13958948275

Committed 19 Mar 2025 11:53PM UTC coverage: 88.194% (-0.5%) from 88.66%

Build # 13958948275

Build Type

push

github

Committed by

web-flow

Commit Message

Finite domain (#849)

* Move arithmetic and bit operations functions to finite_domain.cpp
* Remove operator-= (now havoc) and operator+= (now add_constraint)
* Abort early when registers are not usable; clear type variable instead of explicitly assigning T_UNINIT. Update YAML tests accordingly
---------
Signed-off-by: Elazar Gershuni <elazarg@gmail.com>

Run Details

847 of 898 new or added lines in 11 files covered. (94.32%)

57 existing lines in 8 files now uncovered.

8628 of 9783 relevant lines covered (88.19%)

9034663.84 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

53.77

/src/asm_ostream.cpp

// Copyright (c) Prevail Verifier contributors.
// SPDX-License-Identifier: MIT
#include <fstream>
#include <iomanip>
#include <iostream>
#include <variant>
#include <vector>

#include "asm_syntax.hpp"
#include "crab/cfg.hpp"
#include "crab/fwd_analyzer.hpp"
#include "crab/interval.hpp"
#include "crab/type_encoding.hpp"
#include "crab/variable.hpp"
#include "crab_utils/num_big.hpp"
#include "crab_verifier.hpp"
#include "helpers.hpp"
#include "platform.hpp"
#include "spec_type_descriptors.hpp"

using crab::TypeGroup;
using std::optional;
using std::string;
using std::vector;

namespace crab {

std::ostream& operator<<(std::ostream& o, const interval_t& interval) {
    if (interval.is_bottom()) {
        o << "_|_";
    } else {
        o << "[" << interval._lb << ", " << interval._ub << "]";
    }
    return o;
}
std::ostream& operator<<(std::ostream& o, const number_t& z) { return o << z._n.str(); }

std::string number_t::to_string() const { return _n.str(); }

std::string interval_t::to_string() const {
    std::ostringstream s;
    s << *this;
    return s.str();
}

std::ostream& operator<<(std::ostream& os, const label_t& label) {
    if (label == label_t::entry) {
        return os << "entry";
    }
    if (label == label_t::exit) {
        return os << "exit";
    }
    if (!label.stack_frame_prefix.empty()) {
        os << label.stack_frame_prefix << STACK_FRAME_DELIMITER;
    }
    os << label.from;
    if (label.to != -1) {
        os << ":" << label.to;
    }
    if (!label.special_label.empty()) {
        os << " (" << label.special_label << ")";
    }
    return os;
}

string to_string(label_t const& label) {
    std::stringstream str;
    str << label;
    return str.str();
}

} // namespace crab

struct LineInfoPrinter {
    std::ostream& os;
    std::string previous_source_line;

    void print_line_info(const label_t& label) {
        if (thread_local_options.verbosity_opts.print_line_info) {
            const auto& line_info_map = thread_local_program_info.get().line_info;
            const auto& line_info = line_info_map.find(label.from);
            // Print line info only once.
            if (line_info != line_info_map.end() && line_info->second.source_line != previous_source_line) {
                os << "\n" << line_info->second << "\n";
                previous_source_line = line_info->second.source_line;
            }
        }
    }
};

void print_jump(std::ostream& o, const std::string& direction, const std::set<label_t>& labels) {
    auto [it, et] = std::pair{labels.begin(), labels.end()};
    if (it != et) {
        o << "  " << direction << " ";
        while (it != et) {
            o << *it;
            ++it;
            if (it == et) {
                o << ";";
            } else {
                o << ",";
            }
        }
    }
    o << "\n";
}

void print_program(const Program& prog, std::ostream& os, const bool simplify, const printfunc& prefunc,
                   const printfunc& postfunc) {
    LineInfoPrinter printer{os};
    for (const crab::basic_block_t& bb : crab::basic_block_t::collect_basic_blocks(prog.cfg(), simplify)) {
        prefunc(os, bb.first_label());
        print_jump(os, "from", prog.cfg().parents_of(bb.first_label()));
        os << bb.first_label() << ":\n";
        for (const label_t& label : bb) {
            printer.print_line_info(label);
            for (const auto& pre : prog.assertions_at(label)) {
                os << "  " << "assert " << pre << ";\n";
            }
            os << "  " << prog.instruction_at(label) << ";\n";
        }
        print_jump(os, "goto", prog.cfg().children_of(bb.last_label()));
        postfunc(os, bb.last_label());
    }
    os << "\n";
}

static void nop(std::ostream&, const label_t&) {}

void print_program(const Program& prog, std::ostream& os, const bool simplify) {
    print_program(prog, os, simplify, nop, nop);
}

void print_dot(const Program& prog, std::ostream& out) {
    out << "digraph program {\n";
    out << "    node [shape = rectangle];\n";
    for (const auto& label : prog.labels()) {
        out << "    \"" << label << "\"[xlabel=\"" << label << "\",label=\"";

        for (const auto& pre : prog.assertions_at(label)) {
            out << "assert " << pre << "\\l";
        }
        out << prog.instruction_at(label) << "\\l";

        out << "\"];\n";
        for (const label_t& next : prog.cfg().children_of(label)) {
            out << "    \"" << label << "\" -> \"" << next << "\";\n";
        }
        out << "\n";
    }
    out << "}\n";
}

void print_dot(const Program& prog, const std::string& outfile) {
    std::ofstream out{outfile};
    if (out.fail()) {
        throw std::runtime_error(std::string("Could not open file ") + outfile);
    }
    print_dot(prog, out);
}

void print_reachability(std::ostream& os, const Report& report) {
    for (const auto& [label, notes] : report.reachability) {
        for (const auto& msg : notes) {
            os << label << ": " << msg << "\n";
        }
    }
    os << "\n";
}

void print_warnings(std::ostream& os, const Report& report) {
    LineInfoPrinter printer{os};
    for (const auto& [label, warnings] : report.warnings) {
        for (const auto& msg : warnings) {
            printer.print_line_info(label);
            os << label << ": " << msg << "\n";
        }
    }
    os << "\n";
}

