[PATCH] D97854: [RFC][nsan] A Floating-point numerical sanitizer.

[Clement Courbet via Phabricator via cfe-commits]

courbet created this revision.
Herald added subscribers: dexonsmith, jdoerfert, jfb, steven_wu, cryptoad, hiraditya, mgorny.
courbet requested review of this revision.
Herald added projects: clang, Sanitizers, LLVM.
Herald added subscribers: llvm-commits, Sanitizers, cfe-commits.

LLVM has sanitizers for thread safety, memory, UB,... We propose nsan
as a new sanitizer for numerical (floating-point) issues.

For each floating point IR instruction, the instrumentation pass inserts
an equivalent instruction in double the precision (e.g. float -> double,
double -> fp128), called the "shadow".

For any instruction that is observable outside of a function (return,
function call with float parameters, store, ...), the results of the
original and shadow computations are compared, and a warning is emitted
if the values do not match.

Original values in memory are shadowed in double the precision, with an
additional tag for each byte to represent the memory type (untyped,
float, long, double, long double, ...). Libc functions (and corresponding
llvm intrinsics) are intercepted to copy or set shadow types accordingly.

Unit tests include some well-known examples of numerical instabilities.

nsan is still work in progress, but this patch is able to run and detect
issues on several applications, including the whoel SPECfp benchmark
suite.

nsan-instrumented applications are typically 3-100x slower and take ~4x
more memory than the original.

More details can be found in this paper: https://arxiv.org/abs/2102.12782


Repository:
  rG LLVM Github Monorepo

https://reviews.llvm.org/D97854

Files:
  clang/include/clang/Basic/Features.def
  clang/include/clang/Basic/Sanitizers.def
  clang/include/clang/Driver/SanitizerArgs.h
  clang/lib/CodeGen/BackendUtil.cpp
  clang/lib/CodeGen/CGDeclCXX.cpp
  clang/lib/CodeGen/CodeGenFunction.cpp
  clang/lib/Driver/SanitizerArgs.cpp
  clang/lib/Driver/ToolChains/CommonArgs.cpp
  clang/lib/Driver/ToolChains/Linux.cpp
  clang/runtime/CMakeLists.txt
  compiler-rt/cmake/config-ix.cmake
  compiler-rt/include/sanitizer/nsan_interface.h
  compiler-rt/lib/nsan/CMakeLists.txt
  compiler-rt/lib/nsan/nsan.cc
  compiler-rt/lib/nsan/nsan.h
  compiler-rt/lib/nsan/nsan.syms.extra
  compiler-rt/lib/nsan/nsan_flags.cc
  compiler-rt/lib/nsan/nsan_flags.h
  compiler-rt/lib/nsan/nsan_flags.inc
  compiler-rt/lib/nsan/nsan_interceptors.cc
  compiler-rt/lib/nsan/nsan_platform.h
  compiler-rt/lib/nsan/nsan_stats.cc
  compiler-rt/lib/nsan/nsan_stats.h
  compiler-rt/lib/nsan/nsan_suppressions.cc
  compiler-rt/lib/nsan/nsan_suppressions.h
  compiler-rt/lib/nsan/tests/CMakeLists.txt
  compiler-rt/lib/nsan/tests/NSanUnitTest.cpp
  compiler-rt/test/nsan/CMakeLists.txt
  compiler-rt/test/nsan/alloca.cc
  compiler-rt/test/nsan/cadna_ex1.cc
  compiler-rt/test/nsan/cadna_ex2.cc
  compiler-rt/test/nsan/cadna_ex3.cc
  compiler-rt/test/nsan/cadna_ex4.cc
  compiler-rt/test/nsan/cadna_ex5.cc
  compiler-rt/test/nsan/cadna_ex6.cc
  compiler-rt/test/nsan/cadna_ex7.cc
  compiler-rt/test/nsan/cancellation_fn_ptr.cc
  compiler-rt/test/nsan/cancellation_libm.cc
  compiler-rt/test/nsan/cancellation_ok.cc
  compiler-rt/test/nsan/compare.cc
  compiler-rt/test/nsan/compute_pi.cc
  compiler-rt/test/nsan/helpers.h
  compiler-rt/test/nsan/infinity.cc
  compiler-rt/test/nsan/intercept_libc_str.cc
  compiler-rt/test/nsan/intercept_libc_wstr.cc
  compiler-rt/test/nsan/interface_dump_shadow_mem.cc
  compiler-rt/test/nsan/jmmuller.cc
  compiler-rt/test/nsan/lit.cfg.py
  compiler-rt/test/nsan/lit.site.cfg.py.in
  compiler-rt/test/nsan/memcpy.cc
  compiler-rt/test/nsan/memset_nonzero.cc
  compiler-rt/test/nsan/memset_zero.cc
  compiler-rt/test/nsan/rumps_royal_pain.cc
  compiler-rt/test/nsan/simd.cc
  compiler-rt/test/nsan/smooth_surprise.cc
  compiler-rt/test/nsan/stable_sort.cc
  compiler-rt/test/nsan/stack.cc
  compiler-rt/test/nsan/stats.cc
  compiler-rt/test/nsan/sums.cc
  compiler-rt/test/nsan/suppressions.cc
  compiler-rt/test/nsan/swap.cc
  compiler-rt/test/nsan/type_punning.cc
  compiler-rt/test/nsan/uninstrumented_write.cc
  compiler-rt/test/nsan/vector_push_back.cc
  compiler-rt/test/nsan/verificarlo_case4.cc
  llvm/include/llvm/Bitcode/LLVMBitCodes.h
  llvm/include/llvm/IR/Attributes.td
  llvm/include/llvm/InitializePasses.h
  llvm/include/llvm/Transforms/Instrumentation/NumericalStabilitySanitizer.h
  llvm/lib/AsmParser/LLLexer.cpp
  llvm/lib/AsmParser/LLParser.cpp
  llvm/lib/AsmParser/LLToken.h
  llvm/lib/Bitcode/Reader/BitcodeReader.cpp
  llvm/lib/Bitcode/Writer/BitcodeWriter.cpp
  llvm/lib/IR/Attributes.cpp
  llvm/lib/IR/Verifier.cpp
  llvm/lib/Passes/PassBuilder.cpp
  llvm/lib/Passes/PassRegistry.def
  llvm/lib/Transforms/IPO/ForceFunctionAttrs.cpp
  llvm/lib/Transforms/Instrumentation/CMakeLists.txt
  llvm/lib/Transforms/Instrumentation/Instrumentation.cpp
  llvm/lib/Transforms/Instrumentation/NumericalStabilitySanitizer.cpp
  llvm/lib/Transforms/Utils/CodeExtractor.cpp
  llvm/test/Instrumentation/NumericalStabilitySanitizer/basic.ll
  llvm/test/Instrumentation/NumericalStabilitySanitizer/cfg.ll
  llvm/test/Instrumentation/NumericalStabilitySanitizer/fcmp.ll
  llvm/test/Instrumentation/NumericalStabilitySanitizer/invoke.ll
  llvm/test/Instrumentation/NumericalStabilitySanitizer/memory.ll

-------------- next part --------------
A non-text attachment was scrubbed...
Name: D97854.327765.patch
Type: text/x-patch
Size: 385924 bytes
Desc: not available
URL: <http://lists.llvm.org/pipermail/cfe-commits/attachments/20210303/5008c6dc/attachment-0001.bin>