dexfuzz/executors/Executor.java

/*
 * Copyright (C) 2014 The Android Open Source Project
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 *      http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */

package dexfuzz.executors;

import dexfuzz.ExecutionResult;
import dexfuzz.Log;
import dexfuzz.Options;
import dexfuzz.StreamConsumer;
import dexfuzz.listeners.BaseListener;

import java.io.IOException;
import java.util.Map;

/**
 * Base class containing the common methods for executing a particular backend of ART.
 */
public abstract class Executor {
  private String androidHostOut;
  private String androidProductOut;

  private StreamConsumer outputConsumer;
  private StreamConsumer errorConsumer;

  protected ExecutionResult executionResult;
  protected String executeClass;

  // Set by subclasses.
  protected String name;
  protected int timeout;
  protected BaseListener listener;
  protected String testLocation;
  protected Architecture architecture;
  protected Device device;

  protected Executor(String name, int timeout, BaseListener listener, Architecture architecture,
      Device device) {
    executeClass = Options.executeClass;

    if (Options.shortTimeouts) {
      this.timeout = 2;
    } else {
      this.timeout = timeout;
    }

    this.name = name;
    this.listener = listener;
    this.architecture = architecture;
    this.device = device;

    this.testLocation = Options.executeDirectory;

    Map<String, String> envVars = System.getenv();
    androidProductOut = checkForEnvVar(envVars, "ANDROID_PRODUCT_OUT");
    androidHostOut = checkForEnvVar(envVars, "ANDROID_HOST_OUT");

    outputConsumer = new StreamConsumer();
    outputConsumer.start();
    errorConsumer = new StreamConsumer();
    errorConsumer.start();

    if (!device.isLocal()) {
      // Check for ADB.
      try {
        ProcessBuilder pb = new ProcessBuilder();
        pb.command("adb", "devices");
        Process process = pb.start();
        int exitValue = process.waitFor();
        if (exitValue != 0) {
          Log.errorAndQuit("Problem executing ADB - is it in your $PATH?");
        }
      } catch (IOException e) {
        Log.errorAndQuit("IOException when executing ADB, is it working?");
      } catch (InterruptedException e) {
        Log.errorAndQuit("InterruptedException when executing ADB, is it working?");
      }

      // Check we can run something on ADB.
      ExecutionResult result = executeOnDevice("true", true);
      if (result.getFlattenedAll().contains("device not found")) {
        Log.errorAndQuit("Couldn't connect to specified ADB device: " + device.getName());
      }
    }
  }

  private String checkForEnvVar(Map<String, String> envVars, String key) {
    if (!envVars.containsKey(key)) {
      Log.errorAndQuit("Cannot run a fuzzed program if $" + key + " is not set!");
    }
    return envVars.get(key);
  }

  private ExecutionResult executeCommand(String command, boolean captureOutput) {
    ExecutionResult result = new ExecutionResult();

    Log.info("Executing: " + command);

    try {
      ProcessBuilder processBuilder = new ProcessBuilder(command.split(" "));
      processBuilder.environment().put("ANDROID_ROOT", androidHostOut);
      Process process = processBuilder.start();

      if (captureOutput) {
        // Give the streams to the StreamConsumers.
        outputConsumer.giveStreamAndStartConsuming(process.getInputStream());
        errorConsumer.giveStreamAndStartConsuming(process.getErrorStream());
      }

      // Wait until the process is done - the StreamConsumers will keep the
      // buffers drained, so this shouldn't block indefinitely.
      // Get the return value as well.
      result.returnValue = process.waitFor();

      Log.info("Return value: " + result.returnValue);

      if (captureOutput) {
        // Tell the StreamConsumers to stop consuming, and wait for them to finish
        // so we know we have all of the output.
        outputConsumer.processFinished();
        errorConsumer.processFinished();
        result.output = outputConsumer.getOutput();
        result.error = errorConsumer.getOutput();

        // Always explicitly indicate the return code in the text output now.
        // NB: adb shell doesn't actually return exit codes currently, but this will
        // be useful if/when it does.
        result.output.add("RETURN CODE: " + result.returnValue);
      }

    } catch (IOException e) {
      Log.errorAndQuit("ExecutionResult.execute() caught an IOException");
    } catch (InterruptedException e) {
      Log.errorAndQuit("ExecutionResult.execute() caught an InterruptedException");
    }

    return result;
  }

  /**
   * Called by subclass Executors in their execute() implementations.
   */
  protected ExecutionResult executeOnDevice(String command, boolean captureOutput) {
    String timeoutString = "timeout " + timeout + " ";
    return executeCommand(timeoutString + device.getExecutionShellPrefix() + command,
        captureOutput);
  }

  private ExecutionResult pushToDevice(String command) {
    return executeCommand(device.getExecutionPushPrefix() + command, false);
  }

