INSTANCES); 216 pooling.total_tables = pooling.total_tables.max(limits::TABLES); 217 pooling.max_tables_per_module = 218 pooling.max_tables_per_module.max(limits::TABLES_PER_MODULE); 219 pooling.max_memories_per_module = pooling 220 .max_memories_per_module 221 .max(limits::MEMORIES_PER_MODULE); 222 pooling.max_memories_per_component = pooling 223 .max_memories_per_component 224 .max(limits::MEMORIES_PER_MODULE); 225 pooling.total_core_instances = pooling.total_core_instances.max(limits::CORE_INSTANCES); 226 pooling.max_memory_size = pooling.max_memory_size.max(limits::MEMORY_SIZE); 227 pooling.table_elements = pooling.table_elements.max(limits::TABLE_ELEMENTS); 228 pooling.core_instance_size = pooling.core_instance_size.max(limits::CORE_INSTANCE_SIZE); 229 pooling.component_instance_size = pooling 230 .component_instance_size 231 .max(limits::CORE_INSTANCE_SIZE); 232 pooling.total_stacks = pooling.total_stacks.max(limits::TOTAL_STACKS); 233 } 234 235 // Return the test configuration that this fuzz configuration represents 236 // which is used afterwards to test if the `test` here is expected to 237 // fail or not. 238 WastConfig { 239 collector: match self.wasmtime.collector { 240 Collector::Null => wasmtime_test_util::wast::Collector::Null, 241 Collector::DeferredReferenceCounting => { 242 wasmtime_test_util::wast::Collector::DeferredReferenceCounting 243 } 244 }, 245 pooling: matches!( 246 self.wasmtime.strategy, 247 InstanceAllocationStrategy::Pooling(_) 248 ), 249 compiler: match self.wasmtime.compiler_strategy { 250 CompilerStrategy::CraneliftNative => { 251 wasmtime_test_util::wast::Compiler::CraneliftNative 252 } 253 CompilerStrategy::CraneliftPulley => { 254 wasmtime_test_util::wast::Compiler::CraneliftPulley 255 } 256 CompilerStrategy::Winch => wasmtime_test_util::wast::Compiler::Winch, 257 }, 258 } 259 } 260 261 /// Converts this to a `wasmtime::Config` object 262 pub fn to_wasmtime(&self) -> wasmtime::Config { 263 crate::init_fuzzing(); 264 265 let mut cfg = wasmtime_cli_flags::CommonOptions::default(); 266 cfg.codegen.native_unwind_info = 267 Some(cfg!(target_os = "windows") || self.wasmtime.native_unwind_info); 268 cfg.codegen.parallel_compilation = Some(false); 269 cfg.debug.address_map = Some(self.wasmtime.generate_address_map); 270 cfg.opts.opt_level = Some(self.wasmtime.opt_level.to_wasmtime()); 271 cfg.opts.regalloc_algorithm = Some(self.wasmtime.regalloc_algorithm.to_wasmtime()); 272 cfg.opts.signals_based_traps = Some(self.wasmtime.signals_based_traps); 273 cfg.opts.memory_guaranteed_dense_image_size = Some(std::cmp::min( 274 // Clamp this at 16MiB so we don't get huge in-memory 275 // images during fuzzing. 276 16 << 20, 277 self.wasmtime.memory_guaranteed_dense_image_size, 278 )); 279 cfg.wasm.async_stack_zeroing = Some(self.wasmtime.async_stack_zeroing); 280 cfg.wasm.bulk_memory = Some(true); 281 cfg.wasm.component_model_async = Some(self.module_config.component_model_async); 282 cfg.wasm.component_model_async_builtins = 283 Some(self.module_config.component_model_async_builtins); 284 cfg.wasm.component_model_async_stackful = 285 Some(self.module_config.component_model_async_stackful); 286 cfg.wasm.component_model_error_context = 287 Some(self.module_config.component_model_error_context); 288 cfg.wasm.component_model_gc = Some(self.module_config.component_model_gc); 289 cfg.wasm.custom_page_sizes = Some(self.module_config.config.custom_page_sizes_enabled); 290 cfg.wasm.epoch_interruption = Some(self.wasmtime.epoch_interruption); 291 cfg.wasm.extended_const = Some(self.module_config.config.extended_const_enabled); 292 cfg.wasm.fuel = self.wasmtime.consume_fuel.then(|| u64::MAX); 293 cfg.wasm.function_references = Some(self.module_config.function_references_enabled); 294 cfg.wasm.gc = Some(self.module_config.config.gc_enabled); 295 cfg.wasm.memory64 = Some(self.module_config.config.memory64_enabled); 296 cfg.wasm.multi_memory = Some(self.module_config.config.max_memories > 1); 297 cfg.wasm.multi_value = Some(self.module_config.config.multi_value_enabled); 298 cfg.wasm.nan_canonicalization = Some(self.wasmtime.canonicalize_nans); 299 cfg.wasm.reference_types = Some(self.module_config.config.reference_types_enabled); 300 cfg.wasm.simd = Some(self.module_config.config.simd_enabled); 301 cfg.wasm.tail_call = Some(self.module_config.config.tail_call_enabled); 302 cfg.wasm.threads = Some(self.module_config.config.threads_enabled); 303 cfg.wasm.shared_everything_threads = 304 Some(self.module_config.config.shared_everything_threads_enabled); 305 cfg.wasm.wide_arithmetic = Some(self.module_config.config.wide_arithmetic_enabled); 306 cfg.wasm.exceptions = Some(self.module_config.config.exceptions_enabled); 307 cfg.wasm.legacy_exceptions = Some(self.module_config.legacy_exceptions); 308 if !self.module_config.config.simd_enabled { 309 cfg.wasm.relaxed_simd = Some(false); 310 } 311 cfg.codegen.collector = Some(self.wasmtime.collector.to_wasmtime()); 312 313 let compiler_strategy = &self.wasmtime.compiler_strategy; 314 let cranelift_strategy = match compiler_strategy { 315 CompilerStrategy::CraneliftNative | CompilerStrategy::CraneliftPulley => true, 316 CompilerStrategy::Winch => false, 317 }; 318 self.wasmtime.compiler_strategy.configure(&mut cfg); 319 320 self.wasmtime.codegen.configure(&mut cfg); 321 322 // Determine whether we will actually enable PCC -- this is 323 // disabled if the module requires memory64, which is not yet 324 // compatible (due to the need for dynamic checks). 325 let pcc = cfg!(feature = "fuzz-pcc") 326 && self.wasmtime.pcc 327 && !self.module_config.config.memory64_enabled; 328 329 // Only set cranelift specific flags when the Cranelift strategy is 330 // chosen. 331 if cranelift_strategy { 332 // If the wasm-smith-generated module use nan canonicalization then we 333 // don't need to enable it, but if it doesn't enable it already then we 334 // enable this codegen option. 335 cfg.wasm.nan_canonicalization = Some(!self.module_config.config.canonicalize_nans); 336 337 // Enabling the verifier will at-least-double compilation time, which 338 // with a 20-30x slowdown in fuzzing can cause issues related to 339 // timeouts. If generated modules can have more than a small handful of 340 // functions then disable the verifier when fuzzing to try to lessen the 341 // impact of timeouts. 342 if self.module_config.config.max_funcs > 10 { 343 cfg.codegen.cranelift_debug_verifier = Some(false); 344 } 345 346 if self.wasmtime.force_jump_veneers { 347 cfg.codegen.cranelift.push(( 348 "wasmtime_linkopt_force_jump_veneer".to_string(), 349 Some("true".to_string()), 350 )); 351 } 352 353 if let Some(pad) = self.wasmtime.padding_between_functions { 354 cfg.codegen.cranelift.push(( 355 "wasmtime_linkopt_padding_between_functions".to_string(), 356 Some(pad.to_string()), 357 )); 358 } 359 360 cfg.codegen.pcc = Some(pcc); 361 362 // Eager init is currently only supported on Cranelift, not Winch. 363 cfg.opts.table_lazy_init = Some(self.wasmtime.table_lazy_init); 364 } 365 366 self.wasmtime.strategy.configure(&mut cfg); 367 368 // Vary the memory configuration, but only if threads are not enabled. 369 // When the threads proposal is enabled we might generate shared memory, 370 // which is less amenable to different memory configurations: 371 // - shared memories are required to be "static" so fuzzing the various 372 // memory configurations will mostly result in uninteresting errors. 