Copy disabled (too large)
Download .txt
Showing preview only (52,777K chars total). Download the full file to get everything.
Repository: dslab-epfl/s2e
Branch: master
Commit: 45f67aaf7ccb
Files: 3576
Total size: 63.5 MB
Directory structure:
gitextract_8rt5w_4a/
├── .github/
│ └── FUNDING.yml
├── .gitignore
├── LICENSE
├── Makefile
├── README
├── S2E-AUTHORS
├── config.lua
├── docs/
│ ├── BuildingLinux.html
│ ├── BuildingLinux.rst
│ ├── BuildingS2E.html
│ ├── BuildingS2E.rst
│ ├── Contribute.html
│ ├── Contribute.rst
│ ├── EquivalenceTesting.html
│ ├── EquivalenceTesting.rst
│ ├── FAQ.html
│ ├── FAQ.rst
│ ├── Howtos/
│ │ ├── Concolic.html
│ │ ├── Concolic.rst
│ │ ├── Debugging.html
│ │ ├── Debugging.rst
│ │ ├── ExecutionTracers.html
│ │ ├── ExecutionTracers.rst
│ │ ├── Parallel.html
│ │ ├── Parallel.rst
│ │ ├── WritingPlugins.html
│ │ ├── WritingPlugins.rst
│ │ ├── init_env.html
│ │ └── init_env.rst
│ ├── ImageInstallation.html
│ ├── ImageInstallation.rst
│ ├── Makefile
│ ├── Plugins/
│ │ ├── Annotation.html
│ │ ├── Annotation.rst
│ │ ├── BaseInstructions.html
│ │ ├── BaseInstructions.rst
│ │ ├── EdgeKiller.html
│ │ ├── EdgeKiller.rst
│ │ ├── FunctionMonitor.html
│ │ ├── FunctionMonitor.rst
│ │ ├── ModuleExecutionDetector.html
│ │ ├── ModuleExecutionDetector.rst
│ │ ├── RawMonitor.html
│ │ ├── RawMonitor.rst
│ │ ├── StateManager.html
│ │ ├── StateManager.rst
│ │ ├── Tracers/
│ │ │ ├── ExecutionTracer.html
│ │ │ ├── ExecutionTracer.rst
│ │ │ ├── InstructionCounter.html
│ │ │ ├── InstructionCounter.rst
│ │ │ ├── ModuleTracer.html
│ │ │ ├── ModuleTracer.rst
│ │ │ ├── TestCaseGenerator.html
│ │ │ ├── TestCaseGenerator.rst
│ │ │ ├── TranslationBlockTracer.html
│ │ │ └── TranslationBlockTracer.rst
│ │ └── WindowsInterceptor/
│ │ ├── WindowsMonitor.html
│ │ └── WindowsMonitor.rst
│ ├── ProfilingS2E.html
│ ├── ProfilingS2E.rst
│ ├── SystemTap.html
│ ├── SystemTap.rst
│ ├── TestingMinimalProgram.html
│ ├── TestingMinimalProgram.rst
│ ├── Tools/
│ │ ├── CoverageGenerator.html
│ │ ├── CoverageGenerator.rst
│ │ ├── DebugInfo.html
│ │ ├── DebugInfo.rst
│ │ ├── ExecutionProfiler.html
│ │ ├── ExecutionProfiler.rst
│ │ ├── ForkProfiler.html
│ │ ├── ForkProfiler.rst
│ │ ├── TbPrinter.html
│ │ └── TbPrinter.rst
│ ├── UsingS2EGet.html
│ ├── UsingS2EGet.rst
│ ├── Windows/
│ │ ├── CheckedBuild.html
│ │ ├── CheckedBuild.rst
│ │ ├── DriverTutorial.html
│ │ └── DriverTutorial.rst
│ ├── config.s2e.i686
│ ├── index.html
│ ├── index.rst
│ ├── pygments-default.css
│ ├── rst2html-pygments
│ ├── rst2latex-pygments
│ ├── s2e.css
│ └── sample/
│ └── factorial.c
├── guest/
│ ├── Makefile
│ ├── configure
│ ├── demos/
│ │ └── quicksort.c
│ ├── include/
│ │ ├── s2e-arm.h
│ │ ├── s2e-x86.h
│ │ └── s2e.h
│ ├── init_env/
│ │ └── init_env.c
│ ├── s2ecmd/
│ │ └── s2ecmd.c
│ ├── s2eget/
│ │ └── s2eget.c
│ ├── stp/
│ │ └── s2e.stp
│ └── windbg-gdb/
│ ├── BFDInterface.cpp
│ ├── BFDInterface.h
│ ├── Makefile
│ ├── StartSize.h
│ ├── Symbols.cpp
│ ├── Symbols.h
│ ├── gdbsyms.def
│ └── main.cpp
├── klee/
│ ├── LICENSE.TXT
│ ├── Makefile
│ ├── Makefile.common
│ ├── Makefile.config.in
│ ├── README.txt
│ ├── TODO.txt
│ ├── autoconf/
│ │ ├── AutoRegen.sh
│ │ ├── config.guess
│ │ ├── config.sub
│ │ ├── configure.ac
│ │ └── install-sh
│ ├── configure
│ ├── docs/
│ │ ├── SMT-COMP/
│ │ │ ├── BitVector_ArraysEx.smt
│ │ │ ├── BitVectors.smt
│ │ │ ├── QF_AUFBV.smt
│ │ │ └── QF_BV.smt
│ │ ├── doxygen.cfg
│ │ ├── intro
│ │ └── overview
│ ├── examples/
│ │ ├── islower/
│ │ │ └── islower.c
│ │ ├── regexp/
│ │ │ ├── Regexp.c
│ │ │ └── notes.txt
│ │ └── sort/
│ │ └── sort.c
│ ├── include/
│ │ ├── expr/
│ │ │ ├── Lexer.h
│ │ │ └── Parser.h
│ │ └── klee/
│ │ ├── AddressSpace.h
│ │ ├── BitfieldSimplifier.h
│ │ ├── CallPathManager.h
│ │ ├── Common.h
│ │ ├── Config/
│ │ │ ├── common.h
│ │ │ └── config.h.in
│ │ ├── Constraints.h
│ │ ├── Context.h
│ │ ├── CoreStats.h
│ │ ├── ExecutionState.h
│ │ ├── Executor.h
│ │ ├── Expr.h
│ │ ├── ExprBuilder.h
│ │ ├── ExternalDispatcher.h
│ │ ├── IncompleteSolver.h
│ │ ├── Internal/
│ │ │ ├── ADT/
│ │ │ │ ├── DiscretePDF.h
│ │ │ │ ├── DiscretePDF.inc
│ │ │ │ ├── ImmutableMap.h
│ │ │ │ ├── ImmutableSet.h
│ │ │ │ ├── ImmutableTree.h
│ │ │ │ ├── KTest.h
│ │ │ │ ├── MapOfSets.h
│ │ │ │ ├── RNG.h
│ │ │ │ └── TreeStream.h
│ │ │ ├── Module/
│ │ │ │ ├── Cell.h
│ │ │ │ ├── InstructionInfoTable.h
│ │ │ │ ├── KInstIterator.h
│ │ │ │ ├── KInstruction.h
│ │ │ │ └── KModule.h
│ │ │ ├── README.txt
│ │ │ ├── Support/
│ │ │ │ ├── FloatEvaluation.h
│ │ │ │ ├── IntEvaluation.h
│ │ │ │ ├── ModuleUtil.h
│ │ │ │ ├── QueryLog.h
│ │ │ │ └── Timer.h
│ │ │ └── System/
│ │ │ └── Time.h
│ │ ├── Interpreter.h
│ │ ├── Memory.h
│ │ ├── ObjectHolder.h
│ │ ├── PTree.h
│ │ ├── Searcher.h
│ │ ├── Solver.h
│ │ ├── SolverImpl.h
│ │ ├── SolverStats.h
│ │ ├── Statistic.h
│ │ ├── Statistics.h
│ │ ├── StatsTracker.h
│ │ ├── TimerStatIncrementer.h
│ │ ├── UserSearcher.h
│ │ └── util/
│ │ ├── Assignment.h
│ │ ├── BitArray.h
│ │ ├── Bits.h
│ │ ├── ExprEvaluator.h
│ │ ├── ExprHashMap.h
│ │ ├── ExprPPrinter.h
│ │ ├── ExprRangeEvaluator.h
│ │ ├── ExprUtil.h
│ │ ├── ExprVisitor.h
│ │ └── Ref.h
│ ├── lib/
│ │ ├── Basic/
│ │ │ ├── KTest.cpp
│ │ │ ├── Makefile
│ │ │ ├── README.txt
│ │ │ └── Statistics.cpp
│ │ ├── Core/
│ │ │ ├── AddressSpace.cpp
│ │ │ ├── CallPathManager.cpp
│ │ │ ├── Common.cpp
│ │ │ ├── Context.cpp
│ │ │ ├── CoreStats.cpp
│ │ │ ├── ExecutionState.cpp
│ │ │ ├── Executor.cpp
│ │ │ ├── ExecutorTimers.cpp
│ │ │ ├── ExecutorUtil.cpp
│ │ │ ├── ExternalDispatcher.cpp
│ │ │ ├── ImpliedValue.cpp
│ │ │ ├── ImpliedValue.h
│ │ │ ├── KleeExecutor.cpp
│ │ │ ├── KleeExecutor.h
│ │ │ ├── Makefile
│ │ │ ├── Memory.cpp
│ │ │ ├── MemoryManager.cpp
│ │ │ ├── MemoryManager.h
│ │ │ ├── PTree.cpp
│ │ │ ├── Searcher.cpp
│ │ │ ├── SeedInfo.cpp
│ │ │ ├── SeedInfo.h
│ │ │ ├── SpecialFunctionHandler.cpp
│ │ │ ├── SpecialFunctionHandler.h
│ │ │ ├── StatsTracker.cpp
│ │ │ ├── TimingSolver.cpp
│ │ │ ├── TimingSolver.h
│ │ │ └── UserSearcher.cpp
│ │ ├── Expr/
│ │ │ ├── BitfieldSimplifier.cpp
│ │ │ ├── Constraints.cpp
│ │ │ ├── Expr.cpp
│ │ │ ├── ExprBuilder.cpp
│ │ │ ├── ExprEvaluator.cpp
│ │ │ ├── ExprPPrinter.cpp
│ │ │ ├── ExprUtil.cpp
│ │ │ ├── ExprVisitor.cpp
│ │ │ ├── Lexer.cpp
│ │ │ ├── Makefile
│ │ │ ├── Parser.cpp
│ │ │ └── Updates.cpp
│ │ ├── Makefile
│ │ ├── Module/
│ │ │ ├── Checks.cpp
│ │ │ ├── InstructionInfoTable.cpp
│ │ │ ├── IntrinsicCleaner.cpp
│ │ │ ├── KInstruction.cpp
│ │ │ ├── KModule.cpp
│ │ │ ├── LowerSwitch.cpp
│ │ │ ├── Makefile
│ │ │ ├── ModuleUtil.cpp
│ │ │ ├── Optimize.cpp
│ │ │ ├── Passes.h
│ │ │ ├── PhiCleaner.cpp
│ │ │ └── RaiseAsm.cpp
│ │ ├── README.txt
│ │ ├── SMT/
│ │ │ ├── LICENSE.CVC3
│ │ │ ├── Makefile
│ │ │ ├── SMTParser.cpp
│ │ │ ├── SMTParser.h
│ │ │ ├── main.cpp
│ │ │ ├── smtlib.lex
│ │ │ └── smtlib.y
│ │ ├── Solver/
│ │ │ ├── CachingSolver.cpp
│ │ │ ├── CexCachingSolver.cpp
│ │ │ ├── ConstantDivision.cpp
│ │ │ ├── ConstantDivision.h
│ │ │ ├── FastCexSolver.cpp
│ │ │ ├── IncompleteSolver.cpp
│ │ │ ├── IndependentSolver.cpp
│ │ │ ├── Makefile
│ │ │ ├── PCLoggingSolver.cpp
│ │ │ ├── STPBuilder.cpp
│ │ │ ├── STPBuilder.h
│ │ │ ├── Solver.cpp
│ │ │ └── SolverStats.cpp
│ │ └── Support/
│ │ ├── Makefile
│ │ ├── README.txt
│ │ ├── RNG.cpp
│ │ ├── Time.cpp
│ │ ├── Timer.cpp
│ │ └── TreeStream.cpp
│ ├── runtime/
│ │ ├── Intrinsic/
│ │ │ ├── Makefile
│ │ │ ├── klee_div_zero_check.c
│ │ │ ├── klee_int.c
│ │ │ ├── klee_range.c
│ │ │ ├── memcpy.c
│ │ │ ├── memmove.c
│ │ │ ├── mempcpy.c
│ │ │ └── memset.c
│ │ ├── Makefile
│ │ ├── POSIX/
│ │ │ ├── Makefile
│ │ │ ├── fd.c
│ │ │ ├── fd.h
│ │ │ ├── fd_32.c
│ │ │ ├── fd_64.c
│ │ │ ├── fd_init.c
│ │ │ ├── illegal.c
│ │ │ ├── klee_init_env.c
│ │ │ ├── misc.c
│ │ │ ├── selinux.c
│ │ │ ├── stubs.c
│ │ │ ├── testing-dir/
│ │ │ │ ├── c
│ │ │ │ └── d
│ │ │ └── testing-env
│ │ ├── Runtest/
│ │ │ ├── Makefile
│ │ │ └── intrinsics.c
│ │ └── klee-libc/
│ │ ├── Makefile
│ │ ├── __cxa_atexit.c
│ │ ├── abort.c
│ │ ├── atexit.c
│ │ ├── atoi.c
│ │ ├── calloc.c
│ │ ├── htonl.c
│ │ ├── klee-choose.c
│ │ ├── memchr.c
│ │ ├── memcmp.c
│ │ ├── memcpy.c
│ │ ├── memmove.c
│ │ ├── mempcpy.c
│ │ ├── memset.c
│ │ ├── putchar.c
│ │ ├── stpcpy.c
│ │ ├── strcat.c
│ │ ├── strchr.c
│ │ ├── strcmp.c
│ │ ├── strcoll.c
│ │ ├── strcpy.c
│ │ ├── strlen.c
│ │ ├── strncmp.c
│ │ ├── strncpy.c
│ │ ├── strrchr.c
│ │ ├── strtol.c
│ │ ├── strtoul.c
│ │ ├── tolower.c
│ │ └── toupper.c
│ ├── scripts/
│ │ ├── IStatsMerge.py
│ │ ├── IStatsSum.py
│ │ ├── klee-control
│ │ ├── klee-gcc
│ │ └── objdump
│ ├── stp/
│ │ ├── AST/
│ │ │ ├── AST.cpp
│ │ │ ├── AST.h
│ │ │ ├── ASTKind.kinds
│ │ │ ├── ASTUtil.cpp
│ │ │ ├── ASTUtil.h
│ │ │ ├── BitBlast.cpp
│ │ │ ├── Makefile
│ │ │ ├── STLport_config.h
│ │ │ ├── SimpBool.cpp
│ │ │ ├── ToCNF.cpp
│ │ │ ├── ToSAT.cpp
│ │ │ ├── Transform.cpp
│ │ │ ├── asttest.cpp
│ │ │ ├── bbtest.cpp
│ │ │ ├── cnftest.cpp
│ │ │ └── genkinds.pl
│ │ ├── INSTALL
│ │ ├── LICENSE
│ │ ├── Makefile
│ │ ├── Makefile.common.in
│ │ ├── README
│ │ ├── bitvec/
│ │ │ ├── Makefile
│ │ │ └── consteval.cpp
│ │ ├── c_interface/
│ │ │ ├── Makefile
│ │ │ ├── c_interface.cpp
│ │ │ ├── c_interface.h
│ │ │ └── fdstream.h
│ │ ├── constantbv/
│ │ │ ├── Makefile
│ │ │ ├── constantbv.cpp
│ │ │ └── constantbv.h
│ │ ├── parser/
│ │ │ ├── Makefile
│ │ │ ├── PL.lex
│ │ │ ├── PL.y
│ │ │ ├── let-funcs.cpp
│ │ │ ├── main.cpp
│ │ │ ├── smtlib.lex
│ │ │ └── smtlib.y
│ │ ├── sat/
│ │ │ ├── Global.h
│ │ │ ├── Heap.h
│ │ │ ├── LICENSE
│ │ │ ├── Makefile
│ │ │ ├── Simplifier.C
│ │ │ ├── Solver.C
│ │ │ ├── Solver.h
│ │ │ ├── SolverTypes.h
│ │ │ ├── Sort.h
│ │ │ └── VarOrder.h
│ │ ├── simplifier/
│ │ │ ├── Makefile
│ │ │ ├── bvsolver.cpp
│ │ │ ├── bvsolver.h
│ │ │ └── simplifier.cpp
│ │ └── stp/
│ │ └── Makefile
│ ├── test/
│ │ ├── CXX/
│ │ │ ├── ArrayNew.cpp
│ │ │ ├── New.cpp
│ │ │ ├── SimpleVirtual.cpp
│ │ │ ├── StaticConstructor.cpp
│ │ │ ├── StaticDestructor.cpp
│ │ │ ├── Trivial.cpp
│ │ │ └── dg.exp
│ │ ├── Concrete/
│ │ │ ├── BitwiseOps.ll
│ │ │ ├── BoolReadWrite.ll
│ │ │ ├── Casts.ll
│ │ │ ├── CmpEq.ll
│ │ │ ├── ConcreteTest.py
│ │ │ ├── ConstantExpr.ll
│ │ │ ├── FloatingPointOps.ll
│ │ │ ├── GlobalInitializers.ll
│ │ │ ├── GlobalVariable.ll
│ │ │ ├── ICmp.ll
│ │ │ ├── InvokeAndReturn.ll
│ │ │ ├── InvokeAndUnwindOnce.ll
│ │ │ ├── InvokeAndUnwindTwice.ll
│ │ │ ├── Makefile
│ │ │ ├── OneCall.ll
│ │ │ ├── OverlappingPhiNodes.ll
│ │ │ ├── Select.ll
│ │ │ ├── Shifts.ll
│ │ │ ├── SimpleStoreAndLoad.ll
│ │ │ ├── UnconditionalBranch.ll
│ │ │ ├── UnconditionalBranchWithSimplePhi.ll
│ │ │ ├── UnorderedPhiNodes.ll
│ │ │ ├── _testingUtils.c
│ │ │ ├── ackermann.c
│ │ │ └── arith_test.ll
│ │ ├── Coverage/
│ │ │ ├── ReadArgs.c
│ │ │ ├── ReplayOutDir.c
│ │ │ └── dg.exp
│ │ ├── Dogfood/
│ │ │ ├── ImmutableSet.cpp
│ │ │ └── dg.exp
│ │ ├── Expr/
│ │ │ ├── Evaluate.pc
│ │ │ ├── Evaluate2.pc
│ │ │ ├── Lexer/
│ │ │ │ ├── Numbers.pc
│ │ │ │ └── dg.exp
│ │ │ ├── Parser/
│ │ │ │ ├── Concat64.pc
│ │ │ │ ├── ConstantFolding.pc
│ │ │ │ ├── Exprs.pc
│ │ │ │ ├── MultiByteReads.pc
│ │ │ │ ├── Simplify.pc
│ │ │ │ ├── TypeChecking.pc
│ │ │ │ └── dg.exp
│ │ │ └── dg.exp
│ │ ├── Feature/
│ │ │ ├── Alias.c
│ │ │ ├── AliasFunction.c
│ │ │ ├── AliasFunctionExit.c
│ │ │ ├── AsmAddresses.c
│ │ │ ├── ByteSwap.c
│ │ │ ├── CallToUndefinedExternal.cpp
│ │ │ ├── CheckForImpliedValue.c.failing
│ │ │ ├── CheckMemoryAccess.c
│ │ │ ├── CopyOnWrite.c
│ │ │ ├── DanglingConcreteReadExpr.c
│ │ │ ├── DefineFixedObject.c
│ │ │ ├── DoubleFree.c
│ │ │ ├── DumpStatesOnHalt.c
│ │ │ ├── Envp.c
│ │ │ ├── ExprLogging.c
│ │ │ ├── ExternalWeakLinkage.c
│ │ │ ├── Float.c
│ │ │ ├── FunctionPointer.c
│ │ │ ├── GetValue.c
│ │ │ ├── ImpliedValue.c.failing
│ │ │ ├── InAndOutOfBounds.c
│ │ │ ├── IndirectCallToBuiltin.c
│ │ │ ├── IndirectCallToExternal.c
│ │ │ ├── InvalidBitfieldAccess.c.failing
│ │ │ ├── IsSymbolic.c
│ │ │ ├── KleeReportError.c
│ │ │ ├── LongDoubleSupport.c
│ │ │ ├── LowerSwitch.c
│ │ │ ├── MakeConcreteSymbolic.c
│ │ │ ├── MakeSymbolicName.c
│ │ │ ├── MemoryLimit.c
│ │ │ ├── MultipleFreeResolution.c
│ │ │ ├── MultipleReadResolution.c
│ │ │ ├── MultipleReallocResolution.c
│ │ │ ├── MultipleWriteResolution.c
│ │ │ ├── NamedSeedMatching.c
│ │ │ ├── OneFreeError.c
│ │ │ ├── OneOutOfBounds.c
│ │ │ ├── Optimize.c
│ │ │ ├── OverlappedError.c
│ │ │ ├── PreferCex.c
│ │ │ ├── RaiseAsm.c
│ │ │ ├── ReallocFailure.c
│ │ │ ├── ReplayPath.c
│ │ │ ├── Searchers.c
│ │ │ ├── SetForking.c
│ │ │ ├── Vararg.c
│ │ │ ├── WithLibc.c
│ │ │ ├── WriteCov.c
│ │ │ ├── _utils._ll
│ │ │ ├── const_array_opt1.c
│ │ │ ├── dg.exp
│ │ │ └── utils.h
│ │ ├── Makefile
│ │ ├── Makefile.tests
│ │ ├── Programs/
│ │ │ ├── dg.exp
│ │ │ └── pcregrep.c
│ │ ├── README
│ │ ├── Runtime/
│ │ │ ├── POSIX/
│ │ │ │ ├── DirConsistency.c
│ │ │ │ ├── DirSeek.c
│ │ │ │ ├── FDNumbers.c
│ │ │ │ ├── FD_Fail.c
│ │ │ │ ├── FD_Fail2.c
│ │ │ │ ├── Fcntl.c
│ │ │ │ ├── FilePerm.c
│ │ │ │ ├── FreeArgv.c
│ │ │ │ ├── Getenv.c
│ │ │ │ ├── Ioctl.c
│ │ │ │ ├── Isatty.c
│ │ │ │ ├── PrgName.c
│ │ │ │ ├── Read1.c
│ │ │ │ ├── SELinux.c
│ │ │ │ ├── SeedAndFail.c
│ │ │ │ ├── Stdin.c
│ │ │ │ ├── Write1.c
│ │ │ │ ├── Write2.c
│ │ │ │ └── dg.exp
│ │ │ └── Uclibc/
│ │ │ ├── 2007-10-08-optimization-calls-wrong-libc-functions.c
│ │ │ ├── 2008-03-04-libc-atexit-uses-dso-handle.c
│ │ │ ├── Environ.c
│ │ │ └── dg.exp
│ │ ├── Solver/
│ │ │ ├── FastCexSolver.pc
│ │ │ ├── LargeIntegers.pc
│ │ │ └── dg.exp
│ │ ├── TestRunner.sh
│ │ ├── lib/
│ │ │ └── llvm.exp
│ │ └── regression/
│ │ ├── 2007-07-25-invalid-stp-array-binding-to-objectstate.c
│ │ ├── 2007-07-30-unflushed-byte.c
│ │ ├── 2007-08-01-bool-zext-in-call.ll
│ │ ├── 2007-08-01-cache-unclear-on-overwrite-flushed.c
│ │ ├── 2007-08-06-64bit-shift.c
│ │ ├── 2007-08-06-access-after-free.c
│ │ ├── 2007-08-08-free-zero.c
│ │ ├── 2007-08-16-invalid-constant-value.c
│ │ ├── 2007-08-16-valid-write-to-freed-object.c
│ │ ├── 2007-10-11-free-of-alloca.c
│ │ ├── 2007-10-11-illegal-access-after-free-and-branch.c
│ │ ├── 2007-10-12-failed-make-symbolic-after-copy.c
│ │ ├── 2008-02-11-phi-nodes-after-invoke.ll
│ │ ├── 2008-03-04-free-of-global.c
│ │ ├── 2008-03-11-free-of-malloc-zero.c
│ │ ├── 2008-04-10-bad-alloca-free.c
│ │ ├── 2008-05-23-gep-with-global-const.c
│ │ └── dg.exp
│ ├── tools/
│ │ ├── Makefile
│ │ ├── gen-random-bout/
│ │ │ ├── Makefile
│ │ │ └── gen-random-bout.cpp
│ │ ├── kleaver/
│ │ │ ├── Makefile
│ │ │ └── main.cpp
│ │ ├── klee/
│ │ │ ├── Debug.cpp
│ │ │ ├── Makefile
│ │ │ └── main.cpp
│ │ ├── klee-config/
│ │ │ ├── FinalLibDeps.txt
│ │ │ ├── Makefile
│ │ │ └── klee-config.in.in
│ │ ├── klee-replay/
│ │ │ ├── Makefile
│ │ │ ├── fd_init.c
│ │ │ ├── file-creator.c
│ │ │ ├── klee-replay.c
│ │ │ ├── klee-replay.h
│ │ │ └── klee_init_env.c
│ │ ├── klee-stats/
│ │ │ ├── Makefile
│ │ │ └── klee-stats
│ │ └── ktest-tool/
│ │ ├── Makefile
│ │ └── ktest-tool
│ ├── unittests/
│ │ ├── Expr/
│ │ │ ├── ExprTest.cpp
│ │ │ └── Makefile
│ │ ├── Makefile
│ │ ├── Solver/
│ │ │ ├── Makefile
│ │ │ └── SolverTest.cpp
│ │ └── TestMain.cpp
│ ├── utils/
│ │ ├── data/
│ │ │ └── Queries/
│ │ │ ├── pcresymperf-3.pc
│ │ │ └── pcresymperf-4.pc
│ │ ├── emacs/
│ │ │ └── klee-pc-mode.el
│ │ └── valgrind/
│ │ ├── README.txt
│ │ ├── valgrind-llvm.supp
│ │ └── valgrind-stp.supp
│ └── www/
│ ├── Documentation.html
│ ├── GetInvolved.html
│ ├── GetStarted.html
│ ├── KQuery.html
│ ├── TestingCoreutils.html
│ ├── Tutorial-1.html
│ ├── Tutorial-2.html
│ ├── Tutorials.html
│ ├── bugs.html
│ ├── content.css
│ ├── index.html
│ ├── klee-files.html
│ ├── klee-tools.html
│ ├── menu.css
│ ├── menu.html.incl
│ └── resources/
│ ├── Regexp.c.html
│ └── islower.c.html
├── patches/
│ └── compiler-rt-3.2-asan4s2e.patch
├── qemu/
│ ├── .gitignore
│ ├── .gitmodules
│ ├── .mailmap
│ ├── CODING_STYLE
│ ├── COPYING
│ ├── COPYING.LIB
│ ├── Changelog
│ ├── HACKING
│ ├── LICENSE
│ ├── MAINTAINERS
│ ├── Makefile
│ ├── Makefile.dis
│ ├── Makefile.hw
│ ├── Makefile.objs
│ ├── Makefile.target
│ ├── Makefile.user
│ ├── QMP/
│ │ ├── README
│ │ ├── qmp
│ │ ├── qmp-events.txt
│ │ ├── qmp-shell
│ │ ├── qmp-spec.txt
│ │ ├── qmp.py
│ │ ├── qom-get
│ │ ├── qom-list
│ │ └── qom-set
│ ├── README
│ ├── TODO
│ ├── VERSION
│ ├── a.out.h
│ ├── acl.c
│ ├── acl.h
│ ├── aes.c
│ ├── aes.h
│ ├── aio.c
│ ├── alpha-dis.c
│ ├── alpha.ld
│ ├── arch_init.c
│ ├── arch_init.h
│ ├── arm-dis.c
│ ├── arm-semi.c
│ ├── arm.ld
│ ├── async.c
│ ├── audio/
│ │ ├── alsaaudio.c
│ │ ├── audio.c
│ │ ├── audio.h
│ │ ├── audio_int.h
│ │ ├── audio_pt_int.c
│ │ ├── audio_pt_int.h
│ │ ├── audio_template.h
│ │ ├── audio_win_int.c
│ │ ├── audio_win_int.h
│ │ ├── coreaudio.c
│ │ ├── dsound_template.h
│ │ ├── dsoundaudio.c
│ │ ├── esdaudio.c
│ │ ├── fmodaudio.c
│ │ ├── mixeng.c
│ │ ├── mixeng.h
│ │ ├── mixeng_template.h
│ │ ├── noaudio.c
│ │ ├── ossaudio.c
│ │ ├── paaudio.c
│ │ ├── rate_template.h
│ │ ├── sdlaudio.c
│ │ ├── spiceaudio.c
│ │ ├── wavaudio.c
│ │ ├── wavcapture.c
│ │ └── winwaveaudio.c
│ ├── balloon.c
│ ├── balloon.h
│ ├── bitmap.c
│ ├── bitmap.h
│ ├── bitops.c
│ ├── bitops.h
│ ├── block/
│ │ ├── blkdebug.c
│ │ ├── blkverify.c
│ │ ├── bochs.c
│ │ ├── cloop.c
│ │ ├── cow.c
│ │ ├── curl.c
│ │ ├── dmg.c
│ │ ├── iscsi.c
│ │ ├── nbd.c
│ │ ├── parallels.c
│ │ ├── qcow.c
│ │ ├── qcow2-cache.c
│ │ ├── qcow2-cluster.c
│ │ ├── qcow2-refcount.c
│ │ ├── qcow2-snapshot.c
│ │ ├── qcow2.c
│ │ ├── qcow2.h
│ │ ├── qed-check.c
│ │ ├── qed-cluster.c
│ │ ├── qed-gencb.c
│ │ ├── qed-l2-cache.c
│ │ ├── qed-table.c
│ │ ├── qed.c
│ │ ├── qed.h
│ │ ├── raw-posix-aio.h
│ │ ├── raw-posix.c
│ │ ├── raw-win32.c
│ │ ├── raw.c
│ │ ├── rbd.c
│ │ ├── s2e.c
│ │ ├── sheepdog.c
│ │ ├── stream.c
│ │ ├── vdi.c
│ │ ├── vmdk.c
│ │ ├── vpc.c
│ │ └── vvfat.c
│ ├── block-migration.c
│ ├── block-migration.h
│ ├── block.c
│ ├── block.h
│ ├── block_int.h
│ ├── blockdev.c
│ ├── blockdev.h
│ ├── bsd-user/
│ │ ├── bsd-mman.h
│ │ ├── bsdload.c
│ │ ├── elfload.c
│ │ ├── errno_defs.h
│ │ ├── freebsd/
│ │ │ ├── strace.list
│ │ │ └── syscall_nr.h
│ │ ├── i386/
│ │ │ ├── syscall.h
│ │ │ └── target_signal.h
│ │ ├── main.c
│ │ ├── mmap.c
│ │ ├── netbsd/
│ │ │ ├── strace.list
│ │ │ └── syscall_nr.h
│ │ ├── openbsd/
│ │ │ ├── strace.list
│ │ │ └── syscall_nr.h
│ │ ├── qemu-types.h
│ │ ├── qemu.h
│ │ ├── signal.c
│ │ ├── sparc/
│ │ │ ├── syscall.h
│ │ │ └── target_signal.h
│ │ ├── sparc64/
│ │ │ ├── syscall.h
│ │ │ └── target_signal.h
│ │ ├── strace.c
│ │ ├── syscall.c
│ │ ├── syscall_defs.h
│ │ ├── uaccess.c
│ │ └── x86_64/
│ │ ├── syscall.h
│ │ └── target_signal.h
│ ├── bswap.h
│ ├── bt-host.c
│ ├── bt-host.h
│ ├── bt-vhci.c
│ ├── buffered_file.c
│ ├── buffered_file.h
│ ├── cache-utils.c
│ ├── cache-utils.h
│ ├── cmd.c
│ ├── cmd.h
│ ├── compatfd.c
│ ├── compatfd.h
│ ├── compiler.h
│ ├── config.h
│ ├── configure
│ ├── console.c
│ ├── console.h
│ ├── coroutine-gthread.c
│ ├── coroutine-sigaltstack.c
│ ├── coroutine-ucontext.c
│ ├── coroutine-win32.c
│ ├── cpu-all.h
│ ├── cpu-common.h
│ ├── cpu-defs.h
│ ├── cpu-exec.c
│ ├── cpus.c
│ ├── cpus.h
│ ├── cris-dis.c
│ ├── cursor.c
│ ├── cursor_hidden.xpm
│ ├── cursor_left_ptr.xpm
│ ├── cutils.c
│ ├── darwin-user/
│ │ ├── commpage.c
│ │ ├── ioctls.h
│ │ ├── ioctls_types.h
│ │ ├── machload.c
│ │ ├── main.c
│ │ ├── mmap.c
│ │ ├── qemu.h
│ │ ├── signal.c
│ │ ├── syscall.c
│ │ └── syscalls.h
│ ├── def-helper.h
│ ├── default-configs/
│ │ ├── alpha-linux-user.mak
│ │ ├── alpha-softmmu.mak
│ │ ├── arm-linux-user.mak
│ │ ├── arm-s2e-softmmu.mak
│ │ ├── arm-softmmu.mak
│ │ ├── armeb-linux-user.mak
│ │ ├── cris-linux-user.mak
│ │ ├── cris-softmmu.mak
│ │ ├── i386-bsd-user.mak
│ │ ├── i386-darwin-user.mak
│ │ ├── i386-linux-user.mak
│ │ ├── i386-s2e-softmmu.mak
│ │ ├── i386-softmmu.mak
│ │ ├── lm32-softmmu.mak
│ │ ├── m68k-linux-user.mak
│ │ ├── m68k-softmmu.mak
│ │ ├── microblaze-linux-user.mak
│ │ ├── microblaze-softmmu.mak
│ │ ├── microblazeel-linux-user.mak
│ │ ├── microblazeel-softmmu.mak
│ │ ├── mips-linux-user.mak
│ │ ├── mips-softmmu.mak
│ │ ├── mips64-linux-user.mak
│ │ ├── mips64-softmmu.mak
│ │ ├── mips64el-linux-user.mak
│ │ ├── mips64el-softmmu.mak
│ │ ├── mipsel-linux-user.mak
│ │ ├── mipsel-softmmu.mak
│ │ ├── mipsn32-linux-user.mak
│ │ ├── mipsn32el-linux-user.mak
│ │ ├── pci.mak
│ │ ├── ppc-darwin-user.mak
│ │ ├── ppc-linux-user.mak
│ │ ├── ppc-softmmu.mak
│ │ ├── ppc64-linux-user.mak
│ │ ├── ppc64-softmmu.mak
│ │ ├── ppc64abi32-linux-user.mak
│ │ ├── ppcemb-softmmu.mak
│ │ ├── s390x-linux-user.mak
│ │ ├── s390x-softmmu.mak
│ │ ├── sh4-linux-user.mak
│ │ ├── sh4-softmmu.mak
│ │ ├── sh4eb-linux-user.mak
│ │ ├── sh4eb-softmmu.mak
│ │ ├── sparc-bsd-user.mak
│ │ ├── sparc-linux-user.mak
│ │ ├── sparc-softmmu.mak
│ │ ├── sparc32plus-linux-user.mak
│ │ ├── sparc64-bsd-user.mak
│ │ ├── sparc64-linux-user.mak
│ │ ├── sparc64-softmmu.mak
│ │ ├── unicore32-linux-user.mak
│ │ ├── x86_64-bsd-user.mak
│ │ ├── x86_64-linux-user.mak
│ │ ├── x86_64-s2e-softmmu.mak
│ │ ├── x86_64-softmmu.mak
│ │ ├── xtensa-softmmu.mak
│ │ └── xtensaeb-softmmu.mak
│ ├── device_tree.c
│ ├── device_tree.h
│ ├── dis-asm.h
│ ├── disas.c
│ ├── disas.h
│ ├── dma-helpers.c
│ ├── dma.h
│ ├── docs/
│ │ ├── blkverify.txt
│ │ ├── bootindex.txt
│ │ ├── ccid.txt
│ │ ├── ich9-ehci-uhci.cfg
│ │ ├── libcacard.txt
│ │ ├── live-block-ops.txt
│ │ ├── memory.txt
│ │ ├── migration.txt
│ │ ├── qapi-code-gen.txt
│ │ ├── qdev-device-use.txt
│ │ ├── specs/
│ │ │ ├── acpi_pci_hotplug.txt
│ │ │ ├── ivshmem_device_spec.txt
│ │ │ ├── qcow2.txt
│ │ │ └── qed_spec.txt
│ │ ├── tracing.txt
│ │ ├── usb2.txt
│ │ ├── writing-qmp-commands.txt
│ │ └── xen-save-devices-state.txt
│ ├── dyngen-exec.h
│ ├── elf.h
│ ├── envlist.c
│ ├── envlist.h
│ ├── error.c
│ ├── error.h
│ ├── error_int.h
│ ├── event_notifier.c
│ ├── event_notifier.h
│ ├── exec-all.h
│ ├── exec-memory.h
│ ├── exec-obsolete.h
│ ├── exec.c
│ ├── fpu/
│ │ ├── softfloat-macros.h
│ │ ├── softfloat-specialize.h
│ │ ├── softfloat.c
│ │ └── softfloat.h
│ ├── fsdev/
│ │ ├── file-op-9p.h
│ │ ├── qemu-fsdev-dummy.c
│ │ ├── qemu-fsdev.c
│ │ ├── qemu-fsdev.h
│ │ ├── virtfs-proxy-helper.c
│ │ ├── virtfs-proxy-helper.texi
│ │ ├── virtio-9p-marshal.c
│ │ └── virtio-9p-marshal.h
│ ├── gdb-xml/
│ │ ├── arm-core.xml
│ │ ├── arm-neon.xml
│ │ ├── arm-vfp.xml
│ │ ├── arm-vfp3.xml
│ │ ├── cf-core.xml
│ │ ├── cf-fp.xml
│ │ ├── power-altivec.xml
│ │ ├── power-core.xml
│ │ ├── power-fpu.xml
│ │ ├── power-spe.xml
│ │ └── power64-core.xml
│ ├── gdbstub.c
│ ├── gdbstub.h
│ ├── gen-icount.h
│ ├── hmp-commands.hx
│ ├── hmp.c
│ ├── hmp.h
│ ├── host-utils.c
│ ├── host-utils.h
│ ├── hppa-dis.c
│ ├── hppa.ld
│ ├── hw/
│ │ ├── 9p.h
│ │ ├── 9pfs/
│ │ │ ├── codir.c
│ │ │ ├── cofile.c
│ │ │ ├── cofs.c
│ │ │ ├── coxattr.c
│ │ │ ├── virtio-9p-coth.c
│ │ │ ├── virtio-9p-coth.h
│ │ │ ├── virtio-9p-device.c
│ │ │ ├── virtio-9p-handle.c
│ │ │ ├── virtio-9p-local.c
│ │ │ ├── virtio-9p-posix-acl.c
│ │ │ ├── virtio-9p-proxy.c
│ │ │ ├── virtio-9p-proxy.h
│ │ │ ├── virtio-9p-synth.c
│ │ │ ├── virtio-9p-synth.h
│ │ │ ├── virtio-9p-xattr-user.c
│ │ │ ├── virtio-9p-xattr.c
│ │ │ ├── virtio-9p-xattr.h
│ │ │ ├── virtio-9p.c
│ │ │ └── virtio-9p.h
│ │ ├── a15mpcore.c
│ │ ├── a9mpcore.c
│ │ ├── ac97.c
│ │ ├── acpi.c
│ │ ├── acpi.h
│ │ ├── acpi_piix4.c
│ │ ├── adb.c
│ │ ├── adb.h
│ │ ├── adlib.c
│ │ ├── ads7846.c
│ │ ├── alpha_dp264.c
│ │ ├── alpha_pci.c
│ │ ├── alpha_sys.h
│ │ ├── alpha_typhoon.c
│ │ ├── an5206.c
│ │ ├── apb_pci.c
│ │ ├── apb_pci.h
│ │ ├── apic.c
│ │ ├── apic.h
│ │ ├── apic_common.c
│ │ ├── apic_internal.h
│ │ ├── apm.c
│ │ ├── apm.h
│ │ ├── applesmc.c
│ │ ├── arm-misc.h
│ │ ├── arm11mpcore.c
│ │ ├── arm_boot.c
│ │ ├── arm_gic.c
│ │ ├── arm_l2x0.c
│ │ ├── arm_mptimer.c
│ │ ├── arm_pic.c
│ │ ├── arm_sysctl.c
│ │ ├── arm_timer.c
│ │ ├── armv7m.c
│ │ ├── armv7m_nvic.c
│ │ ├── audiodev.h
│ │ ├── axis_dev88.c
│ │ ├── baum.c
│ │ ├── baum.h
│ │ ├── bitbang_i2c.c
│ │ ├── bitbang_i2c.h
│ │ ├── blizzard.c
│ │ ├── blizzard_template.h
│ │ ├── boards.h
│ │ ├── bonito.c
│ │ ├── bt-hci-csr.c
│ │ ├── bt-hci.c
│ │ ├── bt-hid.c
│ │ ├── bt-l2cap.c
│ │ ├── bt-sdp.c
│ │ ├── bt.c
│ │ ├── bt.h
│ │ ├── cadence_gem.c
│ │ ├── cadence_ttc.c
│ │ ├── cadence_uart.c
│ │ ├── cbus.c
│ │ ├── ccid-card-emulated.c
│ │ ├── ccid-card-passthru.c
│ │ ├── ccid.h
│ │ ├── cdrom.c
│ │ ├── cirrus_vga.c
│ │ ├── cirrus_vga_rop.h
│ │ ├── cirrus_vga_rop2.h
│ │ ├── cirrus_vga_template.h
│ │ ├── collie.c
│ │ ├── cris-boot.c
│ │ ├── cris-boot.h
│ │ ├── cris_pic_cpu.c
│ │ ├── cs4231.c
│ │ ├── cs4231a.c
│ │ ├── cuda.c
│ │ ├── debugcon.c
│ │ ├── dec_pci.c
│ │ ├── dec_pci.h
│ │ ├── device-hotplug.c
│ │ ├── devices.h
│ │ ├── dma.c
│ │ ├── dp8393x.c
│ │ ├── ds1225y.c
│ │ ├── ds1338.c
│ │ ├── dummy_m68k.c
│ │ ├── e1000.c
│ │ ├── e1000_hw.h
│ │ ├── ecc.c
│ │ ├── eccmemctl.c
│ │ ├── eepro100.c
│ │ ├── eeprom93xx.c
│ │ ├── eeprom93xx.h
│ │ ├── elf_ops.h
│ │ ├── empty_slot.c
│ │ ├── empty_slot.h
│ │ ├── es1370.c
│ │ ├── escc.c
│ │ ├── escc.h
│ │ ├── esp.c
│ │ ├── esp.h
│ │ ├── etraxfs.h
│ │ ├── etraxfs_dma.c
│ │ ├── etraxfs_dma.h
│ │ ├── etraxfs_eth.c
│ │ ├── etraxfs_pic.c
│ │ ├── etraxfs_ser.c
│ │ ├── etraxfs_timer.c
│ │ ├── exynos4210.c
│ │ ├── exynos4210.h
│ │ ├── exynos4210_combiner.c
│ │ ├── exynos4210_fimd.c
│ │ ├── exynos4210_gic.c
│ │ ├── exynos4210_mct.c
│ │ ├── exynos4210_pmu.c
│ │ ├── exynos4210_pwm.c
│ │ ├── exynos4210_uart.c
│ │ ├── exynos4_boards.c
│ │ ├── fakepci.c
│ │ ├── fakepci.h
│ │ ├── fdc.c
│ │ ├── fdc.h
│ │ ├── firmware_abi.h
│ │ ├── flash.h
│ │ ├── fmopl.c
│ │ ├── fmopl.h
│ │ ├── framebuffer.c
│ │ ├── framebuffer.h
│ │ ├── fw_cfg.c
│ │ ├── fw_cfg.h
│ │ ├── g364fb.c
│ │ ├── grackle_pci.c
│ │ ├── grlib.h
│ │ ├── grlib_apbuart.c
│ │ ├── grlib_gptimer.c
│ │ ├── grlib_irqmp.c
│ │ ├── gt64xxx.c
│ │ ├── gumstix.c
│ │ ├── gus.c
│ │ ├── gusemu.h
│ │ ├── gusemu_hal.c
│ │ ├── gusemu_mixer.c
│ │ ├── gustate.h
│ │ ├── hda-audio.c
│ │ ├── heathrow_pic.c
│ │ ├── hid.c
│ │ ├── hid.h
│ │ ├── highbank.c
│ │ ├── hpet.c
│ │ ├── hpet_emul.h
│ │ ├── hw.h
│ │ ├── i2c.c
│ │ ├── i2c.h
│ │ ├── i82374.c
│ │ ├── i82378.c
│ │ ├── i8254.c
│ │ ├── i8254.h
│ │ ├── i8254_common.c
│ │ ├── i8254_internal.h
│ │ ├── i8259.c
│ │ ├── i8259_common.c
│ │ ├── i8259_internal.h
│ │ ├── ide/
│ │ │ ├── ahci.c
│ │ │ ├── ahci.h
│ │ │ ├── atapi.c
│ │ │ ├── cmd646.c
│ │ │ ├── core.c
│ │ │ ├── ich.c
│ │ │ ├── internal.h
│ │ │ ├── isa.c
│ │ │ ├── macio.c
│ │ │ ├── microdrive.c
│ │ │ ├── mmio.c
│ │ │ ├── pci.c
│ │ │ ├── pci.h
│ │ │ ├── piix.c
│ │ │ ├── qdev.c
│ │ │ └── via.c
│ │ ├── ide.h
│ │ ├── integratorcp.c
│ │ ├── intel-hda-defs.h
│ │ ├── intel-hda.c
│ │ ├── intel-hda.h
│ │ ├── ioapic.c
│ │ ├── ioapic.h
│ │ ├── ioapic_common.c
│ │ ├── ioapic_internal.h
│ │ ├── ioh3420.c
│ │ ├── ioh3420.h
│ │ ├── irq.c
│ │ ├── irq.h
│ │ ├── isa-bus.c
│ │ ├── isa.h
│ │ ├── isa_mmio.c
│ │ ├── ivshmem.c
│ │ ├── jazz_led.c
│ │ ├── kvm/
│ │ │ ├── apic.c
│ │ │ ├── clock.c
│ │ │ ├── clock.h
│ │ │ ├── i8254.c
│ │ │ ├── i8259.c
│ │ │ └── ioapic.c
│ │ ├── kvmvapic.c
│ │ ├── lan9118.c
│ │ ├── lance.c
│ │ ├── leon3.c
│ │ ├── lm32.h
│ │ ├── lm32_boards.c
│ │ ├── lm32_hwsetup.h
│ │ ├── lm32_juart.c
│ │ ├── lm32_juart.h
│ │ ├── lm32_pic.c
│ │ ├── lm32_pic.h
│ │ ├── lm32_sys.c
│ │ ├── lm32_timer.c
│ │ ├── lm32_uart.c
│ │ ├── lm4549.c
│ │ ├── lm4549.h
│ │ ├── lm832x.c
│ │ ├── loader.c
│ │ ├── loader.h
│ │ ├── lsi53c895a.c
│ │ ├── m48t59.c
│ │ ├── mac_dbdma.c
│ │ ├── mac_dbdma.h
│ │ ├── mac_nvram.c
│ │ ├── macio.c
│ │ ├── mainstone.c
│ │ ├── marvell_88w8618_audio.c
│ │ ├── max111x.c
│ │ ├── max7310.c
│ │ ├── mc146818rtc.c
│ │ ├── mc146818rtc.h
│ │ ├── mc146818rtc_regs.h
│ │ ├── mcf.h
│ │ ├── mcf5206.c
│ │ ├── mcf5208.c
│ │ ├── mcf_fec.c
│ │ ├── mcf_intc.c
│ │ ├── mcf_uart.c
│ │ ├── microblaze_boot.c
│ │ ├── microblaze_boot.h
│ │ ├── microblaze_pic_cpu.c
│ │ ├── microblaze_pic_cpu.h
│ │ ├── milkymist-ac97.c
│ │ ├── milkymist-hpdmc.c
│ │ ├── milkymist-hw.h
│ │ ├── milkymist-memcard.c
│ │ ├── milkymist-minimac2.c
│ │ ├── milkymist-pfpu.c
│ │ ├── milkymist-softusb.c
│ │ ├── milkymist-sysctl.c
│ │ ├── milkymist-tmu2.c
│ │ ├── milkymist-uart.c
│ │ ├── milkymist-vgafb.c
│ │ ├── milkymist-vgafb_template.h
│ │ ├── milkymist.c
│ │ ├── mips-bios.h
│ │ ├── mips.h
│ │ ├── mips_addr.c
│ │ ├── mips_cpudevs.h
│ │ ├── mips_fulong2e.c
│ │ ├── mips_int.c
│ │ ├── mips_jazz.c
│ │ ├── mips_malta.c
│ │ ├── mips_mipssim.c
│ │ ├── mips_r4k.c
│ │ ├── mips_timer.c
│ │ ├── mipsnet.c
│ │ ├── mpc8544_guts.c
│ │ ├── msi.c
│ │ ├── msi.h
│ │ ├── msix.c
│ │ ├── msix.h
│ │ ├── msmouse.c
│ │ ├── msmouse.h
│ │ ├── mst_fpga.c
│ │ ├── multiboot.c
│ │ ├── multiboot.h
│ │ ├── musicpal.c
│ │ ├── nand.c
│ │ ├── ne2000-isa.c
│ │ ├── ne2000.c
│ │ ├── ne2000.h
│ │ ├── nseries.c
│ │ ├── nvram.h
│ │ ├── omap.h
│ │ ├── omap1.c
│ │ ├── omap2.c
│ │ ├── omap_clk.c
│ │ ├── omap_dma.c
│ │ ├── omap_dss.c
│ │ ├── omap_gpio.c
│ │ ├── omap_gpmc.c
│ │ ├── omap_gptimer.c
│ │ ├── omap_i2c.c
│ │ ├── omap_intc.c
│ │ ├── omap_l4.c
│ │ ├── omap_lcd_template.h
│ │ ├── omap_lcdc.c
│ │ ├── omap_mmc.c
│ │ ├── omap_sdrc.c
│ │ ├── omap_spi.c
│ │ ├── omap_sx1.c
│ │ ├── omap_synctimer.c
│ │ ├── omap_tap.c
│ │ ├── omap_uart.c
│ │ ├── onenand.c
│ │ ├── opencores_eth.c
│ │ ├── openpic.c
│ │ ├── openpic.h
│ │ ├── palm.c
│ │ ├── parallel.c
│ │ ├── pc.c
│ │ ├── pc.h
│ │ ├── pc_piix.c
│ │ ├── pc_sysfw.c
│ │ ├── pci-hotplug.c
│ │ ├── pci-stub.c
│ │ ├── pci.c
│ │ ├── pci.h
│ │ ├── pci_bridge.c
│ │ ├── pci_bridge.h
│ │ ├── pci_host.c
│ │ ├── pci_host.h
│ │ ├── pci_ids.h
│ │ ├── pci_internals.h
│ │ ├── pci_regs.h
│ │ ├── pcie.c
│ │ ├── pcie.h
│ │ ├── pcie_aer.c
│ │ ├── pcie_aer.h
│ │ ├── pcie_host.c
│ │ ├── pcie_host.h
│ │ ├── pcie_port.c
│ │ ├── pcie_port.h
│ │ ├── pcie_regs.h
│ │ ├── pckbd.c
│ │ ├── pcmcia.h
│ │ ├── pcnet-pci.c
│ │ ├── pcnet.c
│ │ ├── pcnet.h
│ │ ├── pcspk.c
│ │ ├── pcspk.h
│ │ ├── petalogix_ml605_mmu.c
│ │ ├── petalogix_s3adsp1800_mmu.c
│ │ ├── pflash_cfi01.c
│ │ ├── pflash_cfi02.c
│ │ ├── piix4.c
│ │ ├── piix_pci.c
│ │ ├── pixel_ops.h
│ │ ├── pl011.c
│ │ ├── pl022.c
│ │ ├── pl031.c
│ │ ├── pl041.c
│ │ ├── pl041.h
│ │ ├── pl041.hx
│ │ ├── pl050.c
│ │ ├── pl061.c
│ │ ├── pl080.c
│ │ ├── pl110.c
│ │ ├── pl110_template.h
│ │ ├── pl181.c
│ │ ├── pl190.c
│ │ ├── pm_smbus.c
│ │ ├── pm_smbus.h
│ │ ├── ppc-viosrp.h
│ │ ├── ppc.c
│ │ ├── ppc.h
│ │ ├── ppc405.h
│ │ ├── ppc405_boards.c
│ │ ├── ppc405_uc.c
│ │ ├── ppc440_bamboo.c
│ │ ├── ppc4xx.h
│ │ ├── ppc4xx_devs.c
│ │ ├── ppc4xx_pci.c
│ │ ├── ppc_booke.c
│ │ ├── ppc_mac.h
│ │ ├── ppc_newworld.c
│ │ ├── ppc_oldworld.c
│ │ ├── ppc_prep.c
│ │ ├── ppce500_mpc8544ds.c
│ │ ├── ppce500_pci.c
│ │ ├── ppce500_spin.c
│ │ ├── prep_pci.c
│ │ ├── primecell.h
│ │ ├── ps2.c
│ │ ├── ps2.h
│ │ ├── ptimer.c
│ │ ├── ptimer.h
│ │ ├── pxa.h
│ │ ├── pxa2xx.c
│ │ ├── pxa2xx_dma.c
│ │ ├── pxa2xx_gpio.c
│ │ ├── pxa2xx_keypad.c
│ │ ├── pxa2xx_lcd.c
│ │ ├── pxa2xx_mmci.c
│ │ ├── pxa2xx_pcmcia.c
│ │ ├── pxa2xx_pic.c
│ │ ├── pxa2xx_template.h
│ │ ├── pxa2xx_timer.c
│ │ ├── qdev-addr.c
│ │ ├── qdev-addr.h
│ │ ├── qdev-monitor.c
│ │ ├── qdev-properties.c
│ │ ├── qdev.c
│ │ ├── qdev.h
│ │ ├── qxl-logger.c
│ │ ├── qxl-render.c
│ │ ├── qxl.c
│ │ ├── qxl.h
│ │ ├── r2d.c
│ │ ├── rc4030.c
│ │ ├── realview.c
│ │ ├── realview_gic.c
│ │ ├── rtl8139.c
│ │ ├── s390-virtio-bus.c
│ │ ├── s390-virtio-bus.h
│ │ ├── s390-virtio.c
│ │ ├── sb16.c
│ │ ├── sbi.c
│ │ ├── scsi-bus.c
│ │ ├── scsi-defs.h
│ │ ├── scsi-disk.c
│ │ ├── scsi-generic.c
│ │ ├── scsi.h
│ │ ├── sd.c
│ │ ├── sd.h
│ │ ├── serial.c
│ │ ├── sga.c
│ │ ├── sh.h
│ │ ├── sh7750.c
│ │ ├── sh7750_regnames.c
│ │ ├── sh7750_regnames.h
│ │ ├── sh7750_regs.h
│ │ ├── sh_intc.c
│ │ ├── sh_intc.h
│ │ ├── sh_pci.c
│ │ ├── sh_serial.c
│ │ ├── sh_timer.c
│ │ ├── sharpsl.h
│ │ ├── shix.c
│ │ ├── slavio_intctl.c
│ │ ├── slavio_misc.c
│ │ ├── slavio_timer.c
│ │ ├── sm501.c
│ │ ├── sm501_template.h
│ │ ├── smbios.c
│ │ ├── smbios.h
│ │ ├── smbus.c
│ │ ├── smbus.h
│ │ ├── smbus_eeprom.c
│ │ ├── smc91c111.c
│ │ ├── soc_dma.c
│ │ ├── soc_dma.h
│ │ ├── spapr.c
│ │ ├── spapr.h
│ │ ├── spapr_hcall.c
│ │ ├── spapr_llan.c
│ │ ├── spapr_pci.c
│ │ ├── spapr_pci.h
│ │ ├── spapr_rtas.c
│ │ ├── spapr_vio.c
│ │ ├── spapr_vio.h
│ │ ├── spapr_vscsi.c
│ │ ├── spapr_vty.c
│ │ ├── sparc32_dma.c
│ │ ├── sparc32_dma.h
│ │ ├── spitz.c
│ │ ├── srp.h
│ │ ├── ssd0303.c
│ │ ├── ssd0323.c
│ │ ├── ssi-sd.c
│ │ ├── ssi.c
│ │ ├── ssi.h
│ │ ├── stellaris.c
│ │ ├── stellaris_enet.c
│ │ ├── stellaris_input.c
│ │ ├── strongarm.c
│ │ ├── strongarm.h
│ │ ├── sun4c_intctl.c
│ │ ├── sun4m.c
│ │ ├── sun4m.h
│ │ ├── sun4m_iommu.c
│ │ ├── sun4u.c
│ │ ├── sysbus.c
│ │ ├── sysbus.h
│ │ ├── tc58128.c
│ │ ├── tc6393xb.c
│ │ ├── tc6393xb_template.h
│ │ ├── tcx.c
│ │ ├── tmp105.c
│ │ ├── tosa.c
│ │ ├── tsc2005.c
│ │ ├── tsc210x.c
│ │ ├── tusb6010.c
│ │ ├── twl92230.c
│ │ ├── unin_pci.c
│ │ ├── usb/
│ │ │ ├── bus.c
│ │ │ ├── core.c
│ │ │ ├── desc.c
│ │ │ ├── desc.h
│ │ │ ├── dev-audio.c
│ │ │ ├── dev-bluetooth.c
│ │ │ ├── dev-hid.c
│ │ │ ├── dev-hub.c
│ │ │ ├── dev-network.c
│ │ │ ├── dev-serial.c
│ │ │ ├── dev-smartcard-reader.c
│ │ │ ├── dev-storage.c
│ │ │ ├── dev-wacom.c
│ │ │ ├── hcd-ehci.c
│ │ │ ├── hcd-musb.c
│ │ │ ├── hcd-ohci.c
│ │ │ ├── hcd-uhci.c
│ │ │ ├── hcd-xhci.c
│ │ │ ├── host-bsd.c
│ │ │ ├── host-linux.c
│ │ │ ├── host-stub.c
│ │ │ ├── libhw.c
│ │ │ └── redirect.c
│ │ ├── usb.h
│ │ ├── versatile_pci.c
│ │ ├── versatilepb.c
│ │ ├── vexpress.c
│ │ ├── vga-isa-mm.c
│ │ ├── vga-isa.c
│ │ ├── vga-pci.c
│ │ ├── vga.c
│ │ ├── vga.h
│ │ ├── vga_int.h
│ │ ├── vga_template.h
│ │ ├── vhost.c
│ │ ├── vhost.h
│ │ ├── vhost_net.c
│ │ ├── vhost_net.h
│ │ ├── virtex_ml507.c
│ │ ├── virtio-balloon.c
│ │ ├── virtio-balloon.h
│ │ ├── virtio-blk.c
│ │ ├── virtio-blk.h
│ │ ├── virtio-console.c
│ │ ├── virtio-net.c
│ │ ├── virtio-net.h
│ │ ├── virtio-pci.c
│ │ ├── virtio-pci.h
│ │ ├── virtio-scsi.c
│ │ ├── virtio-scsi.h
│ │ ├── virtio-serial-bus.c
│ │ ├── virtio-serial.h
│ │ ├── virtio.c
│ │ ├── virtio.h
│ │ ├── vmmouse.c
│ │ ├── vmport.c
│ │ ├── vmware_vga.c
│ │ ├── vmware_vga.h
│ │ ├── vt82c686.c
│ │ ├── vt82c686.h
│ │ ├── watchdog.c
│ │ ├── watchdog.h
│ │ ├── wdt_i6300esb.c
│ │ ├── wdt_ib700.c
│ │ ├── wm8750.c
│ │ ├── xen.h
│ │ ├── xen_backend.c
│ │ ├── xen_backend.h
│ │ ├── xen_blkif.h
│ │ ├── xen_common.h
│ │ ├── xen_console.c
│ │ ├── xen_devconfig.c
│ │ ├── xen_disk.c
│ │ ├── xen_domainbuild.c
│ │ ├── xen_domainbuild.h
│ │ ├── xen_machine_pv.c
│ │ ├── xen_nic.c
│ │ ├── xen_platform.c
│ │ ├── xenfb.c
│ │ ├── xgmac.c
│ │ ├── xics.c
│ │ ├── xics.h
│ │ ├── xilinx.h
│ │ ├── xilinx_axidma.c
│ │ ├── xilinx_axidma.h
│ │ ├── xilinx_axienet.c
│ │ ├── xilinx_ethlite.c
│ │ ├── xilinx_intc.c
│ │ ├── xilinx_timer.c
│ │ ├── xilinx_uartlite.c
│ │ ├── xilinx_zynq.c
│ │ ├── xio3130_downstream.c
│ │ ├── xio3130_downstream.h
│ │ ├── xio3130_upstream.c
│ │ ├── xio3130_upstream.h
│ │ ├── xtensa_bootparam.h
│ │ ├── xtensa_lx60.c
│ │ ├── xtensa_pic.c
│ │ ├── xtensa_sim.c
│ │ ├── z2.c
│ │ ├── zaurus.c
│ │ └── zynq_slcr.c
│ ├── i386-dis.c
│ ├── i386.ld
│ ├── ia64-dis.c
│ ├── ia64.ld
│ ├── include/
│ │ └── qemu/
│ │ ├── cpu.h
│ │ ├── object.h
│ │ └── qom-qobject.h
│ ├── input.c
│ ├── int128.h
│ ├── iohandler.c
│ ├── ioport-user.c
│ ├── ioport.c
│ ├── ioport.h
│ ├── iorange.h
│ ├── iov.c
│ ├── iov.h
│ ├── json-lexer.c
│ ├── json-lexer.h
│ ├── json-parser.c
│ ├── json-parser.h
│ ├── json-streamer.c
│ ├── json-streamer.h
│ ├── kvm-all.c
│ ├── kvm-stub.c
│ ├── kvm.h
│ ├── libcacard/
│ │ ├── Makefile
│ │ ├── cac.c
│ │ ├── cac.h
│ │ ├── card_7816.c
│ │ ├── card_7816.h
│ │ ├── card_7816t.h
│ │ ├── event.c
│ │ ├── eventt.h
│ │ ├── libcacard.pc.in
│ │ ├── link_test.c
│ │ ├── vcard.c
│ │ ├── vcard.h
│ │ ├── vcard_emul.h
│ │ ├── vcard_emul_nss.c
│ │ ├── vcard_emul_type.c
│ │ ├── vcard_emul_type.h
│ │ ├── vcardt.h
│ │ ├── vevent.h
│ │ ├── vreader.c
│ │ ├── vreader.h
│ │ ├── vreadert.h
│ │ ├── vscard_common.h
│ │ └── vscclient.c
│ ├── libfdt_env.h
│ ├── linux-aio.c
│ ├── linux-headers/
│ │ ├── COPYING
│ │ ├── README
│ │ ├── asm-powerpc/
│ │ │ ├── kvm.h
│ │ │ └── kvm_para.h
│ │ ├── asm-s390/
│ │ │ ├── kvm.h
│ │ │ └── kvm_para.h
│ │ ├── asm-x86/
│ │ │ ├── hyperv.h
│ │ │ ├── kvm.h
│ │ │ └── kvm_para.h
│ │ └── linux/
│ │ ├── kvm.h
│ │ ├── kvm_para.h
│ │ ├── vhost.h
│ │ ├── virtio_config.h
│ │ └── virtio_ring.h
│ ├── linux-user/
│ │ ├── alpha/
│ │ │ ├── syscall.h
│ │ │ ├── syscall_nr.h
│ │ │ ├── target_signal.h
│ │ │ └── termbits.h
│ │ ├── arm/
│ │ │ ├── nwfpe/
│ │ │ │ ├── double_cpdo.c
│ │ │ │ ├── extended_cpdo.c
│ │ │ │ ├── fpa11.c
│ │ │ │ ├── fpa11.h
│ │ │ │ ├── fpa11.inl
│ │ │ │ ├── fpa11_cpdo.c
│ │ │ │ ├── fpa11_cpdt.c
│ │ │ │ ├── fpa11_cprt.c
│ │ │ │ ├── fpopcode.c
│ │ │ │ ├── fpopcode.h
│ │ │ │ ├── fpsr.h
│ │ │ │ └── single_cpdo.c
│ │ │ ├── syscall.h
│ │ │ ├── syscall_nr.h
│ │ │ ├── target_signal.h
│ │ │ └── termbits.h
│ │ ├── cpu-uname.c
│ │ ├── cpu-uname.h
│ │ ├── cris/
│ │ │ ├── syscall.h
│ │ │ ├── syscall_nr.h
│ │ │ ├── target_signal.h
│ │ │ └── termbits.h
│ │ ├── elfload.c
│ │ ├── errno_defs.h
│ │ ├── flat.h
│ │ ├── flatload.c
│ │ ├── i386/
│ │ │ ├── syscall.h
│ │ │ ├── syscall_nr.h
│ │ │ ├── target_signal.h
│ │ │ └── termbits.h
│ │ ├── ioctls.h
│ │ ├── linux_loop.h
│ │ ├── linuxload.c
│ │ ├── m68k/
│ │ │ ├── syscall.h
│ │ │ ├── syscall_nr.h
│ │ │ ├── target_signal.h
│ │ │ └── termbits.h
│ │ ├── m68k-sim.c
│ │ ├── main.c
│ │ ├── microblaze/
│ │ │ ├── syscall.h
│ │ │ ├── syscall_nr.h
│ │ │ ├── target_signal.h
│ │ │ └── termbits.h
│ │ ├── mips/
│ │ │ ├── syscall.h
│ │ │ ├── syscall_nr.h
│ │ │ ├── target_signal.h
│ │ │ └── termbits.h
│ │ ├── mips64/
│ │ │ ├── syscall.h
│ │ │ ├── syscall_nr.h
│ │ │ ├── target_signal.h
│ │ │ └── termbits.h
│ │ ├── mipsn32/
│ │ │ ├── syscall.h
│ │ │ ├── syscall_nr.h
│ │ │ ├── target_signal.h
│ │ │ └── termbits.h
│ │ ├── mmap.c
│ │ ├── ppc/
│ │ │ ├── syscall.h
│ │ │ ├── syscall_nr.h
│ │ │ ├── target_signal.h
│ │ │ └── termbits.h
│ │ ├── qemu-types.h
│ │ ├── qemu.h
│ │ ├── s390x/
│ │ │ ├── syscall.h
│ │ │ ├── syscall_nr.h
│ │ │ ├── target_signal.h
│ │ │ └── termbits.h
│ │ ├── sh4/
│ │ │ ├── syscall.h
│ │ │ ├── syscall_nr.h
│ │ │ ├── target_signal.h
│ │ │ └── termbits.h
│ │ ├── signal.c
│ │ ├── socket.h
│ │ ├── sparc/
│ │ │ ├── syscall.h
│ │ │ ├── syscall_nr.h
│ │ │ ├── target_signal.h
│ │ │ └── termbits.h
│ │ ├── sparc64/
│ │ │ ├── syscall.h
│ │ │ ├── syscall_nr.h
│ │ │ ├── target_signal.h
│ │ │ └── termbits.h
│ │ ├── strace.c
│ │ ├── strace.list
│ │ ├── syscall.c
│ │ ├── syscall_defs.h
│ │ ├── syscall_types.h
│ │ ├── target_flat.h
│ │ ├── uaccess.c
│ │ ├── unicore32/
│ │ │ ├── syscall.h
│ │ │ ├── syscall_nr.h
│ │ │ ├── target_signal.h
│ │ │ └── termbits.h
│ │ ├── vm86.c
│ │ └── x86_64/
│ │ ├── syscall.h
│ │ ├── syscall_nr.h
│ │ ├── target_signal.h
│ │ └── termbits.h
│ ├── llvm-lib.h
│ ├── lm32-dis.c
│ ├── m68k-dis.c
│ ├── m68k-semi.c
│ ├── m68k.ld
│ ├── main-loop.c
│ ├── main-loop.h
│ ├── memory.c
│ ├── memory.h
│ ├── microblaze-dis.c
│ ├── migration-exec.c
│ ├── migration-fd.c
│ ├── migration-tcp.c
│ ├── migration-unix.c
│ ├── migration.c
│ ├── migration.h
│ ├── mips-dis.c
│ ├── mips.ld
│ ├── module.c
│ ├── module.h
│ ├── monitor.c
│ ├── monitor.h
│ ├── nbd.c
│ ├── nbd.h
│ ├── net/
│ │ ├── checksum.c
│ │ ├── checksum.h
│ │ ├── dump.c
│ │ ├── dump.h
│ │ ├── queue.c
│ │ ├── queue.h
│ │ ├── slirp.c
│ │ ├── slirp.h
│ │ ├── socket.c
│ │ ├── socket.h
│ │ ├── tap-aix.c
│ │ ├── tap-bsd.c
│ │ ├── tap-haiku.c
│ │ ├── tap-linux.c
│ │ ├── tap-linux.h
│ │ ├── tap-solaris.c
│ │ ├── tap-win32.c
│ │ ├── tap.c
│ │ ├── tap.h
│ │ ├── util.c
│ │ ├── util.h
│ │ ├── vde.c
│ │ └── vde.h
│ ├── net.c
│ ├── net.h
│ ├── notify.c
│ ├── notify.h
│ ├── os-posix.c
│ ├── os-win32.c
│ ├── osdep.c
│ ├── osdep.h
│ ├── oslib-posix.c
│ ├── oslib-win32.c
│ ├── path.c
│ ├── pc-bios/
│ │ ├── Makefile
│ │ ├── README
│ │ ├── bamboo.dtb
│ │ ├── bamboo.dts
│ │ ├── keymaps/
│ │ │ ├── ar
│ │ │ ├── bepo
│ │ │ ├── common
│ │ │ ├── da
│ │ │ ├── de
│ │ │ ├── de-ch
│ │ │ ├── en-gb
│ │ │ ├── en-us
│ │ │ ├── es
│ │ │ ├── et
│ │ │ ├── fi
│ │ │ ├── fo
│ │ │ ├── fr
│ │ │ ├── fr-be
│ │ │ ├── fr-ca
│ │ │ ├── fr-ch
│ │ │ ├── hr
│ │ │ ├── hu
│ │ │ ├── is
│ │ │ ├── it
│ │ │ ├── ja
│ │ │ ├── lt
│ │ │ ├── lv
│ │ │ ├── mk
│ │ │ ├── modifiers
│ │ │ ├── nl
│ │ │ ├── nl-be
│ │ │ ├── no
│ │ │ ├── pl
│ │ │ ├── pt
│ │ │ ├── pt-br
│ │ │ ├── ru
│ │ │ ├── sl
│ │ │ ├── sv
│ │ │ ├── th
│ │ │ └── tr
│ │ ├── mpc8544ds.dtb
│ │ ├── mpc8544ds.dts
│ │ ├── ohw.diff
│ │ ├── openbios-ppc
│ │ ├── openbios-sparc32
│ │ ├── openbios-sparc64
│ │ ├── optionrom/
│ │ │ ├── Makefile
│ │ │ ├── kvmvapic.S
│ │ │ ├── linuxboot.S
│ │ │ ├── multiboot.S
│ │ │ └── optionrom.h
│ │ ├── palcode-clipper
│ │ ├── petalogix-ml605.dtb
│ │ ├── petalogix-s3adsp1800.dtb
│ │ ├── pxe-e1000.rom
│ │ ├── pxe-eepro100.rom
│ │ ├── pxe-ne2k_pci.rom
│ │ ├── pxe-pcnet.rom
│ │ ├── pxe-rtl8139.rom
│ │ ├── pxe-virtio.rom
│ │ ├── s390-zipl.rom
│ │ └── spapr-rtas/
│ │ ├── Makefile
│ │ └── spapr-rtas.S
│ ├── pci-ids.txt
│ ├── pflib.c
│ ├── pflib.h
│ ├── poison.h
│ ├── posix-aio-compat.c
│ ├── ppc-dis.c
│ ├── ppc.ld
│ ├── ppc64.ld
│ ├── qapi/
│ │ ├── qapi-dealloc-visitor.c
│ │ ├── qapi-dealloc-visitor.h
│ │ ├── qapi-types-core.h
│ │ ├── qapi-visit-core.c
│ │ ├── qapi-visit-core.h
│ │ ├── qapi-visit-impl.h
│ │ ├── qmp-core.h
│ │ ├── qmp-dispatch.c
│ │ ├── qmp-input-visitor.c
│ │ ├── qmp-input-visitor.h
│ │ ├── qmp-output-visitor.c
│ │ ├── qmp-output-visitor.h
│ │ ├── qmp-registry.c
│ │ ├── string-input-visitor.c
│ │ ├── string-input-visitor.h
│ │ ├── string-output-visitor.c
│ │ └── string-output-visitor.h
│ ├── qapi-schema-guest.json
│ ├── qapi-schema-test.json
│ ├── qapi-schema.json
│ ├── qbool.c
│ ├── qbool.h
│ ├── qdict-test-data.txt
│ ├── qdict.c
│ ├── qdict.h
│ ├── qemu-aio.h
│ ├── qemu-barrier.h
│ ├── qemu-bridge-helper.c
│ ├── qemu-char.c
│ ├── qemu-char.h
│ ├── qemu-common.h
│ ├── qemu-config.c
│ ├── qemu-config.h
│ ├── qemu-coroutine-int.h
│ ├── qemu-coroutine-io.c
│ ├── qemu-coroutine-lock.c
│ ├── qemu-coroutine-sleep.c
│ ├── qemu-coroutine.c
│ ├── qemu-coroutine.h
│ ├── qemu-doc.texi
│ ├── qemu-error.c
│ ├── qemu-error.h
│ ├── qemu-file.h
│ ├── qemu-ga.c
│ ├── qemu-img-cmds.hx
│ ├── qemu-img.c
│ ├── qemu-img.texi
│ ├── qemu-io.c
│ ├── qemu-lock.h
│ ├── qemu-log.h
│ ├── qemu-nbd.c
│ ├── qemu-nbd.texi
│ ├── qemu-objects.h
│ ├── qemu-option.c
│ ├── qemu-option.h
│ ├── qemu-options-wrapper.h
│ ├── qemu-options.h
│ ├── qemu-options.hx
│ ├── qemu-os-posix.h
│ ├── qemu-os-win32.h
│ ├── qemu-progress.c
│ ├── qemu-queue.h
│ ├── qemu-sockets.c
│ ├── qemu-tech.texi
│ ├── qemu-thread-posix.c
│ ├── qemu-thread-posix.h
│ ├── qemu-thread-win32.c
│ ├── qemu-thread-win32.h
│ ├── qemu-thread.h
│ ├── qemu-timer-common.c
│ ├── qemu-timer.c
│ ├── qemu-timer.h
│ ├── qemu-tls.h
│ ├── qemu-tool.c
│ ├── qemu-user.c
│ ├── qemu-x509.h
│ ├── qemu-xattr.h
│ ├── qemu.sasl
│ ├── qemu_socket.h
│ ├── qerror.c
│ ├── qerror.h
│ ├── qfloat.c
│ ├── qfloat.h
│ ├── qga/
│ │ ├── channel-posix.c
│ │ ├── channel-win32.c
│ │ ├── channel.h
│ │ ├── commands-posix.c
│ │ ├── commands-win32.c
│ │ ├── commands.c
│ │ ├── guest-agent-command-state.c
│ │ ├── guest-agent-core.h
│ │ ├── service-win32.c
│ │ └── service-win32.h
│ ├── qint.c
│ ├── qint.h
│ ├── qjson.c
│ ├── qjson.h
│ ├── qlist.c
│ ├── qlist.h
│ ├── qmp-commands.hx
│ ├── qmp.c
│ ├── qobject.h
│ ├── qom/
│ │ ├── Makefile
│ │ ├── container.c
│ │ ├── cpu.c
│ │ ├── object.c
│ │ └── qom-qobject.c
│ ├── qstring.c
│ ├── qstring.h
│ ├── qtest.c
│ ├── qtest.h
│ ├── range.h
│ ├── readline.c
│ ├── readline.h
│ ├── roms/
│ │ ├── Makefile
│ │ ├── config.seabios
│ │ ├── configure-seabios.sh
│ │ └── s2ebios/
│ │ ├── Makefile
│ │ ├── init.asm
│ │ ├── s2e-bios-low.asm
│ │ ├── s2e-bios-up.asm
│ │ ├── s2e-inst.asm
│ │ ├── s2e-test-ndis.asm
│ │ ├── s2e-test-statemanager.asm
│ │ └── s2e-test.asm
│ ├── rules.mak
│ ├── s2e/
│ │ ├── ConfigFile.cpp
│ │ ├── ConfigFile.h
│ │ ├── ExprInterface.cpp
│ │ ├── ExprInterface.h
│ │ ├── MMUFunctionHandlers.cpp
│ │ ├── MemoryCache.h
│ │ ├── Plugin.cpp
│ │ ├── Plugin.h
│ │ ├── Plugins/
│ │ │ ├── Annotation.cpp
│ │ │ ├── Annotation.h
│ │ │ ├── ArmFunctionMonitor.cpp
│ │ │ ├── ArmFunctionMonitor.h
│ │ │ ├── BaseInstructions.cpp
│ │ │ ├── BaseInstructions.h
│ │ │ ├── CacheSim.cpp
│ │ │ ├── CacheSim.h
│ │ │ ├── CodeSelector.cpp
│ │ │ ├── CodeSelector.h
│ │ │ ├── ConsistencyModels.cpp
│ │ │ ├── ConsistencyModels.h
│ │ │ ├── CorePlugin.cpp
│ │ │ ├── CorePlugin.h
│ │ │ ├── DataStructureSpy.h
│ │ │ ├── Debugger.cpp
│ │ │ ├── Debugger.h
│ │ │ ├── EdgeKiller.cpp
│ │ │ ├── EdgeKiller.h
│ │ │ ├── Example.cpp
│ │ │ ├── Example.h
│ │ │ ├── ExecutableImage.h
│ │ │ ├── ExecutionStatisticsCollector.cpp
│ │ │ ├── ExecutionStatisticsCollector.h
│ │ │ ├── ExecutionTracers/
│ │ │ │ ├── EventTracer.cpp
│ │ │ │ ├── EventTracer.h
│ │ │ │ ├── ExceptionTracer.cpp
│ │ │ │ ├── ExceptionTracer.h
│ │ │ │ ├── ExecutionTracer.cpp
│ │ │ │ ├── ExecutionTracer.h
│ │ │ │ ├── InstructionCounter.cpp
│ │ │ │ ├── InstructionCounter.h
│ │ │ │ ├── MemoryTracer.cpp
│ │ │ │ ├── MemoryTracer.h
│ │ │ │ ├── ModuleTracer.cpp
│ │ │ │ ├── ModuleTracer.h
│ │ │ │ ├── StateSwitchTracer.cpp
│ │ │ │ ├── StateSwitchTracer.h
│ │ │ │ ├── TestCaseGenerator.cpp
│ │ │ │ ├── TestCaseGenerator.h
│ │ │ │ ├── TraceEntries.h
│ │ │ │ ├── TranslationBlockTracer.cpp
│ │ │ │ └── TranslationBlockTracer.h
│ │ │ ├── FunctionMonitor.h
│ │ │ ├── HostFiles.cpp
│ │ │ ├── HostFiles.h
│ │ │ ├── InterruptInjector.cpp
│ │ │ ├── InterruptInjector.h
│ │ │ ├── LibraryCallMonitor.cpp
│ │ │ ├── LibraryCallMonitor.h
│ │ │ ├── MemoryChecker.cpp
│ │ │ ├── MemoryChecker.h
│ │ │ ├── ModuleDescriptor.h
│ │ │ ├── ModuleExecutionDetector.cpp
│ │ │ ├── ModuleExecutionDetector.h
│ │ │ ├── OSMonitor.h
│ │ │ ├── Opcodes.h
│ │ │ ├── RawMonitor.cpp
│ │ │ ├── RawMonitor.h
│ │ │ ├── Searchers/
│ │ │ │ ├── ConcolicDFSSearcher.cpp
│ │ │ │ ├── ConcolicDFSSearcher.h
│ │ │ │ ├── CooperativeSearcher.cpp
│ │ │ │ ├── CooperativeSearcher.h
│ │ │ │ ├── MaxTbSearcher.cpp
│ │ │ │ └── MaxTbSearcher.h
│ │ │ ├── StackChecker.cpp
│ │ │ ├── StackChecker.h
│ │ │ ├── StackMonitor.cpp
│ │ │ ├── StackMonitor.h
│ │ │ ├── StateManager.cpp
│ │ │ ├── StateManager.h
│ │ │ ├── SymbolicHardware.cpp
│ │ │ ├── SymbolicHardware.h
│ │ │ ├── ThreadDescriptor.h
│ │ │ ├── WindowsApi/
│ │ │ │ ├── Api.cpp
│ │ │ │ ├── Api.h
│ │ │ │ ├── HalHandlers.cpp
│ │ │ │ ├── HalHandlers.h
│ │ │ │ ├── Ndis.h
│ │ │ │ ├── NdisHandlers.cpp
│ │ │ │ ├── NdisHandlers.h
│ │ │ │ ├── NdisHandlersUtils.cpp
│ │ │ │ ├── NdisMemoryCheck.cpp
│ │ │ │ ├── NdisProtocolHandlers.cpp
│ │ │ │ ├── Ntddk.h
│ │ │ │ ├── NtoskrnlHandlers.cpp
│ │ │ │ ├── NtoskrnlHandlers.h
│ │ │ │ ├── WindowsDriverExerciser.cpp
│ │ │ │ └── WindowsDriverExerciser.h
│ │ │ ├── WindowsInterceptor/
│ │ │ │ ├── BlueScreenInterceptor.cpp
│ │ │ │ ├── BlueScreenInterceptor.h
│ │ │ │ ├── KernelModeInterceptor.cpp
│ │ │ │ ├── KernelModeInterceptor.h
│ │ │ │ ├── UserModeInterceptor.cpp
│ │ │ │ ├── UserModeInterceptor.h
│ │ │ │ ├── WindowsCrashDumpGenerator.cpp
│ │ │ │ ├── WindowsCrashDumpGenerator.h
│ │ │ │ ├── WindowsImage.cpp
│ │ │ │ ├── WindowsImage.h
│ │ │ │ ├── WindowsMonitor.cpp
│ │ │ │ ├── WindowsMonitor.h
│ │ │ │ ├── WindowsSpy.cpp
│ │ │ │ └── WindowsSpy.h
│ │ │ ├── X86ExceptionInterceptor.cpp
│ │ │ ├── X86ExceptionInterceptor.h
│ │ │ ├── X86FunctionMonitor.cpp
│ │ │ └── X86FunctionMonitor.h
│ │ ├── S2E.cpp
│ │ ├── S2E.h
│ │ ├── S2EDeviceState.cpp
│ │ ├── S2EDeviceState.h
│ │ ├── S2EExecutionState.cpp
│ │ ├── S2EExecutionState.h
│ │ ├── S2EExecutor.cpp
│ │ ├── S2EExecutor.h
│ │ ├── S2ESJLJ.h
│ │ ├── S2EStatsTracker.cpp
│ │ ├── S2EStatsTracker.h
│ │ ├── SelectRemovalPass.cpp
│ │ ├── SelectRemovalPass.h
│ │ ├── Signals/
│ │ │ ├── Signals.h
│ │ │ ├── build.sh
│ │ │ ├── fsigc++.h
│ │ │ ├── functors.h
│ │ │ ├── sig-template.h
│ │ │ ├── signals.cpp
│ │ │ └── test.cpp
│ │ ├── Slab.cpp
│ │ ├── Slab.h
│ │ ├── Synchronization.cpp
│ │ ├── Synchronization.h
│ │ ├── Utils.h
│ │ ├── machine.h
│ │ ├── s2e_block.h
│ │ ├── s2e_config.h
│ │ ├── s2e_qemu.h
│ │ └── x64.asm
│ ├── s390-dis.c
│ ├── s390.ld
│ ├── savevm.c
│ ├── scripts/
│ │ ├── analyse-9p-simpletrace.py
│ │ ├── check-qerror.sh
│ │ ├── checkpatch.pl
│ │ ├── create_config
│ │ ├── feature_to_c.sh
│ │ ├── get_maintainer.pl
│ │ ├── gtester-cat
│ │ ├── hxtool
│ │ ├── kvm/
│ │ │ ├── kvm_stat
│ │ │ └── vmxcap
│ │ ├── make_device_config.sh
│ │ ├── ordereddict.py
│ │ ├── qapi-commands.py
│ │ ├── qapi-types.py
│ │ ├── qapi-visit.py
│ │ ├── qapi.py
│ │ ├── qemu-binfmt-conf.sh
│ │ ├── qemu-gdb.py
│ │ ├── qtest
│ │ ├── refresh-pxe-roms.sh
│ │ ├── signrom.sh
│ │ ├── simpletrace.py
│ │ ├── texi2pod.pl
│ │ ├── tracetool
│ │ └── update-linux-headers.sh
│ ├── sh4-dis.c
│ ├── slirp/
│ │ ├── COPYRIGHT
│ │ ├── arp_table.c
│ │ ├── bootp.c
│ │ ├── bootp.h
│ │ ├── cksum.c
│ │ ├── debug.h
│ │ ├── if.c
│ │ ├── if.h
│ │ ├── ip.h
│ │ ├── ip_icmp.c
│ │ ├── ip_icmp.h
│ │ ├── ip_input.c
│ │ ├── ip_output.c
│ │ ├── libslirp.h
│ │ ├── main.h
│ │ ├── mbuf.c
│ │ ├── mbuf.h
│ │ ├── misc.c
│ │ ├── misc.h
│ │ ├── sbuf.c
│ │ ├── sbuf.h
│ │ ├── slirp.c
│ │ ├── slirp.h
│ │ ├── slirp_config.h
│ │ ├── socket.c
│ │ ├── socket.h
│ │ ├── tcp.h
│ │ ├── tcp_input.c
│ │ ├── tcp_output.c
│ │ ├── tcp_subr.c
│ │ ├── tcp_timer.c
│ │ ├── tcp_timer.h
│ │ ├── tcp_var.h
│ │ ├── tcpip.h
│ │ ├── tftp.c
│ │ ├── tftp.h
│ │ ├── udp.c
│ │ └── udp.h
│ ├── softmmu-semi.h
│ ├── softmmu_defs.h
│ ├── softmmu_exec.h
│ ├── softmmu_header.h
│ ├── softmmu_template.h
│ ├── sparc-dis.c
│ ├── sparc.ld
│ ├── sparc64.ld
│ ├── spice-qemu-char.c
│ ├── sysconfigs/
│ │ └── target/
│ │ └── target-x86_64.conf
│ ├── sysemu.h
│ ├── target-alpha/
│ │ ├── STATUS
│ │ ├── cpu.h
│ │ ├── fpu_helper.c
│ │ ├── helper.c
│ │ ├── helper.h
│ │ ├── int_helper.c
│ │ ├── machine.c
│ │ ├── mem_helper.c
│ │ ├── sys_helper.c
│ │ └── translate.c
│ ├── target-arm/
│ │ ├── cpu-qom.h
│ │ ├── cpu.c
│ │ ├── cpu.h
│ │ ├── helper.c
│ │ ├── helper.h
│ │ ├── iwmmxt_helper.c
│ │ ├── machine.c
│ │ ├── neon_helper.c
│ │ ├── op_addsub.h
│ │ ├── op_helper.c
│ │ ├── target-defs.h
│ │ └── translate.c
│ ├── target-cris/
│ │ ├── cpu.h
│ │ ├── crisv10-decode.h
│ │ ├── crisv32-decode.h
│ │ ├── helper.c
│ │ ├── helper.h
│ │ ├── machine.c
│ │ ├── mmu.c
│ │ ├── mmu.h
│ │ ├── op_helper.c
│ │ ├── opcode-cris.h
│ │ ├── translate.c
│ │ └── translate_v10.c
│ ├── target-i386/
│ │ ├── TODO
│ │ ├── cpu.h
│ │ ├── cpuid.c
│ │ ├── helper.c
│ │ ├── helper.h
│ │ ├── helper_template.h
│ │ ├── hyperv.c
│ │ ├── hyperv.h
│ │ ├── kvm.c
│ │ ├── machine.c
│ │ ├── op_helper.c
│ │ ├── ops_sse.h
│ │ ├── ops_sse_header.h
│ │ ├── svm.h
│ │ └── translate.c
│ ├── target-lm32/
│ │ ├── README
│ │ ├── TODO
│ │ ├── cpu.h
│ │ ├── helper.c
│ │ ├── helper.h
│ │ ├── machine.c
│ │ ├── op_helper.c
│ │ └── translate.c
│ ├── target-m68k/
│ │ ├── cpu.h
│ │ ├── helper.c
│ │ ├── helpers.h
│ │ ├── m68k-qreg.h
│ │ ├── machine.c
│ │ ├── op_helper.c
│ │ ├── qregs.def
│ │ └── translate.c
│ ├── target-microblaze/
│ │ ├── cpu.h
│ │ ├── helper.c
│ │ ├── helper.h
│ │ ├── machine.c
│ │ ├── microblaze-decode.h
│ │ ├── mmu.c
│ │ ├── mmu.h
│ │ ├── op_helper.c
│ │ └── translate.c
│ ├── target-mips/
│ │ ├── TODO
│ │ ├── cpu.h
│ │ ├── helper.c
│ │ ├── helper.h
│ │ ├── machine.c
│ │ ├── mips-defs.h
│ │ ├── op_helper.c
│ │ ├── translate.c
│ │ └── translate_init.c
│ ├── target-ppc/
│ │ ├── STATUS
│ │ ├── cpu.h
│ │ ├── helper.c
│ │ ├── helper.h
│ │ ├── helper_regs.h
│ │ ├── kvm.c
│ │ ├── kvm_ppc.c
│ │ ├── kvm_ppc.h
│ │ ├── machine.c
│ │ ├── mfrom_table.c
│ │ ├── mfrom_table_gen.c
│ │ ├── op_helper.c
│ │ ├── translate.c
│ │ └── translate_init.c
│ ├── target-s390x/
│ │ ├── cpu-qom.h
│ │ ├── cpu.c
│ │ ├── cpu.h
│ │ ├── helper.c
│ │ ├── helper.h
│ │ ├── kvm.c
│ │ ├── machine.c
│ │ ├── op_helper.c
│ │ └── translate.c
│ ├── target-sh4/
│ │ ├── README.sh4
│ │ ├── cpu.h
│ │ ├── helper.c
│ │ ├── helper.h
│ │ ├── machine.c
│ │ ├── op_helper.c
│ │ └── translate.c
│ ├── target-sparc/
│ │ ├── TODO
│ │ ├── cc_helper.c
│ │ ├── cpu-qom.h
│ │ ├── cpu.c
│ │ ├── cpu.h
│ │ ├── fop_helper.c
│ │ ├── helper.c
│ │ ├── helper.h
│ │ ├── int32_helper.c
│ │ ├── int64_helper.c
│ │ ├── ldst_helper.c
│ │ ├── machine.c
│ │ ├── mmu_helper.c
│ │ ├── translate.c
│ │ ├── vis_helper.c
│ │ └── win_helper.c
│ ├── target-unicore32/
│ │ ├── cpu-qom.h
│ │ ├── cpu.c
│ │ ├── cpu.h
│ │ ├── helper.c
│ │ ├── helper.h
│ │ ├── op_helper.c
│ │ └── translate.c
│ ├── target-xtensa/
│ │ ├── core-dc232b/
│ │ │ ├── core-isa.h
│ │ │ └── gdb-config.c
│ │ ├── core-dc232b.c
│ │ ├── core-fsf/
│ │ │ └── core-isa.h
│ │ ├── core-fsf.c
│ │ ├── cpu.h
│ │ ├── helper.c
│ │ ├── helpers.h
│ │ ├── machine.c
│ │ ├── op_helper.c
│ │ ├── overlay_tool.h
│ │ └── translate.c
│ ├── targphys.h
│ ├── tcg/
│ │ ├── LICENSE
│ │ ├── README
│ │ ├── TODO
│ │ ├── arm/
│ │ │ ├── tcg-target.c
│ │ │ └── tcg-target.h
│ │ ├── hppa/
│ │ │ ├── tcg-target.c
│ │ │ └── tcg-target.h
│ │ ├── i386/
│ │ │ ├── tcg-target.c
│ │ │ └── tcg-target.h
│ │ ├── ia64/
│ │ │ ├── tcg-target.c
│ │ │ └── tcg-target.h
│ │ ├── mips/
│ │ │ ├── tcg-target.c
│ │ │ └── tcg-target.h
│ │ ├── optimize.c
│ │ ├── ppc/
│ │ │ ├── tcg-target.c
│ │ │ └── tcg-target.h
│ │ ├── ppc64/
│ │ │ ├── tcg-target.c
│ │ │ └── tcg-target.h
│ │ ├── s390/
│ │ │ ├── tcg-target.c
│ │ │ └── tcg-target.h
│ │ ├── sparc/
│ │ │ ├── tcg-target.c
│ │ │ └── tcg-target.h
│ │ ├── tcg-llvm.cpp
│ │ ├── tcg-llvm.h
│ │ ├── tcg-op.h
│ │ ├── tcg-opc.h
│ │ ├── tcg-runtime.h
│ │ ├── tcg.c
│ │ ├── tcg.h
│ │ └── tci/
│ │ ├── README
│ │ ├── tcg-target.c
│ │ └── tcg-target.h
│ ├── tcg-runtime.c
│ ├── tci-dis.c
│ ├── tci.c
│ ├── tests/
│ │ ├── Makefile
│ │ ├── check-block.sh
│ │ ├── check-qdict.c
│ │ ├── check-qfloat.c
│ │ ├── check-qint.c
│ │ ├── check-qjson.c
│ │ ├── check-qlist.c
│ │ ├── check-qstring.c
│ │ ├── libqtest.c
│ │ ├── libqtest.h
│ │ ├── qemu-iotests/
│ │ │ ├── .gitignore
│ │ │ ├── 001
│ │ │ ├── 001.out
│ │ │ ├── 002
│ │ │ ├── 002.out
│ │ │ ├── 003
│ │ │ ├── 003.out
│ │ │ ├── 004
│ │ │ ├── 004.out
│ │ │ ├── 005
│ │ │ ├── 005.out
│ │ │ ├── 006
│ │ │ ├── 006.out
│ │ │ ├── 007
│ │ │ ├── 007.out
│ │ │ ├── 008
│ │ │ ├── 008.out
│ │ │ ├── 009
│ │ │ ├── 009.out
│ │ │ ├── 010
│ │ │ ├── 010.out
│ │ │ ├── 011
│ │ │ ├── 011.out
│ │ │ ├── 012
│ │ │ ├── 012.out
│ │ │ ├── 013
│ │ │ ├── 013.out
│ │ │ ├── 014
│ │ │ ├── 014.out
│ │ │ ├── 015
│ │ │ ├── 015.out
│ │ │ ├── 016
│ │ │ ├── 016.out
│ │ │ ├── 017
│ │ │ ├── 017.out
│ │ │ ├── 018
│ │ │ ├── 018.out
│ │ │ ├── 019
│ │ │ ├── 019.out
│ │ │ ├── 020
│ │ │ ├── 020.out
│ │ │ ├── 021
│ │ │ ├── 021.out
│ │ │ ├── 022
│ │ │ ├── 022.out
│ │ │ ├── 023
│ │ │ ├── 023.out
│ │ │ ├── 024
│ │ │ ├── 024.out
│ │ │ ├── 025
│ │ │ ├── 025.out
│ │ │ ├── 026
│ │ │ ├── 026.out
│ │ │ ├── 027
│ │ │ ├── 027.out
│ │ │ ├── 028
│ │ │ ├── 028.out
│ │ │ ├── 029
│ │ │ ├── 029.out
│ │ │ ├── 030
│ │ │ ├── 030.out
│ │ │ ├── COPYING
│ │ │ ├── Makefile
│ │ │ ├── README
│ │ │ ├── check
│ │ │ ├── common
│ │ │ ├── common.config
│ │ │ ├── common.filter
│ │ │ ├── common.pattern
│ │ │ ├── common.rc
│ │ │ ├── group
│ │ │ └── iotests.py
│ │ ├── qemu-iotests-quick.sh
│ │ ├── rtc-test.c
│ │ ├── s2earm/
│ │ │ └── buildHello.sh
│ │ ├── tcg/
│ │ │ ├── Makefile
│ │ │ ├── alpha/
│ │ │ │ ├── Makefile
│ │ │ │ ├── crt.s
│ │ │ │ ├── hello-alpha.c
│ │ │ │ ├── test-cond.c
│ │ │ │ └── test-ovf.c
│ │ │ ├── cris/
│ │ │ │ ├── Makefile
│ │ │ │ ├── README
│ │ │ │ ├── check_abs.c
│ │ │ │ ├── check_addc.c
│ │ │ │ ├── check_addcm.c
│ │ │ │ ├── check_addi.s
│ │ │ │ ├── check_addiv32.s
│ │ │ │ ├── check_addm.s
│ │ │ │ ├── check_addo.c
│ │ │ │ ├── check_addoq.c
│ │ │ │ ├── check_addq.s
│ │ │ │ ├── check_addr.s
│ │ │ │ ├── check_addxc.s
│ │ │ │ ├── check_addxm.s
│ │ │ │ ├── check_addxr.s
│ │ │ │ ├── check_andc.s
│ │ │ │ ├── check_andm.s
│ │ │ │ ├── check_andq.s
│ │ │ │ ├── check_andr.s
│ │ │ │ ├── check_asr.s
│ │ │ │ ├── check_ba.s
│ │ │ │ ├── check_bas.s
│ │ │ │ ├── check_bcc.s
│ │ │ │ ├── check_bound.c
│ │ │ │ ├── check_boundc.s
│ │ │ │ ├── check_boundr.s
│ │ │ │ ├── check_btst.s
│ │ │ │ ├── check_clearfv32.s
│ │ │ │ ├── check_clrjmp1.s
│ │ │ │ ├── check_cmp-2.s
│ │ │ │ ├── check_cmpc.s
│ │ │ │ ├── check_cmpm.s
│ │ │ │ ├── check_cmpq.s
│ │ │ │ ├── check_cmpr.s
│ │ │ │ ├── check_cmpxc.s
│ │ │ │ ├── check_cmpxm.s
│ │ │ │ ├── check_dstep.s
│ │ │ │ ├── check_ftag.c
│ │ │ │ ├── check_gcctorture_pr28634-1.c
│ │ │ │ ├── check_gcctorture_pr28634.c
│ │ │ │ ├── check_glibc_kernelversion.c
│ │ │ │ ├── check_hello.c
│ │ │ │ ├── check_int64.c
│ │ │ │ ├── check_jsr.s
│ │ │ │ ├── check_lapc.s
│ │ │ │ ├── check_lsl.s
│ │ │ │ ├── check_lsr.s
│ │ │ │ ├── check_lz.c
│ │ │ │ ├── check_mapbrk.c
│ │ │ │ ├── check_mcp.s
│ │ │ │ ├── check_mmap1.c
│ │ │ │ ├── check_mmap2.c
│ │ │ │ ├── check_mmap3.c
│ │ │ │ ├── check_movdelsr1.s
│ │ │ │ ├── check_movecr.s
│ │ │ │ ├── check_movei.s
│ │ │ │ ├── check_movemr.s
│ │ │ │ ├── check_movemrv32.s
│ │ │ │ ├── check_moveq.c
│ │ │ │ ├── check_mover.s
│ │ │ │ ├── check_moverm.s
│ │ │ │ ├── check_movmp.s
│ │ │ │ ├── check_movpmv32.s
│ │ │ │ ├── check_movpr.s
│ │ │ │ ├── check_movprv32.s
│ │ │ │ ├── check_movscr.s
│ │ │ │ ├── check_movsm.s
│ │ │ │ ├── check_movsr.s
│ │ │ │ ├── check_movucr.s
│ │ │ │ ├── check_movum.s
│ │ │ │ ├── check_movur.s
│ │ │ │ ├── check_mulv32.s
│ │ │ │ ├── check_mulx.s
│ │ │ │ ├── check_neg.s
│ │ │ │ ├── check_not.s
│ │ │ │ ├── check_openpf1.c
│ │ │ │ ├── check_openpf2.c
│ │ │ │ ├── check_openpf3.c
│ │ │ │ ├── check_openpf4.c
│ │ │ │ ├── check_openpf5.c
│ │ │ │ ├── check_orc.s
│ │ │ │ ├── check_orm.s
│ │ │ │ ├── check_orq.s
│ │ │ │ ├── check_orr.s
│ │ │ │ ├── check_ret.s
│ │ │ │ ├── check_scc.s
│ │ │ │ ├── check_settls1.c
│ │ │ │ ├── check_sigalrm.c
│ │ │ │ ├── check_stat1.c
