svf-tools 1.0.976 → 1.0.978
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/package.json +1 -1
- package/svf/include/Graphs/ThreadCallGraph.h +0 -6
- package/svf/include/MTA/LockAnalysis.h +41 -31
- package/svf/include/MTA/MHP.h +34 -54
- package/svf/include/MTA/MTAStat.h +1 -2
- package/svf/include/MTA/TCT.h +36 -18
- package/svf/include/Util/CxtStmt.h +13 -12
- package/svf/include/Util/Options.h +1 -20
- package/svf/include/Util/SVFUtil.h +8 -43
- package/svf/include/Util/ThreadAPI.h +42 -85
- package/svf/lib/Graphs/ThreadCallGraph.cpp +1 -73
- package/svf/lib/MTA/LockAnalysis.cpp +83 -75
- package/svf/lib/MTA/MHP.cpp +142 -121
- package/svf/lib/MTA/MTA.cpp +2 -40
- package/svf/lib/MTA/MTAStat.cpp +7 -33
- package/svf/lib/MTA/TCT.cpp +30 -30
- package/svf/lib/Util/CallGraphBuilder.cpp +0 -15
- package/svf/lib/Util/Options.cpp +0 -62
- package/svf/lib/Util/ThreadAPI.cpp +27 -6
- package/svf-llvm/lib/SVFIRExtAPI.cpp +0 -26
- package/svf-llvm/tools/MTA/CMakeLists.txt +1 -1
- package/svf-llvm/tools/MTA/mta.cpp +0 -8
- package/svf/include/MTA/FSMPTA.h +0 -270
- package/svf/include/MTA/MTAResultValidator.h +0 -448
- package/svf/include/MTA/PCG.h +0 -229
- package/svf/lib/MTA/FSMPTA.cpp +0 -792
- package/svf/lib/MTA/PCG.cpp +0 -364
- package/svf-llvm/tools/MTA/LockResultValidator.cpp +0 -251
- package/svf-llvm/tools/MTA/LockResultValidator.h +0 -84
- package/svf-llvm/tools/MTA/MTAAnnotator.cpp +0 -293
- package/svf-llvm/tools/MTA/MTAAnnotator.h +0 -120
- package/svf-llvm/tools/MTA/MTAResultValidator.cpp +0 -716
- package/svf-llvm/tools/MTA/MTAResultValidator.h +0 -337
package/svf/include/MTA/FSMPTA.h
DELETED
|
@@ -1,270 +0,0 @@
|
|
|
1
|
-
//===- FSMPTA.h -- Flow-sensitive analysis of multithreaded programs-------------//
|
|
2
|
-
//
|
|
3
|
-
// SVF: Static Value-Flow Analysis
|
|
4
|
-
//
|
|
5
|
-
// Copyright (C) <2013-> <Yulei Sui>
|
|
6
|
-
//
|
|
7
|
-
|
|
8
|
-
// This program is free software: you can redistribute it and/or modify
|
|
9
|
-
// it under the terms of the GNU Affero General Public License as published by
|
|
10
|
-
// the Free Software Foundation, either version 3 of the License, or
|
|
11
|
-
// (at your option) any later version.
|
|
12
|
-
|
|
13
|
-
// This program is distributed in the hope that it will be useful,
|
|
14
|
-
// but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
15
|
-
// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
16
|
-
// GNU Affero General Public License for more details.
|
|
17
|
-
|
|
18
|
-
// You should have received a copy of the GNU Affero General Public License
|
|
19
|
-
// along with this program. If not, see <http://www.gnu.org/licenses/>.
|
|
20
|
-
//
|
|
21
|
-
//===----------------------------------------------------------------------===//
|
|
22
|
-
|
|
23
|
-
/*
|
|
24
|
-
* FSMPTA.h
|
|
25
|
-
*
|
|
26
|
-
* Created on: Jul 29, 2015
|
|
27
|
-
* Author: Yulei Sui, Peng Di
|
|
28
|
-
*
|
|
29
|
-
* The implementation is based on
|
|
30
|
-
* Yulei Sui, Peng Di, and Jingling Xue. "Sparse Flow-Sensitive Pointer Analysis for Multithreaded Programs".
