From dd0a8c200c5de8ee87c2423ac1b954bb311ba872 Mon Sep 17 00:00:00 2001 From: van Hauser Date: Fri, 20 Sep 2019 18:22:01 +0200 Subject: Makefile fix --- llvm_mode/Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'llvm_mode') diff --git a/llvm_mode/Makefile b/llvm_mode/Makefile index f635ca83..ed853d9d 100644 --- a/llvm_mode/Makefile +++ b/llvm_mode/Makefile @@ -37,7 +37,7 @@ endif LLVMVER = $(shell $(LLVM_CONFIG) --version) LLVM_UNSUPPORTED = $(shell $(LLVM_CONFIG) --version | egrep -q '^[12]|^3\.0|^1[0-9]' && echo 1 || echo 0 ) -LLVM_MAJOR = ($shell $(LLVM_CONFIG) --version | sed 's/\..*//') +LLVM_MAJOR = $(shell $(LLVM_CONFIG) --version | sed 's/\..*//') ifeq "$(LLVM_UNSUPPORTED)" "1" $(warn llvm_mode only supports versions 3.8.0 up to 9) -- cgit 1.4.1 From 123d97bfb896aefca24ff8bdc235b900fe714fde Mon Sep 17 00:00:00 2001 From: van Hauser Date: Fri, 20 Sep 2019 18:37:16 +0200 Subject: LLVM_CONFIG llvm_mode fix --- docs/ChangeLog | 2 ++ llvm_mode/Makefile | 16 ++++++++++++---- llvm_mode/README.md | 4 ++++ 3 files changed, 18 insertions(+), 4 deletions(-) (limited to 'llvm_mode') diff --git a/docs/ChangeLog b/docs/ChangeLog index 4ea4e4b2..b32253b6 100644 --- a/docs/ChangeLog +++ b/docs/ChangeLog @@ -22,6 +22,8 @@ Version ++2.54d (dev): add AFL_CUSTOM_MUTATOR_ONLY (that will trigger the previous behaviour) - no more unlinking the input file, this way the input file can also be a FIFO or disk partition + - setting LLVM_CONFIG for llvm_mode will now again switch to the selected + llvm version. If you setup is correct. - reducing duplicate code in afl-fuzz - added "make help" - removed compile warnings from python internal stuff diff --git a/llvm_mode/Makefile b/llvm_mode/Makefile index ed853d9d..2d35505e 100644 --- a/llvm_mode/Makefile +++ b/llvm_mode/Makefile @@ -38,6 +38,7 @@ endif LLVMVER = $(shell $(LLVM_CONFIG) --version) LLVM_UNSUPPORTED = $(shell $(LLVM_CONFIG) --version | egrep -q '^[12]|^3\.0|^1[0-9]' && echo 1 || echo 0 ) LLVM_MAJOR = $(shell $(LLVM_CONFIG) --version | sed 's/\..*//') +LLVM_BINDIR = $(shell $(LLVM_CONFIG) --bindir) ifeq "$(LLVM_UNSUPPORTED)" "1" $(warn llvm_mode only supports versions 3.8.0 up to 9) @@ -77,11 +78,18 @@ endif # this seems to be busted on some distros, so using the one in $PATH is # probably better. -ifeq "$(origin CC)" "default" - ifeq "$(shell uname)" "OpenBSD" - CC = $(BIN_PATH)/clang - CXX = $(BIN_PATH)/clang++ +CC = $(LLVM_BINDIR)/clang +CXX = $(LLVM_BINDIR)/clang++ + +ifeq "$(shell test -e $(CC) || echo 1 )" "1" + # llvm-config --bindir is not providing a valid path, so ... + ifeq "$(shell test -e "$(BIN_DIR)/clang" && echo 1)" "1" + # we found one in the local install directory, lets use these + CC = $(BIN_DIR)/clang + CXX = $(BIN_DIR)/clang++ else + # hope for the best + $(warn we have trouble finding clang/clang++ - llvm-config is not helping us) CC = clang CXX = clang++ endif diff --git a/llvm_mode/README.md b/llvm_mode/README.md index c7ef4b45..f196395b 100644 --- a/llvm_mode/README.md +++ b/llvm_mode/README.md @@ -41,6 +41,10 @@ In order to leverage this mechanism, you need to have clang installed on your system. You should also make sure that the llvm-config tool is in your path (or pointed to via LLVM_CONFIG in the environment). +Note that if you have several LLVM versions installed, pointing LLVM_CONFIG +to the version you want to use will switch compiling to this specific +version - if you installation is set up correctly :-) + Unfortunately, some systems that do have clang come without llvm-config or the LLVM development headers; one example of this is FreeBSD. FreeBSD users will also run into problems with clang being built statically and not being able to -- cgit 1.4.1 From 1e503a586d9f3d45e27bc1dbb3b2093c1e5f7b6f Mon Sep 17 00:00:00 2001 From: hexcoder- Date: Sun, 22 Sep 2019 08:02:56 +0200 Subject: first realisation of splitting floating point compares activated with AFL_LLVM_LAF_SPLIT_COMPARES=1 needs testing on big endian machines A compare is split into sign integer comparison exponent integer comparison mantissa/fraction integer comparison These integer comparisons are further splitted if they are bigger than a byte. --- docs/env_variables.txt | 3 +- llvm_mode/split-compares-pass.so.cc | 544 +++++++++++++++++++++++++++++++----- 2 files