svf-lib 1.0.973 → 1.0.976
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/SVF-linux/Release-build/lib/libSvf.a +0 -0
- package/SVF-linux/include/SABER/PathCondAllocator.h +4 -4
- package/SVF-linux/include/SABER/SrcSnkDDA.h +2 -2
- package/SVF-linux/include/SABER/SrcSnkSolver.h +186 -0
- package/SVF-linux/include/SVF-FE/IRAnnotator.h +321 -0
- package/SVF-linux/include/Util/BDDExpr.h +182 -0
- package/SVF-linux/include/Util/DPItem.h +1 -1
- package/SVF-linux/include/Util/ExeState.h +172 -0
- package/SVF-linux/include/Util/Options.h +0 -3
- package/SVF-linux/include/Util/Z3Expr.h +235 -0
- package/SVF-linux/include/WPA/FlowSensitiveTBHC.h +1 -1
- package/SVF-linux/include/WPA/TypeBasedHeapCloning.h +188 -0
- package/SVF-osx/Release-build/lib/CUDD/libCudd.a +0 -0
- package/SVF-osx/Release-build/lib/libSvf.a +0 -0
- package/SVF-osx/include/SABER/PathCondAllocator.h +4 -4
- package/SVF-osx/include/SABER/SrcSnkDDA.h +2 -2
- package/SVF-osx/include/SABER/SrcSnkSolver.h +186 -0
- package/SVF-osx/include/SVF-FE/IRAnnotator.h +321 -0
- package/SVF-osx/include/Util/BDDExpr.h +182 -0
- package/SVF-osx/include/Util/DPItem.h +1 -1
- package/SVF-osx/include/Util/ExeState.h +172 -0
- package/SVF-osx/include/Util/Options.h +0 -3
- package/SVF-osx/include/Util/Z3Expr.h +235 -0
- package/SVF-osx/include/WPA/FlowSensitiveTBHC.h +1 -1
- package/SVF-osx/include/WPA/TypeBasedHeapCloning.h +188 -0
- package/package.json +1 -1
|
@@ -0,0 +1,321 @@
|
|
|
1
|
+
/*
|
|
2
|
+
* Annotator.h
|
|
3
|
+
*
|
|
4
|
+
* Created on: March 22, 2021
|
|
5
|
+
* Author: Nicholas Tsom
|
|
6
|
+
*/
|
|
7
|
+
|
|
8
|
+
#ifndef IRANNOTATOR_H_
|
|
9
|
+
#define IRANNOTATOR_H_
|
|
10
|
+
|
|
11
|
+
#include "MemoryModel/SVFIR.h"
|
|
12
|
+
#include "MemoryModel/PointerAnalysisImpl.h"
|
|
13
|
+
#include "Util/SVFUtil.h"
|
|
14
|
+
#include "llvm/IR/Metadata.h"
|
|
15
|
+
|
|
16
|
+
|
|
17
|
+
namespace SVF
|
|
18
|
+
{
|
|
19
|
+
/*!
|
|
20
|
+
* Program annotator to write metadata information on LLVM IR
|
|
21
|
+
*/
|
|
22
|
+
class IRAnnotator
|
|
23
|
+
{
|
|
24
|
+
public:
|
|
25
|
+
IRAnnotator():
|
|
26
|
+
mainModule(nullptr),
|
|
27
|
+
ptsTo(nullptr)
|
|
28
|
+
{}
|
|
29
|
+
~IRAnnotator() {}
|
|
30
|
+
|
|
31
|
+
void processAndersenResults(SVFIR *pag, BVDataPTAImpl *ptsTo, bool writeFlag)
|
|
32
|
+
{
|
|
33
|
+
this->ptsTo = ptsTo;
|
|
34
|
+
mainModule = LLVMModuleSet::getLLVMModuleSet()->getMainLLVMModule();
|
|
35
|
+
|
|
36
|
+
// Add a named metadata node used to check whether or not
|
|
37
|
+
// this IR has been annotated with Andersen information
|
|
38
|
+
if (writeFlag)
|
|
39
|
+
mainModule->getOrInsertNamedMetadata("SVFIR-Annotated");
|
|
40
|
+
|
|
41
|
+
for (auto it = pag->begin(); it != pag->end(); ++it)
|
|
42
|
+
{
|
|
43
|
+
auto nodeId = it->first;
|
|
44
|
+
auto pagNode = it->second;
|
|
45
|
+
auto gepNode = SVFUtil::dyn_cast<GepObjVar>(pagNode);
|
|
46
|
+
|
|
47
|
+
if (gepNode && writeFlag)
|
|
48
|
+
{
|
|
49
|
+
writePAGgepNode(nodeId, gepNode);
|
|
50
|
+
}
|
|
51
|
+
else if (pagNode->hasValue())
|
|
52
|
+
{
|
|
53
|
+
processPAGNode(pagNode->getValue(), nodeId, writeFlag);
|
|
54
|
+
}
|
|
55
|
+
}
|
|
56
|
+
|
|
57
|
+
if (!writeFlag)
|
|
58
|
+
readPAGgepNodes(pag);
|
|
59
|
+
}
|
|
60
|
+
|
|
61
|
+
private:
|
|
62
|
+
// Write the PAGgepNode to the IR such that metadata name is the SVFIR node id and the operands
|
|
63
|
+
// are its base node's id and location offset
|
|
64
|
+
void writePAGgepNode(SVF::NodeID nodeId, GepObjVar* gepNode)
|
|
65
|
+
{
|
|
66
|
+
auto baseNodeId = gepNode->getBaseNode();
|
|
67
|
+
auto locationSetOffset = gepNode->getConstantFieldIdx();
