ftsrg / gazer

An LLVM-based formal verification frontend for C programs.
24 stars 5 forks source link

Generate XCFA #55

Closed radl97 closed 3 years ago

radl97 commented 4 years ago

Add XCFA generation capability to Gazer.

Basic usage: tools/gazer-theta/gazer-theta --xcfa --memory=simple --theta-path=$THETA_DIR/theta/subprojects/xcfa-cli/build/libs/theta-xcfa-cli-*.jar --lib-path=$THETA_DIR/theta/lib <files...>.

Issues: Passing by reference does not throw error as it should (as it is not supported). Tracing not supported at all. We would need a model too for this, after all

sallaigy commented 3 years ago

I took a look at the PR and I would like to raise a few major concerns before moving on further. FIrst of all, the PR is huge and I believe it would make sense to split it up into smaller ones:

  1. The reogranization of the code regarding Theta CFA generation, just to lay some groundwork.
  2. As a first iteration, I think it would make sense to implement the simple memory model without XCFA considerations. This has two benefits: 1) limits the scope and 2) it could be used by the BMC and current Theta CFA backend. Also, can't we implement it using MemorySSA?
  3. The actual implementation of the XCFA transformation with the necessary stuff to support threaded programs in Gazer.

Also there are some major remarks:

radl97 commented 3 years ago

I will give a detailed answer tomorrow. However, as your review points out a lot of design-related issues, I will also add that the Theta CEGAR-related options should not be passed to Theta-XCFA right now (and it is not trivial where exactly that configuration should reside).

radl97 commented 3 years ago

I will open new, smaller PRs instead, cherry-picking these commits. There are some changes needed before getting into the core XCFA generation.