search

DependableSystemsLab / LLFI

LLFI is an LLVM based fault injection tool, that injects faults into the LLVM IR of the application source code. The faults can be injected into specific program points, and the effect can be easily tracked back to the source code. Please refer to the paper below. NOTE: If you publish a paper using LLFI, please add it to PaperLLFI.bib
http://blogs.ubc.ca/karthik/2014/02/23/quantifying-the-accuracy-of-high-level-fault-injection-techniques/
Other
66 stars 36 forks source link

LLFI upgraded with LLVM-3.9 is not working for dstreg during instrument #103

Closed nankmr2012 closed 5 years ago

nankmr2012 commented 7 years ago

The LLFI is upgraded with respect to LLVM-3.9 which is located in the branch of github, the name of branch is : llfi3.9 The LLFI works perfectly expect if the regloc is dstreg i.e it works if regloc is allsrcreg or srcreg1~4. I am attaching error report while instrumenting the factorial program:-

~/llvm3.9/factorial$ ../llfi/bin/instrument --readable factorial.ll Unable to output logging information to file llfi.log.compilation.txt Unable to output logging information to file llfi.log.compilation.txt Instruction does not dominate all uses! %12 = call i32 (i8, ...) bitcast (i32 (...) @atoi to i32 (i8, ...))(i8* %fi8), !llfi_index !14 %fi9 = call i32 @injectFault4(i64 13, i32 %12, i32 54, i32 0, i32 1, i32 0, i8* getelementptr inbounds ([5 x i8], [5 x i8]* @call_namestr, i32 0, i32 0)), !llfiinjectfault !2 Instruction does not dominate all uses! %11 = load i8, i8_* %fi7, align 8, !llfi_index !13 %fi8 = call i8* @injectFault3(i64 12, i8* %11, i32 30, i32 0, i32 1, i32 0, i8* getelementptr inbounds ([5 x i8], [5 x i8]* @load_namestr, i32 0, i32 0)), !llfiinjectfault !2 Instruction does not dominate all uses! %10 = getelementptr i8, i8_* %fi6, i64 1, !llfi_index !12 %fi7 = call i8* @injectFault2(i64 11, i8* %10, i32 32, i32 0, i32 1, i32 0, i8* getelementptr inbounds ([14 x i8], [14 x i8]* @getelementptr_namestr, i32 0, i32 0)), !llfi_injectfault !2 Instruction does not dominate all uses! %9 = load i8, i8* %fi2, align 8, !llfi_index !11 %fi6 = call i8* @injectFault2(i64 10, i8* %9, i32 30, i32 0, i32 1, i32 0, i8* getelementptr inbounds ([5 x i8], [5 x i8]* @load_namestr, i32 0, i32 0)), !llfi_injectfault !2 Instruction does not dominate all uses! %8 = alloca i32, align 4, !llfi_index !7 %fi5 = call i32* @injectFault0(i64 6, i32* %8, i32 29, i32 0, i32 1, i32 0, i8* getelementptr inbounds ([7 x i8], [7 x i8]* @alloca_namestr, i32 0, i32 0)), !llfi_injectfault !2 Instruction does not dominate all uses! %7 = alloca i32, align 4, !llfi_index !6 %fi4 = call i32* @injectFault0(i64 5, i32* %7, i32 29, i32 0, i32 1, i32 0, i8* getelementptr inbounds ([7 x i8], [7 x i8]* @alloca_namestr, i32 0, i32 0)), !llfi_injectfault !2 Instruction does not dominate all uses! %6 = alloca i32, align 4, !llfi_index !5 %fi3 = call i32* @injectFault0(i64 4, i32* %6, i32 29, i32 0, i32 1, i32 0, i8* getelementptr inbounds ([7 x i8], [7 x i8]* @alloca_namestr, i32 0, i32 0)), !llfi_injectfault !2 Instruction does not dominate all uses! %5 = alloca i8, align 8, !llfi_index !4 %fi2 = call i8* @injectFault1(i64 