diff --git a/CHANGELOG.md b/CHANGELOG.md index ff411b8a9..788d9dee6 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -5,6 +5,96 @@ The format loosely follows [Keep a Changelog](https://keepachangelog.com/en/1.0. ## [Unreleased] +## [9.0.0] - Unreleased + +A major version: the fuzzing engine changed (LibFuzzer → AFL++ 4.40c), the +`--nondet-generator` values changed (`fuzzer` → `afl`), and several verdicts +change meaning -- a KLEE run that did not explore every path is no longer +TRUE, and the program's own `abort()` prunes a path instead of ending the +search. Measured against the v15 baseline in `docs/reports/tacas-experiment-log.md`. + +### Changed (breaking) + +- **The default hybrid is the alternation** (`--alternate-engines`, with seed + exchange) whenever `--timeout` is given. `--fixed-hybrid` keeps the 8.x + schedule. Measured on the 213-task Cover-Error sample: 157 covered, against + 128 for the 8.x hybrid. On Cover-Branches: 53.5% against 46.5% (R26). +- The fuzzer's corpus is part of Cover-Branches suites by default + (`MAP2CHECK_FUZZER_SUITE=0` turns it off). + +- Fuzzing engine: LibFuzzer replaced by AFL++ 4.40c (persistent mode, PCGUARD, + CmpLog). `--nondet-generator fuzzer` is now `--nondet-generator afl`. +- Verdicts: TRUE only from an exhaustive KLEE exploration. KLEE exiting 0 after + its timer, after concretizing a symbolic input (floats), after killing + states (`*.err`, `*.early`), near its memory cap, or after crashing is now + UNKNOWN, never TRUE. +- The program's own `abort()` (inline or through `assume_abort_if_not`) prunes + the path (`map2check_assume(0)`, `klee_silent_exit` under KLEE) instead of + stopping KLEE's search. + +### Added + +- `--slice` for every property (reachability, assert, memtrack, memcleanup, + overflow) through sbt-slicer, preserving the nondet read order; the slice is + computed once per run (`.slice/`), a slicer failure is remembered, and + the criteria are collected without regex. Experiment knobs: + `MAP2CHECK_SLICE_CLEANUP=light|o2`, `MAP2CHECK_SLICER_FLAGS`. +- `--seed-exchange`: the engines hand each other input vectors through a + persistent store (`.seeds/`) -- the fuzzer queue, replayed through the + witness binary into typed `.ktest` seeds for KLEE (ranked: new-edge entries + first), and KLEE's vectors back to the fuzzer. +- `--alternate-engines`: AFL++ and KLEE take turns, each ending when its engine + stagnates (`AFL_EXIT_ON_TIME`; KLEE's covered instructions from `run.stats`, + SQLite optional), with windows and patience doubling every round. +- KLEE's vectors, completed with zeros past their end, are run natively + through the witness after every KLEE phase that found nothing. +- AFL++ binaries built once per run (`.build/`), within one build budget. +- The fuzzer's corpus contributes Cover-Branches test cases (up to half the + suite, deduplicated). +- `--add-invariants` profiles (`MAP2CHECK_CLAM_PROFILE=default|memory|none`), + the number of invariants inserted in the log, and a fallback when Clam + fails. `MAP2CHECK_PREOPT=ssa` (reachability and assert): the module in SSA + form before instrumentation. +- `MAP2CHECK_CHECK_CSTRINGS=1`: the strings a `%s` or `puts` reads are checked. +- `MAP2CHECK_KLEE_MAX_MEMORY` (MB): KLEE's memory cap, default unchanged. +- Official Test-Comp 2026 validation (`tests/testcomp/official/run.sh`): + suites are generated and validated under BenchExec with the competition's + validators (TestCov gcc/clang unformatted, TestCoCa clang formatted), each + task with its own property files; the corpora are drawn from the official + task set with proportional stratification (`build_corpus_official.py`). + +### Fixed + +- Nondet types the instrumentation did not model (#74): `float`, `longlong`, + `ulonglong`, `u8`/`u16`/`u32` and `__VERIFIER_nondet_memory` were external + calls, so KLEE killed every state and the task was UNKNOWN by construction. + Each now has a KLEE and an AFL++ generator of the right width, a full-width + log entry (64-bit and float values no longer go through the `int` logger; + floats print as `%.9g`) and a ktest decoding; `nondet_memory` yields one + `uchar` input per byte, as the validators' harness reads it. Floats in the + official Cover-Error corpus: 11/33 → 33/33, every suite confirmed by all + three validators. +- The KLEE runtime wrote its nondet log with the values still symbolic, and + uClibc's `vfprintf` forked on every digit (#75): a straight-line program + with ten nondet reads reached its target and never finished. The values are + now pinned to one model before printing, the rows are formatted without + `printf` (byte-identical output), a log past 1,024 rows is left to the + violating `.ktest`, and the log container grows geometrically. Ten reads: + UNKNOWN → FAILED in 1 s; 10,000 reads: UNKNOWN → FAILED in 31 s. +- The AFL++ generator replayed its input from the start past its end: a + `while (__VERIFIER_nondet_int())` loop never ended and afl-fuzz aborted in + its dry run. Reads past the end are now zero. +- MemoryTrackPass matched memory intrinsics by their LLVM 6 names: + `memset/memcpy/memmove` were never checked under LLVM 16. +- A fuzzer binary that fails to link is reported with its cause instead of as + a build timeout; an unreadable input program is reported as such. +- The Cover-Branches suite: the 50-case cap and duplicates count across + phases, and a run starts from an empty suite. +- Evaluation harnesses: children no longer inherit the manifest's descriptor + (the program under test could move the loop's offset); a crash replayed from + the fuzzer is not a tool failure. + + ### Changed - Replaced LibFuzzer with AFL++ 4.40c (persistent, PCGUARD) as the fuzzing engine. diff --git a/CLAUDE.md b/CLAUDE.md index 6e3827fb7..f48d9f3f3 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -61,6 +61,14 @@ the driver is present at `$CLAM_DIR/bin/clam.py`. It is opt-in because an unsoun invariant produces a wrong TRUE rather than an error — see [the dependency review](docs/reports/2026-08-16-crabllvm-review.md). +Status of `--add-invariants` (2026-09-30): **optional and under study**. +- The crab-llvm invariants of the SV-COMP 2019/2020 builds were emitted as `llvm.assume`, + which neither `NonDetPass` nor KLEE consumes. +- On the current hybrid, Clam's profiles (`MAP2CHECK_CLAM_PROFILE=default|memory|none`) + have shown no gain so far. +- A dedicated study round is pending; see `docs/reports/tacas-experiment-log.md` (INV-1, + R25) and `docs/backlog.md`. + Enabling sanitizers switches from static to shared linking and enables `-fsanitize=address,undefined -fno-omit-frame-pointer -g`. ### Run unit tests @@ -107,6 +115,18 @@ Entry point: `map2check.cpp` → `main()`. Parses CLI options (via Boost.Program 5. `executeAnalysis()` — run the instrumented binary; collect results 6. Witness/counterexample generation in [counter_example/](modules/frontend/counter_example/) and [witness/](modules/frontend/witness/) +With no `--nondet-generator`, `main()` runs the hybrid, and each phase builds a new `Caller`: +- **Alternating (the default since 9.0, needs `--timeout`):** AFL++ and KLEE take turns + (`alternateEngines()`), each stopped on stagnation. +- **Fixed (`--fixed-hybrid`):** the 8.x schedule. + +State that must survive the phases lives beside the scratch directory, not inside it: +`.seeds/` (seed store), `.slice/` (slice cache) and `.build/` (AFL++ +binaries). + +A TRUE verdict requires an exhaustive KLEE run: see `kleeDroppedPaths()` in +`modules/frontend/test_suite/ktest_reader.cpp`. + **Verification modes** (enum `Map2CheckMode`): `MEMTRACK_MODE`, `REACHABILITY_MODE`, `OVERFLOW_MODE`, `ASSERT_MODE`, `MEMCLEANUP_MODE`. To add a new analysis: extend `callPass()` in [caller.cpp](modules/frontend/caller.cpp) and add a CLI option in [map2check.cpp](modules/frontend/map2check.cpp). diff --git a/CMakeLists.txt b/CMakeLists.txt index a10f305e4..b3f272042 100644 --- a/CMakeLists.txt +++ b/CMakeLists.txt @@ -1,5 +1,5 @@ cmake_minimum_required(VERSION 3.20) -project(Map2Check VERSION 8.0.0 LANGUAGES C CXX) +project(Map2Check VERSION 9.0.0 LANGUAGES C CXX) option(BUILD_DOC "Build documentation" OFF) option(SKIP_AFL_PLUS_PLUS "Don't use AFL++" OFF) diff --git a/Dockerfile.dev b/Dockerfile.dev index 9a8080ba2..9499e6c09 100644 --- a/Dockerfile.dev +++ b/Dockerfile.dev @@ -177,8 +177,12 @@ RUN printf 'int main(void){return 0;}\n' > /tmp/aflcheck.c && \ # libzstd-dev is required, not optional: LLVM 16 from apt.llvm.org exports # zstd::libzstd_shared, so Clam's find_package(LLVM) fails outright without it. # libflint-dev is NOT needed -- that belongs to the PPLite domain, and no -# optional domain is enabled here: --crab-track=num uses the default interval -# domain, so LDD, Apron, Elina and PPLite would all be dead weight. +# optional domain is enabled here. Clam's default domain is zones (a DBM, +# built into Crab), the same default the crab-llvm of the SV-COMP builds had; +# what LDD, Apron, Elina and PPLite would add is boxes, oct and pk, which the +# old engine shipped (Apron) and --add-invariants never selected. Whether they +# are worth building is part of the pending --add-invariants study +# (docs/backlog.md). RUN apt-get update && apt-get install -y \ libmpfr-dev \ libzstd-dev \ diff --git a/README.md b/README.md index 9fcf74bfe..a181015bc 100644 --- a/README.md +++ b/README.md @@ -71,6 +71,78 @@ $ ./map2check --help When you use a LLVM bytecode as input for the tool, be sure to add `-g` flag when generating the file, it is not required, but map2check will provide better info (like line numbers). +#### Engines, test suites and analysis options (9.0) + +

+Map2Check generates inputs with two engines: the AFL++ 4.40c fuzzer (persistent mode, PCGUARD, +CmpLog) and the KLEE 3.1 symbolic executor. By default, and whenever --timeout is +given, the two run as an alternating hybrid. They take turns, each turn ends once its engine stops +finding new coverage, and every round doubles the turn's window. The engines also hand each other +input vectors. +

+ +| Option | Effect | +|---|---| +| *(default, with `--timeout`)* | Alternating hybrid with seed exchange. Same as `--alternate-engines`. | +| `--fixed-hybrid` | The 8.x schedule: the fuzzer for 0.2 of the budget, then KLEE. | +| `--fixed-hybrid --seed-exchange` | The 8.x schedule with seed exchange (0.2 / 0.6 / 0.2, with a last fuzzer phase). | +| `--nondet-generator afl` / `symex` | One engine only: AFL++ or KLEE. In 8.x the fuzzer value was `fuzzer`. | +| `--slice` | Slice the program before the analysis (sbt-slicer), for reachability, `--check-asserts`, `--memtrack`, `--memcleanup-property` and `--check-overflow`. | +| `--generate-test-suite` | Emit a Test-Comp test suite (`test-suite/`). | +| `--generate-test-suite --cover-branches` | Emit a Cover-Branches suite, up to 50 cases, from KLEE's paths and the fuzzer's corpus. | +| `--add-invariants` | Optional, and off in the default build. See below. | + +

+Verdicts. A TRUE verdict needs KLEE to have explored every path. Map2Check reports +UNKNOWN instead when KLEE stopped early for any reason: +

+ +- its timer ran out; +- it concretized a symbolic input (for example a floating-point value); +- it killed states; +- it hit its memory cap; +- it crashed. + +

+A call to abort() in the program under analysis is treated the way SV-COMP treats it: as +an assumption. It prunes that path and does not end the search. +

+ +

+Environment knobs. These exist for experiments; the defaults are the measured choices. +

+ +| Variable | Default | Meaning | +|---|---|---| +| `MAP2CHECK_FUZZER_SUITE` | on | `0` leaves the fuzzer's corpus out of Cover-Branches suites. | +| `MAP2CHECK_SLICE_CLEANUP` | none | `light` or `o2`: an opt pipeline over the fresh slice. Measured neutral. | +| `MAP2CHECK_SLICER_FLAGS` | — | Extra sbt-slicer flags, e.g. `--cda=ntscd`. Measured neutral. | +| `MAP2CHECK_PREOPT` | off | `ssa`: mem2reg + simplifycfg before instrumentation, for reachability and assert only. Measured neutral in the hybrid. | +| `MAP2CHECK_CHECK_CSTRINGS` | off | `1`: check the strings a `%s` or `puts` reads. It fixes one wrong TRUE on Juliet, but produces false positives on memory the runtime does not track (CASTLE: FP from 1 to 4). | +| `MAP2CHECK_CLAM_PROFILE` | default | `memory` or `none`: see `--add-invariants`. | +| `MAP2CHECK_KLEE_MAX_MEMORY` | KLEE's 2000 | KLEE's `--max-memory`, in MB. Raising it to 6000 changed nothing on Intel-TDX (0/8 either way). | + +

+--add-invariants inserts abstract-interpretation invariants computed by +Clam (formerly crab-llvm). The build must be configured +with -DENABLE_CLAM=ON and Clam installed at $CLAM_DIR; otherwise the option is +refused with exit code 3. +

+ +

+The option stays optional while it is under study. So far: +

+ +- In the SV-COMP 2019/2020 builds, the invariants reached neither the instrumentation nor KLEE: they were emitted as `llvm.assume`. +- On the current hybrid, the first measurement found no gain. +- Clam is bounded to 0.2 of the budget and falls back to the plain compile when it fails. +- A dedicated study round is planned. See `docs/reports/tacas-experiment-log.md` (INV-1, R25). + +

+Measurements of every option above are recorded in +docs/reports/tacas-experiment-log.md. +

+ ___ #### Verifying WebAssembly (WASM) binaries diff --git a/docs/backlog.md b/docs/backlog.md new file mode 100644 index 000000000..0ac1fab36 --- /dev/null +++ b/docs/backlog.md @@ -0,0 +1,106 @@ +# Backlog + +Itens decididos como "não agora", cada um com o motivo e onde está a evidência. + +## `--add-invariants`: rodada dedicada de estudo + +- **Estado:** a opção é opcional e fica desligada no build padrão (`-DENABLE_CLAM=OFF`). + O usuário ainda desconfia da conclusão "não ajuda". +- **O que já se sabe** (log de experimentos, INV-1 e R25): + - Na v7.3 os invariantes saíam como `llvm.assume` e ficavam inertes. Até out/2018 eles + chegavam ao KLEE (`--crab-track=arr --crab-add-invariants=after-load`). + - Numa sonda só com o KLEE, o ganho veio do pré-processamento em SSA, não dos + invariantes. + - No híbrido (71 tarefas de Cover-Error e 50 de MemSafety), os perfis do Clam não + ganharam e o MemSafety teve mais FALSE errados (4 contra 2). Parte dos ERROR vinha do + Clam sem limite de tempo, já corrigido. +- **O que a rodada precisa responder:** + - efeito só com o KLEE (`--nondet-generator symex`), onde os invariantes têm mais + chance de pesar, separado do efeito no híbrido; + - por que os FALSE errados de MemSafety aumentam: um invariante incorreto ou o + caminho de compilação do Clam (`-m 64`, pré-processamento próprio); + - os domínios que o motor antigo tinha e o nosso Clam não compila: Apron (`oct`, + `pk`) e LDD (`boxes`); + - o gate: nenhuma detecção perdida no CASTLE e numa amostra do Juliet. + +## Limite de memória do KLEE nas rodadas paralelas + +- **Sintoma:** com 8 contêineres, e às vezes com 4, a memória da máquina (23 GB) chega a + ficar crítica. O KLEE usa até `--max-memory` = 2000 MB por processo. Um KLEE morto + pelo OOM killer sai como "did not finish its run", ou seja UNKNOWN, e contamina a + medição. Os vigias do Claude Code também foram encerrados por isso. +- **Opções:** + - passar `--max-memory` por execução, proporcional às vagas; + - limitar a memória por contêiner (`docker run --memory`); + - registrar no resultado quando o KLEE morreu por falta de memória, para descartar e + repetir essas tarefas. +- **Por que não agora:** não afeta o produto (uma execução de competição tem uma tarefa + por máquina), só a infraestrutura de medição. + +## Harness de campanha fora do repositório + +- Os escalonadores das rodadas R19 a R26 vivem em `../tacas-results/` e não são + versionados, por decisão: campanhas não pertencem ao repositório do produto. +- Dois defeitos deles contaminaram rodadas, e quem escrever o próximo precisa evitá-los: + - `IFS=$'\t' read` junta tabs consecutivos, e uma coluna vazia desloca as seguintes; + usar `-` nos campos vazios; + - os filhos herdavam o manifest pelo descritor 3. Corrigido no harness do repositório + (`3<&-`). + +## Validação de witness (fase D, item 4.2): estudo, a discutir com o orientador + +- **Estado atual:** + - O Map2Check gera só witness **GraphML** (`--generate-witness`, formato 1.0), gravado + em `../witness.graphml` a partir do scratch. + - Não gera o formato **2.0 (YAML)**, adotado pelo SV-COMP. É preciso confirmar no + call do ano quais formatos ainda são aceitos. + - Nenhum teste valida os witnesses gerados. + - A Test-Comp não usa witness; a suíte é validada pelo TestCov. O item só pesa para o + SV-COMP. +- **Caminho barato já esboçado (validação por execução):** compilar o programa original + (com ASan, para as propriedades de memória), alimentá-lo com o vetor que viola a + propriedade (que o Map2Check já emite na suíte de Cover-Error) e confirmar o + `reach_error` ou o crash. É parecido com o que o TestCov faz e com os validadores por + execução do SV-COMP. +- **Não começar a implementação** antes da conversa com o orientador: definir se o + objetivo é o formato 2.0, a validação por execução, os dois ou nenhum. + +## `--debug` com a alternância dá segfault + +- Achado em 2026-10-02: `map2check --debug --check-overflow --timeout 60` sobre um caso do + Juliet (CWE190 `char_fscanf_square_01`, good) termina com segfault depois das fases. O + scratch aparece aninhado (`.map2check/.map2check-…`). Sem `--debug` a + execução termina normalmente. Só afeta a depuração. + +## Recorte da campanha × conjunto oficial da Test-Comp 2026 + +- **Contexto:** a campanha da 9.0 usa o recorte da v15 (`cover-error-q400.tsv`, 1 087 + tarefas; `cover-branches-q400.tsv`, 2 765). A Test-Comp 2026 tem 1 895 tarefas em + C.Cover-Error e 14 322 em C.Cover-Branches + ([resultados](https://test-comp.sosy-lab.org/2026/results/results-verified/)). +- **Diferença de composição (Cover-Error):** + - faltam no recorte as subcategorias novas: SoftwareSystems-Intel-TDX-Module (658), + Hardware (497), coreutils (29) e BusyBox, OpenBSD e Linux64 (7); + - o ECA pesa 400 tarefas no recorte, contra 18 no conjunto oficial; + - as subcategorias clássicas (ProductLines, Loops, Sequentialized, Arrays, XCSP, + Floats, BitVectors, ControlFlow, Recursive) praticamente coincidem. +- **Consequência:** os 722 pontos de Cover-Error da 9.0 valem só para a comparação + pareada com a v15. Não estimam a pontuação oficial, que é normalizada por subcategoria. +- **TODO:** montar um manifest com as subcategorias ausentes (Hardware, Intel-TDX, + coreutils) e rodar uma amostra delas depois da campanha de Cover-Branches. + +## ~~Caminhos podados pelo assume no KLEE não geram teste~~ (resolvido) + +- **Sintoma:** na campanha da 9.0, 29 tarefas de Cover-Branches (25 XCSP, 4 Floats) + terminam com zero testes. O XCSP cai de 76,2% para 58,1% de cobertura média, o que + custa cerca de 1,7 p.p. na média geral. +- **Causa:** o `nondet_assume` sob o KLEE poda com `klee_silent_exit`, que não grava + `.ktest`. Quando todos os caminhos são podados, a suíte sai vazia. +- **Correção proposta:** podar com `_exit(0)`. O caminho termina normalmente e grava o + teste, sem rodar os handlers de saída. +- **Validação necessária:** + - os testes de integração; + - o §29 (`safe.c`) continua dando TRUE; + - o memtrack com `sleep-3` não ganha falso positivo. + - Depois disso, repetir só as tarefas que ficaram com zero testes. +- **Resolvido** em `e4e0b74c7` e `6848d2395` (ver o log de experimentos, 2026-10-05/06). diff --git a/docs/migration-schedule.md b/docs/migration-schedule.md index 17b23e94e..d2a4c039d 100644 --- a/docs/migration-schedule.md +++ b/docs/migration-schedule.md @@ -4,6 +4,15 @@ **Fim previsto:** 30/Mai/2027 **Regime:** ~5h/dia útil de desenvolvimento efetivo +> **Situação em 29/Set/2026 — linha TACAS.** As fases 2 e 3 foram antecipadas e entregues +> por um caminho diferente do planejado abaixo: o slicing usa o `sbt-slicer` (dg) como +> processo externo, e não uma biblioteca integrada; a coordenação AFL++ ↔ KLEE roda dentro +> do frontend C++, e não num coordenador Python com IPC. As tabelas das fases 2 e 3 trazem +> o status real e onde cada item foi feito. Medições em `docs/reports/tacas-experiment-log.md` +> (rodadas R1–R19). Resultado de referência (R15, Cover-Error, 213 tarefas, 300 s): controle +> tacasv2 **129 cobertas** × v15 111, TRUE errado 27 → 5, tempo mediano 43 → 5 s; com a troca +> de sementes (R16) **148 cobertas**. + --- ## Métricas do Codebase Atual @@ -176,19 +185,19 @@ | Done | ID | Tarefa | Início | Fim | Dias | Teste | Relatório | |:-----|:---|:-------|:-------|:----|:-----|:------|:----------| -| ☐ | 2.1.1 | Criar `FindDG.cmake` (FetchContent de `mchalupa/dg`) | 28/Set | 30/Set | 3 | DG compila com LLVM 16 | — | -| ☐ | 2.1.2 | Validar `llvm-slicer` standalone no container | 01/Out | 02/Out | 2 | Slice de programa simples funciona | — | -| ☐ | 2.1.3 | Criar módulo `SlicingPreprocessor` (API C++) | 05/Out | 16/Out | 10 | Testes unitários do módulo | — | -| ☐ | 2.1.4 | Definir critério de slicing automático (`__VERIFIER_error` + MemSafety) | 19/Out | 23/Out | 5 | Slice preserva instruções de interesse | `docs/migration/2.1-dg-library.md` | +| ✅ | 2.1.1 | ~~`FindDG.cmake`~~ → `sbt-slicer` (dg) instalado no `Dockerfile.dev` em `/opt/sbt-slicer` | 28/Set | 26/Set | — | Slicer roda com LLVM 16 | tacasv2a | +| ✅ | 2.1.2 | Validar o slicer standalone no container | 01/Out | 26/Set | — | Slice de programa simples funciona | tacasv2a | +| ✅ | 2.1.3 | ~~`SlicingPreprocessor`~~ → `Caller::runSlicer` + `utils/slicer.hpp` (critérios, estatísticas, stub do alvo) | 05/Out | 27/Set | — | `SlicerTest` (21 testes) | specs `2026-09-2{6,7}-tacasv2{a,b,c}-*` | +| ✅ | 2.1.4 | Critérios por propriedade: alvo/assert antes da instrumentação; `map2check_*` + nondets + externas + intrínsecos de memória depois dela (memsafety, memcleanup, overflow) | 19/Out | 27/Set | — | Integração §13–§25 | `docs/reports/tacas-experiment-log.md` (R1–R14b) | ### 2.2 Integração no Pipeline (Semanas 18-20) | Done | ID | Tarefa | Início | Fim | Dias | Teste | Relatório | |:-----|:---|:-------|:-------|:----|:-----|:------|:----------| -| ☐ | 2.2.1 | Adicionar opção `--slice` ao CLI | 26/Out | 27/Out | 2 | `map2check --help` mostra opção | — | -| ☐ | 2.2.2 | Integrar pipeline: `C → IR → Slice → Instrumentação → Análise` | 28/Out | 06/Nov | 8 | Suite completa com `--slice` ativo | — | -| ☐ | 2.2.3 | Testes comparativos: com e sem slicing nos 9 benchmarks | 09/Nov | 13/Nov | 5 | Tabela de redução de tamanho bitcode | — | -| ☐ | 2.2.4 | Testes em benchmarks SV-COMP ReachSafety (amostra) | 16/Nov | 20/Nov | 5 | ≥ baseline em cobertura | `docs/migration/2.2-slicing-pipeline.md` | +| ✅ | 2.2.1 | Opção `--slice` no CLI | 26/Out | 26/Set | — | `map2check --help` mostra opção | tacasv2a | +| ✅ | 2.2.2 | Pipeline `C → IR → Slice → Instrumentação → Análise` (e slice pós-instrumentação para memória/overflow) | 28/Out | 27/Set | — | Integração com `--slice` | tacasv2a/b/c | +| ✅ | 2.2.3 | Comparativos controle × slice (Test-Comp, MemSafety, NoOverflows, CASTLE, Juliet) | 09/Nov | 28/Set | — | R8–R15 | `docs/reports/tacas-experiment-log.md` | +| ⏳ | 2.2.4 | Test-Comp Cover-Error: slice **empata** com o controle (126 × 129, R15) — otimizações na 2.4 | 16/Nov | — | — | ≥ controle em cobertas, TRUE errado = 0 | R15, R19 | ### 2.3 Validação e Buffer (Semanas 21-22) @@ -197,6 +206,15 @@ | ☐ | 2.3.1 | Medir impacto: memória, tempo, taxa de unknown | 23/Nov | 27/Nov | 5 | Relatório quantitativo | `docs/migration/2.3-fase2-final.md` | | ☐ | 2.3.2 | **Buffer/contingência** | 30/Nov | 04/Dez | 5 | — | — | +### 2.4 Otimizações do slicing — tacas 2d (Set/2026) + +| Done | ID | Tarefa | Teste | Relatório | +|:-----|:---|:-------|:------|:----------| +| ✅ | 2.4.1 | Fatiar uma vez por execução (cache `.slice/`, inclusive da falha do slicer) — elimina os 4 ERROR de ECA da R15 | Integração §31 | spec `2026-09-29-tacas-2d-slicing-optimizations-design.md` | +| ⏳ | 2.4.2 | Limpeza pós-slice (`MAP2CHECK_SLICE_CLEANUP` = `light` ou `o2`) — em medição | R19 | — | +| ⏳ | 2.4.3 | Parâmetros do dg (`--cda=ntscd`, `--pta=fs`) — em medição | R19 | — | +| ☐ | 2.4.4 | Cutoff-diverging com `!dbg` (só se 2.4.1–2.4.3 não bastarem) | — | — | + > **Marco Fase 2:** Slicing funcional, redução mensurável em timeouts > **Data-alvo:** 04/Dez/2026 @@ -208,29 +226,40 @@ | Done | ID | Tarefa | Início | Fim | Dias | Teste | Relatório | |:-----|:---|:-------|:-------|:----|:-----|:------|:----------| -| ☐ | 3.1.1 | `FindAFLPlusPlus.cmake` — compilar/instalar AFL++ 4.40c | 07/Dez | 11/Dez | 5 | `afl-fuzz --version` OK | — | -| ☐ | 3.1.2 | Instrumentação AFL++ com LLVM 16 (modo PCGUARD) | 14/Dez | 18/Dez | 5 | Programa de teste instrumentado e fuzzado | — | -| ☐ | 3.1.3 | Wrapper de compilação para programas com instrumentação AFL++ | 21/Dez | 24/Dez | 4 | Programa fuzzeado encontra crash | — | -| ☐ | 3.1.4 | Validação: fuzzing standalone em benchmarks simples | 05/Jan | 09/Jan | 5 | ≥3 crashes encontrados em programas unsafe | `docs/migration/3.1-aflpp.md` | +| ✅ | 3.1.1 | AFL++ 4.40c no `Dockerfile.dev` (toolchain em `/usr/local/bin`), substituindo o LibFuzzer | 07/Dez | 25/Set | — | `afl-fuzz --version` OK | tacasv1 | +| ✅ | 3.1.2 | Instrumentação PCGUARD + modo persistente + binário CmpLog | 14/Dez | 26/Set | — | Programa instrumentado e fuzzado | tacasv1 | +| ✅ | 3.1.3 | Pipeline de compilação AFL++ no `Caller` + replay de crash pelo binário witness | 21/Dez | 26/Set | — | Crash confirmado por replay | tacasv1 | +| ✅ | 3.1.4 | Validação em Test-Comp; correções: leitura após o fim da entrada devolve zero (laços `while(nondet)` travavam o dry run) | 05/Jan | 29/Set | — | Integração §32 | spec `2026-09-25-tacasv1-aflpp-migration-design.md` | ### 3.2 Coordenador Central (Semanas 27-30) | Done | ID | Tarefa | Início | Fim | Dias | Teste | Relatório | |:-----|:---|:-------|:-------|:----|:-----|:------|:----------| -| ☐ | 3.2.1 | Criar módulo `coordinator/` (Python + subprocess) | 12/Jan | 16/Jan | 5 | Testes unitários do módulo | — | -| ☐ | 3.2.2 | IPC POSIX: shared memory + semáforos | 19/Jan | 23/Jan | 5 | Comunicação bidirecional testada | — | -| ☐ | 3.2.3 | Ciclo de vida: AFL++ → monitoramento → KLEE → reinjeção | 26/Jan | 06/Fev | 10 | Programa simples verificado end-to-end | — | -| ☐ | 3.2.4 | Heurística de Desbloqueio de Fronteira (Δt, proximidade) | 09/Fev | 13/Fev | 5 | Detecção de estagnação + branch flipping | `docs/migration/3.2-coordinator.md` | +| ✅ | 3.2.1 | ~~`coordinator/` em Python~~ → laço `alternateEngines()` no frontend C++ (`--alternate-engines`) | 12/Jan | 29/Set | — | `AlternationTest` | spec `2026-09-29-tacas-3b-engine-alternation-design.md` | +| ✅ | 3.2.2 | ~~IPC POSIX~~ → troca por arquivos no store `.seeds/` (fases sequenciais, 1 núcleo) | 19/Jan | 28/Set | — | Integração §11, §26–§28 | tacas 3a | +| ✅ | 3.2.3 | Ciclo AFL++ → KLEE → reinjeção, em rodadas com janelas que dobram | 26/Jan | 29/Set | — | Integração §33 | tacas 3b | +| ⏳ | 3.2.4 | Detecção de estagnação (`AFL_EXIT_ON_TIME`; `CoveredInstructions` do `run.stats` do KLEE) — em medição; *branch flipping* por proximidade ainda não | 09/Fev | — | — | R19 | tacas 3b | ### 3.3 Smart Seeds e Validação (Semanas 31-34) | Done | ID | Tarefa | Início | Fim | Dias | Teste | Relatório | |:-----|:---|:-------|:-------|:----|:-----|:------|:----------| -| ☐ | 3.3.1 | Gerenciador de Smart Seeds (serialização, conversão, filtro) | 16/Fev | 20/Fev | 5 | Seeds transferidas AFL++ ↔ KLEE | — | -| ☐ | 3.3.2 | Ranking por densidade SDG | 23/Fev | 27/Fev | 5 | Seeds priorizadas corretamente | — | -| ☐ | 3.3.3 | Teste integrado: pipeline completo com coordenação | 02/Mar | 06/Mar | 5 | Benchmark com melhoria de cobertura | `docs/migration/3.3-fase3-final.md` | +| ✅ | 3.3.1 | Smart seeds: fila do AFL++ → replay tipado → `.ktest`; `.ktest` → bytes do AFL++ (`--seed-exchange`) | 16/Fev | 28/Set | — | `SeedStoreTest`, `KtestReaderTest` | spec `2026-09-28-tacasv3a-smart-seeds-plumbing-design.md` | +| ☐ | 3.3.2 | Ranking de sementes (novidade de cobertura; densidade SDG) — tacas 3c | 23/Fev | — | 5 | Seeds priorizadas corretamente | — | +| ⏳ | 3.3.3 | Teste integrado com coordenação: R16 (seeds 148 × 129 cobertas); R19 (alternância) em curso | 02/Mar | — | — | Benchmark com melhoria de cobertura | `docs/reports/tacas-experiment-log.md` | | ☐ | 3.3.4 | **Buffer/contingência** | 09/Mar | 13/Mar | 5 | — | — | +### 3.4 Correções de veredito achadas nas rodadas TACAS + +| Done | ID | Correção | Teste | +|:-----|:---|:---------|:------| +| ✅ | 3.4.1 | KLEE parado pelo HaltTimer não é prova (TRUE errado 27 → 5 na R15) | Integração | +| ✅ | 3.4.2 | Vetor vazio conta como testemunha (programas sem entrada) | `KtestReaderTest` | +| ✅ | 3.4.3 | `abort()` do programa poda o caminho (`map2check_assume(0)`), não encerra a busca do KLEE | Integração §29 | +| ✅ | 3.4.4 | KLEE que concretizou uma entrada ou matou estados cedo não é prova | Integração §30 | +| ☐ | 3.4.5 | MemoryTrackPass não instrumenta os intrínsecos `llvm.memcpy/memset/memmove` do LLVM 16 | — | +| ☐ | 3.4.6 | Falso positivo do memtrack no busybox `sleep-3` | — | + > **Marco Fase 3:** Coordenador funcional, AFL++ ↔ KLEE com Smart Seeds > **Data-alvo:** 13/Mar/2027 diff --git a/docs/reports/2026-08-16-crabllvm-review.md b/docs/reports/2026-08-16-crabllvm-review.md index 9bbd10a42..0d71e71a6 100644 --- a/docs/reports/2026-08-16-crabllvm-review.md +++ b/docs/reports/2026-08-16-crabllvm-review.md @@ -283,3 +283,28 @@ Tudo verificável e datado de 2026-08-16: - Leitura direta dos cinco pontos de acoplamento no Map2Check, citados por arquivo e linha - Baseline v5 para os números de externas não resolvidas e de precisão + +--- + +## Adendo (2026-09-30): o que o motor antigo fazia de fato + +Medido com o release v7.3.1 (SV-COMP 2020), que roda em `python:2.7-slim` com o clang do +LLVM 6 que vem nele. Detalhes em `docs/reports/tacas-experiment-log.md`, INV-1 e R25. + +- **Houve duas configurações.** Até 18/10/2018 (commit `4bb409c20`) o Map2Check usava + `--crab-track=arr --crab-add-invariants=after-load`, e os invariantes saíam como + `verifier.assume`, que o NonDetPass mapeava para `klee_assume`. Da v7.3 em diante + entrou o `--crab-promote-assume`, que emite `llvm.assume`. O NonDetPass antigo não o + mapeava, e o KLEE 2.1 do release o ignora (o mesmo vale para o KLEE 3.1). **Nas versões + de competição de 2019 e 2020 os invariantes não tinham efeito.** +- A seção 2 desta revisão já suspeitava disso ("a invocação legada não teria injetado + nada"); agora está medido. +- **O que parecia funcionar** provavelmente era o caminho de compilação: passar pelo + crab-llvm, e hoje pelo Clam, deixa o módulo em SSA, e o KLEE explora isso melhor. Numa + sonda só com o KLEE, o Clam sem nenhum invariante decidiu o que o pipeline normal + deixava UNKNOWN. +- **No híbrido atual** (R25) os perfis do Clam não ganharam, e o MemSafety teve mais + FALSE errados. +- A opção continua **opcional**. Os perfis (`MAP2CHECK_CLAM_PROFILE=default|memory|none`), + a contagem de invariantes no log, o limite de 0,2T e o recuo para a compilação normal + entraram na 9.0. A rodada dedicada de estudo está em `docs/backlog.md`. diff --git a/docs/reports/2026-09-29-handoff-tacas.md b/docs/reports/2026-09-29-handoff-tacas.md new file mode 100644 index 000000000..ed74759b2 --- /dev/null +++ b/docs/reports/2026-09-29-handoff-tacas.md @@ -0,0 +1,240 @@ +# Handoff TACAS — 2026-09-29 (atualizado à tarde) + +Ponto de partida para a próxima sessão. Regras do usuário que continuam valendo: + +- **Nunca mergear**: sempre abrir PR, com base `develop`. +- Branches se chamam `feat/…`. **Não mexer no gatilho do `ci.yml`**. +- **Registrar cada mini-rodada** em `docs/reports/tacas-experiment-log.md` e comparar uma + a uma. +- LibFuzzer está abandonado. +- Commits e PRs em inglês; docs e relatórios em pt-BR. +- **Nunca rodar `cmake .` num `build_*` sem `-DCMAKE_INSTALL_PREFIX`.** O prefixo volta + para `release/` e o `ninja install` sobrescreve a instalação de referência. + +Em 2026-09-29 o usuário delegou as decisões ("você tem permissão para fazer as decisões que +quiser") e pediu, nesta ordem: +1. investigar os TRUE errados restantes; +2. implementar o 2d e o 3b com as abordagens recomendadas; +3. lançar os testes ao final. + +## 1. Pilha de branches (locais, **nenhuma enviada ainda**) + +Cada branch parte da anterior. As PRs devem ser abertas em cadeia (cada uma com base na +anterior, ou todas contra `develop` em ordem). + +| branch | commits próprios (resumo) | +|---|---| +| `feat/tacas-smart-seeds` | 3a (sementes), revisão, `provedSafe`, **fix abort → assume**, **fix caminhos descartados** (+ duas correções dele), logs R15/R16/R18 | +| `feat/tacas-2d-slicing` | 2d: slice uma vez por execução (cache `.slice/`), knobs `MAP2CHECK_SLICE_CLEANUP` e `MAP2CHECK_SLICER_FLAGS`, `opt` limitado | +| `feat/tacas-3b-alternation` | fix AFL (zeros após o fim da entrada); 3b `--alternate-engines`; correções da revisão; `migration-schedule.md` atualizado | +| `feat/tacas-memtrack-intrinsics` | fix: `memset/memcpy/memmove` checados no LLVM 16 (despacho por `MemSetInst`/`MemTransferInst`); fix: mensagem de erro de link do AFL++ | +| `feat/tacas-3c-seed-ranking` | 3c v1: entradas `+cov` da fila vão primeiro para o KLEE (spec `2026-09-29-tacas-3c-seed-ranking-design.md`); logs R16-CB/R17/R19 parcial; fix do classificador (segfault do replay do AFL não é ERROR) | +| `feat/tacas-memtrack-strings` | fix: `%s`/`puts` checam a string antes da chamada (o `printf` roda como externa no KLEE → TRUE errado do Juliet CWE193) | +| (3b, depois da R19) | `fix(hybrid): the fuzzer gets all of KLEE's vectors, built once, with growing patience` — as 5 perdas eca-* da alternância | +| `feat/tacas-klee-vector-replay` (acima de fuzzer-suite) | vetores do KLEE executados nativamente com zeros após o fim, depois de cada fase KLEE sem violação (o ganho eca-* do braço seeds, agora explícito e também no híbrido simples) | +| `feat/tacas-fuzzer-suite` | knob `MAP2CHECK_FUZZER_SUITE=1`: o corpus do AFL++ entra na suíte de Cover-Branches (até metade, sem duplicatas) | + +- **Ponta da pilha:** `feat/tacas-3c-seed-ranking` (a R19 e a R17 usam o build de + `8c70e5a73`; a R20 usa `install_r20`, da ponta com o 3c). +- **Testes:** unitários 12/12; integração 46 seções. +- **Specs:** + - `docs/superpowers/specs/2026-09-29-tacas-2d-slicing-optimizations-design.md`; + - `docs/superpowers/specs/2026-09-29-tacas-3b-engine-alternation-design.md`, que inclui + a seção "Revisão". +- **Revisão final (subagente opus):** achados 1–9 tratados. + - 1: o contador "partially completed paths" também conta podas por assunção e impedia + qualquer prova. Corrigido. + - 2–3: KLEE que morreu e "skipping fork". Corrigidos. + - 4–9: suíte de Cover-Branches entre fases, orçamento das fases, SIGINT duplo, paciência + do KLEE e flags. Corrigidos. + +## 2. Correções de veredito desta sessão (todas testadas) + +- **`abort()` do programa vira poda** (`map2check_assume(0)`). Resolveu 6 de 8 TRUE errados + da R15 e também o falso positivo do memtrack no `busybox sleep-3`: o `bb_show_usage()` + chamava `abort()` com `argv` ainda alocado. +- **KLEE que descartou caminhos não é prova.** Os casos são: + - "silently concretizing" (double simbólico: `sin_interpolated_index-1`); + - qualquer `*.err` ou `*.early` (VLA: `insertion_sort-1-2`); + - HaltTimer; + - "skipping fork" ou "over memory cap"; + - `info` sem "done: completed paths" (crash). +- **`nondet_assume` do KLEE usa `klee_silent_exit`.** O `klee_assume(0)` gerava `user.err`. +- **AFL++:** leitura após o fim da entrada devolve 0. Antes ela recomeçava o buffer, o + `while(nondet())` nunca terminava e o `afl-fuzz` abortava no dry run. +- **Memtrack:** intrínsecos de memória do LLVM 16 passaram a ser checados. + +## 3. Resultados já registrados no log + +- **R16 (Cover-Error, sementes 3a × controle R15):** **148 × 129 cobertas** (+15%), pares + 21 × 2. Os 7 TRUE errados vêm dos dois defeitos já corrigidos. +- **R18:** a correção do abort eliminou 6 de 8 TRUE errados. Os 2 restantes eram + caminhos descartados, também corrigidos. + +## 4. Rodadas em execução (dados em `/home/guilherme/github/prism/tacas-results/`) + +- **Build:** `install_r19`, cópia congelada do `build_abort/install` no commit `8c70e5a73` + (registrado em `r19-commit.txt`). +- **R19:** + - Escalonador: `r19-sched.sh`, rodando com `setsid`, log em `r19-sched.log`. Os jobs estão + em `r19-jobs.tsv`, com no máximo 11 contêineres ao mesmo tempo. + - Cover-Error (`r15-ce.tsv`): control, seeds, alternate, slice, slice-light, slice-o2, + slice-ntscd, slice-ptafs, 3 shards cada. + - Cover-Branches (`r15-cb.tsv`): control, seeds, alternate, 2 shards cada. + - Resultados em `R19--_s/results.csv`. + - A primeira tentativa foi descartada (`discarded-r19a/`): o build tinha o contador de + parciais errado e os defeitos da revisão. +- **R17:** + - Escalonador: `r17-sched.sh`, log em `r17-sched.log`. Divide as vagas com a R19. + - SV-COMP MemSafety (50), MemCleanup (10) e NoOverflows (20), 120 s, braços control, + seeds e alternate. + - Manifests `r17-*.tsv`, regenerados com `build_corpus.py` e os mesmos parâmetros da + R9/R13. Os originais se perderam em diretórios temporários. + - Resultados em `R17--/`. +- **R20:** `r20-sched.sh`, que espera a R19 lançar seus 30 jobs. Mede Cover-Error seeds e + alternate com o ranking do 3c (`install_r20`), para comparar com os mesmos braços da R19. +- **R21:** `r21-sched.sh`. MemSafety e MemCleanup (control) e o CASTLE com `install_r21` + (checagem de `%s`), para comparar com a R17 e a R14. Gate: nenhum falso positivo novo. +- **R22:** `r22-sched.sh`, que espera a R19. Cover-Branches control, seeds e alternate + com `MAP2CHECK_FUZZER_SUITE=1` (`install_r23`: o `r22-run.sh` foi reapontado), para + comparar com a R19. +- **R23:** `r23-sched.sh`, que espera a R19. Cover-Error seeds e alternate com o build + final (`install_r23`: ponta `feat/tacas-fuzzer-suite`, com a alternância corrigida — sem + limite na troca KLEE → AFL++, cache dos binários do AFL++, paciência crescente). + Comparar com a R19. A R20 ficou só com o braço seeds, que isola o 3c. +- **R24:** `r24-sched.sh`, que espera a R19. Cover-Error control e seeds com `install_r24` + (ponta `feat/tacas-klee-vector-replay`). Comparar o control com o da R19 (efeito do + replay de vetores) e o seeds com o da R23. +- **Incidente da R19:** o shard 0 do braço seeds tinha 38 linhas do shard 1 e faltavam 42 + tarefas dele. Foi relançado como `r19-ce-seeds-0-resume` (e `control-0-resume` para 2 + faltantes). Na análise, filtrar as linhas pelo índice no manifest (`i % 3 == shard`). +- **R16 Cover-Branches** (`r16-cb-seeds-*`, build antigo) terminando; comparar com a R15. + +**Análise pendente:** +- **Cover-Error:** cobertas, TRUE errado e pares discordantes de cada braço contra o + control. Gate: TRUE errado = 0. +- **Cover-Branches:** cobertura média. +- **R17:** correct-true, correct-false, wrong-true, wrong-false. + - Um wrong-true bloqueia o braço. + - Contar TRUE corretos, porque a parada por estagnação pode custar provas. +- **2d:** promover o vencedor entre light, o2, ntscd e ptafs a padrão, com commit próprio. +- **3b:** promover `--alternate-engines` a padrão do híbrido se ele ganhar de seeds. + +## 4b. Estado em 2026-09-29, noite + +- **Resultados já no log:** R19 (Cover-Error e Cover-Branches) e R21. + - Cover-Error: seeds +23 −0 contra o control; alternate +20 −0. + - Cover-Branches: alternate 50,3% contra 44,7%. + - TRUE errado 0 em todos os braços. +- **Correções da noite:** + - fd 3 do harness fechado para os filhos; + - varredura do IR sem regex (2d); + - orçamento único para as 3 compilações do AFL++ (3b); + - checagem de `%s` atrás de `MAP2CHECK_CHECK_CSTRINGS=1`, por falso positivo em Juliet + good. + - A ponta passou na integração 50/50. +- **Knobs de slicing:** nenhum promovido (as variantes ficaram em ±3). +- **Na fila** (8 vagas, reduzidas por falta de memória): R20, R21-castle, R22, R23, R24 + (e o shard `r24-ce-control-0-resume`). As rodadas usam installs anteriores às correções + da noite. Isso só afeta slice em programas enormes e o harness, que foi corrigido no repo + e vale para contêineres novos. + +- **R22 control relançado** (`r22-cb-control-*-rerun`): a primeira tentativa deu ERROR nas + 120 tarefas ("cannot create std::vector larger than max_size()", input ilegível no hash) + durante o pico de falta de memória; os dados foram para `discarded-r22a/`. O hash agora + falha com mensagem clara (`fix(frontend): an unreadable input program...`). + +## 4c. Próxima frente, por decisão do usuário: a lacuna Crab-LLVM → Clam + +Depois de fechar a campanha atual e **antes das outras lacunas** (floats, memória não +inicializada, busca dirigida). O ponto de partida: +- O motor antigo era a cadeia de forks `hbgit/crab-llvm` (branch `dev-llvm-6.0`), com + `hbgit/crab`, `hbgit/sea-dsa` e `hbgit/llvm-dsa`. Os commits públicos do hbgit nesses + forks são só de porte e build para o LLVM 6. As especializações de que o usuário lembra + não aparecem ali; **perguntar onde estão**. +- O release do SV-COMP 2020 (`v7.3.1`, `map2check-rc-v7.3-svcomp20.zip`) traz o motor + compilado em `bin/crabllvm`, com Apron (domínios `oct` e `pk`). O domínio padrão era + `zones`. +- No Clam `dev16` do `Dockerfile.dev`, o padrão também é `zones`, mas nem Apron, nem Elina, + nem LDD, nem PPLite são compilados: `oct`, `pk` e `boxes` ficam indisponíveis. O + comentário do Dockerfile que fala em "intervalos" está errado. +- O `--add-invariants` sobre o Clam **nunca foi medido** (o gate previsto é CASTLE e Juliet + sem perder detecção). +- **Sonda de 2026-09-29, num programa com laço.** O motor do v7.3.1 roda em + `python:2.7-slim` com o clang do LLVM 6 que vem no próprio release. + - As flags do v7.3.1, tiradas das strings do binário, incluem `--crab-promote-assume`: + **17 invariantes emitidos como `llvm.assume`**. + - O Clam, com as flags atuais, emite **18 como `verifier.assume`**, que o NonDetPass + converte em `klee_assume`. + - O NonDetPass antigo só reconhecia `verifier.assume`, e o **KLEE ignora `llvm.assume`** + (testado no 3.1). Então, no v7.3.1, os invariantes **não chegavam ao KLEE como + restrição**. Se ajudavam, era pelo otimizador do LLVM, que dobra ramos com base em + `llvm.assume`. O mecanismo é outro, e é provavelmente isso que "não é a mesma coisa" + quer dizer. + - Os dois motores produzem fatos no estilo de zones (`x − y ≤ c`). +- **INV-1 feito** (log de experimentos). Os invariantes estavam inertes desde a v7.3 + (out/2018). O ganho observado vinha do pré-processamento em SSA, não dos invariantes. + Branch `feat/tacas-invariants`: + - `MAP2CHECK_CLAM_PROFILE=default|memory|none`; + - `MAP2CHECK_PREOPT=ssa`, só para alcançabilidade e assert; + - build `build_inv` com `-DENABLE_CLAM=ON` e os links `lib/klee/runtime` e `lib/clang` + criados à mão. +- **R25 na fila** (`r25-sched.sh`, `install_r25`): + - Cover-Error, shard 0 (71 tarefas): off, ssa, clam-none, clam-default, clam-memory; + - MemSafety (50): off, clam-none, clam-default, clam-memory. + - Gate: nenhuma detecção perdida. +- Primeiro passo (feito, ver INV-1): um **inventário diferencial**. Rodar o motor do v7.3.1 e o Clam `dev16` + nos mesmos programas e comparar os invariantes, antes de portar qualquer coisa. + +## 5. Depois das rodadas + +1. Registrar R17 e R19 no log. +2. Promover os knobs vencedores. +3. Push das 4 branches e PRs em cadeia, sem merge, com os números na descrição. +4. **3c:** ranking de sementes (novidade de cobertura, densidade SDG). +5. **Ideia anotada:** usar o corpus do AFL++ como casos de Cover-Branches, via replay + tipado. Hoje a suíte de CB sai só do KLEE. +6. **Perda de 2026-09-29:** o `release/results/map2check_castle.2026-07-17_04-53-54.results.sv-comp19_map2check.txt` + foi apagado por engano e não tem cópia. Regera-se com `tests/castle/run_castle_benchexec.sh`. + `release/` foi restaurado a partir de `install_v15/`. +7. O worktree velho `../Map2Check-2c` precisa de `--force` para ser removido. **Pedir + permissão** antes. + +## 6. Campanha completa da 9.0 (lançada em 2026-09-30, 14h16) + +- **Lançador:** `../tacas-results/v9-campaign.sh`, rodando com `setsid`, log em + `../tacas-results/v9-campaign.log`. Ele espera o R26 terminar e roda sozinho, na ordem + do plano: CASTLE, Cover-Error (1087, 3 shards), Juliet (grupos a–d, como a v15) e + Cover-Branches (2765, 6 shards). +- **Build:** `install_v9`, cópia congelada da ponta de `feat/map2check-9.0` + (`v9-commit.txt`). Um commit de código novo antes do merge exige rodar de novo a parte + afetada. +- **Imagem:** `map2check-v9-eval:latest`, que é a `map2check-dev:aflpp` com o TestCov. +- **Condições da v15:** `--memory=4g`, `--cpus=2` (Test-Comp) e `--cpus=1` (Juliet e + CASTLE), 300 s, `PER_FAMILY=10`; no máximo 5 contêineres. +- **Resultados:** `../tacas-results/V9-*`, pareados com `tests/*/results_v15*`. + +### Queda de energia (2026-10-02) e como retomar + +- A campanha parou na queda; os CSVs ficaram íntegros, exceto o + `V9-juliet-b/juliet_scope_c_results.csv`, que tinha 300 bytes nulos no fim. Ele foi + limpo, e a cópia original está em `.bak-powerloss`. +- O lançador foi reescrito para sobreviver a outra queda: + - os contêineres usam `--restart=unless-stopped` e voltam sozinhos com o Docker; + - um job concluído grava `../tacas-results/.v9-done-` e fica parado, e o lançador + o remove. Sem isso, a política de reinício o rodaria de novo. +- **Para retomar depois de um reboot**, dentro de `../tacas-results`: + `SLOTS=5 setsid nohup ./v9-campaign.sh > v9-campaign.stderr 2>&1 < /dev/null &` + Ele pula o que estiver marcado como concluído, e os harnesses pulam o que já está no + CSV. Retomada conferida sem duplicatas. + +### Cover-Branches: shard 5 dividido em 4 partes (2026-10-03, 20h) + +- Para encurtar a cauda (os shards 4 e 5 tinham ~460 tarefas cada, a ~13/h), o shard 5 + foi dividido em `../tacas-results/cb-s5-p{0..3}.tsv` (115 tarefas cada), com resultados + em `V9-cb_s5_p{0..3}`. Eles rodam pelo lançador auxiliar `v9-cb5.sh`. O principal foi + encerrado (só faltava o shard 5) e `.v9-done-v9-cb-s5` impede que ele o suba inteiro. +- **Análise:** juntar `V9-cb_s{0..4}` (filtrando por índice % 6) com as 4 partes do + shard 5 (sem filtro). +- **Após um reboot:** relançar `./v9-cb5.sh`; ele também remove os jobs concluídos dos + shards 0 a 4. diff --git a/docs/reports/2026-09-30-plano-campanha-completa.md b/docs/reports/2026-09-30-plano-campanha-completa.md new file mode 100644 index 000000000..487633a04 --- /dev/null +++ b/docs/reports/2026-09-30-plano-campanha-completa.md @@ -0,0 +1,66 @@ +# Plano da campanha completa pós-merge (Map2Check 9.0) + +**Objetivo:** medir a 9.0 no **mesmo recorte da campanha v15** (relatório +`docs/Map2Check-Relatorio-v15.docx`), com a configuração padrão da 9.0, para uma +comparação pareada tarefa a tarefa. É a base do artigo e da decisão de release. + +## O que roda + +**Um braço só:** a configuração padrão da 9.0, que é o híbrido alternado com troca de +sementes e o corpus do fuzzer nas suítes de Cover-Branches. Os braços alternativos +(`--fixed-hybrid`, `--slice`, knobs) já foram medidos nas amostras (R15 a R26) e não +entram. A v15 **não roda de novo**: os resultados dela estão em `tests/*/results_v15*` +e o pareamento é feito pelo programa. + +| corpus | tarefas | manifest | custo médio por tarefa* | horas-vaga | +|---|---|---|---|---| +| Test-Comp Cover-Error | 1 087 | `tests/testcomp/corpus/cover-error-q400.tsv` (o recorte da v15) | ~85 s + TestCov ≈ 110 s | ~33 | +| Test-Comp Cover-Branches | 2 765 (o mesmo recorte da v15, confirmado) | `tests/testcomp/corpus/cover-branches-q400.tsv` | ~240 s + TestCov ≈ 300 s | ~230 | +| Juliet (escopo C) | ~8 000 | `tests/juliet` (os 4 shards da v15) | ~36 s | ~80 | +| CASTLE | 250 (119 em escopo) | `tests/castle` | ~60 s | ~2 | +| SV-COMP MemSafety, MemCleanup e NoOverflows | por categoria, a decidir | `build_corpus.py` | ~36 s | depende | + +\* medido nas rodadas R17, R19 e R26 com 300 s (Test-Comp) e 120 s (SV-COMP). + +## Capacidade e duração + +- Máquina: 16 núcleos, 23 GB. Com **no máximo 5 contêineres** a memória não fica crítica + (com 8 ela ficou; ver `docs/backlog.md`, limite de memória do KLEE). +- Duração, com 5 vagas: + - Cover-Error: ~7 h; + - Juliet: ~16 h; + - Cover-Branches: ~2 dias (2 765 tarefas); + - CASTLE e SV-COMP por categoria: algumas horas. + - Total: **~3,5 dias**. +- Ordem sugerida, das decisões mais baratas para as mais caras: + 1. CASTLE; + 2. Cover-Error; + 3. SV-COMP; + 4. Juliet; + 5. Cover-Branches. + +## Regras da execução + +- **Build:** a tag da 9.0 depois do merge, com o install congelado (copiado) antes do + início, como nas rodadas R19 a R26. +- **Escalonador fora do repositório** (decisão do projeto). Ele precisa: + - usar `-` em vez de campo vazio na lista de jobs (o bash junta tabs consecutivos); + - retomar pelo CSV; + - separar os shards por índice do manifest. +- **Validação de cada lote antes de seguir:** + - nenhuma tarefa com ERROR em massa, que é sinal de problema de infraestrutura; + - contar as tarefas com "did not finish its run" (KLEE morto por falta de memória) e + repeti-las. +- **Registro:** cada corpus concluído entra em `docs/reports/tacas-experiment-log.md`, + comparado à v15 com: + - cobertas e TRUE errado (Cover-Error); + - cobertura média (Cover-Branches); + - TP, FN, TN e FP (Juliet e CASTLE); + - correct e wrong (SV-COMP). + +## Critérios de aceite para a release + +- TRUE errado = 0 em Cover-Error e nenhum wrong-true novo no SV-COMP. +- Cover-Error e Cover-Branches: não piores que a v15 no pareado (a amostra aponta + +46 cobertas em 213). +- CASTLE e Juliet: FP não maiores que os da v15, e FN iguais ou menores. diff --git a/docs/reports/2026-10-06-ambiente-testcomp-oficial.md b/docs/reports/2026-10-06-ambiente-testcomp-oficial.md new file mode 100644 index 000000000..19b286f46 --- /dev/null +++ b/docs/reports/2026-10-06-ambiente-testcomp-oficial.md @@ -0,0 +1,150 @@ +# Ambiente oficial da Test-Comp 2026 + +Reprodução local do ambiente da competição, para (a) revalidar as suítes com os +validadores oficiais e (b) medir com as condições que a Test-Comp de fato usa — e +não com o nosso teto calibrado. + +**Branch:** `feat/testcomp-official-env` (a partir de `feat/map2check-9.0`). +**Commits:** `e5a86a779`, `cb99fe7bd`, `866d35028`, `44d2160ab`. + +## 1. Motivo + +A análise da campanha da 9.0 mostrou que o teto de **50 casos por suíte** +(`kMaxBranchTestCases`) foi calibrado no **nosso** ambiente: TestCov 3.7, 300 s por +tarefa, **sem** BenchExec. A competição **não** limita o tamanho da suíte. Para saber se +o teto ajuda