Georg Kienesberger - Vienna University of Technology
FOSDEM’09
Free and Open Source Software Developers’ European Meeting
7-8 February 2009 - Brussels, Belgium
These slides are licensed under a Creative Commons Attribution-Share Alike 3.0 Austria License. http://creativecommons.org
Digital Identity is Under Attack: FIDO Paris Seminar.pptx
Ast2Cfg - A Framework for CFG-Based Analysis and Visualisation of Ada Programs
1. Ast2Cfg - A Framework for CFG-Based Analysis
and Visualisation of Ada Programs
Georg Kienesberger - Vienna University of Technology
FOSDEM’09
Free and Open Source Software Developers’ European Meeting
7-8 February 2009 - Brussels, Belgium
These slides are licensed under a Creative Commons Attribution-Share Alike 3.0 Austria License. http://creativecommons.org 1
2. 1 Overview
2 CFG and AST
3 The Software
4 Live Demonstration of Ast2Cfg, Cfg2Dot
5 Examples
2
3. Overview
• Control Flow Graph (CFG) used in many
analysis/optimisation methods
3
4. Overview
• Control Flow Graph (CFG) used in many
analysis/optimisation methods
• ISO/IEC 15291:1999 - Ada Semantic Interface Specification
(ASIS) implemented by ASIS-for-GNAT
3
5. Overview
• Control Flow Graph (CFG) used in many
analysis/optimisation methods
• ISO/IEC 15291:1999 - Ada Semantic Interface Specification
(ASIS) implemented by ASIS-for-GNAT
• traverse Abstract Syntax Tree (AST) and build CFG
3
6. Overview
• Control Flow Graph (CFG) used in many
analysis/optimisation methods
• ISO/IEC 15291:1999 - Ada Semantic Interface Specification
(ASIS) implemented by ASIS-for-GNAT
• traverse Abstract Syntax Tree (AST) and build CFG
• Framework
3
7. Control Flow Graph (CFG)
• directed graph
• nodes represent statements
• There is an edge from node u to node v if v can follow u in
some execution sequence.
• unique start node called root or initial node
4
8. Example: The Source Code
procedure Test is
A: array (1 .. 3) of Natural;
S: Natural;
K: Natural;
begin
A := (1,2,3);
S := 0;
K := A’First;
loop
if K <= A’Last then
S := S + A(K);
K := K + 1;
else
exit;
end if;
end loop;
end Test;
5
9. Example: The Control Flow Graph (CFG)
A := (1,2,3);
S := 0;
K := A’First;
loop
if K <= A’Last
S := S + A(K);
exit;
K := K + 1;
end if;
end loop;
6
10. Example: The Control Flow Graph (CFG)
A := (1,2,3);
S := 0;
K := A’First;
loop
if K <= A’Last
S := S + A(K);
exit;
K := K + 1;
end if;
end loop;
6
11. Example: The Control Flow Graph (CFG)
A := (1,2,3);
S := 0;
K := A’First;
loop
if K <= A’Last
S := S + A(K);
exit;
K := K + 1;
end if;
end loop;
6
17. The Software
• Ast2Cfg - the framework, designed as a library
• Cfg2Dot - uses Ast2Cfg, outputs the CFG structure in dot
format
• Ast2Dot - uses ASIS directly to output the AST in dot format
• available under GPLv2 (Ast2Dot) or GPLv3 (Ast2Cfg,
Cfg2Dot)
11
18. The Structure of the Transformation Process
Transformation
Pre Op
Traversal
.adt
Post
Child Has Finished
File
AST Post Op
Structure CFG
12
20. Flow World: The Main Data Structure
• World Object
• Flow Object
• Pkg Object
• CFG Object
• Node Object
13
21. Flow World: The Main Data Structure
• World Object
• Flow Object
• Pkg Object
• CFG Object
• Node Object
• Pkg/CFG Tree (implicit structure)
13
22. Example: Pkg/CFG Tree
Default_PKG
(body)
procedure Outer CFG is
package Outer Pkg is
end Outer Pkg;
Outer_CFG
package body Outer Pkg is
(body)
package Inner Pkg is
end Inner Pkg;
procedure Inner CFG is
begin Outer_Pkg Outer_Pkg
end Inner CFG; (spec) (body)
end Outer Pkg;
begin
end Outer CFG; Inner_Pkg Inner_CFG
(spec) (body)