|
|
31
|
-
* 2016 International Symposium on Code Generation and Optimization (CGO'16)
|
|
32
|
-
*/
|
|
33
|
-
|
|
34
|
-
#ifndef FSPTANALYSIS_H_
|
|
35
|
-
#define FSPTANALYSIS_H_
|
|
36
|
-
|
|
37
|
-
|
|
38
|
-
#include "WPA/FlowSensitive.h"
|
|
39
|
-
#include "MSSA/SVFGBuilder.h"
|
|
40
|
-
#include "MTA/LockAnalysis.h"
|
|
41
|
-
#include "MemoryModel/PointsTo.h"
|
|
42
|
-
#include "MTA/MHP.h"
|
|
43
|
-
|
|
44
|
-
namespace SVF
|
|
45
|
-
{
|
|
46
|
-
|
|
47
|
-
class MHP;
|
|
48
|
-
class LockAnalysis;
|
|
49
|
-
|
|
50
|
-
|
|
51
|
-
class SVFGNodeLockSpan
|
|
52
|
-
{
|
|
53
|
-
public:
|
|
54
|
-
SVFGNodeLockSpan(const StmtSVFGNode* SVFGnode, LockAnalysis::LockSpan lockspan) :
|
|
55
|
-
SVFGNode(SVFGnode), lockSpan(lockspan) {}
|
|
56
|
-
virtual ~SVFGNodeLockSpan() {}
|
|
57
|
-
|
|
58
|
-
inline bool operator< (const SVFGNodeLockSpan& rhs) const
|
|
59
|
-
{
|
|
60
|
-
if (SVFGNode != rhs.getSVFGNode())
|
|
61
|
-
return SVFGNode < rhs.getSVFGNode();
|
|
62
|
-
return lockSpan.size() < rhs.getLockSpan().size();
|
|
63
|
-
}
|
|
64
|
-
inline SVFGNodeLockSpan& operator= (const SVFGNodeLockSpan& rhs)
|
|
65
|
-
{
|
|
66
|
-
if(*this != rhs)
|
|
67
|
-
{
|
|
68
|
-
SVFGNode = rhs.getSVFGNode();
|
|
69
|
-
lockSpan = rhs.getLockSpan();
|
|
70
|
-
}
|
|
71
|
-
return *this;
|
|
72
|
-
}
|
|
73
|
-
inline bool operator== (const SVFGNodeLockSpan& rhs) const
|
|
74
|
-
{
|
|
75
|
-
return (SVFGNode == rhs.getSVFGNode() && lockSpan == rhs.getLockSpan());
|
|
76
|
-
}
|
|
77
|
-
inline bool operator!= (const SVFGNodeLockSpan& rhs) const
|
|
78
|
-
{
|
|
79
|
-
return !(*this == rhs);
|
|
80
|
-
}
|
|
81
|
-
inline const StmtSVFGNode* getSVFGNode() const
|
|
82
|
-
{
|
|
83
|
-
return SVFGNode;
|
|
84
|
-
}
|
|
85
|
-
inline const LockAnalysis::LockSpan getLockSpan() const
|
|
86
|
-
{
|
|
87
|
-
return lockSpan;
|
|
88
|
-
}
|
|
89
|
-
private:
|
|
90
|
-
const StmtSVFGNode* SVFGNode;
|
|
91
|
-
LockAnalysis::LockSpan lockSpan;
|
|
92
|
-
};
|
|
93
|
-
|
|
94
|
-
/*!
|
|
95
|
-
* SVFG builder for DDA
|
|
96
|
-
*/
|
|
97
|
-
class MTASVFGBuilder : public SVFGBuilder
|
|
98
|
-
{
|
|
99
|
-
|
|
100
|
-
public:
|
|
101
|
-
typedef PointerAnalysis::CallSiteSet CallSiteSet;
|
|
102
|
-
typedef PointerAnalysis::CallEdgeMap CallEdgeMap;
|
|
103
|
-
typedef PointerAnalysis::FunctionSet FunctionSet;
|
|
104
|
-
typedef Set<const SVFGNode*> SVFGNodeSet;
|
|
105
|
-
typedef std::vector<const SVFGNode*> SVFGNodeVec;
|
|
106
|
-
typedef NodeBS SVFGNodeIDSet;
|
|
107
|
-
typedef Set<const SVFInstruction*> InstSet;
|
|
108
|
-
typedef std::pair<NodeID,NodeID> NodeIDPair;
|
|
109
|
-
typedef Map<SVFGNodeLockSpan, bool> PairToBoolMap;
|
|
110
|
-
|
|
111
|
-
/// Constructor
|
|
112
|
-
MTASVFGBuilder(MHP* m, LockAnalysis* la) : SVFGBuilder(), mhp(m), lockana(la)
|
|
113
|
-
{
|
|
114
|
-
}
|
|
115
|
-
|
|
116
|
-
/// Destructor
|
|
117
|
-
virtual ~MTASVFGBuilder() {}
|
|
118
|
-
|
|
119
|
-
/// Number of newly added SVFG edges
|
|
120
|
-
static u32_t numOfNewSVFGEdges;
|
|
121
|
-
static u32_t numOfRemovedSVFGEdges;
|
|
122
|
-
static u32_t numOfRemovedPTS;
|
|
123
|
-
|
|
124
|
-
protected:
|
|
125
|
-
/// Re-write create SVFG method
|
|
126
|
-
virtual void buildSVFG();
|
|
127
|
-
|
|
128
|
-
private:
|
|
129
|
-
/// Record edges
|
|
130
|
-
