1 //==-- handle_llvm.cpp - Helper function for Clang fuzzers -----------------==//
2 //
3 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4 // See https://llvm.org/LICENSE.txt for license information.
5 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6 //
7 //===----------------------------------------------------------------------===//
8 //
9 // Implements HandleLLVM for use by the Clang fuzzers. First runs a loop
10 // vectorizer optimization pass over the given IR code. Then mimics lli on both
11 // versions to JIT the generated code and execute it. Currently, functions are
12 // executed on dummy inputs.
13 //
14 //===----------------------------------------------------------------------===//
15
16 #include "handle_llvm.h"
17 #include "input_arrays.h"
18
19 #include "llvm/ADT/Triple.h"
20 #include "llvm/Analysis/TargetLibraryInfo.h"
21 #include "llvm/Analysis/TargetTransformInfo.h"
22 #include "llvm/CodeGen/CommandFlags.h"
23 #include "llvm/CodeGen/MachineModuleInfo.h"
24 #include "llvm/CodeGen/TargetPassConfig.h"
25 #include "llvm/ExecutionEngine/JITEventListener.h"
26 #include "llvm/ExecutionEngine/JITSymbol.h"
27 #include "llvm/ExecutionEngine/MCJIT.h"
28 #include "llvm/ExecutionEngine/ObjectCache.h"
29 #include "llvm/ExecutionEngine/RTDyldMemoryManager.h"
30 #include "llvm/ExecutionEngine/SectionMemoryManager.h"
31 #include "llvm/IR/IRPrintingPasses.h"
32 #include "llvm/IR/LLVMContext.h"
33 #include "llvm/IR/Module.h"
34 #include "llvm/IR/Verifier.h"
35 #include "llvm/IRPrinter/IRPrintingPasses.h"
36 #include "llvm/IRReader/IRReader.h"
37 #include "llvm/MC/TargetRegistry.h"
38 #include "llvm/Passes/OptimizationLevel.h"
39 #include "llvm/Passes/PassBuilder.h"
40 #include "llvm/Support/MemoryBuffer.h"
41 #include "llvm/Support/SourceMgr.h"
42 #include "llvm/Support/TargetSelect.h"
43 #include "llvm/Target/TargetMachine.h"
44
45 using namespace llvm;
46
47 // Define a type for the functions that are compiled and executed
48 typedef void (*LLVMFunc)(int*, int*, int*, int);
49
50 // Helper function to parse command line args and find the optimization level
51 static CodeGenOpt::Level
getOptLevel(const std::vector<const char * > & ExtraArgs)52 getOptLevel(const std::vector<const char *> &ExtraArgs) {
53 // Find the optimization level from the command line args
54 CodeGenOpt::Level OLvl = CodeGenOpt::Default;
55 for (auto &A : ExtraArgs) {
56 if (A[0] == '-' && A[1] == 'O') {
57 if (auto Level = CodeGenOpt::parseLevel(A[2])) {
58 OLvl = *Level;
59 } else {
60 errs() << "error: opt level must be between 0 and 3.\n";
61 std::exit(1);
62 }
63 }
64 }
65 return OLvl;
66 }
67
ErrorAndExit(std::string message)68 static void ErrorAndExit(std::string message) {
69 errs()<< "ERROR: " << message << "\n";
70 std::exit(1);
71 }
72
73 // Helper function to add optimization passes to the TargetMachine at the
74 // specified optimization level, OptLevel
RunOptimizationPasses(raw_ostream & OS,Module & M,CodeGenOpt::Level OptLevel)75 static void RunOptimizationPasses(raw_ostream &OS, Module &M,
76 CodeGenOpt::Level OptLevel) {
77 llvm::OptimizationLevel OL;
78 switch (OptLevel) {
79 case CodeGenOpt::None:
80 OL = OptimizationLevel::O0;
81 break;
82 case CodeGenOpt::Less:
83 OL = OptimizationLevel::O1;
84 break;
85 case CodeGenOpt::Default:
86 OL = OptimizationLevel::O2;
87 break;
88 case CodeGenOpt::Aggressive:
89 OL = OptimizationLevel::O3;
90 break;
91 }
92
93 LoopAnalysisManager LAM;
94 FunctionAnalysisManager FAM;
95 CGSCCAnalysisManager CGAM;
96 ModuleAnalysisManager MAM;
97
98 PassBuilder PB;
99
100 PB.registerModuleAnalyses(MAM);
101 PB.registerCGSCCAnalyses(CGAM);
102 PB.registerFunctionAnalyses(FAM);
103 PB.registerLoopAnalyses(LAM);
104 PB.crossRegisterProxies(LAM, FAM, CGAM, MAM);
105
106 ModulePassManager MPM;
107 if (OL == OptimizationLevel::O0)
108 MPM = PB.buildO0DefaultPipeline(OL);
109 else
110 MPM = PB.buildPerModuleDefaultPipeline(OL);
111 MPM.addPass(PrintModulePass(OS));
112
113 MPM.run(M, MAM);
114 }
115
116 // Mimics the opt tool to run an optimization pass over the provided IR
OptLLVM(const std::string & IR,CodeGenOpt::Level OLvl)117 static std::string OptLLVM(const std::string &IR, CodeGenOpt::Level OLvl) {
118 // Create a module that will run the optimization passes
119 SMDiagnostic Err;
120 LLVMContext Context;
121 std::unique_ptr<Module> M = parseIR(MemoryBufferRef(IR, "IR"), Err, Context);
122 if (!M || verifyModule(*M, &errs()))
