├── qemu ├── VERSION ├── target-m68k │ ├── machine.c │ ├── m68k-qreg.h │ └── qregs.def ├── target-sh4 │ └── machine.c ├── default-configs │ ├── s390x-softmmu.mak │ ├── cris-linux-user.mak │ ├── i386-bsd-user.mak │ ├── i386-linux-user.mak │ ├── mips-linux-user.mak │ ├── sh4-linux-user.mak │ ├── sparc-bsd-user.mak │ ├── x86_64-bsd-user.mak │ ├── alpha-linux-user.mak │ ├── i386-darwin-user.mak │ ├── mips64-linux-user.mak │ ├── mipsel-linux-user.mak │ ├── s390x-linux-user.mak │ ├── sh4eb-linux-user.mak │ ├── sparc-linux-user.mak │ ├── sparc64-bsd-user.mak │ ├── x86_64-linux-user.mak │ ├── mips64el-linux-user.mak │ ├── mipsn32-linux-user.mak │ ├── mipsn32el-linux-user.mak │ ├── sparc64-linux-user.mak │ ├── unicore32-linux-user.mak │ ├── microblaze-linux-user.mak │ ├── sparc32plus-linux-user.mak │ ├── microblazeel-linux-user.mak │ ├── arm-linux-user.mak │ ├── m68k-linux-user.mak │ ├── ppc-darwin-user.mak │ ├── ppc-linux-user.mak │ ├── armeb-linux-user.mak │ ├── ppc64-linux-user.mak │ ├── ppc64abi32-linux-user.mak │ ├── cris-softmmu.mak │ ├── m68k-softmmu.mak │ ├── xtensa-softmmu.mak │ ├── xtensaeb-softmmu.mak │ ├── microblaze-softmmu.mak │ ├── microblazeel-softmmu.mak │ ├── lm32-softmmu.mak │ ├── sh4-softmmu.mak │ ├── sh4eb-softmmu.mak │ ├── sparc-softmmu.mak │ ├── alpha-softmmu.mak │ ├── sparc64-softmmu.mak │ └── pci.mak ├── roms │ ├── config.seabios │ ├── configure-seabios.sh │ ├── Makefile │ └── s2ebios │ │ └── s2e-bios-up.asm ├── config.h ├── linux-user │ ├── cpu-uname.h │ ├── unicore32 │ │ └── termbits.h │ ├── sparc │ │ └── syscall.h │ ├── sparc64 │ │ └── syscall.h │ ├── sh4 │ │ └── syscall.h │ └── m68k │ │ └── syscall.h ├── pc-bios │ ├── keymaps │ │ ├── nl-be │ │ └── modifiers │ ├── bamboo.dtb │ ├── bios.bin │ ├── slof.bin │ ├── kvmvapic.bin │ ├── openbios-ppc │ ├── ppc_rom.bin │ ├── sgabios.bin │ ├── vgabios.bin │ ├── linuxboot.bin │ ├── mpc8544ds.dtb │ ├── multiboot.bin │ ├── palcode-clipper │ ├── pxe-e1000.rom │ ├── pxe-pcnet.rom │ ├── pxe-rtl8139.rom │ ├── pxe-virtio.rom │ ├── s390-zipl.rom │ ├── spapr-rtas.bin │ ├── vgabios-qxl.bin │ ├── openbios-sparc32 │ ├── openbios-sparc64 │ ├── pxe-eepro100.rom │ ├── pxe-ne2k_pci.rom │ ├── petalogix-ml605.dtb │ ├── vgabios-cirrus.bin │ ├── vgabios-stdvga.bin │ ├── vgabios-vmware.bin │ ├── petalogix-s3adsp1800.dtb │ └── Makefile ├── scripts │ └── qtest ├── hw │ ├── msmouse.h │ ├── empty_slot.h │ ├── sh7750_regnames.h │ ├── dec_pci.h │ ├── mips-bios.h │ ├── microblaze_pic_cpu.h │ ├── cris-boot.h │ ├── qdev-addr.h │ ├── apb_pci.h │ ├── vmware_vga.h │ ├── primecell.h │ ├── ioh3420.h │ ├── mc146818rtc.h │ ├── lm32_juart.h │ ├── vt82c686.h │ ├── xio3130_upstream.h │ ├── bitbang_i2c.h │ ├── escc.h │ ├── microblaze_boot.h │ ├── multiboot.h │ ├── audiodev.h │ ├── sharpsl.h │ ├── lm32_pic.h │ ├── ps2.h │ ├── mips_cpudevs.h │ ├── xio3130_downstream.h │ ├── esp.h │ ├── sparc32_dma.h │ ├── 9p.h │ ├── apm.h │ ├── kvm │ │ └── clock.h │ ├── xen_domainbuild.h │ ├── lm32.h │ └── pm_smbus.h ├── tests │ ├── tcg │ │ ├── pi_10.com │ │ ├── alpha │ │ │ ├── hello-alpha.c │ │ │ └── crt.s │ │ ├── cris │ │ │ ├── README │ │ │ ├── check_hello.c │ │ │ ├── check_openpf4.c │ │ │ ├── .gdbinit │ │ │ ├── crt.s │ │ │ ├── check_cmp-2.s │ │ │ ├── check_stat1.c │ │ │ ├── check_ret.s │ │ │ ├── check_stat2.c │ │ │ ├── check_time2.c │ │ │ ├── sys.h │ │ │ ├── check_movprv32.s │ │ │ ├── check_gcctorture_pr28634-1.c │ │ │ ├── check_clearfv32.s │ │ │ ├── check_openpf2.c │ │ │ ├── check_gcctorture_pr28634.c │ │ │ └── check_sigalrm.c │ │ ├── xtensa │ │ │ ├── test_fail.S │ │ │ ├── test_mul32.S │ │ │ ├── crt.S │ │ │ └── test_boolean.S │ │ └── lm32 │ │ │ ├── test_b.S │ │ │ ├── test_ret.S │ │ │ ├── test_calli.S │ │ │ ├── test_call.S │ │ │ ├── test_bi.S │ │ │ ├── test_break.S │ │ │ ├── test_scall.S │ │ │ ├── test_sextb.S │ │ │ ├── test_sexth.S │ │ │ ├── test_sli.S │ │ │ ├── test_divu.S │ │ │ ├── test_bret.S │ │ │ ├── test_eret.S │ │ │ ├── test_sb.S │ │ │ ├── test_sh.S │ │ │ ├── test_lw.S │ │ │ ├── test_cmpei.S │ │ │ ├── test_modu.S │ │ │ ├── test_ori.S │ │ │ ├── test_cmpnei.S │ │ │ ├── test_xori.S │ │ │ ├── test_andi.S │ │ │ └── test_be.S │ ├── qemu-iotests │ │ ├── 030.out │ │ ├── .gitignore │ │ ├── Makefile │ │ ├── 006.out │ │ ├── 012.out │ │ ├── 007.out │ │ ├── 005.out │ │ ├── 029.out │ │ ├── 001.out │ │ └── 008.out │ ├── s2earm │ │ └── buildHello.sh │ ├── check-block.sh │ └── qemu-iotests-quick.sh ├── README ├── target-lm32 │ ├── TODO │ └── helper.h ├── linux-headers │ ├── README │ └── asm-s390 │ │ └── kvm_para.h ├── darwin-user │ ├── ioctls_types.h │ └── ioctls.h ├── qom │ └── Makefile ├── tcg │ ├── LICENSE │ └── TODO ├── bt-host.h ├── bsd-user │ ├── sparc │ │ └── syscall.h │ ├── sparc64 │ │ └── syscall.h │ ├── x86_64 │ │ └── target_signal.h │ └── i386 │ │ └── target_signal.h ├── s2e │ └── Signals │ │ ├── build.sh │ │ └── signals.cpp ├── target-microblaze │ └── machine.c ├── trace │ └── stderr.h ├── qemu-x509.h ├── libcacard │ └── libcacard.pc.in ├── target-arm │ └── target-defs.h ├── audio │ └── audio_win_int.h ├── qemu-thread-posix.h ├── target-cris │ └── mmu.h ├── Makefile.dis ├── qemu-thread-win32.h ├── target-xtensa │ └── core-fsf.c ├── LICENSE ├── envlist.h ├── pflib.h └── qapi │ └── qapi-types-core.h ├── s2e.creator ├── klee ├── include │ └── klee │ │ ├── Config │ │ └── common.h │ │ └── Internal │ │ └── README.txt ├── runtime │ ├── POSIX │ │ └── testing-dir │ │ │ ├── d │ │ │ ├── a │ │ │ ├── b │ │ │ └── c │ ├── klee-libc │ │ ├── abort.c │ │ ├── strcmp.c │ │ ├── tolower.c │ │ ├── toupper.c │ │ ├── strlen.c │ │ ├── strcpy.c │ │ ├── memset.c │ │ └── strcoll.c │ └── Intrinsic │ │ ├── klee_int.c │ │ ├── memset.c │ │ └── klee_div_zero_check.c ├── test │ ├── README │ ├── Expr │ │ ├── dg.exp │ │ ├── Lexer │ │ │ └── dg.exp │ │ ├── Parser │ │ │ ├── dg.exp │ │ │ └── Concat64.pc │ │ └── Evaluate2.pc │ ├── Solver │ │ ├── dg.exp │ │ └── FastCexSolver.pc │ ├── CXX │ │ ├── dg.exp │ │ ├── Trivial.cpp │ │ ├── StaticConstructor.cpp │ │ ├── StaticDestructor.cpp │ │ └── New.cpp │ ├── Coverage │ │ ├── dg.exp │ │ ├── ReadArgs.c │ │ └── ReplayOutDir.c │ ├── Dogfood │ │ └── dg.exp │ ├── Feature │ │ ├── dg.exp │ │ ├── DoubleFree.c │ │ ├── OneFreeError.c │ │ ├── OneOutOfBounds.c │ │ ├── DumpStatesOnHalt.c │ │ ├── CallToUndefinedExternal.cpp │ │ ├── ExternalWeakLinkage.c │ │ ├── IndirectCallToExternal.c │ │ ├── DefineFixedObject.c │ │ ├── IndirectCallToBuiltin.c │ │ ├── ByteSwap.c │ │ ├── IsSymbolic.c │ │ ├── ReallocFailure.c │ │ ├── GetValue.c │ │ ├── MakeSymbolicName.c │ │ ├── MakeConcreteSymbolic.c │ │ ├── Float.c │ │ ├── PreferCex.c │ │ ├── WriteCov.c │ │ ├── Envp.c │ │ ├── DanglingConcreteReadExpr.c │ │ ├── Optimize.c │ │ ├── WithLibc.c │ │ ├── OverlappedError.c │ │ └── Alias.c │ ├── Programs │ │ └── dg.exp │ ├── regression │ │ ├── dg.exp │ │ ├── 2007-08-08-free-zero.c │ │ ├── 2007-10-11-free-of-alloca.c │ │ ├── 2008-03-04-free-of-global.c │ │ ├── 2008-04-10-bad-alloca-free.c │ │ ├── 2008-05-23-gep-with-global-const.c │ │ ├── 2008-03-11-free-of-malloc-zero.c │ │ ├── 2007-07-25-invalid-stp-array-binding-to-objectstate.c │ │ ├── 2007-07-30-unflushed-byte.c │ │ ├── 2007-08-06-64bit-shift.c │ │ ├── 2007-08-01-cache-unclear-on-overwrite-flushed.c │ │ └── 2007-10-11-illegal-access-after-free-and-branch.c │ ├── Runtime │ │ ├── Uclibc │ │ │ ├── dg.exp │ │ │ ├── Environ.c │ │ │ ├── 2008-03-04-libc-atexit-uses-dso-handle.c │ │ │ └── 2007-10-08-optimization-calls-wrong-libc-functions.c │ │ └── POSIX │ │ │ ├── dg.exp │ │ │ ├── Fcntl.c │ │ │ ├── FreeArgv.c │ │ │ └── Getenv.c │ └── Concrete │ │ ├── GlobalVariable.ll │ │ ├── UnconditionalBranch.ll │ │ ├── OneCall.ll │ │ ├── BoolReadWrite.ll │ │ ├── UnconditionalBranchWithSimplePhi.ll │ │ ├── CmpEq.ll │ │ ├── InvokeAndReturn.ll │ │ ├── InvokeAndUnwindOnce.ll │ │ ├── UnorderedPhiNodes.ll │ │ ├── OverlappingPhiNodes.ll │ │ ├── BitwiseOps.ll │ │ ├── ackermann.c │ │ ├── Select.ll │ │ ├── SimpleStoreAndLoad.ll │ │ ├── InvokeAndUnwindTwice.ll │ │ └── Shifts.ll ├── tools │ ├── klee-replay │ │ ├── fd_init.c │ │ ├── klee_init_env.c │ │ └── Makefile │ ├── gen-random-bout │ │ └── Makefile │ ├── klee-config │ │ └── FinalLibDeps.txt │ └── klee │ │ └── Debug.cpp ├── www │ └── content │ │ ├── coreutils_kc_0.png │ │ └── coreutils_kc_1.png ├── utils │ └── valgrind │ │ ├── README.txt │ │ └── valgrind-llvm.supp ├── lib │ ├── Support │ │ ├── README.txt │ │ └── Makefile │ ├── Basic │ │ ├── README.txt │ │ └── Makefile │ ├── Core │ │ ├── KleeExecutor.cpp │ │ └── Makefile │ ├── Makefile │ ├── Expr │ │ └── Makefile │ ├── Module │ │ ├── Makefile │ │ └── KInstruction.cpp │ └── Solver │ │ └── Makefile ├── stp │ ├── bitvec │ │ └── Makefile │ ├── constantbv │ │ └── Makefile │ ├── INSTALL │ ├── c_interface │ │ └── Makefile │ ├── simplifier │ │ └── Makefile │ ├── stp │ │ └── Makefile │ └── Makefile.common.in ├── unittests │ ├── Expr │ │ └── Makefile │ ├── Solver │ │ └── Makefile │ ├── Makefile │ └── TestMain.cpp ├── examples │ └── islower │ │ └── islower.c └── docs │ ├── intro │ └── SMT-COMP │ └── QF_AUFBV.smt ├── stp ├── tests │ ├── misc-tests │ │ ├── no-query.cvc │ │ └── cryptominisat-bug.cvc │ ├── bio-tests │ │ ├── easy-sat-bio.cvc.tar.gz │ │ ├── hard-sat-bio.cvc.tar.gz │ │ └── easy-unsat-bio.cvc.tar.gz │ ├── generated_tests │ │ ├── Makefile │ │ ├── runMulDivRem.sh │ │ ├── extract.pl │ │ └── run-experiments.pl │ ├── sample-tests │ │ ├── variable-rightshift-valid.cvc │ │ ├── variable-rightshift-invalid.cvc │ │ ├── a107test0001.cvc │ │ ├── a15test0001.cvc │ │ ├── a105test0001.cvc │ │ ├── a126test0001.cvc │ │ ├── a103test0001.cvc │ │ ├── a12test0001.cvc │ │ ├── a100test0001.cvc │ │ ├── a13test0002.cvc │ │ ├── a176test0022.cvc │ │ ├── a101test0002.cvc │ │ ├── a185test0001.cvc │ │ ├── a186test0002.cvc │ │ ├── a114test0001.cvc │ │ ├── a121test0001.cvc │ │ ├── a167test0001.cvc │ │ ├── a116test0003.cvc │ │ ├── a124test0004.cvc │ │ ├── a115test0002.cvc │ │ └── a163test0021.cvc │ ├── c-api-tests │ │ ├── stp-bool.c │ │ ├── parsefile-using-cinterface.c │ │ └── print.c │ ├── crypto-tests │ │ ├── t3.stp │ │ └── t3_flat.stp │ └── sample-smt-tests │ │ └── working_54.smt ├── include │ └── stp │ │ └── c_interface.h ├── windows │ ├── winports │ │ ├── msc99hdr │ │ │ └── unistd.h │ │ └── compdep.h │ ├── README │ └── cmakemods │ │ └── staticrt.cmake ├── papers │ ├── EXE-STP.pdf │ ├── vijayganesh-stp-paper.pdf │ └── EXE-STP-TISSEC-Journal-2007.pdf ├── src │ ├── sat │ │ ├── cryptominisat2 │ │ │ └── VERSION │ │ ├── core │ │ │ └── Makefile │ │ ├── core_prop │ │ │ └── Makefile │ │ ├── simp │ │ │ └── Makefile │ │ ├── utils │ │ │ └── Makefile │ │ └── README │ ├── to-sat │ │ ├── AIG │ │ │ └── BBNodeManagerAIG.cpp │ │ └── Makefile │ ├── simplifier │ │ ├── MutableASTNode.cpp │ │ └── Makefile │ ├── boost │ │ ├── config │ │ │ ├── abi │ │ │ │ ├── msvc_suffix.hpp │ │ │ │ └── borland_suffix.hpp │ │ │ └── platform │ │ │ │ └── amigaos.hpp │ │ ├── pool │ │ │ └── detail │ │ │ │ ├── pool_construct.sh │ │ │ │ └── pool_construct_simple.sh │ │ └── type_traits │ │ │ ├── aligned_storage.hpp │ │ │ └── detail │ │ │ └── size_t_trait_undef.hpp │ ├── util │ │ └── Makefile │ ├── STPManager │ │ └── Makefile │ ├── extlib-constbv │ │ └── Makefile │ ├── absrefine_counterexample │ │ └── Makefile │ ├── c_interface │ │ └── Makefile │ ├── extlib-abc │ │ ├── Makefile │ │ └── aig │ │ │ └── cnf │ │ │ └── Makefile │ ├── printer │ │ └── Makefile │ └── ocaml-wrapper │ │ ├── Makefile │ │ └── libstp_regerrorhandler.c ├── clean-install.sh ├── unit_test │ ├── bvsge.smt2 │ ├── bvsgt.smt2 │ ├── bvxor.smt2 │ ├── orAlwaysTrue.smt2 │ ├── alwaysTrue.smt2 │ ├── bvnot.smt2 │ ├── bvor.smt2 │ ├── bvshift.smt2 │ ├── pure.smt2 │ ├── bvsgt2.smt2 │ ├── bvnor.smt2 │ ├── xor.smt2 │ ├── bvge1.smt2 │ ├── uncon_then_pure.smt │ ├── xor3.smt2 │ ├── bvand.smt2 │ ├── xor4.smt2 │ ├── writing_same.smt2 │ ├── bvand3.smt2 │ ├── sim.smt2 │ ├── bvge3.smt2 │ ├── bvmul_minus.smt2 │ ├── harald.smt2 │ ├── mod.smt2 │ ├── eq.smt2 │ ├── unc_shift.smt │ ├── unit_test.sh │ ├── bvconcat.smt2 │ ├── bvconcat2.smt2 │ ├── bvconcat3.smt2 │ ├── bvsolver.smt │ └── xor2.smt2 ├── CODING_GUIDLINES ├── scripts │ ├── liblinks.sh │ └── emacs-format-file └── DOWNLOAD ├── tools ├── tools │ ├── s2etools-config │ │ └── FinalLibDeps.txt │ ├── tbtrace │ │ └── Makefile │ ├── cacheprof │ │ └── Makefile │ ├── coverage │ │ └── Makefile │ ├── debugger │ │ └── Makefile │ ├── icounter │ │ └── Makefile │ ├── pfprofiler │ │ └── Makefile │ ├── forkprofiler │ │ └── Makefile │ └── Makefile ├── lib │ ├── Makefile │ ├── Utils │ │ ├── Makefile │ │ └── signals.cpp │ ├── BinaryReaders │ │ └── Makefile │ └── ExecutionTracer │ │ └── Makefile └── Makefile ├── docs ├── img │ └── lines.gif ├── Makefile ├── Plugins │ └── Tracers │ │ ├── TestCaseGenerator.rst │ │ └── InstructionCounter.rst └── Tools │ └── ExecutionProfiler.rst ├── s2e.config ├── .gitignore ├── guest ├── windbg-gdb │ ├── gdbsyms.def │ ├── StartSize.h │ └── Makefile └── configure ├── LICENSE └── config.lua /qemu/VERSION: -------------------------------------------------------------------------------- 1 | 1.0.50 2 | -------------------------------------------------------------------------------- /qemu/target-m68k/machine.c: -------------------------------------------------------------------------------- 1 | -------------------------------------------------------------------------------- /qemu/target-sh4/machine.c: -------------------------------------------------------------------------------- 1 | -------------------------------------------------------------------------------- /s2e.creator: -------------------------------------------------------------------------------- 1 | [General] 2 | -------------------------------------------------------------------------------- /klee/include/klee/Config/common.h: -------------------------------------------------------------------------------- 1 | -------------------------------------------------------------------------------- /klee/runtime/POSIX/testing-dir/d: -------------------------------------------------------------------------------- 1 | -------------------------------------------------------------------------------- /klee/test/README: -------------------------------------------------------------------------------- 1 | about tests.... 2 | -------------------------------------------------------------------------------- /klee/runtime/POSIX/testing-dir/a: -------------------------------------------------------------------------------- 1 | /dev/null -------------------------------------------------------------------------------- /klee/runtime/POSIX/testing-dir/b: -------------------------------------------------------------------------------- 1 | /dev/random -------------------------------------------------------------------------------- /stp/tests/misc-tests/no-query.cvc: -------------------------------------------------------------------------------- 1 | ASSERT FALSE; -------------------------------------------------------------------------------- /qemu/default-configs/s390x-softmmu.mak: -------------------------------------------------------------------------------- 1 | CONFIG_VIRTIO=y 2 | -------------------------------------------------------------------------------- /qemu/roms/config.seabios: -------------------------------------------------------------------------------- 1 | # empty, default config works for us 2 | -------------------------------------------------------------------------------- /stp/include/stp/c_interface.h: -------------------------------------------------------------------------------- 1 | ../../src/c_interface/c_interface.h -------------------------------------------------------------------------------- /tools/tools/s2etools-config/FinalLibDeps.txt: -------------------------------------------------------------------------------- 1 | executiontracer.a: 2 | -------------------------------------------------------------------------------- /klee/runtime/POSIX/testing-dir/c: -------------------------------------------------------------------------------- 1 | #!/bin/sh 2 | echo "Hello world!" 3 | -------------------------------------------------------------------------------- /qemu/config.h: -------------------------------------------------------------------------------- 1 | #include "config-host.h" 2 | #include "config-target.h" 3 | -------------------------------------------------------------------------------- /klee/tools/klee-replay/fd_init.c: -------------------------------------------------------------------------------- 1 | #include "../../runtime/POSIX/fd_init.c" 2 | -------------------------------------------------------------------------------- /docs/img/lines.gif: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/S2E/s2e-old/HEAD/docs/img/lines.gif -------------------------------------------------------------------------------- /qemu/linux-user/cpu-uname.h: -------------------------------------------------------------------------------- 1 | const char *cpu_to_uname_machine(void *cpu_env); 2 | -------------------------------------------------------------------------------- /qemu/pc-bios/keymaps/nl-be: -------------------------------------------------------------------------------- 1 | # Dutch (Belgium) 2 | map 0x813 3 | include common 4 | -------------------------------------------------------------------------------- /stp/windows/winports/msc99hdr/unistd.h: -------------------------------------------------------------------------------- 1 | /* this is a in-place holder 2 | 3 | */ 4 | -------------------------------------------------------------------------------- /qemu/default-configs/cris-linux-user.mak: -------------------------------------------------------------------------------- 1 | # Default configuration for cris-linux-user 2 | -------------------------------------------------------------------------------- /qemu/default-configs/i386-bsd-user.mak: -------------------------------------------------------------------------------- 1 | # Default configuration for i386-bsd-user 2 | -------------------------------------------------------------------------------- /qemu/default-configs/i386-linux-user.mak: -------------------------------------------------------------------------------- 1 | # Default configuration for i386-linux-user 2 | -------------------------------------------------------------------------------- /qemu/default-configs/mips-linux-user.mak: -------------------------------------------------------------------------------- 1 | # Default configuration for mips-linux-user 2 | -------------------------------------------------------------------------------- /qemu/default-configs/sh4-linux-user.mak: -------------------------------------------------------------------------------- 1 | # Default configuration for sh4-linux-user 2 | -------------------------------------------------------------------------------- /qemu/default-configs/sparc-bsd-user.mak: -------------------------------------------------------------------------------- 1 | # Default configuration for sparc-bsd-user 2 | -------------------------------------------------------------------------------- /qemu/default-configs/x86_64-bsd-user.mak: -------------------------------------------------------------------------------- 1 | # Default configuration for x86_64-bsd-user 2 | -------------------------------------------------------------------------------- /qemu/scripts/qtest: -------------------------------------------------------------------------------- 1 | #!/bin/sh 2 | 3 | export QTEST_QEMU_BINARY=$1 4 | shift 5 | "$@" 6 | -------------------------------------------------------------------------------- /klee/tools/klee-replay/klee_init_env.c: -------------------------------------------------------------------------------- 1 | #include "../../runtime/POSIX/klee_init_env.c" 2 | -------------------------------------------------------------------------------- /qemu/default-configs/alpha-linux-user.mak: -------------------------------------------------------------------------------- 1 | # Default configuration for alpha-linux-user 2 | -------------------------------------------------------------------------------- /qemu/default-configs/i386-darwin-user.mak: -------------------------------------------------------------------------------- 1 | # Default configuration for i386-darwin-user 2 | -------------------------------------------------------------------------------- /qemu/default-configs/mips64-linux-user.mak: -------------------------------------------------------------------------------- 1 | # Default configuration for mips64-linux-user 2 | -------------------------------------------------------------------------------- /qemu/default-configs/mipsel-linux-user.mak: -------------------------------------------------------------------------------- 1 | # Default configuration for mipsel-linux-user 2 | -------------------------------------------------------------------------------- /qemu/default-configs/s390x-linux-user.mak: -------------------------------------------------------------------------------- 1 | # Default configuration for s390x-linux-user 2 | -------------------------------------------------------------------------------- /qemu/default-configs/sh4eb-linux-user.mak: -------------------------------------------------------------------------------- 1 | # Default configuration for sh4eb-linux-user 2 | -------------------------------------------------------------------------------- /qemu/default-configs/sparc-linux-user.mak: -------------------------------------------------------------------------------- 1 | # Default configuration for sparc-linux-user 2 | -------------------------------------------------------------------------------- /qemu/default-configs/sparc64-bsd-user.mak: -------------------------------------------------------------------------------- 1 | # Default configuration for sparc64-bsd-user 2 | -------------------------------------------------------------------------------- /qemu/default-configs/x86_64-linux-user.mak: -------------------------------------------------------------------------------- 1 | # Default configuration for x86_64-linux-user 2 | -------------------------------------------------------------------------------- /qemu/pc-bios/bamboo.dtb: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/S2E/s2e-old/HEAD/qemu/pc-bios/bamboo.dtb -------------------------------------------------------------------------------- /qemu/pc-bios/bios.bin: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/S2E/s2e-old/HEAD/qemu/pc-bios/bios.bin -------------------------------------------------------------------------------- /qemu/pc-bios/slof.bin: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/S2E/s2e-old/HEAD/qemu/pc-bios/slof.bin -------------------------------------------------------------------------------- /stp/papers/EXE-STP.pdf: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/S2E/s2e-old/HEAD/stp/papers/EXE-STP.pdf -------------------------------------------------------------------------------- /qemu/default-configs/mips64el-linux-user.mak: -------------------------------------------------------------------------------- 1 | # Default configuration for mips64el-linux-user 2 | -------------------------------------------------------------------------------- /qemu/default-configs/mipsn32-linux-user.mak: -------------------------------------------------------------------------------- 1 | # Default configuration for mipsn32-linux-user 2 | -------------------------------------------------------------------------------- /qemu/default-configs/mipsn32el-linux-user.mak: -------------------------------------------------------------------------------- 1 | # Default configuration for mipsn32el-linux-user 2 | -------------------------------------------------------------------------------- /qemu/default-configs/sparc64-linux-user.mak: -------------------------------------------------------------------------------- 1 | # Default configuration for sparc64-linux-user 2 | -------------------------------------------------------------------------------- /qemu/default-configs/unicore32-linux-user.mak: -------------------------------------------------------------------------------- 1 | # Default configuration for unicore32-linux-user 2 | -------------------------------------------------------------------------------- /qemu/hw/msmouse.h: -------------------------------------------------------------------------------- 1 | /* msmouse.c */ 2 | CharDriverState *qemu_chr_open_msmouse(QemuOpts *opts); 3 | -------------------------------------------------------------------------------- /qemu/pc-bios/kvmvapic.bin: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/S2E/s2e-old/HEAD/qemu/pc-bios/kvmvapic.bin -------------------------------------------------------------------------------- /qemu/pc-bios/openbios-ppc: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/S2E/s2e-old/HEAD/qemu/pc-bios/openbios-ppc -------------------------------------------------------------------------------- /qemu/pc-bios/ppc_rom.bin: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/S2E/s2e-old/HEAD/qemu/pc-bios/ppc_rom.bin -------------------------------------------------------------------------------- /qemu/pc-bios/sgabios.bin: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/S2E/s2e-old/HEAD/qemu/pc-bios/sgabios.bin -------------------------------------------------------------------------------- /qemu/pc-bios/vgabios.bin: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/S2E/s2e-old/HEAD/qemu/pc-bios/vgabios.bin -------------------------------------------------------------------------------- /qemu/tests/tcg/pi_10.com: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/S2E/s2e-old/HEAD/qemu/tests/tcg/pi_10.com -------------------------------------------------------------------------------- /s2e.config: -------------------------------------------------------------------------------- 1 | // ADD PREDEFINED MACROS HERE! 2 | #define CONFIG_S2E 3 | #define CONFIG_SOFTMMU 4 | -------------------------------------------------------------------------------- /qemu/README: -------------------------------------------------------------------------------- 1 | Read the documentation in qemu-doc.html or on http://wiki.qemu.org 2 | 3 | - QEMU team 4 | -------------------------------------------------------------------------------- /qemu/default-configs/microblaze-linux-user.mak: -------------------------------------------------------------------------------- 1 | # Default configuration for microblaze-linux-user 2 | -------------------------------------------------------------------------------- /qemu/default-configs/sparc32plus-linux-user.mak: -------------------------------------------------------------------------------- 1 | # Default configuration for sparc32plus-linux-user 2 | -------------------------------------------------------------------------------- /qemu/pc-bios/linuxboot.bin: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/S2E/s2e-old/HEAD/qemu/pc-bios/linuxboot.bin -------------------------------------------------------------------------------- /qemu/pc-bios/mpc8544ds.dtb: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/S2E/s2e-old/HEAD/qemu/pc-bios/mpc8544ds.dtb -------------------------------------------------------------------------------- /qemu/pc-bios/multiboot.bin: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/S2E/s2e-old/HEAD/qemu/pc-bios/multiboot.bin -------------------------------------------------------------------------------- /qemu/pc-bios/palcode-clipper: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/S2E/s2e-old/HEAD/qemu/pc-bios/palcode-clipper -------------------------------------------------------------------------------- /qemu/pc-bios/pxe-e1000.rom: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/S2E/s2e-old/HEAD/qemu/pc-bios/pxe-e1000.rom -------------------------------------------------------------------------------- /qemu/pc-bios/pxe-pcnet.rom: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/S2E/s2e-old/HEAD/qemu/pc-bios/pxe-pcnet.rom -------------------------------------------------------------------------------- /qemu/pc-bios/pxe-rtl8139.rom: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/S2E/s2e-old/HEAD/qemu/pc-bios/pxe-rtl8139.rom -------------------------------------------------------------------------------- /qemu/pc-bios/pxe-virtio.rom: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/S2E/s2e-old/HEAD/qemu/pc-bios/pxe-virtio.rom -------------------------------------------------------------------------------- /qemu/pc-bios/s390-zipl.rom: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/S2E/s2e-old/HEAD/qemu/pc-bios/s390-zipl.rom -------------------------------------------------------------------------------- /qemu/pc-bios/spapr-rtas.bin: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/S2E/s2e-old/HEAD/qemu/pc-bios/spapr-rtas.bin -------------------------------------------------------------------------------- /qemu/pc-bios/vgabios-qxl.bin: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/S2E/s2e-old/HEAD/qemu/pc-bios/vgabios-qxl.bin -------------------------------------------------------------------------------- /qemu/default-configs/microblazeel-linux-user.mak: -------------------------------------------------------------------------------- 1 | # Default configuration for microblazeel-linux-user 2 | -------------------------------------------------------------------------------- /qemu/pc-bios/openbios-sparc32: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/S2E/s2e-old/HEAD/qemu/pc-bios/openbios-sparc32 -------------------------------------------------------------------------------- /qemu/pc-bios/openbios-sparc64: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/S2E/s2e-old/HEAD/qemu/pc-bios/openbios-sparc64 -------------------------------------------------------------------------------- /qemu/pc-bios/pxe-eepro100.rom: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/S2E/s2e-old/HEAD/qemu/pc-bios/pxe-eepro100.rom -------------------------------------------------------------------------------- /qemu/pc-bios/pxe-ne2k_pci.rom: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/S2E/s2e-old/HEAD/qemu/pc-bios/pxe-ne2k_pci.rom -------------------------------------------------------------------------------- /qemu/linux-user/unicore32/termbits.h: -------------------------------------------------------------------------------- 1 | /* NOTE: exactly the same as i386 */ 2 | #include "../i386/termbits.h" 3 | -------------------------------------------------------------------------------- /qemu/pc-bios/petalogix-ml605.dtb: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/S2E/s2e-old/HEAD/qemu/pc-bios/petalogix-ml605.dtb -------------------------------------------------------------------------------- /qemu/pc-bios/vgabios-cirrus.bin: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/S2E/s2e-old/HEAD/qemu/pc-bios/vgabios-cirrus.bin -------------------------------------------------------------------------------- /qemu/pc-bios/vgabios-stdvga.bin: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/S2E/s2e-old/HEAD/qemu/pc-bios/vgabios-stdvga.bin -------------------------------------------------------------------------------- /qemu/pc-bios/vgabios-vmware.bin: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/S2E/s2e-old/HEAD/qemu/pc-bios/vgabios-vmware.bin -------------------------------------------------------------------------------- /qemu/target-lm32/TODO: -------------------------------------------------------------------------------- 1 | * disassembler (lm32-dis.c) 2 | * linux-user emulation 3 | * native bp/wp emulation (?) 