|
|
68
|
+
|
|
69
|
+
LLVMContext &context = mainModule->getContext();
|
|
70
|
+
llvm::SmallVector<llvm::Metadata *, 32> operands;
|
|
71
|
+
operands.push_back(llvm::MDString::get(context, std::to_string(baseNodeId)));
|
|
72
|
+
operands.push_back(llvm::MDString::get(context, std::to_string(locationSetOffset)));
|
|
73
|
+
|
|
74
|
+
llvm::MDTuple *metadata = llvm::MDTuple::get(context, operands);
|
|
75
|
+
std::string label = "gepnode-" + std::to_string(nodeId);
|
|
76
|
+
|
|
77
|
+
mainModule->getOrInsertNamedMetadata(label)->addOperand(metadata);
|
|
78
|
+
}
|
|
79
|
+
|
|
80
|
+
// Reads the PAGGepNodes in the annotated IR and creates a new SVFIR Node based on the
|
|
81
|
+
// data contained in the operands of the metadata node
|
|
82
|
+
void readPAGgepNodes(SVFIR *pag)
|
|
83
|
+
{
|
|
84
|
+
for (auto it = mainModule->named_metadata_begin(); it != mainModule->named_metadata_end(); ++it)
|
|
85
|
+
{
|
|
86
|
+
std::string label = it->getName().str();
|
|
87
|
+
std::string toErase = "gepnode-";
|
|
88
|
+
std::size_t pos = label.find(toErase);
|
|
89
|
+
if (pos == std::string::npos)
|
|
90
|
+
{
|
|
91
|
+
continue;
|
|
92
|
+
}
|
|
93
|
+
label.erase(pos, toErase.length());
|
|
94
|
+
|
|
95
|
+
SVF::NodeID nodeId = std::stoi(label);
|
|
96
|
+
auto mdNode = it->getOperand(0);
|
|
97
|
+
|
|
98
|
+
SVF::NodeID baseNodeId = std::stoi(llvm::cast<llvm::MDString>(mdNode->getOperand(0))->getString().str());
|
|
99
|
+
SVF::s32_t locationSetOffset = std::stoi(llvm::cast<llvm::MDString>(mdNode->getOperand(1))->getString().str());
|
|
100
|
+
|
|
101
|
+
LocationSet locationSet = LocationSet(locationSetOffset);
|
|
102
|
+
SVF::NodeID gepnodeId = pag->getGepObjVar(baseNodeId, locationSet);
|
|
103
|
+
|
|
104
|
+
assert(nodeId == gepnodeId && "nodeId != gepnodeId");
|
|
105
|
+
}
|
|
106
|
+
}
|
|
107
|
+
|
|
108
|
+
// Deduce the LLVM value's type, and process the metadata accordingly
|
|
109
|
+
void processPAGNode(const Value *value, SVF::NodeID nodeId, bool writeFlag)
|
|
110
|
+
{
|
|
111
|
+
if (auto instruction = const_cast<Instruction *>(SVFUtil::dyn_cast<Instruction>(value)))
|
|
112
|
+
{
|
|
113
|
+
processInstructionNode(instruction, nodeId, writeFlag);
|
|
114
|
+
}
|
|
115
|
+
else if (auto argument = const_cast<Argument *>(SVFUtil::dyn_cast<Argument>(value)))
|
|
116
|
+
{
|
|
117
|
+
processArgumentNode(argument, nodeId, writeFlag);
|
|
118
|
+
}
|
|
119
|
+
else if (auto function = const_cast<Function *>(SVFUtil::dyn_cast<Function>(value)))
|
|
120
|
+
{
|
|
121
|
+
processFunctionNode(function, nodeId, writeFlag);
|
|
122
|
+
}
|
|
123
|
+
else if (auto globalVar = const_cast<GlobalVariable *>(SVFUtil::dyn_cast<GlobalVariable>(value)))
|
|
124
|
+
{
|
|
125
|
+
processGlobalVarNode(globalVar, nodeId, writeFlag);
|
|
126
|
+
}
|
|
127
|
+
else if (auto basicBlock = const_cast<BasicBlock *>(SVFUtil::dyn_cast<BasicBlock>(value)))
|
|
128
|
+
{
|
|
129
|
+
processBasicBlockNode(basicBlock, nodeId, writeFlag);
|
|
130
|
+
}
|
|
131
|
+
else if (SVFUtil::isa<Constant>(value))
|
|
132
|
+
{
|
|
133
|
+
processConstantNode(nodeId, writeFlag);
|
|
134
|
+
}
|
|
135
|
+
else if (auto inlineAsm = const_cast<llvm::InlineAsm *>(SVFUtil::dyn_cast<llvm::InlineAsm>(value)))
|
|
136
|
+
{
|
|
137
|
+
processInlineAsmNode(inlineAsm, nodeId, writeFlag);
|
|
138
|
+
}
|
|
139
|
+
else
|
|
140
|
+
{
|
|
141
|
+
SVFUtil::outs() << "Value is NOT a Instruction, Argument, Function, GlobalVariable, BasicBlock, Constant or InlineAsm" << std::endl;
|
|
142
|
+
SVFUtil::outs() << SVFUtil::value2String(value) << "\n";
|
|
143
|
+
}
|
|
144
|
+
}
|
|
145
|
+
|
|
146
|
+