│ │ │ │ ├── check_stat2.c
│ │ │ │ ├── check_stat3.c
│ │ │ │ ├── check_stat4.c
│ │ │ │ ├── check_subc.s
│ │ │ │ ├── check_subm.s
│ │ │ │ ├── check_subq.s
│ │ │ │ ├── check_subr.s
│ │ │ │ ├── check_swap.c
│ │ │ │ ├── check_time1.c
│ │ │ │ ├── check_time2.c
│ │ │ │ ├── check_xarith.s
│ │ │ │ ├── crisutils.h
│ │ │ │ ├── crt.s
│ │ │ │ ├── sys.c
│ │ │ │ ├── sys.h
│ │ │ │ └── testutils.inc
│ │ │ ├── hello-arm.c
│ │ │ ├── hello-i386.c
│ │ │ ├── hello-mips.c
│ │ │ ├── linux-test.c
│ │ │ ├── lm32/
│ │ │ │ ├── Makefile
│ │ │ │ ├── crt.S
│ │ │ │ ├── linker.ld
│ │ │ │ ├── macros.inc
│ │ │ │ ├── test_add.S
│ │ │ │ ├── test_addi.S
│ │ │ │ ├── test_and.S
│ │ │ │ ├── test_andhi.S
│ │ │ │ ├── test_andi.S
│ │ │ │ ├── test_b.S
│ │ │ │ ├── test_be.S
│ │ │ │ ├── test_bg.S
│ │ │ │ ├── test_bge.S
│ │ │ │ ├── test_bgeu.S
│ │ │ │ ├── test_bgu.S
│ │ │ │ ├── test_bi.S
│ │ │ │ ├── test_bne.S
│ │ │ │ ├── test_break.S
│ │ │ │ ├── test_bret.S
│ │ │ │ ├── test_call.S
│ │ │ │ ├── test_calli.S
│ │ │ │ ├── test_cmpe.S
│ │ │ │ ├── test_cmpei.S
│ │ │ │ ├── test_cmpg.S
│ │ │ │ ├── test_cmpge.S
│ │ │ │ ├── test_cmpgei.S
│ │ │ │ ├── test_cmpgeu.S
│ │ │ │ ├── test_cmpgeui.S
│ │ │ │ ├── test_cmpgi.S
│ │ │ │ ├── test_cmpgu.S
│ │ │ │ ├── test_cmpgui.S
│ │ │ │ ├── test_cmpne.S
│ │ │ │ ├── test_cmpnei.S
│ │ │ │ ├── test_divu.S
│ │ │ │ ├── test_eret.S
│ │ │ │ ├── test_lb.S
│ │ │ │ ├── test_lbu.S
│ │ │ │ ├── test_lh.S
│ │ │ │ ├── test_lhu.S
│ │ │ │ ├── test_lw.S
│ │ │ │ ├── test_modu.S
│ │ │ │ ├── test_mul.S
│ │ │ │ ├── test_muli.S
│ │ │ │ ├── test_nor.S
│ │ │ │ ├── test_nori.S
│ │ │ │ ├── test_or.S
│ │ │ │ ├── test_orhi.S
│ │ │ │ ├── test_ori.S
│ │ │ │ ├── test_ret.S
│ │ │ │ ├── test_sb.S
│ │ │ │ ├── test_scall.S
│ │ │ │ ├── test_sextb.S
│ │ │ │ ├── test_sexth.S
│ │ │ │ ├── test_sh.S
│ │ │ │ ├── test_sl.S
│ │ │ │ ├── test_sli.S
│ │ │ │ ├── test_sr.S
│ │ │ │ ├── test_sri.S
│ │ │ │ ├── test_sru.S
│ │ │ │ ├── test_srui.S
│ │ │ │ ├── test_sub.S
│ │ │ │ ├── test_sw.S
│ │ │ │ ├── test_xnor.S
│ │ │ │ ├── test_xnori.S
│ │ │ │ ├── test_xor.S
│ │ │ │ └── test_xori.S
│ │ │ ├── pi_10.com
│ │ │ ├── runcom.c
│ │ │ ├── sha1.c
│ │ │ ├── test-arm-iwmmxt.s
│ │ │ ├── test-i386-code16.S
│ │ │ ├── test-i386-muldiv.h
│ │ │ ├── test-i386-shift.h
│ │ │ ├── test-i386-ssse3.c
│ │ │ ├── test-i386-vm86.S
│ │ │ ├── test-i386.c
│ │ │ ├── test-i386.h
│ │ │ ├── test-mmap.c
│ │ │ ├── test_path.c
│ │ │ ├── testthread.c
│ │ │ └── xtensa/
│ │ │ ├── Makefile
│ │ │ ├── crt.S
│ │ │ ├── linker.ld
│ │ │ ├── macros.inc
│ │ │ ├── test_b.S
│ │ │ ├── test_bi.S
│ │ │ ├── test_boolean.S
│ │ │ ├── test_break.S
│ │ │ ├── test_bz.S
│ │ │ ├── test_clamps.S
│ │ │ ├── test_fail.S
│ │ │ ├── test_interrupt.S
│ │ │ ├── test_loop.S
│ │ │ ├── test_mac16.S
│ │ │ ├── test_max.S
│ │ │ ├── test_min.S
│ │ │ ├── test_mmu.S
│ │ │ ├── test_mul16.S
│ │ │ ├── test_mul32.S
│ │ │ ├── test_nsa.S
│ │ │ ├── test_pipeline.S
│ │ │ ├── test_quo.S
│ │ │ ├── test_rem.S
│ │ │ ├── test_rst0.S
│ │ │ ├── test_sar.S
│ │ │ ├── test_sext.S
│ │ │ ├── test_shift.S
│ │ │ ├── test_timer.S
│ │ │ ├── test_windowed.S
│ │ │ └── vectors.S
│ │ ├── test-coroutine.c
│ │ ├── test-qmp-commands.c
│ │ ├── test-qmp-input-strict.c
│ │ ├── test-qmp-input-visitor.c
│ │ ├── test-qmp-output-visitor.c
│ │ ├── test-string-input-visitor.c
│ │ └── test-string-output-visitor.c
│ ├── thunk.c
│ ├── thunk.h
│ ├── trace/
│ │ ├── control.c
│ │ ├── control.h
│ │ ├── default.c
│ │ ├── simple.c
│ │ ├── simple.h
│ │ ├── stderr.c
│ │ └── stderr.h
│ ├── trace-events
│ ├── translate-all.c
│ ├── uboot_image.h
│ ├── ui/
│ │ ├── cocoa.m
│ │ ├── curses.c
│ │ ├── curses_keys.h
│ │ ├── d3des.c
│ │ ├── d3des.h
│ │ ├── keymaps.c
│ │ ├── keymaps.h
│ │ ├── qemu-spice.h
│ │ ├── sdl.c
│ │ ├── sdl_keysym.h
│ │ ├── sdl_zoom.c
│ │ ├── sdl_zoom.h
│ │ ├── sdl_zoom_template.h
│ │ ├── spice-core.c
│ │ ├── spice-display.c
│ │ ├── spice-display.h
│ │ ├── spice-input.c
│ │ ├── vnc-auth-sasl.c
│ │ ├── vnc-auth-sasl.h
│ │ ├── vnc-auth-vencrypt.c
│ │ ├── vnc-auth-vencrypt.h
│ │ ├── vnc-enc-hextile-template.h
│ │ ├── vnc-enc-hextile.c
│ │ ├── vnc-enc-tight.c
│ │ ├── vnc-enc-tight.h
│ │ ├── vnc-enc-zlib.c
│ │ ├── vnc-enc-zrle-template.c
│ │ ├── vnc-enc-zrle.c
│ │ ├── vnc-enc-zrle.h
│ │ ├── vnc-enc-zywrle-template.c
│ │ ├── vnc-enc-zywrle.h
│ │ ├── vnc-jobs-async.c
│ │ ├── vnc-jobs-sync.c
│ │ ├── vnc-jobs.h
│ │ ├── vnc-palette.c
│ │ ├── vnc-palette.h
│ │ ├── vnc-tls.c
│ │ ├── vnc-tls.h
│ │ ├── vnc.c
│ │ ├── vnc.h
│ │ ├── vnc_keysym.h
│ │ ├── x_keymap.c
│ │ └── x_keymap.h
│ ├── user-exec.c
│ ├── version.rc
│ ├── vgafont.h
│ ├── vl.c
│ ├── vmstate.h
│ ├── x86_64.ld
│ ├── xen-all.c
│ ├── xen-mapcache.c
│ ├── xen-mapcache.h
│ ├── xen-stub.c
│ └── xtensa-semi.c
├── s2e.config
├── s2e.creator
├── s2e.creator.user.example
├── s2e.files
├── s2e.includes
├── s2e.refresh_project.py
├── stp/
│ ├── AUTHORS
│ ├── CODING_GUIDLINES
│ ├── DOWNLOAD
│ ├── INSTALL
│ ├── LICENSE
│ ├── LICENSE_COMPONENTS
│ ├── README
│ ├── clean-install.sh
│ ├── scripts/
│ │ ├── Makefile.common
│ │ ├── Makefile.in
│ │ ├── configure
│ │ ├── emacs-format-file
│ │ ├── emacs-format.sh
│ │ ├── liblinks.sh
│ │ └── run_tests.pl
│ ├── src/
│ │ ├── AST/
│ │ │ ├── AST.h
│ │ │ ├── ASTBVConst.cpp
│ │ │ ├── ASTBVConst.h
│ │ │ ├── ASTInterior.cpp
│ │ │ ├── ASTInterior.h
│ │ │ ├── ASTInternal.h
│ │ │ ├── ASTInternalWithChildren.h
│ │ │ ├── ASTKind.kinds
│ │ │ ├── ASTNode.cpp
│ │ │ ├── ASTNode.h
│ │ │ ├── ASTSymbol.cpp
│ │ │ ├── ASTSymbol.h
│ │ │ ├── ASTUtil.cpp
│ │ │ ├── ASTmisc.cpp
│ │ │ ├── ArrayTransformer.cpp
│ │ │ ├── ArrayTransformer.h
│ │ │ ├── Makefile
│ │ │ ├── NodeFactory/
│ │ │ │ ├── HashingNodeFactory.cpp
│ │ │ │ ├── HashingNodeFactory.h
│ │ │ │ ├── NodeFactory.cpp
│ │ │ │ ├── NodeFactory.h
│ │ │ │ ├── SimplifyingNodeFactory.cpp
│ │ │ │ ├── SimplifyingNodeFactory.h
│ │ │ │ ├── TypeChecker.cpp
│ │ │ │ └── TypeChecker.h
│ │ │ ├── RunTimes.cpp
│ │ │ ├── RunTimes.h
│ │ │ ├── STLport_config.h
│ │ │ ├── TestAST/
│ │ │ │ ├── asttest.cpp
│ │ │ │ ├── bbtest.cpp
│ │ │ │ └── cnftest.cpp
│ │ │ ├── UsefulDefs.h
│ │ │ └── genkinds.pl
│ │ ├── STPManager/
│ │ │ ├── DifficultyScore.h
│ │ │ ├── Makefile
│ │ │ ├── NodeIterator.h
│ │ │ ├── STP.cpp
│ │ │ ├── STP.h
│ │ │ ├── STPManager.cpp
│ │ │ ├── STPManager.h
│ │ │ └── UserDefinedFlags.h
│ │ ├── absrefine_counterexample/
│ │ │ ├── AbsRefine_CounterExample.h
│ │ │ ├── AbstractionRefinement.cpp
│ │ │ ├── CounterExample.cpp
│ │ │ └── Makefile
│ │ ├── boost/
│ │ │ ├── config/
│ │ │ │ ├── abi/
│ │ │ │ │ ├── borland_prefix.hpp
│ │ │ │ │ ├── borland_suffix.hpp
│ │ │ │ │ ├── msvc_prefix.hpp
│ │ │ │ │ └── msvc_suffix.hpp
│ │ │ │ ├── abi_prefix.hpp
│ │ │ │ ├── abi_suffix.hpp
│ │ │ │ ├── auto_link.hpp
│ │ │ │ ├── compiler/
│ │ │ │ │ ├── borland.hpp
│ │ │ │ │ ├── codegear.hpp
│ │ │ │ │ ├── comeau.hpp
│ │ │ │ │ ├── common_edg.hpp
│ │ │ │ │ ├── compaq_cxx.hpp
│ │ │ │ │ ├── digitalmars.hpp
│ │ │ │ │ ├── gcc.hpp
│ │ │ │ │ ├── gcc_xml.hpp
│ │ │ │ │ ├── greenhills.hpp
│ │ │ │ │ ├── hp_acc.hpp
│ │ │ │ │ ├── intel.hpp
│ │ │ │ │ ├── kai.hpp
│ │ │ │ │ ├── metrowerks.hpp
│ │ │ │ │ ├── mpw.hpp
│ │ │ │ │ ├── nvcc.hpp
│ │ │ │ │ ├── pgi.hpp
│ │ │ │ │ ├── sgi_mipspro.hpp
│ │ │ │ │ ├── sunpro_cc.hpp
│ │ │ │ │ ├── vacpp.hpp
│ │ │ │ │ └── visualc.hpp
│ │ │ │ ├── no_tr1/
│ │ │ │ │ ├── cmath.hpp
│ │ │ │ │ ├── complex.hpp
│ │ │ │ │ ├── functional.hpp
│ │ │ │ │ ├── memory.hpp
│ │ │ │ │ └── utility.hpp
│ │ │ │ ├── platform/
│ │ │ │ │ ├── aix.hpp
│ │ │ │ │ ├── amigaos.hpp
│ │ │ │ │ ├── beos.hpp
│ │ │ │ │ ├── bsd.hpp
│ │ │ │ │ ├── cygwin.hpp
│ │ │ │ │ ├── hpux.hpp
│ │ │ │ │ ├── irix.hpp
│ │ │ │ │ ├── linux.hpp
│ │ │ │ │ ├── macos.hpp
│ │ │ │ │ ├── qnxnto.hpp
│ │ │ │ │ ├── solaris.hpp
│ │ │ │ │ ├── symbian.hpp
│ │ │ │ │ ├── vxworks.hpp
│ │ │ │ │ └── win32.hpp
│ │ │ │ ├── posix_features.hpp
│ │ │ │ ├── requires_threads.hpp
│ │ │ │ ├── select_compiler_config.hpp
│ │ │ │ ├── select_platform_config.hpp
│ │ │ │ ├── select_stdlib_config.hpp
│ │ │ │ ├── stdlib/
│ │ │ │ │ ├── dinkumware.hpp
│ │ │ │ │ ├── libcomo.hpp
│ │ │ │ │ ├── libstdcpp3.hpp
│ │ │ │ │ ├── modena.hpp
│ │ │ │ │ ├── msl.hpp
│ │ │ │ │ ├── roguewave.hpp
│ │ │ │ │ ├── sgi.hpp
│ │ │ │ │ ├── stlport.hpp
│ │ │ │ │ └── vacpp.hpp
│ │ │ │ ├── suffix.hpp
│ │ │ │ ├── user.hpp
│ │ │ │ └── warning_disable.hpp
│ │ │ ├── config.hpp
│ │ │ ├── detail/
│ │ │ │ ├── algorithm.hpp
│ │ │ │ ├── allocator_utilities.hpp
│ │ │ │ ├── atomic_count.hpp
│ │ │ │ ├── binary_search.hpp
│ │ │ │ ├── call_traits.hpp
│ │ │ │ ├── catch_exceptions.hpp
│ │ │ │ ├── compressed_pair.hpp
│ │ │ │ ├── container_fwd.hpp
│ │ │ │ ├── dynamic_bitset.hpp
│ │ │ │ ├── endian.hpp
│ │ │ │ ├── has_default_constructor.hpp
│ │ │ │ ├── identifier.hpp
│ │ │ │ ├── indirect_traits.hpp
│ │ │ │ ├── interlocked.hpp
│ │ │ │ ├── is_function_ref_tester.hpp
│ │ │ │ ├── is_incrementable.hpp
│ │ │ │ ├── is_xxx.hpp
│ │ │ │ ├── iterator.hpp
│ │ │ │ ├── lcast_precision.hpp
│ │ │ │ ├── lightweight_mutex.hpp
│ │ │ │ ├── lightweight_test.hpp
│ │ │ │ ├── lightweight_thread.hpp
│ │ │ │ ├── limits.hpp
│ │ │ │ ├── named_template_params.hpp
│ │ │ │ ├── no_exceptions_support.hpp
│ │ │ │ ├── none_t.hpp
│ │ │ │ ├── numeric_traits.hpp
│ │ │ │ ├── ob_call_traits.hpp
│ │ │ │ ├── ob_compressed_pair.hpp
│ │ │ │ ├── quick_allocator.hpp
│ │ │ │ ├── reference_content.hpp
│ │ │ │ ├── scoped_enum_emulation.hpp
│ │ │ │ ├── select_type.hpp
│ │ │ │ ├── sp_typeinfo.hpp
│ │ │ │ ├── templated_streams.hpp
│ │ │ │ ├── utf8_codecvt_facet.hpp
│ │ │ │ └── workaround.hpp
│ │ │ ├── pool/
│ │ │ │ ├── detail/
│ │ │ │ │ ├── ct_gcd_lcm.hpp
│ │ │ │ │ ├── for.m4
│ │ │ │ │ ├── gcd_lcm.hpp
│ │ │ │ │ ├── guard.hpp
│ │ │ │ │ ├── mutex.hpp
│ │ │ │ │ ├── pool_construct.bat
│ │ │ │ │ ├── pool_construct.inc
│ │ │ │ │ ├── pool_construct.m4
│ │ │ │ │ ├── pool_construct.sh
│ │ │ │ │ ├── pool_construct_simple.bat
│ │ │ │ │ ├── pool_construct_simple.inc
│ │ │ │ │ ├── pool_construct_simple.m4
│ │ │ │ │ ├── pool_construct_simple.sh
│ │ │ │ │ └── singleton.hpp
│ │ │ │ ├── object_pool.hpp
│ │ │ │ ├── pool.hpp
│ │ │ │ ├── pool_alloc.hpp
│ │ │ │ ├── poolfwd.hpp
│ │ │ │ ├── simple_segregated_storage.hpp
│ │ │ │ └── singleton_pool.hpp
│ │ │ ├── static_assert.hpp
│ │ │ └── type_traits/
│ │ │ ├── add_const.hpp
│ │ │ ├── add_cv.hpp
│ │ │ ├── add_pointer.hpp
│ │ │ ├── add_reference.hpp
│ │ │ ├── add_volatile.hpp
│ │ │ ├── aligned_storage.hpp
│ │ │ ├── alignment_of.hpp
│ │ │ ├── alignment_traits.hpp
│ │ │ ├── arithmetic_traits.hpp
│ │ │ ├── array_traits.hpp
│ │ │ ├── broken_compiler_spec.hpp
│ │ │ ├── composite_traits.hpp
│ │ │ ├── config.hpp
│ │ │ ├── conversion_traits.hpp
│ │ │ ├── cv_traits.hpp
│ │ │ ├── decay.hpp
│ │ │ ├── detail/
│ │ │ │ ├── bool_trait_def.hpp
│ │ │ │ ├── bool_trait_undef.hpp
│ │ │ │ ├── cv_traits_impl.hpp
│ │ │ │ ├── false_result.hpp
│ │ │ │ ├── ice_and.hpp
│ │ │ │ ├── ice_eq.hpp
│ │ │ │ ├── ice_not.hpp
│ │ │ │ ├── ice_or.hpp
│ │ │ │ ├── is_function_ptr_helper.hpp
│ │ │ │ ├── is_function_ptr_tester.hpp
│ │ │ │ ├── is_mem_fun_pointer_impl.hpp
│ │ │ │ ├── is_mem_fun_pointer_tester.hpp
│ │ │ │ ├── size_t_trait_def.hpp
│ │ │ │ ├── size_t_trait_undef.hpp
│ │ │ │ ├── template_arity_spec.hpp
│ │ │ │ ├── type_trait_def.hpp
│ │ │ │ ├── type_trait_undef.hpp
│ │ │ │ ├── wrap.hpp
│ │ │ │ └── yes_no_type.hpp
│ │ │ ├── extent.hpp
│ │ │ ├── floating_point_promotion.hpp
│ │ │ ├── function_traits.hpp
│ │ │ ├── has_new_operator.hpp
│ │ │ ├── has_nothrow_assign.hpp
│ │ │ ├── has_nothrow_constructor.hpp
│ │ │ ├── has_nothrow_copy.hpp
│ │ │ ├── has_nothrow_destructor.hpp
│ │ │ ├── has_trivial_assign.hpp
│ │ │ ├── has_trivial_constructor.hpp
│ │ │ ├── has_trivial_copy.hpp
│ │ │ ├── has_trivial_destructor.hpp
│ │ │ ├── has_virtual_destructor.hpp
│ │ │ ├── ice.hpp
│ │ │ ├── integral_constant.hpp
│ │ │ ├── integral_promotion.hpp
│ │ │ ├── intrinsics.hpp
│ │ │ ├── is_abstract.hpp
│ │ │ ├── is_arithmetic.hpp
│ │ │ ├── is_array.hpp
│ │ │ ├── is_base_and_derived.hpp
│ │ │ ├── is_base_of.hpp
│ │ │ ├── is_base_of_tr1.hpp
│ │ │ ├── is_class.hpp
│ │ │ ├── is_complex.hpp
│ │ │ ├── is_compound.hpp
│ │ │ ├── is_const.hpp
│ │ │ ├── is_convertible.hpp
│ │ │ ├── is_empty.hpp
│ │ │ ├── is_enum.hpp
│ │ │ ├── is_float.hpp
│ │ │ ├── is_floating_point.hpp
│ │ │ ├── is_function.hpp
│ │ │ ├── is_fundamental.hpp
│ │ │ ├── is_integral.hpp
│ │ │ ├── is_member_function_pointer.hpp
│ │ │ ├── is_member_object_pointer.hpp
│ │ │ ├── is_member_pointer.hpp
│ │ │ ├── is_object.hpp
│ │ │ ├── is_pod.hpp
│ │ │ ├── is_pointer.hpp
│ │ │ ├── is_polymorphic.hpp
│ │ │ ├── is_reference.hpp
│ │ │ ├── is_same.hpp
│ │ │ ├── is_scalar.hpp
│ │ │ ├── is_signed.hpp
│ │ │ ├── is_stateless.hpp
│ │ │ ├── is_union.hpp
│ │ │ ├── is_unsigned.hpp
│ │ │ ├── is_virtual_base_of.hpp
│ │ │ ├── is_void.hpp
│ │ │ ├── is_volatile.hpp
│ │ │ ├── make_signed.hpp
│ │ │ ├── make_unsigned.hpp
│ │ │ ├── msvc/
│ │ │ │ ├── remove_all_extents.hpp
│ │ │ │ ├── remove_bounds.hpp
│ │ │ │ ├── remove_const.hpp
│ │ │ │ ├── remove_cv.hpp
│ │ │ │ ├── remove_extent.hpp
│ │ │ │ ├── remove_pointer.hpp
│ │ │ │ ├── remove_reference.hpp
│ │ │ │ ├── remove_volatile.hpp
│ │ │ │ └── typeof.hpp
│ │ │ ├── object_traits.hpp
│ │ │ ├── promote.hpp
│ │ │ ├── rank.hpp
│ │ │ ├── reference_traits.hpp
│ │ │ ├── remove_all_extents.hpp
│ │ │ ├── remove_bounds.hpp
│ │ │ ├── remove_const.hpp
│ │ │ ├── remove_cv.hpp
│ │ │ ├── remove_extent.hpp
│ │ │ ├── remove_pointer.hpp
│ │ │ ├── remove_reference.hpp
│ │ │ ├── remove_volatile.hpp
│ │ │ ├── same_traits.hpp
│ │ │ ├── transform_traits.hpp
│ │ │ ├── transform_traits_spec.hpp
│ │ │ └── type_with_alignment.hpp
│ │ ├── c_interface/
│ │ │ ├── Makefile
│ │ │ ├── c_interface.cpp
│ │ │ ├── c_interface.h
│ │ │ └── fdstream.h
│ │ ├── extlib-abc/
│ │ │ ├── Makefile
│ │ │ ├── aig/
│ │ │ │ ├── aig/
│ │ │ │ │ ├── aigCheck.c
│ │ │ │ │ ├── aigDfs.c
│ │ │ │ │ ├── aigFanout.c
│ │ │ │ │ ├── aigMan.c
│ │ │ │ │ ├── aigMem.c
│ │ │ │ │ ├── aigMffc.c
│ │ │ │ │ ├── aigObj.c
│ │ │ │ │ ├── aigOper.c
│ │ │ │ │ ├── aigOrder.c
│ │ │ │ │ ├── aigPart.c
│ │ │ │ │ ├── aigRepr.c
│ │ │ │ │ ├── aigRet.c
│ │ │ │ │ ├── aigScl.c
│ │ │ │ │ ├── aigSeq.c
│ │ │ │ │ ├── aigShow.c
│ │ │ │ │ ├── aigTable.c
│ │ │ │ │ ├── aigTime.c
│ │ │ │ │ ├── aigTiming.c
│ │ │ │ │ ├── aigTruth.c
│ │ │ │ │ ├── aigTsim.c
│ │ │ │ │ ├── aigUtil.c
│ │ │ │ │ └── aigWin.c
│ │ │ │ ├── cnf/
│ │ │ │ │ ├── Makefile
│ │ │ │ │ ├── cnfCore.c
│ │ │ │ │ ├── cnfCut.c
│ │ │ │ │ ├── cnfData.c
│ │ │ │ │ ├── cnfMan.c
│ │ │ │ │ ├── cnfMap.c
│ │ │ │ │ ├── cnfPost.c
│ │ │ │ │ ├── cnfUtil.c
│ │ │ │ │ └── cnfWrite.c
│ │ │ │ ├── dar/
│ │ │ │ │ ├── darBalance.c
│ │ │ │ │ ├── darCore.c
│ │ │ │ │ ├── darCut.c
│ │ │ │ │ ├── darData.c
│ │ │ │ │ ├── darLib.c
│ │ │ │ │ ├── darMan.c
│ │ │ │ │ ├── darPrec.c
│ │ │ │ │ ├── darRefact.c
│ │ │ │ │ └── darScript.c
│ │ │ │ └── kit/
│ │ │ │ ├── kitAig.c
│ │ │ │ ├── kitGraph.c
│ │ │ │ ├── kitIsop.c
│ │ │ │ ├── kitSop.c
│ │ │ │ └── kitTruth.c
│ │ │ ├── aig.h
│ │ │ ├── cnf.h
│ │ │ ├── cnf_short.h
│ │ │ ├── copyright.txt
│ │ │ ├── dar.h
│ │ │ ├── darInt.h
│ │ │ ├── kit.h
│ │ │ ├── leaks.h
│ │ │ ├── vec.h
│ │ │ ├── vecFlt.h
│ │ │ ├── vecInt.h
│ │ │ ├── vecPtr.h
│ │ │ ├── vecStr.h
│ │ │ └── vecVec.h
│ │ ├── extlib-constbv/
│ │ │ ├── Makefile
│ │ │ ├── constantbv.cpp
│ │ │ └── constantbv.h
│ │ ├── main/
│ │ │ ├── Globals.cpp
│ │ │ ├── Globals.h
│ │ │ ├── Makefile
│ │ │ └── main.cpp
│ │ ├── ocaml-wrapper/
│ │ │ ├── COPYRIGHT-NOTICE
│ │ │ ├── Makefile
│ │ │ ├── OCamlMakefile
│ │ │ ├── libstp.idl
│ │ │ ├── libstp_regerrorhandler.c
│ │ │ ├── stpvc.ml
│ │ │ └── stpvc.mli
│ │ ├── parser/
│ │ │ ├── LetMgr.cpp
│ │ │ ├── LetMgr.h
│ │ │ ├── Makefile
│ │ │ ├── ParserInterface.h
│ │ │ ├── cvc.lex
│ │ │ ├── cvc.y
│ │ │ ├── parser.h
│ │ │ ├── smt.lex
│ │ │ ├── smt.y
│ │ │ ├── smt2.lex
│ │ │ └── smt2.y
│ │ ├── printer/
│ │ │ ├── AssortedPrinters.cpp
│ │ │ ├── AssortedPrinters.h
│ │ │ ├── BenchPrinter.cpp
│ │ │ ├── CPrinter.cpp
│ │ │ ├── GDLPrinter.cpp
│ │ │ ├── LispPrinter.cpp
│ │ │ ├── Makefile
│ │ │ ├── PLPrinter.cpp
│ │ │ ├── SMTLIB1Printer.cpp
│ │ │ ├── SMTLIB2Printer.cpp
│ │ │ ├── SMTLIBPrinter.cpp
│ │ │ ├── SMTLIBPrinter.h
│ │ │ ├── dotPrinter.cpp
│ │ │ └── printers.h
│ │ ├── sat/
│ │ │ ├── CryptoMinisat.cpp
│ │ │ ├── CryptoMinisat.h
│ │ │ ├── LICENSE
│ │ │ ├── Makefile
│ │ │ ├── MinisatCore.cpp
│ │ │ ├── MinisatCore.h
│ │ │ ├── MinisatCore_prop.cpp
│ │ │ ├── MinisatCore_prop.h
│ │ │ ├── README
│ │ │ ├── SATSolver.h
│ │ │ ├── SimplifyingMinisat.cpp
│ │ │ ├── SimplifyingMinisat.h
│ │ │ ├── core/
│ │ │ │ ├── Dimacs.h
│ │ │ │ ├── Main.cc
│ │ │ │ ├── Makefile
│ │ │ │ ├── Solver.cc
│ │ │ │ ├── Solver.h
│ │ │ │ └── SolverTypes.h
│ │ │ ├── core_prop/
│ │ │ │ ├── Makefile
│ │ │ │ ├── Solver_prop.cc
│ │ │ │ └── Solver_prop.h
│ │ │ ├── cryptominisat2/
│ │ │ │ ├── BitArray.h
│ │ │ │ ├── BoundedQueue.h
│ │ │ │ ├── CMakeLists.txt
│ │ │ │ ├── CSet.h
│ │ │ │ ├── Clause.h
│ │ │ │ ├── ClauseAllocator.cpp
│ │ │ │ ├── ClauseAllocator.h
│ │ │ │ ├── ClauseCleaner.cpp
│ │ │ │ ├── ClauseCleaner.h
│ │ │ │ ├── DoublePackedRow.h
│ │ │ │ ├── FailedVarSearcher.cpp
│ │ │ │ ├── FailedVarSearcher.h
│ │ │ │ ├── FindUndef.cpp
│ │ │ │ ├── FindUndef.h
│ │ │ │ ├── Gaussian.cpp
│ │ │ │ ├── Gaussian.h
│ │ │ │ ├── GaussianConfig.h
│ │ │ │ ├── Logger.cpp
│ │ │ │ ├── Logger.h
│ │ │ │ ├── MTRand/
│ │ │ │ │ └── MersenneTwister.h
│ │ │ │ ├── Main.cpp
│ │ │ │ ├── Makefile
│ │ │ │ ├── MatrixFinder.cpp
│ │ │ │ ├── MatrixFinder.h
│ │ │ │ ├── MersenneTwister.h
│ │ │ │ ├── OnlyNonLearntBins.cpp
│ │ │ │ ├── OnlyNonLearntBins.h
│ │ │ │ ├── PackedMatrix.h
│ │ │ │ ├── PackedRow.cpp
│ │ │ │ ├── PackedRow.h
│ │ │ │ ├── PartFinder.cpp
│ │ │ │ ├── PartFinder.h
│ │ │ │ ├── PartHandler.cpp
│ │ │ │ ├── PartHandler.h
│ │ │ │ ├── RestartTypeChooser.cpp
│ │ │ │ ├── RestartTypeChooser.h
│ │ │ │ ├── Solver.cpp
│ │ │ │ ├── Solver.h
│ │ │ │ ├── SolverTypes.h
│ │ │ │ ├── StateSaver.cpp
│ │ │ │ ├── StateSaver.h
│ │ │ │ ├── Subsumer.cpp
│ │ │ │ ├── Subsumer.h
│ │ │ │ ├── UselessBinRemover.cpp
│ │ │ │ ├── UselessBinRemover.h
│ │ │ │ ├── VERSION
│ │ │ │ ├── VarReplacer.cpp
│ │ │ │ ├── VarReplacer.h
│ │ │ │ ├── XSet.h
│ │ │ │ ├── XorFinder.cpp
│ │ │ │ ├── XorFinder.h
│ │ │ │ ├── XorSubsumer.cpp
│ │ │ │ ├── XorSubsumer.h
│ │ │ │ ├── constants.h
│ │ │ │ ├── msvc/
│ │ │ │ │ └── stdint.h
│ │ │ │ ├── mtl/
│ │ │ │ │ ├── Alg.h
│ │ │ │ │ ├── BasicHeap.h
│ │ │ │ │ ├── BoxedVec.h
│ │ │ │ │ ├── Heap.h
│ │ │ │ │ ├── Map.h
│ │ │ │ │ ├── Queue.h
│ │ │ │ │ └── Vec.h
│ │ │ │ └── time_mem.h
│ │ │ ├── doc/
│ │ │ │ └── ReleaseNotes-2.2.0.txt
│ │ │ ├── mtl/
│ │ │ │ ├── Alg.h
│ │ │ │ ├── Alloc.h
│ │ │ │ ├── BasicHeap.h
│ │ │ │ ├── BoxedVec.h
│ │ │ │ ├── Heap.h
│ │ │ │ ├── IntTypesMtl.h
│ │ │ │ ├── Map.h
│ │ │ │ ├── Queue.h
│ │ │ │ ├── Sort.h
│ │ │ │ ├── Vec.h
│ │ │ │ ├── XAlloc.h
│ │ │ │ └── template.mk
│ │ │ ├── simp/
│ │ │ │ ├── Main.cc
│ │ │ │ ├── Makefile
│ │ │ │ ├── SimpSolver.cc
│ │ │ │ └── SimpSolver.h
│ │ │ └── utils/
│ │ │ ├── Makefile
│ │ │ ├── Options.cc
│ │ │ ├── Options.h
│ │ │ ├── ParseUtils.h
│ │ │ ├── System.cc
│ │ │ └── System.h
│ │ ├── simplifier/
│ │ │ ├── AIGSimplifyPropositionalCore.h
│ │ │ ├── AlwaysTrue.h
│ │ │ ├── EstablishIntervals.h
│ │ │ ├── FindPureLiterals.h
│ │ │ ├── Makefile
│ │ │ ├── MutableASTNode.cpp
│ │ │ ├── MutableASTNode.h
│ │ │ ├── PropagateEqualities.cpp
│ │ │ ├── PropagateEqualities.h
│ │ │ ├── RemoveUnconstrained.cpp
│ │ │ ├── RemoveUnconstrained.h
│ │ │ ├── SubstitutionMap.cpp
│ │ │ ├── SubstitutionMap.h
│ │ │ ├── Symbols.h
│ │ │ ├── UseITEContext.h
│ │ │ ├── VariablesInExpression.cpp
│ │ │ ├── VariablesInExpression.h
│ │ │ ├── bvsolver.cpp
│ │ │ ├── bvsolver.h
│ │ │ ├── constantBitP/
│ │ │ │ ├── ConstantBitP_Arithmetic.cpp
│ │ │ │ ├── ConstantBitP_Boolean.cpp
│ │ │ │ ├── ConstantBitP_Comparison.cpp
│ │ │ │ ├── ConstantBitP_Division.cpp
│ │ │ │ ├── ConstantBitP_Multiplication.cpp
│ │ │ │ ├── ConstantBitP_Shifting.cpp
│ │ │ │ ├── ConstantBitP_TransferFunctions.cpp
│ │ │ │ ├── ConstantBitP_TransferFunctions.h
│ │ │ │ ├── ConstantBitP_Utility.cpp
│ │ │ │ ├── ConstantBitP_Utility.h
│ │ │ │ ├── ConstantBitPropagation.cpp
│ │ │ │ ├── ConstantBitPropagation.h
│ │ │ │ ├── Dependencies.h
│ │ │ │ ├── FixedBits.cpp
│ │ │ │ ├── FixedBits.h
│ │ │ │ ├── MultiplicationStats.h
│ │ │ │ ├── NodeToFixedBitsMap.h
│ │ │ │ ├── WorkList.h
│ │ │ │ └── multiplication/
│ │ │ │ ├── ColumnCounts.h
│ │ │ │ ├── ColumnStats.h
│ │ │ │ ├── Edge.h
│ │ │ │ └── ImplicationGraph.h
│ │ │ ├── consteval.cpp
│ │ │ ├── simplifier.cpp
│ │ │ └── simplifier.h
│ │ ├── to-sat/
│ │ │ ├── AIG/
│ │ │ │ ├── BBNodeAIG.h
│ │ │ │ ├── BBNodeManagerAIG.cpp
│ │ │ │ ├── BBNodeManagerAIG.h
│ │ │ │ ├── ToCNFAIG.cpp
│ │ │ │ ├── ToCNFAIG.h
│ │ │ │ ├── ToSATAIG.cpp
│ │ │ │ └── ToSATAIG.h
│ │ │ ├── ASTNode/
│ │ │ │ ├── BBNodeManagerASTNode.h
│ │ │ │ ├── ClauseList.cpp
│ │ │ │ ├── ClauseList.h
│ │ │ │ ├── SimpBool.cpp
│ │ │ │ ├── ToCNF.cpp
│ │ │ │ ├── ToCNF.h
│ │ │ │ ├── ToSAT.cpp
│ │ │ │ └── ToSAT.h
│ │ │ ├── BitBlaster.cpp
│ │ │ ├── BitBlaster.h
│ │ │ ├── Makefile
│ │ │ ├── ToSATBase.cpp
│ │ │ └── ToSATBase.h
│ │ └── util/
│ │ ├── Makefile
│ │ └── rewrite.cpp
│ ├── tests/
│ │ ├── big-test/
│ │ │ ├── dsa_chop_allopt.stp.cvc_old
│ │ │ ├── dsa_chop_allopt.stp.smt2
│ │ │ ├── dsa_chop_dc.stp.cvc_old
│ │ │ ├── dsa_chop_dc.stp.smt2
│ │ │ ├── dsa_chop_noopt-nossa.stp.cvc_old
│ │ │ ├── dsa_chop_noopt-nossa.stp.smt2
│ │ │ ├── dsa_chop_noopt-ssa.stp.cvc_old
│ │ │ └── dsa_chop_noopt-ssa.stp.smt2
│ │ ├── bio-tests/
│ │ │ ├── 4-alpha-helices-2-rungs-more-bits-simplified.cvc
│ │ │ ├── 4-alpha-helices-2-rungs.cvc
│ │ │ ├── 4-alpha-helices-3-rungs-macros.cvc
│ │ │ ├── 4-alpha-helices-3-rungs.cvc
│ │ │ └── rna2.cvc
│ │ ├── c-api-tests/
│ │ │ ├── Makefile
│ │ │ ├── array-cvcl-02.c
│ │ │ ├── b4-c.c
│ │ │ ├── b4-c2.c
│ │ │ ├── biosat-rna.cpp
│ │ │ ├── cvc-to-c.cpp
│ │ │ ├── f.cvc
│ │ │ ├── getbvunsignedlonglong-check.c
│ │ │ ├── if-check.c
│ │ │ ├── interface-check.c
│ │ │ ├── leak.c
│ │ │ ├── multiple-queries.c
│ │ │ ├── parsefile-using-cinterface.c
│ │ │ ├── parsestring-using-cinterface.c
│ │ │ ├── print.c
│ │ │ ├── push-no-pop.c
│ │ │ ├── push-pop-1.c
│ │ │ ├── push-pop.c
│ │ │ ├── sbvdiv.c
│ │ │ ├── simplify.c
│ │ │ ├── simplify1.c
│ │ │ ├── squares-leak.c
│ │ │ ├── stp-array-model.c
│ │ │ ├── stp-bool.c
│ │ │ ├── stp-counterex.c
│ │ │ ├── stp-div-001.c
│ │ │ ├── stp-test3.c
│ │ │ ├── stpcheck.c
│ │ │ ├── t.cvc
│ │ │ ├── userguided-absrefine.c
│ │ │ ├── x.c
│ │ │ └── y.c
│ │ ├── crypto-tests/
│ │ │ ├── 1024_bit_prime_1s_only.stp
│ │ │ ├── rsa_1024_bit_prime_1s_only.stp
│ │ │ ├── rsa_97_bit_prime.stp
│ │ │ ├── rsa_97_bit_prime_1s_only.stp
│ │ │ ├── t3.stp
│ │ │ ├── t3_flat.stp
│ │ │ ├── t4.stp
│ │ │ ├── t4_flat.stp
│ │ │ ├── t4_nadia.stp
│ │ │ ├── t4_nadia_n1.stp
│ │ │ ├── t5.stp
│ │ │ ├── tea.pl
│ │ │ ├── tea_four_round_one_var.stp
│ │ │ ├── tea_four_round_one_var_half_key.stp
│ │ │ ├── tea_four_round_two_var_half_key.stp
│ │ │ ├── tea_four_round_two_var_tea.stp
│ │ │ ├── tea_three_round_one_var.stp
│ │ │ ├── tea_three_round_two_var.stp
│ │ │ ├── tea_three_round_two_var_half_key.stp
│ │ │ └── tea_two_round_two_var.stp
│ │ ├── generated_tests/
│ │ │ ├── ArrayGenerator.java
│ │ │ ├── Makefile
│ │ │ ├── extract.pl
│ │ │ ├── form_128.var_32.bits_32.cvc
│ │ │ ├── form_16.var_32.bits_32.cvc
│ │ │ ├── form_256.var_32.bits_32.cvc
│ │ │ ├── form_32.var_128.bits_32.cvc
│ │ │ ├── form_32.var_16.bits_32.cvc
│ │ │ ├── form_32.var_256.bits_32.cvc
│ │ │ ├── form_32.var_32.bits_32.cvc
│ │ │ ├── form_32.var_4.bits_32.cvc
│ │ │ ├── form_32.var_64.bits_32.cvc
│ │ │ ├── form_32.var_8.bits_32.cvc
│ │ │ ├── form_4.var_32.bits_32.cvc
│ │ │ ├── form_64.var_32.bits_32.cvc
│ │ │ ├── form_8.var_32.bits_32.cvc
│ │ │ ├── g.cvc
│ │ │ ├── gen2.cvc
│ │ │ ├── mulDivRem.cpp
│ │ │ ├── random-tests/
│ │ │ │ ├── OptGen.java
│ │ │ │ └── tree.cpp
│ │ │ ├── run-experiments.pl
│ │ │ ├── runMulDivRem.sh
│ │ │ └── testgen.pl
│ │ ├── misc-tests/
│ │ │ ├── cryptominisat-bug.cvc
│ │ │ └── no-query.cvc
│ │ ├── sample-smt-tests/
│ │ │ ├── 610dd9dc.T.stp.smt_71.smt
│ │ │ ├── convert-tiff2jpg-query-1831.smt_68.smt
│ │ │ ├── working_54.smt
│ │ │ └── working_55.smt
│ │ └── sample-tests/
│ │ ├── a100test0001.cvc
│ │ ├── a101test0002.cvc
│ │ ├── a103test0001.cvc
│ │ ├── a105test0001.cvc
│ │ ├── a107test0001.cvc
│ │ ├── a114test0001.cvc
│ │ ├── a115test0002.cvc
│ │ ├── a116test0003.cvc
│ │ ├── a121test0001.cvc
│ │ ├── a122test0002.cvc
│ │ ├── a123test0003.cvc
│ │ ├── a124test0004.cvc
│ │ ├── a126test0001.cvc
│ │ ├── a127test0009.cvc
│ │ ├── a128test0016.cvc
│ │ ├── a12test0001.cvc
│ │ ├── a13test0002.cvc
│ │ ├── a15test0001.cvc
│ │ ├── a163test0021.cvc
│ │ ├── a164test0005.cvc
│ │ ├── a165test0010.cvc
│ │ ├── a166test0014.cvc
│ │ ├── a167test0001.cvc
│ │ ├── a168test0018.cvc
│ │ ├── a169test0012.cvc
│ │ ├── a170test0017.cvc
│ │ ├── a171test0019.cvc
│ │ ├── a172test0002.cvc
│ │ ├── a173test0011.cvc
│ │ ├── a174test0003.cvc
│ │ ├── a175test0013.cvc
│ │ ├── a176test0022.cvc
│ │ ├── a177test0006.cvc
│ │ ├── a178test0007.cvc
│ │ ├── a179test0008.cvc
│ │ ├── a180test0004.cvc
│ │ ├── a181test0020.cvc
│ │ ├── a182test0015.cvc
│ │ ├── a185test0001.cvc
│ │ ├── a186test0002.cvc
│ │ ├── a187test0009.cvc
│ │ ├── a188test0016.cvc
│ │ ├── egt-1899.cvc
│ │ ├── long-by-hand.cvc
│ │ ├── variable-rightshift-invalid.cvc
│ │ └── variable-rightshift-valid.cvc
│ ├── unit_test/
│ │ ├── alwaysTrue.smt2
│ │ ├── bvand.smt2
│ │ ├── bvand2.smt2
│ │ ├── bvand3.smt2
│ │ ├── bvconcat.smt2
│ │ ├── bvconcat2.smt2
│ │ ├── bvconcat3.smt2
│ │ ├── bvge1.smt2
│ │ ├── bvge3.smt2
│ │ ├── bvmul_minus.smt2
│ │ ├── bvnor.smt2
│ │ ├── bvnot.smt2
│ │ ├── bvor.smt2
│ │ ├── bvsge.smt2
│ │ ├── bvsgt.smt2
│ │ ├── bvsgt2.smt2
│ │ ├── bvshift.smt2
│ │ ├── bvsolver.smt
│ │ ├── bvxor.smt2
│ │ ├── eq.smt2
│ │ ├── eq2.smt2
│ │ ├── eqConcat.smt2
│ │ ├── harald.smt2
│ │ ├── mod.smt2
│ │ ├── mod2.smt2
│ │ ├── mult.smt2
│ │ ├── orAlwaysTrue.smt2
│ │ ├── pure.smt2
│ │ ├── pure2.smt2
│ │ ├── sim.smt2
│ │ ├── unc_shift.smt
│ │ ├── uncon_then_pure.smt
│ │ ├── unit_test.sh
│ │ ├── writing_same.smt2
│ │ ├── xor.smt2
│ │ ├── xor2.smt2
│ │ ├── xor3.smt2
│ │ └── xor4.smt2
│ └── windows/
│ ├── README
│ ├── cmakemods/
│ │ ├── msvcmt.cmake
│ │ ├── slibgcc.cmake
│ │ └── staticrt.cmake
│ ├── r446-winport.patch
│ └── winports/
│ ├── compdep.h
│ ├── msc99hdr/
│ │ ├── inttypes.h
│ │ ├── stdbool.h
│ │ ├── stdint.h
│ │ └── unistd.h
│ └── sys/
│ └── time.h
└── tools/
├── Makefile
├── Makefile.common
├── Makefile.config.in
├── autoconf/
│ ├── AutoRegen.sh
│ ├── aclocal.m4
│ ├── config.guess
│ ├── config.sub
│ ├── configure.ac
│ └── install-sh
├── configure
├── include/
│ └── s2etools/
│ └── config.h.in
├── lib/
│ ├── BinaryReaders/
│ │ ├── BFDInterface.cpp
│ │ ├── BFDInterface.h
│ │ ├── Binary.cpp
│ │ ├── Binary.h
│ │ ├── ExecutableFile.cpp
│ │ ├── ExecutableFile.h
│ │ ├── Library.cpp
│ │ ├── Library.h
│ │ ├── Macho.cpp
│ │ ├── Macho.h
│ │ ├── Makefile
│ │ ├── Pe.cpp
│ │ ├── Pe.h
│ │ ├── TextModule.cpp
│ │ └── TextModule.h
│ ├── ExecutionTracer/
│ │ ├── CacheProfiler.cpp
│ │ ├── CacheProfiler.h
│ │ ├── InstructionCounter.cpp
│ │ ├── InstructionCounter.h
│ │ ├── LogParser.cpp
│ │ ├── LogParser.h
│ │ ├── Makefile
│ │ ├── ModuleParser.cpp
│ │ ├── ModuleParser.h
│ │ ├── PageFault.cpp
│ │ ├── PageFault.h
│ │ ├── Path.h
│ │ ├── PathBuilder.cpp
│ │ ├── TestCase.cpp
│ │ └── TestCase.h
│ ├── Makefile
│ └── Utils/
│ ├── BasicBlockListParser.cpp
│ ├── BasicBlockListParser.h
│ ├── Makefile
│ ├── Signals/
│ │ ├── Signals.h
│ │ ├── fsigc++.h
│ │ ├── functors.h
│ │ └── sig-template.h
│ └── signals.cpp
└── tools/
├── Makefile
├── cacheprof/
│ ├── Makefile
│ └── cacheprof.cpp
├── coverage/
│ ├── Coverage.cpp
│ ├── Coverage.h
│ └── Makefile
├── debugger/
│ ├── Debugger.cpp
│ ├── Debugger.h
│ └── Makefile
├── forkprofiler/
│ ├── Makefile
│ ├── forkprofiler.cpp
│ └── forkprofiler.h
├── icounter/
│ ├── Makefile
│ ├── icounter.cpp
│ └── icounter.h
├── pfprofiler/
│ ├── CacheProfiler.cpp
│ ├── CacheProfiler.h
│ ├── Makefile
│ ├── pfprofiler.cpp
│ └── pfprofiler.h
├── s2etools-config/
│ ├── FinalLibDeps.txt
│ ├── Makefile
│ └── s2etools-config.in.in
├── scripts/
│ ├── gdb.ini
│ └── ida/
│ ├── extractBasicBlocks.py
│ └── extractFunctions.py
└── tbtrace/
├── Makefile
├── TbTrace.cpp
└── TbTrace.h
================================================
FILE CONTENTS
================================================
================================================
FILE: .github/FUNDING.yml
================================================
# These are supported funding model platforms
github: vitalych
patreon: # Replace with a single Patreon username
open_collective: # Replace with a single Open Collective username
ko_fi: # Replace with a single Ko-fi username
tidelift: # Replace with a single Tidelift platform-name/package-name e.g., npm/babel
community_bridge: # Replace with a single Community Bridge project-name e.g., cloud-foundry
liberapay: # Replace with a single Liberapay username
issuehunt: # Replace with a single IssueHunt username
otechie: # Replace with a single Otechie username
custom: # Replace with up to 4 custom sponsorship URLs e.g., ['link1', 'link2']
================================================
FILE: .gitignore
================================================
*~
/s2e.creator.user
/guest/demos/quicksort
/guest/init_env/init_env*.so
/guest/s2ecmd/s2ecmd
/guest/s2eget/s2eget
================================================
FILE: LICENSE
================================================
S2E as a whole is released under the GNU General Public License version 2.
Some S2E files are released under GPL, LGPL or BSD licenses. Please consult
LICENSE files in the subfolders and the headers of each individual files for
more details.
================================================
FILE: Makefile
================================================
#Environment variables:
#
# BUILD_ARCH=corei7, etc...
# Overrides the default clang -march settings.
# Useful to build S2E in VirtualBox or in other VMs that do not support
# some advanced instruction sets.
# Used by STP only for now.
#
# EXTRA_QEMU_FLAGS=...
# Pass additional flags to QEMU's configure script.
#
# PARALLEL=no
# Turn off build parallelization.
#
# LLVMBUILD=...
# Contains llvm-native, llvm-debug, llvm-release, and llvm source folders
# Can be used to avoid rebuilding clang/llvm for every branch of S2E
#
S2ESRC := $(dir $(realpath $(lastword $(MAKEFILE_LIST))))
S2EBUILD:=$(CURDIR)
LLVMBUILD?=$(S2EBUILD)
OS := $(shell uname)
JOBS:=2
ifeq ($(PARALLEL),no)
JOBS := 1
else ifeq ($(OS),Darwin)
JOBS := $(patsubst hw.ncpu:%,%,$(shell sysctl hw.ncpu))
else ifeq ($(OS),Linux)
JOBS := $(shell grep -c ^processor /proc/cpuinfo)
endif
MAKE = make -j$(JOBS)
all: all-release guest-tools
guest-tools: stamps/guest-tools32-make stamps/guest-tools64-make
all-release all-asan-release: stamps/tools-release-make
all-release: stamps/qemu-release-make
all-asan-release: stamps/qemu-asan-release-make
all-debug all-asan-debug: stamps/tools-debug-make
all-debug: stamps/qemu-debug-make
all-asan-debug: stamps/qemu-asan-debug-make
ifeq ($(wildcard qemu/vl.c),qemu/vl.c)
$(error You should not run make in the S2E source directory!)
endif
LLVM_VERSION=3.2
LLVM_SRC=llvm-$(LLVM_VERSION).src.tar.gz
LLVM_SRC_DIR=llvm-$(LLVM_VERSION).src
LLVM_NATIVE_SRC_DIR=llvm-$(LLVM_VERSION).src.native
CLANG_SRC=clang-$(LLVM_VERSION).src.tar.gz
CLANG_SRC_DIR=clang-$(LLVM_VERSION).src
CLANG_DEST_DIR=$(LLVM_NATIVE_SRC_DIR)/tools/clang
COMPILER_RT_SRC=compiler-rt-$(LLVM_VERSION).src.tar.gz
COMPILER_RT_SRC_DIR=compiler-rt-$(LLVM_VERSION).src
COMPILER_RT_DEST_DIR=$(LLVM_NATIVE_SRC_DIR)/projects/compiler-rt
KLEE_QEMU_DIRS = $(foreach suffix,-debug -release,$(addsuffix $(suffix),klee klee-asan qemu qemu-asan))
ifeq ($(LLVMBUILD),$(S2EBUILD))
LLVM_DIRS = llvm-debug llvm-native llvm-release
endif
clean:
-rm -Rf $(KLEE_QEMU_DIRS)
-rm -Rf stamps
guestclean:
-rm -f stamps/guest-tools*
-rm -rf guest-tools*
distclean: clean guestclean
-rm -Rf guest-tools $(LLVM_DIRS) stp stp-asan tools-debug tools-release
-rm -Rf $(COMPILER_RT_SRC_DIR) $(LLVM_SRC_DIR) $(LLVM_NATIVE_SRC_DIR)
.PHONY: all all-debug all-release all-asan-debug all-asan-release
.PHONY: clean distclean guestclean
ALWAYS:
guest-tools32 guest-tools64 $(KLEE_QEMU_DIRS) $(LLVM_DIRS) stamps tools-debug tools-release:
mkdir -p $@
stamps/%-configure: | % stamps
cd $* && $(CONFIGURE_COMMAND)
touch $@
stamps/%-make:
$(MAKE) -C $* $(BUILD_OPTS)
touch $@
# On Ubuntu 14.04, c++config.h is located in a platform-specific path
ifeq (,$(wildcard /usr/include/x86_64-linux-gnu/c++/4.8/c++config.h))
export CPLUS_INCLUDE_PATH=/usr/include:/usr/include/x86_64-linux-gnu:/usr/include/x86_64-linux-gnu/c++/4.8
export C_INCLUDE_PATH=/usr/include:/usr/include/x86_64-linux-gnu
endif
#############
# Downloads #
#############
ifeq ($(LLVMBUILD),$(S2EBUILD))
LLVM_SRC_URL = http://llvm.org/releases/$(LLVM_VERSION)/
$(CLANG_SRC) $(COMPILER_RT_SRC) $(LLVM_SRC):
wget $(LLVM_SRC_URL)$@
.INTERMEDIATE: $(CLANG_SRC_DIR) $(COMPILER_RT_SRC_DIR)
$(CLANG_SRC_DIR): $(CLANG_SRC)
$(COMPILER_RT_SRC_DIR): $(COMPILER_RT_SRC)
$(LLVM_SRC_DIR): $(LLVM_SRC)
$(CLANG_SRC_DIR) $(COMPILER_RT_SRC_DIR) $(LLVM_SRC_DIR):
tar -xmzf $<
$(LLVM_NATIVE_SRC_DIR): $(LLVM_SRC_DIR)
$(LLVM_NATIVE_SRC_DIR):
cp -r $< $@
$(CLANG_DEST_DIR): $(CLANG_SRC_DIR) $(LLVM_NATIVE_SRC_DIR)
$(COMPILER_RT_DEST_DIR): $(COMPILER_RT_SRC_DIR) $(LLVM_NATIVE_SRC_DIR)
$(CLANG_DEST_DIR) $(COMPILER_RT_DEST_DIR):
mv $< $@
endif
stp stp-asan: $(S2ESRC)/stp
stp stp-asan:
cp -r $< $@
########
# LLVM #
########
CLANG_CC=$(LLVMBUILD)/llvm-native/Release/bin/clang
CLANG_CXX=$(LLVMBUILD)/llvm-native/Release/bin/clang++
ifeq ($(LLVMBUILD),$(S2EBUILD))
LLVM_CONFIGURE_FLAGS = --prefix=$(S2EBUILD)/opt \
--enable-jit --enable-optimized \
#First build it with the system's compiler
stamps/llvm-native-configure: $(CLANG_DEST_DIR) $(COMPILER_RT_DEST_DIR)
stamps/llvm-native-configure: CONFIGURE_COMMAND = $(S2EBUILD)/$(LLVM_NATIVE_SRC_DIR)/configure \
$(LLVM_CONFIGURE_FLAGS) \
--disable-assertions #compiler-rt won't build if we specify explicit targets...
stamps/llvm-native-make: stamps/llvm-native-configure
stamps/llvm-native-make: BUILD_OPTS = ENABLE_OPTIMIZED=1
#Then, build LLVM with the clang compiler.
#Note that we build LLVM without clang and compiler-rt, because S2E does not need them.
stamps/llvm-debug-configure: stamps/llvm-native-make
stamps/llvm-release-configure: stamps/llvm-native-make
stamps/llvm-%-configure: CONFIGURE_COMMAND = $(S2EBUILD)/$(LLVM_SRC_DIR)/configure \
$(LLVM_CONFIGURE_FLAGS) \
--target=x86_64 --enable-targets=x86 \
CC=$(CLANG_CC) \
CXX=$(CLANG_CXX)
stamps/llvm-debug-make: stamps/llvm-debug-configure
stamps/llvm-debug-make: BUILD_OPTS = ENABLE_OPTIMIZED=0 REQUIRES_RTTI=1
stamps/llvm-release-make: stamps/llvm-release-configure
stamps/llvm-release-make: BUILD_OPTS = ENABLE_OPTIMIZED=1 REQUIRES_RTTI=1
else
stamps/llvm-release-make stamps/llvm-debug-make stamps/llvm-native-make:
@echo "Won't build $@, using $(LLVMBUILD) folder"
endif
#######
# STP #
#######
stamps/stp-make stamps/stp-asan-make: ALWAYS
STP_CONFIGURE_FLAGS = --with-prefix=$(S2EBUILD)/stp --with-fpic \
--with-g++=$(CLANG_CXX) --with-gcc=$(CLANG_CC)
stamps/stp-configure: stamps/llvm-native-make
stamps/stp-configure: CONFIGURE_COMMAND = scripts/configure $(STP_CONFIGURE_FLAGS)
#STP: concurrent build is not reliable
stamps/stp-make: stamps/stp-configure
cd stp && make
mkdir -p stamps && touch $@
#ASAN-enabled STP
#XXX: need to fix the STP build to actually use ASAN...
stamps/stp-asan-configure: stamps/llvm-native-make
stamps/stp-asan-configure: CONFIGURE_COMMAND = scripts/configure $(STP_CONFIGURE_FLAGS) --with-address-sanitizer
stamps/stp-asan-make: stamps/stp-asan-configure
cd stp-asan && make
mkdir -p stamps && touch $@
########
# KLEE #
########
stamps/klee-debug-make stamps/klee-asan-debug-make stamps/klee-release-make stamps/klee-asan-release-make: ALWAYS
KLEE_CONFIGURE_COMMON = $(S2ESRC)/klee/configure \
--prefix=$(S2EBUILD)/opt \
--with-llvmsrc=$(LLVMBUILD)/$(LLVM_SRC_DIR) \
--target=x86_64 --enable-exceptions \
CC=$(CLANG_CC) CXX=$(CLANG_CXX)
KLEE_CONFIGURE_COMMAND = $(KLEE_CONFIGURE_COMMON) --with-stp=$(S2EBUILD)/stp
stamps/klee-debug-configure: stamps/stp-make stamps/llvm-debug-make
stamps/klee-debug-configure: CONFIGURE_COMMAND = $(KLEE_CONFIGURE_COMMAND) \
--with-llvmobj=$(LLVMBUILD)/llvm-debug \
CXXFLAGS="-g -O0" LDFLAGS="-g"
stamps/klee-release-configure: stamps/stp-make stamps/llvm-release-make
stamps/klee-release-configure: CONFIGURE_COMMAND = $(KLEE_CONFIGURE_COMMAND) \
--with-llvmobj=$(LLVMBUILD)/llvm-release
stamps/klee-debug-make: stamps/klee-debug-configure
stamps/klee-debug-make: BUILD_OPTS = ENABLE_OPTIMIZED=0
stamps/klee-release-make: stamps/klee-release-configure
stamps/klee-release-make: BUILD_OPTS = ENABLE_OPTIMIZED=1
#ASAN-enabled KLEE
KLEE_ASAN_CONFIGURE_COMMAND = $(KLEE_CONFIGURE_COMMON) --with-stp=$(S2EBUILD)/stp-asan
stamps/klee-asan-debug-configure: stamps/stp-asan-make stamps/llvm-debug-make
stamps/klee-asan-debug-configure: CONFIGURE_COMMAND = $(KLEE_ASAN_CONFIGURE_COMMAND) \
--with-llvmobj=$(LLVMBUILD)/llvm-debug \
CXXFLAGS="-g -O0 -fsanitize=address" \
LDFLAGS="-g -fsanitize=address"
stamps/klee-asan-release-configure: stamps/stp-asan-make stamps/llvm-release-make
stamps/klee-asan-release-configure: CONFIGURE_COMMAND = $(KLEE_ASAN_CONFIGURE_COMMAND) \
--with-llvmobj=$(LLVMBUILD)/llvm-release \
CXXFLAGS="-fsanitize=address" \
LDFLAGS="-fsanitize=address"
stamps/klee-asan-debug-make: stamps/klee-asan-debug-configure
stamps/klee-asan-debug-make: BUILD_OPTS = ENABLE_OPTIMIZED=0
stamps/klee-asan-release-make: stamps/klee-asan-release-configure
stamps/klee-asan-release-make: BUILD_OPTS = ENABLE_OPTIMIZED=1
########
# QEMU #
########
#HACK: LLVM does not recognize which processor features are supported, and uses SSE4 when it's not supported, so disable this
EXTRA_QEMU_FLAGS += --extra-cflags=-mno-sse3 --extra-cxxflags=-mno-sse3
QEMU_S2E_ARCH =
QEMU_S2E_ARCH += i386-s2e-softmmu i386-softmmu
QEMU_S2E_ARCH += x86_64-s2e-softmmu x86_64-softmmu
QEMU_S2E_ARCH += arm-s2e-softmmu arm-softmmu
empty :=
comma := ,
space := $(empty) $(empty)
QEMU_S2E_ARCH := $(subst $(space),$(comma),$(strip $(QEMU_S2E_ARCH)))
QEMU_COMMON_FLAGS = --prefix=$(S2EBUILD)/opt\
--cc=$(CLANG_CC) \
--cxx=$(CLANG_CXX) \
--target-list=$(QEMU_S2E_ARCH)\
--enable-llvm \
--enable-s2e \
--with-pkgversion=S2E \
--disable-virtfs \
--disable-fdt \
$(EXTRA_QEMU_FLAGS)
QEMU_CONFIGURE_FLAGS = --with-stp=$(S2EBUILD)/stp \
$(QEMU_COMMON_FLAGS)
QEMU_DEBUG_FLAGS = --with-llvm=$(LLVMBUILD)/llvm-debug/Debug+Asserts \
--enable-debug
QEMU_RELEASE_FLAGS = --with-llvm=$(LLVMBUILD)/llvm-release/Release+Asserts
stamps/qemu-debug-configure: stamps/klee-debug-make
stamps/qemu-debug-configure: CONFIGURE_COMMAND = $(S2ESRC)/qemu/configure \
--with-klee=$(S2EBUILD)/klee-debug/Debug+Asserts \
$(QEMU_DEBUG_FLAGS) \
$(QEMU_CONFIGURE_FLAGS)
stamps/qemu-release-configure: stamps/klee-release-make
stamps/qemu-release-configure: CONFIGURE_COMMAND = $(S2ESRC)/qemu/configure \
--with-klee=$(S2EBUILD)/klee-release/Release+Asserts \
$(QEMU_RELEASE_FLAGS) \
$(QEMU_CONFIGURE_FLAGS)
stamps/qemu-debug-make: stamps/qemu-debug-configure
stamps/qemu-release-make: stamps/qemu-release-configure
#ASAN-enabled QEMU
QEMU_ASAN_FLAGS = --enable-address-sanitizer \
--with-stp=$(S2EBUILD)/stp-asan \
$(QEMU_COMMON_FLAGS)
stamps/qemu-asan-debug-configure: stamps/klee-asan-debug-make
stamps/qemu-asan-debug-configure: CONFIGURE_COMMAND = $(S2ESRC)/qemu/configure \
--with-klee=$(S2EBUILD)/klee-asan-debug/Debug+Asserts \
$(QEMU_DEBUG_FLAGS) \
$(QEMU_ASAN_FLAGS)
stamps/qemu-asan-release-configure: stamps/klee-asan-release-make
stamps/qemu-asan-release-configure: CONFIGURE_COMMAND = $(S2ESRC)/qemu/configure \
--with-klee=$(S2EBUILD)/klee-asan-release/Release+Asserts \
$(QEMU_RELEASE_FLAGS) \
$(QEMU_ASAN_FLAGS)
stamps/qemu-asan-debug-make: stamps/qemu-asan-debug-configure
stamps/qemu-asan-release-make: stamps/qemu-asan-release-configure
#########
# Tools #
#########
TOOLS_CONFIGURE_COMMAND = $(S2ESRC)/tools/configure \
--with-llvmsrc=$(LLVMBUILD)/$(LLVM_SRC_DIR) \
--with-s2esrc=$(S2ESRC)/qemu \
--target=x86_64 CC=$(CLANG_CC) CXX=$(CLANG_CXX)
stamps/tools-debug-configure: stamps/llvm-debug-make
stamps/tools-debug-configure: CONFIGURE_COMMAND = $(TOOLS_CONFIGURE_COMMAND) \
--with-llvmobj=$(LLVMBUILD)/llvm-debug
stamps/tools-release-configure: stamps/llvm-release-make
stamps/tools-release-configure: CONFIGURE_COMMAND = $(TOOLS_CONFIGURE_COMMAND) \
--with-llvmobj=$(LLVMBUILD)/llvm-release
stamps/tools-debug-make stamps/tools-release-make: ALWAYS
stamps/tools-debug-make: stamps/tools-debug-configure
stamps/tools-debug-make: BUILD_OPTS = ENABLE_OPTIMIZED=0 REQUIRES_RTTI=1
stamps/tools-release-make: stamps/tools-release-configure
stamps/tools-release-make: BUILD_OPTS = ENABLE_OPTIMIZED=1 REQUIRES_RTTI=1
############
#Guest tools
############
GUEST_CONFIGURE_COMMAND = $(S2ESRC)/guest/configure
stamps/guest-tools%-configure: CONFIGURE_COMMAND = $(GUEST_CONFIGURE_COMMAND)
stamps/guest-tools32-make: stamps/guest-tools32-configure
stamps/guest-tools32-make: BUILD_OPTS = CFLAGS="-m32"
stamps/guest-tools64-make: stamps/guest-tools64-configure
stamps/guest-tools64-make: BUILD_OPTS = CFLAGS="-m64"
================================================
FILE: README
================================================
S²E: A Platform for In-Vivo Multi-Path Software Analysis
========================================================
https://s2e.epfl.ch
S2E is a platform for writing tools that analyze the properties and behavior of software systems. So far, S2E has been used to develop a comprehensive performance profiler, a reverse engineering tool for proprietary software, and a bug finding tool for both kernel-mode and user-mode binaries. Building these tools on top of S2E took less than 770 LOC and 40 person-hours each.
S2E’s novelty consists of its ability to scale to large real systems, such as a full Windows stack. S2E is based on two new ideas:
1. Selective symbolic execution, a way to automatically
minimize the amount of code that has to be executed
symbolically given a target analysis; and
2. Relaxed execution consistency models, a way to make
principled performance/accuracy trade-offs in complex
analyses.
These techniques give S2E three key abilities:
1. to simultaneously analyze entire families of execution
paths, instead of just one execution at a time;
2. to perform the analyses in-vivo within a real software
stack—user programs, libraries, kernel, drivers, etc.—
instead of using abstract models of these layers; and
to operate directly on binaries, thus being able to analyze
even proprietary software.
Conceptually, S2E is an automated path explorer with modular path analyzers: the explorer drives the target system down all execution paths of interest, while analyzers check properties of each such path (e.g., to look for bugs) or simply collect information (e.g., count page faults). Desired paths can be specified in multiple ways, and S2E users can either combine existing
analyzers to build a custom analysis tool, or write new analyzers using the S2E API.
S2E helps make analyses based on symbolic execution practical for large software that runs in real environments, without requiring explicit modeling of these environments.
S2E is built upon the KLEE symbolic execution engine (http://klee.llvm.org) and the QEMU virtual machine emulator (http://qemu.org).
Documentation
=============
Setup instruction and user documentation can be found in the /docs folder, both in RST and HTML format.
================================================
FILE: S2E-AUTHORS
================================================
Vitaly Chipounov <vitaly.chipounov@epfl.ch>
Volodymyr Kuznetsov <vova.kuznetsov@epfl.ch>
Jonas Wagner <jonas.wagner@epfl.ch>
Cristian Zamfir <cristian.zamfir@epfl.ch>
Prof. George Candea <george.candea@epfl.ch>
External Contributors:
======================
Michael Contreras <michael@inetric.com>
LLVM 3.2 and x86_64 support
Andreas Kirchner <akalypse@gmail.com>
Luca Bruno <lucab@debian.org>
Jonas Zaddach <zaddach@eurecom.fr>
ARM porting
Diego Biurrun <diego@biurrun.de>
Build system
Matt Renzelmann <mjr@cs.wisc.edu>
Enhanced symbolic hardware, SymDrive
Raimondas Sasnauskas <raimondas.sasnauskas@cs.rwth-aachen.de>
Alexandre Gouraud <alexandre.gouraud@enst-bretagne.fr>
Sriram Subramanian <srirams@cs.wisc.edu>
Swaminathan Sundararaman <swami@cs.wisc.edu>
Vlad Georgescu <vgeorgescu@gmail.com>
================================================
FILE: config.lua
================================================
s2e = {
kleeArgs = {
-- Run each state for at least 30 second before
-- switching to the other:
"--use-batching-search=true", "--batch-time=30.0"
}
}
plugins = {
-- Enable a plugin that handles S2E custom opcode
"BaseInstructions"
}
================================================
FILE: docs/BuildingLinux.html
================================================
<?xml version="1.0" encoding="utf-8" ?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
<meta name="generator" content="Docutils 0.11: http://docutils.sourceforge.net/" />
<title>Compiling the Linux Kernel</title>
<link rel="stylesheet" href="./s2e.css" type="text/css" />
</head>
<body>
<div class="document" id="compiling-the-linux-kernel">
<h1 class="title">Compiling the Linux Kernel</h1>
<p>Although S2E can run any Linux kernel, it is often convenient to recompile it to suit particular needs,
e.g., to enable Kprobes, add debug information, etc.</p>
<p>This sections explains how to compile S2E on a Debian system using a <tt class="docutils literal">chroot</tt> environment.</p>
<pre class="literal-block">
$ # Install the bootstrapping environment
$ sudo apt-get install debootstrap
$ # Create the directory with the chroot environment
$ mkdir ~/debian
$ # From now on, we need root rights
$ sudo -s
$ # Create the basic chroot environment
$ debootstrap lenny debian/ http://mirror.switch.ch/ftp/mirror/debian/
$ mount -t proc proc debian/proc
$ # Activate the chroot
$ chroot ~/debian
$ # Setup devices
$ cd /dev; MAKEDEV generic; cd ..
$ # Set the locale to UTF-8, otherwise perl will complain
$ export LANGUAGE=en_US.UTF-8
$ export LANG=en_US.UTF-8
$ export LC_ALL=en_US.UTF-8
$ locale-gen en_US.UTF-8
$ dpkg-reconfigure locales
$ # Install build tools and developer's libraries for ncurses
$ apt-get install build-essential kernel-package locales libncurses-dev
$ # Download the kernel
$ mkdir /root/kernel && cd /root/kernel
$ wget http://www.kernel.org/pub/linux/kernel/v2.6/linux-2.6.26.8.tar.bz2
$ tar xjvf linux-2.6.26.8.tar.bz2
$ cd linux-2.6.26.8
$ # Select your options
$ make menuconfig
$ # Compile and generate kernel packages (that will be located in ../)
$ make-kpkg --append-to-version=-s2e --rootcmd fakeroot --cross-compile --initrd kernel_image kernel_headers
</pre>
<p>The result of the process is two <tt class="docutils literal">*.deb</tt> files that you can upload to your VM image.</p>
</div>
<div class="footer">
<hr class="footer" />
<a class="reference external" href="BuildingLinux.rst">View document source</a>.
</div>
</body>
</html>
================================================
FILE: docs/BuildingLinux.rst
================================================
==========================
Compiling the Linux Kernel
==========================
Although S2E can run any Linux kernel, it is often convenient to recompile it to suit particular needs,
e.g., to enable Kprobes, add debug information, etc.
This sections explains how to compile S2E on a Debian system using a ``chroot`` environment.
::
$ # Install the bootstrapping environment
$ sudo apt-get install debootstrap
$ # Create the directory with the chroot environment
$ mkdir ~/debian
$ # From now on, we need root rights
$ sudo -s
$ # Create the basic chroot environment
$ debootstrap lenny debian/ http://mirror.switch.ch/ftp/mirror/debian/
$ mount -t proc proc debian/proc
$ # Activate the chroot
$ chroot ~/debian
$ # Setup devices
$ cd /dev; MAKEDEV generic; cd ..
$ # Set the locale to UTF-8, otherwise perl will complain
$ export LANGUAGE=en_US.UTF-8
$ export LANG=en_US.UTF-8
$ export LC_ALL=en_US.UTF-8
$ locale-gen en_US.UTF-8
$ dpkg-reconfigure locales
$ # Install build tools and developer's libraries for ncurses
$ apt-get install build-essential kernel-package locales libncurses-dev
$ # Download the kernel
$ mkdir /root/kernel && cd /root/kernel
$ wget http://www.kernel.org/pub/linux/kernel/v2.6/linux-2.6.26.8.tar.bz2
$ tar xjvf linux-2.6.26.8.tar.bz2
$ cd linux-2.6.26.8
$ # Select your options
$ make menuconfig
$ # Compile and generate kernel packages (that will be located in ../)
$ make-kpkg --append-to-version=-s2e --rootcmd fakeroot --cross-compile --initrd kernel_image kernel_headers
The result of the process is two ``*.deb`` files that you can upload to your VM image.
================================================
FILE: docs/BuildingS2E.html
================================================
<?xml version="1.0" encoding="utf-8" ?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
<meta name="generator" content="Docutils 0.11: http://docutils.sourceforge.net/" />
<title>Building the S2E Platform</title>
<link rel="stylesheet" href="./s2e.css" type="text/css" />
</head>
<body>
<div class="document" id="building-the-s2e-platform">
<h1 class="title">Building the S2E Platform</h1>
<p>The following steps describe the installation process in detail. We assume the installation
is performed on an Ubuntu 12.04 64-bit host system (S2E also works on 64-bit Mac systems).</p>
<div class="contents topic" id="contents">
<p class="topic-title first">Contents</p>
<ul class="simple">
<li><a class="reference internal" href="#required-packages" id="id1">Required Packages</a></li>
<li><a class="reference internal" href="#checking-out-s2e" id="id2">Checking out S2E</a></li>
<li><a class="reference internal" href="#building-s2e" id="id3">Building S2E</a></li>
<li><a class="reference internal" href="#updating-s2e" id="id4">Updating S2E</a></li>
<li><a class="reference internal" href="#rebuilding-s2e-documentation" id="id5">Rebuilding S2E Documentation</a></li>
</ul>
</div>
<div class="section" id="required-packages">
<h1>Required Packages</h1>
<pre class="literal-block">
$ sudo apt-get install build-essential
$ sudo apt-get install subversion
$ sudo apt-get install git
$ sudo apt-get install gettext
$ sudo apt-get install liblua5.1-0-dev
$ sudo apt-get install libsdl1.2-dev
$ sudo apt-get install libsigc++-2.0-dev
$ sudo apt-get install binutils-dev
$ sudo apt-get install python-docutils
$ sudo apt-get install python-pygments
$ sudo apt-get install nasm
$ sudo apt-get install libiberty-dev
$ sudo apt-get install libc6-dev-i386
</pre>
<p>The following commands ask <tt class="docutils literal"><span class="pre">apt-get</span></tt> to install build dependencies for llvm-3.0
and qemu.</p>
<pre class="literal-block">
$ sudo apt-get build-dep llvm-3.3
$ sudo apt-get build-dep qemu
</pre>
</div>
<div class="section" id="checking-out-s2e">
<h1>Checking out S2E</h1>
<p>S2E source code can be obtained from the S2E GIT repository using the
following commands:</p>
<pre class="literal-block">
$ cd $S2EDIR
$ git clone https://github.com/dslab-epfl/s2e.git
</pre>
<p>This will clone the S2E repository into <tt class="docutils literal">$S2EDIR/s2e</tt>.</p>
<p>You can also clone S2E via SSH:</p>
<pre class="literal-block">
$ cd $S2EDIR
$ git clone git@github.com:dslab-epfl/s2e.git
</pre>
<p>In order to report bugs, please use GitHub's <a class="reference external" href="https://github.com/dslab-epfl/s2e/issues">issue tracker</a>. If you would like
to contribute to S2E, please create your own personal clone of S2E on GitHub, push your changes to it and then send us a
pull request.</p>
<p>You can find more information about using git on <a class="reference external" href="http://gitref.org/">http://gitref.org/</a> or on
<a class="reference external" href="http://progit.org/">http://progit.org/</a>.</p>
</div>
<div class="section" id="building-s2e">
<h1>Building S2E</h1>
<p>The recommended method of building S2E is using the S2E Makefile:</p>
<pre class="literal-block">
$ mkdir $S2EDIR/build
$ cd $S2EDIR/build
$ make -f ../s2e/Makefile
> Go make some coffee, this will take a lot of time
</pre>
<p>By default, the <tt class="docutils literal">make</tt> command compiles S2E in release mode. The resulting
binary is placed in <tt class="docutils literal"><span class="pre">$S2EDIR/build/qemu-release/i386-s2e-softmmu/qemu-system-i386</span></tt>.
To compile in Debug mode, use <tt class="docutils literal">make <span class="pre">all-debug</span></tt>. The Makefile automatically
uses the maximum number of available processors in order to speed up compilation.</p>
<p>You can also build each component of S2E manually. Refer to the Makefile for
the commands required to build all inidividual components.</p>
</div>
<div class="section" id="updating-s2e">
<h1>Updating S2E</h1>
<p>You can use the same Makefile to recompile S2E either when changing it
yourself or when pulling new versions through <tt class="docutils literal">git</tt>. Note that the Makefile
will not automatically reconfigure the packages; for deep changes you might need
to either start from scratch by issuing <tt class="docutils literal">make clean</tt> or to force
the reconfiguration of specific modules by deleting the corresponding files from
the <tt class="docutils literal">stamps</tt> subdirectory.</p>
</div>
<div class="section" id="rebuilding-s2e-documentation">
<h1>Rebuilding S2E Documentation</h1>
<p>The S2E documentation is written in <a class="reference external" href="http://docutils.sourceforge.net/rst.html">reStructuredText</a> format. For convenience, we also
keep generated HTML files in the repository. Never change HTML files
manually and always recompile them (by invoking <tt class="docutils literal">make</tt> in the docs folder)
after changing any <tt class="docutils literal">RST</tt> files.</p>
</div>
</div>
<div class="footer">
<hr class="footer" />
<a class="reference external" href="BuildingS2E.rst">View document source</a>.
</div>
</body>
</html>
================================================
FILE: docs/BuildingS2E.rst
================================================
==========================
Building the S2E Platform
==========================
The following steps describe the installation process in detail. We assume the installation
is performed on an Ubuntu 12.04 64-bit host system (S2E also works on 64-bit Mac systems).
.. contents::
Required Packages
=================
::
$ sudo apt-get install build-essential
$ sudo apt-get install subversion
$ sudo apt-get install git
$ sudo apt-get install gettext
$ sudo apt-get install liblua5.1-0-dev
$ sudo apt-get install libsdl1.2-dev
$ sudo apt-get install libsigc++-2.0-dev
$ sudo apt-get install binutils-dev
$ sudo apt-get install python-docutils
$ sudo apt-get install python-pygments
$ sudo apt-get install nasm
$ sudo apt-get install libiberty-dev
$ sudo apt-get install libc6-dev-i386
The following commands ask ``apt-get`` to install build dependencies for llvm-3.0
and qemu. ::
$ sudo apt-get build-dep llvm-3.3
$ sudo apt-get build-dep qemu
Checking out S2E
================
S2E source code can be obtained from the S2E GIT repository using the
following commands::
$ cd $S2EDIR
$ git clone https://github.com/dslab-epfl/s2e.git
This will clone the S2E repository into ``$S2EDIR/s2e``.
You can also clone S2E via SSH::
$ cd $S2EDIR
$ git clone git@github.com:dslab-epfl/s2e.git
In order to report bugs, please use GitHub's `issue tracker <https://github.com/dslab-epfl/s2e/issues>`_. If you would like
to contribute to S2E, please create your own personal clone of S2E on GitHub, push your changes to it and then send us a
pull request.
You can find more information about using git on `http://gitref.org/ <http://gitref.org/>`_ or on
`http://progit.org/ <http://progit.org/>`_.
Building S2E
============
The recommended method of building S2E is using the S2E Makefile::
$ mkdir $S2EDIR/build
$ cd $S2EDIR/build
$ make -f ../s2e/Makefile
> Go make some coffee, this will take a lot of time
By default, the ``make`` command compiles S2E in release mode. The resulting
binary is placed in ``$S2EDIR/build/qemu-release/i386-s2e-softmmu/qemu-system-i386``.
To compile in Debug mode, use ``make all-debug``. The Makefile automatically
uses the maximum number of available processors in order to speed up compilation.
You can also build each component of S2E manually. Refer to the Makefile for
the commands required to build all inidividual components.
Updating S2E
============
You can use the same Makefile to recompile S2E either when changing it
yourself or when pulling new versions through ``git``. Note that the Makefile
will not automatically reconfigure the packages; for deep changes you might need
to either start from scratch by issuing ``make clean`` or to force
the reconfiguration of specific modules by deleting the corresponding files from
the ``stamps`` subdirectory.
Rebuilding S2E Documentation
=============================
The S2E documentation is written in `reStructuredText
<http://docutils.sourceforge.net/rst.html>`_ format. For convenience, we also
keep generated HTML files in the repository. Never change HTML files
manually and always recompile them (by invoking ``make`` in the docs folder)
after changing any ``RST`` files.
