aboutsummaryrefslogtreecommitdiff
path: root/tools/llvm-mc-fuzzer/llvm-mc-fuzzer.cpp
diff options
context:
space:
mode:
authorDimitry Andric <dim@FreeBSD.org>2017-04-16 16:01:22 +0000
committerDimitry Andric <dim@FreeBSD.org>2017-04-16 16:01:22 +0000
commit71d5a2540a98c81f5bcaeb48805e0e2881f530ef (patch)
tree5343938942df402b49ec7300a1c25a2d4ccd5821 /tools/llvm-mc-fuzzer/llvm-mc-fuzzer.cpp
parent31bbf64f3a4974a2d6c8b3b27ad2f519caf74057 (diff)
Diffstat (limited to 'tools/llvm-mc-fuzzer/llvm-mc-fuzzer.cpp')
-rw-r--r--tools/llvm-mc-fuzzer/llvm-mc-fuzzer.cpp159
1 files changed, 0 insertions, 159 deletions
diff --git a/tools/llvm-mc-fuzzer/llvm-mc-fuzzer.cpp b/tools/llvm-mc-fuzzer/llvm-mc-fuzzer.cpp
deleted file mode 100644
index e31ea762add5..000000000000
--- a/tools/llvm-mc-fuzzer/llvm-mc-fuzzer.cpp
+++ /dev/null
@@ -1,159 +0,0 @@
-//===--- llvm-mc-fuzzer.cpp - Fuzzer for the MC layer ---------------------===//
-//
-// The LLVM Compiler Infrastructure
-//
-// This file is distributed under the University of Illinois Open Source
-// License. See LICENSE.TXT for details.
-//
-//===----------------------------------------------------------------------===//
-//
-//===----------------------------------------------------------------------===//
-
-#include "FuzzerInterface.h"
-#include "llvm-c/Disassembler.h"
-#include "llvm-c/Target.h"
-#include "llvm/MC/SubtargetFeature.h"
-#include "llvm/Support/CommandLine.h"
-#include "llvm/Support/raw_ostream.h"
-
-using namespace llvm;
-
-const unsigned AssemblyTextBufSize = 80;
-
-enum ActionType {
- AC_Assemble,
- AC_Disassemble
-};
-
-static cl::opt<ActionType>
-Action(cl::desc("Action to perform:"),
- cl::init(AC_Assemble),
- cl::values(clEnumValN(AC_Assemble, "assemble",
- "Assemble a .s file (default)"),
- clEnumValN(AC_Disassemble, "disassemble",
- "Disassemble strings of hex bytes")));
-
-static cl::opt<std::string>
- TripleName("triple", cl::desc("Target triple to assemble for, "
- "see -version for available targets"));
-
-static cl::opt<std::string>
- MCPU("mcpu",
- cl::desc("Target a specific cpu type (-mcpu=help for details)"),
- cl::value_desc("cpu-name"), cl::init(""));
-
-// This is useful for variable-length instruction sets.
-static cl::opt<unsigned> InsnLimit(
- "insn-limit",
- cl::desc("Limit the number of instructions to process (0 for no limit)"),
- cl::value_desc("count"), cl::init(0));
-
-static cl::list<std::string>
- MAttrs("mattr", cl::CommaSeparated,
- cl::desc("Target specific attributes (-mattr=help for details)"),
- cl::value_desc("a1,+a2,-a3,..."));
-// The feature string derived from -mattr's values.
