KLEE:关于内联程序集的意外错误

Question

我最近和KLEE在一起玩。我遵循了文档"KLEE大楼(LLVM 3.4)“并成功地运行了本教程中的所有示例。

但是，当使用KLEE运行我自己的程序时：

$ klee -load=/usr/lib/x86_64-linux-gnu/libssl.so --libc=uclibc --posix-runtime -emit-all-errors -allow-external-sym-calls klee_client.bc

发生了一些错误。(请参见下面的控制台输出)

KLEE: NOTE: Using klee-uclibc : /home/testuser/Downloads/klee/Release+Asserts/lib/klee-uclibc.bca
KLEE: NOTE: Using model: /home/testuser/Downloads/klee/Release+Asserts/lib/libkleeRuntimePOSIX.bca
KLEE: output directory is "/home/testuser/Downloads/klee_test/klee-out-3"
KLEE: WARNING ONCE: function "__libc_connect" has inline asm
KLEE: WARNING ONCE: function "setsockopt" has inline asm
KLEE: WARNING ONCE: function "shutdown" has inline asm
KLEE: WARNING ONCE: function "socket" has inline asm
KLEE: WARNING ONCE: function "__libc_recvfrom" has inline asm
KLEE: WARNING ONCE: function "__libc_sendto" has inline asm
KLEE: WARNING: undefined reference to function: ERR_clear_error
KLEE: WARNING: undefined reference to function: ERR_error_string
KLEE: WARNING: undefined reference to function: ERR_get_error
KLEE: WARNING: undefined reference to function: OPENSSL_config
KLEE: WARNING: undefined reference to function: SSL_CTX_ctrl
KLEE: WARNING: undefined reference to function: SSL_CTX_free
KLEE: WARNING: undefined reference to function: SSL_CTX_new
KLEE: WARNING: undefined reference to function: SSL_CTX_set_next_proto_select_cb
KLEE: WARNING: undefined reference to function: SSL_connect
KLEE: WARNING: undefined reference to function: SSL_free
KLEE: WARNING: undefined reference to function: SSL_get_error
KLEE: WARNING: undefined reference to function: SSL_library_init
KLEE: WARNING: undefined reference to function: SSL_load_error_strings
KLEE: WARNING: undefined reference to function: SSL_new
KLEE: WARNING: undefined reference to function: SSL_read
KLEE: WARNING: undefined reference to function: SSL_set_fd
KLEE: WARNING: undefined reference to function: SSL_shutdown
KLEE: WARNING: undefined reference to function: SSL_write
KLEE: WARNING: undefined reference to function: SSLv23_client_method
KLEE: WARNING: undefined reference to function: klee_posix_prefer_cex
...
KLEE: WARNING ONCE: calling external: syscall(16, 0, 21505, 40876048)
KLEE: WARNING ONCE: calling __user_main with extra arguments.
KLEE: WARNING ONCE: __syscall_rt_sigaction: silently ignoring
KLEE: WARNING ONCE: calling external: OPENSSL_config(0)
KLEE: WARNING ONCE: calling external: SSL_load_error_strings()
KLEE: WARNING ONCE: calling external: SSL_library_init()
KLEE: WARNING ONCE: calling external: printf(35435072, 46338336)
KLEE: ERROR: /home/testuser/Downloads/klee-uclibc/libc/inet/socketcalls.c:362: inline assembly is unsupported

KLEE: done: total instructions = 99493
KLEE: done: completed paths = 1
KLEE: done: generated tests = 1

我很好奇为什么会有与uclibc相关的错误？因为我按照KLEE文档的话编译了它，在编译之前，我没有找到在“配置”uclibc之前禁用汇编程序代码(例如no-asm)的任何选项。

此外，我还注意到，有许多关于“未明确提及功能：.”的警告。是否应该将相应的库编译为llvm，而不是使用现有的共享对象？

谢谢!

Answer 1

对于Q1:基本上，KLEE教育用户将uClibc编译成LLVM的归档文件。uClibc中的许多函数包含内联程序集(甚至直接与程序集一起开发)。这些程序集不会被编译成LLVM IR，相反，它们将在IR中保持不变。在执行ucLibc函数的IR之前，KLEE将检查IR中是否包含任何程序集。如果是这样，您将看到警告为“函数XXX有内联asm”。没有禁用程序集的选项。要摆脱这些程序集，您必须找到一种将它们转换为LLVM IR的方法。

对于Q2:您需要分离KLEE和将要测试的程序(例如，在您的情况下，klee_client.bc )。当您将现有的共享对象加载到KLEE时，实际上是将库链接到KLEE进程，而不是将要测试的程序。要将将要测试的程序与库链接起来，您需要将库编译成IR，然后通过修改KLEE中的主要功能(或者使用在KLEE中构建的一些选项，我还不清楚)将它链接到待测试程序。当需要测试的程序由KLEE加载并与指定的库链接时，KLEE将检查是否存在每个所需的函数(由某些指令调用)。否则，您将看到警告。在您的例子中，您基本上没有将将要测试的程序与LibSSL的LLVM IR链接起来。