================================================
FILE: docs/Contribute.html
================================================
<?xml version="1.0" encoding="utf-8" ?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
<meta name="generator" content="Docutils 0.11: http://docutils.sourceforge.net/" />
<title>Contributing to S2E</title>
<link rel="stylesheet" href="./s2e.css" type="text/css" />
</head>
<body>
<div class="document" id="contributing-to-s2e">
<h1 class="title">Contributing to S2E</h1>
<div class="section" id="submitting-patches">
<h1>Submitting patches</h1>
<p>S2E welcomes contributions of code (either fixing bugs or adding new functionality).
However, we get a lot of patches, and so we have some guidelines about submitting patches.
If you follow these, you'll help make our task of code review easier and your patch is likely to be committed faster.</p>
<p>Since S2E is based on QEMU, patch submissions mostly follow the QEMU <a class="reference external" href="http://wiki.qemu.org/Contribute/SubmitAPatch">guidelines</a>
(most of the text is taken from the QEMU wiki). Here are the relevant parts applicable to S2E.</p>
<p>All contributions to S2E must be <strong>sent as pull requests</strong> on GitHub. Please create an account and create a private fork of S2E.
Patch contributions should not be posted on the mailing list, bug tracker, posted on forums, or externally hosted and linked to.</p>
<p><strong>Patches must include a Signed-off-by: line</strong>. For more information see
<a class="reference external" href="http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=blob;f=Documentation/SubmittingPatches;h=689e2371095cc5dfea9927120009341f369159aa;hb=f6f94e2ab1b33f0082ac22d71f66385a60d8157f#l297">SubmittingPatches 1.12</a>. This is vital or we will not be able to apply your patch! Please use your real name to sign a patch (not an alias name).</p>
<p><strong>Correct English</strong> is appreciated. If you are not sure, <a class="reference external" href="http://wiki.qemu.org/Contribute/SpellCheck">codespell</a> or other programs
help finding the most common spelling mistakes in code and documentation.</p>
<p><strong>Patches should be against current git master</strong>. There's no point submitting a patch which is based on a
released version of S2E because development will have moved on from then and it probably won't even apply to master.</p>
<p><strong>Split up longer patches</strong> into a patch series of logical code changes. Each change should compile and execute successfully.
For instance, don't add a file to the makefile in patch one and then add the file itself in patch two.
(This rule is here so that people can later use tools like <a class="reference external" href="http://git-scm.com/docs/git-bisect">git bisect</a>
without hitting points in the commit history where S2E doesn't work for reasons unrelated to the bug they're chasing.)</p>
<p><strong>Patches that touch QEMU only</strong> should also be sent upstream. If your patch modifies QEMU and S2E, check whether the part
that changes QEMU could also be applied upstream. Split up the patch if necessary.</p>
<p><strong>Don't include irrelevant changes</strong>. In particular, don't include formatting, coding style or whitespace
changes to bits of code that would otherwise not be touched by the patch.
(It's OK to fix coding style issues in the immediate area (few lines) of the lines you're changing.)
If you think a section of code really does need a reindent or other large-scale style fix,
submit this as a separate patch which makes no semantic changes; don't put it in the same patch as your bug fix.</p>
<p><strong>Write a good commit message</strong>. S2E follows the usual standard for git commit messages:
the first line (which becomes the email subject line) is "single line summary of change".
Then there is a blank line and a more detailed description of the patch, another blank and your
Signed-off-by: line. Don't include comments like "This is a suggestion for fixing this bug"
(they can go below the "---" line in the email so they don't go into the final commit message).</p>
</div>
<div class="section" id="submitting-larger-contributions">
<h1>Submitting larger contributions</h1>
<p>The process for submitting larger contributions is the same as submitting bug fixes.
Everything goes through GitHub.</p>
<p>To be accepted, your code must follow the following rules:</p>
<ol class="arabic">
<li><p class="first">All files must be prefixed with the S2E copyright header.
All contributions must use the BSD 3-clause license.</p>
<p>You can use the following template:</p>
</li>
</ol>
<div class="highlight"><pre><span class="cm">/*</span>
<span class="cm"> * S2E Selective Symbolic Execution Platform</span>
<span class="cm"> *</span>
<span class="cm"> * Copyright (c) 2013, ***** YOUR COPYRIGHT ******</span>
<span class="cm"> * All rights reserved.</span>
<span class="cm"> *</span>
<span class="cm"> * Redistribution and use in source and binary forms, with or without</span>
<span class="cm"> * modification, are permitted provided that the following conditions are met:</span>
<span class="cm"> * * Redistributions of source code must retain the above copyright</span>
<span class="cm"> * notice, this list of conditions and the following disclaimer.</span>
<span class="cm"> * * Redistributions in binary form must reproduce the above copyright</span>
<span class="cm"> * notice, this list of conditions and the following disclaimer in the</span>
<span class="cm"> * documentation and/or other materials provided with the distribution.</span>
<span class="cm"> * * Neither the name of the copyright holder nor the</span>
<span class="cm"> * names of its contributors may be used to endorse or promote products</span>
<span class="cm"> * derived from this software without specific prior written permission.</span>
<span class="cm"> *</span>
<span class="cm"> * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND</span>
<span class="cm"> * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED</span>
<span class="cm"> * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE</span>
<span class="cm"> * DISCLAIMED. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE</span>
<span class="cm"> * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES</span>
<span class="cm"> * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;</span>
<span class="cm"> * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND</span>
<span class="cm"> * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT</span>
<span class="cm"> * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS</span>
<span class="cm"> * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.</span>
<span class="cm"> *</span>
<span class="cm"> * All contributors are listed in the S2E-AUTHORS file.</span>
<span class="cm"> */</span>
</pre></div>
<ol class="arabic simple" start="2">
<li>Your code must be documented. If you write a plugin, please add both the RST and the corresponding HTML file
to the documentation. The documentation should at least describe all the plugin settings and provide usage examples.
Please be as thorough as possible in the documentation. The clearer it is, the fewer questions will be asked.</li>
<li>Notes about coding style/commits/commit messages, etc. described in the previous section also apply here.</li>
</ol>
</div>
<div class="section" id="submitting-bug-reports">
<h1>Submitting bug reports</h1>
<p>We need the following to debug S2E crashes:</p>
<ol class="arabic" start="0">
<li><p class="first">Ideally, we prefer an SSH login to the machine that contains your environment so that we can
debug live. This method has been pretty effective in the past and might be the easiest for
you to set up. Otherwise, see the next points:</p>
</li>
<li><p class="first">A stack trace for the crash + <tt class="docutils literal"><span class="pre">s2e-last</span></tt> folder + git revision of the S2E source you used.
Make sure to use the latest revision of the master branch if possible.
If you have changed the S2E source or need custom plugins, first check that
you can reproduce the bug with vanilla S2E. Otherwise, please read point 3 and 4 below.</p>
</li>
<li><p class="first">An archive containing a guest image that is ready to run and a script to launch it. You must build your image in such a way that it
can be launched by a script. We should not have to type any commands or do any sort
of manipulation in the guest. We will reject your image if we spend more than 10 minutes trying
to run it.</p>
<p>Try to make the smallest image possible. If you can reproduce the bug with a 128 MB RAM guest,
do not submit an image that uses 512 MB. We prefer minimal Debian images
(no desktop, etc.), unless of course your project requires a specific setup.</p>
<p>Guest images can be quite large, feel free to use Dropbox, Gdrive, or any other
online service that suits you. Make sure that the interface for your download service is in english.
We should be able to download your image in a few clicks.</p>
<p>Before submitting, make sure that your archive (e.g., tar.gz) contains:</p>
<blockquote>
<ul class="simple">
<li>The base S2E image (<tt class="docutils literal">image.s2e</tt>)</li>
<li>The ready-to-run S2E snapshot (<tt class="docutils literal">image.s2e.ready</tt>)</li>
<li><tt class="docutils literal"><span class="pre">s2e-config.lua</span></tt> that is readable by S2E from the master branch</li>
<li><tt class="docutils literal">run.sh</tt> script that starts S2E (use relative paths for images and <tt class="docutils literal"><span class="pre">s2e-config.lua</span></tt>, no path prefix for the S2E binary)</li>
<li>Contents of <tt class="docutils literal"><span class="pre">s2e-last</span></tt> + stack trace + description of the bug</li>
</ul>
</blockquote>
</li>
</ol>
<p>If we cannot reproduce the bugs with the information you gave us above, we will ask you:</p>
<ol class="arabic simple" start="3">
<li>A Virtual Box VM containing the host environment and the S2E guest.
It must come with a Vagrant file to minimize setup time on our side.
Check that you can reproduce the bug in such an environment first.
If not, see the next point.</li>
<li>An SSH login so that we can debug live.</li>
</ol>
</div>
</div>
<div class="footer">
<hr class="footer" />
<a class="reference external" href="Contribute.rst">View document source</a>.
</div>
</body>
</html>
================================================
FILE: docs/Contribute.rst
================================================
===================
Contributing to S2E
===================
Submitting patches
==================
S2E welcomes contributions of code (either fixing bugs or adding new functionality).
However, we get a lot of patches, and so we have some guidelines about submitting patches.
If you follow these, you'll help make our task of code review easier and your patch is likely to be committed faster.
Since S2E is based on QEMU, patch submissions mostly follow the QEMU `guidelines <http://wiki.qemu.org/Contribute/SubmitAPatch>`_
(most of the text is taken from the QEMU wiki). Here are the relevant parts applicable to S2E.
All contributions to S2E must be **sent as pull requests** on GitHub. Please create an account and create a private fork of S2E.
Patch contributions should not be posted on the mailing list, bug tracker, posted on forums, or externally hosted and linked to.
**Patches must include a Signed-off-by: line**. For more information see
`SubmittingPatches 1.12 <http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=blob;f=Documentation/SubmittingPatches;h=689e2371095cc5dfea9927120009341f369159aa;hb=f6f94e2ab1b33f0082ac22d71f66385a60d8157f#l297>`_. This is vital or we will not be able to apply your patch! Please use your real name to sign a patch (not an alias name).
**Correct English** is appreciated. If you are not sure, `codespell <http://wiki.qemu.org/Contribute/SpellCheck>`_ or other programs
help finding the most common spelling mistakes in code and documentation.
**Patches should be against current git master**. There's no point submitting a patch which is based on a
released version of S2E because development will have moved on from then and it probably won't even apply to master.
**Split up longer patches** into a patch series of logical code changes. Each change should compile and execute successfully.
For instance, don't add a file to the makefile in patch one and then add the file itself in patch two.
(This rule is here so that people can later use tools like `git bisect <http://git-scm.com/docs/git-bisect>`_
without hitting points in the commit history where S2E doesn't work for reasons unrelated to the bug they're chasing.)
**Patches that touch QEMU only** should also be sent upstream. If your patch modifies QEMU and S2E, check whether the part
that changes QEMU could also be applied upstream. Split up the patch if necessary.
**Don't include irrelevant changes**. In particular, don't include formatting, coding style or whitespace
changes to bits of code that would otherwise not be touched by the patch.
(It's OK to fix coding style issues in the immediate area (few lines) of the lines you're changing.)
If you think a section of code really does need a reindent or other large-scale style fix,
submit this as a separate patch which makes no semantic changes; don't put it in the same patch as your bug fix.
**Write a good commit message**. S2E follows the usual standard for git commit messages:
the first line (which becomes the email subject line) is "single line summary of change".
Then there is a blank line and a more detailed description of the patch, another blank and your
Signed-off-by: line. Don't include comments like "This is a suggestion for fixing this bug"
(they can go below the "---" line in the email so they don't go into the final commit message).
Submitting larger contributions
===============================
The process for submitting larger contributions is the same as submitting bug fixes.
Everything goes through GitHub.
To be accepted, your code must follow the following rules:
1. All files must be prefixed with the S2E copyright header.
All contributions must use the BSD 3-clause license.
You can use the following template:
.. code-block:: c
/*
* S2E Selective Symbolic Execution Platform
*
* Copyright (c) 2013, ***** YOUR COPYRIGHT ******
* All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions are met:
* * Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
* * Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in the
* documentation and/or other materials provided with the distribution.
* * Neither the name of the copyright holder nor the
* names of its contributors may be used to endorse or promote products
* derived from this software without specific prior written permission.
*
* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
* WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
* DISCLAIMED. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
* (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
* LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
* ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
* SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
*
* All contributors are listed in the S2E-AUTHORS file.
*/
2. Your code must be documented. If you write a plugin, please add both the RST and the corresponding HTML file
to the documentation. The documentation should at least describe all the plugin settings and provide usage examples.
Please be as thorough as possible in the documentation. The clearer it is, the fewer questions will be asked.
3. Notes about coding style/commits/commit messages, etc. described in the previous section also apply here.
Submitting bug reports
======================
We need the following to debug S2E crashes:
0. Ideally, we prefer an SSH login to the machine that contains your environment so that we can
debug live. This method has been pretty effective in the past and might be the easiest for
you to set up. Otherwise, see the next points:
1. A stack trace for the crash + ``s2e-last`` folder + git revision of the S2E source you used.
Make sure to use the latest revision of the master branch if possible.
If you have changed the S2E source or need custom plugins, first check that
you can reproduce the bug with vanilla S2E. Otherwise, please read point 3 and 4 below.
2. An archive containing a guest image that is ready to run and a script to launch it. You must build your image in such a way that it
can be launched by a script. We should not have to type any commands or do any sort
of manipulation in the guest. We will reject your image if we spend more than 10 minutes trying
to run it.
Try to make the smallest image possible. If you can reproduce the bug with a 128 MB RAM guest,
do not submit an image that uses 512 MB. We prefer minimal Debian images
(no desktop, etc.), unless of course your project requires a specific setup.
Guest images can be quite large, feel free to use Dropbox, Gdrive, or any other
online service that suits you. Make sure that the interface for your download service is in english.
We should be able to download your image in a few clicks.
Before submitting, make sure that your archive (e.g., tar.gz) contains:
- The base S2E image (``image.s2e``)
- The ready-to-run S2E snapshot (``image.s2e.ready``)
- ``s2e-config.lua`` that is readable by S2E from the master branch
- ``run.sh`` script that starts S2E (use relative paths for images and ``s2e-config.lua``, no path prefix for the S2E binary)
- Contents of ``s2e-last`` + stack trace + description of the bug
If we cannot reproduce the bugs with the information you gave us above, we will ask you:
3. A Virtual Box VM containing the host environment and the S2E guest.
It must come with a Vagrant file to minimize setup time on our side.
Check that you can reproduce the bug in such an environment first.
If not, see the next point.
4. An SSH login so that we can debug live.
================================================
FILE: docs/EquivalenceTesting.html
================================================
<?xml version="1.0" encoding="utf-8" ?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
<meta name="generator" content="Docutils 0.11: http://docutils.sourceforge.net/" />
<title>Equivalence Testing</title>
<link rel="stylesheet" href="./s2e.css" type="text/css" />
</head>
<body>
<div class="document" id="equivalence-testing">
<h1 class="title">Equivalence Testing</h1>
<p>Given two functions <tt class="docutils literal">f</tt> and <tt class="docutils literal">g</tt>, we would like to check
whether for all input, they produce the same output. In other words, we verify
whether <tt class="docutils literal">f</tt> and <tt class="docutils literal">g</tt> are equivalent.</p>
<p>Equivalence testing is useful to check that two implementations of the same
algorithm produce identical results. E.g., scripts may parse the output of
some tools (e.g., ls) and thus expect certain behavior. The developers
of alternative and compatible implementations (e.g., ls for Busybox)
of such tools can use equivalence testing to gain confidence that their
implementation behaves in the same way. Another example is to check the equivalence
of two implementations of the same protocol (e.g., TCP/IP).</p>
<p>In this tutorial, we show how to perform equivalence testing with S2E.
At a high level, this is done by passing identical symbolic inputs to the functions,
letting S2E explore the execution tree, and when both functions return, check whether
they produced the same output (e.g., with an assertion check).</p>
<div class="section" id="program-to-test">
<h1>Program to Test</h1>
<p>This sample program contains two implementations of the factorial algorithm that
we want to test for equivalence.
Both implementations behave in the same way except in some corner cases.</p>
<div class="highlight"><pre><span class="cp">#include <inttypes.h></span>
<span class="cp">#include <s2e.h></span>
<span class="cm">/**</span>
<span class="cm"> * Computes x!</span>
<span class="cm"> * If x > max, computes max!</span>
<span class="cm"> */</span>
<span class="kt">uint64_t</span> <span class="nf">factorial1</span><span class="p">(</span><span class="kt">uint64_t</span> <span class="n">x</span><span class="p">,</span> <span class="kt">uint64_t</span> <span class="n">max</span><span class="p">)</span> <span class="p">{</span>
<span class="kt">uint64_t</span> <span class="n">ret</span> <span class="o">=</span> <span class="mi">1</span><span class="p">;</span>
<span class="k">for</span> <span class="p">(</span><span class="kt">uint64_t</span> <span class="n">i</span> <span class="o">=</span> <span class="mi">1</span><span class="p">;</span> <span class="n">i</span><span class="o"><=</span><span class="n">x</span> <span class="o">&&</span> <span class="n">i</span><span class="o"><=</span><span class="n">max</span><span class="p">;</span> <span class="o">++</span><span class="n">i</span><span class="p">)</span> <span class="p">{</span>
<span class="n">ret</span> <span class="o">=</span> <span class="n">ret</span> <span class="o">*</span> <span class="n">i</span><span class="p">;</span>
<span class="p">}</span>
<span class="k">return</span> <span class="n">ret</span><span class="p">;</span>
<span class="p">}</span>
<span class="cm">/**</span>
<span class="cm"> * Computes x!</span>
<span class="cm"> * If x > max, computes max!</span>
<span class="cm"> */</span>
<span class="kt">uint64_t</span> <span class="nf">factorial2</span><span class="p">(</span><span class="kt">uint64_t</span> <span class="n">x</span><span class="p">,</span> <span class="kt">uint64_t</span> <span class="n">max</span><span class="p">)</span> <span class="p">{</span>
<span class="k">if</span> <span class="p">(</span><span class="n">x</span> <span class="o">></span> <span class="n">max</span><span class="p">)</span> <span class="p">{</span>
<span class="k">return</span> <span class="n">max</span><span class="p">;</span>
<span class="p">}</span>
<span class="k">if</span> <span class="p">(</span><span class="n">x</span> <span class="o">==</span> <span class="mi">1</span><span class="p">)</span> <span class="p">{</span>
<span class="k">return</span> <span class="n">x</span><span class="p">;</span>
<span class="p">}</span>
<span class="k">return</span> <span class="n">x</span> <span class="o">*</span> <span class="n">factorial2</span><span class="p">(</span><span class="n">x</span><span class="o">-</span><span class="mi">1</span><span class="p">,</span> <span class="n">max</span><span class="p">);</span>
<span class="p">}</span>
<span class="kt">int</span> <span class="nf">main</span><span class="p">()</span> <span class="p">{</span>
<span class="kt">uint64_t</span> <span class="n">x</span><span class="p">;</span>
<span class="kt">uint64_t</span> <span class="n">max</span> <span class="o">=</span> <span class="mi">10</span><span class="p">;</span>
<span class="c1">//Make x symbolic</span>
<span class="n">s2e_make_symbolic</span><span class="p">(</span><span class="o">&</span><span class="n">x</span><span class="p">,</span> <span class="k">sizeof</span><span class="p">(</span><span class="n">x</span><span class="p">),</span> <span class="s">"x"</span><span class="p">);</span>
<span class="n">s2e_enable_forking</span><span class="p">();</span>
<span class="kt">uint64_t</span> <span class="n">f1</span> <span class="o">=</span> <span class="n">factorial1</span><span class="p">(</span><span class="n">x</span><span class="p">,</span> <span class="n">max</span><span class="p">);</span>
<span class="kt">uint64_t</span> <span class="n">f2</span> <span class="o">=</span> <span class="n">factorial2</span><span class="p">(</span><span class="n">x</span><span class="p">,</span> <span class="n">max</span><span class="p">);</span>
<span class="c1">//Check the equivalence of the two functions for each path</span>
<span class="n">s2e_assert</span><span class="p">(</span><span class="n">f1</span> <span class="o">==</span> <span class="n">f2</span><span class="p">);</span>
<span class="c1">//In case of success, terminate the state with the</span>
<span class="c1">//appropriate message</span>
<span class="n">s2e_kill_state</span><span class="p">(</span><span class="mi">0</span><span class="p">,</span> <span class="s">"Success"</span><span class="p">);</span>
<span class="k">return</span> <span class="mi">0</span><span class="p">;</span>
<span class="p">}</span>
</pre></div>
<p>Compile it as follows after adapting the include path:</p>
<pre class="literal-block">
$ gcc -I /home/user/s2e/guest/include/ -std=c99 -o factorial factorial.c
</pre>
</div>
<div class="section" id="configuring-s2e">
<h1>Configuring S2E</h1>
<p>We will instruct S2E to compute test cases at the end of each execution path (i.e., when
<tt class="docutils literal">s2e_kill_state</tt> is called), in order to reproduce potential assertion failures on
our own. A test case consists of concrete program inputs that would drive the program down
the corresponding execution path.</p>
<div class="highlight"><pre><span class="c1">-- File: config.lua</span>
<span class="n">s2e</span> <span class="o">=</span> <span class="p">{</span>
<span class="n">kleeArgs</span> <span class="o">=</span> <span class="p">{</span>
<span class="c1">--Switch states only when the current one terminates</span>
<span class="s2">"</span><span class="s">--use-dfs-search"</span>
<span class="p">}</span>
<span class="p">}</span>
<span class="n">plugins</span> <span class="o">=</span> <span class="p">{</span>
<span class="c1">-- Enable S2E custom opcodes</span>
<span class="s2">"</span><span class="s">BaseInstructions"</span><span class="p">,</span>
<span class="c1">-- Basic tracing required for test case generation</span>
<span class="s2">"</span><span class="s">ExecutionTracer"</span><span class="p">,</span>
<span class="c1">-- Enable the test case generator plugin</span>
<span class="s2">"</span><span class="s">TestCaseGenerator"</span>
<span class="p">}</span>
</pre></div>
</div>
<div class="section" id="running-the-program-in-s2e">
<h1>Running the Program in S2E</h1>
<p>Run the program in S2E. Refer to <a class="reference external" href="TestingMinimalProgram.html">this tuorial</a> for more details.
S2E will exit when all paths terminate.</p>
<p>Make sure to have at least 8 GB of available virtual memory
and set the stack size to unlimited using <tt class="docutils literal">ulimit <span class="pre">-s</span> unlimited</tt>.</p>
</div>
<div class="section" id="interpreting-the-results">
<h1>Interpreting the Results</h1>
<p>After the run, the <tt class="docutils literal"><span class="pre">s2e-last/messages.txt</span></tt> file contains the following output:</p>
<ul class="simple">
<li>Messages explaining the reason why each state terminated (either success or failure)</li>
<li>The concrete input that would allow replaying the same path independently of S2E</li>
</ul>
<p>For several states, we see the following type of message:</p>
<pre class="literal-block">
message: "Assertion failed: f1 == f2"
TestCaseGenerator: processTestCase of state 0 at address 0x8048525
x: 7f 7f 7f 7f 7f 7f 7f 7f
</pre>
<p>This indicates that when <tt class="docutils literal">x == 0x7f7f7f7f7f7f7f7f</tt>, the two implementations of
factorial produce a different output. To reproduce this behavior, take the computed value for x
(it is displayed in little endian format by the test case generator),
plug it into the original program, and run the program in a debugger to understand what happens.
When you fixed the deviating behavior, rerun the program again in S2E, until all states terminate
with a success.</p>
</div>
</div>
<div class="footer">
<hr class="footer" />
<a class="reference external" href="EquivalenceTesting.rst">View document source</a>.
</div>
</body>
</html>
================================================
FILE: docs/EquivalenceTesting.rst
================================================
===================
Equivalence Testing
===================
Given two functions ``f`` and ``g``, we would like to check
whether for all input, they produce the same output. In other words, we verify
whether ``f`` and ``g`` are equivalent.
Equivalence testing is useful to check that two implementations of the same
algorithm produce identical results. E.g., scripts may parse the output of
some tools (e.g., ls) and thus expect certain behavior. The developers
of alternative and compatible implementations (e.g., ls for Busybox)
of such tools can use equivalence testing to gain confidence that their
implementation behaves in the same way. Another example is to check the equivalence
of two implementations of the same protocol (e.g., TCP/IP).
In this tutorial, we show how to perform equivalence testing with S2E.
At a high level, this is done by passing identical symbolic inputs to the functions,
letting S2E explore the execution tree, and when both functions return, check whether
they produced the same output (e.g., with an assertion check).
Program to Test
===============
This sample program contains two implementations of the factorial algorithm that
we want to test for equivalence.
Both implementations behave in the same way except in some corner cases.
.. code-block:: c
#include <inttypes.h>
#include <s2e.h>
/**
* Computes x!
* If x > max, computes max!
*/
uint64_t factorial1(uint64_t x, uint64_t max) {
uint64_t ret = 1;
for (uint64_t i = 1; i<=x && i<=max; ++i) {
ret = ret * i;
}
return ret;
}
/**
* Computes x!
* If x > max, computes max!
*/
uint64_t factorial2(uint64_t x, uint64_t max) {
if (x > max) {
return max;
}
if (x == 1) {
return x;
}
return x * factorial2(x-1, max);
}
int main() {
uint64_t x;
uint64_t max = 10;
//Make x symbolic
s2e_make_symbolic(&x, sizeof(x), "x");
s2e_enable_forking();
uint64_t f1 = factorial1(x, max);
uint64_t f2 = factorial2(x, max);
//Check the equivalence of the two functions for each path
s2e_assert(f1 == f2);
//In case of success, terminate the state with the
//appropriate message
s2e_kill_state(0, "Success");
return 0;
}
Compile it as follows after adapting the include path:
::
$ gcc -I /home/user/s2e/guest/include/ -std=c99 -o factorial factorial.c
Configuring S2E
===============
We will instruct S2E to compute test cases at the end of each execution path (i.e., when
``s2e_kill_state`` is called), in order to reproduce potential assertion failures on
our own. A test case consists of concrete program inputs that would drive the program down
the corresponding execution path.
.. code-block:: lua
-- File: config.lua
s2e = {
kleeArgs = {
--Switch states only when the current one terminates
"--use-dfs-search"
}
}
plugins = {
-- Enable S2E custom opcodes
"BaseInstructions",
-- Basic tracing required for test case generation
"ExecutionTracer",
-- Enable the test case generator plugin
"TestCaseGenerator"
}
Running the Program in S2E
==========================
Run the program in S2E. Refer to `this tuorial <TestingMinimalProgram.html>`_ for more details.
S2E will exit when all paths terminate.
Make sure to have at least 8 GB of available virtual memory
and set the stack size to unlimited using ``ulimit -s unlimited``.
Interpreting the Results
========================
After the run, the ``s2e-last/messages.txt`` file contains the following output:
* Messages explaining the reason why each state terminated (either success or failure)
* The concrete input that would allow replaying the same path independently of S2E
For several states, we see the following type of message:
::
message: "Assertion failed: f1 == f2"
TestCaseGenerator: processTestCase of state 0 at address 0x8048525
x: 7f 7f 7f 7f 7f 7f 7f 7f
This indicates that when ``x == 0x7f7f7f7f7f7f7f7f``, the two implementations of
factorial produce a different output. To reproduce this behavior, take the computed value for x
(it is displayed in little endian format by the test case generator),
plug it into the original program, and run the program in a debugger to understand what happens.
When you fixed the deviating behavior, rerun the program again in S2E, until all states terminate
with a success.
================================================
FILE: docs/FAQ.html
================================================
<?xml version="1.0" encoding="utf-8" ?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
<meta name="generator" content="Docutils 0.11: http://docutils.sourceforge.net/" />
<title>Frequently Asked Questions (FAQ)</title>
<link rel="stylesheet" href="./s2e.css" type="text/css" />
</head>
<body>
<div class="document" id="frequently-asked-questions-faq">
<h1 class="title">Frequently Asked Questions (FAQ)</h1>
<div class="contents topic" id="contents">
<p class="topic-title first">Contents</p>
<ul class="auto-toc simple">
<li><a class="reference internal" href="#s2e" id="id1">1 S2E</a><ul class="auto-toc">
<li><a class="reference internal" href="#how-do-i-know-what-s2e-is-doing" id="id2">1.1 How do I know what S2E is doing?</a></li>
<li><a class="reference internal" href="#execution-seems-stuck-slow-what-to-do" id="id3">1.2 Execution seems stuck/slow. What to do?</a></li>
<li><a class="reference internal" href="#how-do-i-deal-with-path-explosion" id="id4">1.3 How do I deal with path explosion?</a></li>
<li><a class="reference internal" href="#how-to-keep-memory-usage-low" id="id5">1.4 How to keep memory usage low?</a></li>
<li><a class="reference internal" href="#how-much-time-is-the-constraint-solver-taking-to-solve-constraints" id="id6">1.5 How much time is the constraint solver taking to solve constraints?</a></li>
<li><a class="reference internal" href="#what-do-the-various-fields-in-run-stats-mean" id="id7">1.6 What do the various fields in <tt class="docutils literal">run.stats</tt> mean?</a></li>
</ul>
</li>
</ul>
</div>
<div class="section" id="s2e">
<h1>1 S2E</h1>
<div class="section" id="how-do-i-know-what-s2e-is-doing">
<h2>1.1 How do I know what S2E is doing?</h2>
<ol class="arabic">
<li><p class="first">Enable execution tracing and use the fork profiler to identify the code locations that fork the most.
In your LUA file, enable the <tt class="docutils literal">ExecutionTracer</tt>, <tt class="docutils literal">ModuleTracer</tt> and the <tt class="docutils literal">ModuleExecutionDetector</tt> plugins.
This will allow you to collect all fork locations. Additionally, you can use <tt class="docutils literal">TranslationBlockTracer</tt> in order to
have a detailed trace for each execution path, which you can view with the <tt class="docutils literal">tbtrace</tt> tool. Finally, <tt class="docutils literal">TranslationBlockTracer</tt>
allows you to use the basic block <a class="reference external" href="Tools/CoverageGenerator.html">coverage</a> tool.</p>
</li>
<li><p class="first">Look at <tt class="docutils literal"><span class="pre">s2e-last/debug.txt</span></tt> and other files.
These files list all the major events occurring during symbolic execution.</p>
<p>S2E outputs "Firing timer event" into <tt class="docutils literal"><span class="pre">s2e-last/debug.txt</span></tt> once per second.
If you do not see this event every second,
it means that QEMU is stuck running plugin code (most likely because of a plugin bug)
or constraint solver code (because of a complex query).
To see which query is causing the problem, look at the query log.</p>
</li>
<li><p class="first"><tt class="docutils literal">run.stats</tt> contains many types of statistics. S2E updates this file about every second,
when executing symbolic code. See later in this FAQ for a description of its fields.</p>
</li>
</ol>
</div>
<div class="section" id="execution-seems-stuck-slow-what-to-do">
<h2>1.2 Execution seems stuck/slow. What to do?</h2>
<p>First, ensure that you configured S2E properly.</p>
<ul class="simple">
<li>If you used <tt class="docutils literal">s2e_disable_all_apic_interrupts</tt>, you probably forgot an <tt class="docutils literal">s2e_enable_all_apic_interrupts</tt> call somewhere in your code.
Use this functionality with care, disabling interrupts can easily hang your guest OS.</li>
<li>Some constraints are hard to solve. Set a timeout in the constraint solver with <tt class="docutils literal"><span class="pre">--use-forked-stp</span></tt> and <tt class="docutils literal"><span class="pre">--max-stp-time=TimeoutInSeconds</span></tt>.
If you do not see the "Firing timer event" message periodically in the <tt class="docutils literal">debug.txt</tt> log file, execution got stuck in the
constraint solver.</li>
<li>By default, S2E flushes the translation block cache on every state switch.
S2E does not implement copy-on-write for this cache, therefore it must flush
the cache to ensure correct execution. Flushing avoids clobbering in case
there are two paths that execute different pieces of code loaded at the same memory locations.
Flushing is <em>very</em> expensive in case of frequent state switches. In most of the cases, flushing is not necessary, e.g., if you
execute a program that does not use self-modifying code or frequently loads/unloads libraries. In this case,
use the <tt class="docutils literal"><span class="pre">--flush-tbs-on-state-switch=false</span></tt> option.</li>
<li>Make sure your VM image is minimal for the components you want to test. In most cases, it should not have swap enabled
and all unnecessary background deamons should be disabled. Refer to the <a class="reference external" href="ImageInstallation.html">image installation</a> tutorial for
more information.</li>
</ul>
<p>Second, throw hardware at your problem</p>
<ul class="simple">
<li>Refer to the "<a class="reference external" href="Howtos/Parallel.html">How to run S2E on multiple cores</a>" tutorial for instructions.</li>
</ul>
<p>Third, use S2E to <em>selectively</em> relax and/or overconstrain path constraints.</p>
<ul class="simple">
<li>Understanding what to select can be made considerably easier if you <a class="reference external" href="Howtos/Debugging.html">attach a debugger</a> to the S2E instance.</li>
<li>Check that the module under analysis is not doing unnecessary calls with symbolic arguments (e.g., <tt class="docutils literal">printf</tt>).
Use the <tt class="docutils literal">s2e_get_example_*</tt> functions to provide a concrete value to <tt class="docutils literal">printf</tt> without actually adding path
constraints, to avoid disabling future paths. Unless a program reads the output of <tt class="docutils literal">printf</tt> and takes decisions
based on it, not adding constraints will not affect execution consistency from the point of view of the module under analysis.</li>
<li>If you use a depth-first search and execution hits a polling loop, rapid forking may occur and execution may never exit the loop.
Moreover, depending on the accumulated constraints, each iteration may be slower and slower.
Try to use a different search strategy or kill unwanted execution paths.</li>
<li>Try to relax path constraints. For example, there may be a branch that causes a bottleneck. Use the <em>Annotation</em> plugin to intercept
that branch instruction and overwrite the branch condition with an unconstrained value. This trades execution consistency
for execution speed. Unconstraining execution may create paths that cannot occur in real executions (i.e., false positives), but as long as there
are few of them, or you can detect them a posteriori, this is an acceptable trade-off.</li>
</ul>
</div>
<div class="section" id="how-do-i-deal-with-path-explosion">
<h2>1.3 How do I deal with path explosion?</h2>
<p>Use S2E to <em>selectively</em> kill paths that are not interesting and prevent forking outside modules of interest.
The following describes concrete steps that allowed us to explore programs most efficiently.</p>
<ol class="arabic simple">
<li>Run your program with minimum symbolic input (e.g., 1 byte) and with tracing enabled (see first section).</li>
<li>Insert more and more symbolic values until path explosion occurs (i.e., it takes too long for you to explore all the paths
or it takes too much memory/CPU resources).</li>
<li>Extract the fork profile and identify the code locations that fork the most.</li>
<li>If forking occurs outside the module of interest, the following may help:<ul>
<li>Use the CodeSelector plugin to disable forking when execution leaves the module of interest</li>
<li>Concretize some symbolic values when execution leaves the module of interest. You may need to use the <tt class="docutils literal">FunctionMonitor</tt> plugin
to track function calls and concretize parameters.</li>
<li>Provide example values to library functions (e.g., to <tt class="docutils literal">printf</tt>, as described previously)</li>
</ul>
</li>
<li>Kill the paths that you are not interested in:<ul>
<li>You may only want to explore error-free paths. For example, kill all those where library functions fail.</li>
<li>You may only be interested in error recovery code. In this case, kill all the paths in which no errors occur.</li>
<li>Write a custom plugin that probes the program's state to decide when to kill the path.</li>
<li>If you exercise multiple entry points of a library (e.g., a device driver), it may make sense to choose only
one successful path when an entry point exits and kill all the others. Use the <a class="reference external" href="Plugins/StateManager.html">StateManager</a> plugin to suspend
the execution of all paths that returned from a library function until one return succeeds.</li>
<li>Kill back-edges of polling loops using the <a class="reference external" href="Plugins/EdgeKiller.html">EdgeKiller</a> plugin. You can also use
this plugin when execution enters some block of code (e.g., error recovery).</li>
</ul>
</li>
<li>Prioritize paths according to a metric that makes sense for your problem.
This may be done by writing a custom state searcher plugin. S2E comes with several examples of searchers that aim to maximize code coverage
as fast as possible.</li>
</ol>
</div>
<div class="section" id="how-to-keep-memory-usage-low">
<h2>1.4 How to keep memory usage low?</h2>
<p>You can use several options, depending on your needs.</p>
<ul class="simple">
<li>Enable the shared framebuffer. By default, each state writes to its own framebuffer, which
may add up to several megabytes to each state. However, it often does not matter what appears on
the screen. In such case, use the <tt class="docutils literal"><span class="pre">--state-shared-memory=true</span></tt> option.</li>
<li>Disable forking when a memory limit is reached
using the following KLEE options: <tt class="docutils literal"><span class="pre">--max-memory-inhibit</span></tt> and <tt class="docutils literal"><span class="pre">--max-memory=MemoryLimitInMB</span></tt>.</li>
<li>Explicitly kill unneeded paths. For example, if you want to achieve high code coverage and
know that some path is unlikely to cover any new code, kill it.</li>
</ul>
</div>
<div class="section" id="how-much-time-is-the-constraint-solver-taking-to-solve-constraints">
<h2>1.5 How much time is the constraint solver taking to solve constraints?</h2>
<p>Enable logging for constraint solving queries:</p>
<pre class="literal-block">
s2e = {
kleeArgs = {
"--use-query-log", "--use-query-pc-log", "--use-stp-query-pc-log"
}
</pre>
<p>With this configuration S2E generates two logs: <tt class="docutils literal"><span class="pre">s2e-last/queries.pc</span></tt> and <tt class="docutils literal"><span class="pre">s2e-last/stp-queries.qlog</span></tt>.
Look for "Elapsed time" in the logs.</p>
</div>
<div class="section" id="what-do-the-various-fields-in-run-stats-mean">
<h2>1.6 What do the various fields in <tt class="docutils literal">run.stats</tt> mean?</h2>
<p>You can open <tt class="docutils literal">run.stats</tt> in a spreadsheet as a CSV file.
Most of the fields are self-explanatory. Here are the trickiest ones:</p>
<ul class="simple">
<li><tt class="docutils literal">QueryTime</tt> shows how much time KLEE spent in the STP solver.</li>
<li><tt class="docutils literal">CexCacheTime</tt> adds to that time also the time spent while looking
for a solution in a counter-example cache (which is enabled by the
<tt class="docutils literal"><span class="pre">--use-cex-cache</span></tt> KLEE option).
SolverTime shows how much time KLEE spent in total while solving queries
(this includes all the solver optimizations that could be enabled by various solver-related KLEE options).</li>
<li><tt class="docutils literal">ResolveTime</tt> represents time that KLEE spent resolving symbolic
memory addresses, however in S2E this is not computed correctly yet.</li>
<li><tt class="docutils literal">ForkTime</tt> shows how much time KLEE spent on forking states.</li>
</ul>
</div>
</div>
</div>
<div class="footer">
<hr class="footer" />
<a class="reference external" href="FAQ.rst">View document source</a>.
</div>
</body>
</html>
================================================
FILE: docs/FAQ.rst
================================================
======================================
Frequently Asked Questions (FAQ)
======================================
.. contents::
.. sectnum::
S2E
===
How do I know what S2E is doing?
--------------------------------
1. Enable execution tracing and use the fork profiler to identify the code locations that fork the most.
In your LUA file, enable the ``ExecutionTracer``, ``ModuleTracer`` and the ``ModuleExecutionDetector`` plugins.
This will allow you to collect all fork locations. Additionally, you can use ``TranslationBlockTracer`` in order to
have a detailed trace for each execution path, which you can view with the ``tbtrace`` tool. Finally, ``TranslationBlockTracer``
allows you to use the basic block `coverage <Tools/CoverageGenerator.html>`_ tool.
2. Look at ``s2e-last/debug.txt`` and other files.
These files list all the major events occurring during symbolic execution.
S2E outputs "Firing timer event" into ``s2e-last/debug.txt`` once per second.
If you do not see this event every second,
it means that QEMU is stuck running plugin code (most likely because of a plugin bug)
or constraint solver code (because of a complex query).
To see which query is causing the problem, look at the query log.
3. ``run.stats`` contains many types of statistics. S2E updates this file about every second,
when executing symbolic code. See later in this FAQ for a description of its fields.
Execution seems stuck/slow. What to do?
---------------------------------------
First, ensure that you configured S2E properly.
* If you used ``s2e_disable_all_apic_interrupts``, you probably forgot an ``s2e_enable_all_apic_interrupts`` call somewhere in your code.
Use this functionality with care, disabling interrupts can easily hang your guest OS.
* Some constraints are hard to solve. Set a timeout in the constraint solver with ``--use-forked-stp`` and ``--max-stp-time=TimeoutInSeconds``.
If you do not see the "Firing timer event" message periodically in the ``debug.txt`` log file, execution got stuck in the
constraint solver.
* By default, S2E flushes the translation block cache on every state switch.
S2E does not implement copy-on-write for this cache, therefore it must flush
the cache to ensure correct execution. Flushing avoids clobbering in case
there are two paths that execute different pieces of code loaded at the same memory locations.
Flushing is *very* expensive in case of frequent state switches. In most of the cases, flushing is not necessary, e.g., if you
execute a program that does not use self-modifying code or frequently loads/unloads libraries. In this case,
use the ``--flush-tbs-on-state-switch=false`` option.
* Make sure your VM image is minimal for the components you want to test. In most cases, it should not have swap enabled
and all unnecessary background deamons should be disabled. Refer to the `image installation <ImageInstallation.html>`_ tutorial for
more information.
Second, throw hardware at your problem
* Refer to the "`How to run S2E on multiple cores <Howtos/Parallel.html>`_" tutorial for instructions.
Third, use S2E to *selectively* relax and/or overconstrain path constraints.
* Understanding what to select can be made considerably easier if you `attach a debugger <Howtos/Debugging.html>`_ to the S2E instance.
* Check that the module under analysis is not doing unnecessary calls with symbolic arguments (e.g., ``printf``).
Use the ``s2e_get_example_*`` functions to provide a concrete value to ``printf`` without actually adding path
constraints, to avoid disabling future paths. Unless a program reads the output of ``printf`` and takes decisions
based on it, not adding constraints will not affect execution consistency from the point of view of the module under analysis.
* If you use a depth-first search and execution hits a polling loop, rapid forking may occur and execution may never exit the loop.
Moreover, depending on the accumulated constraints, each iteration may be slower and slower.
Try to use a different search strategy or kill unwanted execution paths.
* Try to relax path constraints. For example, there may be a branch that causes a bottleneck. Use the *Annotation* plugin to intercept
that branch instruction and overwrite the branch condition with an unconstrained value. This trades execution consistency
for execution speed. Unconstraining execution may create paths that cannot occur in real executions (i.e., false positives), but as long as there
are few of them, or you can detect them a posteriori, this is an acceptable trade-off.
How do I deal with path explosion?
-----------------------------------
Use S2E to *selectively* kill paths that are not interesting and prevent forking outside modules of interest.
The following describes concrete steps that allowed us to explore programs most efficiently.
1. Run your program with minimum symbolic input (e.g., 1 byte) and with tracing enabled (see first section).
2. Insert more and more symbolic values until path explosion occurs (i.e., it takes too long for you to explore all the paths
or it takes too much memory/CPU resources).
3. Extract the fork profile and identify the code locations that fork the most.
4. If forking occurs outside the module of interest, the following may help:
* Use the CodeSelector plugin to disable forking when execution leaves the module of interest
* Concretize some symbolic values when execution leaves the module of interest. You may need to use the ``FunctionMonitor`` plugin
to track function calls and concretize parameters.
* Provide example values to library functions (e.g., to ``printf``, as described previously)
5. Kill the paths that you are not interested in:
* You may only want to explore error-free paths. For example, kill all those where library functions fail.
* You may only be interested in error recovery code. In this case, kill all the paths in which no errors occur.
* Write a custom plugin that probes the program's state to decide when to kill the path.
* If you exercise multiple entry points of a library (e.g., a device driver), it may make sense to choose only
one successful path when an entry point exits and kill all the others. Use the `StateManager <Plugins/StateManager.html>`_ plugin to suspend
the execution of all paths that returned from a library function until one return succeeds.
* Kill back-edges of polling loops using the `EdgeKiller <Plugins/EdgeKiller.html>`_ plugin. You can also use
this plugin when execution enters some block of code (e.g., error recovery).
6. Prioritize paths according to a metric that makes sense for your problem.
This may be done by writing a custom state searcher plugin. S2E comes with several examples of searchers that aim to maximize code coverage
as fast as possible.
How to keep memory usage low?
-------------------------------
You can use several options, depending on your needs.
* Enable the shared framebuffer. By default, each state writes to its own framebuffer, which
may add up to several megabytes to each state. However, it often does not matter what appears on
the screen. In such case, use the ``--state-shared-memory=true`` option.
* Disable forking when a memory limit is reached
using the following KLEE options: ``--max-memory-inhibit`` and ``--max-memory=MemoryLimitInMB``.
* Explicitly kill unneeded paths. For example, if you want to achieve high code coverage and
know that some path is unlikely to cover any new code, kill it.
How much time is the constraint solver taking to solve constraints?
-------------------------------------------------------------------
Enable logging for constraint solving queries:
::
s2e = {
kleeArgs = {
"--use-query-log", "--use-query-pc-log", "--use-stp-query-pc-log"
}
With this configuration S2E generates two logs: ``s2e-last/queries.pc`` and ``s2e-last/stp-queries.qlog``.
Look for "Elapsed time" in the logs.
What do the various fields in ``run.stats`` mean?
-------------------------------------------------
You can open ``run.stats`` in a spreadsheet as a CSV file.
Most of the fields are self-explanatory. Here are the trickiest ones:
* ``QueryTime`` shows how much time KLEE spent in the STP solver.
* ``CexCacheTime`` adds to that time also the time spent while looking
for a solution in a counter-example cache (which is enabled by the
``--use-cex-cache`` KLEE option).
SolverTime shows how much time KLEE spent in total while solving queries
(this includes all the solver optimizations that could be enabled by various solver-related KLEE options).
* ``ResolveTime`` represents time that KLEE spent resolving symbolic
memory addresses, however in S2E this is not computed correctly yet.
* ``ForkTime`` shows how much time KLEE spent on forking states.
================================================
FILE: docs/Howtos/Concolic.html
================================================
<?xml version="1.0" encoding="utf-8" ?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
<meta name="generator" content="Docutils 0.11: http://docutils.sourceforge.net/" />
<title>Analyzing Large Programs Using Concolic Execution</title>
<link rel="stylesheet" href="../s2e.css" type="text/css" />
</head>
<body>
<div class="document" id="analyzing-large-programs-using-concolic-execution">
<h1 class="title">Analyzing Large Programs Using Concolic Execution</h1>
<p>In the previous tutorials, we have seen how to use symbolic execution in order
to explore different program paths. In practice, symbolic execution
requires the S2E user to inject symbolic values in the program's inputs so that
the symbolic execution engine can follow both outcomes of the conditional branches.
This allows covering parts of the program that might be hard to reach otherwise
(e.g., by guessing the inputs, or using random testing).</p>
<p>Unfortunately, symbolic execution may get stuck at the start of an
execution and have a hard time reaching deep paths. This is caused by the
path selection heuristics and by the constraint solver. Path selection heuristics
may not know very well which execution paths to choose so that execution
goes deeper. For example, in a loop that depends on a symbolic condition, the heuristics
may blindly keep selecting paths that would never exit the loop. Even if the path
selection heuristics knew which path to select to go through the whole program,
invoking the constraint solver on every branch that depends on symbolic input may
become increasingly slower with larger and larger path depths.</p>
<p>To alleviate this, S2E also implements <em>concolic execution</em>.
Concolic execution works exactly as traditional symbolic execution: it propagates
symbolic inputs through the system, allowing conditional branches to fork new paths
whenever necessary. The key difference is that concolic execution augments these
symbolic values with <em>concrete</em> values (hence the term <em>concolic</em>). The concrete values
give a hint to the search heuristics about which paths to follow first. In practice,
the S2E user launches the program with concrete arguments that would drive the
program down the path that reaches interesting parts of that program, which S2E would
then thoroughly explore. More practical details are provided in the next sections
of this tutorial.</p>
<p>Concolic execution allows the program under analysis to run to completion
(without getting stuck in the middle) while exploring additional paths along the main concrete path.
On each branch that depends on a symbolic value, the engine follows in priority the one that
would have been followed had the program been executed with concrete values. When the first path
that corresponds to the initial concrete values terminates, the engine will pick another path,
recompute a new set of concrete values, and proceed similarly until this second path terminates.
Of course, custom path selection plugins can optimize the selection for different needs
(high code coverage, bug finding, etc.).</p>
<p>There are two key optimizations to make this feasible: (1) <em>never</em> call the constraint solver during the execution
of a path and (2) perform speculative forking. Whenever execution reaches
a branch that depends on symbolic input, S2E forks a new state regardless of the actual
feasibility of that forked state. This avoids calling the constraint solver.
Since S2E stores concrete values for every symbolic variable, the execution engine can
readily evaluate the outcome of every branch condition by substituting symbolic values with concrete ones,
and chose the corresponding concrete path.</p>
<p>S2E invokes the constraint solver when selecting a new state to run. Since all states result
from speculative forks, it is necessary to check whether the states are actually feasible
before running them. For that, S2E invokes the constraint solver to compute the concrete inputs
that would allow execution to reach that state. If the solver fails to find the inputs,
S2E discards the state. Otherwise, S2E uses the computed concrete inputs to resume
concolic execution.</p>
<div class="section" id="setting-up-s2e-for-concolic-execution">
<h1>Setting up S2E for Concolic Execution</h1>
<p>The following is a minimal S2E configuration file that enables concolic execution.</p>
<pre class="literal-block">
s2e = {
kleeArgs = {}
}
plugins = {
-- Enable a plugin that handles S2E custom opcode
"BaseInstructions"
}
</pre>
<p>It instructs the S2E engine to enable concolic execution and to use the depth-first path selection heuristic (aka path <em>searcher</em>).
The DFS heuristic works well with concolic execution, because it naturally lets the current "concrete"
path run to completion. It is possible to use any existing searcher in concolic mode.
However, it may be better to design new searchers with concolic execution in mind in order to improve
exploration efficiency.</p>
<p><strong>Note:</strong> concolic mode with DFS is the default setting of S2E. The following is an explicit configuration:</p>
<pre class="literal-block">
s2e = {
kleeArgs = {
"--use-concolic-execution=true",
"--use-dfs-search=true"
}
}
plugins = {
-- Enable a plugin that handles S2E custom opcode
"BaseInstructions"
}
</pre>
</div>
<div class="section" id="executing-programs-in-concolic-mode">
<h1>Executing Programs in Concolic Mode</h1>
<div class="section" id="using-custom-instructions">
<h2>Using custom instructions</h2>
<p>The <tt class="docutils literal">s2e_make_concolic</tt> custom instruction injects symbolic values while keeping the original concrete values.
It is used in the same way as <tt class="docutils literal">s2e_make_symbolic</tt>. It reads the original concrete values from memory, stores them in an internal cache,
and overwrites the memory with symbolic values. The cache maps the symbolic values to the actual
concrete values and allows the substitution of symbolic inputs with the concrete ones during
expression evaluation (e.g., at fork points).</p>
</div>
<div class="section" id="using-the-init-env-plugin">
<h2>Using the <tt class="docutils literal">init_env</tt> plugin</h2>
<p>The <a class="reference external" href="init_env.html">init_env</a> library enables symbolic execution without modifying the program's source code.
This library also supports concolic execution with the <tt class="docutils literal"><span class="pre">--concolic</span></tt> switch, that can be added right before the concrete program arguments.
The following example invokes the <tt class="docutils literal">tr</tt> Unix utility via the <tt class="docutils literal">tr ab ab ab</tt> command. The library automatically assigns
symbolic arguments to all arguments while keeping the concrete <tt class="docutils literal">ab</tt> values.</p>
<pre class="literal-block">
LD_PRELOAD=/home/s2e/init_env.so tr --concolic ab ab ab
</pre>
</div>
</div>
<div class="section" id="faq">
<h1>FAQ</h1>
<ul>
<li><p class="first"><em>Can I use s2e_make_symbolic in concolic mode?</em></p>
<p>Yes. S2E will automatically assign default concrete values satisfying the path constraints during concolic execution.</p>
</li>
<li><p class="first"><em>I have cryptographic routines in my code. Can concolic execution get through them?</em></p>
<p>Yes, but. Concolic execution will use the initial concrete values to get through cryptographic routines without getting stuck in the constraint solver.
However, it is very likely to get stuck when checking the feasibility of a newly-selected deep speculative state (and computing new sets of concrete inputs).
Concolic execution does not magically make constraint solving easier, it merely defers it to a later point.</p>
</li>
<li><p class="first"><em>Concolic execution seems to fork a lot more states than symbolic execution. Why?</em></p>
<p>This is due to speculative forking. In normal symbolic execution, the execution engine only forks a new path
if the solver reports that both are feasible. In concolic execution, forking is done regardless of the feasibility.
The execution engine prunes the infeasible paths later, after the path selection heuristic selects one for execution.</p>
</li>
<li><p class="first"><em>I implemented custom plugins to aggressively prune paths because symbolic execution was getting stuck. Are these plugins still useful?</em></p>
<p>Yes, reducing state space by discarding uninteresting paths is always useful. Concolic execution does not solve the path explosion
problem by itself. It merley helps getting to deep parts of the program faster.</p>
</li>
</ul>
</div>
</div>
<div class="footer">
<hr class="footer" />
<a class="reference external" href="Concolic.rst">View document source</a>.
</div>
</body>
</html>
================================================
FILE: docs/Howtos/Concolic.rst
================================================
=================================================
Analyzing Large Programs Using Concolic Execution
=================================================
In the previous tutorials, we have seen how to use symbolic execution in order
to explore different program paths. In practice, symbolic execution
requires the S2E user to inject symbolic values in the program's inputs so that
the symbolic execution engine can follow both outcomes of the conditional branches.
This allows covering parts of the program that might be hard to reach otherwise
(e.g., by guessing the inputs, or using random testing).
Unfortunately, symbolic execution may get stuck at the start of an
execution and have a hard time reaching deep paths. This is caused by the
path selection heuristics and by the constraint solver. Path selection heuristics
may not know very well which execution paths to choose so that execution
goes deeper. For example, in a loop that depends on a symbolic condition, the heuristics
may blindly keep selecting paths that would never exit the loop. Even if the path
selection heuristics knew which path to select to go through the whole program,
invoking the constraint solver on every branch that depends on symbolic input may
become increasingly slower with larger and larger path depths.
To alleviate this, S2E also implements *concolic execution*.
Concolic execution works exactly as traditional symbolic execution: it propagates
symbolic inputs through the system, allowing conditional branches to fork new paths
whenever necessary. The key difference is that concolic execution augments these
symbolic values with *concrete* values (hence the term *concolic*). The concrete values
give a hint to the search heuristics about which paths to follow first. In practice,
the S2E user launches the program with concrete arguments that would drive the
program down the path that reaches interesting parts of that program, which S2E would
then thoroughly explore. More practical details are provided in the next sections
of this tutorial.
Concolic execution allows the program under analysis to run to completion
(without getting stuck in the middle) while exploring additional paths along the main concrete path.
On each branch that depends on a symbolic value, the engine follows in priority the one that
would have been followed had the program been executed with concrete values. When the first path
that corresponds to the initial concrete values terminates, the engine will pick another path,
recompute a new set of concrete values, and proceed similarly until this second path terminates.
Of course, custom path selection plugins can optimize the selection for different needs
(high code coverage, bug finding, etc.).
There are two key optimizations to make this feasible: (1) *never* call the constraint solver during the execution
of a path and (2) perform speculative forking. Whenever execution reaches
a branch that depends on symbolic input, S2E forks a new state regardless of the actual
feasibility of that forked state. This avoids calling the constraint solver.
Since S2E stores concrete values for every symbolic variable, the execution engine can
readily evaluate the outcome of every branch condition by substituting symbolic values with concrete ones,
and chose the corresponding concrete path.
S2E invokes the constraint solver when selecting a new state to run. Since all states result
from speculative forks, it is necessary to check whether the states are actually feasible
before running them. For that, S2E invokes the constraint solver to compute the concrete inputs
that would allow execution to reach that state. If the solver fails to find the inputs,
S2E discards the state. Otherwise, S2E uses the computed concrete inputs to resume
concolic execution.
Setting up S2E for Concolic Execution
=====================================
The following is a minimal S2E configuration file that enables concolic execution.
::
s2e = {
kleeArgs = {}
}
plugins = {
-- Enable a plugin that handles S2E custom opcode
"BaseInstructions"
}
It instructs the S2E engine to enable concolic execution and to use the depth-first path selection heuristic (aka path *searcher*).
The DFS heuristic works well with concolic execution, because it naturally lets the current "concrete"
path run to completion. It is possible to use any existing searcher in concolic mode.
However, it may be better to design new searchers with concolic execution in mind in order to improve
exploration efficiency.
**Note:** concolic mode with DFS is the default setting of S2E. The following is an explicit configuration:
::
s2e = {
kleeArgs = {
"--use-concolic-execution=true",
"--use-dfs-search=true"
}
}
plugins = {
-- Enable a plugin that handles S2E custom opcode
"BaseInstructions"
}
Executing Programs in Concolic Mode
===================================
Using custom instructions
-------------------------
The ``s2e_make_concolic`` custom instruction injects symbolic values while keeping the original concrete values.
It is used in the same way as ``s2e_make_symbolic``. It reads the original concrete values from memory, stores them in an internal cache,
and overwrites the memory with symbolic values. The cache maps the symbolic values to the actual
concrete values and allows the substitution of symbolic inputs with the concrete ones during
expression evaluation (e.g., at fork points).
Using the ``init_env`` plugin
-----------------------------
The `init_env <init_env.html>`_ library enables symbolic execution without modifying the program's source code.
This library also supports concolic execution with the ``--concolic`` switch, that can be added right before the concrete program arguments.
The following example invokes the ``tr`` Unix utility via the ``tr ab ab ab`` command. The library automatically assigns
symbolic arguments to all arguments while keeping the concrete ``ab`` values.
::
LD_PRELOAD=/home/s2e/init_env.so tr --concolic ab ab ab
FAQ
===
* *Can I use s2e_make_symbolic in concolic mode?*
Yes. S2E will automatically assign default concrete values satisfying the path constraints during concolic execution.
* *I have cryptographic routines in my code. Can concolic execution get through them?*
Yes, but. Concolic execution will use the initial concrete values to get through cryptographic routines without getting stuck in the constraint solver.
However, it is very likely to get stuck when checking the feasibility of a newly-selected deep speculative state (and computing new sets of concrete inputs).
Concolic execution does not magically make constraint solving easier, it merely defers it to a later point.
* *Concolic execution seems to fork a lot more states than symbolic execution. Why?*
This is due to speculative forking. In normal symbolic execution, the execution engine only forks a new path
if the solver reports that both are feasible. In concolic execution, forking is done regardless of the feasibility.
The execution engine prunes the infeasible paths later, after the path selection heuristic selects one for execution.
* *I implemented custom plugins to aggressively prune paths because symbolic execution was getting stuck. Are these plugins still useful?*
Yes, reducing state space by discarding uninteresting paths is always useful. Concolic execution does not solve the path explosion
problem by itself. It merley helps getting to deep parts of the program faster.
================================================
FILE: docs/Howtos/Debugging.html
================================================
<?xml version="1.0" encoding="utf-8" ?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
<meta name="generator" content="Docutils 0.11: http://docutils.sourceforge.net/" />
<title>Debugging Guest Code</title>
<link rel="stylesheet" href="../s2e.css" type="text/css" />
</head>
<body>
<div class="document" id="debugging-guest-code">
<h1 class="title">Debugging Guest Code</h1>
<p>It is possible to attach GDB to any running instance of S2E. S2E relies on the QEMU GDB interface, which can
be enabled with the <cite>-s</cite> command line option. This option creates a socket on port number 1234.</p>
<pre class="literal-block">
$ ./i386-s2e-softmmu/qemu -s2e-config-file config.lua -s
</pre>
<p>Once the guest is launched and the program is running, attach GDB to it.</p>
<pre class="literal-block">
$ gdb /path/to/my/prog
(gdb) target remote localhost:1234
#use gdb as usual (set breakpoints, source directories, single-step, etc.).
</pre>
<div class="section" id="remarks">
<h1>Remarks</h1>
<ul class="simple">
<li>GDB can only manipulate the current path. Use the DFS search strategy to have a coherent debugging experience.</li>
<li>GDB cannot inspect symbolic variables. If you attempt to display a symbolic variable, S2E will concretize it.</li>
<li>You can also debug kernel-mode code.</li>
</ul>
</div>
<div class="section" id="useful-tips">
<h1>Useful tips</h1>
<ul class="simple">
<li>At any point, if you feel that symbolic execution got stuck, attach GDB to the running S2E instance to check
what code is being executed.</li>
</ul>
</div>
</div>
<div class="footer">
<hr class="footer" />
<a class="reference external" href="Debugging.rst">View document source</a>.
</div>
</body>
</html>
================================================
FILE: docs/Howtos/Debugging.rst
================================================
====================
Debugging Guest Code
====================
It is possible to attach GDB to any running instance of S2E. S2E relies on the QEMU GDB interface, which can
be enabled with the `-s` command line option. This option creates a socket on port number 1234.
::
$ ./i386-s2e-softmmu/qemu -s2e-config-file config.lua -s
Once the guest is launched and the program is running, attach GDB to it.
::
$ gdb /path/to/my/prog
(gdb) target remote localhost:1234
#use gdb as usual (set breakpoints, source directories, single-step, etc.).
Remarks
========
* GDB can only manipulate the current path. Use the DFS search strategy to have a coherent debugging experience.
* GDB cannot inspect symbolic variables. If you attempt to display a symbolic variable, S2E will concretize it.
* You can also debug kernel-mode code.
Useful tips
===========
* At any point, if you feel that symbolic execution got stuck, attach GDB to the running S2E instance to check
what code is being executed.
================================================
FILE: docs/Howtos/ExecutionTracers.html
================================================
<?xml version="1.0" encoding="utf-8" ?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
<meta name="generator" content="Docutils 0.11: http://docutils.sourceforge.net/" />
<title>How to Use Execution Tracers?</title>
<link rel="stylesheet" href="../s2e.css" type="text/css" />
</head>
<body>
<div class="document" id="how-to-use-execution-tracers">
<h1 class="title">How to Use Execution Tracers?</h1>
<div class="contents topic" id="contents">
<p class="topic-title first">Contents</p>
<ul class="simple">
<li><a class="reference internal" href="#minimal-configuration-file" id="id2">1. Minimal Configuration File</a></li>
<li><a class="reference internal" href="#guest-configuration" id="id3">2. Guest Configuration</a></li>
<li><a class="reference internal" href="#viewing-the-traces" id="id4">3. Viewing the Traces</a></li>
<li><a class="reference internal" href="#mini-faq" id="id5">Mini-FAQ</a></li>
</ul>
</div>
<p>Execution tracers are S2E analysis plugins that record various information along the execution of each path.
Here is a list of currently available plugins:</p>
<ul class="simple">
<li><strong>ExecutionTracer</strong>: Base plugin upon which all tracers depend. This plugin records fork points so that offline
analysis tools can reconstruct the execution tree. This plugin is useful by itself to obtain a fork profile
of the system and answer questions such as: Which branch forks the most? What is causing path explosion?</li>
<li><strong>ModuleTracer</strong>: Records when and where the guest OS loads modules, programs, or libraries. Offline analysis tools
rely on this plugin to display debug information such as which line of code corresponds to which program counter.
If ModuleTracer is disabled, no debug information will be displayed.</li>
<li><strong>TestCaseGenerator</strong>: Outputs a test case whenever a path terminates. The test case consists of concrete input values
that would exercise the given path.</li>
<li><strong>TranslationBlockTracer</strong>: Records information about the executed translation blocks, including the program counter of
each executed block and the content of registers before and after execution. This plugin is useful to obtain basic block
coverage.</li>
<li><strong>InstructionCounter</strong>: Counts the number of instructions executed on each path in the modules of interest.</li>
</ul>
<p>Most of the tracers record information only for the configured modules (except ExecutionTracer, which records forks
anywhere in the system). For this, tracers need to know when execution enters and leaves the modules of interest.
Tracers rely on the ModuleExecutionDetector plugin to obtain this information. ModuleExecutionDetector relies itself
on OS monitor plugins to be notified whenever the OS loads or unloads the modules.</p>
<p>Here is an end-to-end example of how to generate an execution trace for the <tt class="docutils literal">echo</tt> utility using the <a class="reference external" href="../Howtos/init_env.html">init_env.so</a> library.
The trace will contain all memory accesses done by <tt class="docutils literal">echo</tt>, as well as the list of executed translation blocks and test cases.</p>
<div class="section" id="minimal-configuration-file">
<h1>1. Minimal Configuration File</h1>
<blockquote>
<pre class="literal-block">
s2e = {
kleeArgs = {}
}
plugins = {
"BaseInstructions",
"ExecutionTracer",
"ModuleTracer",
"RawMonitor",
"ModuleExecutionDetector",
--The following plugins can be enabled as needed
"MemoryTracer",
"TestCaseGenerator",
"TranslationBlockTracer"
}
pluginsConfig = {}
pluginsConfig.MemoryTracer = {
monitorMemory = true,
monitorModules = true,
}
</pre>
</blockquote>
</div>
<div class="section" id="guest-configuration">
<h1>2. Guest Configuration</h1>
<p>Preparing the guest program for tracing is easy. The <a class="reference external" href="../Howtos/init_env.html">init_env.so</a> library will instruct
S2E to trace the program as specified in the configuration file.</p>
<blockquote>
<pre class="literal-block">
$ LD_PRELOAD=/home/s2e/init_env.so /bin/echo abc ab > /dev/null
</pre>
</blockquote>
</div>
<div class="section" id="viewing-the-traces">
<h1>3. Viewing the Traces</h1>
<p>S2E comes with several tools that parse and display the execution traces.
They are located in the <cite>tools</cite> folder of the source distribution.
You can find the documentation for them on the <a class="reference external" href="../index.html">main page</a>.</p>
<p>Here is an example that prints the list of executed translation blocks and all memory accesses performed in paths #0 and #34.</p>
<blockquote>
<pre class="literal-block">
$ $S2EDIR/build/tools/Release+Asserts/bin/tbtrace -trace=s2e-last/ExecutionTracer.dat \
-outputdir=s2e-last/traces -pathId=0 -pathId=34 -printMemory
</pre>
</blockquote>
</div>
<div class="section" id="mini-faq">
<h1>Mini-FAQ</h1>
<ul class="simple">
<li>You followed all steps and no debug information is displayed by the offline tools.<ul>
<li>Some programs might be relocated by the OS and their load base will differ from their native base. Try to disable ASLR.</li>
<li>Check that your binutils library understands the debug information in the binaries.</li>
</ul>
</li>
</ul>
</div>
</div>
<div class="footer">
<hr class="footer" />
<a class="reference external" href="ExecutionTracers.rst">View document source</a>.
</div>
</body>
</html>
================================================
FILE: docs/Howtos/ExecutionTracers.rst
================================================
=============================
How to Use Execution Tracers?
=============================
.. contents::
Execution tracers are S2E analysis plugins that record various information along the execution of each path.
Here is a list of currently available plugins:
* **ExecutionTracer**: Base plugin upon which all tracers depend. This plugin records fork points so that offline
analysis tools can reconstruct the execution tree. This plugin is useful by itself to obtain a fork profile
of the system and answer questions such as: Which branch forks the most? What is causing path explosion?
* **ModuleTracer**: Records when and where the guest OS loads modules, programs, or libraries. Offline analysis tools
rely on this plugin to display debug information such as which line of code corresponds to which program counter.
If ModuleTracer is disabled, no debug information will be displayed.
* **TestCaseGenerator**: Outputs a test case whenever a path terminates. The test case consists of concrete input values
that would exercise the given path.
* **TranslationBlockTracer**: Records information about the executed translation blocks, including the program counter of
each executed block and the content of registers before and after execution. This plugin is useful to obtain basic block
coverage.
* **InstructionCounter**: Counts the number of instructions executed on each path in the modules of interest.
Most of the tracers record information only for the configured modules (except ExecutionTracer, which records forks
anywhere in the system). For this, tracers need to know when execution enters and leaves the modules of interest.
Tracers rely on the ModuleExecutionDetector plugin to obtain this information. ModuleExecutionDetector relies itself
on OS monitor plugins to be notified whenever the OS loads or unloads the modules.
Here is an end-to-end example of how to generate an execution trace for the ``echo`` utility using the `init_env.so <../Howtos/init_env.html>`_ library.
The trace will contain all memory accesses done by ``echo``, as well as the list of executed translation blocks and test cases.
1. Minimal Configuration File
=============================
::
s2e = {
kleeArgs = {}
}
plugins = {
"BaseInstructions",
"ExecutionTracer",
"ModuleTracer",
"RawMonitor",
"ModuleExecutionDetector",
--The following plugins can be enabled as needed
"MemoryTracer",
"TestCaseGenerator",
"TranslationBlockTracer"
}
pluginsConfig = {}
pluginsConfig.MemoryTracer = {
monitorMemory = true,
monitorModules = true,
}
2. Guest Configuration
======================
Preparing the guest program for tracing is easy. The `init_env.so <../Howtos/init_env.html>`_ library will instruct
S2E to trace the program as specified in the configuration file.
::
$ LD_PRELOAD=/home/s2e/init_env.so /bin/echo abc ab > /dev/null
3. Viewing the Traces
=====================
S2E comes with several tools that parse and display the execution traces.
They are located in the `tools` folder of the source distribution.
You can find the documentation for them on the `main page <../index.html>`_.
Here is an example that prints the list of executed translation blocks and all memory accesses performed in paths #0 and #34.
::
$ $S2EDIR/build/tools/Release+Asserts/bin/tbtrace -trace=s2e-last/ExecutionTracer.dat \
-outputdir=s2e-last/traces -pathId=0 -pathId=34 -printMemory
Mini-FAQ
========
* You followed all steps and no debug information is displayed by the offline tools.
* Some programs might be relocated by the OS and their load base will differ from their native base. Try to disable ASLR.
* Check that your binutils library understands the debug information in the binaries.
================================================
FILE: docs/Howtos/Parallel.html
================================================
<?xml version="1.0" encoding="utf-8" ?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
<meta name="generator" content="Docutils 0.11: http://docutils.sourceforge.net/" />
<title>Parallel S2E</title>
<link rel="stylesheet" href="../s2e.css" type="text/css" />
</head>
<body>
<div class="document" id="parallel-s2e">
<h1 class="title">Parallel S2E</h1>
<p>S2E can be run in multi-process mode in order to speed up path exploration.
Each process is called a worker. Each worker periodically checks whether there
are processor cores available, and if yes, forks itself. The child worker inherits half of the states of the parent.</p>
<p>To enable multi-process mode, append <tt class="docutils literal"><span class="pre">-s2e-max-processes</span> XX</tt> to the command line,
where <tt class="docutils literal">XX</tt> is the maximum number of S2E instances you would like to have.</p>
<p>Add the <tt class="docutils literal"><span class="pre">-nographic</span></tt> option as it is not possible to fork a new S2E window for now.</p>
<div class="section" id="how-do-i-process-generated-traces">
<h1>How do I process generated traces?</h1>
<p>In multi-process mode, S2E outputs traces in the <tt class="docutils literal"><span class="pre">s2e-last/XX</span></tt> folders, where <tt class="docutils literal">XX</tt> is the sequence number of the S2E instance.
S2E increments this number each time it launches a new instance. Note that instances can also terminate, e.g., when they
finish exploring their respective state subtree.</p>
<p>Each trace file contains a subtree of the global execution tree. Therefore, analysis tools must process the traces in the relative order
of their creation. The relative order is defined by the sequence number of the instance. This can be done by specifying
multiple <tt class="docutils literal"><span class="pre">-trace</span></tt> arguments to the offline analysis tools. For example, generating the fork profile of a multi-core run can be done
as follows:</p>
<pre class="literal-block">
$ /home/s2e/tools/Release/bin/forkprofiler -outputdir=s2e-last/ \
-trace=s2e-last/0/ExecutionTracer.dat -trace=s2e-last/1/ExecutionTracer.dat \
-trace=s2e-last/2/ExecutionTracer.dat -trace=s2e-last/3/ExecutionTracer.dat
</pre>
</div>
<div class="section" id="limitations">
<h1>Limitations</h1>
<ul class="simple">
<li>S2E can only run on a shared-memory architecture. S2E cannot start on one machine and fork new instances on other machines for now.
This limitation will be removed soon.</li>
<li>It is not possible to have a separate S2E window for each process for now. If you start with <tt class="docutils literal"><span class="pre">-nographic</span></tt>, you will not be able
to manipulate the console. To start the program that you want to symbolically execute in the guest, use the <a class="reference external" href="../UsingS2EGet.html">HostFiles</a> plugin or
the <tt class="docutils literal"><span class="pre">-vnc</span> :1</tt> option.</li>
<li>Because S2E uses the <tt class="docutils literal">fork</tt> system call, S2E cannot run on Windows in multi-core mode.</li>
</ul>
</div>
</div>
<div class="footer">
<hr class="footer" />
<a class="reference external" href="Parallel.rst">View document source</a>.
</div>
</body>
</html>
================================================
FILE: docs/Howtos/Parallel.rst
================================================
============
Parallel S2E
============
S2E can be run in multi-process mode in order to speed up path exploration.
Each process is called a worker. Each worker periodically checks whether there
are processor cores available, and if yes, forks itself. The child worker inherits half of the states of the parent.
To enable multi-process mode, append ``-s2e-max-processes XX`` to the command line,
where ``XX`` is the maximum number of S2E instances you would like to have.
Add the ``-nographic`` option as it is not possible to fork a new S2E window for now.
How do I process generated traces?
----------------------------------
In multi-process mode, S2E outputs traces in the ``s2e-last/XX`` folders, where ``XX`` is the sequence number of the S2E instance.
S2E increments this number each time it launches a new instance. Note that instances can also terminate, e.g., when they
finish exploring their respective state subtree.
Each trace file contains a subtree of the global execution tree. Therefore, analysis tools must process the traces in the relative order
of their creation. The relative order is defined by the sequence number of the instance. This can be done by specifying
multiple ``-trace`` arguments to the offline analysis tools. For example, generating the fork profile of a multi-core run can be done
as follows:
::
$ /home/s2e/tools/Release/bin/forkprofiler -outputdir=s2e-last/ \
-trace=s2e-last/0/ExecutionTracer.dat -trace=s2e-last/1/ExecutionTracer.dat \
-trace=s2e-last/2/ExecutionTracer.dat -trace=s2e-last/3/ExecutionTracer.dat
Limitations
-----------
* S2E can only run on a shared-memory architecture. S2E cannot start on one machine and fork new instances on other machines for now.
This limitation will be removed soon.
* It is not possible to have a separate S2E window for each process for now. If you start with ``-nographic``, you will not be able
to manipulate the console. To start the program that you want to symbolically execute in the guest, use the `HostFiles <../UsingS2EGet.html>`_ plugin or
the ``-vnc :1`` option.
* Because S2E uses the ``fork`` system call, S2E cannot run on Windows in multi-core mode.
================================================
FILE: docs/Howtos/WritingPlugins.html
================================================
<?xml version="1.0" encoding="utf-8" ?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
<meta name="generator" content="Docutils 0.11: http://docutils.sourceforge.net/" />
<title>How to Write an S2E plugin?</title>
<link rel="stylesheet" href="../s2e.css" type="text/css" />
</head>
<body>
<div class="document" id="how-to-write-an-s2e-plugin">
<h1 class="title">How to Write an S2E plugin?</h1>
<p>In this tutorial, we show step-by-step how to write a complete plugin that uses most of the features of the S2E plugin infrastructure.
We take the example of a plugin that counts how many times a specific instruction has been executed.
Users of that plugin can specify the instruction to watch in the S2E configuration file.
We will also show how to build the plugin so that it can communicate with other plugins and expose
reusable functionality.</p>
<div class="section" id="starting-with-an-empty-plugin">
<h1>Starting with an Empty Plugin</h1>
<p>The first thing to do is to name the plugin and create boilerplate code. Let us name the plugin <tt class="docutils literal">InstructionTracker</tt>.
You can copy/paste the <tt class="docutils literal">Example</tt> plugin that ships with S2E.</p>
<p>Create a file named <tt class="docutils literal">InstructionTracker.h</tt> in the <tt class="docutils literal">/qemu/s2e/Plugins</tt> directory with the following content:</p>
<div class="highlight"><pre><span class="cp">#ifndef S2E_PLUGINS_INSTRTRACKER_H</span>
<span class="cp">#define S2E_PLUGINS_INSTRTRACKER_H</span>
<span class="cp">#include <s2e/Plugin.h></span>
<span class="cp">#include <s2e/Plugins/CorePlugin.h></span>
<span class="cp">#include <s2e/S2EExecutionState.h></span>
<span class="n">namespace</span> <span class="n">s2e</span> <span class="p">{</span>
<span class="n">namespace</span> <span class="n">plugins</span> <span class="p">{</span>
<span class="n">class</span> <span class="n">InstructionTracker</span> <span class="o">:</span> <span class="n">public</span> <span class="n">Plugin</span>
<span class="p">{</span>
<span class="n">S2E_PLUGIN</span>
<span class="nl">public:</span>
<span class="n">InstructionTracker</span><span class="p">(</span><span class="n">S2E</span> <span class="o">*</span><span class="n">s2e</span><span class="p">)</span><span class="o">:</span> <span class="n">Plugin</span><span class="p">(</span><span class="n">s2e</span><span class="p">)</span> <span class="p">{}</span>
<span class="kt">void</span> <span class="n">initialize</span><span class="p">();</span>
<span class="p">};</span>
<span class="p">}</span> <span class="c1">// namespace plugins</span>
<span class="p">}</span> <span class="c1">// namespace s2e</span>
<span class="cp">#endif</span>
</pre></div>
<p>Then, create the corresponding <tt class="docutils literal">InstructionTracker.cpp</tt> file in the same directory as follows:</p>
<div class="highlight"><pre><span class="cp">#include <s2e/S2E.h></span>
<span class="cp">#include "InstructionTracker.h"</span>
<span class="n">namespace</span> <span class="n">s2e</span> <span class="p">{</span>
<span class="n">namespace</span> <span class="n">plugins</span> <span class="p">{</span>
<span class="c1">//Define a plugin whose class is InstructionTracker and called "InstructionTracker".</span>
<span class="c1">//The plugin does not have any dependency.</span>
<span class="n">S2E_DEFINE_PLUGIN</span><span class="p">(</span><span class="n">InstructionTracker</span><span class="p">,</span> <span class="s">"Tutorial - Tracking instructions"</span><span class="p">,</span> <span class="s">"InstructionTracker"</span><span class="p">,);</span>
<span class="kt">void</span> <span class="n">InstructionTracker</span><span class="o">::</span><span class="n">initialize</span><span class="p">()</span>
<span class="p">{</span>
<span class="p">}</span>
<span class="p">}</span> <span class="c1">// namespace plugins</span>
<span class="p">}</span> <span class="c1">// namespace s2e</span>
</pre></div>
<p>Finally, we need to compile the plugin with the rest of S2E.
For this, add the following line to <tt class="docutils literal">/qemu/Makefile.target</tt>, near other plugin declarations:</p>
<pre class="literal-block">
s2eobj-y += s2e/Plugins/InstructionTracker.o
#...many more lines here...
s2eobj-y += s2e/Plugins/ExecutionTracers/ExecutionTracer.o
s2eobj-y += s2e/Plugins/ExecutionTracers/ModuleTracer.o
s2eobj-y += s2e/Plugins/ExecutionTracers/EventTracer.o
</pre>
</div>
<div class="section" id="reading-configuration-parameters">
<h1>Reading Configuration Parameters</h1>
<p>We would like to let the user specify which instruction to monitor. For this, we create a configuration variable
that stores the address of that instruction.
Every plugin can have an entry in the S2E configuration file. The entry for our plugin would look like this:</p>
<pre class="literal-block">
pluginsConfig.InstructionTracker = {
-- The address we want to track
addressToTrack=0x12345
}
</pre>
<p>If we run the plugin as it is now, nothing will happen. S2E ignores any unknown configuration value.
We need a mechanism to explicitly retrieve the configuration value.
In S2E, plugins can retrieve the configuration at any time. In our case, we do it during the initialization phase.</p>
<div class="highlight"><pre><span class="c1">//We need this to read configuration files</span>
<span class="cp">#include <s2e/ConfigFile.h></span>
<span class="c1">//...</span>
<span class="kt">void</span> <span class="n">InstructionTracker</span><span class="o">::</span><span class="n">initialize</span><span class="p">()</span>
<span class="p">{</span>
<span class="n">m_address</span> <span class="o">=</span> <span class="p">(</span><span class="kt">uint64_t</span><span class="p">)</span> <span class="n">s2e</span><span class="p">()</span><span class="o">-></span><span class="n">getConfig</span><span class="p">()</span><span class="o">-></span><span class="n">getInt</span><span class="p">(</span><span class="n">getConfigKey</span><span class="p">()</span> <span class="o">+</span> <span class="s">".addressToTrack"</span><span class="p">);</span>
<span class="p">}</span>
</pre></div>
<p>Do not forget to add <tt class="docutils literal">uint64_t m_address;</tt> to the private members of class <tt class="docutils literal">InstructionTracker</tt>
in <tt class="docutils literal">InstructionTracker.h</tt>.</p>
</div>
<div class="section" id="instrumenting-instructions">
<h1>Instrumenting Instructions</h1>
<p>To instrument an instruction, an S2E plugins registers to the <tt class="docutils literal">onTranslateInstructionStart</tt> core event.
There are many other core events to which a plugin can register. These events are defined in <tt class="docutils literal">CorePlugin.h</tt>.</p>
<p>Extend your code as follows. Do not forget to add all new member functions to the (private) section of the class declaration.</p>
<div class="highlight"><pre><span class="kt">void</span> <span class="n">InstructionTracker</span><span class="o">::</span><span class="n">initialize</span><span class="p">()</span>
<span class="p">{</span>
<span class="n">m_address</span> <span class="o">=</span> <span class="p">(</span><span class="kt">uint64_t</span><span class="p">)</span> <span class="n">s2e</span><span class="p">()</span><span class="o">-></span><span class="n">getConfig</span><span class="p">()</span><span class="o">-></span><span class="n">getInt</span><span class="p">(</span><span class="n">getConfigKey</span><span class="p">()</span> <span class="o">+</span> <span class="s">".addressToTrack"</span><span class="p">);</span>
<span class="c1">//This indicates that our plugin is interested in monitoring instruction translation.</span>
<span class="c1">//For this, the plugin registers a callback with the onTranslateInstruction signal.</span>
<span class="n">s2e</span><span class="p">()</span><span class="o">-></span><span class="n">getCorePlugin</span><span class="p">()</span><span class="o">-></span><span class="n">onTranslateInstructionStart</span><span class="p">.</span><span class="n">connect</span><span class="p">(</span>
<span class="n">sigc</span><span class="o">::</span><span class="n">mem_fun</span><span class="p">(</span><span class="o">*</span><span class="n">this</span><span class="p">,</span> <span class="o">&</span><span class="n">InstructionTracker</span><span class="o">::</span><span class="n">onTranslateInstruction</span><span class="p">));</span>
<span class="p">}</span>
<span class="kt">void</span> <span class="n">InstructionTracker</span><span class="o">::</span><span class="n">onTranslateInstruction</span><span class="p">(</span><span class="n">ExecutionSignal</span> <span class="o">*</span><span class="n">signal</span><span class="p">,</span>
<span class="n">S2EExecutionState</span> <span class="o">*</span><span class="n">state</span><span class="p">,</span>
<span class="n">TranslationBlock</span> <span class="o">*</span><span class="n">tb</span><span class="p">,</span>
<span class="kt">uint64_t</span> <span class="n">pc</span><span class="p">)</span>
<span class="p">{</span>
<span class="k">if</span><span class="p">(</span><span class="n">m_address</span> <span class="o">==</span> <span class="n">pc</span><span class="p">)</span> <span class="p">{</span>
<span class="c1">//When we find an interesting address, ask S2E to invoke our</span>
<span class="c1">//callback when the address is actually executed.</span>
<span class="n">signal</span><span class="o">-></span><span class="n">connect</span><span class="p">(</span><span class="n">sigc</span><span class="o">::</span><span class="n">mem_fun</span><span class="p">(</span><span class="o">*</span><span class="n">this</span><span class="p">,</span> <span class="o">&</span><span class="n">InstructionTracker</span><span class="o">::</span><span class="n">onInstructionExecution</span><span class="p">));</span>
<span class="p">}</span>
<span class="p">}</span>
<span class="c1">//This callback is called only when the instruction at our address is executed.</span>
<span class="c1">//The callback incurs zero overhead for all other instructions.</span>
<span class="kt">void</span> <span class="n">InstructionTracker</span><span class="o">::</span><span class="n">onInstructionExecution</span><span class="p">(</span><span class="n">S2EExecutionState</span> <span class="o">*</span><span class="n">state</span><span class="p">,</span> <span class="kt">uint64_t</span> <span class="n">pc</span><span class="p">)</span>
<span class="p">{</span>
<span class="n">s2e</span><span class="p">()</span><span class="o">-></span><span class="n">getDebugStream</span><span class="p">()</span> <span class="o"><<</span> <span class="s">"Executing instruction at "</span> <span class="o"><<</span> <span class="n">hexval</span><span class="p">(</span><span class="n">pc</span><span class="p">)</span> <span class="o"><<</span> <span class="sc">'\n'</span><span class="p">;</span>
<span class="c1">//The plugins can arbitrarily modify/observe the current execution state via</span>
<span class="c1">//the execution state pointer.</span>
<span class="c1">//Plugins can also call the s2e() method to use the S2E API.</span>
<span class="p">}</span>
</pre></div>
</div>
<div class="section" id="counting-instructions">
<h1>Counting Instructions</h1>
<p>We would like to count how many times that particular instruction is executed.
There are two options:</p>
<blockquote>
<ol class="arabic simple">
<li>Count how many times it was executed across all paths.</li>
<li>Count how many times it was executed in each path.</li>
</ol>
</blockquote>
<p>The first option is trivial to implement. Simply add an additional member
to the class and increment it every time the <tt class="docutils literal">onInstructionExecution</tt> callback is invoked.</p>
<p>The second option requires to keep per-state plugin information.
S2E plugins manage per-state information in a class that derives from <tt class="docutils literal">PluginState</tt>.
This class must implement a factory method that returns a new instance of the class when S2E starts symbolic execution.
It must also implement a <tt class="docutils literal">clone</tt> method which S2E uses to fork the plugin state.</p>
<p>Here is how <tt class="docutils literal">InstructionTracker</tt> could implement the plugin state.</p>
<div class="highlight"><pre><span class="n">class</span> <span class="n">InstructionTrackerState</span><span class="o">:</span> <span class="n">public</span> <span class="n">PluginState</span>
<span class="p">{</span>
<span class="nl">private:</span>
<span class="kt">int</span> <span class="n">m_count</span><span class="p">;</span>
<span class="nl">public:</span>
<span class="n">InstructionTrackerState</span><span class="p">()</span> <span class="p">{</span>
<span class="n">m_count</span> <span class="o">=</span> <span class="mi">0</span><span class="p">;</span>
<span class="p">}</span>
<span class="o">~</span><span class="n">InstructionTrackerState</span><span class="p">()</span> <span class="p">{}</span>
<span class="k">static</span> <span class="n">PluginState</span> <span class="o">*</span><span class="n">factory</span><span class="p">(</span><span class="n">Plugin</span><span class="o">*</span><span class="p">,</span> <span class="n">S2EExecutionState</span><span class="o">*</span><span class="p">)</span> <span class="p">{</span>
<span class="k">return</span> <span class="n">new</span> <span class="n">InstructionTrackerState</span><span class="p">();</span>
<span class="p">}</span>
<span class="n">InstructionTrackerState</span> <span class="o">*</span><span class="n">clone</span><span class="p">()</span> <span class="k">const</span> <span class="p">{</span>
<span class="k">return</span> <span class="n">new</span> <span class="n">InstructionTrackerState</span><span class="p">(</span><span class="o">*</span><span class="n">this</span><span class="p">);</span>
<span class="p">}</span>
<span class="kt">void</span> <span class="n">increment</span><span class="p">()</span> <span class="p">{</span> <span class="o">++</span><span class="n">m_count</span><span class="p">;</span> <span class="p">}</span>
<span class="kt">int</span> <span class="n">get</span><span class="p">()</span> <span class="p">{</span> <span class="k">return</span> <span class="n">m_count</span><span class="p">;</span> <span class="p">}</span>
<span class="p">};</span>
</pre></div>
<p>Plugin code can refer to this state using the <tt class="docutils literal">DECLARE_PLUGINSTATE</tt> macro, like this:</p>
<div class="highlight"><pre><span class="kt">void</span> <span class="n">InstructionTracker</span><span class="o">::</span><span class="n">onInstructionExecution</span><span class="p">(</span><span class="n">S2EExecutionState</span> <span class="o">*</span><span class="n">state</span><span class="p">,</span> <span class="kt">uint64_t</span> <span class="n">pc</span><span class="p">)</span>
<span class="p">{</span>
<span class="c1">//This macro declares the plgState variable of type InstructionTrackerState.</span>
<span class="c1">//It automatically takes care of retrieving the right plugin state attached to the</span>
<span class="c1">//specified execution state.</span>
<span class="n">DECLARE_PLUGINSTATE</span><span class="p">(</span><span class="n">InstructionTrackerState</span><span class="p">,</span> <span class="n">state</span><span class="p">);</span>
<span class="n">s2e</span><span class="p">()</span><span class="o">-></span><span class="n">getDebugStream</span><span class="p">()</span> <span class="o"><<</span> <span class="s">"Executing instruction at "</span> <span class="o"><<</span> <span class="n">hexval</span><span class="p">(</span><span class="n">pc</span><span class="p">)</span> <span class="o"><<</span> <span class="sc">'\n'</span><span class="p">;</span>
<span class="c1">//Increment the count</span>
<span class="n">plgState</span><span class="o">-></span><span class="n">increment</span><span class="p">();</span>
<span class="p">}</span>
</pre></div>
</div>
<div class="section" id="exporting-events">
<h1>Exporting Events</h1>
<p>All S2E plugins can define custom events. Other plugins can in turn connect to them and also export
their own events. This scheme is heavily used by stock S2E plugins. For example, S2E provides the <tt class="docutils literal">Annotation</tt> plugin that
invokes a user-written script that can arbitrarily manipulate the execution state.