4 | -------------------------------------------------------------------------------- /qemu/tests/tcg/alpha/hello-alpha.c: -------------------------------------------------------------------------------- 1 | int main (void) 2 | { 3 | write (1, "hello\n", 6); 4 | return 0; 5 | } 6 | -------------------------------------------------------------------------------- /stp/src/sat/cryptominisat2/VERSION: -------------------------------------------------------------------------------- 1 | CryptoMiniSat 2 | GIT revision: e540792aa3a01ec047b005b6351247fa87ae6eb6 3 | -------------------------------------------------------------------------------- /klee/test/Expr/dg.exp: -------------------------------------------------------------------------------- 1 | load_lib llvm.exp 2 | 3 | RunLLVMTests [lsort [glob -nocomplain $srcdir/$subdir/*.{pc}]] 4 | -------------------------------------------------------------------------------- /klee/test/Solver/dg.exp: -------------------------------------------------------------------------------- 1 | load_lib llvm.exp 2 | 3 | RunLLVMTests [lsort [glob -nocomplain $srcdir/$subdir/*.{pc}]] 4 | -------------------------------------------------------------------------------- /klee/www/content/coreutils_kc_0.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/S2E/s2e-old/HEAD/klee/www/content/coreutils_kc_0.png -------------------------------------------------------------------------------- /klee/www/content/coreutils_kc_1.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/S2E/s2e-old/HEAD/klee/www/content/coreutils_kc_1.png -------------------------------------------------------------------------------- /qemu/default-configs/arm-linux-user.mak: -------------------------------------------------------------------------------- 1 | # Default configuration for arm-linux-user 2 | 3 | CONFIG_GDBSTUB_XML=y 4 | -------------------------------------------------------------------------------- /qemu/default-configs/m68k-linux-user.mak: -------------------------------------------------------------------------------- 1 | # Default configuration for m68k-linux-user 2 | 3 | CONFIG_GDBSTUB_XML=y 4 | -------------------------------------------------------------------------------- /qemu/default-configs/ppc-darwin-user.mak: -------------------------------------------------------------------------------- 1 | # Default configuration for ppc-darwin-user 2 | 3 | CONFIG_GDBSTUB_XML=y 4 | -------------------------------------------------------------------------------- /qemu/default-configs/ppc-linux-user.mak: -------------------------------------------------------------------------------- 1 | # Default configuration for ppc-linux-user 2 | 3 | CONFIG_GDBSTUB_XML=y 4 | -------------------------------------------------------------------------------- /qemu/hw/empty_slot.h: -------------------------------------------------------------------------------- 1 | /* empty_slot.c */ 2 | void empty_slot_init(target_phys_addr_t addr, uint64_t slot_size); 3 | -------------------------------------------------------------------------------- /klee/test/Expr/Lexer/dg.exp: -------------------------------------------------------------------------------- 1 | load_lib llvm.exp 2 | 3 | RunLLVMTests [lsort [glob -nocomplain $srcdir/$subdir/*.{pc}]] 4 | -------------------------------------------------------------------------------- /klee/test/Expr/Parser/dg.exp: -------------------------------------------------------------------------------- 1 | load_lib llvm.exp 2 | 3 | RunLLVMTests [lsort [glob -nocomplain $srcdir/$subdir/*.{pc}]] 4 | -------------------------------------------------------------------------------- /klee/utils/valgrind/README.txt: -------------------------------------------------------------------------------- 1 | A few valgrind suppression files for known leaks. The LLVM ones may be 2 | fixed by now. 3 | -------------------------------------------------------------------------------- /qemu/default-configs/armeb-linux-user.mak: -------------------------------------------------------------------------------- 1 | # Default configuration for armeb-linux-user 2 | 3 | CONFIG_GDBSTUB_XML=y 4 | -------------------------------------------------------------------------------- /qemu/default-configs/ppc64-linux-user.mak: -------------------------------------------------------------------------------- 1 | # Default configuration for ppc64-linux-user 2 | 3 | CONFIG_GDBSTUB_XML=y 4 | -------------------------------------------------------------------------------- /qemu/pc-bios/petalogix-s3adsp1800.dtb: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/S2E/s2e-old/HEAD/qemu/pc-bios/petalogix-s3adsp1800.dtb -------------------------------------------------------------------------------- /stp/papers/vijayganesh-stp-paper.pdf: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/S2E/s2e-old/HEAD/stp/papers/vijayganesh-stp-paper.pdf -------------------------------------------------------------------------------- /klee/test/CXX/dg.exp: -------------------------------------------------------------------------------- 1 | load_lib llvm.exp 2 | 3 | RunLLVMTests [lsort [glob -nocomplain $srcdir/$subdir/*.{ll,llx,c,cpp,tr}]] 4 | -------------------------------------------------------------------------------- /stp/windows/README: -------------------------------------------------------------------------------- 1 | This patch to revision 446 was provided by Hume and tested under cygwin/mingw/centos 5.4/msvc9.0. 2 | 3 | -------------------------------------------------------------------------------- /klee/lib/Support/README.txt: -------------------------------------------------------------------------------- 1 | This directory holds basic support facilities (data structures, 2 | utilities, etc.) used by klee. 3 | -------------------------------------------------------------------------------- /klee/test/Coverage/dg.exp: -------------------------------------------------------------------------------- 1 | load_lib llvm.exp 2 | 3 | RunLLVMTests [lsort [glob -nocomplain $srcdir/$subdir/*.{ll,llx,c,cpp,tr}]] 4 | -------------------------------------------------------------------------------- /klee/test/Dogfood/dg.exp: -------------------------------------------------------------------------------- 1 | load_lib llvm.exp 2 | 3 | RunLLVMTests [lsort [glob -nocomplain $srcdir/$subdir/*.{ll,llx,c,cpp,tr}]] 4 | -------------------------------------------------------------------------------- /klee/test/Feature/dg.exp: -------------------------------------------------------------------------------- 1 | load_lib llvm.exp 2 | 3 | RunLLVMTests [lsort [glob -nocomplain $srcdir/$subdir/*.{ll,llx,c,cpp,tr}]] 4 | -------------------------------------------------------------------------------- /klee/test/Programs/dg.exp: -------------------------------------------------------------------------------- 1 | load_lib llvm.exp 2 | 3 | RunLLVMTests [lsort [glob -nocomplain $srcdir/$subdir/*.{ll,llx,c,cpp,tr}]] 4 | -------------------------------------------------------------------------------- /qemu/default-configs/ppc64abi32-linux-user.mak: -------------------------------------------------------------------------------- 1 | # Default configuration for ppc64abi32-linux-user 2 | 3 | CONFIG_GDBSTUB_XML=y 4 | -------------------------------------------------------------------------------- /qemu/linux-headers/README: -------------------------------------------------------------------------------- 1 | Automatically imported Linux kernel headers. 2 | Only use scripts/update-linux-headers.sh to update! 3 | -------------------------------------------------------------------------------- /stp/papers/EXE-STP-TISSEC-Journal-2007.pdf: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/S2E/s2e-old/HEAD/stp/papers/EXE-STP-TISSEC-Journal-2007.pdf -------------------------------------------------------------------------------- /stp/src/sat/core/Makefile: -------------------------------------------------------------------------------- 1 | EXEC = minisat 2 | DEPDIR = mtl utils 3 | MROOT=.. 4 | 5 | include $(MROOT)/mtl/template.mk 6 | -------------------------------------------------------------------------------- /stp/tests/bio-tests/easy-sat-bio.cvc.tar.gz: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/S2E/s2e-old/HEAD/stp/tests/bio-tests/easy-sat-bio.cvc.tar.gz -------------------------------------------------------------------------------- /stp/tests/bio-tests/hard-sat-bio.cvc.tar.gz: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/S2E/s2e-old/HEAD/stp/tests/bio-tests/hard-sat-bio.cvc.tar.gz -------------------------------------------------------------------------------- /stp/tests/misc-tests/cryptominisat-bug.cvc: -------------------------------------------------------------------------------- 1 | 2 | X : BITVECTOR(4); 3 | 4 | ASSERT 0bin0000 = BVPLUS(4,0bin0110, X); 5 | QUERY FALSE; -------------------------------------------------------------------------------- /klee/test/regression/dg.exp: -------------------------------------------------------------------------------- 1 | load_lib llvm.exp 2 | 3 | RunLLVMTests [lsort [glob -nocomplain $srcdir/$subdir/*.{ll,llx,c,cpp,tr}]] 4 | -------------------------------------------------------------------------------- /qemu/darwin-user/ioctls_types.h: -------------------------------------------------------------------------------- 1 | STRUCT(termios, TYPE_INT, TYPE_INT, TYPE_INT, TYPE_INT, MK_ARRAY(TYPE_CHAR, 20), TYPE_INT, TYPE_INT) 2 | -------------------------------------------------------------------------------- /qemu/qom/Makefile: -------------------------------------------------------------------------------- 1 | qom-y = object.o container.o qom-qobject.o 2 | qom-twice-y = cpu.o 3 | 4 | object.o: QEMU_CFLAGS+=-Wno-array-bounds 5 | -------------------------------------------------------------------------------- /stp/src/sat/core_prop/Makefile: -------------------------------------------------------------------------------- 1 | EXEC = minisat 2 | DEPDIR = mtl utils 3 | MROOT=.. 4 | 5 | include $(MROOT)/mtl/template.mk 6 | -------------------------------------------------------------------------------- /stp/src/sat/simp/Makefile: -------------------------------------------------------------------------------- 1 | EXEC = minisat 2 | DEPDIR = mtl utils core 3 | MROOT =.. 4 | 5 | include $(MROOT)/mtl/template.mk 6 | -------------------------------------------------------------------------------- /stp/src/sat/utils/Makefile: -------------------------------------------------------------------------------- 1 | EXEC = system_test 2 | DEPDIR = mtl 3 | MROOT = .. 4 | 5 | include $(MROOT)/mtl/template.mk 6 | -------------------------------------------------------------------------------- /stp/tests/bio-tests/easy-unsat-bio.cvc.tar.gz: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/S2E/s2e-old/HEAD/stp/tests/bio-tests/easy-unsat-bio.cvc.tar.gz -------------------------------------------------------------------------------- /stp/tests/generated_tests/Makefile: -------------------------------------------------------------------------------- 1 | mudivrem: 2 | g++ mulDivRem.cpp -m32 -Wno-deprecated -DTR1_UNORDERED_MAP -o muldiv -L../../lib -lstp -------------------------------------------------------------------------------- /qemu/tests/qemu-iotests/030.out: -------------------------------------------------------------------------------- 1 | ... 2 | ---------------------------------------------------------------------- 3 | Ran 3 tests 4 | 5 | OK 6 | -------------------------------------------------------------------------------- /qemu/tests/tcg/cris/README: -------------------------------------------------------------------------------- 1 | Test-suite for the cris port. Heavily based on the test-suite for the CRIS port of sim by Hans-Peter Nilsson. 2 | -------------------------------------------------------------------------------- /stp/src/to-sat/AIG/BBNodeManagerAIG.cpp: -------------------------------------------------------------------------------- 1 | #include "BBNodeManagerAIG.h" 2 | 3 | namespace BEEV 4 | { 5 | 6 | } 7 | 8 | 9 | 10 | 11 | -------------------------------------------------------------------------------- /.gitignore: -------------------------------------------------------------------------------- 1 | *~ 2 | /s2e.creator.user 3 | /guest/demos/quicksort 4 | /guest/init_env/init_env*.so 5 | /guest/s2ecmd/s2ecmd 6 | /guest/s2eget/s2eget 7 | -------------------------------------------------------------------------------- /qemu/default-configs/cris-softmmu.mak: -------------------------------------------------------------------------------- 1 | # Default configuration for cris-softmmu 2 | 3 | CONFIG_NAND=y 4 | CONFIG_PTIMER=y 5 | CONFIG_PFLASH_CFI02=y 6 | -------------------------------------------------------------------------------- /qemu/default-configs/m68k-softmmu.mak: -------------------------------------------------------------------------------- 1 | # Default configuration for m68k-softmmu 2 | 3 | include pci.mak 4 | CONFIG_GDBSTUB_XML=y 5 | CONFIG_PTIMER=y 6 | -------------------------------------------------------------------------------- /qemu/tests/tcg/cris/check_hello.c: -------------------------------------------------------------------------------- 1 | #include 2 | #include 3 | int main () 4 | { 5 | printf ("pass\n"); 6 | exit (0); 7 | } 8 | -------------------------------------------------------------------------------- /guest/windbg-gdb/gdbsyms.def: -------------------------------------------------------------------------------- 1 | LIBRARY "GDBSYMS.DLL" 2 | 3 | EXPORTS 4 | DebugExtensionInitialize 5 | DebugExtensionNotify 6 | gdbsyms 7 | 8 | -------------------------------------------------------------------------------- /klee/test/Expr/Evaluate2.pc: -------------------------------------------------------------------------------- 1 | # RUN: %kleaver -evaluate %s > %t.log 2 | 3 | # RUN: grep "Query 0: VALID" %t.log 4 | # XFAIL: * 5 | (query [false] false) 6 | -------------------------------------------------------------------------------- /qemu/default-configs/xtensa-softmmu.mak: -------------------------------------------------------------------------------- 1 | # Default configuration for Xtensa 2 | 3 | CONFIG_SERIAL=y 4 | CONFIG_OPENCORES_ETH=y 5 | CONFIG_PFLASH_CFI01=y 6 | -------------------------------------------------------------------------------- /qemu/default-configs/xtensaeb-softmmu.mak: -------------------------------------------------------------------------------- 1 | # Default configuration for Xtensa 2 | 3 | CONFIG_SERIAL=y 4 | CONFIG_OPENCORES_ETH=y 5 | CONFIG_PFLASH_CFI01=y 6 | -------------------------------------------------------------------------------- /qemu/tests/qemu-iotests/.gitignore: -------------------------------------------------------------------------------- 1 | check.log 2 | check.time 3 | *.out.bad 4 | *.notrun 5 | 6 | # ignore everything in the scratch directory 7 | scratch/ 8 | -------------------------------------------------------------------------------- /qemu/roms/configure-seabios.sh: -------------------------------------------------------------------------------- 1 | #!/bin/sh 2 | config="$1" 3 | make -C seabios clean distclean 4 | cp "$config" seabios/.config 5 | make -C seabios oldnoconfig 6 | -------------------------------------------------------------------------------- /qemu/default-configs/microblaze-softmmu.mak: -------------------------------------------------------------------------------- 1 | # Default configuration for microblaze-softmmu 2 | 3 | CONFIG_PTIMER=y 4 | CONFIG_PFLASH_CFI01=y 5 | CONFIG_SERIAL=y 6 | -------------------------------------------------------------------------------- /qemu/tests/tcg/xtensa/test_fail.S: -------------------------------------------------------------------------------- 1 | .include "macros.inc" 2 | 3 | test_suite fail 4 | 5 | test fail 6 | test_fail 7 | test_end 8 | 9 | test_suite_end 10 | -------------------------------------------------------------------------------- /qemu/default-configs/microblazeel-softmmu.mak: -------------------------------------------------------------------------------- 1 | # Default configuration for microblazeel-softmmu 2 | 3 | CONFIG_PTIMER=y 4 | CONFIG_PFLASH_CFI01=y 5 | CONFIG_SERIAL=y 6 | -------------------------------------------------------------------------------- /qemu/default-configs/lm32-softmmu.mak: -------------------------------------------------------------------------------- 1 | # Default configuration for lm32-softmmu 2 | 3 | CONFIG_PTIMER=y 4 | CONFIG_PFLASH_CFI01=y 5 | CONFIG_PFLASH_CFI02=y 6 | CONFIG_SD=y 7 | -------------------------------------------------------------------------------- /qemu/hw/sh7750_regnames.h: -------------------------------------------------------------------------------- 1 | #ifndef _SH7750_REGNAMES_H 2 | #define _SH7750_REGNAMES_H 3 | 4 | const char *regname(uint32_t addr); 5 | 6 | #endif /* _SH7750_REGNAMES_H */ 7 | -------------------------------------------------------------------------------- /qemu/tcg/LICENSE: -------------------------------------------------------------------------------- 1 | All the files in this directory and subdirectories are released under 2 | a BSD like license (see header in each file). No other license is 3 | accepted. 4 | -------------------------------------------------------------------------------- /qemu/tests/tcg/cris/check_openpf4.c: -------------------------------------------------------------------------------- 1 | /* Basic file operations, now *with* sysroot. 2 | #sim: --sysroot=@exedir@ 3 | */ 4 | #define PREFIX "/" 5 | #include "check_openpf3.c" 6 | -------------------------------------------------------------------------------- /qemu/bt-host.h: -------------------------------------------------------------------------------- 1 | #ifndef BT_HOST_H 2 | #define BT_HOST_H 3 | 4 | struct HCIInfo; 5 | 6 | /* bt-host.c */ 7 | struct HCIInfo *bt_host_hci(const char *id); 8 | 9 | #endif 10 | -------------------------------------------------------------------------------- /qemu/hw/dec_pci.h: -------------------------------------------------------------------------------- 1 | #ifndef DEC_PCI_H 2 | #define DEC_PCI_H 3 | 4 | #include "qemu-common.h" 5 | 6 | PCIBus *pci_dec_21154_init(PCIBus *parent_bus, int devfn); 7 | 8 | #endif 9 | -------------------------------------------------------------------------------- /klee/test/Runtime/Uclibc/dg.exp: -------------------------------------------------------------------------------- 1 | load_lib llvm.exp 2 | 3 | if { [klee_supports_uclibc] } { 4 | RunLLVMTests [lsort [glob -nocomplain $srcdir/$subdir/*.{ll,llx,c,cpp,tr}]] 5 | } 6 | -------------------------------------------------------------------------------- /qemu/tests/tcg/lm32/test_b.S: -------------------------------------------------------------------------------- 1 | .include "macros.inc" 2 | 3 | start 4 | 5 | test_name B_1 6 | load r1 jump 7 | b r1 8 | tc_fail 9 | end 10 | 11 | jump: 12 | tc_pass 13 | end 14 | -------------------------------------------------------------------------------- /klee/test/Runtime/POSIX/dg.exp: -------------------------------------------------------------------------------- 1 | load_lib llvm.exp 2 | 3 | if { [klee_supports_posix_runtime] } { 4 | RunLLVMTests [lsort [glob -nocomplain $srcdir/$subdir/*.{ll,llx,c,cpp,tr}]] 5 | } 6 | -------------------------------------------------------------------------------- /qemu/default-configs/sh4-softmmu.mak: -------------------------------------------------------------------------------- 1 | # Default configuration for sh4-softmmu 2 | 3 | include pci.mak 4 | CONFIG_SERIAL=y 5 | CONFIG_PTIMER=y 6 | CONFIG_PFLASH_CFI02=y 7 | CONFIG_ISA_MMIO=y 8 | -------------------------------------------------------------------------------- /qemu/tests/qemu-iotests/Makefile: -------------------------------------------------------------------------------- 1 | 2 | CLEANFILES= *.out.bad *.notrun check.log check.time 3 | 4 | # no default target 5 | default: 6 | 7 | clean: 8 | rm -f $(CLEANFILES) 9 | 10 | -------------------------------------------------------------------------------- /stp/clean-install.sh: -------------------------------------------------------------------------------- 1 | #!/bin/sh 2 | if [ "$PREFIX" == "" ]; then 3 | PREFIX=$HOME 4 | fi 5 | 6 | make configclean 7 | . scripts/configure 8 | make clean 9 | make install 10 | 11 | -------------------------------------------------------------------------------- /klee/include/klee/Internal/README.txt: -------------------------------------------------------------------------------- 1 | This directory holds header files for things which are exposed as part 2 | of the internal API of a library, but shouldn't be exposed to 3 | externally. 4 | -------------------------------------------------------------------------------- /qemu/default-configs/sh4eb-softmmu.mak: -------------------------------------------------------------------------------- 1 | # Default configuration for sh4eb-softmmu 2 | 3 | include pci.mak 4 | CONFIG_SERIAL=y 5 | CONFIG_PTIMER=y 6 | CONFIG_PFLASH_CFI02=y 7 | CONFIG_ISA_MMIO=y 8 | -------------------------------------------------------------------------------- /qemu/tests/tcg/lm32/test_ret.S: -------------------------------------------------------------------------------- 1 | .include "macros.inc" 2 | 3 | start 4 | 5 | test_name RET_1 6 | load ra mark 7 | ret 8 | 9 | tc_fail 10 | end 11 | 12 | mark: 13 | tc_pass 14 | end 15 | -------------------------------------------------------------------------------- /qemu/darwin-user/ioctls.h: -------------------------------------------------------------------------------- 1 | /* emulated ioctl list */ 2 | 3 | IOCTL(TIOCGETA, IOC_R, MK_PTR(MK_STRUCT(STRUCT_termios))) 4 | IOCTL(TIOCSETA, IOC_W, MK_PTR(MK_STRUCT(STRUCT_termios))) 5 | -------------------------------------------------------------------------------- /qemu/bsd-user/sparc/syscall.h: -------------------------------------------------------------------------------- 1 | struct target_pt_regs { 2 | abi_ulong psr; 3 | abi_ulong pc; 4 | abi_ulong npc; 5 | abi_ulong y; 6 | abi_ulong u_regs[16]; 7 | }; 8 | 9 | #define UNAME_MACHINE "sun4" 10 | -------------------------------------------------------------------------------- /qemu/linux-user/sparc/syscall.h: -------------------------------------------------------------------------------- 1 | struct target_pt_regs { 2 | abi_ulong psr; 3 | abi_ulong pc; 4 | abi_ulong npc; 5 | abi_ulong y; 6 | abi_ulong u_regs[16]; 7 | }; 8 | 9 | #define UNAME_MACHINE "sun4" 10 | -------------------------------------------------------------------------------- /klee/test/regression/2007-08-08-free-zero.c: -------------------------------------------------------------------------------- 1 | // RUN: %llvmgcc %s -emit-llvm -O0 -c -o %t1.bc 2 | // RUN: %klee %t1.bc 3 | // RUN: ls klee-last | not grep *.err 4 | 5 | int main() { 6 | free(0); 7 | return 0; 8 | } 9 | -------------------------------------------------------------------------------- /klee/tools/gen-random-bout/Makefile: -------------------------------------------------------------------------------- 1 | ##===- tools/klee/Makefile ---------------*- Makefile -*-===## 2 | 3 | LEVEL=../.. 4 | TOOLNAME = gen-random-bout 5 | USEDLIBS = kleeBasic.a 6 | 7 | include $(LEVEL)/Makefile.common 8 | -------------------------------------------------------------------------------- /qemu/s2e/Signals/build.sh: -------------------------------------------------------------------------------- 1 | #!/bin/sh 2 | 3 | FLAGS=`pkg-config --libs --cflags sigc++-2.0` 4 | LLVM="-I/Users/vitaly/S2E/llvm-2.6/include/ -I/Users/vitaly/S2E/llvm-2.6-obj/include/" 5 | g++ -o test $LLVM $FLAGS *.cpp 6 | -------------------------------------------------------------------------------- /qemu/hw/mips-bios.h: -------------------------------------------------------------------------------- 1 | #include "cpu.h" 2 | 3 | #define BIOS_SIZE (4 * 1024 * 1024) 4 | #ifdef TARGET_WORDS_BIGENDIAN 5 | #define BIOS_FILENAME "mips_bios.bin" 6 | #else 7 | #define BIOS_FILENAME "mipsel_bios.bin" 8 | #endif 9 | -------------------------------------------------------------------------------- /qemu/tests/tcg/cris/.gdbinit: -------------------------------------------------------------------------------- 1 | b main 2 | b _fail 3 | b exit 4 | display /i $pc 5 | display /x $srp 6 | display /x $r0 7 | display /x $r1 8 | display /x $r2 9 | display /x $r3 10 | display /x $r4 11 | display /t $ccs 12 | -------------------------------------------------------------------------------- /qemu/tests/tcg/lm32/test_calli.S: -------------------------------------------------------------------------------- 1 | .include "macros.inc" 2 | 3 | start 4 | 5 | test_name CALLI_1 6 | calli mark 7 | return: 8 | 9 | tc_fail 10 | end 11 | 12 | mark: 13 | mv r3, ra 14 | check_r3 return 15 | end 16 | -------------------------------------------------------------------------------- /klee/test/Concrete/GlobalVariable.ll: -------------------------------------------------------------------------------- 1 | declare void @print_i32(i32) 2 | 3 | @anInt = global i32 1 4 | @aRef = global i32* @anInt 5 | 6 | define i32 @main() { 7 | call void @print_i32(i32 0) 8 | ret i32 0 9 | } 10 | -------------------------------------------------------------------------------- /qemu/hw/microblaze_pic_cpu.h: -------------------------------------------------------------------------------- 1 | #ifndef MICROBLAZE_PIC_CPU_H 2 | #define MICROBLAZE_PIC_CPU_H 3 | 4 | #include "qemu-common.h" 5 | 6 | qemu_irq *microblaze_pic_init_cpu(CPUMBState *env); 7 | 8 | #endif /* MICROBLAZE_PIC_CPU_H */ 9 | -------------------------------------------------------------------------------- /qemu/tests/qemu-iotests/006.out: -------------------------------------------------------------------------------- 1 | QA output created by 006 2 | 3 | creating 128GB image 4 | qemu-img: The image size is too large for file format 'vpc' 5 | Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=137438953472 6 | *** done 7 | -------------------------------------------------------------------------------- /stp/unit_test/bvsge.smt2: -------------------------------------------------------------------------------- 1 | (set-logic QF_BV) 2 | (set-info :smt-lib-version 2.0) 3 | (set-info :category "check") 4 | (set-info :status sat) 5 | (declare-fun v0 () (_ BitVec 2)) 6 | (assert (bvsge v0 v0)) 7 | (check-sat) 8 | (exit) 9 | -------------------------------------------------------------------------------- /klee/lib/Basic/README.txt: -------------------------------------------------------------------------------- 1 | This directory holds the most basic support facilities provided for 2 | both the klee and kleaver libraries. The code in this directory should 3 | have no dependencies on LLVM or any other klee libraries. 4 | -------------------------------------------------------------------------------- /klee/test/Concrete/UnconditionalBranch.ll: -------------------------------------------------------------------------------- 1 | declare void @print_i32(i32) 2 | 3 | define i32 @main() { 4 | entry: 5 | %a = add i32 0, 1 6 | br label %exit 7 | exit: 8 | call void @print_i32(i32 %a) 9 | ret i32 0 10 | } 11 | -------------------------------------------------------------------------------- /qemu/tests/tcg/lm32/test_call.S: -------------------------------------------------------------------------------- 1 | .include "macros.inc" 2 | 3 | start 4 | 5 | test_name CALL_1 6 | load r1 mark 7 | call r1 8 | return: 9 | 10 | tc_fail 11 | end 12 | 13 | mark: 14 | mv r3, ra 15 | check_r3 return 16 | end 17 | -------------------------------------------------------------------------------- /qemu/tests/tcg/cris/crt.s: -------------------------------------------------------------------------------- 1 | .data 2 | _stack_start: 3 | .space 8192, 0 4 | _stack_end: 5 | .text 6 | .global _start 7 | _start: 8 | move.d _stack_end, $sp 9 | jsr main 10 | nop 11 | moveq 0, $r10 12 | jump exit 13 | nop 14 | -------------------------------------------------------------------------------- /klee/tools/klee-config/FinalLibDeps.txt: -------------------------------------------------------------------------------- 1 | libkleeBasic.a: 2 | libkleeSupport.a: 3 | libkleaverExpr.a: 4 | libkleaverSolver.a: libkleaverExpr.a 5 | libkleeCore.a libkleeModule.a: libkleeBasic.a libkleeSupport.a libkleaverSolver.a libkleaverExpr.a 6 | -------------------------------------------------------------------------------- /qemu/bsd-user/sparc64/syscall.h: -------------------------------------------------------------------------------- 1 | struct target_pt_regs { 2 | abi_ulong u_regs[16]; 3 | abi_ulong tstate; 4 | abi_ulong pc; 5 | abi_ulong npc; 6 | abi_ulong y; 7 | abi_ulong fprs; 8 | }; 9 | 10 | #define UNAME_MACHINE "sun4u" 11 | -------------------------------------------------------------------------------- /qemu/linux-user/sparc64/syscall.h: -------------------------------------------------------------------------------- 1 | struct target_pt_regs { 2 | abi_ulong u_regs[16]; 3 | abi_ulong tstate; 4 | abi_ulong pc; 5 | abi_ulong npc; 6 | abi_ulong y; 7 | abi_ulong fprs; 8 | }; 9 | 10 | #define UNAME_MACHINE "sun4u" 11 | -------------------------------------------------------------------------------- /stp/tests/sample-tests/variable-rightshift-valid.cvc: -------------------------------------------------------------------------------- 1 | %% Regression level = 3 2 | %% Result = Valid 3 | %% Language = presentation 4 | 5 | X, Y : BITVECTOR(2); 6 | 7 | ASSERT X = 0bin11; 8 | ASSERT X >> Y = 0bin10; 9 | 10 | QUERY FALSE; -------------------------------------------------------------------------------- /qemu/target-microblaze/machine.c: -------------------------------------------------------------------------------- 1 | #include "hw/hw.h" 2 | #include "hw/boards.h" 3 | 4 | void cpu_save(QEMUFile *f, void *opaque) 5 | { 6 | } 7 | 8 | int cpu_load(QEMUFile *f, void *opaque, int version_id) 9 | { 10 | return 0; 11 | } 12 | -------------------------------------------------------------------------------- /qemu/tests/tcg/cris/check_cmp-2.s: -------------------------------------------------------------------------------- 1 | 2 | 3 | .include "testutils.inc" 4 | 5 | start 6 | 7 | move.d 4294967283, $r0 8 | move.d $r0, $r10 9 | cmp.d $r0, $r10 10 | beq 1f 11 | move.d $r10, $r3 12 | fail 13 | 1: 14 | pass 15 | quit 16 | -------------------------------------------------------------------------------- /stp/tests/sample-tests/variable-rightshift-invalid.cvc: -------------------------------------------------------------------------------- 1 | %% Regression level = 3 2 | %% Result = InValid 3 | %% Language = presentation 4 | 5 | X, Y : BITVECTOR(2); 6 | 7 | ASSERT X = 0bin11; 8 | ASSERT X >> Y = 0bin01; 9 | 10 | QUERY FALSE; -------------------------------------------------------------------------------- /qemu/trace/stderr.h: -------------------------------------------------------------------------------- 1 | #ifndef TRACE_STDERR_H 2 | #define TRACE_STDERR_H 3 | 4 | typedef uint64_t TraceEventID; 5 | 6 | typedef struct { 7 | const char *tp_name; 8 | bool state; 9 | } TraceEvent; 10 | 11 | #endif /* ! TRACE_STDERR_H */ 12 | -------------------------------------------------------------------------------- /qemu/default-configs/sparc-softmmu.mak: -------------------------------------------------------------------------------- 1 | # Default configuration for sparc-softmmu 2 | 3 | CONFIG_ECC=y 4 | CONFIG_ESP=y 5 | CONFIG_ESCC=y 6 | CONFIG_M48T59=y 7 | CONFIG_PTIMER=y 8 | CONFIG_FDC=y 9 | CONFIG_EMPTY_SLOT=y 10 | CONFIG_PCNET_COMMON=y 11 | -------------------------------------------------------------------------------- /stp/unit_test/bvsgt.smt2: -------------------------------------------------------------------------------- 1 | (set-logic QF_BV) 2 | (set-info :smt-lib-version 2.0) 3 | (set-info :category "check") 4 | (set-info :status unsat) 5 | (declare-fun p () Bool) 6 | (assert (bvsgt (_ bv4 3) (ite p (_ bv7 3)(_ bv0 3) ) ) ) 7 | (check-sat) 8 | (exit) 9 | -------------------------------------------------------------------------------- /klee/test/Feature/DoubleFree.c: -------------------------------------------------------------------------------- 1 | // RUN: %llvmgcc %s -emit-llvm -O0 -c -o %t1.bc 2 | // RUN: %klee %t1.bc 3 | // RUN: test -f klee-last/test000001.ptr.err 4 | 5 | int main() { 6 | int *x = malloc(4); 7 | free(x); 8 | free(x); 9 | return 0; 10 | } 11 | -------------------------------------------------------------------------------- /LICENSE: -------------------------------------------------------------------------------- 1 | S2E as a whole is released under the GNU General Public License version 2. 