bool recordEdge(NodeID id1, NodeID id2, PointsTo pts);
|
|
131
|
-
bool recordAddingEdge(NodeID id1, NodeID id2, PointsTo pts);
|
|
132
|
-
bool recordRemovingEdge(NodeID id1, NodeID id2, PointsTo pts);
|
|
133
|
-
/// perform adding/removing MHP Edges in value flow graph
|
|
134
|
-
void performAddingMHPEdges();
|
|
135
|
-
void performRemovingMHPEdges();
|
|
136
|
-
SVFGEdge* addTDEdges(NodeID srcId, NodeID dstId, PointsTo& pts);
|
|
137
|
-
/// Connect MHP indirect value-flow edges for two nodes that may-happen-in-parallel
|
|
138
|
-
void connectMHPEdges(PointerAnalysis* pta);
|
|
139
|
-
|
|
140
|
-
void handleStoreLoadNonSparse(const StmtSVFGNode* n1,const StmtSVFGNode* n2, PointerAnalysis* pta);
|
|
141
|
-
void handleStoreStoreNonSparse(const StmtSVFGNode* n1,const StmtSVFGNode* n2, PointerAnalysis* pta);
|
|
142
|
-
|
|
143
|
-
void handleStoreLoad(const StmtSVFGNode* n1,const StmtSVFGNode* n2, PointerAnalysis* pta);
|
|
144
|
-
void handleStoreStore(const StmtSVFGNode* n1,const StmtSVFGNode* n2, PointerAnalysis* pta);
|
|
145
|
-
|
|
146
|
-
void handleStoreLoadWithLockPrecisely(const StmtSVFGNode* n1,const StmtSVFGNode* n2, PointerAnalysis* pta);
|
|
147
|
-
void handleStoreStoreWithLockPrecisely(const StmtSVFGNode* n1,const StmtSVFGNode* n2, PointerAnalysis* pta);
|
|
148
|
-
|
|
149
|
-
void mergeSpan(NodeBS comlocks, InstSet& res);
|
|
150
|
-
void readPrecision();
|
|
151
|
-
|
|
152
|
-
SVFGNodeIDSet getPrevNodes(const StmtSVFGNode* n);
|
|
153
|
-
SVFGNodeIDSet getSuccNodes(const StmtSVFGNode* n);
|
|
154
|
-
SVFGNodeIDSet getSuccNodes(const StmtSVFGNode* n, NodeID o);
|
|
155
|
-
|
|
156
|
-
bool isHeadofSpan(const StmtSVFGNode* n, LockAnalysis::LockSpan lspan);
|
|
157
|
-
bool isTailofSpan(const StmtSVFGNode* n, LockAnalysis::LockSpan lspan);
|
|
158
|
-
bool isHeadofSpan(const StmtSVFGNode* n, InstSet mergespan);
|
|
159
|
-
bool isTailofSpan(const StmtSVFGNode* n, InstSet mergespan);
|
|
160
|
-
bool isHeadofSpan(const StmtSVFGNode* n);
|
|
161
|
-
bool isTailofSpan(const StmtSVFGNode* n);
|
|
162
|
-
/// Collect all loads/stores SVFGNodes
|
|
163
|
-
void collectLoadStoreSVFGNodes();
|
|
164
|
-
|
|
165
|
-
/// all stores/loads SVFGNodes
|
|
166
|
-
SVFGNodeSet stnodeSet;
|
|
167
|
-
SVFGNodeSet ldnodeSet;
|
|
168
|
-
|
|
169
|
-
/// MHP class
|
|
170
|
-
MHP* mhp;
|
|
171
|
-
LockAnalysis* lockana;
|
|
172
|
-
|
|
173
|
-
Set<NodeIDPair> recordedges;
|
|
174
|
-
Map<NodeIDPair, PointsTo> edge2pts;
|
|
175
|
-
|
|
176
|
-
|
|
177
|
-
Map<const StmtSVFGNode*, SVFGNodeIDSet> prevset;
|
|
178
|
-
Map<const StmtSVFGNode*, SVFGNodeIDSet> succset;
|
|
179
|
-
|
|
180
|
-
Map<const StmtSVFGNode*, bool> headmap;
|
|
181
|
-
Map<const StmtSVFGNode*, bool> tailmap;
|
|
182
|
-
|
|
183
|
-
PairToBoolMap pairheadmap;
|
|
184
|
-
PairToBoolMap pairtailmap;
|
|
185
|
-
|
|
186
|
-
|
|
187
|
-
static const u32_t ADDEDGE_NOEDGE= 0;
|
|
188
|
-
static const u32_t ADDEDGE_NONSPARSE= 1;
|
|
189
|
-
static const u32_t ADDEDGE_ALLOPT= 2;
|
|
190
|
-
static const u32_t ADDEDGE_NOMHP= 3;
|
|
191
|
-
static const u32_t ADDEDGE_NOALIAS= 4;
|
|
192
|
-
static const u32_t ADDEDGE_NOLOCK= 5;
|
|
193
|
-
static const u32_t ADDEDGE_NORP= 6;
|
|
194
|
-
// static const u32_t ADDEDGE_PRECISELOCK= 5;
|
|
195
|
-
|
|
196
|
-
};
|
|
197
|
-
|
|
198
|
-
|
|
199
|
-
/*!
