mirror of
https://github.com/KhronosGroup/SPIRV-Tools
synced 2024-11-23 04:00:05 +00:00
4af38c49bf
(1) Runtime arrays are turned into fixed-size arrays, by turning
OpTypeRuntimeArray into OpTypeArray and uses of OpArrayLength into
uses of the constant used for the length of the fixed-size array.
(2) Atomic instructions are not donated, and uses of their results are
replaced with uses of constants of the result type.
256 lines
11 KiB
C++
256 lines
11 KiB
C++
// Copyright (c) 2020 Google LLC
|
|
//
|
|
// Licensed under the Apache License, Version 2.0 (the "License");
|
|
// you may not use this file except in compliance with the License.
|
|
// You may obtain a copy of the License at
|
|
//
|
|
// http://www.apache.org/licenses/LICENSE-2.0
|
|
//
|
|
// Unless required by applicable law or agreed to in writing, software
|
|
// distributed under the License is distributed on an "AS IS" BASIS,
|
|
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
// See the License for the specific language governing permissions and
|
|
// limitations under the License.
|
|
|
|
#include "source/fuzz/fuzzer_pass_add_function_calls.h"
|
|
|
|
#include "source/fuzz/call_graph.h"
|
|
#include "source/fuzz/fuzzer_util.h"
|
|
#include "source/fuzz/transformation_add_global_variable.h"
|
|
#include "source/fuzz/transformation_add_local_variable.h"
|
|
#include "source/fuzz/transformation_function_call.h"
|
|
|
|
namespace spvtools {
|
|
namespace fuzz {
|
|
|
|
FuzzerPassAddFunctionCalls::FuzzerPassAddFunctionCalls(
|
|
opt::IRContext* ir_context, TransformationContext* transformation_context,
|
|
FuzzerContext* fuzzer_context,
|
|
protobufs::TransformationSequence* transformations)
|
|
: FuzzerPass(ir_context, transformation_context, fuzzer_context,
|
|
transformations) {}
|
|
|
|
FuzzerPassAddFunctionCalls::~FuzzerPassAddFunctionCalls() = default;
|
|
|
|
void FuzzerPassAddFunctionCalls::Apply() {
|
|
ForEachInstructionWithInstructionDescriptor(
|
|
[this](opt::Function* function, opt::BasicBlock* block,
|
|
opt::BasicBlock::iterator inst_it,
|
|
const protobufs::InstructionDescriptor& instruction_descriptor)
|
|
-> void {
|
|
// Check whether it is legitimate to insert a function call before the
|
|
// instruction.
|
|
if (!fuzzerutil::CanInsertOpcodeBeforeInstruction(SpvOpFunctionCall,
|
|
inst_it)) {
|
|
return;
|
|
}
|
|
|
|
// Randomly decide whether to try inserting a function call here.
|
|
if (!GetFuzzerContext()->ChoosePercentage(
|
|
GetFuzzerContext()->GetChanceOfCallingFunction())) {
|
|
return;
|
|
}
|
|
|
|
// Compute the module's call graph - we don't cache it since it may
|
|
// change each time we apply a transformation. If this proves to be
|
|
// a bottleneck the call graph data structure could be made updatable.
|
|
CallGraph call_graph(GetIRContext());
|
|
|
|
// Gather all the non-entry point functions different from this
|
|
// function. It is important to ignore entry points as a function
|
|
// cannot be an entry point and the target of an OpFunctionCall
|
|
// instruction. We ignore this function to avoid direct recursion.
|
|
std::vector<opt::Function*> candidate_functions;
|
|
for (auto& other_function : *GetIRContext()->module()) {
|
|
if (&other_function != function &&
|
|
!fuzzerutil::FunctionIsEntryPoint(GetIRContext(),
|
|
other_function.result_id())) {
|
|
candidate_functions.push_back(&other_function);
|
|
}
|
|
}
|
|
|
|
// Choose a function to call, at random, by considering candidate
|
|
// functions until a suitable one is found.
