1/* Copyright (c) 2013-2015 Jeffrey Pfau
  2 *
  3 * This Source Code Form is subject to the terms of the Mozilla Public
  4 * License, v. 2.0. If a copy of the MPL was not distributed with this
  5 * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
  6#include "gba/context/config.h"
  7#include "gba/context/context.h"
  8#include "gba/gba.h"
  9#include "gba/renderers/video-software.h"
 10#include "gba/serialize.h"
 11
 12#include "platform/commandline.h"
 13#include "util/memory.h"
 14#include "util/string.h"
 15#include "util/vfs.h"
 16
 17#include <errno.h>
 18#include <signal.h>
 19
 20#define FUZZ_OPTIONS "F:NO:S:V:"
 21#define FUZZ_USAGE \
 22	"\nAdditional options:\n" \
 23	"  -F FRAMES        Run for the specified number of FRAMES before exiting\n" \
 24	"  -N               Disable video rendering entirely\n" \
 25	"  -O OFFSET        Offset to apply savestate overlay\n" \
 26	"  -S FILE          Load a savestate when starting the test\n" \
 27	"  -V FILE          Overlay a second savestate over the loaded savestate\n" \
 28
 29struct FuzzOpts {
 30	bool noVideo;
 31	int frames;
 32	size_t overlayOffset;
 33	char* savestate;
 34	char* ssOverlay;
 35};
 36
 37static void _GBAFuzzRunloop(struct GBAContext* context, int frames);
 38static void _GBAFuzzShutdown(int signal);
 39static bool _parseFuzzOpts(struct SubParser* parser, struct GBAConfig* config, int option, const char* arg);
 40
 41static bool _dispatchExiting = false;
 42
 43int main(int argc, char** argv) {
 44	signal(SIGINT, _GBAFuzzShutdown);
 45
 46	struct FuzzOpts fuzzOpts = { false, 0, 0, 0, 0 };
 47	struct SubParser subparser = {
 48		.usage = FUZZ_USAGE,
 49		.parse = _parseFuzzOpts,
 50		.extraOptions = FUZZ_OPTIONS,
 51		.opts = &fuzzOpts
 52	};
 53
 54	struct GBAContext context;
 55	GBAContextInit(&context, "fuzz");
 56	struct GBAOptions opts = {
 57		.idleOptimization = IDLE_LOOP_DETECT
 58	};
 59	GBAConfigLoadDefaults(&context.config, &opts);
 60	GBAConfigFreeOpts(&opts);
 61
 62	struct GBAArguments args;
 63	bool parsed = parseArguments(&args, &context.config, argc, argv, &subparser);
 64	if (!parsed || args.showHelp) {
 65		usage(argv[0], FUZZ_USAGE);
 66		freeArguments(&args);
 67		GBAContextDeinit(&context);
 68		return !parsed;
 69	}
 70
 71	struct GBAVideoSoftwareRenderer renderer;
 72	renderer.outputBuffer = 0;
 73
 74	if (!fuzzOpts.noVideo) {
 75		GBAVideoSoftwareRendererCreate(&renderer);
 76		renderer.outputBuffer = malloc(256 * 256 * 4);
 77		renderer.outputBufferStride = 256;
 78		context.renderer = &renderer.d;
 79	}
 80
 81#ifdef __AFL_HAVE_MANUAL_CONTROL
 82	__AFL_INIT();
 83#endif
 84
 85	struct VFile* rom = VFileOpen(args.fname, O_RDONLY);
 86
 87	context.gba->hardCrash = false;
 88	GBAContextLoadROMFromVFile(&context, rom, 0);
 89
 90	struct VFile* savestate = 0;
 91	struct VFile* savestateOverlay = 0;
 92	size_t overlayOffset;
 93
 94	GBAContextStart(&context);
 95
 96	if (fuzzOpts.savestate) {
 97		savestate = VFileOpen(fuzzOpts.savestate, O_RDONLY);
 98		free(fuzzOpts.savestate);
 99	}
100	if (fuzzOpts.ssOverlay) {
101		overlayOffset = fuzzOpts.overlayOffset;
102		if (overlayOffset < sizeof(struct GBASerializedState)) {
103			savestateOverlay = VFileOpen(fuzzOpts.ssOverlay, O_RDONLY);
104		}
105		free(fuzzOpts.ssOverlay);
106	}
107	if (savestate) {
108		if (!savestateOverlay) {
109			GBALoadStateNamed(context.gba, savestate);
110		} else {
111			struct GBASerializedState* state = GBAAllocateState();
112			savestate->read(savestate, state, sizeof(*state));
113			savestateOverlay->read(savestateOverlay, (uint8_t*) state + overlayOffset, sizeof(*state) - overlayOffset);
114			GBADeserialize(context.gba, state);
115			GBADeallocateState(state);
116			savestateOverlay->close(savestateOverlay);
117			savestateOverlay = 0;
118		}
119		savestate->close(savestate);
120		savestate = 0;
121	}
122
123	blip_set_rates(context.gba->audio.left, GBA_ARM7TDMI_FREQUENCY, 0x8000);
124	blip_set_rates(context.gba->audio.right, GBA_ARM7TDMI_FREQUENCY, 0x8000);
125
126	_GBAFuzzRunloop(&context, fuzzOpts.frames);
127
128	GBAContextStop(&context);
129	GBAContextUnloadROM(&context);
130
131	if (savestate) {
132		savestate->close(savestate);
133	}
134	if (savestateOverlay) {
135		savestateOverlay->close(savestateOverlay);
136	}
137
138	freeArguments(&args);
139	if (renderer.outputBuffer) {
140		free(renderer.outputBuffer);
141	}
142	GBAContextDeinit(&context);
143
144	return 0;
145}
146
147static void _GBAFuzzRunloop(struct GBAContext* context, int frames) {
148	do {
149		GBAContextFrame(context, 0);
150	} while (context->gba->video.frameCounter < frames && !_dispatchExiting);
151}
152
153static void _GBAFuzzShutdown(int signal) {
154	UNUSED(signal);
155	_dispatchExiting = true;
156}
157
158static bool _parseFuzzOpts(struct SubParser* parser, struct GBAConfig* config, int option, const char* arg) {
159	UNUSED(config);
160	struct FuzzOpts* opts = parser->opts;
161	errno = 0;
162	switch (option) {
163	case 'F':
164		opts->frames = strtoul(arg, 0, 10);
165		return !errno;
166	case 'N':
167		opts->noVideo = true;
168		return true;
169	case 'O':
170		opts->overlayOffset = strtoul(arg, 0, 10);
171		return !errno;
172	case 'S':
173		opts->savestate = strdup(arg);
174		return true;
175	case 'V':
176		opts->ssOverlay = strdup(arg);
177		return true;
178	default:
179		return false;
180	}
181}