void processInstructionNode(Instruction *instruction, const SVF::NodeID &nodeId, bool writeFlag)
|
|
147
|
+
{
|
|
148
|
+
std::string label = "inode-" + std::to_string(nodeId);
|
|
149
|
+
|
|
150
|
+
if (writeFlag)
|
|
151
|
+
{
|
|
152
|
+
LLVMContext &context = instruction->getContext();
|
|
153
|
+
auto mdNodePts = getMdNodePts(nodeId, context);
|
|
154
|
+
instruction->setMetadata(label, mdNodePts);
|
|
155
|
+
}
|
|
156
|
+
else
|
|
157
|
+
{
|
|
158
|
+
auto mdNode = instruction->getMetadata(label);
|
|
159
|
+
assert(mdNode != nullptr && "Failed to retrive valid node id at instruction");
|
|
160
|
+
addAndersenMetadata(nodeId, mdNode);
|
|
161
|
+
}
|
|
162
|
+
}
|
|
163
|
+
|
|
164
|
+
void processArgumentNode(Argument *argument, const SVF::NodeID &nodeId, bool writeFlag)
|
|
165
|
+
{
|
|
166
|
+
std::string label = "anode-" + std::to_string(nodeId);
|
|
167
|
+
|
|
168
|
+
if (writeFlag)
|
|
169
|
+
{
|
|
170
|
+
LLVMContext &context = argument->getContext();
|
|
171
|
+
auto mdNodePts = getMdNodePts(nodeId, context);
|
|
172
|
+
argument->getParent()->setMetadata(label, mdNodePts);
|
|
173
|
+
}
|
|
174
|
+
else
|
|
175
|
+
{
|
|
176
|
+
auto mdNode = argument->getParent()->getMetadata(label);
|
|
177
|
+
assert(mdNode != nullptr && "Failed to retrive valid node id at argument");
|
|
178
|
+
addAndersenMetadata(nodeId, mdNode);
|
|
179
|
+
}
|
|
180
|
+
}
|
|
181
|
+
|
|
182
|
+
void processFunctionNode(Function *function, const SVF::NodeID &nodeId, bool writeFlag)
|
|
183
|
+
{
|
|
184
|
+
std::string label = "fnode-" + std::to_string(nodeId);
|
|
185
|
+
|
|
186
|
+
if (writeFlag)
|
|
187
|
+
{
|
|
188
|
+
LLVMContext &context = function->getContext();
|
|
189
|
+
auto mdNodePts = getMdNodePts(nodeId, context);
|
|
190
|
+
function->setMetadata(label, mdNodePts);
|
|
191
|
+
}
|
|
192
|
+
else
|
|
193
|
+
{
|
|
194
|
+
auto mdNode = function->getMetadata(label);
|
|
195
|
+
assert(mdNode != nullptr && "Failed to retrive valid node id at function");
|
|
196
|
+
addAndersenMetadata(nodeId, mdNode);
|
|
197
|
+
}
|
|
198
|
+
}
|
|
199
|
+
|
|
200
|
+
void processGlobalVarNode(GlobalVariable *globalVar, const SVF::NodeID &nodeId, bool writeFlag)
|
|
201
|
+
{
|
|
202
|
+
std::string label = "gnode-" + std::to_string(nodeId);
|
|
203
|
+
|
|
204
|
+
if (writeFlag)
|
|
205
|
+
{
|
|
206
|
+
LLVMContext &context = globalVar->getContext();
|
|
207
|
+
auto mdNodePts = getMdNodePts(nodeId, context);
|
|
208
|
+
globalVar->setMetadata(label, mdNodePts);
|
|
209
|
+
}
|
|
210
|
+
else
|
|
211
|
+
{
|
|
212
|
+
auto mdNode = globalVar->getMetadata(label);
|
|
213
|
+
assert(mdNode != nullptr && "Failed to retrive valid node id at instruction");
|
|
214
|
+
addAndersenMetadata(nodeId, mdNode);
|
|
215
|
+
}
|
|
216
|
+
}
|
|
217
|
+
|
|
218
|
+
void processBasicBlockNode(BasicBlock *basicBlock, const SVF::NodeID &nodeId, bool writeFlag)
|
|
219
|
+
{
|
|
220
|
+
std::string label = "bnode-" + std::to_string(nodeId);
|
|
221
|
+
|
|
222
|
+
if (writeFlag)
|
|
223
|
+
{
|
|
224
|
+
LLVMContext &context = basicBlock->getContext();
|
|
225
|
+
auto mdNodePts = getMdNodePts(nodeId, context);
|
|
226
|
+
basicBlock->getParent()->setMetadata(label, mdNodePts);
|
|
227
|
+
}
|
|
228
|
+
else
|
|
229
|
+
{
|
|
230
|
+
auto mdNode = basicBlock->getParent()->getMetadata(label);
|
|
231
|
+
assert(mdNode != nullptr && "Failed to retrive valid node id at basicBlock");
|
|
232
|
+
addAndersenMetadata(nodeId, mdNode);
|
|
233
|
+
}
|
|
234
|
+
}
|
|
235
|
+
|
|
236
|
+
void processConstantNode(const SVF::NodeID &nodeId, bool writeFlag)
|
|
237
|
+
{
|
|
238
|
+
std::string label = "cnode-" + std::to_string(nodeId);