3, i8** %5, i32 29, i32 0, i32 1, i32 0, i8* getelementptr inbounds ([7 x i8], [7 x i8]* @alloca_namestr, i32 0, i32 0)), !llfi_injectfault !2 Instruction does not dominate all uses! %4 = alloca i32, align 4, !llfi_index !3 %fi1 = call i32* @injectFault0(i64 2, i32* %4, i32 29, i32 0, i32 1, i32 0, i8* getelementptr inbounds ([7 x i8], [7 x i8]* @alloca_namestr, i32 0, i32 0)), !llfi_injectfault !2 Instruction does not dominate all uses! %16 = icmp sle i32 %fi10, %fi11, !llfi_index !21 %fi12 = call i1 @injectFault5(i64 20, i1 %16, i32 51, i32 0, i32 1, i32 0, i8* getelementptr inbounds ([5 x i8], [5 x i8]* @icmp_namestr, i32 0, i32 0)), !llfi_injectfault !2 Instruction does not dominate all uses! %15 = load i32, i32* %fi5, align 4, !llfi_index !20 %fi11 = call i32 @injectFault4(i64 19, i32 %15, i32 30, i32 0, i32 1, i32 0, i8* getelementptr inbounds ([5 x i8], [5 x i8]* @load_namestr, i32 0, i32 0)), !llfi_injectfault !2 Instruction does not dominate all uses! %20 = mul nsw i32 %fi13, %fi14, !llfi_index !25 %fi15 = call i32 @injectFault4(i64 24, i32 %20, i32 15, i32 0, i32 1, i32 0, i8* getelementptr inbounds ([4 x i8], [4 x i8]* @mul_namestr, i32 0, i32 0)), !llfi_injectfault !2 Instruction does not dominate all uses! %19 = load i32, i32* %fi3, align 4, !llfi_index !24 %fi14 = call i32 @injectFault4(i64 23, i32 %19, i32 30, i32 0, i32 1, i32 0, i8* getelementptr inbounds ([5 x i8], [5 x i8]* @load_namestr, i32 0, i32 0)), !llfi_injectfault !2 Instruction does not dominate all uses! %23 = add nsw i32 %fi16, 1, !llfi_index !29 %fi17 = call i32 @injectFault4(i64 28, i32 %23, i32 11, i32 0, i32 1, i32 0, i8* getelementptr inbounds ([4 x i8], [4 x i8]* @add_namestr, i32 0, i32 0)), !llfi_injectfault !2 Instruction does not dominate all uses! %27 = load i32, i32* %fi, align 4, !llfi_index !34 %fi20 = call i32 @injectFault4(i64 33, i32 %27, i32 30, i32 0, i32 1, i32 0, i8* getelementptr inbounds ([5 x i8], [5 x i8]* @load_namestr, i32 0, i32 0)), !llfiinjectfault !2 Instruction does not dominate all uses! %26 = call i32 (i8, ...) @printf(i8_ getelementptr inbounds ([4 x i8], [4 x i8]* @.str, i32 0, i32 0), i32 %fi18), !llfi_index !33 %fi19 = call i32 @injectFault4(i64 32, i32 %26, i32 54, i32 0, i32 1, i32 0, i8* getelementptr inbounds ([5 x i8], [5 x i8]\ @call_namestr, i32 0, i32 0)), !llfi_injectfault !2 LLVM ERROR: Broken function found, compilation aborted!

ERROR: there was an error during running the instrumentation pass, please follow the provided instructions for instrument.

abrahamchan commented 7 years ago

Nanda has kept me up to date on this issue. I have debugged the API calls with him, and we managed to narrow down the problem to ConstantExpr::getGetElementPtr() in the FaultInjectionPass::insertInjectionFuncCall() function.

karthikp-ubc commented 7 years ago

So is the problem with LLVM's implementation of the function or with LLFI's use of the above function ? If it's the latter, we should be able to precisely find out the cause of the error. Thanks

karthikp-ubc commented 5 years ago

We decided not to do the update after all, so I'm closing this issue. The functionality works in the current version.