This plugin allows to implement different execution consistency models
and is a central piece in tools like DDT and RevNIC. This plugins relies on <tt class="docutils literal">FunctionMonitor</tt> to intercept annotated functions and
on <tt class="docutils literal">ModuleExecutionDetector</tt> to trigger annotations when execution enters user-defined modules. Finally, <tt class="docutils literal">ModuleExecutionDetector</tt>
itself depends on several plugins that abstract OS-specific events (e.g., module loads/unloads).</p>
<p>In this tutorial, we show how <tt class="docutils literal">InstructionTracker</tt> can expose an event and trigger it when the monitored instruction
is executed ten times.</p>
<p>First, we declare the signal as a <tt class="docutils literal">public</tt> field of the <tt class="docutils literal">InstructionTracker</tt> class. It is important that the field be public,
otherwise other plugins will not be able to register.</p>
<div class="highlight"><pre><span class="n">class</span> <span class="n">InstructionTracker</span><span class="o">:</span> <span class="n">public</span> <span class="n">Plugin</span> <span class="p">{</span>
<span class="c1">//...</span>
<span class="nl">public:</span>
<span class="n">sigc</span><span class="o">::</span><span class="n">signal</span><span class="o"><</span>
<span class="kt">void</span><span class="p">,</span>
<span class="n">S2EExecutionState</span> <span class="o">*</span><span class="p">,</span> <span class="c1">//The first parameter of the callback is the state</span>
<span class="kt">uint64_t</span> <span class="c1">//The second parameter is an integer representing the program counter</span>
<span class="o">></span> <span class="n">onPeriodicEvent</span><span class="p">;</span>
<span class="c1">//...</span>
<span class="p">}</span>
</pre></div>
<p>Second, we add some logic to fire the event and call all the registered callbacks.</p>
<div class="highlight"><pre><span class="kt">void</span> <span class="n">InstructionTracker</span><span class="o">::</span><span class="n">onInstructionExecution</span><span class="p">(</span><span class="n">S2EExecutionState</span> <span class="o">*</span><span class="n">state</span><span class="p">,</span> <span class="kt">uint64_t</span> <span class="n">pc</span><span class="p">)</span>
<span class="p">{</span>
<span class="n">DECLARE_PLUGINSTATE</span><span class="p">(</span><span class="n">InstructionTrackerState</span><span class="p">,</span> <span class="n">state</span><span class="p">);</span>
<span class="n">s2e</span><span class="p">()</span><span class="o">-></span><span class="n">getDebugStream</span><span class="p">()</span> <span class="o"><<</span> <span class="s">"Executing instruction at "</span> <span class="o"><<</span> <span class="n">hexval</span><span class="p">(</span><span class="n">pc</span><span class="p">)</span> <span class="o"><<</span> <span class="sc">'\n'</span><span class="p">;</span>
<span class="n">plgState</span><span class="o">-></span><span class="n">increment</span><span class="p">();</span>
<span class="c1">//Fire the event</span>
<span class="k">if</span> <span class="p">((</span><span class="n">plgState</span><span class="o">-></span><span class="n">get</span><span class="p">()</span> <span class="o">%</span> <span class="mi">10</span><span class="p">)</span> <span class="o">==</span> <span class="mi">0</span><span class="p">)</span> <span class="p">{</span>
<span class="n">onPeriodicEvent</span><span class="p">.</span><span class="n">emit</span><span class="p">(</span><span class="n">state</span><span class="p">,</span> <span class="n">pc</span><span class="p">);</span>
<span class="p">}</span>
<span class="p">}</span>
</pre></div>
<p>That is all we need to define and trigger an event.
To register for this event, a plugin invokes <tt class="docutils literal"><span class="pre">s2e()->getPlugin("PluginName");</span></tt>, where <tt class="docutils literal">PluginName</tt> is
the name of the plugin as defined in the <tt class="docutils literal">S2E_DEFINE_PLUGIN</tt> macro.
In our case, a plugin named <tt class="docutils literal">MyClient</tt> would do something like this in its initialization routine:</p>
<div class="highlight"><pre><span class="c1">//Specify dependencies</span>
<span class="n">S2E_DEFINE_PLUGIN</span><span class="p">(</span><span class="n">MyClient</span><span class="p">,</span> <span class="s">"We use InstructionTracker"</span><span class="p">,</span> <span class="s">"MyClient"</span><span class="p">,</span> <span class="s">"InstructionTracker"</span><span class="p">);</span>
<span class="kt">void</span> <span class="n">MyClient</span><span class="o">::</span><span class="n">initialize</span><span class="p">()</span>
<span class="p">{</span>
<span class="c1">//Get the instance of the plugin</span>
<span class="n">InstructionTracker</span> <span class="o">*</span><span class="n">tracker</span> <span class="o">=</span> <span class="n">static_cast</span><span class="o"><</span><span class="n">InstructionTracker</span><span class="o">*></span><span class="p">(</span><span class="n">s2e</span><span class="p">()</span><span class="o">-></span><span class="n">getPlugin</span><span class="p">(</span><span class="s">"InstructionTracker"</span><span class="p">));</span>
<span class="n">assert</span><span class="p">(</span><span class="n">tracker</span><span class="p">);</span>
<span class="c1">//Register to custom events</span>
<span class="n">tracker</span><span class="o">-></span><span class="n">onPeriodicEvent</span><span class="p">...</span>
<span class="c1">//Call plugin's public members</span>
<span class="n">tracker</span><span class="o">-></span><span class="p">...</span>
<span class="p">}</span>
</pre></div>
<p>Note that S2E enforces the plugin dependencies specified in the <tt class="docutils literal">S2E_DEFINE_PLUGIN</tt> macro.
If a dependency is not satisfied (e.g., the plugin is not enabled in the configuration file or
is not compiled in S2E), S2E will not start and emit an error message instead.</p>
<p>It is not always necessary to specify the dependencies.
For example, a plugin may want to work with reduced functionality if some dependent plugin is missing.
Attempting to call <tt class="docutils literal"><span class="pre">s2e()->getPlugin()</span></tt> returns <tt class="docutils literal">NULL</tt> if the requested plugin is missing.</p>
</div>
</div>
<div class="footer">
<hr class="footer" />
<a class="reference external" href="WritingPlugins.rst">View document source</a>.
</div>
</body>
</html>
================================================
FILE: docs/Howtos/WritingPlugins.rst
================================================
===========================
How to Write an S2E plugin?
===========================
In this tutorial, we show step-by-step how to write a complete plugin that uses most of the features of the S2E plugin infrastructure.
We take the example of a plugin that counts how many times a specific instruction has been executed.
Users of that plugin can specify the instruction to watch in the S2E configuration file.
We will also show how to build the plugin so that it can communicate with other plugins and expose
reusable functionality.
Starting with an Empty Plugin
=============================
The first thing to do is to name the plugin and create boilerplate code. Let us name the plugin ``InstructionTracker``.
You can copy/paste the ``Example`` plugin that ships with S2E.
Create a file named ``InstructionTracker.h`` in the ``/qemu/s2e/Plugins`` directory with the following content:
.. code-block:: c
#ifndef S2E_PLUGINS_INSTRTRACKER_H
#define S2E_PLUGINS_INSTRTRACKER_H
#include <s2e/Plugin.h>
#include <s2e/Plugins/CorePlugin.h>
#include <s2e/S2EExecutionState.h>
namespace s2e {
namespace plugins {
class InstructionTracker : public Plugin
{
S2E_PLUGIN
public:
InstructionTracker(S2E *s2e): Plugin(s2e) {}
void initialize();
};
} // namespace plugins
} // namespace s2e
#endif
Then, create the corresponding ``InstructionTracker.cpp`` file in the same directory as follows:
.. code-block:: c
#include <s2e/S2E.h>
#include "InstructionTracker.h"
namespace s2e {
namespace plugins {
//Define a plugin whose class is InstructionTracker and called "InstructionTracker".
//The plugin does not have any dependency.
S2E_DEFINE_PLUGIN(InstructionTracker, "Tutorial - Tracking instructions", "InstructionTracker",);
void InstructionTracker::initialize()
{
}
} // namespace plugins
} // namespace s2e
Finally, we need to compile the plugin with the rest of S2E.
For this, add the following line to ``/qemu/Makefile.target``, near other plugin declarations:
::
s2eobj-y += s2e/Plugins/InstructionTracker.o
#...many more lines here...
s2eobj-y += s2e/Plugins/ExecutionTracers/ExecutionTracer.o
s2eobj-y += s2e/Plugins/ExecutionTracers/ModuleTracer.o
s2eobj-y += s2e/Plugins/ExecutionTracers/EventTracer.o
Reading Configuration Parameters
================================
We would like to let the user specify which instruction to monitor. For this, we create a configuration variable
that stores the address of that instruction.
Every plugin can have an entry in the S2E configuration file. The entry for our plugin would look like this:
::
pluginsConfig.InstructionTracker = {
-- The address we want to track
addressToTrack=0x12345
}
If we run the plugin as it is now, nothing will happen. S2E ignores any unknown configuration value.
We need a mechanism to explicitly retrieve the configuration value.
In S2E, plugins can retrieve the configuration at any time. In our case, we do it during the initialization phase.
.. code-block:: c
//We need this to read configuration files
#include <s2e/ConfigFile.h>
//...
void InstructionTracker::initialize()
{
m_address = (uint64_t) s2e()->getConfig()->getInt(getConfigKey() + ".addressToTrack");
}
Do not forget to add ``uint64_t m_address;`` to the private members of class ``InstructionTracker``
in ``InstructionTracker.h``.
Instrumenting Instructions
==========================
To instrument an instruction, an S2E plugins registers to the ``onTranslateInstructionStart`` core event.
There are many other core events to which a plugin can register. These events are defined in ``CorePlugin.h``.
Extend your code as follows. Do not forget to add all new member functions to the (private) section of the class declaration.
.. code-block:: c
void InstructionTracker::initialize()
{
m_address = (uint64_t) s2e()->getConfig()->getInt(getConfigKey() + ".addressToTrack");
//This indicates that our plugin is interested in monitoring instruction translation.
//For this, the plugin registers a callback with the onTranslateInstruction signal.
s2e()->getCorePlugin()->onTranslateInstructionStart.connect(
sigc::mem_fun(*this, &InstructionTracker::onTranslateInstruction));
}
void InstructionTracker::onTranslateInstruction(ExecutionSignal *signal,
S2EExecutionState *state,
TranslationBlock *tb,
uint64_t pc)
{
if(m_address == pc) {
//When we find an interesting address, ask S2E to invoke our
//callback when the address is actually executed.
signal->connect(sigc::mem_fun(*this, &InstructionTracker::onInstructionExecution));
}
}
//This callback is called only when the instruction at our address is executed.
//The callback incurs zero overhead for all other instructions.
void InstructionTracker::onInstructionExecution(S2EExecutionState *state, uint64_t pc)
{
s2e()->getDebugStream() << "Executing instruction at " << hexval(pc) << '\n';
//The plugins can arbitrarily modify/observe the current execution state via
//the execution state pointer.
//Plugins can also call the s2e() method to use the S2E API.
}
Counting Instructions
=====================
We would like to count how many times that particular instruction is executed.
There are two options:
1) Count how many times it was executed across all paths.
2) Count how many times it was executed in each path.
The first option is trivial to implement. Simply add an additional member
to the class and increment it every time the ``onInstructionExecution`` callback is invoked.
The second option requires to keep per-state plugin information.
S2E plugins manage per-state information in a class that derives from ``PluginState``.
This class must implement a factory method that returns a new instance of the class when S2E starts symbolic execution.
It must also implement a ``clone`` method which S2E uses to fork the plugin state.
Here is how ``InstructionTracker`` could implement the plugin state.
.. code-block:: c
class InstructionTrackerState: public PluginState
{
private:
int m_count;
public:
InstructionTrackerState() {
m_count = 0;
}
~InstructionTrackerState() {}
static PluginState *factory(Plugin*, S2EExecutionState*) {
return new InstructionTrackerState();
}
InstructionTrackerState *clone() const {
return new InstructionTrackerState(*this);
}
void increment() { ++m_count; }
int get() { return m_count; }
};
Plugin code can refer to this state using the ``DECLARE_PLUGINSTATE`` macro, like this:
.. code-block:: c
void InstructionTracker::onInstructionExecution(S2EExecutionState *state, uint64_t pc)
{
//This macro declares the plgState variable of type InstructionTrackerState.
//It automatically takes care of retrieving the right plugin state attached to the
//specified execution state.
DECLARE_PLUGINSTATE(InstructionTrackerState, state);
s2e()->getDebugStream() << "Executing instruction at " << hexval(pc) << '\n';
//Increment the count
plgState->increment();
}
Exporting Events
================
All S2E plugins can define custom events. Other plugins can in turn connect to them and also export
their own events. This scheme is heavily used by stock S2E plugins. For example, S2E provides the ``Annotation`` plugin that
invokes a user-written script that can arbitrarily manipulate the execution state.
This plugin allows to implement different execution consistency models
and is a central piece in tools like DDT and RevNIC. This plugins relies on ``FunctionMonitor`` to intercept annotated functions and
on ``ModuleExecutionDetector`` to trigger annotations when execution enters user-defined modules. Finally, ``ModuleExecutionDetector``
itself depends on several plugins that abstract OS-specific events (e.g., module loads/unloads).
In this tutorial, we show how ``InstructionTracker`` can expose an event and trigger it when the monitored instruction
is executed ten times.
First, we declare the signal as a ``public`` field of the ``InstructionTracker`` class. It is important that the field be public,
otherwise other plugins will not be able to register.
.. code-block:: c
class InstructionTracker: public Plugin {
//...
public:
sigc::signal<
void,
S2EExecutionState *, //The first parameter of the callback is the state
uint64_t //The second parameter is an integer representing the program counter
> onPeriodicEvent;
//...
}
Second, we add some logic to fire the event and call all the registered callbacks.
.. code-block:: c
void InstructionTracker::onInstructionExecution(S2EExecutionState *state, uint64_t pc)
{
DECLARE_PLUGINSTATE(InstructionTrackerState, state);
s2e()->getDebugStream() << "Executing instruction at " << hexval(pc) << '\n';
plgState->increment();
//Fire the event
if ((plgState->get() % 10) == 0) {
onPeriodicEvent.emit(state, pc);
}
}
That is all we need to define and trigger an event.
To register for this event, a plugin invokes ``s2e()->getPlugin("PluginName");``, where ``PluginName`` is
the name of the plugin as defined in the ``S2E_DEFINE_PLUGIN`` macro.
In our case, a plugin named ``MyClient`` would do something like this in its initialization routine:
.. code-block:: c
//Specify dependencies
S2E_DEFINE_PLUGIN(MyClient, "We use InstructionTracker", "MyClient", "InstructionTracker");
void MyClient::initialize()
{
//Get the instance of the plugin
InstructionTracker *tracker = static_cast<InstructionTracker*>(s2e()->getPlugin("InstructionTracker"));
assert(tracker);
//Register to custom events
tracker->onPeriodicEvent...
//Call plugin's public members
tracker->...
}
Note that S2E enforces the plugin dependencies specified in the ``S2E_DEFINE_PLUGIN`` macro.
If a dependency is not satisfied (e.g., the plugin is not enabled in the configuration file or
is not compiled in S2E), S2E will not start and emit an error message instead.
It is not always necessary to specify the dependencies.
For example, a plugin may want to work with reduced functionality if some dependent plugin is missing.
Attempting to call ``s2e()->getPlugin()`` returns ``NULL`` if the requested plugin is missing.
================================================
FILE: docs/Howtos/init_env.html
================================================
<?xml version="1.0" encoding="utf-8" ?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
<meta name="generator" content="Docutils 0.11: http://docutils.sourceforge.net/" />
<title>How to symbolically execute Linux binaries?</title>
<link rel="stylesheet" href="../s2e.css" type="text/css" />
</head>
<body>
<div class="document" id="how-to-symbolically-execute-linux-binaries">
<h1 class="title">How to symbolically execute Linux binaries?</h1>
<div class="contents topic" id="contents">
<p class="topic-title first">Contents</p>
<ul class="simple">
<li><a class="reference internal" href="#obtaining-and-compiling-init-env" id="id1">1. Obtaining and compiling <tt class="docutils literal">init_env</tt></a></li>
<li><a class="reference internal" href="#configuring-s2e-for-use-with-init-env" id="id2">2. Configuring S2E for use with <tt class="docutils literal">init_env</tt></a></li>
<li><a class="reference internal" href="#using-init-env" id="id3">3. Using <tt class="docutils literal">init_env</tt></a></li>
<li><a class="reference internal" href="#analyzing-large-programs-with-concolic-execution" id="id4">4. Analyzing large programs with concolic execution</a></li>
<li><a class="reference internal" href="#what-about-other-symbolic-input" id="id5">5. What about other symbolic input?</a></li>
</ul>
</div>
<p>In this tutorial, we will show how to symbolically (or concolically) execute <em>existing</em> Linux programs,
<em>without</em> modifying their source code. In the <a class="reference external" href="../TestingMinimalProgram.html">Testing a Simple Program</a> tutorial,
we instrumented the source code with S2E instructions to inject symbolic values.
This tutorial shows how to do this directly from the program's command line.</p>
<p>To do so, we use the <tt class="docutils literal">init_env</tt> shared library and <tt class="docutils literal">LD_PRELOAD</tt>.
This library intercepts the call to the <tt class="docutils literal">main</tt> function and inserts user-configured symbolic arguments.
This library can also restrict symbolic execution to the program itself or to all the code in the program's address space.</p>
<div class="section" id="obtaining-and-compiling-init-env">
<h1>1. Obtaining and compiling <tt class="docutils literal">init_env</tt></h1>
<p>The <tt class="docutils literal">init_env</tt> library can be found in the <tt class="docutils literal">guest</tt> folder of the S2E
distribution. Copy the entire guest directory to your guest virtual machine, and
run <tt class="docutils literal">make</tt>. This will compile <tt class="docutils literal">init_env</tt> along with some other useful
tools.</p>
</div>
<div class="section" id="configuring-s2e-for-use-with-init-env">
<h1>2. Configuring S2E for use with <tt class="docutils literal">init_env</tt></h1>
<p><tt class="docutils literal">init_env</tt> communicates with several S2E plugins in order to restrict
symbolic execution to the program of interest. The S2E configuration
file must contain default settings for these plugins, as follows:</p>
<pre class="literal-block">
plugins = {
-- Enable S2E custom opcodes
"BaseInstructions",
-- Track when the guest loads programs
"RawMonitor",
-- Detect when execution enters
-- the program of interest
"ModuleExecutionDetector",
-- Restrict symbolic execution to
-- the programs of interest
"CodeSelector",
}
</pre>
<p>Note that it is not necessary to declare empty configuration blocks
for <tt class="docutils literal">RawMonitor</tt>, <tt class="docutils literal">ModuleExecutionDetector</tt>, or <tt class="docutils literal">CodeSelector</tt>.</p>
</div>
<div class="section" id="using-init-env">
<h1>3. Using <tt class="docutils literal">init_env</tt></h1>
<p>The <tt class="docutils literal">init_env</tt> library needs to be pre-loaded to your binary using
<tt class="docutils literal">LD_PRELOAD</tt>. <tt class="docutils literal">init_env</tt> intercepts the program's entry point invocation, parses
the command line arguments of the program, configures symbolic execution, and removes <tt class="docutils literal">init_env</tt>-related
parameters, before invoking the original program's entry point.</p>
<p>For example, the following invokes <tt class="docutils literal">echo</tt> from GNU CoreUtils, using up to two
symbolic command line arguments, selecting only code from the <tt class="docutils literal">echo</tt>
binary, and terminating the execution path after <tt class="docutils literal">echo</tt> returns:</p>
<pre class="literal-block">
$ LD_PRELOAD=/path/to/guest/init_env/init_env.so /bin/echo \
--select-process-code --sym-args 0 2 4 ; /path/to/guest/s2ecmd/s2ecmd kill 0 "echo done"
</pre>
<p>The <tt class="docutils literal">s2ecmd</tt> utility can be found in <tt class="docutils literal">$S2EDIR/guest/</tt> and allows to control S2E from
the guest's command line. Here, we ask it to kill the execution path after <tt class="docutils literal">echo</tt> returns.
It is important to do so, otherwise S2E will run forever, all 100s of paths generated by <tt class="docutils literal">echo</tt> will eventually
wait indefinitely at the prompt.</p>
<p>The <tt class="docutils literal">init_env</tt> library supports the following commands. Each command is added
as a command-line parameter to the program being executed. It is removed before
the program sees the actual command line. In the above example, <tt class="docutils literal">echo</tt> would
see zero to two command line arguments of up to four bytes, but would not see
the <tt class="docutils literal"><span class="pre">--select-process-code</span></tt> or <tt class="docutils literal"><span class="pre">--sym-args</span></tt> argument.</p>
<pre class="literal-block">
--select-process Enable forking in the current process only
--select-process-userspace Enable forking in userspace-code of the
current process only
--select-process-code Enable forking in the code section of the
current binary only
--concolic Augment all concrete arguments with symbolic values
--sym-arg <N> Replace by a symbolic argument of length N
--sym-args <MIN> <MAX> <N> Replace by at least MIN arguments and at most
MAX arguments, each with maximum length N
</pre>
<p>Additionally, <tt class="docutils literal">init_env</tt> will show a usage message if the sole argument given
is <tt class="docutils literal"><span class="pre">--help</span></tt>.</p>
</div>
<div class="section" id="analyzing-large-programs-with-concolic-execution">
<h1>4. Analyzing large programs with concolic execution</h1>
<p>Depending on the program under analysis, normal symbolic execution may get stuck in the constraint
solver. It is better in general to use <a class="reference external" href="Concolic.html">concolic execution</a>. The following
command runs <tt class="docutils literal">echo</tt> in concolic mode, based on the concrete parameter <tt class="docutils literal">abc</tt> (i.e., the first
path will print <tt class="docutils literal">abc</tt>, while the others will print other strings):</p>
<pre class="literal-block">
$ LD_PRELOAD=/path/to/guest/init_env/init_env.so /bin/echo --concolic abc ; /path/to/guest/s2ecmd/s2ecmd kill 0 "echo done"
</pre>
<p>You may also want to add <tt class="docutils literal">> /dev/null</tt> to prevent the program from forking in the kernel
when printing symbolic content.</p>
</div>
<div class="section" id="what-about-other-symbolic-input">
<h1>5. What about other symbolic input?</h1>
<p>You can easily feed symbolic data to your program via <tt class="docutils literal">stdin</tt>.
The idea is to pipe the symbolic output of one program to the input of another.
Symbolic output can be generated using the <tt class="docutils literal">s2ecmd</tt> utility, located in the
guest tools directory.</p>
<pre class="literal-block">
$ /path/to/guest/s2ecmd/s2ecmd symbwrite 4 | echo
</pre>
<p>The command above will pass 4 symbolic bytes to <tt class="docutils literal">echo</tt>.</p>
<p>The easiest way to have your program read symbolic data from <em>files</em> (other than
<tt class="docutils literal">stdin</tt>) currently involves a ramdisk. You need to redirect the symbolic output
of <tt class="docutils literal">s2ecmd symbwrite</tt> to a file residing on the ramdisk, then have your program under
test read that file. On many Linux distributions, the <tt class="docutils literal">/tmp</tt> filesystem resides in
RAM, so using a file in <tt class="docutils literal">/tmp</tt> works. This can be checked using the <tt class="docutils literal">df</tt>
command: it should print something similar to <tt class="docutils literal">tmpfs 123 456 123 1% /tmp</tt>.</p>
</div>
</div>
<div class="footer">
<hr class="footer" />
<a class="reference external" href="init_env.rst">View document source</a>.
</div>
</body>
</html>
================================================
FILE: docs/Howtos/init_env.rst
================================================
===========================================
How to symbolically execute Linux binaries?
===========================================
.. contents::
In this tutorial, we will show how to symbolically (or concolically) execute *existing* Linux programs,
*without* modifying their source code. In the `Testing a Simple Program <../TestingMinimalProgram.html>`_ tutorial,
we instrumented the source code with S2E instructions to inject symbolic values.
This tutorial shows how to do this directly from the program's command line.
To do so, we use the ``init_env`` shared library and ``LD_PRELOAD``.
This library intercepts the call to the ``main`` function and inserts user-configured symbolic arguments.
This library can also restrict symbolic execution to the program itself or to all the code in the program's address space.
1. Obtaining and compiling ``init_env``
---------------------------------------
The ``init_env`` library can be found in the ``guest`` folder of the S2E
distribution. Copy the entire guest directory to your guest virtual machine, and
run ``make``. This will compile ``init_env`` along with some other useful
tools.
2. Configuring S2E for use with ``init_env``
--------------------------------------------
``init_env`` communicates with several S2E plugins in order to restrict
symbolic execution to the program of interest. The S2E configuration
file must contain default settings for these plugins, as follows:
::
plugins = {
-- Enable S2E custom opcodes
"BaseInstructions",
-- Track when the guest loads programs
"RawMonitor",
-- Detect when execution enters
-- the program of interest
"ModuleExecutionDetector",
-- Restrict symbolic execution to
-- the programs of interest
"CodeSelector",
}
Note that it is not necessary to declare empty configuration blocks
for ``RawMonitor``, ``ModuleExecutionDetector``, or ``CodeSelector``.
3. Using ``init_env``
---------------------
The ``init_env`` library needs to be pre-loaded to your binary using
``LD_PRELOAD``. ``init_env`` intercepts the program's entry point invocation, parses
the command line arguments of the program, configures symbolic execution, and removes ``init_env``-related
parameters, before invoking the original program's entry point.
For example, the following invokes ``echo`` from GNU CoreUtils, using up to two
symbolic command line arguments, selecting only code from the ``echo``
binary, and terminating the execution path after ``echo`` returns::
$ LD_PRELOAD=/path/to/guest/init_env/init_env.so /bin/echo \
--select-process-code --sym-args 0 2 4 ; /path/to/guest/s2ecmd/s2ecmd kill 0 "echo done"
The ``s2ecmd`` utility can be found in ``$S2EDIR/guest/`` and allows to control S2E from
the guest's command line. Here, we ask it to kill the execution path after ``echo`` returns.
It is important to do so, otherwise S2E will run forever, all 100s of paths generated by ``echo`` will eventually
wait indefinitely at the prompt.
The ``init_env`` library supports the following commands. Each command is added
as a command-line parameter to the program being executed. It is removed before
the program sees the actual command line. In the above example, ``echo`` would
see zero to two command line arguments of up to four bytes, but would not see
the ``--select-process-code`` or ``--sym-args`` argument.
::
--select-process Enable forking in the current process only
--select-process-userspace Enable forking in userspace-code of the
current process only
--select-process-code Enable forking in the code section of the
current binary only
--concolic Augment all concrete arguments with symbolic values
--sym-arg <N> Replace by a symbolic argument of length N
--sym-args <MIN> <MAX> <N> Replace by at least MIN arguments and at most
MAX arguments, each with maximum length N
Additionally, ``init_env`` will show a usage message if the sole argument given
is ``--help``.
4. Analyzing large programs with concolic execution
---------------------------------------------------
Depending on the program under analysis, normal symbolic execution may get stuck in the constraint
solver. It is better in general to use `concolic execution <Concolic.html>`_. The following
command runs ``echo`` in concolic mode, based on the concrete parameter ``abc`` (i.e., the first
path will print ``abc``, while the others will print other strings)::
$ LD_PRELOAD=/path/to/guest/init_env/init_env.so /bin/echo --concolic abc ; /path/to/guest/s2ecmd/s2ecmd kill 0 "echo done"
You may also want to add ``> /dev/null`` to prevent the program from forking in the kernel
when printing symbolic content.
5. What about other symbolic input?
-----------------------------------
You can easily feed symbolic data to your program via ``stdin``.
The idea is to pipe the symbolic output of one program to the input of another.
Symbolic output can be generated using the ``s2ecmd`` utility, located in the
guest tools directory.
::
$ /path/to/guest/s2ecmd/s2ecmd symbwrite 4 | echo
The command above will pass 4 symbolic bytes to ``echo``.
The easiest way to have your program read symbolic data from *files* (other than
``stdin``) currently involves a ramdisk. You need to redirect the symbolic output
of ``s2ecmd symbwrite`` to a file residing on the ramdisk, then have your program under
test read that file. On many Linux distributions, the ``/tmp`` filesystem resides in
RAM, so using a file in ``/tmp`` works. This can be checked using the ``df``
command: it should print something similar to ``tmpfs 123 456 123 1% /tmp``.
================================================
FILE: docs/ImageInstallation.html
================================================
<?xml version="1.0" encoding="utf-8" ?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
<meta name="generator" content="Docutils 0.11: http://docutils.sourceforge.net/" />
<title>Preparing VM Images for S2E</title>
<link rel="stylesheet" href="./s2e.css" type="text/css" />
</head>
<body>
<div class="document" id="preparing-vm-images-for-s2e">
<h1 class="title">Preparing VM Images for S2E</h1>
<div class="contents topic" id="contents">
<p class="topic-title first">Contents</p>
<ul class="simple">
<li><a class="reference internal" href="#preparing-a-linux-vm-image" id="id1">Preparing a Linux VM Image</a></li>
<li><a class="reference internal" href="#the-s2e-vm-image-format" id="id2">The S2E VM Image Format</a></li>
<li><a class="reference internal" href="#general-requirements-and-guidelines-for-vm-images" id="id3">General Requirements and Guidelines for VM Images</a></li>
<li><a class="reference internal" href="#experimental-kvm-snapshot-support" id="id4">Experimental KVM Snapshot Support</a></li>
</ul>
</div>
<p>To run S2E, you need a QEMU-compatible virtual machine disk image. S2E can run
any x86 operating system inside the VM.
In this section, we describe how to build a Linux image and present general
requirements and guidelines for various operating systems.</p>
<div class="section" id="preparing-a-linux-vm-image">
<h1>Preparing a Linux VM Image</h1>
<p>In the following, we describe how to install a minimal version of Debian Linux in QEMU.</p>
<p><strong>Please make sure that you perform all the steps below using QEMU that ships with S2E.</strong>
There will be compatibility problems if you use QEMU that comes with your system (especially
when saving/restoring snapshots).</p>
<p><tt class="docutils literal">$S2EDIR</tt> refers to the directory where S2E is installed. The paths below assume you
followed the installation tutorials.</p>
<pre class="literal-block">
$ # Create an empty disk image
$ $S2EDIR/build/qemu-release/qemu-img create -f raw s2e_disk.raw 2G
$ # Download debian install CD (the exact version doesn't really matter, below is an example)
$ wget http://cdimage.debian.org/debian-cd/7.7.0/i386/iso-cd/debian-7.7.0-i386-CD-1.iso
$ # Run QEMU and install the OS
$ $S2EDIR/build/qemu-release/i386-softmmu/qemu-system-i386 s2e_disk.raw -enable-kvm -m 1024 -cdrom debian-7.7.0-i386-CD-1.iso
> Follow on-screen instructions to install Debian Linux inside VM (use the most basic setup that includes ssh)
> If you have trouble navigating the menus, try specifying a keymap (e.g., add "-k en-us")
> Using "-enable-kvm" is faster, but KVM must be installed and you must be in the 'kvm' group (otherwise remove "-enable-kvm")
$ # When your system is installed and rebooted, run the following command
$ # inside the guest to install C and C++ compilers
guest$ su -c "apt-get install build-essential"
</pre>
<p>You have just set up a disk image in RAW format. You will need to give it
a .s2e extension for use with S2E (the reasons for this are described in
the next section). The S2E image format is identical to the RAW format, so
no conversion needs to take place. We therefore create a .raw.s2e copy that
will be treated as read-only by S2E, and we keep around the .raw image in
case we want to make modifications to the base image in the future.</p>
<pre class="literal-block">
$ ln s2e_disk.raw s2e_disk.raw.s2e
</pre>
</div>
<div class="section" id="the-s2e-vm-image-format">
<h1>The S2E VM Image Format</h1>
<p>Existing image formats are not suitable for multi-path execution, because
they usually mutate internal bookkeeping structures on read operations.
Worse, they may write these mutations back to the disk image file, causing
VM image corruptions. QCOW2 is one example of such formats.</p>
<p>The S2E image format, unlike the other formats, is multi-path aware.
When in S2E mode, writes are local to each state and do not clobber other states.
Moreover, writes are NEVER propagated from the state to the image (or the snapshot). This makes it possible
to share one disk image and snapshots among many instances of S2E.</p>
<p>The S2E image format stores snapshots in a separate file, suffixed by the name of the
snapshot. For example, if the base image is called "my_image.raw.s2e",
the snapshot <tt class="docutils literal">ready</tt> (generated with <tt class="docutils literal">savevm ready</tt>) will be saved in the file
<tt class="docutils literal">my_image.raw.s2e.ready</tt> in the same folder as <tt class="docutils literal">my_image.raw.s2e</tt>.</p>
</div>
<div class="section" id="general-requirements-and-guidelines-for-vm-images">
<h1>General Requirements and Guidelines for VM Images</h1>
<p>When running in S2E mode, the image <strong>must</strong> be in S2E format. S2E does not support any other image format.</p>
<p>Any x86 image that boots in vanilla QEMU will work in S2E. However, we enumerate a list of tips
and optimizations that will make administration easier and symbolic execution faster.
<em>These tips should be used as guidelines and are not mandatory.</em></p>
<p>Here is a checklist we recommend to follow:</p>
<ul class="simple">
<li>Install your operating system in the vanilla QEMU. It is the fastest approach. In general, all installation and setup tasks should be done in vanilla QEMU.</li>
<li>Keep a fresh copy of your OS installation. It is recommended to start with a fresh copy for each analysis task. For instance, if you use an image to test a device driver, avoid using this same image to analyze some spreadsheet component. One image = one analysis. It is easier to manage and your results will be easier to reproduce.</li>
<li>Once your image (in S2E format) is set up and ready to be run in symbolic execution mode, take a snapshot and resume that snapshot in the S2E-enabled QEMU. This step is not necessary, but it greatly shortens boot times. Booting an image in S2E can take a (very) long time.</li>
<li>It is recommended to use 128MiB of RAM for the guest OS (or less). S2E is not limited by the amount of memory in any way (it is 64-bit), but your physical machine is.</li>
<li>Disable fancy desktop themes. Most OSes have a GUI, which consumes resources. Disabling all visual effects will make program analysis faster.</li>
<li>Disable the screen saver.</li>
<li>Disable unnecessary services to save memory and speed up the guest. Services like file sharing, printing, wireless network configuration, or firewall are useless unless you want to test them in S2E.</li>
<li>Avoid the QEMU <tt class="docutils literal">virtio</tt> network interface for now. In the version of QEMU that is bundled into S2E, there can be random crashes.</li>
</ul>
</div>
<div class="section" id="experimental-kvm-snapshot-support">
<h1>Experimental KVM Snapshot Support</h1>
<p>It is possible to boot an image in KVM mode, take a snapshot, and resume
it in the dynamic binary translation (DBT) mode that QEMU normally uses.
This is useful if your guest system is large and avoids cumbersome manipulations to workaround the relative slowness of the DBT
(e.g., starting in QEMU, setting up, converting the disk image to S2E, rebooting again in DBT mode, etc.).</p>
<pre class="literal-block">
# Set up the guest, take a snapshot
$ ./qemu-release/x86_64-softmmu/qemu-system-x86_64 -enable-kvm -cpu core2duo -net none
# Resume the snapshot in DBT mode using vanilla QEMU, to finish the setup
$ ./qemu-release/x86_64-softmmu/qemu-system-x86_64 -cpu core2duo -net none -loadvm mysnapshot
# Resume the snapshot in S2E mode
$ ./qemu-release/x86_64-s2e-softmmu/qemu-system-x86_64 -cpu core2duo -net none -loadvm mysnapshot
</pre>
<p>Limitations:</p>
<ul class="simple">
<li>The host CPU in KVM mode must match the virtual CPU in DBT mode. For example, you cannot save a KVM snapshot
on an Intel CPU and resume it with default settings in DBT mode (i.e., -cpu qemu64, which uses the AMD variations of some instructions).</li>
<li>The CPUID flags should be matched between KVM and DBT mode. Mismatches do not seem to matter for simple experiments, but may
lead to guest kernel crashes. You can dump <tt class="docutils literal">/proc/cpuinfo</tt> in KVM and DBT mode, compare both and add the corresponding tweaks
to the <tt class="docutils literal"><span class="pre">-cpu</span></tt> parameter.</li>
<li>KVM mode does not support S2E custom instructions. They cause an invalid opcode exception in the guest.
Therefore, you might need to save a second snapshot in DBT mode when using tools such as <tt class="docutils literal">s2eget</tt>.</li>
<li>It is possible that the guest hangs when resumed in DBT mode from a KVM snapshot.
Try to save and resume again.</li>
<li>Resuming DBT snapshots in KVM mode does not seem to work.</li>
</ul>
</div>
</div>
<div class="footer">
<hr class="footer" />
<a class="reference external" href="ImageInstallation.rst">View document source</a>.
</div>
</body>
</html>
================================================
FILE: docs/ImageInstallation.rst
================================================
=============================
Preparing VM Images for S2E
=============================
.. contents::
To run S2E, you need a QEMU-compatible virtual machine disk image. S2E can run
any x86 operating system inside the VM.
In this section, we describe how to build a Linux image and present general
requirements and guidelines for various operating systems.
Preparing a Linux VM Image
==========================
In the following, we describe how to install a minimal version of Debian Linux in QEMU.
**Please make sure that you perform all the steps below using QEMU that ships with S2E.**
There will be compatibility problems if you use QEMU that comes with your system (especially
when saving/restoring snapshots).
``$S2EDIR`` refers to the directory where S2E is installed. The paths below assume you
followed the installation tutorials.
::
$ # Create an empty disk image
$ $S2EDIR/build/qemu-release/qemu-img create -f raw s2e_disk.raw 2G
$ # Download debian install CD (the exact version doesn't really matter, below is an example)
$ wget http://cdimage.debian.org/debian-cd/7.7.0/i386/iso-cd/debian-7.7.0-i386-CD-1.iso
$ # Run QEMU and install the OS
$ $S2EDIR/build/qemu-release/i386-softmmu/qemu-system-i386 s2e_disk.raw -enable-kvm -m 1024 -cdrom debian-7.7.0-i386-CD-1.iso
> Follow on-screen instructions to install Debian Linux inside VM (use the most basic setup that includes ssh)
> If you have trouble navigating the menus, try specifying a keymap (e.g., add "-k en-us")
> Using "-enable-kvm" is faster, but KVM must be installed and you must be in the 'kvm' group (otherwise remove "-enable-kvm")
$ # When your system is installed and rebooted, run the following command
$ # inside the guest to install C and C++ compilers
guest$ su -c "apt-get install build-essential"
You have just set up a disk image in RAW format. You will need to give it
a .s2e extension for use with S2E (the reasons for this are described in
the next section). The S2E image format is identical to the RAW format, so
no conversion needs to take place. We therefore create a .raw.s2e copy that
will be treated as read-only by S2E, and we keep around the .raw image in
case we want to make modifications to the base image in the future.
::
$ ln s2e_disk.raw s2e_disk.raw.s2e
The S2E VM Image Format
=======================
Existing image formats are not suitable for multi-path execution, because
they usually mutate internal bookkeeping structures on read operations.
Worse, they may write these mutations back to the disk image file, causing
VM image corruptions. QCOW2 is one example of such formats.
The S2E image format, unlike the other formats, is multi-path aware.
When in S2E mode, writes are local to each state and do not clobber other states.
Moreover, writes are NEVER propagated from the state to the image (or the snapshot). This makes it possible
to share one disk image and snapshots among many instances of S2E.
The S2E image format stores snapshots in a separate file, suffixed by the name of the
snapshot. For example, if the base image is called "my_image.raw.s2e",
the snapshot ``ready`` (generated with ``savevm ready``) will be saved in the file
``my_image.raw.s2e.ready`` in the same folder as ``my_image.raw.s2e``.
General Requirements and Guidelines for VM Images
=================================================
When running in S2E mode, the image **must** be in S2E format. S2E does not support any other image format.
Any x86 image that boots in vanilla QEMU will work in S2E. However, we enumerate a list of tips
and optimizations that will make administration easier and symbolic execution faster.
*These tips should be used as guidelines and are not mandatory.*
Here is a checklist we recommend to follow:
* Install your operating system in the vanilla QEMU. It is the fastest approach. In general, all installation and setup tasks should be done in vanilla QEMU.
* Keep a fresh copy of your OS installation. It is recommended to start with a fresh copy for each analysis task. For instance, if you use an image to test a device driver, avoid using this same image to analyze some spreadsheet component. One image = one analysis. It is easier to manage and your results will be easier to reproduce.
* Once your image (in S2E format) is set up and ready to be run in symbolic execution mode, take a snapshot and resume that snapshot in the S2E-enabled QEMU. This step is not necessary, but it greatly shortens boot times. Booting an image in S2E can take a (very) long time.
* It is recommended to use 128MiB of RAM for the guest OS (or less). S2E is not limited by the amount of memory in any way (it is 64-bit), but your physical machine is.
* Disable fancy desktop themes. Most OSes have a GUI, which consumes resources. Disabling all visual effects will make program analysis faster.
* Disable the screen saver.
* Disable unnecessary services to save memory and speed up the guest. Services like file sharing, printing, wireless network configuration, or firewall are useless unless you want to test them in S2E.
* Avoid the QEMU ``virtio`` network interface for now. In the version of QEMU that is bundled into S2E, there can be random crashes.
Experimental KVM Snapshot Support
=================================
It is possible to boot an image in KVM mode, take a snapshot, and resume
it in the dynamic binary translation (DBT) mode that QEMU normally uses.
This is useful if your guest system is large and avoids cumbersome manipulations to workaround the relative slowness of the DBT
(e.g., starting in QEMU, setting up, converting the disk image to S2E, rebooting again in DBT mode, etc.).
::
# Set up the guest, take a snapshot
$ ./qemu-release/x86_64-softmmu/qemu-system-x86_64 -enable-kvm -cpu core2duo -net none
# Resume the snapshot in DBT mode using vanilla QEMU, to finish the setup
$ ./qemu-release/x86_64-softmmu/qemu-system-x86_64 -cpu core2duo -net none -loadvm mysnapshot
# Resume the snapshot in S2E mode
$ ./qemu-release/x86_64-s2e-softmmu/qemu-system-x86_64 -cpu core2duo -net none -loadvm mysnapshot
Limitations:
- The host CPU in KVM mode must match the virtual CPU in DBT mode. For example, you cannot save a KVM snapshot
on an Intel CPU and resume it with default settings in DBT mode (i.e., -cpu qemu64, which uses the AMD variations of some instructions).
- The CPUID flags should be matched between KVM and DBT mode. Mismatches do not seem to matter for simple experiments, but may
lead to guest kernel crashes. You can dump ``/proc/cpuinfo`` in KVM and DBT mode, compare both and add the corresponding tweaks
to the ``-cpu`` parameter.
- KVM mode does not support S2E custom instructions. They cause an invalid opcode exception in the guest.
Therefore, you might need to save a second snapshot in DBT mode when using tools such as ``s2eget``.
- It is possible that the guest hangs when resumed in DBT mode from a KVM snapshot.
Try to save and resume again.
- Resuming DBT snapshots in KVM mode does not seem to work.
================================================
FILE: docs/Makefile
================================================
RST_FILES := $(wildcard *.rst */*.rst)
HTML_FILES := $(RST_FILES:.rst=.html)
all: $(HTML_FILES)
clean:
rm -f $(HTML_FILES)
%.html: %.rst
./rst2html-pygments \
--stylesheet=$$(echo $< | sed -e 's:[^/]\+/:../:g' | xargs dirname)/s2e.css \
--link-stylesheet --source-link --no-toc-backlinks \
--input-encoding utf-8:strict $< $@
sed -i 's/\.rst/\.html/' $@
sed -i 's/$(basename $(notdir $@))\.html/$(basename $(notdir $@)).rst/' $@
================================================
FILE: docs/Plugins/Annotation.html
================================================
<?xml version="1.0" encoding="utf-8" ?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
<meta name="generator" content="Docutils 0.11: http://docutils.sourceforge.net/" />
<title>Annotation</title>
<link rel="stylesheet" href="../s2e.css" type="text/css" />
</head>
<body>
<div class="document" id="annotation">
<h1 class="title">Annotation</h1>
<p>The Annotations plugin combines monitoring and instrumentation capabilities to
let users annotate single machine instructions or entire function calls. The
user writes the annotation directly inside the S2E configuration file, using the Lua
language.</p>
<dl class="docutils">
<dt>This plugin can be used to manipulate:</dt>
<dd><ul class="first last simple">
<li>single instructions</li>
<li>entire function calls</li>
</ul>
</dd>
</dl>
<p>It requires <em>FunctionMonitor</em>, <em>ModuleExecutionDetector</em> and an OS monitor plugin
(or the generic <em>RawMonitor</em>) as dependencies.</p>
<div class="section" id="setting-up-s2e-for-annotation-usage">
<h1>Setting up S2E for Annotation usage</h1>
<p>An example of practical Annotation usage is shown in the <a class="reference external" href="../Windows/DriverTutorial.html">Analyzing Windows Driver tutorial</a>, as follows:</p>
<pre class="literal-block">
plugins = {
"WindowsMonitor",
"ModuleExecutionDetector",
"FunctionMonitor",
"BlueScreenInterceptor",
"Annotation"
}
pluginsConfig = {}
-- OS monitor configuration (Win XP)
pluginsConfig.WindowsMonitor = {
version="XPSP3",
userMode=true,
kernelMode=true,
checked=false,
monitorModuleLoad=true,
monitorModuleUnload=true,
monitorProcessUnload=true
}
-- Module detector configuration (pcntpci5.sys driver)
pluginsConfig.ModuleExecutionDetector = {
pcntpci5_sys_1 = {
moduleName = "pcntpci5.sys",
kernelMode = true,
},
}
-- Annotation configuration
pluginsConfig.Annotation =
{
ann1 = {
active=true,
module="pcntpci5_sys_1",
address=0x169c9,
instructionAnnotation="print_ebx",
beforeInstruction = true,
switchInstructionToSymbolic = false
},
ann2 = {
module="pcntpci5_sys_1",
active = true,
address = 0x1233a,
callAnnotation = "copyup",
paramcount = 4
},
}
-- Annotation to fiddle with driver buffer
function copyup (state, pluginState)
buf = state:readParameter(0);
len = state:reaParameter(3);
for i = 0, len - 1, 1 do
state:writeMemorySymb("copyup_buf", buf + i, 1);
end
state:writeRegister("eax", 1);
pluginState:setSkip(true);
end
-- Annotation to inspect driver status
function print_ebx (state, pluginState)
status = state:readRegister("ebx");
print("Driver status: " .. status);
end
</pre>
</div>
<div class="section" id="options">
<h1>Options</h1>
<p>Each annotation is defined in a single sub-module within an Annotation configuration block.
This plugin accepts an arbitrary number of per-module sections.
Per-module options are prefixed with <em>"ann_section."</em> in the documentation (equivalent to
<em>ann1</em> and <em>ann2</em> in the examples). Refer to the sections below for details.</p>
<dl class="docutils">
<dt>Configuration options are semantically organized in three groups:</dt>
<dd><ul class="first last simple">
<li>common for all annotations</li>
<li>specific to function call annotations</li>
<li>specific to single instruction annotations</li>
</ul>
</dd>
</dl>
<div class="section" id="common-options">
<h2>Common options</h2>
<p>These options are common to all types of annotations.</p>
<div class="section" id="ann-section-module-string">
<h3>ann_section.module=["string"]</h3>
<p>The name of the module. This must match the name returned by the monitoring plugin.</p>
</div>
<div class="section" id="ann-section-active-true-false">
<h3>ann_section.active=[true|false]</h3>
<p>Whether the annotation is active or not (default is false).</p>
</div>
<div class="section" id="ann-section-address-int">
<h3>ann_section.address=[int]</h3>
<p>The native address of the instruction or the entry-point of the function to annotate.</p>
</div>
</div>
<div class="section" id="function-call-annotation">
<h2>Function call annotation</h2>
<p>These options have to be used in order to annotate function calls.</p>
<div class="section" id="ann-section-callannotation-string">
<h3>ann_section.callAnnotation=["string"]</h3>
<p>The name of the Lua function to execute when the annotation triggers.
This option also specifies that the user wants to annotate the entire function
starting at <em>module.address</em>.
The callAnnotation will be triggered twice: once when entering and again when
returning from the annotated function call.</p>
</div>
<div class="section" id="ann-section-paramcount-int">
<h3>ann_section.paramcount=[int]</h3>
<p>The number of input parameters taken by the annotated function, under the <strong>cdecl</strong>
calling convention (default is 0). In fact, this assumes that all parameters are
passed on the stack, and will not work with different calling conventions.</p>
</div>
</div>
<div class="section" id="instruction-annotation">
<h2>Instruction annotation</h2>
<p>These options have to be used in order to annotate single instructions.</p>
<div class="section" id="ann-section-instructionannotation-string">
<h3>ann_section.instructionAnnotation=["string"]</h3>
<p>The name of the Lua function to execute when the annotation triggers.
This option also specifies that the user wants to annotate only the single instruction
at <em>module.address</em>.
The instructionAnnotation will be triggered just once when execution reaches the
annotated address.</p>
</div>
<div class="section" id="ann-section-beforeinstruction-true-false">
<h3>ann_section.beforeInstruction=[true|false]</h3>
<p>Whether to call the annotation before or after the instruction (default is false).</p>
</div>
<div class="section" id="ann-section-switchinstructiontosymbolic-true-false">
<h3>ann_section.switchInstructionToSymbolic=[true|false]</h3>
<p>Whether to switch to symbolic mode before executing the annotated instruction (default is false).
Please note that symbolic execution is required in order to write symbolic values, ie. you will
need to enable this setting in order to inject symbolic values via the Lua API. Failing to do
so will result in S2E crash.</p>
</div>
</div>
</div>
<div class="section" id="configuration-sample">
<h1>Configuration Sample</h1>
<p>Here below is an example of a complete Annotation configuration stanza showing how to specify
annotations for both function calls and single instructions.</p>
<pre class="literal-block">
pluginsConfig.Annotation = {
-- function call annotation
ann1 = {
module = "modA",
active = true,
address = 0x0000CAFE,
callAnnotation = "call_ann",
p
gitextract_8rt5w_4a/
├── .github/
│ └── FUNDING.yml
├── .gitignore
├── LICENSE
├── Makefile
├── README
├── S2E-AUTHORS
├── config.lua
├── docs/
│ ├── BuildingLinux.html
│ ├── BuildingLinux.rst
│ ├── BuildingS2E.html
│ ├── BuildingS2E.rst
│ ├── Contribute.html
│ ├── Contribute.rst
│ ├── EquivalenceTesting.html
│ ├── EquivalenceTesting.rst
│ ├── FAQ.html
│ ├── FAQ.rst
│ ├── Howtos/
│ │ ├── Concolic.html
│ │ ├── Concolic.rst
│ │ ├── Debugging.html
│ │ ├── Debugging.rst
│ │ ├── ExecutionTracers.html
│ │ ├── ExecutionTracers.rst
│ │ ├── Parallel.html
│ │ ├── Parallel.rst
│ │ ├── WritingPlugins.html
│ │ ├── WritingPlugins.rst
│ │ ├── init_env.html
│ │ └── init_env.rst
│ ├── ImageInstallation.html
│ ├── ImageInstallation.rst
│ ├── Makefile
│ ├── Plugins/
│ │ ├── Annotation.html
│ │ ├── Annotation.rst
│ │ ├── BaseInstructions.html
│ │ ├── BaseInstructions.rst
│ │ ├── EdgeKiller.html
│ │ ├── EdgeKiller.rst
│ │ ├── FunctionMonitor.html
│ │ ├── FunctionMonitor.rst
│ │ ├── ModuleExecutionDetector.html
│ │ ├── ModuleExecutionDetector.rst
│ │ ├── RawMonitor.html
│ │ ├── RawMonitor.rst
│ │ ├── StateManager.html
│ │ ├── StateManager.rst
│ │ ├── Tracers/
│ │ │ ├── ExecutionTracer.html
│ │ │ ├── ExecutionTracer.rst
│ │ │ ├── InstructionCounter.html
│ │ │ ├── InstructionCounter.rst
│ │ │ ├── ModuleTracer.html
│ │ │ ├── ModuleTracer.rst
│ │ │ ├── TestCaseGenerator.html
│ │ │ ├── TestCaseGenerator.rst
│ │ │ ├── TranslationBlockTracer.html
│ │ │ └── TranslationBlockTracer.rst
│ │ └── WindowsInterceptor/
│ │ ├── WindowsMonitor.html
│ │ └── WindowsMonitor.rst
│ ├── ProfilingS2E.html
│ ├── ProfilingS2E.rst
│ ├── SystemTap.html
│ ├── SystemTap.rst
│ ├── TestingMinimalProgram.html
│ ├── TestingMinimalProgram.rst
│ ├── Tools/
│ │ ├── CoverageGenerator.html
│ │ ├── CoverageGenerator.rst
│ │ ├── DebugInfo.html
│ │ ├── DebugInfo.rst
│ │ ├── ExecutionProfiler.html
│ │ ├── ExecutionProfiler.rst
│ │ ├── ForkProfiler.html
│ │ ├── ForkProfiler.rst
│ │ ├── TbPrinter.html
│ │ └── TbPrinter.rst
│ ├── UsingS2EGet.html
│ ├── UsingS2EGet.rst
│ ├── Windows/
│ │ ├── CheckedBuild.html
│ │ ├── CheckedBuild.rst
│ │ ├── DriverTutorial.html
│ │ └── DriverTutorial.rst
│ ├── config.s2e.i686
│ ├── index.html
│ ├── index.rst
│ ├── pygments-default.css
│ ├── rst2html-pygments
│ ├── rst2latex-pygments
│ ├── s2e.css
│ └── sample/
│ └── factorial.c
├── guest/
│ ├── Makefile
│ ├── configure
│ ├── demos/
│ │ └── quicksort.c
│ ├── include/
│ │ ├── s2e-arm.h
│ │ ├── s2e-x86.h
│ │ └── s2e.h
│ ├── init_env/
│ │ └── init_env.c
│ ├── s2ecmd/
│ │ └── s2ecmd.c
│ ├── s2eget/
│ │ └── s2eget.c
│ ├── stp/
│ │ └── s2e.stp
│ └── windbg-gdb/
│ ├── BFDInterface.cpp
│ ├── BFDInterface.h
│ ├── Makefile
│ ├── StartSize.h
│ ├── Symbols.cpp
│ ├── Symbols.h
│ ├── gdbsyms.def
│ └── main.cpp
├── klee/
│ ├── LICENSE.TXT
│ ├── Makefile
│ ├── Makefile.common
│ ├── Makefile.config.in
│ ├── README.txt
│ ├── TODO.txt
│ ├── autoconf/
│ │ ├── AutoRegen.sh
│ │ ├── config.guess
│ │ ├── config.sub
│ │ ├── configure.ac
│ │ └── install-sh
│ ├── configure
│ ├── docs/
│ │ ├── SMT-COMP/
│ │ │ ├── BitVector_ArraysEx.smt
│ │ │ ├── BitVectors.smt
│ │ │ ├── QF_AUFBV.smt
│ │ │ └── QF_BV.smt
│ │ ├── doxygen.cfg
│ │ ├── intro
│ │ └── overview
│ ├── examples/
│ │ ├── islower/
│ │ │ └── islower.c
│ │ ├── regexp/
│ │ │ ├── Regexp.c
│ │ │ └── notes.txt
│ │ └── sort/
│ │ └── sort.c
│ ├── include/
│ │ ├── expr/
│ │ │ ├── Lexer.h
│ │ │ └── Parser.h
│ │ └── klee/
│ │ ├── AddressSpace.h
│ │ ├── BitfieldSimplifier.h
│ │ ├── CallPathManager.h
│ │ ├── Common.h
│ │ ├── Config/
│ │ │ ├── common.h
│ │ │ └── config.h.in
│ │ ├── Constraints.h
│ │ ├── Context.h
│ │ ├── CoreStats.h
│ │ ├── ExecutionState.h
│ │ ├── Executor.h
│ │ ├── Expr.h
│ │ ├── ExprBuilder.h
│ │ ├── ExternalDispatcher.h
│ │ ├── IncompleteSolver.h
│ │ ├── Internal/
│ │ │ ├── ADT/
│ │ │ │ ├── DiscretePDF.h
│ │ │ │ ├── DiscretePDF.inc
│ │ │ │ ├── ImmutableMap.h
│ │ │ │ ├── ImmutableSet.h
│ │ │ │ ├── ImmutableTree.h
│ │ │ │ ├── KTest.h
│ │ │ │ ├── MapOfSets.h
│ │ │ │ ├── RNG.h
│ │ │ │ └── TreeStream.h
│ │ │ ├── Module/
│ │ │ │ ├── Cell.h
│ │ │ │ ├── InstructionInfoTable.h
│ │ │ │ ├── KInstIterator.h
│ │ │ │ ├── KInstruction.h
│ │ │ │ └── KModule.h
│ │ │ ├── README.txt
│ │ │ ├── Support/
│ │ │ │ ├── FloatEvaluation.h
│ │ │ │ ├── IntEvaluation.h
│ │ │ │ ├── ModuleUtil.h
│ │ │ │ ├── QueryLog.h
│ │ │ │ └── Timer.h
│ │ │ └── System/
│ │ │ └── Time.h
│ │ ├── Interpreter.h
│ │ ├── Memory.h
│ │ ├── ObjectHolder.h
│ │ ├── PTree.h
│ │ ├── Searcher.h
│ │ ├── Solver.h
│ │ ├── SolverImpl.h
│ │ ├── SolverStats.h
│ │ ├── Statistic.h
│ │ ├── Statistics.h
│ │ ├── StatsTracker.h
│ │ ├── TimerStatIncrementer.h
│ │ ├── UserSearcher.h
│ │ └── util/
│ │ ├── Assignment.h
│ │ ├── BitArray.h
│ │ ├── Bits.h
│ │ ├── ExprEvaluator.h
│ │ ├── ExprHashMap.h
│ │ ├── ExprPPrinter.h
│ │ ├── ExprRangeEvaluator.h
│ │ ├── ExprUtil.h
│ │ ├── ExprVisitor.h
│ │ └── Ref.h
│ ├── lib/
│ │ ├── Basic/
│ │ │ ├── KTest.cpp
│ │ │ ├── Makefile
│ │ │ ├── README.txt
│ │ │ └── Statistics.cpp
│ │ ├── Core/
│ │ │ ├── AddressSpace.cpp
│ │ │ ├── CallPathManager.cpp
│ │ │ ├── Common.cpp
│ │ │ ├── Context.cpp
│ │ │ ├── CoreStats.cpp
│ │ │ ├── ExecutionState.cpp
│ │ │ ├── Executor.cpp
│ │ │ ├── ExecutorTimers.cpp
│ │ │ ├── ExecutorUtil.cpp
│ │ │ ├── ExternalDispatcher.cpp
│ │ │ ├── ImpliedValue.cpp
│ │ │ ├── ImpliedValue.h
│ │ │ ├── KleeExecutor.cpp
│ │ │ ├── KleeExecutor.h
│ │ │ ├── Makefile
│ │ │ ├── Memory.cpp
│ │ │ ├── MemoryManager.cpp
│ │ │ ├── MemoryManager.h
│ │ │ ├── PTree.cpp
│ │ │ ├── Searcher.cpp
│ │ │ ├── SeedInfo.cpp
│ │ │ ├── SeedInfo.h
│ │ │ ├── SpecialFunctionHandler.cpp
│ │ │ ├── SpecialFunctionHandler.h
│ │ │ ├── StatsTracker.cpp
│ │ │ ├── TimingSolver.cpp
│ │ │ ├── TimingSolver.h
│ │ │ └── UserSearcher.cpp
│ │ ├── Expr/
│ │ │ ├── BitfieldSimplifier.cpp
│ │ │ ├── Constraints.cpp
│ │ │ ├── Expr.cpp
│ │ │ ├── ExprBuilder.cpp
│ │ │ ├── ExprEvaluator.cpp
│ │ │ ├── ExprPPrinter.cpp
│ │ │ ├── ExprUtil.cpp
│ │ │ ├── ExprVisitor.cpp
│ │ │ ├── Lexer.cpp
│ │ │ ├── Makefile
│ │ │ ├── Parser.cpp
│ │ │ └── Updates.cpp
│ │ ├── Makefile
│ │ ├── Module/
│ │ │ ├── Checks.cpp
│ │ │ ├── InstructionInfoTable.cpp
│ │ │ ├── IntrinsicCleaner.cpp
│ │ │ ├── KInstruction.cpp
│ │ │ ├── KModule.cpp
│ │ │ ├── LowerSwitch.cpp
│ │ │ ├── Makefile
│ │ │ ├── ModuleUtil.cpp
│ │ │ ├── Optimize.cpp
│ │ │ ├── Passes.h
│ │ │ ├── PhiCleaner.cpp
│ │ │ └── RaiseAsm.cpp
│ │ ├── README.txt
│ │ ├── SMT/
│ │ │ ├── LICENSE.CVC3
│ │ │ ├── Makefile
│ │ │ ├── SMTParser.cpp
│ │ │ ├── SMTParser.h
│ │ │ ├── main.cpp
│ │ │ ├── smtlib.lex
│ │ │ └── smtlib.y
│ │ ├── Solver/
│ │ │ ├── CachingSolver.cpp
│ │ │ ├── CexCachingSolver.cpp
│ │ │ ├── ConstantDivision.cpp
│ │ │ ├── ConstantDivision.h
│ │ │ ├── FastCexSolver.cpp
│ │ │ ├── IncompleteSolver.cpp
│ │ │ ├── IndependentSolver.cpp
│ │ │ ├── Makefile
│ │ │ ├── PCLoggingSolver.cpp
│ │ │ ├── STPBuilder.cpp
│ │ │ ├── STPBuilder.h
│ │ │ ├── Solver.cpp
│ │ │ └── SolverStats.cpp
│ │ └── Support/
│ │ ├── Makefile
│ │ ├── README.txt
│ │ ├── RNG.cpp
│ │ ├── Time.cpp
│ │ ├── Timer.cpp
│ │ └── TreeStream.cpp
│ ├── runtime/
│ │ ├── Intrinsic/
│ │ │ ├── Makefile
│ │ │ ├── klee_div_zero_check.c
│ │ │ ├── klee_int.c
│ │ │ ├── klee_range.c
│ │ │ ├── memcpy.c
│ │ │ ├── memmove.c
│ │ │ ├── mempcpy.c
│ │ │ └── memset.c
│ │ ├── Makefile
│ │ ├── POSIX/
│ │ │ ├── Makefile
│ │ │ ├── fd.c
│ │ │ ├── fd.h
│ │ │ ├── fd_32.c
│ │ │ ├── fd_64.c
│ │ │ ├── fd_init.c
│ │ │ ├── illegal.c
│ │ │ ├── klee_init_env.c
│ │ │ ├── misc.c
│ │ │ ├── selinux.c
│ │ │ ├── stubs.c
│ │ │ ├── testing-dir/
│ │ │ │ ├── c
│ │ │ │ └── d
│ │ │ └── testing-env
│ │ ├── Runtest/
│ │ │ ├── Makefile
│ │ │ └── intrinsics.c
│ │ └── klee-libc/
│ │ ├── Makefile
│ │ ├── __cxa_atexit.c
│ │ ├── abort.c
│ │ ├── atexit.c
│ │ ├── atoi.c
│ │ ├── calloc.c
│ │ ├── htonl.c
│ │ ├── klee-choose.c
│ │ ├── memchr.c
│ │ ├── memcmp.c
│ │ ├── memcpy.c
│ │ ├── memmove.c
│ │ ├── mempcpy.c
│ │ ├── memset.c
│ │ ├── putchar.c
│ │ ├── stpcpy.c
│ │ ├── strcat.c
│ │ ├── strchr.c
│ │ ├── strcmp.c
│ │ ├── strcoll.c
│ │ ├── strcpy.c
│ │ ├── strlen.c
│ │ ├── strncmp.c
│ │ ├── strncpy.c
│ │ ├── strrchr.c
│ │ ├── strtol.c
│ │ ├── strtoul.c
│ │ ├── tolower.c
│ │ └── toupper.c
│ ├── scripts/
│ │ ├── IStatsMerge.py
│ │ ├── IStatsSum.py
│ │ ├── klee-control
│ │ ├── klee-gcc
│ │ └── objdump
│ ├── stp/
│ │ ├── AST/
│ │ │ ├── AST.cpp
│ │ │ ├── AST.h
│ │ │ ├── ASTKind.kinds
│ │ │ ├── ASTUtil.cpp
│ │ │ ├── ASTUtil.h
│ │ │ ├── BitBlast.cpp
│ │ │ ├── Makefile
│ │ │ ├── STLport_config.h
│ │ │ ├── SimpBool.cpp
│ │ │ ├── ToCNF.cpp
│ │ │ ├── ToSAT.cpp
│ │ │ ├── Transform.cpp
│ │ │ ├── asttest.cpp
│ │ │ ├── bbtest.cpp
│ │ │ ├── cnftest.cpp
│ │ │ └── genkinds.pl
│ │ ├── INSTALL
│ │ ├── LICENSE
│ │ ├── Makefile
│ │ ├── Makefile.common.in
│ │ ├── README
│ │ ├── bitvec/
│ │ │ ├── Makefile
│ │ │ └── consteval.cpp
│ │ ├── c_interface/
│ │ │ ├── Makefile
│ │ │ ├── c_interface.cpp
│ │ │ ├── c_interface.h
│ │ │ └── fdstream.h
│ │ ├── constantbv/
│ │ │ ├── Makefile
│ │ │ ├── constantbv.cpp
│ │ │ └── constantbv.h
│ │ ├── parser/
│ │ │ ├── Makefile
│ │ │ ├── PL.lex
│ │ │ ├── PL.y
│ │ │ ├── let-funcs.cpp
│ │ │ ├── main.cpp
│ │ │ ├── smtlib.lex
│ │ │ └── smtlib.y
│ │ ├── sat/
│ │ │ ├── Global.h
│ │ │ ├── Heap.h
│ │ │ ├── LICENSE
│ │ │ ├── Makefile
│ │ │ ├── Simplifier.C
│ │ │ ├── Solver.C
│ │ │ ├── Solver.h
│ │ │ ├── SolverTypes.h
│ │ │ ├── Sort.h
│ │ │ └── VarOrder.h
│ │ ├── simplifier/
│ │ │ ├── Makefile
│ │ │ ├── bvsolver.cpp
│ │ │ ├── bvsolver.h
│ │ │ └── simplifier.cpp
│ │ └── stp/
│ │ └── Makefile
│ ├── test/
│ │ ├── CXX/
│ │ │ ├── ArrayNew.cpp
│ │ │ ├── New.cpp
│ │ │ ├── SimpleVirtual.cpp
│ │ │ ├── StaticConstructor.cpp
│ │ │ ├── StaticDestructor.cpp
│ │ │ ├── Trivial.cpp
│ │ │ └── dg.exp
│ │ ├── Concrete/
│ │ │ ├── BitwiseOps.ll
│ │ │ ├── BoolReadWrite.ll
│ │ │ ├── Casts.ll
│ │ │ ├── CmpEq.ll
│ │ │ ├── ConcreteTest.py
│ │ │ ├── ConstantExpr.ll
│ │ │ ├── FloatingPointOps.ll
│ │ │ ├── GlobalInitializers.ll
│ │ │ ├── GlobalVariable.ll
│ │ │ ├── ICmp.ll
│ │ │ ├── InvokeAndReturn.ll
│ │ │ ├── InvokeAndUnwindOnce.ll
│ │ │ ├── InvokeAndUnwindTwice.ll
│ │ │ ├── Makefile
│ │ │ ├── OneCall.ll
│ │ │ ├── OverlappingPhiNodes.ll
│ │ │ ├── Select.ll
│ │ │ ├── Shifts.ll
│ │ │ ├── SimpleStoreAndLoad.ll
│ │ │ ├── UnconditionalBranch.ll
│ │ │ ├── UnconditionalBranchWithSimplePhi.ll
│ │ │ ├── UnorderedPhiNodes.ll
│ │ │ ├── _testingUtils.c
│ │ │ ├── ackermann.c
│ │ │ └── arith_test.ll
│ │ ├── Coverage/
│ │ │ ├── ReadArgs.c
│ │ │ ├── ReplayOutDir.c
│ │ │ └── dg.exp
│ │ ├── Dogfood/
│ │ │ ├── ImmutableSet.cpp
│ │ │ └── dg.exp
│ │ ├── Expr/
│ │ │ ├── Evaluate.pc
│ │ │ ├── Evaluate2.pc
│ │ │ ├── Lexer/
│ │ │ │ ├── Numbers.pc
│ │ │ │ └── dg.exp
│ │ │ ├── Parser/
│ │ │ │ ├── Concat64.pc
│ │ │ │ ├── ConstantFolding.pc
│ │ │ │ ├── Exprs.pc
│ │ │ │ ├── MultiByteReads.pc
│ │ │ │ ├── Simplify.pc
│ │ │ │ ├── TypeChecking.pc
│ │ │ │ └── dg.exp
│ │ │ └── dg.exp
│ │ ├── Feature/
│ │ │ ├── Alias.c
│ │ │ ├── AliasFunction.c
│ │ │ ├── AliasFunctionExit.c
│ │ │ ├── AsmAddresses.c
│ │ │ ├── ByteSwap.c
│ │ │ ├── CallToUndefinedExternal.cpp
│ │ │ ├── CheckForImpliedValue.c.failing
│ │ │ ├── CheckMemoryAccess.c
│ │ │ ├── CopyOnWrite.c
│ │ │ ├── DanglingConcreteReadExpr.c
│ │ │ ├── DefineFixedObject.c
│ │ │ ├── DoubleFree.c
│ │ │ ├── DumpStatesOnHalt.c
│ │ │ ├── Envp.c
│ │ │ ├── ExprLogging.c
│ │ │ ├── ExternalWeakLinkage.c
│ │ │ ├── Float.c
│ │ │ ├── FunctionPointer.c
│ │ │ ├── GetValue.c
│ │ │ ├── ImpliedValue.c.failing
│ │ │ ├── InAndOutOfBounds.c
│ │ │ ├── IndirectCallToBuiltin.c
│ │ │ ├── IndirectCallToExternal.c
│ │ │ ├── InvalidBitfieldAccess.c.failing
│ │ │ ├── IsSymbolic.c
│ │ │ ├── KleeReportError.c
│ │ │ ├── LongDoubleSupport.c
│ │ │ ├── LowerSwitch.c
│ │ │ ├── MakeConcreteSymbolic.c
│ │ │ ├── MakeSymbolicName.c
│ │ │ ├── MemoryLimit.c
│ │ │ ├── MultipleFreeResolution.c
│ │ │ ├── MultipleReadResolution.c
│ │ │ ├── MultipleReallocResolution.c
│ │ │ ├── MultipleWriteResolution.c
│ │ │ ├── NamedSeedMatching.c
│ │ │ ├── OneFreeError.c
│ │ │ ├── OneOutOfBounds.c
│ │ │ ├── Optimize.c
│ │ │ ├── OverlappedError.c
│ │ │ ├── PreferCex.c
│ │ │ ├── RaiseAsm.c
│ │ │ ├── ReallocFailure.c
│ │ │ ├── ReplayPath.c
│ │ │ ├── Searchers.c
│ │ │ ├── SetForking.c
│ │ │ ├── Vararg.c
│ │ │ ├── WithLibc.c
│ │ │ ├── WriteCov.c
│ │ │ ├── _utils._ll
│ │ │ ├── const_array_opt1.c
│ │ │ ├── dg.exp
│ │ │ └── utils.h
│ │ ├── Makefile
│ │ ├── Makefile.tests
│ │ ├── Programs/
│ │ │ ├── dg.exp
│ │ │ └── pcregrep.c
│ │ ├── README
│ │ ├── Runtime/
│ │ │ ├── POSIX/
│ │ │ │ ├── DirConsistency.c
│ │ │ │ ├── DirSeek.c
│ │ │ │ ├── FDNumbers.c
│ │ │ │ ├── FD_Fail.c
│ │ │ │ ├── FD_Fail2.c
│ │ │ │ ├── Fcntl.c
│ │ │ │ ├── FilePerm.c
│ │ │ │ ├── FreeArgv.c
│ │ │ │ ├── Getenv.c
│ │ │ │ ├── Ioctl.c
│ │ │ │ ├── Isatty.c
│ │ │ │ ├── PrgName.c
│ │ │ │ ├── Read1.c
│ │ │ │ ├── SELinux.c
│ │ │ │ ├── SeedAndFail.c
│ │ │ │ ├── Stdin.c
│ │ │ │ ├── Write1.c
│ │ │ │ ├── Write2.c
│ │ │ │ └── dg.exp
│ │ │ └── Uclibc/
│ │ │ ├── 2007-10-08-optimization-calls-wrong-libc-functions.c
│ │ │ ├── 2008-03-04-libc-atexit-uses-dso-handle.c
│ │ │ ├── Environ.c
│ │ │ └── dg.exp
│ │ ├── Solver/
│ │ │ ├── FastCexSolver.pc
│ │ │ ├── LargeIntegers.pc
│ │ │ └── dg.exp
│ │ ├── TestRunner.sh
│ │ ├── lib/
│ │ │ └── llvm.exp
│ │ └── regression/
│ │ ├── 2007-07-25-invalid-stp-array-binding-to-objectstate.c
│ │ ├── 2007-07-30-unflushed-byte.c
│ │ ├── 2007-08-01-bool-zext-in-call.ll
│ │ ├── 2007-08-01-cache-unclear-on-overwrite-flushed.c
│ │ ├── 2007-08-06-64bit-shift.c
│ │ ├── 2007-08-06-access-after-free.c
│ │ ├── 2007-08-08-free-zero.c
│ │ ├── 2007-08-16-invalid-constant-value.c
│ │ ├── 2007-08-16-valid-write-to-freed-object.c
│ │ ├── 2007-10-11-free-of-alloca.c
│ │ ├── 2007-10-11-illegal-access-after-free-and-branch.c
│ │ ├── 2007-10-12-failed-make-symbolic-after-copy.c
│ │ ├── 2008-02-11-phi-nodes-after-invoke.ll
│ │ ├── 2008-03-04-free-of-global.c
│ │ ├── 2008-03-11-free-of-malloc-zero.c
│ │ ├── 2008-04-10-bad-alloca-free.c
│ │ ├── 2008-05-23-gep-with-global-const.c
│ │ └── dg.exp
│ ├── tools/
│ │ ├── Makefile
│ │ ├── gen-random-bout/
│ │ │ ├── Makefile
│ │ │ └── gen-random-bout.cpp
│ │ ├── kleaver/
│ │ │ ├── Makefile
│ │ │ └── main.cpp
│ │ ├── klee/
│ │ │ ├── Debug.cpp
│ │ │ ├── Makefile
│ │ │ └── main.cpp
│ │ ├── klee-config/
│ │ │ ├── FinalLibDeps.txt
│ │ │ ├── Makefile
│ │ │ └── klee-config.in.in
│ │ ├── klee-replay/
│ │ │ ├── Makefile
│ │ │ ├── fd_init.c
│ │ │ ├── file-creator.c
│ │ │ ├── klee-replay.c
│ │ │ ├── klee-replay.h
│ │ │ └── klee_init_env.c
│ │ ├── klee-stats/
│ │ │ ├── Makefile
│ │ │ └── klee-stats
│ │ └── ktest-tool/
│ │ ├── Makefile
│ │ └── ktest-tool
│ ├── unittests/
│ │ ├── Expr/
│ │ │ ├── ExprTest.cpp
│ │ │ └── Makefile
│ │ ├── Makefile
│ │ ├── Solver/
│ │ │ ├── Makefile
│ │ │ └── SolverTest.cpp
│ │ └── TestMain.cpp
│ ├── utils/
│ │ ├── data/
│ │ │ └── Queries/
│ │ │ ├── pcresymperf-3.pc
│ │ │ └── pcresymperf-4.pc
│ │ ├── emacs/
│ │ │ └── klee-pc-mode.el
│ │ └── valgrind/
│ │ ├── README.txt
│ │ ├── valgrind-llvm.supp
│ │ └── valgrind-stp.supp
│ └── www/
│ ├── Documentation.html
│ ├── GetInvolved.html
│ ├── GetStarted.html
│ ├── KQuery.html
│ ├── TestingCoreutils.html
│ ├── Tutorial-1.html
│ ├── Tutorial-2.html
│ ├── Tutorials.html
│ ├── bugs.html
│ ├── content.css
│ ├── index.html
│ ├── klee-files.html
