1 //==-- handle_llvm.cpp - Helper function for Clang fuzzers -----------------==// 2 // 3 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions. 4 // See https://llvm.org/LICENSE.txt for license information. 5 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception 6 // 7 //===----------------------------------------------------------------------===// 8 // 9 // Implements HandleLLVM for use by the Clang fuzzers. First runs a loop 10 // vectorizer optimization pass over the given IR code. Then mimics lli on both 11 // versions to JIT the generated code and execute it. Currently, functions are 12 // executed on dummy inputs. 13 // 14 //===----------------------------------------------------------------------===// 15 16 #include "handle_llvm.h" 17 #include "input_arrays.h" 18 19 #include "llvm/ADT/Triple.h" 20 #include "llvm/Analysis/TargetLibraryInfo.h" 21 #include "llvm/Analysis/TargetTransformInfo.h" 22 #include "llvm/CodeGen/CommandFlags.h" 23 #include "llvm/CodeGen/MachineModuleInfo.h" 24 #include "llvm/CodeGen/TargetPassConfig.h" 25 #include "llvm/ExecutionEngine/JITEventListener.h" 26 #include "llvm/ExecutionEngine/JITSymbol.h" 27 #include "llvm/ExecutionEngine/MCJIT.h" 28 #include "llvm/ExecutionEngine/ObjectCache.h" 29 #include "llvm/ExecutionEngine/RTDyldMemoryManager.h" 30 #include "llvm/ExecutionEngine/SectionMemoryManager.h" 31 #include "llvm/IR/IRPrintingPasses.h" 32 #include "llvm/IR/LLVMContext.h" 33 #include "llvm/IR/Module.h" 34 #include "llvm/IR/Verifier.h" 35 #include "llvm/IRPrinter/IRPrintingPasses.h" 36 #include "llvm/IRReader/IRReader.h" 37 #include "llvm/MC/TargetRegistry.h" 38 #include "llvm/Passes/OptimizationLevel.h" 39 #include "llvm/Passes/PassBuilder.h" 40 #include "llvm/Support/MemoryBuffer.h" 41 #include "llvm/Support/SourceMgr.h" 42 #include "llvm/Support/TargetSelect.h" 43 #include "llvm/Target/TargetMachine.h" 44 45 using namespace llvm; 46 47 // Define a type for the functions that are compiled and executed 48 typedef void (*LLVMFunc)(int*, int*, int*, int); 49 50 // Helper function to parse command line args and find the optimization level 51 static CodeGenOpt::Level 52 getOptLevel(const std::vector<const char *> &ExtraArgs) { 53 // Find the optimization level from the command line args 54 CodeGenOpt::Level OLvl = CodeGenOpt::Default; 55 for (auto &A : ExtraArgs) { 56 if (A[0] == '-' && A[1] == 'O') { 57 if (auto Level = CodeGenOpt::parseLevel(A[2])) { 58 OLvl = *Level; 59 } else { 60 errs() << "error: opt level must be between 0 and 3.\n"; 61 std::exit(1); 62 } 63 } 64 } 65 return OLvl; 66 } 67 68 static void ErrorAndExit(std::string message) { 69 errs()<< "ERROR: " << message << "\n"; 70 std::exit(1); 71 } 72 73 // Helper function to add optimization passes to the TargetMachine at the 74 // specified optimization level, OptLevel 75 static void RunOptimizationPasses(raw_ostream &OS, Module &M, 76 CodeGenOpt::Level OptLevel) { 77 llvm::OptimizationLevel OL; 78 switch (OptLevel) { 79 case CodeGenOpt::None: 80 OL = OptimizationLevel::O0; 81 break; 82 case CodeGenOpt::Less: 83 OL = OptimizationLevel::O1; 84 break; 85 case CodeGenOpt::Default: 86 OL = OptimizationLevel::O2; 87 break; 88 case CodeGenOpt::Aggressive: 89 OL = OptimizationLevel::O3; 90 break; 91 } 92 93 LoopAnalysisManager LAM; 94 FunctionAnalysisManager FAM; 95 CGSCCAnalysisManager CGAM; 96 ModuleAnalysisManager MAM; 97 98 PassBuilder PB; 99 100 PB.registerModuleAnalyses(MAM); 101 PB.registerCGSCCAnalyses(CGAM); 102 PB.registerFunctionAnalyses(FAM); 103 PB.registerLoopAnalyses(LAM); 104 PB.crossRegisterProxies(LAM, FAM, CGAM, MAM); 105 106 ModulePassManager MPM; 107 if (OL == OptimizationLevel::O0) 108 MPM = PB.buildO0DefaultPipeline(OL); 109 else 110 MPM = PB.buildPerModuleDefaultPipeline(OL); 111 MPM.addPass(PrintModulePass(OS)); 112 113 MPM.run(M, MAM); 114 } 115 116 // Mimics the opt tool to run an optimization pass over the provided IR 117 static std::string OptLLVM(const std::string &IR, CodeGenOpt::Level OLvl) { 118 // Create a module that will run the optimization passes 119 SMDiagnostic Err; 120 LLVMContext Context; 121 std::unique_ptr<Module> M = parseIR(MemoryBufferRef(IR, "IR"), Err, Context); 122 if (!M || verifyModule(*M, &errs())) 123 