Module Db.Value


module Value: sig .. end
The Value analysis itself.
See also internal documentation.

type state = Relations_type.Model.t 
Internal state of the value analysis.
type t = Cvalue_type.V.t 
Internal representation of a value.
exception Aborted
val self : Project.Computation.t
Internal state of the value analysis from project viewpoints.
Consult the Plugin Development Guide for additional details.
val mark_as_computed : unit -> unit
Indicate that the value analysis has been done already.
val compute : (unit -> unit) Pervasives.ref
Compute the value analysis using the entry point of the current project. You may set it with Globals.set_entry_point.
Consult the Plugin Development Guide for additional details.
val is_computed : unit -> bool
Return true iff the value analysis has been done.
Consult the Plugin Development Guide for additional details.
val degeneration_occurred : (Cil_types.kinstr -> Cil_types.lval option -> unit) Pervasives.ref
This hook is called by the value analysis in the seldom case a total degeneration occurs.

Parameterization


val register_builtin : (string ->
(state ->
(Cil_types.exp * t) list ->
Cvalue_type.V_Offsetmap.t option * state *
Locations.Location_Bits.Top_Param.t) ->
unit)
Pervasives.ref
!record_builtin name f registers an abstract function f to use everytime a C function named name is called in the program
val mem_builtin : (string -> bool) Pervasives.ref

Arguments of the main function



The functions below are related to the arguments that are passed to the function that is analysed by the value analysis. Specific arguments are set by fun_set_args. Arguments reset to default values when fun_use_default_args is called, when the ast is changed, or if the options -libentry or -main are changed.
val fun_set_args : t list -> unit
Specify the arguments to use. This function is not journalized, and will generate an error when the journal is replayed
val fun_use_default_args : unit -> unit
val fun_get_args : unit -> t list option
For this function, the result None means that default values are used for the arguments.j

Initial state of the analysis



The functions below are related to the the value of the global variables when the value analysis is started. If globals_set_initial_state has not been called, the given state is used. A default state (which depends on the option -libentry) is used when globals_use_default_initial_state is called, or when the ast changes.
val globals_set_initial_state : state -> unit
Specify the initial state to use. This function is not journalized, and will generate an error when the journal is replayed
val globals_use_default_initial_state : unit -> unit
val globals_state : unit -> state
Initial state used by the analysis
val globals_use_supplied_state : unit -> bool
Returns true if the initial state for globals used by the value analysis has been supplied by the user (through globals_set_initial_state), or false if it is automatically computed by the value analysis

Getters



State of the analysis at various points
val get_initial_state : Db_types.kernel_function -> state
val get_state : Cil_types.kinstr -> state
val find : state -> Locations.location -> t

Evaluations


val eval_lval : (with_alarms:CilE.warn_mode ->
Locations.Zone.t option ->
state -> Cil_types.lval -> Locations.Zone.t option * t)
Pervasives.ref
val eval_expr : (with_alarms:CilE.warn_mode -> state -> Cil_types.exp -> t)
Pervasives.ref
val eval_expr_with_state : (with_alarms:CilE.warn_mode ->
state -> Cil_types.exp -> state * t)
Pervasives.ref
val find_lv_plus : (with_alarms:CilE.warn_mode ->
Relations_type.Model.t -> Cil_types.exp -> (Cil_types.lval * Ival.t) list)
Pervasives.ref
returns the list of all decompositions of expr into the sum an lvalue and an interval.

Values and kernel functions


val expr_to_kernel_function : (Cil_types.kinstr ->
with_alarms:CilE.warn_mode ->
deps:Locations.Zone.t option ->
Cil_types.exp -> Locations.Zone.t * Kernel_function.Set.t)
Pervasives.ref
val expr_to_kernel_function_state : (state ->
deps:Locations.Zone.t option ->
Cil_types.exp -> Locations.Zone.t * Kernel_function.Set.t)
Pervasives.ref
exception Not_a_call
val call_to_kernel_function : Cil_types.stmt -> Kernel_function.Set.t
Return the functions that can be called from this call.
Raises Not_a_call if the statement is not a call.
val valid_behaviors : (Db_types.kernel_function -> state -> Cil_types.funbehavior list)
Pervasives.ref

