1 //==-- handle_llvm.cpp - Helper function for Clang fuzzers -----------------==//
2 //
3 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4 // See https://llvm.org/LICENSE.txt for license information.
5 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6 //
7 //===----------------------------------------------------------------------===//
8 //
9 // Implements HandleLLVM for use by the Clang fuzzers. First runs a loop
10 // vectorizer optimization pass over the given IR code. Then mimics lli on both
11 // versions to JIT the generated code and execute it. Currently, functions are
12 // executed on dummy inputs.
13 //
14 //===----------------------------------------------------------------------===//
15 
16 #include "handle_llvm.h"
17 #include "input_arrays.h"
18 
19 #include "llvm/ADT/Triple.h"
20 #include "llvm/Analysis/TargetLibraryInfo.h"
21 #include "llvm/Analysis/TargetTransformInfo.h"
22 #include "llvm/CodeGen/CommandFlags.h"
23 #include "llvm/CodeGen/MachineModuleInfo.h"
24 #include "llvm/CodeGen/TargetPassConfig.h"
25 #include "llvm/ExecutionEngine/JITEventListener.h"
26 #include "llvm/ExecutionEngine/JITSymbol.h"
27 #include "llvm/ExecutionEngine/MCJIT.h"
28 #include "llvm/ExecutionEngine/ObjectCache.h"
29 #include "llvm/ExecutionEngine/RTDyldMemoryManager.h"
30 #include "llvm/ExecutionEngine/SectionMemoryManager.h"
31 #include "llvm/IR/IRPrintingPasses.h"
32 #include "llvm/IR/LLVMContext.h"
33 #include "llvm/IR/LegacyPassManager.h"
34 #include "llvm/IR/LegacyPassNameParser.h"
35 #include "llvm/IR/Module.h"
36 #include "llvm/IR/Verifier.h"
37 #include "llvm/IRReader/IRReader.h"
38 #include "llvm/Pass.h"
39 #include "llvm/PassRegistry.h"
40 #include "llvm/Support/MemoryBuffer.h"
41 #include "llvm/Support/SourceMgr.h"
42 #include "llvm/Support/TargetRegistry.h"
43 #include "llvm/Support/TargetSelect.h"
44 #include "llvm/Target/TargetMachine.h"
45 #include "llvm/Transforms/IPO.h"
46 #include "llvm/Transforms/IPO/PassManagerBuilder.h"
47 #include "llvm/Transforms/Vectorize.h"
48 
49 using namespace llvm;
50 
51 static codegen::RegisterCodeGenFlags CGF;
52 
53 // Define a type for the functions that are compiled and executed
54 typedef void (*LLVMFunc)(int*, int*, int*, int);
55 
56 // Helper function to parse command line args and find the optimization level
57 static void getOptLevel(const std::vector<const char *> &ExtraArgs,
58                               CodeGenOpt::Level &OLvl) {
59   // Find the optimization level from the command line args
60   OLvl = CodeGenOpt::Default;
61   for (auto &A : ExtraArgs) {
62     if (A[0] == '-' && A[1] == 'O') {
63       switch(A[2]) {
64         case '0': OLvl = CodeGenOpt::None; break;
65         case '1': OLvl = CodeGenOpt::Less; break;
66         case '2': OLvl = CodeGenOpt::Default; break;
67         case '3': OLvl = CodeGenOpt::Aggressive; break;
68         default:
69           errs() << "error: opt level must be between 0 and 3.\n";
70           std::exit(1);
71       }
72     }
73   }
74 }
75 
76 static void ErrorAndExit(std::string message) {
77   errs()<< "ERROR: " << message << "\n";
78   std::exit(1);
79 }
80 
81 // Helper function to add optimization passes to the TargetMachine at the
82 // specified optimization level, OptLevel
83 static void AddOptimizationPasses(legacy::PassManagerBase &MPM,
84                                   CodeGenOpt::Level OptLevel,
85                                   unsigned SizeLevel) {
86   // Create and initialize a PassManagerBuilder
87   PassManagerBuilder Builder;
88   Builder.OptLevel = OptLevel;
89   Builder.SizeLevel = SizeLevel;
90   Builder.Inliner = createFunctionInliningPass(OptLevel, SizeLevel, false);
91   Builder.LoopVectorize = true;
92   Builder.populateModulePassManager(MPM);
93 }
94 
95 // Mimics the opt tool to run an optimization pass over the provided IR
96 static std::string OptLLVM(const std::string &IR, CodeGenOpt::Level OLvl) {
97   // Create a module that will run the optimization passes
98   SMDiagnostic Err;
99   LLVMContext Context;
100   std::unique_ptr<Module> M = parseIR(MemoryBufferRef(IR, "IR"), Err, Context);
101   if (!M || verifyModule(*M, &errs()))
102     ErrorAndExit("Could not parse IR");
103 
104   Triple ModuleTriple(M->getTargetTriple());
105   const TargetOptions Options = codegen::InitTargetOptionsFromCodeGenFlags();
106   std::string E;
107   const Target *TheTarget =
108       TargetRegistry::lookupTarget(codegen::getMArch(), ModuleTriple, E);
109   TargetMachine *Machine = TheTarget->createTargetMachine(