void print_all_messages(std::ostream& os, const Report& report) {
    print_reachability(os, report);
    print_warnings(os, report);
}

void print_invariants(std::ostream& os, const Program& prog, const bool simplify, const Invariants& invariants) {
    print_program(
        prog, os, simplify,
        [&](std::ostream& os, const label_t& label) -> void {
            os << "\nPre-invariant : " << invariants.invariants.at(label).pre << "\n";
        },
        [&](std::ostream& os, const label_t& label) -> void {
            os << "\nPost-invariant : " << invariants.invariants.at(label).post << "\n";
        });
}

namespace asm_syntax {
std::ostream& operator<<(std::ostream& os, const ArgSingle::Kind kind) {
    switch (kind) {
    case ArgSingle::Kind::ANYTHING: return os << "uint64_t";
    case ArgSingle::Kind::PTR_TO_CTX: return os << "ctx";
    case ArgSingle::Kind::MAP_FD: return os << "map_fd";
    case ArgSingle::Kind::MAP_FD_PROGRAMS: return os << "map_fd_programs";
    case ArgSingle::Kind::PTR_TO_MAP_KEY: return os << "map_key";
    case ArgSingle::Kind::PTR_TO_MAP_VALUE: return os << "map_value";
    }
    assert(false);
    return os;
}

std::ostream& operator<<(std::ostream& os, const ArgPair::Kind kind) {
    switch (kind) {
    case ArgPair::Kind::PTR_TO_READABLE_MEM: return os << "mem";
    case ArgPair::Kind::PTR_TO_READABLE_MEM_OR_NULL: return os << "mem?";
    case ArgPair::Kind::PTR_TO_WRITABLE_MEM: return os << "out";
    }
    assert(false);
    return os;
}

std::ostream& operator<<(std::ostream& os, const ArgSingle arg) {
    os << arg.kind << " " << arg.reg;
    return os;
}

std::ostream& operator<<(std::ostream& os, const ArgPair arg) {
    os << arg.kind << " " << arg.mem << "[" << arg.size;
    if (arg.can_be_zero) {
        os << "?";
    }
    os << "], uint64_t " << arg.size;
    return os;
}

std::ostream& operator<<(std::ostream& os, const Bin::Op op) {
    using Op = Bin::Op;
    switch (op) {
    case Op::MOV: return os;
    case Op::MOVSX8: return os << "s8";
    case Op::MOVSX16: return os << "s16";
    case Op::MOVSX32: return os << "s32";
    case Op::ADD: return os << "+";
    case Op::SUB: return os << "-";
    case Op::MUL: return os << "*";
    case Op::UDIV: return os << "/";
    case Op::SDIV: return os << "s/";
    case Op::UMOD: return os << "%";
    case Op::SMOD: return os << "s%";
    case Op::OR: return os << "|";
    case Op::AND: return os << "&";
    case Op::LSH: return os << "<<";
    case Op::RSH: return os << ">>";
    case Op::ARSH: return os << ">>>";
    case Op::XOR: return os << "^";
    }
    assert(false);
    return os;
}

std::ostream& operator<<(std::ostream& os, const Condition::Op op) {
    using Op = Condition::Op;
    switch (op) {
    case Op::EQ: return os << "==";
    case Op::NE: return os << "!=";
    case Op::SET: return os << "&==";
    case Op::NSET: return os << "&!="; // not in ebpf
    case Op::LT: return os << "<";     // TODO: os << "u<";
    case Op::LE: return os << "<=";    // TODO: os << "u<=";
    case Op::GT: return os << ">";     // TODO: os << "u>";
    case Op::GE: return os << ">=";    // TODO: os << "u>=";
    case Op::SLT: return os << "s<";
    case Op::SLE: return os << "s<=";
    case Op::SGT: return os << "s>";
    case Op::SGE: return os << "s>=";
    }
    assert(false);
    return os;
}

static string size(const int w) { return string("u") + std::to_string(w * 8); }

// ReSharper disable CppMemberFunctionMayBeConst
struct AssertionPrinterVisitor {
    std::ostream& _os;

    void operator()(ValidStore const& a) {
        _os << a.mem << ".type != stack -> " << TypeConstraint{a.val, TypeGroup::number};
    }

    void operator()(ValidAccess const& a) {
        if (a.or_null) {
            _os << "(" << TypeConstraint{a.reg, TypeGroup::number} << " and " << a.reg << ".value == 0) or ";
        }
        _os << "valid_access(" << a.reg << ".offset";
        if (a.offset > 0) {
            _os << "+" << a.offset;
        } else if (a.offset < 0) {
            _os << a.offset;
        }

        if (a.width == Value{Imm{0}}) {
            // a.width == 0, meaning we only care it's an in-bound pointer,
            // so it can be compared with another pointer to the same region.
            _os << ") for comparison/subtraction";
        } else {
            _os << ", width=" << a.width << ") for ";
            if (a.access_type == AccessType::read) {
                _os << "read";
            } else {
                _os << "write";
            }
        }
    }

    void operator()(const BoundedLoopCount& a) {
        _os << crab::variable_t::loop_counter(to_string(a.name)) << " < " << a.limit;
    }

    static crab::variable_t typereg(const Reg& r) { return crab::variable_t::reg(crab::data_kind_t::types, r.v); }

    void operator()(ValidSize const& a) {
        const auto op = a.can_be_zero ? " >= " : " > ";
        _os << a.reg << ".value" << op << 0;
    }

    void operator()(ValidCall const& a) {
        const EbpfHelperPrototype proto = thread_local_program_info->platform->get_helper_prototype(a.func);
        _os << "valid call(" << proto.name << ")";
    }

    void operator()(ValidMapKeyValue const& a) {
        _os << "within stack(" << a.access_reg << ":" << (a.key ? "key_size" : "value_size") << "(" << a.map_fd_reg
            << "))";
    }

    void operator()(ZeroCtxOffset const& a) {
        _os << crab::variable_t::reg(crab::data_kind_t::ctx_offsets, a.reg.v) << " == 0";
    }

    void operator()(Comparable const& a) {
        if (a.or_r2_is_number) {
            _os << TypeConstraint{a.r2, TypeGroup::number} << " or ";
        }
        _os << typereg(a.r1) << " == " << typereg(a.r2) << " in " << TypeGroup::singleton_ptr;
    }

    void operator()(Addable const& a) {
        _os << TypeConstraint{a.ptr, TypeGroup::pointer} << " -> " << TypeConstraint{a.num, TypeGroup::number};
    }

    void operator()(ValidDivisor const& a) { _os << a.reg << " != 0"; }

    void operator()(TypeConstraint const& tc) {
        const string cmp_op = is_singleton_type(tc.types) ? "==" : "in";
        _os << typereg(tc.reg) << " " << cmp_op << " " << tc.types;
    }

    void operator()(FuncConstraint const& fc) { _os << typereg(fc.reg) << " is helper"; }
};