14
23. Flow World: The Main Data Structure (contd.)
• World Object
• Flow Object
• Pkg Object
• CFG Object
• Node Object
• Pkg/CFG Tree (implicit structure)
• Parameter Tree (saved in nodes)
15
29. Usage
with Ada.Text IO; use Ada.Text IO; with Ast2Cfg.Pkgs; use Ast2Cfg.Pkgs;
with Ast2Cfg.Control; with Ast2Cfg.Flow World; with Ast2Cfg.Output;
procedure Run is
World: Ast2Cfg.Flow World.World Object Ptr;
Pkgs: Pkg Class Ptr List.Object;
Pkg: Pkg Class Ptr := null;
begin
-- Initialisations
Ast2Cfg.Output.Set Level(Ast2Cfg.Output.Warning);
Ast2Cfg.Control.Init("−CN foo.adt bar.adt");
-- Fill the World with flow data
World := Ast2Cfg.Control.Generate;
-- Output the name of all top-level packages
Pkgs := Ast2Cfg.Flow World.Get Pkgs(World.all);
Pkg Class Ptr List.Reset(Pkgs);
while Pkg Class Ptr List.Has Next(Pkgs) loop
Pkg Class Ptr List.Get Next(Pkgs, Pkg);
Put Line(Get Name(Pkg.all));
end loop;
-- Finalisation
Ast2Cfg.Control.Final;
end Run;
21
31. Examples: If Statement
Branch Node 1.2.5:
if/case
Node 1.2.7:
Node 1.2.14:
Idents: >
elsif (false) then
if (X>10) then
if (X>10) then
null; Parameter Node 1.2.8: Node 1.2.12: Node 1.2.16:
elsif (false) then
null; STMT/PAR null; null;
end if;
Parameter Call Node 1.2.9: Node 1.2.6:
Dest: >
FUNC/PARAM/ROOT end if/case
Parameter Node 1.2.10: Parameter Node 1.2.11: Node 1.2.18:
Variable: X
PARAM/NODE PARAM/NODE CFG END
23
32. Examples: Case Statement
Branch Node 1.3.9:
Name: Start
Idents: X
if/case
Node 1.3.11: Node 1.3.15:
Node 1.3.19:
Idents: A Idents: B
<<Start> case X is
> when others =>
when A => when B =>
when A =>
null;
when B => Goto Jump Node 1.3.23:
null; Node 1.3.13: Node 1.3.17:
Target: Start
when others => Idents: Start
goto Start; null; null;
goto Start;
end case;
Node 1.3.10:
end if/case
Node 1.3.24:
CFG END
24
34. Examples: A few words on the word static
Infinite Loop Node 1.1.5:
loop
procedure Not A Loop is
I: Integer := 0;
begin T-Exit Jump Node 1.1.8:
loop exit;
exit;
I := I + 1;
end loop;
Node 1.1.16:
end Not A Loop;
Loop End
Node 1.1.17:
CFG END
not a loop.adb:7:09: warning: unreachable code
26
35. Examples: A few words on the word static (2)
Infinite Loop Node 1.1.5:
loop
C-Exit Jump Node 1.1.8:
procedure Not A Loop 2 is
I: Integer := 10; Idents: >=
begin
exit when I >= 10;
loop
exit when I >= 10;
I := I + 1;
end loop; Assignment Node 1.1.14:
Node 1.1.19:
end Not A Loop 2; Idents: I,+
Loop End
I := I + 1;
Node 1.1.20:
CFG END
27
36. Examples: Tasks
Node 1.3.1:
select/acc
Node 1.4.4:
−− Caller Object Node 1.3.4:
Task Object.Entry1; Idents: Condition
select
Entry Call Node1.6.7: or
−− Called Object Dest: Task_Object.Entry1
select Idents: Task_Object.Entry1
accept Entry1 do Task_Object.Entry1;
null; Accept Node1.3.8: Accept Node1.4.8:
end Entry1; Dest: CFG[1.4.0] Dest: CFG[1.5.0]
or accept Entry1 do accept Entry2 do
when Condition => Node 1.6.9:
accept Entry2 do
