Ejemplo n.º 1
0
def load_system(file_path):
    sys, prop = loadsystem.parse(file_path)
    sys.init_sims(plt_lib=None, psim_args=None)
    # useful to talk about the parameterization of ci without talking about
    # delta_t
    prop.delta_t = sys.delta_t
    #step_sim = simsys.get_step_simulator(
    #    sys.controller_sim,
    #    sys.plant_sim,
    #    sys.delta_t)
    #trace = sim(py_x, t0, tf, py_u, pvt);

    #system_sim = simsys.get_system_simulator(step_sim, sys.delta_t, sys.num_dims)

    system_sim = simsys.get_system_simulator(sys)

    # simstate encapsulates pvt, s, d,
    def one_shot_sim(x, t0, tf, w, simstate=None):
        if t0 != 0:
            raise err.Fatal('t0 must be 0!')
        else:
            # TODO: construct numpy arrays in loadsystem
            # This will require changing code into quite  afew
            # places...carefull!
            s = np.array(prop.initial_controller_state)
            d = np.array(prop.initial_discrete_state)
            pvt = np.zeros(1)
            ci_array = w
            return system_sim(x, s, d, pvt, t0, tf, ci_array)

    return one_shot_sim, prop
Ejemplo n.º 2
0
def load_system(file_path):
    sys, prop = loadsystem.parse(file_path)
    sys.init_sims(plt_lib=None, psim_args=None)
    # useful to talk about the parameterization of ci without talking about
    # delta_t
    prop.delta_t = sys.delta_t
    #step_sim = simsys.get_step_simulator(
    #    sys.controller_sim,
    #    sys.plant_sim,
    #    sys.delta_t)
    #trace = sim(py_x, t0, tf, py_u, pvt);

    #system_sim = simsys.get_system_simulator(step_sim, sys.delta_t, sys.num_dims)

    system_sim = simsys.get_system_simulator(sys)

    # simstate encapsulates pvt, s, d,
    def one_shot_sim(x, t0, tf, w, simstate=None):
        if t0 != 0:
            raise err.Fatal('t0 must be 0!')
        else:
            # TODO: construct numpy arrays in loadsystem
            # This will require changing code into quite  afew
            # places...carefull!
            s = np.array(prop.initial_controller_state)
            d = np.array(prop.initial_discrete_state)
            pvt = np.zeros(1)
            ci_array = w
            return system_sim(x, s, d, pvt, t0, tf, ci_array)

    return one_shot_sim, prop
Ejemplo n.º 3
0
def main():
    logger.info('execution begins')
    LIST_OF_SYEMX_ENGINES = ['klee', 'pathcrawler']
    LIST_OF_CONTROLLER_REPRS = ['smt2', 'trace']
    LIST_OF_TRACE_STRUCTS = ['list', 'tree']
    LIST_OF_REFINEMENTS = ['init', 'trace']

    usage = '%(prog)s <filename>'
    parser = argparse.ArgumentParser(description='S3CAM', usage=usage)
    parser.add_argument('-f',
                        '--filename',
                        default=None,
                        metavar='file_path.tst')

    #parser.add_argument('--run-benchmarks', action="store_true", default=False,
    #                    help='run pacakged benchmarks')

    parser.add_argument('-s',
                        '--simulate',
                        type=int,
                        metavar='num-sims',
                        help='simulate')
    parser.add_argument('-c',
                        '--ss-concrete',
                        action="store_true",
                        help='scatter & simulate')
    parser.add_argument(
        '--ss-concolic',
        action="store_true",
        help='scatter & simulate with concolic execution using KLEE')
    parser.add_argument('-x',
                        '--ss-symex',
                        type=str,
                        metavar='engine',
                        choices=LIST_OF_SYEMX_ENGINES,
                        help='SS + SymEx with static paths')

    parser.add_argument('-r',
                        '--cntrl-rep',
                        type=str,
                        metavar='repr',
                        choices=LIST_OF_CONTROLLER_REPRS,
                        help='Controller Representation')

    parser.add_argument('-p',
                        '--plot',
                        action='store_true',
                        help='enable plotting')

    parser.add_argument('--dump',
                        action='store_true',
                        help='dump trace in mat file')

    parser.add_argument('--seed',
                        type=int,
                        metavar='seed_value',
                        help='seed for the random generator')