changed, 481 insertions(+), 66 deletions(-) (limited to 'llvm_mode') diff --git a/docs/env_variables.txt b/docs/env_variables.txt index d5688939..e763118e 100644 --- a/docs/env_variables.txt +++ b/docs/env_variables.txt @@ -97,7 +97,8 @@ Then there are a few specific features that are only available in llvm_mode: - Setting AFL_LLVM_LAF_TRANSFORM_COMPARES will split string compare functions - - Setting AFL_LLVM_LAF_SPLIT_COMPARES will split > 8 bit CMP instructions + - Setting AFL_LLVM_LAF_SPLIT_COMPARES will split all floating point and + 64, 32 and 16 bit integer CMP instructions See llvm_mode/README.laf-intel for more information. diff --git a/llvm_mode/split-compares-pass.so.cc b/llvm_mode/split-compares-pass.so.cc index 1e9d6542..c5da42c0 100644 --- a/llvm_mode/split-compares-pass.so.cc +++ b/llvm_mode/split-compares-pass.so.cc @@ -1,5 +1,6 @@ /* * Copyright 2016 laf-intel + * extended for floating point by Heiko Eißfeldt * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. @@ -21,6 +22,7 @@ #include "llvm/Transforms/Utils/BasicBlockUtils.h" #include "llvm/IR/Verifier.h" #include "llvm/IR/Module.h" +#include "llvm/ADT/APFloat.h" #include "llvm/IR/IRBuilder.h" @@ -49,9 +51,11 @@ class SplitComparesTransform : public ModulePass { } private: - bool splitCompares(Module &M, unsigned bitw); + size_t splitIntCompares(Module &M, unsigned bitw); + size_t splitFPCompares(Module &M); bool simplifyCompares(Module &M); - bool simplifySignedness(Module &M); + bool simplifyIntSignedness(Module &M); + size_t nextPowerOfTwo(size_t in); }; @@ -65,6 +69,7 @@ bool SplitComparesTransform::simplifyCompares(Module &M) { LLVMContext & C = M.getContext(); std::vector icomps; + std::vector fcomps; IntegerType * Int1Ty = IntegerType::getInt1Ty(C); /* iterate over all functions, bbs and instruction and add @@ -79,25 +84,41 @@ bool SplitComparesTransform::simplifyCompares(Module &M) { if ((selectcmpInst = dyn_cast(&IN))) { - if (selectcmpInst->getPredicate() != CmpInst::ICMP_UGE && - selectcmpInst->getPredicate() != CmpInst::ICMP_SGE && - selectcmpInst->getPredicate() != CmpInst::ICMP_ULE && - selectcmpInst->getPredicate() != CmpInst::ICMP_SLE) { + if (selectcmpInst->getPredicate() == CmpInst::ICMP_UGE || + selectcmpInst->getPredicate() == CmpInst::ICMP_SGE || + selectcmpInst->getPredicate() == CmpInst::ICMP_ULE || + selectcmpInst->getPredicate() == CmpInst::ICMP_SLE) { - continue; + auto op0 = selectcmpInst->getOperand(0); + auto op1 = selectcmpInst->getOperand(1); + + IntegerType *intTyOp0 = dyn_cast(op0->getType()); + IntegerType *intTyOp1 = dyn_cast(op1->getType()); + + /* this is probably not needed but we do it anyway */ + if (!intTyOp0 || !intTyOp1) { continue; } + + icomps.push_back(selectcmpInst); } - auto op0 = selectcmpInst->getOperand(0); - auto op1 = selectcmpInst->getOperand(1); + if (selectcmpInst->getPredicate() == CmpInst::FCMP_OGE || + selectcmpInst->getPredicate() == CmpInst::FCMP_UGE || + selectcmpInst->getPredicate() == CmpInst::FCMP_OLE || + selectcmpInst->getPredicate() == CmpInst::FCMP_ULE) { - IntegerType *intTyOp0 = dyn_cast(op0->getType()); - IntegerType *intTyOp1 = dyn_cast(op1->getType()); + auto op0 = selectcmpInst->getOperand(0); + auto op1 = selectcmpInst->getOperand(1); - /* this is probably not needed but we do it anyway */ - if (!intTyOp0 || !intTyOp1) { continue; } + Type *TyOp0 = op0->getType(); + Type *TyOp1 = op1->getType(); - icomps.push_back(selectcmpInst); + /* this is probably not needed but we do it anyway */ + if (TyOp0 != TyOp1) { continue; } + + fcomps.push_back(selectcmpInst); + + } } @@ -107,7 +128,7 @@ bool SplitComparesTransform::simplifyCompares(Module &M) { } - if (!icomps.size()) { return false; } + if (!icomps.size() && !fcomps.size()) { return false; } for (auto &IcmpInst : icomps) { @@ -173,18 +194,83 @@ bool SplitComparesTransform::simplifyCompares(Module &M) { } + /* now for floating point */ + for (auto &FcmpInst : fcomps) { + + BasicBlock *bb = FcmpInst->getParent(); + + auto op0 = FcmpInst->getOperand(0); + auto op1 = FcmpInst->getOperand(1); + + /* find out what the new predicate is going to be */ + auto pred = dyn_cast(FcmpInst)->getPredicate(); + CmpInst::Predicate new_pred; + switch (pred) { + + case CmpInst::FCMP_UGE: new_pred = CmpInst::FCMP_UGT; break; + case