Module Abstract_domain

module Abstract_domain: sig .. end

Abstract domains of the analysis.

An abstract domain is a collection of abstract states propagated through the control flow graph by a dataflow analysis. At a program point, they are abstractions of the set of possible concrete states that may arise during any execution of the program.

In Eva, different abstract domains may communicate through alarms, values and locations. Alarms report undesirable behaviors that may occur during an execution of the program. They are defined in Alarmset, while values and locations depend on the domain. Values are numerical and non-relational abstractions of the set of the possible values of expressions at a program point. Locations are similar abstractions for memory locations. The main values and locations used in the analyzer are respectively available in Main_values and Main_locations. Values and locations abstractions are extensible, should a domain requires new abstractions. Their signature are in Abstract_value.S and Abstract_location.S.

Lvalues and expressions are cooperatively evaluated into locations and values using all the information provided by all domains. These computed values and locations are then available for the domain transformers which model the action of statements on abstract states. However, a domain could ignore this mechanism; its values and locations should then be the unit type.

This file gathers the definition of the module types for an abstract domain.

The module type Abstract_domain.S requires all the functions to be implemented to define the abstract semantics of a domain, divided in four categories:

Abstract_domain.Lattice gives a semi-lattice structure to the abstract states.
Abstract_domain.Queries extracts information from a state, by giving a value to an expression. They are used when evaluating expressions.
Abstract_domain.Transfer are the transfer functions of the domain for assignments, assumptions and function calls. These functions use the values and locations computed by the evaluation of the expressions involved in a given statement. These values and locations are made available through a Abstract_domain.valuation record.
The remaining functions are essentially dedicated to the evaluation of logical predicates, to the initialization of an initial state, and to the Mem_exec cache.

The module type S_with_Structure is Abstract_domain.S, plus a special OCaml value describing the internal structure of the domain and identifying it. This structure enables automatic accessors to the domain when combined to others. See Structure for details. S_with_Structure is the interface to implement in order to introduce a now domain in Eva.

The module type Abstract_domain.Internal contains some other functionalities needed by the analyzer, but that can be automatically generated from the previous one. The functor Domain_builder.Complete produces an Abstract_domain.Internal module from a S_with_Structure one.

Abstract_domain.Internal modules can then be lifted on more general values and locations through Domain_lift.Make, and be combined through Domain_product.Make.

Finally, External is the type of the final modules built and used by Eva. It contains the generic accessors to specific domains, described in Interface.

module type Lattice = sig .. end

Lattice structure of a domain.

module type Queries = sig .. end

Extraction of information: queries for values or locations inferred by a domain about expressions and lvalues.

type ('value, 'location, 'origin) valuation = {

`find : Cil_types.exp -> ('value, 'origin) Eval.record_val Eval.or_top;`	`(*`	Finds the value computed for an expression. The returned record also contains the origin provided by the domain for the given expression, the alarms emitted by its evaluation and whether its value has been reduced. Returns `Top if the expression has not been evaluated.	`*)`
`fold : 'a. (Cil_types.exp -> ('value, 'origin) Eval.record_val -> 'a -> 'a) -> 'a -> 'a;`	`(*`	`fold f a` computes (f eN rN ... (f e1 r1 a)...), where e1 ... eN are the evaluated (sub)expressions and r1 ... rN are the computed records for each of these expressions. The record of an expression contains its value, reduction status, origin and alarms.	`*)`
`find_loc : Cil_types.lval -> 'location Eval.record_loc Eval.or_top;`	`(*`	Finds the location computed for an lvalue. The returned record also contains the lvalue type and the alarms emitted by its evaluation. Returns `Top if the lvalue has not been evaluated.	`*)`

}

Results of an evaluation: the results of all intermediate calculation (the value of each (sub)expression and the location of each lvalue) are available to the domain. As the evaluation results into a mapping from exp to record_val and from lval to record_loc, we define as Abstract_domain.valuation the classic functions to retrieve information from a map.

module type Transfer = sig .. end

Transfer function of the domain.

type 'state logic_environment = {

	`states : Cil_types.logic_label -> 'state;`	`(*`	`result` contains the variable corresponding to \result. It is None when \result is meaningless.	`*)`
	`result : Cil_types.varinfo option;`

}

Environment for the logical evaluation of predicates.

type variable_kind =

`\|`	`Global`	`(*`	Global variable.	`*)`
`\|`	`Formal of Cil_types.kernel_function`	`(*`	Formal parameter of a function.	`*)`
`\|`	`Local of Cil_types.kernel_function`	`(*`	Local variable of a function.	`*)`
`\|`	`Result of Cil_types.kernel_function`	`(*`	Special variable storing the return value of a call. Assigned at the end of the called function, and used at the call site. Also used to model the ACSL \result construct.	`*)`

type init_value =

`\|`	`Zero`
`\|`	`Top`

Value for the initialization of variables. Can be either zero or top.

module type Reuse = sig .. end

MemExec is a global cache for the complete analysis of functions.

module type S = sig .. end

Signature for the abstract domains of the analysis.

module type Store = sig .. end

Automatic storage of the states computed during the analysis.

module type Internal = sig .. end

Full implementation of domains.

type 't key = 't Structure.Key_Domain.key

module type Leaf = sig .. end

Signature for a leaf module of a domain.