-std::string FeaturesStr;
-
-static cl::list<std::string>
- FuzzerArgs("fuzzer-args", cl::Positional,
- cl::desc("Options to pass to the fuzzer"), cl::ZeroOrMore,
- cl::PositionalEatsArgs);
-static std::vector<char *> ModifiedArgv;
-
-int DisassembleOneInput(const uint8_t *Data, size_t Size) {
- char AssemblyText[AssemblyTextBufSize];
-
- std::vector<uint8_t> DataCopy(Data, Data + Size);
-
- LLVMDisasmContextRef Ctx = LLVMCreateDisasmCPUFeatures(
- TripleName.c_str(), MCPU.c_str(), FeaturesStr.c_str(), nullptr, 0,
- nullptr, nullptr);
- assert(Ctx);
- uint8_t *p = DataCopy.data();
- unsigned Consumed;
- unsigned InstructionsProcessed = 0;
- do {
- Consumed = LLVMDisasmInstruction(Ctx, p, Size, 0, AssemblyText,
- AssemblyTextBufSize);
- Size -= Consumed;
- p += Consumed;
-
- InstructionsProcessed ++;
- if (InsnLimit != 0 && InstructionsProcessed < InsnLimit)
- break;
- } while (Consumed != 0);
- LLVMDisasmDispose(Ctx);
- return 0;
-}
-
-int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) {
- if (Action == AC_Assemble)
- errs() << "error: -assemble is not implemented\n";
- else if (Action == AC_Disassemble)
- return DisassembleOneInput(Data, Size);
-
- llvm_unreachable("Unknown action");
- return 0;
-}
-
-int LLVMFuzzerInitialize(int *argc, char ***argv) {
- // The command line is unusual compared to other fuzzers due to the need to
- // specify the target. Options like -triple, -mcpu, and -mattr work like
- // their counterparts in llvm-mc, while -fuzzer-args collects options for the
- // fuzzer itself.
- //
- // Examples:
- //
- // Fuzz the big-endian MIPS32R6 disassembler using 100,000 inputs of up to
- // 4-bytes each and use the contents of ./corpus as the test corpus:
- // llvm-mc-fuzzer -triple mips-linux-gnu -mcpu=mips32r6 -disassemble \
- // -fuzzer-args -max_len=4 -runs=100000 ./corpus
- //
- // Infinitely fuzz the little-endian MIPS64R2 disassembler with the MSA
- // feature enabled using up to 64-byte inputs:
- // llvm-mc-fuzzer -triple mipsel-linux-gnu -mcpu=mips64r2 -mattr=msa \
- // -disassemble -fuzzer-args ./corpus
- //
- // If your aim is to find instructions that are not tested, then it is
- // advisable to constrain the maximum input size to a single instruction
- // using -max_len as in the first example. This results in a test corpus of
- // individual instructions that test unique paths. Without this constraint,
- // there will be considerable redundancy in the corpus.
-
- char **OriginalArgv = *argv;
-
- LLVMInitializeAllTargetInfos();
- LLVMInitializeAllTargetMCs();
- LLVMInitializeAllDisassemblers();
-
- cl::ParseCommandLineOptions(*argc, OriginalArgv);
-
- // Rebuild the argv without the arguments llvm-mc-fuzzer consumed so that
- // the driver can parse its arguments.
- //
- // FuzzerArgs cannot provide the non-const pointer that OriginalArgv needs.
- // Re-use the strings from OriginalArgv instead of copying FuzzerArg to a
- // non-const buffer to avoid the need to clean up when the fuzzer terminates.
- ModifiedArgv.push_back(OriginalArgv[0]);
- for (const auto &FuzzerArg : FuzzerArgs) {
- for (int i = 1; i < *argc; ++i) {
- if (FuzzerArg == OriginalArgv[i])
- ModifiedArgv.push_back(OriginalArgv[i]);
- }
- }
- *argc = ModifiedArgv.size();
- *argv = ModifiedArgv.data();
-
- // Package up features to be passed to target/subtarget
- // We have to pass it via a global since the callback doesn't
- // permit any user data.
- if (MAttrs.size()) {
- SubtargetFeatures Features;
- for (unsigned i = 0; i != MAttrs.size(); ++i)
- Features.AddFeature(MAttrs[i]);
- FeaturesStr = Features.getString();
- }
-
- return 0;
-}