ou atrapalha, os testes precisam rodar como a competição roda. + +## 2. O que a competição usa (tag `testcomp26`) + +De `gitlab.com/sosy-lab/test-comp/bench-defs`, tag `testcomp26`: + +- **Imagem:** `registry.gitlab.com/sosy-lab/benchmarking/competition-scripts/user`, + Ubuntu 24.04.3, clang 18 e gcc 13. O `Dockerfile` fixa o digest + `sha256:2a38216d…`. A imagem "full" do TestCov no fm-tools é a mesma. +- **BenchExec 3.34** (submódulo `829bf7a458`). +- **Validadores:** + - TestCov 3.11.post3 (Zenodo `17698774`); + - TestCoCa `testcomp26` (Zenodo `17819536`). +- **Validação:** 10 min, 7 GB, 2 núcleos e `--timelimit-per-run 50`. São **cinco** + definições: TestCov com gcc e com clang, formatado e não formatado, mais o TestCoCa. +- **Pontuação** (`competition-scripts`, `export_adjusted_csvs.py`, `update_score_tester`): + - **Cover-Branches:** o **máximo** da cobertura entre os validadores; + - **Cover-Error:** basta **um** validador responder TRUE. +- **Geradores:** 15 min de CPU, 15 GB, 4 núcleos, `resultfiles **/test-suite`. Não existe + `map2check.xml` na tag (o nosso segue o modelo do `klee.xml`). + +## 3. O que foi construído + +Em `tests/testcomp/official/`: + +- **`Dockerfile`** — imagem `map2check-testcomp-env`: a base oficial fixada por digest, + BenchExec 3.34, TestCov 3.11.post3 e TestCoCa baixados do Zenodo com verificação de + `sha256`. +- **`init.sh`** — entrypoint que cria o cgroup separado do BenchExec (cgroups v2, como o + `doc/benchexec-in-container.md` prescreve). Sem ele o BenchExec não limita nem mede. +- **`bench-defs/`** — as **cinco** definições oficiais, sem alterações, mais o + `map2check.xml` (não oficial, modelado no `klee.xml`) para **gerar** as suítes. +- **`testcomp.py`** — dois passos, cada um uma rodada de BenchExec: + - `generate`: monta o archive (`utils/testcomp-archive/make-archive.sh`) e roda sob o + `map2check.xml`; cada `test-suite/` vira um `.zip` no layout dos validadores; + - `validate`: as cinco definições oficiais, com o task set e os caminhos reescritos, + e as pontuações fundidas como a competição funde. +- **`run.sh`** — sobe o contêiner (`--privileged --cap-drop=all --device /dev/fuse`), + monta o repositório em `/m2c` e os dados em `/data`, e **traduz** os caminhos da linha + de comando para dentro do contêiner. + +Em `utils/`: + +- **`map2check-testcomp-wrapper.py`** — passa a apontar o AFL++, `AFL_PATH`, `AFL_CC` e os + passes para as cópias **empacotadas** no archive, quando existem; fora do archive, os + padrões de instalação de desenvolvimento continuam valendo. +- **`moduleBenchExec/map2check_testcomp.py`** — módulo tool-info do BenchExec (separado do + `map2check.py`, que é o adaptador SV-COMP). Tira o orçamento de `cputime` quando o run + set não tem `walltime` — que é o caso da Test-Comp. +- **`moduleBenchExec/__init__.py`** — para o BenchExec carregar + `moduleBenchExec.map2check_testcomp`. +- **`testcomp-archive/make-archive.sh`** — zip **autocontido** (~99 MB) com LLVM 16, KLEE 3.1 + e AFL++ 4.40c. Reconstrói o `RUNPATH` de cada ELF (via `patchelf`) em vez de usar + `LD_LIBRARY_PATH`, e recusa symlinks não resolvidos. + +## 4. Como rodar + +```sh +# imagem (uma vez) +docker build -t map2check-testcomp-env tests/testcomp/official + +# archive do Map2Check: roda na imagem de desenvolvimento, que tem LLVM16/KLEE/AFL++ +docker run --rm -v "$PWD:/workspace" -w /workspace map2check-dev:aflpp \ + utils/testcomp-archive/make-archive.sh /workspace/install_v9b /workspace/map2check.zip + +# gerar as suítes num corpus pequeno +tests/testcomp/official/run.sh generate --property cover-branches \ + --tasks tests/testcomp/corpus/cover-branches-q40.tsv \ + --archive map2check-testcomp.zip --suites OUT/suites --out OUT/gen + +# validar com os cinco validadores oficiais +tests/testcomp/official/run.sh validate --property cover-branches \ + --tasks tests/testcomp/corpus/cover-branches-q40.tsv \ + --suites OUT/suites --out OUT/val +``` + +## 5. Verificação + +- **Os cinco validadores concordam** em 3 tarefas (smoke2), sob o BenchExec: + +| tarefa | gcc | clang | TestCoCa | +|---|---|---|---| +| `array-fpi/s52iff_overflow` | 81,25% | 81,25% | 81,25% | +| `xcsp/AllInterval-011` | 90,91% | 86,36% | 90,91% | +| `eca-rers2012/Problem10_label28` | 37,81% | 37,81% | 37,81% | + +- Uma suíte ECA de 50 casos foi validada em **~40 s** pelo TestCov 3.11, enquanto o + TestCov 3.7 estourava os 300 s do harness. +- O pacote roda na **imagem oficial**, com KLEE e AFL++ funcionando. +- `run.sh generate` sob o BenchExec gerou as 3 suítes, com `--timelimit 120s` e + `--memorylimit 6GB`. + +## 6. Problemas resolvidos no caminho + +- **Overlay de `/home`:** o repositório é montado em `/m2c` e os dados em `/data`; o + `/home` do contêiner fica livre, porque o BenchExec o sobrepõe (e um overlay sobre um bind + mount abaixo dele falha com "Failed to create overlay mount"). Usa `fuse-overlayfs`. +- **TestCov escrevendo ao lado do programa:** as entradas vão para um diretório de staging. +- **`--format` escrevendo no diretório da ferramenta:** o BenchExec roda a partir de uma + **cópia** da ferramenta. +- **`${taskdef_name}` inclui `.yml`:** o layout das suítes mantém o nome completo. + +## 7. Achado e correção: propriedades locais da tarefa (2026-10-07) + +Ao validar as **140 suítes** de Cover-Branches que deram `TESTCOV_ERROR` na campanha da +9.0 (TestCov 3.7, 300 s), todas saíram **`MISSING`**. + +- **Causa raiz:** `testcomp.py:stage_tasks()` copiava o `.yml`, os `input_files` e o + `properties/` **global** — mas não os arquivos de propriedade **locais da tarefa**. + `eca-rers2018/Problem14.yml` referencia ~100 `properties/unreach-call-*.prp` relativos à + própria tarefa. O BenchExec resolve **todas** as propriedades de uma definição ao + carregar o task set; faltando um arquivo, ele **aborta a rodada inteira** — e com ela o + resultado de todas as 140 tarefas. O smoke2 passou porque `eca-rers2012` não tem + propriedades locais. +- **Correção** (`44d2160ab`): `stage_tasks` copia o `properties/` da tarefa quando existe. +- **Verificação:** com a correção, `eca-rers2018/Problem14` valida (`done`, ~2,4% nos cinco + validadores) e o BenchExec não aborta mais. + +> Ressalva da rodada completa: o host de 25 GB ficou **sob swap** (`7 GB × 3 threads`) e o +> próprio BenchExec avisou `System has swapped during benchmarking. Benchmark results are +> unreliable!`. Os números finais do `gcc-unformatted` do tcerr saíram; os das variantes +> `formatted` saíram quase todos `TIMEOUT` e **não devem ser levados a sério** desta rodada. + +## 8. Questões em aberto + +- O `sv-benchmarks` local (ago/2026, `cd68d4ed`) é mais novo que o fixado na `testcomp26` + (`7efe28dd`). Decidir se a rerrodada **fixa** a versão da competição. +- O `make-archive.sh` lê o `install_v9b` (build de `6848d2395`). + +## 9. Próximos passos + +1. Recalibrar o **teto de 50** com o validador oficial (o teto não existe na competição). +2. Implementar a **seleção da suíte por cobertura**. +3. CI da Test-Comp: reproduzir este ambiente num job — **adiado** por decisão de sessão + (custo ~20–35 min/run, `--privileged`/`/dev/fuse`); a alternativa barata é um teste + unitário do `stage_tasks`. Ver `docs/reports/2026-10-07-handoff-testcomp-oficial.md`. diff --git a/docs/reports/2026-10-11-handoff-v99-campanha.md b/docs/reports/2026-10-11-handoff-v99-campanha.md new file mode 100644 index 000000000..1567d4ccd --- /dev/null +++ b/docs/reports/2026-10-11-handoff-v99-campanha.md @@ -0,0 +1,104 @@ +# Handoff — campanha V99 no ambiente oficial da Test-Comp (2026-10-11) + +Ponto de partida para a próxima sessão (Claude). O objetivo da sessão foi: **rodar a +campanha completa da 9.0 no ambiente oficial da Test-Comp 2026**, com sv-benchmarks +fixado na `testcomp26`, limites oficiais e validação pelos validadores oficiais. + +Regras do usuário que continuam valendo: +- **Nunca mergear**; sempre PR com base `develop`. +- Branches `feat/…`. **Não mexer no gatilho do `ci.yml`**. +- Registrar cada mini-rodada em `docs/reports/tacas-experiment-log.md`. +- Commits/PRs em inglês; docs em pt-BR. +- **Nunca rodar `cmake .` num `build_*` sem `-DCMAKE_INSTALL_PREFIX`** (o prefixo volta + para `release/`). + +## 1. Branch e commits + +`feat/testcomp-official-env`, base `feat/map2check-9.0`. HEAD `44d2160ab`. Commits +próprios: `e5a86a779` (validadores oficiais sob BenchExec), `cb99fe7bd` (runner +generate/validate), `866d35028` (archive do AFL++), `44d2160ab` (staging das +propriedades locais da tarefa). + +**Nada foi pushado.** Há trabalho **não commitado** (ver §5). + +## 2. Decisões do usuário nesta sessão + +- Rerrodada com **limites oficiais** (900 s; memória ajustada a **8 GB** para 2 vagas + nesta máquina de 23 GB; 4 núcleos). +- **Cover-Error inteira** + **Cover-Branches 3 500 estratificado** (proporcional ao + tamanho de cada categoria oficial). +- **sv-benchmarks fixado na `testcomp26`** (`7efe28dd29576b46927b7a34e8f742bd90966a75`). +- Build = ponta atual (`44d2160ab`; o código do tool é o da `feat/map2check-9.0` + o + wrapper/tool-info novos). +- Geração pelo **harness** (retomável), validação pelos validadores oficiais. + +## 3. O que está rodando agora + +- **Campanha `v99`**, launcher `tacas-results/v99-campaign.sh` (PID 33936). Contêineres + `v99-ce-s0/s1` (imagem `map2check-v9-eval:latest`, `--memory=8g --cpus=4`, + `--restart=unless-stopped`, retoma pelo CSV, done-markers `.v99-done-*`). + - **Cover-Error: ~1 579/1 902** processadas; 697 geraram teste; suítes em + `tacas-results/V99-suites/`, CSVs em `tacas-results/V99-ce_s*/results.csv`. + - **Cover-Branches: 0/3 500** — só entra quando o CE fechar (o launcher já os + enfileira). + - Build `install_v99` (script de build no relatório do ambiente oficial), archive + `tacas-results/V99/map2check-testcomp.zip`. +- **Validação oficial preliminar** (`validate-v99-ce.sh`, 3 validadores: gcc-unformatted, + clang-unformatted, testcoca): fechou **673/682 = 98,7%** TRUE por ≥1 validador. + scores.csv em `tacas-results/V99-ce-prelim/scores.csv`. Re-rodar quando o CE avançar. + +## 4. Issue aberta (pendência principal) + +- **#74** — "NonDetPass: tipos `__VERIFIER_nondet_*` não modelados zeram tarefas + (Intel-TDX, Floats) para UNKNOWN" — https://github.com/hbgit/Map2Check/issues/74 + - `NonDetPass.cpp` modela só 16 tipos; faltam `float, longlong, ulonglong, _Bool, + u8/u16/u32, charp`. + - Medido: 147 tarefas `UNKNOWN` afetadas (ulonglong 113, float 22, u32 12) → + **Intel-TDX 125, Floats 22**. + - A correção exige recompilar o tool → foi decidido **não** mexer no build no meio da + campanha (build único). Fica como follow-up. + +## 5. Trabalho não commitado (revisar e commitar) + +- `tests/testcomp/official/testcomp.py` — fixes: (a) staging das propriedades locais do + task (já em `44d2160ab`); (b) **disco**: remove `--no-compress-results`, apaga o + `results/` (o `.files` é o grosso), o `sv-benchmarks/` staged e o `tool/` + após cada validador — validado: 3 tarefas → 20 KB (antes 140 → 8 GB). Knob + `MAP2CHECK_KEEP_RESULTS=1` preserva o scratch para debug. +- `tests/testcomp/run_testcomp_evaluation.sh` — `TESTCOV_S=0` desliga o TestCov interno + (a validação é pelos validadores oficiais). +- `tests/testcomp/build_corpus_official.py` — **novo**: corpus estratificado + PROPORCIONAL ao tamanho, lendo categorias/excludes do def oficial. (Não existia + estratificação proporcional no repo; o `build_corpus.py` usa cota igual por categoria.) +- `tests/testcomp/corpus/cover-error-official.tsv` (1 902) e + `cover-branches-3500.tsv` (3 500). +- `tests/testcomp/official/bench-defs/excludes/ECA-excludes.set` — exclude oficial do + ECA (exclui 1 027 de ~1 059 ECA; sem ele o corpus super-representava ECA). +- Docs: `docs/reports/2026-10-06-ambiente-testcomp-oficial.md` (novo) e entrada no + `tacas-experiment-log.md`. + +## 6. Próximos passos + +1. **Fechar o CE** (as ~323 restantes são Intel-TDX/Hardware, lentas e UNKNOWN) e deixar + o **CB** (3 500) rodar; o launcher já cuida disso. +2. **Validar oficialmente** as suítes conforme a geração avança (rodar `validate-v99-ce.sh` + periodicamente; depois idem para o CB com `--property cover-branches`). +3. **Relatório da campanha** (pt-BR) com a comparação pareada e o placar oficial de CE e + CB; entrada no `tacas-experiment-log.md`. +4. **Commitar** o trabalho do §5 (cada um no seu assunto). +5. **Issue #74**: implementar o fix do `NonDetPass`, recompilar e re-rodar as categorias + afetadas (ou a campanha com build novo) — combinado como follow-up. +6. **tcerr**: a validação best-of (`clang-unformatted` + `testcoca`) morreu no meio; refazer + quando a máquina desafogar (script `tacas-results/official/validate-tcerr-fast.sh`). +7. **Windows/WSL**: o `ext4.vhdx` precisa ser compactado no Windows (o WSL liberou ~15 GB + internos — o lixo era `official/` 8,3 GB + imagens/build cache do Docker; o vhdx não + encolhe sozinho). Após `wsl --shutdown`, **relançar o launcher v99** (não sobrevive a + reboot). + +## 7. Números atuais + +- Cover-Error geração: ~1 579/1 902 (83%); 697 com teste (44,1% das processadas); + consolidado ~36,6% do corpus. +- Cover-Error validação oficial (682): **673 = 98,7%**. +- Categorias fracas: Intel-TDX 0/658, Hardware ~5/65 (orçamento/nondet), Floats ~11/33 + (nondet `float`, issue #74). diff --git a/docs/reports/2026-10-12-issue74-rerodada.md b/docs/reports/2026-10-12-issue74-rerodada.md new file mode 100644 index 000000000..0025703fd --- /dev/null +++ b/docs/reports/2026-10-12-issue74-rerodada.md @@ -0,0 +1,128 @@ +# Issue #74 — re-rodada das categorias afetadas (2026-10-12) + +Relatório da correção dos tipos `__VERIFIER_nondet_*` não modelados (issue #74) e da +re-rodada Cover-Error que mede o efeito dela nas condições oficiais da campanha V99. + +## Resumo + +- **Floats: 11/33 → 33/33** no Cover-Error, todas com score 1,0 nos 3 validadores oficiais. + As 22 tarefas recuperadas davam `UNKNOWN` em ~810–865 s; agora dão `FAILED` em 0–92 s. +- **Sem regressão:** as 15 tarefas de outras categorias que já davam `FAILED` na v99 + continuam `FAILED`, com score 1,0 nos 3 validadores. +- **Intel-TDX: 0/12** na amostra, como antes. O #74 era necessário, mas não suficiente: o + gargalo agora é a explosão de estados do KLEE ao gravar o log nondet, registrada na + **issue #75**. Ela afeta qualquer tarefa com mais que poucas leituras nondet, não só a + Intel-TDX. + +## Configuração + +| Item | Valor | +|------|-------| +| Correção | `05a157371` (branch `feat/nondet-missing-types`) | +| Build | `install_v99b` (o `install_v99` da campanha ficou intocado) | +| Imagem | `map2check-v9-eval:latest` | +| Limites | 900 s, 8 GB, 4 núcleos, `TESTCOV_S=0` (iguais aos da V99) | +| Tarefas | 60 de `tacas-results/V99b-affected.tsv` | +| Validação | `run.sh validate --property cover-error`, 3 validadores oficiais: `testcov-…-gcc-unformatted`, `testcov-…-clang-unformatted`, `testcoca-…-clang-formatted` | + +Composição das 60 tarefas: + +- **33 Floats:** a categoria inteira do corpus CE. +- **12 Intel-TDX:** amostra, semente 7499. +- **15 tarefas de guarda de regressão:** tarefas que davam `FAILED` na v99, em ProductLines + (5), Loops (3), Sequentialized (2), Hardware (2), Arrays (2) e Heap (1). + +A re-rodada ocupou uma das 2 vagas do launcher, em paralelo com o CE da v99. A carga da +máquina foi a mesma da campanha. + +## Resultados, par a par com a v99 + +| Categoria | Tarefas | v99 `FAILED` | v99b `FAILED` | Score oficial v99b | Transições | +|-----------|--------:|-------------:|--------------:|-------------------:|------------| +| Floats | 33 | 11 | **33** | **33,0** | 22 `UNKNOWN→FAILED`, 11 `FAILED→FAILED` | +| Intel-TDX | 12 | 0 | 0 | — | 5 `UNKNOWN→UNKNOWN`, 7 não rodadas na v99 (SKIPPED) → `UNKNOWN` | +| ProductLines | 5 | 5 | 5 | 5,0 | `FAILED→FAILED` | +| Loops | 3 | 3 | 3 | 3,0 | `FAILED→FAILED` | +| Sequentialized | 2 | 2 | 2 | 2,0 | `FAILED→FAILED` | +| Hardware | 2 | 2 | 2 | 2,0 | `FAILED→FAILED` | +| Arrays | 2 | 2 | 2 | 2,0 | `FAILED→FAILED` | +| Heap | 1 | 1 | 1 | 1,0 | `FAILED→FAILED` | + +**Validação oficial:** 48/48 suítes `true` em **cada um** dos 3 validadores, soma de score +48,0. As 26 tarefas que já davam `FAILED` na v99 também tinham score 1,0 lá, então não há +perda. + +**Tempo:** + +- Floats recuperadas: 0–92 s, mediana ~2 s. Na v99, as mesmas tarefas davam ~810–865 s. +- Guarda de regressão: a maioria ficou na mesma faixa. Algumas oscilaram, por exemplo + `email_spec27_product17` (8 → 64 s) e `email_spec27_product18` (21 → 51 s). Outras + ficaram mais rápidas, como `pals_lcr-var-start-time` (139 → 70 s) e `twocount32` + (107 → 82 s). +- Essas variações vêm do sorteio do AFL++ e da carga do vizinho. Todas ficaram muito abaixo + do orçamento de 900 s. + +## Intel-TDX: por que continua zerada (issue #75) + +O `failed external call: __VERIFIER_nondet_ulonglong` do #74 sumiu. Mesmo assim, as 12 +tarefas terminam `UNKNOWN` em ~800 s. + +Para isolar a causa, usei um programa sintético sem nenhum desvio antes do fim: +N leituras `__VERIFIER_nondet_int` e `reach_error` se `a[0] == 7 && a[N-1] == 42`. +KLEE puro, `install_v99b`: + +| N | Veredito | Tempo | Caminhos parciais | +|--:|----------|------:|------------------:| +| 2 | `FAILED` | 0 s | 1 | +| 5 | `FAILED` | 28 s | 861 | +| 10 | `UNKNOWN` | 60 s | 1 550 | +| 100 | `UNKNOWN` | 120 s | 3 218 | +| 10 000 | `UNKNOWN` | 120 s | 0 completos | + +**Diagnóstico pelo `run.istats` (N = 10):** 1 549 das 1 551 bifurcações estão sob +`map2check_target_function → map2check_exit → nondet_log_to_file → fprintf → vfprintf`. + +Ou seja, o KLEE **já chegou ao `reach_error`**. O que impede o veredito é a gravação do +`klee_log.csv`, cujos valores ainda são simbólicos: o `vfprintf` do uclibc bifurca a cada +dígito de cada valor. Uma tarefa Intel-TDX lê ~31 500 valores por execução. + +**Consequências:** + +- Nessas tarefas, o híbrido depende só do AFL++. +- O efeito vale para qualquer categoria com muitas leituras nondet, inclusive no + Cover-Branches. + +**Correção proposta na #75:** concretizar os valores antes de gravar, só no runtime KLEE. + +**Medido, mas não corrigido:** + +- O AFL++ roda a ~97 exec/s nessas tarefas. +- O log faz um `malloc` por leitura, e esse `malloc` também vaza, porque `append_element` + já copia a linha. + +**Hipótese descartada:** a B-tree em disco (`ContainerBTree.c`) **não** está no caminho. +O build liga o `ContainerRealloc.bc`. + +**Fora do escopo:** 44 das 658 tarefas exigem um valor igual a um endereço de `malloc`, o +que nenhum vetor reproduz no validador. + +## Situação da campanha V99 + +- **Cover-Error:** as 256 Intel-TDX restantes foram marcadas `SKIPPED` (`UNKNOWN` por + construção no `install_v99`). O `v99-ce-s1` termina as Hardware restantes. +- **Cover-Branches:** começou às 18h37 (`v99-cb-s0`), na vaga liberada pela re-rodada. +- **Placar oficial:** para a correção do #74 contar, as Floats do `install_v99b` + substituem as da v99 (+22 no CE). O CB tem 2 009 tarefas que declaram `float`. Ele roda + com o `install_v99` e herda a limitação; uma re-rodada CB das Floats com o `install_v99b` + fica como próximo passo. + +## Artefatos + +Todos em `tacas-results/`: + +- `V99b-affected.tsv`: lista das 60 tarefas. +- `V99b-ce-affected/results.csv`: vereditos e tempos. +- `V99b-suites/`: suítes. +- `V99b-ce-val/scores.csv`: validação oficial, 48 tarefas. +- `compare-v99b.py`: comparação par a par. +- `V99b-probe74/`: sonda de 300 s da #74. diff --git a/docs/reports/tacas-experiment-log.md b/docs/reports/tacas-experiment-log.md index adbed7c00..151569d04 100644 --- a/docs/reports/tacas-experiment-log.md +++ b/docs/reports/tacas-experiment-log.md @@ -286,3 +286,705 @@ classificador contava todo FALSE nelas como errado (corrigido: "any"). - **Leitura:** com o build final, o slicing de memória fica **34 × 33 corretos** e **1 × 2 TRUE errados** contra o controle nesta amostra — ligeiramente melhor, e sem nenhum erro novo atribuível à fatia. + +## R15 — amostra Test-Comp: tacasv2 (develop) × v15, Cover-Error (2026-09-28) + +- **Config:** build da `develop` depois do merge de #69/#68/#70/#71; `build_corpus.py + --property cover-error --per-category 20` (213 tarefas, **todas pareadas** com a + campanha v15 — amostragem aninhada), 300 s, TestCov 300 s, 3 shards por braço. + Controle = híbrido sem slice (tacasv1 + correções); slice = `--slice`. + +| braço | cobertas | TRUE errado | FALSE errado | tempo mediano | +|---|---|---|---|---| +| v15 controle | 111 | **27** | 0 | 43 s | +| v15 slice | 108 | 15 | 0 | — | +| **R15 controle** | **129** | **5** | 0 | **5 s** | +| R15 slice | 126 | 4 | 0 | 7 s | + +- **Controle × v15:** +18 cobertas (+16%); pares discordantes 20 × 2 (só R15 × só v15). + Por categoria (v15 → R15): ProductLines 14 → 20, Loops 13 → 16, Arrays 15 → 18, + ECA 2 → 5, Sequentialized 0 → 2; Heap 19 → 18 (única perda). +- **TRUE errado 27 → 5:** a correção "KLEE parado pelo timer não é prova" confirmada em + escala — a v15 respondia TRUE em 27 de 212 tarefas com bug. +- **Slice × controle:** 126 × 129 (pares discordantes 3 × 6) — empate técnico, leve + desvantagem. TRUE errado 4 × 5: o slice elimina 2 (`pals_lcr…`) e introduz 2 + (`float-benchs/cast_union_tight.c`, `loops/insertion_sort-1-2.c`); 4 ERROR (ECA, + ~330 s, sem suíte) só no slice. +- **Em aberto:** os 4–5 TRUE errados restantes (`seq-mthreaded/pals_*`, + `float-benchs/sin_interpolated_index-1.c`, e os 2 do slice) e os 4 ERROR do slice. + +### R15 — Cover-Branches, controle × v15 (mesma rodada) + +- 120 tarefas (10 por categoria), todas pareadas com a v15; só o braço controle (o + slicing não atua em Cover-Branches). +- **Cobertura média: v15 48,0% × R15 47,7%** — neutra. Melhor em 6 tarefas, pior em 3, + igual em 111. Recursive 51,9 → 45,0% (a única queda relevante); XCSP 74,2 → 77,7%. +- Validação do TestCov mais limpa: VALIDATED 116 (v15: 107), VALIDATED_ABORTS 3 (v15: 10), + TESTCOV_ERROR 1 (v15: 3). Tempo mediano 183 × 195 s. +- **Leitura:** o AFL++ não muda a cobertura de ramos nesta amostra; o ganho da tacasv2 + está no Cover-Error. + +## R18 — validação da correção do abort() nos TRUE errados da R15 (2026-09-29) + +- **Config:** `build_abort` (commit 1eb8a30b9), 300 s, as tarefas com TRUE errado da R15: + 6 no braço controle (sem slice), 2 no braço slice (`--slice`). Manifests + `tacas-results/r18-{ctrl,slice}.tsv`. + +| tarefa | braço | R15 | R18 | +|---|---|---|---| +| pals_lcr.4.1 | controle | TRUE errado | FAILED/COVERED (83 s) | +| pals_lcr-var-start-time.4.2 | controle | TRUE errado | FAILED/COVERED (175 s) | +| pals_STARTPALS_Triplicated.1 | controle | TRUE errado | FAILED/COVERED (9 s) | +| pals_floodmax.3.1 | controle | TRUE errado (R16) | FAILED/COVERED (24 s) | +| pals_floodmax.3.4 | controle | TRUE errado | UNKNOWN (256 s) | +| sin_interpolated_index-1 | controle | TRUE errado | **TRUE errado** (59 s) | +| cast_union_tight | slice | TRUE errado | FAILED/COVERED (1 s) | +| insertion_sort-1-2 | slice | TRUE errado | **TRUE errado** (3 s) | + +- **Leitura:** 6 de 8 TRUE errados eliminados (5 viraram FAILED coberto, 1 UNKNOWN). + `cast_union_tight` também era abort inline, não defeito do slice. Restam 2 com causa + diferente: `sin_interpolated_index-1` (controle) e `insertion_sort-1-2` (slice) — investigar. + +### R18 — causa dos 2 TRUE errados restantes (2026-09-29) + +Reproduzidos à mão (`build_abort`, 300 s). **Causa comum:** o KLEE sai com 0 quando a fila +esvazia, e o frontend lia isso como exploração completa — mas nos dois casos ele tinha +**descartado caminhos**: + +- `sin_interpolated_index-1` (controle): `silently concretizing (reason: floating point) + expression (ReadLSB w64 0 non_det_double) to value 0` — o KLEE 3.1 não tem double + simbólico; 1 caminho, "completo", TRUE. +- `insertion_sort-1-2` (slice): o VLA `int v[SIZE]` gerou `concretized symbolic size` e + `null page access` — 2 estados mortos por erros do próprio KLEE (`partially completed + paths = 2` no `info`), TRUE. + +**Correção:** `kleeDroppedPaths()` generaliza o `kleeHaltedOnTimer`: HaltTimer, qualquer +"silently concretizing" em `warnings.txt`, ou `partially completed paths > 0` → a execução +é tratada como timeout (violação registrada vale; senão UNKNOWN). Revalidação: `sin` → **FAILED** numa execução e UNKNOWN noutra (o AFL++ da fase 1 acha ou +não o 180.0; sem `--seed-exchange` não há fase 3 — a frase anterior dizia o contrário e +estava errada), `insertion_sort` --slice → **UNKNOWN**. Nunca TRUE. Integração 40/40 (§30 nova: double concretizado; vermelha no +`build_seeds`, verde no novo). Uma §31 (abort dentro do `assert` da libc) foi descartada: +passava também no binário antigo — esse caminho não gera TRUE errado. + +**Custo esperado:** programas com float/VLA que o KLEE "provava" passam a UNKNOWN. Medir +TRUE corretos no SV-COMP (R17) — é o preço da solidez. + +## R16 — `--seed-exchange` (3a) × controle R15, Cover-Error (2026-09-29) + +- **Config:** `build_seeds` (3a + revisão, **sem** as correções do abort e dos caminhos + descartados — mesma base de veredito que o controle R15), `--seed-exchange`, amostra + `r15-ce.tsv` (213, todas pareadas), 300 s, 3 shards. + +| braço | cobertas | TRUE errado | ERROR | tempo mediano | +|---|---|---|---|---| +| R15 controle | 129 | 5 | 0 | 5 s | +| **R16 seeds** | **148** | 7 | 0 | 6 s | + +- **+19 cobertas (+15%)**, pares discordantes **21 × 2**. Por categoria (controle → seeds): + Sequentialized 