Home | History | Annotate | Line # | Download | only in handle-llvm 
      1 //==-- handle_llvm.cpp - Helper function for Clang fuzzers -----------------==//
      2 //
      3 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
      4 // See https://llvm.org/LICENSE.txt for license information.
      5 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
      6 //
      7 //===----------------------------------------------------------------------===//
      8 //
      9 // Implements HandleLLVM for use by the Clang fuzzers. First runs a loop
     10 // vectorizer optimization pass over the given IR code. Then mimics lli on both
     11 // versions to JIT the generated code and execute it. Currently, functions are
     12 // executed on dummy inputs.
     13 //
     14 //===----------------------------------------------------------------------===//
     15 
     16 #include "handle_llvm.h"
     17 #include "input_arrays.h"
     18 
     19 #include "llvm/ADT/Triple.h"
     20 #include "llvm/Analysis/TargetLibraryInfo.h"
     21 #include "llvm/Analysis/TargetTransformInfo.h"
     22 #include "llvm/CodeGen/CommandFlags.h"
     23 #include "llvm/CodeGen/MachineModuleInfo.h"
     24 #include "llvm/CodeGen/TargetPassConfig.h"
     25 #include "llvm/ExecutionEngine/JITEventListener.h"
     26 #include "llvm/ExecutionEngine/JITSymbol.h"
     27 #include "llvm/ExecutionEngine/MCJIT.h"
     28 #include "llvm/ExecutionEngine/ObjectCache.h"
     29 #include "llvm/ExecutionEngine/RTDyldMemoryManager.h"
     30 #include "llvm/ExecutionEngine/SectionMemoryManager.h"
     31 #include "llvm/IR/IRPrintingPasses.h"
     32 #include "llvm/IR/LLVMContext.h"
     33 #include "llvm/IR/LegacyPassManager.h"
     34 #include "llvm/IR/LegacyPassNameParser.h"
     35 #include "llvm/IR/Module.h"
     36 #include "llvm/IR/Verifier.h"
     37 #include "llvm/IRReader/IRReader.h"
     38 #include "llvm/Pass.h"
     39 #include "llvm/PassRegistry.h"
     40 #include "llvm/Support/MemoryBuffer.h"
     41 #include "llvm/Support/SourceMgr.h"
     42 #include "llvm/Support/TargetRegistry.h"
     43 #include "llvm/Support/TargetSelect.h"
     44 #include "llvm/Target/TargetMachine.h"
     45 #include "llvm/Transforms/IPO.h"
     46 #include "llvm/Transforms/IPO/PassManagerBuilder.h"
     47 #include "llvm/Transforms/Vectorize.h"
     48 
     49 using namespace llvm;
     50 
     51 static codegen::RegisterCodeGenFlags CGF;
     52 
     53 // Define a type for the functions that are compiled and executed
     54 typedef void (*LLVMFunc)(int*, int*, int*, int);
     55 
     56 // Helper function to parse command line args and find the optimization level
     57 static void getOptLevel(const std::vector<const char *> &ExtraArgs,
     58                               CodeGenOpt::Level &OLvl) {
     59   // Find the optimization level from the command line args
     60   OLvl = CodeGenOpt::Default;
     61   for (auto &A : ExtraArgs) {
     62     if (A[0] == '-' && A[1] == 'O') {
     63       switch(A[2]) {
     64         case '0': OLvl = CodeGenOpt::None; break;
     65         case '1': OLvl = CodeGenOpt::Less; break;
     66         case '2': OLvl = CodeGenOpt::Default; break;
     67         case '3': OLvl = CodeGenOpt::Aggressive; break;
     68         default:
     69           errs() << "error: opt level must be between 0 and 3.\n";
     70           std::exit(1);
     71       }
     72     }
     73   }
     74 }
     75 
     76 static void ErrorAndExit(std::string message) {
     77   errs()<< "ERROR: " << message << "\n";
     78   std::exit(1);
     79 }
     80 
     81 // Helper function to add optimization passes to the TargetMachine at the
     82 // specified optimization level, OptLevel
     83 static void AddOptimizationPasses(legacy::PassManagerBase &MPM,
     84                                   CodeGenOpt::Level OptLevel,
     85                                   unsigned SizeLevel) {
     86   // Create and initialize a PassManagerBuilder
     87   PassManagerBuilder Builder;
     88   Builder.OptLevel = OptLevel;
     89   Builder.SizeLevel = SizeLevel;
     90   Builder.Inliner = createFunctionInliningPass(OptLevel, SizeLevel, false);
     91   Builder.LoopVectorize = true;
     92   Builder.populateModulePassManager(MPM);
     93 }
     94 
     95 // Mimics the opt tool to run an optimization pass over the provided IR
     96 static std::string OptLLVM(const std::string &IR, CodeGenOpt::Level OLvl) {
     97   // Create a module that will run the optimization passes
     98   SMDiagnostic Err;
     99   LLVMContext Context;
    100   std::unique_ptr<Module> M = parseIR(MemoryBufferRef(IR, "IR"), Err, Context);
    101   if (!M || verifyModule(*M, &errs()))
    102     ErrorAndExit("Could not parse IR");
    103 
    104   Triple ModuleTriple(M->getTargetTriple());
    105   const TargetOptions Options =
    106       codegen::InitTargetOptionsFromCodeGenFlags(ModuleTriple);
    107   std::string E;
    108   const Target *TheTarget =
    109       TargetRegistry::lookupTarget(codegen::getMArch(), ModuleTriple, E);
    110   if (!TheTarget)
    111     ErrorAndExit(E);
    112 