ErrorAndExit("Could not parse IR"); 124 125 Triple ModuleTriple(M->getTargetTriple()); 126 const TargetOptions Options = 127 codegen::InitTargetOptionsFromCodeGenFlags(ModuleTriple); 128 std::string E; 129 const Target *TheTarget = 130 TargetRegistry::lookupTarget(codegen::getMArch(), ModuleTriple, E); 131 if (!TheTarget) 132 ErrorAndExit(E); 133 134 std::unique_ptr<TargetMachine> TM(TheTarget->createTargetMachine( 135 M->getTargetTriple(), codegen::getCPUStr(), codegen::getFeaturesStr(), 136 Options, codegen::getExplicitRelocModel(), 137 codegen::getExplicitCodeModel(), OLvl)); 138 if (!TM) 139 ErrorAndExit("Could not create target machine"); 140 141 codegen::setFunctionAttributes(codegen::getCPUStr(), 142 codegen::getFeaturesStr(), *M); 143 144 // Add a pass that writes the optimized IR to an output stream 145 std::string outString; 146 raw_string_ostream OS(outString); 147 RunOptimizationPasses(OS, *M, OLvl); 148 149 return outString; 150 } 151 152 // Takes a function and runs it on a set of inputs 153 // First determines whether f is the optimized or unoptimized function 154 static void RunFuncOnInputs(LLVMFunc f, int Arr[kNumArrays][kArraySize]) { 155 for (int i = 0; i < kNumArrays / 3; i++) 156 f(Arr[i], Arr[i + (kNumArrays / 3)], Arr[i + (2 * kNumArrays / 3)], 157 kArraySize); 158 } 159 160 // Takes a string of IR and compiles it using LLVM's JIT Engine 161 static void CreateAndRunJITFunc(const std::string &IR, CodeGenOpt::Level OLvl) { 162 SMDiagnostic Err; 163 LLVMContext Context; 164 std::unique_ptr<Module> M = parseIR(MemoryBufferRef(IR, "IR"), Err, Context); 165 if (!M) 166 ErrorAndExit("Could not parse IR"); 167 168 Function *EntryFunc = M->getFunction("foo"); 169 if (!EntryFunc) 170 ErrorAndExit("Function not found in module"); 171 172 std::string ErrorMsg; 173 Triple ModuleTriple(M->getTargetTriple()); 174 175 EngineBuilder builder(std::move(M)); 176 builder.setMArch(codegen::getMArch()); 177 builder.setMCPU(codegen::getCPUStr()); 178 builder.setMAttrs(codegen::getFeatureList()); 179 builder.setErrorStr(&ErrorMsg); 180 builder.setEngineKind(EngineKind::JIT); 181 builder.setMCJITMemoryManager(std::make_unique<SectionMemoryManager>()); 182 builder.setOptLevel(OLvl); 183 builder.setTargetOptions( 184 codegen::InitTargetOptionsFromCodeGenFlags(ModuleTriple)); 185 186 std::unique_ptr<ExecutionEngine> EE(builder.create()); 187 if (!EE) 188 ErrorAndExit("Could not create execution engine"); 189 190 EE->finalizeObject(); 191 EE->runStaticConstructorsDestructors(false); 192 193 #if defined(__GNUC__) && !defined(__clang) && \ 194 ((__GNUC__ == 4) && (__GNUC_MINOR__ < 9)) 195 // Silence 196 // 197 // warning: ISO C++ forbids casting between pointer-to-function and 198 // pointer-to-object [-Wpedantic] 199 // 200 // Since C++11 this casting is conditionally supported and GCC versions 201 // starting from 4.9.0 don't warn about the cast. 202 #pragma GCC diagnostic push 203 #pragma GCC diagnostic ignored "-Wpedantic" 204 #endif 205 LLVMFunc f = reinterpret_cast<LLVMFunc>(EE->getPointerToFunction(EntryFunc)); 206 #if defined(__GNUC__) && !defined(__clang) && \ 207 ((__GNUC__ == 4) && (__GNUC_MINOR__ < 9)) 208 #pragma GCC diagnostic pop 209 #endif 210 211 // Figure out if we are running the optimized func or the unoptimized func 212 RunFuncOnInputs(f, (OLvl == CodeGenOpt::None) ? UnoptArrays : OptArrays); 213 214 EE->runStaticConstructorsDestructors(true); 215 } 216 217 // Main fuzz target called by ExampleClangLLVMProtoFuzzer.cpp 218 // Mimics the lli tool to JIT the LLVM IR code and execute it 219 void clang_fuzzer::HandleLLVM(const std::string &IR, 220 const std::vector<const char *> &ExtraArgs) { 221 // Populate OptArrays and UnoptArrays with the arrays from InputArrays 222 memcpy(OptArrays, InputArrays, kTotalSize); 223 memcpy(UnoptArrays, InputArrays, kTotalSize); 224 225 // Parse ExtraArgs to set the optimization level 226 CodeGenOpt::Level OLvl = getOptLevel(ExtraArgs); 227 228 // First we optimize the IR by running a loop vectorizer pass 229 std::string OptIR = OptLLVM(IR, OLvl); 230 231 CreateAndRunJITFunc(OptIR, OLvl); 232 CreateAndRunJITFunc(IR, CodeGenOpt::None); 233 234 if (memcmp(OptArrays, UnoptArrays, kTotalSize)) 235 ErrorAndExit("!!!BUG!!!"); 236 } 237