CmpInst::FCMP_OGE: new_pred = CmpInst::FCMP_OGT; break; + case CmpInst::FCMP_ULE: new_pred = CmpInst::FCMP_ULT; break; + case CmpInst::FCMP_OLE: new_pred = CmpInst::FCMP_OLT; break; + default: // keep the compiler happy + continue; + + } + + /* split before the icmp instruction */ + BasicBlock *end_bb = bb->splitBasicBlock(BasicBlock::iterator(FcmpInst)); + + /* the old bb now contains a unconditional jump to the new one (end_bb) + * we need to delete it later */ + + /* create the ICMP instruction with new_pred and add it to the old basic + * block bb it is now at the position where the old IcmpInst was */ + Instruction *fcmp_np; + fcmp_np = CmpInst::Create(Instruction::FCmp, new_pred, op0, op1); + bb->getInstList().insert(bb->getTerminator()->getIterator(), fcmp_np); + + /* create a new basic block which holds the new EQ fcmp */ + Instruction *fcmp_eq; + /* insert middle_bb before end_bb */ + BasicBlock *middle_bb = + BasicBlock::Create(C, "injected", end_bb->getParent(), end_bb); + fcmp_eq = CmpInst::Create(Instruction::FCmp, CmpInst::FCMP_OEQ, op0, op1); + middle_bb->getInstList().push_back(fcmp_eq); + /* add an unconditional branch to the end of middle_bb with destination + * end_bb */ + BranchInst::Create(end_bb, middle_bb); + + /* replace the uncond branch with a conditional one, which depends on the + * new_pred icmp. True goes to end, false to the middle (injected) bb */ + auto term = bb->getTerminator(); + BranchInst::Create(end_bb, middle_bb, fcmp_np, bb); + term->eraseFromParent(); + + /* replace the old IcmpInst (which is the first inst in end_bb) with a PHI + * inst to wire up the loose ends */ + PHINode *PN = PHINode::Create(Int1Ty, 2, ""); + /* the first result depends on the outcome of icmp_eq */ + PN->addIncoming(fcmp_eq, middle_bb); + /* if the source was the original bb we know that the icmp_np yielded true + * hence we can hardcode this value */ + PN->addIncoming(ConstantInt::get(Int1Ty, 1), bb); + /* replace the old IcmpInst with our new and shiny PHI inst */ + BasicBlock::iterator ii(FcmpInst); + ReplaceInstWithInst(FcmpInst->getParent()->getInstList(), ii, PN); + + } + return true; } /* this function transforms signed compares to equivalent unsigned compares */ -bool SplitComparesTransform::simplifySignedness(Module &M) { +bool SplitComparesTransform::simplifyIntSignedness(Module &M) { LLVMContext & C = M.getContext(); std::vector icomps; IntegerType * Int1Ty = IntegerType::getInt1Ty(C); - /* iterate over all functions, bbs and instruction and add + /* iterate over all functions, bbs and instructions and add * all signed compares to icomps vector */ for (auto &F : M) { @@ -196,26 +282,24 @@ bool SplitComparesTransform::simplifySignedness(Module &M) { if ((selectcmpInst = dyn_cast(&IN))) { - if (selectcmpInst->getPredicate() != CmpInst::ICMP_SGT && - selectcmpInst->getPredicate() != CmpInst::ICMP_SLT) { + if (selectcmpInst->getPredicate() == CmpInst::ICMP_SGT || + selectcmpInst->getPredicate() == CmpInst::ICMP_SLT) { - continue; + auto op0 = selectcmpInst->getOperand(0); + auto op1 = selectcmpInst->getOperand(1); - } - - auto op0 = selectcmpInst->getOperand(0); - auto op1 = selectcmpInst->getOperand(1); + IntegerType *intTyOp0 = dyn_cast(op0->getType()); + IntegerType *intTyOp1 = dyn_cast(op1->getType()); - IntegerType *intTyOp0 = dyn_cast(op0->getType()); - IntegerType *intTyOp1 = dyn_cast(op1->getType()); + /* see above */ + if (!intTyOp0 || !intTyOp1) { continue; } - /* see above */ - if (!intTyOp0 || !intTyOp1) { continue; } + /* i think this is not possible but to lazy to look it up */ + if (intTyOp0->getBitWidth() != intTyOp1->getBitWidth()) { continue; } - /* i think this is not possible but to lazy to look it up */ - if (intTyOp0->getBitWidth() != intTyOp1->getBitWidth()) { continue; } + icomps.push_back(selectcmpInst); - icomps.push_back(selectcmpInst); + } } @@ -328,8 +412,333 @@ bool SplitComparesTransform::simplifySignedness(Module &M) { } +size_t SplitComparesTransform::nextPowerOfTwo(size_t in) { + --in; + in |= in >> 1; + in |= in >> 2; + in |= in >> 4; +// in |= in >> 8; +// in |= in >> 16; + return in + 1; +} + +/* splits fcmps into two nested fcmps with sign compare and the rest */ +size_t SplitComparesTransform::splitFPCompares(Module &M) { + size_t count = 0; + + LLVMContext &C = M.getContext(); + + const DataLayout &dl = M.getDataLayout(); + + /* define unions with floating point and (sign, exponent, mantissa) triples */ + if (dl.isLittleEndian()) { + } + else if (dl.isBigEndian()) { + } + else { + return count; + } + + std::vector fcomps; + + /* get all EQ, NE, GT, and LT fcmps. if the other two + * functions were executed only these four predicates should exist */ + for (auto &F : M) { + + for (auto &BB : F) { + + for (auto &IN : BB) { + + CmpInst *selectcmpInst = nullptr; + + if ((selectcmpInst = dyn_cast(&IN))) { + + if (selectcmpInst->getPredicate() == CmpInst::FCMP_OEQ || + selectcmpInst->getPredicate() == CmpInst::FCMP_ONE || + selectcmpInst->getPredicate() == CmpInst::FCMP_UNE || + selectcmpInst->getPredicate() == CmpInst::FCMP_OGT || + selectcmpInst->getPredicate() == CmpInst::FCMP_OLT) { + + auto op0 = selectcmpInst->getOperand(0); + auto op1 = selectcmpInst->getOperand(1); + + Type *TyOp0 = op0->getType(); + Type *TyOp1 = op1->getType(); + + if (TyOp0 != TyOp1) { continue; } + + fcomps.push_back(selectcmpInst); + + } + + } + + } + + } + + } + if (!fcomps.size()) { return count; } + + IntegerType *Int1Ty = IntegerType::getInt1Ty(C); + + for (auto &FcmpInst : fcomps) { + + BasicBlock *bb = FcmpInst->getParent(); + + auto op0 = FcmpInst->getOperand(0); + auto op1 = FcmpInst->getOperand(1); + + unsigned op0_size, op1_size; + op0_size = op0->getType()->getPrimitiveSizeInBits(); + op1_size = op1->getType()->getPrimitiveSizeInBits(); + + if (op0_size != op1_size) { + continue; + } + + const unsigned int precision = llvm::APFloatBase::semanticsPrecision(op0->getType()->getFltSemantics()); + const unsigned int sizeInBits = llvm::APFloatBase::semanticsSizeInBits(op0->getType()->getFltSemantics()); + + + const unsigned shiftR_exponent = precision - 1; + const unsigned long long mask_fraction = ((1 << (precision - 2))) | ((1 << (precision - 2)) - 1); + const unsigned long long mask_exponent = (1 << (sizeInBits - precision)) - 1; + + // round up sizes to the next power of two + // this should help with integer compare splitting + size_t exTySizeBytes = ((sizeInBits - precision + 7) >> 3); + size_t frTySizeBytes = ((precision - 1 + 7) >> 3); + + IntegerType *IntExponentTy = IntegerType::get(C, nextPowerOfTwo(exTySizeBytes) << 3); + IntegerType *IntFractionTy = IntegerType::get(C, nextPowerOfTwo(frTySizeBytes) << 3); + + BasicBlock *end_bb = bb->splitBasicBlock(BasicBlock::iterator(FcmpInst)); + + /* create the integers from floats directly */ + Instruction *b_op0, *b_op1; + b_op0 = CastInst::Create(Instruction::BitCast, op0, IntegerType::get(C, op0_size)); + bb->getInstList().insert(bb->getTerminator()->getIterator(), b_op0); + + b_op1 = CastInst::Create(Instruction::BitCast, op1, IntegerType::get(C, op1_size)); + bb->getInstList().insert(bb->getTerminator()->getIterator(), b_op1); + + /* isolate signs of value of floating point type */ + + /* create a 1 bit compare for the sign bit. to do this shift and trunc + * the original operands so only the first bit remains.*/ + Instruction *s_s0, *t_s0, *s_s1, *t_s1, *icmp_sign_bit; + + s_s0 = BinaryOperator::Create(Instruction::LShr, b_op0, + ConstantInt::get(b_op0->getType(), op0_size - 1)); + bb->getInstList().insert(bb->getTerminator()->getIterator(), s_s0); + t_s0 = new TruncInst(s_s0, Int1Ty); + bb->getInstList().insert(bb->getTerminator()->getIterator(), t_s0); + + s_s1 = BinaryOperator::Create(Instruction::LShr, b_op1, + ConstantInt::get(b_op1->getType(), op1_size - 1)); + bb->getInstList().insert(bb->getTerminator()->getIterator(), s_s1); + t_s1 = new TruncInst(s_s1, Int1Ty); + bb->getInstList().insert(bb->getTerminator()->getIterator(), t_s1); + + /* compare of the sign bits */ + icmp_sign_bit = CmpInst::Create(Instruction::ICmp, CmpInst::ICMP_EQ, t_s0, t_s1); + bb->getInstList().insert(bb->getTerminator()->getIterator(), icmp_sign_bit); + + /* create a new basic block which is executed if the signedness bits are + * equal */ + BasicBlock * signequal_bb = + BasicBlock::Create(C, "signequal", end_bb->getParent(), end_bb); + + BranchInst::Create(end_bb, signequal_bb); + + /* create a new bb which is executed if exponents are equal */ + BasicBlock * middle_bb = + BasicBlock::Create(C, "injected", end_bb->getParent(), end_bb); + + BranchInst::Create(end_bb, middle_bb); + + auto term = bb->getTerminator(); + /* if the signs are different goto end_bb else to signequal_bb */ + BranchInst::Create(signequal_bb, end_bb, icmp_sign_bit, bb); + term->eraseFromParent(); + + /* insert code for equal signs */ + + /* isolate the exponents */ + Instruction *s_e0, *m_e0, *t_e0, *s_e1, *m_e1, *t_e1; + + s_e0 = BinaryOperator::Create(Instruction::LShr, b_op0, ConstantInt::get(b_op0->getType(), shiftR_exponent)); + s_e1 = BinaryOperator::Create(Instruction::LShr, b_op1, ConstantInt::get(b_op1->getType(), shiftR_exponent)); + signequal_bb->getInstList().insert(signequal_bb->getTerminator()->getIterator(), s_e0); + signequal_bb->getInstList().insert(signequal_bb->getTerminator()->getIterator(), s_e1); + + if (sizeInBits - precision < exTySizeBytes * 8) { + m_e0 = BinaryOperator::Create(Instruction::And, s_e0, ConstantInt::get(s_e0->getType(), mask_exponent)); + m_e1 = BinaryOperator::Create(Instruction::And, s_e1, ConstantInt::get(s_e1->getType(), mask_exponent)); + signequal_bb->getInstList().insert(signequal_bb->getTerminator()->getIterator(), m_e0); + signequal_bb->getInstList().insert(signequal_bb->getTerminator()->getIterator(), m_e1); + + t_e0 = new TruncInst(m_e0, IntExponentTy); + t_e1 = new TruncInst(m_e1, IntExponentTy); + } else { + t_e0 = new TruncInst(s_e0, IntExponentTy); + t_e1 = new TruncInst(s_e1, IntExponentTy); + } + signequal_bb->getInstList().insert(signequal_bb->getTerminator()->getIterator(), t_e0); + signequal_bb->getInstList().insert(signequal_bb->getTerminator()->getIterator(), t_e1); + /* compare the exponents of the operands */ + Instruction *icmp_exponent_result; + switch (FcmpInst->getPredicate()) { + case CmpInst::FCMP_OEQ: + icmp_exponent_result = + CmpInst::Create(Instruction::ICmp, CmpInst::ICMP_EQ, t_e0, t_e1); + break; + case CmpInst::FCMP_ONE: + case CmpInst::FCMP_UNE: + icmp_exponent_result = + CmpInst::Create(Instruction::ICmp, CmpInst::ICMP_NE, t_e0, t_e1); + break; + case CmpInst::FCMP_OGT: + Instruction *icmp_exponent; + icmp_exponent = + CmpInst::Create(Instruction::ICmp, CmpInst::ICMP_UGT, t_e0, t_e1); + signequal_bb->getInstList().insert(signequal_bb->getTerminator()->getIterator(), icmp_exponent); + icmp_exponent_result = BinaryOperator::Create(Instruction::Xor, icmp_exponent, t_s0); + break; + case CmpInst::FCMP_OLT: + icmp_exponent = + CmpInst::Create(Instruction::ICmp, CmpInst::ICMP_ULT, t_e0, t_e1); + signequal_bb->getInstList().insert(signequal_bb->getTerminator()->getIterator(), icmp_exponent); + icmp_exponent_result = BinaryOperator::Create(Instruction::Xor, icmp_exponent, t_s0); + break; + default: + continue; + } + signequal_bb->getInstList().insert(signequal_bb->getTerminator()->getIterator(), icmp_exponent_result); + + { + auto term = signequal_bb->getTerminator(); + /* if the exponents are different do a fraction cmp */ + BranchInst::Create(middle_bb, end_bb, icmp_exponent_result, signequal_bb); + term->eraseFromParent(); + } + + + /* isolate the mantissa aka fraction */ + Instruction *t_f0, *t_f1; + bool needTrunc = IntFractionTy->getPrimitiveSizeInBits() < op0_size; +//errs() << "Fractions: IntFractionTy size " << IntFractionTy->getPrimitiveSizeInBits() << ", op0_size " << op0_size << ", needTrunc " << needTrunc << "\n"; + if (precision - 1 < frTySizeBytes * 8) { + Instruction *m_f0, *m_f1; + m_f0 = BinaryOperator::Create(Instruction::And, b_op0, ConstantInt::get(b_op0->getType(), mask_fraction)); + m_f1 = BinaryOperator::Create(Instruction::And, b_op1, ConstantInt::get(b_op1->getType(), mask_fraction)); + middle_bb->getInstList().insert(middle_bb->getTerminator()->getIterator(), m_f0); + middle_bb->getInstList().insert(middle_bb->getTerminator()->getIterator(), m_f1); + + if (needTrunc) { + t_f0 = new TruncInst(m_f0, IntFractionTy); + t_f1 = new TruncInst(m_f1, IntFractionTy); + middle_bb->getInstList().insert(middle_bb->getTerminator()->getIterator(), t_f0); + middle_bb->getInstList().insert(middle_bb->getTerminator()->getIterator(), t_f1); + } else { + t_f0 = m_f0; + t_f1 = m_f1; + } + } else { + if (needTrunc) { + t_f0 = new TruncInst(b_op0, IntFractionTy); + t_f1 = new