1//==-- handle_llvm.cpp - Helper function for Clang fuzzers -----------------==//
2//
3// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4// See https://llvm.org/LICENSE.txt for license information.
5// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6//
7//===----------------------------------------------------------------------===//
8//
9// Implements HandleLLVM for use by the Clang fuzzers. First runs a loop
10// vectorizer optimization pass over the given IR code. Then mimics lli on both
11// versions to JIT the generated code and execute it. Currently, functions are
12// executed on dummy inputs.
13//
14//===----------------------------------------------------------------------===//
15
16#include "handle_llvm.h"
17#include "input_arrays.h"
18
19#include "llvm/ADT/Triple.h"
20#include "llvm/Analysis/TargetLibraryInfo.h"
21#include "llvm/Analysis/TargetTransformInfo.h"
22#include "llvm/CodeGen/CommandFlags.h"
23#include "llvm/CodeGen/MachineModuleInfo.h"
24#include "llvm/CodeGen/TargetPassConfig.h"
25#include "llvm/ExecutionEngine/JITEventListener.h"
26#include "llvm/ExecutionEngine/JITSymbol.h"
27#include "llvm/ExecutionEngine/MCJIT.h"
28#include "llvm/ExecutionEngine/ObjectCache.h"
29#include "llvm/ExecutionEngine/RTDyldMemoryManager.h"
30#include "llvm/ExecutionEngine/SectionMemoryManager.h"
31#include "llvm/IR/IRPrintingPasses.h"
32#include "llvm/IR/LLVMContext.h"
33#include "llvm/IR/LegacyPassManager.h"
34#include "llvm/IR/LegacyPassNameParser.h"
35#include "llvm/IR/Module.h"
36#include "llvm/IR/Verifier.h"
37#include "llvm/IRReader/IRReader.h"
38#include "llvm/Pass.h"
39#include "llvm/PassRegistry.h"
40#include "llvm/Support/MemoryBuffer.h"
41#include "llvm/Support/SourceMgr.h"
42#include "llvm/Support/TargetRegistry.h"
43#include "llvm/Support/TargetSelect.h"
44#include "llvm/Target/TargetMachine.h"
45#include "llvm/Transforms/IPO.h"
46#include "llvm/Transforms/IPO/PassManagerBuilder.h"
47#include "llvm/Transforms/Vectorize.h"
48
49using namespace llvm;
50
51static codegen::RegisterCodeGenFlags CGF;
52
53// Define a type for the functions that are compiled and executed
54typedef void (*LLVMFunc)(int*, int*, int*, int);
55
56// Helper function to parse command line args and find the optimization level
57static void getOptLevel(const std::vector<const char *> &ExtraArgs,
58                              CodeGenOpt::Level &OLvl) {
59  // Find the optimization level from the command line args
60  OLvl = CodeGenOpt::Default;
61  for (auto &A : ExtraArgs) {
62    if (A[0] == '-' && A[1] == 'O') {
63      switch(A[2]) {
64        case '0': OLvl = CodeGenOpt::None; break;
65        case '1': OLvl = CodeGenOpt::Less; break;
66        case '2': OLvl = CodeGenOpt::Default; break;
67        case '3': OLvl = CodeGenOpt::Aggressive; break;
68        default:
69          errs() << "error: opt level must be between 0 and 3.\n";
70          std::exit(1);
71      }
72    }
73  }
74}
75
76static void ErrorAndExit(std::string message) {
77  errs()<< "ERROR: " << message << "\n";
78  std::exit(1);
79}
80
81// Helper function to add optimization passes to the TargetMachine at the
82// specified optimization level, OptLevel
83static void AddOptimizationPasses(legacy::PassManagerBase &MPM,
84                                  CodeGenOpt::Level OptLevel,
85                                  unsigned SizeLevel) {
86  // Create and initialize a PassManagerBuilder
87  PassManagerBuilder Builder;
88  Builder.OptLevel = OptLevel;
89  Builder.SizeLevel = SizeLevel;
90  Builder.Inliner = createFunctionInliningPass(OptLevel, SizeLevel, false);
91  Builder.LoopVectorize = true;
92  Builder.populateModulePassManager(MPM);
93}
94
95// Mimics the opt tool to run an optimization pass over the provided IR
96static std::string OptLLVM(const std::string &IR, CodeGenOpt::Level OLvl) {
97  // Create a module that will run the optimization passes
98  SMDiagnostic Err;
99  LLVMContext Context;
100  std::unique_ptr<Module> M = parseIR(MemoryBufferRef(IR, "IR"), Err, Context);
101  if (!M || verifyModule(*M, &errs()))
102    ErrorAndExit("Could not parse IR");
103
104  Triple ModuleTriple(M->getTargetTriple());
105  const TargetOptions Options =
106      codegen::InitTargetOptionsFromCodeGenFlags(ModuleTriple);
107  std::string E;
108  const Target *TheTarget =
109      TargetRegistry::lookupTarget(codegen::getMArch(), ModuleTriple, E);
110  if (!TheTarget)
111    ErrorAndExit(E);
112
113  std::unique_ptr<TargetMachine> TM(TheTarget->createTargetMachine(