|
|
200
|
-
* Flow-sensitive pointer analysis for multithreaded programs
|
|
201
|
-
*/
|
|
202
|
-
class FSMPTA : public FlowSensitive
|
|
203
|
-
{
|
|
204
|
-
|
|
205
|
-
|
|
206
|
-
public:
|
|
207
|
-
|
|
208
|
-
/// Constructor
|
|
209
|
-
FSMPTA(MHP* m, LockAnalysis* la) : FlowSensitive(m->getTCT()->getPTA()->getPAG()), mhp(m), lockana(la)
|
|
210
|
-
{
|
|
211
|
-
}
|
|
212
|
-
|
|
213
|
-
/// Destructor
|
|
214
|
-
~FSMPTA()
|
|
215
|
-
{
|
|
216
|
-
}
|
|
217
|
-
|
|
218
|
-
/// Initialize analysis
|
|
219
|
-
void initialize(SVFModule* module);
|
|
220
|
-
|
|
221
|
-
inline SVFIR* getPAG()
|
|
222
|
-
{
|
|
223
|
-
return mhp->getTCT()->getPTA()->getPAG();
|
|
224
|
-
}
|
|
225
|
-
|
|
226
|
-
/// Create single instance of flow-sensitive pointer analysis
|
|
227
|
-
static FSMPTA* createFSMPTA(SVFModule* module, MHP* m, LockAnalysis* la)
|
|
228
|
-
{
|
|
229
|
-
if (mfspta == nullptr)
|
|
230
|
-
{
|
|
231
|
-
mfspta = new FSMPTA(m,la);
|
|
232
|
-
mfspta->analyze();
|
|
233
|
-
}
|
|
234
|
-
return mfspta;
|
|
235
|
-
}
|
|
236
|
-
|
|
237
|
-
/// Release flow-sensitive pointer analysis
|
|
238
|
-
static void releaseFSMPTA()
|
|
239
|
-
{
|
|
240
|
-
if (mfspta)
|
|
241
|
-
delete mfspta;
|
|
242
|
-
mfspta = nullptr;
|
|
243
|
-
}
|
|
244
|
-
|
|
245
|
-
/// Get MHP
|
|
246
|
-
inline MHP* getMHP() const
|
|
247
|
-
{
|
|
248
|
-
return mhp;
|
|
249
|
-
}
|
|
250
|
-
|
|
251
|
-
private:
|
|
252
|
-
static FSMPTA* mfspta;
|
|
253
|
-
MHP* mhp;
|
|
254
|
-
LockAnalysis* lockana;
|
|
255
|
-
using FlowSensitive::initialize;
|
|
256
|
-
};
|
|
257
|
-
|
|
258
|
-
} // End namespace SVF
|
|
259
|
-
|
|
260
|
-
template <> struct std::hash<SVF::SVFGNodeLockSpan>
|
|
261
|
-
{
|
|
262
|
-
size_t operator()(const SVF::SVFGNodeLockSpan &cs) const
|
|
263
|
-
{
|
|
264
|
-
std::hash<SVF::StmtSVFGNode* >h;
|
|
265
|
-
SVF::StmtSVFGNode* node = const_cast<SVF::StmtSVFGNode* > (cs.getSVFGNode());
|
|
266
|
-
return h(node);
|
|
267
|
-
}
|
|
268
|
-
};
|
|
269
|
-
|
|
270
|
-
#endif /* FSPTANALYSIS_H_ */
|
|
@@ -1,448 +0,0 @@
|
|
|
1
|
-
/*
|
|
2
|
-
* MTAResultValidator.h
|
|
3
|
-
*
|
|
4
|
-
* Created on: 29/06/2015
|
|
5
|
-
* Author: Peng Di and Ding Ye
|
|
6
|
-
*/
|
|
7
|
-
|
|
8
|
-
#ifndef MTARESULTVALIDATOR_H_
|
|
9
|
-
#define MTARESULTVALIDATOR_H_
|
|
10
|
-
|
|
11
|
-
#include "MTA/MHP.h"
|
|
12
|
-
|
|
13
|
-
/*!
|
|
14
|
-
* Validate the result of context-sensitive analysis, including context-sensitive
|
|
15
|
-
* thread detection and thread interleaving.
|
|
16
|
-
*/
|
|
17
|
-
namespace SVF
|
|
18
|
-
{
|
|
19
|
-
typedef unsigned NodeID;
|
|
20
|
-
|
|
21
|
-
class MTAResultValidator
|
|
22
|
-
{
|
|
23
|
-
|
|
24
|
-
public:
|
|
25
|
-
typedef int INTERLEV_FLAG;
|
|
26
|
-
MTAResultValidator(MHP* mh) :
|
|
27
|
-
mhp(mh)
|
|
28
|
-
{
|
|
29
|
-
tcg = mhp->getThreadCallGraph();
|
|
30
|
-
tdAPI = tcg->getThreadAPI();
|
|
31
|
-
mod = mhp->getTCT()->getSVFModule();
|
|
32
|
-
}
|
|
33
|
-
// Destructor
|
|
34
|
-
~MTAResultValidator()
|
|
35
|
-
{
|
|
36
|
-
}
|
|
37
|
-
|
|
38
|
-
// Analysis
|
|
39
|
-
void analyze();
|
|
40
|
-
inline SVFModule* getModule() const
|
|
41
|
-
{
|
|
42
|
-
return mod;
|
|
43
|
-
}
|
|
44
|
-
protected:
|
|
45
|
-
|
|
46
|
-
/*
|
|
47
|
-
* Assistant functions
|
|
48
|
-
*/
|
|
49
|
-
|
|
50
|
-
// Split string
|
|
51
|
-
std::vector<std::string> &split(const std::string &s, char delim, std::vector<std::string> &elems);
|
|
52
|
-
std::vector<std::string> split(const std::string &s, char delim);
|
|
53
|
-
|
|
54
|
-
// Get special arguments of given call sites
|
|
55
|
-
NodeID getIntArg(const Instruction* inst, unsigned int arg_num);
|
|
56
|
-
std::vector<std::string> getStringArg(const Instruction* inst, unsigned int arg_num);
|
|
57
|
-
CallStrCxt getCxtArg(const Instruction* inst, unsigned int arg_num);
|
|
58
|
-
|
|
59
|
-
/*
|
|
60
|
-
* Get the previous LoadInst or StoreInst from Instruction "I" in the
|
|
61
|
-
* same BasicBlock. Return nullptr if none exists.