TruncInst(b_op1, IntFractionTy); + middle_bb->getInstList().insert(middle_bb->getTerminator()->getIterator(), t_f0); + middle_bb->getInstList().insert(middle_bb->getTerminator()->getIterator(), t_f1); + } else { + t_f0 = b_op0; + t_f1 = b_op1; + } + } + + /* compare the fractions of the operands */ + Instruction *icmp_fraction_result; + switch (FcmpInst->getPredicate()) { + case CmpInst::FCMP_OEQ: + icmp_fraction_result = + CmpInst::Create(Instruction::ICmp, CmpInst::ICMP_EQ, t_f0, t_f1); + break; + case CmpInst::FCMP_UNE: + case CmpInst::FCMP_ONE: + icmp_fraction_result = + CmpInst::Create(Instruction::ICmp, CmpInst::ICMP_NE, t_f0, t_f1); + break; + case CmpInst::FCMP_OGT: + Instruction *icmp_fraction; + icmp_fraction = + CmpInst::Create(Instruction::ICmp, CmpInst::ICMP_UGT, t_f0, t_f1); + middle_bb->getInstList().insert(middle_bb->getTerminator()->getIterator(), icmp_fraction); + icmp_fraction_result = BinaryOperator::Create(Instruction::Xor, icmp_fraction, t_s0); + break; + case CmpInst::FCMP_OLT: + icmp_fraction = + CmpInst::Create(Instruction::ICmp, CmpInst::ICMP_ULT, t_f0, t_f1); + middle_bb->getInstList().insert(middle_bb->getTerminator()->getIterator(), icmp_fraction); + icmp_fraction_result = BinaryOperator::Create(Instruction::Xor, icmp_fraction, t_s0); + break; + default: + continue; + } + middle_bb->getInstList().insert(middle_bb->getTerminator()->getIterator(), icmp_fraction_result); + + PHINode *PN = PHINode::Create(Int1Ty, 3, ""); + + switch (FcmpInst->getPredicate()) { + case CmpInst::FCMP_OEQ: + /* unequal signs cannot be equal values */ + /* goto false branch */ + PN->addIncoming(ConstantInt::get(Int1Ty, 0), bb); + /* unequal exponents cannot be equal values, too */ + PN->addIncoming(ConstantInt::get(Int1Ty, 0), signequal_bb); + /* fractions comparison */ + PN->addIncoming(icmp_fraction_result, middle_bb); + break; + case CmpInst::FCMP_ONE: + case CmpInst::FCMP_UNE: + /* unequal signs are unequal values */ + /* goto true branch */ + PN->addIncoming(ConstantInt::get(Int1Ty, 1), bb); + /* unequal exponents are unequal values, too */ + PN->addIncoming(ConstantInt::get(Int1Ty, 1), signequal_bb); + /* fractions comparison */ + PN->addIncoming(icmp_fraction_result, middle_bb); + break; + case CmpInst::FCMP_OGT: + /* if op1 is negative goto true branch, + else go on comparing */ + PN->addIncoming(t_s1, bb); + PN->addIncoming(icmp_exponent_result, signequal_bb); + PN->addIncoming(icmp_fraction_result, middle_bb); + break; + case CmpInst::FCMP_OLT: + /* if op0 is negative goto true branch, + else go on comparing */ + PN->addIncoming(t_s0, bb); + PN->addIncoming(icmp_exponent_result, signequal_bb); + PN->addIncoming(icmp_fraction_result, middle_bb); + break; + default: + continue; + } + + BasicBlock::iterator ii(FcmpInst); + ReplaceInstWithInst(FcmpInst->getParent()->getInstList(), ii, PN); + ++count; + } + + return count; + +} + /* splits icmps of size bitw into two nested icmps with bitw/2 size each */ -bool SplitComparesTransform::splitCompares(Module &M, unsigned bitw) { +size_t SplitComparesTransform::splitIntCompares(Module &M, unsigned bitw) { + size_t count = 0; LLVMContext &C = M.getContext(); @@ -339,13 +748,14 @@ bool SplitComparesTransform::splitCompares(Module &M, unsigned bitw) { std::vector icomps; - if (bitw % 2) { return false; } + if (bitw % 2) { return 0; } /* not supported yet */ - if (bitw > 64) { return false; } + if (bitw > 64) { return 0; } - /* get all EQ, NE, UGT, and ULT icmps of width bitw. if the other two - * unctions were executed only these four predicates should exist */ + /* get all EQ, NE, UGT, and ULT icmps of width bitw. if the + * functions simplifyCompares() and simplifyIntSignedness() + * were executed only these four predicates should exist */ for (auto &F : M) { for (auto &BB : F) { @@ -356,33 +766,31 @@ bool SplitComparesTransform::splitCompares(Module &M, unsigned bitw) { if ((selectcmpInst = dyn_cast(&IN))) { - if (selectcmpInst->getPredicate() != CmpInst::ICMP_EQ && - selectcmpInst->getPredicate() != CmpInst::ICMP_NE && - selectcmpInst->getPredicate() != CmpInst::ICMP_UGT && - selectcmpInst->getPredicate() != CmpInst::ICMP_ULT) { + if (selectcmpInst->getPredicate() == CmpInst::ICMP_EQ || + selectcmpInst->getPredicate() == CmpInst::ICMP_NE || + selectcmpInst->getPredicate() == CmpInst::ICMP_UGT || + selectcmpInst->getPredicate() == CmpInst::ICMP_ULT) { - continue; + auto