|
|
239
|
+
|
|
240
|
+
if (writeFlag)
|
|
241
|
+
{
|
|
242
|
+
LLVMContext &context = mainModule->getContext();
|
|
243
|
+
auto mdNodePts = getMdNodePts(nodeId, context);
|
|
244
|
+
mainModule->getOrInsertNamedMetadata(label)->addOperand(mdNodePts);
|
|
245
|
+
}
|
|
246
|
+
else
|
|
247
|
+
{
|
|
248
|
+
auto mdNode = mainModule->getNamedMetadata(label);
|
|
249
|
+
assert(mdNode != nullptr && "Failed to retrive valid node id at instruction");
|
|
250
|
+
addAndersenNamedMetdata(nodeId, mdNode);
|
|
251
|
+
}
|
|
252
|
+
}
|
|
253
|
+
|
|
254
|
+
void processInlineAsmNode(llvm::InlineAsm *inlineAsm, const SVF::NodeID &nodeId, bool writeFlag)
|
|
255
|
+
{
|
|
256
|
+
std::string label = "iAsmnode-" + std::to_string(nodeId);
|
|
257
|
+
|
|
258
|
+
if (writeFlag)
|
|
259
|
+
{
|
|
260
|
+
LLVMContext &context = mainModule->getContext();
|
|
261
|
+
auto mdNodePts = getMdNodePts(nodeId, context);
|
|
262
|
+
mainModule->getOrInsertNamedMetadata(label)->addOperand(mdNodePts);
|
|
263
|
+
}
|
|
264
|
+
else
|
|
265
|
+
{
|
|
266
|
+
auto mdNode = mainModule->getNamedMetadata(label);
|
|
267
|
+
assert(mdNode != nullptr && "Failed to retrive valid node id at inlineAsm");
|
|
268
|
+
addAndersenNamedMetdata(nodeId, mdNode);
|
|
269
|
+
}
|
|
270
|
+
}
|
|
271
|
+
|
|
272
|
+
void addAndersenMetadata(const SVF::NodeID &nodeId, MDNode *mdNode)
|
|
273
|
+
{
|
|
274
|
+
if (mdNode)
|
|
275
|
+
{
|
|
276
|
+
for (unsigned int i = 0; i < mdNode->getNumOperands(); i++)
|
|
277
|
+
{
|
|
278
|
+
auto anderNodeIdStr = llvm::cast<llvm::MDString>(mdNode->getOperand(i))->getString().str();
|
|
279
|
+
auto anderNodeId = SVF::NodeID(std::stoul(anderNodeIdStr));
|
|
280
|
+
ptsTo->addPts(nodeId, anderNodeId);
|
|
281
|
+
}
|
|
282
|
+
}
|
|
283
|
+
}
|
|
284
|
+
|
|
285
|
+
void addAndersenNamedMetdata(const SVF::NodeID &nodeId, NamedMDNode *mdNode)
|
|
286
|
+
{
|
|
287
|
+
if (mdNode)
|
|
288
|
+
{
|
|
289
|
+
for (unsigned int i = 0; i < mdNode->getNumOperands(); i++)
|
|
290
|
+
{
|
|
291
|
+
auto node = mdNode->getOperand(i);
|
|
292
|
+
|
|
293
|
+
for (unsigned int j = 0; j < node->getNumOperands(); j++)
|
|
294
|
+
{
|
|
295
|
+
auto anderNodeIdStr = llvm::cast<llvm::MDString>(node->getOperand(j))->getString().str();
|
|
296
|
+
auto anderNodeId = SVF::NodeID(std::stoul(anderNodeIdStr));
|
|
297
|
+
ptsTo->addPts(nodeId, anderNodeId);
|
|
298
|
+
}
|
|
299
|
+
}
|
|
300
|
+
}
|
|
301
|
+
}
|
|
302
|
+
|
|
303
|
+
inline llvm::MDTuple* getMdNodePts(const SVF::NodeID &nodeId, LLVMContext &context)
|
|
304
|
+
{
|
|
305
|
+
llvm::SmallVector<llvm::Metadata *, 32> operands;
|
|
306
|
+
auto &ptTo = ptsTo->getPts(nodeId);
|
|
307
|
+
for (const auto p : ptTo)
|
|
308
|
+
{
|
|
309
|
+
operands.push_back(llvm::MDString::get(context, std::to_string(p)));
|
|
310
|
+
}
|
|
311
|
+
return llvm::MDTuple::get(context, operands);
|
|
312
|
+
}
|
|
313
|
+
|
|
314
|
+
Module* mainModule;
|
|
315
|
+
BVDataPTAImpl *ptsTo;
|
|
316
|
+
|
|
317
|
+
};
|
|
318
|
+
|
|
319
|
+
} // End namespace SVF
|
|
320
|
+
|
|
321
|
+
#endif /* IRANNOTATOR_H_ */
|
|
@@ -0,0 +1,182 @@
|
|
|
1
|
+
//===- BDDExpr.h -- Context/Path BDD conditions----------------------------//
|
|
2
|
+
//
|
|
3
|
+
// SVF: Static Value-Flow Analysis
|
|
4
|
+
//
|
|
5
|
+
// Copyright (C) <2013-2017> <Yulei Sui>
|
|
6
|
+
//
|
|
7
|
+
|
|
8
|
+
// This program is free software: you can redistribute it and/or modify
|
|
9
|
+
// it under the terms of the GNU General Public License as published by
|
|
10
|
+
// the Free Software Foundation, either version 3 of the License, or
|
|
11
|
+
// (at your option) any later version.
