ClearBlue
SymbolicExprGraphSolver.h
1 /*
2  * Developed by Qingkai Shi
3  * Copy Right by Prism Research Group, HKUST and State Key Lab for Novel
4  * Software Tech., Nanjing University.
5  */
6 
7 #ifndef IR_SEG_SYMBOLICEXPRGRAPHSOLVER_H
8 #define IR_SEG_SYMBOLICEXPRGRAPHSOLVER_H
9 
10 #include <llvm/IR/BasicBlock.h>
11 #include <llvm/IR/Dominators.h>
12 
13 #include <string>
14 #include <unordered_map>
15 
16 #include "Analysis/Bitcode/TSDataLayout.h"
17 #include "Analysis/Graph/DomTreePass.h"
18 
19 #include "IR/SEG/SEGArgumentNode.h"
20 #include "IR/SEG/SEGLoadMemNode.h"
21 #include "IR/SEG/SEGPhiNode.h"
22 #include "IR/SEG/SEGRegionNode.h"
23 #include "IR/SEG/SEGReturnNode.h"
24 #include "IR/SEG/SEGStoreMemNode.h"
25 
26 #include "IR/SEG/SEGBinaryWithIntConstNode.h"
27 #include "IR/SEG/SEGCastNode.h"
28 
29 #include "SMT/SMTFactory.h"
30 
31 #include "Utils/ADT/PushPopCache.h"
32 
33 using namespace llvm;
34 
35 class MessageQueue;
36 class ExternalMemorySpec;
37 class ExternalIOSpec;
38 
48 class SymbolicExprGraphSolver : public SMTSolver {
49 protected:
51  std::unordered_map<const SEGNodeBase *, SMTExpr> NodeExprMap;
52 
54  std::unordered_map<std::string, const SEGNodeBase *> NodeSymbolNameMap;
55 
56  TSDataLayout &DL;
57 
58  ExternalMemorySpec *MemSpec = nullptr;
59  ExternalIOSpec *IOSpec = nullptr;
60 
61 public:
62  SymbolicExprGraphSolver(SMTFactory &Fcty, TSDataLayout &D,
63  ExternalMemorySpec *MemSepc, ExternalIOSpec *IOSpec);
64  virtual ~SymbolicExprGraphSolver();
65 
67  SMTExprVec getCtrlDeps(const SEGNodeBase *N, void *Args = nullptr);
68 
70  virtual SMTExprVec getCtrlDeps(BasicBlock *B, const SymbolicExprGraph *G,
71  void *Args = nullptr);
72 
78  virtual std::pair<SMTExprVec, SMTExprVec>
79  getCtrlDepsPair(BasicBlock *B, const SymbolicExprGraph *G,
80  void *Args = nullptr) {
81  return __getCtrlDeps(B, G);
82  }
83 
85  virtual SMTExprVec getDataDeps(const SEGNodeBase *N, void *Args = nullptr);
86 
87  // Return gated function for a child of a phiNode
88  // This is the most accurate for a phi incoming node, since it is identified
89  // with incoming BB and the value.
90  virtual SMTExprVec getPhiGated(const SEGPhiNode *PhiNode,
91  const SEGPhiNode::IncomeNode InNode,
92  void *Args = nullptr);
93 
94  // This function first try to find the inNode then call the inNode version.
95  SMTExprVec getPhiGated(const SEGPhiNode *PhiNode, const SEGNodeBase *Value,
96  BasicBlock *BB, void *Args = nullptr);
97 
98  // This is a less accurate version since one value could come from several
99  // different BBs. We collect their ctrl dep + immediate cond and then OR all
100  // of them.
101  SMTExprVec getPhiGated(const SEGPhiNode *PhiNode, const SEGNodeBase *Value,
102  void *Args = nullptr);
103 
109  virtual SMTExprVec getDeps(const SEGNodeBase *N, const SEGNodeBase *M);
110 
113  virtual std::pair<SMTExprVec, SMTExprVec> getDepsPair(const SEGNodeBase *N,
114  const SEGNodeBase *M);
115 
116 private:
119  std::pair<SMTExprVec, SMTExprVec>
120  __getCtrlDeps(BasicBlock *B, const SymbolicExprGraph *G, size_t Depth = 0);
121 
122  std::pair<SMTExprVec, SMTExprVec>
123  __getPhiGated(const SEGPhiNode *PhiNd, const SEGPhiNode::IncomeNode In);
124 
126  SMTExprVec __getDataDeps(const SEGNodeBase *N, size_t Depth = 0);
127 
128 public:
129  virtual void push();
130 
131  virtual void pop(unsigned N = 1);
132 
133  virtual void reset();
134 
135  virtual SMTResultType check();
136 
137 protected:
138  PushPopCache<const SEGNodeBase *> ConstraintCache;
139  PushPopCache<BasicBlock *> BBCache;
140 
141 private:
142  PushPopCache<const SEGArgumentNode *> FunctionArgumentCache;
143  PushPopCache<const SEGCallSiteOutputNode *> CallSiteOutputCache;
144 
145  std::unordered_map<BasicBlock *, SMTExprVec> CtrlCacheMap;
146  std::unordered_map<const SEGOpcodeNode *, SMTExpr> OpcodeConstraintsCacheMap;
147 
148 public:
149  const std::unordered_set<const SEGArgumentNode *> &
150  getUsedFunctionArguments() {
151  return FunctionArgumentCache.getCacheSet();
152  }
153 
154  // see PushPopVector::getCacheVector(bool)
155  std::pair<std::vector<const SEGCallSiteOutputNode *>::iterator,
156  std::vector<const SEGCallSiteOutputNode *>::iterator>
157  getUsedCallSiteOutputs(bool Restart = false) {
158  return CallSiteOutputCache.getCacheVector(Restart);
159  }
160 
161 public:
163  const SEGNodeBase *getNodeFromSymbol(std::string Symbol) {
164  auto It = NodeSymbolNameMap.find(Symbol);
165  if (It == NodeSymbolNameMap.end()) {
166  return nullptr;
167  }
168  return It->second;
169  }
170 
171  SMTExpr getOrInsertExpr(const SEGNodeBase *N);
172 
186  SMTExpr encodeOpcodeNode(const SEGOpcodeNode *N);
187 
188  virtual SMTExpr encodeBinaryOpcodeNode(const SEGOpcodeNode *N);
189  virtual SMTExpr encodeCompareOpcodeNode(const SEGOpcodeNode *N);
190  virtual SMTExpr encodeCastOpcodeNode(const SEGOpcodeNode *N);
191  virtual SMTExpr encodeGEPOpcodeNode(const SEGOpcodeNode *N);
192  virtual SMTExpr encodeExtractElementOpcodeNode(const SEGOpcodeNode *N);
193  virtual SMTExpr encodeInsertElementOpcodeNode(const SEGOpcodeNode *N);
194  virtual SMTExpr encodeSelectOpcodeNode(const SEGOpcodeNode *N);
195  virtual SMTExpr encodeConcatOpcodeNode(const SEGOpcodeNode *N);
196 };
197 
198 // Using the domination relationship between basic blocks
199 // to refine the constraints.
