| 1 | \part{Tools}
|
|---|
| 2 | \label{part:tools}
|
|---|
| 3 |
|
|---|
| 4 | \chapter{Introduction}
|
|---|
| 5 |
|
|---|
| 6 | \section{Symbolic execution}
|
|---|
| 7 |
|
|---|
| 8 | \section{Tool overview}
|
|---|
| 9 |
|
|---|
| 10 | Current tools allow one to \emph{run} a CIVL program using random
|
|---|
| 11 | choice to resolve nondeterministic choices; \emph{verify} a program
|
|---|
| 12 | using model checking to explore all states of the program;
|
|---|
| 13 | \emph{replay} a trace if an error is found.
|
|---|
| 14 |
|
|---|
| 15 | The properties checked are assertion violations, division by zero,
|
|---|
| 16 | illegal pointer accesses, etc.
|
|---|
| 17 |
|
|---|
| 18 | The available tools and options are summarized by the \texttt{civl
|
|---|
| 19 | help} command:
|
|---|
| 20 |
|
|---|
| 21 | \begin{verbatim}
|
|---|
| 22 | Usage: civl <command> <options> filename ...
|
|---|
| 23 | Commands:
|
|---|
| 24 | verify : verify program filename
|
|---|
| 25 | run : run program filename
|
|---|
| 26 | help : print this message
|
|---|
| 27 | replay : replay trace for program filename
|
|---|
| 28 | parse : show result of preprocessing and parsing filename
|
|---|
| 29 | preprocess : show result of preprocessing filename
|
|---|
| 30 | Options:
|
|---|
| 31 | -debug or -debug=BOOLEAN (default: false)
|
|---|
| 32 | debug mode: print very detailed information
|
|---|
| 33 | -echo or -echo=BOOLEAN (default: false)
|
|---|
| 34 | print the command line
|
|---|
| 35 | -errorBound=INTEGER (default: 1)
|
|---|
| 36 | stop after finding this many errors
|
|---|
| 37 | -guided or -guided=BOOLEAN
|
|---|
| 38 | user guided simulation; applies only to run, ignored
|
|---|
| 39 | for all other commands
|
|---|
| 40 | -id=INTEGER (default: 0)
|
|---|
| 41 | ID number of trace to replay
|
|---|
| 42 | -inputKEY=VALUE
|
|---|
| 43 | initialize input variable KEY to VALUE
|
|---|
| 44 | -maxdepth=INTEGER (default: 2147483647)
|
|---|
| 45 | bound on search depth
|
|---|
| 46 | -min or -min=BOOLEAN (default: false)
|
|---|
| 47 | search for minimal counterexample
|
|---|
| 48 | -por=STRING (default: std)
|
|---|
| 49 | partial order reduction (por) choices:
|
|---|
| 50 | std (standard por) or scp (scoped por)
|
|---|
| 51 | -random or -random=BOOLEAN
|
|---|
| 52 | select enabled transitions randomly; default for run,
|
|---|
| 53 | ignored for all other commands
|
|---|
| 54 | -saveStates or -saveStates=BOOLEAN (default: true)
|
|---|
| 55 | save states during depth-first search
|
|---|
| 56 | -seed=STRING
|
|---|
| 57 | set the random seed; applies only to run
|
|---|
| 58 | -showModel or -showModel=BOOLEAN (default: false)
|
|---|
| 59 | print the model
|
|---|
| 60 | -showProverQueries or -showProverQueries=BOOLEAN (default: false)
|
|---|
| 61 | print theorem prover queries only
|
|---|
| 62 | -showQueries or -showQueries=BOOLEAN (default: false)
|
|---|
| 63 | print all queries
|
|---|
| 64 | -showSavedStates or -showSavedStates=BOOLEAN (default: false)
|
|---|
| 65 | print saved states only
|
|---|
| 66 | -showStates or -showStates=BOOLEAN (default: false)
|
|---|
| 67 | print all states
|
|---|
| 68 | -showTransitions or -showTransitions=BOOLEAN (default: false)
|
|---|
| 69 | print transitions
|
|---|
| 70 | -simplify or -simplify=BOOLEAN (default: true)
|
|---|
| 71 | simplify states?