// ReSharper disable CppMemberFunctionMayBeConst
struct CommandPrinterVisitor {
    std::ostream& os_;

    void visit(const auto& item) { std::visit(*this, item); }

    void operator()(Undefined const& a) { os_ << "Undefined{" << a.opcode << "}"; }

    void operator()(LoadMapFd const& b) { os_ << b.dst << " = map_fd " << b.mapfd; }

    void operator()(LoadMapAddress const& b) { os_ << b.dst << " = map_val(" << b.mapfd << ") + " << b.offset; }

    // llvm-objdump uses "w<number>" for 32-bit operations and "r<number>" for 64-bit operations.
    // We use the same convention here for consistency.
    static std::string reg_name(Reg const& a, const bool is64) { return ((is64) ? "r" : "w") + std::to_string(a.v); }

    void operator()(Bin const& b) {
        os_ << reg_name(b.dst, b.is64) << " " << b.op << "= " << b.v;
        if (b.lddw) {
            os_ << " ll";
        }
    }

    void operator()(Un const& b) {
        os_ << b.dst << " = ";
        switch (b.op) {
        case Un::Op::BE16: os_ << "be16 "; break;
        case Un::Op::BE32: os_ << "be32 "; break;
        case Un::Op::BE64: os_ << "be64 "; break;
        case Un::Op::LE16: os_ << "le16 "; break;
        case Un::Op::LE32: os_ << "le32 "; break;
        case Un::Op::LE64: os_ << "le64 "; break;
        case Un::Op::SWAP16: os_ << "swap16 "; break;
        case Un::Op::SWAP32: os_ << "swap32 "; break;
        case Un::Op::SWAP64: os_ << "swap64 "; break;
        case Un::Op::NEG: os_ << "-"; break;
        }
        os_ << b.dst;
    }

    void operator()(Call const& call) {
        os_ << "r0 = " << call.name << ":" << call.func << "(";
        for (uint8_t r = 1; r <= 5; r++) {
            // Look for a singleton.
            auto single = std::ranges::find_if(call.singles, [r](const ArgSingle arg) { return arg.reg.v == r; });
            if (single != call.singles.end()) {
                if (r > 1) {
                    os_ << ", ";
                }
                os_ << *single;
                continue;
            }

            // Look for the start of a pair.
            auto pair = std::ranges::find_if(call.pairs, [r](const ArgPair arg) { return arg.mem.v == r; });
            if (pair != call.pairs.end()) {
                if (r > 1) {
                    os_ << ", ";
                }
                os_ << *pair;
                r++;
                continue;
            }

            // Not found.
            break;
        }
        os_ << ")";
    }

    void operator()(CallLocal const& call) { os_ << "call <" << to_string(call.target) << ">"; }

    void operator()(Callx const& callx) { os_ << "callx " << callx.func; }

    void operator()(Exit const& b) { os_ << "exit"; }

    void operator()(Jmp const& b) {
        // A "standalone" jump Instruction.
        // Print the label without offset calculations.
        if (b.cond) {
            os_ << "if ";
            print(*b.cond);
            os_ << " ";
        }
        os_ << "goto label <" << to_string(b.target) << ">";
    }

    void operator()(Jmp const& b, const int offset) {
        const string sign = offset > 0 ? "+" : "";
        const string target = sign + std::to_string(offset) + " <" + to_string(b.target) + ">";

        if (b.cond) {
            os_ << "if ";
            print(*b.cond);
            os_ << " ";
        }
        os_ << "goto " << target;
    }

    void operator()(Packet const& b) {
        /* Direct packet access, R0 = *(uint *) (skb->data + imm32) */
        /* Indirect packet access, R0 = *(uint *) (skb->data + src_reg + imm32) */
        const string s = size(b.width);
        os_ << "r0 = ";
        os_ << "*(" << s << " *)skb[";
        if (b.regoffset) {
            os_ << *b.regoffset;
        }
        if (b.offset != 0) {
            if (b.regoffset) {
                os_ << " + ";
            }
            os_ << b.offset;
        }
        os_ << "]";
    }

    void print(Deref const& access) {
        const string sign = access.offset < 0 ? " - " : " + ";
        int offset = std::abs(access.offset); // what about INT_MIN?
        os_ << "*(" << size(access.width) << " *)";
        os_ << "(" << access.basereg << sign << offset << ")";
    }

    void print(Condition const& cond) {
        os_ << cond.left << " " << ((!cond.is64) ? "w" : "") << cond.op << " " << cond.right;
    }

    void operator()(Mem const& b) {
        if (b.is_load) {
            os_ << b.value << " = ";
        }
        print(b.access);
        if (!b.is_load) {
            os_ << " = " << b.value;
        }
    }

    void operator()(Atomic const& b) {
        os_ << "lock ";
        print(b.access);
        os_ << " ";
        bool showfetch = true;
        switch (b.op) {
        case Atomic::Op::ADD: os_ << "+"; break;
        case Atomic::Op::OR: os_ << "|"; break;
        case Atomic::Op::AND: os_ << "&"; break;
        case Atomic::Op::XOR: os_ << "^"; break;
        case Atomic::Op::XCHG:
            os_ << "x";
            showfetch = false;
            break;
        case Atomic::Op::CMPXCHG:
            os_ << "cx";
            showfetch = false;
            break;
        }
        os_ << "= " << b.valreg;

