Previous Up Next

6  Modeling Heuristics

6.1  Nondeterministic Choice

Blast uses the special variable __BLAST_NONDET to implement nondeterministic choice. Thus,
if (__BLAST_NONDET) {
 // then branch
} else {
 // else branch
}
is treated as a nondeterministic if statement whose either branch may be taken. This is sometimes useful in modeling nondeterministic choice in specification functions or in models of library functions.

6.2  Stubs and Drivers

Blast is essentially a whole program analysis. If there are calls in your code to library functions, it expects to see the body of the function. If the body of a function is not present, Blast optimistically assumes that the function has no effect on the variables of the program other than the one in which the return value is copied.

Sometimes we are interested in the effect of library functions, but not in their detailed implementation. For example, we may be interested in knowing that malloc returns either a null pointer or a non-null pointer, without knowing exactly how memory allocation works. This is useful for scalability: we are abstracting unnecessary details of the library. Sometimes this is necessary as well: certain system services are written in assembly and not amenable to our analysis.

Blast expects in these cases that the user provides stubs for useful library functions. Each stub function is basically a piece of C code, possibly with the use of __BLAST_NONDET to allow nondeterministic choice.

6.3  Syntax of Seed Predicates

You can input initial predicates on the command line using the option -pred. This section gives the syntax for input predicates. The format of the predicate file is a list of predicates, separated by semicolons. Each predicate is a valid boolean expression in C syntax. However, we change variable names to also reflect the scope of the variable. So the variable x in function foo is written x@foo. The detailed syntax can be seen in the file inputparse.mly in the directory psrc.

Notice that if the same syntactic name is used for multiple variables in different scopes then Cil renames the local variables. In this case, one has to look at the names produced by Cil to use the appropriate variable in the predicates.


Previous Up Next