|
|---|
| 72 | -solve or -solve=BOOLEAN (default: false)
|
|---|
| 73 | try to solve for concrete counterexample
|
|---|
| 74 | -states=STRING (default: immutable)
|
|---|
| 75 | state implementation: immutable, transient, persistent
|
|---|
| 76 | -sysIncludePath=STRING
|
|---|
| 77 | set the system include path
|
|---|
| 78 | -trace=STRING
|
|---|
| 79 | filename of trace to replay
|
|---|
| 80 | -userIncludePath=STRING
|
|---|
| 81 | set the user include path
|
|---|
| 82 | -verbose or -verbose=BOOLEAN (default: false)
|
|---|
| 83 | verbose mode
|
|---|
| 84 | \end{verbatim}
|
|---|
| 85 |
|
|---|
| 86 | \chapter{Running a CIVL-C program}
|
|---|
| 87 |
|
|---|
| 88 | \chapter{Model Checking}
|
|---|
| 89 |
|
|---|
| 90 | \chapter{Replaying counter-examples}
|
|---|
| 91 |
|
|---|
| 92 | \chapter{C/MPI Programs}
|
|---|
| 93 |
|
|---|
| 94 |
|
|---|
| 95 | \chapter{Transitions}
|
|---|
| 96 | In CIVL, a transition stands for the execution of a number of statements of a certain process from one state, and the execution of each statement is considered as one step. A transition has the following form in the output, where sid and sid' are the identifiers for the source and the target states, pid is the identifier of the process that this transition belongs to, and step 0,1 ... are the steps contained in the transitions.
|
|---|
| 97 |
|
|---|
| 98 | \begin{verbatim}
|
|---|
| 99 | State sid, proc pid:
|
|---|
| 100 | step 0;
|
|---|
| 101 | step 1;
|
|---|
| 102 | ...
|
|---|
| 103 | --> State sid'
|
|---|
| 104 | \end{verbatim}
|
|---|
| 105 |
|
|---|
| 106 | A step of a transition has the following form in the CIVL output, where src and dst is the source and destination location of the statement executed in the step, file is the file that contains the source code of the statement, location and text are the location and summary of text of the statement in the source file.
|
|---|
| 107 |
|
|---|
| 108 | \begin{verbatim}
|
|---|
| 109 | src->dst: statement at file:location "text";
|
|---|
| 110 | \end{verbatim}
|
|---|
| 111 |
|
|---|
| 112 | For example, the following is a transition from state 0 to state 1, containing 6 steps. File names are renamed with short names and the mapping of short names and the original files is presented in output as well.
|
|---|
| 113 |
|
|---|
| 114 | \begin{verbatim}
|
|---|
| 115 | File name list:
|
|---|
| 116 | f0 : atomicBlockedResume.cvl
|
|---|
| 117 |
|
|---|
| 118 | State 0, proc 0:
|
|---|
| 119 | 0->1: x = 1 at f0:3.0-9 "int x = 1";
|
|---|
| 120 | 1->2: y = 0 at f0:4.0-9 "int y = 0";
|
|---|
| 121 | 2->3: z = 0 at f0:5.0-9 "int z = 0";
|
|---|
| 122 | 3->6: sum = 0 at f0:6.0-11 "int sum = 0";
|
|---|
| 123 | 6->8: $spawn foo(1) at f0:22.4-17 "$spawn foo(1)";
|
|---|
| 124 | 8->10: $spawn foo(2) at f0:23.4-17 "$spawn foo(2)";
|
|---|
| 125 | --> State 1
|
|---|
| 126 | \end{verbatim}
|
|---|
| 127 |
|
|---|
| 128 | To make use of this feature, one needs to specify the option ``-showTransitions'' when running CIVL.
|
|---|
| 129 |
|
|---|