373 // The interesting part about shared memories is the runtime so we 374 // don't fuzz non-default settings. 375 // - shared memories are required to be aligned which means that the 376 // `CustomUnaligned` variant isn't actually safe to use with a shared 377 // memory. 378 if !self.module_config.config.threads_enabled { 379 // If PCC is enabled, force other options to be compatible: PCC is currently only 380 // supported when bounds checks are elided. 381 let memory_config = if pcc { 382 MemoryConfig { 383 memory_reservation: Some(4 << 30), // 4 GiB 384 memory_guard_size: Some(2 << 30), // 2 GiB 385 memory_reservation_for_growth: Some(0), 386 guard_before_linear_memory: false, 387 memory_init_cow: true, 388 // Doesn't matter, only using virtual memory. 389 cranelift_enable_heap_access_spectre_mitigations: None, 390 } 391 } else { 392 self.wasmtime.memory_config.clone() 393 }; 394 395 memory_config.configure(&mut cfg); 396 }; 397 398 // If malloc-based memory is going to be used, which requires these four 399 // options set to specific values (and Pulley auto-sets two of them) 400 // then be sure to cap `memory_reservation_for_growth` at a smaller 401 // value than the default. For malloc-based memory reservation beyond 402 // the end of memory isn't captured by `StoreLimiter` so we need to be 403 // sure it's small enough to not blow OOM limits while fuzzing. 404 if ((cfg.opts.signals_based_traps == Some(true) && cfg.opts.memory_guard_size == Some(0)) 405 || self.wasmtime.compiler_strategy == CompilerStrategy::CraneliftPulley) 406 && cfg.opts.memory_reservation == Some(0) 407 && cfg.opts.memory_init_cow == Some(false) 408 { 409 let growth = &mut cfg.opts.memory_reservation_for_growth; 410 let max = 1 << 20; 411 *growth = match *growth { 412 Some(n) => Some(n.min(max)), 413 None => Some(max), 414 }; 415 } 416 417 log::debug!("creating wasmtime config with CLI options:\n{cfg}"); 418 let mut cfg = cfg.config(None).expect("failed to create wasmtime::Config"); 419 420 if self.wasmtime.async_config != AsyncConfig::Disabled { 421 log::debug!("async config in use {:?}", self.wasmtime.async_config); 422 self.wasmtime.async_config.configure(&mut cfg); 423 } 424 425 return cfg; 426 } 427 428 /// Convenience function for generating a `Store<T>` using this 429 /// configuration. 430 pub fn to_store(&self) -> Store<StoreLimits> { 431 let engine = Engine::new(&self.to_wasmtime()).unwrap(); 432 let mut store = Store::new(&engine, StoreLimits::new()); 433 self.configure_store(&mut store); 434 store 435 } 436 437 /// Configures a store based on this configuration. 438 pub fn configure_store(&self, store: &mut Store<StoreLimits>) { 439 store.limiter(|s| s as &mut dyn wasmtime::ResourceLimiter); 440 441 // Configure the store to never abort by default, that is it'll have 442 // max fuel or otherwise trap on an epoch change but the epoch won't 443 // ever change. 444 // 445 // Afterwards though see what `AsyncConfig` is being used an further 446 // refine the store's configuration based on that. 447 if self.wasmtime.consume_fuel { 448 store.set_fuel(u64::MAX).unwrap(); 449 } 450 if self.wasmtime.epoch_interruption { 451 store.epoch_deadline_trap(); 452 store.set_epoch_deadline(1); 453 } 454 match self.wasmtime.async_config { 455 AsyncConfig::Disabled => {} 456 AsyncConfig::YieldWithFuel(amt) => { 457 assert!(self.wasmtime.consume_fuel); 458 store.fuel_async_yield_interval(Some(amt)).unwrap(); 459 } 460 AsyncConfig::YieldWithEpochs { ticks, .. } => { 461 assert!