2 → 8, XCSP 7 → 13, ECA 5 → 8, Recursive 7 → 9, ControlFlow 3 → 4, + BitVectors 7 → 8; as demais iguais. Perdas: 2 ECA (`Problem13_label54`, + `Problem10_label12`). +- **TRUE errado 7:** todos da família `pals_*` (abort inline) e `sin_interpolated_index-1` + (double concretizado) — os dois defeitos que esta branch já corrige (1eb8a30b9, + 4c16013bc). O braço seeds expõe mais deles porque a fase 3 do AFL++ não roda depois de + uma "prova" do KLEE. +- **Leitura:** a troca de sementes é o maior ganho medido na linha TACAS até aqui. A + rodada limpa (R19, build final nos dois braços) confirma sem os TRUE errados. +- Cover-Branches do R16 ainda rodando. + +### Correção da correção — poda por assunção não é caminho descartado (2026-09-29) + +A primeira versão do `kleeDroppedPaths` lia `partially completed paths > 0` no `info`. Esse +contador inclui os caminhos **podados por assunção**: `klee_assume(0)` num caminho já falso +é um erro do KLEE (`user.err`, "invalid klee_assume call (provably false)"), e até +`klee_silent_exit` conta como parcial (medido num programa mínimo: os dois dão +`partially completed paths = 1`). Resultado: **nenhum programa com `assume_abort_if_not` +ou abort inline podia mais ser provado** — o §29 `safe.c` ia de TRUE para UNKNOWN. + +Correção: `nondet_assume` (KLEE) poda com `klee_silent_exit(0)`, que não deixa arquivo; e +os caminhos descartados passam a ser lidos pelo que cada estado morto deixa no disco — +qualquer `*.err` ou `*.early` —, além do HaltTimer e do "silently concretizing". O §29 +agora exige TRUE. `sin` e `insertion_sort` seguem sem TRUE errado (UNKNOWN; o segundo por +`ptr.err`). + +**Efeito na R19:** o `install_r19` tem a versão com o contador. Em Test-Comp isso não muda +a cobertura (o veredito não pontua), só impede o `provedSafe` de encerrar a execução mais +cedo em programas com assunções. A R17 (SV-COMP, onde TRUE pontua) precisa do build +corrigido. + +### R16 — Cover-Branches, `--seed-exchange` × controle R15 (2026-09-29) + +- Mesma config da R16 Cover-Error (`build_seeds`), amostra `r15-cb.tsv` (120, pareadas). +- **Cobertura média: controle 47,7% × seeds 49,7%** (+2,0 p.p.); melhor em 26 tarefas, pior + em 9. Tempo mediano 195 → 160 s. +- Por categoria (controle → seeds): ControlFlow 41,3 → 57,9, BitVectors 65,7 → 73,7, + Recursive 45,0 → 53,0; **Loops 67,1 → 60,8** (uma tarefa: `geo2-ll_unwindbound50` + −62,5 p.p.), XCSP 77,7 → 75,0 (`AllInterval-011` −27 p.p.). +- TestCov: VALIDATED 118 (R15: 116), VALIDATED_ABORTS 1 (3). +- **Leitura:** diferente da tacasv2 (neutra em CB), a troca de sementes melhora a cobertura + de ramos, apesar de a suíte de CB sair só do KLEE — o KLEE semeado explora ramos que o + controle não alcançava. As duas quedas grandes ficam para a R19 confirmar (ruído do + fuzzer × efeito real). + +## R17 — SV-COMP MemSafety/MemCleanup/NoOverflows, control × seeds × alternate (2026-09-29) + +- **Config:** `install_r19` (commit 8c70e5a73), manifests regenerados com `build_corpus.py` + (memsafety 10/categoria = 50, memcleanup 10, overflow 10/categoria = 20), 120 s. + +| memsafety (50) | correct-true | correct-false | wrong-true | wrong-false | unknown | error | +|---|---|---|---|---|---|---| +| control | 10 | 19 | 2 | 3 | 10 | 6 | +| seeds | 10 | 20 | 1 | 3 | 10 | 6 | +| alternate | 9 | 20 | 1 | 3 | 10 | 7 | + +- MemCleanup (10): control 6 corretos, seeds 6, alternate 6. NoOverflows (20): control e + seeds 2 correct-true + 17 unknown; alternate idem (2 + 17 + 1 error) — os três iguais. +- **wrong-true comum aos três:** `CWE121…CWE193_char_declare_cpy_07_bad`. Causa: o modelo + `ldv_strcpy` copia `strlen` bytes (sem o terminador) e o estouro real é a **leitura** em + `printf("%s")` — que o KLEE executa como **chamada externa** (a uClibc do KLEE declara + `printf` sem defini-lo: `calling external: printf(...)`), fora de qualquer checagem, e o + memtrack não confere argumentos `%s`. Lacuna de solidez pré-existente; correção em + aberto: checar a string de cada `%s` (e `puts`/`str*`) antes da chamada. +- **wrong-true só no control:** `CWE122…CWE129_rand_18_bad` — os braços com sementes o + acham (FALSE correto). +- **Os 6 `error` são do classificador, não da ferramenta:** as tarefas + `array-memsafety/*-alloca` têm `alloca` de tamanho não determinístico; o AFL++ acha um + crash (pilha estourada), o replay imprime "Segmentation fault", e + `verdict_classifier.sh` conta isso como falha — embora o Map2Check termine com UNKNOWN + (o KLEE concretiza o tamanho → `model.err` → caminho descartado). +- **Leitura:** as sementes não pioram nada em SV-COMP e ganham 1 FALSE e eliminam 1 TRUE + errado; a alternância perde 1 TRUE correto frente ao control (a estagnação corta o KLEE + — o preço previsto na revisão). + +## R19 — Test-Comp, parcial (2026-09-29) + +- **Cover-Error, 171 tarefas pareadas nos 4 braços principais** (o shard 0 do braço seeds + perdeu 42 tarefas por um incidente de escrita e está sendo completado): + +| braço | cobertas | TRUE errado | ERROR | tempo mediano | +|---|---|---|---|---| +| R15 control (referência) | 101 | 5 | 0 | 6 s | +| control | 101 | **0** | 0 | 3 s | +| **seeds** | **120** | 0 | 0 | 5 s | +| alternate | 118 | 0 | 0 | 14 s | +| slice | 102 | 0 | 2 | 4 s | + +- seeds × control: **+20 −1**; alternate × control: +17 −0; alternate × seeds: +4 −6; + slice × control: +3 −2. +- **TRUE errado zerado em todos os braços** (eram 5 no control R15): as correções do abort e + dos caminhos descartados confirmadas em escala. +- Braços slice-light/o2/ntscd/ptafs e Cover-Branches ainda rodando. + +### R19 — diagnóstico das perdas de `--alternate-engines` (2026-09-29) + +Contra o braço seeds, a alternância perde 6 e ganha 2; 5 das perdas são eca-*. Reproduzido +em `eca-rers2012/Problem06_label05.c` (300 s): + +- **A troca KLEE → AFL++ estava limitada** aos 64 vetores mais recentes do KLEE. No braço + seeds, a fase 3 do AFL++ recebe todos (4676), e o dry run dela encontra vetores que, + completados com zeros depois do fim, chegam ao `reach_error` (`sig:06`, crashes com + `op:dry_run`). É isso que cobre essas tarefas eca-* que o KLEE sozinho deixa UNKNOWN. + O limite descartava justamente esses vetores. Ele tinha vindo de um laço cuja calibração + nunca terminava, problema já resolvido com a leitura de zeros. +- **Cada fase do AFL++ recompilava os 3 binários:** ~24 s por fase em eca-*. +- **A estagnação fixa de 15 s cortava o AFL++ em ~17 s**, onde o híbrido fixo dava 60 s. + +**Correção** (`fix(hybrid): the fuzzer gets all of KLEE's vectors, built once, with growing +patience`): sem limite na troca, cache dos binários por execução (`.build/`, também +beneficia a fase 3 do braço seeds) e paciência do AFL++ dobrando por rodada. +`Problem06_label05`: UNKNOWN → **FAILED em 157 s** (seeds: 281 s). Remedição na R23. + +## R19 — resultado (2026-09-29) + +**Cover-Error, 213 tarefas** (linhas filtradas pelo shard; os shards afetados pelo incidente +do descritor 3 foram completados com `-resume`): + +| braço | cobertas | % | TRUE errado | ERROR | vs control | tempo mediano | +|---|---|---|---|---|---|---| +| control | 128 | 60,1 | 0 | 0 | — | 3 s | +| **seeds** | **151** | **70,9** | 0 | 0 | **+23 −0** | 5 s | +| alternate | 148 | 69,5 | 0 | 0 | +20 −0 | 9 s | +| slice | 128 | 60,1 | 0 | 4 | +3 −3 | 4 s | +| slice-light | 127 | 59,6 | 0 | 4 | +3 −4 | 4 s | +| slice-o2 (207) | 128 | 61,8 | 0 | 4 | +5 −3 | 4 s | +| slice-ntscd (181, parcial) | 113 | 62,4 | 0 | 4 | +2 −1 | 5 s | +| slice-ptafs (155, parcial) | 90 | 58,1 | 0 | 4 | +1 −3 | 5 s | + +- **TRUE errado 0 em todos os braços** (R15 control: 5). As correções de veredito se + confirmam em escala. +- **Sementes: +23 −0** contra o control, o melhor resultado da linha TACAS. Alternância: + +20 −0. As 5 perdas eca-* dela frente ao seeds têm causa achada e corrigida (ver o + diagnóstico acima); a remedição fica para a R23. +- **Slicing:** as variantes não mudam o quadro (±3). Nenhuma supera o slice simples com + margem, e nenhum knob é promovido por enquanto. Os 4 ERROR de ECA continuam: o cache do + 2d eliminou o refatiamento, mas o passo do slice ainda levava 105 s (regex sobre o IR, + ~45 s fora de qualquer orçamento) e as 3 compilações do AFL++ somavam até 0,75T. + Correções: varredura sem regex e um orçamento único para as compilações. + `Problem102_label34` com `--slice`: ERROR → UNKNOWN em 307 s. + +**Cover-Branches, 120 tarefas:** + +| braço | cobertura média | melhor / pior que o control | +|---|---|---| +| control | 44,7% | — | +| seeds | 46,1% | 31 / 13 | +| **alternate** | **50,3%** (119) | **43 / 5** | + +- **A alternância é o melhor braço em Cover-Branches** (+5,6 p.p.), o que se explica pelas + várias fases do KLEE, cada uma alimentada pelo corpus do fuzzer. O control da R19 (44,7%) + ficou abaixo do da R15 (47,7%) na mesma amostra. A carga da máquina foi maior (11 + contêineres e falta de memória no fim), e isso pesa em Cover-Branches, que usa o + orçamento inteiro. + +## R21 — checagem de `%s` e correção do classificador, SV-COMP (2026-09-29) + +- `install_r21`, control, contra a R17 control. + - **MemSafety:** o CWE193 cpy bad foi de TRUE errado para **FALSE correto**. Os 6 + `error` das tarefas alloca viraram `unknown` (classificador corrigido). + - **Falso positivo novo:** `CWE121…dest_char_declare_cpy_01_good` foi de TRUE correto + para FALSE-DEREF errado. O `ldv_strcpy` do SV-COMP copia `strlen` bytes sem o + terminador, e o terminador do buffer da versão good é um byte **não inicializado**: + para o gabarito do SV-COMP ele é zero; numa execução nativa ou no KLEE (que preenche + `alloca` com um padrão diferente de zero) não é. + - **MemCleanup:** os 2 `error` viraram `unknown`. +- **Decisão:** a checagem de `%s` fica atrás de `MAP2CHECK_CHECK_CSTRINGS=1`, desligada + por padrão, até ser medida numa amostra maior do Juliet (1 acerto × 1 erro em 50 não + basta; pelos pesos do SV-COMP compensaria, mas não com essa amostra). +- **Incidente de harness (descritor 3):** o laço do harness lê o manifest pelo fd 3, e os + filhos o herdavam, inclusive o programa analisado via chamadas externas do KLEE. O offset + andou sob o laço: o shard 0 da R24 parou em 29 de 71, e o shard 0 do seeds da R19 recebeu + linhas do shard 1. Os filhos agora rodam com o fd 3 fechado. + +## INV-1 — `--add-invariants`: crab-llvm antigo × Clam (2026-09-30) + +**Pergunta:** o `--add-invariants` do crab-llvm "funcionava", e o do Clam "não é a mesma +coisa"? + +**O que se descobriu sobre o motor antigo** (release v7.3.1 do SV-COMP 2020, que roda em +`python:2.7-slim` com o clang do LLVM 6 embutido): +- Houve **duas configurações**. + - Até 18/10/2018: `--crab-track=arr --crab-add-invariants=after-load`. Os invariantes + saíam como `verifier.assume`, o NonDetPass os mapeava para `map2check_crab_assume`, e + eles chegavam ao KLEE como `klee_assume`. + - A partir da v7.3 (SV-COMP 2019 e 2020): `--crab-track=num + --crab-add-invariants=block-entry --crab-promote-assume`. O `promote` emite + `llvm.assume`, que o NonDetPass não mapeia e que o KLEE ignora (testado no KLEE 2.1 do + release e no 3.1, com e sem `--optimize`). **Os invariantes das versões de competição + não chegavam a lugar nenhum.** + +**Geração, 90 programas** (40 de alcançabilidade da amostra Cover-Error e 50 de MemSafety), +timeout de 60 s: + +| config | rodou | com invariante | total | +|---|---|---|---| +| OLD-A (antigo, até 2018) | 76 | 14 | 155 | +| OLD-B (antigo, v7.3; `llvm.assume`, inerte) | 35 | 33 | 224 698 | +| NEW-cur (Clam, `num` + `block-entry`) | 79 | 68 | 72 452 | +| NEW-A (Clam, `mem` + `after-load`) | 70 | 19 | 702 | + +- A configuração que "funcionava" insere **poucos** invariantes, depois de leituras de + memória. A atual do Clam insere **muitos**, na entrada de cada bloco. O perfil + `memory` do Clam reproduz a ordem de grandeza da antiga. + +**Efeito na análise, sonda num laço** (`n ≤ 1000`, versões segura e com bug em `n == 777`, +symex, 60 s): + +| braço | seguro | com bug | +|---|---|---| +| sem `--add-invariants` | UNKNOWN (HaltTimer) | UNKNOWN | +| Clam padrão (18 invariantes) | UNKNOWN | UNKNOWN | +| Clam `memory` (0 invariantes) | **TRUE** | **FAILED** | +| Clam `none` (pipeline do Clam, 0 invariantes) | **TRUE** | **FAILED** | +| **sem Clam, `MAP2CHECK_PREOPT=ssa`** | **TRUE** | **FAILED** | + +- **O ganho vem do pré-processamento, não dos invariantes.** O Clam compila com + `-disable-O0-optnone` e deixa o módulo em SSA (`mem2reg`, `simplifycfg`). O Map2Check + compila em `-O0` com `optnone`, cada variável local vira um objeto de memória no KLEE, e + o laço não fecha no orçamento. +- Os 18 invariantes do perfil padrão não bastaram: o KLEE completou mais caminhos com eles + (261 contra 184 sem), mas também parou no HaltTimer. +- **Hipótese a medir em escala (R25):** `MAP2CHECK_PREOPT=ssa` (sem Clam) é um ganho + geral, e os invariantes só se pagam somados ao SSA, se se pagarem. +- Implementado nesta frente (`feat/tacas-invariants`): + - `MAP2CHECK_CLAM_PROFILE=default|memory|none`; + - log com a contagem de invariantes inseridos; + - recuo para a compilação normal quando o Clam falha (antes, o pipeline ficava sem + bitcode); + - `MAP2CHECK_PREOPT=ssa`. + +## R20, R22, R23, R24 — primeiros resultados (2026-09-30, madrugada) + +Todos contra o braço equivalente da R19, nas tarefas em comum (linhas filtradas por shard). + +| rodada | mudança medida | tarefas | cobertas (nova × R19) | +/− | TRUE errado | +|---|---|---|---|---|---| +| **R24 control** (completa) | replay dos vetores do KLEE, híbrido **sem** sementes | 213 | **146 × 128** | **+20 −2** | 0 | +| R24 seeds (parcial) | replay + sementes | 59 | 47 × 46 | +1 −0 | 0 | +| R20 seeds (parcial) | ranking `+cov` (3c) | 178 | 128 × 128 | +2 −2 | 0 | +| R23 seeds (parcial) | build final (cache do AFL++, orçamento, fd 3) | 177 | 132 × 128 | +5 −1 | 0 | + +- **O replay dos vetores do KLEE traz o híbrido simples para perto do braço com sementes** + (146 contra 151 da R19 seeds). As mudanças concentram-se em `pals_*`, eca-*, XCSP (`aim-*`, + `CostasArray`, `AllInterval`) e `fuzzle`, justamente as tarefas em que o seeds ganhava + com o dry run do AFL++. O mecanismo diagnosticado se confirma. +- **3c v1 (ranking):** neutro nesta amostra (+2 −2). O ranking só pesa quando a fila passa + de 64 entradas. +- **Cover-Branches, R22** (corpus do AFL++ na suíte, `MAP2CHECK_FUZZER_SUITE=1`): + - control, 99 tarefas: **49,2% × 44,8%**, 33 melhores e 2 piores; TestCov VALIDATED + 97/99; + - seeds, 22 tarefas: 48,5% × 44,8%, 4 melhores e 3 piores. + +## R21 CASTLE e dois incidentes (2026-09-30, madrugada) + +- **CASTLE com `install_r21`** (checagem de `%s` ainda **ligada** nesse build): TP 54, TN 44, + FN 12, UNKNOWN 5, **FP 4** (R14: TP 53, TN 44, FN 14, FP 1). Os 4 FP (787-1, 787-2, + 787-4, 822-3) são todos um `printf("%s")` de memória que o runtime não rastreia: buffer + preenchido por `scanf` e `argv[0]`. É uma confirmação independente de que + `MAP2CHECK_CHECK_CSTRINGS` deve continuar **desligado** (como está no branch da PR); os + FN caíram de 14 para 12. +- **Incidente do escalonador** (corrige uma conclusão anterior): os escalonadores leem os + jobs com `IFS=$'\t' read`, e o bash junta tabs consecutivos. Com a coluna de flags vazia, + o conteúdo da coluna de ambiente escorregava para a de flags. Com isso: + - o braço `ssa` da R25 passou `MAP2CHECK_PREOPT=ssa` ao Map2Check como **nome de + arquivo** (71/71 ERROR). Relançado com `-e`; + - **a primeira R22 control (120 ERROR) teve a mesma causa, e não falta de memória**, + como registrado antes. O relançamento dela usou `-e` e é válido; + - os outros braços têm flags não vazias ou nenhuma variável, e não foram afetados. + +### R20 e R23 seeds, completas (2026-09-30, 01h) + +| rodada | o que muda | cobertas (213) | vs R19 seeds (151) | vs R19 control (128) | TRUE errado | +|---|---|---|---|---|---| +| R20 seeds | + ranking `+cov` (3c v1) | 150 | +2 −3 | +22 | 0 | +| **R23 seeds** | build final (cache do AFL++, fd 3, hash, orçamento) | **154** | **+5 −2** | **+26** | 0 | + +- **3c v1 é neutro** também na amostra completa: fica disponível, sem ganho medido. +- **O build final com sementes é o melhor resultado de Cover-Error da linha: 154/213 + (72,3%)**, contra 111 da v15 na mesma amostra. +- As perdas recorrentes (`Problem10_label12`, `Problem13_label54`) aparecem também no + R20. São tarefas eca-* no limite do orçamento. + +## Madrugada de 2026-09-30 — R22, R23, R24 e R25 completas + +**Cover-Error, 213 tarefas** (referência: R19 control, 128): + +| braço | cobertas | % | vs R19 control | TRUE errado | tempo mediano | +|---|---|---|---|---|---| +| R24 control (replay dos vetores do KLEE) | 146 | 68,5 | +20 −2 | 0 | 4 s | +| R23 seeds (build final) | 154 | 72,3 | +26 −0 | 0 | 4 s | +| **R24 seeds (build final + replay)** | **155** | **72,8** | **+27 −0** | 0 | 5 s | +| R23 alternate (build final) | 153 | 71,8 | +26 −1 | 0 | 12 s | + +- R23 alternate × R19 alternate: +7 −2. A correção das perdas eca-* funcionou. + R23 alternate × R23 seeds: +4 −5, um empate. +- **v15 → build final na mesma amostra: 111 → 155 cobertas, TRUE errado 27 → 0.** + +**Cover-Branches, 120 tarefas** (R19 control 44,7%): + +| braço | cobertura média | melhor / pior | +|---|---|---| +| R19 seeds | 46,1% | 31 / 13 | +| **R19 alternate** | **50,6%** | 44 / 5 | +| R22 control + corpus do AFL++ | 49,7% | 40 / 3 | +| R22 seeds + corpus do AFL++ | 49,4% | 36 / 8 | + +**R25 (`--add-invariants` e SSA), shard 0 de Cover-Error (71 tarefas) e MemSafety (50):** + +| braço | Cover-Error cobertas | ERROR | MemSafety (corretas / wrong-true / wrong-false) | +|---|---|---|---| +| off | 51 | 0 | 28 / 2 / 2 | +| ssa | 50 (+2 −3) | 0 | — | +| clam-none | 50 (+1 −2) | 2 | 25 / 1 / 4 | +| clam-default | 49 (+1 −3) | 4 | 27 / 1 / 4 | +| clam-memory | 44 (+2 −9) | 7 | 25 / 2 / 4 | + +- **No híbrido, nem o SSA nem os invariantes ajudam.** O ganho que a sonda viu era do KLEE + sozinho; no híbrido, o AFL++ e o replay dos vetores já decidem essas tarefas. Os braços + com Clam **pioram**: mais FALSE errados em MemSafety (4 contra 2), e ERROR por o Clam + estourar o orçamento, já corrigido com um limite de 0,2T. +- **Decisão:** `--add-invariants` continua opcional e desligado por padrão; o SSA não é + promovido. +- **Incidente:** a mudança de versão no `CMakeLists.txt` fez o cache do `build_inv` ser + regenerado, com o prefixo voltando para `release/` e o `ENABLE_CLAM` para OFF. O + `release/` foi sobrescrito de novo e restaurado a partir do `install_v15` (idêntico, + conferido com `diff`). As rodadas usaram installs congelados antes disso. + +## R26 completa (2026-09-30) e primeiros lotes da campanha da 9.0 + +**R26, SV-COMP (120 s):** a alternância **não perde nenhum TRUE correto**. + +| | control (fixo) | seeds | alternate | +|---|---|---|---| +| MemSafety (50): correct-true / correct-false | 10 / 19 | 10 / 20 | **10 / 20** | +| MemSafety: wrong-true / wrong-false | 2 / 3 | 1 / 3 | **1 / 3** | +| MemCleanup (10): corretos | 6 | 6 | 6 | +| NoOverflows (20): corretos | 2 | 2 | 2 | + +As sementes e a alternância corrigem o TRUE errado do `CWE122…rand_18`. O seeds teve 1 +ERROR (`tricky_address2`). + +**CASTLE:** R26 e a campanha da 9.0 dão TP 54, TN 44, FN 14, FP 1, **igual à v15**; os 4 +TIMEOUT da v15 viraram UNKNOWN. + +**Campanha da 9.0, parcial** (`install_v9` = `3476ff769`; condições da v15: 4 GB, 300 s): + +| corpus | pareado com a v15 | v15 | 9.0 | +|---|---|---|---| +| Cover-Error (q400) | 532 de 1087 | 288 cobertas, **57 TRUE errados** | **394 cobertas (+112 −6), 0 TRUE errado**; mediana 59 → 19 s | +| Juliet, grupos a e b | 2 271 | TP 340, FN 118, FP 20, TN 1074, ERROR 114 | **TP 776**, FN 90, FP 20, TN 1058, ERROR 0 | + +- Juliet: 294 UNKNOWN e 102 ERROR da v15 viraram TP; 16 TN viraram UNKNOWN. + +## Campanha da 9.0: dois defeitos achados no Juliet c, e a troca de build (2026-10-02) + +- **Achado:** o grupo c do Juliet (CWE190 e 191, overflow) teve **55 ERROR** que a v15 não + tinha, e 207 das 272 paradas por estagnação terminaram em SIGKILL. + 1. **Link do fuzzer sem `-lm`.** Um programa com `sqrt` ou `pow` não linkava ("undefined + reference to `sqrt`"), perdia a fase do AFL++ e o harness contava ERROR. + 2. **KLEE preso numa chamada externa nativa.** As variantes `fscanf` passam um `FILE*` + da uClibc ao `__isoc99_fscanf` nativo. Preso ali, o KLEE não olha o sinal de + interrupção nem o próprio `--max-time`, e só saía no SIGKILL do fim da janela, + desperdiçando o resto dela. Testado à parte: o KLEE isolado responde ao SIGINT + normalmente; nesse módulo não reage nem em 60 s. +- **Correção** (`76eedfc75`): os links nativos levam `-lm`; um KLEE que não para em 10 s + depois do SIGINT é morto e o tempo vai para a próxima fase. No caso reproduzido: + 5 fases em vez de 4 no mesmo orçamento e o fuzzer linkando. +- **Troca de build na campanha** (decisão do usuário: corrigir, refazer o que deu erro e + seguir com a versão corrigida como a 9.0): + - `install_v9` passa a ser o build de `76eedfc75`; o anterior fica em + `install_v9-3476ff7`; + - **refeitos com o build novo:** o grupo c inteiro do Juliet, as 2 tarefas de + Cover-Error que chamam a libm (`loop-floats-scientific-comp/loop2-1.c` e `loop4.i`) e o + Cover-Branches (que mal tinha começado); + - **mantidos do build anterior:** CASTLE, Cover-Error (exceto essas 2) e os grupos a, b e + d do Juliet, sem erro de libm. Os dois defeitos não mudam veredito; o segundo só + devolvia tempo nas paradas por estagnação. +- **Fora da campanha:** o `--debug` dá segfault com a alternância (no fim da execução). + Só afeta a depuração e ficou registrado para corrigir. + +## Campanha da 9.0 — Cover-Error, CASTLE e Juliet a, b, d completos (2026-10-02, 23h) + +**Cover-Error, 1 087 tarefas** (recorte da v15, pareado): + +| | v15 | 9.0 | +|---|---|---| +| cobertas | 470 | **722 (+265 −13, +54%)** | +| TRUE errado | **175** | **0** | +| ERROR | 9 | 0 | +| tempo mediano | 176 s | 72 s | + +- Por categoria (v15 → 9.0): ECA 58 → 146, ProductLines 111 → 169, Sequentialized + 9 → 78, XCSP 22 → 38, Arrays 84 → 92, Loops 102 → 109; nenhuma categoria cai. + +**Juliet** (pareado; a, b e d completos, c refeito com o build corrigido e em curso): + +| grupo | TP (v15 → 9.0) | FN | FP | TN | ERROR | +|---|---|---|---|---|---| +| a (2 320) | 214 → **611** | 127 → 100 | 0 → 0 | 1 140 → 1 131 | 269 → 0 | +| b (1 600) | 216 → **473** | 202 → 170 | 30 → 30 | 729 → 722 | 111 → 0 | +| d (960) | 364 → 364 | 116 → 114 | 80 → 80 | 380 → 369 | 0 → 0 | + +- O grupo d não ganhou TP, perdeu 11 TN para UNKNOWN e teve mais UNKNOWN + TIMEOUT + (20 → 33). É a única queda; investigar quando a campanha fechar. + +**CASTLE:** igual à v15 (TP 54, FN 14, FP 1). + +**Cover-Branches, parcial (111 de 2 765):** 48,3% contra 42,1% da v15, 47 melhores e 19 +piores. TestCov: VALIDATED 84, VALIDATED_ABORTS 23, TESTCOV_ERROR 4 (v15: 93, 15 e 3). O +aumento de VALIDATED_ABORTS vem dos casos do corpus do fuzzer que violam uma assunção +(o teste termina num `abort()`). A suíte continua válida e a cobertura conta. + +## Campanha da 9.0 — Cover-Branches completo (2026-10-05) + +O shard 4 fechou às 4h48 e, com ele, a campanha inteira. O build é o `76eedfc75` +(`install_v9`) e as condições são as da v15: 300 s por tarefa, `--memory=4g`, TestCov +com 300 s. + +**Cover-Branches, 2 765 tarefas** (recorte da v15, pareado): + +| | v15 | 9.0 | +|---|---|---| +| cobertura média | 41,4% | **45,1% (+3,7 p.p.)** | +| cobertura mediana | 38,5% | **47,6%** | +| melhores / piores / iguais | — | 932 / 381 / 1 452 | +| VALIDATED / VALIDATED_ABORTS | 2 325 / 329 | 2 416 / 209 | +| TESTCOV_ERROR | 110 | 140 (139 ECA) | +| tempo mediano | 114 s | 274 s | + +- **Por categoria** (cobertura média, v15 → 9.0): + - Arrays: 60,7 → 76,2; + - BitVectors: 60,6 → 70,0; + - ControlFlow: 44,9 → 53,1; + - Recursive: 57,8 → 65,3; + - Heap: 40,6 → 47,3; + - Loops: 70,5 → 73,8; + - LinkedLists: 75,8 → 78,5; + - Sequentialized: 56,0 → 58,7; + - Floats: 5,4 → 6,7; + - ProductLines: 20,3 → 20,7; + - ECA: 10,5 → 10,6. + - **A única queda é o XCSP: 77,6 → 54,6.** +- **Tarefas com zero testes.** 50 tarefas (43 XCSP, 7 Floats) geram testes na v15 e + nenhum na 9.0. Elas somam 1,6 p.p. da média geral; sem elas, a comparação fica em + 40,5% → 45,9%. + - A causa é a poda de assunção com `klee_silent_exit` (ver o backlog). + - Na direção contrária, 51 tarefas sem teste na v15 passam a ter testes na 9.0. +- **TESTCOV_ERROR.** Dos 140, 109 já davam erro na v15. Quase todos são do ECA: o + TestCov passa do limite de 300 s do harness. Falta revalidar com um limite maior. +- **Tempo.