|
|
62
|
-
*/
|
|
63
|
-
const Instruction* getPreviousMemoryAccessInst(const Instruction* I);
|
|
64
|
-
|
|
65
|
-
// Compare two cxts
|
|
66
|
-
bool matchCxt(const CallStrCxt cxt1, const CallStrCxt cxt2) const;
|
|
67
|
-
|
|
68
|
-
// Dump calling context information
|
|
69
|
-
void dumpCxt(const CallStrCxt& cxt) const;
|
|
70
|
-
|
|
71
|
-
void dumpInterlev(NodeBS& lev);
|
|
72
|
-
|
|
73
|
-
// Get the validation result string of a single validation scenario.
|
|
74
|
-
inline std::string getOutput(const char *scenario, bool analysisRes);
|
|
75
|
-
inline std::string getOutputforInterlevAnalysis(const char *scenario, INTERLEV_FLAG analysisRes);
|
|
76
|
-
|
|
77
|
-
/*
|
|
78
|
-
* Collect the callsite targets for validations.
|
|
79
|
-
* The targets are labeled by "cs1:", "cs2:"... that are the names of its basic blocks.
|
|
80
|
-
* The collected targets are stored in csnumToInstMap that maps label "cs1" to its Callsite.
|
|
81
|
-
*/
|
|
82
|
-
bool collectCallsiteTargets();
|
|
83
|
-
|
|
84
|
-
/*
|
|
85
|
-
* Collect the CxtThread targets for validations.
|
|
86
|
-
* The collected targets are stored in vthdToCxt that maps vthd to cxt.
|
|
87
|
-
*/
|
|
88
|
-
bool collectCxtThreadTargets();
|
|
89
|
-
|
|
90
|
-
/*
|
|
91
|
-
* Collect TCT targets for validations.
|
|
92
|
-
* The collected targets are stored in rthdToChildren.
|
|
93
|
-
*/
|
|
94
|
-
bool collectTCTTargets();
|
|
95
|
-
|
|
96
|
-
/*
|
|
97
|
-
* Collect the thread interleaving targets for validations.
|
|
98
|
-
* The collected targets are stored in instToTSMap and threadStmtToInterLeaving.
|
|
99
|
-
*/
|
|
100
|
-
bool collectInterleavingTargets();
|
|
101
|
-
|
|
102
|
-
/*
|
|
103
|
-
* Perform validation for Cxtthread.
|
|
104
|
-
* If correct, the validator maps given thread vthd to static CxtThread rthd stored in vthdTorthd.
|
|
105
|
-
*/
|
|
106
|
-
bool validateCxtThread();
|
|
107
|
-
|
|
108
|
-
/*
|
|
109
|
-
* Perform validation for TCT.
|
|
110
|
-
*/
|
|
111
|
-
bool validateTCT();
|
|
112
|
-
|
|
113
|
-
/*
|
|
114
|
-
* Perform validation for thread interleaving.
|
|
115
|
-
*/
|
|
116
|
-
INTERLEV_FLAG validateInterleaving();
|
|
117
|
-
|
|
118
|
-
private:
|
|
119
|
-
|
|
120
|
-
typedef Map<NodeID, const SVFInstruction*> csnumToInst;
|
|
121
|
-
typedef Map<NodeID, CallStrCxt> vthdToCxtMap;
|
|
122
|
-
typedef Map<NodeID, NodeID> vthdTorthdMap;
|
|
123
|
-
typedef Map<NodeID, NodeID> rthdTovthdMap;
|
|
124
|
-
|
|
125
|
-
typedef Map<NodeID, Set<NodeID>> rthdToChildrenMap;
|
|
126
|
-
|
|
127
|
-
MHP::InstToThreadStmtSetMap instToTSMap; // Map a instruction to CxtThreadStmtSet
|
|
128
|
-
MHP::ThreadStmtToThreadInterleav threadStmtToInterLeaving; /// Map a statement to its thread interleavings
|
|
129
|
-
|
|
130
|
-
static constexpr char const *CXT_THREAD = "CXT_THREAD";
|
|
131
|
-
static constexpr char const *INTERLEV_ACCESS = "INTERLEV_ACCESS";
|
|
132
|
-
static constexpr char const *TCT_ACCESS = "TCT_ACCESS";
|
|
133
|
-
|
|
134
|
-
ThreadAPI* tdAPI;
|
|
135
|
-
ThreadCallGraph* tcg;
|
|
136
|
-
MHP* mhp;
|
|
137
|
-
vthdToCxtMap vthdToCxt;
|
|
138
|
-
vthdTorthdMap vthdTorthd;
|
|
139
|
-
rthdTovthdMap rthdTovthd;
|
|
140
|
-
csnumToInst csnumToInstMap;
|
|
141
|
-
rthdToChildrenMap rthdToChildren;
|
|
142
|
-
SVFModule* mod;
|
|
143
|
-
/// Constant INTERLEV_FLAG values
|
|
144
|
-
//@{
|
|
145
|
-
static const INTERLEV_FLAG INTERLEV_TRUE = 0x01;
|
|
146
|
-
static const INTERLEV_FLAG INTERLEV_IMPRECISE = 0x02;
|
|
147
|
-
static const INTERLEV_FLAG INTERLEV_UNSOUND = 0x04;
|
|
148
|
-
//@}
|
|
149
|
-
};
|
|
150
|
-
|
|
151
|
-
|
|
152
|
-
|
|
153
|
-
/*!
