public void AddTransitiveViolation(Violation violation, Transition transition = null)
{
this.TransitiveViolations.Add(
new TransitiveViolation()
{
Violation = violation,
TransitionDescriptor = new TransitionDescriptor(transition)
});
}
public Violation CloneViolation()
{
Violation clone = this.Clone() as Violation;
clone.Guid = Guid.NewGuid();
clone.ChildViolationList = new List <Violation>(this.ChildViolationList);
clone.Assumptions = new HashSet <Assumption>(this.Assumptions);
clone.TransitiveViolations = new List <TransitiveViolation>();
return(clone);
}
public bool HasPreviousViolation(Violation v)
{
Violation current = this;
while (current != null)
{
if (current.IsSameAs(v))
{
return(true);
}
current = current.PreviousViolationObject as Violation;
}
return(false);
}
private void AddWorkUnits(SimulationContext parentContext, Violation newViolation = null)
{
Violation currentViolation = parentContext.CurrentViolation;
//
// Establish the contexts that should be simulated against.
//
SimulationContext newContext;
if (newViolation != null)
{
newContext = parentContext.CloneCast();
newContext.CurrentViolation = newViolation;
newContext.ParentContext = parentContext;
//
// Have we reached a fixed point?
//
//if (newContext.HasPreviousContext(newContext))
//{
// return;
//}
}
else
{
newContext = parentContext;
newContext.ParentContext = null;
}
//
// Inherit the initial assumptions for the current violation.
//
foreach (Assumption assumption in newContext.CurrentViolation.Assumptions)
{
newContext.Assume(assumption);
}
this.WorkUnitQueue.Enqueue(new WorkUnit()
{
Context = newContext
});
}
public void InheritParameterStateFromContent(Violation from, params MemoryAccessParameter[] parameters)
{
foreach (MemoryAccessParameter parameter in parameters)
{
switch (parameter)
{
case MemoryAccessParameter.Base:
this.BaseState = from.ContentSrcState;
break;
case MemoryAccessParameter.Content:
this.ContentSrcState = from.ContentSrcState;
break;
case MemoryAccessParameter.Displacement:
this.DisplacementState = from.ContentSrcState;
break;
case MemoryAccessParameter.Extent:
this.ExtentState = from.ContentSrcState;
break;
default:
throw new NotSupportedException();
}
}
if ((parameters.Contains(MemoryAccessParameter.Base)) ||
(this.Method == MemoryAccessMethod.Execute))
{
this.AddressingMode = MemoryAddressingMode.Absolute;
}
else
{
this.AddressingMode = MemoryAddressingMode.Relative;
}
}
/// <summary>
/// Checks if the supplied violation is the same as this one base on the parameters of the violation.
/// </summary>
/// <param name="v"></param>
/// <returns></returns>
public bool IsSameAs(Violation v)
{
return(this.EquivalenceClass == v.EquivalenceClass);
}
private TransitionInformation ProcessTransitionForWorkUnit(WorkUnit unit, Transition transition)
{
SimulationContext activeContext = unit.Context.CloneCast();
Violation newViolation = null;
TransitionInformation transitionInfo = new TransitionInformation()
{
PreViolation = activeContext.CurrentViolation,
Transition = transition
};
try
{
activeContext.AddVisitedTransition(transitionInfo);
activeContext.CurrentTransition = transition;
transition.Evaluate(activeContext);
newViolation = (Violation)transition.OnSuccess(activeContext);
//
// Associate the transitive violation that is enabled by the current violation.
//
if (newViolation != null)
{
activeContext.CurrentViolation.AddTransitiveViolation(newViolation);
transitionInfo.PostViolation = newViolation;
}
else
{
transitionInfo.PostViolation = transitionInfo.PreViolation;
}
}
catch (ConstraintNotSatisfied ex)
{
activeContext.FailureReason = String.Format("Constraint not satisfied on transition '{0}': {1}", transitionInfo.Transition, ex.Message);
activeContext.Exploitability = 0;
}
if (activeContext.Exploitability == 0)
{
if (activeContext.Global.TrackImpossible)
{
activeContext.Global.AddCompletedSimulationContext(activeContext);
}
return(null);
}
if (this.OnTransition != null)
{
this.OnTransition(transitionInfo);
}
if (Debug)
{
Console.WriteLine("Visited transitions with hash {0},{1},{2} = {3}:",
unit.Context.AssumptionsEquivalenceClass,
unit.Context.TransitionsEquivalenceClass,
unit.Context.ViolationsEquivalenceClass,
unit.Context.InvariantEquivalenceClass
);
foreach (TransitionInformation i in activeContext.VisitedTransitions)
{
Console.WriteLine("\t{0} --> {1} --> {2}",
i.PreViolation,
i.Transition.Label,
i.PostViolation);
}
Console.WriteLine("-------");
}
//
// If the simulation has reached a completion state, log it as successful and return.
