def _check_invariant(self, syscall, lemma):
inv = getattr(spec, 'spec_lemma_{}'.format(lemma))
args = syscall_spec.get_syscall_args(syscall)
kwargs = {}
if 'syscall' in inspect.getargspec(inv)[0]:
kwargs['syscall'] = syscall
if 'oldstate' in inspect.getargspec(inv)[0]:
kwargs['oldstate'] = self.state
pre = z3.And(spec.spec_invariants(self.state),
inv(self.state, **kwargs))
self.solver.add(pre)
cond, newstate = getattr(spec, syscall)(self.state, *args)
model = self._prove(z3.And(spec.spec_invariants(newstate),
inv(newstate, **kwargs)),
pre=pre,
return_model=INTERACTIVE,
minimize=MODEL_HI)
if INTERACTIVE and model:
from ipdb import set_trace
set_trace()
def _syscall_generic(self, name):
args = syscall_spec.get_syscall_args(name)
res = self.ctx.call('@' + name, *args)
cond, newstate = getattr(spec, name)(self.state, *args)
model = self._prove(z3.And(spec.state_equiv(self.ctx, newstate),
cond == (res == util.i32(0))),
pre=z3.And(self._pre_state, z3.BoolVal(True)),
return_model=INTERACTIVE)
if INTERACTIVE and model:
from ipdb import set_trace
set_trace()
def _syscall_generic(self, name):
args = syscall_spec.get_syscall_args(name)
res = self.ctx.call('@' + name, *args) #ctx(impl)变换(res为smt) 执行hv6中的self.globals[fn](self, *args)，重点是执行branch函数进行符号执行（本质是执行c语句）（（没有调用的情况下执行语句））（（（执行过程中会检查是否满足spec的条件）））
print "\n×××××××××××"
print "res:\n{}".format(res)
print "\n×××××××××××"
cond, newstate = getattr(spec, name)(self.state, *args) #内核状态变换(cond为smt)
print "\n×××××××××××"
print "cond:\n{}".format(cond.type)
print "\n×××××××××××"
# import pdb
# pdb.set_trace() spec.state_equiv(self.ctx, newstate)
model = self._prove(z3.And(z3.BoolVal(True), #impl和spec分别执行后，状态是否等价
cond == (res == util.i32(0))),
pre=z3.And(self._pre_state, z3.BoolVal(True)),
return_model=INTERACTIVE)
if INTERACTIVE and model:
from ipdb import set_trace
set_trace()