weir/ifds.rs
1//! DF-4 - IFDS/IDE interprocedural dataflow framework.
2//!
3//! Reps & Horwitz & Sagiv (1995): distributive dataflow problems
4//! over a finite domain D reduce to graph reachability on the
5//! exploded super-graph. Nodes are (statement × fact) pairs; edges
6//! encode flow + call-return summary edges. Reaching a sink fact
7//! from a source fact = the source taint flows to the sink along
8//! some interprocedural path that respects matched call/return.
9//!
10//! Following the `vyre-libs::security::flows_to` idiom, this module
11//! ships ONE dispatch step of forward reachability over the super-
12//! graph. The caller-side fixpoint driver iterates it until the
13//! reach frontier converges, and the surge stdlib composes the
14//! source/sink/sanitizer triple on top.
15//!
16//! ## Soundness
17//!
18//! PHASE6_DATAFLOW CRITICAL: previous docstring claimed
19//! `Soundness::Exact`. That was a lie - the body is generic forward
20//! reachability with `0xFFFF_FFFF` mask, NO call/return matching, NO
21//! summary edges, NO sanitizer gating, and NO exploded super-graph
22//! construction. Real Reps-Horwitz-Sagiv requires building the
23//! exploded super-graph (handled by [`super::ifds_gpu`]) and then
24//! running the step kernel over it.
25//!
26//! This module's [`ifds_reach_step`] is now correctly tagged
27//! [`MayOver`](super::Soundness::MayOver) and delegates to
28//! [`super::ifds_gpu::ifds_gpu_step`] when the caller passes a real
29//! [`super::ifds_gpu::IfdsShape`]. The Tier-3 ProgramGraphShape
30//! entry remains for back-compat callers that pre-built the CSR by
31//! hand - those callers MUST still iterate to fixpoint and gate
32//! sanitizer facts themselves.
33//!
34//! Rules requiring zero-FP MUST compose this primitive with an
35//! explicit sanitizer mask after each step - see surge stdlib
36//! `flows_to_with_sanitizer`.
37//!
38//! Underpins C01, C08, C09, C13, C15, C16, C18.
39
40mod closure;
41#[cfg(any(test, feature = "cpu-parity"))]
42mod cpu_oracle;
43mod program;
44mod tag;
45
46#[cfg(test)]
47mod tests;
48
49pub(crate) const OP_ID: &str = "weir::ifds";
50
51pub use closure::{
52 ifds_reach_closure_borrowed_into_result_with_scratch_via, ifds_reach_closure_borrowed_into_via,
53 ifds_reach_closure_borrowed_into_with_scratch_via, ifds_reach_closure_borrowed_via,
54 ifds_reach_closure_via,
55};
56#[cfg(any(test, feature = "cpu-parity"))]
57#[allow(deprecated)]
58pub(crate) use cpu_oracle::ifds_reach_closure_cpu;
59#[cfg(any(test, feature = "cpu-parity"))]
60pub(crate) use program::IFDS_REACH_MASK;
61pub use program::{ifds_reach_step, ifds_reach_step_exploded};
62pub use tag::Ifds;