  /**
   * Call this to make sure the StreamConsumer threads are stopped.
   */
  public void shutdown() {
    outputConsumer.shutdown();
    errorConsumer.shutdown();
  }

  /**
   * Called by the Fuzzer after each execution has finished, to clear the results.
   */
  public void reset() {
    executionResult = null;
  }

  /**
   * Called by the Fuzzer to verify the mutated program using the host-side dex2oat.
   */
  public boolean verifyOnHost(String programName) {
    StringBuilder commandBuilder = new StringBuilder();
    commandBuilder.append("dex2oat ");

    // This assumes that the Architecture enum's name, when reduced to lower-case,
    // matches what dex2oat would expect.
    commandBuilder.append("--instruction-set=").append(architecture.toString().toLowerCase());
    commandBuilder.append(" --instruction-set-features=default ");

    // Select the correct boot image.
    commandBuilder.append("--boot-image=").append(androidProductOut);
    if (device.noBootImageAvailable()) {
      commandBuilder.append("/data/art-test/core.art ");
    } else {
      commandBuilder.append("/system/framework/boot.art ");
    }

    commandBuilder.append("--oat-file=output.oat ");
    commandBuilder.append("--android-root=").append(androidHostOut).append(" ");
    commandBuilder.append("--runtime-arg -classpath ");
    commandBuilder.append("--runtime-arg ").append(programName).append(" ");
    commandBuilder.append("--dex-file=").append(programName).append(" ");
    commandBuilder.append("--compiler-filter=interpret-only --runtime-arg -Xnorelocate ");

    ExecutionResult verificationResult = executeCommand(commandBuilder.toString(), true);

    boolean success = true;

    if (verificationResult.isSigabort()) {
      listener.handleHostVerificationSigabort(verificationResult);
      success = false;
    }

    if (success) {
      // Search for a keyword that indicates verification was not successful.
      // TODO: Determine if dex2oat crashed?
      for (String line : verificationResult.error) {
        if (line.contains("Verification error")
            || line.contains("Failure to verify dex file")) {
          success = false;
        }
        if (Options.dumpVerify) {
          // Strip out the start of the log lines.
          listener.handleDumpVerify(line.replaceFirst(".*(cc|h):\\d+] ",  ""));
        }
      }
    }

    if (!success) {
      listener.handleFailedHostVerification(verificationResult);
    }

    executeCommand("rm output.oat", false);

    return success;
  }

  /**
   * Called by the Fuzzer to upload the program to the target device.
   * TODO: Check if we're executing on a local device, and don't do this?
   */
  public void uploadToTarget(String programName) {
    pushToDevice(programName + " " + testLocation);
  }

  /**
   * Executor subclasses need to override this, to construct their arguments for dalvikvm
   * invocation correctly.
   */
  public abstract void execute(String programName);

  /**
   * Executor subclasses need to override this, to delete their generated OAT file correctly.
   */
  public abstract void deleteGeneratedOatFile(String programName);

  /**
   * Executor subclasses need to override this, to report if they need a cleaned code cache.
   */
  public abstract boolean needsCleanCodeCache();

  /**
   * Fuzzer.checkForArchitectureSplit() will use this determine the architecture of the Executor.
   */
  public Architecture getArchitecture() {
    return architecture;
  }

  /**
   * Used in each subclass of Executor's deleteGeneratedOatFile() method, to know what to delete.
   */
  protected String getOatFileName(String programName) {
    // Converts e.g. /data/art-test/file.dex to data@art-test@file.dex
    return (testLocation.replace("/", "@").substring(1) + "@" + programName);
  }

  /**
   * Used by the Fuzzer to get result of execution.
   */
  public ExecutionResult getResult() {
    return executionResult;
  }

  /**
   * Because dex2oat can accept a program with soft errors on the host, and then fail after
   * performing hard verification on the target, we need to check if the Executor detected
   * a target verification failure, before doing anything else with the resulting output.
   * Used by the Fuzzer.
   */
  public boolean verifyOnTarget() {
    // TODO: Remove this once host-verification can be forced to always fail?
    if (executionResult.getFlattenedOutput().contains("VerifyError")) {
      return false;
    }
    return true;
  }

  public String getName() {
    return name;
  }
}