1 //==-- handle_llvm.cpp - Helper function for Clang fuzzers -----------------==//
2 //
3 // The LLVM Compiler Infrastructure
4 //
5 // This file is distributed under the University of Illinois Open Source
6 // License. See LICENSE.TXT for details.
7 //
8 //===----------------------------------------------------------------------===//
9 //
10 // Implements HandleLLVM for use by the Clang fuzzers. First runs a loop
11 // vectorizer optimization pass over the given IR code. Then mimics lli on both
12 // versions to JIT the generated code and execute it. Currently, functions are
13 // executed on dummy inputs.
14 //
15 //===----------------------------------------------------------------------===//
16
17 #include "handle_llvm.h"
18 #include "input_arrays.h"
19
20 #include "llvm/ADT/Triple.h"
21 #include "llvm/Analysis/TargetLibraryInfo.h"
22 #include "llvm/Analysis/TargetTransformInfo.h"
23 #include "llvm/CodeGen/CommandFlags.inc"
24 #include "llvm/CodeGen/MachineModuleInfo.h"
25 #include "llvm/CodeGen/TargetPassConfig.h"
26 #include "llvm/ExecutionEngine/JITEventListener.h"
27 #include "llvm/ExecutionEngine/JITSymbol.h"
28 #include "llvm/ExecutionEngine/MCJIT.h"
29 #include "llvm/ExecutionEngine/ObjectCache.h"
30 #include "llvm/ExecutionEngine/RTDyldMemoryManager.h"
31 #include "llvm/ExecutionEngine/SectionMemoryManager.h"
32 #include "llvm/IR/IRPrintingPasses.h"
33 #include "llvm/IR/LegacyPassManager.h"
34 #include "llvm/IR/LegacyPassNameParser.h"
35 #include "llvm/IR/LLVMContext.h"
36 #include "llvm/IR/Module.h"
37 #include "llvm/IR/Verifier.h"
38 #include "llvm/IRReader/IRReader.h"
39 #include "llvm/Pass.h"
40 #include "llvm/PassRegistry.h"
41 #include "llvm/Support/MemoryBuffer.h"
42 #include "llvm/Support/SourceMgr.h"
43 #include "llvm/Support/TargetRegistry.h"
44 #include "llvm/Support/TargetSelect.h"
45 #include "llvm/Target/TargetMachine.h"
46 #include "llvm/Transforms/IPO/PassManagerBuilder.h"
47 #include "llvm/Transforms/IPO.h"
48 #include "llvm/Transforms/Vectorize.h"
49
50 using namespace llvm;
51
52 // Define a type for the functions that are compiled and executed
53 typedef void (*LLVMFunc)(int*, int*, int*, int);
54
55 // Helper function to parse command line args and find the optimization level
getOptLevel(const std::vector<const char * > & ExtraArgs,CodeGenOpt::Level & OLvl)56 static void getOptLevel(const std::vector<const char *> &ExtraArgs,
57 CodeGenOpt::Level &OLvl) {
58 // Find the optimization level from the command line args
59 OLvl = CodeGenOpt::Default;
60 for (auto &A : ExtraArgs) {
61 if (A[0] == '-' && A[1] == 'O') {
62 switch(A[2]) {
63 case '0': OLvl = CodeGenOpt::None; break;
64 case '1': OLvl = CodeGenOpt::Less; break;
65 case '2': OLvl = CodeGenOpt::Default; break;
66 case '3': OLvl = CodeGenOpt::Aggressive; break;
67 default:
68 errs() << "error: opt level must be between 0 and 3.\n";
69 std::exit(1);
70 }
71 }
72 }
73 }
74
ErrorAndExit(std::string message)75 static void ErrorAndExit(std::string message) {
76 errs()<< "ERROR: " << message << "\n";
77 std::exit(1);
78 }
79
80 // Helper function to add optimization passes to the TargetMachine at the
81 // specified optimization level, OptLevel
AddOptimizationPasses(legacy::PassManagerBase & MPM,CodeGenOpt::Level OptLevel,unsigned SizeLevel)82 static void AddOptimizationPasses(legacy::PassManagerBase &MPM,
83 CodeGenOpt::Level OptLevel,
84 unsigned SizeLevel) {
85 // Create and initialize a PassManagerBuilder
86 PassManagerBuilder Builder;
87 Builder.OptLevel = OptLevel;
88 Builder.SizeLevel = SizeLevel;
89 Builder.Inliner = createFunctionInliningPass(OptLevel, SizeLevel, false);
90 Builder.LoopVectorize = true;
91 Builder.populateModulePassManager(MPM);
92 }
93
94 // Mimics the opt tool to run an optimization pass over the provided IR
OptLLVM(const std::string & IR,CodeGenOpt::Level OLvl)95 static std::string OptLLVM(const std::string &IR, CodeGenOpt::Level OLvl) {
96 // Create a module that will run the optimization passes
97 SMDiagnostic Err;
98 LLVMContext Context;
99 std::unique_ptr<Module> M = parseIR(MemoryBufferRef(IR, "IR"), Err, Context);
100 if (!M || verifyModule(*M, &errs()))
101 ErrorAndExit("Could not parse IR");
102
103 Triple ModuleTriple(M->getTargetTriple());
104 const TargetOptions Options = InitTargetOptionsFromCodeGenFlags();
105 std::string E;
106 const Target *TheTarget = TargetRegistry::lookupTarget(MArch, ModuleTriple, E);