2 | 3 | Some S2E files are released under GPL, LGPL or BSD licenses. Please consult 4 | LICENSE files in the subfolders and the headers of each individual files for 5 | more details. 6 | -------------------------------------------------------------------------------- /klee/test/Feature/OneFreeError.c: -------------------------------------------------------------------------------- 1 | // RUN: %llvmgcc %s -emit-llvm -O0 -c -o %t1.bc 2 | // RUN: %klee %t1.bc 3 | // RUN: test -f klee-last/test000001.ptr.err 4 | 5 | int main() { 6 | int *x = malloc(4); 7 | free(x); 8 | x[0] = 1; 9 | return 0; 10 | } 11 | -------------------------------------------------------------------------------- /klee/test/Feature/OneOutOfBounds.c: -------------------------------------------------------------------------------- 1 | // RUN: %llvmgcc %s -emit-llvm -O0 -c -o %t1.bc 2 | // RUN: %klee %t1.bc 3 | // RUN: test -f klee-last/test000001.ptr.err 4 | 5 | int main() { 6 | int *x = malloc(4); 7 | x[1] = 1; 8 | free(x); 9 | return 0; 10 | } 11 | -------------------------------------------------------------------------------- /qemu/tests/s2earm/buildHello.sh: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | echo Building the ARM Hello World... 3 | # '-EB' would mean: big endian 4 | arm-linux-gnueabi-as -mcpu=arm926e -march=armv5te -alh -o hello.o s2earm-inst.S hello.S > hello.lst 5 | arm-linux-gnueabi-ld -o hello.bin hello.o 6 | -------------------------------------------------------------------------------- /klee/test/Coverage/ReadArgs.c: -------------------------------------------------------------------------------- 1 | // RUN: %llvmgcc %s -emit-llvm -O0 -c -o %t1.bc 2 | // RUN: rm -rf xxx 3 | // RUN: echo " --output-dir=xxx " > %t1.args 4 | // RUN: %klee --read-args %t1.args %t1.bc 5 | // RUN: test -d xxx 6 | 7 | int main() { 8 | return 0; 9 | } 10 | -------------------------------------------------------------------------------- /stp/tests/generated_tests/runMulDivRem.sh: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | 3 | for i in {1..5000} 4 | do 5 | ./muldiv > file 6 | result=`stp -d -m file` 7 | if [ $result != "sat" ]; then 8 | echo "failed" 9 | exit 10 | fi 11 | echo $result 12 | done 13 | -------------------------------------------------------------------------------- /klee/test/Feature/DumpStatesOnHalt.c: -------------------------------------------------------------------------------- 1 | // RUN: %llvmgcc %s -g -emit-llvm -O0 -c -o %t1.bc 2 | // RUN: %klee --stop-after-n-instructions=1 --dump-states-on-halt=true %t1.bc 3 | // RUN: test -f klee-last/test000001.ktest 4 | 5 | int main() { 6 | int x = 10; 7 | return x; 8 | } 9 | -------------------------------------------------------------------------------- /qemu/hw/cris-boot.h: -------------------------------------------------------------------------------- 1 | 2 | struct cris_load_info 3 | { 4 | const char *image_filename; 5 | const char *cmdline; 6 | int image_size; 7 | 8 | target_phys_addr_t entry; 9 | }; 10 | 11 | void cris_load_image(CPUCRISState *env, struct cris_load_info *li); 12 | -------------------------------------------------------------------------------- /klee/test/Feature/CallToUndefinedExternal.cpp: -------------------------------------------------------------------------------- 1 | // RUN: %llvmgcc %s -emit-llvm -g -c -o %t1.bc 2 | // RUN: %klee %t1.bc 3 | // RUN: test -f klee-last/test000001.external.err 4 | 5 | extern "C" void poof(void); 6 | 7 | int main() { 8 | poof(); 9 | 10 | return 0; 11 | } 12 | -------------------------------------------------------------------------------- /stp/windows/cmakemods/staticrt.cmake: -------------------------------------------------------------------------------- 1 | # version 1.00 2 | # to make msvc/gcc to link statically the runtime libraries 3 | get_filename_component(MYMODESDIR ${CMAKE_CURRENT_LIST_FILE} PATH) 4 | include("${MYMODESDIR}/msvcmt.cmake") 5 | include("${MYMODESDIR}/slibgcc.cmake") 6 | 7 | -------------------------------------------------------------------------------- /klee/test/Concrete/OneCall.ll: -------------------------------------------------------------------------------- 1 | declare void @print_i32(i32) 2 | 3 | define i32 @sum(i32 %a, i32 %b) { 4 | %c = sub i32 %a, %b 5 | ret i32 %c 6 | } 7 | 8 | define i32 @main() { 9 | %a = call i32 @sum(i32 54, i32 2) 10 | call void @print_i32(i32 %a) 11 | ret i32 0 12 | } 13 | -------------------------------------------------------------------------------- /qemu/tests/tcg/lm32/test_bi.S: -------------------------------------------------------------------------------- 1 | .include "macros.inc" 2 | 3 | start 4 | 5 | test_name BI_1 6 | bi jump 7 | tc_fail 8 | end 9 | 10 | jump_back: 11 | tc_pass 12 | end 13 | 14 | jump: 15 | tc_pass 16 | 17 | test_name BI_2 18 | bi jump_back 19 | tc_fail 20 | 21 | end 22 | 23 | 24 | -------------------------------------------------------------------------------- /stp/src/simplifier/MutableASTNode.cpp: -------------------------------------------------------------------------------- 1 | /* 2 | * MutableASTNode.cpp 3 | * 4 | * Created on: 06/02/2011 5 | * Author: thansen 6 | */ 7 | 8 | #include "MutableASTNode.h" 9 | namespace BEEV 10 | { 11 | 12 | vector MutableASTNode::all; 13 | 14 | }; 15 | -------------------------------------------------------------------------------- /stp/unit_test/bvxor.smt2: -------------------------------------------------------------------------------- 1 | (set-logic QF_BV) 2 | (set-info :smt-lib-version 2.0) 3 | (set-info :category "check") 4 | (set-info :status sat) 5 | (declare-fun v0 () (_ BitVec 2)) 6 | 7 | (assert (bvule (bvxor v0 (_ bv0 2)) v0)) 8 | 9 | 10 | 11 | (check-sat) 12 | (exit) 13 | 14 | -------------------------------------------------------------------------------- /klee/test/Feature/ExternalWeakLinkage.c: -------------------------------------------------------------------------------- 1 | // RUN: %llvmgcc %s -emit-llvm -g -c -o %t1.bc 2 | // RUN: %klee --exit-on-error %t1.bc 3 | 4 | #include 5 | 6 | void __attribute__((weak)) IAmSoWeak(int); 7 | 8 | int main() { 9 | assert(IAmSoWeak==0); 10 | return 0; 11 | } 12 | -------------------------------------------------------------------------------- /stp/CODING_GUIDLINES: -------------------------------------------------------------------------------- 1 | 1. We try to follow the GNU coding guidelines and indentation 2 | standards. Please visit the following website to learn more: 3 | 4 | http://www.gnu.org/prep/standards/standards.html 5 | 6 | 2. The code is auto-formatted using an emacs-based script before 7 | check-in. 8 | -------------------------------------------------------------------------------- /stp/tests/sample-tests/a107test0001.cvc: -------------------------------------------------------------------------------- 1 | %% Regression level = 3 2 | %% Result = InValid 3 | %% Language = presentation 4 | 5 | %---------------------------------------------------- 6 | 7 | %---------------------------------------------------- 8 | QUERY FALSE; 9 | COUNTEREXAMPLE; 10 | -------------------------------------------------------------------------------- /stp/tests/sample-tests/a15test0001.cvc: -------------------------------------------------------------------------------- 1 | %% Regression level = 3 2 | %% Result = InValid 3 | %% Language = presentation 4 | 5 | %---------------------------------------------------- 6 | 7 | %---------------------------------------------------- 8 | QUERY FALSE; 9 | COUNTEREXAMPLE; 10 | -------------------------------------------------------------------------------- /tools/lib/Makefile: -------------------------------------------------------------------------------- 1 | ##===- lib/Makefile ---------------*- Makefile -*-===## 2 | 3 | LEVEL=.. 4 | 5 | PARALLEL_DIRS=ExecutionTracer BinaryReaders Utils 6 | 7 | #LIBRARYNAME=s2etools 8 | #DONT_BUILD_RELINKED=1 9 | #BUILD_ARCHIVE=1 10 | 11 | include $(LEVEL)/Makefile.common 12 | 13 | -------------------------------------------------------------------------------- /klee/test/Runtime/Uclibc/Environ.c: -------------------------------------------------------------------------------- 1 | // RUN: %llvmgcc %s -emit-llvm -g -c -o %t1.bc 2 | // RUN: %klee --libc=uclibc --exit-on-error %t1.bc 3 | 4 | #include 5 | 6 | int main() { 7 | printf("HOME: %s\n", getenv("HOME")); 8 | assert(getenv("HOME") != 0); 9 | return 0; 10 | } 11 | -------------------------------------------------------------------------------- /klee/tools/klee/Debug.cpp: -------------------------------------------------------------------------------- 1 | #include 2 | #include 3 | 4 | void kdb_printExpr(klee::Expr *e) { 5 | std::cerr << "expr: " << e << " -- "; 6 | if (e) { 7 | std::cerr << *e; 8 | } else { 9 | std::cerr << "(null)"; 10 | } 11 | std::cerr << "\n"; 12 | } 13 | -------------------------------------------------------------------------------- /qemu/qemu-x509.h: -------------------------------------------------------------------------------- 1 | #ifndef QEMU_X509_H 2 | #define QEMU_X509_H 3 | 4 | #define X509_CA_CERT_FILE "ca-cert.pem" 5 | #define X509_CA_CRL_FILE "ca-crl.pem" 6 | #define X509_SERVER_KEY_FILE "server-key.pem" 7 | #define X509_SERVER_CERT_FILE "server-cert.pem" 8 | 9 | #endif /* QEMU_X509_H */ 10 | -------------------------------------------------------------------------------- /klee/stp/bitvec/Makefile: -------------------------------------------------------------------------------- 1 | LEVEL=../.. 2 | 3 | LIBRARYNAME=consteval 4 | BUILD_ARCHIVE=1 5 | NO_INSTALL=1 6 | 7 | include $(LEVEL)/Makefile.common 8 | 9 | CXXFLAGS+=-I$(ObjDir)/../../AST/$(BuildMode) -DEXT_HASH_MAP 10 | CompileCommonOpts:=$(filter-out -pedantic, $(CompileCommonOpts)) 11 | 12 | -------------------------------------------------------------------------------- /klee/stp/constantbv/Makefile: -------------------------------------------------------------------------------- 1 | LEVEL=../.. 2 | 3 | LIBRARYNAME=constantbv 4 | BUILD_ARCHIVE=1 5 | NO_INSTALL=1 6 | 7 | include $(LEVEL)/Makefile.common 8 | 9 | CXXFLAGS+=-I$(ObjDir)/../../AST/$(BuildMode) -DEXT_HASH_MAP 10 | CompileCommonOpts:=$(filter-out -pedantic, $(CompileCommonOpts)) 11 | -------------------------------------------------------------------------------- /stp/unit_test/orAlwaysTrue.smt2: -------------------------------------------------------------------------------- 1 | (set-logic QF_BV) 2 | (set-info :smt-lib-version 2.0) 3 | (set-info :category "check") 4 | (set-info :status sat) 5 | (declare-fun v0 () (_ BitVec 2)) 6 | 7 | (assert (not (= (_ bv0 2) (bvor (_ bv1 2) v0 )))) 8 | 9 | 10 | 11 | (check-sat) 12 | (exit) 13 | 14 | -------------------------------------------------------------------------------- /klee/stp/INSTALL: -------------------------------------------------------------------------------- 1 | 1. To install STP perform the following steps on your Unix/GNU-Linux/MacOS X commandline: 2 | 3 | ./configure --with-prefix=$HOME (or another installation directory) 4 | make clean 5 | make 6 | make install 7 | 8 | 2. To test the system after installation: 9 | 10 | make regressall -------------------------------------------------------------------------------- /klee/stp/c_interface/Makefile: -------------------------------------------------------------------------------- 1 | LEVEL=../.. 2 | 3 | LIBRARYNAME=cinterface 4 | BUILD_ARCHIVE=1 5 | NO_INSTALL=1 6 | 7 | include $(LEVEL)/Makefile.common 8 | 9 | CXXFLAGS+=-I$(ObjDir)/../../AST/$(BuildMode) -DEXT_HASH_MAP 10 | CompileCommonOpts:=$(filter-out -pedantic, $(CompileCommonOpts)) 11 | 12 | -------------------------------------------------------------------------------- /klee/stp/simplifier/Makefile: -------------------------------------------------------------------------------- 1 | LEVEL=../.. 2 | 3 | LIBRARYNAME=simplifier 4 | BUILD_ARCHIVE=1 5 | NO_INSTALL=1 6 | 7 | include $(LEVEL)/Makefile.common 8 | 9 | CXXFLAGS+=-I$(ObjDir)/../../AST/$(BuildMode) -DEXT_HASH_MAP 10 | CompileCommonOpts:=$(filter-out -pedantic, $(CompileCommonOpts)) 11 | 12 | -------------------------------------------------------------------------------- /klee/test/regression/2007-10-11-free-of-alloca.c: -------------------------------------------------------------------------------- 1 | // RUN: %llvmgcc %s -emit-llvm -O0 -c -o %t1.bc 2 | // RUN: %klee %t1.bc 3 | // RUN: test -f klee-last/test000001.free.err 4 | 5 | int main() { 6 | int buf[4]; 7 | free(buf); // this should give runtime error, not crash 8 | return 0; 9 | } 10 | -------------------------------------------------------------------------------- /klee/test/regression/2008-03-04-free-of-global.c: -------------------------------------------------------------------------------- 1 | // RUN: %llvmgcc %s -emit-llvm -O0 -c -o %t1.bc 2 | // RUN: %klee %t1.bc 3 | // RUN: test -f klee-last/test000001.free.err 4 | 5 | int buf[4]; 6 | 7 | int main() { 8 | free(buf); // this should give runtime error, not crash 9 | return 0; 10 | } 11 | -------------------------------------------------------------------------------- /klee/test/regression/2008-04-10-bad-alloca-free.c: -------------------------------------------------------------------------------- 1 | // RUN: %llvmgcc %s -emit-llvm -O0 -c -o %t1.bc 2 | // RUN: %klee --exit-on-error %t1.bc 3 | 4 | void f(int *addr) { 5 | klee_make_symbolic(addr, sizeof *addr, "moo"); 6 | } 7 | 8 | int main() { 9 | int x; 10 | f(&x); 11 | return x; 12 | } 13 | -------------------------------------------------------------------------------- /stp/scripts/liblinks.sh: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | # You can use this script to symbolically link the requested libraries. 3 | # You can then compile STP using: 4 | # make STATIC=true 5 | # if you want to use the SMT-LIB parser 6 | ln -s `g++ -print-file-name=libstdc++.a` 7 | ln -s `g++ -print-file-name=libc.a` 8 | -------------------------------------------------------------------------------- /stp/tests/c-api-tests/stp-bool.c: -------------------------------------------------------------------------------- 1 | #include 2 | #include "c_interface.h" 3 | 4 | int main () 5 | { 6 | VC vc; 7 | int query_result; 8 | int count = 0; 9 | 10 | vc = vc_createValidityChecker (); 11 | 12 | 13 | Type type64 = vc_boolType (vc); 14 | 15 | 16 | vc_Destroy (vc); 17 | } 18 | -------------------------------------------------------------------------------- /config.lua: -------------------------------------------------------------------------------- 1 | s2e = { 2 | kleeArgs = { 3 | -- Run each state for at least 30 second before 4 | -- switching to the other: 5 | "--use-batching-search=true", "--batch-time=30.0" 6 | } 7 | } 8 | 9 | 10 | plugins = { 11 | -- Enable a plugin that handles S2E custom opcode 12 | "BaseInstructions" 13 | } 14 | -------------------------------------------------------------------------------- /qemu/hw/qdev-addr.h: -------------------------------------------------------------------------------- 1 | #define DEFINE_PROP_TADDR(_n, _s, _f, _d) \ 2 | DEFINE_PROP_DEFAULT(_n, _s, _f, _d, qdev_prop_taddr, target_phys_addr_t) 3 | 4 | extern PropertyInfo qdev_prop_taddr; 5 | void qdev_prop_set_taddr(DeviceState *dev, const char *name, target_phys_addr_t value); 6 | -------------------------------------------------------------------------------- /qemu/libcacard/libcacard.pc.in: -------------------------------------------------------------------------------- 1 | prefix=@PREFIX@ 2 | exec_prefix=${prefix} 3 | libdir=@LIBDIR@ 4 | includedir=@INCLUDEDIR@ 5 | 6 | Name: cacard 7 | Description: CA Card library 8 | Version: @VERSION@ 9 | 10 | Requires: nss 11 | Libs: -L${libdir} -lcacard 12 | Libs.private: 13 | Cflags: -I${includedir} 14 | -------------------------------------------------------------------------------- /qemu/tests/tcg/lm32/test_break.S: -------------------------------------------------------------------------------- 1 | .include "macros.inc" 2 | 3 | start 4 | 5 | test_name BREAK_1 6 | mvi r1, 1 7 | wcsr IE, r1 8 | insn: 9 | break 10 | check_excp 1 11 | 12 | test_name BREAK_2 13 | mv r3, ba 14 | check_r3 insn 15 | 16 | test_name BREAK_3 17 | rcsr r3, IE 18 | check_r3 4 19 | 20 | end 21 | -------------------------------------------------------------------------------- /stp/tests/sample-tests/a105test0001.cvc: -------------------------------------------------------------------------------- 1 | %% Regression level = 3 2 | %% Result = InValid 3 | %% Language = presentation 4 | 5 | i: BITVECTOR(32); 6 | %---------------------------------------------------- 7 | 8 | %---------------------------------------------------- 9 | QUERY FALSE; 10 | COUNTEREXAMPLE; 11 | -------------------------------------------------------------------------------- /klee/test/Runtime/Uclibc/2008-03-04-libc-atexit-uses-dso-handle.c: -------------------------------------------------------------------------------- 1 | // RUN: %llvmgcc %s -emit-llvm -O0 -c -o %t1.bc 2 | // RUN: %klee --exit-on-error --libc=uclibc %t1.bc 3 | 4 | // just make sure atexit works ok 5 | 6 | void boo() { 7 | } 8 | 9 | int main() { 10 | atexit(boo); 11 | return 0; 12 | } 13 | -------------------------------------------------------------------------------- /qemu/tests/qemu-iotests/012.out: -------------------------------------------------------------------------------- 1 | QA output created by 012 2 | Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=134217728 3 | 4 | == mark image read-only 5 | 6 | == read from read-only image 7 | read 512/512 bytes at offset 0 8 | 512.000000 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec) 9 | *** done 10 | -------------------------------------------------------------------------------- /qemu/tests/tcg/lm32/test_scall.S: -------------------------------------------------------------------------------- 1 | .include "macros.inc" 2 | 3 | start 4 | 5 | test_name SCALL_1 6 | mvi r1, 1 7 | wcsr IE, r1 8 | insn: 9 | scall 10 | check_excp 64 11 | 12 | test_name SCALL_2 13 | mv r3, ea 14 | check_r3 insn 15 | 16 | test_name SCALL_3 17 | rcsr r3, IE 18 | check_r3 2 19 | 20 | end 21 | -------------------------------------------------------------------------------- /qemu/target-m68k/m68k-qreg.h: -------------------------------------------------------------------------------- 1 | enum { 2 | #define DEFO32(name, offset) QREG_##name, 3 | #define DEFR(name, reg, mode) QREG_##name, 4 | #define DEFF64(name, offset) QREG_##name, 5 | QREG_NULL, 6 | #include "qregs.def" 7 | TARGET_NUM_QREGS = 0x100 8 | #undef DEFO32 9 | #undef DEFR 10 | #undef DEFF64 11 | }; 12 | -------------------------------------------------------------------------------- /stp/src/boost/config/abi/msvc_suffix.hpp: -------------------------------------------------------------------------------- 1 | // (C) Copyright John Maddock 2003. 2 | // Use, modification and distribution are subject to the 3 | // Boost Software License, Version 1.0. (See accompanying file 4 | // LICENSE_1_0.txt or copy at http://www.boost.org/LICENSE_1_0.txt) 5 | 6 | #pragma pack(pop) 7 | 8 | 9 | -------------------------------------------------------------------------------- /qemu/roms/Makefile: -------------------------------------------------------------------------------- 1 | 2 | default: 3 | @echo "nothing is build by default" 4 | @echo "available build targets:" 5 | @echo " bios -- update bios.bin (seabios)" 6 | 7 | bios: config.seabios 8 | sh configure-seabios.sh $< 9 | make -C seabios out/bios.bin 10 | cp seabios/out/bios.bin ../pc-bios/bios.bin 11 | -------------------------------------------------------------------------------- /stp/unit_test/alwaysTrue.smt2: -------------------------------------------------------------------------------- 1 | 2 | (set-logic QF_BV) 3 | (set-info :smt-lib-version 2.0) 4 | (set-info :category "check") 5 | (set-info :status sat) 6 | 7 | (declare-fun a () Bool) 8 | (declare-fun b () Bool) 9 | (declare-fun c () Bool) 10 | (assert (= (or c b) b) ) 11 | (assert (ite (= (or c b) b) c b )) 12 | 13 | (exit) -------------------------------------------------------------------------------- /klee/stp/stp/Makefile: -------------------------------------------------------------------------------- 1 | LEVEL=../.. 2 | 3 | LIBRARYNAME=stp 4 | BUILD_ARCHIVE=1 5 | 6 | include $(LEVEL)/Makefile.common 7 | 8 | STP_OBJS:=$(addprefix $(PROJ_OBJ_DIR)/../, $(addsuffix /$(BuildMode)/*.o, AST sat simplifier bitvec c_interface constantbv)) 9 | 10 | $(LibName.A): $(STP_OBJS) 11 | ObjectsO+=$(STP_OBJS) 12 | 13 | -------------------------------------------------------------------------------- /klee/test/regression/2008-05-23-gep-with-global-const.c: -------------------------------------------------------------------------------- 1 | // RUN: %llvmgcc -O0 -c -o %t.bc %s 2 | // RUN: %klee --exit-on-error %t.bc 3 | 4 | #include 5 | 6 | int a; 7 | 8 | int main() { 9 | void *p1 = &((char*) 0)[(long) &a]; 10 | void *p2 = &a; 11 | 12 | assert(p1 == p2); 13 | 14 | return 0; 15 | } 16 | -------------------------------------------------------------------------------- /stp/tests/sample-tests/a126test0001.cvc: -------------------------------------------------------------------------------- 1 | %% Regression level = 3 2 | %% Result = InValid 3 | %% Language = presentation 4 | 5 | x: BITVECTOR(32); 6 | y: BITVECTOR(32); 7 | %---------------------------------------------------- 8 | 9 | %---------------------------------------------------- 10 | QUERY FALSE; 11 | COUNTEREXAMPLE; 12 | -------------------------------------------------------------------------------- /klee/test/Concrete/BoolReadWrite.ll: -------------------------------------------------------------------------------- 1 | declare void @print_i1(i1) 2 | 3 | define i32 @main() { 4 | %mem = alloca i1 5 | store i1 1, i1* %mem 6 | %v = load i1* %mem 7 | br i1 %v, label %ok, label %exit 8 | ok: 9 | call void @print_i1(i1 %v) 10 | br label %exit 11 | exit: 12 | ret i32 0 13 | } 14 | -------------------------------------------------------------------------------- /qemu/target-arm/target-defs.h: -------------------------------------------------------------------------------- 1 | #if defined(CONFIG_USER_ONLY) 2 | #define TARGET_PAGE_BITS 12 3 | #else 4 | /* The ARM MMU allows 1k pages. */ 5 | /* ??? Linux doesn't actually use these, and they're deprecated in recent 6 | architecture revisions. Maybe a configure option to disable them. */ 7 | #define TARGET_PAGE_BITS 10 8 | #endif 9 | -------------------------------------------------------------------------------- /stp/unit_test/bvnot.smt2: -------------------------------------------------------------------------------- 1 | (set-logic QF_BV) 2 | (set-info :smt-lib-version 2.0) 3 | (set-info :category "check") 4 | (set-info :status unsat) 5 | (declare-fun x () (_ BitVec 6)) 6 | 7 | 8 | 9 | ; This is always true. 10 | (assert 11 | (= 12 | (bvnot x ) 13 | x 14 | ) 15 | ) 16 | 17 | 18 | (check-sat) 19 | (exit) 20 | 21 | -------------------------------------------------------------------------------- /stp/unit_test/bvor.smt2: -------------------------------------------------------------------------------- 1 | (set-logic QF_BV) 2 | (set-info :smt-lib-version 2.0) 3 | (set-info :category "check") 4 | (set-info :status sat) 5 | (declare-fun v0 () (_ BitVec 2)) 6 | (declare-fun v1 () (_ BitVec 2)) 7 | (assert (= (bvor v0 v0) (_ bv0 2))) 8 | (assert (= (bvor v1 (bvnot v1)) (_ bv3 2))) 9 | 10 | (check-sat) 11 | (exit) 12 | -------------------------------------------------------------------------------- /stp/unit_test/bvshift.smt2: -------------------------------------------------------------------------------- 1 | (set-logic QF_BV) 2 | (set-info :smt-lib-version 2.0) 3 | (set-info :category "check") 4 | (set-info :status sat) 5 | (declare-fun v0 () (_ BitVec 2)) 6 | (declare-fun v1 () (_ BitVec 2)) 7 | (declare-fun v2 () (_ BitVec 2)) 8 | 9 | (assert (= (bvshl (_ bv0 2) v0) (_ bv0 2))) 10 | (check-sat) 11 | (exit) 12 | -------------------------------------------------------------------------------- /klee/test/Concrete/UnconditionalBranchWithSimplePhi.ll: -------------------------------------------------------------------------------- 1 | declare void @print_i32(i32) 2 | 3 | define i32 @main() { 4 | entry: 5 | %a = add i32 0, 1 6 | br label %exit 7 | unused: 8 | %b = add i32 1, 2 9 | br label %exit 10 | exit: 11 | %c = phi i32 [%a, %entry], [%b, %unused] 12 | call void @print_i32(i32 %c) 13 | ret i32 0 14 | } 15 | -------------------------------------------------------------------------------- /qemu/pc-bios/Makefile: -------------------------------------------------------------------------------- 1 | # 2 | # NOTE: only compilable with x86 cross compile tools 3 | # 4 | include ../config-host.mak 5 | 6 | DEFINES= 7 | 8 | TARGETS= 9 | 10 | all: $(TARGETS) 11 | 12 | %.o: %.S 13 | $(CC) $(DEFINES) -c -o $@ $< 14 | 15 | %.dtb: %.dts 16 | dtc -I dts -O dtb -o $@ $< 17 | 18 | clean: 19 | rm -f $(TARGETS) *.o *~ 20 | -------------------------------------------------------------------------------- /qemu/tests/tcg/lm32/test_sextb.S: -------------------------------------------------------------------------------- 1 | .include "macros.inc" 2 | 3 | start 4 | 5 | test_name SEXTB_1 6 | mvi r1, 0 7 | sextb r3, r1 8 | check_r3 0 9 | 10 | test_name SEXTB_2 11 | mvi r1, 0x7f 12 | sextb r3, r1 13 | check_r3 0x0000007f 14 | 15 | test_name SEXTB_3 16 | mvi r1, 0x80 17 | sextb r3, r1 18 | check_r3 0xffffff80 19 | 20 | end 21 | -------------------------------------------------------------------------------- /stp/scripts/emacs-format-file: -------------------------------------------------------------------------------- 1 | ;;; File: emacs-format-file 2 | ;;; Stan Warford 3 | ;;; 17 May 2006 4 | 5 | (defun emacs-format-function () 6 | "Format the whole buffer." 7 | (c-set-style "gnu") 8 | (indent-region (point-min) (point-max) nil) 9 | (untabify (point-min) (point-max)) 10 | (save-buffer) 11 | ) 12 | -------------------------------------------------------------------------------- /klee/test/Concrete/CmpEq.ll: -------------------------------------------------------------------------------- 1 | declare void @print_i32(i32) 2 | 3 | define i32 @main() { 4 | %a = add i8 0, 1 5 | %b = add i8 %a, -1 6 | %c = icmp eq i8 %b, 0 7 | br i1 %c, label %exitTrue, label %exitFalse 8 | exitTrue: 9 | call void @print_i32(i32 1) 10 | ret i32 0 11 | exitFalse: 12 | call void @print_i32(i32 0) 13 | ret i32 0 14 | } 15 | -------------------------------------------------------------------------------- /qemu/default-configs/alpha-softmmu.mak: -------------------------------------------------------------------------------- 1 | # Default configuration for alpha-softmmu 2 | 3 | include pci.mak 4 | CONFIG_SERIAL=y 5 | CONFIG_I8254=y 6 | CONFIG_PCKBD=y 7 | CONFIG_VGA=y 8 | CONFIG_VGA_PCI=y 9 | CONFIG_VGA_CIRRUS=y 10 | CONFIG_IDE_CORE=y 11 | CONFIG_IDE_QDEV=y 12 | CONFIG_VMWARE_VGA=y 13 | CONFIG_IDE_CMD646=y 14 | CONFIG_I8259=y 15 | -------------------------------------------------------------------------------- /qemu/hw/apb_pci.h: -------------------------------------------------------------------------------- 1 | #ifndef APB_PCI_H 2 | #define APB_PCI_H 3 | 4 | #include "qemu-common.h" 5 | 6 | PCIBus *pci_apb_init(target_phys_addr_t special_base, 7 | target_phys_addr_t mem_base, 8 | qemu_irq *ivec_irqs, PCIBus **bus2, PCIBus **bus3, 9 | qemu_irq **pbm_irqs); 10 | #endif 11 | -------------------------------------------------------------------------------- /qemu/linux-user/sh4/syscall.h: -------------------------------------------------------------------------------- 1 | struct target_pt_regs { 2 | unsigned long regs[16]; 3 | unsigned long pc; 4 | unsigned long pr; 5 | unsigned long sr; 6 | unsigned long gbr; 7 | unsigned long mach; 8 | unsigned long macl; 9 | long tra; 10 | }; 11 | 12 | #define UNAME_MACHINE "sh4" 13 | -------------------------------------------------------------------------------- /qemu/tests/tcg/lm32/test_sexth.S: -------------------------------------------------------------------------------- 1 | .include "macros.inc" 2 | 3 | start 4 | 5 | test_name SEXTH_1 6 | mvi r1, 0 7 | sexth r3, r1 8 | check_r3 0 9 | 10 | test_name SEXTH_2 11 | load r1 0x7fff 12 | sexth r3, r1 13 | check_r3 0x00007fff 14 | 15 | test_name SEXTH_3 16 | load r1 0x8000 17 | sexth r3, r1 18 | check_r3 0xffff8000 19 | 20 | end 21 | -------------------------------------------------------------------------------- /stp/src/util/Makefile: -------------------------------------------------------------------------------- 1 | TOP = ../../ 2 | include $(TOP)scripts/Makefile.common 3 | 4 | SRCS = rewrite.cpp 5 | OBJS = $(SRCS:.cpp=.o) 6 | CFLAGS += -L../../lib/ 7 | 8 | .PHONY: clean 9 | 10 | rewrite: $(OBJS) $(TOP)lib/libstp.a 11 | rm -f evaluate 12 | $(CXX) $(CFLAGS) $^ -o rewrite -lstp 13 | 14 | clean: 15 | rm -f *.o rewrite 16 | -------------------------------------------------------------------------------- /tools/lib/Utils/Makefile: -------------------------------------------------------------------------------- 1 | #===-- lib/Basic/Makefile ----------------------------------*- Makefile -*--===# 2 | # 3 | # 4 | #===------------------------------------------------------------------------===# 5 | 6 | LEVEL=../.. 