    # TAG:MSH
    parser.add_argument('--meng',
                        type=str,
                        metavar='engine_name',
                        help='Shared Matlab Engine name')

    parser.add_argument('-t',
                        '--trace-struct',
                        type=str,
                        metavar='struct',
                        default='tree',
                        choices=LIST_OF_TRACE_STRUCTS,
                        help='structure for cntrl-rep')

    parser.add_argument('--refine',
                        type=str,
                        metavar='method',
                        default='init',
                        choices=LIST_OF_REFINEMENTS,
                        help='Refinement method')

    parser.add_argument('-o',
                        '--output',
                        type=str,
                        default='vio.log',
                        help='violation log')

    #    argcomplete.autocomplete(parser)
    args = parser.parse_args()
    #print(args)

    if args.filename is None:
        print('No file to test. Please use --help')
        exit()
        print('No arguments passed. Loading list of packaged benchmarks!')
        example_list = egl.get_example_list()
        print('select from a list of examples')
        for (idx, example) in enumerate(example_list):
            print('({}) {}'.format(idx, example_list[idx]['description']))

        i = int(raw_input())
        filename = example_list[i]['filename']
        path = example_list[i]['path']
        filepath = fp.construct_path(filename, path)
    else:
        filepath = args.filename

    if args.seed is not None:
        np.random.seed(args.seed)

    # TODO:
    # dynamicall generate an opt class to mimic the same defined in
    # loadsystem.py
    # switch this to a reg class later.
    Options = type('Options', (), {})
    opts = Options()
    if args.simulate is not None:
        opts.MODE = 'simulate'
        opts.num_sim_samples = args.simulate
    elif args.ss_concrete:
        opts.MODE = 'falsify'
        opts.METHOD = 'concrete'
    elif args.ss_concolic:
        opts.MODE = 'falsify'
        opts.METHOD = 'concolic'
        print('removed concolic (KLEE)')
        exit(0)
    elif args.ss_symex is not None:
        opts.MODE = 'falsify'
        opts.METHOD = 'symbolic'
        opts.symbolic_analyzer = args.ss_symex
        #if opts.symbolic_analyzer not in LIST_OF_SYEMX_ENGINES:
        #    raise err.Fatal('unknown symbolic analyses engine requested.')
        if args.cntrl_rep is None:
            raise err.Fatal('controller representation must be provided')
        else:
            opts.cntrl_rep = args.cntrl_rep
            opts.trace_struct = args.trace_struct
    else:
        raise err.Fatal('no options passed. Check usage.')
    opts.plot = args.plot
    opts.dump_trace = args.dump
    opts.refine = args.refine
    opts.op_fname = args.output
    opts.sys_path = filepath

    sys, prop = loadsystem.parse(filepath)
    # TAG:MSH
    matlab_engine = args.meng
    sys.init_sims(plt, psim_args=matlab_engine)

    if opts.plot:
        pass
        #import matplotlib

        # Force GTK3 backend. By default GTK2 gets loaded and conflicts with
        # graph-tool

        #matplotlib.use('GTK3Agg')
        #global plt
        #import matplotlib.pyplot as plt
    sanity_check_input(sys, prop, opts)
    run_secam(sys, prop, opts)
Ejemplo n.º 4
0
def main():
    logger.info('execution begins')

    usage = '%(prog)s <filename>'
    parser = argparse.ArgumentParser(description='CPFuzz', usage=usage)
    parser.add_argument('-f',
                        '--filename',
                        default=None,
                        metavar='file_path.tst')
    # uniform random fuzz
    parser.add_argument('-s',
                        '--simulate',
                        type=int,
                        metavar='num-sims',
                        help='simulate')

    # todo: fuzz using robust value
    parser.add_argument('-x',
                        '--robust',
                        type=int,
                        metavar='num-sims',
                        help='using mtl robust value')

    parser.add_argument('-p',
                        '--plot',
                        action='store_true',
                        help='enable plotting')

    parser.add_argument('--dump',
                        action='store_true',
                        help='dump trace in mat file')

    parser.add_argument('--seed',
                        type=int,
                        metavar='seed_value',
                        help='seed for the random generator')

    args = parser.parse_args()

    if args.filename is None:
        print('No file to test. Please use --help')
        exit()
    else:
        filepath = args.filename

    if args.seed is not None:
        np.random.seed(args.seed)