│ ├── klee-tools.html
│ ├── menu.css
│ ├── menu.html.incl
│ └── resources/
│ ├── Regexp.c.html
│ └── islower.c.html
├── patches/
│ └── compiler-rt-3.2-asan4s2e.patch
├── qemu/
│ ├── .gitignore
│ ├── .gitmodules
│ ├── .mailmap
│ ├── CODING_STYLE
│ ├── COPYING
│ ├── COPYING.LIB
│ ├── Changelog
│ ├── HACKING
│ ├── LICENSE
│ ├── MAINTAINERS
│ ├── Makefile
│ ├── Makefile.dis
│ ├── Makefile.hw
│ ├── Makefile.objs
│ ├── Makefile.target
│ ├── Makefile.user
│ ├── QMP/
│ │ ├── README
│ │ ├── qmp
│ │ ├── qmp-events.txt
│ │ ├── qmp-shell
│ │ ├── qmp-spec.txt
│ │ ├── qmp.py
│ │ ├── qom-get
│ │ ├── qom-list
│ │ └── qom-set
│ ├── README
│ ├── TODO
│ ├── VERSION
│ ├── a.out.h
│ ├── acl.c
│ ├── acl.h
│ ├── aes.c
│ ├── aes.h
│ ├── aio.c
│ ├── alpha-dis.c
│ ├── alpha.ld
│ ├── arch_init.c
│ ├── arch_init.h
│ ├── arm-dis.c
│ ├── arm-semi.c
│ ├── arm.ld
│ ├── async.c
│ ├── audio/
│ │ ├── alsaaudio.c
│ │ ├── audio.c
│ │ ├── audio.h
│ │ ├── audio_int.h
│ │ ├── audio_pt_int.c
│ │ ├── audio_pt_int.h
│ │ ├── audio_template.h
│ │ ├── audio_win_int.c
│ │ ├── audio_win_int.h
│ │ ├── coreaudio.c
│ │ ├── dsound_template.h
│ │ ├── dsoundaudio.c
│ │ ├── esdaudio.c
│ │ ├── fmodaudio.c
│ │ ├── mixeng.c
│ │ ├── mixeng.h
│ │ ├── mixeng_template.h
│ │ ├── noaudio.c
│ │ ├── ossaudio.c
│ │ ├── paaudio.c
│ │ ├── rate_template.h
│ │ ├── sdlaudio.c
│ │ ├── spiceaudio.c
│ │ ├── wavaudio.c
│ │ ├── wavcapture.c
│ │ └── winwaveaudio.c
│ ├── balloon.c
│ ├── balloon.h
│ ├── bitmap.c
│ ├── bitmap.h
│ ├── bitops.c
│ ├── bitops.h
│ ├── block/
│ │ ├── blkdebug.c
│ │ ├── blkverify.c
│ │ ├── bochs.c
│ │ ├── cloop.c
│ │ ├── cow.c
│ │ ├── curl.c
│ │ ├── dmg.c
│ │ ├── iscsi.c
│ │ ├── nbd.c
│ │ ├── parallels.c
│ │ ├── qcow.c
│ │ ├── qcow2-cache.c
│ │ ├── qcow2-cluster.c
│ │ ├── qcow2-refcount.c
│ │ ├── qcow2-snapshot.c
│ │ ├── qcow2.c
│ │ ├── qcow2.h
│ │ ├── qed-check.c
│ │ ├── qed-cluster.c
│ │ ├── qed-gencb.c
│ │ ├── qed-l2-cache.c
│ │ ├── qed-table.c
│ │ ├── qed.c
│ │ ├── qed.h
│ │ ├── raw-posix-aio.h
│ │ ├── raw-posix.c
│ │ ├── raw-win32.c
│ │ ├── raw.c
│ │ ├── rbd.c
│ │ ├── s2e.c
│ │ ├── sheepdog.c
│ │ ├── stream.c
│ │ ├── vdi.c
│ │ ├── vmdk.c
│ │ ├── vpc.c
│ │ └── vvfat.c
│ ├── block-migration.c
│ ├── block-migration.h
│ ├── block.c
│ ├── block.h
│ ├── block_int.h
│ ├── blockdev.c
│ ├── blockdev.h
│ ├── bsd-user/
│ │ ├── bsd-mman.h
│ │ ├── bsdload.c
│ │ ├── elfload.c
│ │ ├── errno_defs.h
│ │ ├── freebsd/
│ │ │ ├── strace.list
│ │ │ └── syscall_nr.h
│ │ ├── i386/
│ │ │ ├── syscall.h
│ │ │ └── target_signal.h
│ │ ├── main.c
│ │ ├── mmap.c
│ │ ├── netbsd/
│ │ │ ├── strace.list
│ │ │ └── syscall_nr.h
│ │ ├── openbsd/
│ │ │ ├── strace.list
│ │ │ └── syscall_nr.h
│ │ ├── qemu-types.h
│ │ ├── qemu.h
│ │ ├── signal.c
│ │ ├── sparc/
│ │ │ ├── syscall.h
│ │ │ └── target_signal.h
│ │ ├── sparc64/
│ │ │ ├── syscall.h
│ │ │ └── target_signal.h
│ │ ├── strace.c
│ │ ├── syscall.c
│ │ ├── syscall_defs.h
│ │ ├── uaccess.c
│ │ └── x86_64/
│ │ ├── syscall.h
│ │ └── target_signal.h
│ ├── bswap.h
│ ├── bt-host.c
│ ├── bt-host.h
│ ├── bt-vhci.c
│ ├── buffered_file.c
│ ├── buffered_file.h
│ ├── cache-utils.c
│ ├── cache-utils.h
│ ├── cmd.c
│ ├── cmd.h
│ ├── compatfd.c
│ ├── compatfd.h
│ ├── compiler.h
│ ├── config.h
│ ├── configure
│ ├── console.c
│ ├── console.h
│ ├── coroutine-gthread.c
│ ├── coroutine-sigaltstack.c
│ ├── coroutine-ucontext.c
│ ├── coroutine-win32.c
│ ├── cpu-all.h
│ ├── cpu-common.h
│ ├── cpu-defs.h
│ ├── cpu-exec.c
│ ├── cpus.c
│ ├── cpus.h
│ ├── cris-dis.c
│ ├── cursor.c
│ ├── cursor_hidden.xpm
│ ├── cursor_left_ptr.xpm
│ ├── cutils.c
│ ├── darwin-user/
│ │ ├── commpage.c
│ │ ├── ioctls.h
│ │ ├── ioctls_types.h
│ │ ├── machload.c
│ │ ├── main.c
│ │ ├── mmap.c
│ │ ├── qemu.h
│ │ ├── signal.c
│ │ ├── syscall.c
│ │ └── syscalls.h
│ ├── def-helper.h
│ ├── default-configs/
│ │ ├── alpha-linux-user.mak
│ │ ├── alpha-softmmu.mak
│ │ ├── arm-linux-user.mak
│ │ ├── arm-s2e-softmmu.mak
│ │ ├── arm-softmmu.mak
│ │ ├── armeb-linux-user.mak
│ │ ├── cris-linux-user.mak
│ │ ├── cris-softmmu.mak
│ │ ├── i386-bsd-user.mak
│ │ ├── i386-darwin-user.mak
│ │ ├── i386-linux-user.mak
│ │ ├── i386-s2e-softmmu.mak
│ │ ├── i386-softmmu.mak
│ │ ├── lm32-softmmu.mak
│ │ ├── m68k-linux-user.mak
│ │ ├── m68k-softmmu.mak
│ │ ├── microblaze-linux-user.mak
│ │ ├── microblaze-softmmu.mak
│ │ ├── microblazeel-linux-user.mak
│ │ ├── microblazeel-softmmu.mak
│ │ ├── mips-linux-user.mak
│ │ ├── mips-softmmu.mak
│ │ ├── mips64-linux-user.mak
│ │ ├── mips64-softmmu.mak
│ │ ├── mips64el-linux-user.mak
│ │ ├── mips64el-softmmu.mak
│ │ ├── mipsel-linux-user.mak
│ │ ├── mipsel-softmmu.mak
│ │ ├── mipsn32-linux-user.mak
│ │ ├── mipsn32el-linux-user.mak
│ │ ├── pci.mak
│ │ ├── ppc-darwin-user.mak
│ │ ├── ppc-linux-user.mak
│ │ ├── ppc-softmmu.mak
│ │ ├── ppc64-linux-user.mak
│ │ ├── ppc64-softmmu.mak
│ │ ├── ppc64abi32-linux-user.mak
│ │ ├── ppcemb-softmmu.mak
│ │ ├── s390x-linux-user.mak
│ │ ├── s390x-softmmu.mak
│ │ ├── sh4-linux-user.mak
│ │ ├── sh4-softmmu.mak
│ │ ├── sh4eb-linux-user.mak
│ │ ├── sh4eb-softmmu.mak
│ │ ├── sparc-bsd-user.mak
│ │ ├── sparc-linux-user.mak
│ │ ├── sparc-softmmu.mak
│ │ ├── sparc32plus-linux-user.mak
│ │ ├── sparc64-bsd-user.mak
│ │ ├── sparc64-linux-user.mak
│ │ ├── sparc64-softmmu.mak
│ │ ├── unicore32-linux-user.mak
│ │ ├── x86_64-bsd-user.mak
│ │ ├── x86_64-linux-user.mak
│ │ ├── x86_64-s2e-softmmu.mak
│ │ ├── x86_64-softmmu.mak
│ │ ├── xtensa-softmmu.mak
│ │ └── xtensaeb-softmmu.mak
│ ├── device_tree.c
│ ├── device_tree.h
│ ├── dis-asm.h
│ ├── disas.c
│ ├── disas.h
│ ├── dma-helpers.c
│ ├── dma.h
│ ├── docs/
│ │ ├── blkverify.txt
│ │ ├── bootindex.txt
│ │ ├── ccid.txt
│ │ ├── ich9-ehci-uhci.cfg
│ │ ├── libcacard.txt
│ │ ├── live-block-ops.txt
│ │ ├── memory.txt
│ │ ├── migration.txt
│ │ ├── qapi-code-gen.txt
│ │ ├── qdev-device-use.txt
│ │ ├── specs/
│ │ │ ├── acpi_pci_hotplug.txt
│ │ │ ├── ivshmem_device_spec.txt
│ │ │ ├── qcow2.txt
│ │ │ └── qed_spec.txt
│ │ ├── tracing.txt
│ │ ├── usb2.txt
│ │ ├── writing-qmp-commands.txt
│ │ └── xen-save-devices-state.txt
│ ├── dyngen-exec.h
│ ├── elf.h
│ ├── envlist.c
│ ├── envlist.h
│ ├── error.c
│ ├── error.h
│ ├── error_int.h
│ ├── event_notifier.c
│ ├── event_notifier.h
│ ├── exec-all.h
│ ├── exec-memory.h
│ ├── exec-obsolete.h
│ ├── exec.c
│ ├── fpu/
│ │ ├── softfloat-macros.h
│ │ ├── softfloat-specialize.h
│ │ ├── softfloat.c
│ │ └── softfloat.h
│ ├── fsdev/
│ │ ├── file-op-9p.h
│ │ ├── qemu-fsdev-dummy.c
│ │ ├── qemu-fsdev.c
│ │ ├── qemu-fsdev.h
│ │ ├── virtfs-proxy-helper.c
│ │ ├── virtfs-proxy-helper.texi
│ │ ├── virtio-9p-marshal.c
│ │ └── virtio-9p-marshal.h
│ ├── gdb-xml/
│ │ ├── arm-core.xml
│ │ ├── arm-neon.xml
│ │ ├── arm-vfp.xml
│ │ ├── arm-vfp3.xml
│ │ ├── cf-core.xml
│ │ ├── cf-fp.xml
│ │ ├── power-altivec.xml
│ │ ├── power-core.xml
│ │ ├── power-fpu.xml
│ │ ├── power-spe.xml
│ │ └── power64-core.xml
│ ├── gdbstub.c
│ ├── gdbstub.h
│ ├── gen-icount.h
│ ├── hmp-commands.hx
│ ├── hmp.c
│ ├── hmp.h
│ ├── host-utils.c
│ ├── host-utils.h
│ ├── hppa-dis.c
│ ├── hppa.ld
│ ├── hw/
│ │ ├── 9p.h
│ │ ├── 9pfs/
│ │ │ ├── codir.c
│ │ │ ├── cofile.c
│ │ │ ├── cofs.c
│ │ │ ├── coxattr.c
│ │ │ ├── virtio-9p-coth.c
│ │ │ ├── virtio-9p-coth.h
│ │ │ ├── virtio-9p-device.c
│ │ │ ├── virtio-9p-handle.c
│ │ │ ├── virtio-9p-local.c
│ │ │ ├── virtio-9p-posix-acl.c
│ │ │ ├── virtio-9p-proxy.c
│ │ │ ├── virtio-9p-proxy.h
│ │ │ ├── virtio-9p-synth.c
│ │ │ ├── virtio-9p-synth.h
│ │ │ ├── virtio-9p-xattr-user.c
│ │ │ ├── virtio-9p-xattr.c
│ │ │ ├── virtio-9p-xattr.h
│ │ │ ├── virtio-9p.c
│ │ │ └── virtio-9p.h
│ │ ├── a15mpcore.c
│ │ ├── a9mpcore.c
│ │ ├── ac97.c
│ │ ├── acpi.c
│ │ ├── acpi.h
│ │ ├── acpi_piix4.c
│ │ ├── adb.c
│ │ ├── adb.h
│ │ ├── adlib.c
│ │ ├── ads7846.c
│ │ ├── alpha_dp264.c
│ │ ├── alpha_pci.c
│ │ ├── alpha_sys.h
│ │ ├── alpha_typhoon.c
│ │ ├── an5206.c
│ │ ├── apb_pci.c
│ │ ├── apb_pci.h
│ │ ├── apic.c
│ │ ├── apic.h
│ │ ├── apic_common.c
│ │ ├── apic_internal.h
│ │ ├── apm.c
│ │ ├── apm.h
│ │ ├── applesmc.c
│ │ ├── arm-misc.h
│ │ ├── arm11mpcore.c
│ │ ├── arm_boot.c
│ │ ├── arm_gic.c
│ │ ├── arm_l2x0.c
│ │ ├── arm_mptimer.c
│ │ ├── arm_pic.c
│ │ ├── arm_sysctl.c
│ │ ├── arm_timer.c
│ │ ├── armv7m.c
│ │ ├── armv7m_nvic.c
│ │ ├── audiodev.h
│ │ ├── axis_dev88.c
│ │ ├── baum.c
│ │ ├── baum.h
│ │ ├── bitbang_i2c.c
│ │ ├── bitbang_i2c.h
│ │ ├── blizzard.c
│ │ ├── blizzard_template.h
│ │ ├── boards.h
│ │ ├── bonito.c
│ │ ├── bt-hci-csr.c
│ │ ├── bt-hci.c
│ │ ├── bt-hid.c
│ │ ├── bt-l2cap.c
│ │ ├── bt-sdp.c
│ │ ├── bt.c
│ │ ├── bt.h
│ │ ├── cadence_gem.c
│ │ ├── cadence_ttc.c
│ │ ├── cadence_uart.c
│ │ ├── cbus.c
│ │ ├── ccid-card-emulated.c
│ │ ├── ccid-card-passthru.c
│ │ ├── ccid.h
│ │ ├── cdrom.c
│ │ ├── cirrus_vga.c
│ │ ├── cirrus_vga_rop.h
│ │ ├── cirrus_vga_rop2.h
│ │ ├── cirrus_vga_template.h
│ │ ├── collie.c
│ │ ├── cris-boot.c
│ │ ├── cris-boot.h
│ │ ├── cris_pic_cpu.c
│ │ ├── cs4231.c
│ │ ├── cs4231a.c
│ │ ├── cuda.c
│ │ ├── debugcon.c
│ │ ├── dec_pci.c
│ │ ├── dec_pci.h
│ │ ├── device-hotplug.c
│ │ ├── devices.h
│ │ ├── dma.c
│ │ ├── dp8393x.c
│ │ ├── ds1225y.c
│ │ ├── ds1338.c
│ │ ├── dummy_m68k.c
│ │ ├── e1000.c
│ │ ├── e1000_hw.h
│ │ ├── ecc.c
│ │ ├── eccmemctl.c
│ │ ├── eepro100.c
│ │ ├── eeprom93xx.c
│ │ ├── eeprom93xx.h
│ │ ├── elf_ops.h
│ │ ├── empty_slot.c
│ │ ├── empty_slot.h
│ │ ├── es1370.c
│ │ ├── escc.c
│ │ ├── escc.h
│ │ ├── esp.c
│ │ ├── esp.h
│ │ ├── etraxfs.h
│ │ ├── etraxfs_dma.c
│ │ ├── etraxfs_dma.h
│ │ ├── etraxfs_eth.c
│ │ ├── etraxfs_pic.c
│ │ ├── etraxfs_ser.c
│ │ ├── etraxfs_timer.c
│ │ ├── exynos4210.c
│ │ ├── exynos4210.h
│ │ ├── exynos4210_combiner.c
│ │ ├── exynos4210_fimd.c
│ │ ├── exynos4210_gic.c
│ │ ├── exynos4210_mct.c
│ │ ├── exynos4210_pmu.c
│ │ ├── exynos4210_pwm.c
│ │ ├── exynos4210_uart.c
│ │ ├── exynos4_boards.c
│ │ ├── fakepci.c
│ │ ├── fakepci.h
│ │ ├── fdc.c
│ │ ├── fdc.h
│ │ ├── firmware_abi.h
│ │ ├── flash.h
│ │ ├── fmopl.c
│ │ ├── fmopl.h
│ │ ├── framebuffer.c
│ │ ├── framebuffer.h
│ │ ├── fw_cfg.c
│ │ ├── fw_cfg.h
│ │ ├── g364fb.c
│ │ ├── grackle_pci.c
│ │ ├── grlib.h
│ │ ├── grlib_apbuart.c
│ │ ├── grlib_gptimer.c
│ │ ├── grlib_irqmp.c
│ │ ├── gt64xxx.c
│ │ ├── gumstix.c
│ │ ├── gus.c
│ │ ├── gusemu.h
│ │ ├── gusemu_hal.c
│ │ ├── gusemu_mixer.c
│ │ ├── gustate.h
│ │ ├── hda-audio.c
│ │ ├── heathrow_pic.c
│ │ ├── hid.c
│ │ ├── hid.h
│ │ ├── highbank.c
│ │ ├── hpet.c
│ │ ├── hpet_emul.h
│ │ ├── hw.h
│ │ ├── i2c.c
│ │ ├── i2c.h
│ │ ├── i82374.c
│ │ ├── i82378.c
│ │ ├── i8254.c
│ │ ├── i8254.h
│ │ ├── i8254_common.c
│ │ ├── i8254_internal.h
│ │ ├── i8259.c
│ │ ├── i8259_common.c
│ │ ├── i8259_internal.h
│ │ ├── ide/
│ │ │ ├── ahci.c
│ │ │ ├── ahci.h
│ │ │ ├── atapi.c
│ │ │ ├── cmd646.c
│ │ │ ├── core.c
│ │ │ ├── ich.c
│ │ │ ├── internal.h
│ │ │ ├── isa.c
│ │ │ ├── macio.c
│ │ │ ├── microdrive.c
│ │ │ ├── mmio.c
│ │ │ ├── pci.c
│ │ │ ├── pci.h
│ │ │ ├── piix.c
│ │ │ ├── qdev.c
│ │ │ └── via.c
│ │ ├── ide.h
│ │ ├── integratorcp.c
│ │ ├── intel-hda-defs.h
│ │ ├── intel-hda.c
│ │ ├── intel-hda.h
│ │ ├── ioapic.c
│ │ ├── ioapic.h
│ │ ├── ioapic_common.c
│ │ ├── ioapic_internal.h
│ │ ├── ioh3420.c
│ │ ├── ioh3420.h
│ │ ├── irq.c
│ │ ├── irq.h
│ │ ├── isa-bus.c
│ │ ├── isa.h
│ │ ├── isa_mmio.c
│ │ ├── ivshmem.c
│ │ ├── jazz_led.c
│ │ ├── kvm/
│ │ │ ├── apic.c
│ │ │ ├── clock.c
│ │ │ ├── clock.h
│ │ │ ├── i8254.c
│ │ │ ├── i8259.c
│ │ │ └── ioapic.c
│ │ ├── kvmvapic.c
│ │ ├── lan9118.c
│ │ ├── lance.c
│ │ ├── leon3.c
│ │ ├── lm32.h
│ │ ├── lm32_boards.c
│ │ ├── lm32_hwsetup.h
│ │ ├── lm32_juart.c
│ │ ├── lm32_juart.h
│ │ ├── lm32_pic.c
│ │ ├── lm32_pic.h
│ │ ├── lm32_sys.c
│ │ ├── lm32_timer.c
│ │ ├── lm32_uart.c
│ │ ├── lm4549.c
│ │ ├── lm4549.h
│ │ ├── lm832x.c
│ │ ├── loader.c
│ │ ├── loader.h
│ │ ├── lsi53c895a.c
│ │ ├── m48t59.c
│ │ ├── mac_dbdma.c
│ │ ├── mac_dbdma.h
│ │ ├── mac_nvram.c
│ │ ├── macio.c
│ │ ├── mainstone.c
│ │ ├── marvell_88w8618_audio.c
│ │ ├── max111x.c
│ │ ├── max7310.c
│ │ ├── mc146818rtc.c
│ │ ├── mc146818rtc.h
│ │ ├── mc146818rtc_regs.h
│ │ ├── mcf.h
│ │ ├── mcf5206.c
│ │ ├── mcf5208.c
│ │ ├── mcf_fec.c
│ │ ├── mcf_intc.c
│ │ ├── mcf_uart.c
│ │ ├── microblaze_boot.c
│ │ ├── microblaze_boot.h
│ │ ├── microblaze_pic_cpu.c
│ │ ├── microblaze_pic_cpu.h
│ │ ├── milkymist-ac97.c
│ │ ├── milkymist-hpdmc.c
│ │ ├── milkymist-hw.h
│ │ ├── milkymist-memcard.c
│ │ ├── milkymist-minimac2.c
│ │ ├── milkymist-pfpu.c
│ │ ├── milkymist-softusb.c
│ │ ├── milkymist-sysctl.c
│ │ ├── milkymist-tmu2.c
│ │ ├── milkymist-uart.c
│ │ ├── milkymist-vgafb.c
│ │ ├── milkymist-vgafb_template.h
│ │ ├── milkymist.c
│ │ ├── mips-bios.h
│ │ ├── mips.h
│ │ ├── mips_addr.c
│ │ ├── mips_cpudevs.h
│ │ ├── mips_fulong2e.c
│ │ ├── mips_int.c
│ │ ├── mips_jazz.c
│ │ ├── mips_malta.c
│ │ ├── mips_mipssim.c
│ │ ├── mips_r4k.c
│ │ ├── mips_timer.c
│ │ ├── mipsnet.c
│ │ ├── mpc8544_guts.c
│ │ ├── msi.c
│ │ ├── msi.h
│ │ ├── msix.c
│ │ ├── msix.h
│ │ ├── msmouse.c
│ │ ├── msmouse.h
│ │ ├── mst_fpga.c
│ │ ├── multiboot.c
│ │ ├── multiboot.h
│ │ ├── musicpal.c
│ │ ├── nand.c
│ │ ├── ne2000-isa.c
│ │ ├── ne2000.c
│ │ ├── ne2000.h
│ │ ├── nseries.c
│ │ ├── nvram.h
│ │ ├── omap.h
│ │ ├── omap1.c
│ │ ├── omap2.c
│ │ ├── omap_clk.c
│ │ ├── omap_dma.c
│ │ ├── omap_dss.c
│ │ ├── omap_gpio.c
│ │ ├── omap_gpmc.c
│ │ ├── omap_gptimer.c
│ │ ├── omap_i2c.c
│ │ ├── omap_intc.c
│ │ ├── omap_l4.c
│ │ ├── omap_lcd_template.h
│ │ ├── omap_lcdc.c
│ │ ├── omap_mmc.c
│ │ ├── omap_sdrc.c
│ │ ├── omap_spi.c
│ │ ├── omap_sx1.c
│ │ ├── omap_synctimer.c
│ │ ├── omap_tap.c
│ │ ├── omap_uart.c
│ │ ├── onenand.c
│ │ ├── opencores_eth.c
│ │ ├── openpic.c
│ │ ├── openpic.h
│ │ ├── palm.c
│ │ ├── parallel.c
│ │ ├── pc.c
│ │ ├── pc.h
│ │ ├── pc_piix.c
│ │ ├── pc_sysfw.c
│ │ ├── pci-hotplug.c
│ │ ├── pci-stub.c
│ │ ├── pci.c
│ │ ├── pci.h
│ │ ├── pci_bridge.c
│ │ ├── pci_bridge.h
│ │ ├── pci_host.c
│ │ ├── pci_host.h
│ │ ├── pci_ids.h
│ │ ├── pci_internals.h
│ │ ├── pci_regs.h
│ │ ├── pcie.c
│ │ ├── pcie.h
│ │ ├── pcie_aer.c
│ │ ├── pcie_aer.h
│ │ ├── pcie_host.c
│ │ ├── pcie_host.h
│ │ ├── pcie_port.c
│ │ ├── pcie_port.h
│ │ ├── pcie_regs.h
│ │ ├── pckbd.c
│ │ ├── pcmcia.h
│ │ ├── pcnet-pci.c
│ │ ├── pcnet.c
│ │ ├── pcnet.h
│ │ ├── pcspk.c
│ │ ├── pcspk.h
│ │ ├── petalogix_ml605_mmu.c
│ │ ├── petalogix_s3adsp1800_mmu.c
│ │ ├── pflash_cfi01.c
│ │ ├── pflash_cfi02.c
│ │ ├── piix4.c
│ │ ├── piix_pci.c
│ │ ├── pixel_ops.h
│ │ ├── pl011.c
│ │ ├── pl022.c
│ │ ├── pl031.c
│ │ ├── pl041.c
│ │ ├── pl041.h
│ │ ├── pl041.hx
│ │ ├── pl050.c
│ │ ├── pl061.c
│ │ ├── pl080.c
│ │ ├── pl110.c
│ │ ├── pl110_template.h
│ │ ├── pl181.c
│ │ ├── pl190.c
│ │ ├── pm_smbus.c
│ │ ├── pm_smbus.h
│ │ ├── ppc-viosrp.h
│ │ ├── ppc.c
│ │ ├── ppc.h
│ │ ├── ppc405.h
│ │ ├── ppc405_boards.c
│ │ ├── ppc405_uc.c
│ │ ├── ppc440_bamboo.c
│ │ ├── ppc4xx.h
│ │ ├── ppc4xx_devs.c
│ │ ├── ppc4xx_pci.c
│ │ ├── ppc_booke.c
│ │ ├── ppc_mac.h
│ │ ├── ppc_newworld.c
│ │ ├── ppc_oldworld.c
│ │ ├── ppc_prep.c
│ │ ├── ppce500_mpc8544ds.c
│ │ ├── ppce500_pci.c
│ │ ├── ppce500_spin.c
│ │ ├── prep_pci.c
│ │ ├── primecell.h
│ │ ├── ps2.c
│ │ ├── ps2.h
│ │ ├── ptimer.c
│ │ ├── ptimer.h
│ │ ├── pxa.h
│ │ ├── pxa2xx.c
│ │ ├── pxa2xx_dma.c
│ │ ├── pxa2xx_gpio.c
│ │ ├── pxa2xx_keypad.c
│ │ ├── pxa2xx_lcd.c
│ │ ├── pxa2xx_mmci.c
│ │ ├── pxa2xx_pcmcia.c
│ │ ├── pxa2xx_pic.c
│ │ ├── pxa2xx_template.h
│ │ ├── pxa2xx_timer.c
│ │ ├── qdev-addr.c
│ │ ├── qdev-addr.h
│ │ ├── qdev-monitor.c
│ │ ├── qdev-properties.c
│ │ ├── qdev.c
│ │ ├── qdev.h
│ │ ├── qxl-logger.c
│ │ ├── qxl-render.c
│ │ ├── qxl.c
│ │ ├── qxl.h
│ │ ├── r2d.c
│ │ ├── rc4030.c
│ │ ├── realview.c
│ │ ├── realview_gic.c
│ │ ├── rtl8139.c
│ │ ├── s390-virtio-bus.c
│ │ ├── s390-virtio-bus.h
│ │ ├── s390-virtio.c
│ │ ├── sb16.c
│ │ ├── sbi.c
│ │ ├── scsi-bus.c
│ │ ├── scsi-defs.h
│ │ ├── scsi-disk.c
│ │ ├── scsi-generic.c
│ │ ├── scsi.h
│ │ ├── sd.c
│ │ ├── sd.h
│ │ ├── serial.c
│ │ ├── sga.c
│ │ ├── sh.h
│ │ ├── sh7750.c
│ │ ├── sh7750_regnames.c
│ │ ├── sh7750_regnames.h
│ │ ├── sh7750_regs.h
│ │ ├── sh_intc.c
│ │ ├── sh_intc.h
│ │ ├── sh_pci.c
│ │ ├── sh_serial.c
│ │ ├── sh_timer.c
│ │ ├── sharpsl.h
│ │ ├── shix.c
│ │ ├── slavio_intctl.c
│ │ ├── slavio_misc.c
│ │ ├── slavio_timer.c
│ │ ├── sm501.c
│ │ ├── sm501_template.h
│ │ ├── smbios.c
│ │ ├── smbios.h
│ │ ├── smbus.c
│ │ ├── smbus.h
│ │ ├── smbus_eeprom.c
│ │ ├── smc91c111.c
│ │ ├── soc_dma.c
│ │ ├── soc_dma.h
│ │ ├── spapr.c
│ │ ├── spapr.h
│ │ ├── spapr_hcall.c
│ │ ├── spapr_llan.c
│ │ ├── spapr_pci.c
│ │ ├── spapr_pci.h
│ │ ├── spapr_rtas.c
│ │ ├── spapr_vio.c
│ │ ├── spapr_vio.h
│ │ ├── spapr_vscsi.c
│ │ ├── spapr_vty.c
│ │ ├── sparc32_dma.c
│ │ ├── sparc32_dma.h
│ │ ├── spitz.c
│ │ ├── srp.h
│ │ ├── ssd0303.c
│ │ ├── ssd0323.c
│ │ ├── ssi-sd.c
│ │ ├── ssi.c
│ │ ├── ssi.h
│ │ ├── stellaris.c
│ │ ├── stellaris_enet.c
│ │ ├── stellaris_input.c
│ │ ├── strongarm.c
│ │ ├── strongarm.h
│ │ ├── sun4c_intctl.c
│ │ ├── sun4m.c
│ │ ├── sun4m.h
│ │ ├── sun4m_iommu.c
│ │ ├── sun4u.c
│ │ ├── sysbus.c
│ │ ├── sysbus.h
│ │ ├── tc58128.c
│ │ ├── tc6393xb.c
│ │ ├── tc6393xb_template.h
│ │ ├── tcx.c
│ │ ├── tmp105.c
│ │ ├── tosa.c
│ │ ├── tsc2005.c
│ │ ├── tsc210x.c
│ │ ├── tusb6010.c
│ │ ├── twl92230.c
│ │ ├── unin_pci.c
│ │ ├── usb/
│ │ │ ├── bus.c
│ │ │ ├── core.c
│ │ │ ├── desc.c
│ │ │ ├── desc.h
│ │ │ ├── dev-audio.c
│ │ │ ├── dev-bluetooth.c
│ │ │ ├── dev-hid.c
│ │ │ ├── dev-hub.c
│ │ │ ├── dev-network.c
│ │ │ ├── dev-serial.c
│ │ │ ├── dev-smartcard-reader.c
│ │ │ ├── dev-storage.c
│ │ │ ├── dev-wacom.c
│ │ │ ├── hcd-ehci.c
│ │ │ ├── hcd-musb.c
│ │ │ ├── hcd-ohci.c
│ │ │ ├── hcd-uhci.c
│ │ │ ├── hcd-xhci.c
│ │ │ ├── host-bsd.c
│ │ │ ├── host-linux.c
│ │ │ ├── host-stub.c
│ │ │ ├── libhw.c
│ │ │ └── redirect.c
│ │ ├── usb.h
│ │ ├── versatile_pci.c
│ │ ├── versatilepb.c
│ │ ├── vexpress.c
│ │ ├── vga-isa-mm.c
│ │ ├── vga-isa.c
│ │ ├── vga-pci.c
│ │ ├── vga.c
│ │ ├── vga.h
│ │ ├── vga_int.h
│ │ ├── vga_template.h
│ │ ├── vhost.c
│ │ ├── vhost.h
│ │ ├── vhost_net.c
│ │ ├── vhost_net.h
│ │ ├── virtex_ml507.c
│ │ ├── virtio-balloon.c
│ │ ├── virtio-balloon.h
│ │ ├── virtio-blk.c
│ │ ├── virtio-blk.h
│ │ ├── virtio-console.c
│ │ ├── virtio-net.c
│ │ ├── virtio-net.h
│ │ ├── virtio-pci.c
│ │ ├── virtio-pci.h
│ │ ├── virtio-scsi.c
│ │ ├── virtio-scsi.h
│ │ ├── virtio-serial-bus.c
│ │ ├── virtio-serial.h
│ │ ├── virtio.c
│ │ ├── virtio.h
│ │ ├── vmmouse.c
│ │ ├── vmport.c
│ │ ├── vmware_vga.c
│ │ ├── vmware_vga.h
│ │ ├── vt82c686.c
│ │ ├── vt82c686.h
│ │ ├── watchdog.c
│ │ ├── watchdog.h
│ │ ├── wdt_i6300esb.c
│ │ ├── wdt_ib700.c
│ │ ├── wm8750.c
│ │ ├── xen.h
│ │ ├── xen_backend.c
│ │ ├── xen_backend.h
│ │ ├── xen_blkif.h
│ │ ├── xen_common.h
│ │ ├── xen_console.c
│ │ ├── xen_devconfig.c
│ │ ├── xen_disk.c
│ │ ├── xen_domainbuild.c
│ │ ├── xen_domainbuild.h
│ │ ├── xen_machine_pv.c
│ │ ├── xen_nic.c
│ │ ├── xen_platform.c
│ │ ├── xenfb.c
│ │ ├── xgmac.c
│ │ ├── xics.c
│ │ ├── xics.h
│ │ ├── xilinx.h
│ │ ├── xilinx_axidma.c
│ │ ├── xilinx_axidma.h
│ │ ├── xilinx_axienet.c
│ │ ├── xilinx_ethlite.c
│ │ ├── xilinx_intc.c
│ │ ├── xilinx_timer.c
│ │ ├── xilinx_uartlite.c
│ │ ├── xilinx_zynq.c
│ │ ├── xio3130_downstream.c
│ │ ├── xio3130_downstream.h
│ │ ├── xio3130_upstream.c
│ │ ├── xio3130_upstream.h
│ │ ├── xtensa_bootparam.h
│ │ ├── xtensa_lx60.c
│ │ ├── xtensa_pic.c
│ │ ├── xtensa_sim.c
│ │ ├── z2.c
│ │ ├── zaurus.c
│ │ └── zynq_slcr.c
│ ├── i386-dis.c
│ ├── i386.ld
│ ├── ia64-dis.c
│ ├── ia64.ld
│ ├── include/
│ │ └── qemu/
│ │ ├── cpu.h
│ │ ├── object.h
│ │ └── qom-qobject.h
│ ├── input.c
│ ├── int128.h
│ ├── iohandler.c
│ ├── ioport-user.c
│ ├── ioport.c
│ ├── ioport.h
│ ├── iorange.h
│ ├── iov.c
│ ├── iov.h
│ ├── json-lexer.c
│ ├── json-lexer.h
│ ├── json-parser.c
│ ├── json-parser.h
│ ├── json-streamer.c
│ ├── json-streamer.h
│ ├── kvm-all.c
│ ├── kvm-stub.c
│ ├── kvm.h
│ ├── libcacard/
│ │ ├── Makefile
│ │ ├── cac.c
│ │ ├── cac.h
│ │ ├── card_7816.c
│ │ ├── card_7816.h
│ │ ├── card_7816t.h
│ │ ├── event.c
│ │ ├── eventt.h
│ │ ├── libcacard.pc.in
│ │ ├── link_test.c
│ │ ├── vcard.c
│ │ ├── vcard.h
│ │ ├── vcard_emul.h
│ │ ├── vcard_emul_nss.c
│ │ ├── vcard_emul_type.c
│ │ ├── vcard_emul_type.h
│ │ ├── vcardt.h
│ │ ├── vevent.h
│ │ ├── vreader.c
│ │ ├── vreader.h
│ │ ├── vreadert.h
│ │ ├── vscard_common.h
│ │ └── vscclient.c
│ ├── libfdt_env.h
│ ├── linux-aio.c
│ ├── linux-headers/
│ │ ├── COPYING
│ │ ├── README
│ │ ├── asm-powerpc/
│ │ │ ├── kvm.h
│ │ │ └── kvm_para.h
│ │ ├── asm-s390/
│ │ │ ├── kvm.h
│ │ │ └── kvm_para.h
│ │ ├── asm-x86/
│ │ │ ├── hyperv.h
│ │ │ ├── kvm.h
│ │ │ └── kvm_para.h
│ │ └── linux/
│ │ ├── kvm.h
│ │ ├── kvm_para.h
│ │ ├── vhost.h
│ │ ├── virtio_config.h
│ │ └── virtio_ring.h
│ ├── linux-user/
│ │ ├── alpha/
│ │ │ ├── syscall.h
│ │ │ ├── syscall_nr.h
│ │ │ ├── target_signal.h
│ │ │ └── termbits.h
│ │ ├── arm/
│ │ │ ├── nwfpe/
│ │ │ │ ├── double_cpdo.c
│ │ │ │ ├── extended_cpdo.c
│ │ │ │ ├── fpa11.c
│ │ │ │ ├── fpa11.h
│ │ │ │ ├── fpa11.inl
│ │ │ │ ├── fpa11_cpdo.c
│ │ │ │ ├── fpa11_cpdt.c
│ │ │ │ ├── fpa11_cprt.c
│ │ │ │ ├── fpopcode.c
│ │ │ │ ├── fpopcode.h
│ │ │ │ ├── fpsr.h
│ │ │ │ └── single_cpdo.c
│ │ │ ├── syscall.h
│ │ │ ├── syscall_nr.h
│ │ │ ├── target_signal.h
│ │ │ └── termbits.h
│ │ ├── cpu-uname.c
│ │ ├── cpu-uname.h
│ │ ├── cris/
│ │ │ ├── syscall.h
│ │ │ ├── syscall_nr.h
│ │ │ ├── target_signal.h
│ │ │ └── termbits.h
│ │ ├── elfload.c
│ │ ├── errno_defs.h
│ │ ├── flat.h
│ │ ├── flatload.c
│ │ ├── i386/
│ │ │ ├── syscall.h
│ │ │ ├── syscall_nr.h
│ │ │ ├── target_signal.h
│ │ │ └── termbits.h
│ │ ├── ioctls.h
│ │ ├── linux_loop.h
│ │ ├── linuxload.c
│ │ ├── m68k/
│ │ │ ├── syscall.h
│ │ │ ├── syscall_nr.h
│ │ │ ├── target_signal.h
│ │ │ └── termbits.h
│ │ ├── m68k-sim.c
│ │ ├── main.c
│ │ ├── microblaze/
│ │ │ ├── syscall.h
│ │ │ ├── syscall_nr.h
│ │ │ ├── target_signal.h
│ │ │ └── termbits.h
│ │ ├── mips/
│ │ │ ├── syscall.h
│ │ │ ├── syscall_nr.h
│ │ │ ├── target_signal.h
│ │ │ └── termbits.h
│ │ ├── mips64/
│ │ │ ├── syscall.h
│ │ │ ├── syscall_nr.h
│ │ │ ├── target_signal.h
│ │ │ └── termbits.h
│ │ ├── mipsn32/
│ │ │ ├── syscall.h
│ │ │ ├── syscall_nr.h
│ │ │ ├── target_signal.h
│ │ │ └── termbits.h
│ │ ├── mmap.c
│ │ ├── ppc/
│ │ │ ├── syscall.h
│ │ │ ├── syscall_nr.h
│ │ │ ├── target_signal.h
│ │ │ └── termbits.h
│ │ ├── qemu-types.h
│ │ ├── qemu.h
│ │ ├── s390x/
│ │ │ ├── syscall.h
│ │ │ ├── syscall_nr.h
│ │ │ ├── target_signal.h
│ │ │ └── termbits.h
│ │ ├── sh4/
│ │ │ ├── syscall.h
│ │ │ ├── syscall_nr.h
│ │ │ ├── target_signal.h
│ │ │ └── termbits.h
│ │ ├── signal.c
│ │ ├── socket.h
│ │ ├── sparc/
│ │ │ ├── syscall.h
│ │ │ ├── syscall_nr.h
│ │ │ ├── target_signal.h
│ │ │ └── termbits.h
│ │ ├── sparc64/
│ │ │ ├── syscall.h
│ │ │ ├── syscall_nr.h
│ │ │ ├── target_signal.h
│ │ │ └── termbits.h
│ │ ├── strace.c
│ │ ├── strace.list
│ │ ├── syscall.c
│ │ ├── syscall_defs.h
│ │ ├── syscall_types.h
│ │ ├── target_flat.h
│ │ ├── uaccess.c
│ │ ├── unicore32/
│ │ │ ├── syscall.h
│ │ │ ├── syscall_nr.h
│ │ │ ├── target_signal.h
│ │ │ └── termbits.h
│ │ ├── vm86.c
│ │ └── x86_64/
│ │ ├── syscall.h
│ │ ├── syscall_nr.h
│ │ ├── target_signal.h
│ │ └── termbits.h
│ ├── llvm-lib.h
│ ├── lm32-dis.c
│ ├── m68k-dis.c
│ ├── m68k-semi.c
│ ├── m68k.ld
│ ├── main-loop.c
│ ├── main-loop.h
│ ├── memory.c
│ ├── memory.h
│ ├── microblaze-dis.c
│ ├── migration-exec.c
│ ├── migration-fd.c
│ ├── migration-tcp.c
│ ├── migration-unix.c
│ ├── migration.c
│ ├── migration.h
│ ├── mips-dis.c
│ ├── mips.ld
│ ├── module.c
│ ├── module.h
│ ├── monitor.c
│ ├── monitor.h
│ ├── nbd.c
│ ├── nbd.h
│ ├── net/
│ │ ├── checksum.c
│ │ ├── checksum.h
│ │ ├── dump.c
│ │ ├── dump.h
│ │ ├── queue.c
│ │ ├── queue.h
│ │ ├── slirp.c
│ │ ├── slirp.h
│ │ ├── socket.c
│ │ ├── socket.h
│ │ ├── tap-aix.c
│ │ ├── tap-bsd.c
│ │ ├── tap-haiku.c
│ │ ├── tap-linux.c
│ │ ├── tap-linux.h
│ │ ├── tap-solaris.c
│ │ ├── tap-win32.c
│ │ ├── tap.c
│ │ ├── tap.h
│ │ ├── util.c
│ │ ├── util.h
│ │ ├── vde.c
│ │ └── vde.h
│ ├── net.c
│ ├── net.h
│ ├── notify.c
│ ├── notify.h
│ ├── os-posix.c
│ ├── os-win32.c
│ ├── osdep.c
│ ├── osdep.h
│ ├── oslib-posix.c
│ ├── oslib-win32.c
│ ├── path.c
│ ├── pc-bios/
│ │ ├── Makefile
│ │ ├── README
│ │ ├── bamboo.dtb
│ │ ├── bamboo.dts
│ │ ├── keymaps/
│ │ │ ├── ar
│ │ │ ├── bepo
│ │ │ ├── common
│ │ │ ├── da
│ │ │ ├── de
│ │ │ ├── de-ch
│ │ │ ├── en-gb
│ │ │ ├── en-us
│ │ │ ├── es
│ │ │ ├── et
│ │ │ ├── fi
│ │ │ ├── fo
│ │ │ ├── fr
│ │ │ ├── fr-be
│ │ │ ├── fr-ca
│ │ │ ├── fr-ch
│ │ │ ├── hr
│ │ │ ├── hu
│ │ │ ├── is
│ │ │ ├── it
│ │ │ ├── ja
│ │ │ ├── lt
│ │ │ ├── lv
│ │ │ ├── mk
│ │ │ ├── modifiers
│ │ │ ├── nl
│ │ │ ├── nl-be
│ │ │ ├── no
│ │ │ ├── pl
│ │ │ ├── pt
│ │ │ ├── pt-br
│ │ │ ├── ru
│ │ │ ├── sl
│ │ │ ├── sv
│ │ │ ├── th
│ │ │ └── tr
│ │ ├── mpc8544ds.dtb
│ │ ├── mpc8544ds.dts
│ │ ├── ohw.diff
│ │ ├── openbios-ppc
│ │ ├── openbios-sparc32
│ │ ├── openbios-sparc64
│ │ ├── optionrom/
│ │ │ ├── Makefile
│ │ │ ├── kvmvapic.S
│ │ │ ├── linuxboot.S
│ │ │ ├── multiboot.S
│ │ │ └── optionrom.h
│ │ ├── palcode-clipper
│ │ ├── petalogix-ml605.dtb
│ │ ├── petalogix-s3adsp1800.dtb
│ │ ├── pxe-e1000.rom
│ │ ├── pxe-eepro100.rom
│ │ ├── pxe-ne2k_pci.rom
│ │ ├── pxe-pcnet.rom
│ │ ├── pxe-rtl8139.rom
│ │ ├── pxe-virtio.rom
│ │ ├── s390-zipl.rom
│ │ └── spapr-rtas/
│ │ ├── Makefile
│ │ └── spapr-rtas.S
│ ├── pci-ids.txt
│ ├── pflib.c
│ ├── pflib.h
│ ├── poison.h
│ ├── posix-aio-compat.c
│ ├── ppc-dis.c
│ ├── ppc.ld
│ ├── ppc64.ld
│ ├── qapi/
│ │ ├── qapi-dealloc-visitor.c
│ │ ├── qapi-dealloc-visitor.h
│ │ ├── qapi-types-core.h
│ │ ├── qapi-visit-core.c
│ │ ├── qapi-visit-core.h
│ │ ├── qapi-visit-impl.h
│ │ ├── qmp-core.h
│ │ ├── qmp-dispatch.c
│ │ ├── qmp-input-visitor.c
│ │ ├── qmp-input-visitor.h
│ │ ├── qmp-output-visitor.c
│ │ ├── qmp-output-visitor.h
│ │ ├── qmp-registry.c
│ │ ├── string-input-visitor.c
│ │ ├── string-input-visitor.h
│ │ ├── string-output-visitor.c
│ │ └── string-output-visitor.h
│ ├── qapi-schema-guest.json
│ ├── qapi-schema-test.json
│ ├── qapi-schema.json
│ ├── qbool.c
│ ├── qbool.h
│ ├── qdict-test-data.txt
│ ├── qdict.c
│ ├── qdict.h
│ ├── qemu-aio.h
│ ├── qemu-barrier.h
│ ├── qemu-bridge-helper.c
│ ├── qemu-char.c
│ ├── qemu-char.h
│ ├── qemu-common.h
│ ├── qemu-config.c
│ ├── qemu-config.h
│ ├── qemu-coroutine-int.h
│ ├── qemu-coroutine-io.c
│ ├── qemu-coroutine-lock.c
│ ├── qemu-coroutine-sleep.c
│ ├── qemu-coroutine.c
│ ├── qemu-coroutine.h
│ ├── qemu-doc.texi
│ ├── qemu-error.c
│ ├── qemu-error.h
│ ├── qemu-file.h
│ ├── qemu-ga.c
│ ├── qemu-img-cmds.hx
│ ├── qemu-img.c
│ ├── qemu-img.texi
│ ├── qemu-io.c
│ ├── qemu-lock.h
│ ├── qemu-log.h
│ ├── qemu-nbd.c
│ ├── qemu-nbd.texi
│ ├── qemu-objects.h
│ ├── qemu-option.c
│ ├── qemu-option.h
│ ├── qemu-options-wrapper.h
│ ├── qemu-options.h
│ ├── qemu-options.hx
│ ├── qemu-os-posix.h
│ ├── qemu-os-win32.h
│ ├── qemu-progress.c
│ ├── qemu-queue.h
│ ├── qemu-sockets.c
│ ├── qemu-tech.texi
│ ├── qemu-thread-posix.c
│ ├── qemu-thread-posix.h
│ ├── qemu-thread-win32.c
│ ├── qemu-thread-win32.h
│ ├── qemu-thread.h
│ ├── qemu-timer-common.c
│ ├── qemu-timer.c
│ ├── qemu-timer.h
│ ├── qemu-tls.h
│ ├── qemu-tool.c
│ ├── qemu-user.c
│ ├── qemu-x509.h
│ ├── qemu-xattr.h
│ ├── qemu.sasl
│ ├── qemu_socket.h
│ ├── qerror.c
│ ├── qerror.h
│ ├── qfloat.c
│ ├── qfloat.h
│ ├── qga/
│ │ ├── channel-posix.c
│ │ ├── channel-win32.c
│ │ ├── channel.h
│ │ ├── commands-posix.c
│ │ ├── commands-win32.c
│ │ ├── commands.c
│ │ ├── guest-agent-command-state.c
│ │ ├── guest-agent-core.h
│ │ ├── service-win32.c
│ │ └── service-win32.h
│ ├── qint.c
│ ├── qint.h
│ ├── qjson.c
│ ├── qjson.h
│ ├── qlist.c
│ ├── qlist.h
│ ├── qmp-commands.hx
│ ├── qmp.c
│ ├── qobject.h
│ ├── qom/
│ │ ├── Makefile
│ │ ├── container.c
│ │ ├── cpu.c
│ │ ├── object.c
│ │ └── qom-qobject.c
│ ├── qstring.c
│ ├── qstring.h
│ ├── qtest.c
│ ├── qtest.h
│ ├── range.h
│ ├── readline.c
│ ├── readline.h
│ ├── roms/
│ │ ├── Makefile
│ │ ├── config.seabios
│ │ ├── configure-seabios.sh
│ │ └── s2ebios/
│ │ ├── Makefile
│ │ ├── init.asm
│ │ ├── s2e-bios-low.asm
│ │ ├── s2e-bios-up.asm
│ │ ├── s2e-inst.asm
│ │ ├── s2e-test-ndis.asm
│ │ ├── s2e-test-statemanager.asm
│ │ └── s2e-test.asm
│ ├── rules.mak
│ ├── s2e/
│ │ ├── ConfigFile.cpp
│ │ ├── ConfigFile.h
│ │ ├── ExprInterface.cpp
│ │ ├── ExprInterface.h
│ │ ├── MMUFunctionHandlers.cpp
│ │ ├── MemoryCache.h
│ │ ├── Plugin.cpp
│ │ ├── Plugin.h
│ │ ├── Plugins/
│ │ │ ├── Annotation.cpp
│ │ │ ├── Annotation.h
│ │ │ ├── ArmFunctionMonitor.cpp
│ │ │ ├── ArmFunctionMonitor.h
│ │ │ ├── BaseInstructions.cpp
│ │ │ ├── BaseInstructions.h
│ │ │ ├── CacheSim.cpp
│ │ │ ├── CacheSim.h
│ │ │ ├── CodeSelector.cpp
│ │ │ ├── CodeSelector.h
│ │ │ ├── ConsistencyModels.cpp
│ │ │ ├── ConsistencyModels.h
│ │ │ ├── CorePlugin.cpp
│ │ │ ├── CorePlugin.h
│ │ │ ├── DataStructureSpy.h
│ │ │ ├── Debugger.cpp
│ │ │ ├── Debugger.h
│ │ │ ├── EdgeKiller.cpp
│ │ │ ├── EdgeKiller.h
│ │ │ ├── Example.cpp
│ │ │ ├── Example.h
│ │ │ ├── ExecutableImage.h
│ │ │ ├── ExecutionStatisticsCollector.cpp
│ │ │ ├── ExecutionStatisticsCollector.h
│ │ │ ├── ExecutionTracers/
│ │ │ │ ├── EventTracer.cpp
│ │ │ │ ├── EventTracer.h
│ │ │ │ ├── ExceptionTracer.cpp
│ │ │ │ ├── ExceptionTracer.h
│ │ │ │ ├── ExecutionTracer.cpp
│ │ │ │ ├── ExecutionTracer.h
│ │ │ │ ├── InstructionCounter.cpp
│ │ │ │ ├── InstructionCounter.h
│ │ │ │ ├── MemoryTracer.cpp
│ │ │ │ ├── MemoryTracer.h
│ │ │ │ ├── ModuleTracer.cpp
│ │ │ │ ├── ModuleTracer.h
│ │ │ │ ├── StateSwitchTracer.cpp
│ │ │ │ ├── StateSwitchTracer.h
│ │ │ │ ├── TestCaseGenerator.cpp
│ │ │ │ ├── TestCaseGenerator.h
│ │ │ │ ├── TraceEntries.h
│ │ │ │ ├── TranslationBlockTracer.cpp
│ │ │ │ └── TranslationBlockTracer.h
│ │ │ ├── FunctionMonitor.h
│ │ │ ├── HostFiles.cpp
│ │ │ ├── HostFiles.h
│ │ │ ├── InterruptInjector.cpp
│ │ │ ├── InterruptInjector.h
│ │ │ ├── LibraryCallMonitor.cpp
│ │ │ ├── LibraryCallMonitor.h
│ │ │ ├── MemoryChecker.cpp
│ │ │ ├── MemoryChecker.h
│ │ │ ├── ModuleDescriptor.h
│ │ │ ├── ModuleExecutionDetector.cpp
│ │ │ ├── ModuleExecutionDetector.h
│ │ │ ├── OSMonitor.h
│ │ │ ├── Opcodes.h
│ │ │ ├── RawMonitor.cpp
│ │ │ ├── RawMonitor.h
│ │ │ ├── Searchers/
│ │ │ │ ├── ConcolicDFSSearcher.cpp
│ │ │ │ ├── ConcolicDFSSearcher.h
│ │ │ │ ├── CooperativeSearcher.cpp
│ │ │ │ ├── CooperativeSearcher.h
│ │ │ │ ├── MaxTbSearcher.cpp
│ │ │ │ └── MaxTbSearcher.h
│ │ │ ├── StackChecker.cpp
│ │ │ ├── StackChecker.h
│ │ │ ├── StackMonitor.cpp
│ │ │ ├── StackMonitor.h
│ │ │ ├── StateManager.cpp
│ │ │ ├── StateManager.h
│ │ │ ├── SymbolicHardware.cpp
│ │ │ ├── SymbolicHardware.h
│ │ │ ├── ThreadDescriptor.h
│ │ │ ├── WindowsApi/
│ │ │ │ ├── Api.cpp
│ │ │ │ ├── Api.h
│ │ │ │ ├── HalHandlers.cpp
│ │ │ │ ├── HalHandlers.h
│ │ │ │ ├── Ndis.h
│ │ │ │ ├── NdisHandlers.cpp
│ │ │ │ ├── NdisHandlers.h
│ │ │ │ ├── NdisHandlersUtils.cpp
│ │ │ │ ├── NdisMemoryCheck.cpp
│ │ │ │ ├── NdisProtocolHandlers.cpp
│ │ │ │ ├── Ntddk.h
│ │ │ │ ├── NtoskrnlHandlers.cpp
│ │ │ │ ├── NtoskrnlHandlers.h
│ │ │ │ ├── WindowsDriverExerciser.cpp
│ │ │ │ └── WindowsDriverExerciser.h
│ │ │ ├── WindowsInterceptor/
│ │ │ │ ├── BlueScreenInterceptor.cpp
│ │ │ │ ├── BlueScreenInterceptor.h
│ │ │ │ ├── KernelModeInterceptor.cpp
│ │ │ │ ├── KernelModeInterceptor.h
│ │ │ │ ├── UserModeInterceptor.cpp
│ │ │ │ ├── UserModeInterceptor.h
│ │ │ │ ├── WindowsCrashDumpGenerator.cpp
│ │ │ │ ├── WindowsCrashDumpGenerator.h
│ │ │ │ ├── WindowsImage.cpp
│ │ │ │ ├── WindowsImage.h
│ │ │ │ ├── WindowsMonitor.cpp
│ │ │ │ ├── WindowsMonitor.h
│ │ │ │ ├── WindowsSpy.cpp
│ │ │ │ └── WindowsSpy.h
│ │ │ ├── X86ExceptionInterceptor.cpp
│ │ │ ├── X86ExceptionInterceptor.h
│ │ │ ├── X86FunctionMonitor.cpp
│ │ │ └── X86FunctionMonitor.h
│ │ ├── S2E.cpp
│ │ ├── S2E.h
│ │ ├── S2EDeviceState.cpp
│ │ ├── S2EDeviceState.h
│ │ ├── S2EExecutionState.cpp
│ │ ├── S2EExecutionState.h
│ │ ├── S2EExecutor.cpp
│ │ ├── S2EExecutor.h
│ │ ├── S2ESJLJ.h
│ │ ├── S2EStatsTracker.cpp
│ │ ├── S2EStatsTracker.h
│ │ ├── SelectRemovalPass.cpp
│ │ ├── SelectRemovalPass.h
│ │ ├── Signals/
│ │ │ ├── Signals.h
│ │ │ ├── build.sh
│ │ │ ├── fsigc++.h
│ │ │ ├── functors.h
│ │ │ ├── sig-template.h
│ │ │ ├── signals.cpp
│ │ │ └── test.cpp
│ │ ├── Slab.cpp
│ │ ├── Slab.h
│ │ ├── Synchronization.cpp
│ │ ├── Synchronization.h
│ │ ├── Utils.h
│ │ ├── machine.h
│ │ ├── s2e_block.h
│ │ ├── s2e_config.h
│ │ ├── s2e_qemu.h
│ │ └── x64.asm
│ ├── s390-dis.c
│ ├── s390.ld
│ ├── savevm.c
│ ├── scripts/
│ │ ├── analyse-9p-simpletrace.py
│ │ ├── check-qerror.sh
│ │ ├── checkpatch.pl
│ │ ├── create_config
│ │ ├── feature_to_c.sh
│ │ ├── get_maintainer.pl
│ │ ├── gtester-cat
│ │ ├── hxtool
│ │ ├── kvm/
│ │ │ ├── kvm_stat
│ │ │ └── vmxcap
│ │ ├── make_device_config.sh
│ │ ├── ordereddict.py
│ │ ├── qapi-commands.py
│ │ ├── qapi-types.py
│ │ ├── qapi-visit.py
│ │ ├── qapi.py
│ │ ├── qemu-binfmt-conf.sh
│ │ ├── qemu-gdb.py
│ │ ├── qtest
│ │ ├── refresh-pxe-roms.sh
│ │ ├── signrom.sh
│ │ ├── simpletrace.py
│ │ ├── texi2pod.pl
│ │ ├── tracetool
│ │ └── update-linux-headers.sh
│ ├── sh4-dis.c
│ ├── slirp/
│ │ ├── COPYRIGHT
│ │ ├── arp_table.c
│ │ ├── bootp.c
│ │ ├── bootp.h
│ │ ├── cksum.c
│ │ ├── debug.h
│ │ ├── if.c
│ │ ├── if.h
│ │ ├── ip.h
│ │ ├── ip_icmp.c
│ │ ├── ip_icmp.h
│ │ ├── ip_input.c
│ │ ├── ip_output.c
│ │ ├── libslirp.h
│ │ ├── main.h
│ │ ├── mbuf.c
│ │ ├── mbuf.h
│ │ ├── misc.c
│ │ ├── misc.h
│ │ ├── sbuf.c
│ │ ├── sbuf.h
│ │ ├── slirp.c
│ │ ├── slirp.h
│ │ ├── slirp_config.h
│ │ ├── socket.c
│ │ ├── socket.h
│ │ ├── tcp.h
│ │ ├── tcp_input.c
│ │ ├── tcp_output.c
│ │ ├── tcp_subr.c
│ │ ├── tcp_timer.c
│ │ ├── tcp_timer.h
│ │ ├── tcp_var.h
│ │ ├── tcpip.h
│ │ ├── tftp.c
│ │ ├── tftp.h
│ │ ├── udp.c
│ │ └── udp.h
│ ├── softmmu-semi.h
│ ├── softmmu_defs.h
│ ├── softmmu_exec.h
│ ├── softmmu_header.h
│ ├── softmmu_template.h
│ ├── sparc-dis.c
│ ├── sparc.ld
│ ├── sparc64.ld
│ ├── spice-qemu-char.c
│ ├── sysconfigs/
│ │ └── target/
│ │ └── target-x86_64.conf
│ ├── sysemu.h
│ ├── target-alpha/
│ │ ├── STATUS
│ │ ├── cpu.h
│ │ ├── fpu_helper.c
│ │ ├── helper.c
│ │ ├── helper.h
│ │ ├── int_helper.c
│ │ ├── machine.c
│ │ ├── mem_helper.c
│ │ ├── sys_helper.c
│ │ └── translate.c
│ ├── target-arm/
│ │ ├── cpu-qom.h
│ │ ├── cpu.c
│ │ ├── cpu.h
│ │ ├── helper.c
│ │ ├── helper.h
│ │ ├── iwmmxt_helper.c
│ │ ├── machine.c
│ │ ├── neon_helper.c
│ │ ├── op_addsub.h
│ │ ├── op_helper.c
│ │ ├── target-defs.h
│ │ └── translate.c
│ ├── target-cris/
│ │ ├── cpu.h
│ │ ├── crisv10-decode.h
│ │ ├── crisv32-decode.h
│ │ ├── helper.c
│ │ ├── helper.h
│ │ ├── machine.c
│ │ ├── mmu.c
│ │ ├── mmu.h
│ │ ├── op_helper.c
│ │ ├── opcode-cris.h
│ │ ├── translate.c
│ │ └── translate_v10.c
│ ├── target-i386/
│ │ ├── TODO
│ │ ├── cpu.h
│ │ ├── cpuid.c
│ │ ├── helper.c
│ │ ├── helper.h
│ │ ├── helper_template.h
│ │ ├── hyperv.c
│ │ ├── hyperv.h
│ │ ├── kvm.c
│ │ ├── machine.c
│ │ ├── op_helper.c
│ │ ├── ops_sse.h
│ │ ├── ops_sse_header.h
│ │ ├── svm.h
│ │ └── translate.c
│ ├── target-lm32/
│ │ ├── README
│ │ ├── TODO
│ │ ├── cpu.h
│ │ ├── helper.c
│ │ ├── helper.h
│ │ ├── machine.c
│ │ ├── op_helper.c
│ │ └── translate.c
│ ├── target-m68k/
│ │ ├── cpu.h
│ │ ├── helper.c
│ │ ├── helpers.h
│ │ ├── m68k-qreg.h
│ │ ├── machine.c
│ │ ├── op_helper.c
│ │ ├── qregs.def
│ │ └── translate.c
│ ├── target-microblaze/
│ │ ├── cpu.h
│ │ ├── helper.c
│ │ ├── helper.h
│ │ ├── machine.c
│ │ ├── microblaze-decode.h
│ │ ├── mmu.c
│ │ ├── mmu.h
│ │ ├── op_helper.c
│ │ └── translate.c
│ ├── target-mips/
│ │ ├── TODO
│ │ ├── cpu.h
│ │ ├── helper.c
│ │ ├── helper.h
│ │ ├── machine.c
│ │ ├── mips-defs.h
│ │ ├── op_helper.c
│ │ ├── translate.c
│ │ └── translate_init.c
│ ├── target-ppc/
│ │ ├── STATUS
│ │ ├── cpu.h
│ │ ├── helper.c
│ │ ├── helper.h
│ │ ├── helper_regs.h
│ │ ├── kvm.c
│ │ ├── kvm_ppc.c
│ │ ├── kvm_ppc.h
│ │ ├── machine.c
│ │ ├── mfrom_table.c
│ │ ├── mfrom_table_gen.c
│ │ ├── op_helper.c
│ │ ├── translate.c
│ │ └── translate_init.c
│ ├── target-s390x/
│ │ ├── cpu-qom.h
│ │ ├── cpu.c
│ │ ├── cpu.h
│ │ ├── helper.c
│ │ ├── helper.h
│ │ ├── kvm.c
│ │ ├── machine.c
│ │ ├── op_helper.c
│ │ └── translate.c
│ ├── target-sh4/
│ │ ├── README.sh4
│ │ ├── cpu.h
│ │ ├── helper.c
│ │ ├── helper.h
│ │ ├── machine.c
│ │ ├── op_helper.c
│ │ └── translate.c
│ ├── target-sparc/
│ │ ├── TODO
│ │ ├── cc_helper.c
│ │ ├── cpu-qom.h
│ │ ├── cpu.c
│ │ ├── cpu.h
│ │ ├── fop_helper.c
│ │ ├── helper.c
│ │ ├── helper.h
│ │ ├── int32_helper.c
│ │ ├── int64_helper.c
│ │ ├── ldst_helper.c
│ │ ├── machine.c
│ │ ├── mmu_helper.c
│ │ ├── translate.c
│ │ ├── vis_helper.c
│ │ └── win_helper.c
│ ├── target-unicore32/
│ │ ├── cpu-qom.h
│ │ ├── cpu.c
│ │ ├── cpu.h
│ │ ├── helper.c
│ │ ├── helper.h
│ │ ├── op_helper.c
│ │ └── translate.c
│ ├── target-xtensa/
│ │ ├── core-dc232b/
│ │ │ ├── core-isa.h
│ │ │ └── gdb-config.c
│ │ ├── core-dc232b.c
│ │ ├── core-fsf/
│ │ │ └── core-isa.h
│ │ ├── core-fsf.c
│ │ ├── cpu.h
│ │ ├── helper.c
│ │ ├── helpers.h
│ │ ├── machine.c
│ │ ├── op_helper.c
│ │ ├── overlay_tool.h
│ │ └── translate.c
│ ├── targphys.h
│ ├── tcg/
│ │ ├── LICENSE
│ │ ├── README
│ │ ├── TODO
│ │ ├── arm/
│ │ │ ├── tcg-target.c
│ │ │ └── tcg-target.h
│ │ ├── hppa/
│ │ │ ├── tcg-target.c
│ │ │ └── tcg-target.h
│ │ ├── i386/
│ │ │ ├── tcg-target.c
│ │ │ └── tcg-target.h
│ │ ├── ia64/
│ │ │ ├── tcg-target.c
│ │ │ └── tcg-target.h
│ │ ├── mips/
│ │ │ ├── tcg-target.c
│ │ │ └── tcg-target.h
│ │ ├── optimize.c
│ │ ├── ppc/
│ │ │ ├── tcg-target.c
│ │ │ └── tcg-target.h
│ │ ├── ppc64/
│ │ │ ├── tcg-target.c
│ │ │ └── tcg-target.h
│ │ ├── s390/
│ │ │ ├── tcg-target.c
│ │ │ └── tcg-target.h
│ │ ├── sparc/
│ │ │ ├── tcg-target.c
│ │ │ └── tcg-target.h
│ │ ├── tcg-llvm.cpp
│ │ ├── tcg-llvm.h
│ │ ├── tcg-op.h
│ │ ├── tcg-opc.h
│ │ ├── tcg-runtime.h
│ │ ├── tcg.c
│ │ ├── tcg.h
│ │ └── tci/
│ │ ├── README
│ │ ├── tcg-target.c
│ │ └── tcg-target.h
│ ├── tcg-runtime.c
│ ├── tci-dis.c
│ ├── tci.c
│ ├── tests/
│ │ ├── Makefile
│ │ ├── check-block.sh
│ │ ├── check-qdict.c
│ │ ├── check-qfloat.c
│ │ ├── check-qint.c
│ │ ├── check-qjson.c
│ │ ├── check-qlist.c
│ │ ├── check-qstring.c
│ │ ├── libqtest.c
│ │ ├── libqtest.h
│ │ ├── qemu-iotests/
│ │ │ ├── .gitignore
│ │ │ ├── 001
│ │ │ ├── 001.out
│ │ │ ├── 002
│ │ │ ├── 002.out
│ │ │ ├── 003
│ │ │ ├── 003.out
│ │ │ ├── 004
│ │ │ ├── 004.out
│ │ │ ├── 005
│ │ │ ├── 005.out
│ │ │ ├── 006
│ │ │ ├── 006.out
│ │ │ ├── 007
│ │ │ ├── 007.out
│ │ │ ├── 008
│ │ │ ├── 008.out
│ │ │ ├── 009
│ │ │ ├── 009.out
│ │ │ ├── 010
│ │ │ ├── 010.out
│ │ │ ├── 011
│ │ │ ├── 011.out
│ │ │ ├── 012
│ │ │ ├── 012.out
│ │ │ ├── 013
│ │ │ ├── 013.out
│ │ │ ├── 014
│ │ │ ├── 014.out
│ │ │ ├── 015
│ │ │ ├── 015.out
│ │ │ ├── 016
│ │ │ ├── 016.out
│ │ │ ├── 017
│ │ │ ├── 017.out
│ │ │ ├── 018
│ │ │ ├── 018.out
│ │ │ ├── 019
│ │ │ ├── 019.out
│ │ │ ├── 020
│ │ │ ├── 020.out
│ │ │ ├── 021
│ │ │ ├── 021.out
│ │ │ ├── 022
│ │ │ ├── 022.out
│ │ │ ├── 023
│ │ │ ├── 023.out
│ │ │ ├── 024
│ │ │ ├── 024.out
│ │ │ ├── 025
│ │ │ ├── 025.out
│ │ │ ├── 026
│ │ │ ├── 026.out
│ │ │ ├── 027
│ │ │ ├── 027.out
│ │ │ ├── 028
│ │ │ ├── 028.out
│ │ │ ├── 029
│ │ │ ├── 029.out
│ │ │ ├── 030
│ │ │ ├── 030.out
│ │ │ ├── COPYING
│ │ │ ├── Makefile
│ │ │ ├── README
│ │ │ ├── check
│ │ │ ├── common
│ │ │ ├── common.config
│ │ │ ├── common.filter
│ │ │ ├── common.pattern
│ │ │ ├── common.rc
│ │ │ ├── group
│ │ │ └── iotests.py
│ │ ├── qemu-iotests-quick.sh
│ │ ├── rtc-test.c
│ │ ├── s2earm/
│ │ │ └── buildHello.sh
│ │ ├── tcg/
│ │ │ ├── Makefile
│ │ │ ├── alpha/
│ │ │ │ ├── Makefile
│ │ │ │ ├── crt.s
│ │ │ │ ├── hello-alpha.c
│ │ │ │ ├── test-cond.c
│ │ │ │ └── test-ovf.c
│ │ │ ├── cris/
│ │ │ │ ├── Makefile
│ │ │ │ ├── README
│ │ │ │ ├── check_abs.c
│ │ │ │ ├── check_addc.c
│ │ │ │ ├── check_addcm.c
│ │ │ │ ├── check_addi.s
│ │ │ │ ├── check_addiv32.s
│ │ │ │ ├── check_addm.s
│ │ │ │ ├── check_addo.c
│ │ │ │ ├── check_addoq.c
│ │ │ │ ├── check_addq.s
│ │ │ │ ├── check_addr.s
│ │ │ │ ├── check_addxc.s
│ │ │ │ ├── check_addxm.s
│ │ │ │ ├── check_addxr.s
│ │ │ │ ├── check_andc.s
│ │ │ │ ├── check_andm.s
│ │ │ │ ├── check_andq.s
│ │ │ │ ├── check_andr.s
│ │ │ │ ├── check_asr.s
│ │ │ │ ├── check_ba.s
│ │ │ │ ├── check_bas.s
│ │ │ │ ├── check_bcc.s
│ │ │ │ ├── check_bound.c
│ │ │ │ ├── check_boundc.s
│ │ │ │ ├── check_boundr.s
│ │ │ │ ├── check_btst.s
│ │ │ │ ├── check_clearfv32.s
│ │ │ │ ├── check_clrjmp1.s
│ │ │ │ ├── check_cmp-2.s
│ │ │ │ ├── check_cmpc.s
│ │ │ │ ├── check_cmpm.s
│ │ │ │ ├── check_cmpq.s
│ │ │ │ ├── check_cmpr.s
│ │ │ │ ├── check_cmpxc.s
│ │ │ │ ├── check_cmpxm.s
│ │ │ │ ├── check_dstep.s
│ │ │ │ ├── check_ftag.c
│ │ │ │ ├── check_gcctorture_pr28634-1.c
│ │ │ │ ├── check_gcctorture_pr28634.c
│ │ │ │ ├── check_glibc_kernelversion.c
│ │ │ │ ├── check_hello.c
│ │ │ │ ├── check_int64.c
│ │ │ │ ├── check_jsr.s
│ │ │ │ ├── check_lapc.s
│ │ │ │ ├── check_lsl.s
│ │ │ │ ├── check_lsr.s
│ │ │ │ ├── check_lz.c
│ │ │ │ ├── check_mapbrk.c
│ │ │ │ ├── check_mcp.s
│ │ │ │ ├── check_mmap1.c
│ │ │ │ ├── check_mmap2.c
│ │ │ │ ├── check_mmap3.c
│ │ │ │ ├── check_movdelsr1.s
│ │ │ │ ├── check_movecr.s
│ │ │ │ ├── check_movei.s
│ │ │ │ ├── check_movemr.s
│ │ │ │ ├── check_movemrv32.s
│ │ │ │ ├── check_moveq.c
│ │ │ │ ├── check_mover.s
│ │ │ │ ├── check_moverm.s
│ │ │ │ ├── check_movmp.s
│ │ │ │ ├── check_movpmv32.s
│ │ │ │ ├── check_movpr.s
│ │ │ │ ├── check_movprv32.s
│ │ │ │ ├── check_movscr.s
│ │ │ │ ├── check_movsm.s
│ │ │ │ ├── check_movsr.s
│ │ │ │ ├── check_movucr.s
│ │ │ │ ├── check_movum.s
│ │ │ │ ├── check_movur.s
│ │ │ │ ├── check_mulv32.s
│ │ │ │ ├── check_mulx.s
│ │ │ │ ├── check_neg.s
│ │ │ │ ├── check_not.s
│ │ │ │ ├── check_openpf1.c
│ │ │ │ ├── check_openpf2.c
│ │ │ │ ├── check_openpf3.c
│ │ │ │ ├── check_openpf4.c
│ │ │ │ ├── check_openpf5.c
│ │ │ │ ├── check_orc.s
│ │ │ │ ├── check_orm.s
│ │ │ │ ├── check_orq.s
│ │ │ │ ├── check_orr.s
│ │ │ │ ├── check_ret.s
│ │ │ │ ├── check_scc.s
│ │ │ │ ├── check_settls1.c
│ │ │ │ ├── check_sigalrm.c
│ │ │ │ ├── check_stat1.c
│ │ │ │ ├── check_stat2.c
│ │ │ │ ├── check_stat3.c
│ │ │ │ ├── check_stat4.c
│ │ │ │ ├── check_subc.s
│ │ │ │ ├── check_subm.s
│ │ │ │ ├── check_subq.s
│ │ │ │ ├── check_subr.s
│ │ │ │ ├── check_swap.c
│ │ │ │ ├── check_time1.c
│ │ │ │ ├── check_time2.c
│ │ │ │ ├── check_xarith.s
│ │ │ │ ├── crisutils.h
│ │ │ │ ├── crt.s
│ │ │ │ ├── sys.c
│ │ │ │ ├── sys.h
│ │ │ │ └── testutils.inc
│ │ │ ├── hello-arm.c
│ │ │ ├── hello-i386.c
│ │ │ ├── hello-mips.c
│ │ │ ├── linux-test.c
│ │ │ ├── lm32/
│ │ │ │ ├── Makefile
│ │ │ │ ├── crt.S
│ │ │ │ ├── linker.ld
│ │ │ │ ├── macros.inc
│ │ │ │ ├── test_add.S
│ │ │ │ ├── test_addi.S
│ │ │ │ ├── test_and.S
│ │ │ │ ├── test_andhi.S
│ │ │ │ ├── test_andi.S
│ │ │ │ ├── test_b.S
│ │ │ │ ├── test_be.S
│ │ │ │ ├── test_bg.S
│ │ │ │ ├── test_bge.S
│ │ │ │ ├── test_bgeu.S
│ │ │ │ ├── test_bgu.S
│ │ │ │ ├── test_bi.S
│ │ │ │ ├── test_bne.S
│ │ │ │ ├── test_break.S
│ │ │ │ ├── test_bret.S
│ │ │ │ ├── test_call.S
│ │ │ │ ├── test_calli.S
│ │ │ │ ├── test_cmpe.S
│ │ │ │ ├── test_cmpei.S
│ │ │ │ ├── test_cmpg.S
│ │ │ │ ├── test_cmpge.S
│ │ │ │ ├── test_cmpgei.S
│ │ │ │ ├── test_cmpgeu.S
│ │ │ │ ├── test_cmpgeui.S
│ │ │ │ ├── test_cmpgi.S
│ │ │ │ ├── test_cmpgu.S
│ │ │ │ ├── test_cmpgui.S
│ │ │ │ ├── test_cmpne.S
│ │ │ │ ├── test_cmpnei.S
│ │ │ │ ├── test_divu.S
│ │ │ │ ├── test_eret.S
│ │ │ │ ├── test_lb.S
│ │ │ │ ├── test_lbu.S
│ │ │ │ ├── test_lh.S
│ │ │ │ ├── test_lhu.S
│ │ │ │ ├── test_lw.S
│ │ │ │ ├── test_modu.S
│ │ │ │ ├── test_mul.S
│ │ │ │ ├── test_muli.S
│ │ │ │ ├── test_nor.S
│ │ │ │ ├── test_nori.S
│ │ │ │ ├── test_or.S
│ │ │ │ ├── test_orhi.S
│ │ │ │ ├── test_ori.S
│ │ │ │ ├── test_ret.S
│ │ │ │ ├── test_sb.S
│ │ │ │ ├── test_scall.S
│ │ │ │ ├── test_sextb.S
│ │ │ │ ├── test_sexth.S
│ │ │ │ ├── test_sh.S
│ │ │ │ ├── test_sl.S
│ │ │ │ ├── test_sli.S
│ │ │ │ ├── test_sr.S
│ │ │ │ ├── test_sri.S
│ │ │ │ ├── test_sru.S
│ │ │ │ ├── test_srui.S
│ │ │ │ ├── test_sub.S
│ │ │ │ ├── test_sw.S
│ │ │ │ ├── test_xnor.S
│ │ │ │ ├── test_xnori.S
│ │ │ │ ├── test_xor.S
│ │ │ │ └── test_xori.S
│ │ │ ├── pi_10.com
│ │ │ ├── runcom.c
│ │ │ ├── sha1.c
│ │ │ ├── test-arm-iwmmxt.s
│ │ │ ├── test-i386-code16.S
│ │ │ ├── test-i386-muldiv.h
│ │ │ ├── test-i386-shift.h
│ │ │ ├── test-i386-ssse3.c
│ │ │ ├── test-i386-vm86.S
│ │ │ ├── test-i386.c
│ │ │ ├── test-i386.h
│ │ │ ├── test-mmap.c
│ │ │ ├── test_path.c
│ │ │ ├── testthread.c
│ │ │ └── xtensa/
│ │ │ ├── Makefile
│ │ │ ├── crt.S
│ │ │ ├── linker.ld
│ │ │ ├── macros.inc
│ │ │ ├── test_b.S
│ │ │ ├── test_bi.S
│ │ │ ├── test_boolean.S
│ │ │ ├── test_break.S
│ │ │ ├── test_bz.S
│ │ │ ├── test_clamps.S
│ │ │ ├── test_fail.S
│ │ │ ├── test_interrupt.S
│ │ │ ├── test_loop.S
│ │ │ ├── test_mac16.S
│ │ │ ├── test_max.S
│ │ │ ├── test_min.S
│ │ │ ├── test_mmu.S
│ │ │ ├── test_mul16.S
│ │ │ ├── test_mul32.S
│ │ │ ├── test_nsa.S
│ │ │ ├── test_pipeline.S
│ │ │ ├── test_quo.S
│ │ │ ├── test_rem.S
│ │ │ ├── test_rst0.S
│ │ │ ├── test_sar.S
│ │ │ ├── test_sext.S
│ │ │ ├── test_shift.S
│ │ │ ├── test_timer.S
│ │ │ ├── test_windowed.S
│ │ │ └── vectors.S
│ │ ├── test-coroutine.c
│ │ ├── test-qmp-commands.c
│ │ ├── test-qmp-input-strict.c
│ │ ├── test-qmp-input-visitor.c
│ │ ├── test-qmp-output-visitor.c
│ │ ├── test-string-input-visitor.c
│ │ └── test-string-output-visitor.c
│ ├── thunk.c
│ ├── thunk.h
│ ├── trace/
│ │ ├── control.c
│ │ ├── control.h
│ │ ├── default.c
│ │ ├── simple.c
│ │ ├── simple.h
│ │ ├── stderr.c
│ │ └── stderr.h
│ ├── trace-events
│ ├── translate-all.c
│ ├── uboot_image.h
│ ├── ui/
│ │ ├── cocoa.m
│ │ ├── curses.c
│ │ ├── curses_keys.h
│ │ ├── d3des.c
│ │ ├── d3des.h
│ │ ├── keymaps.c
│ │ ├── keymaps.h
│ │ ├── qemu-spice.h
│ │ ├── sdl.c
│ │ ├── sdl_keysym.h
│ │ ├── sdl_zoom.c
│ │ ├── sdl_zoom.h
│ │ ├── sdl_zoom_template.h
│ │ ├── spice-core.c
│ │ ├── spice-display.c
│ │ ├── spice-display.h
│ │ ├── spice-input.c
│ │ ├── vnc-auth-sasl.c
│ │ ├── vnc-auth-sasl.h
│ │ ├── vnc-auth-vencrypt.c
│ │ ├── vnc-auth-vencrypt.h
│ │ ├── vnc-enc-hextile-template.h
│ │ ├── vnc-enc-hextile.c
│ │ ├── vnc-enc-tight.c
│ │ ├── vnc-enc-tight.h
│ │ ├── vnc-enc-zlib.c
│ │ ├── vnc-enc-zrle-template.c
│ │ ├── vnc-enc-zrle.c
│ │ ├── vnc-enc-zrle.h
│ │ ├── vnc-enc-zywrle-template.c
│ │ ├── vnc-enc-zywrle.h
│ │ ├── vnc-jobs-async.c
│ │ ├── vnc-jobs-sync.c
│ │ ├── vnc-jobs.h
│ │ ├── vnc-palette.c
│ │ ├── vnc-palette.h
│ │ ├── vnc-tls.c
│ │ ├── vnc-tls.h
│ │ ├── vnc.c
│ │ ├── vnc.h
│ │ ├── vnc_keysym.h
│ │ ├── x_keymap.c
│ │ └── x_keymap.h
│ ├── user-exec.c
│ ├── version.rc
│ ├── vgafont.h
│ ├── vl.c
│ ├── vmstate.h
│ ├── x86_64.ld
│ ├── xen-all.c
│ ├── xen-mapcache.c
│ ├── xen-mapcache.h
│ ├── xen-stub.c
│ └── xtensa-semi.c
├── s2e.config
├── s2e.creator
├── s2e.creator.user.example
├── s2e.files
├── s2e.includes
├── s2e.refresh_project.py
├── stp/
│ ├── AUTHORS
│ ├── CODING_GUIDLINES
│ ├── DOWNLOAD
│ ├── INSTALL
│ ├── LICENSE
│ ├── LICENSE_COMPONENTS
│ ├── README
│ ├── clean-install.sh
│ ├── scripts/
│ │ ├── Makefile.common
│ │ ├── Makefile.in
│ │ ├── configure
│ │ ├── emacs-format-file
│ │ ├── emacs-format.sh
│ │ ├── liblinks.sh
│ │ └── run_tests.pl
│ ├── src/
│ │ ├── AST/
│ │ │ ├── AST.h
│ │ │ ├── ASTBVConst.cpp
│ │ │ ├── ASTBVConst.h
│ │ │ ├── ASTInterior.cpp
│ │ │ ├── ASTInterior.h
│ │ │ ├── ASTInternal.h
│ │ │ ├── ASTInternalWithChildren.h
│ │ │ ├── ASTKind.kinds
│ │ │ ├── ASTNode.cpp
│ │ │ ├── ASTNode.h
│ │ │ ├── ASTSymbol.cpp
│ │ │ ├── ASTSymbol.h
│ │ │ ├── ASTUtil.cpp
│ │ │ ├── ASTmisc.cpp
│ │ │ ├── ArrayTransformer.cpp
│ │ │ ├── ArrayTransformer.h
│ │ │ ├── Makefile
│ │ │ ├── NodeFactory/
│ │ │ │ ├── HashingNodeFactory.cpp
│ │ │ │ ├── HashingNodeFactory.h
│ │ │ │ ├── NodeFactory.cpp
│ │ │ │ ├── NodeFactory.h
│ │ │ │ ├── SimplifyingNodeFactory.cpp
│ │ │ │ ├── SimplifyingNodeFactory.h
│ │ │ │ ├── TypeChecker.cpp
│ │ │ │ └── TypeChecker.h
│ │ │ ├── RunTimes.cpp
│ │ │ ├── RunTimes.h
│ │ │ ├── STLport_config.h
│ │ │ ├── TestAST/
│ │ │ │ ├── asttest.cpp
│ │ │ │ ├── bbtest.cpp
│ │ │ │ └── cnftest.cpp
│ │ │ ├── UsefulDefs.h
│ │ │ └── genkinds.pl
│ │ ├── STPManager/
│ │ │ ├── DifficultyScore.h
│ │ │ ├── Makefile
│ │ │ ├── NodeIterator.h
│ │ │ ├── STP.cpp
│ │ │ ├── STP.h
│ │ │ ├── STPManager.cpp
│ │ │ ├── STPManager.h
│ │ │ └── UserDefinedFlags.h
│ │ ├── absrefine_counterexample/
│ │ │ ├── AbsRefine_CounterExample.h
│ │ │ ├── AbstractionRefinement.cpp
│ │ │ ├── CounterExample.cpp
│ │ │ └── Makefile
│ │ ├── boost/
│ │ │ ├── config/
│ │ │ │ ├── abi/
│ │ │ │ │ ├── borland_prefix.hpp
│ │ │ │ │ ├── borland_suffix.hpp
│ │ │ │ │ ├── msvc_prefix.hpp
│ │ │ │ │ └── msvc_suffix.hpp
│ │ │ │ ├── abi_prefix.hpp
│ │ │ │ ├── abi_suffix.hpp
│ │ │ │ ├── auto_link.hpp
│ │ │ │ ├── compiler/
│ │ │ │ │ ├── borland.hpp
│ │ │ │ │ ├── codegear.hpp
│ │ │ │ │ ├── comeau.hpp
│ │ │ │ │ ├── common_edg.hpp
│ │ │ │ │ ├── compaq_cxx.hpp
│ │ │ │ │ ├── digitalmars.hpp
│ │ │ │ │ ├── gcc.hpp
│ │ │ │ │ ├── gcc_xml.hpp
│ │ │ │ │ ├── greenhills.hpp
│ │ │ │ │ ├── hp_acc.hpp
│ │ │ │ │ ├── intel.hpp
│ │ │ │ │ ├── kai.hpp
│ │ │ │ │ ├── metrowerks.hpp
│ │ │ │ │ ├── mpw.hpp
│ │ │ │ │ ├── nvcc.hpp
│ │ │ │ │ ├── pgi.hpp
│ │ │ │ │ ├── sgi_mipspro.hpp
│ │ │ │ │ ├── sunpro_cc.hpp
│ │ │ │ │ ├── vacpp.hpp
│ │ │ │ │ └── visualc.hpp
│ │ │ │ ├── no_tr1/
│ │ │ │ │ ├── cmath.hpp
│ │ │ │ │ ├── complex.hpp
│ │ │ │ │ ├── functional.hpp
│ │ │ │ │ ├── memory.hpp
│ │ │ │ │ └── utility.hpp
│ │ │ │ ├── platform/
│ │ │ │ │ ├── aix.hpp
│ │ │ │ │ ├── amigaos.hpp
│ │ │ │ │ ├── beos.hpp
│ │ │ │ │ ├── bsd.hpp
│ │ │ │ │ ├── cygwin.hpp
│ │ │ │ │ ├── hpux.hpp
│ │ │ │ │ ├── irix.hpp
│ │ │ │ │ ├── linux.hpp
│ │ │ │ │ ├── macos.hpp
│ │ │ │ │ ├── qnxnto.hpp
│ │ │ │ │ ├── solaris.hpp
│ │ │ │ │ ├── symbian.hpp
│ │ │ │ │ ├── vxworks.hpp
│ │ │ │ │ └── win32.hpp
│ │ │ │ ├── posix_features.hpp
│ │ │ │ ├── requires_threads.hpp
│ │ │ │ ├── select_compiler_config.hpp
│ │ │ │ ├── select_platform_config.hpp
│ │ │ │ ├── select_stdlib_config.hpp
│ │ │ │ ├── stdlib/
│ │ │ │ │ ├── dinkumware.hpp
│ │ │ │ │ ├── libcomo.hpp
│ │ │ │ │ ├── libstdcpp3.hpp
│ │ │ │ │ ├── modena.hpp
│ │ │ │ │ ├── msl.hpp
│ │ │ │ │ ├── roguewave.hpp
│ │ │ │ │ ├── sgi.hpp
│ │ │ │ │ ├── stlport.hpp
│ │ │ │ │ └── vacpp.hpp
│ │ │ │ ├── suffix.hpp
│ │ │ │ ├── user.hpp
│ │ │ │ └── warning_disable.hpp
│ │ │ ├── config.hpp
│ │ │ ├── detail/
│ │ │ │ ├── algorithm.hpp
│ │ │ │ ├── allocator_utilities.hpp
│ │ │ │ ├── atomic_count.hpp
│ │ │ │ ├── binary_search.hpp
│ │ │ │ ├── call_traits.hpp
│ │ │ │ ├── catch_exceptions.hpp
│ │ │ │ ├── compressed_pair.hpp
│ │ │ │ ├── container_fwd.hpp
│ │ │ │ ├── dynamic_bitset.hpp
│ │ │ │ ├── endian.hpp
│ │ │ │ ├── has_default_constructor.hpp
│ │ │ │ ├── identifier.hpp
│ │ │ │ ├── indirect_traits.hpp
│ │ │ │ ├── interlocked.hpp
│ │ │ │ ├── is_function_ref_tester.hpp
│ │ │ │ ├── is_incrementable.hpp
│ │ │ │ ├── is_xxx.hpp
│ │ │ │ ├── iterator.hpp
│ │ │ │ ├── lcast_precision.hpp
│ │ │ │ ├── lightweight_mutex.hpp
│ │ │ │ ├── lightweight_test.hpp
│ │ │ │ ├── lightweight_thread.hpp
│ │ │ │ ├── limits.hpp
│ │ │ │ ├── named_template_params.hpp
│ │ │ │ ├── no_exceptions_support.hpp
│ │ │ │ ├── none_t.hpp
│ │ │ │ ├── numeric_traits.hpp
│ │ │ │ ├── ob_call_traits.hpp
│ │ │ │ ├── ob_compressed_pair.hpp
│ │ │ │ ├── quick_allocator.hpp
│ │ │ │ ├── reference_content.hpp
│ │ │ │ ├── scoped_enum_emulation.hpp
│ │ │ │ ├── select_type.hpp
│ │ │ │ ├── sp_typeinfo.hpp
│ │ │ │ ├── templated_streams.hpp
│ │ │ │ ├── utf8_codecvt_facet.hpp
│ │ │ │ └── workaround.hpp
│ │ │ ├── pool/
│ │ │ │ ├── detail/
│ │ │ │ │ ├── ct_gcd_lcm.hpp
│ │ │ │ │ ├── for.m4
│ │ │ │ │ ├── gcd_lcm.hpp
│ │ │ │ │ ├── guard.hpp
│ │ │ │ │ ├── mutex.hpp
│ │ │ │ │ ├── pool_construct.bat
│ │ │ │ │ ├── pool_construct.inc
│ │ │ │ │ ├── pool_construct.m4
│ │ │ │ │ ├── pool_construct.sh
│ │ │ │ │ ├── pool_construct_simple.bat
│ │ │ │ │ ├── pool_construct_simple.inc
│ │ │ │ │ ├── pool_construct_simple.m4
│ │ │ │ │ ├── pool_construct_simple.sh
│ │ │ │ │ └── singleton.hpp
│ │ │ │ ├── object_pool.hpp
│ │ │ │ ├── pool.hpp
│ │ │ │ ├── pool_alloc.hpp
│ │ │ │ ├── poolfwd.hpp
│ │ │ │ ├── simple_segregated_storage.hpp
│ │ │ │ └── singleton_pool.hpp
│ │ │ ├── static_assert.hpp
│ │ │ └── type_traits/
│ │ │ ├── add_const.hpp
│ │ │ ├── add_cv.hpp
│ │ │ ├── add_pointer.hpp
│ │ │ ├── add_reference.hpp
│ │ │ ├── add_volatile.hpp
│ │ │ ├── aligned_storage.hpp
│ │ │ ├── alignment_of.hpp
│ │ │ ├── alignment_traits.hpp
│ │ │ ├── arithmetic_traits.hpp
│ │ │ ├── array_traits.hpp
│ │ │ ├── broken_compiler_spec.hpp
│ │ │ ├── composite_traits.hpp
│ │ │ ├── config.hpp
│ │ │ ├── conversion_traits.hpp
│ │ │ ├── cv_traits.hpp
│ │ │ ├── decay.hpp
│ │ │ ├── detail/
│ │ │ │ ├── bool_trait_def.hpp
│ │ │ │ ├── bool_trait_undef.hpp
│ │ │ │ ├── cv_traits_impl.hpp
│ │ │ │ ├── false_result.hpp
│ │ │ │ ├── ice_and.hpp
│ │ │ │ ├── ice_eq.hpp
│ │ │ │ ├── ice_not.hpp
│ │ │ │ ├── ice_or.hpp
│ │ │ │ ├── is_function_ptr_helper.hpp
│ │ │ │ ├── is_function_ptr_tester.hpp
│ │ │ │ ├── is_mem_fun_pointer_impl.hpp
│ │ │ │ ├── is_mem_fun_pointer_tester.hpp
│ │ │ │ ├── size_t_trait_def.hpp
│ │ │ │ ├── size_t_trait_undef.hpp
│ │ │ │ ├── template_arity_spec.hpp
│ │ │ │ ├── type_trait_def.hpp
│ │ │ │ ├── type_trait_undef.hpp
│ │ │ │ ├── wrap.hpp
│ │ │ │ └── yes_no_type.hpp
│ │ │ ├── extent.hpp
│ │ │ ├── floating_point_promotion.hpp
│ │ │ ├── function_traits.hpp
│ │ │ ├── has_new_operator.hpp
│ │ │ ├── has_nothrow_assign.hpp
│ │ │ ├── has_nothrow_constructor.hpp
│ │ │ ├── has_nothrow_copy.hpp
│ │ │ ├── has_nothrow_destructor.hpp
│ │ │ ├── has_trivial_assign.hpp
│ │ │ ├── has_trivial_constructor.hpp
│ │ │ ├── has_trivial_copy.hpp
│ │ │ ├── has_trivial_destructor.hpp
│ │ │ ├── has_virtual_destructor.hpp
│ │ │ ├── ice.hpp
│ │ │ ├── integral_constant.hpp
│ │ │ ├── integral_promotion.hpp
│ │ │ ├── intrinsics.hpp
│ │ │ ├── is_abstract.hpp
│ │ │ ├── is_arithmetic.hpp
│ │ │ ├── is_array.hpp
│ │ │ ├── is_base_and_derived.hpp
│ │ │ ├── is_base_of.hpp
│ │ │ ├── is_base_of_tr1.hpp
│ │ │ ├── is_class.hpp
│ │ │ ├── is_complex.hpp
│ │ │ ├── is_compound.hpp
│ │ │ ├── is_const.hpp
│ │ │ ├── is_convertible.hpp
│ │ │ ├── is_empty.hpp
│ │ │ ├── is_enum.hpp
│ │ │ ├── is_float.hpp
│ │ │ ├── is_floating_point.hpp
│ │ │ ├── is_function.hpp
│ │ │ ├── is_fundamental.hpp
│ │ │ ├── is_integral.hpp
│ │ │ ├── is_member_function_pointer.hpp
│ │ │ ├── is_member_object_pointer.hpp
│ │ │ ├── is_member_pointer.hpp
│ │ │ ├── is_object.hpp
│ │ │ ├── is_pod.hpp
│ │ │ ├── is_pointer.hpp
│ │ │ ├── is_polymorphic.hpp
│ │ │ ├── is_reference.hpp
│ │ │ ├── is_same.hpp
│ │ │ ├── is_scalar.hpp
│ │ │ ├── is_signed.hpp
│ │ │ ├── is_stateless.hpp
│ │ │ ├── is_union.hpp
│ │ │ ├── is_unsigned.hpp
│ │ │ ├── is_virtual_base_of.hpp
│ │ │ ├── is_void.hpp
│ │ │ ├── is_volatile.hpp
│ │ │ ├── make_signed.hpp
│ │ │ ├── make_unsigned.hpp
│ │ │ ├── msvc/
│ │ │ │ ├── remove_all_extents.hpp
│ │ │ │ ├── remove_bounds.hpp
│ │ │ │ ├── remove_const.hpp
│ │ │ │ ├── remove_cv.hpp
│ │ │ │ ├── remove_extent.hpp
│ │ │ │ ├── remove_pointer.hpp
│ │ │ │ ├── remove_reference.hpp
│ │ │ │ ├── remove_volatile.hpp
│ │ │ │ └── typeof.hpp
│ │ │ ├── object_traits.hpp
│ │ │ ├── promote.hpp
│ │ │ ├── rank.hpp
│ │ │ ├── reference_traits.hpp
│ │ │ ├── remove_all_extents.hpp
│ │ │ ├── remove_bounds.hpp
│ │ │ ├── remove_const.hpp
│ │ │ ├── remove_cv.hpp
│ │ │ ├── remove_extent.hpp
│ │ │ ├── remove_pointer.hpp
│ │ │ ├── remove_reference.hpp
│ │ │ ├── remove_volatile.hpp
│ │ │ ├── same_traits.hpp
│ │ │ ├── transform_traits.hpp
│ │ │ ├── transform_traits_spec.hpp
│ │ │ └── type_with_alignment.hpp
│ │ ├── c_interface/
│ │ │ ├── Makefile
│ │ │ ├── c_interface.cpp
│ │ │ ├── c_interface.h
│ │ │ └── fdstream.h
│ │ ├── extlib-abc/
│ │ │ ├── Makefile
│ │ │ ├── aig/
│ │ │ │ ├── aig/
│ │ │ │ │ ├── aigCheck.c
│ │ │ │ │ ├── aigDfs.c
│ │ │ │ │ ├── aigFanout.c
│ │ │ │ │ ├── aigMan.c
│ │ │ │ │ ├── aigMem.c
│ │ │ │ │ ├── aigMffc.c
│ │ │ │ │ ├── aigObj.c
│ │ │ │ │ ├── aigOper.c
│ │ │ │ │ ├── aigOrder.c
│ │ │ │ │ ├── aigPart.c
│ │ │ │ │ ├── aigRepr.c
│ │ │ │ │ ├── aigRet.c
│ │ │ │ │ ├── aigScl.c
│ │ │ │ │ ├── aigSeq.c
│ │ │ │ │ ├── aigShow.c
│ │ │ │ │ ├── aigTable.c
│ │ │ │ │ ├── aigTime.c
│ │ │ │ │ ├── aigTiming.c
│ │ │ │ │ ├── aigTruth.c
│ │ │ │ │ ├── aigTsim.c
│ │ │ │ │ ├── aigUtil.c
│ │ │ │ │ └── aigWin.c
│ │ │ │ ├── cnf/
│ │ │ │ │ ├── Makefile
│ │ │ │ │ ├── cnfCore.c
│ │ │ │ │ ├── cnfCut.c
│ │ │ │ │ ├── cnfData.c
│ │ │ │ │ ├── cnfMan.c
│ │ │ │ │ ├── cnfMap.c
│ │ │ │ │ ├── cnfPost.c
│ │ │ │ │ ├── cnfUtil.c
│ │ │ │ │ └── cnfWrite.c
│ │ │ │ ├── dar/
│ │ │ │ │ ├── darBalance.c
│ │ │ │ │ ├── darCore.c
│ │ │ │ │ ├── darCut.c
│ │ │ │ │ ├── darData.c
│ │ │ │ │ ├── darLib.c
│ │ │ │ │ ├── darMan.c
│ │ │ │ │ ├── darPrec.c
│ │ │ │ │ ├── darRefact.c
│ │ │ │ │ └── darScript.c
│ │ │ │ └── kit/
│ │ │ │ ├── kitAig.c
│ │ │ │ ├── kitGraph.c
│ │ │ │ ├── kitIsop.c
│ │ │ │ ├── kitSop.c
│ │ │ │ └── kitTruth.c
│ │ │ ├── aig.h
│ │ │ ├── cnf.h
│ │ │ ├── cnf_short.h
│ │ │ ├── copyright.txt
│ │ │ ├── dar.h
│ │ │ ├── darInt.h
│ │ │ ├── kit.h
│ │ │ ├── leaks.h
│ │ │ ├── vec.h
│ │ │ ├── vecFlt.h
│ │ │ ├── vecInt.h
│ │ │ ├── vecPtr.h
│ │ │ ├── vecStr.h
│ │ │ └── vecVec.h
│ │ ├── extlib-constbv/
│ │ │ ├── Makefile
│ │ │ ├── constantbv.cpp
│ │ │ └── constantbv.h
│ │ ├── main/
│ │ │ ├── Globals.cpp
│ │ │ ├── Globals.h
│ │ │ ├── Makefile
│ │ │ └── main.cpp
│ │ ├── ocaml-wrapper/
│ │ │ ├── COPYRIGHT-NOTICE
│ │ │ ├── Makefile
│ │ │ ├── OCamlMakefile
│ │ │ ├── libstp.idl
│ │ │ ├── libstp_regerrorhandler.c
│ │ │ ├── stpvc.ml
│ │ │ └── stpvc.mli
│ │ ├── parser/
│ │ │ ├── LetMgr.cpp
│ │ │ ├── LetMgr.h
│ │ │ ├── Makefile
│ │ │ ├── ParserInterface.h
│ │ │ ├── cvc.lex
│ │ │ ├── cvc.y
│ │ │ ├── parser.h
│ │ │ ├── smt.lex
│ │ │ ├── smt.y
│ │ │ ├── smt2.lex
│ │ │ └── smt2.y
│ │ ├── printer/
│ │ │ ├── AssortedPrinters.cpp
│ │ │ ├── AssortedPrinters.h
│ │ │ ├── BenchPrinter.cpp
│ │ │ ├── CPrinter.cpp
│ │ │ ├── GDLPrinter.cpp
│ │ │ ├── LispPrinter.cpp
│ │ │ ├── Makefile
│ │ │ ├── PLPrinter.cpp
│ │ │ ├── SMTLIB1Printer.cpp
│ │ │ ├── SMTLIB2Printer.cpp
│ │ │ ├── SMTLIBPrinter.cpp
│ │ │ ├── SMTLIBPrinter.h
│ │ │ ├── dotPrinter.cpp
│ │ │ └── printers.h
│ │ ├── sat/
│ │ │ ├── CryptoMinisat.cpp
│ │ │ ├── CryptoMinisat.h
│ │ │ ├── LICENSE
│ │ │ ├── Makefile
│ │ │ ├── MinisatCore.cpp
│ │ │ ├── MinisatCore.h
│ │ │ ├── MinisatCore_prop.cpp
│ │ │ ├── MinisatCore_prop.h
│ │ │ ├── README
│ │ │ ├── SATSolver.h
│ │ │ ├── SimplifyingMinisat.cpp
│ │ │ ├── SimplifyingMinisat.h
│ │ │ ├── core/
│ │ │ │ ├── Dimacs.h
│ │ │ │ ├── Main.cc
│ │ │ │ ├── Makefile
│ │ │ │ ├── Solver.cc
│ │ │ │ ├── Solver.h
│ │ │ │ └── SolverTypes.h
│ │ │ ├── core_prop/
│ │ │ │ ├── Makefile
│ │ │ │ ├── Solver_prop.cc
│ │ │ │ └── Solver_prop.h
│ │ │ ├── cryptominisat2/
│ │ │ │ ├── BitArray.h
│ │ │ │ ├── BoundedQueue.h
│ │ │ │ ├── CMakeLists.txt
│ │ │ │ ├── CSet.h
│ │ │ │ ├── Clause.h
│ │ │ │ ├── ClauseAllocator.cpp
│ │ │ │ ├── ClauseAllocator.h
│ │ │ │ ├── ClauseCleaner.cpp
│ │ │ │ ├── ClauseCleaner.h
│ │ │ │ ├── DoublePackedRow.h
│ │ │ │ ├── FailedVarSearcher.cpp
│ │ │ │ ├── FailedVarSearcher.h
│ │ │ │ ├── FindUndef.cpp
│ │ │ │ ├── FindUndef.h
│ │ │ │ ├── Gaussian.cpp
│ │ │ │ ├── Gaussian.h
│ │ │ │ ├── GaussianConfig.h
│ │ │ │ ├── Logger.cpp
│ │ │ │ ├── Logger.h
│ │ │ │ ├── MTRand/
│ │ │ │ │ └── MersenneTwister.h
│ │ │ │ ├── Main.cpp
│ │ │ │ ├── Makefile
│ │ │ │ ├── MatrixFinder.cpp
│ │ │ │ ├── MatrixFinder.h
│ │ │ │ ├── MersenneTwister.h
│ │ │ │ ├── OnlyNonLearntBins.cpp
│ │ │ │ ├── OnlyNonLearntBins.h
│ │ │ │ ├── PackedMatrix.h
│ │ │ │ ├── PackedRow.cpp
│ │ │ │ ├── PackedRow.h
│ │ │ │ ├── PartFinder.cpp
│ │ │ │ ├── PartFinder.h
│ │ │ │ ├── PartHandler.cpp
│ │ │ │ ├── PartHandler.h
│ │ │ │ ├── RestartTypeChooser.cpp
│ │ │ │ ├── RestartTypeChooser.h
│ │ │ │ ├── Solver.cpp
│ │ │ │ ├── Solver.h
│ │ │ │ ├── SolverTypes.h
│ │ │ │ ├── StateSaver.cpp
│ │ │ │ ├── StateSaver.h
│ │ │ │ ├── Subsumer.cpp
│ │ │ │ ├── Subsumer.h
│ │ │ │ ├── UselessBinRemover.cpp
│ │ │ │ ├── UselessBinRemover.h
│ │ │ │ ├── VERSION
│ │ │ │ ├── VarReplacer.cpp
│ │ │ │ ├── VarReplacer.h
│ │ │ │ ├── XSet.h
│ │ │ │ ├── XorFinder.cpp
│ │ │ │ ├── XorFinder.h
│ │ │ │ ├── XorSubsumer.cpp
│ │ │ │ ├── XorSubsumer.h
│ │ │ │ ├── constants.h
│ │ │ │ ├── msvc/
│ │ │ │ │ └── stdint.h
│ │ │ │ ├── mtl/
│ │ │ │ │ ├── Alg.h
│ │ │ │ │ ├── BasicHeap.h
│ │ │ │ │ ├── BoxedVec.h
│ │ │ │ │ ├── Heap.h
│ │ │ │ │ ├── Map.h
│ │ │ │ │ ├── Queue.h
│ │ │ │ │ └── Vec.h
│ │ │ │ └── time_mem.h
│ │ │ ├── doc/
│ │ │ │ └── ReleaseNotes-2.2.0.txt
│ │ │ ├── mtl/
│ │ │ │ ├── Alg.h
│ │ │ │ ├── Alloc.h
│ │ │ │ ├── BasicHeap.h
│ │ │ │ ├── BoxedVec.h
│ │ │ │ ├── Heap.h
│ │ │ │ ├── IntTypesMtl.h
│ │ │ │ ├── Map.h
│ │ │ │ ├── Queue.h
│ │ │ │ ├── Sort.h
│ │ │ │ ├── Vec.h
│ │ │ │ ├── XAlloc.h
│ │ │ │ └── template.mk
│ │ │ ├── simp/
│ │ │ │ ├── Main.cc
│ │ │ │ ├── Makefile
│ │ │ │ ├── SimpSolver.cc
│ │ │ │ └── SimpSolver.h
│ │ │ └── utils/
│ │ │ ├── Makefile
│ │ │ ├── Options.cc
│ │ │ ├── Options.h
│ │ │ ├── ParseUtils.h
│ │ │ ├── System.cc
│ │ │ └── System.h
│ │ ├── simplifier/
│ │ │ ├── AIGSimplifyPropositionalCore.h
│ │ │ ├── AlwaysTrue.h
│ │ │ ├── EstablishIntervals.h
│ │ │ ├── FindPureLiterals.h
│ │ │ ├── Makefile
│ │ │ ├── MutableASTNode.cpp
│ │ │ ├── MutableASTNode.h
│ │ │ ├── PropagateEqualities.cpp
│ │ │ ├── PropagateEqualities.h
│ │ │ ├── RemoveUnconstrained.cpp
│ │ │ ├── RemoveUnconstrained.h
│ │ │ ├── SubstitutionMap.cpp
│ │ │ ├── SubstitutionMap.h
│ │ │ ├── Symbols.h
│ │ │ ├── UseITEContext.h
│ │ │ ├── VariablesInExpression.cpp
│ │ │ ├── VariablesInExpression.h
│ │ │ ├── bvsolver.cpp
│ │ │ ├── bvsolver.h
│ │ │ ├── constantBitP/
│ │ │ │ ├── ConstantBitP_Arithmetic.cpp
│ │ │ │ ├── ConstantBitP_Boolean.cpp
│ │ │ │ ├── ConstantBitP_Comparison.cpp
│ │ │ │ ├── ConstantBitP_Division.cpp
│ │ │ │ ├── ConstantBitP_Multiplication.cpp
│ │ │ │ ├── ConstantBitP_Shifting.cpp
│ │ │ │ ├── ConstantBitP_TransferFunctions.cpp
│ │ │ │ ├── ConstantBitP_TransferFunctions.h
│ │ │ │ ├── ConstantBitP_Utility.cpp
│ │ │ │ ├── ConstantBitP_Utility.h
│ │ │ │ ├── ConstantBitPropagation.cpp
│ │ │ │ ├── ConstantBitPropagation.h
│ │ │ │ ├── Dependencies.h
│ │ │ │ ├── FixedBits.cpp
│ │ │ │ ├── FixedBits.h
│ │ │ │ ├── MultiplicationStats.h
│ │ │ │ ├── NodeToFixedBitsMap.h
│ │ │ │ ├── WorkList.h
│ │ │ │ └── multiplication/
│ │ │ │ ├── ColumnCounts.h
│ │ │ │ ├── ColumnStats.h
│ │ │ │ ├── Edge.h
│ │ │ │ └── ImplicationGraph.h
│ │ │ ├── consteval.cpp
│ │ │ ├── simplifier.cpp
│ │ │ └── simplifier.h
│ │ ├── to-sat/
│ │ │ ├── AIG/
│ │ │ │ ├── BBNodeAIG.h
│ │ │ │ ├── BBNodeManagerAIG.cpp
│ │ │ │ ├── BBNodeManagerAIG.h
│ │ │ │ ├── ToCNFAIG.cpp
│ │ │ │ ├── ToCNFAIG.h
│ │ │ │ ├── ToSATAIG.cpp
│ │ │ │ └── ToSATAIG.h
│ │ │ ├── ASTNode/
│ │ │ │ ├── BBNodeManagerASTNode.h
│ │ │ │ ├── ClauseList.cpp
│ │ │ │ ├── ClauseList.h
│ │ │ │ ├── SimpBool.cpp
│ │ │ │ ├── ToCNF.cpp
│ │ │ │ ├── ToCNF.h
│ │ │ │ ├── ToSAT.cpp
│ │ │ │ └── ToSAT.h
│ │ │ ├── BitBlaster.cpp
│ │ │ ├── BitBlaster.h
│ │ │ ├── Makefile
│ │ │ ├── ToSATBase.cpp
│ │ │ └── ToSATBase.h
│ │ └── util/
│ │ ├── Makefile
│ │ └── rewrite.cpp
│ ├── tests/
│ │ ├── big-test/
│ │ │ ├── dsa_chop_allopt.stp.cvc_old
│ │ │ ├── dsa_chop_allopt.stp.smt2
│ │ │ ├── dsa_chop_dc.stp.cvc_old
│ │ │ ├── dsa_chop_dc.stp.smt2
│ │ │ ├── dsa_chop_noopt-nossa.stp.cvc_old
│ │ │ ├── dsa_chop_noopt-nossa.stp.smt2
│ │ │ ├── dsa_chop_noopt-ssa.stp.cvc_old
│ │ │ └── dsa_chop_noopt-ssa.stp.smt2
│ │ ├── bio-tests/
│ │ │ ├── 4-alpha-helices-2-rungs-more-bits-simplified.cvc
│ │ │ ├── 4-alpha-helices-2-rungs.cvc
│ │ │ ├── 4-alpha-helices-3-rungs-macros.cvc
│ │ │ ├── 4-alpha-helices-3-rungs.cvc
│ │ │ └── rna2.cvc
│ │ ├── c-api-tests/
│ │ │ ├── Makefile
│ │ │ ├── array-cvcl-02.c
│ │ │ ├── b4-c.c
│ │ │ ├── b4-c2.c
│ │ │ ├── biosat-rna.cpp
│ │ │ ├── cvc-to-c.cpp
│ │ │ ├── f.cvc
│ │ │ ├── getbvunsignedlonglong-check.c
│ │ │ ├── if-check.c
│ │ │ ├── interface-check.c
│ │ │ ├── leak.c
│ │ │ ├── multiple-queries.c
│ │ │ ├── parsefile-using-cinterface.c
│ │ │ ├── parsestring-using-cinterface.c
│ │ │ ├── print.c
│ │ │ ├── push-no-pop.c
│ │ │ ├── push-pop-1.c
│ │ │ ├── push-pop.c
│ │ │ ├── sbvdiv.c
│ │ │ ├── simplify.c
│ │ │ ├── simplify1.c
│ │ │ ├── squares-leak.c
│ │ │ ├── stp-array-model.c
│ │ │ ├── stp-bool.c
│ │ │ ├── stp-counterex.c
│ │ │ ├── stp-div-001.c
│ │ │ ├── stp-test3.c
│ │ │ ├── stpcheck.c
│ │ │ ├── t.cvc
│ │ │ ├── userguided-absrefine.c
│ │ │ ├── x.c
│ │ │ └── y.c
│ │ ├── crypto-tests/
│ │ │ ├── 1024_bit_prime_1s_only.stp
│ │ │ ├── rsa_1024_bit_prime_1s_only.stp
│ │ │ ├── rsa_97_bit_prime.stp
│ │ │ ├── rsa_97_bit_prime_1s_only.stp
│ │ │ ├── t3.stp
│ │ │ ├── t3_flat.stp
│ │ │ ├── t4.stp
│ │ │ ├── t4_flat.stp
│ │ │ ├── t4_nadia.stp
│ │ │ ├── t4_nadia_n1.stp
│ │ │ ├── t5.stp
│ │ │ ├── tea.pl
│ │ │ ├── tea_four_round_one_var.stp
│ │ │ ├── tea_four_round_one_var_half_key.stp
│ │ │ ├── tea_four_round_two_var_half_key.stp
│ │ │ ├── tea_four_round_two_var_tea.stp
│ │ │ ├── tea_three_round_one_var.stp
│ │ │ ├── tea_three_round_two_var.stp
│ │ │ ├── tea_three_round_two_var_half_key.stp
│ │ │ └── tea_two_round_two_var.stp
│ │ ├── generated_tests/
│ │ │ ├── ArrayGenerator.java
│ │ │ ├── Makefile
│ │ │ ├── extract.pl
│ │ │ ├── form_128.var_32.bits_32.cvc
│ │ │ ├── form_16.var_32.bits_32.cvc
│ │ │ ├── form_256.var_32.bits_32.cvc
│ │ │ ├── form_32.var_128.bits_32.cvc
│ │ │ ├── form_32.var_16.bits_32.cvc
│ │ │ ├── form_32.var_256.bits_32.cvc
│ │ │ ├── form_32.var_32.bits_32.cvc
│ │ │ ├── form_32.var_4.bits_32.cvc
│ │ │ ├── form_32.var_64.bits_32.cvc
│ │ │ ├── form_32.var_8.bits_32.cvc
│ │ │ ├── form_4.var_32.bits_32.cvc
│ │ │ ├── form_64.var_32.bits_32.cvc
│ │ │ ├── form_8.var_32.bits_32.cvc
│ │ │ ├── g.cvc
│ │ │ ├── gen2.cvc
│ │ │ ├── mulDivRem.cpp
│ │ │ ├── random-tests/
│ │ │ │ ├── OptGen.java
│ │ │ │ └── tree.cpp
│ │ │ ├── run-experiments.pl
│ │ │ ├── runMulDivRem.sh
│ │ │ └── testgen.pl
│ │ ├── misc-tests/
│ │ │ ├── cryptominisat-bug.cvc
│ │ │ └── no-query.cvc
│ │ ├── sample-smt-tests/
│ │ │ ├── 610dd9dc.T.stp.smt_71.smt
│ │ │ ├── convert-tiff2jpg-query-1831.smt_68.smt
│ │ │ ├── working_54.smt
│ │ │ └── working_55.smt
│ │ └── sample-tests/
│ │ ├── a100test0001.cvc
│ │ ├── a101test0002.cvc
│ │ ├── a103test0001.cvc
│ │ ├── a105test0001.cvc
│ │ ├── a107test0001.cvc
│ │ ├── a114test0001.cvc
│ │ ├── a115test0002.cvc
│ │ ├── a116test0003.cvc
│ │ ├── a121test0001.cvc
│ │ ├── a122test0002.cvc
│ │ ├── a123test0003.cvc
│ │ ├── a124test0004.cvc
│ │ ├── a126test0001.cvc
│ │ ├── a127test0009.cvc
│ │ ├── a128test0016.cvc
│ │ ├── a12test0001.cvc
│ │ ├── a13test0002.cvc
│ │ ├── a15test0001.cvc
│ │ ├── a163test0021.cvc
│ │ ├── a164test0005.cvc
│ │ ├── a165test0010.cvc
│ │ ├── a166test0014.cvc
│ │ ├── a167test0001.cvc
│ │ ├── a168test0018.cvc
│ │ ├── a169test0012.cvc
│ │ ├── a170test0017.cvc
│ │ ├── a171test0019.cvc
│ │ ├── a172test0002.cvc
│ │ ├── a173test0011.cvc
│ │ ├── a174test0003.cvc
│ │ ├── a175test0013.cvc
│ │ ├── a176test0022.cvc
│ │ ├── a177test0006.cvc
│ │ ├── a178test0007.cvc
│ │ ├── a179test0008.cvc
│ │ ├── a180test0004.cvc
│ │ ├── a181test0020.cvc
│ │ ├── a182test0015.cvc
│ │ ├── a185test0001.cvc
│ │ ├── a186test0002.cvc
│ │ ├── a187test0009.cvc
│ │ ├── a188test0016.cvc
│ │ ├── egt-1899.cvc
│ │ ├── long-by-hand.cvc
│ │ ├── variable-rightshift-invalid.cvc
│ │ └── variable-rightshift-valid.cvc
│ ├── unit_test/
│ │ ├── alwaysTrue.smt2
│ │ ├── bvand.smt2
│ │ ├── bvand2.smt2
│ │ ├── bvand3.smt2
│ │ ├── bvconcat.smt2
│ │ ├── bvconcat2.smt2
│ │ ├── bvconcat3.smt2
│ │ ├── bvge1.smt2
│ │ ├── bvge3.smt2
│ │ ├── bvmul_minus.smt2
│ │ ├── bvnor.smt2
│ │ ├── bvnot.smt2
│ │ ├── bvor.smt2
│ │ ├── bvsge.smt2
│ │ ├── bvsgt.smt2
│ │ ├── bvsgt2.smt2
│ │ ├── bvshift.smt2
│ │ ├── bvsolver.smt
│ │ ├── bvxor.smt2
│ │ ├── eq.smt2
│ │ ├── eq2.smt2
│ │ ├── eqConcat.smt2
│ │ ├── harald.smt2
│ │ ├── mod.smt2
│ │ ├── mod2.smt2
│ │ ├── mult.smt2
│ │ ├── orAlwaysTrue.smt2
│ │ ├── pure.smt2
│ │ ├── pure2.smt2
│ │ ├── sim.smt2
│ │ ├── unc_shift.smt
│ │ ├── uncon_then_pure.smt
│ │ ├── unit_test.sh
│ │ ├── writing_same.smt2
│ │ ├── xor.smt2
│ │ ├── xor2.smt2
│ │ ├── xor3.smt2
│ │ └── xor4.smt2
│ └── windows/
│ ├── README
│ ├── cmakemods/
│ │ ├── msvcmt.cmake
│ │ ├── slibgcc.cmake
│ │ └── staticrt.cmake
│ ├── r446-winport.patch
│ └── winports/
│ ├── compdep.h
│ ├── msc99hdr/
│ │ ├── inttypes.h
│ │ ├── stdbool.h
│ │ ├── stdint.h
│ │ └── unistd.h
│ └── sys/
│ └── time.h
└── tools/
├── Makefile
├── Makefile.common
├── Makefile.config.in
├── autoconf/
│ ├── AutoRegen.sh
│ ├── aclocal.m4
│ ├── config.guess
│ ├── config.sub
│ ├── configure.ac
│ └── install-sh
├── configure
├── include/
│ └── s2etools/
│ └── config.h.in
├── lib/
│ ├── BinaryReaders/
│ │ ├── BFDInterface.cpp
│ │ ├── BFDInterface.h
│ │ ├── Binary.cpp
│ │ ├── Binary.h
│ │ ├── ExecutableFile.cpp
│ │ ├── ExecutableFile.h
│ │ ├── Library.cpp
│ │ ├── Library.h
│ │ ├── Macho.cpp
│ │ ├── Macho.h
│ │ ├── Makefile
│ │ ├── Pe.cpp
│ │ ├── Pe.h
│ │ ├── TextModule.cpp
│ │ └── TextModule.h
│ ├── ExecutionTracer/
│ │ ├── CacheProfiler.cpp
│ │ ├── CacheProfiler.h
│ │ ├── InstructionCounter.cpp
│ │ ├── InstructionCounter.h
│ │ ├── LogParser.cpp
│ │ ├── LogParser.h
│ │ ├── Makefile
│ │ ├── ModuleParser.cpp
│ │ ├── ModuleParser.h
│ │ ├── PageFault.cpp
│ │ ├── PageFault.h
│ │ ├── Path.h
│ │ ├── PathBuilder.cpp
│ │ ├── TestCase.cpp
│ │ └── TestCase.h
│ ├── Makefile
│ └── Utils/
│ ├── BasicBlockListParser.cpp
│ ├── BasicBlockListParser.h
│ ├── Makefile
│ ├── Signals/
│ │ ├── Signals.h
│ │ ├── fsigc++.h
│ │ ├── functors.h
│ │ └── sig-template.h
│ └── signals.cpp
└── tools/
├── Makefile
├── cacheprof/
│ ├── Makefile
│ └── cacheprof.cpp
├── coverage/
│ ├── Coverage.cpp
│ ├── Coverage.h
│ └── Makefile
├── debugger/
│ ├── Debugger.cpp
│ ├── Debugger.h
│ └── Makefile
├── forkprofiler/
│ ├── Makefile
│ ├── forkprofiler.cpp
│ └── forkprofiler.h
├── icounter/
│ ├── Makefile
│ ├── icounter.cpp
│ └── icounter.h
├── pfprofiler/
│ ├── CacheProfiler.cpp
│ ├── CacheProfiler.h
│ ├── Makefile
│ ├── pfprofiler.cpp
│ └── pfprofiler.h
├── s2etools-config/
│ ├── FinalLibDeps.txt
│ ├── Makefile
│ └── s2etools-config.in.in
├── scripts/
│ ├── gdb.ini
│ └── ida/
│ ├── extractBasicBlocks.py
│ └── extractFunctions.py
└── tbtrace/
├── Makefile
├── TbTrace.cpp
└── TbTrace.h
Showing preview only (2,829K chars total). Download the full file or copy to clipboard to get everything.