        if (showfetch && b.fetch) {
            os_ << " fetch";
        }
    }

    void operator()(Assume const& b) {
        os_ << "assume ";
        print(b.cond);
    }

    void operator()(IncrementLoopCounter const& a) { os_ << crab::variable_t::loop_counter(to_string(a.name)) << "++"; }
};
// ReSharper restore CppMemberFunctionMayBeConst

std::ostream& operator<<(std::ostream& os, Instruction const& ins) {
    std::visit(CommandPrinterVisitor{os}, ins);
    return os;
}

string to_string(Instruction const& ins) {
    std::stringstream str;
    str << ins;
    return str.str();
}

std::ostream& operator<<(std::ostream& os, const Assertion& a) {
    std::visit(AssertionPrinterVisitor{os}, a);
    return os;
}

string to_string(Assertion const& constraint) {
    std::stringstream str;
    str << constraint;
    return str.str();
}

auto get_labels(const InstructionSeq& insts) {
    pc_t pc = 0;
    std::map<label_t, pc_t> pc_of_label;
    for (const auto& [label, inst, _] : insts) {
        pc_of_label[label] = pc;
        pc += size(inst);
    }
    return pc_of_label;
}

void print(const InstructionSeq& insts, std::ostream& out, const std::optional<const label_t>& label_to_print,
           const bool print_line_info) {
    const auto pc_of_label = get_labels(insts);
    pc_t pc = 0;
    std::string previous_source;
    CommandPrinterVisitor visitor{out};
    for (const LabeledInstruction& labeled_inst : insts) {
        const auto& [label, ins, line_info] = labeled_inst;
        if (!label_to_print.has_value() || label == label_to_print) {
            if (line_info.has_value() && print_line_info) {
                auto& [file, source, line, column] = line_info.value();
                // Only decorate the first instruction associated with a source line.
                if (source != previous_source) {
                    out << line_info.value();
                    previous_source = source;
                }
            }
            if (label.isjump()) {
                out << "\n";
                out << label << ":\n";
            }
            if (label_to_print.has_value()) {
                out << pc << ": ";
            } else {
                out << std::setw(8) << pc << ":\t";
            }
            if (const auto jmp = std::get_if<Jmp>(&ins)) {
                if (!pc_of_label.contains(jmp->target)) {
                    throw std::runtime_error(string("Cannot find label ") + crab::to_string(jmp->target));
                }
                const pc_t target_pc = pc_of_label.at(jmp->target);
                visitor(*jmp, target_pc - static_cast<int>(pc) - 1);
            } else {
                std::visit(visitor, ins);
            }
            out << "\n";
        }
        pc += size(ins);
    }
}

} // namespace asm_syntax

std::ostream& operator<<(std::ostream& o, const EbpfMapDescriptor& desc) {
    return o << "(" << "original_fd = " << desc.original_fd << ", " << "inner_map_fd = " << desc.inner_map_fd << ", "
             << "type = " << desc.type << ", " << "max_entries = " << desc.max_entries << ", "
             << "value_size = " << desc.value_size << ", " << "key_size = " << desc.key_size << ")";
}

void print_map_descriptors(const std::vector<EbpfMapDescriptor>& descriptors, std::ostream& o) {
    int i = 0;
    for (const auto& desc : descriptors) {
        o << "map " << i << ":" << desc << "\n";
        i++;
    }
}

std::ostream& operator<<(std::ostream& os, const btf_line_info_t& line_info) {
    os << "; " << line_info.file_name << ":" << line_info.line_number << "\n";
    os << "; " << line_info.source_line << "\n";
    return os;
}