107 TargetMachine *Machine =
108 TheTarget->createTargetMachine(M->getTargetTriple(), getCPUStr(),
109 getFeaturesStr(), Options, getRelocModel(),
110 getCodeModel(), OLvl);
111 std::unique_ptr<TargetMachine> TM(Machine);
112 setFunctionAttributes(getCPUStr(), getFeaturesStr(), *M);
113
114 legacy::PassManager Passes;
115
116 Passes.add(new TargetLibraryInfoWrapperPass(ModuleTriple));
117 Passes.add(createTargetTransformInfoWrapperPass(TM->getTargetIRAnalysis()));
118
119 LLVMTargetMachine <M = static_cast<LLVMTargetMachine &>(*TM);
120 Passes.add(LTM.createPassConfig(Passes));
121
122 Passes.add(createVerifierPass());
123
124 AddOptimizationPasses(Passes, OLvl, 0);
125
126 // Add a pass that writes the optimized IR to an output stream
127 std::string outString;
128 raw_string_ostream OS(outString);
129 Passes.add(createPrintModulePass(OS, "", false));
130
131 Passes.run(*M);
132
133 return OS.str();
134 }
135
136 // Takes a function and runs it on a set of inputs
137 // First determines whether f is the optimized or unoptimized function
RunFuncOnInputs(LLVMFunc f,int Arr[kNumArrays][kArraySize])138 static void RunFuncOnInputs(LLVMFunc f, int Arr[kNumArrays][kArraySize]) {
139 for (int i = 0; i < kNumArrays / 3; i++)
140 f(Arr[i], Arr[i + (kNumArrays / 3)], Arr[i + (2 * kNumArrays / 3)],
141 kArraySize);
142 }
143
144 // Takes a string of IR and compiles it using LLVM's JIT Engine
CreateAndRunJITFunc(const std::string & IR,CodeGenOpt::Level OLvl)145 static void CreateAndRunJITFunc(const std::string &IR, CodeGenOpt::Level OLvl) {
146 SMDiagnostic Err;
147 LLVMContext Context;
148 std::unique_ptr<Module> M = parseIR(MemoryBufferRef(IR, "IR"), Err, Context);
149 if (!M)
150 ErrorAndExit("Could not parse IR");
151
152 Function *EntryFunc = M->getFunction("foo");
153 if (!EntryFunc)
154 ErrorAndExit("Function not found in module");
155
156 std::string ErrorMsg;
157 EngineBuilder builder(std::move(M));
158 builder.setMArch(MArch);
159 builder.setMCPU(getCPUStr());
160 builder.setMAttrs(getFeatureList());
161 builder.setErrorStr(&ErrorMsg);
162 builder.setEngineKind(EngineKind::JIT);
163 builder.setUseOrcMCJITReplacement(false);
164 builder.setMCJITMemoryManager(make_unique<SectionMemoryManager>());
165 builder.setOptLevel(OLvl);
166 builder.setTargetOptions(InitTargetOptionsFromCodeGenFlags());
167
168 std::unique_ptr<ExecutionEngine> EE(builder.create());
169 if (!EE)
170 ErrorAndExit("Could not create execution engine");
171
172 EE->finalizeObject();
173 EE->runStaticConstructorsDestructors(false);
174
175 #if defined(__GNUC__) && !defined(__clang) && \
176 ((__GNUC__ == 4) && (__GNUC_MINOR__ < 9))
177 // Silence
178 //
179 // warning: ISO C++ forbids casting between pointer-to-function and
180 // pointer-to-object [-Wpedantic]
181 //
182 // Since C++11 this casting is conditionally supported and GCC versions
183 // starting from 4.9.0 don't warn about the cast.
184 #pragma GCC diagnostic push
185 #pragma GCC diagnostic ignored "-Wpedantic"
186 #endif
187 LLVMFunc f = reinterpret_cast<LLVMFunc>(EE->getPointerToFunction(EntryFunc));
188 #if defined(__GNUC__) && !defined(__clang) && \
189 ((__GNUC__ == 4) && (__GNUC_MINOR__ < 9))
190 #pragma GCC diagnostic pop
191 #endif
192
193 // Figure out if we are running the optimized func or the unoptimized func
194 RunFuncOnInputs(f, (OLvl == CodeGenOpt::None) ? UnoptArrays : OptArrays);
195
196 EE->runStaticConstructorsDestructors(true);
197 }
198
199 // Main fuzz target called by ExampleClangLLVMProtoFuzzer.cpp
200 // Mimics the lli tool to JIT the LLVM IR code and execute it
HandleLLVM(const std::string & IR,const std::vector<const char * > & ExtraArgs)201 void clang_fuzzer::HandleLLVM(const std::string &IR,
202 const std::vector<const char *> &ExtraArgs) {
203 // Populate OptArrays and UnoptArrays with the arrays from InputArrays
204 memcpy(OptArrays, InputArrays, kTotalSize);
205 memcpy(UnoptArrays, InputArrays, kTotalSize);
206
207 // Parse ExtraArgs to set the optimization level
208 CodeGenOpt::Level OLvl;
209 getOptLevel(ExtraArgs, OLvl);
210
211 // First we optimize the IR by running a loop vectorizer pass
212 std::string OptIR = OptLLVM(IR, OLvl);
213
214 CreateAndRunJITFunc(OptIR, OLvl);
215 CreateAndRunJITFunc(IR, CodeGenOpt::None);
216
217 if (memcmp(OptArrays, UnoptArrays, kTotalSize))
218 ErrorAndExit("!!!BUG!!!");
219
220 return;
221 }
222