110       M->getTargetTriple(), codegen::getCPUStr(), codegen::getFeaturesStr(),
111       Options, codegen::getExplicitRelocModel(),
112       codegen::getExplicitCodeModel(), OLvl);
113   std::unique_ptr<TargetMachine> TM(Machine);
114   codegen::setFunctionAttributes(codegen::getCPUStr(),
115                                  codegen::getFeaturesStr(), *M);
116 
117   legacy::PassManager Passes;
118 
119   Passes.add(new TargetLibraryInfoWrapperPass(ModuleTriple));
120   Passes.add(createTargetTransformInfoWrapperPass(TM->getTargetIRAnalysis()));
121 
122   LLVMTargetMachine &LTM = static_cast<LLVMTargetMachine &>(*TM);
123   Passes.add(LTM.createPassConfig(Passes));
124 
125   Passes.add(createVerifierPass());
126 
127   AddOptimizationPasses(Passes, OLvl, 0);
128 
129   // Add a pass that writes the optimized IR to an output stream
130   std::string outString;
131   raw_string_ostream OS(outString);
132   Passes.add(createPrintModulePass(OS, "", false));
133 
134   Passes.run(*M);
135 
136   return OS.str();
137 }
138 
139 // Takes a function and runs it on a set of inputs
140 // First determines whether f is the optimized or unoptimized function
141 static void RunFuncOnInputs(LLVMFunc f, int Arr[kNumArrays][kArraySize]) {
142   for (int i = 0; i < kNumArrays / 3; i++)
143     f(Arr[i], Arr[i + (kNumArrays / 3)], Arr[i + (2 * kNumArrays / 3)],
144       kArraySize);
145 }
146 
147 // Takes a string of IR and compiles it using LLVM's JIT Engine
148 static void CreateAndRunJITFunc(const std::string &IR, CodeGenOpt::Level OLvl) {
149   SMDiagnostic Err;
150   LLVMContext Context;
151   std::unique_ptr<Module> M = parseIR(MemoryBufferRef(IR, "IR"), Err, Context);
152   if (!M)
153     ErrorAndExit("Could not parse IR");
154 
155   Function *EntryFunc = M->getFunction("foo");
156   if (!EntryFunc)
157     ErrorAndExit("Function not found in module");
158 
159   std::string ErrorMsg;
160   EngineBuilder builder(std::move(M));
161   builder.setMArch(codegen::getMArch());
162   builder.setMCPU(codegen::getCPUStr());
163   builder.setMAttrs(codegen::getFeatureList());
164   builder.setErrorStr(&ErrorMsg);
165   builder.setEngineKind(EngineKind::JIT);
166   builder.setMCJITMemoryManager(std::make_unique<SectionMemoryManager>());
167   builder.setOptLevel(OLvl);
168   builder.setTargetOptions(codegen::InitTargetOptionsFromCodeGenFlags());
169 
170   std::unique_ptr<ExecutionEngine> EE(builder.create());
171   if (!EE)
172     ErrorAndExit("Could not create execution engine");
173 
174   EE->finalizeObject();
175   EE->runStaticConstructorsDestructors(false);
176 
177 #if defined(__GNUC__) && !defined(__clang) &&                                  \
178     ((__GNUC__ == 4) && (__GNUC_MINOR__ < 9))
179 // Silence
180 //
181 //   warning: ISO C++ forbids casting between pointer-to-function and
182 //   pointer-to-object [-Wpedantic]
183 //
184 // Since C++11 this casting is conditionally supported and GCC versions
185 // starting from 4.9.0 don't warn about the cast.
186 #pragma GCC diagnostic push
187 #pragma GCC diagnostic ignored "-Wpedantic"
188 #endif
189   LLVMFunc f = reinterpret_cast<LLVMFunc>(EE->getPointerToFunction(EntryFunc));
190 #if defined(__GNUC__) && !defined(__clang) &&                                  \
191     ((__GNUC__ == 4) && (__GNUC_MINOR__ < 9))
192 #pragma GCC diagnostic pop
193 #endif
194 
195   // Figure out if we are running the optimized func or the unoptimized func
196   RunFuncOnInputs(f, (OLvl == CodeGenOpt::None) ? UnoptArrays : OptArrays);
197 
198   EE->runStaticConstructorsDestructors(true);
199 }
200 
201 // Main fuzz target called by ExampleClangLLVMProtoFuzzer.cpp
202 // Mimics the lli tool to JIT the LLVM IR code and execute it
203 void clang_fuzzer::HandleLLVM(const std::string &IR,
204                               const std::vector<const char *> &ExtraArgs) {
205   // Populate OptArrays and UnoptArrays with the arrays from InputArrays
206   memcpy(OptArrays, InputArrays, kTotalSize);
207   memcpy(UnoptArrays, InputArrays, kTotalSize);
208 
209   // Parse ExtraArgs to set the optimization level
210   CodeGenOpt::Level OLvl;
211   getOptLevel(ExtraArgs, OLvl);
212 
213   // First we optimize the IR by running a loop vectorizer pass
214   std::string OptIR = OptLLVM(IR, OLvl);
215 
216   CreateAndRunJITFunc(OptIR, OLvl);
217   CreateAndRunJITFunc(IR, CodeGenOpt::None);
218 
219   if (memcmp(OptArrays, UnoptArrays, kTotalSize))
220     ErrorAndExit("!!!BUG!!!");
221 
222   return;
223 }
224