1	// Copyright (c) Prevail Verifier contributors.
2	// SPDX-License-Identifier: MIT
3	#include <fstream>
4	#include <iomanip>
5	#include <iostream>
6	#include <variant>
7	#include <vector>
8
9	#include "asm_syntax.hpp"
10	#include "crab/cfg.hpp"
11	#include "crab/fwd_analyzer.hpp"
12	#include "crab/interval.hpp"
13	#include "crab/type_encoding.hpp"
14	#include "crab/variable.hpp"
15	#include "crab_utils/num_big.hpp"
16	#include "crab_verifier.hpp"
17	#include "helpers.hpp"
18	#include "platform.hpp"
19	#include "spec_type_descriptors.hpp"
20
21	using crab::TypeGroup;
22	using std::optional;
23	using std::string;
24	using std::vector;
25
26	namespace crab {
27
28	std::ostream& operator<<(std::ostream& o, const interval_t& interval) {	820✔
29	if (interval.is_bottom()) {	820✔
30	o << "_\|_";	×
31	} else {
32	o << "[" << interval._lb << ", " << interval._ub << "]";	820✔
33	}
34	return o;	820✔
35	}
36	std::ostream& operator<<(std::ostream& o, const number_t& z) { return o << z._n.str(); }	350,288✔
37
NEW 38	std::string number_t::to_string() const { return _n.str(); }	×
39
40	std::string interval_t::to_string() const {	×
41	std::ostringstream s;	×
42	s << *this;	×
43	return s.str();	×
44	}	×
45
46	std::ostream& operator<<(std::ostream& os, const label_t& label) {	1,592✔
47	if (label == label_t::entry) {	1,592✔
48	return os << "entry";	6✔
49	}
50	if (label == label_t::exit) {	1,586✔
51	return os << "exit";	6✔
52	}
53	if (!label.stack_frame_prefix.empty()) {	1,580✔
54	os << label.stack_frame_prefix << STACK_FRAME_DELIMITER;	330✔
55	}
56	os << label.from;	1,580✔
57	if (label.to != -1) {	1,580✔
58	os << ":" << label.to;	50✔
59	}
60	if (!label.special_label.empty()) {	1,580✔
61	os << " (" << label.special_label << ")";	20✔
62	}
63	return os;	790✔
64	}
65
66	string to_string(label_t const& label) {	1,546✔
67	std::stringstream str;	1,546✔
68	str << label;	1,546✔
69	return str.str();	3,092✔
70	}	1,546✔
71
72	} // namespace crab
73
74	struct LineInfoPrinter {
75	std::ostream& os;
76	std::string previous_source_line;
77
78	void print_line_info(const label_t& label) {	×
79	if (thread_local_options.verbosity_opts.print_line_info) {	×
80	const auto& line_info_map = thread_local_program_info.get().line_info;	×
81	const auto& line_info = line_info_map.find(label.from);	×
82	// Print line info only once.
83	if (line_info != line_info_map.end() && line_info->second.source_line != previous_source_line) {	×
84	os << "\n" << line_info->second << "\n";	×
85	previous_source_line = line_info->second.source_line;	×
86	}
87	}
88	}	×
89	};
90
91	void print_jump(std::ostream& o, const std::string& direction, const std::set<label_t>& labels) {	×
92	auto [it, et] = std::pair{labels.begin(), labels.end()};	×
93	if (it != et) {	×
94	o << " " << direction << " ";	×
95	while (it != et) {	×
96	o << *it;	×
97	++it;	×
98	if (it == et) {	×
99	o << ";";	×
100	} else {
101	o << ",";	×
102	}
103	}
104	}
105	o << "\n";	×
106	}	×
107
108	void print_program(const Program& prog, std::ostream& os, const bool simplify, const printfunc& prefunc,	×
109	const printfunc& postfunc) {
110	LineInfoPrinter printer{os};	×
111	for (const crab::basic_block_t& bb : crab::basic_block_t::collect_basic_blocks(prog.cfg(), simplify)) {	×
112	prefunc(os, bb.first_label());	×
113	print_jump(os, "from", prog.cfg().parents_of(bb.first_label()));	×
114	os << bb.first_label() << ":\n";	×
115	for (const label_t& label : bb) {	×
116	printer.print_line_info(label);	×
117	for (const auto& pre : prog.assertions_at(label)) {	×
118	os << " " << "assert " << pre << ";\n";	×
119	}	×
120	os << " " << prog.instruction_at(label) << ";\n";	×
121	}
122	print_jump(os, "goto", prog.cfg().children_of(bb.last_label()));	×
123	postfunc(os, bb.last_label());	×
124	}	×
125	os << "\n";	×
126	}	×
127
128	static void nop(std::ostream&, const label_t&) {}	×
129
130	void print_program(const Program& prog, std::ostream& os, const bool simplify) {	×
131	print_program(prog, os, simplify, nop, nop);	×
132	}	×
133
134	void print_dot(const Program& prog, std::ostream& out) {	×
135	out << "digraph program {\n";	×
136	out << " node [shape = rectangle];\n";	×
137	for (const auto& label : prog.labels()) {	×
138	out << " \"" << label << "\"[xlabel=\"" << label << "\",label=\"";	×
139
140	for (const auto& pre : prog.assertions_at(label)) {	×
141	out << "assert " << pre << "\\l";	×
142	}	×
143	out << prog.instruction_at(label) << "\\l";	×
144
145	out << "\"];\n";	×
146	for (const label_t& next : prog.cfg().children_of(label)) {	×
147	out << " \"" << label << "\" -> \"" << next << "\";\n";	×
148	}
149	out << "\n";	×
150	}
151	out << "}\n";	×
152	}	×
153
154	void print_dot(const Program& prog, const std::string& outfile) {	×
155	std::ofstream out{outfile};	×
156	if (out.fail()) {	×
157	throw std::runtime_error(std::string("Could not open file ") + outfile);	×
158	}
159	print_dot(prog, out);	×
160	}	×
161
162	void print_reachability(std::ostream& os, const Report& report) {	×
163	for (const auto& [label, notes] : report.reachability) {	×
164	for (const auto& msg : notes) {	×
165	os << label << ": " << msg << "\n";	×
166	}
167	}
168	os << "\n";	×
169	}	×
170
171	void print_warnings(std::ostream& os, const Report& report) {	×
172	LineInfoPrinter printer{os};	×