|
|
154
|
-
* \brief Validate the result of concurrent analysis.
|
|
155
|
-
*
|
|
156
|
-
* The properties to validate of two memory accesses include
|
|
157
|
-
* one or more of the following four:
|
|
158
|
-
* (1) they may accesses aliases;
|
|
159
|
-
* (2) they may happen in parallel;
|
|
160
|
-
* (3) they are protected by common lock(s);
|
|
161
|
-
* (4) they may cause a data race error.
|
|
162
|
-
* The ground truth are specified by the "RC_ACCESS" function in the target program.
|
|
163
|
-
*
|
|
164
|
-
* Users may utilize this result validator to validate their analysis with
|
|
165
|
-
* one or more of the four properties, by inheriting the RCResultValidator class.
|
|
166
|
-
* The corresponding virtual function of the desired property should be overridden.
|
|
167
|
-
*/
|
|
168
|
-
class RaceResultValidator
|
|
169
|
-
{
|
|
170
|
-
public:
|
|
171
|
-
typedef int RC_FLAG;
|
|
172
|
-
|
|
173
|
-
/*!
|
|
174
|
-
* Data structure for recording access pairs for the validation.
|
|
175
|
-
*/
|
|
176
|
-
class AccessPair
|
|
177
|
-
{
|
|
178
|
-
public:
|
|
179
|
-
/// Constructor
|
|
180
|
-
AccessPair(const Instruction* I1, const Instruction* I2,
|
|
181
|
-
const RC_FLAG flags) :
|
|
182
|
-
I1(I1), I2(I2), flags(flags)
|
|
183
|
-
{
|
|
184
|
-
}
|
|
185
|
-
|
|
186
|
-
/// Class member access
|
|
187
|
-
//@{
|
|
188
|
-
inline bool isFlaged(const RC_FLAG flag) const
|
|
189
|
-
{
|
|
190
|
-
return flags & flag;
|
|
191
|
-
}
|
|
192
|
-
inline const Instruction* getInstruction1() const
|
|
193
|
-
{
|
|
194
|
-
return I1;
|
|
195
|
-
}
|
|
196
|
-
inline const Instruction* getInstruction2() const
|
|
197
|
-
{
|
|
198
|
-
return I2;
|
|
199
|
-
}
|
|
200
|
-
//@}
|
|
201
|
-
|
|
202
|
-
private:
|
|
203
|
-
const Instruction* I1;
|
|
204
|
-
const Instruction* I2;
|
|
205
|
-
RC_FLAG flags;
|
|
206
|
-
};
|
|
207
|
-
|
|
208
|
-
/// Destructor
|
|
209
|
-
virtual ~RaceResultValidator()
|
|
210
|
-
{
|
|
211
|
-
release();
|
|
212
|
-
}
|
|
213
|
-
|
|
214
|
-
/// Initialization
|
|
215
|
-
void init(SVFModule* M)
|
|
216
|
-
{
|
|
217
|
-
this->M = M;
|
|
218
|
-
selectedValidationScenarios = RC_MHP | RC_ALIASES | RC_PROTECTED | RC_RACE;
|
|
219
|
-
collectValidationTargets();
|
|
220
|
-
}
|
|
221
|
-
|
|
222
|
-
/// Analysis
|
|
223
|
-
void analyze()
|
|
224
|
-
{
|
|
225
|
-
validateAll();
|
|
226
|
-
}
|
|
227
|
-
|
|
228
|
-
/// Release resource
|
|
229
|
-
void release()
|
|
230
|
-
{
|
|
231
|
-
}
|
|
232
|
-
|
|
233
|
-
/// Check if the input program has validation target
|
|
234
|
-
inline bool hasValidationTarget() const
|
|
235
|
-
{
|
|
236
|
-
return !accessPairs.empty();
|
|
237
|
-
}
|
|
238
|
-
|
|
239
|
-
protected:
|
|
240
|
-
/// Interface to the specific validation properties.
|
|
241
|
-
/// Override one or more to implement your own analysis.
|
|
242
|
-
//@{
|
|
243
|
-
virtual bool mayAccessAliases(const Instruction* I1,
|
|
244
|
-
const Instruction* I2)
|
|
245
|
-
{
|
|
246
|
-
selectedValidationScenarios &= ~RC_ALIASES;
|
|
247
|
-
return true;
|
|
248
|
-
}
|
|
249
|
-
virtual bool mayHappenInParallel(const Instruction* I1,
|
|
250
|
-
const Instruction* I2)
|
|
251
|
-
{
|
|
252
|
-
selectedValidationScenarios &= ~RC_MHP;
|
|
253
|
-
return true;
|
|
254
|
-
}
|
|
255
|
-
virtual bool protectedByCommonLocks(const Instruction* I1,
|
|
256
|
-
const Instruction* I2)
|
|
257
|
-
{
|
|
258
|
-
selectedValidationScenarios &= ~RC_PROTECTED;
|
|
259
|
-
return true;
|
|
260
|
-
}
|
|
261
|
-
virtual bool mayHaveDataRace(const Instruction* I1,
|
|
262
|
-
const Instruction* I2)
|
|
263
|
-
{
|
|
264
|
-
selectedValidationScenarios &= ~RC_RACE;
|
|
265
|
-
return true;
|
|
266
|
-
}
|
|
267
|
-
//@}
|
|
268
|
-
|
|
269
|
-
/*!