Reachability


val is_accessible : Cil_types.kinstr -> bool
val is_reachable : state -> bool
val is_reachable_stmt : Cil_types.stmt -> bool

About kernel functions


exception Void_Function
val find_return_loc : Db_types.kernel_function -> Locations.location
Return the location of the returned lvalue of the given function.
Raises Void_Function is the function does not return any value.
val is_called : (Db_types.kernel_function -> bool) Pervasives.ref
val callers : (Db_types.kernel_function ->
(Db_types.kernel_function * Cil_types.stmt list) list)
Pervasives.ref
Returns the list of callers with their call sites. Each function is present only once in the list.
val never_terminates : (Db_types.kernel_function -> bool) Pervasives.ref
Returns true if the function never reaches its return.

Values in kinstr


val access : (Cil_types.kinstr -> Cil_types.lval -> t) Pervasives.ref
val access_expr : (Cil_types.kinstr -> Cil_types.exp -> t) Pervasives.ref
val access_location : (Cil_types.kinstr -> Locations.location -> t) Pervasives.ref
val access_after : (Cil_types.kinstr -> Cil_types.lval -> t) Pervasives.ref
Raises Not_found if the kinstr has no accessible successors.
val access_location_after : (Cil_types.kinstr -> Locations.location -> t) Pervasives.ref
Raises Not_found if the kinstr has no accessible successors.
val lval_to_offsetmap_after : (Cil_types.kinstr -> Cil_types.lval -> Cvalue_type.V_Offsetmap.t option)
Pervasives.ref
Raises Not_found if the kinstr has no accessible successors.

Locations of left values


val lval_to_loc : (Cil_types.kinstr ->
with_alarms:CilE.warn_mode -> Cil_types.lval -> Locations.location)
Pervasives.ref
val lval_to_loc_with_deps : (Cil_types.kinstr ->
with_alarms:CilE.warn_mode ->
deps:Locations.Zone.t ->
Cil_types.lval -> Locations.Zone.t * Locations.location)
Pervasives.ref
val lval_to_loc_with_deps_state : (state ->
deps:Locations.Zone.t ->
Cil_types.lval -> Locations.Zone.t * Locations.location)
Pervasives.ref
val lval_to_loc_state : (state -> Cil_types.lval -> Locations.location) Pervasives.ref
val lval_to_offsetmap : (Cil_types.kinstr ->
Cil_types.lval ->
with_alarms:CilE.warn_mode -> Cvalue_type.V_Offsetmap.t option)
Pervasives.ref
val lval_to_zone : (Cil_types.kinstr ->
with_alarms:CilE.warn_mode -> Cil_types.lval -> Locations.Zone.t)
Pervasives.ref
val lval_to_zone_state : (state -> Cil_types.lval -> Locations.Zone.t) Pervasives.ref
Does not emit alarms.
val assigns_to_zone_inputs_state : (state ->
Cil_types.identified_term Cil_types.assigns list -> Locations.Zone.t)
Pervasives.ref

Callbacks


module Record_Value_Callbacks: Hook.Iter_hook  with type param = (kernel_function * kinstr) list
    * state Cilutil.InstrHashtbl.t
Actions to perform at end of each function analysis.
module Record_Value_Superposition_Callbacks: Hook.Iter_hook  with type param = (kernel_function * kinstr) list
    * State_set.t Cilutil.InstrHashtbl.t
module Call_Value_Callbacks: Hook.Iter_hook  with type param = state * (kernel_function * kinstr) list
Actions to perform at each treatment of a "call" statement.

Pretty printing


val pretty : Format.formatter -> t -> unit
val pretty_state_without_null : Format.formatter -> state -> unit
val pretty_state : Format.formatter -> state -> unit
val display : Format.formatter -> Db_types.kernel_function -> unit
val display_globals : Format.formatter -> unit -> unit

Internal use only


val noassert_get_state : Cil_types.kinstr -> state
To be used during the value analysis itself (instead of Db.Value.get_state).
val initial_state_only_globals : (unit -> state) Pervasives.ref
val update_table : Cil_types.kinstr -> state -> unit
val memoize : (Db_types.kernel_function -> unit) Pervasives.ref
val merge_initial_state : Db_types.kernel_function -> state -> unit
Store an additional possible initial state for the given function as well as its values for actuals.