(self.wasmtime.epoch_interruption); 462 store.set_epoch_deadline(ticks); 463 store.epoch_deadline_async_yield_and_update(ticks); 464 } 465 } 466 } 467 468 /// Generates an arbitrary method of timing out an instance, ensuring that 469 /// this configuration supports the returned timeout. 470 pub fn generate_timeout(&mut self, u: &mut Unstructured<'_>) -> arbitrary::Result<Timeout> { 471 let time_duration = Duration::from_millis(100); 472 let timeout = u 473 .choose(&[Timeout::Fuel(100_000), Timeout::Epoch(time_duration)])? 474 .clone(); 475 match &timeout { 476 Timeout::Fuel(..) => { 477 self.wasmtime.consume_fuel = true; 478 } 479 Timeout::Epoch(..) => { 480 self.wasmtime.epoch_interruption = true; 481 } 482 Timeout::None => unreachable!("Not an option given to choose()"), 483 } 484 Ok(timeout) 485 } 486 487 /// Compiles the `wasm` within the `engine` provided. 488 /// 489 /// This notably will use `Module::{serialize,deserialize_file}` to 490 /// round-trip if configured in the fuzzer. 491 pub fn compile(&self, engine: &Engine, wasm: &[u8]) -> Result<Module> { 492 // Propagate this error in case the caller wants to handle 493 // valid-vs-invalid wasm. 494 let module = Module::new(engine, wasm)?; 495 if !self.wasmtime.use_precompiled_cwasm { 496 return Ok(module); 497 } 498 499 // Don't propagate these errors to prevent them from accidentally being 500 // interpreted as invalid wasm, these should never fail on a 501 // well-behaved host system. 502 let dir = tempfile::TempDir::new().unwrap(); 503 let file = dir.path().join("module.wasm"); 504 std::fs::write(&file, module.serialize().unwrap()).unwrap(); 505 unsafe { Ok(Module::deserialize_file(engine, &file).unwrap()) } 506 } 507 508 /// Updates this configuration to forcibly enable async support. Only useful 509 /// in fuzzers which do async calls. 510 pub fn enable_async(&mut self, u: &mut Unstructured<'_>) -> arbitrary::Result<()> { 511 if self.wasmtime.consume_fuel || u.arbitrary()? { 512 self.wasmtime.async_config = 513 AsyncConfig::YieldWithFuel(u.int_in_range(1000..=100_000)?); 514 self.wasmtime.consume_fuel = true; 515 } else { 516 self.wasmtime.async_config = AsyncConfig::YieldWithEpochs { 517 dur: Duration::from_millis(u.int_in_range(1..=10)?), 518 ticks: u.int_in_range(1..=10)?, 519 }; 520 self.wasmtime.epoch_interruption = true; 521 } 522 Ok(()) 523 } 524 } 525 526 impl<'a> Arbitrary<'a> for Config { 527 fn arbitrary(u: &mut Unstructured<'a>) -> arbitrary::Result<Self> { 528 let mut config = Self { 529 wasmtime: u.arbitrary()?, 530 module_config: u.arbitrary()?, 531 }; 532 533 config 534 .wasmtime 535 .update_module_config(&mut config.module_config, u)?; 536 537 Ok(config) 538 } 539 } 540 541 /// Configuration related to `wasmtime::Config` and the various settings which 542 /// can be tweaked from within. 543 #[derive(Arbitrary, Clone, Debug, Eq, Hash, PartialEq)] 544 pub struct WasmtimeConfig { 545 opt_level: OptLevel, 546 regalloc_algorithm: RegallocAlgorithm, 547 debug_info: bool, 548 canonicalize_nans: bool, 549 interruptable: bool, 550 pub(crate) consume_fuel: bool, 551 pub(crate) epoch_interruption: bool, 552 /// The Wasmtime memory configuration to use. 553 pub memory_config: MemoryConfig, 554 force_jump_veneers: bool, 555 memory_init_cow: bool, 556 memory_guaranteed_dense_image_size: u64, 557 use_precompiled_cwasm: bool, 558 async_stack_zeroing: bool, 559 /// Configuration for the instance allocation strategy to use. 560 pub strategy: InstanceAllocationStrategy, 561 codegen: CodegenSettings, 562 padding_between_functions: Option<u16>, 563 generate_address_map: bool, 564 native_unwind_info: bool, 565 /// Configuration for the compiler to use. 566 pub compiler_strategy: CompilerStrategy, 567 collector: Collector, 568 table_lazy_init: bool, 569 570 /// Whether or not fuzzing should enable PCC. 571 pcc: bool, 572 573 /// Configuration for whether wasm is invoked in an async fashion and how 574 /// it's cooperatively time-sliced. 