|
|
opt::Function* chosen_function = nullptr;
|
|
while (!candidate_functions.empty()) {
|
|
opt::Function* candidate_function =
|
|
GetFuzzerContext()->RemoveAtRandomIndex(&candidate_functions);
|
|
if (!GetTransformationContext()->GetFactManager()->BlockIsDead(
|
|
block->id()) &&
|
|
!GetTransformationContext()->GetFactManager()->FunctionIsLivesafe(
|
|
candidate_function->result_id())) {
|
|
// Unless in a dead block, only livesafe functions can be invoked
|
|
continue;
|
|
}
|
|
if (call_graph.GetIndirectCallees(candidate_function->result_id())
|
|
.count(function->result_id())) {
|
|
// Calling this function could lead to indirect recursion
|
|
continue;
|
|
}
|
|
chosen_function = candidate_function;
|
|
break;
|
|
}
|
|
|
|
if (!chosen_function) {
|
|
// No suitable function was found to call. (This can happen, for
|
|
// instance, if the current function is the only function in the
|
|
// module.)
|
|
return;
|
|
}
|
|
|
|
ApplyTransformation(TransformationFunctionCall(
|
|
GetFuzzerContext()->GetFreshId(), chosen_function->result_id(),
|
|
ChooseFunctionCallArguments(*chosen_function, function, block,
|
|
inst_it),
|
|
instruction_descriptor));
|
|
});
|
|
}
|
|
|
|
std::map<uint32_t, std::vector<opt::Instruction*>>
|
|
FuzzerPassAddFunctionCalls::GetAvailableInstructionsSuitableForActualParameters(
|
|
opt::Function* function, opt::BasicBlock* block,
|
|
const opt::BasicBlock::iterator& inst_it) {
|
|
// Find all instructions in scope that could potentially be used as actual
|
|
// parameters. Weed out unsuitable pointer arguments immediately.
|
|
std::vector<opt::Instruction*> potentially_suitable_instructions =
|
|
FindAvailableInstructions(
|
|
function, block, inst_it,
|
|
[this, block](opt::IRContext* context,
|
|
opt::Instruction* inst) -> bool {
|
|
if (!inst->HasResultId() || !inst->type_id()) {
|
|
// An instruction needs a result id and type in order
|
|
// to be suitable as an actual parameter.
|
|
return false;
|
|
}
|
|
if (context->get_def_use_mgr()->GetDef(inst->type_id())->opcode() ==
|
|
SpvOpTypePointer) {
|
|
switch (inst->opcode()) {
|
|
case SpvOpFunctionParameter:
|
|
case SpvOpVariable:
|
|
// Function parameters and variables are the only
|
|
// kinds of pointer that can be used as actual
|
|
// parameters.
|
|
break;
|
|
default:
|
|
return false;
|
|
}
|
|
if (!GetTransformationContext()->GetFactManager()->BlockIsDead(
|
|
block->id()) &&
|
|
!GetTransformationContext()
|
|
->GetFactManager()
|
|
->PointeeValueIsIrrelevant(inst->result_id())) {
|
|
// We can only pass a pointer as an actual parameter
|
|
// if the pointee value for the pointer is irrelevant,
|
|
// or if the block from which we would make the
|
|
// function call is dead.
|
|
return false;
|
|
}
|
|
}
|
|
return true;
|
|
});
|
|
|
|
// Group all the instructions that are potentially viable as function actual
|
|
// parameters by their result types.
|
|
std::map<uint32_t, std::vector<opt::Instruction*>> result;
|
|
for (auto inst : potentially_suitable_instructions) {
|
|
if (result.count(inst->type_id()) == 0) {
|
|
// This is the first instruction of this type we have seen, so populate
|
|
// the map with an entry.
|
|
result.insert({inst->type_id(), {}});
|
|
}
|
|
// Add the instruction to the sequence of instructions already associated
|
|
// with this type.
