1//===--- llvm-isel-fuzzer.cpp - Fuzzer for instruction selection ----------===//
2//
3// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4// See https://llvm.org/LICENSE.txt for license information.
5// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6//
7//===----------------------------------------------------------------------===//
8//
9// Tool to fuzz instruction selection using libFuzzer.
10//
11//===----------------------------------------------------------------------===//
12
13#include "llvm/ADT/StringRef.h"
14#include "llvm/Analysis/TargetLibraryInfo.h"
15#include "llvm/Bitcode/BitcodeReader.h"
16#include "llvm/Bitcode/BitcodeWriter.h"
17#include "llvm/CodeGen/CommandFlags.h"
18#include "llvm/FuzzMutate/FuzzerCLI.h"
19#include "llvm/FuzzMutate/IRMutator.h"
20#include "llvm/FuzzMutate/Operations.h"
21#include "llvm/IR/Constants.h"
22#include "llvm/IR/LLVMContext.h"
23#include "llvm/IR/LegacyPassManager.h"
24#include "llvm/IR/Module.h"
25#include "llvm/IR/Verifier.h"
26#include "llvm/IRReader/IRReader.h"
27#include "llvm/Support/CommandLine.h"
28#include "llvm/Support/DataTypes.h"
29#include "llvm/Support/Debug.h"
30#include "llvm/Support/SourceMgr.h"
31#include "llvm/Support/TargetRegistry.h"
32#include "llvm/Support/TargetSelect.h"
33#include "llvm/Target/TargetMachine.h"
34
35#define DEBUG_TYPE "isel-fuzzer"
36
37using namespace llvm;
38
39static codegen::RegisterCodeGenFlags CGF;
40
41static cl::opt<char>
42OptLevel("O",
43         cl::desc("Optimization level. [-O0, -O1, -O2, or -O3] "
44                  "(default = '-O2')"),
45         cl::Prefix,
46         cl::ZeroOrMore,
47         cl::init(' '));
48
49static cl::opt<std::string>
50TargetTriple("mtriple", cl::desc("Override target triple for module"));
51
52static std::unique_ptr<TargetMachine> TM;
53static std::unique_ptr<IRMutator> Mutator;
54
55std::unique_ptr<IRMutator> createISelMutator() {
56  std::vector<TypeGetter> Types{
57      Type::getInt1Ty,  Type::getInt8Ty,  Type::getInt16Ty, Type::getInt32Ty,
58      Type::getInt64Ty, Type::getFloatTy, Type::getDoubleTy};
59
60  std::vector<std::unique_ptr<IRMutationStrategy>> Strategies;
61  Strategies.emplace_back(
62      new InjectorIRStrategy(InjectorIRStrategy::getDefaultOps()));
63  Strategies.emplace_back(new InstDeleterIRStrategy());
64
65  return std::make_unique<IRMutator>(std::move(Types), std::move(Strategies));
66}
67
68extern "C" LLVM_ATTRIBUTE_USED size_t LLVMFuzzerCustomMutator(
69    uint8_t *Data, size_t Size, size_t MaxSize, unsigned int Seed) {
70  LLVMContext Context;
71  std::unique_ptr<Module> M;
72  if (Size <= 1)
73    // We get bogus data given an empty corpus - just create a new module.
74    M.reset(new Module("M", Context));
75  else
76    M = parseModule(Data, Size, Context);
77
78  Mutator->mutateModule(*M, Seed, Size, MaxSize);
79
80  return writeModule(*M, Data, MaxSize);
81}
82
83extern "C" int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) {
84  if (Size <= 1)
85    // We get bogus data given an empty corpus - ignore it.
86    return 0;
87
88  LLVMContext Context;
89  auto M = parseAndVerify(Data, Size, Context);
90  if (!M) {
91    errs() << "error: input module is broken!\n";
92    return 0;
93  }
94
95  // Set up the module to build for our target.
96  M->setTargetTriple(TM->getTargetTriple().normalize());
97  M->setDataLayout(TM->createDataLayout());
98
99  // Build up a PM to do instruction selection.
100  legacy::PassManager PM;
101  TargetLibraryInfoImpl TLII(TM->getTargetTriple());
102  PM.add(new TargetLibraryInfoWrapperPass(TLII));
103  raw_null_ostream OS;
104  TM->addPassesToEmitFile(PM, OS, nullptr, CGFT_Null);
105  PM.run(*M);
106
107  return 0;
108}
109
110static void handleLLVMFatalError(void *, const std::string &Message, bool) {
111  // TODO: Would it be better to call into the fuzzer internals directly?
112  dbgs() << "LLVM ERROR: " << Message << "\n"
113         << "Aborting to trigger fuzzer exit handling.\n";
114  abort();
115}
116
117extern "C" LLVM_ATTRIBUTE_USED int LLVMFuzzerInitialize(int *argc,
118                                                        char ***argv) {
119  EnableDebugBuffering = true;
120
121  InitializeAllTargets();
122  InitializeAllTargetMCs();
123  InitializeAllAsmPrinters();
124  InitializeAllAsmParsers();
125
126  handleExecNameEncodedBEOpts(*argv[0]);
127  parseFuzzerCLOpts(*argc, *argv);
128
129  if (TargetTriple.empty()) {
130    errs() << *argv[0] << ": -mtriple must be specified\n";
131    exit(1);
132  }
133
134  Triple TheTriple = Triple(Triple::normalize(TargetTriple));
135
136  // Get the target specific parser.
137  std::string Error;
138  const Target *TheTarget =
139      TargetRegistry::lookupTarget(codegen::getMArch(), TheTriple, Error);
140  if (!TheTarget) {
141    errs() << argv[0] << ": " << Error;
142    return 1;
143  }
144
145  // Set up the pipeline like llc does.
146  std::string CPUStr = codegen::getCPUStr(),
147              FeaturesStr = codegen::getFeaturesStr();
148
149  CodeGenOpt::Level OLvl = CodeGenOpt::Default;
150  switch (OptLevel) {
151  default:
152    errs() << argv[0] << ": invalid optimization level.\n";
153    return 1;
154  case ' ': break;
155  case '0': OLvl = CodeGenOpt::None; break;
156  case '1': OLvl = CodeGenOpt::Less; break;
157  case '2': OLvl = CodeGenOpt::Default; break;
158  case '3': OLvl = CodeGenOpt::Aggressive; break;
159  }
160
161  TargetOptions Options = codegen::InitTargetOptionsFromCodeGenFlags(TheTriple);
162  TM.reset(TheTarget->createTargetMachine(
163      TheTriple.getTriple(), CPUStr, FeaturesStr, Options,
164      codegen::getExplicitRelocModel(), codegen::getExplicitCodeModel(), OLvl));
165  assert(TM && "Could not allocate target machine!");
166
167  // Make sure we print the summary and the current unit when LLVM errors out.
168  install_fatal_error_handler(handleLLVMFatalError, nullptr);
169
170  // Finally, create our mutator.
171  Mutator = createISelMutator();
172  return 0;
173}
174