How to trace a variable and slice all the code that it touches with Frama-C

Question

Is it possible to trace a variable and slice all the code it touches using Frama-C? For example consider the following program:

#include <stdio.h>

#define SIZE 512

int storage[SIZE];

void insert(int index, int val) {
    storage[index] = val;
}

int main(int argc, char *argv[]) {
    int x = 10;
    int y = 20;
    int z = 30;

    z = 0; /* some change to unrelated var */

    insert(x, y);

    return 0;
}

My expected slice for variable x is:

#include <stdio.h>

#define SIZE 512

int storage[SIZE];

void insert(int index, int val) {
    storage[index] = val;
}

int main(int argc, char *argv[]) {
    int x = 10;
    int y = 20;

    insert(x, y);

    return 0;
}

How can I achieve this? So far, I have tried following frama-c slice_issue.c -no-frama-c-stdlib -kernel-msg-key -slice-value x -then-on 'Slicing export' -print. It generates following slice:

/* Generated by Frama-C */
int main(void)
{
  int __retres;
  int x = 10;
  __retres = 0;
  return __retres;
}

I can get the expected output if I supply -slice-calls insert in slice command. But is there any way to get the same effect without specifying the function names explicitly in the slice commands?

Thanks in advance. Any hints or pointing to the documentation will be appreciated.

score 1 · Accepted Answer · answered Oct 05 '21 at 07:02

I'm not sure that -slice-calls is doing what you want. According to frama-c -slicing-help:

-slice-calls <f1, ..., fn> select every calls to functions f1,...,fn, and all their effect.

In other words, you're adding to the slicing criterion any call to insert, regardless of whether one of the arguments is x or not (e.g. if you replace your call with insert(z,y), it will also be kept in the slice.

It seems to me that you're more after -slice-rd x. Quoting again frama-c -slicing-help:

-slice-rd <v1, ..., vn> select the read accesses to left-values v1,...,vn (addresses are evaluated at the beginning of the function given as entry point)

With that, insert(x,y); is added to the slicing criterion because there's a read access to x, not because it is a call to insert (and insert(z,y) gets discarded as expected).

That said, if you really want to trace all calls to all functions, as with many options that takes a set of functions as parameter, you can do it with -slice-calls @all (see section 3.3.3 of Frama-C's user manual)

How to trace a variable and slice all the code that it touches with Frama-C

1 Answers1