search

mchalupa / dg

[LLVM Static Slicer] Various program analyses, construction of dependence graphs and program slicing of LLVM bitcode.
MIT License
474 stars 131 forks source link

Slice results only from DDG #434

Open zhangzhenghsy opened 2 years ago

zhangzhenghsy commented 2 years ago

It seems that now the slice result are from both control dependent graph and data dependent graph. If I just want to get the data dependent lines, what should I do? Thanks

mchalupa commented 2 years ago

In what form you need the data dependence? If you are just viewing the dependecies via llvm-dg-dump, then there are these options:

  Dot printer options:
      --call                      - Print calls (default=false).
      --cfgall                    - Print full control flow graph (default=false).
      --postdom                   - Print post dominator tree (default=false).
      --no-cfg                    - Do not print control flow graph (default=false).
      --no-control                - Do not print control dependencies (default=false).
      --no-data                   - Do not print data dependencies (default=false).
      --no-use                    - Do not print uses (default=false).

I guess you should be good with llvm-dda-dump that dumps precisely the data dependence (also to dot).

For slicing (llvm-slicer), it is not possible to omit control dependence as the resulting bitcode would be malformed. But you can use -annotate=dd to generate an annotated debug file where you can see the data dependence.

zhangzhenghsy commented 2 years ago

Thanks a lot. Let me try. In fact, I only need all the data-dependent lines of a given line in the function.

zhangzhenghsy commented 2 years ago

I don't really understand the results. I run ./llvm-dda-dump --entry=do_mount -c do_new_mount namespace_tag/built-in_tag.bc > dda_result, trying to find the dependent lines of do_new_mount(......) in do_mount(), https://elixir.bootlin.com/linux/v5.5-rc5/source/fs/namespace.c#L3142 I have two questions: 1) The results are really long, it seems that the tool doesn't only analyze function do_mount() but also a lot of other functions, is it normal? 2) It seems that it doesn't show any dependent lines of do_new_mount() function call. What's the reason? image

mchalupa commented 2 years ago

The results are really long, it seems that the tool doesn't only analyze function do_mount() but also a lot of other functions, is it normal?

Yes, the analysis is interprocedural and all the functions that can be (transitively) called from do_mount are analyzed.

It seems that it doesn't show any dependent lines of do_new_mount() function call. What's the reason?

The call has no data dependence, its arguments do.

btw. llvm-dda-dump has also a switch -c-lines.

mchalupa commented 2 years ago

Since there have been multiple needs for such a functionality in the past, I quickly hacked a tool that gives you only the data (or control) dependence for a given instruction/line. It is in this branch for now: https://github.com/mchalupa/dg/tree/llvm-dg-deps .

You can use it as:

llvm-dg-deps -data '3142#' bitcode.bc

The format for -data is the same as for -sc. The output is not polished anyhow, but I hope this still helps.