** A 9.0 gasta o orçamento inteiro, porque a alternância só para por + estagnação e a suíte continua crescendo. Na v15 o híbrido fixo terminava antes. +- O campo de veredito (SUCCEEDED 1 655 → 296) não pesa em Cover-Branches. Só a cobertura + validada pelo TestCov conta. + +## Correção dos caminhos podados pelo assume, e rerrodada (2026-10-05/06) + +- **Defeito:** sob o KLEE, o `nondet_assume` podava com `klee_silent_exit`, que não grava + `.ktest`. Na campanha da 9.0, 50 tarefas de Cover-Branches (43 XCSP, 7 Floats) tinham + testes na v15 e nenhum na 9.0. +- **Correção 1** (`e4e0b74c7`): a poda passa a usar `_exit(0)`. O caminho termina + normalmente e o KLEE grava o teste. +- **Correção 2** (`6848d2395`): o caminho podado leva um objeto marcador + (`map2check_pruned`). + - O leitor remove o marcador e põe esses vetores depois dos outros. + - A suíte marca o caso com um comentário XML e o troca por um caminho mais profundo + quando atinge o limite de 50, inclusive em fases seguintes. + - Motivo: só com a correção 1, a primeira fase do KLEE no AllInterval achava apenas + caminhos podados e enchia a suíte. A cobertura caía de 95% para 9%. +- **Rerrodada** (300 s por tarefa, mesmas condições), com a cobertura média em %: + +| lote | tarefas | v15 | 9.0 | só a correção 1 | correções 1 e 2 | +|---|---|---|---|---|---| +| tarefas sem teste na 9.0 | 50 | 88,8 | 0,0 | 88,8 | **88,8** | +| XCSP que já tinham testes | 76 | 64,9 | 85,5 | 78,5 | **94,7** (+20 −6 contra a 9.0) | +| controle sorteado | 100 | 46,9 | 54,4 | 55,9 | **55,0** (+19 −7) | +| Cover-Error sorteado | 100 | — | 63 cobertas | 66 | **63** (+3 −3, ECA), TRUE errado 0 | + +- **Projeção no Cover-Branches completo** (as 226 tarefas trocadas pelas da rerrodada): + - média: v15 41,4% → 9.0 45,1% → **47,0%**; + - XCSP: 77,6% → 54,6% → **96,6%**. +- **Ainda abaixo da 9.0 original:** AllInterval-035 (38,6 → 2,9), -025 e -017. As oscilações + de mais e de menos no controle e no Cover-Error ficam dentro da variação entre + execuções vista nas rodadas anteriores. + +## Ambiente oficial da Test-Comp e revalidação das suítes ECA (2026-10-06/07) + +- **Motivo:** o teto de 50 casos por suíte (`kMaxBranchTestCases`) foi calibrado no **nosso** + ambiente (TestCov 3.7, 300 s, sem BenchExec). A competição não limita o tamanho da suíte, + então os testes precisam rodar como ela roda. +- **Ambiente construído:** branch `feat/testcomp-official-env`. Imagem oficial (Ubuntu + 24.04, digest fixo) + BenchExec 3.34 + TestCov 3.11.post3 + TestCoCa, as cinco definições + oficiais de validação e um `map2check.xml` (não oficial) para gerar. Pontuação como a + competição funde: Cover-Branches = melhor cobertura entre os validadores; Cover-Error = + um TRUE basta. Detalhes em `docs/reports/2026-10-06-ambiente-testcomp-oficial.md`. +- **Verificação (smoke2, 3 tarefas):** os cinco validadores **concordam**. `s52iff_overflow` + 81,25%; `AllInterval-011` 90,91% (gcc) / 86,36% (clang); `Problem10_label28` 37,81%. Uma + suíte ECA de 50 casos validou em ~40 s no TestCov 3.11, contra o estouro de 300 s do 3.7. +- **Achado e correção (2026-10-07).** Ao revalidar as **140 suítes** de Cover-Branches que + deram `TESTCOV_ERROR` (TestCov 3.7, 300 s) na campanha da 9.0, todas saíram `MISSING`. + Causa: `testcomp.py:stage_tasks()` não copiava os arquivos de propriedade **locais da + tarefa**; o `eca-rers2018/Problem14.yml` referencia ~100 `properties/unreach-call-*.prp` + relativos à tarefa, e o BenchExec **aborta o task set inteiro** quando um não resolve. + Correção `44d2160ab`; com ela, `Problem14` valida (`done`, ~2,4% nos cinco validadores). +- **Ressalva da rodada completa:** o host de 25 GB ficou **sob swap** (`7 GB × 3 threads`) e + o BenchExec avisou `System has swapped during benchmarking. Benchmark results are + unreliable!`; as variantes `formatted` saíram quase todas `TIMEOUT`. Os números do tcerr + desta rodada **não** são conclusivos — repetir com `--numOfThreads 1`–`2`. +- **Leitura:** o ambiente oficial funciona ponta a ponta. Falta (1) recalibrar o teto de 50 + com o validador oficial e (2) implementar a seleção da suíte por cobertura. O CI que + reproduz este ambiente ficou **adiado** (custo ~20–35 min/run; ver o handoff de 07/10). + +## Issue #74 — tipos nondet não modelados (2026-10-12) + +- **Correção:** `05a157371` (branch `feat/nondet-missing-types`, sobre `feat/testcomp-official-env`). + O `NonDetPass` passa a modelar `float`, `longlong`, `ulonglong`, `u8/u16/u32` e + `__VERIFIER_nondet_memory(p, n)`. Cada tipo tem gerador KLEE e AFL++ da largura certa, + linha de log com o valor inteiro (64 bits e float não passam mais pelo logger de `int`) e + nome decodificado pelo leitor de ktest; float sai em `%.9g` (ida e volta exata). + `nondet_memory` segue o harness dos validadores: **n entradas `uchar`, uma por byte** + (o KLEE cria um objeto de n bytes, o leitor o expande). `_Bool`, `charp` e `uint128` + continuam fora: o harness oficial não tem os dois primeiros e o corpus não usa nenhum. +- **Build:** `install_v99b` (`build_v99b`, prefixo próprio; o `install_v99` da campanha + ficou intocado). 12/12 testes unitários; 8 testes novos (decodificação, expansão de + memória, log → semente). +- **Integração (programas sintéticos, 120 s):** ulonglong, longlong, u8/u16/u32, memory e + float — `install_v99` 5× `UNKNOWN`; `install_v99b` 5× `FAILED` em 0–17 s, e as 5 suítes + dão `Result: TRUE` no TestCov 3.11 oficial. +- **Sonda em tarefas reais (300 s, `install_v99b`):** + - **Floats 5/5 `FAILED` em 1–6 s** (na v99: `UNKNOWN` em ~830 s cada) e **TRUE nos 3 + validadores oficiais** (gcc-unformatted, clang-unformatted, testcoca). Dados em + `tacas-results/V99b-probe74/`. + - **Intel-TDX 0/8.** O `failed external call` sumiu, mas não basta: cada execução lê + **~31 500 valores nondet** (os *havoc* de structs/arrays inteiros), o AFL++ roda a ~97 + exec/s e o KLEE executa 39 M instruções em 150 s sem completar **nenhum** caminho. + Além disso, 44/658 tarefas exigem `rcx == (uint64_t)`, que nenhum + vetor reproduz fora do alocador do KLEE. É um problema de escala, separado do #74. +- **Campanha V99:** as 256 Intel-TDX que faltavam no CE foram marcadas `SKIPPED` (todas + chamam um nondet não modelado → `UNKNOWN` por construção no `install_v99`; já eram 0/399). + Backup dos CSVs em `results.csv.bak-before-tdx-skip`. Libera ~28 h de vaga para o CB. +- **Re-rodada `v99-b74-ce` (900 s/8 GB/4 núcleos, `install_v99b`):** as 33 + Floats, 12 Intel-TDX (amostra, semente 7499) e 15 tarefas `FAILED` de outras categorias como + guarda de regressão. Ocupa uma das 2 vagas do launcher. Resultados em + `tacas-results/V99b-ce-affected/`, suítes em `tacas-results/V99b-suites/`. +- **Resultado da re-rodada (concluída às 18h37):** + - **Floats: 11/33 → 33/33 `FAILED`.** As 22 recuperadas levavam ~810–865 s na v99 e + agora levam 0–92 s. + - **Guarda de regressão: 15/15 continuam `FAILED`.** + - **Intel-TDX: 0/12.** + - **Validação oficial:** 48/48 suítes `true` em cada um dos 3 validadores (score 48,0). + - Relatório completo em `docs/reports/2026-10-12-issue74-rerodada.md`. +- **Issue #75 — explosão de estados do KLEE ao gravar o log nondet.** + - **Sintético:** N leituras `int` e alvo no fim. N = 5 já dá 861 caminhos parciais e + 28 s; N = 10 dá `UNKNOWN`. + - **Causa:** 1 549 das 1 551 bifurcações estão em `nondet_log_to_file → vfprintf`, + porque o log grava valores ainda simbólicos. + - **Alcance:** é o que segura a Intel-TDX, e vale para qualquer tarefa com muitas + leituras nondet. + - **Hipótese descartada:** a B-tree em disco; o build liga o `ContainerRealloc`. + +## Issue #75 — correção do log nondet do KLEE, sondas e amostra (2026-10-12/13) + +- **Correção (`8da579488`, `b4bda9011`, na `feat/map2check-9.0`):** + - o log nondet é **concretizado** (`klee_get_value_i64` + `klee_assume`) antes de ser + gravado; + - o `fprintf` foi trocado por formatação manual (custava ~7 000 instruções KLEE por + chamada); + - o `ContainerRealloc` cresce geometricamente; + - logs com mais de 1 024 linhas não são gravados, e o vetor sai do `.ktest`; + - knob `MAP2CHECK_KLEE_MAX_MEMORY`. + - Build `install_v99c`. Teste unitário `NonDetLogTest` (CSV byte a byte igual ao do + `fprintf`) e regressão de integração §38. +- **Sintético (N leituras `int`, alvo no fim, KLEE puro):** + + | N | v99b | v99c | + |---|---|---| + | 5 | 28 s | 1 s | + | 10 | `UNKNOWN` | 1 s | + | 100 | `UNKNOWN` | 1 s | + | 1 000 | `UNKNOWN` | 6 s | + | 10 000 | `UNKNOWN` | 31 s (vetor do ktest) | + +- **Sonda em tarefas reais (300 s):** + - Floats 5/5 continuam `FAILED`. + - **Intel-TDX 0/8**, com a memória padrão e também com `MAP2CHECK_KLEE_MAX_MEMORY=6000`. + - A `t1` no KLEE puro (240 s) completa 852 caminhos (antes: 0), deixa 557 parciais e + perde estados pelo teto de memória. + - Conclusão: o que resta é a **explosão genuína** do programa (havoc de milhares de + leituras e pré-condição longa), não mais o log. É uma frente separada. +- **Amostra `m2c-sample75` (40 tarefas de CE, semente 7575, 900 s/8 GB/4 núcleos):** + 20 `FAILED` e 20 `UNKNOWN` da v99, comparadas 1 a 1. Dados em + `tacas-results/V99c-sample/`. + - **20/20 `FAILED` mantidas**, e as 20 suítes dão `true` nos 3 validadores oficiais. + Isso é idêntico à v99, inclusive o `ERROR (1)` do TestCov em + `seq_cmp_antisymmetry_cover_target`, que só o TestCoCa valida. + - **Tempo das 20 `FAILED`: 1 584 s → 1 364 s (−14 %).** O ganho vem de duas tarefas: + - `Problem11_label00`: 249 → 89 s; + - `id_o100`: 76 → 1 s. + + Nas demais, a variação ficou dentro do ruído (`aim-100-3-4-sat-1`: 78 → 115 s). + - **0/20 ganhos nas `UNKNOWN`**: 19 Hardware (btor2c) e `Problem101_label00`. Agora usam + quase todo o orçamento (~830–900 s, contra ~710–890 s na v99), sem vetor. + - **Leitura:** a #75 não introduz regressão e acelera alguns casos. Na Hardware o + gargalo não é o log. +- **Campanha:** em 13/10 às 00h43, o `v99c-campaign.sh` iniciou as 256 Intel-TDX `SKIPPED` + no `install_v99c` (`v99c-ce-tdx-s0/1`). O Cover-Branches (4 shards, 3 500 tarefas, + `install_v99c`) começa sozinho quando todo o CE terminar. diff --git a/docs/superpowers/plans/2026-09-28-tacasv3a-smart-seeds-plumbing.md b/docs/superpowers/plans/2026-09-28-tacasv3a-smart-seeds-plumbing.md new file mode 100644 index 000000000..f3b801e2d --- /dev/null +++ b/docs/superpowers/plans/2026-09-28-tacasv3a-smart-seeds-plumbing.md @@ -0,0 +1,145 @@ +# tacasv3a — Smart seeds plumbing: Implementation Plan + +> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking. + +**Goal:** make `--seed-exchange` actually move seeds between AFL++ and KLEE, across the hybrid's three phases. + +**Architecture:** +- **Seed store.** A persistent directory `/.seeds/` next to the scratch directory, with `afl/`, `ktest/` and `replay/` subdirectories. +- **KLEE → AFL++.** KLEE vectors go to `afl/`, and the AFL++ phase uses `afl/` as its `-i`. +- **AFL++ → KLEE.** The AFL++ queue is replayed through the witness binary inside `replay/`, and the typed nondet log becomes one `.ktest` per entry in `ktest/`. KLEE then runs with `--seed-dir`. +- **Budget.** 0.2 / 0.6 / 0.2 when the exchange is on. +- **Cleanup.** The store is removed after the last phase unless `--debug`. +- **Where the code lives.** Pure selection logic goes into `modules/frontend/utils/seed_store.hpp`; the rest goes in `Caller` and `map2check.cpp`. + +**Tech Stack:** C++17, GTest, bash integration tests, Docker dev image `map2check-dev:aflpp`. Use build dir `build_aflpp` (prefix pinned to `/workspace/build_aflpp/install`) and `build_aflpp_ut` (ENABLE_TEST). Rebuild `build_aflpp` only after R15 has finished, because it is using that install. + +**Spec:** `docs/superpowers/specs/2026-09-28-tacasv3a-smart-seeds-plumbing-design.md` + +## Global Constraints + +- **Store path:** `/.seeds`, absolute, with subdirectories `afl/`, `ktest/` and `replay/`. It exists only with `--seed-exchange`. +- **Queue replay:** at most 64 entries, in queue id order, each with a 2 s cap, run inside `replay/`. Empty or duplicate vectors are skipped. +- **KLEE seeding flags:** `--seed-dir=/ktest --allow-seed-extension --allow-seed-truncation --seed-time=s`, added only when `ktest/` has a file. +- **Budget with the exchange:** KLEE `min(0.6T, remaining−5)`. Without the exchange nothing changes (0.8T). +- **Log lines:** `Seeded KLEE with N vectors from AFL++` and `Seeded the fuzzer corpus with M vectors from KLEE`. +- **Default behaviour is unchanged** without `--seed-exchange`. +- Every mini-round is logged in `docs/reports/tacas-experiment-log.md`. + +## Review Focus + +- **A crash found by AFL++ must survive the queue replays.** Replays run in `replay/`, never in the phase directory. Pinned by integration test (2). +- **A run without `--debug` leaves no `*.seeds/` directory**, including when a phase errors out. Pinned by (3). +- **A queue entry whose replay hangs** is capped at 2 s. The `timeout` is covered by the code path; no dedicated test. +- **KLEE given seeds whose object sizes differ from its own** must not abort. The extension and truncation flags cover this, and it is exercised by (1). + +--- + +### Task 1: `seed_store.hpp` (pure) + unit tests + +**Files:** +- Create: `modules/frontend/utils/seed_store.hpp` and `tests/unit/frontend/SeedStoreTest.cpp`. +- Modify: `tests/unit/frontend/CMakeLists.txt`. + +**Produces:** +- `std::string Map2Check::seedStorePath(const std::string& cwd, const std::string& programHash)` returns `cwd + "/" + programHash + ".seeds"`. +- `std::vector Map2Check::selectQueueEntries(std::vector names, size_t cap)` keeps only names starting with `id:`, sorts them lexicographically (which is id order, because AFL++ zero-pads), and truncates to `cap`. +- `bool Map2Check::isNewVector(const std::vector& bytes, std::set>* seen)` returns false for an empty vector or one already in `seen`; otherwise it inserts the vector and returns true. + +- [ ] **Step 1:** Write the tests below in `SeedStoreTest.cpp`, and register it in CMake the same way as `SlicerTest` (`add_executable(SeedStoreTest SeedStoreTest.cpp)` + `map2check_test(SeedStoreTest)`). + +```cpp +#include + +#include +#include +#include + +#include "../../../modules/frontend/utils/seed_store.hpp" + +// Next to the scratch directory, not inside it: every hybrid phase recreates +// the scratch directory, and a store inside it never reached the next phase. +TEST(SeedStorePath, SitsBesideTheScratchDirectory) { + EXPECT_EQ(Map2Check::seedStorePath("/work", "abc.map2check"), + "/work/abc.map2check.seeds"); +} + +TEST(SelectQueueEntries, KeepsOnlyQueueEntriesInIdOrderUpToTheCap) { + const std::vector names = { + "id:000002,src:000000,time:9", ".state", "README.txt", + "id:000000,time:0,execs:0,orig:seed", "id:000001,src:000000,time:5"}; + const std::vector chosen = + Map2Check::selectQueueEntries(names, 2); + ASSERT_EQ(chosen.size(), 2u); + EXPECT_EQ(chosen[0], "id:000000,time:0,execs:0,orig:seed"); + EXPECT_EQ(chosen[1], "id:000001,src:000000,time:5"); +} + +TEST(IsNewVector, RejectsEmptyAndDuplicateVectors) { + std::set> seen; + EXPECT_FALSE(Map2Check::isNewVector({}, &seen)); + EXPECT_TRUE(Map2Check::isNewVector({1, 2}, &seen)); + EXPECT_FALSE(Map2Check::isNewVector({1, 2}, &seen)); + EXPECT_TRUE(Map2Check::isNewVector({1, 3}, &seen)); +} +``` + +- [ ] **Step 2:** Run `ninja SeedStoreTest` in `build_aflpp_ut`. Expected: FAIL, header not found. +- [ ] **Step 3:** Implement the header: `#include `, namespace `Map2Check`, the three inline functions exactly as specified, and a doc comment on each. +- [ ] **Step 4:** Run the test binary. Expected: `[ PASSED ] 3 tests.`, and ctest 100%. +- [ ] **Step 5: Commit** `feat(tacasv3a): pure seed-store helpers`. + +### Task 2: Store, KLEE → AFL++, budget and cleanup + +**Files:** `modules/frontend/caller.hpp`, `modules/frontend/caller.cpp`, `modules/frontend/map2check.cpp`, `tests/integration/test_testcomp_regressions.sh` (section 11). + +**Produces:** +- The member `std::string seedStore;` (absolute), set in the `Caller` constructor from `seedStorePath(currentPath, programHash)`. +- The accessor `const std::string& seedStorePath() const`. + +- [ ] **Step 1: Failing tests.** In section 11 of the integration script: + - Replace the `n_off` check with: after the run without the flag, `ls -d "$WORK/seed"/*.seeds 2>/dev/null | wc -l` must be 0. + - Replace the `n_on` count with: after the `--seed-exchange --debug` run, count files in `"$WORK"/seed/*.seeds/afl/` whose names start with `klee-`. It must be > 0, and the log must contain `Seeded the fuzzer corpus with`. + - Add a run of the same program with `--seed-exchange` **without** `--debug`. Afterwards `ls -d "$WORK/seed"/*.seeds` must be empty (`ok "no seed store is left behind without --debug"`). + + Run the suite. Expected: the `*.seeds` checks FAIL, because the store does not exist yet. +- [ ] **Step 2: Implement.** + - Set `seedStore` in the constructor, right after `currentPath` is set. + - `exportKleeVectorsAsSeeds` writes to `seedStore + "/afl"` (`create_directories`). + - In the AFL++ branch, `inputDir` is `seedStore + "/afl"` when `seedExchange`, otherwise `"afl-in"`. The queue copy-back writes to `seedStore + "/afl/afl-" + name`. + - KLEE budget: `const double kleeShare = this->seedExchange ? 0.6 : 0.8;` replaces the literal `0.8`. + - Remove `exportFuzzerVectorAsKtest` and its `--seed-file` use. Task 3 replaces it. + - In `map2check.cpp`, keep the store path from the last `map2check_execution`: a file-scope `std::string lastSeedStore` assigned from `caller->seedStorePath()`. After the hybrid phase sequence in `main`, when `args.seedExchange && !args.debugMode`, call `std::filesystem::remove_all(lastSeedStore, ec)`. + - Remove `Caller::seedDirectory` if nothing else uses it. +- [ ] **Step 3:** Rebuild (after R15) and run the suite plus ctest. Expected: section 11 passes, and everything else is unchanged. +- [ ] **Step 4: Commit** `feat(tacasv3a): a seed store that survives the hybrid's phases`. + +### Task 3: AFL++ → KLEE by replay, and KLEE `--seed-dir` + +**Files:** `modules/frontend/caller.hpp`, `modules/frontend/caller.cpp`, `tests/integration/test_testcomp_regressions.sh`. + +**Produces:** `unsigned Caller::exportFuzzerCorpusAsKtests();` (private). It returns the number of `.ktest` files written. + +- [ ] **Step 1: Failing tests.** Add section 26, "seeds reach KLEE", and section 27, "a crash survives the replays": + - **26:** `seed.c` from section 11, run with `--seed-exchange --debug`. The log must contain `Seeded KLEE with N vectors from AFL++` with N > 0 (grep the number), and the KLEE command line (debug) must contain `--seed-dir=`. + - **27:** the program `int x = nondet(); if (x > 1000 && x < 1100) reach_error();` (AFL++ finds it quickly thanks to CmpLog/interesting values), run with `--seed-exchange --target-function --target-function-name reach_error --timeout 30`. It must report `VERIFICATION FAILED`. + + Run them. Expected: 26 FAILS (no such line); 27 passes (a regression guard; ledger it). +- [ ] **Step 2: Implement** `exportFuzzerCorpusAsKtests()`, called at the end of the AFL++ branch when `seedExchange && !isWitnessFileCreated()`: + - List `afl-out/default/queue`, then `selectQueueEntries(names, 64)`. + - For each entry: + - clear `replay/` (`remove_all` + `create_directories`); + - run `cd && timeout -k 1 2 /-witness-fuzzed.out < '' > /dev/null 2>&1`; + - read `readNonDetLogAsObjects(/klee_log.csv)`; + - skip it if the objects are empty or if `ktestToFuzzerBytes(objects)` is not new according to `isNewVector`; + - otherwise `writeKtestFile(/ktest/afl-.ktest, objects)`. + - Log `Seeded KLEE with N vectors from AFL++` when N > 0. +- [ ] **Step 3: KLEE flags.** In the KLEE branch, when `seedExchange` and `/ktest` holds any regular file, append ` --seed-dir=/ktest --allow-seed-extension --allow-seed-truncation --seed-time=s` where `seedFlag` used to go (both command variants). +- [ ] **Step 4:** Rebuild and run the suite plus ctest. Expected: 26 and 27 pass, and everything else is unchanged. +- [ ] **Step 5: Commit** `feat(tacasv3a): the fuzzer corpus reaches KLEE as typed seeds`. + +### Task 4: Mini-rounds + +- [ ] **R16, Test-Comp:** the R15 manifests (`r15-ce.tsv`, `r15-cb.tsv`), 300 s, `EXTRA_FLAGS=--seed-exchange` (GENERATOR hybrid). Compare against the R15 control arm (same tasks, same code without the exchange). Report coverage, N and M per task (grep the `Seeded` lines from raw logs, or run a sample with `--debug`), and the median time. +- [ ] **R17, SV-COMP:** MemSafety and NoOverflows from the R14 manifests, plus a ReachSafety sample (`build_corpus.py` has no reachsafety property; use `--property cover-error`'s task list with `--target-function` via `run_testcomp_evaluation.sh`'s verdict column, or skip ReachSafety and note it). 120 s, with and without `--seed-exchange`. Report correct and wrong answers per arm. +- [ ] **Log R16–R17** with comparisons, and commit. diff --git a/docs/superpowers/specs/2026-09-28-tacasv3a-smart-seeds-plumbing-design.md b/docs/superpowers/specs/2026-09-28-tacasv3a-smart-seeds-plumbing-design.md new file mode 100644 index 000000000..7ef0a0c66 --- /dev/null +++ b/docs/superpowers/specs/2026-09-28-tacasv3a-smart-seeds-plumbing-design.md @@ -0,0 +1,137 @@ +# tacasv3a — Smart seeds, parte 1: o encanamento da troca AFL++ ↔ KLEE + +**Data:** 2026-09-28 +**Branch:** `feat/tacas-smart-seeds` (a partir de `develop`, que já tem a tacasv2) +**Baseline:** tacasv2 com `--seed-exchange` desligado (o híbrido default) +**Status:** rascunho — aguardando revisão +**Linha:** `decisions/tacas-afl-slicing-roadmap.md` (ai-memory); Fase 3.3 do +`docs/migration-schedule.md`. Registro de rodadas: `docs/reports/tacas-experiment-log.md`. + +--- + +## 1. Objetivo + +Fazer a troca de sementes entre os motores **acontecer de verdade** e medir o efeito. A +v15 mediu "sem ganho" com o `--seed-exchange`, mas, como a seção 2 mostra, as sementes +praticamente nunca chegavam ao outro motor. Esta etapa conserta o encanamento; o laço +alternado com detecção de estagnação (3b) e a priorização das sementes (3c) vêm depois, +cada uma com spec e medição próprios. + +**Métrica de sucesso** (decidida com o usuário): Test-Comp — tarefas cobertas no +Cover-Error e cobertura média no Cover-Branches — **e** vereditos de propriedades do +SV-COMP (MemSafety, NoOverflows, ReachSafety), sempre contra a tacasv2 sem a troca, no +mesmo corpus e no mesmo build. + +--- + +## 2. Diagnóstico do `--seed-exchange` atual + +| # | Defeito | Onde | +|---|---|---| +| 1 | As sementes não atravessam fases: cada fase cria um `Caller` que apaga o diretório de trabalho, e `seeds/` mora dentro dele | `Caller::Caller` (`rm -rf `), `Caller::seedDirectory` | +| 2 | Fuzzer → KLEE lê o `klee_log.csv` do diretório **atual**, que acabou de ser recriado vazio; e mandaria um vetor só | `exportFuzzerVectorAsKtest` | +| 3 | O corpus do AFL++ nunca chega ao KLEE, embora o KLEE aceite um diretório de sementes | idem | +| 4 | A terceira fase (KLEE → AFL++) quase não roda: o KLEE usa até 0,8× o orçamento e sobram segundos | `map2check.cpp` (fase 3) e orçamentos em `executeAnalysis` | + +--- + +## 3. Design + +### 3.1 Armazém de sementes persistente + +- Diretório `/.seeds/`, **ao lado** do diretório de trabalho (não dentro + dele), criado na primeira fase e reaproveitado pelas seguintes: + - `afl/` — entradas para o `-i` do AFL++ (vetores do KLEE convertidos em bytes, mais o + corpus que o próprio AFL++ descobriu); + - `ktest/` — sementes para o `--seed-dir` do KLEE; + - `replay/` — diretório isolado onde as entradas do AFL++ são reexecutadas. +- Removido pelo `main` depois da última fase, salvo em `--debug`. +- Só existe com `--seed-exchange`. Sem a flag, nada muda em relação à tacasv2. + +### 3.2 Fuzzer → KLEE: conversão por replay + +Ao fim da fase AFL++ (sem violação encontrada): + +1. Para cada entrada de `afl-out/default/queue/` (em ordem de id, até **64**): + - roda o binário de witness **dentro de `replay/`**, com a entrada no stdin e teto de + 2 s. Em `replay/` os arquivos que o runtime grava (`map2check_property`, + `klee_log.csv`, …) não tocam o diretório da fase — um replay não pode sobrescrever + uma violação já registrada; + - lê o `replay/klee_log.csv` com `readNonDetLogAsObjects` e grava + `ktest/afl-.ktest` com `writeKtestFile`; apaga o log antes da próxima entrada; + - descarta vetores vazios e duplicados (mesmos bytes). +2. Registra `Seeded KLEE with N vectors from AFL++`. + +Na fase KLEE, com `ktest/` não vazio: +`--seed-dir=/ktest --allow-seed-extension --allow-seed-truncation --seed-time=<¼ do orçamento do KLEE>`. +O `--seed-time` impede que reproduzir sementes consuma a fase inteira. + +### 3.3 KLEE → fuzzer + +- `exportKleeVectorsAsSeeds` passa a gravar em `/afl/` (hoje grava em `seeds/`, + que é apagado). A fase AFL++ usa `/afl/` como `-i`. +- A cópia do corpus do AFL++ de volta ao armazém (hoje em `seeds/`) passa a gravar em + `/afl/`. + +### 3.4 Orçamento com a troca ligada + +- AFL++ **0,2**, KLEE **0,6**, AFL++ **0,2** do orçamento (hoje 0,2 / até 0,8 / o que sobrar). +- Sem `--seed-exchange`: inalterado (0,2 / 0,8), para a tacasv2 continuar medindo o mesmo. + +### 3.5 O que fica igual + +- O default continua **sem** troca. Promover a troca a default é decisão para depois da + medição. +- Nenhuma mudança nos motores, na instrumentação ou no slicing. + +--- + +## 4. Referência comparada + +| Aspecto | FuSeBMC v4 | tacasv3a | Por quê | +|---|---|---|---| +| Direção | fuzzer ↔ BMC, alternado | AFL++ → KLEE → AFL++ | O laço alternado é o 3b | +| Formato | seeds do fuzzer usados pelo BMC via "smart seeds" | replay no binário de witness para obter o vetor tipado | O KLEE precisa de um objeto por leitura nondet; o runtime já registra os tipos | +| Priorização | por cobertura | ordem de id, teto 64 | Ranking é o 3c | + +--- + +## 5. Testes + +Integração (`test_testcomp_regressions.sh`, seção de seed exchange): + +1. **As sementes atravessam fases.** Programa em que o AFL++ acha caminhos e o KLEE + resolve uma guarda (a mesma `seed.c` da seção 11): com `--seed-exchange --debug`, o log + tem `Seeded KLEE with N vectors from AFL++` com N > 0 **e** + `Seeded the fuzzer corpus with M vectors from KLEE` com M > 0, e o armazém `.seeds/` + existe ao lado do diretório de trabalho. +2. **O replay não sobrescreve uma violação.