7 | 8 | LIBRARYNAME=utils 9 | DONT_BUILD_RELINKED=1 10 | BUILD_ARCHIVE=1 11 | 12 | include $(LEVEL)/Makefile.common 13 | -------------------------------------------------------------------------------- /qemu/hw/vmware_vga.h: -------------------------------------------------------------------------------- 1 | #ifndef QEMU_VMWARE_VGA_H 2 | #define QEMU_VMWARE_VGA_H 3 | 4 | #include "qemu-common.h" 5 | 6 | /* vmware_vga.c */ 7 | static inline DeviceState *pci_vmsvga_init(PCIBus *bus) 8 | { 9 | PCIDevice *dev; 10 | 11 | dev = pci_create_simple(bus, -1, "vmware-svga"); 12 | return &dev->qdev; 13 | } 14 | 15 | #endif 16 | -------------------------------------------------------------------------------- /stp/tests/sample-tests/a103test0001.cvc: -------------------------------------------------------------------------------- 1 | %% Regression level = 3 2 | %% Result = InValid 3 | %% Language = presentation 4 | 5 | a: ARRAY BITVECTOR(32) OF BITVECTOR(8); 6 | i: BITVECTOR(32); 7 | %---------------------------------------------------- 8 | 9 | %---------------------------------------------------- 10 | QUERY FALSE; 11 | COUNTEREXAMPLE; 12 | -------------------------------------------------------------------------------- /stp/unit_test/pure.smt2: -------------------------------------------------------------------------------- 1 | 2 | (set-logic QF_BV) 3 | (set-info :smt-lib-version 2.0) 4 | (set-info :category "check") 5 | (set-info :status sat) 6 | (declare-fun v0 () (_ BitVec 20)) 7 | (declare-fun v1 () Bool) 8 | 9 | 10 | (assert (or v1 (= (bvsmod v0 (bvnot v0)) (_ bv23211 20) ))) 11 | 12 | 13 | 14 | 15 | (check-sat) 16 | (exit) 17 | 18 | 19 | -------------------------------------------------------------------------------- /klee/test/Feature/IndirectCallToExternal.c: -------------------------------------------------------------------------------- 1 | // RUN: %llvmgcc %s -emit-llvm -g -c -o %t1.bc 2 | // RUN: %klee %t1.bc 3 | 4 | #include 5 | #include 6 | #include 7 | #include 8 | 9 | int main() { 10 | int (*scmp)(char*,char*) = strcmp; 11 | 12 | assert(scmp("hello","hi") < 0); 13 | 14 | return 0; 15 | } 16 | -------------------------------------------------------------------------------- /klee/unittests/Expr/Makefile: -------------------------------------------------------------------------------- 1 | ##===- unittests/Expr/Makefile -----------------------------*- Makefile -*-===## 2 | 3 | LEVEL := ../.. 4 | TESTNAME := Expr 5 | USEDLIBS := kleaverExpr.a kleeBasic.a 6 | LINK_COMPONENTS := support 7 | 8 | include $(LEVEL)/Makefile.config 9 | include $(LLVM_SRC_ROOT)/unittests/Makefile.unittest 10 | 11 | LIBS += -lstp 12 | -------------------------------------------------------------------------------- /qemu/tests/tcg/cris/check_stat1.c: -------------------------------------------------------------------------------- 1 | #include 2 | #include 3 | #include 4 | #include 5 | #include 6 | 7 | int main (void) 8 | { 9 | struct stat buf; 10 | 11 | if (stat (".", &buf) != 0 12 | || !S_ISDIR (buf.st_mode)) 13 | abort (); 14 | printf ("pass\n"); 15 | exit (0); 16 | } 17 | -------------------------------------------------------------------------------- /qemu/hw/primecell.h: -------------------------------------------------------------------------------- 1 | #ifndef PRIMECELL_H 2 | #define PRIMECELL_H 3 | 4 | /* Declarations for ARM PrimeCell based periperals. */ 5 | /* Also includes some devices that are currently only used by the 6 | ARM boards. */ 7 | 8 | /* arm_sysctl GPIO lines */ 9 | #define ARM_SYSCTL_GPIO_MMC_WPROT 0 10 | #define ARM_SYSCTL_GPIO_MMC_CARDIN 1 11 | 12 | #endif 13 | -------------------------------------------------------------------------------- /klee/test/Feature/DefineFixedObject.c: -------------------------------------------------------------------------------- 1 | // RUN: %llvmgcc -c -o %t1.bc %s 2 | // RUN: %klee --exit-on-error %t1.bc 3 | 4 | #include 5 | 6 | #define ADDRESS ((int*) 0x0080) 7 | 8 | int main() { 9 | klee_define_fixed_object(ADDRESS, 4); 10 | 11 | int *p = ADDRESS; 12 | 13 | *p = 10; 14 | printf("*p: %d\n", *p); 15 | 16 | return 0; 17 | } 18 | -------------------------------------------------------------------------------- /qemu/default-configs/sparc64-softmmu.mak: -------------------------------------------------------------------------------- 1 | # Default configuration for sparc64-softmmu 2 | 3 | include pci.mak 4 | CONFIG_ISA_MMIO=y 5 | CONFIG_M48T59=y 6 | CONFIG_PTIMER=y 7 | CONFIG_VGA=y 8 | CONFIG_VGA_PCI=y 9 | CONFIG_VGA_CIRRUS=y 10 | CONFIG_SERIAL=y 11 | CONFIG_PARALLEL=y 12 | CONFIG_PCKBD=y 13 | CONFIG_FDC=y 14 | CONFIG_IDE_ISA=y 15 | CONFIG_IDE_CMD646=y 16 | -------------------------------------------------------------------------------- /qemu/hw/ioh3420.h: -------------------------------------------------------------------------------- 1 | #ifndef QEMU_IOH3420_H 2 | #define QEMU_IOH3420_H 3 | 4 | #include "pcie_port.h" 5 | 6 | PCIESlot *ioh3420_init(PCIBus *bus, int devfn, bool multifunction, 7 | const char *bus_name, pci_map_irq_fn map_irq, 8 | uint8_t port, uint8_t chassis, uint16_t slot); 9 | 10 | #endif /* QEMU_IOH3420_H */ 11 | -------------------------------------------------------------------------------- /stp/unit_test/bvsgt2.smt2: -------------------------------------------------------------------------------- 1 | (set-logic QF_BV) 2 | (set-info :smt-lib-version 2.0) 3 | (set-info :category "check") 4 | (set-info :status sat) 5 | (declare-fun x () (_ BitVec 15)) 6 | (declare-fun y () (_ BitVec 5)) 7 | 8 | ; Check that unconstrained elimination through >'s works. 9 | 10 | (assert (bvsgt x (concat (_ bv0 10) y)) ) 11 | (check-sat) 12 | (exit) 13 | -------------------------------------------------------------------------------- /tools/lib/BinaryReaders/Makefile: -------------------------------------------------------------------------------- 1 | #===-- lib/Basic/Makefile ----------------------------------*- Makefile -*--===# 2 | # 3 | # 4 | # 5 | #===------------------------------------------------------------------------===# 6 | 7 | LEVEL=../.. 8 | 9 | LIBRARYNAME=binaryreaders 10 | DONT_BUILD_RELINKED=1 11 | BUILD_ARCHIVE=1 12 | 13 | include $(LEVEL)/Makefile.common 14 | -------------------------------------------------------------------------------- /tools/lib/ExecutionTracer/Makefile: -------------------------------------------------------------------------------- 1 | #===-- lib/Basic/Makefile ----------------------------------*- Makefile -*--===# 2 | # 3 | # 4 | #===------------------------------------------------------------------------===# 5 | 6 | LEVEL=../.. 7 | 8 | LIBRARYNAME=executiontracer 9 | DONT_BUILD_RELINKED=1 10 | BUILD_ARCHIVE=1 11 | 12 | include $(LEVEL)/Makefile.common 13 | -------------------------------------------------------------------------------- /klee/examples/islower/islower.c: -------------------------------------------------------------------------------- 1 | /* 2 | * First KLEE tutorial: testing a small function 3 | */ 4 | 5 | #include 6 | 7 | int my_islower(int x) { 8 | if (x >= 'a' && x <= 'z') 9 | return 1; 10 | else return 0; 11 | } 12 | 13 | int main() { 14 | char c; 15 | klee_make_symbolic(&c, sizeof(c), "input"); 16 | return my_islower(c); 17 | } 18 | -------------------------------------------------------------------------------- /qemu/target-m68k/qregs.def: -------------------------------------------------------------------------------- 1 | DEFF64(FP_RESULT, fp_result) 2 | DEFO32(PC, pc) 3 | DEFO32(SR, sr) 4 | DEFO32(CC_OP, cc_op) 5 | DEFO32(CC_DEST, cc_dest) 6 | DEFO32(CC_SRC, cc_src) 7 | DEFO32(CC_X, cc_x) 8 | DEFO32(DIV1, div1) 9 | DEFO32(DIV2, div2) 10 | DEFO32(EXCEPTION, exception_index) 11 | DEFO32(HALTED, halted) 12 | DEFO32(MACSR, macsr) 13 | DEFO32(MAC_MASK, mac_mask) 14 | -------------------------------------------------------------------------------- /qemu/tests/qemu-iotests/007.out: -------------------------------------------------------------------------------- 1 | QA output created by 007 2 | 3 | creating image 4 | Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=1048576 5 | savevm 1 6 | savevm 2 7 | savevm 3 8 | savevm 4 9 | savevm 5 10 | savevm 6 11 | savevm 7 12 | savevm 8 13 | savevm 9 14 | savevm 10 15 | 16 | checking image for errors 17 | No errors were found on the image. 18 | *** done 19 | -------------------------------------------------------------------------------- /klee/test/Feature/IndirectCallToBuiltin.c: -------------------------------------------------------------------------------- 1 | // RUN: %llvmgcc %s -emit-llvm -g -c -o %t1.bc 2 | // RUN: %klee %t1.bc 3 | 4 | #include 5 | #include 6 | 7 | int main() { 8 | void *(*allocator)(size_t) = malloc; 9 | int *mem = allocator(10); 10 | 11 | printf("mem: %p\n", mem); 12 | printf("mem[0]: %d\n", mem[0]); 13 | 14 | return 0; 15 | } 16 | -------------------------------------------------------------------------------- /qemu/audio/audio_win_int.h: -------------------------------------------------------------------------------- 1 | #ifndef AUDIO_WIN_INT_H 2 | #define AUDIO_WIN_INT_H 3 | 4 | int waveformat_from_audio_settings (WAVEFORMATEX *wfx, 5 | struct audsettings *as); 6 | 7 | int waveformat_to_audio_settings (WAVEFORMATEX *wfx, 8 | struct audsettings *as); 9 | 10 | #endif /* AUDIO_WIN_INT_H */ 11 | -------------------------------------------------------------------------------- /qemu/hw/mc146818rtc.h: -------------------------------------------------------------------------------- 1 | #ifndef MC146818RTC_H 2 | #define MC146818RTC_H 3 | 4 | #include "isa.h" 5 | #include "mc146818rtc_regs.h" 6 | 7 | ISADevice *rtc_init(ISABus *bus, int base_year, qemu_irq intercept_irq); 8 | void rtc_set_memory(ISADevice *dev, int addr, int val); 9 | void rtc_set_date(ISADevice *dev, const struct tm *tm); 10 | 11 | #endif /* !MC146818RTC_H */ 12 | -------------------------------------------------------------------------------- /stp/src/boost/config/abi/borland_suffix.hpp: -------------------------------------------------------------------------------- 1 | // (C) Copyright John Maddock 2003. 2 | // Use, modification and distribution are subject to the 3 | // Boost Software License, Version 1.0. (See accompanying file 4 | // LICENSE_1_0.txt or copy at http://www.boost.org/LICENSE_1_0.txt) 5 | 6 | # pragma option pop 7 | #pragma nopushoptwarn 8 | 9 | 10 | 11 | 12 | 13 | -------------------------------------------------------------------------------- /stp/unit_test/bvnor.smt2: -------------------------------------------------------------------------------- 1 | (set-logic QF_BV) 2 | (set-info :smt-lib-version 2.0) 3 | (set-info :category "check") 4 | (set-info :status sat) 5 | (declare-fun v0 () (_ BitVec 2)) 6 | (declare-fun v1 () (_ BitVec 2)) 7 | (declare-fun v2 () (_ BitVec 2)) 8 | 9 | (assert (= (bvor v0 v0) (_ bv0 2))) 10 | (assert (= (bvxor v1 v1) (_ bv0 2))) 11 | 12 | (check-sat) 13 | (exit) 14 | -------------------------------------------------------------------------------- /klee/test/Coverage/ReplayOutDir.c: -------------------------------------------------------------------------------- 1 | // RUN: %llvmgcc %s -emit-llvm -O0 -c -o %t1.bc 2 | // RUN: rm -rf %t1.out %t1.replay 3 | // RUN: %klee --output-dir=%t1.out %t1.bc 4 | // RUN: %klee --output-dir=%t1.replay --replay-out-dir=%t1.out %t1.bc 5 | 6 | int main() { 7 | int i; 8 | klee_make_symbolic(&i, sizeof i, "i"); 9 | klee_print_range("i", i); 10 | return 0; 11 | } 12 | -------------------------------------------------------------------------------- /klee/test/Feature/ByteSwap.c: -------------------------------------------------------------------------------- 1 | // RUN: %llvmgcc %s -emit-llvm -O0 -c -o %t1.bc 2 | // RUN: %klee --libc=klee --exit-on-error %t1.bc 3 | 4 | #include 5 | #include 6 | 7 | int main() { 8 | 9 | uint32_t n = 0; 10 | klee_make_symbolic(&n, sizeof(n)); 11 | 12 | uint32_t h = ntohl(n); 13 | assert(htonl(h) == n); 14 | 15 | return 0; 16 | } 17 | -------------------------------------------------------------------------------- /klee/test/Solver/FastCexSolver.pc: -------------------------------------------------------------------------------- 1 | # RUN: %kleaver --use-fast-cex-solver --use-dummy-solver %s > %t 2 | # RUN: not grep FAIL %t 3 | 4 | array arr1[4] : w32 -> w8 = symbolic 5 | (query [] (Not (Eq 4096 (ReadLSB w32 0 arr1)))) 6 | 7 | array arr2[2] : w32 -> w8 = symbolic 8 | (query [(Ule (Add w8 208 N0:(Read w8 0 arr2)) 9 | 9)] 10 | (Eq 52 N0)) 11 | 12 | 13 | -------------------------------------------------------------------------------- /stp/src/STPManager/Makefile: -------------------------------------------------------------------------------- 1 | TOP = ../.. 2 | include $(TOP)/scripts/Makefile.common 3 | 4 | SRCS = $(wildcard *.cpp) 5 | OBJS = $(SRCS:.cpp=.o) 6 | 7 | 8 | libstpmgr.a: $(OBJS) 9 | $(RM) $@ 10 | $(AR) qcs $@ $^ 11 | 12 | .PHONY: clean 13 | clean: 14 | $(RM) *.o *~ *.a .#* depend 15 | 16 | depend: $(SRCS) 17 | @$(call makedepend,$@,$(SRCS)) 18 | 19 | -include depend 20 | -------------------------------------------------------------------------------- /stp/unit_test/xor.smt2: -------------------------------------------------------------------------------- 1 | 2 | (set-logic QF_BV) 3 | (set-info :smt-lib-version 2.0) 4 | (set-info :category "check") 5 | (set-info :status sat) 6 | (declare-fun v0 () Bool ) 7 | (declare-fun v1 () Bool ) 8 | (declare-fun v2 () Bool ) 9 | 10 | ; This should be simplifed to v_0 <=> -v_1 before bitblasing. 11 | (assert (xor v0 v1)) 12 | 13 | (check-sat) 14 | (exit) 15 | 16 | 17 | -------------------------------------------------------------------------------- /klee/docs/intro: -------------------------------------------------------------------------------- 1 | /// @mainpage KLEE 2 | /// 3 | /// @section main_intro Introduction 4 | /// Welcome to KLEE. KLEE is a symbolic execution engine that works on LLVM 5 | /// bitcode. 6 | /// 7 | /// @section Documentation 8 | /// The documentation of KLEE is composed of the Doxygen documentation 9 | /// of the code as well as the following documents: 10 | /// - @subpage overview 11 | -------------------------------------------------------------------------------- /qemu/hw/lm32_juart.h: -------------------------------------------------------------------------------- 1 | #ifndef QEMU_HW_LM32_JUART_H 2 | #define QEMU_HW_LM32_JUART_H 3 | 4 | #include "qemu-common.h" 5 | 6 | uint32_t lm32_juart_get_jtx(DeviceState *d); 7 | uint32_t lm32_juart_get_jrx(DeviceState *d); 8 | void lm32_juart_set_jtx(DeviceState *d, uint32_t jtx); 9 | void lm32_juart_set_jrx(DeviceState *d, uint32_t jrx); 10 | 11 | #endif /* QEMU_HW_LM32_JUART_H */ 12 | -------------------------------------------------------------------------------- /qemu/hw/vt82c686.h: -------------------------------------------------------------------------------- 1 | #ifndef HW_VT82C686_H 2 | #define HW_VT82C686_H 3 | 4 | /* vt82c686.c */ 5 | ISABus *vt82c686b_init(PCIBus * bus, int devfn); 6 | void vt82c686b_ac97_init(PCIBus *bus, int devfn); 7 | void vt82c686b_mc97_init(PCIBus *bus, int devfn); 8 | i2c_bus *vt82c686b_pm_init(PCIBus *bus, int devfn, uint32_t smb_io_base, 9 | qemu_irq sci_irq); 10 | 11 | #endif 12 | -------------------------------------------------------------------------------- /qemu/hw/xio3130_upstream.h: -------------------------------------------------------------------------------- 1 | #ifndef QEMU_XIO3130_UPSTREAM_H 2 | #define QEMU_XIO3130_UPSTREAM_H 3 | 4 | #include "pcie_port.h" 5 | 6 | PCIEPort *xio3130_upstream_init(PCIBus *bus, int devfn, bool multifunction, 7 | const char *bus_name, pci_map_irq_fn map_irq, 8 | uint8_t port); 9 | 10 | #endif /* QEMU_XIO3130_H */ 11 | -------------------------------------------------------------------------------- /qemu/tests/tcg/cris/check_ret.s: -------------------------------------------------------------------------------- 1 | # mach: crisv3 crisv8 crisv10 2 | # output: 3\n 3 | 4 | # Test that ret works. 5 | 6 | .include "testutils.inc" 7 | start 8 | x: 9 | moveq 0,r3 10 | jsr z 11 | w: 12 | quit 13 | y: 14 | addq 1,r3 15 | checkr3 3 16 | quit 17 | 18 | z: 19 | addq 1,r3 20 | move srp,r2 21 | add.d y-w,r2 22 | move r2,srp 23 | ret 24 | addq 1,r3 25 | quit 26 | -------------------------------------------------------------------------------- /stp/src/extlib-constbv/Makefile: -------------------------------------------------------------------------------- 1 | TOP = ../.. 2 | include $(TOP)/scripts/Makefile.common 3 | 4 | SRCS = $(wildcard *.cpp) 5 | OBJS = $(SRCS:.cpp=.o) 6 | 7 | 8 | libconstantbv.a: $(OBJS) 9 | $(RM) $@ 10 | $(AR) qcs $@ $^ 11 | 12 | .PHONY: clean 13 | clean: 14 | $(RM) *.o *~ *.a .#* depend 15 | 16 | depend: $(SRCS) 17 | @$(call makedepend,$@,$(SRCS)) 18 | 19 | -include depend 20 | -------------------------------------------------------------------------------- /stp/tests/sample-tests/a12test0001.cvc: -------------------------------------------------------------------------------- 1 | %% Regression level = 3 2 | %% Result = InValid 3 | %% Language = presentation 4 | 5 | a: BITVECTOR(32); 6 | b: BITVECTOR(32); 7 | %---------------------------------------------------- 8 | ASSERT (a = 0bin00000000000000000000000001100100); 9 | 10 | %---------------------------------------------------- 11 | QUERY FALSE; 12 | COUNTEREXAMPLE; 13 | -------------------------------------------------------------------------------- /klee/unittests/Solver/Makefile: -------------------------------------------------------------------------------- 1 | ##===- unittests/Solver/Makefile ---------------------------*- Makefile -*-===## 2 | 3 | LEVEL := ../.. 4 | TESTNAME := Solver 5 | USEDLIBS := kleaverSolver.a kleaverExpr.a kleeSupport.a kleeBasic.a 6 | LINK_COMPONENTS := support 7 | 8 | include $(LEVEL)/Makefile.config 9 | include $(LLVM_SRC_ROOT)/unittests/Makefile.unittest 10 | 11 | LIBS += -lstp 12 | -------------------------------------------------------------------------------- /qemu/hw/bitbang_i2c.h: -------------------------------------------------------------------------------- 1 | #ifndef BITBANG_I2C_H 2 | #define BITBANG_I2C_H 3 | 4 | #include "i2c.h" 5 | 6 | typedef struct bitbang_i2c_interface bitbang_i2c_interface; 7 | 8 | #define BITBANG_I2C_SDA 0 9 | #define BITBANG_I2C_SCL 1 10 | 11 | bitbang_i2c_interface *bitbang_i2c_init(i2c_bus *bus); 12 | int bitbang_i2c_set(bitbang_i2c_interface *i2c, int line, int level); 13 | 14 | #endif 15 | -------------------------------------------------------------------------------- /qemu/hw/escc.h: -------------------------------------------------------------------------------- 1 | /* escc.c */ 2 | #define ESCC_SIZE 4 3 | MemoryRegion *escc_init(target_phys_addr_t base, qemu_irq irqA, qemu_irq irqB, 4 | CharDriverState *chrA, CharDriverState *chrB, 5 | int clock, int it_shift); 6 | 7 | void slavio_serial_ms_kbd_init(target_phys_addr_t base, qemu_irq irq, 8 | int disabled, int clock, int it_shift); 9 | -------------------------------------------------------------------------------- /stp/src/absrefine_counterexample/Makefile: -------------------------------------------------------------------------------- 1 | TOP = ../.. 2 | include $(TOP)/scripts/Makefile.common 3 | 4 | SRCS = $(wildcard *.cpp) 5 | OBJS = $(SRCS:.cpp=.o) 6 | 7 | 8 | libabstractionrefinement.a: $(OBJS) 9 | $(RM) $@ 10 | $(AR) qcs $@ $^ 11 | 12 | clean: 13 | $(RM) *.o *~ *.a .#* depend 14 | 15 | depend: $(SRCS) 16 | @$(call makedepend,$@,$(SRCS)) 17 | 18 | -include depend 19 | -------------------------------------------------------------------------------- /stp/src/c_interface/Makefile: -------------------------------------------------------------------------------- 1 | TOP = ../.. 2 | include $(TOP)/scripts/Makefile.common 3 | 4 | SRCS = $(wildcard *.cpp) 5 | OBJS = $(SRCS:.cpp=.o) 6 | 7 | 8 | libcinterface.a: $(OBJS) 9 | $(RM) $@ 10 | $(AR) qcs $@ $^ 11 | 12 | .PHONY: clean 13 | clean: 14 | $(RM) *.o *~ *.a .#* depend 15 | 16 | depend: $(SRCS) 17 | @$(call makedepend,$@,$(SRCS)) 18 | 19 | -include depend 20 | 21 | -------------------------------------------------------------------------------- /stp/tests/sample-tests/a100test0001.cvc: -------------------------------------------------------------------------------- 1 | %% Regression level = 3 2 | %% Result = InValid 3 | %% Language = presentation 4 | 5 | a: BITVECTOR(32); 6 | b: BITVECTOR(32); 7 | %---------------------------------------------------- 8 | ASSERT SBVLT(a,0bin00000000000000000000000001100100); 9 | 10 | %---------------------------------------------------- 11 | QUERY FALSE; 12 | COUNTEREXAMPLE; 13 | -------------------------------------------------------------------------------- /stp/tests/sample-tests/a13test0002.cvc: -------------------------------------------------------------------------------- 1 | %% Regression level = 3 2 | %% Result = InValid 3 | %% Language = presentation 4 | 5 | a: BITVECTOR(32); 6 | b: BITVECTOR(32); 7 | %---------------------------------------------------- 8 | ASSERT NOT (a = 0bin00000000000000000000000001100100); 9 | 10 | %---------------------------------------------------- 11 | QUERY FALSE; 12 | COUNTEREXAMPLE; 13 | -------------------------------------------------------------------------------- /stp/tests/sample-tests/a176test0022.cvc: -------------------------------------------------------------------------------- 1 | %% Regression level = 3 2 | %% Result = InValid 3 | %% Language = presentation 4 | 5 | n: BITVECTOR(32); 6 | c: BITVECTOR(8); 7 | %---------------------------------------------------- 8 | ASSERT NOT BVLT(n,0bin00000000000000000000000000010000); 9 | 10 | %---------------------------------------------------- 11 | QUERY FALSE; 12 | COUNTEREXAMPLE; 13 | -------------------------------------------------------------------------------- /qemu/hw/microblaze_boot.h: -------------------------------------------------------------------------------- 1 | #ifndef __MICROBLAZE_BOOT__ 2 | #define __MICROBLAZE_BOOT__ 3 | 4 | #include "hw.h" 5 | 6 | void microblaze_load_kernel(CPUMBState *env, target_phys_addr_t ddr_base, 7 | uint32_t ramsize, const char *dtb_filename, 8 | void (*machine_cpu_reset)(CPUMBState *)); 9 | 10 | #endif /* __MICROBLAZE_BOOT __ */ 11 | -------------------------------------------------------------------------------- /stp/tests/sample-tests/a101test0002.cvc: -------------------------------------------------------------------------------- 1 | %% Regression level = 3 2 | %% Result = InValid 3 | %% Language = presentation 4 | 5 | a: BITVECTOR(32); 6 | b: BITVECTOR(32); 7 | %---------------------------------------------------- 8 | ASSERT NOT SBVLT(a,0bin00000000000000000000000001100100); 9 | 10 | %---------------------------------------------------- 11 | QUERY FALSE; 12 | COUNTEREXAMPLE; 13 | -------------------------------------------------------------------------------- /stp/tests/sample-tests/a185test0001.cvc: -------------------------------------------------------------------------------- 1 | %% Regression level = 3 2 | %% Result = InValid 3 | %% Language = presentation 4 | 5 | x: BITVECTOR(31); 6 | %---------------------------------------------------- 7 | ASSERT SBVLT(0bin00000000000000000000000000000000 8 | ,((x << 1))[31:0]); 9 | 10 | %---------------------------------------------------- 11 | QUERY FALSE; 12 | COUNTEREXAMPLE; 13 | -------------------------------------------------------------------------------- /klee/test/Feature/IsSymbolic.c: -------------------------------------------------------------------------------- 1 | // RUN: %llvmgcc %s -emit-llvm -O0 -c -o %t1.bc 2 | // RUN: %klee %t1.bc 3 | 4 | #include 5 | 6 | int main() { 7 | int x, y, z = 0; 8 | klee_make_symbolic(&x, sizeof x); 9 | klee_make_symbolic(&y, sizeof y); 10 | if (x) { 11 | assert(klee_is_symbolic(y)); 12 | } else { 13 | assert(!klee_is_symbolic(z)); 14 | } 15 | return 0; 16 | } 17 | -------------------------------------------------------------------------------- /stp/src/extlib-abc/Makefile: -------------------------------------------------------------------------------- 1 | TOP = ../.. 2 | include $(TOP)/scripts/Makefile.common 3 | 4 | SRCS = $(wildcard aig/*/*.c) 5 | OBJS = $(SRCS:.c=.o) 6 | CFLAGS += -I. 7 | 8 | 9 | libabc.a: $(OBJS) 10 | $(RM) $@ 11 | $(AR) qcs $@ $^ 12 | 13 | .PHONY: clean 14 | clean: 15 | $(RM) $(OBJS) *~ *.a .#* depend 16 | 17 | depend: $(SRCS) 18 | @$(call makedepend,$@,$(SRCS)) 19 | 20 | -include depend 21 | -------------------------------------------------------------------------------- /stp/tests/generated_tests/extract.pl: -------------------------------------------------------------------------------- 1 | #!/usr/bin/perl -w 2 | 3 | open(logfile, "$ARGV[$0]") 4 | or die ("Cannot open log file"); 5 | 6 | my $flag = 0; 7 | while() { 8 | if($flag == 1) { 9 | if(/\S/) { 10 | print; 11 | } 12 | else { 13 | print "segfault or timeout\n"; 14 | } 15 | $flag = 0; 16 | } 17 | if(/\*\*\*/) { 18 | $flag = 1; 19 | } 20 | } 21 | -------------------------------------------------------------------------------- /stp/tests/sample-tests/a186test0002.cvc: -------------------------------------------------------------------------------- 1 | %% Regression level = 3 2 | %% Result = InValid 3 | %% Language = presentation 4 | 5 | x: BITVECTOR(31); 6 | %---------------------------------------------------- 7 | ASSERT NOT SBVLT(0bin00000000000000000000000000000000 8 | ,((x << 1))[31:0]); 9 | 10 | %---------------------------------------------------- 11 | QUERY FALSE; 12 | COUNTEREXAMPLE; 13 | -------------------------------------------------------------------------------- /stp/unit_test/bvge1.smt2: -------------------------------------------------------------------------------- 1 | (set-logic QF_BV) 2 | (set-info :smt-lib-version 2.0) 3 | (set-info :category "check") 4 | (set-info :status unsat) 5 | (declare-fun x () (_ BitVec 10)) 6 | (declare-fun y () (_ BitVec 10)) 7 | 8 | 9 | ; 10 | (assert 11 | (bvult 12 | (bvudiv x y ) 13 | (_ bv1 10) 14 | ) 15 | ) 16 | 17 | (assert (not (bvult x y))) 18 | 19 | 20 | (check-sat) 21 | (exit) 22 | 23 | -------------------------------------------------------------------------------- /stp/unit_test/uncon_then_pure.smt: -------------------------------------------------------------------------------- 1 | (benchmark r 2 | :status sat 3 | :category { crafted } 4 | :difficulty { 0 } 5 | :logic QF_BV 6 | :extrafuns ((x BitVec[3])) 7 | :extrafuns ((y BitVec[3])) 8 | 9 | :extrafuns ((m BitVec[3])) 10 | :extrafuns ((p BitVec[3])) 11 | 12 | :assumption (or (bvslt x y ) (or (= (bvmul p m) bv3[3]) (= (bvadd p m) bv3[3]))) 13 | :formula true 14 | ) 15 | -------------------------------------------------------------------------------- /stp/unit_test/xor3.smt2: -------------------------------------------------------------------------------- 1 | 2 | (set-logic QF_BV) 3 | (set-info :smt-lib-version 2.0) 4 | (set-info :category "check") 5 | (set-info :status sat) 6 | (declare-fun v0 () Bool ) 7 | (declare-fun v1 () Bool ) 8 | (declare-fun v2 () Bool ) 9 | 10 | ; Checks that =, that is IFF, will be mixed in with xor. 11 | (assert (xor (not (xor v0 v1)) (= v2 v1))) 12 | 13 | (check-sat) 14 | (exit) 15 | 16 | 17 | -------------------------------------------------------------------------------- /klee/test/Concrete/InvokeAndReturn.ll: -------------------------------------------------------------------------------- 1 | declare void @print_i32(i32) 2 | 3 | define i8 @sum(i8 %a, i8 %b) { 4 | %c = add i8 %a, %b 5 | ret i8 %c 6 | } 7 | 8 | define i32 @main() { 9 | invoke i8 @sum(i8 1, i8 2) 10 | to label %continue 11 | unwind label %error 12 | continue: 13 | call void @print_i32(i32 1) 14 | ret i32 0 15 | error: 16 | call void @print_i32(i32 0) 17 | ret i32 0 18 | } 19 | -------------------------------------------------------------------------------- /klee/test/Concrete/InvokeAndUnwindOnce.ll: -------------------------------------------------------------------------------- 1 | declare void @print_i32(i32) 2 | 3 | define i8 @sum(i8 %a, i8 %b) { 4 | %c = add i8 %a, %b 5 | unwind 6 | } 7 | 8 | define i32 @main() { 9 | invoke i8 @sum(i8 1, i8 2) 10 | to label %continue 11 | unwind label %error 12 | continue: 13 | call void @print_i32(i32 1) 14 | ret i32 0 15 | error: 16 | call void @print_i32(i32 0) 17 | ret i32 0 18 | } 19 | -------------------------------------------------------------------------------- /qemu/pc-bios/keymaps/modifiers: -------------------------------------------------------------------------------- 1 | Shift_R 0x36 2 | Shift_L 0x2a 3 | 4 | Alt_R 0xb8 5 | Mode_switch 0xb8 6 | ISO_Level3_Shift 0xb8 7 | Alt_L 0x38 8 | 9 | Control_R 0x9d 10 | Control_L 0x1d 11 | 12 | # Translate Super to Windows keys. 13 | # This is hardcoded. See documentation for details. 