|
|
result.at(inst->type_id()).push_back(inst);
|
|
}
|
|
return result;
|
|
}
|
|
|
|
std::vector<uint32_t> FuzzerPassAddFunctionCalls::ChooseFunctionCallArguments(
|
|
const opt::Function& callee, opt::Function* caller_function,
|
|
opt::BasicBlock* caller_block,
|
|
const opt::BasicBlock::iterator& caller_inst_it) {
|
|
auto type_to_available_instructions =
|
|
GetAvailableInstructionsSuitableForActualParameters(
|
|
caller_function, caller_block, caller_inst_it);
|
|
|
|
opt::Instruction* function_type = GetIRContext()->get_def_use_mgr()->GetDef(
|
|
callee.DefInst().GetSingleWordInOperand(1));
|
|
assert(function_type->opcode() == SpvOpTypeFunction &&
|
|
"The function type does not have the expected opcode.");
|
|
std::vector<uint32_t> result;
|
|
for (uint32_t arg_index = 1; arg_index < function_type->NumInOperands();
|
|
arg_index++) {
|
|
auto arg_type_id =
|
|
GetIRContext()
|
|
->get_def_use_mgr()
|
|
->GetDef(function_type->GetSingleWordInOperand(arg_index))
|
|
->result_id();
|
|
if (type_to_available_instructions.count(arg_type_id)) {
|
|
std::vector<opt::Instruction*>& candidate_arguments =
|
|
type_to_available_instructions.at(arg_type_id);
|
|
// TODO(https://github.com/KhronosGroup/SPIRV-Tools/issues/3177) The value
|
|
// selected here is arbitrary. We should consider adding this
|
|
// information as a fact so that the passed parameter could be
|
|
// transformed/changed.
|
|
result.push_back(candidate_arguments[GetFuzzerContext()->RandomIndex(
|
|
candidate_arguments)]
|
|
->result_id());
|
|
} else {
|
|
// We don't have a suitable id in scope to pass, so we must make
|
|
// something up.
|
|
auto type_instruction =
|
|
GetIRContext()->get_def_use_mgr()->GetDef(arg_type_id);
|
|
|
|
if (type_instruction->opcode() == SpvOpTypePointer) {
|
|
// In the case of a pointer, we make a new variable, at function
|
|
// or global scope depending on the storage class of the
|
|
// pointer.
|
|
|
|
// Get a fresh id for the new variable.
|
|
uint32_t fresh_variable_id = GetFuzzerContext()->GetFreshId();
|
|
|
|
// The id of this variable is what we pass as the parameter to
|
|
// the call.
|
|
result.push_back(fresh_variable_id);
|
|
|
|
// Now bring the variable into existence.
|
|
auto storage_class = static_cast<SpvStorageClass>(
|
|
type_instruction->GetSingleWordInOperand(0));
|
|
if (storage_class == SpvStorageClassFunction) {
|
|
// Add a new zero-initialized local variable to the current
|
|
// function, noting that its pointee value is irrelevant.
|
|
ApplyTransformation(TransformationAddLocalVariable(
|
|
fresh_variable_id, arg_type_id, caller_function->result_id(),
|
|
FindOrCreateZeroConstant(
|
|
type_instruction->GetSingleWordInOperand(1)),
|
|
true));
|
|
} else {
|
|
assert((storage_class == SpvStorageClassPrivate ||
|
|
storage_class == SpvStorageClassWorkgroup) &&
|
|
"Only Function, Private and Workgroup storage classes are "
|
|
"supported at present.");
|
|
// Add a new global variable to the module, zero-initializing it if
|
|
// it has Private storage class, and noting that its pointee value is
|
|
// irrelevant.
|
|
ApplyTransformation(TransformationAddGlobalVariable(
|
|
fresh_variable_id, arg_type_id, storage_class,
|
|
storage_class == SpvStorageClassPrivate
|
|
? FindOrCreateZeroConstant(
|
|
type_instruction->GetSingleWordInOperand(1))
|
|
: 0,
|
|
true));
|
|
}
|
|
} else {
|
|
// TODO(https://github.com/KhronosGroup/SPIRV-Tools/issues/3177): We use
|
|
// constant zero for the parameter, but could consider adding a fact
|
|
// to allow further passes to obfuscate it.
|
|
result.push_back(FindOrCreateZeroConstant(arg_type_id));
|
|
}
|
|
}
|
|
}
|
|
return result;
|
|
}
|
|
|
|
} // namespace fuzz
|
|
} // namespace spvtools
|