SYMBOL INDEX (31283 symbols across 2221 files)
FILE: docs/sample/factorial.c
function factorial1 (line 54) | uint64_t factorial1(uint64_t x, uint64_t max) {
function factorial2 (line 66) | uint64_t factorial2(uint64_t x, uint64_t max) {
function main (line 78) | int main() {
FILE: guest/demos/quicksort.c
function swap (line 9) | static void swap(int *a, int *b)
function sort (line 14) | static void sort(int arr[], int beg, int end)
function main (line 32) | int main(void)
FILE: guest/include/s2e-arm.h
function s2e_version (line 48) | static inline int s2e_version()
function s2e_enable_symbolic (line 63) | static inline void s2e_enable_symbolic(void)
function s2e_disable_symbolic (line 72) | static inline void s2e_disable_symbolic(void)
function s2e_enable_forking (line 81) | static inline void s2e_enable_forking(void)
function s2e_disable_forking (line 90) | static inline void s2e_disable_forking(void)
function s2e_message (line 99) | static inline void s2e_message(const char* message)
function s2e_warning (line 111) | static inline void s2e_warning(const char* message)
function s2e_print_expression (line 125) | static inline void s2e_print_expression(const char* name, int expression)
function s2e_get_path_id (line 142) | static inline unsigned s2e_get_path_id(void)
function s2e_make_symbolic (line 156) | static inline void s2e_make_symbolic(void* buf, int size, const char* name)
function s2e_make_concolic (line 174) | static inline void s2e_make_concolic(void *buf, int size, const char *name)
function s2e_concretize (line 193) | static inline void s2e_concretize(void* buf, int size)
function s2e_get_example (line 210) | static inline void s2e_get_example(void* buf, int size)
function s2e_get_example_uint (line 228) | static inline unsigned s2e_get_example_uint(unsigned val)
function s2e_get_ram_object_bits (line 246) | static inline int s2e_get_ram_object_bits()
function s2e_kill_state (line 264) | static inline void s2e_kill_state(int status, const char* message)
function s2e_merge_point (line 284) | static inline void s2e_merge_point()
function s2e_rawmon_loadmodule (line 295) | static inline void s2e_rawmon_loadmodule(const char *name, unsigned load...
function s2e_rawmon_loadmodule2 (line 315) | static inline void s2e_rawmon_loadmodule2(const char *name,
function s2e_is_symbolic (line 345) | static inline int s2e_is_symbolic(void *ptr, size_t size)
function s2e_open (line 367) | static inline int s2e_open(const char *fname)
function s2e_close (line 390) | static inline int s2e_close(int fd)
function s2e_read (line 411) | static inline int s2e_read(int fd, char *buf, int count)
function s2e_codeselector_enable_address_space (line 434) | static inline void s2e_codeselector_enable_address_space(unsigned user_m...
function s2e_codeselector_disable_address_space (line 450) | static inline void s2e_codeselector_disable_address_space(uint64_t pagedir)
function s2e_codeselector_select_module (line 464) | static inline void s2e_codeselector_select_module(const char *moduleId)
function s2e_moduleexec_add_module (line 480) | static inline void s2e_moduleexec_add_module(const char *moduleId, const...
FILE: guest/include/s2e-x86.h
function s2e_version (line 47) | static inline int s2e_version(void)
function s2e_enable_symbolic (line 58) | static inline void s2e_enable_symbolic(void)
function s2e_disable_symbolic (line 66) | static inline void s2e_disable_symbolic(void)
function s2e_message (line 74) | static inline void s2e_message(const char *message)
function s2e_warning (line 84) | static inline void s2e_warning(const char *message)
function s2e_print_expression (line 94) | static inline void s2e_print_expression(const char *name, int expression)
function s2e_enable_forking (line 104) | static inline void s2e_enable_forking(void)
function s2e_disable_forking (line 112) | static inline void s2e_disable_forking(void)
function s2e_yield (line 120) | static inline void s2e_yield(void)
function s2e_get_path_id (line 128) | static inline unsigned s2e_get_path_id(void)
function s2e_make_symbolic (line 139) | static inline void s2e_make_symbolic(void *buf, int size, const char *name)
function s2e_make_concolic (line 162) | static inline void s2e_make_concolic(void *buf, int size, const char *name)
function s2e_assume (line 186) | static inline void s2e_assume(int expression)
function s2e_is_symbolic (line 196) | static inline int s2e_is_symbolic(void *ptr, size_t size)
function s2e_concretize (line 208) | static inline void s2e_concretize(void *buf, int size)
function s2e_get_example (line 230) | static inline void s2e_get_example(void *buf, int size)
function s2e_get_example_uint (line 253) | static inline unsigned s2e_get_example_uint(unsigned val)
function s2e_kill_state (line 276) | static inline void s2e_kill_state(int status, const char *message)
function s2e_disable_timer_interrupt (line 298) | static inline void s2e_disable_timer_interrupt(void)
function s2e_enable_timer_interrupt (line 306) | static inline void s2e_enable_timer_interrupt(void)
function s2e_disable_all_apic_interrupts (line 314) | static inline void s2e_disable_all_apic_interrupts(void)
function s2e_enable_all_apic_interrupts (line 322) | static inline void s2e_enable_all_apic_interrupts(void)
function s2e_get_ram_object_bits (line 330) | static inline int s2e_get_ram_object_bits(void)
function s2e_merge_point (line 344) | static inline void s2e_merge_point(void)
function s2e_open (line 354) | static inline int s2e_open(const char *fname)
function s2e_close (line 368) | static inline int s2e_close(int fd)
function s2e_read (line 381) | static inline int s2e_read(int fd, char *buf, int count)
function s2e_memtracer_enable (line 405) | static inline void s2e_memtracer_enable(void)
function s2e_memtracer_disable (line 413) | static inline void s2e_memtracer_disable(void)
function s2e_rawmon_loadmodule (line 423) | static inline void s2e_rawmon_loadmodule(const char *name, unsigned load...
function s2e_rawmon_loadmodule2 (line 447) | static inline void s2e_rawmon_loadmodule2(const char *name,
function s2e_codeselector_enable_address_space (line 472) | static inline void s2e_codeselector_enable_address_space(unsigned user_m...
function s2e_codeselector_disable_address_space (line 482) | static inline void s2e_codeselector_disable_address_space(uint64_t pagedir)
function s2e_codeselector_select_module (line 490) | static inline void s2e_codeselector_select_module(const char *moduleId)
function s2e_moduleexec_add_module (line 500) | static inline void s2e_moduleexec_add_module(const char *moduleId, const...
function s2e_invoke_plugin (line 514) | static inline int s2e_invoke_plugin(const char *pluginName, void *data, ...
FILE: guest/include/s2e.h
type s2e_opcode_module_config_t (line 41) | typedef struct _s2e_opcode_module_config_t {
function __s2e_touch_string (line 72) | static inline void __s2e_touch_string(volatile const char *string)
function __s2e_touch_buffer (line 79) | static inline void __s2e_touch_buffer(volatile void *buffer, unsigned size)
function s2e_kill_state_printf (line 97) | static inline void s2e_kill_state_printf(int status, const char *message...
function _s2e_assert (line 108) | static inline void _s2e_assert(int b, const char *expression)
function s2e_printf (line 118) | static inline int s2e_printf(const char *format, ...)
function s2e_range (line 130) | static inline int s2e_range(int start, int end, const char *name)
FILE: guest/init_env/init_env.c
function __emit_error (line 58) | static void __emit_error(const char *msg) {
function __str_to_int (line 66) | static long int __str_to_int(char *s, const char *error_msg) {
function __streq (line 84) | static int __streq(const char *a, const char *b) {
function __add_arg (line 101) | static void __add_arg(int *argc, char **argv, char *arg, int argcMax) {
type procmap_entry_t (line 121) | typedef struct _procmap_entry_t
function procmap_entry_t (line 130) | static procmap_entry_t *load_process_map(void)
function display_process_map (line 172) | static void display_process_map(procmap_entry_t *map)
function procmap_entry_t (line 182) | static procmap_entry_t *search_process_map(procmap_entry_t *map, const c...
function register_module (line 195) | static void register_module(procmap_entry_t *proc_map, const char *name)
function __s2e_init_env (line 213) | static void __s2e_init_env(int *argcPtr, char ***argvPtr)
function __libc_start_main (line 353) | int __libc_start_main(
FILE: guest/s2ecmd/s2ecmd.c
type cmd_t (line 52) | typedef struct _cmd_t {
function handler_kill (line 59) | static void handler_kill(const char **args)
function handler_message (line 66) | static void handler_message(const char **args)
function handler_wait (line 71) | static void handler_wait(const char **args)
function handler_symbwrite (line 80) | static void handler_symbwrite(const char **args)
function handler_symbfile (line 105) | static void handler_symbfile(const char **args)
function handler_exemplify (line 201) | static void handler_exemplify(const char **args)
function handler_fork (line 219) | static void handler_fork(const char **args)
function print_commands (line 241) | static void print_commands(void)
function find_command (line 252) | static int find_command(const char *cmd)
function main (line 264) | int main(int argc, const char **argv)
FILE: guest/s2eget/s2eget.c
function copy_file (line 55) | static int copy_file(const char *directory, const char *guest_file)
function parse_arguments (line 128) | static int parse_arguments(int argc, const char **argv)
function validate_arguments (line 144) | static int validate_arguments(void)
function print_usage (line 161) | static void print_usage(const char *prog_name)
function main (line 169) | int main(int argc, const char** argv)
FILE: guest/windbg-gdb/BFDInterface.h
function class (line 25) | class BFDInterface {
FILE: guest/windbg-gdb/StartSize.h
function StartSize (line 7) | struct StartSize {
FILE: guest/windbg-gdb/Symbols.cpp
function HRESULT (line 23) | HRESULT Symbols::LoadSymbols(IDebugClient *Client, IDebugSymbols3 *Symbols)
function BOOL (line 73) | BOOL Symbols::LoadSymbolsImage(IDebugControl *Control,
function VOID (line 103) | VOID Symbols::FixPath(IDebugClient *Client, IDebugControl *Control, PSTR...
FILE: guest/windbg-gdb/Symbols.h
function class (line 11) | class Symbols
FILE: guest/windbg-gdb/main.cpp
function HRESULT (line 17) | HRESULT CALLBACK DebugExtensionInitialize(PULONG Version, PULONG Flags)
function VOID (line 28) | VOID CALLBACK DebugExtensionNotify(ULONG Notify, ULONG64 Argument)
function VOID (line 35) | VOID CALLBACK DebugExtensionUninitialize(VOID)
function HRESULT (line 45) | HRESULT CALLBACK gload(PDEBUG_CLIENT Client, PCSTR args)
function HRESULT (line 77) | HRESULT CALLBACK gdump(PDEBUG_CLIENT Client, PCSTR args)
function HRESULT (line 88) | HRESULT CALLBACK gsym(PDEBUG_CLIENT Client, PCSTR args)
function HRESULT (line 141) | HRESULT CALLBACK gbt(PDEBUG_CLIENT Client, PCSTR args)
FILE: klee/examples/islower/islower.c
function my_islower (line 7) | int my_islower(int x) {
function main (line 13) | int main() {
FILE: klee/examples/regexp/Regexp.c
function matchstar (line 14) | static int matchstar(int c, char *re, char *text) {
function matchhere (line 22) | static int matchhere(char *re, char *text) {
function match (line 34) | int match(char *re, char *text) {
function main (line 51) | int main() {
FILE: klee/examples/sort/sort.c
function insert_ordered (line 8) | static void insert_ordered(int *array, unsigned nelem, int item) {
function bubble_sort (line 21) | void bubble_sort(int *array, unsigned nelem) {
function insertion_sort (line 38) | void insertion_sort(int *array, unsigned nelem) {
function test (line 48) | void test(int *array, unsigned nelem) {
function main (line 71) | int main() {
FILE: klee/include/expr/Lexer.h
function namespace (line 15) | namespace llvm {
function namespace (line 19) | namespace klee {
FILE: klee/include/expr/Parser.h
function namespace (line 18) | namespace llvm {
function namespace (line 22) | namespace klee {
FILE: klee/include/klee/AddressSpace.h
function namespace (line 21) | namespace klee {
FILE: klee/include/klee/BitfieldSimplifier.h
function namespace (line 42) | namespace klee {
FILE: klee/include/klee/CallPathManager.h
function namespace (line 18) | namespace llvm {
function namespace (line 23) | namespace klee {
FILE: klee/include/klee/Common.h
function namespace (line 24) | namespace klee {
FILE: klee/include/klee/Constraints.h
function namespace (line 20) | namespace klee {
FILE: klee/include/klee/Context.h
function namespace (line 15) | namespace klee {
FILE: klee/include/klee/CoreStats.h
function namespace (line 15) | namespace klee {
FILE: klee/include/klee/ExecutionState.h
function namespace (line 26) | namespace klee {
FILE: klee/include/klee/Executor.h
type KTest (line 31) | struct KTest
function namespace (line 33) | namespace llvm {
function namespace (line 48) | namespace klee {
FILE: klee/include/klee/Expr.h
function namespace (line 25) | namespace llvm {
function namespace (line 29) | namespace klee {
function compareContents (line 363) | int compareContents(const Expr &b) const {
function virtual (line 372) | virtual ref<Expr> rebuild(ref<Expr> kids[]) const {
function ref (line 382) | static ref<ConstantExpr> alloc(const llvm::APInt &v) {
function ref (line 388) | static ref<ConstantExpr> alloc(uint64_t v, Width w) {
function ref (line 392) | static ref<ConstantExpr> create(uint64_t v, Width w) {
function classof (line 398) | static bool classof(const Expr *E) {
function classof (line 401) | static bool classof(const ConstantExpr *) { return true; }
function class (line 466) | class NonConstantExpr : public Expr {
function class (line 474) | class BinaryExpr : public NonConstantExpr {
function class (line 500) | class CmpExpr : public BinaryExpr {
function class (line 517) | class NotOptimizedExpr : public NonConstantExpr {
function class (line 551) | class UpdateNode {
function class (line 586) | class Array {
function class (line 633) | class UpdateList {
function class (line 659) | class ReadExpr : public NonConstantExpr {
function class (line 704) | class SelectExpr : public NonConstantExpr {
function class (line 761) | class ConcatExpr : public NonConstantExpr {
function class (line 819) | class ExtractExpr : public NonConstantExpr {
function class (line 873) | class NotExpr : public NonConstantExpr {
function class (line 921) | class CastExpr : public NonConstantExpr {
function COMPARISON_EXPR_CLASS (line 1053) | COMPARISON_EXPR_CLASS(Eq)
function isTrue (line 1072) | inline bool Expr::isTrue() const {
FILE: klee/include/klee/ExprBuilder.h
function namespace (line 15) | namespace klee {
FILE: klee/include/klee/ExternalDispatcher.h
function namespace (line 17) | namespace llvm {
function namespace (line 25) | namespace klee {
FILE: klee/include/klee/IncompleteSolver.h
function namespace (line 16) | namespace klee {
FILE: klee/include/klee/Internal/ADT/DiscretePDF.h
type weight_type (line 16) | typedef double weight_type;
FILE: klee/include/klee/Internal/ADT/ImmutableMap.h
function namespace (line 17) | namespace klee {
FILE: klee/include/klee/Internal/ADT/ImmutableSet.h
function namespace (line 17) | namespace klee {
FILE: klee/include/klee/Internal/ADT/ImmutableTree.h
function namespace (line 16) | namespace klee {
function node (line 430) | node(_node) {
FILE: klee/include/klee/Internal/ADT/KTest.h
type KTestObject (line 18) | typedef struct KTestObject KTestObject;
type KTestObject (line 19) | struct KTestObject {
type KTest (line 25) | typedef struct KTest KTest;
type KTest (line 26) | struct KTest {
FILE: klee/include/klee/Internal/ADT/MapOfSets.h
function namespace (line 25) | namespace klee {
FILE: klee/include/klee/Internal/ADT/RNG.h
function namespace (line 13) | namespace klee {
FILE: klee/include/klee/Internal/ADT/TreeStream.h
function namespace (line 17) | namespace klee {
FILE: klee/include/klee/Internal/Module/Cell.h
function namespace (line 15) | namespace klee {
FILE: klee/include/klee/Internal/Module/InstructionInfoTable.h
function namespace (line 17) | namespace llvm {
function namespace (line 23) | namespace klee {
FILE: klee/include/klee/Internal/Module/KInstIterator.h
function namespace (line 13) | namespace klee {
FILE: klee/include/klee/Internal/Module/KInstruction.h
function namespace (line 16) | namespace llvm {
function namespace (line 20) | namespace klee {
FILE: klee/include/klee/Internal/Module/KModule.h
function namespace (line 21) | namespace llvm {
function namespace (line 30) | namespace klee {
FILE: klee/include/klee/Internal/Support/FloatEvaluation.h
function namespace (line 20) | namespace klee {
FILE: klee/include/klee/Internal/Support/IntEvaluation.h
function namespace (line 21) | namespace klee {
FILE: klee/include/klee/Internal/Support/ModuleUtil.h
function namespace (line 15) | namespace llvm {
function namespace (line 21) | namespace klee {
FILE: klee/include/klee/Internal/Support/QueryLog.h
function namespace (line 17) | namespace klee {
FILE: klee/include/klee/Internal/Support/Timer.h
function namespace (line 15) | namespace klee {
FILE: klee/include/klee/Internal/System/Time.h
function namespace (line 13) | namespace klee {
FILE: klee/include/klee/Interpreter.h
type KTest (line 17) | struct KTest
function namespace (line 19) | namespace llvm {
function virtual (line 33) | virtual ~InterpreterHandler() {}
type ModuleOptions (line 51) | struct ModuleOptions {
FILE: klee/include/klee/Memory.h
function namespace (line 22) | namespace llvm {
function namespace (line 26) | namespace klee {
function class (line 155) | class ObjectState {
function isByteConcrete (line 265) | inline bool isByteConcrete(unsigned offset) const {
function isByteFlushed (line 269) | inline bool isByteFlushed(unsigned offset) const {
function isByteKnownSymbolic (line 273) | inline bool isByteKnownSymbolic(unsigned offset) const {
function markByteConcrete (line 277) | inline void markByteConcrete(unsigned offset) {
function markByteUnflushed (line 286) | void markByteUnflushed(unsigned offset) {
FILE: klee/include/klee/ObjectHolder.h
function namespace (line 13) | namespace klee {
FILE: klee/include/klee/PTree.h
function namespace (line 19) | namespace klee {
FILE: klee/include/klee/Searcher.h
function namespace (line 23) | namespace llvm {
function namespace (line 29) | namespace klee {
FILE: klee/include/klee/Solver.h
function namespace (line 17) | namespace klee {
FILE: klee/include/klee/SolverImpl.h
function namespace (line 15) | namespace klee {
FILE: klee/include/klee/SolverStats.h
function namespace (line 15) | namespace klee {
FILE: klee/include/klee/Statistic.h
function namespace (line 16) | namespace klee {
FILE: klee/include/klee/Statistics.h
function namespace (line 19) | namespace klee {
function incrementValue (line 116) | inline void StatisticRecord::incrementValue(const Statistic &s,
function getValue (line 120) | inline uint64_t StatisticRecord::getValue(const Statistic &s) const {
function StatisticRecord (line 124) | inline StatisticRecord &
function getValue (line 132) | inline uint64_t StatisticManager::getValue(const Statistic &s) const {
function incrementIndexedValue (line 136) | inline void StatisticManager::incrementIndexedValue(const Statistic &s,
function getIndexedValue (line 142) | inline uint64_t StatisticManager::getIndexedValue(const Statistic &s,
function setIndexedValue (line 147) | inline void StatisticManager::setIndexedValue(const Statistic &s,
FILE: klee/include/klee/StatsTracker.h
function namespace (line 18) | namespace llvm {
function namespace (line 24) | namespace klee {
FILE: klee/include/klee/TimerStatIncrementer.h
function namespace (line 16) | namespace klee {
FILE: klee/include/klee/UserSearcher.h
function namespace (line 13) | namespace klee {
FILE: klee/include/klee/util/Assignment.h
function namespace (line 19) | namespace klee {
FILE: klee/include/klee/util/BitArray.h
function namespace (line 13) | namespace klee {
function get (line 36) | inline bool get(unsigned idx) { return (bool) ((bits[idx/32]>>(idx&0x1F)...
function set (line 37) | inline void set(unsigned idx) { bits[idx/32] |= 1<<(idx&0x1F); }
function unset (line 38) | inline void unset(unsigned idx) { bits[idx/32] &= ~(1<<(idx&0x1F)); }
function set (line 39) | inline void set(unsigned idx, bool value) { if (value) set(idx); else un...
function isAllZeros (line 41) | bool isAllZeros(unsigned size) {
function isAllOnes (line 49) | bool isAllOnes(unsigned size) {
FILE: klee/include/klee/util/Bits.h
function namespace (line 15) | namespace klee {
FILE: klee/include/klee/util/ExprEvaluator.h
function namespace (line 16) | namespace klee {
FILE: klee/include/klee/util/ExprHashMap.h
function namespace (line 17) | namespace klee {
FILE: klee/include/klee/util/ExprPPrinter.h
function namespace (line 15) | namespace klee {
FILE: klee/include/klee/util/ExprRangeEvaluator.h
function namespace (line 16) | namespace klee {
FILE: klee/include/klee/util/ExprUtil.h
function namespace (line 15) | namespace klee {
FILE: klee/include/klee/util/ExprVisitor.h
function namespace (line 15) | namespace klee {
FILE: klee/include/klee/util/Ref.h
function dec (line 41) | void dec() {
function ptr (line 50) | ptr(p) {
function T (line 67) | T *get () const {
type T (line 128) | typedef T* SimpleType;
function SimpleType (line 129) | static SimpleType getSimplifiedValue(const ::klee::ref<T> &Ref) {
FILE: klee/lib/Basic/KTest.cpp
function read_uint32 (line 25) | static int read_uint32(FILE *f, unsigned *value_out) {
function write_uint32 (line 33) | static int write_uint32(FILE *f, unsigned value) {
function read_string (line 42) | static int read_string(FILE *f, char **value_out) {
function write_string (line 55) | static int write_string(FILE *f, const char *value) {
function kTest_getCurrentVersion (line 67) | unsigned kTest_getCurrentVersion() {
function kTest_checkHeader (line 72) | static int kTest_checkHeader(FILE *f) {
function kTest_isKTestFile (line 82) | int kTest_isKTestFile(const char *path) {
function KTest (line 94) | KTest *kTest_fromFile(const char *path) {
function kTest_toFile (line 178) | int kTest_toFile(KTest *bo, const char *path) {
function kTest_numBytes (line 222) | unsigned kTest_numBytes(KTest *bo) {
function kTest_free (line 229) | void kTest_free(KTest *bo) {
FILE: klee/lib/Basic/Statistics.cpp
function Statistic (line 50) | Statistic *StatisticManager::getStatisticByName(const std::string &name)...
function StatisticManager (line 59) | static StatisticManager &getStatisticManager() {
function Statistic (line 77) | Statistic &Statistic::operator +=(const uint64_t addend) {
FILE: klee/lib/Core/AddressSpace.cpp
function ObjectState (line 42) | const ObjectState *AddressSpace::findObject(const MemoryObject *mo) const {
function ObjectPair (line 48) | ObjectPair AddressSpace::findObject(uint64_t address) const {
function ObjectState (line 54) | ObjectState *AddressSpace::getWriteable(const MemoryObject *mo,
FILE: klee/lib/Core/CallPathManager.cpp
function CallPathNode (line 75) | CallPathNode *CallPathManager::computeCallPath(CallPathNode *parent,
function CallPathNode (line 87) | CallPathNode *CallPathManager::getCallPath(CallPathNode *parent,
FILE: klee/lib/Core/Common.cpp
function klee_vfmessage (line 41) | static void klee_vfmessage(llvm::raw_ostream *os, const char *pfx, const...
function klee_vmessage (line 63) | static void klee_vmessage(const char *pfx, bool onlyToFile, const char *...
FILE: klee/lib/Core/Context.cpp
function Context (line 30) | const Context &Context::get() {
FILE: klee/lib/Core/ExecutionState.cpp
type klee (line 33) | namespace klee {
function ExecutionState (line 97) | ExecutionState* ExecutionState::clone() {
function ExecutionState (line 107) | ExecutionState *ExecutionState::branch() {
FILE: klee/lib/Core/Executor.cpp
type klee (line 290) | namespace klee {
function Solver (line 294) | Solver *constructSolverChain(STPSolver *stpSolver,
function Module (line 383) | const Module *Executor::setModule(llvm::Module *module,
function MemoryObject (line 510) | MemoryObject * Executor::addExternalObject(ExecutionState &state,
function Cell (line 1272) | const Cell& Executor::eval(KInstruction *ki, unsigned index,
function Function (line 1606) | Function* Executor::getCalledFunction(CallSite &cs, ExecutionState &stat...
function isDebugIntrinsic (line 1626) | static bool isDebugIntrinsic(const Function *f, KModule *KM) {
function ObjectState (line 3121) | ObjectState *Executor::bindObjectInState(ExecutionState &state,
function Solver (line 3854) | Solver *Executor::getSolver() const
FILE: klee/lib/Core/ExecutorTimers.cpp
class HaltTimer (line 45) | class HaltTimer : public Executor::Timer {
method HaltTimer (line 49) | HaltTimer(Executor *_executor) : executor(_executor) {}
method run (line 52) | void run() {
function VOID (line 76) | VOID CALLBACK TimerProc(
type itimerval (line 95) | struct itimerval
type timeval (line 96) | struct timeval
class Executor::TimerInfo (line 127) | class Executor::TimerInfo {
method TimerInfo (line 137) | TimerInfo(Timer *_timer, double _rate)
FILE: klee/lib/Core/ExecutorUtil.cpp
type klee (line 36) | namespace klee {
FILE: klee/lib/Core/ExternalDispatcher.cpp
function sigsegv_handler (line 50) | static void sigsegv_handler(int signal)
function sigsegv_handler (line 54) | static void sigsegv_handler(int signal, siginfo_t *info, void *context) {
type sigaction (line 182) | struct sigaction
function Function (line 225) | Function *ExternalDispatcher::createDispatcher(Function *target, Instruc...
FILE: klee/lib/Core/ImpliedValue.h
function namespace (line 23) | namespace klee {
FILE: klee/lib/Core/KleeExecutor.cpp
function Interpreter (line 12) | Interpreter *Interpreter::createKleeExecutor(const InterpreterOptions &o...
FILE: klee/lib/Core/KleeExecutor.h
function namespace (line 19) | namespace klee {
FILE: klee/lib/Core/Memory.cpp
function ObjectHolder (line 54) | ObjectHolder &ObjectHolder::operator=(const ObjectHolder &b) {
function UpdateList (line 160) | const UpdateList &ObjectState::getUpdates() const {
FILE: klee/lib/Core/MemoryManager.cpp
function MemoryObject (line 34) | MemoryObject *MemoryManager::allocate(uint64_t size, bool isLocal,
function MemoryObject (line 52) | MemoryObject *MemoryManager::allocateFixed(uint64_t address, uint64_t size,
FILE: klee/lib/Core/MemoryManager.h
function namespace (line 16) | namespace llvm {
function namespace (line 20) | namespace klee {
FILE: klee/lib/Core/Searcher.cpp
type klee (line 48) | namespace klee {
function ExecutionState (line 57) | ExecutionState &DFSSearcher::selectState() {
function ExecutionState (line 107) | ExecutionState &RandomSearcher::selectState() {
function ExecutionState (line 162) | ExecutionState &WeightedRandomSearcher::selectState() {
function ExecutionState (line 235) | ExecutionState &RandomPathSearcher::selectState() {
function ExecutionState (line 271) | ExecutionState &RandomPathSearcher::selectState() {
function Instruction (line 317) | Instruction *BumpMergingSearcher::getMergePoint(ExecutionState &es) {
function ExecutionState (line 331) | ExecutionState &BumpMergingSearcher::selectState() {
function ExecutionState (line 414) | ExecutionState &MergingSearcher::selectState() {
function ExecutionState (line 535) | ExecutionState &BatchingSearcher::selectState() {
function ExecutionState (line 582) | ExecutionState &IterativeDeepeningTimeSearcher::selectState() {
function ExecutionState (line 635) | ExecutionState &InterleavedSearcher::selectState() {
FILE: klee/lib/Core/SeedInfo.cpp
function KTestObject (line 23) | KTestObject *SeedInfo::getNextInput(const MemoryObject *mo,
FILE: klee/lib/Core/SeedInfo.h
type KTest (line 16) | struct KTest
type KTestObject (line 17) | struct KTestObject
function namespace (line 20) | namespace klee {
FILE: klee/lib/Core/SpecialFunctionHandler.cpp
type HandlerInfo (line 37) | struct HandlerInfo {
FILE: klee/lib/Core/SpecialFunctionHandler.h
function namespace (line 17) | namespace llvm {
function namespace (line 21) | namespace klee {
FILE: klee/lib/Core/StatsTracker.cpp
type klee (line 102) | namespace klee {
class WriteIStatsTimer (line 103) | class WriteIStatsTimer : public Executor::Timer {
method WriteIStatsTimer (line 107) | WriteIStatsTimer(StatsTracker *_statsTracker) : statsTracker(_statsT...
method run (line 110) | void run() { statsTracker->writeIStats(); }
class WriteStatsTimer (line 113) | class WriteStatsTimer : public Executor::Timer {
method WriteStatsTimer (line 117) | WriteStatsTimer(StatsTracker *_statsTracker) : statsTracker(_statsTr...
method run (line 120) | void run() { statsTracker->writeStatsLine(); }
class UpdateReachableTimer (line 123) | class UpdateReachableTimer : public Executor::Timer {
method UpdateReachableTimer (line 127) | UpdateReachableTimer(StatsTracker *_statsTracker) : statsTracker(_st...
method run (line 129) | void run() { statsTracker->computeReachableUncovered(); }
function instructionIsCoverable (line 140) | static bool instructionIsCoverable(Instruction *i) {
function getSuccs (line 561) | static std::vector<Instruction*> getSuccs(Instruction *i) {
FILE: klee/lib/Core/TimingSolver.h
function namespace (line 18) | namespace klee {
FILE: klee/lib/Core/UserSearcher.cpp
function Searcher (line 109) | Searcher *klee::constructUserSearcher(Executor &executor) {
FILE: klee/lib/Expr/BitfieldSimplifier.cpp
function zeroMask (line 45) | inline uint64_t zeroMask(uint64_t w) {
FILE: klee/lib/Expr/Constraints.cpp
class ExprReplaceVisitor (line 20) | class ExprReplaceVisitor : public ExprVisitor {
method ExprReplaceVisitor (line 25) | ExprReplaceVisitor(ref<Expr> _src, ref<Expr> _dst) : src(_src), dst(_d...
method Action (line 27) | Action visitExpr(const Expr &e) {
method Action (line 35) | Action visitExprPost(const Expr &e) {
class ExprReplaceVisitor2 (line 44) | class ExprReplaceVisitor2 : public ExprVisitor {
method ExprReplaceVisitor2 (line 49) | ExprReplaceVisitor2(const std::map< ref<Expr>, ref<Expr> > &_replaceme...
method Action (line 53) | Action visitExprPost(const Expr &e) {
FILE: klee/lib/Expr/Expr.cpp
function AddExpr_createPartialR (line 694) | static ref<Expr> AddExpr_createPartialR(const ref<ConstantExpr> &cl, Exp...
function AddExpr_createPartial (line 714) | static ref<Expr> AddExpr_createPartial(Expr *l, const ref<ConstantExpr> ...
function AddExpr_create (line 717) | static ref<Expr> AddExpr_create(Expr *l, Expr *r) {
function SubExpr_createPartialR (line 742) | static ref<Expr> SubExpr_createPartialR(const ref<ConstantExpr> &cl, Exp...
function SubExpr_createPartial (line 760) | static ref<Expr> SubExpr_createPartial(Expr *l, const ref<ConstantExpr> ...
function SubExpr_create (line 765) | static ref<Expr> SubExpr_create(Expr *l, Expr *r) {
function MulExpr_createPartialR (line 792) | static ref<Expr> MulExpr_createPartialR(const ref<ConstantExpr> &cl, Exp...
function MulExpr_createPartial (line 805) | static ref<Expr> MulExpr_createPartial(Expr *l, const ref<ConstantExpr> ...
function MulExpr_create (line 808) | static ref<Expr> MulExpr_create(Expr *l, Expr *r) {
function AndExpr_createPartial (line 818) | static ref<Expr> AndExpr_createPartial(Expr *l, const ref<ConstantExpr> ...
function AndExpr_createPartialR (line 827) | static ref<Expr> AndExpr_createPartialR(const ref<ConstantExpr> &cl, Exp...
function AndExpr_create (line 830) | static ref<Expr> AndExpr_create(Expr *l, Expr *r) {
function OrExpr_createPartial (line 834) | static ref<Expr> OrExpr_createPartial(Expr *l, const ref<ConstantExpr> &...
function OrExpr_createPartialR (line 843) | static ref<Expr> OrExpr_createPartialR(const ref<ConstantExpr> &cl, Expr...
function OrExpr_create (line 846) | static ref<Expr> OrExpr_create(Expr *l, Expr *r) {
function XorExpr_createPartialR (line 850) | static ref<Expr> XorExpr_createPartialR(const ref<ConstantExpr> &cl, Exp...
function XorExpr_createPartial (line 860) | static ref<Expr> XorExpr_createPartial(Expr *l, const ref<ConstantExpr> ...
function XorExpr_create (line 863) | static ref<Expr> XorExpr_create(Expr *l, Expr *r) {
function UDivExpr_create (line 867) | static ref<Expr> UDivExpr_create(const ref<Expr> &l, const ref<Expr> &r) {
function SDivExpr_create (line 875) | static ref<Expr> SDivExpr_create(const ref<Expr> &l, const ref<Expr> &r) {
function URemExpr_create (line 883) | static ref<Expr> URemExpr_create(const ref<Expr> &l, const ref<Expr> &r) {
function SRemExpr_create (line 891) | static ref<Expr> SRemExpr_create(const ref<Expr> &l, const ref<Expr> &r) {
function ShlExpr_create (line 899) | static ref<Expr> ShlExpr_create(const ref<Expr> &l, const ref<Expr> &r) {
function LShrExpr_create (line 907) | static ref<Expr> LShrExpr_create(const ref<Expr> &l, const ref<Expr> &r) {
function AShrExpr_create (line 915) | static ref<Expr> AShrExpr_create(const ref<Expr> &l, const ref<Expr> &r) {
function EqExpr_create (line 983) | static ref<Expr> EqExpr_create(const ref<Expr> &l, const ref<Expr> &r) {
function TryConstArrayOpt (line 996) | static ref<Expr> TryConstArrayOpt(const ref<ConstantExpr> &cl,
function EqExpr_createPartialR (line 1023) | static ref<Expr> EqExpr_createPartialR(const ref<ConstantExpr> &cl, Expr...
function EqExpr_createPartial (line 1100) | static ref<Expr> EqExpr_createPartial(Expr *l, const ref<ConstantExpr> &...
function UltExpr_create (line 1123) | static ref<Expr> UltExpr_create(const ref<Expr> &l, const ref<Expr> &r) {
function UleExpr_create (line 1132) | static ref<Expr> UleExpr_create(const ref<Expr> &l, const ref<Expr> &r) {
function SltExpr_create (line 1140) | static ref<Expr> SltExpr_create(const ref<Expr> &l, const ref<Expr> &r) {
function SleExpr_create (line 1148) | static ref<Expr> SleExpr_create(const ref<Expr> &l, const ref<Expr> &r) {
FILE: klee/lib/Expr/ExprBuilder.cpp
class DefaultExprBuilder (line 21) | class DefaultExprBuilder : public ExprBuilder {
method Constant (line 22) | virtual ref<Expr> Constant(const llvm::APInt &Value) {
method NotOptimized (line 26) | virtual ref<Expr> NotOptimized(const ref<Expr> &Index) {
method Read (line 30) | virtual ref<Expr> Read(const UpdateList &Updates,
method Select (line 35) | virtual ref<Expr> Select(const ref<Expr> &Cond,
method Concat (line 40) | virtual ref<Expr> Concat(const ref<Expr> &LHS, const ref<Expr> &RHS) {
method Extract (line 44) | virtual ref<Expr> Extract(const ref<Expr> &LHS,
method ZExt (line 49) | virtual ref<Expr> ZExt(const ref<Expr> &LHS, Expr::Width W) {
method SExt (line 53) | virtual ref<Expr> SExt(const ref<Expr> &LHS, Expr::Width W) {
method Add (line 57) | virtual ref<Expr> Add(const ref<Expr> &LHS, const ref<Expr> &RHS) {
method Sub (line 61) | virtual ref<Expr> Sub(const ref<Expr> &LHS, const ref<Expr> &RHS) {
method Mul (line 65) | virtual ref<Expr> Mul(const ref<Expr> &LHS, const ref<Expr> &RHS) {
method UDiv (line 69) | virtual ref<Expr> UDiv(const ref<Expr> &LHS, const ref<Expr> &RHS) {
method SDiv (line 73) | virtual ref<Expr> SDiv(const ref<Expr> &LHS, const ref<Expr> &RHS) {
method URem (line 77) | virtual ref<Expr> URem(const ref<Expr> &LHS, const ref<Expr> &RHS) {
method SRem (line 81) | virtual ref<Expr> SRem(const ref<Expr> &LHS, const ref<Expr> &RHS) {
method Not (line 85) | virtual ref<Expr> Not(const ref<Expr> &LHS) {
method And (line 89) | virtual ref<Expr> And(const ref<Expr> &LHS, const ref<Expr> &RHS) {
method Or (line 93) | virtual ref<Expr> Or(const ref<Expr> &LHS, const ref<Expr> &RHS) {
method Xor (line 97) | virtual ref<Expr> Xor(const ref<Expr> &LHS, const ref<Expr> &RHS) {
method Shl (line 101) | virtual ref<Expr> Shl(const ref<Expr> &LHS, const ref<Expr> &RHS) {
method LShr (line 105) | virtual ref<Expr> LShr(const ref<Expr> &LHS, const ref<Expr> &RHS) {
method AShr (line 109) | virtual ref<Expr> AShr(const ref<Expr> &LHS, const ref<Expr> &RHS) {
method Eq (line 113) | virtual ref<Expr> Eq(const ref<Expr> &LHS, const ref<Expr> &RHS) {
method Ne (line 117) | virtual ref<Expr> Ne(const ref<Expr> &LHS, const ref<Expr> &RHS) {
method Ult (line 121) | virtual ref<Expr> Ult(const ref<Expr> &LHS, const ref<Expr> &RHS) {
method Ule (line 125) | virtual ref<Expr> Ule(const ref<Expr> &LHS, const ref<Expr> &RHS) {
method Ugt (line 129) | virtual ref<Expr> Ugt(const ref<Expr> &LHS, const ref<Expr> &RHS) {
method Uge (line 133) | virtual ref<Expr> Uge(const ref<Expr> &LHS, const ref<Expr> &RHS) {
method Slt (line 137) | virtual ref<Expr> Slt(const ref<Expr> &LHS, const ref<Expr> &RHS) {
method Sle (line 141) | virtual ref<Expr> Sle(const ref<Expr> &LHS, const ref<Expr> &RHS) {
method Sgt (line 145) | virtual ref<Expr> Sgt(const ref<Expr> &LHS, const ref<Expr> &RHS) {
method Sge (line 149) | virtual ref<Expr> Sge(const ref<Expr> &LHS, const ref<Expr> &RHS) {
class ChainedBuilder (line 157) | class ChainedBuilder {
method ChainedBuilder (line 167) | ChainedBuilder(ExprBuilder *_Builder, ExprBuilder *_Base)
method Constant (line 171) | ref<Expr> Constant(const llvm::APInt &Value) {
method NotOptimized (line 175) | ref<Expr> NotOptimized(const ref<Expr> &Index) {
method Read (line 179) | ref<Expr> Read(const UpdateList &Updates,
method Select (line 184) | ref<Expr> Select(const ref<Expr> &Cond,
method Concat (line 189) | ref<Expr> Concat(const ref<Expr> &LHS, const ref<Expr> &RHS) {
method Extract (line 193) | ref<Expr> Extract(const ref<Expr> &LHS,
method ZExt (line 198) | ref<Expr> ZExt(const ref<Expr> &LHS, Expr::Width W) {
method SExt (line 202) | ref<Expr> SExt(const ref<Expr> &LHS, Expr::Width W) {
method Add (line 206) | ref<Expr> Add(const ref<Expr> &LHS, const ref<Expr> &RHS) {
method Sub (line 210) | ref<Expr> Sub(const ref<Expr> &LHS, const ref<Expr> &RHS) {
method Mul (line 214) | ref<Expr> Mul(const ref<Expr> &LHS, const ref<Expr> &RHS) {
method UDiv (line 218) | ref<Expr> UDiv(const ref<Expr> &LHS, const ref<Expr> &RHS) {
method SDiv (line 222) | ref<Expr> SDiv(const ref<Expr> &LHS, const ref<Expr> &RHS) {
method URem (line 226) | ref<Expr> URem(const ref<Expr> &LHS, const ref<Expr> &RHS) {
method SRem (line 230) | ref<Expr> SRem(const ref<Expr> &LHS, const ref<Expr> &RHS) {
method Not (line 234) | ref<Expr> Not(const ref<Expr> &LHS) {
method And (line 238) | ref<Expr> And(const ref<Expr> &LHS, const ref<Expr> &RHS) {
method Or (line 242) | ref<Expr> Or(const ref<Expr> &LHS, const ref<Expr> &RHS) {
method Xor (line 246) | ref<Expr> Xor(const ref<Expr> &LHS, const ref<Expr> &RHS) {
method Shl (line 250) | ref<Expr> Shl(const ref<Expr> &LHS, const ref<Expr> &RHS) {
method LShr (line 254) | ref<Expr> LShr(const ref<Expr> &LHS, const ref<Expr> &RHS) {
method AShr (line 258) | ref<Expr> AShr(const ref<Expr> &LHS, const ref<Expr> &RHS) {
method Eq (line 262) | ref<Expr> Eq(const ref<Expr> &LHS, const ref<Expr> &RHS) {
method Ne (line 266) | ref<Expr> Ne(const ref<Expr> &LHS, const ref<Expr> &RHS) {
method Ult (line 270) | ref<Expr> Ult(const ref<Expr> &LHS, const ref<Expr> &RHS) {
method Ule (line 274) | ref<Expr> Ule(const ref<Expr> &LHS, const ref<Expr> &RHS) {
method Ugt (line 278) | ref<Expr> Ugt(const ref<Expr> &LHS, const ref<Expr> &RHS) {
method Uge (line 282) | ref<Expr> Uge(const ref<Expr> &LHS, const ref<Expr> &RHS) {
method Slt (line 286) | ref<Expr> Slt(const ref<Expr> &LHS, const ref<Expr> &RHS) {
method Sle (line 290) | ref<Expr> Sle(const ref<Expr> &LHS, const ref<Expr> &RHS) {
method Sgt (line 294) | ref<Expr> Sgt(const ref<Expr> &LHS, const ref<Expr> &RHS) {
method Sge (line 298) | ref<Expr> Sge(const ref<Expr> &LHS, const ref<Expr> &RHS) {
class ConstantSpecializedExprBuilder (line 311) | class ConstantSpecializedExprBuilder : public ExprBuilder {
method ConstantSpecializedExprBuilder (line 315) | ConstantSpecializedExprBuilder(ExprBuilder *Base) : Builder(this, Base...
method Constant (line 318) | virtual ref<Expr> Constant(const llvm::APInt &Value) {
method NotOptimized (line 322) | virtual ref<Expr> NotOptimized(const ref<Expr> &Index) {
method Read (line 326) | virtual ref<Expr> Read(const UpdateList &Updates,
method Select (line 339) | virtual ref<Expr> Select(const ref<Expr> &Cond,
method Concat (line 347) | virtual ref<Expr> Concat(const ref<Expr> &LHS, const ref<Expr> &RHS) {
method Extract (line 360) | virtual ref<Expr> Extract(const ref<Expr> &LHS,
method ZExt (line 368) | virtual ref<Expr> ZExt(const ref<Expr> &LHS, Expr::Width W) {
method SExt (line 375) | virtual ref<Expr> SExt(const ref<Expr> &LHS, Expr::Width W) {
method Add (line 382) | virtual ref<Expr> Add(const ref<Expr> &LHS, const ref<Expr> &RHS) {
method Sub (line 395) | virtual ref<Expr> Sub(const ref<Expr> &LHS, const ref<Expr> &RHS) {
method Mul (line 408) | virtual ref<Expr> Mul(const ref<Expr> &LHS, const ref<Expr> &RHS) {
method UDiv (line 421) | virtual ref<Expr> UDiv(const ref<Expr> &LHS, const ref<Expr> &RHS) {
method SDiv (line 434) | virtual ref<Expr> SDiv(const ref<Expr> &LHS, const ref<Expr> &RHS) {
method URem (line 447) | virtual ref<Expr> URem(const ref<Expr> &LHS, const ref<Expr> &RHS) {
method SRem (line 460) | virtual ref<Expr> SRem(const ref<Expr> &LHS, const ref<Expr> &RHS) {
method Not (line 473) | virtual ref<Expr> Not(const ref<Expr> &LHS) {
method And (line 484) | virtual ref<Expr> And(const ref<Expr> &LHS, const ref<Expr> &RHS) {
method Or (line 497) | virtual ref<Expr> Or(const ref<Expr> &LHS, const ref<Expr> &RHS) {
method Xor (line 510) | virtual ref<Expr> Xor(const ref<Expr> &LHS, const ref<Expr> &RHS) {
method Shl (line 523) | virtual ref<Expr> Shl(const ref<Expr> &LHS, const ref<Expr> &RHS) {
method LShr (line 536) | virtual ref<Expr> LShr(const ref<Expr> &LHS, const ref<Expr> &RHS) {
method AShr (line 549) | virtual ref<Expr> AShr(const ref<Expr> &LHS, const ref<Expr> &RHS) {
method Eq (line 562) | virtual ref<Expr> Eq(const ref<Expr> &LHS, const ref<Expr> &RHS) {
method Ne (line 575) | virtual ref<Expr> Ne(const ref<Expr> &LHS, const ref<Expr> &RHS) {
method Ult (line 588) | virtual ref<Expr> Ult(const ref<Expr> &LHS, const ref<Expr> &RHS) {
method Ule (line 601) | virtual ref<Expr> Ule(const ref<Expr> &LHS, const ref<Expr> &RHS) {
method Ugt (line 614) | virtual ref<Expr> Ugt(const ref<Expr> &LHS, const ref<Expr> &RHS) {
method Uge (line 627) | virtual ref<Expr> Uge(const ref<Expr> &LHS, const ref<Expr> &RHS) {
method Slt (line 640) | virtual ref<Expr> Slt(const ref<Expr> &LHS, const ref<Expr> &RHS) {
method Sle (line 653) | virtual ref<Expr> Sle(const ref<Expr> &LHS, const ref<Expr> &RHS) {
method Sgt (line 666) | virtual ref<Expr> Sgt(const ref<Expr> &LHS, const ref<Expr> &RHS) {
method Sge (line 679) | virtual ref<Expr> Sge(const ref<Expr> &LHS, const ref<Expr> &RHS) {
class ConstantFoldingBuilder (line 693) | class ConstantFoldingBuilder :
method ConstantFoldingBuilder (line 696) | ConstantFoldingBuilder(ExprBuilder *Builder, ExprBuilder *Base)
method Add (line 699) | ref<Expr> Add(const ref<ConstantExpr> &LHS,
method Add (line 734) | ref<Expr> Add(const ref<NonConstantExpr> &LHS,
method Add (line 739) | ref<Expr> Add(const ref<NonConstantExpr> &LHS,
method Sub (line 788) | ref<Expr> Sub(const ref<ConstantExpr> &LHS,
method Sub (line 819) | ref<Expr> Sub(const ref<NonConstantExpr> &LHS,
method Sub (line 825) | ref<Expr> Sub(const ref<NonConstantExpr> &LHS,
method Mul (line 872) | ref<Expr> Mul(const ref<ConstantExpr> &LHS,
method Mul (line 883) | ref<Expr> Mul(const ref<NonConstantExpr> &LHS,
method Mul (line 888) | ref<Expr> Mul(const ref<NonConstantExpr> &LHS,
method And (line 893) | ref<Expr> And(const ref<ConstantExpr> &LHS,
method And (line 904) | ref<Expr> And(const ref<NonConstantExpr> &LHS,
method And (line 909) | ref<Expr> And(const ref<NonConstantExpr> &LHS,
method Or (line 914) | ref<Expr> Or(const ref<ConstantExpr> &LHS,
method Or (line 925) | ref<Expr> Or(const ref<NonConstantExpr> &LHS,
method Or (line 930) | ref<Expr> Or(const ref<NonConstantExpr> &LHS,
method Xor (line 935) | ref<Expr> Xor(const ref<ConstantExpr> &LHS,
method Xor (line 944) | ref<Expr> Xor(const ref<NonConstantExpr> &LHS,
method Xor (line 949) | ref<Expr> Xor(const ref<NonConstantExpr> &LHS,
method Eq (line 954) | ref<Expr> Eq(const ref<ConstantExpr> &LHS,
method Eq (line 970) | ref<Expr> Eq(const ref<NonConstantExpr> &LHS,
method Eq (line 975) | ref<Expr> Eq(const ref<NonConstantExpr> &LHS,
class SimplifyingBuilder (line 984) | class SimplifyingBuilder : public ChainedBuilder {
method SimplifyingBuilder (line 986) | SimplifyingBuilder(ExprBuilder *Builder, ExprBuilder *Base)
method Eq (line 989) | ref<Expr> Eq(const ref<ConstantExpr> &LHS,
method Eq (line 1005) | ref<Expr> Eq(const ref<NonConstantExpr> &LHS,
method Eq (line 1010) | ref<Expr> Eq(const ref<NonConstantExpr> &LHS,
method Not (line 1019) | ref<Expr> Not(const ref<NonConstantExpr> &LHS) {
method Ne (line 1027) | ref<Expr> Ne(const ref<Expr> &LHS, const ref<Expr> &RHS) {
method Ugt (line 1032) | ref<Expr> Ugt(const ref<Expr> &LHS, const ref<Expr> &RHS) {
method Uge (line 1037) | ref<Expr> Uge(const ref<Expr> &LHS, const ref<Expr> &RHS) {
method Sgt (line 1042) | ref<Expr> Sgt(const ref<Expr> &LHS, const ref<Expr> &RHS) {
method Sge (line 1047) | ref<Expr> Sge(const ref<Expr> &LHS, const ref<Expr> &RHS) {
function ExprBuilder (line 1057) | ExprBuilder *klee::createDefaultExprBuilder() {
function ExprBuilder (line 1061) | ExprBuilder *klee::createConstantFoldingExprBuilder(ExprBuilder *Base) {
function ExprBuilder (line 1065) | ExprBuilder *klee::createSimplifyingExprBuilder(ExprBuilder *Base) {
FILE: klee/lib/Expr/ExprPPrinter.cpp
class PrintContext (line 44) | class PrintContext {
method PrintContext (line 55) | PrintContext(std::ostream &_os) : os(_os), newline("\n"), pos(0) {}
method setNewline (line 57) | void setNewline(const std::string &_newline) {
method breakLine (line 61) | void breakLine(unsigned indent=0) {
method write (line 70) | void write(const std::string &s) {
method PrintContext (line 76) | PrintContext &operator<<(T elt) {
class PPrinter (line 89) | class PPrinter : public ExprPPrinter {
method shouldPrintWidth (line 105) | bool shouldPrintWidth(ref<Expr> e) {
method isVerySimple (line 111) | bool isVerySimple(const ref<Expr> &e) {
method isVerySimpleUpdate (line 115) | bool isVerySimpleUpdate(const UpdateNode *un) {
method isSimple (line 121) | bool isSimple(const ref<Expr> &e) {
method hasSimpleKids (line 135) | bool hasSimpleKids(const Expr *ep) {
method scanUpdate (line 142) | void scanUpdate(const UpdateNode *un) {
method scan1 (line 155) | void scan1(const ref<Expr> &e) {
method printUpdateList (line 171) | void printUpdateList(const UpdateList &updates, PrintContext &PC) {
method printWidth (line 231) | void printWidth(PrintContext &PC, ref<Expr> e) {
method isReadExprAtOffset (line 245) | bool isReadExprAtOffset(ref<Expr> e, const ReadExpr *base, ref<Expr> o...
method ReadExpr (line 270) | const ReadExpr* hasOrderedReads(ref<Expr> e, int stride) {
method hasAllByteReads (line 309) | bool hasAllByteReads(const Expr *ep) {
method printRead (line 327) | void printRead(const ReadExpr *re, PrintContext &PC, unsigned indent) {
method printExtract (line 333) | void printExtract(const ExtractExpr *ee, PrintContext &PC, unsigned in...
method printExpr (line 338) | void printExpr(const Expr *ep, PrintContext &PC, unsigned indent, bool...
method PPrinter (line 349) | PPrinter(std::ostream &_os) : os(_os), newline("\n") {
method setNewline (line 353) | void setNewline(const std::string &_newline) {
method reset (line 357) | void reset() {
method scan (line 369) | void scan(const ref<Expr> &e) {
method print (line 374) | void print(const ref<Expr> &e, unsigned level=0) {
method printConst (line 380) | void printConst(const ref<ConstantExpr> &e, PrintContext &PC,
method print (line 411) | void print(const ref<Expr> &e, PrintContext &PC, bool printConstWidth=...
method printSeparator (line 468) | void printSeparator(PrintContext &PC, bool simple, unsigned indent) {
function ExprPPrinter (line 477) | ExprPPrinter *klee::ExprPPrinter::create(std::ostream &os) {
FILE: klee/lib/Expr/ExprUtil.cpp
type klee (line 79) | namespace klee {
class SymbolicObjectFinder (line 81) | class SymbolicObjectFinder : public ExprVisitor {
method Action (line 83) | Action visitRead(const ReadExpr &re) {
method SymbolicObjectFinder (line 103) | SymbolicObjectFinder(std::vector<const Array*> &_objects)
FILE: klee/lib/Expr/Lexer.cpp
function isInternalIdentifierChar (line 63) | static inline bool isInternalIdentifierChar(int Char) {
function Token (line 104) | Token &Lexer::SetTokenKind(Token &Result, Token::Kind k) {
function isReservedKW (line 110) | static bool isReservedKW(const char *Str, unsigned N) {
function isWidthKW (line 133) | static bool isWidthKW(const char *Str, unsigned N) {
function Token (line 141) | Token &Lexer::SetIdentifierTokenKind(Token &Result) {
function Token (line 197) | Token &Lexer::LexNumber(Token &Result) {
function Token (line 203) | Token &Lexer::LexIdentifier(Token &Result) {
function Token (line 211) | Token &Lexer::Lex(Token &Result) {
FILE: klee/lib/Expr/Parser.cpp
type ParseResult (line 35) | struct ParseResult {
method ParseResult (line 40) | ParseResult() : IsValid(false), Value() {}
method ParseResult (line 41) | ParseResult(T _Value) : IsValid(true), Value(_Value) {}
method ParseResult (line 42) | ParseResult(bool _IsValid, T _Value) : IsValid(_IsValid), Value(_Value...
method isValid (line 44) | bool isValid() {
method T (line 47) | T get() {
class ExprResult (line 53) | class ExprResult {
method ExprResult (line 58) | ExprResult() : IsValid(false) {}
method ExprResult (line 59) | ExprResult(ExprHandle _Value) : IsValid(true), Value(_Value) {}
method ExprResult (line 60) | ExprResult(ref<ConstantExpr> _Value) : IsValid(true), Value(_Value.get...
method ExprResult (line 61) | ExprResult(bool _IsValid, ExprHandle _Value) : IsValid(_IsValid), Valu...
method isValid (line 63) | bool isValid() {
method ExprHandle (line 66) | ExprHandle get() {
class NumberOrExprResult (line 80) | class NumberOrExprResult {
method NumberOrExprResult (line 86) | NumberOrExprResult() : IsNumber(false) {}
method NumberOrExprResult (line 87) | explicit NumberOrExprResult(Token _AsNumber) : AsNumber(_AsNumber),
method NumberOrExprResult (line 89) | explicit NumberOrExprResult(ExprResult _AsExpr) : AsExpr(_AsExpr),
method isNumber (line 92) | bool isNumber() const { return IsNumber; }
method Token (line 93) | const Token &getNumber() const {
method ExprResult (line 97) | const ExprResult &getExpr() const {
class ParserImpl (line 104) | class ParserImpl : public Parser {
method GetNextNonCommentToken (line 136) | void GetNextNonCommentToken() {
method ConsumeToken (line 143) | void ConsumeToken() {
method ConsumeExpectedToken (line 151) | void ConsumeExpectedToken(Token::Kind k) {
method _ConsumeExpectedToken (line 156) | void _ConsumeExpectedToken(Token::Kind k) {
method ConsumeLParen (line 161) | void ConsumeLParen() {
method ConsumeRParen (line 166) | void ConsumeRParen() {
method ConsumeLSquare (line 172) | void ConsumeLSquare() {
method ConsumeRSquare (line 177) | void ConsumeRSquare() {
method ConsumeAnyToken (line 183) | void ConsumeAnyToken() {
method SkipUntilRParen (line 198) | void SkipUntilRParen(unsigned Level) {
method SkipUntilRParen (line 216) | void SkipUntilRParen() {
method ExpectRParen (line 223) | void ExpectRParen(const char *Msg) {
method SkipUntilRSquare (line 237) | void SkipUntilRSquare(unsigned Level) {
method SkipUntilRSquare (line 255) | void SkipUntilRSquare() {
method ExpectRSquare (line 262) | void ExpectRSquare(const char *Msg) {
method Error (line 320) | void Error(const char *Message) { Error(Message, Tok); }
method ParserImpl (line 323) | ParserImpl(const std::string _Filename,
method Initialize (line 334) | void Initialize() {
method SetMaxErrors (line 344) | virtual void SetMaxErrors(unsigned N) {
method GetNumErrors (line 348) | virtual unsigned GetNumErrors() const {
function Identifier (line 354) | const Identifier *ParserImpl::GetOrCreateIdentifier(const Token &Tok) {
function Decl (line 368) | Decl *ParserImpl::ParseTopLevelDecl() {
function DeclResult (line 401) | DeclResult ParserImpl::ParseArrayDecl() {
function DeclResult (line 544) | DeclResult ParserImpl::ParseCommandDecl() {
function DeclResult (line 568) | DeclResult ParserImpl::ParseQueryCommand() {
function NumberOrExprResult (line 686) | NumberOrExprResult ParserImpl::ParseNumberOrExpr() {
method NumberOrExprResult (line 86) | NumberOrExprResult() : IsNumber(false) {}
method NumberOrExprResult (line 87) | explicit NumberOrExprResult(Token _AsNumber) : AsNumber(_AsNumber),
method NumberOrExprResult (line 89) | explicit NumberOrExprResult(ExprResult _AsExpr) : AsExpr(_AsExpr),
method isNumber (line 92) | bool isNumber() const { return IsNumber; }
method Token (line 93) | const Token &getNumber() const {
method ExprResult (line 97) | const ExprResult &getExpr() const {
function ExprResult (line 704) | ExprResult ParserImpl::ParseExpr(TypeResult ExpectedType) {
method ExprResult (line 58) | ExprResult() : IsValid(false) {}
method ExprResult (line 59) | ExprResult(ExprHandle _Value) : IsValid(true), Value(_Value) {}
method ExprResult (line 60) | ExprResult(ref<ConstantExpr> _Value) : IsValid(true), Value(_Value.get...
method ExprResult (line 61) | ExprResult(bool _IsValid, ExprHandle _Value) : IsValid(_IsValid), Valu...
method isValid (line 63) | bool isValid() {
method ExprHandle (line 66) | ExprHandle get() {
type MacroKind (line 778) | enum MacroKind {
function LookupExprInfo (line 796) | static bool LookupExprInfo(const Token &Tok, unsigned &Kind,
function ExprResult (line 901) | ExprResult ParserImpl::ParseParenExpr(TypeResult FIXME_UNUSED) {
method ExprResult (line 58) | ExprResult() : IsValid(false) {}
method ExprResult (line 59) | ExprResult(ExprHandle _Value) : IsValid(true), Value(_Value) {}
method ExprResult (line 60) | ExprResult(ref<ConstantExpr> _Value) : IsValid(true), Value(_Value.get...
method ExprResult (line 61) | ExprResult(bool _IsValid, ExprHandle _Value) : IsValid(_IsValid), Valu...
method isValid (line 63) | bool isValid() {
method ExprHandle (line 66) | ExprHandle get() {
function ExprResult (line 1001) | ExprResult ParserImpl::ParseUnaryParenExpr(const Token &Name,
method ExprResult (line 58) | ExprResult() : IsValid(false) {}
method ExprResult (line 59) | ExprResult(ExprHandle _Value) : IsValid(true), Value(_Value) {}
method ExprResult (line 60) | ExprResult(ref<ConstantExpr> _Value) : IsValid(true), Value(_Value.get...
method ExprResult (line 61) | ExprResult(bool _IsValid, ExprHandle _Value) : IsValid(_IsValid), Valu...
method isValid (line 63) | bool isValid() {
method ExprHandle (line 66) | ExprHandle get() {
function ExprResult (line 1092) | ExprResult ParserImpl::ParseBinaryParenExpr(const Token &Name,
method ExprResult (line 58) | ExprResult() : IsValid(false) {}
method ExprResult (line 59) | ExprResult(ExprHandle _Value) : IsValid(true), Value(_Value) {}
method ExprResult (line 60) | ExprResult(ref<ConstantExpr> _Value) : IsValid(true), Value(_Value.get...
method ExprResult (line 61) | ExprResult(bool _IsValid, ExprHandle _Value) : IsValid(_IsValid), Valu...
method isValid (line 63) | bool isValid() {
method ExprHandle (line 66) | ExprHandle get() {
function ExprResult (line 1140) | ExprResult ParserImpl::ParseSelectParenExpr(const Token &Name,
method ExprResult (line 58) | ExprResult() : IsValid(false) {}
method ExprResult (line 59) | ExprResult(ExprHandle _Value) : IsValid(true), Value(_Value) {}
method ExprResult (line 60) | ExprResult(ref<ConstantExpr> _Value) : IsValid(true), Value(_Value.get...
method ExprResult (line 61) | ExprResult(bool _IsValid, ExprHandle _Value) : IsValid(_IsValid), Valu...
method isValid (line 63) | bool isValid() {
method ExprHandle (line 66) | ExprHandle get() {
function ExprResult (line 1159) | ExprResult ParserImpl::ParseConcatParenExpr(const Token &Name,
method ExprResult (line 58) | ExprResult() : IsValid(false) {}
method ExprResult (line 59) | ExprResult(ExprHandle _Value) : IsValid(true), Value(_Value) {}
method ExprResult (line 60) | ExprResult(ref<ConstantExpr> _Value) : IsValid(true), Value(_Value.get...
method ExprResult (line 61) | ExprResult(bool _IsValid, ExprHandle _Value) : IsValid(_IsValid), Valu...
method isValid (line 63) | bool isValid() {
method ExprHandle (line 66) | ExprHandle get() {
function IntegerResult (line 1188) | IntegerResult ParserImpl::ParseIntegerConstant(Expr::Width Type) {
function ExprResult (line 1197) | ExprResult ParserImpl::ParseExtractParenExpr(const Token &Name,
method ExprResult (line 58) | ExprResult() : IsValid(false) {}
method ExprResult (line 59) | ExprResult(ExprHandle _Value) : IsValid(true), Value(_Value) {}
method ExprResult (line 60) | ExprResult(ref<ConstantExpr> _Value) : IsValid(true), Value(_Value.get...
method ExprResult (line 61) | ExprResult(bool _IsValid, ExprHandle _Value) : IsValid(_IsValid), Valu...
method isValid (line 63) | bool isValid() {
method ExprHandle (line 66) | ExprHandle get() {
function ExprResult (line 1216) | ExprResult ParserImpl::ParseAnyReadParenExpr(const Token &Name,
method ExprResult (line 58) | ExprResult() : IsValid(false) {}
method ExprResult (line 59) | ExprResult(ExprHandle _Value) : IsValid(true), Value(_Value) {}
method ExprResult (line 60) | ExprResult(ref<ConstantExpr> _Value) : IsValid(true), Value(_Value.get...
method ExprResult (line 61) | ExprResult(bool _IsValid, ExprHandle _Value) : IsValid(_IsValid), Valu...
method isValid (line 63) | bool isValid() {
method ExprHandle (line 66) | ExprHandle get() {
function VersionResult (line 1281) | VersionResult ParserImpl::ParseVersionSpecifier() {
type WriteInfo (line 1321) | struct WriteInfo {
method WriteInfo (line 1327) | WriteInfo(NumberOrExprResult _LHS, NumberOrExprResult _RHS,
function VersionResult (line 1337) | VersionResult ParserImpl::ParseVersion() {
function ExprResult (line 1417) | ExprResult ParserImpl::ParseNumber(Expr::Width Type) {
method ExprResult (line 58) | ExprResult() : IsValid(false) {}
method ExprResult (line 59) | ExprResult(ExprHandle _Value) : IsValid(true), Value(_Value) {}
method ExprResult (line 60) | ExprResult(ref<ConstantExpr> _Value) : IsValid(true), Value(_Value.get...
method ExprResult (line 61) | ExprResult(bool _IsValid, ExprHandle _Value) : IsValid(_IsValid), Valu...
method isValid (line 63) | bool isValid() {
method ExprHandle (line 66) | ExprHandle get() {
function ExprResult (line 1425) | ExprResult ParserImpl::ParseNumberToken(Expr::Width Type, const Token &T...
method ExprResult (line 58) | ExprResult() : IsValid(false) {}
method ExprResult (line 59) | ExprResult(ExprHandle _Value) : IsValid(true), Value(_Value) {}
method ExprResult (line 60) | ExprResult(ref<ConstantExpr> _Value) : IsValid(true), Value(_Value.get...
method ExprResult (line 61) | ExprResult(bool _IsValid, ExprHandle _Value) : IsValid(_IsValid), Valu...
method isValid (line 63) | bool isValid() {
method ExprHandle (line 66) | ExprHandle get() {
function TypeResult (line 1509) | TypeResult ParserImpl::ParseTypeSpecifier() {
function Parser (line 1610) | Parser *Parser::Create(const std::string Filename,
FILE: klee/lib/Expr/Updates.cpp
function UpdateList (line 82) | UpdateList &UpdateList::operator=(const UpdateList &b) {
FILE: klee/lib/Module/InstructionInfoTable.cpp
class InstructionToLineAnnotator (line 36) | class InstructionToLineAnnotator : public llvm::AssemblyAnnotationWriter {
method emitInstructionAnnot (line 39) | void emitInstructionAnnot(const Instruction *i, llvm::raw_ostream &os) {
method emitInstructionAnnot (line 43) | void emitInstructionAnnot(const Instruction *i, llvm::formatted_raw_os...
function buildInstructionToLineMap (line 49) | static void buildInstructionToLineMap(Module *m,
function getDSPIPath (line 76) | static std::string getDSPIPath(const DbgStopPointInst *dspi) {
function getDSPIPath (line 91) | static std::string getDSPIPath(DILocation Loc) {
function InstructionInfo (line 217) | const InstructionInfo &
function InstructionInfo (line 228) | const InstructionInfo &
FILE: klee/lib/Module/IntrinsicCleaner.cpp
type klee (line 34) | namespace klee {
function Value (line 39) | static Value *LowerBSWAP(LLVMContext &Context, Value *V, Instruction *IP)
function CallInst (line 105) | static CallInst *ReplaceCallWith(const char *NewFn, CallInst *CI,
function ReplaceFPIntrinsicWithCall (line 134) | static void ReplaceFPIntrinsicWithCall(CallInst *CI, const char *Fname,
FILE: klee/lib/Module/KModule.cpp
type SwitchImplType (line 51) | enum SwitchImplType {
type llvm (line 90) | namespace llvm {
type klee (line 94) | namespace klee {
type KModulePrivate (line 96) | struct KModulePrivate {
method KModulePrivate (line 100) | KModulePrivate(llvm::Module *module,
function Function (line 176) | static Function *getStubFunctionForCtorList(Module *m,
function injectStaticConstructorsAndDestructors (line 220) | static void injectStaticConstructorsAndDestructors(Module *m) {
function forceImport (line 242) | static void forceImport(Module *m, const char *name, Type *retType, ...) {
function KFunction (line 550) | KFunction* KModule::updateModuleWithFunction(llvm::Function *f)
function KConstant (line 600) | KConstant* KModule::getKConstant(Constant *c) {
function getOperandNum (line 630) | static int getOperandNum(Value *v,
FILE: klee/lib/Module/LowerSwitch.cpp
type klee (line 25) | namespace klee {
type SwitchCaseCmp (line 30) | struct SwitchCaseCmp {
FILE: klee/lib/Module/ModuleUtil.cpp
function Module (line 33) | Module *klee::linkWithLibrary(Module *module,
function Function (line 47) | Function *klee::getDirectCallTarget(const Instruction *i) {
function valueIsOnlyCalled (line 66) | static bool valueIsOnlyCalled(const Value *v) {
FILE: klee/lib/Module/Optimize.cpp
function addPass (line 74) | static inline void addPass(PassManagerBase &PM, Pass *P) {
type llvm (line 86) | namespace llvm {
function AddStandardCompilePasses (line 89) | static void AddStandardCompilePasses(PassManagerBase &PM) {
function CreateOptimizePasses (line 165) | void CreateOptimizePasses(PassManagerBase& Passes, Module* M) {
FILE: klee/lib/Module/Passes.h
function namespace (line 19) | namespace llvm {
function namespace (line 27) | namespace klee {
function class (line 54) | class IntrinsicCleanerPass : public llvm::ModulePass {
function class (line 80) | class IntrinsicFunctionCleanerPass : public llvm::FunctionPass {
function class (line 102) | class PhiCleanerPass : public llvm::FunctionPass {
function class (line 111) | class DivCheckPass : public llvm::ModulePass {
function class (line 121) | class LowerSwitchPass : public llvm::FunctionPass {
FILE: klee/lib/Module/RaiseAsm.cpp
function Function (line 22) | Function *RaiseAsmPass::getIntrinsic(llvm::Module &M,
FILE: klee/lib/SMT/SMTParser.cpp
function Decl (line 64) | Decl* SMTParser::ParseTopLevelDecl() {
function ExprHandle (line 123) | ExprHandle SMTParser::CreateAnd(std::vector<ExprHandle> kids) {
function ExprHandle (line 135) | ExprHandle SMTParser::CreateOr(std::vector<ExprHandle> kids) {
function ExprHandle (line 147) | ExprHandle SMTParser::CreateXor(std::vector<ExprHandle> kids) {
function ExprHandle (line 184) | ExprHandle SMTParser::GetConstExpr(std::string val, uint8_t base, klee::...
function ExprHandle (line 213) | ExprHandle SMTParser::GetVar(std::string name) {
function ExprHandle (line 241) | ExprHandle SMTParser::GetFVar(std::string name) {
FILE: klee/lib/SMT/SMTParser.h
function namespace (line 22) | namespace klee {
FILE: klee/lib/SMT/main.cpp
function main (line 10) | int main(int argc, char** argv) {
FILE: klee/lib/Solver/CachingSolver.cpp
class CachingSolver (line 24) | class CachingSolver : public SolverImpl {
type CacheEntry (line 35) | struct CacheEntry {
method CacheEntry (line 36) | CacheEntry(const ConstraintManager &c, ref<Expr> q)
method CacheEntry (line 39) | CacheEntry(const CacheEntry &ce)
type CacheEntryHash (line 50) | struct CacheEntryHash {
method CachingSolver (line 70) | CachingSolver(Solver *s) : solver(s) {}
method computeValue (line 75) | bool computeValue(const Query& query, ref<Expr> &result) {
method computeInitialValues (line 78) | bool computeInitialValues(const Query& query,
function Solver (line 239) | Solver *klee::createCachingSolver(Solver *_solver) {
FILE: klee/lib/Solver/CexCachingSolver.cpp
type AssignmentLessThan (line 46) | struct AssignmentLessThan {
class CexCachingSolver (line 53) | class CexCachingSolver : public SolverImpl {
method lookupAssignment (line 67) | bool lookupAssignment(const Query& query, Assignment *&result) {
method CexCachingSolver (line 75) | CexCachingSolver(Solver *_solver) : solver(_solver) {}
type NullAssignment (line 89) | struct NullAssignment {
type NonNullAssignment (line 93) | struct NonNullAssignment {
type NullOrSatisfyingAssignment (line 97) | struct NullOrSatisfyingAssignment {
method NullOrSatisfyingAssignment (line 100) | NullOrSatisfyingAssignment(KeyType &_key) : key(_key) {}
function Solver (line 346) | Solver *klee::createCexCachingSolver(Solver *_solver) {
FILE: klee/lib/Solver/ConstantDivision.cpp
type klee (line 17) | namespace klee {
function ones (line 43) | static uint32_t ones( register uint32_t x ) {
function ldz (line 54) | static uint32_t ldz( register uint32_t x ) {
function exp_base_2 (line 65) | static uint32_t exp_base_2( register int32_t n ) {
function ComputeMultConstants64 (line 82) | void ComputeMultConstants64(uint64_t multiplicand,
function ComputeUDivConstants32 (line 118) | void ComputeUDivConstants32(uint32_t d, uint32_t &mprime, uint32_t &sh1,
function ComputeSDivConstants32 (line 128) | void ComputeSDivConstants32(int32_t d, int32_t &mprime, int32_t &dsign,
FILE: klee/lib/Solver/ConstantDivision.h
function namespace (line 15) | namespace klee {
FILE: klee/lib/Solver/FastCexSolver.cpp
function minOR (line 32) | static uint64_t minOR(uint64_t a, uint64_t b,
function maxOR (line 48) | static uint64_t maxOR(uint64_t a, uint64_t b,
function minAND (line 64) | static uint64_t minAND(uint64_t a, uint64_t b,
function maxAND (line 79) | static uint64_t maxAND(uint64_t a, uint64_t b,
class ValueRange (line 98) | class ValueRange {
method ValueRange (line 103) | ValueRange() : m_min(1),m_max(0) {}
method ValueRange (line 104) | ValueRange(const ref<ConstantExpr> &ce) {
method ValueRange (line 108) | ValueRange(uint64_t value) : m_min(value), m_max(value) {}
method ValueRange (line 109) | ValueRange(uint64_t _min, uint64_t _max) : m_min(_min), m_max(_max) {}
method ValueRange (line 110) | ValueRange(const ValueRange &b) : m_min(b.m_min), m_max(b.m_max) {}
method print (line 112) | void print(llvm::raw_ostream &os) const {
method isEmpty (line 120) | bool isEmpty() const {
method contains (line 123) | bool contains(uint64_t value) const {
method intersects (line 126) | bool intersects(const ValueRange &b) const {
method isFullRange (line 130) | bool isFullRange(unsigned bits) {
method ValueRange (line 134) | ValueRange set_intersection(const ValueRange &b) const {
method ValueRange (line 137) | ValueRange set_union(const ValueRange &b) const {
method ValueRange (line 140) | ValueRange set_difference(const ValueRange &b) const {
method ValueRange (line 156) | ValueRange binaryAnd(const ValueRange &b) const {
method ValueRange (line 166) | ValueRange binaryAnd(uint64_t b) const { return binaryAnd(ValueRange(b...
method ValueRange (line 167) | ValueRange binaryOr(ValueRange b) const {
method ValueRange (line 177) | ValueRange binaryOr(uint64_t b) const { return binaryOr(ValueRange(b)); }
method ValueRange (line 178) | ValueRange binaryXor(ValueRange b) const {
method ValueRange (line 189) | ValueRange binaryShiftLeft(unsigned bits) const {
method ValueRange (line 192) | ValueRange binaryShiftRight(unsigned bits) const {
method ValueRange (line 196) | ValueRange concat(const ValueRange &b, unsigned bits) const {
method ValueRange (line 199) | ValueRange extract(uint64_t lowBit, uint64_t maxBit) const {
method ValueRange (line 203) | ValueRange add(const ValueRange &b, unsigned width) const {
method ValueRange (line 206) | ValueRange sub(const ValueRange &b, unsigned width) const {
method ValueRange (line 209) | ValueRange mul(const ValueRange &b, unsigned width) const {
method ValueRange (line 212) | ValueRange udiv(const ValueRange &b, unsigned width) const {
method ValueRange (line 215) | ValueRange sdiv(const ValueRange &b, unsigned width) const {
method ValueRange (line 218) | ValueRange urem(const ValueRange &b, unsigned width) const {
method ValueRange (line 221) | ValueRange srem(const ValueRange &b, unsigned width) const {
method isFixed (line 227) | bool isFixed() const { return m_min==m_max; }
method mustEqual (line 234) | bool mustEqual(const uint64_t b) const { return m_min==m_max && m_min=...
method mayEqual (line 235) | bool mayEqual(const uint64_t b) const { return m_min<=b && m_max>=b; }
method mustEqual (line 237) | bool mustEqual(const ValueRange &b) const {
method mayEqual (line 240) | bool mayEqual(const ValueRange &b) const { return this->intersects(b); }
method min (line 242) | uint64_t min() const {
method max (line 247) | uint64_t max() const {
method minSigned (line 252) | int64_t minSigned(unsigned bits) const {
method maxSigned (line 268) | int64_t maxSigned(unsigned bits) const {
class CexObjectData (line 294) | class CexObjectData {
method CexObjectData (line 311) | CexObjectData(uint64_t size) : possibleContents(size), exactContents(s...