14 | Super_R 0xdc 15 | Super_L 0xdb 16 | 17 | # Translate Menu to the Windows Application key. 18 | Menu 0xdd 19 | -------------------------------------------------------------------------------- /qemu/tests/tcg/cris/check_stat2.c: -------------------------------------------------------------------------------- 1 | /* 2 | #notarget: cris*-*-elf 3 | */ 4 | 5 | #include 6 | #include 7 | #include 8 | #include 9 | #include 10 | 11 | int main (void) 12 | { 13 | struct stat buf; 14 | 15 | if (lstat (".", &buf) != 0 16 | || !S_ISDIR (buf.st_mode)) 17 | abort (); 18 | printf ("pass\n"); 19 | exit (0); 20 | } 21 | -------------------------------------------------------------------------------- /klee/test/Concrete/UnorderedPhiNodes.ll: -------------------------------------------------------------------------------- 1 | declare void @print_i32(i32) 2 | 3 | define i32 @main() { 4 | entry: 5 | br label %test 6 | test: 7 | %a = phi i32 [10, %entry], [%b, %test] 8 | %b = phi i32 [%a, %test], [20, %entry] 9 | %c = phi i32 [0, %entry], [1, %test] 10 | %d = icmp eq i32 %c, 1 11 | br i1 %d, label %exit, label %test 12 | exit: 13 | call void @print_i32(i32 %b) 14 | ret i32 0 15 | } 16 | -------------------------------------------------------------------------------- /klee/test/regression/2008-03-11-free-of-malloc-zero.c: -------------------------------------------------------------------------------- 1 | // RUN: %llvmgcc %s -emit-llvm -O0 -c -o %t1.bc 2 | // RUN: %klee --exit-on-error %t1.bc 3 | 4 | #include 5 | 6 | int main() { 7 | // concrete case 8 | void *p = malloc(0); 9 | free(p); 10 | 11 | p = malloc(0); 12 | void *arr[4] = { p, 0, 0, 0 }; 13 | 14 | // symbolic case 15 | free(arr[klee_range(0, 4, "range")]); 16 | } 17 | -------------------------------------------------------------------------------- /qemu/hw/multiboot.h: -------------------------------------------------------------------------------- 1 | #ifndef QEMU_MULTIBOOT_H 2 | #define QEMU_MULTIBOOT_H 3 | 4 | int load_multiboot(void *fw_cfg, 5 | FILE *f, 6 | const char *kernel_filename, 7 | const char *initrd_filename, 8 | const char *kernel_cmdline, 9 | int kernel_file_size, 10 | uint8_t *header); 11 | 12 | #endif 13 | -------------------------------------------------------------------------------- /qemu/tests/qemu-iotests/005.out: -------------------------------------------------------------------------------- 1 | QA output created by 005 2 | 3 | creating large image 4 | Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=5368709120000 5 | 6 | small read 7 | read 4096/4096 bytes at offset 1024 8 | 4 KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec) 9 | 10 | small write 11 | read 4096/4096 bytes at offset 8192 12 | 4 KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec) 13 | *** done 14 | -------------------------------------------------------------------------------- /stp/unit_test/bvand.smt2: -------------------------------------------------------------------------------- 1 | 2 | (set-logic QF_BV) 3 | (set-info :smt-lib-version 2.0) 4 | (set-info :category "check") 5 | (set-info :status unsat) 6 | (declare-fun v0 () (_ BitVec 1)) 7 | 8 | (assert (= (concat (_ bv0 1) v0) (_ bv2 2))) 9 | 10 | 11 | 12 | 13 | (check-sat) 14 | (exit) 15 | 16 | 17 | ;1126:(EQ 18 | ; 24:0b01010 19 | ; 1124:(BVCONCAT 20 | ; 114:0b000 21 | ; 1108:array_a2_1)) 22 | -------------------------------------------------------------------------------- /stp/unit_test/xor4.smt2: -------------------------------------------------------------------------------- 1 | 2 | (set-logic QF_BV) 3 | (set-info :smt-lib-version 2.0) 4 | (set-info :category "check") 5 | (set-info :status sat) 6 | (declare-fun v0 () Bool ) 7 | (declare-fun v1 () Bool ) 8 | (declare-fun v2 () Bool ) 9 | 10 | ; This should be simplifed to v_0 <=> -v_1 before bitblasing. 11 | (assert (= (xor (not v0) (and v2 (not v1))) true)) 12 | 13 | (check-sat) 14 | (exit) 15 | 16 | 17 | -------------------------------------------------------------------------------- /klee/test/CXX/Trivial.cpp: -------------------------------------------------------------------------------- 1 | // RUN: %llvmgxx %s --emit-llvm -O0 -c -o %t1.bc 2 | // RUN: %klee --no-output --exit-on-error %t1.bc 3 | 4 | #include 5 | 6 | class Test { 7 | int x; 8 | 9 | public: 10 | Test(int _x) : x(_x) {} 11 | ~Test() {} 12 | 13 | int getX() { return x; } 14 | }; 15 | 16 | int main() { 17 | Test rt(2); 18 | 19 | assert(rt.getX()==2); 20 | 21 | return 0; 22 | } 23 | -------------------------------------------------------------------------------- /klee/test/Concrete/OverlappingPhiNodes.ll: -------------------------------------------------------------------------------- 1 | declare void @print_i32(i32) 2 | 3 | define i32 @main() { 4 | entry: 5 | br label %test 6 | test: 7 | %a = phi i32 [10, %entry], [%b, %test] 8 | %b = phi i32 [20, %entry], [%a, %test] 9 | %c = phi i32 [0, %entry], [1, %test] 10 | %d = icmp eq i32 %c, 1 11 | br i1 %d, label %exit, label %test 12 | exit: 13 | call void @print_i32(i32 %b) 14 | ret i32 0 15 | } 16 | -------------------------------------------------------------------------------- /klee/test/Concrete/BitwiseOps.ll: -------------------------------------------------------------------------------- 1 | declare void @print_i32(i32) 2 | 3 | define i32 @main() { 4 | %a = or i32 12345678, 87654321 5 | %b = and i32 %a, 87654321 6 | %check = xor i32 %b, 87654321 7 | %test = icmp eq i32 %check, 0 8 | br i1 %test, label %exitTrue, label %exitFalse 9 | exitTrue: 10 | call void @print_i32(i32 1) 11 | ret i32 0 12 | exitFalse: 13 | call void @print_i32(i32 0) 14 | ret i32 0 15 | } 16 | -------------------------------------------------------------------------------- /klee/test/Feature/ReallocFailure.c: -------------------------------------------------------------------------------- 1 | // RUN: %llvmgcc %s -emit-llvm -O0 -c -o %t1.bc 2 | // RUN: %klee --exit-on-error %t1.bc 3 | 4 | #include 5 | #include 6 | #include 7 | 8 | int main() { 9 | int *p = malloc(sizeof(int)*2); 10 | assert(p); 11 | p[1] = 52; 12 | 13 | int *p2 = realloc(p, 1<<30); 14 | assert(p2 == 0); 15 | assert(p[1] == 52); 16 | 17 | return 0; 18 | } 19 | -------------------------------------------------------------------------------- /stp/tests/sample-tests/a114test0001.cvc: -------------------------------------------------------------------------------- 1 | %% Regression level = 3 2 | %% Result = InValid 3 | %% Language = presentation 4 | 5 | _fresh_symbolic_value: BITVECTOR(32); 6 | %---------------------------------------------------- 7 | ASSERT NOT (_fresh_symbolic_value = 8 | 0bin00000000000000000000000000000000); 9 | 10 | %---------------------------------------------------- 11 | QUERY FALSE; 12 | COUNTEREXAMPLE; 13 | -------------------------------------------------------------------------------- /stp/tests/sample-tests/a121test0001.cvc: -------------------------------------------------------------------------------- 1 | %% Regression level = 3 2 | %% Result = InValid 3 | %% Language = presentation 4 | 5 | _fresh_symbolic_value: BITVECTOR(32); 6 | %---------------------------------------------------- 7 | ASSERT NOT (_fresh_symbolic_value = 8 | 0bin00000000000000000000000000000000); 9 | 10 | %---------------------------------------------------- 11 | QUERY FALSE; 12 | COUNTEREXAMPLE; 13 | -------------------------------------------------------------------------------- /stp/unit_test/writing_same.smt2: -------------------------------------------------------------------------------- 1 | (set-info :source | fuzzsmt 0.3 |) 2 | (set-logic QF_ABV) 3 | (set-info :status sat) 4 | (declare-fun v5572 () (_ BitVec 8)) 5 | (declare-fun v5573 () (_ BitVec 8)) 6 | 7 | 8 | (declare-fun v5574 () (_ BitVec 2)) 9 | (declare-fun a5575 () (Array (_ BitVec 8) (_ BitVec 8))) 10 | 11 | (assert(= v5572 (select (store a5575 v5572 (select a5575 v5572)) v5573))) 12 | 13 | (check-sat) 14 | -------------------------------------------------------------------------------- /klee/test/Concrete/ackermann.c: -------------------------------------------------------------------------------- 1 | // llvm-gcc -O2 --emit-llvm -c ackermann.c && ../../Debug/bin/klee ackermann.o 2 2 2 | 3 | #include 4 | 5 | int ackermann(int m, int n) { 6 | if (m == 0) 7 | return n+1; 8 | else 9 | return ackermann(m-1, (n==0) ? 1 : ackermann(m, n-1)); 10 | } 11 | 12 | int main() { 13 | printf("ackerman(%d, %d) = %d\n", 2, 2, ackermann(2, 2)); 14 | 15 | return 0; 16 | } 17 | -------------------------------------------------------------------------------- /qemu/tests/tcg/alpha/crt.s: -------------------------------------------------------------------------------- 1 | .text 2 | 3 | .globl _start 4 | .ent _start,0 5 | _start: 6 | .frame $15,0,$15 7 | br $29,1f 8 | 1: ldgp $29, 0($29) 9 | .prologue 0 10 | ldq $27,main($29) !literal!1 11 | jsr $26,($27) 12 | or $0,$0,$16 13 | .end _start 14 | 15 | .globl _exit 16 | _exit: 17 | lda $0,1 18 | callsys 19 | 20 | call_pal 0 21 | 22 | .globl write 23 | write: 24 | lda $0,4 25 | callsys 26 | ret 27 | -------------------------------------------------------------------------------- /klee/test/Feature/GetValue.c: -------------------------------------------------------------------------------- 1 | // RUN: %llvmgcc -c -o %t1.bc %s 2 | // RUN: %klee --exit-on-error %t1.bc 3 | 4 | #include 5 | #include 6 | 7 | int main() { 8 | int x = klee_int("x"); 9 | klee_assume(x > 10); 10 | klee_assume(x < 20); 11 | 12 | assert(!klee_is_symbolic(klee_get_value(x))); 13 | assert(klee_get_value(x) > 10); 14 | assert(klee_get_value(x) < 20); 15 | 16 | return 0; 17 | } 18 | -------------------------------------------------------------------------------- /guest/configure: -------------------------------------------------------------------------------- 1 | #!/bin/sh 2 | 3 | BUILD_DIR="$(pwd)" 4 | 5 | cd "$(dirname $0)" 6 | TOOLS_DIR="$(pwd)" 7 | cd "$BUILD_DIR" 8 | 9 | if [ "$BUILD_DIR" = "$TOOLS_DIR" ]; then 10 | echo "Do not build in the source directory!" 11 | exit 12 | fi 13 | 14 | rm -f config.mak 15 | echo "TOOLS_DIR = $TOOLS_DIR" >> config.mak 16 | echo "BUILD_DIR = $BUILD_DIR" >> config.mak 17 | 18 | ln -fs "$TOOLS_DIR/Makefile" Makefile 19 | 20 | 21 | -------------------------------------------------------------------------------- /klee/test/Concrete/Select.ll: -------------------------------------------------------------------------------- 1 | declare void @print_i32(i32) 2 | 3 | define i32 @main() { 4 | %ten = select i1 true, i32 10, i32 0 5 | %five = select i1 false, i32 0, i32 5 6 | %check = add i32 %ten, %five 7 | %test = icmp eq i32 %check, 15 8 | br i1 %test, label %exitTrue, label %exitFalse 9 | exitTrue: 10 | call void @print_i32(i32 1) 11 | ret i32 0 12 | exitFalse: 13 | call void @print_i32(i32 0) 14 | ret i32 0 15 | } 16 | -------------------------------------------------------------------------------- /klee/test/regression/2007-07-25-invalid-stp-array-binding-to-objectstate.c: -------------------------------------------------------------------------------- 1 | // RUN: %llvmgcc %s -emit-llvm -O0 -c -o %t1.bc 2 | // RUN: %klee %t1.bc 3 | 4 | #include 5 | 6 | int main(void) { 7 | char c[2]; 8 | 9 | klee_make_symbolic(&c, sizeof(c)); 10 | 11 | if (c[0] > 10) { 12 | int x; 13 | 14 | c[1] = 1; // copy object state 15 | 16 | assert(c[0] > 10); 17 | } 18 | 19 | return 0; 20 | } 21 | -------------------------------------------------------------------------------- /qemu/tests/tcg/cris/check_time2.c: -------------------------------------------------------------------------------- 1 | /* CB_SYS_time doesn't implement the Linux time syscall; the return 2 | value isn't written to the argument. */ 3 | 4 | #include 5 | #include 6 | #include 7 | 8 | int 9 | main (void) 10 | { 11 | time_t x = (time_t) -1; 12 | time_t t = time (&x); 13 | 14 | if (t == (time_t) -1 || t != x) 15 | abort (); 16 | printf ("pass\n"); 17 | exit (0); 18 | } 19 | -------------------------------------------------------------------------------- /stp/src/printer/Makefile: -------------------------------------------------------------------------------- 1 | TOP = ../.. 2 | include $(TOP)/scripts/Makefile.common 3 | 4 | SRCS = $(wildcard *.cpp) 5 | OBJS = $(SRCS:.cpp=.o) 6 | 7 | 8 | #Make the ast library for use by other modules 9 | libprinter.a: $(OBJS) 10 | $(RM) $@ 11 | $(AR) qcs $@ $^ 12 | 13 | .PHONY: clean 14 | clean: 15 | $(RM) *.o *~ *.a .#* depend 16 | 17 | depend: $(SRCS) 18 | @$(call makedepend,$@,$(SRCS)) 19 | 20 | -include depend 21 | 22 | -------------------------------------------------------------------------------- /stp/src/simplifier/Makefile: -------------------------------------------------------------------------------- 1 | TOP = ../.. 2 | include $(TOP)/scripts/Makefile.common 3 | 4 | SRCS = $(wildcard *.cpp) 5 | SRCS += $(wildcard constantBitP/*.cpp) 6 | OBJS = $(SRCS:.cpp=.o) 7 | 8 | 9 | libsimplifier.a: $(OBJS) 10 | $(RM) $@ 11 | $(AR) qcs $@ $^ 12 | 13 | .PHONY: clean 14 | clean: 15 | $(RM) *.o */*.o *~ *.a .#* depend 16 | 17 | depend: $(SRCS) 18 | @$(call makedepend,$@,$(SRCS)) 19 | 20 | -include depend 21 | -------------------------------------------------------------------------------- /klee/lib/Core/KleeExecutor.cpp: -------------------------------------------------------------------------------- 1 | #include "KleeExecutor.h" 2 | 3 | using namespace klee; 4 | 5 | KleeExecutor::KleeExecutor(const InterpreterOptions &opts, InterpreterHandler *ie) 6 | : Executor(opts, ie) 7 | { 8 | } 9 | 10 | /// 11 | 12 | Interpreter *Interpreter::createKleeExecutor(const InterpreterOptions &opts, 13 | InterpreterHandler *ih) { 14 | return new KleeExecutor(opts, ih); 15 | } 16 | -------------------------------------------------------------------------------- /qemu/default-configs/pci.mak: -------------------------------------------------------------------------------- 1 | CONFIG_PCI=y 2 | CONFIG_VIRTIO_PCI=y 3 | CONFIG_VIRTIO=y 4 | CONFIG_USB_UHCI=y 5 | CONFIG_USB_OHCI=y 6 | CONFIG_USB_EHCI=y 7 | CONFIG_USB_XHCI=y 8 | CONFIG_NE2000_PCI=y 9 | CONFIG_EEPRO100_PCI=y 10 | CONFIG_PCNET_PCI=y 11 | CONFIG_PCNET_COMMON=y 12 | CONFIG_LSI_SCSI_PCI=y 13 | CONFIG_RTL8139_PCI=y 14 | CONFIG_E1000_PCI=y 15 | CONFIG_IDE_CORE=y 16 | CONFIG_IDE_QDEV=y 17 | CONFIG_IDE_PCI=y 18 | CONFIG_AHCI=y 19 | -------------------------------------------------------------------------------- /stp/unit_test/bvand3.smt2: -------------------------------------------------------------------------------- 1 | 2 | (set-logic QF_BV) 3 | (set-info :smt-lib-version 2.0) 4 | (set-info :category "check") 5 | (set-info :status sat) 6 | (declare-fun v1 () (_ BitVec 5)) 7 | (declare-fun v2 () (_ BitVec 5)) 8 | (declare-fun v3 () (_ BitVec 5)) 9 | 10 | ; Identity is discovered. 11 | (assert (= (bvand (bvnot v1) (bvand v2 v3)) (bvand v3 (bvand (bvnot v1) v2)) ) ) 12 | (assert (= (bvnot v1) v2 )) 13 | (check-sat) 14 | 15 | -------------------------------------------------------------------------------- /stp/unit_test/sim.smt2: -------------------------------------------------------------------------------- 1 | 2 | (set-logic QF_BV) 3 | (set-info :smt-lib-version 2.0) 4 | (set-info :category "check") 5 | (set-info :status sat) 6 | (declare-fun v0 () Bool ) 7 | (declare-fun v1 () Bool ) 8 | (declare-fun v2 () Bool ) 9 | (declare-fun v3 () Bool ) 10 | 11 | ; not xor is iff. 12 | 13 | (assert (not (xor v0 v1))) 14 | (assert (not (xor v1 v2))) 15 | (assert (not (xor v2 v3))) 16 | 17 | (check-sat) 18 | (exit) 19 | 20 | 21 | -------------------------------------------------------------------------------- /klee/test/regression/2007-07-30-unflushed-byte.c: -------------------------------------------------------------------------------- 1 | // RUN: %llvmgcc %s -emit-llvm -O0 -c -o %t1.bc 2 | // RUN: %klee %t1.bc 3 | 4 | #include 5 | 6 | int main() { 7 | char i, x[3]; 8 | 9 | klee_make_symbolic(&i, sizeof i); 10 | 11 | x[0] = i; 12 | 13 | // DEMAND FAILED:Memory.cpp:read8:199: is false: "unflushed byte without cache value" 14 | char y = x[1]; 15 | 16 | return 0; 17 | } 18 | 19 | -------------------------------------------------------------------------------- /klee/utils/valgrind/valgrind-llvm.supp: -------------------------------------------------------------------------------- 1 | { 2 | LLVM:Tmp1 3 | Memcheck:Leak 4 | fun:_vgrZU_libstdcZpZpZa__Znwj 5 | fun:_ZN4llvm* 6 | } 7 | { 8 | LLVM:Tmp2 9 | Memcheck:Leak 10 | fun:_vgrZU_libcZdsoZa_malloc 11 | fun:_ZN4llvm* 12 | } 13 | { 14 | LLVM:Tmp3 15 | Memcheck:Leak 16 | fun:*nwj* 17 | fun:*llvm* 18 | } 19 | { 20 | LLVM:Tmp4 21 | Memcheck:Leak 22 | fun:malloc 23 | fun:*llvm* 24 | } 25 | -------------------------------------------------------------------------------- /qemu/hw/audiodev.h: -------------------------------------------------------------------------------- 1 | /* es1370.c */ 2 | int es1370_init(PCIBus *bus); 3 | 4 | /* sb16.c */ 5 | int SB16_init(ISABus *bus); 6 | 7 | /* adlib.c */ 8 | int Adlib_init(ISABus *bus); 9 | 10 | /* gus.c */ 11 | int GUS_init(ISABus *bus); 12 | 13 | /* ac97.c */ 14 | int ac97_init(PCIBus *bus); 15 | 16 | /* cs4231a.c */ 17 | int cs4231a_init(ISABus *bus); 18 | 19 | /* intel-hda.c + hda-audio.c */ 20 | int intel_hda_and_codec_init(PCIBus *bus); 21 | -------------------------------------------------------------------------------- /qemu/hw/sharpsl.h: -------------------------------------------------------------------------------- 1 | /* 2 | * Common declarations for the Zaurii. 3 | * 4 | * This file is licensed under the GNU GPL. 5 | */ 6 | #ifndef QEMU_SHARPSL_H 7 | #define QEMU_SHARPSL_H 8 | 9 | #define zaurus_printf(format, ...) \ 10 | fprintf(stderr, "%s: " format, __FUNCTION__, ##__VA_ARGS__) 11 | 12 | /* zaurus.c */ 13 | 14 | #define SL_PXA_PARAM_BASE 0xa0000a00 15 | void sl_bootparam_write(target_phys_addr_t ptr); 16 | 17 | #endif 18 | -------------------------------------------------------------------------------- /qemu/target-lm32/helper.h: -------------------------------------------------------------------------------- 1 | #include "def-helper.h" 2 | 3 | DEF_HELPER_1(raise_exception, void, i32) 4 | DEF_HELPER_0(hlt, void) 5 | DEF_HELPER_1(wcsr_im, void, i32) 6 | DEF_HELPER_1(wcsr_ip, void, i32) 7 | DEF_HELPER_1(wcsr_jtx, void, i32) 8 | DEF_HELPER_1(wcsr_jrx, void, i32) 9 | DEF_HELPER_0(rcsr_im, i32) 10 | DEF_HELPER_0(rcsr_ip, i32) 11 | DEF_HELPER_0(rcsr_jtx, i32) 12 | DEF_HELPER_0(rcsr_jrx, i32) 13 | 14 | #include "def-helper.h" 15 | -------------------------------------------------------------------------------- /qemu/tests/tcg/cris/sys.h: -------------------------------------------------------------------------------- 1 | #include 2 | 3 | #define STRINGIFY(x) #x 4 | #define TOSTRING(x) STRINGIFY(x) 5 | 6 | #define CURRENT_LOCATION __FILE__ ":" TOSTRING(__LINE__) 7 | 8 | #define err() \ 9 | { \ 10 | _fail("at " CURRENT_LOCATION " "); \ 11 | } 12 | 13 | #define mb() asm volatile ("" : : : "memory") 14 | 15 | void pass(void); 16 | void _fail(char *reason); 17 | -------------------------------------------------------------------------------- /stp/src/boost/pool/detail/pool_construct.sh: -------------------------------------------------------------------------------- 1 | #!/bin/sh 2 | # 3 | # Copyright (C) 2000 Stephen Cleary 4 | # 5 | # Distributed under the Boost Software License, Version 1.0. (See accompany- 6 | # ing file LICENSE_1_0.txt or copy at http://www.boost.org/LICENSE_1_0.txt) 7 | # 8 | # See http://www.boost.org for updates, documentation, and revision history. 9 | # 10 | 11 | m4 -P -E -DNumberOfArguments=$1 pool_construct.m4 > pool_construct.inc 12 | -------------------------------------------------------------------------------- /stp/unit_test/bvge3.smt2: -------------------------------------------------------------------------------- 1 | (set-logic QF_BV) 2 | (set-info :smt-lib-version 2.0) 3 | (set-info :category "check") 4 | (set-info :status unsat) 5 | (declare-fun x () (_ BitVec 10)) 6 | (declare-fun y () (_ BitVec 10)) 7 | 8 | 9 | ; 10 | (assert 11 | (bvslt 12 | (bvlshr (concat (_ bv0 10) y ) (_ bv2 20) ) 13 | (concat (_ bv64 10) x ) 14 | ) 15 | ) 16 | 17 | (assert (not (= x y))) 18 | 19 | 20 | (check-sat) 21 | (exit) 22 | 23 | -------------------------------------------------------------------------------- /stp/unit_test/bvmul_minus.smt2: -------------------------------------------------------------------------------- 1 | (set-logic QF_BV) 2 | (set-info :smt-lib-version 2.0) 3 | (set-info :category "check") 4 | (set-info :status unsat) 5 | (declare-fun x () (_ BitVec 8)) 6 | (declare-fun y () (_ BitVec 8)) 7 | 8 | 9 | 10 | 11 | ; This is always true. 12 | (assert 13 | (not (= 14 | (bvneg (bvmul (bvneg x) (bvneg y) )) 15 | (bvneg (bvmul y x )) 16 | 17 | )) 18 | ) 19 | 20 | 21 | (check-sat) 22 | (exit) 23 | 24 | -------------------------------------------------------------------------------- /tools/tools/tbtrace/Makefile: -------------------------------------------------------------------------------- 1 | #===-- tools/klee/Makefile ---------------------------------*- Makefile -*--===# 2 | # 3 | # 4 | # 5 | #===------------------------------------------------------------------------===# 6 | 7 | LEVEL=../.. 8 | TOOLNAME = tbtrace 9 | USEDLIBS = executiontracer.a binaryreaders.a utils.a 10 | LINK_COMPONENTS = support 11 | 12 | include $(LEVEL)/Makefile.common 13 | 14 | 15 | LIBS += $(TOOL_LIBS) 16 | #-ltcmalloc 17 | -------------------------------------------------------------------------------- /klee/test/Feature/MakeSymbolicName.c: -------------------------------------------------------------------------------- 1 | // RUN: %llvmgcc %s -emit-llvm -g -c -o %t1.bc 2 | // RUN: %klee --use-random-search --exit-on-error %t1.bc 3 | 4 | #include 5 | 6 | int main() { 7 | int a[4] = {1, 2, 3, 4}; 8 | unsigned i; 9 | 10 | klee_make_symbolic(&i, sizeof(i), "index"); 11 | if (i > 3) 12 | klee_silent_exit(0); 13 | 14 | assert(a[i] << 1 != 5); 15 | if (a[i] << 1 == 6) 16 | assert(i == 2); 17 | } 18 | -------------------------------------------------------------------------------- /klee/test/Runtime/Uclibc/2007-10-08-optimization-calls-wrong-libc-functions.c: -------------------------------------------------------------------------------- 1 | // RUN: %llvmgcc %s -emit-llvm -O0 -c -o %t1.bc 2 | // RUN: %klee --exit-on-error --optimize --libc=uclibc %t1.bc 3 | 4 | #include 5 | #include 6 | 7 | int main() { 8 | int a; 9 | 10 | klee_make_symbolic(&a, sizeof a); 11 | 12 | memset(&a, 0, sizeof a); 13 | 14 | if (a) { 15 | assert(0); 16 | } 17 | 18 | return 0; 19 | } 20 | -------------------------------------------------------------------------------- /qemu/hw/lm32_pic.h: -------------------------------------------------------------------------------- 1 | #ifndef QEMU_HW_LM32_PIC_H 2 | #define QEMU_HW_LM32_PIC_H 3 | 4 | #include "qemu-common.h" 5 | 6 | uint32_t lm32_pic_get_ip(DeviceState *d); 7 | uint32_t lm32_pic_get_im(DeviceState *d); 8 | void lm32_pic_set_ip(DeviceState *d, uint32_t ip); 9 | void lm32_pic_set_im(DeviceState *d, uint32_t im); 10 | 11 | void lm32_do_pic_info(Monitor *mon); 12 | void lm32_irq_info(Monitor *mon); 13 | 14 | #endif /* QEMU_HW_LM32_PIC_H */ 15 | -------------------------------------------------------------------------------- /qemu/hw/ps2.h: -------------------------------------------------------------------------------- 1 | /* ps2.c */ 2 | void *ps2_kbd_init(void (*update_irq)(void *, int), void *update_arg); 3 | void *ps2_mouse_init(void (*update_irq)(void *, int), void *update_arg); 4 | void ps2_write_mouse(void *, int val); 5 | void ps2_write_keyboard(void *, int val); 6 | uint32_t ps2_read_data(void *); 7 | void ps2_queue(void *, int b); 8 | void ps2_keyboard_set_translation(void *opaque, int mode); 9 | void ps2_mouse_fake_event(void *opaque); 10 | -------------------------------------------------------------------------------- /stp/src/to-sat/Makefile: -------------------------------------------------------------------------------- 1 | TOP = ../.. 2 | include $(TOP)/scripts/Makefile.common 3 | 4 | SRCS = $(wildcard *.cpp) 5 | SRCS += $(wildcard AIG/*.cpp) 6 | SRCS += $(wildcard ASTNode/*.cpp) 7 | OBJS = $(SRCS:.cpp=.o) 8 | 9 | libtosat.a: $(OBJS) 10 | $(RM) $@ 11 | $(AR) qcs $@ $^ 12 | 13 | .PHONY: clean 14 | clean: 15 | $(RM) *.o */*.o *~ *.a .#* depend 16 | 17 | depend: $(SRCS) 18 | @$(call makedepend,$@,$(SRCS)) 19 | 20 | -include depend 21 | -------------------------------------------------------------------------------- /tools/tools/cacheprof/Makefile: -------------------------------------------------------------------------------- 1 | #===-- tools/klee/Makefile ---------------------------------*- Makefile -*--===# 2 | # 3 | # 4 | # 5 | #===------------------------------------------------------------------------===# 6 | 7 | LEVEL=../.. 8 | TOOLNAME = cacheprof 9 | USEDLIBS = executiontracer.a binaryreaders.a utils.a 10 | LINK_COMPONENTS = support 11 | 12 | include $(LEVEL)/Makefile.common 13 | 14 | 15 | LIBS += $(TOOL_LIBS) 16 | #-ltcmalloc 17 | -------------------------------------------------------------------------------- /tools/tools/coverage/Makefile: -------------------------------------------------------------------------------- 1 | #===-- tools/klee/Makefile ---------------------------------*- Makefile -*--===# 2 | # 3 | # 4 | # 5 | #===------------------------------------------------------------------------===# 6 | 7 | LEVEL=../.. 8 | TOOLNAME = coverage 9 | USEDLIBS = executiontracer.a binaryreaders.a utils.a 10 | LINK_COMPONENTS = support 11 | 12 | include $(LEVEL)/Makefile.common 13 | 14 | 15 | LIBS += $(TOOL_LIBS) 16 | #-ltcmalloc 17 | -------------------------------------------------------------------------------- /tools/tools/debugger/Makefile: -------------------------------------------------------------------------------- 1 | #===-- tools/klee/Makefile ---------------------------------*- Makefile -*--===# 2 | # 3 | # 4 | # 5 | #===------------------------------------------------------------------------===# 6 | 7 | LEVEL=../.. 8 | TOOLNAME = debugger 9 | USEDLIBS = executiontracer.a binaryreaders.a utils.a 10 | LINK_COMPONENTS = support 11 | 12 | include $(LEVEL)/Makefile.common 13 | 14 | 15 | LIBS += $(TOOL_LIBS) 16 | #-ltcmalloc 17 | -------------------------------------------------------------------------------- /tools/tools/icounter/Makefile: -------------------------------------------------------------------------------- 1 | #===-- tools/klee/Makefile ---------------------------------*- Makefile -*--===# 2 | # 3 | # 4 | # 5 | #===------------------------------------------------------------------------===# 6 | 7 | LEVEL=../.. 8 | TOOLNAME = icounter 9 | USEDLIBS = executiontracer.a binaryreaders.a utils.a 10 | LINK_COMPONENTS = support 11 | 12 | include $(LEVEL)/Makefile.common 13 | 14 | 15 | LIBS += $(TOOL_LIBS) 16 | #-ltcmalloc 17 | -------------------------------------------------------------------------------- /tools/tools/pfprofiler/Makefile: -------------------------------------------------------------------------------- 1 | #===-- tools/klee/Makefile ---------------------------------*- Makefile -*--===# 2 | # 3 | # 4 | # 5 | #===------------------------------------------------------------------------===# 6 | 7 | LEVEL=../.. 8 | TOOLNAME = pfprofiler 9 | USEDLIBS = executiontracer.a binaryreaders.a utils.a 10 | LINK_COMPONENTS = support 11 | 12 | include $(LEVEL)/Makefile.common 13 | 14 | 15 | LIBS += $(TOOL_LIBS) 16 | #-ltcmalloc 17 | -------------------------------------------------------------------------------- /klee/stp/Makefile.common.in: -------------------------------------------------------------------------------- 1 | # -*- Makefile -*- 2 | 3 | include $(LEVEL)/Makefile.common 4 | 5 | CFLAGS += @CFLAGS@ 6 | CXXFLAGS += @CXXFLAGS@ -O2 7 | LDFLAGS += @LDFLAGS@ -lstdc++ 8 | 9 | # use the darmin test as a proxy for detecting Mac OS X 10 | ifneq ($(shell uname -s), Darwin) 11 | CFLAGS += -static 12 | endif 13 | 14 | CXXFLAGS += -Wall -DEXT_HASH_MAP 15 | 16 | LEX := flex 17 | YACC := bison -d -y --debug -v 18 | RANLIB := ranlib 19 | 20 | -------------------------------------------------------------------------------- /klee/test/regression/2007-08-06-64bit-shift.c: -------------------------------------------------------------------------------- 1 | // RUN: %llvmgcc %s -emit-llvm -O0 -c -o %t1.bc 2 | // RUN: %klee %t1.bc 3 | 4 | #include 5 | 6 | int main() { 7 | int d; 8 | 9 | klee_make_symbolic( &d, sizeof(d) ); 10 | 11 | int l = d - 1; 12 | unsigned long long m = ((unsigned long long) l << 32) / d; 13 | if (d==2) { 14 | assert(m == 2147483648u); 15 | } 16 | 17 | klee_silent_exit(0); 18 | 19 | return 0; 20 | } 21 | -------------------------------------------------------------------------------- /qemu/s2e/Signals/signals.cpp: -------------------------------------------------------------------------------- 1 | #include "fsigc++.h" 2 | 3 | namespace fsigc { 4 | 5 | connection::connection(mysignal_base *sig, void *func, unsigned index) { 6 | m_functor = func; 7 | m_sig = sig; 8 | m_connected = true; 9 | m_index = index; 10 | } 11 | 12 | void connection::disconnect() { 13 | if (m_connected) { 14 | m_sig->disconnect(m_functor, m_index); 15 | m_connected = false; 16 | } 17 | } 18 | 19 | } 20 | -------------------------------------------------------------------------------- /tools/tools/forkprofiler/Makefile: -------------------------------------------------------------------------------- 1 | #===-- tools/klee/Makefile ---------------------------------*- Makefile -*--===# 2 | # 3 | # 4 | # 5 | #===------------------------------------------------------------------------===# 6 | 7 | LEVEL=../.. 8 | TOOLNAME = forkprofiler 9 | USEDLIBS = executiontracer.a binaryreaders.a utils.a 10 | LINK_COMPONENTS = support 11 | 12 | include $(LEVEL)/Makefile.common 13 | 14 | 15 | LIBS += $(TOOL_LIBS) 16 | #-ltcmalloc 17 | -------------------------------------------------------------------------------- /stp/src/extlib-abc/aig/cnf/Makefile: -------------------------------------------------------------------------------- 1 | TOP = ../../../.. 2 | include $(TOP)/scripts/Makefile.common 3 | 4 | SRCS = $(wildcard *.c) 5 | OBJS = $(SRCS:.c=.o) 6 | CFLAGS += -I.. 7 | CXXFLAGS += -I.. 8 | 9 | libabc.a: $(OBJS) 10 | $(AR) rc $@ $(OBJS) 11 | $(RANLIB) $@ 12 | 13 | 14 | .PHONY: clean 15 | clean: 16 | rm -rf *.o *~ *.a .#* depend 17 | 18 | #depend: $(SRCS) 19 | # @$(CXX) -MM -MG $(CXXFLAGS) $(SRCS) > $@ 20 | 21 | -include depend 22 | -------------------------------------------------------------------------------- /stp/tests/generated_tests/run-experiments.pl: -------------------------------------------------------------------------------- 1 | #!/usr/bin/perl -w 2 | 3 | use strict; 4 | for(my $vars=4; $vars <= 256;$vars=$vars*2) { 5 | my $form = 32; 6 | my $bits = 32; 7 | #for(my $vars=1; $vars <= 32;$vars++) { 8 | #for(my $bits=4; $bits <= 256;) { 9 | system("/bin/sh", "-c", "./testgen.pl -nv $vars -fv $vars -nf $form -b $bits >& form_$form.var_$vars.bits_$bits.cvc"); 10 | #$bits = $bits*2; 11 | #} 12 | #} 13 | } 14 | 15 | -------------------------------------------------------------------------------- /klee/test/Concrete/SimpleStoreAndLoad.ll: -------------------------------------------------------------------------------- 1 | declare void @print_i32(i32) 2 | 3 | define i32 @main() { 4 | entry: 5 | %a = alloca i32, i32 4 6 | %tmp1 = getelementptr i32* %a, i32 0 7 | store i32 0, i32* %tmp1 8 | %tmp2 = load i32* %tmp1 9 | %tmp3 = icmp eq i32 %tmp2, 0 10 | br i1 %tmp3, label %exitTrue, label %exitFalse 11 | exitTrue: 12 | call void @print_i32(i32 1) 13 | ret i32 0 14 | exitFalse: 15 | call void @print_i32(i32 0) 16 | ret i32 0 17 | } 18 | -------------------------------------------------------------------------------- /qemu/hw/mips_cpudevs.h: -------------------------------------------------------------------------------- 1 | #ifndef HW_MIPS_CPUDEVS_H 2 | #define HW_MIPS_CPUDEVS_H 3 | /* Definitions for MIPS CPU internal devices. */ 4 | 5 | /* mips_addr.c */ 6 | uint64_t cpu_mips_kseg0_to_phys(void *opaque, uint64_t addr); 7 | uint64_t cpu_mips_phys_to_kseg0(void *opaque, uint64_t addr); 8 | 9 | /* mips_int.c */ 10 | void cpu_mips_irq_init_cpu(CPUMIPSState *env); 11 | 12 | /* mips_timer.c */ 13 | void cpu_mips_clock_init(CPUMIPSState *); 14 | 15 | #endif 16 | -------------------------------------------------------------------------------- /qemu/tcg/TODO: -------------------------------------------------------------------------------- 1 | - Add new instructions such as: clz, ctz, popcnt. 2 | 3 | - See if it is worth exporting mul2, mulu2, div2, divu2. 4 | 5 | - Support of globals saved in fixed registers between TBs. 6 | 7 | Ideas: 8 | 9 | - Move the slow part of the qemu_ld/st ops after the end of the TB. 10 | 11 | - Change exception syntax to get closer to QOP system (exception 12 | parameters given with a specific instruction). 13 | 14 | - Add float and vector support. 15 | -------------------------------------------------------------------------------- /qemu/tests/tcg/cris/check_movprv32.s: -------------------------------------------------------------------------------- 1 | # mach: crisv32 2 | # output: ffffff20\nbb113344\n 3 | 4 | # Test v32-specific special registers. FIXME: more registers. 5 | 6 | .include "testutils.inc" 7 | start 8 | moveq -1,r3 9 | setf zcvn 10 | move vr,r3 11 | test_cc 1 1 1 1 12 | checkr3 ffffff20 13 | 14 | moveq -1,r3 15 | move.d 0xbb113344,r4 16 | clearf cvnz 17 | move r4,mof 18 | test_cc 0 0 0 0 19 | move mof,r3 20 | checkr3 bb113344 21 | quit 22 | -------------------------------------------------------------------------------- /stp/src/boost/pool/detail/pool_construct_simple.sh: -------------------------------------------------------------------------------- 1 | #!/bin/sh 2 | # 3 | # Copyright (C) 2001 Stephen Cleary 4 | # 5 | # Distributed under the Boost Software License, Version 1.0. (See accompany- 6 | # ing file LICENSE_1_0.txt or copy at http://www.boost.org/LICENSE_1_0.txt) 7 | # 8 | # See http://www.boost.org for updates, documentation, and revision history. 9 | # 10 | 11 | m4 -P -E -DNumberOfArguments=$1 pool_construct_simple.m4 > pool_construct_simple.inc 12 | -------------------------------------------------------------------------------- /tools/lib/Utils/signals.cpp: -------------------------------------------------------------------------------- 1 | #include "Signals/fsigc++.h" 2 | 3 | namespace fsigc { 4 | 5 | connection::connection(mysignal_base *sig, void *func, unsigned index) { 6 | m_functor = func; 7 | m_sig = sig; 8 | m_connected = true; 9 | m_index = index; 10 | } 11 | 12 | void connection::disconnect() { 13 | if (m_connected) { 14 | m_sig->disconnect(m_functor, m_index); 15 | m_connected = false; 16 | } 17 | } 18 | 19 | } 20 | -------------------------------------------------------------------------------- /qemu/tests/tcg/cris/check_gcctorture_pr28634-1.c: -------------------------------------------------------------------------------- 1 | /* PR rtl-optimization/28634. On targets with delayed branches, 2 | dbr_schedule could do the next iteration's addition in the 3 | branch delay slot, then subtract the value again if the branch 4 | wasn't taken. This can lead to rounding errors. */ 5 | int x = -1; 6 | int y = 1; 7 | int 8 | main (void) 9 | { 10 | while (y > 0) 11 | y += x; 12 | if (y != x + 1) 13 | abort (); 14 | exit (0); 15 | } 16 | -------------------------------------------------------------------------------- /qemu/tests/tcg/lm32/test_sli.S: -------------------------------------------------------------------------------- 1 | .include "macros.inc" 2 | 3 | start 4 | 5 | test_name SLI_1 6 | mvi r1, 1 7 | sli r3, r1, 0 8 | check_r3 1 9 | 10 | test_name SLI_2 11 | mvi r1, 0 12 | sli r3, r1, 1 13 | check_r3 0 14 | 15 | test_name SLI_3 16 | mvi r1, 1 17 | sli r3, r1, 31 18 | check_r3 0x80000000 19 | 20 | test_name SLI_4 21 | mvi r1, 16 22 | sli r3, r1, 31 23 | check_r3 0 24 | 25 | test_name SLI_7 26 | mvi r3, 2 27 | sli r3, r3, 2 28 | check_r3 8 29 | 30 | end 31 | -------------------------------------------------------------------------------- /stp/src/ocaml-wrapper/Makefile: -------------------------------------------------------------------------------- 1 | ######################################################### 2 | # 3 | # Owned and copyright BitBlaze, 2007. All rights reserved. 4 | # 5 | ######################################################### 6 | 7 | export OCAMLMAKEFILE=OCamlMakefile 8 | 9 | SOURCES=libstp_regerrorhandler.c libstp.idl stpvc.ml stpvc.mli 10 | RESULT=stpvc 11 | 12 | LIBDIRS = .. 13 | CLIBS = stp stdc++ 14 | 15 | all: dcl ncl top 16 | 17 | include $(OCAMLMAKEFILE) 18 | -------------------------------------------------------------------------------- /stp/unit_test/harald.smt2: -------------------------------------------------------------------------------- 1 | (set-logic QF_BV) 2 | (set-info :smt-lib-version 2.0) 3 | (set-info :category "check") 4 | (set-info :status sat) 5 | (declare-fun x () (_ BitVec 15)) 6 | (declare-fun y () (_ BitVec 15)) 7 | (declare-fun z () (_ BitVec 15)) 8 | 9 | 10 | 11 | (assert (= y (bvadd x (_ bv1 15)))) 12 | (assert (= z (bvadd y (_ bv1 15)))) 13 | 14 | (assert (= (bvmul y y ) (bvadd (_ bv1 15) (bvmul x z)))) 15 | 16 | 17 | 18 | (check-sat) 19 | (exit) 20 | 21 | -------------------------------------------------------------------------------- /qemu/hw/xio3130_downstream.h: -------------------------------------------------------------------------------- 1 | #ifndef QEMU_XIO3130_DOWNSTREAM_H 2 | #define QEMU_XIO3130_DOWNSTREAM_H 3 | 4 | #include "pcie_port.h" 5 | 6 | PCIESlot *xio3130_downstream_init(PCIBus *bus, int devfn, bool multifunction, 7 | const char *bus_name, pci_map_irq_fn map_irq, 8 | uint8_t port, uint8_t chassis, 9 | uint16_t slot); 10 | 11 | #endif /* QEMU_XIO3130_DOWNSTREAM_H */ 12 | -------------------------------------------------------------------------------- /qemu/tests/tcg/cris/check_clearfv32.s: -------------------------------------------------------------------------------- 1 | # mach: crisv32 2 | # output: ef\nef\n 3 | 4 | ; Check that "clearf x" doesn't trivially fail. 5 | 6 | .include "testutils.inc" 7 | start 8 | setf puixnzvc 9 | clearf x ; Actually, x would be cleared by almost-all other insns. 10 | move ccs,r3 11 | and.d 0xff, $r3 12 | checkr3 ef 13 | 14 | setf puixnzvc 15 | moveq 0, $r3 ; moveq should only clear the xflag. 16 | move ccs,r3 17 | and.d 0xff, $r3 18 | checkr3 ef 19 | quit 20 | -------------------------------------------------------------------------------- /qemu/tests/tcg/cris/check_openpf2.c: -------------------------------------------------------------------------------- 1 | /* Check that the simulator has chdir:ed to the --sysroot argument 2 | #sim: --sysroot=@srcdir@ 3 | (or that --sysroot is applied to relative file paths). */ 4 | 5 | #include 6 | #include 7 | #include 8 | int main (int argc, char *argv[]) 9 | { 10 | FILE *f = fopen ("check_openpf2.c", "rb"); 11 | if (f == NULL) 12 | abort (); 13 | fclose(f); 14 | printf ("pass\n"); 15 | return 0; 16 | } 17 | -------------------------------------------------------------------------------- /qemu/tests/tcg/lm32/test_divu.S: -------------------------------------------------------------------------------- 1 | .include "macros.inc" 2 | 3 | start 4 | 5 | test_name DIVU_1 6 | mvi r1, 0 7 | mvi r2, 1 8 | divu r3, r1, r2 9 | check_r3 0 10 | 11 | test_name DIVU_2 12 | mvi r1, 1 13 | mvi r2, 1 14 | divu r3, r1, r2 15 | check_r3 1 16 | 17 | test_name DIVU_3 18 | mvi r1, 0 19 | mvi r2, 0 20 | divu r3, r1, r2 21 | check_excp 16 22 | 23 | test_name DIVU_4 24 | load r1 0xabcdef12 25 | load r2 0x12345 26 | divu r3, r1, r2 27 | check_r3 0x9700 28 | 29 | end 30 | -------------------------------------------------------------------------------- /klee/test/Concrete/InvokeAndUnwindTwice.ll: -------------------------------------------------------------------------------- 1 | declare void @print_i32(i32) 2 | 3 | define i8 @myadd(i8 %a, i8 %b) { 4 | unwind 5 | } 6 | 7 | define i8 @sum(i8 %a, i8 %b) { 8 | %c = call i8 @myadd(i8 %a, i8 %b) 9 | ret i8 %c 10 | } 11 | 12 | define i32 @main() { 13 | invoke i8 @sum(i8 1, i8 2) 14 | to label %continue 15 | unwind label %error 16 | continue: 17 | call void @print_i32(i32 1) 18 | ret i32 0 19 | error: 20 | call void @print_i32(i32 0) 21 | ret i32 0 22 | } 23 | -------------------------------------------------------------------------------- /klee/test/Expr/Parser/Concat64.pc: -------------------------------------------------------------------------------- 1 | # RUN: kleaver --print-ast %s 2 | 3 | array arr1[8] : w32 -> w8 = symbolic 4 | (query [(Eq 0 5 | (Concat w64 (Read w8 7 arr1) 6 | (Concat w56 (Read w8 6 arr1) 7 | (Concat w48 (Read w8 5 arr1) 8 | (Concat w40 (Read w8 4 arr1) 9 | (Concat w32 (Read w8 3 arr1) 10 | (Concat w24 (Read w8 2 arr1) 11 | (Concat w16 (Read w8 1 arr1) (Read w8 0 arr1)))))))))] 12 | false) 13 | -------------------------------------------------------------------------------- /qemu/qemu-thread-posix.h: -------------------------------------------------------------------------------- 1 | #ifndef __QEMU_THREAD_POSIX_H 2 | #define __QEMU_THREAD_POSIX_H 1 3 | #include "pthread.h" 4 | #include "config-host.h" 5 | 6 | struct QemuMutex { 7 | pthread_mutex_t lock; 8 | }; 9 | 10 | struct QemuCond { 11 | pthread_cond_t cond; 12 | }; 13 | 14 | struct QemuThread { 15 | pthread_t thread; 16 | }; 17 | 18 | #ifndef CONFIG_DARWIN 19 | 20 | struct QemuSpinlock { 21 | pthread_spinlock_t lock; 22 | }; 23 | 24 | #endif 25 | 26 | #endif 27 | -------------------------------------------------------------------------------- /qemu/tests/tcg/cris/check_gcctorture_pr28634.c: -------------------------------------------------------------------------------- 1 | /* PR rtl-optimization/28634. On targets with delayed branches, 2 | dbr_schedule could do the next iteration's addition in the 3 | branch delay slot, then subtract the value again if the branch 4 | wasn't taken. This can lead to rounding errors. */ 5 | double x = -0x1.0p53; 6 | double y = 1; 7 | int 8 | main (void) 9 | { 10 | while (y > 0) 11 | y += x; 12 | if (y != x + 1) 13 | abort (); 14 | exit (0); 15 | } 16 | -------------------------------------------------------------------------------- /qemu/tests/tcg/xtensa/test_mul32.S: -------------------------------------------------------------------------------- 1 | .include "macros.inc" 2 | 3 | test_suite mul32 4 | 5 | test mull 6 | movi a2, 0x137f5a5a 7 | mov a3, a2 8 | movi a4, 0xa5a5137f 9 | movi a6, 0x5de480a6 10 | mull a5, a2, a4 11 | assert eq, a5, a6 12 | mull a2, a2, a4 13 | assert eq, a2, a6 14 | mull a3, a4, a3 15 | assert eq, a3, a6 16 | test_end 17 | 18 | /* unfortunately dc232b doesn't have muluh/mulsh*/ 19 | 20 | test_suite_end 21 | -------------------------------------------------------------------------------- /guest/windbg-gdb/StartSize.h: -------------------------------------------------------------------------------- 1 | #ifndef _WINDBG_STARTSIZE_ 2 | 3 | #define _WINDBG_STARTSIZE_ 4 | 5 | #include 6 | 7 | struct StartSize { 8 | uint64_t Start, Size; 9 | bool operator<(const StartSize &i2) const { 10 | return Start+Size <= i2.Start; 11 | } 12 | StartSize() { 13 | Start = Size = 0; 14 | } 15 | StartSize(uint64_t st, uint64_t sz) { 16 | Start = st; 17 | Size = sz; 18 | } 19 | }; 20 | 21 | 22 | #endif 23 | -------------------------------------------------------------------------------- /klee/test/Feature/MakeConcreteSymbolic.c: -------------------------------------------------------------------------------- 1 | // RUN: %llvmgcc %s -emit-llvm -g -c -o %t1.bc 2 | // RUN: %klee --exit-on-error %t1.bc 3 | // RUN: grep "done: total queries = 0" klee-last/info 4 | // RUN: %klee --make-concrete-symbolic=1 --exit-on-error %t1.bc 5 | // RUN: grep "done: total queries = 2" klee-last/info 6 | 7 | 8 | #include 9 | 10 | #define N 2 11 | int main() { 12 | int i; 13 | char a; 14 | 15 | a = 10; 16 | assert(a == 10); 17 | 18 | return 0; 19 | } 20 | -------------------------------------------------------------------------------- /qemu/bsd-user/x86_64/target_signal.h: -------------------------------------------------------------------------------- 1 | #ifndef TARGET_SIGNAL_H 2 | #define TARGET_SIGNAL_H 3 | 4 | #include "cpu.h" 5 | 6 | /* this struct defines a stack used during syscall handling */ 7 | 8 | typedef struct target_sigaltstack { 9 | abi_ulong ss_sp; 10 | abi_long ss_flags; 11 | abi_ulong ss_size; 12 | } target_stack_t; 13 | 14 | static inline abi_ulong get_sp_from_cpustate(CPUX86State *state) 15 | { 16 | return state->regs[R_ESP]; 17 | } 18 | 19 | #endif /* TARGET_SIGNAL_H */ 20 | -------------------------------------------------------------------------------- /qemu/tests/tcg/xtensa/crt.S: -------------------------------------------------------------------------------- 1 | .section .init 2 | j 1f 3 | .section .init.text 4 | 1: 5 | movi a2, _start 6 | jx a2 7 | 8 | .text 9 | .global _start 10 | _start: 11 | movi a2, 1 12 | wsr a2, windowstart 13 | movi a2, 0 14 | wsr a2, windowbase 15 | movi a1, _fstack 16 | movi a2, 0x4000f 17 | wsr a2, ps 18 | isync 19 | 20 | call0 main 21 | 22 | mov a3, a2 23 | movi a2, 1 24 | simcall 25 | -------------------------------------------------------------------------------- /stp/tests/c-api-tests/parsefile-using-cinterface.c: -------------------------------------------------------------------------------- 1 | //g++ -I$(HOME)/stp/c_interface print.c -L$(HOME)/stp/lib -lstp -o hex 2 | 3 | #include 4 | #include "c_interface.h" 5 | 6 | int main() { 7 | VC vc = vc_createValidityChecker(); 8 | vc_setFlags(vc,'n'); 9 | vc_setFlags(vc,'d'); 10 | vc_setFlags(vc,'p'); 11 | 12 | Expr c = vc_parseExpr(vc,"./t.cvc"); 13 | 14 | vc_printExpr(vc, c); 15 | vc_DeleteExpr(c); 16 | printf("\n"); 17 | vc_Destroy(vc); 18 | } 19 | 20 | -------------------------------------------------------------------------------- /klee/test/Feature/Float.c: -------------------------------------------------------------------------------- 1 | // RUN: %llvmgcc -g -c %s -o %t.bc 2 | // RUN: %klee %t.bc > %t.log 3 | // RUN: grep "3.30* -1.10* 2.420*" %t.log 4 | 5 | #include 6 | 7 | float fadd(float a, float b) { 8 | return a + b; 9 | } 10 | 11 | float fsub(float a, float b) { 12 | return a - b; 13 | } 14 | 15 | float fmul(float a, float b) { 16 | return a * b; 17 | } 18 | 19 | int main() { 20 | printf("%f %f %f\n", fadd(1.1, 2.2), fsub(1.1, 2.2), fmul(1.1, 2.2)); 21 | return 0; 22 | } 23 | -------------------------------------------------------------------------------- /klee/unittests/Makefile: -------------------------------------------------------------------------------- 1 | ##===- unittests/Makefile ----------------------------------*- Makefile -*-===## 2 | 3 | LEVEL = .. 4 | 5 | include $(LEVEL)/Makefile.config 6 | 7 | LIBRARYNAME = UnitTestMain 8 | BUILD_ARCHIVE = 1 9 | CPP.Flags += -I$(LLVM_SRC_ROOT)/utils/unittest/googletest/include/ 10 | CPP.Flags += -Wno-variadic-macros 11 | 12 | # FIXME: Parallel dirs is broken? 13 | DIRS = Expr Solver 14 | 15 | include $(LEVEL)/Makefile.common 16 | 17 | clean:: 18 | $(Verb) $(RM) -f *Tests 19 | -------------------------------------------------------------------------------- /qemu/bsd-user/i386/target_signal.h: -------------------------------------------------------------------------------- 1 | #ifndef TARGET_SIGNAL_H 2 | #define TARGET_SIGNAL_H 3 | 4 | #include "cpu.h" 5 | 6 | /* this struct defines a stack used during syscall handling */ 7 | 8 | typedef struct target_sigaltstack { 9 | abi_ulong ss_sp; 10 | abi_long ss_flags; 11 | abi_ulong ss_size; 12 | } target_stack_t; 13 | 14 | 15 | static inline abi_ulong get_sp_from_cpustate(CPUX86State *state) 16 | { 17 | return state->regs[R_ESP]; 18 | } 19 | 20 | #endif /* TARGET_SIGNAL_H */ 21 | -------------------------------------------------------------------------------- /stp/DOWNLOAD: -------------------------------------------------------------------------------- 1 | 2 | 3 | /******************************************************************** 4 | * PROGRAM NAME: STP (Simple Theorem Prover) 5 | * 6 | * AUTHORS: Vijay Ganesh 7 | * 8 | * BEGIN DATE: November, 2005 9 | * 10 | * LICENSE: Please view LICENSE file in the home dir of this Program 11 | ********************************************************************/ 12 | 13 | svn co https://stp-fast-prover.svn.sourceforge.net/svnroot/stp-fast-prover/trunk/stp stp 14 | 15 | 16 | 17 | -------------------------------------------------------------------------------- /stp/tests/sample-tests/a167test0001.cvc: -------------------------------------------------------------------------------- 1 | %% Regression level = 3 2 | %% Result = InValid 3 | %% Language = presentation 4 | 5 | n: BITVECTOR(32); 6 | c: BITVECTOR(8); 7 | %---------------------------------------------------- 8 | ASSERT BVLT(n,0bin00000000000000000000000000010000); 9 | ASSERT NOT NOT ((0bin000000000000000000000000 @ 10 | c) = 0bin00000000000000000000000011111110); 11 | 12 | %---------------------------------------------------- 13 | QUERY FALSE; 14 | COUNTEREXAMPLE; 15 | -------------------------------------------------------------------------------- /tools/Makefile: -------------------------------------------------------------------------------- 1 | ##===- s2etools/Makefile ------------------------*- Makefile -*-===## 2 | # 3 | # S2ETOOLS 4 | # 5 | ##===-----------------------------------------------------------===## 6 | 7 | # 8 | # Indicates our relative path to the top of the project's root directory. 9 | # 10 | LEVEL = . 11 | PARALLEL_DIRS = 12 | DIRS = lib tools 13 | EXTRA_DIST = include 14 | 15 | # 16 | # Include the Master Makefile that knows how to build all. 17 | # 18 | include $(LEVEL)/Makefile.common 19 | 20 | 21 | -------------------------------------------------------------------------------- /tools/tools/Makefile: -------------------------------------------------------------------------------- 1 | ##===- tools/Makefile ---------------*- Makefile -*-===## 2 | # 3 | # S2E 4 | # 5 | ##===-----------------------------------------------===## 6 | 7 | # 8 | # Relative path to the top of the source tree. 9 | # 10 | LEVEL=.. 11 | 12 | # 13 | # List all of the subdirectories that we will compile. 14 | # 15 | PARALLEL_DIRS=tbtrace coverage debugger s2etools-config forkprofiler icounter cacheprof 16 | OPTIONAL_DIRS=static-translator 17 | 18 | include $(LEVEL)/Makefile.common 19 | -------------------------------------------------------------------------------- /klee/test/CXX/StaticConstructor.cpp: -------------------------------------------------------------------------------- 1 | // RUN: %llvmgxx %s --emit-llvm -O0 -c -o %t1.bc 2 | // RUN: %klee --libc=klee --no-output --exit-on-error %t1.bc 3 | 4 | #include 5 | 6 | // to make sure globals are initialized 7 | int aGlobal = 21; 8 | 9 | class Test { 10 | int x; 11 | 12 | public: 13 | Test() : x(aGlobal + 1) {} 14 | ~Test() {} 15 | 16 | int getX() { return x; } 17 | }; 18 | 19 | Test t; 20 | 21 | int main() { 22 | assert(t.getX()==22); 23 | 24 | return 0; 25 | } 26 | -------------------------------------------------------------------------------- /qemu/hw/esp.h: -------------------------------------------------------------------------------- 1 | #ifndef QEMU_HW_ESP_H 2 | #define QEMU_HW_ESP_H 3 | 4 | /* esp.c */ 5 | #define ESP_MAX_DEVS 7 6 | typedef void (*ESPDMAMemoryReadWriteFunc)(void *opaque, uint8_t *buf, int len); 7 | void esp_init(target_phys_addr_t espaddr, int it_shift, 8 | ESPDMAMemoryReadWriteFunc dma_memory_read, 9 | ESPDMAMemoryReadWriteFunc dma_memory_write, 10 | void *dma_opaque, qemu_irq irq, qemu_irq *reset, 11 | qemu_irq *dma_enable); 12 | 13 | #endif 14 | -------------------------------------------------------------------------------- /stp/src/sat/README: -------------------------------------------------------------------------------- 1 | Directory overview: 2 | ================== 3 | 4 | mtl/ Mini Template Library 5 | core/ A core version of the solver 6 | simp/ An extended solver with simplification capabilities 7 | README 8 | LICENSE 9 | 10 | To build (release version: without assertions, statically linked, etc): 11 | ====================================================================== 12 | 13 | cd { core | simp } 14 | gmake rs 15 | 16 | Usage: 17 | ====== 18 | 19 | TODO 20 | -------------------------------------------------------------------------------- /stp/unit_test/mod.smt2: -------------------------------------------------------------------------------- 1 | (set-logic QF_BV) 2 | (set-info :smt-lib-version 2.0) 3 | (set-info :category "check") 4 | (set-info :status sat) 5 | (declare-fun x () (_ BitVec 15)) 6 | (declare-fun y () (_ BitVec 15)) 7 | 8 | 9 | 10 | ; This is always true. 11 | (assert 12 | (bvuge 13 | (_ bv9 15) 14 | (bvurem (bvand x y) (_ bv10 15)) 15 | ) 16 | ) 17 | 18 | ; So unconstrained variables don't eliminate immediately. 19 | (assert (not (= x y))) 20 | 21 | 22 | 23 | (check-sat) 24 | (exit) 25 | 26 | -------------------------------------------------------------------------------- /klee/lib/Makefile: -------------------------------------------------------------------------------- 1 | #===-- lib/Makefile ----------------------------------------*- Makefile -*--===# 2 | # 3 | # The KLEE Symbolic Virtual Machine 4 | # 5 | # This file is distributed under the University of Illinois Open Source 6 | # License. See LICENSE.TXT for details. 7 | # 8 | #===------------------------------------------------------------------------===# 9 | 10 | LEVEL=.. 11 | 12 | PARALLEL_DIRS=Basic Support Expr Solver Module Core 13 | 14 | include $(LEVEL)/Makefile.common 15 | -------------------------------------------------------------------------------- /qemu/tests/qemu-iotests/029.out: -------------------------------------------------------------------------------- 1 | QA output created by 029 2 | Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=67108864 cluster_size=65536 3 | wrote 4096/4096 bytes at offset 0 4 | 4 KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec) 5 | No errors were found on the image. 6 | Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=16777216 cluster_size=1024 7 | wrote 4194304/4194304 bytes at offset 0 8 | 4 MiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec) 9 | No errors were found on the image. 10 | *** done 11 | -------------------------------------------------------------------------------- /qemu/tests/tcg/cris/check_sigalrm.c: -------------------------------------------------------------------------------- 1 | #include 2 | #include 3 | #include 4 | #include 5 | 6 | #define MAGIC (0xdeadbeef) 7 | 8 | int s = 0; 9 | void sighandler(int sig) 10 | { 11 | s = MAGIC; 12 | } 13 | 14 | int main(int argc, char **argv) 15 | { 16 | int p; 17 | 18 | p = getpid(); 19 | signal(SIGALRM, sighandler); 20 | kill(p, SIGALRM); 21 | if (s != MAGIC) 22 | return EXIT_FAILURE; 23 | 24 | printf ("passed\n"); 25 | return EXIT_SUCCESS; 26 | } 27 | -------------------------------------------------------------------------------- /qemu/tests/tcg/lm32/test_bret.S: -------------------------------------------------------------------------------- 1 | .include "macros.inc" 2 | 3 | start 4 | 5 | test_name BRET_1 6 | mvi r1, 4 7 | wcsr IE, r1 8 | load ba mark 9 | bret 10 | tc_fail 11 | bi 1f 12 | 13 | mark: 14 | tc_pass 15 | 16 | 1: 17 | test_name BRET_2 18 | rcsr r3, IE 19 | check_r3 5 20 | 21 | test_name BRET_3 22 | mvi r1, 0 23 | wcsr IE, r1 24 | load ba mark2 25 | bret 26 | tc_fail 27 | bi 1f 28 | 29 | mark2: 30 | tc_pass 31 | 32 | 1: 33 | test_name BRET_4 34 | rcsr r3, IE 35 | check_r3 0 36 | 37 | end 38 | 39 | -------------------------------------------------------------------------------- /qemu/tests/tcg/lm32/test_eret.S: -------------------------------------------------------------------------------- 1 | .include "macros.inc" 2 | 3 | start 4 | 5 | test_name ERET_1 6 | mvi r1, 2 7 | wcsr IE, r1 8 | load ea mark 9 | eret 10 | tc_fail 11 | bi 1f 12 | 13 | mark: 14 | tc_pass 15 | 16 | 1: 17 | test_name ERET_2 18 | rcsr r3, IE 19 | check_r3 3 20 | 21 | test_name ERET_3 22 | mvi r1, 0 23 | wcsr IE, r1 24 | load ea mark2 25 | eret 26 | tc_fail 27 | bi 1f 28 | 29 | mark2: 30 | tc_pass 31 | 32 | 1: 33 | test_name ERET_4 34 | rcsr r3, IE 35 | check_r3 0 36 | 37 | end 38 | 39 | -------------------------------------------------------------------------------- /stp/unit_test/eq.smt2: -------------------------------------------------------------------------------- 1 | (set-logic QF_BV) 2 | (set-info :smt-lib-version 2.0) 3 | (set-info :category "check") 4 | (set-info :status sat) 5 | (declare-fun v0 () (_ BitVec 2)) 6 | (declare-fun v1 () (_ BitVec 2)) 7 | (declare-fun v2 () (_ BitVec 2)) 8 | (declare-fun v3 () (_ BitVec 2)) 9 | 10 | 11 | (assert 12 | (= 13 | (bvor (concat v0 (_ bv0 2)) (concat (_ bv0 2) v1) ) 14 | (bvxor (concat v2 (_ bv0 2)) (concat (_ bv0 2) v3) ) 15 | ) 16 | ) 17 | 18 | 19 | 20 | (check-sat) 21 | (exit) 22 | 23 | -------------------------------------------------------------------------------- /qemu/hw/sparc32_dma.h: -------------------------------------------------------------------------------- 1 | #ifndef SPARC32_DMA_H 2 | #define SPARC32_DMA_H 3 | 4 | /* sparc32_dma.c */ 5 | void ledma_memory_read(void *opaque, target_phys_addr_t addr, 6 | uint8_t *buf, int len, int do_bswap); 7 | void ledma_memory_write(void *opaque, target_phys_addr_t addr, 8 | uint8_t *buf, int len, int do_bswap); 9 | void espdma_memory_read(void *opaque, uint8_t *buf, int len); 10 | void espdma_memory_write(void *opaque, uint8_t *buf, int len); 11 | 12 | #endif 13 | -------------------------------------------------------------------------------- /qemu/target-cris/mmu.h: -------------------------------------------------------------------------------- 1 | #define CRIS_MMU_ERR_EXEC 0 2 | #define CRIS_MMU_ERR_READ 1 3 | #define CRIS_MMU_ERR_WRITE 2 4 | #define CRIS_MMU_ERR_FLUSH 3 5 | 6 | struct cris_mmu_result 7 | { 8 | uint32_t phy; 9 | int prot; 10 | int bf_vec; 11 | }; 12 | 13 | void cris_mmu_init(CPUCRISState *env); 14 | void cris_mmu_flush_pid(CPUCRISState *env, uint32_t pid); 15 | int cris_mmu_translate(struct cris_mmu_result *res, 16 | CPUCRISState *env, uint32_t vaddr, 17 | int rw, int mmu_idx, int debug); 18 | -------------------------------------------------------------------------------- /klee/test/Feature/PreferCex.c: -------------------------------------------------------------------------------- 1 | // RUN: %llvmgcc %s -emit-llvm -O0 -c -o %t1.bc 2 | // RUN: %klee --exit-on-error %t1.bc 3 | // RUN: ktest-tool klee-last/test000001.ktest | grep -F 'Hi\x00\x00' 4 | 5 | #include 6 | #include 7 | #include 8 | 9 | int main() { 10 | char buf[4]; 11 | 12 | klee_make_symbolic(buf, sizeof buf); 13 | klee_prefer_cex(buf, buf[0]=='H'); 14 | klee_prefer_cex(buf, buf[1]=='i'); 15 | klee_prefer_cex(buf, buf[2]=='\0'); 16 | 17 | return 0; 18 | } 19 | -------------------------------------------------------------------------------- /klee/test/Feature/WriteCov.c: -------------------------------------------------------------------------------- 1 | // RUN: %llvmgcc %s -emit-llvm -g -c -o %t2.bc 2 | // RUN: %klee --exit-on-error --write-cov %t2.bc 3 | // RUN: grep WriteCov.c:10 klee-last/test000002.cov 4 | // RUN: grep WriteCov.c:12 klee-last/test000001.cov 5 | 6 | #include 7 | 8 | int main() { 9 | if (klee_range(0,2, "range")) { 10 | assert(__LINE__ == 10); printf("__LINE__ = %d\n", __LINE__); 11 | } else { 12 | assert(__LINE__ == 12); printf("__LINE__ = %d\n", __LINE__); 13 | } 14 | return 0; 15 | } 16 | -------------------------------------------------------------------------------- /stp/tests/crypto-tests/t3.stp: -------------------------------------------------------------------------------- 1 | 2 | a,b,c,x,y : BITVECTOR(48); 3 | 4 | ASSERT(y=BVDIV(48,c,a)); 5 | 6 | 7 | ASSERT(a[0:0] = 0bin1); 8 | ASSERT(b[0:0] = 0bin1); 9 | ASSERT(c=0hex0056E35E38CD); 10 | 11 | 12 | QUERY( 13 | NOT ( 14 | c=BVMULT(48,a,b) AND NOT 15 | a=0hex000000000001 16 | AND 17 | NOT 18 | b=0hex000000000001 19 | AND NOT 20 | a=c 21 | AND NOT 22 | b=c 23 | AND NOT 24 | BVGT(b,y) 25 | 26 | ) 27 | ); 28 | 29 | COUNTEREXAMPLE; 30 | 31 | -------------------------------------------------------------------------------- /klee/runtime/klee-libc/abort.c: -------------------------------------------------------------------------------- 1 | //===-- abort.c -----------------------------------------------------------===// 2 | // 3 | // The KLEE Symbolic Virtual Machine 4 | // 5 | // This file is distributed under the University of Illinois Open Source 6 | // License. See LICENSE.TXT for details. 7 | // 8 | //===----------------------------------------------------------------------===// 9 | 10 | #include 11 | 12 | #include "klee/klee.h" 13 | 14 | void abort(void) { 15 | klee_abort(); 16 | } 17 | -------------------------------------------------------------------------------- /qemu/Makefile.dis: -------------------------------------------------------------------------------- 1 | # Makefile for disassemblers. 2 | 3 | include ../config-host.mak 4 | include config.mak 5 | include $(SRC_PATH)/rules.mak 6 | 7 | .PHONY: all 8 | 9 | $(call set-vpath, $(SRC_PATH)) 10 | 11 | QEMU_CFLAGS+=-I.. 12 | 13 | include $(SRC_PATH)/Makefile.objs 14 | 15 | all: $(libdis-y) 16 | # Dummy command so that make thinks it has done something 17 | @true 18 | 19 | clean: 20 | rm -f *.o *.d *.a *~ 21 | 22 | # Include automatically generated dependency files 23 | -include $(wildcard *.d */*.d) 24 | -------------------------------------------------------------------------------- /qemu/hw/9p.h: -------------------------------------------------------------------------------- 1 | /* 2 | * Virtio 9p 3 | * 4 | * Copyright IBM, Corp. 2010 5 | * 6 | * Authors: 7 | * Aneesh Kumar K.V 8 | * 9 | * This work is licensed under the terms of the GNU GPL, version 2. See 10 | * the COPYING file in the top-level directory. 11 | * 12 | */ 13 | 14 | #ifndef QEMU_9P_H 15 | #define QEMU_9P_H 16 | 17 | typedef struct V9fsConf 18 | { 19 | /* tag name for the device */ 20 | char *tag; 21 | char *fsdev_id; 22 | } V9fsConf; 23 | 24 | #endif 25 | -------------------------------------------------------------------------------- /qemu/hw/apm.h: -------------------------------------------------------------------------------- 1 | #ifndef APM_H 2 | #define APM_H 3 | 4 | #include 5 | #include "qemu-common.h" 6 | #include "hw.h" 7 | 8 | typedef void (*apm_ctrl_changed_t)(uint32_t val, void *arg); 9 | 10 | typedef struct APMState { 11 | uint8_t apmc; 12 | uint8_t apms; 13 | 14 | apm_ctrl_changed_t callback; 15 | void *arg; 16 | } APMState; 17 | 18 | void apm_init(APMState *s, apm_ctrl_changed_t callback, void *arg); 19 | 20 | extern const VMStateDescription vmstate_apm; 21 | 22 | #endif /* APM_H */ 23 | -------------------------------------------------------------------------------- /docs/Makefile: -------------------------------------------------------------------------------- 1 | RST_FILES := $(wildcard *.rst */*.rst) 2 | HTML_FILES := $(RST_FILES:.rst=.html) 3 | 4 | all: $(HTML_FILES) 5 | 6 | clean: 7 | rm -f $(HTML_FILES) 8 | 9 | %.html: %.rst 10 | ./rst2html-pygments \ 11 | --stylesheet=$$(echo $< | sed -e 's:[^/]\+/:../:g' | xargs dirname)/s2e.css \ 12 | --link-stylesheet --source-link --no-toc-backlinks \ 13 | --input-encoding utf-8:strict $< $@ 14 | sed -i 's/\.rst/\.html/' $@ 15 | sed -i 's/$(basename $(notdir $@))\.html/$(basename $(notdir $@)).rst/' $@ 16 | -------------------------------------------------------------------------------- /qemu/tests/tcg/xtensa/test_boolean.S: -------------------------------------------------------------------------------- 1 | .include "macros.inc" 2 | 3 | test_suite boolean 4 | 5 | test all4 6 | movi a2, 0xfec0 7 | wsr a2, br 8 | all4 b0, b0 9 | rsr a3, br 10 | assert eq, a2, a3 11 | all4 b0, b4 12 | rsr a3, br 13 | assert eq, a2, a3 14 | all4 b0, b8 15 | rsr a3, br 16 | assert eq, a2, a3 17 | all4 b0, b12 18 | rsr a3, br 19 | addi a2, a2, 1 20 | assert eq, a2, a3 21 | test_end 22 | 23 | test_suite_end 24 | -------------------------------------------------------------------------------- /klee/lib/Basic/Makefile: -------------------------------------------------------------------------------- 1 | #===-- lib/Basic/Makefile ----------------------------------*- Makefile -*--===# 2 | # 3 | # The KLEE Symbolic Virtual Machine 4 | # 5 | # This file is distributed under the University of Illinois Open Source 6 | # License. See LICENSE.TXT for details. 7 | # 8 | #===------------------------------------------------------------------------===# 9 | 10 | LEVEL=../.. 11 | 12 | LIBRARYNAME=kleeBasic 13 | DONT_BUILD_RELINKED=1 14 | BUILD_ARCHIVE=1 15 | 16 | include $(LEVEL)/Makefile.common 17 | -------------------------------------------------------------------------------- /klee/lib/Core/Makefile: -------------------------------------------------------------------------------- 1 | #===-- lib/Core/Makefile -----------------------------------*- Makefile -*--===# 2 | # 3 | # The KLEE Symbolic Virtual Machine 4 | # 5 | # This file is distributed under the University of Illinois Open Source 6 | # License. See LICENSE.TXT for details. 7 | # 8 | #===------------------------------------------------------------------------===# 9 | 10 | LEVEL=../.. 11 | 12 | LIBRARYNAME=kleeCore 13 | DONT_BUILD_RELINKED=1 14 | BUILD_ARCHIVE=1 15 | 16 | include $(LEVEL)/Makefile.common 17 | -------------------------------------------------------------------------------- /klee/runtime/klee-libc/strcmp.c: -------------------------------------------------------------------------------- 1 | //===-- strcmp.c ----------------------------------------------------------===// 2 | // 3 | // The KLEE Symbolic Virtual Machine 4 | // 5 | // This file is distributed under the University of Illinois Open Source 6 | // License. See LICENSE.TXT for details. 7 | // 8 | //===----------------------------------------------------------------------===// 9 | 10 | int strcmp(const char *a, const char *b) { 11 | while (*a && *a == *b) 12 | ++a, ++b; 13 | return *a - *b; 14 | } 15 | -------------------------------------------------------------------------------- /klee/runtime/klee-libc/tolower.c: -------------------------------------------------------------------------------- 1 | //===-- tolower.c ---------------------------------------------------------===// 2 | // 3 | // The KLEE Symbolic Virtual Machine 4 | // 5 | // This file is distributed under the University of Illinois Open Source 6 | // License. See LICENSE.TXT for details. 7 | // 8 | //===----------------------------------------------------------------------===// 9 | 10 | int tolower(int ch) { 11 | if ( (unsigned int)(ch - 'A') < 26u ) 12 | ch -= 'A' - 'a'; 13 | return ch; 14 | } 15 | -------------------------------------------------------------------------------- /klee/runtime/klee-libc/toupper.c: -------------------------------------------------------------------------------- 1 | //===-- toupper.c ---------------------------------------------------------===// 2 | // 3 | // The KLEE Symbolic Virtual Machine 4 | // 5 | // This file is distributed under the University of Illinois Open Source 6 | // License. See LICENSE.TXT for details. 7 | // 8 | //===----------------------------------------------------------------------===// 9 | 10 | int toupper(int ch) { 11 | if ( (unsigned int)(ch - 'a') < 26u ) 12 | ch += 'A' - 'a'; 13 | return ch; 14 | } 15 | -------------------------------------------------------------------------------- /qemu/roms/s2ebios/s2e-bios-up.asm: -------------------------------------------------------------------------------- 1 | ;Assemble this file to a raw binary, and specify it as the BIOS 2 | ;This binary will be loaded at 0xf0000 3 | 4 | org 0 5 | 6 | %include "init.asm" 7 | 8 | [bits 16] 9 | start: 10 | cli 11 | mov ax, cs 12 | mov ds, ax 13 | mov ax, 0x8000 14 | mov ss, ax 15 | mov sp, 0 16 | call init_pmode 17 | 18 | cli 19 | hlt 20 | 21 | 22 | times 0x10000 - 16 - ($-$$) db 0 23 | 24 | ;0xf000:fff0 25 | boot: 26 | jmp 0xf000:start 27 | 28 | times 0x10000-($-$$) db 0 29 | -------------------------------------------------------------------------------- /qemu/tests/tcg/lm32/test_sb.S: -------------------------------------------------------------------------------- 1 | .include "macros.inc" 2 | 3 | start 4 | 5 | test_name SB_1 6 | load r1 data 7 | load r2 0xf0f1f2aa 8 | sb (r1+0), r2 9 | check_mem data 0xaa000000 10 | 11 | test_name SB_2 12 | load r2 0xf0f1f2bb 13 | sb (r1+1), r2 14 | check_mem data 0xaabb0000 15 | 16 | test_name SB_3 17 | load r2 0xf0f1f2cc 18 | sb (r1+-1), r2 19 | check_mem data0 0x000000cc 20 | 21 | end 22 | 23 | .data 24 | .align 4 25 | data0: 26 | .byte 0, 0, 0, 0 27 | data: 28 | .byte 0, 0, 0, 0 29 | data1: 30 | .byte 0, 0, 0, 0 31 | -------------------------------------------------------------------------------- /qemu/tests/tcg/lm32/test_sh.S: -------------------------------------------------------------------------------- 1 | .include "macros.inc" 2 | 3 | start 4 | 5 | test_name SH_1 6 | load r1 data 7 | load r2 0xf0f1aaaa 8 | sh (r1+0), r2 9 | check_mem data 0xaaaa0000 10 | 11 | test_name SH_2 12 | load r2 0xf0f1bbbb 13 | sh (r1+2), r2 14 | check_mem data 0xaaaabbbb 15 | 16 | test_name SH_3 17 | load r2 0xf0f1cccc 18 | sh (r1+-2), r2 19 | check_mem data0 0x0000cccc 20 | 21 | end 22 | 23 | .data 24 | .align 4 25 | data0: 26 | .byte 0, 0, 0, 0 27 | data: 28 | .byte 0, 0, 0, 0 29 | data1: 30 | .byte 0, 0, 0, 0 31 | -------------------------------------------------------------------------------- /stp/unit_test/unc_shift.smt: -------------------------------------------------------------------------------- 1 | (benchmark r 2 | :status sat 3 | :category { crafted } 4 | :difficulty { 0 } 5 | :logic QF_BV 6 | :extrafuns ((x BitVec[3])) 7 | :extrafuns ((y BitVec[3])) 8 | 9 | :extrafuns ((w BitVec[3])) 10 | :extrafuns ((z BitVec[3])) 11 | 12 | :extrafuns ((q BitVec[3])) 13 | :extrafuns ((r BitVec[3])) 14 | 15 | :assumption (= (bvshl x y ) (bv4[3])) 16 | :assumption (= (bvashr w z ) (bv4[3])) 17 | :assumption (= (bvshl q r ) (bv4[3])) 18 | 19 | 20 | :formula true 21 | ) 22 | -------------------------------------------------------------------------------- /stp/unit_test/unit_test.sh: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | 3 | #Each input should be simplified down to either true or false. 4 | #We no longer generate a CNF for trivially true/false instances, 5 | #so there should be no CNF generated for these. 6 | 7 | 8 | rm -f output_*.cnf 9 | 10 | files=`ls -1 -S *.smt2 *.smt` 11 | for f in $files; do 12 | stp --output-CNF $f 13 | #cnf=`cat output_*.cnf | grep -v "^c" | grep -v "^$" | wc -l` 14 | if [ -e output_0.cnf ] ; then 15 | echo --fail $f 16 | exit 10 17 | fi 18 | 19 | done 20 | 21 | -------------------------------------------------------------------------------- /klee/lib/Expr/Makefile: -------------------------------------------------------------------------------- 1 | #===-- lib/Expr/Makefile -----------------------------------*- Makefile -*--===# 2 | # 3 | # The KLEE Symbolic Virtual Machine 4 | # 5 | # This file is distributed under the University of Illinois Open Source 6 | # License. See LICENSE.TXT for details. 7 | # 8 | #===------------------------------------------------------------------------===# 9 | 10 | LEVEL=../.. 11 | 12 | LIBRARYNAME=kleaverExpr 13 | DONT_BUILD_RELINKED=1 14 | BUILD_ARCHIVE=1 15 | 16 | include $(LEVEL)/Makefile.common 17 | -------------------------------------------------------------------------------- /klee/lib/Module/Makefile: -------------------------------------------------------------------------------- 1 | #===-- lib/Module/Makefile ---------------------------------*- Makefile -*--===# 2 | # 3 | # The KLEE Symbolic Virtual Machine 4 | # 5 | # This file is distributed under the University of Illinois Open Source 6 | # License. See LICENSE.TXT for details. 7 | # 8 | #===------------------------------------------------------------------------===# 9 | 10 | LEVEL=../.. 11 | 12 | LIBRARYNAME=kleeModule 13 | DONT_BUILD_RELINKED=1 14 | BUILD_ARCHIVE=1 15 | 16 | include $(LEVEL)/Makefile.common 17 | -------------------------------------------------------------------------------- /klee/lib/Support/Makefile: -------------------------------------------------------------------------------- 1 | #===-- lib/Support/Makefile --------------------------------*- Makefile -*--===# 2 | # 3 | # The KLEE Symbolic Virtual Machine 4 | # 5 | # This file is distributed under the University of Illinois Open Source 6 | # License. See LICENSE.TXT for details. 7 | # 8 | #===------------------------------------------------------------------------===# 9 | 10 | LEVEL=../.. 11 | 12 | LIBRARYNAME=kleeSupport 13 | DONT_BUILD_RELINKED=1 14 | BUILD_ARCHIVE=1 15 | 16 | include $(LEVEL)/Makefile.common 17 | -------------------------------------------------------------------------------- /klee/test/Concrete/Shifts.ll: -------------------------------------------------------------------------------- 1 | declare void @print_i32(i32) 2 | 3 | define i32 @main() { 4 | %amt = add i8 2, 5 5 | %a = shl i8 1, 5 6 | %b = lshr i8 %a, 5 7 | %c = shl i8 %b, %amt 8 | %d = lshr i8 %c, %amt 9 | %e = shl i8 %d, 7 10 | %f = ashr i8 %e, 7 11 | %g = shl i8 %f, %amt 12 | %h = ashr i8 %g, %amt 13 | %test = icmp eq i8 %h, -1 14 | br i1 %test, label %exitTrue, label %exitFalse 15 | exitTrue: 16 | call void @print_i32(i32 1) 17 | ret i32 0 18 | exitFalse: 19 | call void @print_i32(i32 0) 20 | ret i32 0 21 | } 22 | -------------------------------------------------------------------------------- /docs/Plugins/Tracers/TestCaseGenerator.rst: -------------------------------------------------------------------------------- 1 | ================= 2 | TestCaseGenerator 3 | ================= 4 | 5 | The TestCaseGenerator plugin records in the execution trace the set of concrete inputs for each terminated path. 6 | 7 | Options 8 | ------- 9 | 10 | This plugin does not have any option. 11 | 12 | 13 | Required Plugins 14 | ---------------- 15 | 16 | * `ExecutionTracer `_ 17 | 18 | Configuration Sample 19 | -------------------- 20 | 21 | :: 22 | 23 | pluginsConfig.TestCaseGenerator = {} 24 | 25 | -------------------------------------------------------------------------------- /klee/test/CXX/StaticDestructor.cpp: -------------------------------------------------------------------------------- 1 | // don't optimize this, llvm likes to turn the *p into unreachable 2 | 3 | // RUN: %llvmgxx %s --emit-llvm -g -O0 -c -o %t1.bc 4 | // RUN: %klee --libc=klee --no-output %t1.bc 2> %t1.log 5 | // RUN: grep ":16: memory error" %t1.log 6 | 7 | #include 8 | 9 | class Test { 10 | int *p; 11 | 12 | public: 13 | Test() : p(0) {} 14 | ~Test() { 15 | assert(!p); 16 | assert(*p == 10); // crash here 17 | } 18 | }; 19 | 20 | Test t; 21 | 22 | int main() { 23 | return 0; 24 | } 25 | -------------------------------------------------------------------------------- /qemu/tests/tcg/lm32/test_lw.S: -------------------------------------------------------------------------------- 1 | .include "macros.inc" 2 | 3 | start 4 | 5 | test_name LW_1 6 | load r1 data 7 | lw r3, (r1+0) 8 | check_r3 0x7e7f7071 9 | 10 | test_name LW_2 11 | lw r3, (r1+4) 12 | check_r3 0x72737475 13 | 14 | test_name LW_3 15 | lw r3, (r1+-4) 16 | check_r3 0x7a7b7c7d 17 | 18 | test_name LW_4 19 | load r3 data 20 | lw r3, (r3+0) 21 | check_r3 0x7e7f7071 22 | 23 | end 24 | 25 | .data 26 | .align 4 27 | .byte 0x7a, 0x7b, 0x7c, 0x7d 28 | data: 29 | .byte 0x7e, 0x7f, 0x70, 0x71 30 | .byte 0x72, 0x73, 0x74, 0x75 31 | -------------------------------------------------------------------------------- /klee/test/Feature/Envp.c: -------------------------------------------------------------------------------- 1 | // RUN: %llvmgcc %s -emit-llvm -g -c -o %t1.bc 2 | // RUN: %klee --exit-on-error %t1.bc 3 | 4 | #include 5 | 6 | int main(int argc, char **argv, char **envp) { 7 | unsigned i; 8 | assert(argv[argc] == 0); 9 | printf("argc: %d, argv: %p, envp: %p\n", argc, argv, envp); 10 | printf("--environ--\n"); 11 | int haspwd = 0; 12 | for (i=0; envp[i]; i++) { 13 | printf("%d: %s\n", i, envp[i]); 14 | haspwd |= strncmp(envp[i], "PWD=", 4)==0; 15 | } 16 | assert(haspwd); 17 | return 0; 18 | } 19 | -------------------------------------------------------------------------------- /qemu/hw/kvm/clock.h: -------------------------------------------------------------------------------- 1 | /* 2 | * QEMU KVM support, paravirtual clock device 3 | * 4 | * Copyright (C) 2011 Siemens AG 5 | * 6 | * Authors: 7 | * Jan Kiszka 8 | * 9 | * This work is licensed under the terms of the GNU GPL version 2. 10 | * See the COPYING file in the top-level directory. 11 | * 12 | */ 13 | 14 | #ifdef CONFIG_KVM 15 | 16 | void kvmclock_create(void); 17 | 18 | #else /* CONFIG_KVM */ 19 | 20 | static inline void kvmclock_create(void) 21 | { 22 | } 23 | 24 | #endif /* !CONFIG_KVM */ 25 | -------------------------------------------------------------------------------- /stp/src/boost/config/platform/amigaos.hpp: -------------------------------------------------------------------------------- 1 | // (C) Copyright John Maddock 2002. 2 | // Use, modification and distribution are subject to the 3 | // Boost Software License, Version 1.0. (See accompanying file 4 | // LICENSE_1_0.txt or copy at http://www.boost.org/LICENSE_1_0.txt) 5 | 6 | // See http://www.boost.org for most recent version. 7 | 8 | #define BOOST_PLATFORM "AmigaOS" 9 | 10 | #define BOOST_DISABLE_THREADS 11 | #define BOOST_NO_CWCHAR 12 | #define BOOST_NO_STD_WSTRING 13 | #define BOOST_NO_INTRINSIC_WCHAR_T 14 | 15 | 16 | -------------------------------------------------------------------------------- /stp/unit_test/bvconcat.smt2: -------------------------------------------------------------------------------- 1 | (set-logic QF_BV) 2 | (set-info :smt-lib-version 2.0) 3 | (set-info :category "check") 4 | (set-info :status sat) 5 | (declare-fun v0 () (_ BitVec 2)) 6 | (declare-fun v1 () (_ BitVec 2)) 7 | (declare-fun v2 () (_ BitVec 2)) 8 | (declare-fun v3 () (_ BitVec 2)) 9 | (declare-fun v4 () (_ BitVec 2)) 10 | (declare-fun v5 () (_ BitVec 2)) 11 | (declare-fun v6 () (_ BitVec 2)) 12 | (declare-fun v7 () (_ BitVec 2)) 13 | 14 | (assert (= (concat (concat v4 v5) v1) (concat (concat v6 v7) v2 ) )) 15 | (check-sat) 16 | (exit) 17 | -------------------------------------------------------------------------------- /klee/test/Feature/DanglingConcreteReadExpr.c: -------------------------------------------------------------------------------- 1 | // RUN: %llvmgcc %s -emit-llvm -O0 -c -o %t1.bc 2 | // RUN: %klee %t1.bc 3 | // RUN: grep "total queries = 2" klee-last/info 4 | 5 | #include 6 | 7 | int main() { 8 | unsigned char x, y; 9 | 10 | klee_make_symbolic(&x, sizeof x); 11 | 12 | y = x; 13 | 14 | // should be exactly two queries (prove x is/is not 10) 15 | // eventually should be 0 when we have fast solver 16 | if (x==10) { 17 | assert(y==10); 18 | } 19 | 20 | klee_silent_exit(0); 21 | return 0; 22 | } 23 | -------------------------------------------------------------------------------- /stp/unit_test/bvconcat2.smt2: -------------------------------------------------------------------------------- 1 | (set-logic QF_BV) 2 | (set-info :smt-lib-version 2.0) 3 | (set-info :category "check") 4 | (set-info :status sat) 5 | (declare-fun v0 () (_ BitVec 2)) 6 | (declare-fun v1 () (_ BitVec 2)) 7 | (declare-fun v2 () (_ BitVec 2)) 8 | (declare-fun v3 () (_ BitVec 2)) 9 | (declare-fun v4 () (_ BitVec 2)) 10 | (declare-fun v5 () (_ BitVec 2)) 11 | (declare-fun v6 () (_ BitVec 2)) 12 | (declare-fun v7 () (_ BitVec 2)) 13 | 14 | (assert (= (concat v1 (concat v4 v5)) (concat (concat v6 v7) v2 ) )) 15 | (check-sat) 16 | (exit) 17 | -------------------------------------------------------------------------------- /stp/unit_test/bvconcat3.smt2: -------------------------------------------------------------------------------- 1 | (set-logic QF_BV) 2 | (set-info :smt-lib-version 2.0) 3 | (set-info :category "check") 4 | (set-info :status sat) 5 | (declare-fun v0 () (_ BitVec 2)) 6 | (declare-fun v1 () (_ BitVec 2)) 7 | (declare-fun v2 () (_ BitVec 2)) 8 | (declare-fun v3 () (_ BitVec 2)) 9 | (declare-fun v4 () (_ BitVec 2)) 10 | (declare-fun v5 () (_ BitVec 2)) 11 | (declare-fun v6 () (_ BitVec 2)) 12 | (declare-fun v7 () (_ BitVec 2)) 13 | 14 | (assert (= (concat v1 (concat v2 v3)) (concat (concat v1 v2) v3 ) )) 15 | (check-sat) 16 | (exit) 17 | -------------------------------------------------------------------------------- /klee/unittests/TestMain.cpp: -------------------------------------------------------------------------------- 1 | //===--- unittests/TestMain.cpp - unittest driver -------------------------===// 2 | // 3 | // The LLVM Compiler Infrastructure 4 | // 5 | // This file is distributed under the University of Illinois Open Source 6 | // License. See LICENSE.TXT for details. 7 | // 8 | //===----------------------------------------------------------------------===// 9 | 10 | #include "gtest/gtest.h" 11 | 12 | int main(int argc, char **argv) { 13 | testing::InitGoogleTest(&argc, argv); 14 | return RUN_ALL_TESTS(); 15 | } 16 | -------------------------------------------------------------------------------- /stp/unit_test/bvsolver.smt: -------------------------------------------------------------------------------- 1 | (benchmark r 2 | :status sat 3 | :category { crafted } 4 | :difficulty { 0 } 5 | :logic QF_BV 6 | :extrafuns ((x BitVec[3])) 7 | :extrafuns ((y BitVec[3])) 8 | :extrafuns ((z BitVec[3])) 9 | 10 | :assumption (= (bvadd (bvadd (bvmul bv3[3] x) (bvmul bv4[3] y)) (bvmul bv2[3] z)) bv0[3]) 11 | :assumption (= (bvadd (bvadd (bvmul bv2[3] x) (bvmul bv2[3] y)) (bvmul bv0[3] z)) bv6[3]) 12 | :assumption (= (bvadd (bvadd (bvmul bv2[3] x) (bvmul bv4[3] y)) (bvmul bv2[3] z)) bv0[3]) 13 | 14 | :formula true 15 | ) 16 | -------------------------------------------------------------------------------- /guest/windbg-gdb/Makefile: -------------------------------------------------------------------------------- 1 | PROGRAM=gdb.dll 2 | SOURCES=BFDInterface.cpp main.cpp Symbols.cpp 3 | WINDBG=/c/Program Files/Debugging Tools for Windows (x64) 4 | WINDBG_INC=$(WINDBG)/sdk/inc 5 | WINDBG_LIB=$(WINDBG)/sdk/lib 6 | 7 | %.o:%.cpp 8 | g++ -O3 -I"$(WINDBG_INC)" -c -o $@ $< 9 | 10 | $(PROGRAM): $(SOURCES:.cpp=.o) 11 | g++ $^ -shared -o $(PROGRAM) -ldbgeng -lbfd -lintl -liberty -lz -lgettextpo -lstdc++ -lpsapi 12 | #gcc -x c++ -E -Wall -shared -o $(PROGRAM).i $(SOURCES) 13 | 14 | #-I"$(WINDBG_INC)" 15 | 16 | clean: 17 | rm -f $(PROGRAM) *.o 18 | -------------------------------------------------------------------------------- /klee/test/Feature/Optimize.c: -------------------------------------------------------------------------------- 1 | // RUN: %llvmgcc %s --emit-llvm -O0 -c -o %t2.bc 2 | // RUN: rm -f %t2.log 3 | // RUN: %klee --stop-after-n-instructions=100 --optimize %t2.bc > %t3.log 4 | // RUN: echo "good" > %t3.good 5 | // RUN: diff %t3.log %t3.good 6 | 7 | // should complete by 100 instructions if opt is on 8 | 9 | int main() { 10 | int i, res = 0; 11 | 12 | for (i=1; i<=1000; i++) 13 | res += i; 14 | 15 | if (res == (1000*1001)/2) { 16 | printf("good\n"); 17 | } else { 18 | printf("bad\n"); 19 | } 20 | 21 | return 0; 22 | } 23 | -------------------------------------------------------------------------------- /klee/test/Feature/WithLibc.c: -------------------------------------------------------------------------------- 1 | // RUN: %llvmgcc %s -emit-llvm -O0 -c -o %t2.bc 2 | // RUN: %klee --libc=klee %t2.bc > %t3.log 3 | // RUN: echo "good" > %t3.good 4 | // RUN: diff %t3.log %t3.good 5 | 6 | int main() { 7 | char buf[4]; 8 | char *s = "foo"; 9 | 10 | klee_make_symbolic(buf, sizeof buf); 11 | buf[3] = 0; 12 | 13 | if (strcmp(buf, s)==0) { 14 | if (buf[0]=='f' && buf[1]=='o' && buf[2]=='o' && buf[3]==0) { 15 | printf("good\n"); 16 | } else { 17 | printf("bad\n"); 18 | } 19 | } 20 | 21 | return 0; 22 | } 23 | -------------------------------------------------------------------------------- /qemu/hw/xen_domainbuild.h: -------------------------------------------------------------------------------- 1 | #ifndef QEMU_HW_XEN_DOMAINBUILD_H 2 | #define QEMU_HW_XEN_DOMAINBUILD_H 1 3 | 4 | #include "xen_common.h" 5 | 6 | int xenstore_domain_init1(const char *kernel, const char *ramdisk, 7 | const char *cmdline); 8 | int xenstore_domain_init2(int xenstore_port, int xenstore_mfn, 9 | int console_port, int console_mfn); 10 | int xen_domain_build_pv(const char *kernel, const char *ramdisk, 11 | const char *cmdline); 12 | 13 | #endif /* QEMU_HW_XEN_DOMAINBUILD_H */ 14 | -------------------------------------------------------------------------------- /qemu/linux-user/m68k/syscall.h: -------------------------------------------------------------------------------- 1 | 2 | /* this struct defines the way the registers are stored on the 3 | stack during a system call. */ 4 | 5 | struct target_pt_regs { 6 | abi_long d1, d2, d3, d4, d5, d6, d7; 7 | abi_long a0, a1, a2, a3, a4, a5, a6; 8 | abi_ulong d0; 9 | abi_ulong usp; 10 | abi_ulong orig_d0; 11 | int16_t stkadj; 12 | uint16_t sr; 13 | abi_ulong pc; 14 | uint16_t fntvex; 15 | uint16_t __fill; 16 | }; 17 | 18 | 19 | #define UNAME_MACHINE "m68k" 20 | 21 | void do_m68k_simcall(CPUM68KState *, int); 22 | -------------------------------------------------------------------------------- /stp/tests/sample-smt-tests/working_54.smt: -------------------------------------------------------------------------------- 1 | ( 2 | benchmark temp20.smt 3 | :source {Minkeyrink Solver} 4 | :status unsat 5 | :difficulty {1} 6 | :category {crafted} 7 | :logic QF_BV 8 | :extrafuns ((sym1 BitVec[1])) 9 | :extrafuns ((sym2 BitVec[1])) 10 | :extrafuns ((sym3 BitVec[1])) 11 | 12 | 13 | ; Off-by-one in the bvlshr was causing the problem. Fixed in #54 14 | 15 | :assumption (= (bvlshr sym1 sym2) sym3) 16 | :assumption (= (bvlshr sym3 sym2) sym1) 17 | :assumption (not (= sym2 bv0[1])) 18 | :assumption (not (= sym1 bv0[1])) 19 | 20 | 21 | ) 22 | 23 | -------------------------------------------------------------------------------- /stp/tests/sample-tests/a116test0003.cvc: -------------------------------------------------------------------------------- 1 | %% Regression level = 3 2 | %% Result = InValid 3 | %% Language = presentation 4 | 5 | _fresh_symbolic_value: BITVECTOR(32); 6 | _fresh_symbolic_value_1: BITVECTOR(32); 7 | %---------------------------------------------------- 8 | ASSERT NOT NOT (_fresh_symbolic_value = 9 | 0bin00000000000000000000000000000000); 10 | ASSERT NOT (_fresh_symbolic_value_1 = 11 | 0bin00000000000000000000000000000000); 12 | 13 | %---------------------------------------------------- 14 | QUERY FALSE; 15 | COUNTEREXAMPLE; 16 | -------------------------------------------------------------------------------- /stp/tests/sample-tests/a124test0004.cvc: -------------------------------------------------------------------------------- 1 | %% Regression level = 3 2 | %% Result = InValid 3 | %% Language = presentation 4 | 5 | _fresh_symbolic_value: BITVECTOR(32); 6 | _fresh_symbolic_value_1: BITVECTOR(32); 7 | %---------------------------------------------------- 8 | ASSERT NOT NOT (_fresh_symbolic_value = 9 | 0bin00000000000000000000000000000000); 10 | ASSERT NOT (_fresh_symbolic_value_1 = 11 | 0bin00000000000000000000000000000000); 12 | 13 | %---------------------------------------------------- 14 | QUERY FALSE; 15 | COUNTEREXAMPLE; 16 | -------------------------------------------------------------------------------- /docs/Tools/ExecutionProfiler.rst: -------------------------------------------------------------------------------- 1 | ================== 2 | Execution Profiler 3 | ================== 4 | 5 | The execution profiler tool outputs various metrics about the execution, 6 | like the number of executed instructions, page faults, TLB misses, cache profile, etc. 7 | 8 | Examples 9 | ~~~~~~~~ 10 | 11 | **TO BE DONE** 12 | 13 | Required Plugins 14 | ~~~~~~~~~~~~~~~~ 15 | 16 | * ExecutionTracer 17 | * CacheSim 18 | * InstructionCounter 19 | * ... 20 | 21 | Optional Plugins 22 | ~~~~~~~~~~~~~~~~ 23 | 24 | * ModuleTracer (for debug information) 25 | 26 | -------------------------------------------------------------------------------- /klee/runtime/klee-libc/strlen.c: -------------------------------------------------------------------------------- 1 | //===-- strlen.c ----------------------------------------------------------===// 2 | // 3 | // The KLEE Symbolic Virtual Machine 4 | // 5 | // This file is distributed under the University of Illinois Open Source 6 | // License. See LICENSE.TXT for details. 7 | // 8 | //===----------------------------------------------------------------------===// 9 | 10 | #include 11 | 12 | size_t strlen(const char *str) { 13 | const char *s = str; 14 | while (*s) 15 | ++s; 16 | return s - str; 17 | } 18 | -------------------------------------------------------------------------------- /qemu/linux-headers/asm-s390/kvm_para.h: -------------------------------------------------------------------------------- 1 | /* 2 | * asm-s390/kvm_para.h - definition for paravirtual devices on s390 3 | * 4 | * Copyright IBM Corp. 2008 5 | * 6 | * This program is free software; you can redistribute it and/or modify 7 | * it under the terms of the GNU General Public License (version 2 only) 8 | * as published by the Free Software Foundation. 9 | * 10 | * Author(s): Christian Borntraeger 11 | */ 12 | 13 | #ifndef __S390_KVM_PARA_H 14 | #define __S390_KVM_PARA_H 15 | 16 | 17 | #endif /* __S390_KVM_PARA_H */ 18 | -------------------------------------------------------------------------------- /qemu/tests/qemu-iotests/001.out: -------------------------------------------------------------------------------- 1 | QA output created by 001 2 | Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=134217728 3 | 4 | == reading whole image == 5 | read 134217728/134217728 bytes at offset 0 6 | 128 MiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec) 7 | 8 | == rewriting whole image == 9 | wrote 134217728/134217728 bytes at offset 0 10 | 128 MiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec) 11 | 12 | == verify pattern == 13 | read 134217728/134217728 bytes at offset 0 14 | 128 MiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec) 15 | *** done 16 | -------------------------------------------------------------------------------- /qemu/tests/qemu-iotests/008.out: -------------------------------------------------------------------------------- 1 | QA output created by 008 2 | Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=134217728 3 | 4 | == reading whole image == 5 | read 134217728/134217728 bytes at offset 0 6 | 128 MiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec) 7 | 8 | == rewriting whole image == 9 | wrote 134217728/134217728 bytes at offset 0 10 | 128 MiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec) 11 | 12 | == verify pattern == 13 | read 134217728/134217728 bytes at offset 0 14 | 128 MiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec) 15 | *** done 16 | -------------------------------------------------------------------------------- /stp/tests/crypto-tests/t3_flat.stp: -------------------------------------------------------------------------------- 1 | 2 | a,b,c,x,y : BITVECTOR(96); 3 | 4 | 5 | ASSERT(a[0:0] = 0bin1); 6 | ASSERT(b[0:0] = 0bin1); 7 | ASSERT(c=0hex0000000000000056E35E38CD); 8 | ASSERT(a[95:48] = 0hex000000000000); 9 | ASSERT(b[95:48] = 0hex000000000000); 10 | 11 | 12 | QUERY( 13 | NOT ( 14 | c=BVMULT(96,a,b) AND NOT 15 | a=0hex000000000000000000000001 16 | AND 17 | NOT 18 | b=0hex000000000000000000000001 19 | AND NOT 20 | a=c 21 | AND NOT 22 | b=c 23 | 24 | ) 25 | ); 26 | 27 | COUNTEREXAMPLE; 28 | 29 | -------------------------------------------------------------------------------- /stp/tests/sample-tests/a115test0002.cvc: -------------------------------------------------------------------------------- 1 | %% Regression level = 3 2 | %% Result = InValid 3 | %% Language = presentation 4 | 5 | _fresh_symbolic_value: BITVECTOR(32); 6 | _fresh_symbolic_value_1: BITVECTOR(32); 7 | %---------------------------------------------------- 8 | ASSERT NOT NOT (_fresh_symbolic_value = 9 | 0bin00000000000000000000000000000000); 10 | ASSERT NOT NOT (_fresh_symbolic_value_1 = 11 | 0bin00000000000000000000000000000000); 12 | 13 | %---------------------------------------------------- 14 | QUERY FALSE; 15 | COUNTEREXAMPLE; 16 | -------------------------------------------------------------------------------- /stp/unit_test/xor2.smt2: -------------------------------------------------------------------------------- 1 | 2 | (set-logic QF_BV) 3 | (set-info :smt-lib-version 2.0) 4 | (set-info :category "check") 5 | (set-info :status sat) 6 | (declare-fun v0 () Bool ) 7 | (declare-fun v1 () Bool ) 8 | (declare-fun v2 () Bool ) 9 | (declare-fun v3 () Bool ) 10 | (declare-fun v4 () Bool ) 11 | (declare-fun v5 () Bool ) 12 | 13 | ; The variables appear only in this expression, so 14 | ; they should be simplified out. 15 | (assert (xor (xor (not v0) (not v1)) (xor (not v3) (not v2)))) 16 | (assert (xor v4 v5)) 17 | 18 | (check-sat) 19 | (exit) 20 | 21 | 22 | -------------------------------------------------------------------------------- /klee/runtime/klee-libc/strcpy.c: -------------------------------------------------------------------------------- 1 | //===-- strcpy.c ----------------------------------------------------------===// 2 | // 3 | // The KLEE Symbolic Virtual Machine 4 | // 5 | // This file is distributed under the University of Illinois Open Source 6 | // License. See LICENSE.TXT for details. 