201 private:
202  const DomTree *DT;
203 
204  std::unordered_map<BasicBlock *, std::pair<SMTExprVec, BasicBlock *>>
205  CtrlCacheMap;
206 
207 public:
208  DTSymbolicExprGraphSolver(SMTFactory &Fcty, TSDataLayout &D,
209  ExternalMemorySpec *MemSpec, ExternalIOSpec *IOSpec,
210  const DomTree *T)
211  : SymbolicExprGraphSolver(Fcty, D, MemSpec, IOSpec), DT(T) {}
212 
213 public:
216  virtual SMTExprVec getCtrlDeps(BasicBlock *B, const SymbolicExprGraph *G,
217  void *Args = nullptr);
218 
219  virtual std::pair<SMTExprVec, SMTExprVec>
220  getCtrlDepsPair(BasicBlock *B, const SymbolicExprGraph *G,
221  void *Args = nullptr) {
222  BasicBlock *PrevB = (BasicBlock *)Args;
223  return __getCtrlDepsWrapper(B, G, PrevB);
224  }
225 
228  virtual SMTExprVec getDataDeps(const SEGNodeBase *N, void *Args = nullptr);
229 
234  virtual SMTExprVec getPhiGated(const SEGPhiNode *PhiNode,
235  const SEGPhiNode::IncomeNode InNode,
236  void *Args = nullptr);
237 
238  virtual void reset();
239 
244  virtual SMTExprVec getDeps(const SEGNodeBase *N, const SEGNodeBase *M);
245 
246 private:
248  std::pair<SMTExprVec, SMTExprVec>
249  __getCtrlDepsWrapper(BasicBlock *B, const SymbolicExprGraph *G,
250  BasicBlock *PrevB);
251 
255  std::pair<SMTExprVec, SMTExprVec>
256  __getCtrlDeps(BasicBlock *B, const SymbolicExprGraph *G, BasicBlock *PrevB);
257 
258  std::pair<SMTExprVec, SMTExprVec>
259  __getPhiGated(const SEGPhiNode *PhiNd, const SEGPhiNode::IncomeNode In,
260  BasicBlock *PrevB);
261 
265  SMTExprVec __getDataDeps(const SEGNodeBase *N, BasicBlock *PrevB);
266 };
267 
268 #endif
SEGPhiNode::IncomeNode
Definition: SEGPhiNode.h:33
SymbolicExprGraphSolver::NodeSymbolNameMap
std::unordered_map< std::string, const SEGNodeBase * > NodeSymbolNameMap
map the symbol name used by Z3 in context ctx to the SEG node
Definition: SymbolicExprGraphSolver.h:54
SymbolicExprGraph
Definition: SymbolicExprGraph.h:708
SymbolicExprGraphSolver
Definition: SymbolicExprGraphSolver.h:48
SymbolicExprGraphSolver::NodeExprMap
std::unordered_map< const SEGNodeBase *, SMTExpr > NodeExprMap
each node in seg is a z3 variable
Definition: SymbolicExprGraphSolver.h:51
SymbolicExprGraphSolver::getNodeFromSymbol
const SEGNodeBase * getNodeFromSymbol(std::string Symbol)
return the SEG node for the given symbol
Definition: SymbolicExprGraphSolver.h:163
DTSymbolicExprGraphSolver
Definition: SymbolicExprGraphSolver.h:200
SymbolicExprGraphSolver::getCtrlDepsPair
virtual std::pair< SMTExprVec, SMTExprVec > getCtrlDepsPair(BasicBlock *B, const SymbolicExprGraph *G, void *Args=nullptr)
Definition: SymbolicExprGraphSolver.h:79
SEGPhiNode
Definition: SEGPhiNode.h:28
SEGOpcodeNode
Definition: SymbolicExprGraph.h:519
DTSymbolicExprGraphSolver::getCtrlDepsPair
virtual std::pair< SMTExprVec, SMTExprVec > getCtrlDepsPair(BasicBlock *B, const SymbolicExprGraph *G, void *Args=nullptr)
Definition: SymbolicExprGraphSolver.h:220
SEGNodeBase
The node base of symbolic expression graph.
Definition: SymbolicExprGraph.h:244