Skip to content
GitLab
Explore
Sign in
Register
Primary navigation
Search or go to…
Project
C
cortex-m-rtfm-klee
Manage
Activity
Members
Labels
Plan
Issues
Issue boards
Milestones
Wiki
Code
Merge requests
Repository
Branches
Commits
Tags
Repository graph
Compare revisions
Snippets
Build
Pipelines
Jobs
Pipeline schedules
Artifacts
Deploy
Releases
Model registry
Operate
Environments
Monitor
Incidents
Analyze
Value stream analytics
Contributor analytics
CI/CD analytics
Repository analytics
Model experiments
Help
Help
Support
GitLab documentation
Compare GitLab plans
GitLab community forum
Contribute to GitLab
Provide feedback
Keyboard shortcuts
?
Snippets
Groups
Projects
Show more breadcrumbs
KLEE
cortex-m-rtfm-klee
Commits
a8524aee
Commit
a8524aee
authored
Feb 26, 2018
by
Henrik Tjäder
Browse files
Options
Downloads
Patches
Plain Diff
Spellcheck and modded gitignore
parent
4611bc48
No related branches found
No related tags found
No related merge requests found
Changes
3
Show whitespace changes
Inline
Side-by-side
Showing
3 changed files
.gitignore
+4
-0
4 additions, 0 deletions
.gitignore
examples/panic3.rs
+7
-7
7 additions, 7 deletions
examples/panic3.rs
examples/panic4.rs
+3
-3
3 additions, 3 deletions
examples/panic4.rs
with
14 additions
and
10 deletions
.gitignore
+
4
−
0
View file @
a8524aee
...
@@ -4,3 +4,7 @@
...
@@ -4,3 +4,7 @@
.gdb_history
.gdb_history
Cargo.lock
Cargo.lock
target/
target/
*.swp
tags
klee/tasks.txt
output/
This diff is collapsed.
Click to expand it.
examples/panic3.rs
+
7
−
7
View file @
a8524aee
...
@@ -73,13 +73,13 @@ fn idle() -> ! {
...
@@ -73,13 +73,13 @@ fn idle() -> ! {
// with a non atomic data type (u64), amounting to sequential reads
// with a non atomic data type (u64), amounting to sequential reads
// (which are 32 bit on the ARM Cortex M).
// (which are 32 bit on the ARM Cortex M).
//
//
// However the framework analysis is clever enough
t
to realize that the tasks
// However the framework analysis is clever enough to realize that the tasks
// `EXTI1` and `EXTI2` can never preempt each other, hence we can
// `EXTI1` and `EXTI2` can never preempt each other, hence we can
// can access the data without "claiming" the resouce.
// can access the data without "claiming" the resou
r
ce.
//
//
// Access is done by "dereferencing" `*r.X`, and we can now assert
the
// Access is done by "dereferencing" `*r.X`, and we can now assert
// the value to be `*r.X`. However, as tasks oper
et
ate concurrently,
// the value to be `*r.X`. However, as tasks operate concurrently,
// (without knowle
g
de on other tasks in the system), our analysis here
// (without knowled
g
e on other tasks in the system), our analysis here
// marks `X` as a (implicitly) symbolic.
// marks `X` as a (implicitly) symbolic.
//
//
// Compile and run the example in KLEE.
// Compile and run the example in KLEE.
...
@@ -94,9 +94,9 @@ fn idle() -> ! {
...
@@ -94,9 +94,9 @@ fn idle() -> ! {
// ["EXTI1", "EXTI2"]
// ["EXTI1", "EXTI2"]
//
//
// In this case EXTI => task 0, EXTI2 = task 1, but they might be swapped
// In this case EXTI => task 0, EXTI2 = task 1, but they might be swapped
// due to the underlyin
d
data structure being an (unordered) hash-map.
// due to the underlyin
g
data structure being an (unordered) hash-map.
//
//
// Now uncomment the code in `ex
i
ti2` and comment out the assertion in `exti1`.
// Now uncomment the code in `exti2` and comment out the assertion in `exti1`.
//
//
// Run the KLEE tool and find the failing assertion.
// Run the KLEE tool and find the failing assertion.
//
//
...
...
This diff is collapsed.
Click to expand it.
examples/panic4.rs
+
3
−
3
View file @
a8524aee
...
@@ -48,10 +48,10 @@ fn exti1(t: &mut Threshold, mut r: EXTI1::Resources) {
...
@@ -48,10 +48,10 @@ fn exti1(t: &mut Threshold, mut r: EXTI1::Resources) {
}
}
fn
exti2
(
t
:
&
mut
Threshold
,
r
:
EXTI2
::
Resources
)
{
fn
exti2
(
t
:
&
mut
Threshold
,
r
:
EXTI2
::
Resources
)
{
// k_assume(*r.X > _ && *r.X < _); // pre-con
t
ition on X
// k_assume(*r.X > _ && *r.X < _); // pre-con
d
ition on X
let
b
=
r
.A
[
*
r
.X
as
usize
];
let
b
=
r
.A
[
*
r
.X
as
usize
];
*
r
.I
=
b
;
*
r
.I
=
b
;
// as we don't change X post-cond
t
iton is trivially true
// as we don't change X post-condit
i
on is trivially true
}
}
// The `init` function
// The `init` function
...
@@ -91,7 +91,7 @@ fn idle() -> ! {
...
@@ -91,7 +91,7 @@ fn idle() -> ! {
// You should not change the code, just enable the contacts
// You should not change the code, just enable the contacts
// The `_` should be filled with concrete values
// The `_` should be filled with concrete values
//
//
// Can you find a type invariant that satisfies BOTH pre- and post-cond
t
itons
// Can you find a type invariant that satisfies BOTH pre- and post-condit
i
ons
// at the same time.
// at the same time.
//
//
// If not, why is that not possible?
// If not, why is that not possible?
This diff is collapsed.
Click to expand it.
Preview
0%
Loading
Try again
or
attach a new file
.
Cancel
You are about to add
0
people
to the discussion. Proceed with caution.
Finish editing this message first!
Save comment
Cancel
Please
register
or
sign in
to comment