Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Simplification pass #256

Open
wants to merge 113 commits into
base: main
Choose a base branch
from
Open

Simplification pass #256

wants to merge 113 commits into from

Conversation

ailrst
Copy link
Contributor

@ailrst ailrst commented Oct 9, 2024

Adds the flag --simplify (which implies --parameter-form) which, before running analysis performs partial evaluation and simplification of the IR. To assist this it does a DSA transform, but the copy propagation which runs afterwards is going to undo this somewhat.

This usually removes the flag registers and pushes the comparisons into the assume statements where they are used, folds constants through and does some canonicalisation and term simplification.

It sits on top of the interpreter #241 for partial evaluation, and includes improvements to the parameter form which I will copy into that PR #255. When #243 is merged we should use the interpreter to validate the transform using the memory state hash the csmith examples produce. Currently this is just validated against the system tests, all of which pass with the transform applied.

this implements:

  • a dsa transform via variable renaming
  • constant + copy propagation over the IR
  • a term-rewriting based simplification pass
  • partial evaluation

The simplification/partial eval/copyprop rewrites are applied repeatedly with a fixed number of iterations.

For an example of what simplifications this produces: http://0x0.st/XE79.html

@ailrst ailrst force-pushed the simplification-pass branch from 519f558 to 95744f7 Compare November 1, 2024 05:15
@ailrst
Copy link
Contributor Author

ailrst commented Nov 1, 2024

This improves the DSA, and adds a check for the property. It also adds block coalescing and a debugging flag to perform procedure trimming before running the analysis (so I can test a specific function in cntlm).

This no longer adds all globals from specs to the boogie, because we can't tell if they are global or have been promoted to local. If they are referenced in spec they must be defined in the actual program, so this shouldn't matter.
Test basic_lock_security_write and basic_sec_policy_write are failing now, because the Gamma_R0 in the precondition is optimised out of the program (R0 isn't live at the stat of the program, so I suspect its miscompiled, especially given the signature int main(int secret) is undefined behaviour. basic_lock_read/clang/GTIRB is also timing out suspiciously.

@ailrst ailrst changed the base branch from interpreter to main November 28, 2024 01:16
@ailrst ailrst mentioned this pull request Nov 28, 2024
@ailrst ailrst force-pushed the simplification-pass branch from b81e661 to 21efc16 Compare December 5, 2024 00:31
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants