Skip to content

Commit 791e60f

Browse files
lum1n0uslum1n0us
authored
feat(fuzz): add a new fuzzing target about aot compiler (#4121)
support llvm-jit running mode as another fuzzing target
1 parent 84767f9 commit 791e60f

File tree

9 files changed

+463
-174
lines changed

9 files changed

+463
-174
lines changed

‎build-scripts/version.cmake‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33

44
if(NOT WAMR_ROOT_DIR)
55
# if from wamr-compiler
6-
set(WAMR_ROOT_DIR ${CMAKE_CURRENT_SOURCE_DIR}/..)
6+
set(WAMR_ROOT_DIR ${CMAKE_CURRENT_LIST_DIR}/..)
77
endif()
88

99
set(WAMR_VERSION_MAJOR 2)

‎core/iwasm/compilation/aot_llvm.c‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2520,7 +2520,8 @@ aot_compiler_init(void)
25202520
LLVMInitializeCore(LLVMGetGlobalPassRegistry());
25212521
#endif
25222522

2523-
#if WASM_ENABLE_WAMR_COMPILER != 0
2523+
/* fuzzing only use host targets for simple */
2524+
#if WASM_ENABLE_WAMR_COMPILER != 0 && WASM_ENABLE_FUZZ_TEST == 0
25242525
/* Init environment of all targets for AOT compiler */
25252526
LLVMInitializeAllTargetInfos();
25262527
LLVMInitializeAllTargets();

‎tests/fuzz/wasm-mutator-fuzz/CMakeLists.txt‎

Lines changed: 79 additions & 148 deletions
Original file line numberDiff line numberDiff line change
@@ -1,170 +1,101 @@
11
# Copyright (C) 2019 Intel Corporation. All rights reserved.
22
# SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
33

4-
cmake_minimum_required (VERSION 3.14)
4+
cmake_minimum_required(VERSION 3.14)
55

6-
if (NOT DEFINED CMAKE_C_COMPILER)
7-
set (CMAKE_C_COMPILER "clang")
8-
endif ()
9-
if (NOT DEFINED CMAKE_CXX_COMPILER)
10-
set (CMAKE_CXX_COMPILER "clang++")
11-
endif ()
6+
project(wamr_fuzzing LANGUAGES ASM C CXX)
127

13-
project(wasm_mutator)
8+
include(CMakePrintHelpers)
149

15-
set (CMAKE_BUILD_TYPE Debug)
10+
# Ensure Clang is used as the compiler
11+
if(NOT CMAKE_C_COMPILER_ID STREQUAL "Clang"
12+
OR NOT CMAKE_ASM_COMPILER_ID STREQUAL "Clang")
13+
message(FATAL_ERROR "Please use Clang as the C compiler for libFuzzer compatibility.")
14+
endif()
15+
16+
#
17+
# Global settings
18+
#
19+
set(CMAKE_BUILD_TYPE Debug)
20+
set(CMAKE_C_STANDARD 11)
21+
set(CMAKE_CXX_STANDARD 17)
1622

17-
string (TOLOWER ${CMAKE_HOST_SYSTEM_NAME} WAMR_BUILD_PLATFORM)
23+
string(TOLOWER ${CMAKE_HOST_SYSTEM_NAME} WAMR_BUILD_PLATFORM)
1824