|
|
12
|
+
|
|
13
|
+
// This program is distributed in the hope that it will be useful,
|
|
14
|
+
// but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
15
|
+
// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
16
|
+
// GNU General Public License for more details.
|
|
17
|
+
|
|
18
|
+
// You should have received a copy of the GNU General Public License
|
|
19
|
+
// along with this program. If not, see <http://www.gnu.org/licenses/>.
|
|
20
|
+
//
|
|
21
|
+
//===----------------------------------------------------------------------===//
|
|
22
|
+
|
|
23
|
+
/*
|
|
24
|
+
* Condition.h
|
|
25
|
+
*
|
|
26
|
+
* Created on: Oct 19, 2021
|
|
27
|
+
* Author: Yulei and Xiao
|
|
28
|
+
*/
|
|
29
|
+
|
|
30
|
+
#ifndef BITVECTORCOND_H_
|
|
31
|
+
#define BITVECTORCOND_H_
|
|
32
|
+
|
|
33
|
+
#include "Util/BasicTypes.h"
|
|
34
|
+
#include <cstdio>
|
|
35
|
+
|
|
36
|
+
#include "CUDD/cuddInt.h"
|
|
37
|
+
#include "z3++.h"
|
|
38
|
+
|
|
39
|
+
namespace SVF {
|
|
40
|
+
|
|
41
|
+
class BDDExprManager {
|
|
42
|
+
public:
|
|
43
|
+
typedef DdNode BDDExpr;
|
|
44
|
+
typedef Map<u32_t, BDDExpr *> IndexToBDDExpr;
|
|
45
|
+
private:
|
|
46
|
+
static BDDExprManager *bddExprMgr;
|
|
47
|
+
IndexToBDDExpr indexToBddCondMap;
|
|
48
|
+
DdManager *m_bdd_mgr;
|
|
49
|
+
|
|
50
|
+
inline BDDExpr *BddOne() const {
|
|
51
|
+
return Cudd_ReadOne(m_bdd_mgr);
|
|
52
|
+
}
|
|
53
|
+
|
|
54
|
+
inline BDDExpr *BddZero() const {
|
|
55
|
+
return Cudd_ReadLogicZero(m_bdd_mgr);
|
|
56
|
+
}
|
|
57
|
+
|
|
58
|
+
/// Constructor
|
|
59
|
+
BDDExprManager();
|
|
60
|
+
|
|
61
|
+
public:
|
|
62
|
+
typedef Map<const BDDExpr *, const Instruction *> CondToTermInstMap; // map a condition to its branch instruction
|
|
63
|
+
static u32_t totalCondNum; // a counter for fresh condition
|
|
64
|
+
/// Singleton design here to make sure we only have one instance during any analysis
|
|
65
|
+
//@{
|
|
66
|
+
static BDDExprManager *getBDDExprMgr();
|
|
67
|
+
|
|
68
|
+
static void releaseBDDExprMgr() {
|
|
69
|
+
delete bddExprMgr;
|
|
70
|
+
bddExprMgr = nullptr;
|
|
71
|
+
}
|
|
72
|
+
//@}
|
|
73
|
+
|
|
74
|
+
/// Destructor
|
|
75
|
+
virtual ~BDDExprManager();
|
|
76
|
+
|
|
77
|
+
BDDExpr *createCond(u32_t i) {
|
|
78
|
+
assert(indexToBddCondMap.find(i) == indexToBddCondMap.end() &&
|
|
79
|
+
"This should be fresh index to create new BDD");
|
|
80
|
+
BDDExpr *bddCond = Cudd_bddIthVar(m_bdd_mgr, i);
|
|
81
|
+
return indexToBddCondMap.emplace(i, bddCond).first->second;
|
|
82
|
+
}
|
|
83
|
+
|
|
84
|
+
/// Create a fresh condition to encode each program branch
|
|
85
|
+
virtual BDDExpr *createFreshBranchCond(const Instruction *inst);
|
|
86
|
+
|
|
87
|
+
/// Return the number of condition expressions
|
|
88
|
+
virtual inline u32_t getCondNumber() {
|
|
89
|
+
return Cudd_ReadNodeCount(m_bdd_mgr);
|
|
90
|
+
}
|
|
91
|
+
|
|
92
|
+
|
|
93
|
+
/// Return the unique true condition
|
|
94
|
+
inline BDDExpr *getTrueCond() const {
|
|
95
|
+
return trueCond;
|
|
96
|
+
}
|
|
97
|
+
|
|
98
|
+
/// Return the unique false condition
|
|
99
|
+
inline BDDExpr *getFalseCond() const {
|
|
100
|
+
return falseCond;
|
|
101
|
+
}
|
|
102
|
+
|
|
103
|
+
/// Operations on conditions.