123 ErrorAndExit("Could not parse IR");
124
125 Triple ModuleTriple(M->getTargetTriple());
126 const TargetOptions Options =
127 codegen::InitTargetOptionsFromCodeGenFlags(ModuleTriple);
128 std::string E;
129 const Target *TheTarget =
130 TargetRegistry::lookupTarget(codegen::getMArch(), ModuleTriple, E);
131 if (!TheTarget)
132 ErrorAndExit(E);
133
134 std::unique_ptr<TargetMachine> TM(TheTarget->createTargetMachine(
135 M->getTargetTriple(), codegen::getCPUStr(), codegen::getFeaturesStr(),
136 Options, codegen::getExplicitRelocModel(),
137 codegen::getExplicitCodeModel(), OLvl));
138 if (!TM)
139 ErrorAndExit("Could not create target machine");
140
141 codegen::setFunctionAttributes(codegen::getCPUStr(),
142 codegen::getFeaturesStr(), *M);
143
144 // Add a pass that writes the optimized IR to an output stream
145 std::string outString;
146 raw_string_ostream OS(outString);
147 RunOptimizationPasses(OS, *M, OLvl);
148
149 return outString;
150 }
151
152 // Takes a function and runs it on a set of inputs
153 // First determines whether f is the optimized or unoptimized function
RunFuncOnInputs(LLVMFunc f,int Arr[kNumArrays][kArraySize])154 static void RunFuncOnInputs(LLVMFunc f, int Arr[kNumArrays][kArraySize]) {
155 for (int i = 0; i < kNumArrays / 3; i++)
156 f(Arr[i], Arr[i + (kNumArrays / 3)], Arr[i + (2 * kNumArrays / 3)],
157 kArraySize);
158 }
159
160 // Takes a string of IR and compiles it using LLVM's JIT Engine
CreateAndRunJITFunc(const std::string & IR,CodeGenOpt::Level OLvl)161 static void CreateAndRunJITFunc(const std::string &IR, CodeGenOpt::Level OLvl) {
162 SMDiagnostic Err;
163 LLVMContext Context;
164 std::unique_ptr<Module> M = parseIR(MemoryBufferRef(IR, "IR"), Err, Context);
165 if (!M)
166 ErrorAndExit("Could not parse IR");
167
168 Function *EntryFunc = M->getFunction("foo");
169 if (!EntryFunc)
170 ErrorAndExit("Function not found in module");
171
172 std::string ErrorMsg;
173 Triple ModuleTriple(M->getTargetTriple());
174
175 EngineBuilder builder(std::move(M));
176 builder.setMArch(codegen::getMArch());
177 builder.setMCPU(codegen::getCPUStr());
178 builder.setMAttrs(codegen::getFeatureList());
179 builder.setErrorStr(&ErrorMsg);
180 builder.setEngineKind(EngineKind::JIT);
181 builder.setMCJITMemoryManager(std::make_unique<SectionMemoryManager>());
182 builder.setOptLevel(OLvl);
183 builder.setTargetOptions(
184 codegen::InitTargetOptionsFromCodeGenFlags(ModuleTriple));
185
186 std::unique_ptr<ExecutionEngine> EE(builder.create());
187 if (!EE)
188 ErrorAndExit("Could not create execution engine");
189
190 EE->finalizeObject();
191 EE->runStaticConstructorsDestructors(false);
192
193 #if defined(__GNUC__) && !defined(__clang) && \
194 ((__GNUC__ == 4) && (__GNUC_MINOR__ < 9))
195 // Silence
196 //
197 // warning: ISO C++ forbids casting between pointer-to-function and
198 // pointer-to-object [-Wpedantic]
199 //
200 // Since C++11 this casting is conditionally supported and GCC versions
201 // starting from 4.9.0 don't warn about the cast.
202 #pragma GCC diagnostic push
203 #pragma GCC diagnostic ignored "-Wpedantic"
204 #endif
205 LLVMFunc f = reinterpret_cast<LLVMFunc>(EE->getPointerToFunction(EntryFunc));
206 #if defined(__GNUC__) && !defined(__clang) && \
207 ((__GNUC__ == 4) && (__GNUC_MINOR__ < 9))
208 #pragma GCC diagnostic pop
209 #endif
210
211 // Figure out if we are running the optimized func or the unoptimized func
212 RunFuncOnInputs(f, (OLvl == CodeGenOpt::None) ? UnoptArrays : OptArrays);
213
214 EE->runStaticConstructorsDestructors(true);
215 }
216
217 // Main fuzz target called by ExampleClangLLVMProtoFuzzer.cpp
218 // Mimics the lli tool to JIT the LLVM IR code and execute it
HandleLLVM(const std::string & IR,const std::vector<const char * > & ExtraArgs)219 void clang_fuzzer::HandleLLVM(const std::string &IR,
220 const std::vector<const char *> &ExtraArgs) {
221 // Populate OptArrays and UnoptArrays with the arrays from InputArrays
222 memcpy(OptArrays, InputArrays, kTotalSize);
223 memcpy(UnoptArrays, InputArrays, kTotalSize);
224
225 // Parse ExtraArgs to set the optimization level
226 CodeGenOpt::Level OLvl = getOptLevel(ExtraArgs);
227
228 // First we optimize the IR by running a loop vectorizer pass
229 std::string OptIR = OptLLVM(IR, OLvl);
230
231 CreateAndRunJITFunc(OptIR, OLvl);
232 CreateAndRunJITFunc(IR, CodeGenOpt::None);
233
234 if (memcmp(OptArrays, UnoptArrays, kTotalSize))
235 ErrorAndExit("!!!BUG!!!");
236 }
237