null; CFG END
end Entry2; Node 1.3.3:
end select;
end select
Node 1.5.4:
CFG END
28
37. Examples: Protected Objects
package body Prot Pkg is
Prot_Pkg
protected body (body)
Prot Type is --VARS-- Entry Call Node2.2.3:
Prot_Obj: {ST: Prot_Type} Dest: Prot_Obj.Entry1
entry Entry1 Idents: Prot_Obj.Entry1
(A: in Integer) Prot_Obj.Entry1(0);
when True is
begin Prot_Type Init_CFG
(body) (body) Parameter Call Node 2.2.4: Node 2.2.6:
null; Dest: Prot_Obj.Entry1
end Entry1; PROC/PARAM/ROOT CFG END
end Prot Type;
Entry1 Parameter Node 2.2.5:
Prot Obj: Prot Type; (body)
--PARAMS-- PARAM/NODE
begin A: {ST: Integer}
Prot Obj.Entry1(0);
end Prot Pkg;
29
38. Examples: Types
Types
(spec)
--TYPES--
Rec_Type_0
[COMPONENTS]
F: {CT: Float}
B: {CT: Boolean}
package Types is Rec_Type_1 {ST: Rec_Type_0}
type Rec Type 0 is
tagged F
record INIT
F: Float := abs(3.14);
B: Boolean;
end record;
Parameter Node 1.0.2:
type Rec Type 1 is INIT/NODE
new Rec Type 0
with null record;
Parameter Call Node 1.0.4:
end Types; Dest: abs
FUNC/PARAM/ROOT
Parameter Node 1.0.5:
PARAM/NODE
30
39. Further Information & Downloads
• http://cfg.w3x.org
• For comments, bug reports and feature requests please
contact us:
• cfg@w3x.org
31
40. Further Information & Downloads
• http://cfg.w3x.org
• For comments, bug reports and feature requests please
contact us:
• cfg@w3x.org
• Raul Fechete and Georg Kienesberger. Generating control flow graphs for Ada
programs. Technical Report 183/1-139, Department of Automation, TU
Vienna, September 2007.
31
41. Further Information & Downloads
• http://cfg.w3x.org
• For comments, bug reports and feature requests please
contact us:
• cfg@w3x.org
• Raul Fechete and Georg Kienesberger. Generating control flow graphs for Ada
programs. Technical Report 183/1-139, Department of Automation, TU
Vienna, September 2007.
• Raul Fechete, Georg Kienesberger, and Johann Blieberger. A Framework for
CFG-based Static Program Analysis of Ada Programs. In Ada-Europe’2008
International Conference on Reliable Software Technologies, pages 130-143,
Venice, Italy, June 2008.
31
42. Further Information & Downloads
• http://cfg.w3x.org
• For comments, bug reports and feature requests please
contact us:
• cfg@w3x.org
• Raul Fechete and Georg Kienesberger. Generating control flow graphs for Ada
programs. Technical Report 183/1-139, Department of Automation, TU
Vienna, September 2007.
• Raul Fechete, Georg Kienesberger, and Johann Blieberger. A Framework for
CFG-based Static Program Analysis of Ada Programs. In Ada-Europe’2008
International Conference on Reliable Software Technologies, pages 130-143,
Venice, Italy, June 2008.
• updated documentation in the next few months
31
43. The End
Thank you very much!
Any questions?
http://cfg.w3x.org
These slides are licensed under a Creative Commons Attribution-Share Alike 3.0 Austria License. http://creativecommons.org
32