|
|
104
|
+
//@{
|
|
105
|
+
virtual BDDExpr *AND(BDDExpr *lhs, BDDExpr *rhs);
|
|
106
|
+
|
|
107
|
+
virtual BDDExpr *OR(BDDExpr *lhs, BDDExpr *rhs);
|
|
108
|
+
|
|
109
|
+
virtual BDDExpr *NEG(BDDExpr *lhs);
|
|
110
|
+
//@}
|
|
111
|
+
|
|
112
|
+
virtual bool isNegCond(const BDDExpr *cond) {
|
|
113
|
+
return false;
|
|
114
|
+
}
|
|
115
|
+
|
|
116
|
+
/// Whether the condition is satisfiable
|
|
117
|
+
virtual bool isSatisfiable(const BDDExpr *cond) {
|
|
118
|
+
return cond != getFalseCond();
|
|
119
|
+
}
|
|
120
|
+
|
|
121
|
+
/// Whether lhs and rhs are equivalent branch conditions
|
|
122
|
+
virtual bool isEquivalentBranchCond(const BDDExpr *lhs, const BDDExpr *rhs){
|
|
123
|
+
return lhs == rhs;
|
|
124
|
+
}
|
|
125
|
+
|
|
126
|
+
/// Whether **All Paths** are reachable
|
|
127
|
+
bool isAllPathReachable(const BDDExpr *e);
|
|
128
|
+
|
|
129
|
+
/// Get condition using condition id (z3 ast id)
|
|
130
|
+
virtual BDDExpr *getCond(u32_t id) {
|
|
131
|
+
auto it = indexToBddCondMap.find(id);
|
|
132
|
+
assert(it != indexToBddCondMap.end() && "condition not found!");
|
|
133
|
+
return it->second;
|
|
134
|
+
}
|
|
135
|
+
|
|
136
|
+
/// Get/Set llvm conditional expression
|
|
137
|
+
//{@
|
|
138
|
+
inline const Instruction *getCondInst(const BDDExpr *cond) const {
|
|
139
|
+
CondToTermInstMap::const_iterator it = condToInstMap.find(cond);
|
|
140
|
+
assert(it != condToInstMap.end() && "this should be a fresh condition");
|
|
141
|
+
return it->second;
|
|
142
|
+
}
|
|
143
|
+
|
|
144
|
+
inline void setCondInst(const BDDExpr *cond, const Instruction *inst) {
|
|
145
|
+
assert(condToInstMap.find(cond) == condToInstMap.end() && "this should be a fresh condition");
|
|
146
|
+
condToInstMap[cond] = inst;
|
|
147
|
+
}
|
|
148
|
+
//@}
|
|
149
|
+
|
|
150
|
+
/**
|
|
151
|
+
* Utilities for dumping conditions. These methods use global functions from CUDD
|
|
152
|
+
* package and they can be removed outside this class scope to be used by others.
|
|
153
|
+
*/
|
|
154
|
+
void ddClearFlag(BDDExpr *f) const;
|
|
155
|
+
|
|
156
|
+
void BddSupportStep(BDDExpr *f, NodeBS &support) const;
|
|
157
|
+
|
|
158
|
+
void extractSubConds(const BDDExpr *f, NodeBS &support) const;
|
|
159
|
+
|
|
160
|
+
void dump(const BDDExpr *lhs, OutStream &O);
|
|
161
|
+
|
|
162
|
+
std::string dumpStr(const BDDExpr *e) const;
|
|
163
|
+
|
|
164
|
+
inline std::string getMemUsage() {
|
|
165
|
+
return std::to_string(Cudd_ReadMemoryInUse(m_bdd_mgr));
|
|
166
|
+
}
|
|
167
|
+
|
|
168
|
+
protected:
|
|
169
|
+
static BDDExpr *trueCond;
|
|
170
|
+
static BDDExpr *falseCond;
|
|
171
|
+
|
|
172
|
+
private:
|
|
173
|
+
|
|
174
|
+
CondToTermInstMap condToInstMap; ///< map condition to llvm instruction
|
|
175
|
+
|
|
176
|
+
};
|
|
177
|
+
|
|
178
|
+
|
|
179
|
+
|
|
180
|
+
} // End namespace SVF
|
|
181
|
+
|
|
182
|
+
#endif /* BITVECTORCOND_H_ */
|
|
@@ -0,0 +1,172 @@
|
|
|
1
|
+
//===- ExeState.h -- Execution State ----------------------------//
|
|
2
|
+
//
|
|
3
|
+
// SVF: Static Value-Flow Analysis
|
|
4
|
+
//
|
|
5
|
+
// Copyright (C) <2013-2017> <Yulei Sui>
|
|
6
|
+
//
|
|
7
|
+
|
|
8
|
+
// This program is free software: you can redistribute it and/or modify
|
|
9
|
+
// it under the terms of the GNU General Public License as published by
|
|
10
|
+
// the Free Software Foundation, either version 3 of the License, or
|
|
11
|
+
// (at your option) any later version.