** Programa em que o próprio AFL++ acha o bug: + com `--seed-exchange`, o veredito continua FAILED. +3. **Sem `--debug`, nada fica para trás.** Depois do run, não existe `*.seeds/` no diretório. +4. **Sem a flag, nada muda.** Nenhum `*.seeds/` e nenhuma linha `Seeded` (atualiza a + seção 11, que hoje olha `seeds/` dentro do diretório de trabalho). + +Unitário: a lógica pura — seleção das entradas da fila (ordem, teto, deduplicação por +bytes) e o nome do armazém — em funções testáveis sem os motores. + +--- + +## 6. Avaliação (mini-rodadas, registradas no log) + +- **Test-Comp:** o manifesto da R15 (Cover-Error 213, Cover-Branches 120), 300 s, braço + `--seed-exchange` contra o controle da R15 (mesmo build, sem a troca). +- **SV-COMP:** amostras de MemSafety e NoOverflows da R14 (e uma de ReachSafety, com o + mesmo `build_corpus.py`), com e sem `--seed-exchange`, 120 s. +- Métricas: tarefas cobertas e cobertura de ramos; corretos, **wrong-true/wrong-false**; + N e M (sementes trocadas por tarefa) para confirmar que a troca aconteceu. + +--- + +## 7. Riscos + +| Risco | Mitigação | +|---|---| +| Replay de 64 entradas custa tempo | Teto de 2 s por entrada; binário já compilado; medir o custo por tarefa | +| Semente do AFL++ com vetor que não corresponde aos objetos do KLEE (tamanho/ordem) | `--allow-seed-extension/--allow-seed-truncation`; o vetor vem do mesmo runtime que o KLEE usa | +| KLEE gasta a fase reproduzindo sementes | `--seed-time` = ¼ do orçamento do KLEE | +| Mudar o orçamento (0,2/0,6/0,2) muda o efeito junto com a troca | Só com `--seed-exchange`; a medição compara contra o controle 0,2/0,8, e o efeito é o do pacote | diff --git a/docs/superpowers/specs/2026-09-29-tacas-2d-slicing-optimizations-design.md b/docs/superpowers/specs/2026-09-29-tacas-2d-slicing-optimizations-design.md new file mode 100644 index 000000000..67fa73dbe --- /dev/null +++ b/docs/superpowers/specs/2026-09-29-tacas-2d-slicing-optimizations-design.md @@ -0,0 +1,103 @@ +# tacas 2d — otimizações do slicing (design) + +**Data:** 2026-09-29 · **Branch:** `feat/tacas-2d-slicing` (a partir de `feat/tacas-smart-seeds`) +**Aprovação:** o usuário delegou as decisões ("você tem permissão para fazer as decisões +que quiser") e pediu as abordagens recomendadas no brainstorming de 2026-09-29. + +## Objetivo + +Hoje o `--slice` só empata com o controle: 126 × 129 cobertas na R15 Cover-Error. Além +disso, ele tem 4 ERROR próprios (ECA). O objetivo é que ele passe a ganhar, sem nenhum +TRUE errado. + +## Evidência que orienta o desenho + +- **Os 4 ERROR de ECA** (`Problem08_label51`, `Problem102_label34`, `Problem102_label02`, + `Problem103_label44`) seguem o mesmo roteiro: + - o `sbt-slicer` estoura seu limite (0,2T = 60 s) na fase 1; + - a fase 2 recria o `Caller` e **tenta fatiar de novo**, perdendo mais 60 s; + - o processo passa do orçamento e o harness o mata aos 330 s, sem suíte. +- **Cada fase refatia do zero.** Numa tarefa em que o slicer funciona, isso custa o tempo + do slicer uma vez por fase (2× no híbrido, 3× com `--seed-exchange`). +- **O dg deixa blocos vazios e funções mortas no `.bc` fatiado.** Nenhuma limpeza roda + depois da fatia. + +## Desenho + +### 1. Fatiar uma vez por execução (cache do slice) + +- **Onde fica:** um diretório `/.slice/` ao lado do scratch, no mesmo + esquema do store de sementes, porque o scratch é recriado a cada fase. +- **Chave:** um hash (FNV-1a 64 bits, em hex) do **conteúdo do `.bc` de entrada**, somado + ao rótulo dos critérios, à função de entrada e às flags extras do slicer. Chavear pelo + conteúdo, e não pelo número da fase, garante que só se reaproveita a fatia de uma + entrada idêntica. +- **O que se guarda:** + - `.bc`: a fatia pronta, depois da limpeza (item 2); + - `.failed`: marca que o slicer falhou ou estourou o tempo. Com ela, as fases + seguintes vão direto para o programa inteiro, sem gastar o slicer de novo. +- **Consulta:** acontece em `Caller::runSlicer`. + - Um acerto copia a fatia e registra "reusing the slice from an earlier phase". + - Uma falha registrada devolve `false` com o aviso de sempre, acrescido de "(cached)". +- **Ciclo de vida:** o mesmo do store. + - O diretório é apagado no início da execução (fase ≤ 1). + - O guarda de escopo de `main` o remove no fim, exceto com `--debug`. + - O guarda passa a cuidar dos dois diretórios, o de sementes e o de slice. + - Só existe com `--slice`. + +### 2. Limpeza depois da fatia (experimental) + +- **Knob de ambiente:** `MAP2CHECK_SLICE_CLEANUP`, com os valores: + - `none` (padrão até a medição); + - `light`: `opt -passes='function(simplifycfg,dce),globaldce'`; + - `o2`: `opt -O2`. +- **Onde roda:** dentro de `runSlicer`, depois de uma fatia bem-sucedida e antes de ela + entrar no cache. +- **Se o `opt` falhar,** a fatia fica sem limpeza e a execução avisa. +- **Risco do `o2`:** ele explora comportamento indefinido e pode apagar laços sem efeito + colateral. Isso muda a alcançabilidade. Por isso é só um braço de experimento, e o + gate de TRUE errado = 0 decide. +- **Depois da medição,** o vencedor vira o padrão (commit separado). + +### 3. Parâmetros do dg (experimental) + +- **Knob de ambiente:** `MAP2CHECK_SLICER_FLAGS`, anexado sem alteração à linha do + `sbt-slicer`. Os braços medidos são `--cda=ntscd` e `--pta=fs`. +- **Entra na chave do cache.** +- **Depois da medição,** o vencedor vira o padrão (commit separado). + +### Fora do escopo + +- **Cutoff-diverging consertado:** risco alto (é a causa do "Broken module"). Só entra + se 1–3 não fecharem a diferença. +- **Cache dos demais artefatos** (binário do AFL++, `.bc` do KLEE): compilar e instrumentar + custa segundos. Fica para o 3b, se as rodadas extras mostrarem esse custo. + +## Testes + +- **Unitários** (`SlicerTest.cpp`), sobre `sliceCacheKey`: + - é determinística; + - muda com o conteúdo, com o rótulo, com a entrada e com as flags. +- **Integração, seção nova:** + - o programa VLA da seção 20, rodado no híbrido com `--slice`, mostra o aviso de falha + do slicer uma vez por "slicer run" (debug) e depois "(cached)"; + - um programa fatiável roda o `sbt-slicer` uma vez só e as fases seguintes registram + "reusing the slice". +- **Suíte existente:** 40/40, e ctest. + +## Medição: rodada R19, amostra `r15-ce.tsv`, 300 s + +A mesma rodada R19 mede também o 3b; ver o spec do 3b. + +| braço | build | flags / env | +|---|---|---| +| controle | final | — | +| slice | final | `--slice` | +| slice-light | final | `--slice`, `MAP2CHECK_SLICE_CLEANUP=light` | +| slice-o2 | final | `--slice`, `MAP2CHECK_SLICE_CLEANUP=o2` | +| slice-ntscd | final | `--slice`, `MAP2CHECK_SLICER_FLAGS=--cda=ntscd` | +| slice-ptafs | final | `--slice`, `MAP2CHECK_SLICER_FLAGS=--pta=fs` | + +- **Gate:** TRUE errado = 0 em todo braço promovido. +- **Critério de promoção:** mais cobertas que o `slice` puro, com pares discordantes a + favor. diff --git a/docs/superpowers/specs/2026-09-29-tacas-3b-engine-alternation-design.md b/docs/superpowers/specs/2026-09-29-tacas-3b-engine-alternation-design.md new file mode 100644 index 000000000..bfaae49e2 --- /dev/null +++ b/docs/superpowers/specs/2026-09-29-tacas-3b-engine-alternation-design.md @@ -0,0 +1,150 @@ +# tacas 3b — alternância de engines com detecção de estagnação (design) + +**Data:** 2026-09-29 +**Branch:** `feat/tacas-3b-alternation`, a partir de `feat/tacas-2d-slicing` +**Aprovação:** o usuário delegou as decisões e pediu a abordagem recomendada no +brainstorming de 2026-09-29, a opção A: sinais nativos de estagnação com polling. + +## Objetivo + +Hoje o híbrido com `--seed-exchange` reparte o orçamento de forma fixa: +- AFL++ com 0,2T; +- KLEE com 0,6T; +- AFL++ com 0,2T. + +Isso tem dois custos: +- uma engine estagnada segura o orçamento até o fim da sua cota; +- uma engine que ainda progride é cortada no meio. + +O 3b troca de engine **quando a atual estagna**, em rodadas, até: +- achar a violação; +- provar a propriedade; +- acabar o tempo. + +## Desenho + +### Laço de rodadas (em `main`) + +A flag nova é `--alternate-engines`. Ela implica `--seed-exchange` e só vale no híbrido. +O laço alterna AFL++ e KLEE, começando pelo AFL++, com `args.phase = 1, 2, 3, …`: + +``` +janela(engine, rodada r) = min(restante, base(engine) * 2^(r-1)) + base(AFL++) = 0,1T base(KLEE) = 0,3T +para cada fase: + roda a engine com teto = janela e parada por estagnação (abaixo) + pára o laço se: violação | provedSafe | restante < max(10 s, 0,05T) +``` + +**Por que as janelas dobram:** a mesma engine volta com mais tempo quando a alternância +não resolveu. Uma engine que estagna cedo devolve o tempo que sobrou na hora. + +**Quem alimenta o KLEE:** toda fase AFL++ seguida de uma fase KLEE alimenta o KLEE +(`feedsKleePhase`). O corte é que, se o que resta não comporta outra fase, ela não +alimenta. + +**O que o KLEE recebe de semente:** +- o corpus do AFL++, como hoje; +- os `.ktest` da rodada KLEE anterior. Assim o KLEE reconstrói depressa a fronteira + que já tinha alcançado, em vez de redescobri-la. + +**O que o AFL++ recebe:** o `store/afl` já acumula a fila do AFL++ e os vetores do KLEE, +então nada muda. + +**Seleção das entradas da fila (`selectQueueEntries`):** passa a **pular as sementes com +que o fuzzer começou** (entradas `,orig:`): são vetores do KLEE ou de rodadas anteriores, +que o KLEE já tem. O `store/ktest` é limpo a cada exportação, porque os `.ktest` da rodada +KLEE anterior (`kleeprev/`) carregam o que ela já explorou. (A primeira versão deste spec +previa um `store/exported.txt`; o efeito é o mesmo com menos estado.) + +**Sem limite na troca KLEE → AFL++:** todos os vetores do KLEE vão para o fuzzer. +Completados com zeros depois do fim, alguns caminhos parciais do KLEE chegam ao erro no +dry run do AFL++, e é assim que o híbrido fixo cobre tarefas eca-* que o próprio KLEE deixa +UNKNOWN. Uma primeira versão limitava a exportação aos 64 vetores mais recentes (e o corpus +a 256). Isso custou 5 tarefas eca-* na R19 e foi removido. A calibração ficou barata depois +que o gerador do AFL++ passou a devolver zeros no fim da entrada. + +**Binários do AFL++ compilados uma vez por execução** (cache `.build/`, chaveado +pelo conteúdo dos módulos): em eca-* cada fase do fuzzer gastava ~24 s recompilando. + +**Paciência do AFL++ também dobra por rodada:** com o corte fixo de 15 s, os turnos do +fuzzer em eca-* acabavam em ~17 s, onde o híbrido fixo dava 60 s. + +### Estagnação + +- **AFL++:** `AFL_EXIT_ON_TIME=S`. O próprio fuzzer sai com 0 quando passa S segundos sem + cobertura nova. O `timeout` externo continua sendo o teto da janela. +- **KLEE:** o frontend lança o KLEE em uma thread (`system`, como hoje, com o PID do + `timeout` gravado em `klee.pid`) e faz polling do `klee-out-0/run.stats` a cada 2 s, + lendo `CoveredInstructions` da última linha pela API do SQLite, em modo somente leitura. + - Se o valor fica S segundos sem subir, o frontend manda SIGINT ao `timeout`, que o + repassa ao KLEE. + - O KLEE para de forma limpa: grava os testes dos estados que já terminaram. + - A fase é marcada como **incompleta** (`gotTimeout`). A execução nunca vira TRUE + por isso. +- **Valor de S:** `max(10 s, 0,05T)`, que dá 15 s em T = 300, para o AFL++. Para o KLEE, + S dobra a cada rodada dele: a cobertura de instruções para de subir bem antes de o KLEE + terminar os caminhos que formam uma prova, e um corte fixo nunca o deixaria chegar lá. +- **Sem SQLite:** o SQLite é uma dependência opcional, via `find_package(SQLite3)`. Sem + ele, a estagnação do KLEE fica desligada e vale só o teto da janela. O CI, que não + instala `libsqlite3-dev`, continua compilando. + +### Correção necessária: numeração da suíte + +`TestSuiteWriter` numera os casos a partir de 1 em cada fase (`testcase-1.xml`, …). Com +mais de uma fase KLEE em Cover-Branches, **uma rodada sobrescreveria a anterior**. O +contador passa a começar depois do maior `testcase-N.xml` que já existir no diretório. + +### Revisão (2026-09-29), incorporada + +- **Orçamento:** cada fase mede o próprio tempo de preparação (compilar, instrumentar, + linkar), que nenhuma janela conta. Uma fase só começa se sobrar `S + preparação`, e a + janela desconta a preparação. O AFL++ guarda 5 s de reserva, como o KLEE. +- **SIGINT:** vai direto ao PID do KLEE, filho do `timeout`. Mandado ao `timeout`, ele + repassava ao filho e ao grupo, o KLEE recebia dois sinais e perdia o despejo dos estados + vivos. +- **Suíte de Cover-Branches:** o limite de 50 casos vale para a suíte, não para cada fase, + e vetores repetidos entre fases são pulados. A suíte começa vazia a cada execução, o que + evita somar casos de uma execução anterior no mesmo diretório. +- **Flag:** sem `--timeout`, ou com `--nondet-generator`, `--alternate-engines` avisa e + não se aplica. + +## Fora do escopo + +- **Transformar o corpus do AFL++ em casos de teste de Cover-Branches.** Hoje a suíte de + CB sai só dos `.ktest` do KLEE. É um bom candidato, porque o replay tipado já existe, + mas é uma mudança de outra natureza e fica para depois. +- **Priorização das sementes (3c).** + +## Testes + +- **Unitários:** + - `SeedStoreTest`: a seleção pula nomes já exportados; + - `alternationWindow(engine, rodada, T, restante)`: janelas dobram e respeitam o + restante; + - `stagnationSeconds(T)`; + - `TestSuiteWriter`: o contador continua a partir de um diretório existente. +- **Integração, seções novas:** + - **Várias fases numa execução só:** um programa em que o AFL++ estagna (guarda de + igualdade de 32 bits que o CmpLog não resolve), rodado com `--alternate-engines`, + registra mais de uma fase e termina dentro do orçamento, sem TRUE. + - **Numeração da suíte:** um diretório com `testcase-1.xml` recebe o próximo caso como + `testcase-2.xml`. + - **Estagnação do KLEE:** um programa com laço infinito de estados, a 60 s, mostra o + aviso "KLEE stagnated" antes do teto e o veredito não é TRUE. + +## Medição (R19, a mesma rodada do 2d) + +Braços a comparar, todos com o build final: + +| braço | flags | +|---|---| +| controle | — | +| seeds | `--seed-exchange` | +| alternate | `--alternate-engines` | + +- **Amostras:** Cover-Error em `r15-ce.tsv`; Cover-Branches em `r15-cb.tsv` (seeds e + alternate). +- **Gate:** TRUE errado = 0. +- **Critério de promoção:** mais tarefas cobertas que seeds em Cover-Error e cobertura + média de CB não pior. diff --git a/docs/superpowers/specs/2026-09-29-tacas-3c-seed-ranking-design.md b/docs/superpowers/specs/2026-09-29-tacas-3c-seed-ranking-design.md new file mode 100644 index 000000000..f7741590b --- /dev/null +++ b/docs/superpowers/specs/2026-09-29-tacas-3c-seed-ranking-design.md @@ -0,0 +1,34 @@ +# tacas 3c — priorização de sementes, v1 (design) + +**Data:** 2026-09-29 +**Branch:** `feat/tacas-3c-seed-ranking`, a partir de `feat/tacas-memtrack-intrinsics` +**Aprovação:** decisões delegadas pelo usuário em 2026-09-29. + +## Problema + +O KLEE recebe no máximo 64 entradas da fila do AFL++ (`kMaxSeedsFromFuzzer`), escolhidas +pelas mais antigas por id. Quando a fila passa de 64, o que era novo no fim do fuzzing fica +de fora, e esse é justamente o caso dos programas maiores. + +## v1 (esta branch) + +- O AFL++ 4.40c marca com `,+cov` as entradas que alcançaram **arestas novas**. As demais só + mudaram as contagens de execução de arestas já vistas. Medido: 2 de 18 entradas numa fila + de 20 s. Não existe `.state/redundant_edges` nesta versão. +- `selectQueueEntries` põe as `+cov` primeiro, em ordem de id, depois as outras, também em + ordem de id, e então corta no limite. +- Teste unitário: `SelectQueueEntries.PutsNewCoverageFirst`. + +## Próximos passos (v2, fora desta branch) + +- **Distância ao alvo** (Cover-Error): priorizar sementes cujo replay passa por blocos mais + próximos de `reach_error` no CFG/SDG. O dg do slicing já tem o grafo. Exige um traço de + blocos no replay, que o `TrackBasicBlockPass` pode fornecer. +- **KLEE → AFL++:** hoje seguem os 64 `.ktest` mais recentes. O KLEE não marca quais estados + cobriram código novo; `--only-output-states-covering-new` mudaria a suíte de CB e não + entra. + +## Medição + +É preciso uma rodada `seeds` e `alternate` com este build contra a R19 (os mesmos braços +sem ranking). Só tem efeito em tarefas cuja fila passa de 64 entradas. diff --git a/modules/backend/library/header/Map2CheckTypes.h b/modules/backend/library/header/Map2CheckTypes.h index 1f131cfe4..85a8f9b45 100755 --- a/modules/backend/library/header/Map2CheckTypes.h +++ b/modules/backend/library/header/Map2CheckTypes.h @@ -54,7 +54,19 @@ enum NONDET_TYPE { SECTOR_T = 12, UINT = 13, SHORT = 14, - DOUBLE = 15 + DOUBLE = 15, + /* Issue #74: SV-COMP names NonDetPass did not model. Each was an external + * call KLEE could not resolve, which killed every path through it. */ + FLOAT = 16, + LONGLONG = 17, + ULONGLONG = 18, + U8 = 19, + U16 = 20, + U32 = 21, + /* One byte of a __VERIFIER_nondet_memory(p, n) call, logged by the runtime: + * the validators read that call as n uchar inputs. Its own type, not UCHAR, + * so the seed converter can tell that n rows are one KLEE object. */ + MEMORY_BYTE = 22 }; enum Container_Type { @@ -152,6 +164,8 @@ typedef int as_int; unsigned as_unsigned; double as_double; + long long as_longlong; + unsigned long long as_ulonglong; } value; /** Name of the function where operation took place */ char function_name[FUNCTION_MAX_LENGTH_NAME]; diff --git a/modules/backend/library/header/NonDetGenerator.h b/modules/backend/library/header/NonDetGenerator.h index fb5dec3dd..b9fdfe3bd 100644 --- a/modules/backend/library/header/NonDetGenerator.h +++ b/modules/backend/library/header/NonDetGenerator.h @@ -129,4 +129,32 @@ uint map2check_non_det_uint(); */ double map2check_non_det_double(); +/* Issue #74: the SV-COMP names NonDetPass did not model. The typedefs give the + * generator macros one identifier per type, which also names the KLEE object + * ("non_det_ulonglong"), the only place a .ktest keeps the type. */ +float map2check_non_det_float(); + +typedef long long longlong; +longlong map2check_non_det_longlong(); + +typedef unsigned long long ulonglong; +ulonglong map2check_non_det_ulonglong(); + +typedef unsigned char u8; +u8 map2check_non_det_u8(); + +typedef unsigned short u16; +u16 map2check_non_det_u16(); + +typedef unsigned int u32; +u32 map2check_non_det_u32(); + +/** + * @brief Fills `size` bytes at `destination` with nondeterministic values + * + * The validators' harness reads it as `size` uchar inputs, one per byte, so + * the runtime logs it that way (MEMORY_BYTE rows). + */ +void map2check_non_det_memory(void *destination, size_t size); + #endif diff --git a/modules/backend/library/header/NonDetLog.h b/modules/backend/library/header/NonDetLog.h index 444baa4f9..bc86869a9 100644 --- a/modules/backend/library/header/NonDetLog.h +++ b/modules/backend/library/header/NonDetLog.h @@ -86,5 +86,29 @@ void map2check_nondet_short(unsigned line, unsigned scope, int value, void map2check_nondet_double(unsigned line, unsigned scope, double value, const char *function_name); +void map2check_nondet_float(unsigned line, unsigned scope, double value, + const char *function_name); + +void map2check_nondet_longlong(unsigned line, unsigned scope, long long value, + const char *function_name); + +void map2check_nondet_ulonglong(unsigned line, unsigned scope, + unsigned long long value, + const char *function_name); + +void map2check_nondet_u8(unsigned line, unsigned scope, int value, + const char *function_name); + +void map2check_nondet_u16(unsigned line, unsigned scope, int value, + const char *function_name); + +void map2check_nondet_u32(unsigned line, unsigned scope, int value, + const char *function_name); + +/** Logs one byte of a __VERIFIER_nondet_memory call. Called by the runtime's + * map2check_non_det_memory, not by NonDetPass: the bytes are read inside it. */ +void map2check_nondet_memory_byte(unsigned line, unsigned scope, int value, + const char *function_name); + #endif diff --git a/modules/backend/library/lib/AnalysisModeMemcleanup.c b/modules/backend/library/lib/AnalysisModeMemcleanup.c index d66439869..3c506b206 100644 --- a/modules/backend/library/lib/AnalysisModeMemcleanup.c +++ b/modules/backend/library/lib/AnalysisModeMemcleanup.c @@ -156,6 +156,7 @@ void analysis_generate_aux_witness_files() { // TODO: FIX THIS, not working for static array #include void map2check_load(void *ptr, int size) {} +void map2check_check_cstring(const char *string) {} void map2check_free_resolved_address(void *ptr, unsigned line, const char *function_name, diff --git a/modules/backend/library/lib/AnalysisModeMemtrack.c b/modules/backend/library/lib/AnalysisModeMemtrack.c index 87e79ad1f..a06f363c3 100644 --- a/modules/backend/library/lib/AnalysisModeMemtrack.c +++ b/modules/backend/library/lib/AnalysisModeMemtrack.c @@ -153,6 +153,18 @@ void analysis_generate_aux_witness_files() { // TODO: FIX THIS, not working for static array #include +/* Every byte a %s or puts will read, up to the terminator: each must lie in + * a live allocation. Stops at the first invalid byte (ERROR_DEREF is set and + * the caller's map2check_check_deref reports it), before reading it. */ +void map2check_check_cstring(const char *string) { + if (string == NULL) return; + for (unsigned long i = 0;; ++i) { + map2check_load((void *)(string + i), 1); + if (ERROR_DEREF) return; + if (string[i] == '\0') return; + } +} + void map2check_load(void *ptr, int size) { if (!is_valid_heap_address(&heap_log, ptr, size)) { if (!is_valid_allocation_address(&allocation_log, ptr, size)) { diff --git a/modules/backend/library/lib/ContainerRealloc.c b/modules/backend/library/lib/ContainerRealloc.c index 6fe712943..72d246106 100644 --- a/modules/backend/library/lib/ContainerRealloc.c +++ b/modules/backend/library/lib/ContainerRealloc.c @@ -42,25 +42,55 @@ Bool free_container(MAP2CHECK_CONTAINER *container) { } Bool append_element(MAP2CHECK_CONTAINER *container, void *row) { + /* Grow geometrically: the capacity is the power of two at or above the + * size, so the buffer is reallocated only when the size reaches one. It + * grew by one row per append, and every append copied the whole log: N + * nondet reads cost O(N^2) row copies, and under KLEE each realloc is a new + * memory object whose (symbolic) bytes are copied too -- with 10,000 reads + * the single path ran out of time before reaching the target (issue #75). */ + unsigned old_size = container->size; container->size += 1; + if (old_size != 0 && (old_size & (old_size - 1)) != 0) { + switch (container->type) { + case LIST_LOG_CONTAINER: + ((LIST_LOG_ROW *)container->values)[old_size] = *((LIST_LOG_ROW *)row); + break; + case ALLOCATION_LOG_CONTAINER: + ((MEMORY_ALLOCATIONS_ROW *)container->values)[old_size] = + *((MEMORY_ALLOCATIONS_ROW *)row); + break; + case NONDET_LOG_CONTAINER: + ((NONDET_CALL *)container->values)[old_size] = *((NONDET_CALL *)row); + break; + case HEAP_LOG_CONTAINER: + ((MEMORY_HEAP_ROW *)container->values)[old_size] = + *((MEMORY_HEAP_ROW *)row); + break; + case TRACKBB_LOG_CONTAINER: + ((TRACK_BB_ROW *)container->values)[old_size] = *((TRACK_BB_ROW *)row); + break; + } + return TRUE; + } + unsigned capacity = old_size == 0 ? 