173	for (const auto& [label, warnings] : report.warnings) {	×
174	for (const auto& msg : warnings) {	×
175	printer.print_line_info(label);	×
176	os << label << ": " << msg << "\n";	×
177	}
178	}
179	os << "\n";	×
180	}	×
181
182	void print_all_messages(std::ostream& os, const Report& report) {	×
183	print_reachability(os, report);	×
184	print_warnings(os, report);	×
185	}	×
186
187	void print_invariants(std::ostream& os, const Program& prog, const bool simplify, const Invariants& invariants) {	×
188	print_program(	×
189	prog, os, simplify,
190	[&](std::ostream& os, const label_t& label) -> void {	×
191	os << "\nPre-invariant : " << invariants.invariants.at(label).pre << "\n";	×
192	},	×
193	[&](std::ostream& os, const label_t& label) -> void {	×
194	os << "\nPost-invariant : " << invariants.invariants.at(label).post << "\n";	×
195	});	×
196	}	×
197
198	namespace asm_syntax {
199	std::ostream& operator<<(std::ostream& os, const ArgSingle::Kind kind) {	74✔
200	switch (kind) {	74✔
201	case ArgSingle::Kind::ANYTHING: return os << "uint64_t";	14✔
202	case ArgSingle::Kind::PTR_TO_CTX: return os << "ctx";	4✔
203	case ArgSingle::Kind::MAP_FD: return os << "map_fd";	24✔
204	case ArgSingle::Kind::MAP_FD_PROGRAMS: return os << "map_fd_programs";	×
205	case ArgSingle::Kind::PTR_TO_MAP_KEY: return os << "map_key";	24✔
206	case ArgSingle::Kind::PTR_TO_MAP_VALUE: return os << "map_value";	8✔
207	}
208	assert(false);
209	return os;
210	}
211
212	std::ostream& operator<<(std::ostream& os, const ArgPair::Kind kind) {	×
213	switch (kind) {	×
214	case ArgPair::Kind::PTR_TO_READABLE_MEM: return os << "mem";	×
215	case ArgPair::Kind::PTR_TO_READABLE_MEM_OR_NULL: return os << "mem?";	×
216	case ArgPair::Kind::PTR_TO_WRITABLE_MEM: return os << "out";	×
217	}
218	assert(false);
219	return os;
220	}
221
222	std::ostream& operator<<(std::ostream& os, const ArgSingle arg) {	74✔
223	os << arg.kind << " " << arg.reg;	74✔
224	return os;	74✔
225	}
226
227	std::ostream& operator<<(std::ostream& os, const ArgPair arg) {	×
228	os << arg.kind << " " << arg.mem << "[" << arg.size;	×
229	if (arg.can_be_zero) {	×
230	os << "?";	×
231	}
232	os << "], uint64_t " << arg.size;	×
233	return os;	×
234	}
235
236	std::ostream& operator<<(std::ostream& os, const Bin::Op op) {	278✔
237	using Op = Bin::Op;	139✔
238	switch (op) {	278✔
239	case Op::MOV: return os;	81✔
240	case Op::MOVSX8: return os << "s8";	×
241	case Op::MOVSX16: return os << "s16";	×
242	case Op::MOVSX32: return os << "s32";	×
243	case Op::ADD: return os << "+";	70✔
244	case Op::SUB: return os << "-";	×
245	case Op::MUL: return os << "*";	×
246	case Op::UDIV: return os << "/";	×
247	case Op::SDIV: return os << "s/";	×
248	case Op::UMOD: return os << "%";	×
249	case Op::SMOD: return os << "s%";	×
250	case Op::OR: return os << "\|";	×
251	case Op::AND: return os << "&";	30✔
252	case Op::LSH: return os << "<<";	12✔
253	case Op::RSH: return os << ">>";	×
254	case Op::ARSH: return os << ">>>";	2✔
255	case Op::XOR: return os << "^";	2✔
256	}
257	assert(false);
258	return os;
259	}
260
261	std::ostream& operator<<(std::ostream& os, const Condition::Op op) {	232✔
262	using Op = Condition::Op;	116✔
263	switch (op) {	232✔
264	case Op::EQ: return os << "==";	38✔
265	case Op::NE: return os << "!=";	12✔
266	case Op::SET: return os << "&==";	×
267	case Op::NSET: return os << "&!="; // not in ebpf	×
268	case Op::LT: return os << "<"; // TODO: os << "u<";	132✔
269	case Op::LE: return os << "<="; // TODO: os << "u<=";	12✔
270	case Op::GT: return os << ">"; // TODO: os << "u>";	22✔
271	case Op::GE: return os << ">="; // TODO: os << "u>=";	6✔
272	case Op::SLT: return os << "s<";	4✔
273	case Op::SLE: return os << "s<=";	×
274	case Op::SGT: return os << "s>";	4✔
275	case Op::SGE: return os << "s>=";	2✔
276	}
277	assert(false);
278	return os;
279	}
280
281	static string size(const int w) { return string("u") + std::to_string(w * 8); }	460✔
282
283	// ReSharper disable CppMemberFunctionMayBeConst
284	struct AssertionPrinterVisitor {
285	std::ostream& _os;
286
287	void operator()(ValidStore const& a) {	2✔
288	_os << a.mem << ".type != stack -> " << TypeConstraint{a.val, TypeGroup::number};	2✔
289	}	2✔
290
291	void operator()(ValidAccess const& a) {	48,786✔
292	if (a.or_null) {	48,786✔
293	_os << "(" << TypeConstraint{a.reg, TypeGroup::number} << " and " << a.reg << ".value == 0) or ";	3,360✔
294	}
295	_os << "valid_access(" << a.reg << ".offset";	48,786✔
296	if (a.offset > 0) {	48,786✔
297	_os << "+" << a.offset;	30,956✔
298	} else if (a.offset < 0) {	17,830✔
299	_os << a.offset;	100✔
300	}
301
302	if (a.width == Value{Imm{0}}) {	48,786✔
303	// a.width == 0, meaning we only care it's an in-bound pointer,
304	// so it can be compared with another pointer to the same region.
305	_os << ") for comparison/subtraction";	4,184✔
306	} else {
307	_os << ", width=" << a.width << ") for ";	44,602✔
308	if (a.access_type == AccessType::read) {	44,602✔
309	_os << "read";	33,048✔
310	} else {
311	_os << "write";	11,554✔
312	}
313	}
314	}	48,786✔
315
316	void operator()(const BoundedLoopCount& a) {	32✔
317	_os << crab::variable_t::loop_counter(to_string(a.name)) << " < " << a.limit;	32✔
318	}	32✔
319
320	static crab::variable_t typereg(const Reg& r) { return crab::variable_t::reg(crab::data_kind_t::types, r.v); }	6,554✔
