smt_astt
smt_convt::convert_byte_update(const expr2tc &expr)
{
const byte_update2t &data = to_byte_update2t(expr);
assert(is_scalar_type(data.source_value) && "Byte update only works on "
"scalar variables now");
if (!is_constant_int2t(data.source_offset)) {
expr2tc source = data.source_value;
unsigned int src_width = source->type->get_width();
if (!is_bv_type(source))
source = typecast2tc(get_uint_type(src_width), source);
expr2tc offs = data.source_offset;
// Endian-ness: if we're in non-"native" endian-ness mode, then flip the
// offset distance. The rest of these calculations will still apply.
if (data.big_endian) {
auto data_size = type_byte_size(*source->type);
constant_int2tc data_size_expr(source->type, data_size - 1);
sub2tc sub(source->type, data_size_expr, offs);
offs = sub;
}
if (offs->type->get_width() != src_width)
offs = typecast2tc(get_uint_type(src_width), offs);
expr2tc update = data.update_value;
if (update->type->get_width() != src_width)
update = typecast2tc(get_uint_type(src_width), update);
// The approach: mask, shift and or. XXX, byte order?
// Massively inefficient.
expr2tc eight = constant_int2tc(get_uint_type(src_width), BigInt(8));
expr2tc effs = constant_int2tc(eight->type, BigInt(255));
offs = mul2tc(eight->type, offs, eight);
expr2tc shl = shl2tc(offs->type, effs, offs);
expr2tc noteffs = bitnot2tc(effs->type, shl);
source = bitand2tc(source->type, source, noteffs);
expr2tc shl2 = shl2tc(offs->type, update, offs);
return convert_ast(bitor2tc(offs->type, shl2, source));
}
// We are merging two values: an 8 bit update value, and a larger source
// value that we will have to merge it into. Start off by collecting
// information about the source values and their widths.
assert(is_number_type(data.source_value->type) && "Byte update of unsupported data type");
smt_astt value, src_value;
unsigned int width_op0, width_op2, src_offset;
value = convert_ast(data.update_value);
src_value = convert_ast(data.source_value);
width_op2 = data.update_value->type->get_width();
width_op0 = data.source_value->type->get_width();
src_offset = to_constant_int2t(data.source_offset).constant_value.to_ulong();
// Flip location if we're in big-endian mode
if (data.big_endian) {
unsigned int data_size =
type_byte_size(*data.source_value->type).to_ulong() - 1;
src_offset = data_size - src_offset;
}
if (int_encoding) {
std::cerr << "Can't byte update in integer mode; rerun in bitvector mode"
<< std::endl;
abort();
}
// Assertion some of our assumptions, which broadly mean that we'll only work
// on bytes that are going into non-byte words
assert(width_op2 == 8 && "Can't byte update non-byte operations");
assert(width_op2 != width_op0 && "Can't byte update bytes, sorry");
smt_astt top, middle, bottom;
// Build in three parts: the most significant bits, any in the middle, and
// the bottom, of the reconstructed / merged output. There might not be a
// middle if the update byte is at the top or the bottom.
unsigned int top_of_update = (8 * src_offset) + 8;
unsigned int bottom_of_update = (8 * src_offset);
if (top_of_update == width_op0) {
top = value;
} else {
smt_sortt s = mk_sort(SMT_SORT_BV, width_op0 - top_of_update, false);
top = mk_extract(src_value, width_op0 - 1, top_of_update, s);
}
if (top == value) {
middle = NULL;
} else {
middle = value;
}
if (src_offset == 0) {
middle = NULL;
bottom = value;
} else {
smt_sortt s = mk_sort(SMT_SORT_BV, bottom_of_update, false);
bottom = mk_extract(src_value, bottom_of_update - 1, 0, s);
}
// Concatenate the top and bottom, and possible middle, together.
smt_astt concat;
if (middle != NULL) {
smt_sortt s = mk_sort(SMT_SORT_BV, width_op0 - bottom_of_update, false);
concat = mk_func_app(s, SMT_FUNC_CONCAT, top, middle);
} else {
concat = top;
}
return mk_func_app(src_value->sort, SMT_FUNC_CONCAT, concat, bottom);
}
expr2tc
goto_symext::symex_mem(
const bool is_malloc,
const expr2tc &lhs,
const sideeffect2t &code)
{
if (is_nil_expr(lhs))
return expr2tc(); // ignore
// size
type2tc type = code.alloctype;
expr2tc size = code.size;
bool size_is_one = false;
if (is_nil_expr(size))
size_is_one=true;
else
{
cur_state->rename(size);
mp_integer i;
if (is_constant_int2t(size) && to_constant_int2t(size).as_ulong() == 1)
size_is_one = true;
}
if (is_nil_type(type))
type = char_type2();
else if (is_union_type(type)) {
// Filter out creation of instantiated unions. They're now all byte arrays.