1 : 2 * old_size; - int new_allocation_size; + size_t new_allocation_size; switch (container->type) { case LIST_LOG_CONTAINER: - new_allocation_size = container->size * sizeof(LIST_LOG_ROW); + new_allocation_size = capacity * sizeof(LIST_LOG_ROW); break; case ALLOCATION_LOG_CONTAINER: - new_allocation_size = container->size * sizeof(MEMORY_ALLOCATIONS_ROW); + new_allocation_size = capacity * sizeof(MEMORY_ALLOCATIONS_ROW); break; case NONDET_LOG_CONTAINER: - new_allocation_size = container->size * sizeof(NONDET_CALL); + new_allocation_size = capacity * sizeof(NONDET_CALL); break; case HEAP_LOG_CONTAINER: - new_allocation_size = container->size * sizeof(MEMORY_HEAP_ROW); + new_allocation_size = capacity * sizeof(MEMORY_HEAP_ROW); break; case TRACKBB_LOG_CONTAINER: - new_allocation_size = container->size * sizeof(TRACK_BB_ROW); + new_allocation_size = capacity * sizeof(TRACK_BB_ROW); break; } // printf("new allocation size: %d\n", new_allocation_size); diff --git a/modules/backend/library/lib/NonDetGeneratorAFL.c b/modules/backend/library/lib/NonDetGeneratorAFL.c index 01cefa075..541c32aea 100644 --- a/modules/backend/library/lib/NonDetGeneratorAFL.c +++ b/modules/backend/library/lib/NonDetGeneratorAFL.c @@ -52,13 +52,17 @@ size_t map2check_afl_size; * drags afl-fuzz's stability down. */ static size_t map2check_afl_index = 0; +/* Past the end of the test case every read is zero. It used to start over + * from the first byte, so `while (__VERIFIER_nondet_int())` fed by the + * placeholder seed "A" never ended: afl-fuzz's dry run timed out on it and the + * fuzzer aborted before its first execution. Zero ends such a loop, and it is + * what the witness replay logs, so the suite built from that log stays exact. + * (It also read data[0] of an empty test case.) */ uint8_t get_next_input_from_afl() { if (map2check_afl_index < map2check_afl_size) { return map2check_afl_data[map2check_afl_index++]; } - - map2check_afl_index = 0; - return map2check_afl_data[map2check_afl_index]; + return 0; } /* Fills `out` with `size` bytes from the AFL buffer, in target order. @@ -97,6 +101,23 @@ MAP2CHECK_NON_DET_GENERATOR(double) MAP2CHECK_NON_DET_GENERATOR(int) MAP2CHECK_NON_DET_GENERATOR(uint) MAP2CHECK_NON_DET_GENERATOR(unsigned) +MAP2CHECK_NON_DET_GENERATOR(float) +MAP2CHECK_NON_DET_GENERATOR(longlong) +MAP2CHECK_NON_DET_GENERATOR(ulonglong) +MAP2CHECK_NON_DET_GENERATOR(u8) +MAP2CHECK_NON_DET_GENERATOR(u16) +MAP2CHECK_NON_DET_GENERATOR(u32) + +/* `size` bytes straight from the test case, as KLEE's one object of `size` + * bytes; logged a byte at a time, as the validators' harness reads it. */ +void map2check_non_det_memory(void *destination, size_t size) { + unsigned char *bytes = (unsigned char *)destination; + get_bytes_from_afl(bytes, size); + size_t i = 0; + for (; i < size; i++) { + map2check_nondet_memory_byte(0, 0, bytes[i], "__VERIFIER_nondet_memory"); + } +} #define MAP2CHECK_MAX_FUZZED_STRING 4096 diff --git a/modules/backend/library/lib/NonDetGeneratorKlee.c b/modules/backend/library/lib/NonDetGeneratorKlee.c index 74bb6b721..8eb5876ee 100644 --- a/modules/backend/library/lib/NonDetGeneratorKlee.c +++ b/modules/backend/library/lib/NonDetGeneratorKlee.c @@ -10,6 +10,8 @@ #include "../header/NonDetGenerator.h" #include "../header/NonDetLog.h" #include +#include +#include extern int __map2check_main__(int argc, char **argv); @@ -17,16 +19,72 @@ int main(int argc, char **argv) { return __map2check_main__(argc, argv); } void nondet_init() { nondet_log_init(); } void nondet_destroy() { nondet_log_destroy(); } -void nondet_generate_aux_witness_files() { - nondet_log_to_file(map2check_nondet_get_log()); +extern long long klee_get_value_i64(long long expr); +extern void klee_assume(int); + +/* Pin every logged value to one concrete model before printing it. The values + * are still symbolic when the path ends, and uClibc's vfprintf branches on + * each digit it converts: every row multiplied the states, so a program with + * ten nondet reads reached its target and never finished writing the log + * (issue #75). The assume makes each value consistent with the path and with + * the values pinned before it, so the row is one input vector, not a set of + * independent guesses. The 64-bit view covers every member of the union; the + * narrower ones were zero-extended by new_nondet_call's memset. */ +static void concretize_nondet_log(MAP2CHECK_CONTAINER log) { + unsigned i; + for (i = 0; i < log.size; i++) { + NONDET_CALL *call = (NONDET_CALL *)get_element_at(i, log); + if (call == NULL) + return; + long long symbolic; + memcpy(&symbolic, &call->value, sizeof(symbolic)); + long long concrete = klee_get_value_i64(symbolic); + klee_assume(symbolic == concrete); + memcpy(&call->value, &concrete, sizeof(concrete)); + } } -extern void klee_assume(int); +/* Pinning costs a solver query per row, and the equalities pile up: with + * 1,000 rows the violating path took 6 s, with 10,000 it never reached its + * abort -- the target found, KLEE's timer expiring mid-log. Past this size the + * log is not written: the violating state's .ktest, which KLEE solves in one + * query when the state ends, carries the same vector in the same order, and + * the frontend reads it whenever klee_log.csv is missing. */ +#define MAP2CHECK_KLEE_LOG_MAX_ROWS 1024U + +void nondet_generate_aux_witness_files() { + MAP2CHECK_CONTAINER log = map2check_nondet_get_log(); + if (log.size > MAP2CHECK_KLEE_LOG_MAX_ROWS) + return; + concretize_nondet_log(log); + nondet_log_to_file(log); +} -void nondet_assume(int expr) { klee_assume(expr); } +/* A failed assumption ends the path as a normal exit. klee_assume(0) on a + * path where the condition is already false is a KLEE error ("invalid + * klee_assume call (provably false)", a user.err), and the frontend must read + * every KLEE error as a dropped path -- which made every program with an + * assume_abort_if_not unprovable. + * + * klee_silent_exit avoided the error but wrote no test either, so a program + * whose every path meets a failed assumption (most of XCSP) got an empty + * Cover-Branches suite. _exit ends the path normally, so KLEE writes its + * .ktest, and it skips the exit handlers: a path the program declared + * infeasible reports no leak. */ extern void klee_make_symbolic(void *addr, size_t nbytes, const char *name); +/* The path's test still goes after every unpruned one in a Cover-Branches + * suite (readKtestVectors), so the one-byte "map2check_pruned" object marks + * it. The reader strips the marker; it is never an input. */ +void nondet_assume(int expr) { + if (!expr) { + char pruned; + klee_make_symbolic(&pruned, sizeof(pruned), "map2check_pruned"); + _exit(0); + } +} + /* "non_det_" #type, not "non_det_#type". The stringify operator only applies * to a macro parameter written OUTSIDE a string literal; inside one, # and t * are just two characters. Every symbolic object was therefore named the @@ -80,3 +138,30 @@ MAP2CHECK_NON_DET_GENERATOR(loff_t) MAP2CHECK_NON_DET_GENERATOR(sector_t) MAP2CHECK_NON_DET_GENERATOR(uint) MAP2CHECK_NON_DET_GENERATOR(double) +MAP2CHECK_NON_DET_GENERATOR(float) +MAP2CHECK_NON_DET_GENERATOR(longlong) +MAP2CHECK_NON_DET_GENERATOR(ulonglong) +MAP2CHECK_NON_DET_GENERATOR(u8) +MAP2CHECK_NON_DET_GENERATOR(u16) +MAP2CHECK_NON_DET_GENERATOR(u32) + +/* A fresh object, copied in, rather than klee_make_symbolic(destination): + * KLEE accepts only the exact start and size of an allocation, and the + * benchmarks pass a field or a struct inside a larger one + * (`__VERIFIER_nondet_memory(dest, sizeof(tdr_t))`). One object of `size` + * bytes, not `size` objects of one: the reader expands it into one uchar + * input per byte (decodeKtestInputs), as the validators' harness reads it. */ +void map2check_non_det_memory(void *destination, size_t size) { + if (size == 0) + return; + unsigned char *bytes = malloc(size); + if (bytes == NULL) + return; + klee_make_symbolic(bytes, size, "non_det_memory"); + memcpy(destination, bytes, size); + size_t i = 0; + for (; i < size; i++) { + map2check_nondet_memory_byte(0, 0, bytes[i], "__VERIFIER_nondet_memory"); + } + free(bytes); +} diff --git a/modules/backend/library/lib/NonDetGeneratorNone.c b/modules/backend/library/lib/NonDetGeneratorNone.c index 95200b506..7135795c6 100644 --- a/modules/backend/library/lib/NonDetGeneratorNone.c +++ b/modules/backend/library/lib/NonDetGeneratorNone.c @@ -11,6 +11,7 @@ /* This mode returns consts */ #include +#include extern int __map2check_main__(); int main() { @@ -36,6 +37,22 @@ void *map2check_non_det_pointer() { } long map2check_non_det_long() { return 0; } + +float map2check_non_det_float() { return 0; } + +long long map2check_non_det_longlong() { return 0; } + +unsigned long long map2check_non_det_ulonglong() { return 0; } + +unsigned char map2check_non_det_u8() { return 0; } + +unsigned short map2check_non_det_u16() { return 0; } + +unsigned int map2check_non_det_u32() { return 0; } + +void map2check_non_det_memory(void *destination, size_t size) { + memset(destination, 0, size); +} void nondet_assume(int expr) {} void nondet_init() {} void nondet_destroy() {} diff --git a/modules/backend/library/lib/NonDetLog.c b/modules/backend/library/lib/NonDetLog.c index 5c458cfae..18a0781d2 100644 --- a/modules/backend/library/lib/NonDetLog.c +++ b/modules/backend/library/lib/NonDetLog.c @@ -14,25 +14,71 @@ const char *klee_log_file = "klee_log.csv"; +/* Decimal conversion by hand, not through printf. Under KLEE, uClibc's + * vfprintf is interpreted instruction by instruction -- about 7,000 per call, + * seven calls per row -- and the log of a run with 1,000 nondet reads cost + * 44 M instructions, 93% of the whole path (issue #75). Each helper appends + * to `buffer` and returns the new end. */ +static char *put_ulonglong(char *buffer, unsigned long long value) { + char digits[20]; + int n = 0; + do { + digits[n++] = (char)('0' + value % 10); + value /= 10; + } while (value != 0); + while (n > 0) + *buffer++ = digits[--n]; + return buffer; +} + +static char *put_longlong(char *buffer, long long value) { + if (value < 0) { + *buffer++ = '-'; + /* negate in unsigned: -LLONG_MIN overflows */ + return put_ulonglong(buffer, 0ULL - (unsigned long long)value); + } + return put_ulonglong(buffer, (unsigned long long)value); +} + +static char *put_string(char *buffer, const char *text, size_t max) { + size_t i; + for (i = 0; i < max && text[i] != '\0'; i++) + *buffer++ = text[i]; + return buffer; +} + Bool nondet_log_to_file(MAP2CHECK_CONTAINER klee_container) { if (klee_container.type != NONDET_LOG_CONTAINER) { return FALSE; } FILE *output = fopen(klee_log_file, "w"); + if (output == NULL) { + return FALSE; + } - int i = 0; + /* id;line;scope;function;step;value;type -- five numbers of at most 20 + * characters, the name, a double of at most ~320 (%lf of DBL_MAX) */ + char row[512]; + unsigned i = 0; unsigned size = klee_container.size; for (; i < size; i++) { NONDET_CALL *call = (NONDET_CALL *)get_element_at(i, klee_container); if (call == NULL) { + fclose(output); return FALSE; } - fprintf(output, "%d;", i); - fprintf(output, "%u;", call->line); - fprintf(output, "%u;", call->scope); - fprintf(output, "%s;", call->function_name); - fprintf(output, "%u;", call->step_on_execution); + char *end = row; + end = put_longlong(end, (int)i); + *end++ = ';'; + end = put_ulonglong(end, call->line); + *end++ = ';'; + end = put_ulonglong(end, call->scope); + *end++ = ';'; + end = put_string(end, call->function_name, FUNCTION_MAX_LENGTH_NAME); + *end++ = ';'; + end = put_ulonglong(end, call->step_on_execution); + *end++ = ';'; // The value generated from nondet function. Read inline: it is stored in // the row, not behind a pointer into a stack frame that no longer exists. @@ -42,21 +88,33 @@ Bool nondet_log_to_file(MAP2CHECK_CONTAINER klee_container) { * where the format has seven. The value column still parsed by accident, * being first, but the type column moved to index 7 and anything reading * it got a copy of the value instead. */ - if (((int)call->type) == UNSIGNED) { - fprintf(output, "%u;", call->value.as_unsigned); + if (((int)call->type) == UNSIGNED || ((int)call->type) == U32) { + end = put_ulonglong(end, call->value.as_unsigned); } else if (((int)call->type) == DOUBLE) { - fprintf(output, "%lf;", call->value.as_double); + end += snprintf(end, row + sizeof(row) - end - 16, "%lf", + call->value.as_double); + } else if (((int)call->type) == FLOAT) { + /* %.9g, not %lf: nine significant digits round-trip any float, while + * six fixed decimals print 1e-30 as 0 -- a different input. */ + end += snprintf(end, row + sizeof(row) - end - 16, "%.9g", + (float)call->value.as_double); + } else if (((int)call->type) == LONGLONG) { + end = put_longlong(end, call->value.as_longlong); + } else if (((int)call->type) == ULONGLONG) { + end = put_ulonglong(end, call->value.as_ulonglong); } else { - fprintf(output, "%d;", call->value.as_int); + end = put_longlong(end, call->value.as_int); } + *end++ = ';'; // Type of the nondet function - fprintf(output, "%d\n", ((int)call->type)); + end = put_longlong(end, (int)call->type); + *end++ = '\n'; + fwrite(row, 1, (size_t)(end - row), output); } fclose(output); return TRUE; - } NONDET_CALL new_nondet_call(enum NONDET_TYPE type, unsigned line, @@ -74,8 +132,10 @@ NONDET_CALL new_nondet_call(enum NONDET_TYPE type, unsigned line, * `value` points at a parameter of the map2check_nondet_* wrapper, and that * frame is gone long before the log is flushed at exit. */ if (value != NULL) { - if (type == DOUBLE) { + if (type == DOUBLE || type == FLOAT) { result.value.as_double = *(double *)value; + } else if (type == LONGLONG || type == ULONGLONG) { + result.value.as_longlong = *(long long *)value; } else { result.value.as_int = *(int *)value; } @@ -96,10 +156,9 @@ MAP2CHECK_CONTAINER map2check_nondet_get_log() { return nondet_log; } void helper_map2check_nondet_append_element(NONDET_CALL nondetCall) { map2check_next_current_step(); - NONDET_CALL *row = (NONDET_CALL *)malloc(sizeof(NONDET_CALL)); - *row = nondetCall; - - append_element(&nondet_log, row); + /* append_element copies the row: a heap copy here leaked one row per + * nondet read (and was one more memory object per read under KLEE). */ + append_element(&nondet_log, &nondetCall); } #define MAP2CHECK_NONDET_GENERATOR(type, nondet_type) \ @@ -126,6 +185,10 @@ MAP2CHECK_NONDET_GENERATOR(size_t, SIZE_T) MAP2CHECK_NONDET_GENERATOR(loff_t, LOFF_T) MAP2CHECK_NONDET_GENERATOR(sector_t, SECTOR_T) MAP2CHECK_NONDET_GENERATOR(uint, UINT) +MAP2CHECK_NONDET_GENERATOR(u8, U8) +MAP2CHECK_NONDET_GENERATOR(u16, U16) +MAP2CHECK_NONDET_GENERATOR(u32, U32) +MAP2CHECK_NONDET_GENERATOR(memory_byte, MEMORY_BYTE) // FIX: MAP2CHECK_NONDET_GENERATOR(unsigned, UNSIGNED) void map2check_nondet_unsigned(unsigned line, unsigned scope, unsigned value, @@ -148,3 +211,32 @@ void map2check_nondet_double(unsigned line, unsigned scope, double value, map2check_get_current_step()); helper_map2check_nondet_append_element(nondetCall); } + +/* A float arrives widened to double (NonDetPass emits an fpext), so the row + * keeps one floating-point member; FLOAT says how to print it. */ +void map2check_nondet_float(unsigned line, unsigned scope, double value, + const char *function_name) { + NONDET_CALL nondetCall = + new_nondet_call(FLOAT, line, scope, &value, function_name, + map2check_get_current_step()); + helper_map2check_nondet_append_element(nondetCall); +} + +/* 64-bit, not through the int-valued macro above: that one truncates to 32 + * bits, and an Intel-TDX register value cut in half is a different input. */ +void map2check_nondet_longlong(unsigned line, unsigned scope, long long value, + const char *function_name) { + NONDET_CALL nondetCall = + new_nondet_call(LONGLONG, line, scope, &value, function_name, + map2check_get_current_step()); + helper_map2check_nondet_append_element(nondetCall); +} + +void map2check_nondet_ulonglong(unsigned line, unsigned scope, + unsigned long long value, + const char *function_name) { + NONDET_CALL nondetCall = + new_nondet_call(ULONGLONG, line, scope, &value, function_name, + map2check_get_current_step()); + helper_map2check_nondet_append_element(nondetCall); +} diff --git a/modules/backend/library/lib/WitnessGeneration.c b/modules/backend/library/lib/WitnessGeneration.c index a4de44c20..330f3876b 100644 --- a/modules/backend/library/lib/WitnessGeneration.c +++ b/modules/backend/library/lib/WitnessGeneration.c @@ -6,6 +6,7 @@ * SPDX-License-Identifier: (GPL-2.0) **/ +#include #include "../header/WitnessGeneration.h" #include "../header/AnalysisMode.h" #include "../header/NonDetGenerator.h" @@ -19,7 +20,10 @@ void generate_aux_files(MAP2CHECK_CONTAINER *trackbb_log, Bool violation) { * so without the guard a state that took a different branch clobbers the * violating one's log -- which is exactly what produced a test case with the * right first input and a wrong second one. */ - if (violation) { + /* The seed exchange replays the fuzzer's NON-violating queue entries to + * learn their typed vectors, so it asks for the log explicitly. Only that + * replay sets the variable; KLEE's forked states never do. */ + if (violation || getenv("MAP2CHECK_SEED_REPLAY") != NULL) { nondet_generate_aux_witness_files(); } } diff --git a/modules/backend/pass/MemoryTrackPass.cpp b/modules/backend/pass/MemoryTrackPass.cpp index a35477a80..475c930a3 100644 --- a/modules/backend/pass/MemoryTrackPass.cpp +++ b/modules/backend/pass/MemoryTrackPass.cpp @@ -10,8 +10,12 @@ #include "MemoryTrackPass.hpp" +#include +#include #include +#include +#include #include #include #include @@ -209,8 +213,10 @@ void MemoryTrackPass::instrumentMemset() { IRBuilder<> builder(BBIteratorToInst(j)); Value *function_llvm = builder.CreateGlobalStringPtr(function_name); - // Value *args[] = {varPointerCast, size}; - Value *args[] = {pointer, size}; + // map2check_load takes an i64 size; the intrinsic's may be i32. + Value *sizeCast = CastInst::CreateIntegerCast( + size, Type::getInt64Ty(*this->Ctx), false, bitcast, BBIteratorToInst(j)); + Value *args[] = {varPointerCast, sizeCast}; builder.CreateCall(map2check_load, args); Value *args2[] = {this->line_value, function_llvm}; @@ -255,6 +261,106 @@ void MemoryTrackPass::instrumentMemcpy() { builder.CreateCall(map2check_check_deref, args3); } +namespace { +/** Behind MAP2CHECK_CHECK_CSTRINGS=1 until measured on more of Juliet. The + * check fixes a wrong TRUE (CWE193 "cpy" bad: the buffer is full, the read + * always overruns it) and makes a wrong FALSE on the matching good tasks, whose + * terminator is a byte never initialized -- which SV-COMP counts as a + * terminator and a native or KLEE run does not (R21: one of each in 50). */ +bool cstringChecksEnabled() { + const char *knob = std::getenv("MAP2CHECK_CHECK_CSTRINGS"); + return knob != nullptr && std::string(knob) == "1"; +} + +/** The argument positions a constant printf format reads as strings: each + * %s without a precision (a %.Ns may legitimately point at an unterminated + * buffer). `first` is the position of the first variadic argument. Returns + * nothing for a format it cannot follow (%n$ positional arguments). */ +std::vector stringArgumentsOf(llvm::StringRef format, + unsigned first) { + std::vector positions; + unsigned argument = first; + for (size_t i = 0; i < format.size(); ++i) { + if (format[i] != '%') continue; + ++i; + if (i < format.size() && format[i] == '%') continue; + // flags + while (i < format.size() && llvm::StringRef("-+ #0'").contains(format[i])) + ++i; + // width + if (i < format.size() && format[i] == '*') { + ++argument; + ++i; + } + while (i < format.size() && isdigit(static_cast(format[i]))) + ++i; + if (i < format.size() && format[i] == '$') return {}; + // precision + bool precision = false; + if (i < format.size() && format[i] == '.') { + precision = true; + ++i; + if (i < format.size() && format[i] == '*') { + ++argument; + ++i; + } + while (i < format.size() && + isdigit(static_cast(format[i]))) + ++i; + } + // length modifiers + bool wide = false; + while (i < format.size() && llvm::StringRef("hlLqjzt").contains(format[i])) { + if (format[i] == 'l') wide = true; + ++i; + } + if (i >= format.size()) break; + if (format[i] == 's' && !precision && !wide) positions.push_back(argument); + ++argument; + } + return positions; +} +} // namespace + +/* KLEE's uClibc declares printf without defining it, so KLEE runs it as a + * native external call: whatever it reads is read outside every check. An + * unterminated buffer printed with %s -- Juliet's CWE121 CWE193 "cpy" tasks -- + * came back TRUE. The strings the call will read are checked here, before it: + * the format's %s arguments when the format is a constant, the first argument + * of puts/fputs. */ +void MemoryTrackPass::instrumentCStringArguments() { + CallInst *callInst = dyn_cast(&*this->currentInstruction); + llvm::StringRef name = this->calleeFunction->getName(); + + std::vector strings; + if (name == "puts" || name == "fputs") { + strings.push_back(0); + } else { + const unsigned formatIndex = + name == "printf" ? 0 : (name == "snprintf" ? 2 : 1); + if (callInst->arg_size() <= formatIndex) return; + llvm::StringRef format; + if (!llvm::getConstantStringInfo(callInst->getArgOperand(formatIndex), + format)) { + return; + } + strings = stringArgumentsOf(format, formatIndex + 1); + } + if (strings.empty()) return; + + IRBuilder<> builder(&*this->currentInstruction); + Value *function_llvm = + builder.CreateGlobalStringPtr(this->currentFunction->getName()); + for (unsigned position : strings) { + if (position >= callInst->arg_size()) continue; + Value *argument = callInst->getArgOperand(position); + if (!argument->getType()->isPointerTy()) continue; + builder.CreateCall(map2check_check_cstring, {argument}); + } + Value *args[] = {this->line_value, function_llvm}; + builder.CreateCall(map2check_check_deref, args); +} + void MemoryTrackPass::instrumentAlloca() { CallInst *callInst = dyn_cast(&*this->currentInstruction); auto j = this->currentInstruction; @@ -502,16 +608,22 @@ void MemoryTrackPass::switchCallInstruction() { this->instrumentFree(); } else if (this->calleeFunction->getName() == "posix_memalign") { this->instrumentPosixMemAllign(); - } else if (this->calleeFunction->getName() == "memset") { - this->instrumentMemset(); - } else if (this->calleeFunction->getName() == "llvm.memset.p0i8.i64") { - this->instrumentMemset(); - } else if (this->calleeFunction->getName() == "llvm.memset.p0i8.i32") { + } else if (llvm::isa(&*this->currentInstruction) || + calleeName == "memset") { + // By the intrinsic's kind, not its name. The names carried the pointer + // types -- llvm.memset.p0i8.i64 -- and with opaque pointers LLVM 16 names + // them llvm.memset.p0.i64: matched by name, no memset, memcpy or memmove + // clang emitted was checked at all (memset(p, 0, 16) on 8 malloc'd bytes + // came back UNKNOWN, found only by KLEE's own bounds check). this->instrumentMemset(); - } else if (this->calleeFunction->getName() == "llvm.memcpy.p0i8.p0i8.i64") { - this->instrumentMemcpy(); - } else if (this->calleeFunction->getName() == "llvm.memcpy.p0i8.p0i8.i32") { + } else if (llvm::isa(&*this->currentInstruction) || + calleeName == "memcpy" || calleeName == "memmove") { this->instrumentMemcpy(); + } else if ((calleeName == "printf" || calleeName == "fprintf" || + calleeName == "sprintf" || calleeName == "snprintf" || + calleeName == "puts" || calleeName == "fputs") && + cstringChecksEnabled()) { + this->instrumentCStringArguments(); } else if (this->calleeFunction->getName() == "malloc") { this->instrumentMalloc(); } else if (this->calleeFunction->getName() == "valloc") { @@ -782,6 +894,10 @@ void MemoryTrackPass::prepareMap2CheckInstructions() { Type::getInt64Ty(*this->Ctx), PointerType::get(*this->Ctx, 0), Type::getInt64Ty(*this->Ctx), PointerType::get(*this->Ctx, 0)); + this->map2check_check_cstring = F.getParent()->getOrInsertFunction( + "map2check_check_cstring", Type::getVoidTy(*this->Ctx), + PointerType::get(*this->Ctx, 0)); + this->map2check_check_deref = F.getParent()->getOrInsertFunction( "map2check_check_deref", Type::getVoidTy(*this->Ctx), Type::getInt64Ty(*this->Ctx), PointerType::get(*this->Ctx, 0)); diff --git a/modules/backend/pass/MemoryTrackPass.hpp b/modules/backend/pass/MemoryTrackPass.hpp index 2d404a9d2..b80148a21 100644 --- a/modules/backend/pass/MemoryTrackPass.hpp +++ b/modules/backend/pass/MemoryTrackPass.hpp @@ -49,6 +49,9 @@ struct MemoryTrackPass : public llvm::PassInfoMixin { void instrumentRealloc(); void instrumentMemset(); void instrumentMemcpy(); + /** Checks, before a printf-family call or puts/fputs, every string the call + * will read to its terminator (see the definition). */ + void instrumentCStringArguments(); void instrumentPosixMemAllign(); void instrumentFree(); void instrumentInit(); @@ -92,6 +95,7 @@ struct MemoryTrackPass : public llvm::PassInfoMixin { FunctionCallee map2check_non_static_alloca; FunctionCallee map2check_posix; FunctionCallee map2check_load; + FunctionCallee map2check_check_cstring; FunctionCallee map2check_check_deref; FunctionCallee map2check_function; FunctionCallee map2check_free_resolved_address; diff --git a/modules/backend/pass/NonDetFunctions.hpp b/modules/backend/pass/NonDetFunctions.hpp index d22bb6745..7acfef727 100644 --- a/modules/backend/pass/NonDetFunctions.hpp +++ b/modules/backend/pass/NonDetFunctions.hpp @@ -53,6 +53,12 @@ using llvm::Type; Type::getInt32Ty(*Ctx), Type::getInt32Ty(*Ctx), Type::getDoubleTy(*Ctx), \ PointerType::get(*Ctx, 0)); +#define NON_DET_FUNCTIONS_HELPER_I64(type, c_type) \ + this->NonDet##type = F->getParent()->getOrInsertFunction( \ + "map2check_nondet_" #c_type, Type::getVoidTy(*Ctx), \ + Type::getInt32Ty(*Ctx), Type::getInt32Ty(*Ctx), Type::getInt64Ty(*Ctx), \ + PointerType::get(*Ctx, 0)); + class NonDetFunctions { CONSTANT_GENERATOR(Integer) CONSTANT_GENERATOR(Unsigned) @@ -70,6 +76,12 @@ class NonDetFunctions { CONSTANT_GENERATOR(Sector_t) CONSTANT_GENERATOR(Uint) CONSTANT_GENERATOR(Double) + CONSTANT_GENERATOR(Float) + CONSTANT_GENERATOR(Longlong) + CONSTANT_GENERATOR(Ulonglong) + CONSTANT_GENERATOR(U8) + CONSTANT_GENERATOR(U16) + CONSTANT_GENERATOR(U32) // Constant* NonDetAssume = NULL; public: @@ -90,6 +102,13 @@ class NonDetFunctions { NON_DET_FUNCTIONS_HELPER(Sector_t, sector_t) NON_DET_FUNCTIONS_HELPER(Uint, uint) NON_DET_FUNCTIONS_HELPER_DOUBLE(Double, double) + // A float is logged widened to double (instrumentNonDetFloat). + NON_DET_FUNCTIONS_HELPER_DOUBLE(Float, float) + NON_DET_FUNCTIONS_HELPER_I64(Longlong, longlong) + NON_DET_FUNCTIONS_HELPER_I64(Ulonglong, ulonglong) + NON_DET_FUNCTIONS_HELPER(U8, u8) + NON_DET_FUNCTIONS_HELPER(U16, u16) + NON_DET_FUNCTIONS_HELPER(U32, u32) } }; diff --git a/modules/backend/pass/NonDetPass.cpp b/modules/backend/pass/NonDetPass.cpp index 08dc2b6d0..d10f5a5a0 100644 --- a/modules/backend/pass/NonDetPass.cpp +++ b/modules/backend/pass/NonDetPass.cpp @@ -100,6 +100,58 @@ bool rewriteAssumeToPrune(Function &F) { return true; } +/** Rewrites the program's own calls to abort() into path pruning. Returns how + * many it rewrote. + * + * In SV-COMP, abort() is not an error -- reach_error is the only one -- it is + * how a program discards a path, and the benchmarks write that assumption + * inline as well as through assume_abort_if_not: + * + * i2 = init(); + * if(!