575 pub async_config: AsyncConfig, 576 577 /// Whether or not host signal handlers are enabled for this configuration, 578 /// aka whether signal handlers are supported. 579 signals_based_traps: bool, 580 } 581 582 impl WasmtimeConfig { 583 /// Force `self` to be a configuration compatible with `other`. This is 584 /// useful for differential execution to avoid unhelpful fuzz crashes when 585 /// one engine has a feature enabled and the other does not. 586 pub fn make_compatible_with(&mut self, other: &Self) { 587 // Use the same allocation strategy between the two configs. 588 // 589 // Ideally this wouldn't be necessary, but, during differential 590 // evaluation, if the `lhs` is using ondemand and the `rhs` is using the 591 // pooling allocator (or vice versa), then the module may have been 592 // generated in such a way that is incompatible with the other 593 // allocation strategy. 594 // 595 // We can remove this in the future when it's possible to access the 596 // fields of `wasm_smith::Module` to constrain the pooling allocator 597 // based on what was actually generated. 598 self.strategy = other.strategy.clone(); 599 if let InstanceAllocationStrategy::Pooling { .. } = &other.strategy { 600 // Also use the same memory configuration when using the pooling 601 // allocator. 602 self.memory_config = other.memory_config.clone(); 603 } 604 605 self.make_internally_consistent(); 606 } 607 608 /// Updates `config` to be compatible with `self` and the other way around 609 /// too. 610 pub fn update_module_config( 611 &mut self, 612 config: &mut ModuleConfig, 613 _u: &mut Unstructured<'_>, 614 ) -> arbitrary::Result<()> { 615 match self.compiler_strategy { 616 CompilerStrategy::CraneliftNative => {} 617 618 CompilerStrategy::Winch => { 619 // Winch is not complete on non-x64 targets, so just abandon this test 620 // case. We don't want to force Cranelift because we change what module 621 // config features are enabled based on the compiler strategy, and we 622 // don't want to make the same fuzz input DNA generate different test 623 // cases on different targets. 624 if cfg!(not(target_arch = "x86_64")) { 625 log::warn!( 626 "want to compile with Winch but host architecture does not support it" 627 ); 628 return Err(arbitrary::Error::IncorrectFormat); 629 } 630 631 // Winch doesn't support the same set of wasm proposal as Cranelift 632 // at this time, so if winch is selected be sure to disable wasm 633 // proposals in `Config` to ensure that Winch can compile the 634 // module that wasm-smith generates. 635 config.config.relaxed_simd_enabled = false; 636 config.config.gc_enabled = false; 637 config.config.tail_call_enabled = false; 638 config.config.reference_types_enabled = false; 639 config.function_references_enabled = false; 640 641 // Winch's SIMD implementations require AVX and AVX2. 642 if self 643 .codegen_flag("has_avx") 644 .is_some_and(|value| value == "false") 645 || self 646 .codegen_flag("has_avx2") 647 .is_some_and(|value| value == "false") 648 { 649 config.config.simd_enabled = false; 650 } 651 652 // Tuning the following engine options is currently not supported 653 // by Winch. 654 self.signals_based_traps = true; 655 self.table_lazy_init = true; 656 self.debug_info = false; 657 } 658 659 CompilerStrategy::CraneliftPulley => { 660 config.config.threads_enabled = false; 661 } 662 } 663 664 // If using the pooling allocator, constrain the memory and module configurations 665 // to the module limits. 