How to Run the Fault Injection Experiment without Script

Overview

This page provides the underlying working flow of the description in Get Started with LLFI. Make sure you have read Get Started with LLFI first. The goal of the page is:

1. Help you understand the working flow of LLFI

2. Give you a sense of what each script in Get Started with LLFI is doing, so that if you want to replace one script with your own version, you need to accomplish the tasks of the original version.

Note: this is a short writeup that does not provide full details of each step, and I assume you already know some of the basic command like llvm-gcc, opt, llvm-link, etc.

Procedure

1. compile the program source codes to one single llvm IR file (.bc, or .ll), using llvm-gcc (and llvm-link). make sure the final IR file contains function 'main'. (compiletoIR in Get Started with LLFI)

2. (optional) Do whatever optimizations you want on the IR file (e.g. run opt -mem2reg to replace the load/store operations to PHI node).

3. run opt -load <LLFI pass> -genllfiindexpass to generate an IR file in which each instruction has a unique LLFI ID (instrument in Get Started with LLFI).

4. run opt -load <LLFI pass> -profilingpass on the output IR file of step 3 to generate an IR file with profiling function calls instrumented. You need to pass in a list of options which can be found in /src/LLFI/controller.cpp (instrument in Get Started with LLFI).

5. run opt -load <LLFI pass> -faultinjectionpass on the output IR file of step 3 to generate an IR file with fault injection function calls instrumented. You need to pass in exactly the same list of options as step 4 (instrument in Get Started with LLFI).

6. use llvm-gcc or clang to generate profiling and fault injection executables with the IR files in step 4 and 5. To generate the executables, you need to link the runtime library under /runtime_lib (assuming you know how to link a runtime library). You may need to build the library at the very beginning. The command are as follows: (if you are using clang, you can go directly from .ll to .exe) (instrument in Get Started with LLFI)

   llc, -filetype=obj -o proffile/fifile+'.o' proffile/fifile llvm-gcc -o, proffile/fifile+'.exe' proffile/fifile+'.o' -L llfilinklib -lllfi-rt

7. run profiling and fault injection executables. profiling executable generates a statistics file llfi.stat.prof.txt that contains the clock cycles spent on the specified instructions. The fault injection executable takes a input configuration file llfi.config.runtime.txt (you need to create the file and specify the fault injection parameters, e.g. fi_cycle=100) and outputs the details of the fault injection location in the file llfi.stat.fi.injectedfaults.txt. To run this step, you need to know how to load the dynamic library under /runtime_lib (profile and injectfault in Get Started with LLFI).