size_is_one = false;
type = char_type2();
}
unsigned int &dynamic_counter = get_dynamic_counter();
dynamic_counter++;
// value
symbolt symbol;
symbol.base_name = "dynamic_" + i2string(dynamic_counter) +
(size_is_one ? "_value" : "_array");
symbol.name = "symex_dynamic::" + id2string(symbol.base_name);
symbol.lvalue = true;
typet renamedtype = ns.follow(migrate_type_back(type));
if(size_is_one)
symbol.type=renamedtype;
else
{
symbol.type=typet(typet::t_array);
symbol.type.subtype()=renamedtype;
symbol.type.size(migrate_expr_back(size));
}
symbol.type.dynamic(true);
symbol.mode="C";
new_context.add(symbol);
type2tc new_type;
migrate_type(symbol.type, new_type);
address_of2tc rhs_addrof(get_empty_type(), expr2tc());
if(size_is_one)
{
rhs_addrof.get()->type = get_pointer_type(pointer_typet(symbol.type));
rhs_addrof.get()->ptr_obj = symbol2tc(new_type, symbol.name);
}
else
{
type2tc subtype;
migrate_type(symbol.type.subtype(), subtype);
expr2tc sym = symbol2tc(new_type, symbol.name);
expr2tc idx_val = zero_ulong;
expr2tc idx = index2tc(subtype, sym, idx_val);
rhs_addrof.get()->type =
get_pointer_type(pointer_typet(symbol.type.subtype()));
rhs_addrof.get()->ptr_obj = idx;
}
expr2tc rhs = rhs_addrof;
expr2tc ptr_rhs = rhs;
if (!options.get_bool_option("force-malloc-success")) {
symbol2tc null_sym(rhs->type, "NULL");
sideeffect2tc choice(get_bool_type(), expr2tc(), expr2tc(), std::vector<expr2tc>(), type2tc(), sideeffect2t::nondet);
rhs = if2tc(rhs->type, choice, rhs, null_sym);
replace_nondet(rhs);
ptr_rhs = rhs;
}
if (rhs->type != lhs->type)
rhs = typecast2tc(lhs->type, rhs);
cur_state->rename(rhs);
expr2tc rhs_copy(rhs);
guardt guard;
symex_assign_rec(lhs, rhs, guard);
pointer_object2tc ptr_obj(pointer_type2(), ptr_rhs);
track_new_pointer(ptr_obj, new_type);
dynamic_memory.push_back(allocated_obj(rhs_copy, cur_state->guard, !is_malloc));
return rhs_addrof->ptr_obj;
}
smt_astt
smt_convt::convert_byte_extract(const expr2tc &expr)
{
const byte_extract2t &data = to_byte_extract2t(expr);
assert(is_scalar_type(data.source_value) && "Byte extract now only works on "
"scalar variables");
if (!is_constant_int2t(data.source_offset)) {
expr2tc source = data.source_value;
unsigned int src_width = source->type->get_width();
if (!is_bv_type(source)) {
source = typecast2tc(get_uint_type(src_width), source);
}
// The approach: the argument is now a bitvector. Just shift it the
// appropriate amount, according to the source offset, and select out the
// bottom byte.
expr2tc offs = data.source_offset;
// Endian-ness: if we're in non-"native" endian-ness mode, then flip the
// offset distance. The rest of these calculations will still apply.
if (data.big_endian) {
auto data_size = type_byte_size(*source->type);
constant_int2tc data_size_expr(source->type, data_size - 1);
sub2tc sub(source->type, data_size_expr, offs);
offs = sub;
}
if (offs->type->get_width() != src_width)
// Z3 requires these two arguments to be the same width
offs = typecast2tc(source->type, data.source_offset);
lshr2tc shr(source->type, source, offs);
smt_astt ext = convert_ast(shr);
smt_astt res = mk_extract(ext, 7, 0, convert_sort(get_uint8_type()));
return res;
}
const constant_int2t &intref = to_constant_int2t(data.source_offset);
unsigned width;
width = data.source_value->type->get_width();
uint64_t upper, lower;
if (!data.big_endian) {
upper = ((intref.constant_value.to_long() + 1) * 8) - 1; //((i+1)*w)-1;
lower = intref.constant_value.to_long() * 8; //i*w;
} else {
uint64_t max = width - 1;
upper = max - (intref.constant_value.to_long() * 8); //max-(i*w);
lower = max - ((intref.constant_value.to_long() + 1) * 8 - 1); //max-((i+1)*w-1);
}
smt_astt source = convert_ast(data.source_value);;
if (int_encoding) {
std::cerr << "Refusing to byte extract in integer mode; re-run in "
"bitvector mode" << std::endl;
abort();
} else {
if (is_bv_type(data.source_value)) {
;
} else if (is_fixedbv_type(data.source_value)) {
;
} else if (is_bool_type(data.source_value)) {
// We cdan extract a byte from a bool -- zero or one.
typecast2tc cast(get_uint8_type(), data.source_value);
source = convert_ast(cast);
} else {
std::cerr << "Unrecognized type in operand to byte extract." << std::endl;
data.dump();
abort();
}
unsigned int sort_sz = data.source_value->type->get_width();
if (sort_sz <= upper) {
smt_sortt s = mk_sort(SMT_SORT_BV, 8, false);
return mk_smt_symbol("out_of_bounds_byte_extract", s);
} else {
return mk_extract(source, upper, lower, convert_sort(expr->type));
}
}
}