666 if let InstanceAllocationStrategy::Pooling(pooling) = &mut self.strategy { 667 // If the pooling allocator is used, do not allow shared memory to 668 // be created. FIXME: see 669 // https://github.com/bytecodealliance/wasmtime/issues/4244. 670 config.config.threads_enabled = false; 671 672 // Ensure the pooling allocator can support the maximal size of 673 // memory, picking the smaller of the two to win. 674 let min_bytes = config 675 .config 676 .max_memory32_bytes 677 // memory64_bytes is a u128, but since we are taking the min 678 // we can truncate it down to a u64. 679 .min( 680 config 681 .config 682 .max_memory64_bytes 683 .try_into() 684 .unwrap_or(u64::MAX), 685 ); 686 let min = min_bytes 687 .min(pooling.max_memory_size as u64) 688 .min(self.memory_config.memory_reservation.unwrap_or(0)); 689 pooling.max_memory_size = min as usize; 690 config.config.max_memory32_bytes = min; 691 config.config.max_memory64_bytes = min as u128; 692 693 // If traps are disallowed then memories must have at least one page 694 // of memory so if we still are only allowing 0 pages of memory then 695 // increase that to one here. 696 if config.config.disallow_traps { 697 if pooling.max_memory_size < (1 << 16) { 698 pooling.max_memory_size = 1 << 16; 699 config.config.max_memory32_bytes = 1 << 16; 700 config.config.max_memory64_bytes = 1 << 16; 701 let cfg = &mut self.memory_config; 702 match &mut cfg.memory_reservation { 703 Some(size) => *size = (*size).max(pooling.max_memory_size as u64), 704 size @ None => *size = Some(pooling.max_memory_size as u64), 705 } 706 } 707 // .. additionally update tables 708 if pooling.table_elements == 0 { 709 pooling.table_elements = 1; 710 } 711 } 712 713 // Don't allow too many linear memories per instance since massive 714 // virtual mappings can fail to get allocated. 715 config.config.min_memories = config.config.min_memories.min(10); 716 config.config.max_memories = config.config.max_memories.min(10); 717 718 // Force this pooling allocator to always be able to accommodate the 719 // module that may be generated. 720 pooling.total_memories = config.config.max_memories as u32; 721 pooling.total_tables = config.config.max_tables as u32; 722 } 723 724 if !self.signals_based_traps { 725 // At this time shared memories require a "static" memory 726 // configuration but when signals-based traps are disabled all 727 // memories are forced to the "dynamic" configuration. This is 728 // fixable with some more work on the bounds-checks side of things 729 // to do a full bounds check even on static memories, but that's 730 // left for a future PR. 731 config.config.threads_enabled = false; 732 733 // Spectre-based heap mitigations require signal handlers so this 734 // must always be disabled if signals-based traps are disabled. 735 self.memory_config 736 .cranelift_enable_heap_access_spectre_mitigations = None; 737 } 738 739 self.make_internally_consistent(); 740 741 Ok(()) 742 } 743 744 /// Returns the codegen flag value, if any, for `name`. 745 pub(crate) fn codegen_flag(&self, name: &str) -> Option<&str> { 746 self.codegen.flags().iter().find_map(|(n, value)| { 747 if n == name { 748 Some(value.as_str()) 749 } else { 750 None 751 } 752 }) 753 } 754 755 /// Helper method to handle some dependencies between various configuration 756 /// options. This is intended to be called whenever a `Config` is created or 757 /// modified to ensure that the final result is an instantiable `Config`. 758 /// 759 /// Note that in general this probably shouldn't exist and anything here can 760 /// be considered a "TODO" to go implement more stuff in Wasmtime to accept 761 /// these sorts of configurations. For now though it's intended to reflect 762 /// the current state of the engine's development. 