1925
# Reset default linker flags
20-
set (CMAKE_SHARED_LIBRARY_LINK_C_FLAGS "")
21-
set (CMAKE_SHARED_LIBRARY_LINK_CXX_FLAGS "")
22-
23-
set (CMAKE_C_STANDARD 11)
24-
set (CMAKE_CXX_STANDARD 17)
25-
26-
# Set WAMR_BUILD_TARGET, currently values supported:
27-
# "X86_64", "AMD_64", "X86_32", "AARCH64[sub]", "ARM[sub]", "THUMB[sub]",
28-
# "MIPS", "XTENSA", "RISCV64[sub]", "RISCV32[sub]"
29-
if (NOT DEFINED WAMR_BUILD_TARGET)
30-
if (CMAKE_SYSTEM_PROCESSOR MATCHES "^(arm64|aarch64)")
31-
set (WAMR_BUILD_TARGET "AARCH64")
32-
elseif (CMAKE_SYSTEM_PROCESSOR STREQUAL "riscv64")
33-
set (WAMR_BUILD_TARGET "RISCV64")
34-
elseif (CMAKE_SIZEOF_VOID_P EQUAL 8)
35-
# Build as X86_64 by default in 64-bit platform
36-
set (WAMR_BUILD_TARGET "X86_64")
37-
elseif (CMAKE_SIZEOF_VOID_P EQUAL 4)
38-
# Build as X86_32 by default in 32-bit platform
39-
set (WAMR_BUILD_TARGET "X86_32")
40-
else ()
26+
set(CMAKE_SHARED_LIBRARY_LINK_C_FLAGS "")
27+
set(CMAKE_SHARED_LIBRARY_LINK_CXX_FLAGS "")
28+
29+
# Check if the compiler supports the sanitizer flags
30+
include(CheckCXXCompilerFlag)
31+
check_cxx_compiler_flag("-fsanitize=address" HAS_ADDRESS_SANITIZER)
32+
check_cxx_compiler_flag("-fsanitize=memory" HAS_MEMORY_SANITIZER)
33+
check_cxx_compiler_flag("-fsanitize=undefined" HAS_UNDEFINED_SANITIZER)
34+
35+
# Determine WAMR_BUILD_TARGET based on system properties
36+
if(NOT DEFINED WAMR_BUILD_TARGET)
37+
if(CMAKE_SYSTEM_PROCESSOR MATCHES "^(arm64|aarch64)")
38+
set(WAMR_BUILD_TARGET "AARCH64")
39+
elseif(CMAKE_SYSTEM_PROCESSOR STREQUAL "riscv64")
40+
set(WAMR_BUILD_TARGET "RISCV64")
41+
elseif(CMAKE_SIZEOF_VOID_P EQUAL 8)
42+
set(WAMR_BUILD_TARGET "X86_64")
43+
elseif(CMAKE_SIZEOF_VOID_P EQUAL 4)
44+
set(WAMR_BUILD_TARGET "X86_32")
45+
else()
4146
message(SEND_ERROR "Unsupported build target platform!")
42-
endif ()
43-
endif ()
47+
endif()
48+
endif()
4449

45-
if (APPLE)
50+
if(APPLE)
4651
add_definitions(-DBH_PLATFORM_DARWIN)
47-
endif ()
52+
endif()
53+
54+
# Disable hardware bound check and enable AOT validator
55+
set(WAMR_DISABLE_HW_BOUND_CHECK 1)
56+
set(WAMR_BUILD_AOT_VALIDATOR 1)
57+
58+
set(REPO_ROOT_DIR ${CMAKE_CURRENT_LIST_DIR}/../../..)
59+
message(STATUS "REPO_ROOT_DIR: ${REPO_ROOT_DIR}")
60+
61+
# Use LLVM_DIR from command line if defined
62+
# LLVM_DIR should be something like /path/to/llvm/build/lib/cmake/llvm
63+
if(DEFINED LLVM_DIR)
64+
set(LLVM_DIR $ENV{LLVM_DIR})
65+
else()
66+
set(LLVM_SRC_ROOT ${REPO_ROOT_DIR}/core/deps/llvm)
67+
set(LLVM_BUILD_ROOT ${LLVM_SRC_ROOT}/build)
68+
set(LLVM_DIR ${LLVM_BUILD_ROOT}/lib/cmake/llvm)
69+
endif()
4870

49-
if(CUSTOM_MUTATOR EQUAL 1)
50-
add_compile_definitions(CUSTOM_MUTATOR)
71+
# if LLVM_DIR is an existing directory, use it
72+
if(NOT EXISTS ${LLVM_DIR})
73+
message(FATAL_ERROR "LLVM_DIR not found: ${LLVM_DIR}")
5174
endif()
5275

