llvm dev - Dec 2015 - Dynamic Fault Injection with LLVM

Hi,
I want to use LLVM to make a dynamic fault injection. My primary goal is to
modify the value of a particular register in a particular instruction  and do,
for example, bit flipping on that register.
I've studying some tutorials and codes about LLVM but I'm still not sure
how to begin with. I know that I need to program a LLVM pass that iterates over
blocks and check which instruction modify to later check which operand in that
instruction modify. Is that the correct?
I've seen some examples but all of them seem very complicated (a lot of
code) to understand for a beginner like me. I wonder if there is an easier
example to understand or if you can provide me with one to start with.
Thank you very much for your help!
Best,
Examples that I haven't
understood:https://github.com/aperson40/FlipIt/blob/master/src/pass/faults.cpphttps://github.com/uswick/sight/blob/bd07a3c8592cf073366c76961479f25be1f8d83d/widgets/kulfi/faultInj/faults.cpp
 		 	   		  
-------------- next part --------------
An HTML attachment was scrubbed...
URL:
<http://lists.llvm.org/pipermail/llvm-dev/attachments/20151210/5396525f/attachment.html>

On 12/10/15 12:06 AM, Andres Torres Garcia via llvm-dev
wrote:
>
> Hi,
>
>
> I want to use LLVM to make a dynamic fault injection. My primary goal 
> is to modify the value of a particular register in a particular 
> instruction  and do, for example, bit flipping on that register.
>
By dynamic, do you mean that you want to change which faults are 
injected while the program is running, or is it sufficient to recompile 
the program and rerun it when you want to inject new faults?

Also, are you wanting to inject faults at the LLVM IR level, or do you 
want to inject faults after the program's machine code has been 
generated (e.g., you want to inject faults into a particular register)?

The answers to these questions will determine whether you need to write 
an LLVM IR pass or an LLVM MachineFunction pass (or whether you really 
want to be modifying a dynamic binary translator like QEMU/Valgrind 
instead of using LLVM).
>
> I've studying some tutorials and codes about LLVM but I'm still not
> sure how to begin with. I know that I need to program a LLVM pass that 
> iterates over blocks and check which instruction modify to later check 
> which operand in that instruction modify. Is that the correct?
>
I think the first three documents to read are:

1) How to Write an LLVM Pass
2) The LLVM Programmer's Manual
3) The LLVM Language Reference Manual

The first document explains how to add a new analysis/transform to the 
compiler.  The second explains some of the utility functions and idioms 
that you will see in existing LLVM code.  The third describes (in gory 
detail) the LLVM IR instruction set.

Regards,

John Criswell


-- 
John Criswell
Assistant Professor
Department of Computer Science, University of Rochester
http://www.cs.rochester.edu/u/criswell

-------------- next part --------------
An HTML attachment was scrubbed...
URL:
<http://lists.llvm.org/pipermail/llvm-dev/attachments/20151210/0563749a/attachment.html>

Hi, Andres,

If I understand correctly, you need to first traverse the module, function,
bbs and then detect the instructions that you want to modify. You can use
the getOpcode() or getOpcodeName() to detect the instruction that you want
to modify. Then you need to know which operand you want to modify. You can
use getOperand(i) to get the ith operand of one instruction, and then use
setOperand(i, new_value) to set the new operand. You can see the examples
from the links in your email.

But all these are done in IR level. In the assembly, these instructions
could be deleted/modified/optimized.

Regards,

Xiangyang

2015-12-10 0:06 GMT-05:00 Andres Torres Garcia via llvm-dev <
llvm-dev at lists.llvm.org>:
> Hi,
>
>
> I want to use LLVM to make a dynamic fault injection. My primary goal is
> to modify the value of a particular register in a particular instruction
>  and do, for example, bit flipping on that register.
>
>
> I've studying some tutorials and codes about LLVM but I'm still not
sure
> how to begin with. I know that I need to program a LLVM pass that iterates
> over blocks and check which instruction modify to later check which operand
> in that instruction modify. Is that the correct?
>
>
> I've seen some examples but all of them seem very complicated (a lot of
> code) to understand for a beginner like me. I wonder if there is an easier
> example to understand or if you can provide me with one to start with.
>
>
> Thank you very much for your help!
>
>
> Best,
>
>
> Examples that I haven't understood:
>
> https://github.com/aperson40/FlipIt/blob/master/src/pass/faults.cpp
>
>
>
https://github.com/uswick/sight/blob/bd07a3c8592cf073366c76961479f25be1f8d83d/widgets/kulfi/faultInj/faults.cpp
>
> _______________________________________________
> LLVM Developers mailing list
> llvm-dev at lists.llvm.org
> http://lists.llvm.org/cgi-bin/mailman/listinfo/llvm-dev
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL:
<http://lists.llvm.org/pipermail/llvm-dev/attachments/20151210/f82512bc/attachment.html>