114      M->getTargetTriple(), codegen::getCPUStr(), codegen::getFeaturesStr(),
115      Options, codegen::getExplicitRelocModel(),
116      codegen::getExplicitCodeModel(), OLvl));
117  if (!TM)
118    ErrorAndExit("Could not create target machine");
119
120  codegen::setFunctionAttributes(codegen::getCPUStr(),
121                                 codegen::getFeaturesStr(), *M);
122
123  legacy::PassManager Passes;
124
125  Passes.add(new TargetLibraryInfoWrapperPass(ModuleTriple));
126  Passes.add(createTargetTransformInfoWrapperPass(TM->getTargetIRAnalysis()));
127
128  LLVMTargetMachine &LTM = static_cast<LLVMTargetMachine &>(*TM);
129  Passes.add(LTM.createPassConfig(Passes));
130
131  Passes.add(createVerifierPass());
132
133  AddOptimizationPasses(Passes, OLvl, 0);
134
135  // Add a pass that writes the optimized IR to an output stream
136  std::string outString;
137  raw_string_ostream OS(outString);
138  Passes.add(createPrintModulePass(OS, "", false));
139
140  Passes.run(*M);
141
142  return OS.str();
143}
144
145// Takes a function and runs it on a set of inputs
146// First determines whether f is the optimized or unoptimized function
147static void RunFuncOnInputs(LLVMFunc f, int Arr[kNumArrays][kArraySize]) {
148  for (int i = 0; i < kNumArrays / 3; i++)
149    f(Arr[i], Arr[i + (kNumArrays / 3)], Arr[i + (2 * kNumArrays / 3)],
150      kArraySize);
151}
152
153// Takes a string of IR and compiles it using LLVM's JIT Engine
154static void CreateAndRunJITFunc(const std::string &IR, CodeGenOpt::Level OLvl) {
155  SMDiagnostic Err;
156  LLVMContext Context;
157  std::unique_ptr<Module> M = parseIR(MemoryBufferRef(IR, "IR"), Err, Context);
158  if (!M)
159    ErrorAndExit("Could not parse IR");
160
161  Function *EntryFunc = M->getFunction("foo");
162  if (!EntryFunc)
163    ErrorAndExit("Function not found in module");
164
165  std::string ErrorMsg;
166  Triple ModuleTriple(M->getTargetTriple());
167
168  EngineBuilder builder(std::move(M));
169  builder.setMArch(codegen::getMArch());
170  builder.setMCPU(codegen::getCPUStr());
171  builder.setMAttrs(codegen::getFeatureList());
172  builder.setErrorStr(&ErrorMsg);
173  builder.setEngineKind(EngineKind::JIT);
174  builder.setMCJITMemoryManager(std::make_unique<SectionMemoryManager>());
175  builder.setOptLevel(OLvl);
176  builder.setTargetOptions(
177      codegen::InitTargetOptionsFromCodeGenFlags(ModuleTriple));
178
179  std::unique_ptr<ExecutionEngine> EE(builder.create());
180  if (!EE)
181    ErrorAndExit("Could not create execution engine");
182
183  EE->finalizeObject();
184  EE->runStaticConstructorsDestructors(false);
185
186#if defined(__GNUC__) && !defined(__clang) &&                                  \
187    ((__GNUC__ == 4) && (__GNUC_MINOR__ < 9))
188// Silence
189//
190//   warning: ISO C++ forbids casting between pointer-to-function and
191//   pointer-to-object [-Wpedantic]
192//
193// Since C++11 this casting is conditionally supported and GCC versions
194// starting from 4.9.0 don't warn about the cast.
195#pragma GCC diagnostic push
196#pragma GCC diagnostic ignored "-Wpedantic"
197#endif
198  LLVMFunc f = reinterpret_cast<LLVMFunc>(EE->getPointerToFunction(EntryFunc));
199#if defined(__GNUC__) && !defined(__clang) &&                                  \
200    ((__GNUC__ == 4) && (__GNUC_MINOR__ < 9))
201#pragma GCC diagnostic pop
202#endif
203
204  // Figure out if we are running the optimized func or the unoptimized func
205  RunFuncOnInputs(f, (OLvl == CodeGenOpt::None) ? UnoptArrays : OptArrays);
206
207  EE->runStaticConstructorsDestructors(true);
208}
209
210// Main fuzz target called by ExampleClangLLVMProtoFuzzer.cpp
211// Mimics the lli tool to JIT the LLVM IR code and execute it
212void clang_fuzzer::HandleLLVM(const std::string &IR,
213                              const std::vector<const char *> &ExtraArgs) {
214  // Populate OptArrays and UnoptArrays with the arrays from InputArrays
215  memcpy(OptArrays, InputArrays, kTotalSize);
216  memcpy(UnoptArrays, InputArrays, kTotalSize);
217
218  // Parse ExtraArgs to set the optimization level
219  CodeGenOpt::Level OLvl;
220  getOptLevel(ExtraArgs, OLvl);
221
222  // First we optimize the IR by running a loop vectorizer pass
223  std::string OptIR = OptLLVM(IR, OLvl);
224
225  CreateAndRunJITFunc(OptIR, OLvl);
226  CreateAndRunJITFunc(IR, CodeGenOpt::None);
227
228  if (memcmp(OptArrays, UnoptArrays, kTotalSize))
229    ErrorAndExit("!!!BUG!!!");
230
231  return;
232}
233