53-
if (NOT DEFINED WAMR_BUILD_INTERP)
54-
# Enable Interpreter by default
55-
set (WAMR_BUILD_INTERP 1)
56-
endif ()
57-
58-
if (NOT DEFINED WAMR_BUILD_AOT)
59-
# Enable AOT by default.
60-
set (WAMR_BUILD_AOT 1)
61-
endif ()
62-
63-
if (NOT DEFINED WAMR_BUILD_JIT)
64-
# Disable JIT by default.
65-
set (WAMR_BUILD_JIT 0)
66-
endif ()
67-
68-
if (NOT DEFINED WAMR_BUILD_LIBC_BUILTIN)
69-
# Disable libc builtin support by default
70-
set (WAMR_BUILD_LIBC_BUILTIN 0)
71-
endif ()
72-
73-
if (NOT DEFINED WAMR_BUILD_LIBC_WASI)
74-
# Enable libc wasi support by default
75-
set (WAMR_BUILD_LIBC_WASI 0)
76-
endif ()
77-
78-
if (NOT DEFINED WAMR_BUILD_FAST_INTERP)
79-
# Enable fast interpreter
80-
set (WAMR_BUILD_FAST_INTERP 1)
81-
endif ()
82-
83-
if (NOT DEFINED WAMR_BUILD_MULTI_MODULE)
84-
# Disable multiple modules
85-
set (WAMR_BUILD_MULTI_MODULE 0)
86-
endif ()
87-
88-
if (NOT DEFINED WAMR_BUILD_LIB_PTHREAD)
89-
# Disable pthread library by default
90-
set (WAMR_BUILD_LIB_PTHREAD 0)
91-
endif ()
92-
93-
if (NOT DEFINED WAMR_BUILD_MINI_LOADER)
94-
# Disable wasm mini loader by default
95-
set (WAMR_BUILD_MINI_LOADER 0)
96-
endif ()
97-
98-
if (NOT DEFINED WAMR_BUILD_SIMD)
99-
# Enable SIMD by default
100-
set (WAMR_BUILD_SIMD 1)
101-
endif ()
102-
103-
if (NOT DEFINED WAMR_BUILD_REF_TYPES)
104-
# Enable reference type by default
105-
set (WAMR_BUILD_REF_TYPES 1)
106-
endif ()
107-
108-
if (NOT DEFINED WAMR_BUILD_DEBUG_INTERP)
109-
# Disable Debug feature by default
110-
set (WAMR_BUILD_DEBUG_INTERP 0)
111-
endif ()
112-
113-
if (WAMR_BUILD_DEBUG_INTERP EQUAL 1)
114-
set (WAMR_BUILD_FAST_INTERP 0)
115-
set (WAMR_BUILD_MINI_LOADER 0)
116-
set (WAMR_BUILD_SIMD 0)
117-
endif ()
118-
119-
# sanitizer may use kHandleSignalExclusive to handle SIGSEGV
120-
# like `UBSAN_OPTIONS=handle_segv=2:...`
121-
set (WAMR_DISABLE_HW_BOUND_CHECK 1)
122-
# Enable aot validator
123-
set (WAMR_BUILD_AOT_VALIDATOR 1)
124-
125-
set (REPO_ROOT_DIR ${CMAKE_CURRENT_LIST_DIR}/../../..)
126-
message([ceith]:REPO_ROOT_DIR, ${REPO_ROOT_DIR})
127-
128-
set (CMAKE_C_FLAGS "${CMAKE_C_FLAGS}")
129-
set (CMAKE_CXX_FLAGS "${CMAKE_CXX_FLAGS}")
130-
131-
add_definitions(-DWAMR_USE_MEM_POOL=0 -DWASM_ENABLE_FUZZ_TEST=1)
76+
find_package(LLVM REQUIRED CONFIG)
77+
78+
message(STATUS "Found LLVM ${LLVM_PACKAGE_VERSION}")
79+
message(STATUS "Using LLVMConfig.cmake in: ${LLVM_DIR}")
80+
81+
include_directories(${LLVM_INCLUDE_DIRS})
82+
separate_arguments(LLVM_DEFINITIONS_LIST NATIVE_COMMAND ${LLVM_DEFINITIONS})
83+
add_definitions(${LLVM_DEFINITIONS_LIST})
84+
85+
set(SHARED_DIR ${REPO_ROOT_DIR}/core/shared)
86+
set(IWASM_DIR ${REPO_ROOT_DIR}/core/iwasm)
87+
88+
# Global setting
89+
add_compile_options(-Wno-unused-command-line-argument)
13290

13391
# Enable fuzzer
92+
add_definitions(-DWASM_ENABLE_FUZZ_TEST=1)
13493
add_compile_options(-fsanitize=fuzzer)
13594
add_link_options(-fsanitize=fuzzer)
13695

137-
# if not calling from oss-fuzz helper, enable all support sanitizers
138-
# oss-fuzz will define FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION in CFLAGS and CXXFLAGS
96+
# Enable sanitizers if not in oss-fuzz environment
13997
set(CFLAGS_ENV $ENV{CFLAGS})
14098
string(FIND "${CFLAGS_ENV}" "-DFUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION" IN_OSS_FUZZ)
141-
if (IN_OSS_FUZZ EQUAL -1)
142-
message("[ceith]:Enable ASan and UBSan in non-oss-fuzz environment")
143-
add_compile_options(
144-
-fprofile-instr-generate -fcoverage-mapping
145-
-fno-sanitize-recover=all
146-
-fsanitize=address,undefined
147-
# reference: https://clang.llvm.org/docs/UndefinedBehaviorSanitizer.html
148-
# -fsanitize=undefined: All of the checks listed above other than float-divide-by-zero,
149-
# unsigned-integer-overflow, implicit-conversion, local-bounds and
150-
# the nullability-* group of checks.
151-
#
152-
# for now, we disable below from UBSan
153-
# -alignment
154-
# -implicit-conversion
155-
#
156-
-fsanitize=float-divide-by-zero,unsigned-integer-overflow,local-bounds,nullability
157-
-fno-sanitize=alignment
158-
)
159-
add_link_options(-fsanitize=address -fprofile-instr-generate)
160-
endif ()
161-
162-
include(${REPO_ROOT_DIR}/core/shared/utils/uncommon/shared_uncommon.cmake)
163-
include(${REPO_ROOT_DIR}/build-scripts/runtime_lib.cmake)
164-
165-
add_library(vmlib
166-
${WAMR_RUNTIME_LIB_SOURCE}
167-
)
168-
169-
add_executable(wasm_mutator_fuzz wasm_mutator_fuzz.cc)
170-
target_link_libraries(wasm_mutator_fuzz vmlib -lm)
99+
100+
add_subdirectory(aot-compiler)
101+
add_subdirectory(wasm-mutator)