|
|
270
|
-
* Collect the targets for validations.
|
|
271
|
-
* The targets should be memory access Instructions in pairs.
|
|
272
|
-
* The collected targets are stored in the member variable "accessPairs".
|
|
273
|
-
*/
|
|
274
|
-
void collectValidationTargets()
|
|
275
|
-
{
|
|
276
|
-
// Collect call sites of all RC_ACCESS function calls.
|
|
277
|
-
std::vector<const CallBase*> csInsts;
|
|
278
|
-
const Function* F = nullptr;
|
|
279
|
-
for (Module &M : LLVMModuleSet::getLLVMModuleSet()->getLLVMModules())
|
|
280
|
-
{
|
|
281
|
-
for(auto it = M.begin(); it != M.end(); it++)
|
|
282
|
-
{
|
|
283
|
-
const std::string fName = (*it).getName().str();
|
|
284
|
-
if(fName.find(RC_ACCESS) != std::string::npos)
|
|
285
|
-
{
|
|
286
|
-
F = &(*it);
|
|
287
|
-
break;
|
|
288
|
-
}
|
|
289
|
-
}
|
|
290
|
-
}
|
|
291
|
-
if (!F) return;
|
|
292
|
-
|
|
293
|
-
for (Value::const_use_iterator it = F->use_begin(), ie =
|
|
294
|
-
F->use_end(); it != ie; ++it)
|
|
295
|
-
{
|
|
296
|
-
const Use *u = &*it;
|
|
297
|
-
const Value *user = u->getUser();
|
|
298
|
-
if(LLVMUtil::isCallSite(user))
|
|
299
|
-
{
|
|
300
|
-
const CallBase* csInst = LLVMUtil::getLLVMCallSite(user);
|
|
301
|
-
csInsts.push_back(csInst);
|
|
302
|
-
}
|
|
303
|
-
}
|
|
304
|
-
assert(csInsts.size() % 2 == 0 && "We should have RC_ACCESS called in pairs.");
|
|
305
|
-
|
|
306
|
-
// Sort the validation sites according to their ids.
|
|
307
|
-
std::sort(csInsts.begin(), csInsts.end(), compare);
|
|
308
|
-
|
|
309
|
-
// Generate access pairs.
|
|
310
|
-
for (int i = 0, e = csInsts.size(); i != e;)
|
|
311
|
-
{
|
|
312
|
-
const CallBase* CI1 = csInsts[i++];
|
|
313
|
-
const CallBase* CI2 = csInsts[i++];
|
|
314
|
-
const ConstantInt* C = SVFUtil::dyn_cast<ConstantInt>(CI1->getArgOperand(1));
|
|
315
|
-
assert(C);
|
|
316
|
-
const Instruction* I1 = getPreviousMemoryAccessInst(CI1);
|
|
317
|
-
const Instruction* I2 = getPreviousMemoryAccessInst(CI2);
|
|
318
|
-
assert(I1 && I2 && "RC_ACCESS should be placed immediately after the target memory access.");
|
|
319
|
-
RC_FLAG flags = C->getZExtValue();
|
|
320
|
-
accessPairs.push_back(AccessPair(I1, I2, flags));
|
|
321
|
-
}
|
|
322
|
-
}
|
|
323
|
-
|
|
324
|
-
/// Perform validation for all targets.
|
|
325
|
-
void validateAll()
|
|
326
|
-
{
|
|
327
|
-
SVFUtil::outs() << SVFUtil::pasMsg(" --- Analysis Result Validation ---\n");
|
|
328
|
-
|
|
329
|
-
// Iterate every memory access pair to perform the validation.
|
|
330
|
-
for (int i = 0, e = accessPairs.size(); i != e; ++i)
|
|
331
|
-
{
|
|
332
|
-
const AccessPair &ap = accessPairs[i];
|
|
333
|
-
const Instruction* I1 = ap.getInstruction1();
|
|
334
|
-
const Instruction* I2 = ap.getInstruction2();
|
|
335
|
-
|
|
336
|
-
bool mhp = mayHappenInParallel(I1, I2);
|
|
337
|
-
bool alias = mayAccessAliases(I1, I2);
|
|
338
|
-
bool protect = protectedByCommonLocks(I1, I2);
|
|
339
|
-
bool racy = mayHaveDataRace(I1, I2);
|
|
340
|
-
|
|
341
|
-
SVFUtil::outs() << "For the memory access pair at ("
|
|
342
|
-
<< LLVMModuleSet::getLLVMModuleSet()->getSVFValue(I1)->getSourceLoc() << ", "
|
|
343
|
-
<< LLVMModuleSet::getLLVMModuleSet()->getSVFValue(I2)->getSourceLoc() << ")\n";
|
|
344
|
-
if (selectedValidationScenarios & RC_ALIASES)
|
|
345
|
-
{
|
|
346
|
-
SVFUtil::outs() << "\t"
|
|
347
|
-
<< getOutput("ALIASES", alias, ap.isFlaged(RC_ALIASES))
|
|
348
|
-
<< "\n";
|
|
349
|
-
}
|
|
350
|
-
if (selectedValidationScenarios & RC_MHP)
|
|
351
|
-
{
|
|
352
|
-
SVFUtil::outs() << "\t"
|
|
353
|
-
<< getOutput("MHP", mhp, ap.isFlaged(RC_MHP)) << "\n";
|
|
354
|
-
}
|
|
355
|
-
if (selectedValidationScenarios & RC_PROTECTED)
|
|
356
|
-
{
|
|
357
|
-
SVFUtil::outs() << "\t"
|
|
358
|
-
<< getOutput("PROTECT", protect,
|
|
359
|
-
ap.isFlaged(RC_PROTECTED)) << "\n";
|
|
360
|
-
}
|
|
361
|
-
if (selectedValidationScenarios & RC_RACE)
|
|
362
|
-
{
|
|
363
|
-
SVFUtil::outs() << "\t"
|
|
364
|
-
<< getOutput("RACE", racy, ap.isFlaged(RC_RACE))
|
|
365
|
-
<< "\n";
|
|
366
|
-
}
|
|
367
|
-
}
|
|
368
|
-
|
|
369
|
-
SVFUtil::outs() << "\n";
|
|
370
|
-
}
|
|
371
|
-
|
|
372
|
-
/// Get the validation result string of a single validation scenario.