method CexValueData (line 318) | const CexValueData getPossibleValues(size_t index) const {
method setPossibleValues (line 321) | void setPossibleValues(size_t index, CexValueData values) {
method setPossibleValue (line 324) | void setPossibleValue(size_t index, unsigned char value) {
method CexValueData (line 328) | const CexValueData getExactValues(size_t index) const {
method setExactValues (line 331) | void setExactValues(size_t index, CexValueData values) {
method getPossibleValue (line 336) | unsigned char getPossibleValue(size_t index) const {
class CexRangeEvaluator (line 342) | class CexRangeEvaluator : public ExprRangeEvaluator<ValueRange> {
method CexRangeEvaluator (line 345) | CexRangeEvaluator(std::map<const Array*, CexObjectData*> &_objects)
method ValueRange (line 348) | ValueRange getInitialReadRange(const Array &array, ValueRange index) {
class CexPossibleEvaluator (line 359) | class CexPossibleEvaluator : public ExprEvaluator {
method getInitialValue (line 361) | ref<Expr> getInitialValue(const Array& array, unsigned index) {
method CexPossibleEvaluator (line 376) | CexPossibleEvaluator(std::map<const Array*, CexObjectData*> &_objects)
class CexExactEvaluator (line 380) | class CexExactEvaluator : public ExprEvaluator {
method getInitialValue (line 382) | ref<Expr> getInitialValue(const Array& array, unsigned index) {
method CexExactEvaluator (line 404) | CexExactEvaluator(std::map<const Array*, CexObjectData*> &_objects)
class CexData (line 412) | class CexData {
method CexData (line 420) | CexData() {}
method CexObjectData (line 427) | CexObjectData &getObjectData(const Array *A) {
method propogatePossibleValue (line 436) | void propogatePossibleValue(ref<Expr> e, uint64_t value) {
method propogateExactValue (line 440) | void propogateExactValue(ref<Expr> e, uint64_t value) {
method propogatePossibleValues (line 444) | void propogatePossibleValues(ref<Expr> e, CexValueData range) {
method propogateExactValues (line 785) | void propogateExactValues(ref<Expr> e, CexValueData range) {
method ValueRange (line 925) | ValueRange evalRangeForExpr(const ref<Expr> &e) {
method evaluatePossible (line 932) | ref<Expr> evaluatePossible(ref<Expr> e) {
method evaluateExact (line 936) | ref<Expr> evaluateExact(ref<Expr> e) {
method dump (line 940) | void dump() {
class FastCexSolver (line 969) | class FastCexSolver : public IncompleteSolver {
function propogateValues (line 1000) | static bool propogateValues(const Query& query, CexData &cd,
function Solver (line 1136) | Solver *klee::createFastCexSolver(Solver *s) {
FILE: klee/lib/Solver/IndependentSolver.cpp
class DenseSet (line 27) | class DenseSet {
method DenseSet (line 32) | DenseSet() {}
method add (line 34) | void add(T x) {
method add (line 37) | void add(T start, T end) {
method add (line 43) | bool add(const DenseSet &b) {
method intersects (line 55) | bool intersects(const DenseSet &b) {
method print (line 63) | void print(llvm::raw_ostream &os) const {
class IndependentElementSet (line 85) | class IndependentElementSet {
method IndependentElementSet (line 91) | IndependentElementSet() {}
method IndependentElementSet (line 92) | IndependentElementSet(ref<Expr> e) {
method IndependentElementSet (line 117) | IndependentElementSet(const IndependentElementSet &ies) :
method IndependentElementSet (line 121) | IndependentElementSet &operator=(const IndependentElementSet &ies) {
method print (line 127) | void print(llvm::raw_ostream &os) const {
method intersects (line 159) | bool intersects(const IndependentElementSet &b) {
method add (line 182) | bool add(const IndependentElementSet &b) {
function IndependentElementSet (line 222) | static
method IndependentElementSet (line 91) | IndependentElementSet() {}
method IndependentElementSet (line 92) | IndependentElementSet(ref<Expr> e) {
method IndependentElementSet (line 117) | IndependentElementSet(const IndependentElementSet &ies) :
method IndependentElementSet (line 121) | IndependentElementSet &operator=(const IndependentElementSet &ies) {
method print (line 127) | void print(llvm::raw_ostream &os) const {
method intersects (line 159) | bool intersects(const IndependentElementSet &b) {
method add (line 182) | bool add(const IndependentElementSet &b) {
class IndependentSolver (line 268) | class IndependentSolver : public SolverImpl {
method IndependentSolver (line 273) | IndependentSolver(Solver *_solver)
method computeInitialValues (line 280) | bool computeInitialValues(const Query& query,
function Solver (line 316) | Solver *klee::createIndependentSolver(Solver *s) {
FILE: klee/lib/Solver/PCLoggingSolver.cpp
class PCLoggingSolver (line 32) | class PCLoggingSolver : public SolverImpl {
method startQuery (line 39) | void startQuery(const Query& query, const char *typeName,
method finishQuery (line 57) | void finishQuery(bool success) {
method PCLoggingSolver (line 65) | PCLoggingSolver(Solver *_solver, std::string path)
method computeTruth (line 79) | bool computeTruth(const Query& query, bool &isValid) {
method computeValidity (line 90) | bool computeValidity(const Query& query, Solver::Validity &result) {
method computeValue (line 101) | bool computeValue(const Query& query, ref<Expr> &result) {
method computeInitialValues (line 113) | bool computeInitialValues(const Query& query,
function Solver (line 154) | Solver *klee::createPCLoggingSolver(Solver *_solver, std::string path) {
FILE: klee/lib/Solver/STPBuilder.cpp
function ExprHandle (line 93) | ExprHandle STPBuilder::getTempVar(Expr::Width w) {
function ExprHandle (line 103) | ExprHandle STPBuilder::getTrue() {
function ExprHandle (line 106) | ExprHandle STPBuilder::getFalse() {
function ExprHandle (line 109) | ExprHandle STPBuilder::bvOne(unsigned width) {
function ExprHandle (line 112) | ExprHandle STPBuilder::bvZero(unsigned width) {
function ExprHandle (line 115) | ExprHandle STPBuilder::bvMinusOne(unsigned width) {
function ExprHandle (line 118) | ExprHandle STPBuilder::bvConst32(unsigned width, uint32_t value) {
function ExprHandle (line 121) | ExprHandle STPBuilder::bvConst64(unsigned width, uint64_t value) {
function ExprHandle (line 125) | ExprHandle STPBuilder::bvBoolExtract(ExprHandle expr, int bit) {
function ExprHandle (line 128) | ExprHandle STPBuilder::bvExtract(ExprHandle expr, unsigned top, unsigned...
function ExprHandle (line 131) | ExprHandle STPBuilder::eqExpr(ExprHandle a, ExprHandle b) {
function ExprHandle (line 136) | ExprHandle STPBuilder::bvRightShift(ExprHandle expr, unsigned amount, un...
function ExprHandle (line 152) | ExprHandle STPBuilder::bvLeftShift(ExprHandle expr, unsigned amount, uns...
function ExprHandle (line 170) | ExprHandle STPBuilder::bvVarLeftShift(ExprHandle expr, ExprHandle amount...
function ExprHandle (line 189) | ExprHandle STPBuilder::bvVarRightShift(ExprHandle expr, ExprHandle amoun...
function ExprHandle (line 209) | ExprHandle STPBuilder::bvVarArithRightShift(ExprHandle expr, ExprHandle ...
function ExprHandle (line 237) | ExprHandle STPBuilder::constructAShrByConstant(ExprHandle expr,
function ExprHandle (line 258) | ExprHandle STPBuilder::constructMulByConstant(ExprHandle expr, unsigned ...
function ExprHandle (line 312) | ExprHandle STPBuilder::constructUDivByConstant(ExprHandle expr_n, unsign...
function ExprHandle (line 349) | ExprHandle STPBuilder::constructSDivByConstant(ExprHandle expr_n, unsign...
function ExprHandle (line 415) | ExprHandle STPBuilder::getInitialRead(const Array *root, unsigned index) {
function ExprHandle (line 437) | ExprHandle STPBuilder::construct(ref<Expr> e, int *width_out) {
function ExprHandle (line 460) | ExprHandle STPBuilder::constructActual(ref<Expr> e, int *width_out) {
FILE: klee/lib/Solver/STPBuilder.h
function namespace (line 31) | namespace klee {
FILE: klee/lib/Solver/Solver.cpp
class ValidatingSolver (line 271) | class ValidatingSolver : public SolverImpl {
method ValidatingSolver (line 276) | ValidatingSolver(Solver *_solver, Solver *_oracle)
function Solver (line 463) | Solver *klee::createValidatingSolver(Solver *s, Solver *oracle) {
class DummySolverImpl (line 469) | class DummySolverImpl : public SolverImpl {
method DummySolverImpl (line 471) | DummySolverImpl() {}
method computeValidity (line 473) | bool computeValidity(const Query&, Solver::Validity &result) {
method computeTruth (line 478) | bool computeTruth(const Query&, bool &isValid) {
method computeValue (line 483) | bool computeValue(const Query&, ref<Expr> &result) {
method computeInitialValues (line 488) | bool computeInitialValues(const Query&,
function Solver (line 498) | Solver *klee::createDummySolver() {
class STPSolverImpl (line 504) | class STPSolverImpl : public SolverImpl {
method setTimeout (line 520) | void setTimeout(double _timeout) { timeout = _timeout; }
function stp_error_handler (line 534) | static void stp_error_handler(const char* err_msg) {
function runAndGetCex (line 660) | static void runAndGetCex(::VC vc, STPBuilder *builder, ::VCExpr q,
function stpTimeoutHandler (line 709) | static void stpTimeoutHandler(int x) {
function runAndGetCexForked (line 713) | static bool runAndGetCexForked(::VC vc,
FILE: klee/lib/Support/TreeStream.cpp
function TreeOStream (line 48) | TreeOStream TreeStreamWriter::open() {
function TreeOStream (line 52) | TreeOStream TreeStreamWriter::open(const TreeOStream &os) {
function TreeOStream (line 192) | TreeOStream &TreeOStream::operator<<(const std::string &s) {
FILE: klee/runtime/Intrinsic/klee_div_zero_check.c
function klee_div_zero_check (line 12) | void klee_div_zero_check(long long z) {
FILE: klee/runtime/Intrinsic/klee_int.c
function klee_int (line 13) | int klee_int(const char *name) {
FILE: klee/runtime/Intrinsic/klee_range.c
function klee_range (line 13) | int klee_range(int start, int end, const char* name) {
FILE: klee/runtime/POSIX/fd.c
function exe_disk_file_t (line 39) | static exe_disk_file_t *__get_sym_file(const char *pathname) {
function exe_file_t (line 63) | static exe_file_t *__get_file(int fd) {
function access (line 73) | int access(const char *pathname, int mode) {
function mode_t (line 88) | mode_t umask(mode_t mask) {
function has_permission (line 97) | static int has_permission(int flags, struct stat64 *s) {
function __fd_open (line 128) | int __fd_open(const char *pathname, int flags, mode_t mode) {
function close (line 201) | int close(int fd) {
function read (line 233) | ssize_t read(int fd, void *buf, size_t count) {
function write (line 301) | ssize_t write(int fd, const void *buf, size_t count) {
function off64_t (line 373) | off64_t __fd_lseek(int fd, off64_t offset, int whence) {
function __fd_stat (line 430) | int __fd_stat(const char *path, struct stat64 *buf) {
function __fd_lstat (line 449) | int __fd_lstat(const char *path, struct stat64 *buf) {
function chdir (line 468) | int chdir(const char *path) {
function fchdir (line 486) | int fchdir(int fd) {
function __df_chmod (line 507) | static int __df_chmod(exe_disk_file_t *df, mode_t mode) {
function chmod (line 520) | int chmod(const char *path, mode_t mode) {
function fchmod (line 542) | int fchmod(int fd, mode_t mode) {
function __df_chown (line 569) | static int __df_chown(exe_disk_file_t *df, uid_t owner, gid_t group) {
function chown (line 575) | int chown(const char *path, uid_t owner, gid_t group) {
function fchown (line 588) | int fchown(int fd, uid_t owner, gid_t group) {
function lchown (line 606) | int lchown(const char *path, uid_t owner, gid_t group) {
function __fd_fstat (line 620) | int __fd_fstat(int fd, struct stat64 *buf) {
function __fd_ftruncate (line 643) | int __fd_ftruncate(int fd, off64_t length) {
function __fd_getdents (line 676) | int __fd_getdents(unsigned int fd, struct dirent64 *dirp, unsigned int c...
function ioctl (line 760) | int ioctl(int fd, unsigned long request, ...) {
function fcntl (line 908) | int fcntl(int fd, int cmd, ...) {
function __fd_statfs (line 963) | int __fd_statfs(const char *path, struct statfs *buf) {
function fstatfs (line 980) | int fstatfs(int fd, struct statfs *buf) {
function fsync (line 1000) | int fsync(int fd) {
function dup2 (line 1016) | int dup2(int oldfd, int newfd) {
function dup (line 1041) | int dup(int oldfd) {
function rmdir (line 1060) | int rmdir(const char *pathname) {
function unlink (line 1078) | int unlink(const char *pathname) {
function readlink (line 1099) | ssize_t readlink(const char *path, char *buf, size_t bufsize) {
function select (line 1131) | int select(int nfds, fd_set *read, fd_set *write,
function __concretize_size (line 1259) | static size_t __concretize_size(size_t s) {
function chroot (line 1294) | int chroot(const char *path) {
FILE: klee/runtime/POSIX/fd.h
type exe_disk_file_t (line 20) | typedef struct {
type exe_file_flag_t (line 26) | typedef enum {
type exe_file_t (line 33) | typedef struct {
type exe_file_system_t (line 42) | typedef struct {
type exe_sym_env_t (line 61) | typedef struct {
type stat64 (line 83) | struct stat64
type stat64 (line 84) | struct stat64
type stat64 (line 85) | struct stat64
type statfs (line 87) | struct statfs
type dirent64 (line 88) | struct dirent64
FILE: klee/runtime/POSIX/fd_32.c
function __stat64_to_stat (line 30) | static void __stat64_to_stat(struct stat64 *a, struct stat *b) {
function open (line 48) | int open(const char *pathname, int flags, ...) {
function off_t (line 62) | off_t lseek(int fd, off_t off, int whence) {
function __xstat (line 66) | int __xstat(int vers, const char *path, struct stat *buf) {
function stat (line 73) | int stat(const char *path, struct stat *buf) {
function __lxstat (line 80) | int __lxstat(int vers, const char *path, struct stat *buf) {
function lstat (line 87) | int lstat(const char *path, struct stat *buf) {
function __fxstat (line 94) | int __fxstat(int vers, int fd, struct stat *buf) {
function fstat (line 101) | int fstat(int fd, struct stat *buf) {
function ftruncate (line 108) | int ftruncate(int fd, off_t length) {
function statfs (line 112) | int statfs(const char *path, struct statfs *buf32) {
function getdents (line 137) | ssize_t getdents(int fd, struct dirent *dirp, size_t nbytes) {
type dirent (line 158) | struct dirent
function open64 (line 164) | int open64(const char *pathname, int flags, ...) {
function off64_t (line 179) | off64_t lseek64(int fd, off64_t off, int whence) {
type stat64 (line 183) | struct stat64
function stat64 (line 184) | int stat64(const char *path, struct stat64 *buf) {
type stat64 (line 188) | struct stat64
function lstat64 (line 189) | int lstat64(const char *path, struct stat64 *buf) {
type stat64 (line 193) | struct stat64
function fstat64 (line 194) | int fstat64(int fd, struct stat64 *buf) {
FILE: klee/runtime/POSIX/fd_64.c
function open (line 35) | int open(const char *pathname, int flags, ...) {
function off64_t (line 49) | off64_t lseek(int fd, off64_t offset, int whence) {
function __xstat (line 53) | int __xstat(int vers, const char *path, struct stat *buf) {
function stat (line 57) | int stat(const char *path, struct stat *buf) {
function __lxstat (line 61) | int __lxstat(int vers, const char *path, struct stat *buf) {
function lstat (line 65) | int lstat(const char *path, struct stat *buf) {
function __fxstat (line 69) | int __fxstat(int vers, int fd, struct stat *buf) {
function fstat (line 73) | int fstat(int fd, struct stat *buf) {
function ftruncate64 (line 77) | int ftruncate64(int fd, off64_t length) {
type statfs (line 81) | struct statfs
function statfs (line 82) | int statfs(const char *path, struct statfs *buf) {
function getdents64 (line 86) | int getdents64(unsigned int fd, struct dirent *dirp, unsigned int count) {
type dirent (line 89) | struct dirent
FILE: klee/runtime/POSIX/fd_init.c
function __create_new_dfile (line 46) | static void __create_new_dfile(exe_disk_file_t *dfile, unsigned size,
function __sym_uint32 (line 97) | static unsigned __sym_uint32(const char *name) {
function klee_init_fds (line 110) | void klee_init_fds(unsigned n_files, unsigned file_length,
FILE: klee/runtime/POSIX/illegal.c
function kill (line 22) | int kill(pid_t pid, int sig) {
type __jmp_buf_tag (line 28) | struct __jmp_buf_tag
function _setjmp (line 29) | int _setjmp (struct __jmp_buf_tag __env[1]) {
function longjmp (line 34) | void longjmp(jmp_buf env, int val) {
function execl (line 55) | int execl(const char *path, const char *arg, ...) { return __bad_exec(); }
function execlp (line 56) | int execlp(const char *file, const char *arg, ...) { return __bad_exec(); }
function execle (line 57) | int execle(const char *path, const char *arg, ...) { return __bad_exec(...
function execv (line 58) | int execv(const char *path, char *const argv[]) { return __bad_exec(); }
function execvp (line 59) | int execvp(const char *file, char *const argv[]) { return __bad_exec(); }
function execve (line 60) | int execve(const char *file, char *const argv[], char *const envp[]) { r...
function pid_t (line 62) | pid_t fork(void) {
function pid_t (line 68) | pid_t vfork(void) {
FILE: klee/runtime/POSIX/klee_init_env.c
function __emit_error (line 21) | static void __emit_error(const char *msg) {
function __str_to_int (line 28) | static long int __str_to_int(char *s, const char *error_msg) {
function __isprint (line 46) | static int __isprint(const char c) {
function __streq (line 51) | static int __streq(const char *a, const char *b) {
function __add_arg (line 74) | static void __add_arg(int *argc, char **argv, char *arg, int argcMax) {
function klee_init_env (line 83) | void klee_init_env(int* argcPtr, char*** argvPtr) {
FILE: klee/runtime/POSIX/misc.c
type sym_env_var (line 20) | typedef struct {
function __klee_init_environ (line 29) | void __klee_init_environ(unsigned nvars,
function __strlen (line 39) | static size_t __strlen(const char *s) {
FILE: klee/runtime/POSIX/selinux.c
function is_selinux_enabled (line 29) | int is_selinux_enabled() {
function getfscreatecon (line 36) | int getfscreatecon(security_context_t *context) {
function setfscreatecon (line 42) | int setfscreatecon(security_context_t context) {
function setfilecon (line 59) | int setfilecon(const char *path, security_context_t con) {
function lsetfilecon (line 67) | int lsetfilecon(const char *path, security_context_t con) {
function fsetfilecon (line 71) | int fsetfilecon(int fd, security_context_t con) {
function freecon (line 77) | void freecon(security_context_t con) {}
function freeconary (line 78) | void freeconary(security_context_t *con) {}
FILE: klee/runtime/POSIX/stubs.c
type sigaction (line 33) | struct sigaction
type sigaction (line 34) | struct sigaction
function __syscall_rt_sigaction (line 37) | int __syscall_rt_sigaction(int signum, const struct sigaction *act,
type sigaction (line 43) | struct sigaction
type sigaction (line 44) | struct sigaction
function sigaction (line 46) | int sigaction(int signum, const struct sigaction *act,
function sigprocmask (line 54) | int sigprocmask(int how, const sigset_t *set, sigset_t *oldset) {
function fdatasync (line 61) | int fdatasync(int fd) {
function sync (line 67) | void sync(void) {
function __socketcall (line 76) | int __socketcall(int type, int *args) {
function _IO_getc (line 83) | int _IO_getc(FILE *f) {
function _IO_putc (line 88) | int _IO_putc(int c, FILE *f) {
function mkdir (line 93) | int mkdir(const char *pathname, mode_t mode) {
function mkfifo (line 100) | int mkfifo(const char *pathname, mode_t mode) {
function mknod (line 107) | int mknod(const char *pathname, mode_t mode, dev_t dev) {
function pipe (line 114) | int pipe(int filedes[2]) {
function link (line 121) | int link(const char *oldpath, const char *newpath) {
function symlink (line 128) | int symlink(const char *oldpath, const char *newpath) {
function rename (line 135) | int rename(const char *oldpath, const char *newpath) {
type timespec (line 141) | struct timespec
type timespec (line 141) | struct timespec
function nanosleep (line 142) | int nanosleep(const struct timespec *req, struct timespec *rem) {
type timespec (line 147) | struct timespec
function clock_gettime (line 148) | int clock_gettime(clockid_t clk_id, struct timespec *res) {
type timespec (line 157) | struct timespec
function clock_settime (line 158) | int clock_settime(clockid_t clk_id, const struct timespec *res) {
function time_t (line 164) | time_t time(time_t *t) {
function clock_t (line 172) | clock_t times(struct tms *buf) {
type utmpx (line 181) | struct utmpx
type utmpx (line 182) | struct utmpx
type utmpx (line 183) | struct utmpx
function setutxent (line 187) | void setutxent(void) {
function endutxent (line 192) | void endutxent(void) {
function utmpxname (line 197) | int utmpxname(const char *file) {
function euidaccess (line 203) | int euidaccess(const char *pathname, int mode) {
function eaccess (line 208) | int eaccess(const char *pathname, int mode) {
function group_member (line 213) | int group_member (gid_t __gid) {
type utimbuf (line 217) | struct utimbuf
function utime (line 218) | int utime(const char *filename, const struct utimbuf *buf) {
type timeval (line 224) | struct timeval
function utimes (line 225) | int utimes(const char *filename, const struct timeval times[2]) {
type timeval (line 231) | struct timeval
function futimes (line 232) | int futimes(int fd, const struct timeval times[2]) {
function strverscmp (line 238) | int strverscmp (__const char *__s1, __const char *__s2) {
function gnu_dev_major (line 243) | unsigned int gnu_dev_major(unsigned long long int __dev) {
function gnu_dev_minor (line 248) | unsigned int gnu_dev_minor(unsigned long long int __dev) {
function gnu_dev_makedev (line 253) | unsigned long long int gnu_dev_makedev(unsigned int __major, unsigned in...
function getloadavg (line 269) | int getloadavg(double loadavg[], int nelem) {
function pid_t (line 275) | pid_t wait(int *status) {
type rusage (line 281) | struct rusage
function pid_t (line 282) | pid_t wait3(int *status, int options, struct rusage *rusage) {
type rusage (line 288) | struct rusage
function pid_t (line 289) | pid_t wait4(pid_t pid, int *status, int options, struct rusage *rusage) {
function pid_t (line 296) | pid_t waitpid(pid_t pid, int *status, int options) {
function pid_t (line 303) | pid_t waitid(idtype_t idtype, id_t id, siginfo_t *infop, int options) {
function acl_delete_def_file (line 318) | int acl_delete_def_file(const char *path_p) {
function acl_extended_file (line 325) | int acl_extended_file(const char path_p) {
function acl_entries (line 332) | int acl_entries(acl_t acl) {
function acl_t (line 339) | acl_t acl_from_mode(mode_t mode) {
function acl_t (line 346) | acl_t acl_get_fd(int fd) {
function acl_t (line 353) | acl_t acl_get_file(const char *pathname, acl_type_t type) {
function acl_set_fd (line 360) | int acl_set_fd(int fd, acl_t acl) {
function acl_set_file (line 367) | int acl_set_file(const char *path_p, acl_type_t type, acl_t acl) {
function acl_free (line 374) | int acl_free(void *obj_p) {
function mount (line 383) | int mount(const char *source, const char *target, const char *filesystem...
function umount (line 390) | int umount(const char *target) {
function umount2 (line 397) | int umount2(const char *target, int flags) {
function swapon (line 404) | int swapon(const char *path, int swapflags) {
function swapoff (line 411) | int swapoff(const char *path) {
function setgid (line 418) | int setgid(gid_t gid) {
function setgroups (line 424) | int setgroups(size_t size, const gid_t *list) {
function sethostname (line 431) | int sethostname(const char *name, size_t len) {
function setpgid (line 438) | int setpgid(pid_t pid, pid_t pgid) {
function setpgrp (line 445) | int setpgrp(void) {
function setpriority (line 452) | int setpriority(__priority_which_t which, id_t who, int prio) {
function setresgid (line 459) | int setresgid(gid_t rgid, gid_t egid, gid_t sgid) {
function setresuid (line 466) | int setresuid(uid_t ruid, uid_t euid, uid_t suid) {
type rlimit (line 472) | struct rlimit
function setrlimit (line 473) | int setrlimit(__rlimit_resource_t resource, const struct rlimit *rlim) {
type rlimit64 (line 479) | struct rlimit64
function setrlimit64 (line 480) | int setrlimit64(__rlimit_resource_t resource, const struct rlimit64 *rli...
function pid_t (line 487) | pid_t setsid(void) {
type timeval (line 493) | struct timeval
type timezone (line 493) | struct timezone
function settimeofday (line 494) | int settimeofday(const struct timeval *tv, const struct timezone *tz) {
function setuid (line 501) | int setuid(uid_t uid) {
function reboot (line 507) | int reboot(int flag) {
function mlock (line 514) | int mlock(const void *addr, size_t len) {
function munlock (line 521) | int munlock(const void *addr, size_t len) {
function pause (line 528) | int pause(void) {
function readahead (line 535) | ssize_t readahead(int fd, off64_t *offset, size_t count) {
function munmap (line 556) | int munmap(void*start, size_t length) {
FILE: klee/runtime/Runtest/intrinsics.c
function rand_byte (line 29) | static unsigned char rand_byte(void) {
function klee_make_symbolic (line 36) | void klee_make_symbolic(void *array, unsigned nbytes, const char *name) {
function klee_silent_exit (line 99) | void klee_silent_exit(int x) {
function klee_choose (line 103) | unsigned klee_choose(unsigned n) {
function klee_assume (line 112) | void klee_assume(unsigned x) {
function klee_get_value (line 118) | unsigned klee_get_value(unsigned x) {
function klee_range (line 122) | int klee_range(int begin, int end, const char* name) {
function klee_print_expr (line 135) | void klee_print_expr(const char *msg, ...) { }
function klee_set_forking (line 137) | void klee_set_forking(unsigned enable) { }
FILE: klee/runtime/klee-libc/__cxa_atexit.c
function RunAtExit (line 22) | static void RunAtExit(void) {
function __cxa_atexit (line 29) | int __cxa_atexit(void (*fn)(void*),
FILE: klee/runtime/klee-libc/abort.c
function abort (line 14) | void abort(void) {
FILE: klee/runtime/klee-libc/atexit.c
function atexit (line 14) | int atexit(void (*fn)(void)) {
FILE: klee/runtime/klee-libc/atoi.c
function atoi (line 35) | int atoi(const char *str) {
FILE: klee/runtime/klee-libc/htonl.c
function htons (line 26) | uint16_t htons(uint16_t v) {
function htonl (line 29) | uint32_t htonl(uint32_t v) {
function htons (line 35) | uint16_t htons(uint16_t v) {
function htonl (line 38) | uint32_t htonl(uint32_t v) {
function ntohs (line 44) | uint16_t ntohs(uint32_t v) {
function ntohl (line 47) | uint32_t ntohl(uint32_t v) {
FILE: klee/runtime/klee-libc/klee-choose.c
function klee_choose (line 12) | unsigned klee_choose(unsigned n) {
FILE: klee/runtime/klee-libc/memcmp.c
function memcmp (line 42) | int memcmp(const void *s1, const void *s2, size_t n) {
FILE: klee/runtime/klee-libc/putchar.c
function putchar (line 16) | int putchar(int c) {
FILE: klee/runtime/klee-libc/strcmp.c
function strcmp (line 10) | int strcmp(const char *a, const char *b) {
FILE: klee/runtime/klee-libc/strcoll.c
function strcoll (line 13) | int strcoll(const char *s1, const char *s2) {
FILE: klee/runtime/klee-libc/strlen.c
function strlen (line 12) | size_t strlen(const char *str) {
FILE: klee/runtime/klee-libc/strncmp.c
function strncmp (line 36) | int strncmp(const char *s1, const char *s2, size_t n)
FILE: klee/runtime/klee-libc/strtol.c
function strtol (line 46) | long
FILE: klee/runtime/klee-libc/strtoul.c
function strtoul (line 45) | unsigned long
FILE: klee/runtime/klee-libc/tolower.c
function tolower (line 10) | int tolower(int ch) {
FILE: klee/runtime/klee-libc/toupper.c
function toupper (line 10) | int toupper(int ch) {
FILE: klee/scripts/IStatsMerge.py
class MergeError (line 7) | class MergeError(Exception):
function checkAssemblies (line 10) | def checkAssemblies(directories):
function allEqual (line 23) | def allEqual(l):
function merge (line 26) | def merge(inputs, output, outputDir):
function main (line 148) | def main(args):
FILE: klee/scripts/IStatsSum.py
function getSummary (line 7) | def getSummary(input):
function main (line 101) | def main(args):
FILE: klee/stp/AST/AST.cpp
type BEEV (line 13) | namespace BEEV {
function ASTInterior (line 101) | ASTInterior *BeevMgr::LookupOrCreateInterior(ASTInterior *n_ptr) {
function ostream (line 171) | ostream &ASTNode::LispPrint(ostream &os, int indentation) const {
function ostream (line 179) | ostream &ASTNode::LispPrint_indent(ostream &os,
function ostream (line 190) | ostream &ASTNode::LispPrint1(ostream &os, int indentation) const {
function ostream (line 260) | ostream& ASTNode::PL_Print(ostream &os,
function ASTNode (line 658) | ASTNode BeevMgr::CreateNode(Kind kind, const ASTVec & back_children) {
function ASTNode (line 667) | ASTNode BeevMgr::CreateNode(Kind kind,
function ASTNode (line 678) | ASTNode BeevMgr::CreateNode(Kind kind,
function ASTNode (line 692) | ASTNode BeevMgr::CreateNode(Kind kind,
function ASTInterior (line 707) | ASTInterior *BeevMgr::CreateInteriorNode(Kind kind,
function ostream (line 730) | ostream &operator<<(ostream &os, const ASTNodeMap &nmap)
function ASTNode (line 743) | ASTNode BeevMgr::CreateSymbol(const char * const name)
function ASTNode (line 752) | ASTNode BeevMgr::CreateBVConst(unsigned int width,
function ASTNode (line 774) | ASTNode BeevMgr::CreateBVConst(const char* const strval, int base) {
function ASTNode (line 808) | ASTNode BeevMgr::CreateBVConst(CBV bv, unsigned width){
function ASTNode (line 817) | ASTNode BeevMgr::CreateZeroConst(unsigned width) {
function ASTNode (line 822) | ASTNode BeevMgr::CreateOneConst(unsigned width) {
function ASTNode (line 829) | ASTNode BeevMgr::CreateTwoConst(unsigned width) {
function ASTNode (line 837) | ASTNode BeevMgr::CreateMaxConst(unsigned width) {
function ASTBVConst (line 846) | ASTBVConst *BeevMgr::LookupOrCreateBVConst(ASTBVConst &s) {
function CBV (line 876) | CBV const ASTNode::GetBVConst() const {
function ASTNode (line 883) | ASTNode BeevMgr::CreateBVConst(const unsigned int width,
function ASTNode (line 903) | ASTNode BeevMgr::CreateBVConst(const char* strval, int base) {
function ASTBVConst (line 928) | ASTBVConst *BeevMgr::LookupOrCreateBVConst(ASTBVConst &s) {
function ASTNode (line 964) | ASTNode BeevMgr::CreateZeroConst(unsigned width) {
function ASTNode (line 968) | ASTNode BeevMgr::CreateOneConst(unsigned width) {
function ASTNode (line 972) | ASTNode BeevMgr::CreateTwoConst(unsigned width) {
function ASTNode (line 976) | ASTNode BeevMgr::CreateMaxConst(unsigned width) {
function ASTSymbol (line 995) | ASTSymbol *BeevMgr::LookupOrCreateSymbol(ASTSymbol& s) {
function ostream (line 1047) | ostream &LispPrintVec(ostream &os, const ASTVec &v, int indentation)
function lp (line 1058) | void lp(ASTNode node)
function lpvec (line 1063) | void lpvec(const ASTVec &vec)
function ASTNode (line 1307) | const ASTNode BeevMgr::PopQuery() {
function ASTNode (line 1313) | const ASTNode BeevMgr::GetQuery() {
function ASTVec (line 1317) | const ASTVec BeevMgr::GetAsserts(void) {
function ASTNode (line 1330) | ASTNode BeevMgr::NewArrayVar(unsigned int index, unsigned int value) {
function ASTNode (line 1345) | ASTNode BeevMgr::NewVar(unsigned int value) {
function FatalError (line 1548) | void FatalError(const char * str, const ASTNode& a, int w) {
function FatalError (line 1563) | void FatalError(const char * str) {
function Convert_MINISATVar_To_ASTNode_Print (line 1574) | void Convert_MINISATVar_To_ASTNode_Print(int minisat_var,
function SortByExprNum (line 1585) | void SortByExprNum(ASTVec& v) {
function isAtomic (line 1589) | bool isAtomic(Kind kind) {
FILE: klee/stp/AST/AST.h
function namespace (line 44) | namespace BEEV {
function IsAlreadyPrinted (line 137) | bool IsAlreadyPrinted() const;
function class (line 271) | class ASTNodeHasher {
function class (line 282) | class ASTNodeEqual {
function class (line 301) | class ASTInternal {
function class (line 420) | class ASTInterior : public ASTInternal {
function class (line 487) | class ASTSymbol : public ASTInternal{
function class (line 552) | class ASTBVConst : public ASTInternal {
function ASTInternal (line 618) | ASTBVConst(const ASTBVConst &sym) :
function GetUnsignedConst (line 635) | inline unsigned int GetUnsignedConst(const ASTNode n) {
function class (line 642) | class ASTBVConst : public ASTInternal {
function virtual (line 701) | virtual ~ASTBVConst() { }
function GetUnsignedConst (line 723) | inline unsigned int GetUnsignedConst(const ASTNode n) {
type hash_map (line 834) | typedef hash_map<ASTNode, ASTNode,
type hash_set (line 845) | typedef hash_set<ASTNode,
type hash_multiset (line 849) | typedef hash_multiset<ASTNode,
function class (line 860) | class LispPrinter {
function class (line 889) | class LispVecPrinter {
function SetIndexWidth (line 941) | inline void ASTNode::SetIndexWidth (unsigned int iw) const {
function SetValueWidth (line 949) | inline void ASTNode::SetValueWidth (unsigned int vw) const {
function ASTNode (line 968) | inline ASTNode::ASTNode(ASTInternal *in) : _int_node_ptr(in) {
function ASTNode (line 972) | inline ASTNode::ASTNode(ASTInternal *in) : _int_node_ptr(in) { }
function DecRef (line 1000) | inline void ASTInternal::DecRef()
function ASTNode (line 1009) | inline ASTNode::~ASTNode()
function DecRef (line 1017) | inline void ASTInternal::DecRef()
function ASTNode (line 1022) | inline ASTNode::~ASTNode()
function class (line 1033) | class BeevMgr {
function class (line 1778) | class CompleteCounterExample {
FILE: klee/stp/AST/ASTUtil.cpp
type BEEV (line 13) | namespace BEEV {
function ostream (line 14) | ostream &operator<<(ostream &os, const Spacer &sp) {
function CountersAndStats (line 31) | void CountersAndStats(const char * functionname) {
FILE: klee/stp/AST/ASTUtil.h
function namespace (line 25) | namespace BEEV {
function Spacer (line 87) | inline Spacer spaces(int width) {
type eqstr (line 92) | struct eqstr {
type hash_map (line 98) | typedef hash_map<const char*,int,
FILE: klee/stp/AST/BitBlast.cpp
type BEEV (line 22) | namespace BEEV {
function ASTNode (line 35) | const ASTNode BeevMgr::BBTerm(const ASTNode& term) {
function ASTNode (line 340) | const ASTNode BeevMgr::BBForm(const ASTNode& form)
function ASTVec (line 487) | ASTVec BeevMgr::BBAddOneBit(ASTVec& x, ASTNode cin)
function ASTVec (line 501) | ASTVec BeevMgr::BBInc(ASTVec& x)
function ASTNode (line 508) | ASTNode BeevMgr::Majority(const ASTNode& a, const ASTNode& b,const AST...
function ASTVec (line 543) | ASTVec BeevMgr::BBNeg(const ASTVec& x)
function ASTVec (line 556) | ASTVec BeevMgr::BBUminus(const ASTVec& x)
function ASTVec (line 563) | ASTVec BeevMgr::BBMult(const ASTVec& x, const ASTVec& y)
function ASTVec (line 639) | ASTVec BeevMgr::BBITE(const ASTNode& cond, const ASTVec& thn, const AS...
function ASTVec (line 658) | ASTVec BeevMgr::BBAndBit(const ASTVec& y, ASTNode b)
function ASTNode (line 681) | ASTNode BeevMgr::BBBVLE(const ASTVec& left, const ASTVec& right, bool ...
function ASTNode (line 754) | ASTNode BeevMgr::BBcompare(const ASTNode& form) {
function ASTVec (line 782) | ASTVec BeevMgr::BBfill(unsigned int width, ASTNode fillval)
function ASTNode (line 788) | ASTNode BeevMgr::BBEQ(const ASTVec& left, const ASTVec& right)
FILE: klee/stp/AST/SimpBool.cpp
type BEEV (line 27) | namespace BEEV {
function ASTNode (line 29) | ASTNode BeevMgr::CreateSimpForm(Kind kind, ASTVec &children = _empty_A...
function ASTNode (line 62) | ASTNode BeevMgr::CreateSimpForm(Kind kind,
function ASTNode (line 72) | ASTNode BeevMgr::CreateSimpForm(Kind kind,
function ASTNode (line 86) | ASTNode BeevMgr::CreateSimpForm(Kind kind,
function ASTNode (line 102) | ASTNode BeevMgr::CreateSimpNot(const ASTNode& form) {
function ASTNode (line 125) | ASTNode BeevMgr::CreateSimpXor(const ASTNode& form1, const ASTNode& fo...
function ASTNode (line 133) | ASTNode BeevMgr::CreateSimpAndOr(bool IsAnd, const ASTNode& form1, con...
function ASTNode (line 140) | ASTNode BeevMgr::CreateSimpAndOr(bool IsAnd, ASTVec &children) {
function ASTNode (line 218) | ASTNode BeevMgr::CreateSimpXor(ASTVec &children) {
function ASTNode (line 351) | ASTNode BeevMgr::CreateSimpFormITE(const ASTNode& child0,
FILE: klee/stp/AST/ToCNF.cpp
type BEEV (line 63) | namespace BEEV {
class CNFstats (line 67) | class CNFstats {
method CNFstats (line 73) | CNFstats() : _num_new_rep_vars(0), _num_clauses(0) {}
method printStats (line 75) | void printStats() {
class CNFMgr (line 90) | class CNFMgr {
method CNFMgr (line 121) | CNFMgr(BeevMgr *bmgr)
method CNFIsMemoized (line 133) | bool CNFIsMemoized(ASTNode &form, ASTNode &result)
method ASTNode (line 148) | ASTNode convertXORs(ASTVec children)
method ASTNode (line 171) | ASTNode ToCNFPrePass(const ASTNode &form)
method ASTNode (line 227) | ASTNode CNFMemoize(ASTNode& form, ASTNode result)
method ASTNode (line 237) | ASTNode RepLit(const char *name, int exprnum)
method ASTNode (line 256) | ASTNode ToCNF_AndLike(Kind k, BeevMgr::ClauseList& cll, ASTNode form)
method ASTNode (line 286) | ASTNode ToCNF_AND(BeevMgr::ClauseList& cll, int nodenum, ASTVec& kid...
method ASTNode (line 335) | ASTNode ToCNF_int(BeevMgr::BeevMgr::ClauseList& cll, ASTNode form) {
FILE: klee/stp/AST/ToSAT.cpp
type BEEV (line 15) | namespace BEEV {
function ASTNode (line 162) | ASTNode BeevMgr::SymbolTruthValue(MINISAT::Solver &newS, ASTNode form)
function ASTNode (line 186) | ASTNode BeevMgr::CheckBBandCNF(MINISAT::Solver& newS, ASTNode form)
function ASTNode (line 197) | ASTNode BeevMgr::CheckBBandCNF_int(MINISAT::Solver& newS, ASTNode form)
function ASTNode (line 410) | ASTNode BeevMgr::TermToConstTermUsingModel(const ASTNode& t, bool Arra...
function ASTNode (line 569) | ASTNode BeevMgr::Expand_ReadOverWrite_UsingModel(const ASTNode& term, ...
function ASTNode (line 627) | ASTNode BeevMgr::ComputeFormulaUsingModel(const ASTNode& form) {
function ASTNode (line 940) | ASTNode BeevMgr::GetCounterExample(bool t, const ASTNode& expr) {
function ASTNode (line 1175) | ASTNode BeevMgr::Create_ArrayWriteAxioms(const ASTNode& term, const AS...
function ASTNode (line 1303) | ASTNode BeevMgr::BoolVectoBVConst(hash_map<unsigned,bool> * w, unsigne...
FILE: klee/stp/AST/Transform.cpp
type BEEV (line 13) | namespace BEEV {
function ASTNode (line 16) | ASTNode BeevMgr::TranslateSignedDivMod(const ASTNode& in) {
function ASTNode (line 104) | ASTNode BeevMgr::TransformFormula(const ASTNode& form) {
function ASTNode (line 184) | ASTNode BeevMgr::TransformTerm(const ASTNode& inputterm) {
function ASTNode (line 269) | ASTNode BeevMgr::TransformArray(const ASTNode& term) {
FILE: klee/stp/AST/asttest.cpp
function main (line 5) | int main()
FILE: klee/stp/AST/bbtest.cpp
function main (line 5) | int main()
FILE: klee/stp/AST/cnftest.cpp
function main (line 9) | int main()
FILE: klee/stp/bitvec/consteval.cpp
type BEEV (line 12) | namespace BEEV {
function BVConstEvaluatorError (line 15) | static void BVConstEvaluatorError(CONSTANTBV::ErrCode e, const ASTNode...
function ASTNode (line 22) | ASTNode BeevMgr::BVConstEvaluator(const ASTNode& t) {
function SXBVConst64 (line 311) | static unsigned long long int SXBVConst64(const ASTNode& t) {
function ASTNode (line 331) | ASTNode BeevMgr::BVConstEvaluator(const ASTNode& t) {
FILE: klee/stp/c_interface/c_interface.cpp
function vc_setFlags (line 29) | void vc_setFlags(char c) {
function VC (line 108) | VC vc_createValidityChecker(void) {
function vc_printExpr (line 125) | void vc_printExpr(VC vc, Expr e) {
function vc_printExprFile (line 135) | void vc_printExprFile(VC vc, Expr e, int fd) {
function vc_printVarDeclsToStream (line 141) | static void vc_printVarDeclsToStream(VC vc, ostream &os) {
function vc_printVarDecls (line 165) | void vc_printVarDecls(VC vc) {
function vc_printAssertsToStream (line 169) | static void vc_printAssertsToStream(VC vc, ostream &os, int simplify_pri...
function vc_printAsserts (line 183) | void vc_printAsserts(VC vc, int simplify_print) {
function vc_printQueryStateToBuffer (line 187) | void vc_printQueryStateToBuffer(VC vc, Expr e, char **buf, unsigned long...
function vc_printCounterExampleToBuffer (line 220) | void vc_printCounterExampleToBuffer(VC vc, char **buf, unsigned long *le...
function vc_printExprToBuffer (line 246) | void vc_printExprToBuffer(VC vc, Expr e, char **buf, unsigned long * len) {
function vc_printQuery (line 263) | void vc_printQuery(VC vc){
function Type (line 280) | Type vc_arrayType(VC vc, Type typeIndex, Type typeData) {
function Expr (line 295) | Expr vc_readExpr(VC vc, Expr array, Expr index) {
function Expr (line 311) | Expr vc_writeExpr(VC vc, Expr array, Expr index, Expr newValue) {
function vc_assertFormula (line 334) | void vc_assertFormula(VC vc, Expr e) {
function vc_query (line 350) | int vc_query(VC vc, Expr e) {
function vc_push (line 372) | void vc_push(VC vc) {
function vc_pop (line 378) | void vc_pop(VC vc) {
function vc_printCounterExample (line 383) | void vc_printCounterExample(VC vc) {
function Expr (line 399) | Expr vc_getCounterExample(VC vc, Expr e) {
function vc_counterexample_size (line 411) | int vc_counterexample_size(VC vc) {
function WholeCounterExample (line 416) | WholeCounterExample vc_getWholeCounterExample(VC vc) {
function Expr (line 423) | Expr vc_getTermFromCounterExample(VC vc, Expr e, CompleteCEStar cc) {
function vc_getBVLength (line 432) | int vc_getBVLength(VC vc, Expr ex) {
function Expr (line 447) | Expr vc_varExpr1(VC vc, char* name,
function Expr (line 464) | Expr vc_varExpr(VC vc, char * name, Type type) {
function Expr (line 497) | Expr vc_eqExpr(VC vc, Expr ccc0, Expr ccc1) {
function Expr (line 511) | Expr vc_boolType(VC vc) {
function Expr (line 525) | Expr vc_trueExpr(VC vc) {
function Expr (line 534) | Expr vc_falseExpr(VC vc) {
function Expr (line 543) | Expr vc_notExpr(VC vc, Expr ccc) {
function Expr (line 555) | Expr vc_andExpr(VC vc, Expr left, Expr right) {
function Expr (line 568) | Expr vc_orExpr(VC vc, Expr left, Expr right) {
function Expr (line 580) | Expr vc_andExprN(VC vc, Expr* cc, int n) {
function Expr (line 597) | Expr vc_orExprN(VC vc, Expr* cc, int n) {
function Expr (line 613) | Expr vc_iteExpr(VC vc, Expr cond, Expr thenpart, Expr elsepart){
function Expr (line 637) | Expr vc_impliesExpr(VC vc, Expr antecedent, Expr consequent){
function Expr (line 653) | Expr vc_iffExpr(VC vc, Expr e0, Expr e1){
function Expr (line 669) | Expr vc_boolToBVExpr(VC vc, Expr form) {
function Type (line 691) | Type vc_bvType(VC vc, int num_bits) {
function Type (line 704) | Type vc_bv32Type(VC vc) {
function Expr (line 709) | Expr vc_bvConstExprFromStr(VC vc, char* binary_repr) {
function Expr (line 719) | Expr vc_bvConstExprFromInt(VC vc,
function Expr (line 732) | Expr vc_bvConstExprFromLL(VC vc,
function Expr (line 744) | Expr vc_bvConcatExpr(VC vc, Expr left, Expr right) {
function Expr (line 760) | Expr vc_bvPlusExpr(VC vc, int n_bits, Expr left, Expr right){
function Expr (line 775) | Expr vc_bv32PlusExpr(VC vc, Expr left, Expr right) {
function Expr (line 780) | Expr vc_bvMinusExpr(VC vc, int n_bits, Expr left, Expr right) {
function Expr (line 795) | Expr vc_bv32MinusExpr(VC vc, Expr left, Expr right) {
function Expr (line 800) | Expr vc_bvMultExpr(VC vc, int n_bits, Expr left, Expr right) {
function Expr (line 814) | Expr vc_bvDivExpr(VC vc, int n_bits, Expr left, Expr right) {
function Expr (line 828) | Expr vc_bvModExpr(VC vc, int n_bits, Expr left, Expr right) {
function Expr (line 842) | Expr vc_sbvDivExpr(VC vc, int n_bits, Expr left, Expr right) {
function Expr (line 856) | Expr vc_sbvModExpr(VC vc, int n_bits, Expr left, Expr right) {
function Expr (line 870) | Expr vc_bv32MultExpr(VC vc, Expr left, Expr right) {
function Expr (line 876) | Expr vc_bvLtExpr(VC vc, Expr left, Expr right) {
function Expr (line 890) | Expr vc_bvLeExpr(VC vc, Expr left, Expr right) {
function Expr (line 904) | Expr vc_bvGtExpr(VC vc, Expr left, Expr right) {
function Expr (line 918) | Expr vc_bvGeExpr(VC vc, Expr left, Expr right) {
function Expr (line 933) | Expr vc_sbvLtExpr(VC vc, Expr left, Expr right) {
function Expr (line 947) | Expr vc_sbvLeExpr(VC vc, Expr left, Expr right) {
function Expr (line 961) | Expr vc_sbvGtExpr(VC vc, Expr left, Expr right) {
function Expr (line 975) | Expr vc_sbvGeExpr(VC vc, Expr left, Expr right) {
function Expr (line 989) | Expr vc_bvUMinusExpr(VC vc, Expr ccc) {
function Expr (line 1002) | Expr vc_bvAndExpr(VC vc, Expr left, Expr right) {
function Expr (line 1016) | Expr vc_bvOrExpr(VC vc, Expr left, Expr right) {
function Expr (line 1030) | Expr vc_bvXorExpr(VC vc, Expr left, Expr right) {
function Expr (line 1044) | Expr vc_bvNotExpr(VC vc, Expr ccc) {
function Expr (line 1056) | Expr vc_bvLeftShiftExpr(VC vc, int sh_amt, Expr ccc) {
function Expr (line 1074) | Expr vc_bvRightShiftExpr(VC vc, int sh_amt, Expr ccc) {
function Expr (line 1107) | Expr vc_bv32LeftShiftExpr(VC vc, int sh_amt, Expr child) {
function Expr (line 1112) | Expr vc_bv32RightShiftExpr(VC vc, int sh_amt, Expr child) {
function Expr (line 1117) | Expr vc_bvVar32LeftShiftExpr(VC vc, Expr sh_amt, Expr child) {
function Expr (line 1140) | Expr vc_bvVar32DivByPowOfTwoExpr(VC vc, Expr child, Expr rhs) {
function Expr (line 1160) | Expr vc_bvVar32RightShiftExpr(VC vc, Expr sh_amt, Expr child) {
function Expr (line 1180) | Expr vc_bvExtract(VC vc, Expr ccc, int hi_num, int low_num) {
function Expr (line 1194) | Expr vc_bvBoolExtract(VC vc, Expr ccc, int bit_num) {
function Expr (line 1210) | Expr vc_bvSignExtend(VC vc, Expr ccc, int nbits) {
function getBVInt (line 1241) | int getBVInt(Expr e) {
function getBVUnsigned (line 1251) | unsigned int getBVUnsigned(Expr e) {
function getBVUnsignedLongLong (line 1261) | unsigned long long int getBVUnsignedLongLong(Expr e) {
function Expr (line 1280) | Expr vc_simplify(VC vc, Expr e) {
function Expr (line 1303) | Expr vc_bvCreateMemoryArray(VC vc, char * arrayName) {
function Expr (line 1311) | Expr vc_bvReadMemoryArray(VC vc,
function Expr (line 1335) | Expr vc_bvWriteToMemoryArray(VC vc,
function Expr (line 1370) | Expr vc_bv32ConstExprFromInt(VC vc, unsigned int value){
function Expr (line 1408) | Expr getChild(Expr e, int i){
function vc_registerErrorHandler (line 1423) | void vc_registerErrorHandler(void (*error_hdlr)(const char* err_msg)) {
function vc_getHashQueryStateToBuffer (line 1428) | int vc_getHashQueryStateToBuffer(VC vc, Expr query) {
function Type (line 1438) | Type vc_getType(VC vc, Expr ex) {
function vc_isBool (line 1463) | int vc_isBool(Expr e) {
function vc_Destroy (line 1476) | void vc_Destroy(VC vc) {
function vc_DeleteExpr (line 1487) | void vc_DeleteExpr(Expr e) {
function exprkind_t (line 1493) | exprkind_t getExprKind(Expr e) {
function getDegree (line 1498) | int getDegree (Expr e) {
function getBVLength (line 1503) | int getBVLength(Expr ex) {
function type_t (line 1513) | type_t getType (Expr ex) {
function getVWidth (line 1519) | int getVWidth (Expr ex) {
function getIWidth (line 1525) | int getIWidth (Expr ex) {
function vc_printCounterExampleFile (line 1531) | void vc_printCounterExampleFile(VC vc, int fd) {
function getExprID (line 1544) | int getExprID (Expr ex) {
FILE: klee/stp/c_interface/c_interface.h
type exprkind_t (line 303) | enum exprkind_t{
type type_t (line 361) | enum type_t {
FILE: klee/stp/c_interface/fdstream.h
function namespace (line 53) | namespace std {
function class (line 174) | class fdistream : public std::istream {
FILE: klee/stp/constantbv/constantbv.cpp
type CONSTANTBV (line 51) | namespace CONSTANTBV {
function power10 (line 125) | static unsigned int power10(unsigned int x) {
function BIT_VECTOR_mov_words (line 141) | static void BIT_VECTOR_mov_words(unsigned int * target,
function BIT_VECTOR_ins_words (line 149) | static void BIT_VECTOR_ins_words(unsigned int * addr,
function BIT_VECTOR_del_words (line 161) | static void BIT_VECTOR_del_words(unsigned int * addr,
function BIT_VECTOR_reverse (line 173) | static void BIT_VECTOR_reverse(unsigned char * string, unsigned int le...
function BIT_VECTOR_int2str (line 189) | static unsigned int BIT_VECTOR_int2str(unsigned char * string, unsigne...
function BIT_VECTOR_str2int (line 211) | static unsigned int BIT_VECTOR_str2int(unsigned char * string, unsigne...
function ErrCode (line 268) | ErrCode BitVector_Boot(void) {
function BitVector_Size (line 317) | unsigned int BitVector_Size(unsigned int bits) { /* bit vecto...
function BitVector_Mask (line 325) | unsigned int BitVector_Mask(unsigned int bits) /* bit vector...
function BitVector_Word_Bits (line 339) | unsigned int BitVector_Word_Bits(void)
function BitVector_Long_Bits (line 344) | unsigned int BitVector_Long_Bits(void)
function BitVector_Dispose (line 361) | void BitVector_Dispose(unsigned char * string) /*...
function BitVector_Destroy (line 366) | void BitVector_Destroy(unsigned int * addr) /*...
function BitVector_Destroy_List (line 375) | void BitVector_Destroy_List(unsigned int * * list, unsigned int coun...
function BitVector_Copy (line 527) | void BitVector_Copy(unsigned int * X, unsigned int * Y) ...
function BitVector_Empty (line 562) | void BitVector_Empty(unsigned int * addr) /* X...
function BitVector_Fill (line 569) | void BitVector_Fill(unsigned int * addr) /* X...
function BitVector_Flip (line 582) | void BitVector_Flip(unsigned int * addr) /* X...
function BitVector_Primes (line 595) | void BitVector_Primes(unsigned int * addr)
FILE: klee/stp/constantbv/constantbv.h
function namespace (line 55) | namespace CONSTANTBV {
FILE: klee/stp/parser/let-funcs.cpp
type BEEV (line 13) | namespace BEEV {
function ASTNode (line 45) | ASTNode BeevMgr::ResolveID(const ASTNode& v) {
FILE: klee/stp/parser/main.cpp
function main (line 61) | int main(int argc, char ** argv) {
FILE: klee/stp/sat/Global.h
function namespace (line 35) | namespace MINISAT {
function T (line 128) | T* release (void) { T* ret = data; data = NULL; sz = 0;...
function operator (line 129) | operator T* (void) { return data; }
function operator (line 130) | operator const T* (void) const { return data; }
function size (line 133) | int size (void) const { return sz; }
function shrink (line 134) | void shrink (int nelems) { assert(nelems <= sz); for (int i = ...
function pop (line 135) | void pop (void) { sz--, data[sz].~T(); }
function capacity (line 139) | void capacity (int size) { grow(size); }
function push (line 142) | void push (void) { if (sz == cap) grow(sz+1); new (&da...
function push (line 143) | void push (const T& elem) { if (sz == cap) grow(sz+1); new (&da...
function T (line 144) | const T& last (void) const { return data[sz-1]; }
function T (line 148) | const T& operator [] (int index) const { return data[index]; }
function copyTo (line 156) | void copyTo(vec<T>& copy) const { copy.clear(); copy.growTo(sz); for (in...
function moveTo (line 157) | void moveTo(vec<T>& dest) { dest.clear(true); dest.data = data; dest.sz ...
function class (line 216) | class lbool {
function toInt (line 232) | inline int toInt (lbool l) { return l.toInt(); }
function lbool (line 233) | inline lbool toLbool(int v) { return lbool(v); }
function operator (line 246) | inline bool operator != (const T& x, const T& y) { return !(x == y); }
function operator (line 247) | inline bool operator > (const T& x, const T& y) { return y < x; }
function operator (line 248) | inline bool operator <= (const T& x, const T& y) { return !(y < x); }
function operator (line 249) | inline bool operator >= (const T& x, const T& y) { return !(x < y); }
FILE: klee/stp/sat/Heap.h
function namespace (line 24) | namespace MINISAT {
FILE: klee/stp/sat/Simplifier.C
function namespace (line 22) | namespace MINISAT {
FILE: klee/stp/sat/Solver.C
function namespace (line 24) | namespace MINISAT {
function reduceDB (line 542) | void Solver::reduceDB()
function simplifyDB (line 572) | bool Solver::simplifyDB(bool expensive)
function lbool (line 648) | lbool Solver::search(int nof_conflicts, int nof_learnts)
function progressEstimate (line 715) | double Solver::progressEstimate()
function varRescaleActivity (line 732) | void Solver::varRescaleActivity()
function claRescaleActivity (line 742) | void Solver::claRescaleActivity()
function solve (line 757) | bool Solver::solve(const vec<Lit>& assumps)
FILE: klee/stp/sat/Solver.h
function namespace (line 26) | namespace MINISAT {
function lbool (line 227) | lbool value(Var x) const { return toLbool(assigns[x]); }
function lbool (line 228) | lbool value(Lit p) const { return sign(p) ? ~toLbool(assigns[var(p)]) ...
function nAssigns (line 230) | int nAssigns() { return trail.size(); }
function nClauses (line 231) | int nClauses() { return clauses.size(); }
function nLearnts (line 232) | int nLearnts() { return learnts.size(); }
function nConflicts (line 233) | int nConflicts() { return (int)stats.conflicts; }
function nVars (line 248) | int nVars () { return assigns.size(); }
function addUnit (line 249) | bool addUnit (Lit p) { return ok && (ok = enqueue(p)); }
function addBinary (line 250) | bool addBinary (Lit p, Lit q) { addBinary_tmp [0] = p; addBina...
function addTernary (line 251) | bool addTernary(Lit p, Lit q, Lit r) { addTernary_tmp[0] = p; addTern...
function addClause (line 252) | bool addClause (const vec<Lit>& ps) { if (ok && !newClause(ps)) ok =...
function freezeVar (line 256) | void freezeVar (Var v) { setVarProp(v, p_frozen, true); updateHeap...
function okay (line 260) | bool okay () { return ok; }
function solve (line 263) | bool solve () { vec<Lit> tmp; return solve(tmp); }
function turnOffSubsumption (line 264) | void turnOffSubsumption() {
function returnActivity (line 274) | double returnActivity(int i) { return activity[i];}
function updateInitialActivity (line 275) | void updateInitialActivity(int i, double act) {activity[i] = act; ord...
function check (line 287) | inline void check(bool expr) { assert(expr); }
function printLit (line 289) | static void printLit(Lit l)
function printClause (line 295) | void printClause(const C& c)
function cpuTime (line 308) | static inline double cpuTime(void) {
function int64 (line 311) | static inline int64 memUsed() {
function cpuTime (line 320) | static inline double cpuTime(void) {
function memReadStat (line 326) | static inline int memReadStat(int field)
function int64 (line 342) | static inline int64 memUsed() { return (int64)memReadStat(0) * (int64)ge...
function int64 (line 347) | static inline int64 memUsed(void) {
FILE: klee/stp/sat/SolverTypes.h
function namespace (line 26) | namespace MINISAT {
function sign (line 51) | inline bool sign (Lit p) { return p.x & 1; }
function var (line 52) | inline int var (Lit p) { return p.x >> 1; }
function Lit (line 53) | inline Lit unsign (Lit p) { Lit q; q.x = p.x & ~1; retu...
function Lit (line 54) | inline Lit id (Lit p, bool sgn) { Lit q; q.x = p.x ^ (int)sgn...
function operator (line 56) | inline bool operator == (Lit p, Lit q) { return toInt(p) == toInt(q); }
function operator (line 57) | inline bool operator != (Lit p, Lit q) { return toInt(p) != toInt(q); }
function operator (line 58) | inline bool operator < (Lit p, Lit q) { return toInt(p) < toInt(q); }
function class (line 68) | class Clause {
function shrink (line 89) | void shrink (int i) { assert(i <= size()); size_etc = ((...
function pop (line 90) | void pop () { shrink(1); }
function mark (line 93) | void mark (uint m) { size_etc = (size_etc & ~6) | ((m &...
function Lit (line 94) | Lit operator [] (int i) const { return data[i]; }
function class (line 114) | class TrailPos {
FILE: klee/stp/sat/Sort.h
function namespace (line 24) | namespace MINISAT {
FILE: klee/stp/sat/VarOrder.h
function namespace (line 28) | namespace MINISAT {
function class (line 41) | class VarOrder {
type VarFilter (line 73) | struct VarFilter {
function cleanup (line 80) | void VarOrder::cleanup()
function newVar (line 86) | void VarOrder::newVar(bool polarity, bool dvar)
function update (line 97) | void VarOrder::update(Var x)
function undo (line 104) | void VarOrder::undo(Var x)
function Lit (line 111) | Lit VarOrder::select(double random_var_freq, int decision_level)
FILE: klee/stp/simplifier/bvsolver.cpp
type BEEV (line 37) | namespace BEEV {
function ASTNode (line 57) | ASTNode BVSolver::SplitEven_into_Oddnum_PowerOf2(const ASTNode& in,
function ASTNode (line 208) | ASTNode BVSolver::ChooseMonom(const ASTNode& eq, ASTNode& modifiedlhs) {
function ASTNode (line 292) | ASTNode BVSolver::BVSolve_Odd(const ASTNode& input) {
function ASTNode (line 457) | ASTNode BVSolver::NewVar(unsigned int n) {
function ASTNode (line 473) | ASTNode BVSolver::TopLevelBVSolve(const ASTNode& input) {
function ASTNode (line 534) | ASTNode BVSolver::CheckEvenEqn(const ASTNode& input, bool& evenflag) {
function ASTNode (line 588) | ASTNode BVSolver::BVSolve_Even(const ASTNode& input) {
FILE: klee/stp/simplifier/bvsolver.h
function namespace (line 12) | namespace BEEV {
FILE: klee/stp/simplifier/simplifier.cpp
type BEEV (line 12) | namespace BEEV {
function ASTNode (line 183) | ASTNode BeevMgr::SimplifyFormula_NoRemoveWrites(const ASTNode& b, bool...
function ASTNode (line 189) | ASTNode BeevMgr::SimplifyFormula_TopLevel(const ASTNode& b, bool pushN...
function ASTNode (line 198) | ASTNode BeevMgr::SimplifyFormula(const ASTNode& b, bool pushNeg){
function ASTNode (line 258) | ASTNode BeevMgr::SimplifyAtomicFormula(const ASTNode& a, bool pushNeg) {
function ASTNode (line 354) | ASTNode BeevMgr::CreateSimplifiedINEQ(Kind k,
function ASTNode (line 442) | ASTNode BeevMgr::ITEOpt_InEqs(const ASTNode& in) {
function ASTNode (line 522) | ASTNode BeevMgr::CreateSimplifiedEQ(const ASTNode& in1, const ASTNode&...
function ASTNode (line 545) | ASTNode BeevMgr::CreateSimplifiedTermITE(const ASTNode& in0,
function ASTNode (line 580) | ASTNode BeevMgr::SimplifyAndOrFormula(const ASTNode& a, bool pushNeg) {
function ASTNode (line 674) | ASTNode BeevMgr::SimplifyNotFormula(const ASTNode& a, bool pushNeg) {
function ASTNode (line 718) | ASTNode BeevMgr::SimplifyXorFormula(const ASTNode& a, bool pushNeg) {
function ASTNode (line 746) | ASTNode BeevMgr::SimplifyNandFormula(const ASTNode& a, bool pushNeg) {
function ASTNode (line 769) | ASTNode BeevMgr::SimplifyNorFormula(const ASTNode& a, bool pushNeg) {
function ASTNode (line 792) | ASTNode BeevMgr::SimplifyImpliesFormula(const ASTNode& a, bool pushNeg) {
function ASTNode (line 853) | ASTNode BeevMgr::SimplifyIffFormula(const ASTNode& a, bool pushNeg) {
function ASTNode (line 909) | ASTNode BeevMgr::SimplifyIteFormula(const ASTNode& b, bool pushNeg) {
function ASTNode (line 976) | ASTNode BeevMgr::FlattenOneLevel(const ASTNode& a) {
function ASTNode (line 1016) | ASTNode BeevMgr::SimplifyTerm_TopLevel(const ASTNode& b) {
function ASTNode (line 1026) | ASTNode BeevMgr::SimplifyTerm(const ASTNode& inputterm) {
function ASTNode (line 1656) | ASTNode BeevMgr::CombineLikeTerms(const ASTNode& a) {
function ASTNode (line 1792) | ASTNode BeevMgr::LhsMinusRhs(const ASTNode& eq) {
function ASTNode (line 1879) | ASTNode BeevMgr::DistributeMultOverPlus(const ASTNode& a, bool startdi...
function ASTNode (line 1994) | ASTNode BeevMgr::ConvertBVSXToITE(const ASTNode& a) {
function ASTNode (line 2053) | ASTNode BeevMgr::RemoveWrites_TopLevel(const ASTNode& term) {
function ASTNode (line 2074) | ASTNode BeevMgr::SimplifyWrites_InPlace(const ASTNode& term) {
function ASTNode (line 2157) | ASTNode BeevMgr::RemoveWrites(const ASTNode& input) {
function ASTNode (line 2191) | ASTNode BeevMgr::ReadOverWrite_To_ITE(const ASTNode& term) {
function ASTNode (line 2267) | ASTNode BeevMgr::MultiplicativeInverse(const ASTNode& d) {
function ASTNode (line 2378) | ASTNode BeevMgr::CreateSubstitutionMap(const ASTNode& a){
FILE: klee/test/CXX/ArrayNew.cpp
class Test (line 8) | class Test {
method Test (line 12) | Test() {}
method Test (line 13) | Test(int _x) : x(_x) { }
method getX (line 16) | int getX() { return x; }
method setX (line 17) | void setX(int _x) { x = _x; }
function main (line 20) | int main(int argc) {
FILE: klee/test/CXX/New.cpp
class Test (line 6) | class Test {
method Test (line 10) | Test(int _x) : x(_x) {
method getX (line 15) | int getX() { return x; }
function main (line 21) | int main(int argc) {
FILE: klee/test/CXX/SimpleVirtual.cpp
class Thing (line 8) | class Thing {
method Thing (line 10) | Thing() {}
method getX (line 13) | virtual int getX() { return 1; }
class Thing2 (line 16) | class Thing2 : public Thing {
method getX (line 18) | virtual int getX() { return 2; }
function Thing (line 21) | Thing *getThing(bool which) {
method Thing (line 10) | Thing() {}
method getX (line 13) | virtual int getX() { return 1; }
function main (line 25) | int main(int argc) {
FILE: klee/test/CXX/StaticConstructor.cpp
class Test (line 9) | class Test {
method Test (line 13) | Test() : x(aGlobal + 1) {}
method getX (line 16) | int getX() { return x; }
function main (line 21) | int main() {
FILE: klee/test/CXX/StaticDestructor.cpp
class Test (line 9) | class Test {
method Test (line 13) | Test() : p(0) {}
function main (line 22) | int main() {
FILE: klee/test/CXX/Trivial.cpp
class Test (line 6) | class Test {
method Test (line 10) | Test(int _x) : x(_x) {}
method getX (line 13) | int getX() { return x; }
function main (line 16) | int main() {
FILE: klee/test/Concrete/ConcreteTest.py
class TestError (line 7) | class TestError(Exception):
function getFiles (line 13) | def getFiles():
function readFile (line 19) | def readFile(f):
function testFile (line 28) | def testFile(name, printOutput=False):
function testOneFile (line 61) | def testOneFile(f, printOutput=False, log=None):
function test (line 74) | def test():
FILE: klee/test/Concrete/_testingUtils.c
function print_int (line 14) | void print_int(unsigned long long val) {
FILE: klee/test/Concrete/ackermann.c
function ackermann (line 5) | int ackermann(int m, int n) {
function main (line 12) | int main() {
FILE: klee/test/Coverage/ReadArgs.c
function main (line 7) | int main() {
FILE: klee/test/Coverage/ReplayOutDir.c
function main (line 6) | int main() {
FILE: klee/test/Dogfood/ImmutableSet.cpp
function iff (line 11) | bool iff(bool a, bool b) {
function contains (line 16) | bool contains(InputIterator begin, InputIterator end, T item) {
function equal (line 23) | bool equal(T &a, T &b) {
function remove (line 34) | void remove(InputIterator begin, InputIterator end, T item) {
function check_set (line 45) | void check_set(T &set, unsigned num, unsigned *values) {
function test (line 90) | void test() {
function main (line 130) | int main(int argc, char **argv) {
FILE: klee/test/Feature/Alias.c
function __foo (line 11) | __attribute__((alias("b")));
function main (line 19) | int main() {
FILE: klee/test/Feature/AliasFunction.c
function foo (line 9) | void foo() { printf(" foo()\n"); }
function bar (line 10) | void bar() { printf(" bar()\n"); }
function main (line 12) | int main() {
FILE: klee/test/Feature/AliasFunctionExit.c
function start (line 10) | void start(int x) {
function end (line 16) | void end(int status) {
function main (line 23) | int main() {
FILE: klee/test/Feature/AsmAddresses.c
function main (line 17) | int main() {
FILE: klee/test/Feature/ByteSwap.c
function main (line 7) | int main() {
FILE: klee/test/Feature/CallToUndefinedExternal.cpp
function main (line 7) | int main() {
FILE: klee/test/Feature/CheckMemoryAccess.c
function main (line 10) | int main() {
FILE: klee/test/Feature/CopyOnWrite.c
function explode (line 10) | void explode(int *ap, int i, int *result) {
function main (line 19) | int main() {
FILE: klee/test/Feature/DanglingConcreteReadExpr.c
function main (line 7) | int main() {
FILE: klee/test/Feature/DefineFixedObject.c
function main (line 8) | int main() {
FILE: klee/test/Feature/DoubleFree.c
function main (line 5) | int main() {
FILE: klee/test/Feature/DumpStatesOnHalt.c
function main (line 5) | int main() {
FILE: klee/test/Feature/Envp.c
function main (line 6) | int main(int argc, char **argv, char **envp) {
FILE: klee/test/Feature/ExprLogging.c
function main (line 17) | int main() {
FILE: klee/test/Feature/ExternalWeakLinkage.c
function main (line 8) | int main() {
FILE: klee/test/Feature/Float.c
function fadd (line 7) | float fadd(float a, float b) {
function fsub (line 11) | float fsub(float a, float b) {
function fmul (line 15) | float fmul(float a, float b) {
function main (line 19) | int main() {
FILE: klee/test/Feature/FunctionPointer.c
function foo (line 6) | void foo(const char *msg) { printf("foo: %s\n", msg); }
function baz (line 7) | void baz(const char *msg) { printf("baz: %s\n", msg); }
function bar (line 11) | void bar(void (*fp)(const char *)) { fp("called via bar"); }
function main (line 13) | int main(int argc, char **argv) {
FILE: klee/test/Feature/GetValue.c
function main (line 7) | int main() {
FILE: klee/test/Feature/InAndOutOfBounds.c
function klee_urange (line 7) | unsigned klee_urange(unsigned start, unsigned end) {
function main (line 14) | int main() {
FILE: klee/test/Feature/IndirectCallToBuiltin.c
function main (line 7) | int main() {
FILE: klee/test/Feature/IndirectCallToExternal.c
function main (line 9) | int main() {
FILE: klee/test/Feature/IsSymbolic.c
function main (line 6) | int main() {
FILE: klee/test/Feature/KleeReportError.c
function main (line 7) | int main(int argc, char** argv) {
FILE: klee/test/Feature/LongDoubleSupport.c
function main (line 13) | int main() {
FILE: klee/test/Feature/LowerSwitch.c
function main (line 9) | int main(int argc, char **argv) {
FILE: klee/test/Feature/MakeConcreteSymbolic.c
function main (line 11) | int main() {
FILE: klee/test/Feature/MakeSymbolicName.c
function main (line 6) | int main() {
FILE: klee/test/Feature/MemoryLimit.c
function main (line 10) | int main() {
FILE: klee/test/Feature/MultipleFreeResolution.c
function klee_urange (line 9) | unsigned klee_urange(unsigned start, unsigned end) {
function main (line 22) | int main() {
FILE: klee/test/Feature/MultipleReadResolution.c
function klee_urange (line 11) | unsigned klee_urange(unsigned start, unsigned end) {
function main (line 24) | int main() {
FILE: klee/test/Feature/MultipleReallocResolution.c
function klee_urange (line 10) | unsigned klee_urange(unsigned start, unsigned end) {
function main (line 23) | int main() {
FILE: klee/test/Feature/MultipleWriteResolution.c
function klee_urange (line 11) | unsigned klee_urange(unsigned start, unsigned end) {
function main (line 24) | int main() {
FILE: klee/test/Feature/NamedSeedMatching.c
function main (line 15) | int main(int argc, char **argv) {
FILE: klee/test/Feature/OneFreeError.c
function main (line 5) | int main() {
FILE: klee/test/Feature/OneOutOfBounds.c
function main (line 5) | int main() {
FILE: klee/test/Feature/Optimize.c
function main (line 9) | int main() {
FILE: klee/test/Feature/OverlappedError.c
function main (line 8) | int main() {
FILE: klee/test/Feature/PreferCex.c
function main (line 9) | int main() {
FILE: klee/test/Feature/RaiseAsm.c
type uint16 (line 6) | typedef unsigned short uint16;
type uint32 (line 7) | typedef unsigned int uint32;
function uint16 (line 9) | uint16 byteswap_uint16(uint16 x) {
function uint32 (line 12) | uint32 byteswap_uint32(uint32 x) {
function uint16 (line 17) | uint16 byteswap_uint16_asm(uint16 x) {
function uint32 (line 23) | uint32 byteswap_uint32_asm(uint32 x) {
function main (line 31) | int main() {
FILE: klee/test/Feature/ReallocFailure.c
function main (line 8) | int main() {
FILE: klee/test/Feature/ReplayPath.c
function main (line 11) | int main() {
FILE: klee/test/Feature/Searchers.c
function validate (line 25) | int validate(char *buf, int N) {
function main (line 43) | int main(int argc, char **argv) {
FILE: klee/test/Feature/SetForking.c
function main (line 10) | int main() {
FILE: klee/test/Feature/Vararg.c
type triple (line 10) | struct triple {
function test1 (line 14) | int test1(int x, ...) {
function sum (line 25) | int sum(int N, ...) {
function va_array (line 44) | int va_array(int N, ...) {
function main (line 70) | int main() {
FILE: klee/test/Feature/WithLibc.c
function main (line 6) | int main() {
FILE: klee/test/Feature/WriteCov.c
function main (line 8) | int main() {
FILE: klee/test/Feature/const_array_opt1.c
function main (line 14) | int main() {
FILE: klee/test/Programs/pcregrep.c
type ConstantDoubleTy (line 102) | typedef unsigned long long ConstantDoubleTy;
type ConstantFloatTy (line 103) | typedef unsigned int ConstantFloatTy;
type llvmBitCastUnion (line 108) | typedef union {
type l_struct_2E__IO_FILE (line 115) | struct l_struct_2E__IO_FILE
type l_struct_2E__IO_marker (line 116) | struct l_struct_2E__IO_marker
type l_struct_2E_branch_chain (line 117) | struct l_struct_2E_branch_chain
type l_struct_2E_compile_data (line 118) | struct l_struct_2E_compile_data
type l_struct_2E_pcre (line 119) | struct l_struct_2E_pcre
type l_struct_2E__IO_FILE (line 122) | typedef struct l_struct_2E__IO_FILE l_struct_2E__IO_FILE;
type l_struct_2E__IO_marker (line 123) | typedef struct l_struct_2E__IO_marker l_struct_2E__IO_marker;
type l_struct_2E_branch_chain (line 124) | typedef struct l_struct_2E_branch_chain l_struct_2E_branch_chain;
type l_struct_2E_compile_data (line 125) | typedef struct l_struct_2E_compile_data l_struct_2E_compile_data;
type l_struct_2E_pcre (line 126) | typedef struct l_struct_2E_pcre l_struct_2E_pcre;
type l_struct_2E__IO_FILE (line 129) | struct l_struct_2E__IO_FILE {
type l_struct_2E__IO_marker (line 158) | struct l_struct_2E__IO_marker {
type l_struct_2E_branch_chain (line 164) | struct l_struct_2E_branch_chain {
type l_struct_2E_compile_data (line 169) | struct l_struct_2E_compile_data {
type l_struct_2E_pcre (line 193) | struct l_struct_2E_pcre {
type l_struct_2E__IO_FILE (line 214) | struct l_struct_2E__IO_FILE
type l_struct_2E_compile_data (line 227) | struct l_struct_2E_compile_data
type l_struct_2E_compile_data (line 228) | struct l_struct_2E_compile_data
type l_struct_2E_compile_data (line 229) | struct l_struct_2E_compile_data
type l_struct_2E_branch_chain (line 231) | struct l_struct_2E_branch_chain
type l_struct_2E_compile_data (line 231) | struct l_struct_2E_compile_data
function llvm_fcmp_ord (line 306) | static inline int llvm_fcmp_ord(double X, double Y) { return X == X && Y...
function llvm_fcmp_uno (line 307) | static inline int llvm_fcmp_uno(double X, double Y) { return X != X || Y...
function llvm_fcmp_ueq (line 308) | static inline int llvm_fcmp_ueq(double X, double Y) { return X == Y || l...
function llvm_fcmp_une (line 309) | static inline int llvm_fcmp_une(double X, double Y) { return X != Y; }
function llvm_fcmp_ult (line 310) | static inline int llvm_fcmp_ult(double X, double Y) { return X < Y || l...
function llvm_fcmp_ugt (line 311) | static inline int llvm_fcmp_ugt(double X, double Y) { return X > Y || l...
function llvm_fcmp_ule (line 312) | static inline int llvm_fcmp_ule(double X, double Y) { return X <= Y || l...
function llvm_fcmp_uge (line 313) | static inline int llvm_fcmp_uge(double X, double Y) { return X >= Y || l...
function llvm_fcmp_oeq (line 314) | static inline int llvm_fcmp_oeq(double X, double Y) { return X == Y ; }
function llvm_fcmp_one (line 315) | static inline int llvm_fcmp_one(double X, double Y) { return X != Y && l...
function llvm_fcmp_olt (line 316) | static inline int llvm_fcmp_olt(double X, double Y) { return X < Y ; }
function llvm_fcmp_ogt (line 317) | static inline int llvm_fcmp_ogt(double X, double Y) { return X > Y ; }
function llvm_fcmp_ole (line 318) | static inline int llvm_fcmp_ole(double X, double Y) { return X <= Y ; }
function llvm_fcmp_oge (line 319) | static inline int llvm_fcmp_oge(double X, double Y) { return X >= Y ; }
function main (line 321) | unsigned int main(unsigned int llvm_cbe_argc, unsigned char **llvm_cbe_a...
function check_escape (line 927) | static unsigned int check_escape(unsigned char **llvm_cbe_ptrptr, unsign...
function find_parens (line 1621) | static unsigned int find_parens(unsigned char *llvm_cbe_ptr, unsigned in...
function find_fixedlength (line 2400) | static unsigned int find_fixedlength(unsigned char *llvm_cbe_code) {
function could_be_empty_branch (line 2981) | static unsigned int could_be_empty_branch(unsigned char *llvm_cbe_code, ...
function check_posix_syntax (line 3323) | static unsigned int check_posix_syntax(unsigned char *llvm_cbe_ptr, unsi...
function adjust_recurse (line 3413) | static void adjust_recurse(unsigned char *llvm_cbe_group, unsigned int l...
function check_auto_possessive (line 3644) | static unsigned int check_auto_possessive(unsigned int llvm_cbe_op_code,...
function _pcre_is_newline (line 4655) | static unsigned int _pcre_is_newline(unsigned char *llvm_cbe_ptr, unsign...
function compile_regex (line 4762) | static unsigned int compile_regex(unsigned int llvm_cbe_options, unsigne...
function is_anchored (line 14050) | static unsigned int is_anchored(unsigned char *llvm_cbe_code, unsigned i...
function is_startline (line 14191) | static unsigned int is_startline(unsigned char *llvm_cbe_code, unsigned ...
function find_firstassertedchar (line 14416) | static unsigned int find_firstassertedchar(unsigned char *llvm_cbe_code,...