    Options = type('Options', (), {})
    opts = Options()
    opts.plot = args.plot

    sys, prop = loadsystem.parse(filepath)
    # if not os.path.exists(sys.path+"/fuzz-target"):
    create_harness(sys, prop)
    print("harness generated")
    create_corpus(sys, prop)

    # try:
    #     thread.start_new_thread( setup_plant, (sys,prop) )
    # except:
    #     print("Error: unable to start thread")

    num_segments = prop.num_segments
    num_dims = sys.num_dims
    if (prop.ci.h - prop.ci.l > 0).any():
        cmd = 'afl-fuzz -P ' + filepath + '  -m none -i seed_corpus -o out -- ' + sys.path + '/fuzz-target %d %d %d %d %d %d' % (
            num_segments, num_dims.ci, num_dims.si, num_dims.sf, num_dims.x,
            num_dims.u)
    else:
        cmd = 'afl-fuzz -P ' + filepath + ' -m none -i seed_corpus -o out -- ' + sys.path + '/fuzz-target %d %d %d %d %d %d' % (
            num_segments, 0, num_dims.si, num_dims.sf, num_dims.x, num_dims.u)

    f = open('fuzz.sh', 'w')
    f.write('#!/bin/sh\n' + cmd)
    f.close()
    setup_plant(sys, prop)
Ejemplo n.º 5
0
def main():
    logger.info('execution begins')
    LIST_OF_SYEMX_ENGINES = ['klee', 'pathcrawler']
    LIST_OF_CONTROLLER_REPRS = ['smt2', 'trace']
    LIST_OF_TRACE_STRUCTS = ['list', 'tree']
    LIST_OF_REFINEMENTS = ['init', 'trace', 'model-dft', 'model-dmt',
                           'model-dct', 'model-rel']
    LIST_OF_GRAPH_LIBS = ['nx', 'gt', 'g']
    LIST_OF_PLOT_LIBS = ['mp', 'pg']

    parser = argparse.ArgumentParser(
            description='S3CAM',
            usage='%(prog)s <filename>',
            formatter_class=argparse.ArgumentDefaultsHelpFormatter)
    parser.add_argument('-f', '--filename', default=None, metavar='file_path.tst')

    #parser.add_argument('--run-benchmarks', action="store_true", default=False,
    #                    help='run pacakged benchmarks')

    parser.add_argument('-s', '--simulate', type=int, metavar='num-sims',
                        help='simulate')
    parser.add_argument('-c', '--ss-concrete', action="store_true",
                        help='scatter & simulate')

    parser.add_argument('-cn', '--ss-concrete-no-controller', action="store_true",
                        help='scatter & simulate')

    parser.add_argument('--ss-concolic', action="store_true",
                        help='scatter & simulate with concolic execution using KLEE')
    parser.add_argument('-x', '--ss-symex', type=str, choices=LIST_OF_SYEMX_ENGINES,
                        help='SS + SymEx with static paths')

    parser.add_argument('-r', '--cntrl-rep', type=str, choices=LIST_OF_CONTROLLER_REPRS,
                        help='Controller Representation')

#     parser.add_argument('-p', '--plot', action='store_true',
#                         help='enable plotting')

    parser.add_argument('--dump', action='store_true',
                        help='dump trace in mat file')

    parser.add_argument('--seed', type=int, metavar='integer_seed_value',
                        help='seed for the random generator')