7 | // 8 | //===----------------------------------------------------------------------===// 9 | 10 | char *strcpy(char *to, const char *from) { 11 | char *start = to; 12 | 13 | while ((*to = *from)) 14 | ++to, ++from; 15 | 16 | return start; 17 | } 18 | -------------------------------------------------------------------------------- /klee/test/Feature/OverlappedError.c: -------------------------------------------------------------------------------- 1 | // RUN: %llvmgcc %s -g -emit-llvm -O0 -c -o %t1.bc 2 | // RUN: %klee %t1.bc 3 | // RUN: ls klee-last/ | grep .ktest | wc -l | grep 4 4 | // RUN: ls klee-last/ | grep .ptr.err | wc -l | grep 2 5 | 6 | #include 7 | 8 | int main() { 9 | if (klee_range(0,2, "range")) { 10 | char *x = malloc(8); 11 | *((int*) &x[klee_range(0,6, "range")]) = 1; 12 | free(x); 13 | } else { 14 | char *x = malloc(8); 15 | *((int*) &x[klee_range(-1,5, "range")]) = 1; 16 | free(x); 17 | } 18 | return 0; 19 | } 20 | -------------------------------------------------------------------------------- /klee/test/Runtime/POSIX/Fcntl.c: -------------------------------------------------------------------------------- 1 | // RUN: %llvmgcc %s -emit-llvm -O0 -c -o %t2.bc 2 | // RUN: %klee --init-env --posix-runtime --exit-on-error %t2.bc --sym-files 1 10 3 | 4 | #include 5 | #include 6 | 7 | int main(int argc, char **argv) { 8 | int fd = open("A", O_RDWR|O_TRUNC); 9 | if (fd == -1) 10 | klee_silent_exit(0); 11 | assert(fd == 3); 12 | assert((fcntl(fd, F_GETFD) & FD_CLOEXEC) == 0); 13 | assert(fcntl(fd, F_SETFD, FD_CLOEXEC, 1) == 0); 14 | assert((fcntl(fd, F_GETFD) & FD_CLOEXEC) != 0); 15 | 16 | return 0; 17 | } 18 | -------------------------------------------------------------------------------- /klee/test/regression/2007-08-01-cache-unclear-on-overwrite-flushed.c: -------------------------------------------------------------------------------- 1 | // RUN: %llvmgcc %s -emit-llvm -O0 -c -o %t1.bc 2 | // RUN: %klee %t1.bc 3 | 4 | #include 5 | #include 6 | 7 | int main() { 8 | unsigned char x; 9 | 10 | klee_make_symbolic(&x, sizeof x); 11 | if (x >= 2) klee_silent_exit(0); 12 | 13 | char delete[2] = {0,1}; 14 | 15 | char tmp = delete[ x ]; 16 | char tmp2 = delete[0]; 17 | delete[ x ] = tmp2; 18 | 19 | if (x==1) { 20 | assert(delete[1] == 0); 21 | return 0; 22 | } 23 | 24 | return 0; 25 | } 26 | -------------------------------------------------------------------------------- /qemu/tests/tcg/lm32/test_cmpei.S: -------------------------------------------------------------------------------- 1 | .include "macros.inc" 2 | 3 | start 4 | 5 | test_name CMPEI_1 6 | mvi r1, 0 7 | cmpei r3, r1, 0 8 | check_r3 1 9 | 10 | test_name CMPEI_2 11 | mvi r1, 0 12 | cmpei r3, r1, 1 13 | check_r3 0 14 | 15 | test_name CMPEI_3 16 | mvi r1, 1 17 | cmpei r3, r1, 0 18 | check_r3 0 19 | 20 | test_name CMPEI_4 21 | load r1 0xffffffff 22 | cmpei r3, r1, -1 23 | check_r3 1 24 | 25 | test_name CMPEI_5 26 | mvi r3, 0 27 | cmpei r3, r3, 0 28 | check_r3 1 29 | 30 | test_name CMPEI_6 31 | mvi r3, 0 32 | cmpei r3, r3, 1 33 | check_r3 0 34 | 35 | end 36 | -------------------------------------------------------------------------------- /klee/test/Runtime/POSIX/FreeArgv.c: -------------------------------------------------------------------------------- 1 | // RUN: %llvmgcc %s -emit-llvm -O0 -c -o %t.bc 2 | // RUN: %klee --init-env --posix-runtime %t.bc --sym-args 1 1 1 3 | // RUN: test -f klee-last/test000001.free.err 4 | // RUN: test -f klee-last/test000002.free.err 5 | // RUN: test -f klee-last/test000003.free.err 6 | 7 | int main(int argc, char **argv) { 8 | switch(klee_range(0, 3, "range")) { 9 | case 0: 10 | free(argv); 11 | break; 12 | case 1: 13 | free(argv[0]); 14 | break; 15 | case 2: 16 | free(argv[1]); 17 | break; 18 | } 19 | return 0; 20 | } 21 | -------------------------------------------------------------------------------- /klee/test/regression/2007-10-11-illegal-access-after-free-and-branch.c: -------------------------------------------------------------------------------- 1 | // RUN: %llvmgcc %s -emit-llvm -g -c -o %t1.bc 2 | // RUN: %klee --optimize %t1.bc 3 | // RUN: test -f klee-last/test000001.ptr.err 4 | 5 | #include 6 | #include 7 | #include 8 | 9 | int main(int argc, char **argv) { 10 | unsigned char *buf = malloc(3); 11 | klee_make_symbolic(buf, 3); 12 | if (buf[0]>4) klee_silent_exit(0); 13 | unsigned char x = buf[1]; 14 | free(buf); 15 | if (x) 16 | return buf[2]; 17 | klee_silent_exit(0); 18 | return 0; 19 | } 20 | -------------------------------------------------------------------------------- /qemu/hw/lm32.h: -------------------------------------------------------------------------------- 1 | 2 | #include "qemu-common.h" 3 | 4 | static inline DeviceState *lm32_pic_init(qemu_irq cpu_irq) 5 | { 6 | DeviceState *dev; 7 | SysBusDevice *d; 8 | 9 | dev = qdev_create(NULL, "lm32-pic"); 10 | qdev_init_nofail(dev); 11 | d = sysbus_from_qdev(dev); 12 | sysbus_connect_irq(d, 0, cpu_irq); 13 | 14 | return dev; 15 | } 16 | 17 | static inline DeviceState *lm32_juart_init(void) 18 | { 19 | DeviceState *dev; 20 | 21 | dev = qdev_create(NULL, "lm32-juart"); 22 | qdev_init_nofail(dev); 23 | 24 | return dev; 25 | } 26 | -------------------------------------------------------------------------------- /qemu/tests/tcg/lm32/test_modu.S: -------------------------------------------------------------------------------- 1 | .include "macros.inc" 2 | 3 | start 4 | 5 | test_name MODU_1 6 | mvi r1, 0 7 | mvi r2, 1 8 | modu r3, r1, r2 9 | check_r3 0 10 | 11 | test_name MODU_2 12 | mvi r1, 1 13 | mvi r2, 1 14 | modu r3, r1, r2 15 | check_r3 0 16 | 17 | test_name MODU_3 18 | mvi r1, 3 19 | mvi r2, 2 20 | modu r3, r1, r2 21 | check_r3 1 22 | 23 | test_name MODU_4 24 | mvi r1, 0 25 | mvi r2, 0 26 | modu r3, r1, r2 27 | check_excp 16 28 | 29 | test_name MODU_5 30 | load r1 0xabcdef12 31 | load r2 0x12345 32 | modu r3, r1, r2 33 | check_r3 0x3c12 34 | 35 | end 36 | -------------------------------------------------------------------------------- /klee/test/Feature/Alias.c: -------------------------------------------------------------------------------- 1 | // RUN: %llvmgcc %s -emit-llvm -g -c -o %t1.bc 2 | // RUN: %klee --exit-on-error %t1.bc 3 | 4 | // Darwin does not have strong aliases. 5 | // XFAIL: darwin 6 | 7 | #include 8 | 9 | // alias for global 10 | int b = 52; 11 | extern int a __attribute__((alias("b"))); 12 | 13 | // alias for function 14 | int __foo() { return 52; } 15 | extern int foo() __attribute__((alias("__foo"))); 16 | 17 | int *c = &a; 18 | 19 | int main() { 20 | assert(a == 52); 21 | assert(foo() == 52); 22 | assert(*c == 52); 23 | 24 | return 0; 25 | } 26 | -------------------------------------------------------------------------------- /qemu/tests/tcg/lm32/test_ori.S: -------------------------------------------------------------------------------- 1 | .include "macros.inc" 2 | 3 | start 4 | 5 | test_name ORI_1 6 | mvi r1, 0 7 | ori r3, r1, 0 8 | check_r3 0 9 | 10 | test_name ORI_2 11 | mvi r1, 0 12 | ori r3, r1, 1 13 | check_r3 1 14 | 15 | test_name ORI_3 16 | mvi r1, 1 17 | ori r3, r1, 1 18 | check_r3 1 19 | 20 | test_name ORI_4 21 | mvi r1, 1 22 | ori r3, r1, 0 23 | check_r3 1 24 | 25 | test_name ORI_5 26 | load r1 0xaa55aa55 27 | ori r3, r1, 0x55aa 28 | check_r3 0xaa55ffff 29 | 30 | test_name ORI_6 31 | load r3 0xaa55aa55 32 | ori r3, r3, 0x55aa 33 | check_r3 0xaa55ffff 34 | 35 | end 36 | -------------------------------------------------------------------------------- /stp/tests/c-api-tests/print.c: -------------------------------------------------------------------------------- 1 | //g++ -I$(HOME)/stp/c_interface print.c -L$(HOME)/stp/lib -lstp -o hex 2 | 3 | #include 4 | #include "c_interface.h" 5 | 6 | int main() { 7 | VC vc = vc_createValidityChecker(); 8 | vc_setFlags(vc,'n'); 9 | vc_setFlags(vc,'d'); 10 | vc_setFlags(vc,'p'); 11 | 12 | Expr ct_3 = vc_bvConstExprFromStr(vc, 13 | "00000000000000000000000000000011"); 14 | vc_printExpr(vc, ct_3); printf("\n"); 15 | 16 | ct_3 = vc_bvConstExprFromInt(vc, 32, 5); 17 | vc_printExpr(vc, ct_3); printf("\n"); 18 | 19 | vc_Destroy(vc); 20 | } 21 | 22 | -------------------------------------------------------------------------------- /qemu/tests/check-block.sh: -------------------------------------------------------------------------------- 1 | #!/bin/sh 2 | 3 | export QEMU_PROG="$(pwd)/x86_64-softmmu/qemu-system-x86_64" 4 | export QEMU_IMG_PROG="$(pwd)/qemu-img" 5 | export QEMU_IO_PROG="$(pwd)/qemu-io" 6 | 7 | if [ ! -x $QEMU_PROG ]; then 8 | echo "'make check-block' requires qemu-system-x86_64" 9 | exit 1 10 | fi 11 | 12 | cd $SRC_PATH/tests/qemu-iotests 13 | 14 | ret=0 15 | ./check -T -nocache -raw || ret=1 16 | ./check -T -nocache -qcow2 || ret=1 17 | ./check -T -nocache -qed|| ret=1 18 | ./check -T -nocache -vmdk|| ret=1 19 | ./check -T -nocache -vpc || ret=1 20 | 21 | exit $ret 22 | -------------------------------------------------------------------------------- /qemu/tests/tcg/lm32/test_cmpnei.S: -------------------------------------------------------------------------------- 1 | .include "macros.inc" 2 | 3 | start 4 | 5 | test_name CMPNEI_1 6 | mvi r1, 0 7 | cmpnei r3, r1, 0 8 | check_r3 0 9 | 10 | test_name CMPNEI_2 11 | mvi r1, 0 12 | cmpnei r3, r1, 1 13 | check_r3 1 14 | 15 | test_name CMPNEI_3 16 | mvi r1, 1 17 | cmpnei r3, r1, 0 18 | check_r3 1 19 | 20 | test_name CMPNEI_4 21 | load r1 0xffffffff 22 | cmpnei r3, r1, -1 23 | check_r3 0 24 | 25 | test_name CMPNEI_5 26 | mvi r3, 0 27 | cmpnei r3, r3, 0 28 | check_r3 0 29 | 30 | test_name CMPNEI_6 31 | mvi r3, 0 32 | cmpnei r3, r3, 1 33 | check_r3 1 34 | 35 | end 36 | -------------------------------------------------------------------------------- /stp/src/ocaml-wrapper/libstp_regerrorhandler.c: -------------------------------------------------------------------------------- 1 | ////////////////////////////////////////////////////////// 2 | // 3 | // Owned and copyright BitBlaze, 2007. All rights reserved. 4 | // 5 | ////////////////////////////////////////////////////////// 6 | 7 | #include 8 | #include 9 | #include "../c_interface.h" 10 | 11 | value libstp_regerrorhandler(value _unit) 12 | { 13 | // could be caml_invalid_argument or caml_failwith... 14 | // which is more appropriate? 15 | vc_registerErrorHandler(caml_invalid_argument); 16 | return Val_unit; 17 | } 18 | -------------------------------------------------------------------------------- /klee/runtime/Intrinsic/klee_int.c: -------------------------------------------------------------------------------- 1 | //===-- klee_int.c --------------------------------------------------------===// 2 | // 3 | // The KLEE Symbolic Virtual Machine 4 | // 5 | // This file is distributed under the University of Illinois Open Source 6 | // License. See LICENSE.TXT for details. 7 | // 8 | //===----------------------------------------------------------------------===// 9 | 10 | #include 11 | #include 12 | 13 | int klee_int(const char *name) { 14 | int x; 15 | klee_make_symbolic(&x, sizeof x, name); 16 | return x; 17 | } 18 | -------------------------------------------------------------------------------- /klee/runtime/Intrinsic/memset.c: -------------------------------------------------------------------------------- 1 | //===-- memset.c ----------------------------------------------------------===// 2 | // 3 | // The KLEE Symbolic Virtual Machine 4 | // 5 | // This file is distributed under the University of Illinois Open Source 6 | // License. See LICENSE.TXT for details. 7 | // 8 | //===----------------------------------------------------------------------===// 9 | 10 | #include 11 | 12 | void *memset(void * dst, int s, size_t count) { 13 | char * a = dst; 14 | while (count-- > 0) 15 | *a++ = s; 16 | return dst; 17 | } 18 | -------------------------------------------------------------------------------- /klee/runtime/klee-libc/memset.c: -------------------------------------------------------------------------------- 1 | //===-- memset.c ----------------------------------------------------------===// 2 | // 3 | // The KLEE Symbolic Virtual Machine 4 | // 5 | // This file is distributed under the University of Illinois Open Source 6 | // License. See LICENSE.TXT for details. 7 | // 8 | //===----------------------------------------------------------------------===// 9 | 10 | #include 11 | 12 | void *memset(void * dst, int s, size_t count) { 13 | char * a = dst; 14 | while (count-- > 0) 15 | *a++ = s; 16 | return dst; 17 | } 18 | -------------------------------------------------------------------------------- /klee/tools/klee-replay/Makefile: -------------------------------------------------------------------------------- 1 | #===-- tools/klee-replay/Makefile --------------------------*- Makefile -*--===# 2 | # 3 | # The KLEE Symbolic Virtual Machine 4 | # 5 | # This file is distributed under the University of Illinois Open Source 6 | # License. See LICENSE.TXT for details. 7 | # 8 | #===------------------------------------------------------------------------===# 9 | 10 | LEVEL=../.. 11 | TOOLNAME = klee-replay 12 | 13 | USEDLIBS = kleeBasic.a 14 | LINK_COMPONENTS = 15 | NO_PEDANTIC=1 16 | 17 | include $(LEVEL)/Makefile.common 18 | 19 | LIBS += -lutil 20 | -------------------------------------------------------------------------------- /qemu/hw/pm_smbus.h: -------------------------------------------------------------------------------- 1 | #ifndef PM_SMBUS_H 2 | #define PM_SMBUS_H 3 | 4 | typedef struct PMSMBus { 5 | i2c_bus *smbus; 6 | 7 | uint8_t smb_stat; 8 | uint8_t smb_ctl; 9 | uint8_t smb_cmd; 10 | uint8_t smb_addr; 11 | uint8_t smb_data0; 12 | uint8_t smb_data1; 13 | uint8_t smb_data[32]; 14 | uint8_t smb_index; 15 | } PMSMBus; 16 | 17 | void pm_smbus_init(DeviceState *parent, PMSMBus *smb); 18 | void smb_ioport_writeb(void *opaque, uint32_t addr, uint32_t val); 19 | uint32_t smb_ioport_readb(void *opaque, uint32_t addr); 20 | 21 | #endif /* !PM_SMBUS_H */ 22 | -------------------------------------------------------------------------------- /qemu/qemu-thread-win32.h: -------------------------------------------------------------------------------- 1 | #ifndef __QEMU_THREAD_WIN32_H 2 | #define __QEMU_THREAD_WIN32_H 1 3 | #include "windows.h" 4 | 5 | struct QemuMutex { 6 | CRITICAL_SECTION lock; 7 | LONG owner; 8 | }; 9 | 10 | struct QemuCond { 11 | LONG waiters, target; 12 | HANDLE sema; 13 | HANDLE continue_event; 14 | }; 15 | 16 | typedef struct QemuThreadData QemuThreadData; 17 | struct QemuThread { 18 | QemuThreadData *data; 19 | unsigned tid; 20 | }; 21 | 22 | /* Only valid for joinable threads. */ 23 | HANDLE qemu_thread_get_handle(QemuThread *thread); 24 | 25 | #endif 26 | -------------------------------------------------------------------------------- /qemu/target-xtensa/core-fsf.c: -------------------------------------------------------------------------------- 1 | #include "cpu.h" 2 | #include "exec-all.h" 3 | #include "gdbstub.h" 4 | #include "host-utils.h" 5 | 6 | #include "core-fsf/core-isa.h" 7 | #include "overlay_tool.h" 8 | 9 | static const XtensaConfig fsf = { 10 | .name = "fsf", 11 | .options = XTENSA_OPTIONS, 12 | /* GDB for this core is not supported currently */ 13 | .nareg = XCHAL_NUM_AREGS, 14 | .ndepc = 1, 15 | EXCEPTIONS_SECTION, 16 | INTERRUPTS_SECTION, 17 | TLB_SECTION, 18 | DEBUG_SECTION, 19 | .clock_freq_khz = 10000, 20 | }; 21 | 22 | REGISTER_CORE(fsf) 23 | -------------------------------------------------------------------------------- /stp/windows/winports/compdep.h: -------------------------------------------------------------------------------- 1 | #ifndef __COMPDEP_H__ 2 | #define __COMPDEP_H__ 1 3 | 4 | //some compiler related functions for porting 5 | /************************************************************************/ 6 | #ifdef _MSC_VER 7 | #include 8 | // msvc missed the log2 function 9 | inline long double log2(long double x) 10 | { 11 | return log(x)/log((long double)2); 12 | } 13 | // strtoull is missing too 14 | #define strtoull _strtoui64 15 | #endif 16 | 17 | /************************************************************************/ 18 | #endif 19 | 20 | -------------------------------------------------------------------------------- /docs/Plugins/Tracers/InstructionCounter.rst: -------------------------------------------------------------------------------- 1 | ================== 2 | InstructionCounter 3 | ================== 4 | 5 | The InstructionCounter plugin counts the number of executed instructions along each execution path. 6 | Only instructions inside the modules of interest are counted. 7 | 8 | Options 9 | ------- 10 | 11 | This plugin does not have any option. 12 | 13 | Required Plugins 14 | ---------------- 15 | 16 | * `ExecutionTracer `_ 17 | 18 | Configuration Sample 19 | -------------------- 20 | 21 | :: 22 | 23 | pluginsConfig.InstructionCounter = {} 24 | 25 | -------------------------------------------------------------------------------- /klee/runtime/klee-libc/strcoll.c: -------------------------------------------------------------------------------- 1 | //===-- strcoll.c ---------------------------------------------------------===// 2 | // 3 | // The KLEE Symbolic Virtual Machine 4 | // 5 | // This file is distributed under the University of Illinois Open Source 6 | // License. See LICENSE.TXT for details. 7 | // 8 | //===----------------------------------------------------------------------===// 9 | 10 | #include 11 | 12 | // according to the manpage, this is equiv in the POSIX/C locale. 13 | int strcoll(const char *s1, const char *s2) { 14 | return strcmp(s1,s2); 15 | } 16 | -------------------------------------------------------------------------------- /klee/test/CXX/New.cpp: -------------------------------------------------------------------------------- 1 | // RUN: %llvmgxx %s --emit-llvm -O0 -c -o %t1.bc 2 | // RUN: %klee --no-output --exit-on-error --no-externals %t1.bc 3 | 4 | #include 5 | 6 | class Test { 7 | int x; 8 | 9 | public: 10 | Test(int _x) : x(_x) { 11 | } 12 | ~Test() { 13 | } 14 | 15 | int getX() { return x; } 16 | }; 17 | 18 | // This doesn't do what I want because 19 | // it is being changed to alloca, but 20 | // it is also failing. 21 | int main(int argc) { 22 | Test *rt = new Test(2); 23 | 24 | assert(rt->getX()==2); 25 | 26 | delete rt; 27 | 28 | return 0; 29 | } 30 | -------------------------------------------------------------------------------- /qemu/LICENSE: -------------------------------------------------------------------------------- 1 | The following points clarify the QEMU license: 2 | 3 | 1) QEMU as a whole is released under the GNU General Public License 4 | 5 | 2) Parts of QEMU have specific licenses which are compatible with the 6 | GNU General Public License. Hence each source file contains its own 7 | licensing information. 8 | 9 | Many hardware device emulation sources are released under the BSD license. 10 | 11 | 3) The Tiny Code Generator (TCG) is released under the BSD license 12 | (see license headers in files). 13 | 14 | 4) QEMU is a trademark of Fabrice Bellard. 15 | 16 | Fabrice Bellard. 17 | -------------------------------------------------------------------------------- /qemu/envlist.h: -------------------------------------------------------------------------------- 1 | #ifndef ENVLIST_H 2 | #define ENVLIST_H 3 | 4 | #ifdef __cplusplus 5 | extern "C" { 6 | #endif 7 | 8 | typedef struct envlist envlist_t; 9 | 10 | envlist_t *envlist_create(void); 11 | void envlist_free(envlist_t *); 12 | int envlist_setenv(envlist_t *, const char *); 13 | int envlist_unsetenv(envlist_t *, const char *); 14 | int envlist_parse_set(envlist_t *, const char *); 15 | int envlist_parse_unset(envlist_t *, const char *); 16 | char **envlist_to_environ(const envlist_t *, size_t *); 17 | 18 | #ifdef __cplusplus 19 | } 20 | #endif 21 | 22 | #endif /* ENVLIST_H */ 23 | -------------------------------------------------------------------------------- /qemu/pflib.h: -------------------------------------------------------------------------------- 1 | #ifndef __QEMU_PFLIB_H 2 | #define __QEMU_PFLIB_H 3 | 4 | /* 5 | * PixelFormat conversion library. 6 | * 7 | * Author: Gerd Hoffmann 8 | * 9 | * This work is licensed under the terms of the GNU GPL, version 2. See 10 | * the COPYING file in the top-level directory. 11 | * 12 | */ 13 | 14 | typedef struct QemuPfConv QemuPfConv; 15 | 16 | QemuPfConv *qemu_pf_conv_get(PixelFormat *dst, PixelFormat *src); 17 | void qemu_pf_conv_run(QemuPfConv *conv, void *dst, void *src, uint32_t cnt); 18 | void qemu_pf_conv_put(QemuPfConv *conv); 19 | 20 | #endif 21 | -------------------------------------------------------------------------------- /qemu/tests/qemu-iotests-quick.sh: -------------------------------------------------------------------------------- 1 | #!/bin/sh 2 | 3 | # We don't know which of the system emulator binaries there is (or if there is 4 | # any at all), so the 'quick' group doesn't contain any tests that require 5 | # running qemu proper. Assign a fake binary name so that qemu-iotests doesn't 6 | # complain about the missing binary. 7 | export QEMU_PROG="this_should_be_unused" 8 | 9 | export QEMU_IMG_PROG="$(pwd)/qemu-img" 10 | export QEMU_IO_PROG="$(pwd)/qemu-io" 11 | 12 | cd $SRC_PATH/tests/qemu-iotests 13 | 14 | ret=0 15 | ./check -T -nocache -qcow2 -g quick || ret=1 16 | 17 | exit $ret 18 | -------------------------------------------------------------------------------- /qemu/tests/tcg/lm32/test_xori.S: -------------------------------------------------------------------------------- 1 | .include "macros.inc" 2 | 3 | start 4 | 5 | test_name XORI_1 6 | mvi r1, 0 7 | xori r3, r1, 0 8 | check_r3 0 9 | 10 | test_name XORI_2 11 | mvi r1, 0 12 | xori r3, r1, 1 13 | check_r3 1 14 | 15 | test_name XORI_3 16 | mvi r1, 1 17 | xori r3, r1, 1 18 | check_r3 0 19 | 20 | test_name XORI_4 21 | mvi r1, 1 22 | xori r3, r1, 0 23 | check_r3 1 24 | 25 | test_name XORI_5 26 | load r1 0xaa55aa55 27 | xori r3, r1, 0x5555 28 | check_r3 0xaa55ff00 29 | 30 | test_name XORI_6 31 | load r3 0xaa55aa55 32 | xori r3, r3, 0x5555 33 | check_r3 0xaa55ff00 34 | 35 | end 36 | -------------------------------------------------------------------------------- /klee/lib/Solver/Makefile: -------------------------------------------------------------------------------- 1 | #===-- lib/Solver/Makefile ---------------------------------*- Makefile -*--===# 2 | # 3 | # The KLEE Symbolic Virtual Machine 4 | # 5 | # This file is distributed under the University of Illinois Open Source 6 | # License. See LICENSE.TXT for details. 7 | # 8 | #===------------------------------------------------------------------------===# 9 | 10 | LEVEL=../.. 11 | 12 | LIBRARYNAME=kleaverSolver 13 | DONT_BUILD_RELINKED=1 14 | BUILD_ARCHIVE=1 15 | 16 | include $(LEVEL)/Makefile.common 17 | 18 | CPPFLAGS+=-I$(PROJ_SRC_ROOT)/stp/c_interface 19 | 20 | -------------------------------------------------------------------------------- /klee/runtime/Intrinsic/klee_div_zero_check.c: -------------------------------------------------------------------------------- 1 | //===-- klee_div_zero_check.c ---------------------------------------------===// 2 | // 3 | // The KLEE Symbolic Virtual Machine 4 | // 5 | // This file is distributed under the University of Illinois Open Source 6 | // License. See LICENSE.TXT for details. 7 | // 8 | //===----------------------------------------------------------------------===// 9 | 10 | #include 11 | 12 | void klee_div_zero_check(long long z) { 13 | if (z == 0) 14 | klee_report_error(__FILE__, __LINE__, "divide by zero", "div.err"); 15 | } 16 | -------------------------------------------------------------------------------- /qemu/qapi/qapi-types-core.h: -------------------------------------------------------------------------------- 1 | /* 2 | * Core Definitions for QAPI-generated Types 3 | * 4 | * Copyright IBM, Corp. 2011 5 | * 6 | * Authors: 7 | * Anthony Liguori 8 | * 9 | * This work is licensed under the terms of the GNU LGPL, version 2.1 or later. 10 | * See the COPYING.LIB file in the top-level directory. 11 | * 12 | */ 13 | 14 | #ifndef QAPI_TYPES_CORE_H 15 | #define QAPI_TYPES_CORE_H 16 | 17 | #include "qemu-common.h" 18 | #include "error.h" 19 | 20 | /* FIXME this is temporary until we remove middle mode */ 21 | #include "monitor.h" 22 | 23 | #endif 24 | -------------------------------------------------------------------------------- /klee/docs/SMT-COMP/QF_AUFBV.smt: -------------------------------------------------------------------------------- 1 | (logic QF_AUFBV 2 | 3 | :written_by {Clark Barrett} 4 | :date {May 7, 2007} 5 | 6 | :theory BV_ArraysEx 7 | 8 | :language 9 | "Closed quantifier-free formulas built over an arbitrary expansion of the 10 | BV_ArraysEx signature with free function and predicate symbols over 11 | the sorts of BV_ArraysEx. Formulas in ite terms must satisfy the same 12 | restriction as well, with the exception that they need not be closed (because 13 | they may be in the scope of a let expression). 14 | " 15 | :extensions 16 | "As in the logic QF_BV." 17 | ) 18 | 19 | 20 | -------------------------------------------------------------------------------- /klee/test/Runtime/POSIX/Getenv.c: -------------------------------------------------------------------------------- 1 | // RUN: %llvmgcc %s -emit-llvm -O0 -c -o %t2.bc 2 | // RUN: %klee --init-env --libc=klee --posix-runtime --exit-on-error %t2.bc --sym-files 1 10 3 | 4 | #include 5 | 6 | int main(int argc, char **argv) { 7 | char *g = getenv("PWD"); 8 | if (g) { 9 | printf("have PWD\n"); 10 | } else { 11 | printf("have no PWD\n"); 12 | } 13 | 14 | g = getenv("HELLO"); 15 | if (!g || strcmp(g, "nice")==0) { 16 | printf("getenv(\"HELLO\") = %p\n", g); 17 | if (g) assert(strcmp(getenv("HELLO"),"nice") == 0); 18 | } 19 | 20 | return 0; 21 | } 22 | -------------------------------------------------------------------------------- /stp/src/boost/type_traits/aligned_storage.hpp: -------------------------------------------------------------------------------- 1 | 2 | // Copyright (C) John Maddock 2005. 3 | // Use, modification and distribution are subject to the Boost Software License, 4 | // Version 1.0. (See accompanying file LICENSE_1_0.txt or copy at 5 | // http://www.boost.org/LICENSE_1_0.txt). 6 | // 7 | // See http://www.boost.org/libs/type_traits for most recent version including documentation. 8 | 9 | #ifndef BOOST_TT_ALIGNED_STORAGE_HPP_INCLUDED 10 | # define BOOST_TT_ALIGNED_STORAGE_HPP_INCLUDED 11 | # include 12 | #endif // BOOST_TT_ALIGNED_STORAGE_HPP_INCLUDED 13 | 14 | -------------------------------------------------------------------------------- /klee/lib/Module/KInstruction.cpp: -------------------------------------------------------------------------------- 1 | //===-- KInstruction.cpp --------------------------------------------------===// 2 | // 3 | // The KLEE Symbolic Virtual Machine 4 | // 5 | // This file is distributed under the University of Illinois Open Source 6 | // License. See LICENSE.TXT for details. 7 | // 8 | //===----------------------------------------------------------------------===// 9 | 10 | #include "klee/Internal/Module/KInstruction.h" 11 | 12 | using namespace llvm; 13 | using namespace klee; 14 | 15 | /***/ 16 | 17 | KInstruction::~KInstruction() { 18 | delete[] operands; 19 | } 20 | -------------------------------------------------------------------------------- /qemu/tests/tcg/lm32/test_andi.S: -------------------------------------------------------------------------------- 1 | .include "macros.inc" 2 | 3 | start 4 | 5 | test_name ANDI_1 6 | mvi r1, 0 7 | andi r3, r1, 0 8 | check_r3 0 9 | 10 | test_name ANDI_2 11 | mvi r1, 1 12 | andi r3, r1, 1 13 | check_r3 1 14 | 15 | test_name ANDI_3 16 | load r1 0x000f0000 17 | andi r3, r1, 1 18 | check_r3 0 19 | 20 | test_name ANDI_4 21 | load r1 0xffffffff 22 | andi r3, r1, 0xffff 23 | check_r3 0xffff 24 | 25 | test_name ANDI_5 26 | load r1 0xffffffff 27 | andi r3, r1, 0 28 | check_r3 0 29 | 30 | test_name ANDI_6 31 | load r3 0xffff55aa 32 | andi r3, r3, 0xaaaa 33 | check_r3 0x000000aa 34 | 35 | end 36 | -------------------------------------------------------------------------------- /qemu/tests/tcg/lm32/test_be.S: -------------------------------------------------------------------------------- 1 | .include "macros.inc" 2 | 3 | start 4 | 5 | test_name BE_1 6 | mvi r1, 0 7 | mvi r2, 0 8 | be r1, r2, 1f 9 | tc_fail 10 | bi 2f 11 | 1: 12 | tc_pass 13 | 2: 14 | 15 | test_name BE_2 16 | mvi r1, 1 17 | mvi r2, 0 18 | be r1, r2, 1f 19 | tc_pass 20 | bi 2f 21 | 1: 22 | tc_fail 23 | 2: 24 | 25 | test_name BE_3 26 | mvi r1, 0 27 | mvi r2, 1 28 | be r1, r2, 1f 29 | tc_pass 30 | bi 2f 31 | 1: 32 | tc_fail 33 | 2: 34 | 35 | bi 2f 36 | 1: 37 | tc_pass 38 | bi 3f 39 | 2: 40 | test_name BE_4 41 | mvi r1, 1 42 | mvi r2, 1 43 | be r1, r2, 1b 44 | tc_fail 45 | 3: 46 | 47 | end 48 | 49 | -------------------------------------------------------------------------------- /stp/src/boost/type_traits/detail/size_t_trait_undef.hpp: -------------------------------------------------------------------------------- 1 | 2 | // NO INCLUDE GUARDS, THE HEADER IS INTENDED FOR MULTIPLE INCLUSION 3 | 4 | // Copyright Aleksey Gurtovoy 2002-2004 5 | // 6 | // Distributed under the Boost Software License, Version 1.0. 7 | // (See accompanying file LICENSE_1_0.txt or copy at 8 | // http://www.boost.org/LICENSE_1_0.txt) 9 | 10 | // $Source$ 11 | // $Date: 2004-09-02 11:41:37 -0400 (Thu, 02 Sep 2004) $ 12 | // $Revision: 24874 $ 13 | 14 | #undef BOOST_TT_AUX_SIZE_T_TRAIT_DEF1 15 | #undef BOOST_TT_AUX_SIZE_T_TRAIT_SPEC1 16 | #undef BOOST_TT_AUX_SIZE_T_TRAIT_PARTIAL_SPEC1_1 17 | -------------------------------------------------------------------------------- /stp/tests/sample-tests/a163test0021.cvc: -------------------------------------------------------------------------------- 1 | %% Regression level = 3 2 | %% Result = InValid 3 | %% Language = presentation 4 | 5 | n: BITVECTOR(32); 6 | c: BITVECTOR(8); 7 | %---------------------------------------------------- 8 | ASSERT BVLT(n,0bin00000000000000000000000000010000); 9 | ASSERT NOT ((0bin000000000000000000000000 @ c) 10 | = 0bin00000000000000000000000011111110); 11 | ASSERT BVLT(n,0bin00000000000000000000000000001100); 12 | ASSERT NOT NOT (n = 0bin00000000000000000000000000000000); 13 | 14 | %---------------------------------------------------- 15 | QUERY FALSE; 16 | COUNTEREXAMPLE; 17 | --------------------------------------------------------------------------------