op0 = selectcmpInst->getOperand(0); + auto op1 = selectcmpInst->getOperand(1); - } + IntegerType *intTyOp0 = dyn_cast(op0->getType()); + IntegerType *intTyOp1 = dyn_cast(op1->getType()); - auto op0 = selectcmpInst->getOperand(0); - auto op1 = selectcmpInst->getOperand(1); + if (!intTyOp0 || !intTyOp1) { continue; } - IntegerType *intTyOp0 = dyn_cast(op0->getType()); - IntegerType *intTyOp1 = dyn_cast(op1->getType()); + /* check if the bitwidths are the one we are looking for */ + if (intTyOp0->getBitWidth() != bitw || + intTyOp1->getBitWidth() != bitw) { - if (!intTyOp0 || !intTyOp1) { continue; } + continue; - /* check if the bitwidths are the one we are looking for */ - if (intTyOp0->getBitWidth() != bitw || - intTyOp1->getBitWidth() != bitw) { + } - continue; + icomps.push_back(selectcmpInst); } - icomps.push_back(selectcmpInst); - } } @@ -391,7 +799,7 @@ bool SplitComparesTransform::splitCompares(Module &M, unsigned bitw) { } - if (!icomps.size()) { return false; } + if (!icomps.size()) { return 0; } for (auto &IcmpInst : icomps) { @@ -482,7 +890,7 @@ bool SplitComparesTransform::splitCompares(Module &M, unsigned bitw) { /* transformations for < and > */ /* create a basic block which checks for the inverse predicate. - * if this is true we can go to the end if not we have to got to the + * if this is true we can go to the end if not we have to go to the * bb which checks the lower half of the operands */ Instruction *icmp_inv_cmp, *op0_low, *op1_low, *icmp_low; BasicBlock * inv_cmp_bb = @@ -528,10 +936,10 @@ bool SplitComparesTransform::splitCompares(Module &M, unsigned bitw) { ReplaceInstWithInst(IcmpInst->getParent()->getInstList(), ii, PN); } - + ++count; } - return true; + return count; } @@ -545,26 +953,32 @@ bool SplitComparesTransform::runOnModule(Module &M) { simplifyCompares(M); - simplifySignedness(M); + simplifyIntSignedness(M); if (getenv("AFL_QUIET") == NULL) - errs() << "Split-compare-pass by laf.intel@gmail.com\n"; + errs() << "Split-compare-pass by laf.intel@gmail.com, extended by heiko@hexco.de\n"; + + errs() << "Split-floatingpoint-compare-pass: " << splitFPCompares(M) << " FP comparisons splitted\n"; switch (bitw) { case 64: - errs() << "Running split-compare-pass " << 64 << "\n"; - splitCompares(M, 64); + errs() << "Split-integer-compare-pass " << bitw << "bit: " + << splitIntCompares(M, bitw) << " splitted\n"; + bitw >>= 1; [[clang::fallthrough]]; /*FALLTHRU*/ /* FALLTHROUGH */ case 32: - errs() << "Running split-compare-pass " << 32 << "\n"; - splitCompares(M, 32); + errs() << "Split-integer-compare-pass " << bitw << "bit: " + << splitIntCompares(M, bitw) << " splitted\n"; + bitw >>= 1; [[clang::fallthrough]]; /*FALLTHRU*/ /* FALLTHROUGH */ case 16: - errs() << "Running split-compare-pass " << 16 << "\n"; - splitCompares(M, 16); + errs() << "Split-integer-compare-pass " << bitw << "bit: " + << splitIntCompares(M, bitw) << " splitted\n"; + + bitw >>= 1; break; default: -- cgit 1.4.1 From 7adb7cf7f698b309029d4853b1ec8900fe1baafe Mon Sep 17 00:00:00 2001 From: van Hauser Date: Sun, 22 Sep 2019 10:42:48 +0200 Subject: more tests --- Makefile | 2 +- llvm_mode/afl-llvm-pass.so.cc | 4 +-- test/test.sh | 66 ++++++++++++++++++++++++++++++++++++++++--- 3 files changed, 64 insertions(+), 8 deletions(-) (limited to 'llvm_mode') diff --git a/Makefile b/Makefile index 5d9a55a6..d7309cff 100644 --- a/Makefile +++ b/Makefile @@ -80,7 +80,7 @@ endif all: test_x86 test_shm test_python27 ready $(PROGS) afl-as test_build all_done -tests: +tests: source-only @cd test ; ./test.sh help: diff --git a/llvm_mode/afl-llvm-pass.so.cc b/llvm_mode/afl-llvm-pass.so.cc index 5d531a87..58acd9be 100644 --- a/llvm_mode/afl-llvm-pass.so.cc +++ b/llvm_mode/afl-llvm-pass.so.cc @@ -105,9 +105,7 @@ bool AFLCoverage::runOnModule(Module &M) { SAYF(cCYA "afl-llvm-pass" VERSION cRST " by \n"); - } else - - be_quiet = 1; + } else if (getenv("AFL_QUIET")) be_quiet = 1; /* Decide instrumentation ratio */ diff --git a/test/test.sh b/test/test.sh index 0e2ba52b..6a706ab9 100755 --- a/test/test.sh +++ b/test/test.sh @@ -34,7 +34,7 @@ RED="\\x1b[0;31m" YELLOW="\\x1b[1;93m" RESET="\\x1b[0m" -$ECHO "$RESET" +$ECHO "${RESET}${GREY}[*] starting afl++ test framework ..." test -e ../afl-gcc -a -e ../afl-showmap -a -e ../afl-fuzz && { ../afl-gcc -o test-instr.plain ../test-instr.c > /dev/null 2>&1 @@ -65,7 +65,7 @@ test -e ../afl-gcc -a -e ../afl-showmap -a -e ../afl-fuzz && { timeout -s KILL 10 ../afl-fuzz -i in -o out -- ./test-instr.plain > /dev/null 2>&1 } > /dev/null 2>&1 test -n "$( ls out/queue/id:000002* 2> /dev/null )" && { - $ECHO "$GREEN[+] afl-fuzz is working correctly" + $ECHO "$GREEN[+] afl-fuzz is working correctly with afl-gcc" } || $ECHO "$RED[!] afl-fuzz is not working correctly" rm -rf in out } || $ECHO "$YELLOW[-] we cannot test afl-fuzz because we are missing the timeout command" @@ -74,7 +74,65 @@ test -e ../afl-gcc -a -e ../afl-showmap -a -e ../afl-fuzz && { test -e ../afl-clang-fast && { - echo todo: llvm_mode + ../afl-clang-fast -o test-instr.plain ../test-instr.c > /dev/null 2>&1 + AFL_HARDEN=1 ../afl-clang-fast -o test-compcov.harden test-compcov.c > /dev/null 2>&1 + test -e test-instr.plain && { + $ECHO "$GREEN[+] llvm_mode compilation succeeded" + echo 0 | ../afl-showmap -o test-instr.plain.0 -r -- ./test-instr.plain > /dev/null 2>&1 + ../afl-showmap -o test-instr.plain.1 -r -- ./test-instr.plain < /dev/null > /dev/null 2>&1 + test -e test-instr.plain.0 -a -e test-instr.plain.1 && { + diff -q test-instr.plain.0 test-instr.plain.1 > /dev/null 2>&1 && { + $ECHO "$RED[!] llvm_mode instrumentation should be different on different input but is not" + } || $ECHO "$GREEN[+] llvm_mode instrumentation present and working correctly" + } || $ECHO "$RED[!] llvm_mode instrumentation failed" + rm -f test-instr.plain.0 test-instr.plain.1 + } || $ECHO "$RED[!] llvm_mode failed" + test -e test-compcov.harden && { + grep -Eqa 'stack_chk_fail|fstack-protector-all|fortified' test-compcov.harden > /dev/null 2>&1 && { + $ECHO "$GREEN[+] llvm_mode hardened mode succeeded and is working" + } || $ECHO "$RED[!] hardened mode is not hardened" + rm -f test-compcov.harden + } || $ECHO "$RED[!] llvm_mode hardened mode compilation failed" + # now we want to be sure that afl-fuzz is working + test -n "$TIMEOUT" && { + mkdir -p in + echo 0 > in/in + $ECHO "$GREY[*] running afl-fuzz, this will take approx 10 seconds" + { + timeout -s KILL 10 ../afl-fuzz -i in -o out -- ./test-instr.plain > /dev/null 2>&1 + } > /dev/null 2>&1 + test -n "$( ls out/queue/id:000002* 2> /dev/null )" && { + $ECHO "$GREEN[+] afl-fuzz is working correctly with llvm_mode" + } || $ECHO "$RED[!] afl-fuzz is not working correctly" + rm -rf in out + } || $ECHO "$YELLOW[-] we cannot test afl-fuzz because we are missing the timeout command" + rm -f test-instr.plain + # now for the special llvm_mode things + AFL_LLVM_INSTRIM=1 AFL_LLVM_INSTRIM_LOOPHEAD=1 ../afl-clang-fast -o test-compcov.instrim test-compcov.c > /dev/null 2> test.out + test -e test-compcov.instrim && { + grep -q " 1 location" test.out && { + $ECHO "$GREEN[+] llvm_mode InsTrim feature works correctly" + } || $ECHO "$RED[!] llvm_mode InsTrim feature failed" + } || $ECHO "$RED[!] llvm_mode InsTrim feature compilation failed" + rm -f test-compcov.instrim test.out + + AFL_LLVM_LAF_SPLIT_SWITCHES=1 AFL_LLVM_LAF_TRANSFORM_COMPARES=1 AFL_LLVM_LAF_SPLIT_COMPARES=1 ../afl-clang-fast -o test-compcov.compcov test-compcov.c > /dev/null 2> test.out + test -e test-compcov.compcov && { + grep -Eq " [3-9][0-9] location" test.out && { + $ECHO "$GREEN[+] llvm_mode laf-intel/compcov feature works correctly" + } || $ECHO "$RED[!] llvm_mode laf-intel/compcov feature failed" + } || $ECHO "$RED[!] llvm_mode laf-intel/compcov feature compilation failed" + rm -f test-compcov.compcov test.out + + + echo foobar.c > whitelist.txt + AFL_LLVM_WHITELIST=whitelist.txt ../afl-clang-fast -o test-compcov test-compcov.c > test.out 2>&1 + test -e test-compcov && { + grep -q "No instrumentation targets found" test.out && { + $ECHO "$GREEN[+] llvm_mode whitelist feature works correctly" + } || $ECHO "$RED[!] llvm_mode whitelist feature failed" + } || $ECHO "$RED[!] llvm_mode whitelist feature compilation failed" + rm -f test-compcov test.out } || $ECHO "$YELLOW[-] llvm_mode not compiled, cannot test" @@ -108,7 +166,7 @@ test -e ../afl-qemu-trace && { rm -f test-compcov -$ECHO "$GREY[*] all tests completed!" +$ECHO "$GREY[*] all test cases completed.$RESET" $ECHO "$RESET" # unicorn_mode ? -- cgit 1.4.1