|
|
373
|
-
inline std::string getOutput(const char *scenario,
|
|
374
|
-
bool analysisRes, bool expectedRes)
|
|
375
|
-
{
|
|
376
|
-
std::string ret(scenario);
|
|
377
|
-
ret += "\t";
|
|
378
|
-
if (expectedRes)
|
|
379
|
-
ret += " T: ";
|
|
380
|
-
else
|
|
381
|
-
ret += " F: ";
|
|
382
|
-
if (analysisRes == expectedRes)
|
|
383
|
-
ret += SVFUtil::sucMsg("SUCCESS");
|
|
384
|
-
else
|
|
385
|
-
ret += SVFUtil::errMsg("FAILURE");
|
|
386
|
-
return ret;
|
|
387
|
-
}
|
|
388
|
-
|
|
389
|
-
private:
|
|
390
|
-
SVFModule* M;
|
|
391
|
-
std::vector<AccessPair> accessPairs;
|
|
392
|
-
RC_FLAG selectedValidationScenarios;
|
|
393
|
-
|
|
394
|
-
/*!
|
|
395
|
-
* Comparison function to sort the validation targets in ascending order of
|
|
396
|
-
* the validation id (i.e., the 1st argument of RC_ACCESS function call).
|
|
397
|
-
*/
|
|
398
|
-
static bool compare(const CallBase* CI1, const CallBase* CI2)
|
|
399
|
-
{
|
|
400
|
-
const Value *V1 = CI1->getArgOperand(0);
|
|
401
|
-
const Value *V2 = CI2->getArgOperand(0);
|
|
402
|
-
const ConstantInt* C1 = SVFUtil::dyn_cast<ConstantInt>(V1);
|
|
403
|
-
const ConstantInt* C2 = SVFUtil::dyn_cast<ConstantInt>(V2);
|
|
404
|
-
assert(0 != C1 && 0 != C2);
|
|
405
|
-
return C1->getZExtValue() < C2->getZExtValue();
|
|
406
|
-
}
|
|
407
|
-
|
|
408
|
-
/*!
|
|
409
|
-
* Get the previous LoadInst or StoreInst from Instruction "I" in the
|
|
410
|
-
* same BasicBlock.
|
|
411
|
-
* Return nullptr if none exists.
|
|
412
|
-
*/
|
|
413
|
-
const Instruction* getPreviousMemoryAccessInst(
|
|
414
|
-
const Instruction* I)
|
|
415
|
-
{
|
|
416
|
-
I = I->getPrevNode();
|
|
417
|
-
while (I)
|
|
418
|
-
{
|
|
419
|
-
if (SVFUtil::isa<LoadInst, StoreInst>(I))
|
|
420
|
-
return I;
|
|
421
|
-
|
|
422
|
-
const SVFInstruction* inst = LLVMModuleSet::getLLVMModuleSet()->getSVFInstruction(I);
|
|
423
|
-
|
|
424
|
-
if (const SVFFunction *callee = SVFUtil::getCallee(inst))
|
|
425
|
-
{
|
|
426
|
-
if (callee->getName().find("llvm.memset") != std::string::npos)
|
|
427
|
-
return I;
|
|
428
|
-
|
|
429
|
-
}
|
|
430
|
-
I = I->getPrevNode();
|
|
431
|
-
}
|
|
432
|
-
return nullptr;
|
|
433
|
-
}
|
|
434
|
-
|
|
435
|
-
/// Constant RC_FLAG values
|
|
436
|
-
//@{
|
|
437
|
-
static const RC_FLAG RC_MHP = 0x01;
|
|
438
|
-
static const RC_FLAG RC_ALIASES = 0x02;
|
|
439
|
-
static const RC_FLAG RC_PROTECTED = 0x04;
|
|
440
|
-
static const RC_FLAG RC_RACE = 0x10;
|
|
441
|
-
//@}
|
|
442
|
-
|
|
443
|
-
/// The name of the function which is used to specify the ground truth
|
|
444
|
-
/// of the validation properties in the target program.
|
|
445
|
-
static constexpr char const *RC_ACCESS = "RC_ACCESS";
|
|
446
|
-
};
|
|
447
|
-
} // namespace SVF end
|
|
448
|
-
#endif /* MTARESULTVALIDATOR_H_ */
|