|
|
12
|
+
|
|
13
|
+
// This program is distributed in the hope that it will be useful,
|
|
14
|
+
// but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
15
|
+
// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
16
|
+
// GNU General Public License for more details.
|
|
17
|
+
|
|
18
|
+
// You should have received a copy of the GNU General Public License
|
|
19
|
+
// along with this program. If not, see <http://www.gnu.org/licenses/>.
|
|
20
|
+
//
|
|
21
|
+
//===----------------------------------------------------------------------===//
|
|
22
|
+
/*
|
|
23
|
+
* ExeState.h
|
|
24
|
+
*
|
|
25
|
+
* Created on: April 29, 2022
|
|
26
|
+
* Author: Xiao
|
|
27
|
+
*/
|
|
28
|
+
|
|
29
|
+
#ifndef SVF_EXESTATE_H
|
|
30
|
+
#define SVF_EXESTATE_H
|
|
31
|
+
#include "Util/Z3Expr.h"
|
|
32
|
+
#include "MemoryModel/SVFVariables.h"
|
|
33
|
+
|
|
34
|
+
namespace SVF {
|
|
35
|
+
|
|
36
|
+
#define AddressMask 0x7f000000
|
|
37
|
+
#define FlippedAddressMask (AddressMask^0xffffffff)
|
|
38
|
+
|
|
39
|
+
class ExeState {
|
|
40
|
+
public:
|
|
41
|
+
typedef Map<u32_t, Z3Expr> VarToValMap;
|
|
42
|
+
typedef Map<u32_t, Z3Expr> LocToValMap;
|
|
43
|
+
|
|
44
|
+
protected:
|
|
45
|
+
VarToValMap varToVal;
|
|
46
|
+
LocToValMap locToVal;
|
|
47
|
+
Z3Expr pathConstraint;
|
|
48
|
+
|
|
49
|
+
public:
|
|
50
|
+
ExeState() : pathConstraint(getContext().bool_val(true)) {}
|
|
51
|
+
|
|
52
|
+
ExeState(const Z3Expr &_pc, VarToValMap &_varToValMap, LocToValMap &_locToValMap) : varToVal(_varToValMap),
|
|
53
|
+
locToVal(_locToValMap),
|
|
54
|
+
pathConstraint(_pc) {}
|
|
55
|
+
|
|
56
|
+
ExeState(const ExeState &rhs) : varToVal(rhs.getVarToVal()), locToVal(rhs.getLocToVal()),
|
|
57
|
+
pathConstraint(rhs.getPathConstraint()) {
|
|
58
|
+
|
|
59
|
+
}
|
|
60
|
+
|
|
61
|
+
virtual ~ExeState() = default;
|
|
62
|
+
|
|
63
|
+
ExeState &operator=(const ExeState &rhs);
|
|
64
|
+
|
|
65
|
+
/// Overloading Operator==
|
|
66
|
+
bool operator==(const ExeState &rhs) const;
|
|
67
|
+
|
|
68
|
+
/// Overloading Operator!=
|
|
69
|
+
inline bool operator!=(const ExeState &rhs) const {
|
|
70
|
+
return !(*this == rhs);
|
|
71
|
+
}
|
|
72
|
+
|
|
73
|
+
/// Overloading Operator==
|
|
74
|
+
bool operator<(const ExeState &rhs) const;
|
|
75
|
+
|
|
76
|
+
z3::context &getContext() {
|
|
77
|
+
return Z3Expr::getContext();
|
|
78
|
+
}
|
|
79
|
+
|
|
80
|
+
const VarToValMap &getVarToVal() const {
|
|
81
|
+
return varToVal;
|
|
82
|
+
}
|
|
83
|
+
|
|
84
|
+
const LocToValMap &getLocToVal() const {
|
|
85
|
+
return locToVal;
|
|
86
|
+
}
|
|
87
|
+
|
|
88
|
+
const Z3Expr &getPathConstraint() const {
|
|
89
|
+
return pathConstraint;
|
|
90
|
+
}
|
|
91
|
+
|
|
92
|
+
void setPathConstraint(const Z3Expr &pc) {
|
|
93
|
+
pathConstraint = pc.simplify();
|
|
94
|
+
}
|
|
95
|
+
|
|
96
|
+
inline Z3Expr &operator[](u32_t varId) {
|
|
97
|
+
return getZ3Expr(varId);
|
|
98
|
+
}
|
|
99
|
+
|
|
100
|
+
/// Init Z3Expr for ValVar
|
|
101
|
+
void initValVar(const ValVar *valVar, Z3Expr &e);
|
|
102
|
+
|
|
103
|
+
/// Init Z3Expr for ObjVar
|
|
104
|
+
void initObjVar(const ObjVar *objVar, Z3Expr &e);
|
|
105
|
+
|
|
106
|
+