763 fn make_internally_consistent(&mut self) { 764 if !self.signals_based_traps { 765 let cfg = &mut self.memory_config; 766 // Spectre-based heap mitigations require signal handlers so 767 // this must always be disabled if signals-based traps are 768 // disabled. 769 cfg.cranelift_enable_heap_access_spectre_mitigations = None; 770 771 // With configuration settings that match the use of malloc for 772 // linear memories cap the `memory_reservation_for_growth` value 773 // to something reasonable to avoid OOM in fuzzing. 774 if !cfg.memory_init_cow 775 && cfg.memory_guard_size == Some(0) 776 && cfg.memory_reservation == Some(0) 777 { 778 let min = 10 << 20; // 10 MiB 779 if let Some(val) = &mut cfg.memory_reservation_for_growth { 780 *val = (*val).min(min); 781 } else { 782 cfg.memory_reservation_for_growth = Some(min); 783 } 784 } 785 } 786 } 787 } 788 789 #[derive(Arbitrary, Clone, Debug, PartialEq, Eq, Hash)] 790 enum OptLevel { 791 None, 792 Speed, 793 SpeedAndSize, 794 } 795 796 impl OptLevel { 797 fn to_wasmtime(&self) -> wasmtime::OptLevel { 798 match self { 799 OptLevel::None => wasmtime::OptLevel::None, 800 OptLevel::Speed => wasmtime::OptLevel::Speed, 801 OptLevel::SpeedAndSize => wasmtime::OptLevel::SpeedAndSize, 802 } 803 } 804 } 805 806 #[derive(Arbitrary, Clone, Debug, PartialEq, Eq, Hash)] 807 enum RegallocAlgorithm { 808 Backtracking, 809 SinglePass, 810 } 811 812 impl RegallocAlgorithm { 813 fn to_wasmtime(&self) -> wasmtime::RegallocAlgorithm { 814 match self { 815 RegallocAlgorithm::Backtracking => wasmtime::RegallocAlgorithm::Backtracking, 816 // Note: we have disabled `single_pass` for now because of 817 // its limitations w.r.t. exception handling 818 // (https://github.com/bytecodealliance/regalloc2/issues/217). To 819 // avoid breaking all existing fuzzbugs by changing the 820 // `arbitrary` mappings, we keep the `RegallocAlgorithm` 821 // enum as it is and remap here to `Backtracking`. 822 RegallocAlgorithm::SinglePass => wasmtime::RegallocAlgorithm::Backtracking, 823 } 824 } 825 } 826 827 #[derive(Clone, Debug, PartialEq, Eq, Hash)] 828 /// Compiler to use. 829 pub enum CompilerStrategy { 830 /// Cranelift compiler for the native architecture. 831 CraneliftNative, 832 /// Winch compiler. 833 Winch, 834 /// Cranelift compiler for the native architecture. 835 CraneliftPulley, 836 } 837 838 impl CompilerStrategy { 839 /// Configures `config` to use this compilation strategy 840 pub fn configure(&self, config: &mut wasmtime_cli_flags::CommonOptions) { 841 match self { 842 CompilerStrategy::CraneliftNative => { 843 config.codegen.compiler = Some(wasmtime::Strategy::Cranelift); 844 } 845 CompilerStrategy::Winch => { 846 config.codegen.compiler = Some(wasmtime::Strategy::Winch); 847 } 848 CompilerStrategy::CraneliftPulley => { 849 config.codegen.compiler = Some(wasmtime::Strategy::Cranelift); 850 config.target = Some("pulley64".to_string()); 851 } 852 } 853 } 854 } 855 856 impl Arbitrary<'_> for CompilerStrategy { 857 fn arbitrary(u: &mut Unstructured<'_>) -> arbitrary::Result<Self> { 858 // Favor fuzzing native cranelift, but if allowed also enable 859 // winch/pulley. 860 match u.int_in_range(0..=19)? { 861 1 => Ok(Self::CraneliftPulley), 862 2 => Ok(Self::Winch), 863 _ => Ok(Self::CraneliftNative), 864 } 865 } 866 } 867 868 #[derive(Arbitrary, Clone, Debug, PartialEq, Eq, Hash)] 869 pub enum Collector { 870 DeferredReferenceCounting, 871 Null, 872 } 873 874 impl Collector { 875 fn to_wasmtime(&self) -> wasmtime::Collector { 876 match self { 877 Collector::DeferredReferenceCounting => wasmtime::Collector::DeferredReferenceCounting, 878 Collector::Null => wasmtime::Collector::Null, 879 } 880 } 881 } 882