‎tests/fuzz/wasm-mutator-fuzz/README.md‎

Lines changed: 33 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -1,44 +1,53 @@
11
# WAMR fuzz test framework
22

3-
## install wasm-tools
3+
## Install wasm-tools
4+
5+
Download the release suitable for your specific platform from https://github.com/bytecodealliance/wasm-tools/releases/latest, unpack it, and add the executable wasm-tools to the `PATH`. Then, you should be able to verify that the installation was successful by using the following command:
46

57
```bash
6-
1.git clone https://github.com/bytecodealliance/wasm-tools
7-
$ cd wasm-tools
8-
2.This project can be installed and compiled from source with this Cargo command:
9-
$ cargo install wasm-tools
10-
3.Installation can be confirmed with:
118
$ wasm-tools --version
12-
4.Subcommands can be explored with:
9+
# Or learn subcommands with
1310
$ wasm-tools help
1411
```
1512

13+
## Install clang Toolchain
14+
15+
Refer to: https://apt.llvm.org/ and ensure that you have clang installed.
16+
17+
```bash
18+
$ clang --version
19+
20+
$ clang++ --version
21+
```
22+
1623
## Build
1724

1825
```bash
19-
mkdir build && cd build
2026
# Without custom mutator (libfuzzer modify the buffer randomly)
21-
cmake ..
22-
# TODO: TBC. `wasm-tools mutate` is not supported yet
23-
# With custom mutator (wasm-tools mutate)
24-
cmake .. -DCUSTOM_MUTATOR=1
25-
make -j$(nproc)
27+
$ cmake -S . -B build -DCMAKE_TOOLCHAIN_FILE=./clang_toolchain.cmake -DLLVM_DIR=<llvm_install_dir>/lib/cmake/llvm
28+
29+
# TBC: if `wasm-tools mutate` is supported or not
30+
# Or With custom mutator (wasm-tools mutate)
31+
$ cmake -S . -B build -DCMAKE_TOOLCHAIN_FILE=./clang_toolchain.cmake -DLLVM_DIR=<llvm_install_dir>/lib/cmake/llvm -DCUSTOM_MUTATOR=1
32+
33+
# Then
34+
$ cmake --build build
2635
```
2736

2837
## Manually generate wasm file in build
2938

30-
```bash
39+
````bash
3140
# wasm-tools smith generate some valid wasm file
3241
# The generated wasm file is in corpus_dir under build
3342
# N - Number of files to be generated
34-
./smith_wasm.sh N
43+
$ ./smith_wasm.sh N
3544

3645
# running
3746
``` bash
38-
cd build
39-
./wasm-mutate-fuzz CORPUS_DIR
40-
41-
```
47+
$ ./build/wasm-mutator/wasm_mutator_fuzz ./build/CORPUS_DIR
48+
49+
$ ./build/aot-compiler/aot_compiler_fuzz ./build/CORPUS_DIR
50+
````
4251
4352
## Fuzzing Server
4453
@@ -49,20 +58,20 @@ $ pip install -r requirements.txt
4958

5059
2. Database Migration
5160
$ python3 app/manager.py db init
52-
$ python3 app/manager.py db migrate
53-
$ python3 app/manager.py db upgrade
61+
$ python3 app/manager.py db migrate
62+
$ python3 app/manager.py db upgrade
5463

5564
3. Change localhost to your machine's IP address
56-
$ cd ../portal
65+
$ cd ../portal
5766
$ vim .env # Change localhost to your machine's IP address # http://<ip>:16667
5867

5968
4. Run Server and Portal
6069
$ cd .. # Switch to the original directory
6170
If you want to customize the front-end deployment port: # defaut 9999
62-
$ vim .env # Please change the portal_port to the port you want to use
71+
$ vim .env # Please change the portal_port to the port you want to use
6372

6473
The server is deployed on port 16667 by default, If you want to change the server deployment port:
65-
$ vim .env # Please change the server_port to the port you want to use
74+
$ vim .env # Please change the server_port to the port you want to use
6675
$ vim portal/.env # Please change the VITE_SERVER_URL to the port you want to use # http://ip:<port>
6776

6877

0 commit comments

Comments
 (0)