321
322	void operator()(ValidSize const& a) {	4,206✔
323	const auto op = a.can_be_zero ? " >= " : " > ";	4,206✔
324	_os << a.reg << ".value" << op << 0;	4,206✔
325	}	4,206✔
326
327	void operator()(ValidCall const& a) {	2✔
328	const EbpfHelperPrototype proto = thread_local_program_info->platform->get_helper_prototype(a.func);	2✔
329	_os << "valid call(" << proto.name << ")";	2✔
330	}	2✔
331
332	void operator()(ValidMapKeyValue const& a) {	142✔
333	_os << "within stack(" << a.access_reg << ":" << (a.key ? "key_size" : "value_size") << "(" << a.map_fd_reg	178✔
334	<< "))";	142✔
335	}	142✔
336
337	void operator()(ZeroCtxOffset const& a) {	5,236✔
338	_os << crab::variable_t::reg(crab::data_kind_t::ctx_offsets, a.reg.v) << " == 0";	5,236✔
339	}	5,236✔
340
341	void operator()(Comparable const& a) {	2,196✔
342	if (a.or_r2_is_number) {	2,196✔
343	_os << TypeConstraint{a.r2, TypeGroup::number} << " or ";	354✔
344	}
345	_os << typereg(a.r1) << " == " << typereg(a.r2) << " in " << TypeGroup::singleton_ptr;	2,196✔
346	}	2,196✔
347
348	void operator()(Addable const& a) {	4✔
349	_os << TypeConstraint{a.ptr, TypeGroup::pointer} << " -> " << TypeConstraint{a.num, TypeGroup::number};	8✔
350	}	4✔
351
352	void operator()(ValidDivisor const& a) { _os << a.reg << " != 0"; }	76✔
353
354	void operator()(TypeConstraint const& tc) {	2,156✔
355	const string cmp_op = is_singleton_type(tc.types) ? "==" : "in";	2,182✔
356	_os << typereg(tc.reg) << " " << cmp_op << " " << tc.types;	2,156✔
357	}	2,156✔
358
359	void operator()(FuncConstraint const& fc) { _os << typereg(fc.reg) << " is helper"; }	6✔
360	};
361
362	// ReSharper disable CppMemberFunctionMayBeConst
363	struct CommandPrinterVisitor {
364	std::ostream& os_;
365
366	void visit(const auto& item) { std::visit(*this, item); }
367
368	void operator()(Undefined const& a) { os_ << "Undefined{" << a.opcode << "}"; }	×
369
370	void operator()(LoadMapFd const& b) { os_ << b.dst << " = map_fd " << b.mapfd; }	24✔
371
372	void operator()(LoadMapAddress const& b) { os_ << b.dst << " = map_val(" << b.mapfd << ") + " << b.offset; }	×
373
374	// llvm-objdump uses "w<number>" for 32-bit operations and "r<number>" for 64-bit operations.
375	// We use the same convention here for consistency.
376	static std::string reg_name(Reg const& a, const bool is64) { return ((is64) ? "r" : "w") + std::to_string(a.v); }	417✔
377
378	void operator()(Bin const& b) {	278✔
379	os_ << reg_name(b.dst, b.is64) << " " << b.op << "= " << b.v;	417✔
380	if (b.lddw) {	278✔
381	os_ << " ll";	2✔
382	}
383	}	278✔
384
385	void operator()(Un const& b) {	12✔
386	os_ << b.dst << " = ";	12✔
387	switch (b.op) {	12✔
388	case Un::Op::BE16: os_ << "be16 "; break;	2✔
389	case Un::Op::BE32: os_ << "be32 "; break;	2✔
390	case Un::Op::BE64: os_ << "be64 "; break;	2✔
391	case Un::Op::LE16: os_ << "le16 "; break;	2✔
392	case Un::Op::LE32: os_ << "le32 "; break;	2✔
393	case Un::Op::LE64: os_ << "le64 "; break;	2✔
394	case Un::Op::SWAP16: os_ << "swap16 "; break;	×
395	case Un::Op::SWAP32: os_ << "swap32 "; break;	×
396	case Un::Op::SWAP64: os_ << "swap64 "; break;	×
397	case Un::Op::NEG: os_ << "-"; break;	×
398	}
399	os_ << b.dst;	12✔
400	}	12✔
401
402	void operator()(Call const& call) {	70✔
403	os_ << "r0 = " << call.name << ":" << call.func << "(";	70✔
404	for (uint8_t r = 1; r <= 5; r++) {	144✔
405	// Look for a singleton.
406	auto single = std::ranges::find_if(call.singles, [r](const ArgSingle arg) { return arg.reg.v == r; });	372✔
407	if (single != call.singles.end()) {	144✔
408	if (r > 1) {	74✔
409	os_ << ", ";	48✔
410	}
411	os_ << *single;	74✔
412	continue;	74✔
413	}
414
415	// Look for the start of a pair.
416	auto pair = std::ranges::find_if(call.pairs, [r](const ArgPair arg) { return arg.mem.v == r; });	70✔
417	if (pair != call.pairs.end()) {	70✔
418	if (r > 1) {	×
419	os_ << ", ";	×
420	}
421	os_ << *pair;	×
422	r++;	×
423	continue;	×
424	}
425
426	// Not found.
427	break;	70✔
428	}
429	os_ << ")";	70✔
430	}	70✔
431
432	void operator()(CallLocal const& call) { os_ << "call <" << to_string(call.target) << ">"; }	×
433
434	void operator()(Callx const& callx) { os_ << "callx " << callx.func; }	×
435
436	void operator()(Exit const& b) { os_ << "exit"; }	50✔
437
438	void operator()(Jmp const& b) {	×
439	// A "standalone" jump Instruction.
440	// Print the label without offset calculations.
441	if (b.cond) {	×
442	os_ << "if ";	×
443	print(*b.cond);	×
444	os_ << " ";	×
445	}
446	os_ << "goto label <" << to_string(b.target) << ">";	×
447	}	×
448
449	void operator()(Jmp const& b, const int offset) {	54✔
450	const string sign = offset > 0 ? "+" : "";	54✔
451	const string target = sign + std::to_string(offset) + " <" + to_string(b.target) + ">";	108✔
452
453	if (b.cond) {	54✔
454	os_ << "if ";	40✔
455	print(*b.cond);	40✔
456	os_ << " ";	40✔
457	}
458	os_ << "goto " << target;	54✔
459	}	54✔
460
461	void operator()(Packet const& b) {	×
462	/* Direct packet access, R0 = (uint ) (skb->data + imm32) */
463	/* Indirect packet access, R0 = (uint ) (skb->data + src_reg + imm32) */
464	const string s = size(b.width);	×
465	os_ << "r0 = ";	×
466	os_ << "(" << s << " )skb[";	×
467	if (b.regoffset) {	×
468	os_ << *b.regoffset;	×
469	}