    # TAG:MSH
    parser.add_argument('--meng', type=str, metavar='engine_name',
                        help='Shared Matlab Engine name')

    parser.add_argument('-t', '--trace-struct', type=str, default='tree',
                        choices=LIST_OF_TRACE_STRUCTS, help='structure for cntrl-rep')

    parser.add_argument('--refine', type=str, default='init',
                        choices=LIST_OF_REFINEMENTS, help='Refinement method')

    parser.add_argument('--incl-error', action='store_true',
                        help='Include errors in model for bmc')

    parser.add_argument('-o', '--output', type=str, default='vio.log',
                        help='violation log')

    parser.add_argument('-g', '--graph-lib', type=str, default='nx',
                        choices=LIST_OF_GRAPH_LIBS, help='graph library')

    parser.add_argument('-p', '--plot', type=str, nargs='?',
                        default=None, const='mp',
                        choices=LIST_OF_PLOT_LIBS, help='plot library')

    parser.add_argument('--plots', type=plotting.plot_opts_parse, default='',
                        nargs='+', help='plots x vs y: t-x1 x0-x1')

    parser.add_argument('--max-paths', type=int, default=100,
                        help='max number of paths to use for refinement')

    # TODO: remove this before thigns get too fancy.
    # Add a simple package interface so benchmarks/tests can be
    # written as python files and can call s3cam using an API
    parser.add_argument('--pvt-init-data', type=str, default=None,
                        help='will set pvt_init_data in the supplied .tst file')

    # TODO: This error can be computed against the cell sizes?
    parser.add_argument('--max-model-error', type=float, default=float('inf'),
                        help='split cells till model error (over a single step) <= max-error')

    parser.add_argument('--plot-opts', type=str, default=(),
                        nargs='+', help='additional lib specific plotting opts')

    parser.add_argument('--prop-check', action='store_true',
                        help='Check violations by analyze the entire '
                        'trace, instead of relying only on x(t_end).')

    parser.add_argument('--bmc-engine', type=str,
                        choices=["sal","s3camsmt"],
                        default="s3camsmt",
                        help='Choose the bmc engine')


#    argcomplete.autocomplete(parser)
    args = parser.parse_args()
    #print(args)

    if args.filename is None:
        print('No file to test. Please use --help')
        exit()
    else:
        filepath = args.filename

    if args.seed is not None:
        np.random.seed(args.seed)

    # TODO:
    # dynamicall generate an opt class to mimic the same defined in
    # loadsystem.py
    # switch this to a reg class later.
    Options = type('Options', (), {})
    opts = Options()
    if args.simulate is not None:
        opts.MODE = 'simulate'
        opts.num_sim_samples = args.simulate
    elif args.ss_concrete:
        opts.MODE = 'falsify'
        opts.METHOD = 'concrete'
    elif args.ss_concrete_no_controller:
        opts.MODE = 'falsify'
        opts.METHOD = 'concrete_no_controller'
    elif args.ss_concolic:
        opts.MODE = 'falsify'
        opts.METHOD = 'concolic'
        print('removed concolic (KLEE)')
        exit(0)
    elif args.ss_symex is not None:
        opts.MODE = 'falsify'
        opts.METHOD = 'symbolic'
        opts.symbolic_analyzer = args.ss_symex
        #if opts.symbolic_analyzer not in LIST_OF_SYEMX_ENGINES:
        #    raise err.Fatal('unknown symbolic analyses engine requested.')
        if args.cntrl_rep is None:
            raise err.Fatal('controller representation must be provided')
        else:
            opts.cntrl_rep = args.cntrl_rep
            opts.trace_struct = args.trace_struct
    else:
        raise err.Fatal('no options passed. Check usage.')

    #opts.plot = args.plot
    opts.dump_trace = args.dump
    opts.refine = args.refine
    opts.op_fname = args.output
    opts.sys_path = filepath
    opts.graph_lib = args.graph_lib
    opts.max_paths = args.max_paths
    opts.max_model_error = args.max_model_error
    opts.plotting = plotting.factory(args.plot, *args.plot_opts)
    opts.plots = args.plots
    opts.model_err = args.incl_error
    opts.bmc_engine = args.bmc_engine

    sys, prop = loadsystem.parse(filepath, args.pvt_init_data)
    if args.prop_check:
        opts.property_checker = properties.PropertyChecker(prop.final_cons)
    else:
        opts.property_checker = properties.PropertyCheckerNeverDetects()

    # TAG:MSH
    matlab_engine = args.meng
    sys.init_sims(opts.plotting, opts.property_checker, psim_args=matlab_engine)

    sanity_check_input(sys, prop, opts)
    run_secam(sys, prop, opts)