//
if (this.IsSimulationComplete != null && this.IsSimulationComplete(activeContext))
{
activeContext.Global.AddCompletedSimulationContext(activeContext);
return(transitionInfo);
}
//
// Add new work units based on the state that we have transitioned to.
//
AddWorkUnits(activeContext, newViolation);
return(transitionInfo);
}
private void ProcessWorkUnit(WorkUnit unit)
{
Violation currentViolation = unit.Context.CurrentViolation;
IEnumerable <Transition> transitions = null;
if (this.RestrictedRootTransitions != null)
{
if (unit.Context.RootChecked == false)
{
TransitionInformation root = unit.Context.VisitedTransitions.Where(x => x.Transition.Primitive.IsIdentity == false).FirstOrDefault();
if (root != null)
{
//
// Do not process any further if this transition is not a valid root.
//
if (this.RestrictedRootTransitions.Contains(root.Transition) == false)
{
return;
}
unit.Context.RootChecked = true;
}
}
}
if (this.RestrictedTransitions != null)
{
transitions = this.RestrictedTransitions;
}
else
{
transitions = this.Simulation.Transitions;
}
bool newPathAdded = false;
foreach (Transition transition in transitions)
{
//
// Skip transitions that we have already visited.
//
if (unit.Context.VisitedTransitions.Any(x => x.Transition.Ordinal == transition.Ordinal))
{
continue;
}
TransitionInformation info;
info = ProcessTransitionForWorkUnit(unit, transition);
if (info != null)
{
newPathAdded = true;
}
}
if (newPathAdded == false)
{
if (this.OnFixedPointReached != null && unit.Context.VisitedTransitions.Count > 0)
{
this.OnFixedPointReached(unit.Context);
}
}
}
private void UpdateGraphs()
{
Graph graph = new DirectedGraph();
this.TransitionChains = new Dictionary <MemoryAccessMethod, List <TransitionChain> >();
foreach (Transition transition in this.RootTransitions)
{
//
// Skip identity primitives for now.
//
if (transition.Primitive.IsIdentity)
{
continue;
}
//
// Use an open-ended violation of the method that the transition is from to ensure
// the constraints will match.
//
// TODO: also leverage expected parameter control?
//
Violation initialViolation = new Violation(
transition.Primitive.FromMethod.Value
);
GlobalSimulationContext globalContext = new GlobalSimulationContext(
new Target()
{
Violation = initialViolation
});
//
// Assume that content initialization is possible. Most transitions will require
// that content has been initialized, and it is expected that a content initialization
// primitive will have been used to accomplish this. However, for the purpose of classification,
// we do not want to select or imply any one initialization primitive.
//
globalContext.AssumeContentInitializationPossible = true;
SimulationContext initialContext = new SimulationContext(globalContext);
Simulator simulator = new Simulator(this, initialContext);
//
// Limit simulation to include only those primitives that are part of the same technique.
//
simulator.RestrictToTransitions(
this.Transitions.Where(x => x.Technique == transition.Technique)
);
//
// Add edges for contexts that reach a fixed point.
//
simulator.OnFixedPointReached += (context) =>
{
TransitionInformation contextRoot = context.VisitedTransitions.Where(x => x.Transition.Primitive.IsIdentity == false).FirstOrDefault();
if (contextRoot == null || contextRoot.Transition != transition)
{
return;
}
TransitionChain chain = new TransitionChain();
foreach (TransitionInformation ti in context.VisitedTransitions)
{
graph.AddEdge(
new DirectedEdge(
ti.PreViolation,
ti.PostViolation,
ti.Transition.Primitive
)
);
chain.Transitions.Add(ti);
}
if (!this.TransitionChains.ContainsKey(initialViolation.Method))
{
this.TransitionChains[initialViolation.Method] = new List <TransitionChain>();
}
this.TransitionChains[initialViolation.Method].Add(chain);
};
//
// Execute the simulation.
//
simulator.Run();
}
this.CompleteGraph = graph;
}