470	if (b.offset != 0) {	×
471	if (b.regoffset) {	×
472	os_ << " + ";	×
473	}
474	os_ << b.offset;	×
475	}
476	os_ << "]";	×
477	}	×
478
479	void print(Deref const& access) {	184✔
480	const string sign = access.offset < 0 ? " - " : " + ";	212✔
481	int offset = std::abs(access.offset); // what about INT_MIN?	184✔
482	os_ << "(" << size(access.width) << " )";	276✔
483	os_ << "(" << access.basereg << sign << offset << ")";	184✔
484	}	184✔
485
486	void print(Condition const& cond) {	232✔
487	os_ << cond.left << " " << ((!cond.is64) ? "w" : "") << cond.op << " " << cond.right;	273✔
488	}	232✔
489
490	void operator()(Mem const& b) {	184✔
491	if (b.is_load) {	184✔
492	os_ << b.value << " = ";	44✔
493	}
494	print(b.access);	184✔
495	if (!b.is_load) {	184✔
496	os_ << " = " << b.value;	140✔
497	}
498	}	184✔
499
500	void operator()(Atomic const& b) {	×
501	os_ << "lock ";	×
502	print(b.access);	×
503	os_ << " ";	×
504	bool showfetch = true;	×
505	switch (b.op) {	×
506	case Atomic::Op::ADD: os_ << "+"; break;	×
507	case Atomic::Op::OR: os_ << "\|"; break;	×
508	case Atomic::Op::AND: os_ << "&"; break;	×
509	case Atomic::Op::XOR: os_ << "^"; break;	×
510	case Atomic::Op::XCHG:	×
511	os_ << "x";	×
512	showfetch = false;	×
513	break;	×
514	case Atomic::Op::CMPXCHG:	×
515	os_ << "cx";	×
516	showfetch = false;	×
517	break;	×
518	}
519	os_ << "= " << b.valreg;	×
520
521	if (showfetch && b.fetch) {	×
522	os_ << " fetch";	×
523	}
524	}	×
525
526	void operator()(Assume const& b) {	192✔
527	os_ << "assume ";	192✔
528	print(b.cond);	192✔
529	}	192✔
530
531	void operator()(IncrementLoopCounter const& a) { os_ << crab::variable_t::loop_counter(to_string(a.name)) << "++"; }	×
532	};
533	// ReSharper restore CppMemberFunctionMayBeConst
534
535	std::ostream& operator<<(std::ostream& os, Instruction const& ins) {	194✔
536	std::visit(CommandPrinterVisitor{os}, ins);	97✔
537	return os;	97✔
538	}
539
540	string to_string(Instruction const& ins) {	194✔
541	std::stringstream str;	194✔
542	str << ins;	194✔
543	return str.str();	388✔
544	}	194✔
545
546	std::ostream& operator<<(std::ostream& os, const Assertion& a) {	62,844✔
547	std::visit(AssertionPrinterVisitor{os}, a);	32,385✔
548	return os;	32,385✔
549	}
550
551	string to_string(Assertion const& constraint) {	60,918✔
552	std::stringstream str;	60,918✔
553	str << constraint;	60,918✔
554	return str.str();	121,836✔
555	}	60,918✔
556
557	auto get_labels(const InstructionSeq& insts) {	38✔
558	pc_t pc = 0;	38✔
559	std::map<label_t, pc_t> pc_of_label;	38✔
560	for (const auto& [label, inst, _] : insts) {	708✔
561	pc_of_label[label] = pc;	670✔
562	pc += size(inst);	670✔
563	}
564	return pc_of_label;	38✔
565	}	×
566
567	void print(const InstructionSeq& insts, std::ostream& out, const std::optional<const label_t>& label_to_print,	38✔
568	const bool print_line_info) {
569	const auto pc_of_label = get_labels(insts);	38✔
570	pc_t pc = 0;	38✔
571	std::string previous_source;	38✔
572	CommandPrinterVisitor visitor{out};	38✔
573	for (const LabeledInstruction& labeled_inst : insts) {	708✔
574	const auto& [label, ins, line_info] = labeled_inst;	670✔
575	if (!label_to_print.has_value() \|\| label == label_to_print) {	670✔
576	if (line_info.has_value() && print_line_info) {	670✔
577	auto& [file, source, line, column] = line_info.value();	×
578	// Only decorate the first instruction associated with a source line.
579	if (source != previous_source) {	×
580	out << line_info.value();	×
581	previous_source = source;	×
582	}
583	}
584	if (label.isjump()) {	670✔
585	out << "\n";	×
586	out << label << ":\n";	×
587	}
588	if (label_to_print.has_value()) {	670✔
589	out << pc << ": ";	×
590	} else {
591	out << std::setw(8) << pc << ":\t";	670✔
592	}
593	if (const auto jmp = std::get_if<Jmp>(&ins)) {	670✔
594	if (!pc_of_label.contains(jmp->target)) {	54✔
595	throw std::runtime_error(string("Cannot find label ") + crab::to_string(jmp->target));	×
596	}
597	const pc_t target_pc = pc_of_label.at(jmp->target);	54✔
598	visitor(*jmp, target_pc - static_cast<int>(pc) - 1);	54✔
599	} else {
600	std::visit(visitor, ins);	616✔
601	}
602	out << "\n";	670✔
603	}
604	pc += size(ins);	670✔
605	}
606	}	38✔
607
608	} // namespace asm_syntax
609
610	std::ostream& operator<<(std::ostream& o, const EbpfMapDescriptor& desc) {	28✔
611	return o << "(" << "original_fd = " << desc.original_fd << ", " << "inner_map_fd = " << desc.inner_map_fd << ", "	28✔
612	<< "type = " << desc.type << ", " << "max_entries = " << desc.max_entries << ", "	28✔
613	<< "value_size = " << desc.value_size << ", " << "key_size = " << desc.key_size << ")";	28✔
614	}
615
616	void print_map_descriptors(const std::vector<EbpfMapDescriptor>& descriptors, std::ostream& o) {	38✔
617	int i = 0;	38✔
618	for (const auto& desc : descriptors) {	66✔
619	o << "map " << i << ":" << desc << "\n";	28✔
620	i++;	28✔
621	}
622	}	38✔
623
624	std::ostream& operator<<(std::ostream& os, const btf_line_info_t& line_info) {	×
625	os << "; " << line_info.file_name << ":" << line_info.line_number << "\n";	×
626	os << "; " << line_info.source_line << "\n";	×
627	return os;	×
628	}

vbpf / ebpf-verifier / 13958948275

Source File Press 'n' to go to next uncovered line, 'b' for previous

Source File
Press 'n' to go to next uncovered line, 'b' for previous