/// Return Z3 expression based on SVFVar ID
|
|
107
|
+
Z3Expr &getZ3Expr(u32_t varId);
|
|
108
|
+
|
|
109
|
+
/// Store value to location
|
|
110
|
+
void store(const Z3Expr &loc, const Z3Expr &value);
|
|
111
|
+
|
|
112
|
+
/// Load value at location
|
|
113
|
+
Z3Expr &load(const Z3Expr &loc);
|
|
114
|
+
|
|
115
|
+
/// The physical address starts with 0x7f...... + idx
|
|
116
|
+
inline u32_t getVirtualMemAddress(u32_t idx) const {
|
|
117
|
+
return AddressMask + idx;
|
|
118
|
+
}
|
|
119
|
+
|
|
120
|
+
/// Check bit value of val start with 0x7F000000, filter by 0xFF000000
|
|
121
|
+
inline bool isVirtualMemAddress(u32_t val) {
|
|
122
|
+
return (val & 0xff000000) == AddressMask;
|
|
123
|
+
}
|
|
124
|
+
|
|
125
|
+
/// Return the internal index if idx is an address otherwise return the value of idx
|
|
126
|
+
inline u32_t getInternalID(u32_t idx) const {
|
|
127
|
+
return (idx & FlippedAddressMask);
|
|
128
|
+
}
|
|
129
|
+
|
|
130
|
+
/// Return int value from an expression if it is a numeral, otherwise return an approximate value
|
|
131
|
+
inline s32_t z3Expr2NumValue(const Z3Expr &e) {
|
|
132
|
+
assert(e.is_numeral() && "not numeral?");
|
|
133
|
+
return e.get_numeral_int64();
|
|
134
|
+
}
|
|
135
|
+
|
|
136
|
+
/// Print values of all expressions
|
|
137
|
+
void printExprValues();
|
|
138
|
+
|
|
139
|
+
protected:
|
|
140
|
+
inline void store(u32_t objId, const Z3Expr &z3Expr) {
|
|
141
|
+
locToVal[objId] = z3Expr.simplify();
|
|
142
|
+
}
|
|
143
|
+
|
|
144
|
+
inline Z3Expr &load(u32_t objId) {
|
|
145
|
+
return locToVal[objId];
|
|
146
|
+
}
|
|
147
|
+
};
|
|
148
|
+
}
|
|
149
|
+
|
|
150
|
+
template<>
|
|
151
|
+
struct std::hash<SVF::ExeState> {
|
|
152
|
+
size_t operator()(const SVF::ExeState &exeState) const {
|
|
153
|
+
|
|
154
|
+
size_t h = exeState.getVarToVal().size() * 2;
|
|
155
|
+
SVF::Hash<SVF::u32_t> hf;
|
|
156
|
+
for (const auto &t: exeState.getVarToVal()) {
|
|
157
|
+
h ^= hf(t.first) + 0x9e3779b9 + (h << 6) + (h >> 2);
|
|
158
|
+
h ^= hf(t.second.id()) + 0x9e3779b9 + (h << 6) + (h >> 2);
|
|
159
|
+
}
|
|
160
|
+
|
|
161
|
+
size_t h2 = exeState.getVarToVal().size() * 2;
|
|
162
|
+
|
|
163
|
+
for (const auto &t: exeState.getLocToVal()) {
|
|
164
|
+
h2 ^= hf(t.first) + 0x9e3779b9 + (h2 << 6) + (h2 >> 2);
|
|
165
|
+
h2 ^= hf(t.second.id()) + 0x9e3779b9 + (h2 << 6) + (h2 >> 2);
|
|
166
|
+
}
|
|
167
|
+
SVF::Hash<std::pair<SVF::u32_t, SVF::u32_t>> pairH;
|
|
168
|
+
|
|
169
|
+
return pairH(make_pair(pairH(make_pair(h, h2)), exeState.getPathConstraint().id()));
|
|
170
|
+
}
|
|
171
|
+
};
|
|
172
|
+
#endif //SVF_EXESTATE_H
|
|
@@ -10,7 +10,6 @@
|
|
|
10
10
|
#include "Util/NodeIDAllocator.h"
|
|
11
11
|
#include "MSSA/MemSSA.h"
|
|
12
12
|
#include "WPA/WPAPass.h"
|
|
13
|
-
#include "Util/Conditions.h"
|
|
14
13
|
|
|
15
14
|
namespace SVF
|
|
16
15
|
{
|
|
@@ -255,8 +254,6 @@ public:
|
|
|
255
254
|
// DOTGraphTraits
|
|
256
255
|
static const llvm::cl::opt<bool> ShowHiddenNode;
|
|
257
256
|
|
|
258
|
-
// Conditions
|
|
259
|
-
static const llvm::cl::opt<CondManager::CondMgrKind> ConditionType;
|
|
260
257
|
};
|
|
261
258
|
} // namespace SVF
|
|
262
259
|
|