    113   std::unique_ptr<TargetMachine> TM(TheTarget->createTargetMachine(
    114       M->getTargetTriple(), codegen::getCPUStr(), codegen::getFeaturesStr(),
    115       Options, codegen::getExplicitRelocModel(),
    116       codegen::getExplicitCodeModel(), OLvl));
    117   if (!TM)
    118     ErrorAndExit("Could not create target machine");
    119 
    120   codegen::setFunctionAttributes(codegen::getCPUStr(),
    121                                  codegen::getFeaturesStr(), *M);
    122 
    123   legacy::PassManager Passes;
    124 
    125   Passes.add(new TargetLibraryInfoWrapperPass(ModuleTriple));
    126   Passes.add(createTargetTransformInfoWrapperPass(TM->getTargetIRAnalysis()));
    127 
    128   LLVMTargetMachine &LTM = static_cast<LLVMTargetMachine &>(*TM);
    129   Passes.add(LTM.createPassConfig(Passes));
    130 
    131   Passes.add(createVerifierPass());
    132 
    133   AddOptimizationPasses(Passes, OLvl, 0);
    134 
    135   // Add a pass that writes the optimized IR to an output stream
    136   std::string outString;
    137   raw_string_ostream OS(outString);
    138   Passes.add(createPrintModulePass(OS, "", false));
    139 
    140   Passes.run(*M);
    141 
    142   return OS.str();
    143 }
    144 
    145 // Takes a function and runs it on a set of inputs
    146 // First determines whether f is the optimized or unoptimized function
    147 static void RunFuncOnInputs(LLVMFunc f, int Arr[kNumArrays][kArraySize]) {
    148   for (int i = 0; i < kNumArrays / 3; i++)
    149     f(Arr[i], Arr[i + (kNumArrays / 3)], Arr[i + (2 * kNumArrays / 3)],
    150       kArraySize);
    151 }
    152 
    153 // Takes a string of IR and compiles it using LLVM's JIT Engine
    154 static void CreateAndRunJITFunc(const std::string &IR, CodeGenOpt::Level OLvl) {
    155   SMDiagnostic Err;
    156   LLVMContext Context;
    157   std::unique_ptr<Module> M = parseIR(MemoryBufferRef(IR, "IR"), Err, Context);
    158   if (!M)
    159     ErrorAndExit("Could not parse IR");
    160 
    161   Function *EntryFunc = M->getFunction("foo");
    162   if (!EntryFunc)
    163     ErrorAndExit("Function not found in module");
    164 
    165   std::string ErrorMsg;
    166   Triple ModuleTriple(M->getTargetTriple());
    167 
    168   EngineBuilder builder(std::move(M));
    169   builder.setMArch(codegen::getMArch());
    170   builder.setMCPU(codegen::getCPUStr());
    171   builder.setMAttrs(codegen::getFeatureList());
    172   builder.setErrorStr(&ErrorMsg);
    173   builder.setEngineKind(EngineKind::JIT);
    174   builder.setMCJITMemoryManager(std::make_unique<SectionMemoryManager>());
    175   builder.setOptLevel(OLvl);
    176   builder.setTargetOptions(
    177       codegen::InitTargetOptionsFromCodeGenFlags(ModuleTriple));
    178 
    179   std::unique_ptr<ExecutionEngine> EE(builder.create());
    180   if (!EE)
    181     ErrorAndExit("Could not create execution engine");
    182 
    183   EE->finalizeObject();
    184   EE->runStaticConstructorsDestructors(false);
    185 
    186 #if defined(__GNUC__) && !defined(__clang) &&                                  \
    187     ((__GNUC__ == 4) && (__GNUC_MINOR__ < 9))
    188 // Silence
    189 //
    190 //   warning: ISO C++ forbids casting between pointer-to-function and
    191 //   pointer-to-object [-Wpedantic]
    192 //
    193 // Since C++11 this casting is conditionally supported and GCC versions
    194 // starting from 4.9.0 don't warn about the cast.
    195 #pragma GCC diagnostic push
    196 #pragma GCC diagnostic ignored "-Wpedantic"
    197 #endif
    198   LLVMFunc f = reinterpret_cast<LLVMFunc>(EE->getPointerToFunction(EntryFunc));
    199 #if defined(__GNUC__) && !defined(__clang) &&                                  \
    200     ((__GNUC__ == 4) && (__GNUC_MINOR__ < 9))
    201 #pragma GCC diagnostic pop
    202 #endif
    203 
    204   // Figure out if we are running the optimized func or the unoptimized func
    205   RunFuncOnInputs(f, (OLvl == CodeGenOpt::None) ? UnoptArrays : OptArrays);
    206 
    207   EE->runStaticConstructorsDestructors(true);
    208 }
    209 
    210 // Main fuzz target called by ExampleClangLLVMProtoFuzzer.cpp
    211 // Mimics the lli tool to JIT the LLVM IR code and execute it
    212 void clang_fuzzer::HandleLLVM(const std::string &IR,
    213                               const std::vector<const char *> &ExtraArgs) {
    214   // Populate OptArrays and UnoptArrays with the arrays from InputArrays
    215   memcpy(OptArrays, InputArrays, kTotalSize);
    216   memcpy(UnoptArrays, InputArrays, kTotalSize);
    217 
    218   // Parse ExtraArgs to set the optimization level
    219   CodeGenOpt::Level OLvl;
    220   getOptLevel(ExtraArgs, OLvl);
    221 
    222   // First we optimize the IR by running a loop vectorizer pass
    223   std::string OptIR = OptLLVM(IR, OLvl);
    224 
    225   CreateAndRunJITFunc(OptIR, OLvl);
    226   CreateAndRunJITFunc(IR, CodeGenOpt::None);
    227 
    228   if (memcmp(OptArrays, UnoptArrays, kTotalSize))
    229     ErrorAndExit("!!!BUG!!!");
    230 
    231   return;
    232 }
    233