FILE: klee/test/Runtime/POSIX/DirConsistency.c
function main (line 25) | int main(int argc, char **argv) {
FILE: klee/test/Runtime/POSIX/DirSeek.c
function main (line 19) | int main(int argc, char **argv) {
FILE: klee/test/Runtime/POSIX/FDNumbers.c
function main (line 8) | int main(int argc, char **argv) {
FILE: klee/test/Runtime/POSIX/FD_Fail.c
function main (line 11) | int main(int argc, char** argv) {
FILE: klee/test/Runtime/POSIX/FD_Fail2.c
function main (line 18) | int main(int argc, char** argv) {
FILE: klee/test/Runtime/POSIX/Fcntl.c
function main (line 7) | int main(int argc, char **argv) {
FILE: klee/test/Runtime/POSIX/FilePerm.c
function main (line 12) | int main(int argc, char** argv) {
FILE: klee/test/Runtime/POSIX/FreeArgv.c
function main (line 7) | int main(int argc, char **argv) {
FILE: klee/test/Runtime/POSIX/Getenv.c
function main (line 6) | int main(int argc, char **argv) {
FILE: klee/test/Runtime/POSIX/Ioctl.c
function main (line 12) | int main(int argc, char **argv) {
FILE: klee/test/Runtime/POSIX/Isatty.c
function main (line 18) | int main(int argc, char** argv) {
FILE: klee/test/Runtime/POSIX/PrgName.c
function f (line 13) | int f(int argc, char **argv) {
function main (line 29) | int main(int argc, char **argv) {
FILE: klee/test/Runtime/POSIX/Read1.c
function main (line 11) | int main(int argc, char** argv) {
FILE: klee/test/Runtime/POSIX/SELinux.c
function main (line 10) | int main(int argc, char** argv) {
FILE: klee/test/Runtime/POSIX/SeedAndFail.c
function main (line 17) | int main(int argc, char** argv) {
FILE: klee/test/Runtime/POSIX/Stdin.c
function main (line 17) | int main(int argc, char **argv) {
FILE: klee/test/Runtime/POSIX/Write1.c
function main (line 7) | int main(int argc, char** argv) {
FILE: klee/test/Runtime/POSIX/Write2.c
function main (line 7) | int main(int argc, char** argv) {
FILE: klee/test/Runtime/Uclibc/2007-10-08-optimization-calls-wrong-libc-functions.c
function main (line 7) | int main() {
FILE: klee/test/Runtime/Uclibc/2008-03-04-libc-atexit-uses-dso-handle.c
function boo (line 6) | void boo() {
function main (line 9) | int main() {
FILE: klee/test/Runtime/Uclibc/Environ.c
function main (line 6) | int main() {
FILE: klee/test/regression/2007-07-25-invalid-stp-array-binding-to-objectstate.c
function main (line 6) | int main(void) {
FILE: klee/test/regression/2007-07-30-unflushed-byte.c
function main (line 6) | int main() {
FILE: klee/test/regression/2007-08-01-cache-unclear-on-overwrite-flushed.c
function main (line 7) | int main() {
FILE: klee/test/regression/2007-08-06-64bit-shift.c
function main (line 6) | int main() {
FILE: klee/test/regression/2007-08-06-access-after-free.c
function main (line 6) | int main() {
FILE: klee/test/regression/2007-08-08-free-zero.c
function main (line 5) | int main() {
FILE: klee/test/regression/2007-08-16-invalid-constant-value.c
function main (line 11) | int main() {
FILE: klee/test/regression/2007-08-16-valid-write-to-freed-object.c
function sym (line 4) | unsigned sym() {
function main (line 10) | int main() {
FILE: klee/test/regression/2007-10-11-free-of-alloca.c
function main (line 5) | int main() {
FILE: klee/test/regression/2007-10-11-illegal-access-after-free-and-branch.c
function main (line 9) | int main(int argc, char **argv) {
FILE: klee/test/regression/2007-10-12-failed-make-symbolic-after-copy.c
function main (line 5) | int main() {
FILE: klee/test/regression/2008-03-04-free-of-global.c
function main (line 7) | int main() {
FILE: klee/test/regression/2008-03-11-free-of-malloc-zero.c
function main (line 6) | int main() {
FILE: klee/test/regression/2008-04-10-bad-alloca-free.c
function f (line 4) | void f(int *addr) {
function main (line 8) | int main() {
FILE: klee/test/regression/2008-05-23-gep-with-global-const.c
function main (line 8) | int main() {
FILE: klee/tools/gen-random-bout/gen-random-bout.cpp
function getint (line 18) | static int getint(char *i) {
function push_obj (line 27) | static void push_obj(KTest *b, const char *name, unsigned non_zero_bytes,
function push_range (line 45) | static void push_range(KTest *b, const char *name, unsigned value) {
function main (line 56) | int main(int argc, char *argv[]) {
FILE: klee/tools/kleaver/main.cpp
type ToolActions (line 32) | enum ToolActions {
type BuilderKinds (line 50) | enum BuilderKinds {
function escapedString (line 82) | static std::string escapedString(const char *start, unsigned length) {
function PrintInputTokens (line 100) | static void PrintInputTokens(const MemoryBuffer *MB) {
function PrintInputAST (line 112) | static bool PrintInputAST(const char *Filename,
function EvaluateInputAST (line 146) | static bool EvaluateInputAST(const char *Filename,
function main (line 266) | int main(int argc, char **argv) {
FILE: klee/tools/klee-replay/file-creator.c
function create_link (line 38) | static int create_link(const char *fname,
function create_dir (line 58) | static int create_dir(const char *fname, exe_disk_file_t *dfile,
function getTime (line 68) | double getTime() {
function wait_for_timeout_or_exit (line 76) | int wait_for_timeout_or_exit(pid_t pid, const char *name, int *statusp) {
function create_char_dev (line 93) | static int create_char_dev(const char *fname, exe_disk_file_t *dfile,
function create_pipe (line 212) | static int create_pipe(const char *fname, exe_disk_file_t *dfile,
function create_reg_file (line 273) | static int create_reg_file(const char *fname, exe_disk_file_t *dfile,
function delete_dir (line 315) | static int delete_dir(const char *path, int recurse) {
function delete_file (line 342) | static void delete_file(const char *path, int recurse) {
function create_file (line 353) | static void create_file(int target_fd,
function replay_create_files (line 418) | void replay_create_files(exe_file_system_t *exe_fs) {
function check_file (line 454) | static void check_file(int index, exe_disk_file_t *dfile) {
FILE: klee/tools/klee-replay/klee-replay.c
function stop_monitored (line 34) | static void stop_monitored(int process) {
function int_handler (line 80) | static void int_handler(int signal) {
function timeout_handler (line 93) | static void timeout_handler(int signal) {
function process_status (line 107) | void process_status(int status,
function run_monitored (line 134) | static void run_monitored(char *executable, int argc, char **argv) {
function usage (line 194) | static void usage(void) {
function main (line 202) | int main(int argc, char** argv) {
function __fputc_unlocked (line 310) | int __fputc_unlocked(int c, FILE *f) {
function __fgetc_unlocked (line 314) | int __fgetc_unlocked(FILE *f) {
function klee_get_errno (line 318) | int klee_get_errno() {
function klee_warning (line 322) | void klee_warning(char *name) {
function klee_warning_once (line 326) | void klee_warning_once(char *name) {
function klee_assume (line 330) | int klee_assume(int x) {
function klee_is_symbolic (line 337) | int klee_is_symbolic(int x) {
function klee_prefer_cex (line 341) | void klee_prefer_cex(void *buffer, unsigned condition) {
function klee_make_symbolic (line 345) | void klee_make_symbolic(void *addr, unsigned nbytes, const char *name) {
function klee_range (line 375) | int klee_range(int min, int max, const char* name) {
function klee_report_error (line 387) | void klee_report_error(const char *file, int line,
function klee_mark_global (line 392) | void klee_mark_global(void *object) {
function __emit_error (line 398) | static void __emit_error(const char *msg) {
FILE: klee/tools/klee/Debug.cpp
function kdb_printExpr (line 4) | void kdb_printExpr(klee::Expr *e) {
FILE: klee/tools/klee/main.cpp
function main (line 6) | int main(int argc, char **argv) {
type LibcType (line 120) | enum LibcType {
class KleeHandler (line 208) | class KleeHandler : public InterpreterHandler {
method getNumTestCases (line 227) | unsigned getNumTestCases() { return m_testIndex; }
method getNumPathsExplored (line 228) | unsigned getNumPathsExplored() { return m_pathsExplored; }
method incPathsExplored (line 229) | void incPathsExplored() { m_pathsExplored++; }
function strip (line 555) | static std::string strip(std::string &in) {
function readArgumentsFromFile (line 565) | static void readArgumentsFromFile(char *file, std::vector<std::string> &...
function parseArguments (line 578) | static void parseArguments(int argc, char **argv) {
function initEnv (line 603) | static int initEnv(Module *mainModule) {
function externalsAndGlobalsCheck (line 791) | void externalsAndGlobalsCheck(const Module *m) {
function halt_execution (line 883) | void halt_execution() {
function stop_forking (line 888) | void stop_forking() {
function interrupt_handle (line 892) | static void interrupt_handle() {
function halt_via_gdb (line 909) | static void halt_via_gdb(int pid) {
function main (line 1081) | int main(int argc, char **argv, char **envp) {
FILE: klee/unittests/Expr/ExprTest.cpp
function getConstant (line 19) | ref<Expr> getConstant(int value, Expr::Width width) {
function TEST (line 25) | TEST(ExprTest, BasicConstruction) {
function TEST (line 31) | TEST(ExprTest, ConcatExtract) {
function TEST (line 83) | TEST(ExprTest, ExtractConcat) {
FILE: klee/unittests/Solver/SolverTest.cpp
function getConstant (line 29) | ref<Expr> getConstant(int value, Expr::Width width) {
function testOperation (line 37) | void testOperation(Solver &solver,
function testOpcode (line 93) | void testOpcode(Solver &solver, bool tryBool = true, bool tryZero = true,
function TEST (line 126) | TEST(SolverTest, Evaluation) {
FILE: klee/unittests/TestMain.cpp
function main (line 12) | int main(int argc, char **argv) {
FILE: qemu/QMP/qmp.py
class QMPError (line 15) | class QMPError(Exception):
class QMPConnectError (line 18) | class QMPConnectError(QMPError):
class QMPCapabilitiesError (line 21) | class QMPCapabilitiesError(QMPError):
class QEMUMonitorProtocol (line 24) | class QEMUMonitorProtocol:
method __init__ (line 25) | def __init__(self, address, server=False):
method __get_sock (line 44) | def __get_sock(self):
method __negotiate_capabilities (line 51) | def __negotiate_capabilities(self):
method __json_read (line 62) | def __json_read(self, only_event=False):
method connect (line 76) | def connect(self):
method accept (line 88) | def accept(self):
method cmd_obj (line 100) | def cmd_obj(self, qmp_cmd):
method cmd (line 116) | def cmd(self, name, args=None, id=None):
method command (line 131) | def command(self, cmd, **kwds):
method get_events (line 137) | def get_events(self, wait=False):
method clear_events (line 155) | def clear_events(self):
method close (line 161) | def close(self):
FILE: qemu/a.out.h
type external_filehdr (line 25) | struct external_filehdr {
type AOUTHDR (line 71) | typedef struct
type external_scnhdr (line 104) | struct external_scnhdr {
type external_lineno (line 137) | struct external_lineno {
function external_syment (line 154) | struct QEMU_PACKED external_syment
type external_reloc (line 231) | struct external_reloc {
type external_PE_filehdr (line 326) | struct external_PE_filehdr
type PEAOUTHDR (line 369) | typedef struct
FILE: qemu/acl.c
function qemu_acl (line 39) | qemu_acl *qemu_acl_find(const char *aclname)
function qemu_acl (line 50) | qemu_acl *qemu_acl_init(const char *aclname)
function qemu_acl_party_is_allowed (line 75) | int qemu_acl_party_is_allowed(qemu_acl *acl,
function qemu_acl_reset (line 96) | void qemu_acl_reset(qemu_acl *acl)
function qemu_acl_append (line 113) | int qemu_acl_append(qemu_acl *acl,
function qemu_acl_insert (line 130) | int qemu_acl_insert(qemu_acl *acl,
function qemu_acl_remove (line 161) | int qemu_acl_remove(qemu_acl *acl,
FILE: qemu/acl.h
type qemu_acl_entry (line 30) | typedef struct qemu_acl_entry qemu_acl_entry;
type qemu_acl (line 31) | typedef struct qemu_acl qemu_acl;
type qemu_acl_entry (line 33) | struct qemu_acl_entry {
type qemu_acl (line 40) | struct qemu_acl {
FILE: qemu/aes.c
type u32 (line 37) | typedef uint32_t u32;
type u16 (line 38) | typedef uint16_t u16;
type u8 (line 39) | typedef uint8_t u8;
function AES_set_encrypt_key (line 731) | int AES_set_encrypt_key(const unsigned char *userKey, const int bits,
function AES_set_decrypt_key (line 832) | int AES_set_decrypt_key(const unsigned char *userKey, const int bits,
function AES_encrypt (line 885) | void AES_encrypt(const unsigned char *in, unsigned char *out,
function AES_decrypt (line 1076) | void AES_decrypt(const unsigned char *in, unsigned char *out,
function AES_cbc_encrypt (line 1265) | void AES_cbc_encrypt(const unsigned char *in, unsigned char *out,
FILE: qemu/aes.h
type aes_key_st (line 7) | struct aes_key_st {
type AES_KEY (line 11) | typedef struct aes_key_st AES_KEY;
FILE: qemu/aio.c
type AioHandler (line 21) | typedef struct AioHandler AioHandler;
type AioHandler (line 32) | struct AioHandler
function AioHandler (line 44) | static AioHandler *find_aio_handler(int fd)
function qemu_aio_set_fd_handler (line 57) | int qemu_aio_set_fd_handler(int fd,
function qemu_aio_flush (line 103) | void qemu_aio_flush(void)
function qemu_aio_process_queue (line 125) | int qemu_aio_process_queue(void)
function qemu_aio_wait (line 145) | void qemu_aio_wait(void)
FILE: qemu/alpha-dis.c
type alpha_opcode (line 30) | struct alpha_opcode
type alpha_opcode (line 59) | struct alpha_opcode
type alpha_operand (line 84) | struct alpha_operand
type alpha_operand (line 140) | struct alpha_operand
type bfd_reloc_code_real (line 241) | enum bfd_reloc_code_real {
type alpha_operand (line 296) | struct alpha_operand
function insert_rba (line 435) | static unsigned
function extract_rba (line 441) | static int
function insert_rca (line 454) | static unsigned
function extract_rca (line 460) | static int
function insert_za (line 473) | static unsigned
function extract_za (line 479) | static int
function insert_zb (line 488) | static unsigned
function extract_zb (line 494) | static int
function insert_zc (line 503) | static unsigned
function extract_zc (line 509) | static int
function insert_bdisp (line 520) | static unsigned
function extract_bdisp (line 529) | static int
function insert_jhint (line 538) | static unsigned
function extract_jhint (line 547) | static int
function insert_ev6hwjhint (line 555) | static unsigned
function extract_ev6hwjhint (line 564) | static int
type alpha_opcode (line 709) | struct alpha_opcode
function print_insn_alpha (line 1765) | int
FILE: qemu/arch_init.c
function is_dup_page (line 119) | static int is_dup_page(uint8_t *page)
function ram_save_block (line 137) | static int ram_save_block(QEMUFile *f)
function ram_addr_t (line 199) | static ram_addr_t ram_save_remaining(void)
function ram_bytes_remaining (line 217) | uint64_t ram_bytes_remaining(void)
function ram_bytes_transferred (line 222) | uint64_t ram_bytes_transferred(void)
function ram_bytes_total (line 227) | uint64_t ram_bytes_total(void)
function block_compar (line 238) | static int block_compar(const void *a, const void *b)
function sort_ram_list (line 246) | static void sort_ram_list(void)
function ram_save_live (line 267) | int ram_save_live(QEMUFile *f, int stage, void *opaque)
function ram_load (line 384) | int ram_load(QEMUFile *f, void *opaque, int version_id)
type soundhw (line 482) | struct soundhw {
type soundhw (line 493) | struct soundhw
function select_soundhw (line 584) | void select_soundhw(const char *optarg)
function audio_init (line 643) | void audio_init(ISABus *isa_bus, PCIBus *pci_bus)
function select_soundhw (line 662) | void select_soundhw(const char *optarg)
function audio_init (line 665) | void audio_init(ISABus *isa_bus, PCIBus *pci_bus)
function qemu_uuid_parse (line 670) | int qemu_uuid_parse(const char *str, uint8_t *uuid)
function do_acpitable_option (line 692) | void do_acpitable_option(const char *optarg)
function do_smbios_option (line 702) | void do_smbios_option(const char *optarg)
function cpudef_init (line 712) | void cpudef_init(void)
function audio_available (line 719) | int audio_available(void)
function tcg_available (line 728) | int tcg_available(void)
function kvm_available (line 733) | int kvm_available(void)
function xen_available (line 742) | int xen_available(void)
FILE: qemu/arm-dis.c
function floatformat_to_double (line 64) | static void floatformat_to_double (unsigned char *data, double *dest)
type opcode32 (line 85) | struct opcode32
type opcode16 (line 92) | struct opcode16
type opcode32 (line 148) | struct opcode32
type opcode32 (line 529) | struct opcode32
type opcode32 (line 811) | struct opcode32
type opcode16 (line 1096) | struct opcode16
type opcode32 (line 1263) | struct opcode32
type arm_regname (line 1480) | typedef struct
type map_type (line 1542) | enum map_type {
type map_type (line 1548) | enum map_type
function arm_decode_shift (line 1589) | static void
function bfd_boolean (line 1630) | static bfd_boolean
function print_arm_address (line 2126) | static void
function bfd_boolean (line 2220) | static bfd_boolean
function print_insn_arm_internal (line 2674) | static void
function print_insn_thumb16 (line 3034) | static void
function print_insn_thumb32 (line 3310) | static void
function print_insn_data (line 3766) | static void
function find_ifthen_state (line 3788) | static void
function print_insn_arm (line 3867) | int
FILE: qemu/arm-semi.c
function set_swi_errno (line 104) | static inline uint32_t set_swi_errno(TaskState *ts, uint32_t code)
function set_swi_errno (line 111) | static inline uint32_t set_swi_errno(CPUARMState *env, uint32_t code)
function arm_semi_cb (line 125) | static void arm_semi_cb(CPUARMState *env, target_ulong ret, target_ulong...
function arm_semi_flen_cb (line 155) | static void arm_semi_flen_cb(CPUARMState *env, target_ulong ret, target_...
function do_arm_semihosting (line 177) | uint32_t do_arm_semihosting(CPUARMState *env)
FILE: qemu/async.c
type QEMUBH (line 30) | struct QEMUBH
type QEMUBH (line 35) | struct QEMUBH {
function QEMUBH (line 44) | QEMUBH *qemu_bh_new(QEMUBHFunc *cb, void *opaque)
function qemu_bh_poll (line 55) | int qemu_bh_poll(void)
function qemu_bh_schedule_idle (line 94) | void qemu_bh_schedule_idle(QEMUBH *bh)
function qemu_bh_schedule (line 102) | void qemu_bh_schedule(QEMUBH *bh)
function qemu_bh_cancel (line 112) | void qemu_bh_cancel(QEMUBH *bh)
function qemu_bh_delete (line 117) | void qemu_bh_delete(QEMUBH *bh)
function qemu_bh_update_timeout (line 123) | void qemu_bh_update_timeout(int *timeout)
FILE: qemu/audio/alsaaudio.c
type pollhlp (line 36) | struct pollhlp {
type ALSAVoiceOut (line 43) | typedef struct ALSAVoiceOut {
type ALSAVoiceIn (line 52) | typedef struct ALSAVoiceIn {
type alsa_params_req (line 83) | struct alsa_params_req {
type alsa_params_obt (line 93) | struct alsa_params_obt {
function alsa_fini_poll (line 130) | static void alsa_fini_poll (struct pollhlp *hlp)
function alsa_anal_close1 (line 146) | static void alsa_anal_close1 (snd_pcm_t **handlep)
function alsa_anal_close (line 155) | static void alsa_anal_close (snd_pcm_t **handlep, struct pollhlp *hlp)
function alsa_recover (line 161) | static int alsa_recover (snd_pcm_t *handle)
function alsa_resume (line 171) | static int alsa_resume (snd_pcm_t *handle)
function alsa_poll_handler (line 181) | static void alsa_poll_handler (void *opaque)
function alsa_poll_helper (line 241) | static int alsa_poll_helper (snd_pcm_t *handle, struct pollhlp *hlp, int...
function alsa_poll_out (line 302) | static int alsa_poll_out (HWVoiceOut *hw)
function alsa_poll_in (line 309) | static int alsa_poll_in (HWVoiceIn *hw)
function alsa_write (line 316) | static int alsa_write (SWVoiceOut *sw, void *buf, int len)
function snd_pcm_format_t (line 321) | static snd_pcm_format_t aud_to_alsafmt (audfmt_e fmt, int endianness)
function alsa_to_audfmt (line 371) | static int alsa_to_audfmt (snd_pcm_format_t alsafmt, audfmt_e *fmt,
function alsa_dump_info (line 433) | static void alsa_dump_info (struct alsa_params_req *req,
function alsa_set_threshold (line 448) | static void alsa_set_threshold (snd_pcm_t *handle, snd_pcm_uframes_t thr...
function alsa_open (line 478) | static int alsa_open (int in, struct alsa_params_req *req,
function snd_pcm_sframes_t (line 707) | static snd_pcm_sframes_t alsa_get_avail (snd_pcm_t *handle)
function alsa_write_pending (line 729) | static void alsa_write_pending (ALSAVoiceOut *alsa)
function alsa_run_out (line 792) | static int alsa_run_out (HWVoiceOut *hw, int live)
function alsa_fini_out (line 811) | static void alsa_fini_out (HWVoiceOut *hw)
function alsa_init_out (line 824) | static int alsa_init_out (HWVoiceOut *hw, struct audsettings *as)
function alsa_voice_ctl (line 870) | static int alsa_voice_ctl (snd_pcm_t *handle, const char *typ, int ctl)
function alsa_ctl_out (line 899) | static int alsa_ctl_out (HWVoiceOut *hw, int cmd, ...)
function alsa_init_in (line 933) | static int alsa_init_in (HWVoiceIn *hw, struct audsettings *as)
function alsa_fini_in (line 975) | static void alsa_fini_in (HWVoiceIn *hw)
function alsa_run_in (line 987) | static int alsa_run_in (HWVoiceIn *hw)
function alsa_read (line 1115) | static int alsa_read (SWVoiceIn *sw, void *buf, int size)
function alsa_ctl_in (line 1120) | static int alsa_ctl_in (HWVoiceIn *hw, int cmd, ...)
function alsa_audio_fini (line 1160) | static void alsa_audio_fini (void *opaque)
type audio_option (line 1165) | struct audio_option
type audio_pcm_ops (line 1234) | struct audio_pcm_ops
type audio_driver (line 1248) | struct audio_driver
FILE: qemu/audio/audio.c
type audio_driver (line 46) | struct audio_driver
type fixed_settings (line 55) | struct fixed_settings {
type fixed_settings (line 63) | struct fixed_settings
type fixed_settings (line 64) | struct fixed_settings
type mixeng_volume (line 107) | struct mixeng_volume
type audio_option (line 122) | struct audio_option
function audio_bug (line 124) | int audio_bug (const char *funcname, int cond)
function audio_bits_to_index (line 163) | static inline int audio_bits_to_index (int bits)
function audfmt_e (line 253) | static audfmt_e audio_string_to_audfmt (const char *s, audfmt_e defval,
function audfmt_e (line 288) | static audfmt_e audio_get_conf_fmt (const char *envname,
function audio_get_conf_int (line 300) | static int audio_get_conf_int (const char *key, int defval, int *defaultp)
function AUD_vlog (line 332) | void AUD_vlog (const char *cap, const char *fmt, va_list ap)
function AUD_log (line 350) | void AUD_log (const char *cap, const char *fmt, ...)
function audio_print_options (line 359) | static void audio_print_options (const char *prefix,
function audio_process_options (line 431) | static void audio_process_options (const char *prefix,
function audio_print_settings (line 514) | static void audio_print_settings (struct audsettings *as)
function audio_validate_settings (line 557) | static int audio_validate_settings (struct audsettings *as)
function audio_pcm_info_eq (line 581) | static int audio_pcm_info_eq (struct audio_pcm_info *info, struct audset...
function audio_pcm_init_info (line 613) | void audio_pcm_init_info (struct audio_pcm_info *info, struct audsetting...
function audio_pcm_info_clear_buf (line 648) | void audio_pcm_info_clear_buf (struct audio_pcm_info *info, void *buf, i...
function noop_conv (line 708) | static void noop_conv (struct st_sample *dst, const void *src, int samples)
function CaptureVoiceOut (line 715) | static CaptureVoiceOut *audio_pcm_capture_find_specific (
function audio_notify_capture (line 730) | static void audio_notify_capture (CaptureVoiceOut *cap, audcnotification...
function audio_capture_maybe_changed (line 742) | static void audio_capture_maybe_changed (CaptureVoiceOut *cap, int enabled)
function audio_recalc_and_notify_capture (line 752) | static void audio_recalc_and_notify_capture (CaptureVoiceOut *cap)
function audio_detach_capture (line 767) | static void audio_detach_capture (HWVoiceOut *hw)
function audio_attach_capture (line 795) | static int audio_attach_capture (HWVoiceOut *hw)
function audio_pcm_hw_find_min_in (line 844) | static int audio_pcm_hw_find_min_in (HWVoiceIn *hw)
function audio_pcm_hw_get_live_in (line 857) | int audio_pcm_hw_get_live_in (HWVoiceIn *hw)
function audio_pcm_hw_clip_out (line 867) | int audio_pcm_hw_clip_out (HWVoiceOut *hw, void *pcm_buf,
function audio_pcm_sw_get_rpos_in (line 892) | static int audio_pcm_sw_get_rpos_in (SWVoiceIn *sw)
function audio_pcm_sw_read (line 912) | int audio_pcm_sw_read (SWVoiceIn *sw, void *buf, int size)
function audio_pcm_hw_find_min_out (line 970) | static int audio_pcm_hw_find_min_out (HWVoiceOut *hw, int *nb_livep)
function audio_pcm_hw_get_live_out (line 987) | static int audio_pcm_hw_get_live_out (HWVoiceOut *hw, int *nb_live)
function audio_pcm_sw_write (line 1012) | int audio_pcm_sw_write (SWVoiceOut *sw, void *buf, int size)
function audio_pcm_print_info (line 1088) | static void audio_pcm_print_info (const char *cap, struct audio_pcm_info...
function audio_is_timer_needed (line 1103) | static int audio_is_timer_needed (void)
function audio_reset_timer (line 1117) | static void audio_reset_timer (AudioState *s)
function audio_timer (line 1127) | static void audio_timer (void *opaque)
function AUD_write (line 1136) | int AUD_write (SWVoiceOut *sw, void *buf, int size)
function AUD_read (line 1154) | int AUD_read (SWVoiceIn *sw, void *buf, int size)
function AUD_get_buffer_size_out (line 1172) | int AUD_get_buffer_size_out (SWVoiceOut *sw)
function AUD_set_active_out (line 1177) | void AUD_set_active_out (SWVoiceOut *sw, int on)
function AUD_set_active_in (line 1224) | void AUD_set_active_in (SWVoiceIn *sw, int on)
function audio_get_avail (line 1266) | static int audio_get_avail (SWVoiceIn *sw)
function audio_get_free (line 1289) | static int audio_get_free (SWVoiceOut *sw)
function audio_capture_mix_and_clear (line 1315) | static void audio_capture_mix_and_clear (HWVoiceOut *hw, int rpos, int s...
function audio_run_out (line 1352) | static void audio_run_out (AudioState *s)
function audio_run_in (line 1460) | static void audio_run_in (AudioState *s)
function audio_run_capture (line 1489) | static void audio_run_capture (AudioState *s)
function audio_run (line 1536) | void audio_run (const char *msg)
type audio_option (line 1561) | struct audio_option
function audio_pp_nb_voices (line 1658) | static void audio_pp_nb_voices (const char *typ, int nb)
function AUD_help (line 1677) | void AUD_help (void)
function audio_driver_init (line 1729) | static int audio_driver_init (AudioState *s, struct audio_driver *drv)
function audio_vm_change_state_handler (line 1748) | static void audio_vm_change_state_handler (void *opaque, int running,
function audio_atexit (line 1767) | static void audio_atexit (void)
function audio_init (line 1809) | static void audio_init (void)
function AUD_register_card (line 1910) | void AUD_register_card (const char *name, QEMUSoundCard *card)
function AUD_remove_card (line 1918) | void AUD_remove_card (QEMUSoundCard *card)
function CaptureVoiceOut (line 1925) | CaptureVoiceOut *AUD_add_capture (
function AUD_del_capture (line 2016) | void AUD_del_capture (CaptureVoiceOut *cap, void *cb_opaque)
function AUD_set_volume_out (line 2053) | void AUD_set_volume_out (SWVoiceOut *sw, int mute, uint8_t lvol, uint8_t...
function AUD_set_volume_in (line 2062) | void AUD_set_volume_in (SWVoiceIn *sw, int mute, uint8_t lvol, uint8_t r...
FILE: qemu/audio/audio.h
type audfmt_e (line 32) | typedef enum {
type audsettings (line 47) | struct audsettings {
type audcnotification_e (line 54) | typedef enum {
type audio_capture_ops (line 59) | struct audio_capture_ops {
type capture_ops (line 65) | struct capture_ops {
type CaptureState (line 70) | typedef struct CaptureState {
type SWVoiceOut (line 76) | typedef struct SWVoiceOut SWVoiceOut;
type CaptureVoiceOut (line 77) | typedef struct CaptureVoiceOut CaptureVoiceOut;
type SWVoiceIn (line 78) | typedef struct SWVoiceIn SWVoiceIn;
type QEMUSoundCard (line 80) | typedef struct QEMUSoundCard {
type QEMUAudioTimeStamp (line 85) | typedef struct QEMUAudioTimeStamp {
type audsettings (line 96) | struct audsettings
type audio_capture_ops (line 97) | struct audio_capture_ops
type audsettings (line 108) | struct audsettings
type audsettings (line 129) | struct audsettings
FILE: qemu/audio/audio_int.h
type audio_pcm_ops (line 33) | struct audio_pcm_ops
type audio_option_tag_e (line 35) | typedef enum {
type audio_option (line 42) | struct audio_option {
type audio_callback (line 51) | struct audio_callback {
type audio_pcm_info (line 56) | struct audio_pcm_info {
type SWVoiceCap (line 67) | typedef struct SWVoiceCap SWVoiceCap;
type HWVoiceOut (line 69) | typedef struct HWVoiceOut {
type HWVoiceIn (line 89) | typedef struct HWVoiceIn {
type SWVoiceOut (line 108) | struct SWVoiceOut {
type SWVoiceIn (line 125) | struct SWVoiceIn {
type audio_driver (line 141) | struct audio_driver {
type audio_pcm_ops (line 155) | struct audio_pcm_ops {
type capture_callback (line 169) | struct capture_callback {
type CaptureVoiceOut (line 175) | struct CaptureVoiceOut {
type SWVoiceCap (line 182) | struct SWVoiceCap {
type AudioState (line 188) | struct AudioState {
type audio_driver (line 202) | struct audio_driver
type audio_driver (line 203) | struct audio_driver
type audio_driver (line 204) | struct audio_driver
type audio_driver (line 205) | struct audio_driver
type audio_driver (line 206) | struct audio_driver
type audio_driver (line 207) | struct audio_driver
type audio_driver (line 208) | struct audio_driver
type audio_driver (line 209) | struct audio_driver
type audio_driver (line 210) | struct audio_driver
type audio_driver (line 211) | struct audio_driver
type audio_driver (line 212) | struct audio_driver
type audio_driver (line 213) | struct audio_driver
type mixeng_volume (line 214) | struct mixeng_volume
type audio_pcm_info (line 216) | struct audio_pcm_info
type audsettings (line 216) | struct audsettings
type audio_pcm_info (line 217) | struct audio_pcm_info
function audio_ring_dist (line 235) | static inline int audio_ring_dist (int dst, int src, int len)
function GCC_ATTR (line 240) | static void GCC_ATTR dolog (const char *fmt, ...)
function GCC_ATTR (line 250) | static void GCC_ATTR ldebug (const char *fmt, ...)
function GCC_ATTR (line 264) | static void GCC_ATTR ldebug (const char *fmt, ...)
FILE: qemu/audio/audio_pt_int.c
type audio_pt (line 9) | struct audio_pt
function audio_pt_init (line 22) | int audio_pt_init (struct audio_pt *p, void *(*func) (void *),
function audio_pt_fini (line 90) | int audio_pt_fini (struct audio_pt *p, const char *cap)
function audio_pt_lock (line 108) | int audio_pt_lock (struct audio_pt *p, const char *cap)
function audio_pt_unlock (line 120) | int audio_pt_unlock (struct audio_pt *p, const char *cap)
function audio_pt_wait (line 132) | int audio_pt_wait (struct audio_pt *p, const char *cap)
function audio_pt_unlock_and_signal (line 144) | int audio_pt_unlock_and_signal (struct audio_pt *p, const char *cap)
function audio_pt_join (line 161) | int audio_pt_join (struct audio_pt *p, void **arg, const char *cap)
FILE: qemu/audio/audio_pt_int.h
type audio_pt (line 6) | struct audio_pt {
type audio_pt (line 13) | struct audio_pt
type audio_pt (line 15) | struct audio_pt
type audio_pt (line 16) | struct audio_pt
type audio_pt (line 17) | struct audio_pt
type audio_pt (line 18) | struct audio_pt
type audio_pt (line 19) | struct audio_pt
type audio_pt (line 20) | struct audio_pt
FILE: qemu/audio/audio_template.h
type audio_driver (line 39) | struct audio_driver
type st_sample (line 83) | struct st_sample
type st_sample (line 113) | struct st_sample
type audsettings (line 137) | struct audsettings
function HW (line 209) | static HW *glue (audio_pcm_hw_find_any_, TYPE) (HW *hw)
function HW (line 215) | static HW *glue (audio_pcm_hw_find_any_enabled_, TYPE) (HW *hw)
function HW (line 225) | static HW *glue (audio_pcm_hw_find_specific_, TYPE) (
type audsettings (line 238) | struct audsettings
type audio_driver (line 242) | struct audio_driver
function HW (line 307) | static HW *glue (audio_pcm_hw_add_, TYPE) (struct audsettings *as)
function SW (line 331) | static SW *glue (audio_pcm_create_voice_pair_, TYPE) (
function SW (line 396) | SW *glue (AUD_open_, TYPE) (
FILE: qemu/audio/audio_win_int.c
function waveformat_from_audio_settings (line 14) | int waveformat_from_audio_settings (WAVEFORMATEX *wfx,
function waveformat_to_audio_settings (line 54) | int waveformat_to_audio_settings (WAVEFORMATEX *wfx,
FILE: qemu/audio/audio_win_int.h
type audsettings (line 5) | struct audsettings
type audsettings (line 8) | struct audsettings
FILE: qemu/audio/coreaudio.c
type coreaudioVoiceOut (line 45) | typedef struct coreaudioVoiceOut {
function coreaudio_logstatus (line 57) | static void coreaudio_logstatus (OSStatus status)
function UInt32 (line 147) | static inline UInt32 isPlaying (AudioDeviceID outputDeviceID)
function coreaudio_atexit (line 162) | static void coreaudio_atexit (void)
function coreaudio_lock (line 167) | static int coreaudio_lock (coreaudioVoiceOut *core, const char *fn_name)
function coreaudio_unlock (line 180) | static int coreaudio_unlock (coreaudioVoiceOut *core, const char *fn_name)
function coreaudio_run_out (line 193) | static int coreaudio_run_out (HWVoiceOut *hw, int live)
function OSStatus (line 220) | static OSStatus audioDeviceIOProc(
function coreaudio_write (line 285) | static int coreaudio_write (SWVoiceOut *sw, void *buf, int len)
function coreaudio_init_out (line 290) | static int coreaudio_init_out (HWVoiceOut *hw, struct audsettings *as)
function coreaudio_fini_out (line 440) | static void coreaudio_fini_out (HWVoiceOut *hw)
function coreaudio_ctl_out (line 471) | static int coreaudio_ctl_out (HWVoiceOut *hw, int cmd, ...)
function coreaudio_audio_fini (line 508) | static void coreaudio_audio_fini (void *opaque)
type audio_option (line 513) | struct audio_option
type audio_pcm_ops (line 529) | struct audio_pcm_ops
type audio_driver (line 537) | struct audio_driver
FILE: qemu/audio/dsound_template.h
type audio_pcm_info (line 63) | struct audio_pcm_info
function dsound_fini_out (line 152) | static void dsound_fini_out (HWVoiceOut *hw)
type audsettings (line 177) | struct audsettings
function dsound_init_out (line 179) | static int dsound_init_out (HWVoiceOut *hw, struct audsettings *as)
FILE: qemu/audio/dsoundaudio.c
type audsettings (line 51) | struct audsettings
type dsound (line 66) | typedef struct {
type DSoundVoiceOut (line 75) | typedef struct {
type DSoundVoiceIn (line 87) | typedef struct {
function dsound_log_hresult (line 93) | static void dsound_log_hresult (HRESULT hr)
function DWORD (line 266) | static DWORD millis_to_bytes (struct audio_pcm_info *info, DWORD millis)
function print_wave_format (line 272) | static void print_wave_format (WAVEFORMATEX *wfx)
function dsound_restore_out (line 284) | static int dsound_restore_out (LPDIRECTSOUNDBUFFER dsb)
function dsound_get_status_out (line 314) | static int dsound_get_status_out (LPDIRECTSOUNDBUFFER dsb, DWORD *statusp)
function dsound_get_status_in (line 338) | static int dsound_get_status_in (LPDIRECTSOUNDCAPTUREBUFFER dscb,
function dsound_write_sample (line 352) | static void dsound_write_sample (HWVoiceOut *hw, uint8_t *dst, int dst_len)
function dsound_clear_sample (line 379) | static void dsound_clear_sample (HWVoiceOut *hw, LPDIRECTSOUNDBUFFER dsb)
function dsound_close (line 418) | static void dsound_close (dsound *s)
function dsound_open (line 431) | static int dsound_open (dsound *s)
function dsound_ctl_out (line 511) | static int dsound_ctl_out (HWVoiceOut *hw, int cmd, ...)
function dsound_write (line 563) | static int dsound_write (SWVoiceOut *sw, void *buf, int len)
function dsound_run_out (line 568) | static int dsound_run_out (HWVoiceOut *hw, int live)
function dsound_ctl_in (line 699) | static int dsound_ctl_in (HWVoiceIn *hw, int cmd, ...)
function dsound_read (line 751) | static int dsound_read (SWVoiceIn *sw, void *buf, int len)
function dsound_run_in (line 756) | static int dsound_run_in (HWVoiceIn *hw)
function dsound_audio_fini (line 846) | static void dsound_audio_fini (void *opaque)
type audio_option (line 940) | struct audio_option
type audio_pcm_ops (line 1004) | struct audio_pcm_ops
type audio_driver (line 1018) | struct audio_driver
FILE: qemu/audio/esdaudio.c
type ESDVoiceOut (line 32) | typedef struct {
type ESDVoiceIn (line 43) | typedef struct {
function GCC_FMT_ATTR (line 64) | static void GCC_FMT_ATTR (2, 3) qesd_logerr (int err, const char *fmt, ...)
function qesd_run_out (line 160) | static int qesd_run_out (HWVoiceOut *hw, int live)
function qesd_write (line 182) | static int qesd_write (SWVoiceOut *sw, void *buf, int len)
function qesd_init_out (line 187) | static int qesd_init_out (HWVoiceOut *hw, struct audsettings *as)
function qesd_fini_out (line 254) | static void qesd_fini_out (HWVoiceOut *hw)
function qesd_ctl_out (line 277) | static int qesd_ctl_out (HWVoiceOut *hw, int cmd, ...)
function qesd_run_in (line 368) | static int qesd_run_in (HWVoiceIn *hw)
function qesd_read (line 392) | static int qesd_read (SWVoiceIn *sw, void *buf, int len)
function qesd_init_in (line 397) | static int qesd_init_in (HWVoiceIn *hw, struct audsettings *as)
function qesd_fini_in (line 461) | static void qesd_fini_in (HWVoiceIn *hw)
function qesd_ctl_in (line 484) | static int qesd_ctl_in (HWVoiceIn *hw, int cmd, ...)
function qesd_audio_fini (line 497) | static void qesd_audio_fini (void *opaque)
type audio_option (line 503) | struct audio_option
type audio_pcm_ops (line 531) | struct audio_pcm_ops
type audio_driver (line 545) | struct audio_driver
FILE: qemu/audio/fmodaudio.c
type FMODVoiceOut (line 32) | typedef struct FMODVoiceOut {
type FMODVoiceIn (line 39) | typedef struct FMODVoiceIn {
function fmod_write (line 87) | static int fmod_write (SWVoiceOut *sw, void *buf, int len)
function fmod_clear_sample (line 92) | static void fmod_clear_sample (FMODVoiceOut *fmd)
function fmod_write_sample (line 135) | static void fmod_write_sample (HWVoiceOut *hw, uint8_t *dst, int dst_len)
function fmod_unlock_sample (line 162) | static int fmod_unlock_sample (FSOUND_SAMPLE *sample, void *p1, void *p2,
function fmod_lock_sample (line 173) | static int fmod_lock_sample (
function fmod_run_out (line 227) | static int fmod_run_out (HWVoiceOut *hw, int live)
function aud_to_fmodfmt (line 298) | static int aud_to_fmodfmt (audfmt_e fmt, int stereo)
function fmod_fini_out (line 330) | static void fmod_fini_out (HWVoiceOut *hw)
function fmod_init_out (line 344) | static int fmod_init_out (HWVoiceOut *hw, struct audsettings *as)
function fmod_ctl_out (line 381) | static int fmod_ctl_out (HWVoiceOut *hw, int cmd, ...)
function fmod_init_in (line 405) | static int fmod_init_in (HWVoiceIn *hw, struct audsettings *as)
function fmod_fini_in (line 438) | static void fmod_fini_in (HWVoiceIn *hw)
function fmod_run_in (line 449) | static int fmod_run_in (HWVoiceIn *hw)
function fmod_read (line 591) | static int fmod_read (SWVoiceIn *sw, void *buf, int size)
function fmod_ctl_in (line 596) | static int fmod_ctl_in (HWVoiceIn *hw, int cmd, ...)
function fmod_audio_fini (line 619) | static void fmod_audio_fini (void *opaque)
type audio_option (line 625) | struct audio_option
type audio_pcm_ops (line 659) | struct audio_pcm_ops
type audio_driver (line 673) | struct audio_driver
FILE: qemu/audio/mixeng.c
type rate (line 289) | struct rate {
type rate (line 301) | struct rate
function st_rate_stop (line 327) | void st_rate_stop (void *opaque)
function mixeng_clear (line 332) | void mixeng_clear (struct st_sample *buf, int len)
function mixeng_volume (line 337) | void mixeng_volume (struct st_sample *buf, int len, struct mixeng_volume...
FILE: qemu/audio/mixeng.h
type mixeng_real (line 28) | typedef float mixeng_real;
type mixeng_volume (line 29) | struct mixeng_volume { int mute; mixeng_real r; mixeng_real l; }
type st_sample (line 30) | struct st_sample { mixeng_real l; mixeng_real r; }
type mixeng_volume (line 32) | struct mixeng_volume { int mute; int64_t r; int64_t l; }
type st_sample (line 33) | struct st_sample { int64_t l; int64_t r; }
type st_sample (line 36) | struct st_sample
type st_sample (line 37) | struct st_sample
type st_sample (line 43) | struct st_sample
type st_sample (line 43) | struct st_sample
type st_sample (line 45) | struct st_sample
type st_sample (line 45) | struct st_sample
type st_sample (line 48) | struct st_sample
type st_sample (line 49) | struct st_sample
type mixeng_volume (line 49) | struct mixeng_volume
FILE: qemu/audio/mixeng_template.h
function mixeng_real (line 37) | static mixeng_real inline glue (conv_, ET) (IN_T v)
function IN_T (line 56) | static IN_T inline glue (clip_, ET) (mixeng_real v)
function IN_T (line 84) | static inline IN_T glue (clip_, ET) (int64_t v)
type st_sample (line 102) | struct st_sample
type st_sample (line 104) | struct st_sample
type st_sample (line 115) | struct st_sample
type st_sample (line 117) | struct st_sample
type st_sample (line 129) | struct st_sample
type st_sample (line 131) | struct st_sample
type st_sample (line 141) | struct st_sample
type st_sample (line 143) | struct st_sample
FILE: qemu/audio/noaudio.c
type NoVoiceOut (line 31) | typedef struct NoVoiceOut {
type NoVoiceIn (line 36) | typedef struct NoVoiceIn {
function no_run_out (line 41) | static int no_run_out (HWVoiceOut *hw, int live)
function no_write (line 61) | static int no_write (SWVoiceOut *sw, void *buf, int len)
function no_init_out (line 66) | static int no_init_out (HWVoiceOut *hw, struct audsettings *as)
function no_fini_out (line 73) | static void no_fini_out (HWVoiceOut *hw)
function no_ctl_out (line 78) | static int no_ctl_out (HWVoiceOut *hw, int cmd, ...)
function no_init_in (line 85) | static int no_init_in (HWVoiceIn *hw, struct audsettings *as)
function no_fini_in (line 92) | static void no_fini_in (HWVoiceIn *hw)
function no_run_in (line 97) | static int no_run_in (HWVoiceIn *hw)
function no_read (line 118) | static int no_read (SWVoiceIn *sw, void *buf, int size)
function no_ctl_in (line 130) | static int no_ctl_in (HWVoiceIn *hw, int cmd, ...)
function no_audio_fini (line 142) | static void no_audio_fini (void *opaque)
type audio_pcm_ops (line 147) | struct audio_pcm_ops
type audio_driver (line 161) | struct audio_driver
FILE: qemu/audio/ossaudio.c
type OSSVoiceOut (line 45) | typedef struct OSSVoiceOut {
type OSSVoiceIn (line 56) | typedef struct OSSVoiceIn {
type oss_params (line 84) | struct oss_params {
function oss_anal_close (line 121) | static void oss_anal_close (int *fdp)
function oss_helper_poll_out (line 133) | static void oss_helper_poll_out (void *opaque)
function oss_helper_poll_in (line 139) | static void oss_helper_poll_in (void *opaque)
function oss_poll_out (line 145) | static int oss_poll_out (HWVoiceOut *hw)
function oss_poll_in (line 152) | static int oss_poll_in (HWVoiceIn *hw)
function oss_write (line 159) | static int oss_write (SWVoiceOut *sw, void *buf, int len)
function aud_to_ossfmt (line 164) | static int aud_to_ossfmt (audfmt_e fmt, int endianness)
function oss_to_audfmt (line 198) | static int oss_to_audfmt (int ossfmt, audfmt_e *fmt, int *endianness)
function oss_dump_info (line 240) | static void oss_dump_info (struct oss_params *req, struct oss_params *obt)
function oss_get_version (line 254) | static int oss_get_version (int fd, int *version, const char *typ)
function oss_open (line 278) | static int oss_open (int in, struct oss_params *req,
function oss_write_pending (line 394) | static void oss_write_pending (OSSVoiceOut *oss)
function oss_run_out (line 434) | static int oss_run_out (HWVoiceOut *hw, int live)
function oss_fini_out (line 494) | static void oss_fini_out (HWVoiceOut *hw)
function oss_init_out (line 517) | static int oss_init_out (HWVoiceOut *hw, struct audsettings *as)
function oss_ctl_out (line 625) | static int oss_ctl_out (HWVoiceOut *hw, int cmd, ...)
function oss_init_in (line 683) | static int oss_init_in (HWVoiceIn *hw, struct audsettings *as)
function oss_fini_in (line 737) | static void oss_fini_in (HWVoiceIn *hw)
function oss_run_in (line 749) | static int oss_run_in (HWVoiceIn *hw)
function oss_read (line 818) | static int oss_read (SWVoiceIn *sw, void *buf, int size)
function oss_ctl_in (line 823) | static int oss_ctl_in (HWVoiceIn *hw, int cmd, ...)
function oss_audio_fini (line 859) | static void oss_audio_fini (void *opaque)
type audio_option (line 864) | struct audio_option
type audio_pcm_ops (line 918) | struct audio_pcm_ops
type audio_driver (line 932) | struct audio_driver
FILE: qemu/audio/paaudio.c
type PAVoiceOut (line 12) | typedef struct {
type PAVoiceIn (line 23) | typedef struct {
function GCC_FMT_ATTR (line 43) | static void GCC_FMT_ATTR (2, 3) qpa_logerr (int err, const char *fmt, ...)
function qpa_run_out (line 118) | static int qpa_run_out (HWVoiceOut *hw, int live)
function qpa_write (line 140) | static int qpa_write (SWVoiceOut *sw, void *buf, int len)
function qpa_run_in (line 209) | static int qpa_run_in (HWVoiceIn *hw)
function qpa_read (line 233) | static int qpa_read (SWVoiceIn *sw, void *buf, int len)
function pa_sample_format_t (line 238) | static pa_sample_format_t audfmt_to_pa (audfmt_e afmt, int endianness)
function audfmt_e (line 263) | static audfmt_e pa_to_audfmt (pa_sample_format_t fmt, int *endianness)
function qpa_init_out (line 286) | static int qpa_init_out (HWVoiceOut *hw, struct audsettings *as)
function qpa_init_in (line 351) | static int qpa_init_in (HWVoiceIn *hw, struct audsettings *as)
function qpa_fini_out (line 406) | static void qpa_fini_out (HWVoiceOut *hw)
function qpa_fini_in (line 426) | static void qpa_fini_in (HWVoiceIn *hw)
function qpa_ctl_out (line 446) | static int qpa_ctl_out (HWVoiceOut *hw, int cmd, ...)
function qpa_ctl_in (line 453) | static int qpa_ctl_in (HWVoiceIn *hw, int cmd, ...)
function qpa_audio_fini (line 466) | static void qpa_audio_fini (void *opaque)
type audio_option (line 471) | struct audio_option
type audio_pcm_ops (line 499) | struct audio_pcm_ops
type audio_driver (line 513) | struct audio_driver
FILE: qemu/audio/rate_template.h
function NAME (line 30) | void NAME (void *opaque, struct st_sample *ibuf, struct st_sample *obuf,
FILE: qemu/audio/sdlaudio.c
type SDLVoiceOut (line 40) | typedef struct SDLVoiceOut {
type SDLAudioState (line 53) | struct SDLAudioState {
type SDLAudioState (line 59) | typedef struct SDLAudioState SDLAudioState;
function sdl_unlock (line 81) | static int sdl_unlock (SDLAudioState *s, const char *forfn)
function sdl_post (line 90) | static int sdl_post (SDLAudioState *s, const char *forfn)
function sdl_wait (line 99) | static int sdl_wait (SDLAudioState *s, const char *forfn)
function sdl_unlock_and_post (line 108) | static int sdl_unlock_and_post (SDLAudioState *s, const char *forfn)
function aud_to_sdlfmt (line 117) | static int aud_to_sdlfmt (audfmt_e fmt)
function sdl_to_audfmt (line 141) | static int sdl_to_audfmt(int sdlfmt, audfmt_e *fmt, int *endianness)
function sdl_open (line 182) | static int sdl_open (SDL_AudioSpec *req, SDL_AudioSpec *obt)
function sdl_close (line 220) | static void sdl_close (SDLAudioState *s)
function sdl_callback (line 232) | static void sdl_callback (void *opaque, Uint8 *buf, int len)
function sdl_write_out (line 291) | static int sdl_write_out (SWVoiceOut *sw, void *buf, int len)
function sdl_run_out (line 296) | static int sdl_run_out (HWVoiceOut *hw, int live)
function sdl_fini_out (line 328) | static void sdl_fini_out (HWVoiceOut *hw)
function sdl_init_out (line 335) | static int sdl_init_out (HWVoiceOut *hw, struct audsettings *as)
function sdl_ctl_out (line 376) | static int sdl_ctl_out (HWVoiceOut *hw, int cmd, ...)
function sdl_audio_fini (line 419) | static void sdl_audio_fini (void *opaque)
type audio_option (line 428) | struct audio_option
type audio_pcm_ops (line 438) | struct audio_pcm_ops
type audio_driver (line 446) | struct audio_driver
FILE: qemu/audio/spiceaudio.c
type SpiceRateCtl (line 31) | typedef struct SpiceRateCtl {
type SpiceVoiceOut (line 36) | typedef struct SpiceVoiceOut {
type SpiceVoiceIn (line 46) | typedef struct SpiceVoiceIn {
function spice_audio_fini (line 76) | static void spice_audio_fini (void *opaque)
function rate_start (line 81) | static void rate_start (SpiceRateCtl *rate)
function rate_get_samples (line 87) | static int rate_get_samples (struct audio_pcm_info *info, SpiceRateCtl *...
function line_out_init (line 109) | static int line_out_init (HWVoiceOut *hw, struct audsettings *as)
function line_out_fini (line 128) | static void line_out_fini (HWVoiceOut *hw)
function line_out_run (line 135) | static int line_out_run (HWVoiceOut *hw, int live)
function line_out_write (line 175) | static int line_out_write (SWVoiceOut *sw, void *buf, int len)
function line_out_ctl (line 180) | static int line_out_ctl (HWVoiceOut *hw, int cmd, ...)
function line_in_init (line 211) | static int line_in_init (HWVoiceIn *hw, struct audsettings *as)
function line_in_fini (line 230) | static void line_in_fini (HWVoiceIn *hw)
function line_in_run (line 237) | static int line_in_run (HWVoiceIn *hw)
function line_in_read (line 282) | static int line_in_read (SWVoiceIn *sw, void *buf, int size)
function line_in_ctl (line 287) | static int line_in_ctl (HWVoiceIn *hw, int cmd, ...)
type audio_option (line 311) | struct audio_option
type audio_pcm_ops (line 315) | struct audio_pcm_ops
type audio_driver (line 329) | struct audio_driver
function qemu_spice_audio_init (line 342) | void qemu_spice_audio_init (void)
FILE: qemu/audio/wavaudio.c
type WAVVoiceOut (line 31) | typedef struct WAVVoiceOut {
type audsettings (line 40) | struct audsettings
function wav_run_out (line 49) | static int wav_run_out (HWVoiceOut *hw, int live)
function wav_write_out (line 93) | static int wav_write_out (SWVoiceOut *sw, void *buf, int len)
function le_store (line 99) | static void le_store (uint8_t *buf, uint32_t val, int len)
function wav_init_out (line 108) | static int wav_init_out (HWVoiceOut *hw, struct audsettings *as)
function wav_fini_out (line 175) | static void wav_fini_out (HWVoiceOut *hw)
function wav_ctl_out (line 222) | static int wav_ctl_out (HWVoiceOut *hw, int cmd, ...)
function wav_audio_fini (line 234) | static void wav_audio_fini (void *opaque)
type audio_option (line 240) | struct audio_option
type audio_pcm_ops (line 268) | struct audio_pcm_ops
type audio_driver (line 276) | struct audio_driver
FILE: qemu/audio/wavcapture.c
type WAVState (line 5) | typedef struct {
function le_store (line 16) | sta
Copy disabled (too large)
Download .json
Condensed preview — 3576 files, each showing path, character count, and a content snippet. Download the .json file for the full structured content (54,217K chars).
[
{
"path": ".github/FUNDING.yml",
"chars": 642,
"preview": "# These are supported funding model platforms\n\ngithub: vitalych\npatreon: # Replace with a single Patreon username\nopen_c"
},
{
"path": ".gitignore",
"chars": 115,
"preview": "*~\n/s2e.creator.user\n/guest/demos/quicksort\n/guest/init_env/init_env*.so\n/guest/s2ecmd/s2ecmd\n/guest/s2eget/s2eget\n"
},
{
"path": "LICENSE",
"chars": 243,
"preview": "S2E as a whole is released under the GNU General Public License version 2.\n\nSome S2E files are released under GPL, LGPL "
},
{
"path": "Makefile",
"chars": 13534,
"preview": "#Environment variables:\n#\n# BUILD_ARCH=corei7, etc...\n# Overrides the default clang -march settings.\n# Useful"
},
{
"path": "README",
"chars": 2315,
"preview": "S²E: A Platform for In-Vivo Multi-Path Software Analysis\n========================================================\nhttps:"
},
{
"path": "S2E-AUTHORS",
"chars": 813,
"preview": "Vitaly Chipounov <vitaly.chipounov@epfl.ch>\nVolodymyr Kuznetsov <vova.kuznetsov@epfl.ch>\nJonas Wagner <jonas.wagner@epfl"
},
{
"path": "config.lua",
"chars": 242,
"preview": "s2e = {\n\tkleeArgs = {\n\t-- Run each state for at least 30 second before\n\t-- switching to the other:\n\t\"--use-batching-sear"
},
{
"path": "docs/BuildingLinux.html",
"chars": 2413,
"preview": "<?xml version=\"1.0\" encoding=\"utf-8\" ?>\n<!DOCTYPE html PUBLIC \"-//W3C//DTD XHTML 1.0 Transitional//EN\" \"http://www.w3.or"
},
{
"path": "docs/BuildingLinux.rst",
"chars": 1701,
"preview": "==========================\nCompiling the Linux Kernel\n==========================\n\nAlthough S2E can run any Linux kernel,"
},
{
"path": "docs/BuildingS2E.html",
"chars": 5411,
"preview": "<?xml version=\"1.0\" encoding=\"utf-8\" ?>\n<!DOCTYPE html PUBLIC \"-//W3C//DTD XHTML 1.0 Transitional//EN\" \"http://www.w3.or"
},
{
"path": "docs/BuildingS2E.rst",
"chars": 3264,
"preview": "==========================\nBuilding the S2E Platform\n==========================\n\nThe following steps describe the instal"
},
{
"path": "docs/Contribute.html",
"chars": 10817,
"preview": "<?xml version=\"1.0\" encoding=\"utf-8\" ?>\n<!DOCTYPE html PUBLIC \"-//W3C//DTD XHTML 1.0 Transitional//EN\" \"http://www.w3.or"
},
{
"path": "docs/Contribute.rst",
"chars": 8415,
"preview": "===================\nContributing to S2E\n===================\n\nSubmitting patches\n==================\n\nS2E welcomes contrib"
},
{
"path": "docs/EquivalenceTesting.html",
"chars": 10226,
"preview": "<?xml version=\"1.0\" encoding=\"utf-8\" ?>\n<!DOCTYPE html PUBLIC \"-//W3C//DTD XHTML 1.0 Transitional//EN\" \"http://www.w3.or"
},
{
"path": "docs/EquivalenceTesting.rst",
"chars": 4563,
"preview": "===================\nEquivalence Testing\n===================\n\nGiven two functions ``f`` and ``g``, we would like to check"
},
{
"path": "docs/FAQ.html",
"chars": 13186,
"preview": "<?xml version=\"1.0\" encoding=\"utf-8\" ?>\n<!DOCTYPE html PUBLIC \"-//W3C//DTD XHTML 1.0 Transitional//EN\" \"http://www.w3.or"
},
{
"path": "docs/FAQ.rst",
"chars": 8904,
"preview": "======================================\nFrequently Asked Questions (FAQ)\n======================================\n\n.. conte"
},
{
"path": "docs/Howtos/Concolic.html",
"chars": 9059,
"preview": "<?xml version=\"1.0\" encoding=\"utf-8\" ?>\n<!DOCTYPE html PUBLIC \"-//W3C//DTD XHTML 1.0 Transitional//EN\" \"http://www.w3.or"
},
{
"path": "docs/Howtos/Concolic.rst",
"chars": 7568,
"preview": "=================================================\nAnalyzing Large Programs Using Concolic Execution\n===================="
},
{
"path": "docs/Howtos/Debugging.html",
"chars": 1922,
"preview": "<?xml version=\"1.0\" encoding=\"utf-8\" ?>\n<!DOCTYPE html PUBLIC \"-//W3C//DTD XHTML 1.0 Transitional//EN\" \"http://www.w3.or"
},
{
"path": "docs/Howtos/Debugging.rst",
"chars": 1008,
"preview": "====================\nDebugging Guest Code\n====================\n\nIt is possible to attach GDB to any running instance of "
},
{
"path": "docs/Howtos/ExecutionTracers.html",
"chars": 5722,
"preview": "<?xml version=\"1.0\" encoding=\"utf-8\" ?>\n<!DOCTYPE html PUBLIC \"-//W3C//DTD XHTML 1.0 Transitional//EN\" \"http://www.w3.or"
},
{
"path": "docs/Howtos/ExecutionTracers.rst",
"chars": 3925,
"preview": "=============================\nHow to Use Execution Tracers?\n=============================\n\n.. contents::\n\n\nExecution tra"
},
{
"path": "docs/Howtos/Parallel.html",
"chars": 3488,
"preview": "<?xml version=\"1.0\" encoding=\"utf-8\" ?>\n<!DOCTYPE html PUBLIC \"-//W3C//DTD XHTML 1.0 Transitional//EN\" \"http://www.w3.or"
},
{
"path": "docs/Howtos/Parallel.rst",
"chars": 2190,
"preview": "============\nParallel S2E\n============\n\nS2E can be run in multi-process mode in order to speed up path exploration.\nEach"
},
{
"path": "docs/Howtos/WritingPlugins.html",
"chars": 24086,
"preview": "<?xml version=\"1.0\" encoding=\"utf-8\" ?>\n<!DOCTYPE html PUBLIC \"-//W3C//DTD XHTML 1.0 Transitional//EN\" \"http://www.w3.or"
},
{
"path": "docs/Howtos/WritingPlugins.rst",
"chars": 10967,
"preview": "===========================\nHow to Write an S2E plugin?\n===========================\n\nIn this tutorial, we show step-by-s"
},
{
"path": "docs/Howtos/init_env.html",
"chars": 9243,
"preview": "<?xml version=\"1.0\" encoding=\"utf-8\" ?>\n<!DOCTYPE html PUBLIC \"-//W3C//DTD XHTML 1.0 Transitional//EN\" \"http://www.w3.or"
},
{
"path": "docs/Howtos/init_env.rst",
"chars": 5810,
"preview": "===========================================\nHow to symbolically execute Linux binaries?\n================================"
},
{
"path": "docs/ImageInstallation.html",
"chars": 9165,
"preview": "<?xml version=\"1.0\" encoding=\"utf-8\" ?>\n<!DOCTYPE html PUBLIC \"-//W3C//DTD XHTML 1.0 Transitional//EN\" \"http://www.w3.or"
},
{
"path": "docs/ImageInstallation.rst",
"chars": 7091,
"preview": "=============================\nPreparing VM Images for S2E\n=============================\n\n.. contents::\n\nTo run S2E, you "
},
{
"path": "docs/Makefile",
"chars": 451,
"preview": "RST_FILES := $(wildcard *.rst */*.rst)\nHTML_FILES := $(RST_FILES:.rst=.html)\n\nall: $(HTML_FILES)\n\nclean:\n\trm -f $(HTML_F"
},
{
"path": "docs/Plugins/Annotation.html",
"chars": 15639,
"preview": "<?xml version=\"1.0\" encoding=\"utf-8\" ?>\n<!DOCTYPE html PUBLIC \"-//W3C//DTD XHTML 1.0 Transitional//EN\" \"http://www.w3.or"
},
{
"path": "docs/Plugins/Annotation.rst",
"chars": 11661,
"preview": "=======================\nAnnotation\n=======================\n\nThe Annotations plugin combines monitoring and instrumentati"
},
{
"path": "docs/Plugins/BaseInstructions.html",
"chars": 7696,
"preview": "<?xml version=\"1.0\" encoding=\"utf-8\" ?>\n<!DOCTYPE html PUBLIC \"-//W3C//DTD XHTML 1.0 Transitional//EN\" \"http://www.w3.or"
},
{
"path": "docs/Plugins/BaseInstructions.rst",
"chars": 3652,
"preview": "================\nBaseInstructions\n================\n\nThis plugin implements various custom instructions to control the be"
},
{
"path": "docs/Plugins/EdgeKiller.html",
"chars": 2288,
"preview": "<?xml version=\"1.0\" encoding=\"utf-8\" ?>\n<!DOCTYPE html PUBLIC \"-//W3C//DTD XHTML 1.0 Transitional//EN\" \"http://www.w3.or"
},
{
"path": "docs/Plugins/EdgeKiller.rst",
"chars": 1309,
"preview": "==========\nEdgeKiller\n==========\n\nThe EdgeKiller plugin looks for the execution of a sequence of program counters and ki"
},
{
"path": "docs/Plugins/FunctionMonitor.html",
"chars": 11382,
"preview": "<?xml version=\"1.0\" encoding=\"utf-8\" ?>\n<!DOCTYPE html PUBLIC \"-//W3C//DTD XHTML 1.0 Transitional//EN\" \"http://www.w3.or"
},
{
"path": "docs/Plugins/FunctionMonitor.rst",
"chars": 5548,
"preview": "===============\nFunctionMonitor\n===============\n\nThe FunctionMonitor plugin catches the call/return machine instructions"
},
{
"path": "docs/Plugins/ModuleExecutionDetector.html",
"chars": 2657,
"preview": "<?xml version=\"1.0\" encoding=\"utf-8\" ?>\n<!DOCTYPE html PUBLIC \"-//W3C//DTD XHTML 1.0 Transitional//EN\" \"http://www.w3.or"
},
{
"path": "docs/Plugins/ModuleExecutionDetector.rst",
"chars": 1635,
"preview": "=======================\nModuleExecutionDetector\n=======================\n\nThe ModuleExecutionDetector plugin signals othe"
},
{
"path": "docs/Plugins/RawMonitor.html",
"chars": 4756,
"preview": "<?xml version=\"1.0\" encoding=\"utf-8\" ?>\n<!DOCTYPE html PUBLIC \"-//W3C//DTD XHTML 1.0 Transitional//EN\" \"http://www.w3.or"
},
{
"path": "docs/Plugins/RawMonitor.rst",
"chars": 2781,
"preview": "==========\nRawMonitor\n==========\n\nThe RawMonitor plugin lets users specify via a custom instruction whenever a module of"
},
{
"path": "docs/Plugins/StateManager.html",
"chars": 3189,
"preview": "<?xml version=\"1.0\" encoding=\"utf-8\" ?>\n<!DOCTYPE html PUBLIC \"-//W3C//DTD XHTML 1.0 Transitional//EN\" \"http://www.w3.or"
},
{
"path": "docs/Plugins/StateManager.rst",
"chars": 2155,
"preview": "============\nStateManager\n============\n\nStateManager divides the path exploration in multiple steps by implementing the "
},
{
"path": "docs/Plugins/Tracers/ExecutionTracer.html",
"chars": 1589,
"preview": "<?xml version=\"1.0\" encoding=\"utf-8\" ?>\n<!DOCTYPE html PUBLIC \"-//W3C//DTD XHTML 1.0 Transitional//EN\" \"http://www.w3.or"
},
{
"path": "docs/Plugins/Tracers/ExecutionTracer.rst",
"chars": 714,
"preview": "===============\nExecutionTracer\n===============\n\nThe ExecutionTracer plugin is the main tracing plugin.\nThis plugin save"
},
{
"path": "docs/Plugins/Tracers/InstructionCounter.html",
"chars": 1375,
"preview": "<?xml version=\"1.0\" encoding=\"utf-8\" ?>\n<!DOCTYPE html PUBLIC \"-//W3C//DTD XHTML 1.0 Transitional//EN\" \"http://www.w3.or"
},
{
"path": "docs/Plugins/Tracers/InstructionCounter.rst",
"chars": 447,
"preview": "==================\nInstructionCounter\n==================\n\nThe InstructionCounter plugin counts the number of executed in"
},
{
"path": "docs/Plugins/Tracers/ModuleTracer.html",
"chars": 1606,
"preview": "<?xml version=\"1.0\" encoding=\"utf-8\" ?>\n<!DOCTYPE html PUBLIC \"-//W3C//DTD XHTML 1.0 Transitional//EN\" \"http://www.w3.or"
},
{
"path": "docs/Plugins/Tracers/ModuleTracer.rst",
"chars": 606,
"preview": "============\nModuleTracer\n============\n\nThe ModuleTracer records load events for modules specified by the `ModuleExecuti"
},
{
"path": "docs/Plugins/Tracers/TestCaseGenerator.html",
"chars": 1321,
"preview": "<?xml version=\"1.0\" encoding=\"utf-8\" ?>\n<!DOCTYPE html PUBLIC \"-//W3C//DTD XHTML 1.0 Transitional//EN\" \"http://www.w3.or"
},
{
"path": "docs/Plugins/Tracers/TestCaseGenerator.rst",
"chars": 395,
"preview": "=================\nTestCaseGenerator\n=================\n\nThe TestCaseGenerator plugin records in the execution trace the s"
},
{
"path": "docs/Plugins/Tracers/TranslationBlockTracer.html",
"chars": 2250,
"preview": "<?xml version=\"1.0\" encoding=\"utf-8\" ?>\n<!DOCTYPE html PUBLIC \"-//W3C//DTD XHTML 1.0 Transitional//EN\" \"http://www.w3.or"
},
{
"path": "docs/Plugins/Tracers/TranslationBlockTracer.rst",
"chars": 1195,
"preview": "======================\nTranslationBlockTracer\n======================\n\nThe TranslationBlockTracer plugin records the exec"
},
{
"path": "docs/Plugins/WindowsInterceptor/WindowsMonitor.html",
"chars": 2842,
"preview": "<?xml version=\"1.0\" encoding=\"utf-8\" ?>\n<!DOCTYPE html PUBLIC \"-//W3C//DTD XHTML 1.0 Transitional//EN\" \"http://www.w3.or"
},
{
"path": "docs/Plugins/WindowsInterceptor/WindowsMonitor.rst",
"chars": 1729,
"preview": "==============\nWindowsMonitor\n==============\n\nThe WindowsMonitor plugin implements the detection of module and process l"
},
{
"path": "docs/ProfilingS2E.html",
"chars": 3320,
"preview": "<?xml version=\"1.0\" encoding=\"utf-8\" ?>\n<!DOCTYPE html PUBLIC \"-//W3C//DTD XHTML 1.0 Transitional//EN\" \"http://www.w3.or"
},
{
"path": "docs/ProfilingS2E.rst",
"chars": 1567,
"preview": "=============\nProfiling S2E\n=============\n\nThis page explains how to profile and optimize S2E itself.\n\nRunning OProfile\n"
},
{
"path": "docs/SystemTap.html",
"chars": 19263,
"preview": "<?xml version=\"1.0\" encoding=\"utf-8\" ?>\n<!DOCTYPE html PUBLIC \"-//W3C//DTD XHTML 1.0 Transitional//EN\" \"http://www.w3.or"
},
{
"path": "docs/SystemTap.rst",
"chars": 9966,
"preview": "========================\nUsing SystemTap with S2E\n========================\n\nSystemTap is a powerful tracing framework on"
},
{
"path": "docs/TestingMinimalProgram.html",
"chars": 24371,
"preview": "<?xml version=\"1.0\" encoding=\"utf-8\" ?>\n<!DOCTYPE html PUBLIC \"-//W3C//DTD XHTML 1.0 Transitional//EN\" \"http://www.w3.or"
},
{
"path": "docs/TestingMinimalProgram.rst",
"chars": 10294,
"preview": "=================================\nTesting a Simple Program with S2E\n=================================\n\nThis tutorial ass"
},
{
"path": "docs/Tools/CoverageGenerator.html",
"chars": 2328,
"preview": "<?xml version=\"1.0\" encoding=\"utf-8\" ?>\n<!DOCTYPE html PUBLIC \"-//W3C//DTD XHTML 1.0 Transitional//EN\" \"http://www.w3.or"
},
{
"path": "docs/Tools/CoverageGenerator.rst",
"chars": 1273,
"preview": "==================\nCoverage Generator\n==================\n\nThe coverage generator tool outputs the basic block coverage o"
},
{
"path": "docs/Tools/DebugInfo.html",
"chars": 3520,
"preview": "<?xml version=\"1.0\" encoding=\"utf-8\" ?>\n<!DOCTYPE html PUBLIC \"-//W3C//DTD XHTML 1.0 Transitional//EN\" \"http://www.w3.or"
},
{
"path": "docs/Tools/DebugInfo.rst",
"chars": 2531,
"preview": "===========================\nSupported Debug Information\n===========================\n\nMost of the tools can print debug i"
},
{
"path": "docs/Tools/ExecutionProfiler.html",
"chars": 1348,
"preview": "<?xml version=\"1.0\" encoding=\"utf-8\" ?>\n<!DOCTYPE html PUBLIC \"-//W3C//DTD XHTML 1.0 Transitional//EN\" \"http://www.w3.or"
},
{
"path": "docs/Tools/ExecutionProfiler.rst",
"chars": 422,
"preview": "==================\nExecution Profiler\n==================\n\nThe execution profiler tool outputs various metrics about the "
},
{
"path": "docs/Tools/ForkProfiler.html",
"chars": 1690,
"preview": "<?xml version=\"1.0\" encoding=\"utf-8\" ?>\n<!DOCTYPE html PUBLIC \"-//W3C//DTD XHTML 1.0 Transitional//EN\" \"http://www.w3.or"
},
{
"path": "docs/Tools/ForkProfiler.rst",
"chars": 677,
"preview": "=============\nFork Profiler\n=============\n\nThe fork profiler tool lists all the program counters that caused a fork. \nTh"
},
{
"path": "docs/Tools/TbPrinter.html",
"chars": 2888,
"preview": "<?xml version=\"1.0\" encoding=\"utf-8\" ?>\n<!DOCTYPE html PUBLIC \"-//W3C//DTD XHTML 1.0 Transitional//EN\" \"http://www.w3.or"
},
{
"path": "docs/Tools/TbPrinter.rst",
"chars": 1636,
"preview": "=============\nTrace Printer\n=============\n\nThe trace printer tool outputs for each specified path all the trace items th"
},
{
"path": "docs/UsingS2EGet.html",
"chars": 5064,
"preview": "<?xml version=\"1.0\" encoding=\"utf-8\" ?>\n<!DOCTYPE html PUBLIC \"-//W3C//DTD XHTML 1.0 Transitional//EN\" \"http://www.w3.or"
},
{
"path": "docs/UsingS2EGet.rst",
"chars": 2497,
"preview": "=======================================================\nQuickly Uploading Programs to the Guest with ``s2eget``\n========"
},
{
"path": "docs/Windows/CheckedBuild.html",
"chars": 4480,
"preview": "<?xml version=\"1.0\" encoding=\"utf-8\" ?>\n<!DOCTYPE html PUBLIC \"-//W3C//DTD XHTML 1.0 Transitional//EN\" \"http://www.w3.or"
},
{
"path": "docs/Windows/CheckedBuild.rst",
"chars": 3302,
"preview": "=======================================\nSetting Up the Checked Build of Windows\n=======================================\n"
},
{
"path": "docs/Windows/DriverTutorial.html",
"chars": 29569,
"preview": "<?xml version=\"1.0\" encoding=\"utf-8\" ?>\n<!DOCTYPE html PUBLIC \"-//W3C//DTD XHTML 1.0 Transitional//EN\" \"http://www.w3.or"
},
{
"path": "docs/Windows/DriverTutorial.rst",
"chars": 21353,
"preview": "================================================\nAnalyzing Windows Drivers: Step-by-Step Tutorial\n======================"
},
{
"path": "docs/config.s2e.i686",
"chars": 45263,
"preview": "#\n# Automatically generated make config: don't edit\n# Linux kernel version: 2.6.26.8-s2e\n# Tue Aug 16 01:57:09 2011\n#\n# "
},
{
"path": "docs/index.html",
"chars": 9630,
"preview": "<?xml version=\"1.0\" encoding=\"utf-8\" ?>\n<!DOCTYPE html PUBLIC \"-//W3C//DTD XHTML 1.0 Transitional//EN\" \"http://www.w3.or"
},
{
"path": "docs/index.rst",
"chars": 5244,
"preview": "===============================================\nThe Selective Symbolic Execution (S²E) Platform\n========================"
},
{
"path": "docs/pygments-default.css",
"chars": 4006,
"preview": "/* Stylesheet for pygments enhanced reStructured Text */\n/* ================================================== */\n\n/* :A"
},
{
"path": "docs/rst2html-pygments",
"chars": 2082,
"preview": "#!/usr/bin/env python\n\n# :Author: David Goodger, the Pygments team, Guenter Milde\n# :Date: $Date: $\n# :Copyright: This m"
},
{
"path": "docs/rst2latex-pygments",
"chars": 2083,
"preview": "#!/usr/bin/env python\n\n# Author: David Goodger, the Pygments team, Günter Milde\n# Date: $Date: $\n# Copyright: This modu"
},
{
"path": "docs/s2e.css",
"chars": 3789,
"preview": "/*\n * LLVM documentation style sheet\n */\n\n/* Pygments style */\n@import url('pygments-default.css');\n\n/* Common styles */"
},
{
"path": "docs/sample/factorial.c",
"chars": 3191,
"preview": "/*\n * S2E Selective Symbolic Execution Framework\n *\n * Copyright (c) 2010, Dependable Systems Laboratory, EPFL\n * All ri"
},
{
"path": "guest/Makefile",
"chars": 609,
"preview": "include config.mak\n\nBINARIES = init_env.so s2ecmd s2eget\nCCFLAGS = -I$(TOOLS_DIR)/include -Wall -g -O0 -std=c99\nLDLIBS ="
},
{
"path": "guest/configure",
"chars": 330,
"preview": "#!/bin/sh\n\nBUILD_DIR=\"$(pwd)\"\n\ncd \"$(dirname $0)\"\nTOOLS_DIR=\"$(pwd)\"\ncd \"$BUILD_DIR\"\n\nif [ \"$BUILD_DIR\" = \"$TOOLS_DIR\" ]"
},
{
"path": "guest/demos/quicksort.c",
"chars": 921,
"preview": "/**\n * Quick sort concolic execution demo.\n * Code taken from http://en.wikibooks.org/wiki/Algorithm_Implementation/Sort"
},
{
"path": "guest/include/s2e-arm.h",
"chars": 13896,
"preview": "/*\n * S2E Selective Symbolic Execution Framework\n *\n * Copyright (c) 2010, Dependable Systems Laboratory, EPFL\n * All ri"
},
{
"path": "guest/include/s2e-x86.h",
"chars": 13704,
"preview": "/*\n * S2E Selective Symbolic Execution Framework\n *\n * Copyright (c) 2010, Dependable Systems Laboratory, EPFL\n * All ri"
},
{
"path": "guest/include/s2e.h",
"chars": 5095,
"preview": "/*\n * S2E Selective Symbolic Execution Framework\n *\n * Copyright (c) 2010, Dependable Systems Laboratory, EPFL\n * All ri"
},
{
"path": "guest/init_env/init_env.c",
"chars": 12336,
"preview": "/*\n * S2E Selective Symbolic Execution Framework\n *\n * Copyright (c) 2013, Dependable Systems Laboratory, EPFL\n * All ri"
},
{
"path": "guest/s2ecmd/s2ecmd.c",
"chars": 8550,
"preview": "/*\n * S2E Selective Symbolic Execution Framework\n *\n * Copyright (c) 2010, Dependable Systems Laboratory, EPFL\n * All ri"
},
{
"path": "guest/s2eget/s2eget.c",
"chars": 5240,
"preview": "/*\n * S2E Selective Symbolic Execution Framework\n *\n * Copyright (c) 2010, Dependable Systems Laboratory, EPFL\n * All ri"
},
{
"path": "guest/stp/s2e.stp",
"chars": 1230,
"preview": "#Sample of Systemtap functions for S2E support\n\n/** Terminate current state. */\nfunction s2e_kill_state(status:long, mes"
},
{
"path": "guest/windbg-gdb/BFDInterface.cpp",
"chars": 8610,
"preview": "#include <inttypes.h>\n#include <iostream>\n#include <stdio.h>\n\n#include \"BFDInterface.h\"\n\n\nusing namespace std;\n\n\nBFDInte"
},
{
"path": "guest/windbg-gdb/BFDInterface.h",
"chars": 1523,
"preview": "#ifndef _WINDBG_BFDINTERFACE_\n\n#define _WINDBG_BFDINTERFACE_\n\nextern \"C\" {\n#include <bfd.h>\n}\n\n#include <string>\n#includ"
},
{
"path": "guest/windbg-gdb/Makefile",
"chars": 463,
"preview": "PROGRAM=gdb.dll\nSOURCES=BFDInterface.cpp main.cpp Symbols.cpp\nWINDBG=/c/Program Files/Debugging Tools for Windows (x64)\n"
},
{
"path": "guest/windbg-gdb/StartSize.h",
"chars": 366,
"preview": "#ifndef _WINDBG_STARTSIZE_\n\n#define _WINDBG_STARTSIZE_\n\n#include <inttypes.h>\n\nstruct StartSize {\n uint64_t Start, Si"
},
{
"path": "guest/windbg-gdb/Symbols.cpp",
"chars": 5550,
"preview": "#include <windows.h>\n#include <psapi.h>\n#include \"Symbols.h\"\n\nSymbols::Symbols(IDebugClient *client)\n{\n Control = NUL"
},
{
"path": "guest/windbg-gdb/Symbols.h",
"chars": 1153,
"preview": "#ifndef _WINDBG_SYMBOLS_\n\n#define _WINDBG_SYMBOLS_\n\n#include <map>\n#include <string>\n\n#include \"BFDInterface.h\"\n#include"
},
{
"path": "guest/windbg-gdb/gdbsyms.def",
"chars": 98,
"preview": "LIBRARY \"GDBSYMS.DLL\"\n\nEXPORTS\n DebugExtensionInitialize\n DebugExtensionNotify\n gdbsyms\n\n"
},
{
"path": "guest/windbg-gdb/main.cpp",
"chars": 4781,
"preview": "#define INITGUID\n\n#include <string>\n#include <map>\n#include <stdio.h>\n#include <windows.h>\n#include <psapi.h>\n#include <"
},
{
"path": "klee/LICENSE.TXT",
"chars": 2872,
"preview": "==============================================================================\nklee Release License\n===================="
},
{
"path": "klee/Makefile",
"chars": 1448,
"preview": "#===-- klee/Makefile ---------------------------------------*- Makefile -*--===#\n#\n# The KLEE Symbol"
},
{
"path": "klee/Makefile.common",
"chars": 1037,
"preview": "# -*- Makefile -*-\n\ninclude $(LEVEL)/Makefile.config\n\n# Include LLVM's Master Makefile config and rules.\ninclude $(LLVM_"
},
{
"path": "klee/Makefile.config.in",
"chars": 1359,
"preview": "# -*- Makefile -*-\n\n# Set the name of the project here\nPROJECT_NAME := klee\nPROJ_VERSION := 0.01\n\n# Set this variable to"
},
{
"path": "klee/README.txt",
"chars": 1155,
"preview": "//===----------------------------------------------------------------------===//\n// Klee Symbolic Virtual Machine\n//===-"
},
{
"path": "klee/TODO.txt",
"chars": 2071,
"preview": "TODO\n--\n\nBuild System / Configure / Release Cleanups\n--\n o Rename .bout to .ktest (klee test)\n\n o Rename .pc to .kquery "
},
{
"path": "klee/autoconf/AutoRegen.sh",
"chars": 1409,
"preview": "#!/bin/sh\n\nif ([ \"$#\" != 1 ] || \n [ ! -d \"$1\" ] ||\n [ ! -d \"$1/autoconf/m4\" ]); then\n echo \"usage: $0 <llvmsrc-"
},
{
"path": "klee/autoconf/config.guess",
"chars": 43332,
"preview": "#! /bin/sh\n# Attempt to guess a canonical system name.\n# Copyright (C) 1992, 1993, 1994, 1995, 1996, 1997, 1998, 1999,"
},
{
"path": "klee/autoconf/config.sub",
"chars": 31307,
"preview": "#! /bin/sh\n# Configuration validation subroutine script.\n# Copyright (C) 1992, 1993, 1994, 1995, 1996, 1997, 1998, 199"
},
{
"path": "klee/autoconf/configure.ac",
"chars": 10658,
"preview": "dnl **************************************************************************\ndnl * Initialize\ndnl ********************"
},
{
"path": "klee/autoconf/install-sh",
"chars": 9206,
"preview": "#!/bin/sh\n# install - install a program, script, or datafile\n\nscriptversion=2004-09-10.20\n\n# This originates from X11R5 "
},
{
"path": "klee/configure",
"chars": 167791,
"preview": "#! /bin/sh\n# Guess values for system-dependent variables and create Makefiles.\n# Generated by GNU Autoconf 2.65 for KLEE"
},
{
"path": "klee/docs/SMT-COMP/BitVector_ArraysEx.smt",
"chars": 2305,
"preview": "(theory BitVector_ArraysEx\n\n :written_by {Clark Barrett}\n :date {May 7, 2007}\n \n:sorts_description {\n All sort symbol"
},
{
"path": "klee/docs/SMT-COMP/BitVectors.smt",
"chars": 6143,
"preview": "(theory Fixed_Size_BitVectors\n\n:written_by {Silvio Ranise, Cesare Tinelli, and Clark Barrett}\n\n:date {May 7, 2007}\n\n:not"
},
{
"path": "klee/docs/SMT-COMP/QF_AUFBV.smt",
"chars": 496,
"preview": "(logic QF_AUFBV\n\n :written_by {Clark Barrett}\n :date {May 7, 2007}\n \n :theory BV_ArraysEx\n\n :language \n \"Closed quantifi"
},
{
"path": "klee/docs/SMT-COMP/QF_BV.smt",
"chars": 10245,
"preview": "(logic QF_BV\n\n:written_by {Silvio Ranise, Cesare Tinelli, and Clark Barrett}\n:date {May 7, 2007}\n\n:theory Fixed_Size_Bit"
},
{
"path": "klee/docs/doxygen.cfg",
"chars": 53935,
"preview": "# Doxyfile 1.5.3\n\n# This file describes the settings to be used by the documentation system\n# doxygen (www.doxygen.org) "
},
{
"path": "klee/docs/intro",
"chars": 328,
"preview": "/// @mainpage KLEE\n///\n/// @section main_intro Introduction\n/// Welcome to KLEE. KLEE is a symbolic execution engine tha"
},
{
"path": "klee/docs/overview",
"chars": 5394,
"preview": "/// @page overview High level overview of KLEE.\n/// This document contains a high level overview of the inner workings o"
},
{
"path": "klee/examples/islower/islower.c",
"chars": 262,
"preview": "/*\n * First KLEE tutorial: testing a small function\n */\n\n#include <klee/klee.h>\n\nint my_islower(int x) {\n if (x >= 'a' "
},
{
"path": "klee/examples/regexp/Regexp.c",
"chars": 1186,
"preview": "/* \n * Simple regular expression matching.\n *\n * From:\n * The Practice of Programming\n * Brian W. Kernighan, Rob Pik"
},
{
"path": "klee/examples/regexp/notes.txt",
"chars": 519,
"preview": "clang -m32 -I ~/private/klee/include -c -emit-llvm Regexp.c\n\nklee Regexp.o\nklee --only-output-states-covering-new Regexp"
},
{
"path": "klee/examples/sort/sort.c",
"chars": 1670,
"preview": "#include <klee/klee.h>\n\n#include <stdlib.h>\n#include <stdio.h>\n#include <string.h>\n#include <assert.h>\n\nstatic void inse"
},
{
"path": "klee/include/expr/Lexer.h",
"chars": 4097,
"preview": "//===-- Lexer.h -------------------------------------------------*- C++ -*-===//\n//\n// The KLEE Symb"
},
{
"path": "klee/include/expr/Parser.h",
"chars": 6785,
"preview": "//===-- Parser.h ------------------------------------------------*- C++ -*-===//\n//\n// The KLEE Symb"
},
{
"path": "klee/include/klee/AddressSpace.h",
"chars": 5467,
"preview": "//===-- AddressSpace.h ------------------------------------------*- C++ -*-===//\n//\n// The KLEE Symb"
},
{
"path": "klee/include/klee/BitfieldSimplifier.h",
"chars": 2890,
"preview": "/*\n * S2E Selective Symbolic Execution Framework\n *\n * Copyright (c) 2010, Dependable Systems Laboratory, EPFL\n * All ri"
},
{
"path": "klee/include/klee/CallPathManager.h",
"chars": 2030,
"preview": "//===-- CallPathManager.h ---------------------------------------*- C++ -*-===//\n//\n// The KLEE Symb"
},
{
"path": "klee/include/klee/Common.h",
"chars": 2919,
"preview": "//===-- Common.h ------------------------------------------------*- C++ -*-===//\n//\n// The KLEE Symb"
},
{
"path": "klee/include/klee/Config/common.h",
"chars": 0,
"preview": ""
},
{
"path": "klee/include/klee/Config/config.h.in",
"chars": 2134,
"preview": "/* include/klee/Config/config.h.in. Generated from autoconf/configure.tmp.ac by autoheader. */\n\n/* Define if stplog en"
},
{
"path": "klee/include/klee/Constraints.h",
"chars": 2372,
"preview": "//===-- Constraints.h -------------------------------------------*- C++ -*-===//\n//\n// The KLEE Symb"
},
{
"path": "klee/include/klee/Context.h",
"chars": 1289,
"preview": "//===-- Context.h -----------------------------------------------*- C++ -*-===//\n//\n// The KLEE Symb"
},
{
"path": "klee/include/klee/CoreStats.h",
"chars": 1527,
"preview": "//===-- CoreStats.h ---------------------------------------------*- C++ -*-===//\n//\n// The KLEE Symb"
},
{
"path": "klee/include/klee/ExecutionState.h",
"chars": 4303,
"preview": "//===-- ExecutionState.h ----------------------------------------*- C++ -*-===//\n//\n// The KLEE Symb"
},
{
"path": "klee/include/klee/Executor.h",
"chars": 20023,
"preview": "//===-- Executor.h ----------------------------------------------*- C++ -*-===//\n//\n// The KLEE Symb"
},
{
"path": "klee/include/klee/Expr.h",
"chars": 31890,
"preview": "//===-- Expr.h --------------------------------------------------*- C++ -*-===//\n//\n// The KLEE Symb"
},
{
"path": "klee/include/klee/ExprBuilder.h",
"chars": 4069,
"preview": "//===-- ExprBuilder.h -------------------------------------------*- C++ -*-===//\n//\n// The KLEE Symb"
},
{
"path": "klee/include/klee/ExternalDispatcher.h",
"chars": 1571,
"preview": "//===-- ExternalDispatcher.h ------------------------------------*- C++ -*-===//\n//\n// The KLEE Symb"
},
{
"path": "klee/include/klee/IncompleteSolver.h",
"chars": 3675,
"preview": "//===-- IncompleteSolver.h --------------------------------------*- C++ -*-===//\n//\n// The KLEE Symb"
},
{
"path": "klee/include/klee/Internal/ADT/DiscretePDF.h",
"chars": 1233,
"preview": "//===-- DiscretePDF.h -------------------------------------------*- C++ -*-===//\n//\n// The KLEE Symb"
},
{
"path": "klee/include/klee/Internal/ADT/DiscretePDF.inc",
"chars": 6647,
"preview": "//===- DiscretePDF.inc - --*- C++ -*-===//\n\n//\n\nnamespace klee {\n\ntemplate <class T>\nclass DiscretePDF<T>::Node\n{\nprivat"
},
{
"path": "klee/include/klee/Internal/ADT/ImmutableMap.h",
"chars": 2741,
"preview": "//===-- ImmutableMap.h ------------------------------------------*- C++ -*-===//\n//\n// The KLEE Symb"
},
{
"path": "klee/include/klee/Internal/ADT/ImmutableSet.h",
"chars": 2546,
"preview": "//===-- ImmutableSet.h ------------------------------------------*- C++ -*-===//\n//\n// The KLEE Symb"
},
{
"path": "klee/include/klee/Internal/ADT/ImmutableTree.h",
"chars": 18023,
"preview": "//===-- ImmutableTree.h -----------------------------------------*- C++ -*-===//\n//\n// The KLEE Symb"
},
{
"path": "klee/include/klee/Internal/ADT/KTest.h",
"chars": 1375,
"preview": "//===-- KTest.h --------------------------------------------------*- C++ -*-===//\n//\n// The KLEE Sym"
},
{
"path": "klee/include/klee/Internal/ADT/MapOfSets.h",
"chars": 11512,
"preview": "//===-- MapOfSets.h ---------------------------------------------*- C++ -*-===//\n//\n// The KLEE Symb"
},
{
"path": "klee/include/klee/Internal/ADT/RNG.h",
"chars": 1533,
"preview": "//===-- RNG.h ---------------------------------------------------*- C++ -*-===//\n//\n// The KLEE Symb"
},
{
"path": "klee/include/klee/Internal/ADT/TreeStream.h",
"chars": 1614,
"preview": "//===-- TreeStream.h --------------------------------------------*- C++ -*-===//\n//\n// The KLEE Symb"
},
{
"path": "klee/include/klee/Internal/Module/Cell.h",
"chars": 500,
"preview": "//===-- Cell.h --------------------------------------------------*- C++ -*-===//\n//\n// The KLEE Symb"
},
{
"path": "klee/include/klee/Internal/Module/InstructionInfoTable.h",
"chars": 1836,
"preview": "//===-- InstructionInfoTable.h ----------------------------------*- C++ -*-===//\n//\n// The KLEE Symb"
},
{
"path": "klee/include/klee/Internal/Module/KInstIterator.h",
"chars": 1201,
"preview": "//===-- KInstIterator.h -----------------------------------------*- C++ -*-===//\n//\n// The KLEE Symb"
},
{
"path": "klee/include/klee/Internal/Module/KInstruction.h",
"chars": 1975,
"preview": "//===-- KInstruction.h ------------------------------------------*- C++ -*-===//\n//\n// The KLEE Symb"
},
{
"path": "klee/include/klee/Internal/Module/KModule.h",
"chars": 3394,
"preview": "//===-- KModule.h -----------------------------------------------*- C++ -*-===//\n//\n// The KLEE Symb"
},
{
"path": "klee/include/klee/Internal/README.txt",
"chars": 145,
"preview": "This directory holds header files for things which are exposed as part\nof the internal API of a library, but shouldn't b"
},
{
"path": "klee/include/klee/Internal/Support/FloatEvaluation.h",
"chars": 9180,
"preview": "//===-- FloatEvaluation.h ---------------------------------------*- C++ -*-===//\n//\n// The KLEE Symb"
},
{
"path": "klee/include/klee/Internal/Support/IntEvaluation.h",
"chars": 4694,
"preview": "//===-- IntEvaluation.h -----------------------------------------*- C++ -*-===//\n//\n// The KLEE Symb"
},
{
"path": "klee/include/klee/Internal/Support/ModuleUtil.h",
"chars": 1214,
"preview": "//===-- ModuleUtil.h --------------------------------------------*- C++ -*-===//\n//\n// The KLEE Symb"
},
{
"path": "klee/include/klee/Internal/Support/QueryLog.h",
"chars": 1355,
"preview": "//===-- QueryLog.h ----------------------------------------------*- C++ -*-===//\n//\n// The KLEE Symb"
},
{
"path": "klee/include/klee/Internal/Support/Timer.h",
"chars": 626,
"preview": "//===-- Timer.h -------------------------------------------------*- C++ -*-===//\n//\n// The KLEE Symb"
},
{
"path": "klee/include/klee/Internal/System/Time.h",
"chars": 496,
"preview": "//===-- Time.h --------------------------------------------------*- C++ -*-===//\n//\n// The KLEE Symb"
},
{
"path": "klee/include/klee/Interpreter.h",
"chars": 5017,
"preview": "//===-- Interpreter.h - Abstract Execution Engine Interface -----*- C++ -*-===//\n//\n// The KLEE Symb"
},
{
"path": "klee/include/klee/Memory.h",
"chars": 8331,
"preview": "//===-- Memory.h ------------------------------------------------*- C++ -*-===//\n//\n// The KLEE Symb"
},
{
"path": "klee/include/klee/ObjectHolder.h",
"chars": 822,
"preview": "//===-- ObjectHolder.h ------------------------------------------*- C++ -*-===//\n//\n// The KLEE Symb"
},
{
"path": "klee/include/klee/PTree.h",
"chars": 1248,
"preview": "//===-- PTree.h -------------------------------------------------*- C++ -*-===//\n//\n// The KLEE Symb"
},
{
"path": "klee/include/klee/Searcher.h",
"chars": 8591,
"preview": "//===-- Searcher.h ----------------------------------------------*- C++ -*-===//\n//\n// The KLEE Symb"
},
{
"path": "klee/include/klee/Solver.h",
"chars": 7388,
"preview": "//===-- Solver.h ------------------------------------------------*- C++ -*-===//\n//\n// The KLEE Symb"
},
{
"path": "klee/include/klee/SolverImpl.h",
"chars": 2039,
"preview": "//===-- SolverImpl.h --------------------------------------------*- C++ -*-===//\n//\n// The KLEE Symb"
},
{
"path": "klee/include/klee/SolverStats.h",
"chars": 823,
"preview": "//===-- SolverStats.h -------------------------------------------*- C++ -*-===//\n//\n// The KLEE Symb"
},
{
"path": "klee/include/klee/Statistic.h",
"chars": 1928,
"preview": "//===-- Statistic.h ---------------------------------------------*- C++ -*-===//\n//\n// The KLEE Symb"
},
{
"path": "klee/include/klee/Statistics.h",
"chars": 4836,
"preview": "//===-- Statistics.h --------------------------------------------*- C++ -*-===//\n//\n// The KLEE Symb"
},
{
"path": "klee/include/klee/StatsTracker.h",
"chars": 2551,
"preview": "//===-- StatsTracker.h ------------------------------------------*- C++ -*-===//\n//\n// The KLEE Symb"
},
{
"path": "klee/include/klee/TimerStatIncrementer.h",
"chars": 814,
"preview": "//===-- TimerStatIncrementer.h ----------------------------------*- C++ -*-===//\n//\n// The KLEE Symb"
},
{
"path": "klee/include/klee/UserSearcher.h",
"chars": 639,
"preview": "//===-- UserSearcher.h ------------------------------------------*- C++ -*-===//\n//\n// The KLEE Symb"
},
{
"path": "klee/include/klee/util/Assignment.h",
"chars": 3011,
"preview": "//===-- Assignment.h --------------------------------------------*- C++ -*-===//\n//\n// The KLEE Symb"
},
{
"path": "klee/include/klee/util/BitArray.h",
"chars": 1850,
"preview": "//===-- BitArray.h ----------------------------------------------*- C++ -*-===//\n//\n// The KLEE Symb"
},
{
"path": "klee/include/klee/util/Bits.h",
"chars": 2675,
"preview": "//===-- Bits.h --------------------------------------------------*- C++ -*-===//\n//\n// The KLEE Symb"
},
{
"path": "klee/include/klee/util/ExprEvaluator.h",
"chars": 1313,
"preview": "//===-- ExprEvaluator.h -----------------------------------------*- C++ -*-===//\n//\n// The KLEE Symb"
},
{
"path": "klee/include/klee/util/ExprHashMap.h",
"chars": 1065,
"preview": "//===-- ExprHashMap.h -------------------------------------------*- C++ -*-===//\n//\n// The KLEE Symb"
},
{
"path": "klee/include/klee/util/ExprPPrinter.h",
"chars": 2351,
"preview": "//===-- ExprPPrinter.h ------------------------------------------*- C++ -*-===//\n//\n// The KLEE Symb"
},
{
"path": "klee/include/klee/util/ExprRangeEvaluator.h",
"chars": 7596,
"preview": "//===-- ExprRangeEvaluator.h ------------------------------------*- C++ -*-===//\n//\n// The KLEE Symb"
},
{
"path": "klee/include/klee/util/ExprUtil.h",
"chars": 1367,
"preview": "//===-- ExprUtil.h ----------------------------------------------*- C++ -*-===//\n//\n// The KLEE Symb"
},
{
"path": "klee/include/klee/util/ExprVisitor.h",
"chars": 3166,
"preview": "//===-- ExprVisitor.h -------------------------------------------*- C++ -*-===//\n//\n// The KLEE Symb"
},
{
"path": "klee/include/klee/util/Ref.h",
"chars": 3157,
"preview": "//===-- Ref.h ---------------------------------------------------*- C++ -*-===//\n//\n// The KLEE Symb"
},
{
"path": "klee/lib/Basic/KTest.cpp",
"chars": 5074,
"preview": "//===-- KTest.cpp ---------------------------------------------------------===//\n//\n// The KLEE Symb"
},
{
"path": "klee/lib/Basic/Makefile",
"chars": 444,
"preview": "#===-- lib/Basic/Makefile ----------------------------------*- Makefile -*--===#\n#\n# The KLEE Symbol"
},
{
"path": "klee/lib/Basic/README.txt",
"chars": 197,
"preview": "This directory holds the most basic support facilities provided for\nboth the klee and kleaver libraries. The code in thi"
},
{
"path": "klee/lib/Basic/Statistics.cpp",
"chars": 2199,
"preview": "//===-- Statistics.cpp ----------------------------------------------------===//\n//\n// The KLEE Symb"
},
{
"path": "klee/lib/Core/AddressSpace.cpp",
"chars": 12263,
"preview": "//===-- AddressSpace.cpp --------------------------------------------------===//\n//\n// The KLEE Symb"
},
{
"path": "klee/lib/Core/CallPathManager.cpp",
"chars": 2947,
"preview": "//===-- CallPathManager.cpp -----------------------------------------------===//\n//\n// The KLEE Symb"
},
{
"path": "klee/lib/Core/Common.cpp",
"chars": 3931,
"preview": "//===-- Common.cpp --------------------------------------------------------===//\n//\n// The KLEE Symb"
},
{
"path": "klee/lib/Core/Context.cpp",
"chars": 1134,
"preview": "//===-- Context.cpp -------------------------------------------------------===//\n//\n// The KLEE Symb"
},
{
"path": "klee/lib/Core/CoreStats.cpp",
"chars": 1333,
"preview": "//===-- CoreStats.cpp -----------------------------------------------------===//\n//\n// The KLEE Symb"
},
{
"path": "klee/lib/Core/ExecutionState.cpp",
"chars": 9773,
"preview": "//===-- ExecutionState.cpp ------------------------------------------------===//\n//\n// The KLEE Symb"
}
]
// ... and 3376 more files (download for full content)
About this extraction
This page contains the full source code of the dslab-epfl/s2e GitHub repository, extracted and formatted as plain text for AI agents and large language models (LLMs). The extraction includes 3576 files (63.5 MB), approximately 13.2M tokens, and a symbol index with 31283 extracted functions, classes, methods, constants, and types. Use this with OpenClaw, Claude, ChatGPT, Cursor, Windsurf, or any other AI tool that accepts text input. You can copy the full output to your clipboard or download it as a .txt file.
Extracted by GitExtract — free GitHub repo to text converter for AI. Built by Nikandr Surkov.