(i2)) {abort();} + * + * KLEE runs with --exit-on-error-type=Abort, so the first path violating such + * an assumption ended the whole search, with exit status 0, and the run + * answered TRUE for a program whose bug lay further on. Measured: every wrong + * TRUE of the tacasv2 control arm in the R15 Cover-Error sample (the + * seq-mthreaded/pals_* family and float-benchs/sin_interpolated_index-1). + * + * This runs on the user's module before the runtime is linked, so every abort + * here is the program's; the runtime's own abort (the one that signals a + * recorded violation) is never touched. A violation is still reported the same + * way: TargetPass instruments reach_error itself, so a `{reach_error(); + * abort();}` records the violation before the rewritten abort is reached. */ +unsigned rewriteAbortCallsToPrune(Function &F) { + std::vector aborts; + for (BasicBlock &block : F) { + for (Instruction &instruction : block) { + if (CallInst *call = dyn_cast(&instruction)) { + Function *callee = call->getCalledFunction(); + if (callee != nullptr && callee->getName() == "abort" && + call->arg_size() == 0) { + aborts.push_back(call); + } + } + } + } + if (aborts.empty()) return 0; + + LLVMContext &ctx = F.getContext(); + llvm::Type *int32 = llvm::Type::getInt32Ty(ctx); + llvm::FunctionCallee assume = F.getParent()->getOrInsertFunction( + "map2check_assume", llvm::Type::getVoidTy(ctx), int32); + for (CallInst *call : aborts) { + IRBuilder<> builder(call); + llvm::CallInst *pruned = + builder.CreateCall(assume, {llvm::ConstantInt::get(int32, 0)}); + pruned->setDebugLoc(call->getDebugLoc()); + call->eraseFromParent(); + } + llvm::errs() << "[map2check] rewrote " << aborts.size() << " abort() call(s)" + << " in " << F.getName() << " to prune the path\n"; + return aborts.size(); +} + } // namespace PreservedAnalyses NonDetPass::run(Function &F, @@ -110,6 +162,8 @@ PreservedAnalyses NonDetPass::run(Function &F, return PreservedAnalyses::none(); } + rewriteAbortCallsToPrune(F); + this->nonDetFunctions = make_unique(&F, &F.getContext()); bool initializedFunctionName = false; for (Function::iterator bb = F.begin(), e = F.end(); bb != e; ++bb) { @@ -169,6 +223,22 @@ void NonDetPass::runOnCallInstruction(CallInst *callInst, LLVMContext *Ctx) { CALL_IF_HELPER(Sector_t, SECTOR_T, sector_t) CALL_IF_HELPER(Uint, UINT, uint) CALL_IF_HELPER(Double, DOUBLE, double) + // Issue #74. Unmodeled, each of these stayed an external call KLEE could + // not resolve ("failed external call: __VERIFIER_nondet_ulonglong"), which + // killed every path through it: all of Intel-TDX and most of Floats came + // back UNKNOWN with zero completed paths. + CALL_IF_HELPER(Float, FLOAT, float) + CALL_IF_HELPER(Longlong, LONGLONG, longlong) + CALL_IF_HELPER(Ulonglong, ULONGLONG, ulonglong) + CALL_IF_HELPER(U8, U8, u8) + CALL_IF_HELPER(U16, U16, u16) + CALL_IF_HELPER(U32, U32, u32) + + // Renamed only: it returns nothing to log at the call site, so the runtime + // logs the bytes it writes (map2check_non_det_memory). + if (calleeFunction->getName() == "__VERIFIER_nondet_memory") { + this->instrumentNonDet(NonDetType::MEMORY, calleeFunction); + } if ((calleeFunction->getName() == "__VERIFIER_assume")) { this->instrumentNonDet(NonDetType::ASSUME, calleeFunction); @@ -207,6 +277,13 @@ void NonDetPass::instrumentNonDet(NonDetType nonDetType, INSTRUMENT_CASE_HELPER(SECTOR_T, sector_t) INSTRUMENT_CASE_HELPER(UINT, uint) INSTRUMENT_CASE_HELPER(DOUBLE, double) + INSTRUMENT_CASE_HELPER(FLOAT, float) + INSTRUMENT_CASE_HELPER(LONGLONG, longlong) + INSTRUMENT_CASE_HELPER(ULONGLONG, ulonglong) + INSTRUMENT_CASE_HELPER(U8, u8) + INSTRUMENT_CASE_HELPER(U16, u16) + INSTRUMENT_CASE_HELPER(U32, u32) + INSTRUMENT_CASE_HELPER(MEMORY, memory) case (NonDetType::ASSUME): { Twine assume("map2check_assume"); calleeFunction->setName(assume); @@ -272,12 +349,36 @@ namespace { this->nonDetFunctions->getNonDet##type##Function(); \ builder.CreateCall(NonDetFunction, args); \ } +/* Widened to double: the log keeps one floating-point member. */ +#define NONDET_IMPL_HELPER_FLOAT(type) \ + void NonDetPass::instrumentNonDet##type(CallInst *callInst, \ + LLVMContext *Ctx) { \ + auto j = this->currentInstruction; \ + j++; \ + IRBuilder<> builder(BBIteratorToInst(j)); \ + Value *function_llvm = this->getFunctionNameValue(); \ + Value *widened = \ + builder.CreateFPExt(callInst, Type::getDoubleTy(*Ctx)); \ + DebugInfo debugInfo(Ctx, callInst); \ + Value *args[] = {debugInfo.getLineNumberValue(), \ + debugInfo.getScopeNumberValue(), widened, \ + function_llvm}; \ + FunctionCallee NonDetFunction = \ + this->nonDetFunctions->getNonDet##type##Function(); \ + builder.CreateCall(NonDetFunction, args); \ + } } // namespace NONDET_IMPL_HELPER(Integer) NONDET_IMPL_HELPER(Unsigned) NONDET_IMPL_HELPER(Uint) NONDET_IMPL_HELPER(Double) +NONDET_IMPL_HELPER_FLOAT(Float) +NONDET_IMPL_HELPER(Longlong) +NONDET_IMPL_HELPER(Ulonglong) +NONDET_IMPL_HELPER(U32) +NONDET_IMPL_HELPER_CAST(U8) +NONDET_IMPL_HELPER_CAST(U16) NONDET_IMPL_HELPER_CAST(Char) NONDET_IMPL_HELPER_CAST(Ushort) NONDET_IMPL_HELPER_CAST(Short) diff --git a/modules/backend/pass/NonDetPass.hpp b/modules/backend/pass/NonDetPass.hpp index bbe5bd86a..88b0113f7 100644 --- a/modules/backend/pass/NonDetPass.hpp +++ b/modules/backend/pass/NonDetPass.hpp @@ -57,7 +57,14 @@ enum class NonDetType { SECTOR_T, UINT, CRAB_ASSUME, - DOUBLE + DOUBLE, + FLOAT, + LONGLONG, + ULONGLONG, + U8, + U16, + U32, + MEMORY }; namespace InstrumentNonDetS { @@ -95,6 +102,12 @@ struct NonDetPass : public llvm::PassInfoMixin { INSTRUMENT_HEADER_HELPER(Sector_t) INSTRUMENT_HEADER_HELPER(Uint) INSTRUMENT_HEADER_HELPER(Double) + INSTRUMENT_HEADER_HELPER(Float) + INSTRUMENT_HEADER_HELPER(Longlong) + INSTRUMENT_HEADER_HELPER(Ulonglong) + INSTRUMENT_HEADER_HELPER(U8) + INSTRUMENT_HEADER_HELPER(U16) + INSTRUMENT_HEADER_HELPER(U32) void instrumentCrabAssume(CallInst *callInst, LLVMContext *Ctx); std::unique_ptr nonDetFunctions; Value *functionName = NULL; diff --git a/modules/frontend/CMakeLists.txt b/modules/frontend/CMakeLists.txt index 19778b60e..edc9e75d1 100644 --- a/modules/frontend/CMakeLists.txt +++ b/modules/frontend/CMakeLists.txt @@ -38,4 +38,19 @@ target_include_directories(map2check PRIVATE "${CMAKE_CURRENT_BINARY_DIR}") #set_target_properties(map2check PROPERTIES COMPILE_FLAGS ${CPP_FLAGS}) #-lrt -ldl -ltinfo -lpthread -lz -lm target_link_libraries(map2check ${Boost_LIBRARIES}) + +# --alternate-engines watches KLEE's progress in its SQLite stats database +# (tacas 3b). Optional: without SQLite -- the CI images do not install it -- +# KLEE runs to its window and only the fuzzer stops on stagnation. +find_package(Threads REQUIRED) +target_link_libraries(map2check Threads::Threads) +find_package(SQLite3) +if(SQLite3_FOUND) + target_compile_definitions(Caller PRIVATE MAP2CHECK_HAVE_SQLITE) + target_include_directories(Caller PRIVATE ${SQLite3_INCLUDE_DIRS}) + target_link_libraries(map2check ${SQLite3_LIBRARIES} ${CMAKE_DL_LIBS}) + message(STATUS "SQLite3 found: KLEE stagnation detection enabled") +else() + message(STATUS "SQLite3 not found: KLEE stagnation detection disabled") +endif() install (TARGETS map2check DESTINATION .) diff --git a/modules/frontend/caller.cpp b/modules/frontend/caller.cpp index 2c557fb1f..8485e0682 100644 --- a/modules/frontend/caller.cpp +++ b/modules/frontend/caller.cpp @@ -22,15 +22,28 @@ #include #include #include +#include +#include #include #include #include +#include #include #include +#include +#include + +#ifdef MAP2CHECK_HAVE_SQLITE +#include +#endif + #include "test_suite/ktest_reader.hpp" +#include "test_suite/test_suite.hpp" #include "utils/gen_crypto_hash.hpp" +#include "utils/alternation.hpp" #include "utils/log.hpp" +#include "utils/seed_store.hpp" #include "utils/slicer.hpp" #include "utils/tools.hpp" // namespace fs = boost::filesystem; @@ -63,7 +76,10 @@ Caller::Caller(std::string bc_program_path, Map2CheckMode mode, this->nonDetGenerator = generator; GenHash hash; hash.setFilePath(bc_program_path); - hash.generate_sha1_hash_for_file(); + if (hash.generate_sha1_hash_for_file() != 0) { + throw std::runtime_error("cannot read the input program " + + bc_program_path); + } this->programHash = hash.getOutputSha1HashFile() + ".map2check"; // The scratch directory is named after the SHA-1 of the input bitcode, so it @@ -84,6 +100,9 @@ Caller::Caller(std::string bc_program_path, Map2CheckMode mode, Map2Check::Log::Debug("Changing current dir"); currentPath = std::filesystem::current_path().string(); + seedStore = Map2Check::seedStorePath(currentPath, programHash); + sliceCache = Map2Check::sliceCachePath(currentPath, programHash); + buildCache = currentPath + "/" + programHash + ".build"; std::filesystem::current_path(currentPath + "/" + programHash); Map2Check::Log::Debug("Current path: " + std::filesystem::current_path().string()); @@ -103,6 +122,14 @@ std::chrono::steady_clock::time_point processStart() { } } // namespace +unsigned Caller::remainingOf(unsigned timeout) { + const auto elapsed = std::chrono::duration_cast( + std::chrono::steady_clock::now() - processStart()) + .count(); + const long long left = static_cast(timeout) - elapsed; + return left < 1 ? 1u : static_cast(left); +} + unsigned Caller::remainingSeconds() const { const auto elapsed = std::chrono::duration_cast( std::chrono::steady_clock::now() - processStart()) @@ -115,6 +142,20 @@ unsigned Caller::remainingSeconds() const { return left < 1 ? 1u : static_cast(left); } +bool Caller::ssaPreoptimization() const { + // Reachability and assert only. The memory modes track locals through the + // allocas mem2reg removes (a pointer kept in a local, promoted, made a + // legitimate free() look invalid: FALSE-FREE on safe programs), the overflow + // mode lost detections, and simplifycfg turns branches into selects, which + // is fewer paths and fewer Cover-Branches test cases. + if (map2checkMode != Map2CheckMode::REACHABILITY_MODE && + map2checkMode != Map2CheckMode::ASSERT_MODE) { + return false; + } + const char *knob = std::getenv("MAP2CHECK_PREOPT"); + return knob != nullptr && std::string(knob) == "ssa"; +} + std::string Caller::preOptimizationFlags() { std::ostringstream flags; flags.str(""); @@ -129,18 +170,243 @@ std::string Caller::postOptimizationFlags() { return flags.str(); } +namespace { +/** KLEE's covered-instruction count, from the last row of the SQLite stats + * database it rewrites every second; -1 when it cannot be read (not created + * yet, busy, or a build without SQLite). */ +long long kleeCoveredInstructions(const std::string &statsPath) { +#ifdef MAP2CHECK_HAVE_SQLITE + sqlite3 *db = nullptr; + long long covered = -1; + if (sqlite3_open_v2(statsPath.c_str(), &db, SQLITE_OPEN_READONLY, nullptr) == + SQLITE_OK) { + sqlite3_busy_timeout(db, 200); + sqlite3_stmt *statement = nullptr; + if (sqlite3_prepare_v2(db, + "SELECT CoveredInstructions FROM stats ORDER BY " + "rowid DESC LIMIT 1", + -1, &statement, nullptr) == SQLITE_OK && + sqlite3_step(statement) == SQLITE_ROW) { + covered = sqlite3_column_int64(statement, 0); + } + sqlite3_finalize(statement); + } + sqlite3_close(db); + return covered; +#else + (void)statsPath; + return -1; +#endif +} +} // namespace + +int Caller::runKleeWatched(const std::string &command) { + this->stoppedOnStagnation = false; +#ifndef MAP2CHECK_HAVE_SQLITE + return system(command.c_str()); +#else + if (this->stagnationLimit == 0) return system(command.c_str()); + + // The shell's pid becomes the pid of `timeout` through exec, and `timeout` + // forwards a SIGINT to KLEE -- whose handler halts the search cleanly and + // writes the tests of the states it finished. + std::error_code error; + std::filesystem::remove("klee.pid", error); + const std::string wrapped = "echo $$ > klee.pid; exec " + command; + std::atomic done{false}; + int result = 0; + std::thread runner([&wrapped, &done, &result] { + result = system(wrapped.c_str()); + done = true; + }); + + Map2Check::CoverageWatch watch(this->stagnationLimit); + const auto started = std::chrono::steady_clock::now(); + const std::string stats = std::string(Map2Check::kleeOutputDir) + "/run.stats"; + while (!done) { + for (int tick = 0; tick < 4 && !done; ++tick) { + std::this_thread::sleep_for(std::chrono::milliseconds(500)); + } + if (done) break; + const double now = std::chrono::duration( + std::chrono::steady_clock::now() - started) + .count(); + if (!watch.stagnated(kleeCoveredInstructions(stats), now)) continue; + + // To KLEE itself, the child of `timeout`: signalled, `timeout` forwards + // to the child AND its process group, KLEE gets two SIGINTs, and the + // second one exits before the halt dump of the live states is written. + pid_t pid = 0; + std::ifstream("klee.pid") >> pid; + pid_t klee = 0; + if (pid > 0) { + std::ifstream children("/proc/" + std::to_string(pid) + "/task/" + + std::to_string(pid) + "/children"); + children >> klee; + } + if (klee > 0) { + kill(klee, SIGINT); + } else if (pid > 0) { + kill(pid, SIGINT); + } + this->stoppedOnStagnation = true; + Map2Check::Log::Warning("KLEE stagnated: no new coverage for " + + std::to_string(this->stagnationLimit) + + " s -- stopping it"); + // A KLEE blocked inside a native external call (Juliet's fscanf variants: + // __isoc99_fscanf handed a uClibc FILE*) never looks at the interrupt + // flag -- nor at its own --max-time -- and used to hold the rest of its + // window until timeout's SIGKILL. Not stopped within the grace, it is + // killed now and the time goes to the next phase. Nothing is lost: a run + // that stagnated is already counted incomplete. + constexpr int kInterruptGraceSeconds = 10; + for (int tick = 0; tick < 2 * kInterruptGraceSeconds && !done; ++tick) { + std::this_thread::sleep_for(std::chrono::milliseconds(500)); + } + if (!done) { + if (klee > 0) { + kill(klee, SIGKILL); + } else if (pid > 0) { + kill(pid, SIGKILL); + } + Map2Check::Log::Warning( + "KLEE did not stop within " + + std::to_string(kInterruptGraceSeconds) + + " s of the interrupt (blocked in an external call?) -- killed it"); + } + break; + } + runner.join(); + return result; +#endif +} + +bool Caller::replayKleeVectorsForViolation() { + // KLEE's partial paths -- the states it dumped at a halt -- stop where the + // search stopped. Run natively, completed with zeros past their end (the + // AFL++ generator's rule), some of them go on to the error: that is how the + // fixed hybrid covered eca-* tasks KLEE left UNKNOWN, by accident, in its + // last fuzzer phase's dry run. Done on purpose here, right after KLEE, and + // without needing --seed-exchange. + std::error_code error; + std::string witness; + for (const auto &entry : + std::filesystem::directory_iterator(buildCache, error)) { + const std::string candidate = + entry.path().string() + "/" + programHash + "-witness-fuzzed.out"; + if (std::filesystem::exists(candidate, error)) witness = candidate; + } + if (witness.empty()) return false; + + std::vector tests; + for (const auto &entry : std::filesystem::directory_iterator( + Map2Check::kleeOutputDir, error)) { + if (entry.path().extension() == ".ktest") { + tests.push_back(entry.path().string()); + } + } + std::sort(tests.begin(), tests.end()); + + const std::string replay = + std::filesystem::absolute("vector-replay", error).string(); + const auto started = std::chrono::steady_clock::now(); + const double allowedSeconds = std::min( + 0.1 * static_cast(this->timeout), + static_cast(this->remainingSeconds()) - 5.0); + if (allowedSeconds < 1.0) return false; + const auto allowed = std::chrono::duration(allowedSeconds); + std::set> seen; + unsigned replayed = 0; + for (const std::string &test : tests) { + if (std::chrono::steady_clock::now() - started >= allowed) break; + const std::vector bytes = + Map2Check::ktestToFuzzerBytes(Map2Check::readKtestFile(test)); + if (!seen.insert(bytes).second) continue; + std::filesystem::remove_all(replay, error); + std::filesystem::create_directories(replay, error); + { + std::ofstream input(replay + "/input", std::ios::binary); + input.write(reinterpret_cast(bytes.data()), + static_cast(bytes.size())); + } + std::ostringstream command; + command << "cd '" << replay << "' && timeout -k 1 2 '" << witness + << "' < input > /dev/null 2>&1"; + system(command.str().c_str()); + ++replayed; + if (!std::filesystem::exists(replay + "/map2check_checked_error", error)) { + continue; + } + // A violation: its files (property, nondet log, trace) become this + // phase's, as a confirmed fuzzer crash's do. + for (const auto &entry : + std::filesystem::directory_iterator(replay, error)) { + if (!entry.is_regular_file(error)) continue; + if (entry.path().filename() == "input") continue; + std::filesystem::copy_file( + entry.path(), entry.path().filename(), + std::filesystem::copy_options::overwrite_existing, error); + } + std::filesystem::remove_all(replay, error); + Map2Check::Log::Info("A KLEE vector completed with zeros reaches the " + "violation (" + std::to_string(replayed) + + " replayed)"); + return true; + } + std::filesystem::remove_all(replay, error); + return false; +} + +void Caller::keepKleeTestsAsSeeds() { + // The latest tests, not the first: KLEE numbers them as states finish, and + // the later ones are the deeper paths the next turn should start from. + std::error_code error; + const std::string kept = seedStore + "/kleeprev"; + std::filesystem::remove_all(kept, error); + std::vector tests; + for (const auto &entry : std::filesystem::directory_iterator( + Map2Check::kleeOutputDir, error)) { + if (entry.path().extension() == ".ktest") { + tests.push_back(entry.path().string()); + } + } + if (tests.empty()) return; + std::sort(tests.begin(), tests.end()); + if (tests.size() > kMaxSeedsFromFuzzer) { + tests.erase(tests.begin(), tests.end() - kMaxSeedsFromFuzzer); + } + std::filesystem::create_directories(kept, error); + for (const std::string &test : tests) { + std::filesystem::copy_file( + test, kept + "/" + std::filesystem::path(test).filename().string(), + std::filesystem::copy_options::overwrite_existing, error); + } +} + unsigned Caller::exportKleeVectorsAsSeeds() { std::error_code error; - std::filesystem::create_directories(Caller::seedDirectory, error); + const std::string aflSeeds = seedStore + "/afl"; + std::filesystem::create_directories(aflSeeds, error); - std::vector> ignored; - unsigned written = 0; - unsigned index = 0; + std::vector tests; for (const auto &entry : std::filesystem::directory_iterator( Map2Check::kleeOutputDir, error)) { - if (entry.path().extension() != ".ktest") continue; + if (entry.path().extension() == ".ktest") { + tests.push_back(entry.path().string()); + } + } + // All of them, not a sample: completed with zeros past their end, some of + // KLEE's partial paths reach the error when the fuzzer runs them -- the + // dry run records them as crashes (sig 06), and that is how the fixed + // hybrid covered eca-* tasks KLEE itself left UNKNOWN. A cap of the 64 + // latest dropped exactly those (R19: 5 eca-* losses of --alternate-engines). + // Calibrating thousands is cheap now that a nondet loop ends on zeros. + std::sort(tests.begin(), tests.end()); + unsigned written = 0; + unsigned index = 0; + for (const std::string &test : tests) { std::vector objects = - Map2Check::readKtestFile(entry.path().string()); + Map2Check::readKtestFile(test); if (objects.empty()) continue; std::vector bytes = Map2Check::ktestToFuzzerBytes(objects); @@ -149,7 +415,7 @@ unsigned Caller::exportKleeVectorsAsSeeds() { // Named by index rather than by content hash: AFL++ renames what it // keeps to its own hash anyway, so a second one here buys nothing. std::ostringstream name; - name << Caller::seedDirectory << "/klee-" << index++; + name << aflSeeds << "/klee-" << index++; std::ofstream out(name.str(), std::ios::binary); if (!out.is_open()) continue; out.write(reinterpret_cast(bytes.data()), @@ -163,24 +429,207 @@ unsigned Caller::exportKleeVectorsAsSeeds() { return written; } -std::string Caller::exportFuzzerVectorAsKtest() { - std::vector objects = - Map2Check::readNonDetLogAsObjects(Map2Check::kleeLogCSV); - if (objects.empty()) return ""; +unsigned Caller::exportFuzzerCorpusAsKtests() { + // Each queue entry is replayed through the witness binary, whose runtime + // logs every nondet read with its type (klee_log.csv) -- which is what a + // .ktest needs and what the fuzzer's raw bytes lack. The replay runs in the + // store's replay/, not here: the witness writes map2check_property and + // friends into its working directory, and a replay must never overwrite a + // violation this phase already recorded. + std::error_code error; + const std::string queue = "afl-out/default/queue"; + const std::string replay = seedStore + "/replay"; + const std::string ktests = seedStore + "/ktest"; + const std::string witness = + std::filesystem::absolute(programHash + "-witness-fuzzed.out", error) + .string(); + if (!std::filesystem::exists(witness, error)) return 0; + + std::vector names; + for (const auto &entry : + std::filesystem::directory_iterator(queue, error)) { + if (entry.is_regular_file(error)) { + names.push_back(entry.path().filename().string()); + } + } + // This round's discoveries replace the last round's: KLEE already ran on + // those, and its own tests from that turn (kleeprev/) carry them forward. + std::filesystem::remove_all(ktests, error); + std::filesystem::create_directories(ktests, error); + + // Bounded as a whole, not only per entry: the replays come out of the KLEE + // phase's budget, so they stop at 5% of the run's budget (at least 2 s). + const auto started = std::chrono::steady_clock::now(); + const auto allowed = std::chrono::duration( + std::max(2.0, 0.05 * static_cast(this->timeout))); + std::set> seen; + unsigned written = 0; + for (const std::string &name : + Map2Check::selectQueueEntries(names, kMaxSeedsFromFuzzer)) { + if (std::chrono::steady_clock::now() - started >= allowed) break; + std::filesystem::remove_all(replay, error); + std::filesystem::create_directories(replay, error); + const std::string input = + std::filesystem::absolute(queue + "/" + name, error).string(); + std::ostringstream command; + command << "cd '" << replay << "' && MAP2CHECK_SEED_REPLAY=1 timeout -k 1 2 '" << witness + << "' < '" << input << "' > /dev/null 2>&1"; + system(command.str().c_str()); + const std::vector objects = + Map2Check::readNonDetLogAsObjects(replay + "/" + + Map2Check::kleeLogCSV); + if (objects.empty()) continue; + if (!Map2Check::isNewVector(Map2Check::ktestToFuzzerBytes(objects), + &seen)) { + continue; + } + if (Map2Check::writeKtestFile( + ktests + "/afl-" + std::to_string(written) + ".ktest", objects)) { + ++written; + } + } + std::filesystem::remove_all(replay, error); + if (written > 0) { + Map2Check::Log::Info("Seeded KLEE with " + std::to_string(written) + + " vectors from AFL++"); + } + return written; +} + +namespace { +/** MAP2CHECK_SLICER_FLAGS / MAP2CHECK_SLICE_CLEANUP: experiment knobs (tacas + * 2d spec), read from the environment so a campaign arm can set them without + * a CLI option nobody else should use. */ +std::string environmentKnob(const char *name) { + const char *value = std::getenv(name); + return value == nullptr ? std::string() : std::string(value); +} +} // namespace + +std::vector> Caller::fuzzerCorpusVectors( + size_t cap) { + std::vector> vectors; std::error_code error; - std::filesystem::create_directories(Caller::seedDirectory, error); - const std::string path = - std::string(Caller::seedDirectory) + "/from-fuzzer.ktest"; - if (!Map2Check::writeKtestFile(path, objects)) return ""; - Map2Check::Log::Info("Seeding KLEE with the fuzzer's vector (" + - std::to_string(objects.size()) + " inputs)"); - return path; + const std::string queue = "afl-out/default/queue"; + const std::string replay = + std::filesystem::absolute("suite-replay", error).string(); + const std::string witness = + std::filesystem::absolute(programHash + "-witness-fuzzed.out", error) + .string(); + if (!std::filesystem::exists(witness, error)) return vectors; + + std::vector names; + for (const auto &entry : std::filesystem::directory_iterator(queue, error)) { + if (entry.is_regular_file(error)) { + names.push_back(entry.path().filename().string()); + } + } + const auto started = std::chrono::steady_clock::now(); + const auto allowed = std::chrono::duration( + std::max(2.0, 0.05 * static_cast(this->timeout))); + std::set> seen; + for (const std::string &name : Map2Check::selectQueueEntries(names, cap)) { + if (std::chrono::steady_clock::now() - started >= allowed) break; + std::filesystem::remove_all(replay, error); + std::filesystem::create_directories(replay, error); + const std::string input = + std::filesystem::absolute(queue + "/" + name, error).string(); + std::ostringstream command; + command << "cd '" << replay + << "' && MAP2CHECK_SEED_REPLAY=1 timeout -k 1 2 '" << witness + << "' < '" << input << "' > /dev/null 2>&1"; + system(command.str().c_str()); + std::vector values = + Map2Check::readNonDetLog(replay + "/" + Map2Check::kleeLogCSV); + if (values.empty() || !seen.insert(values).second) continue; + vectors.push_back(values); + } + std::filesystem::remove_all(replay, error); + return vectors; } bool Caller::runSlicer(const std::string &input, const std::string &output, std::vector primary, bool addRuntimeNames, const std::string &entry, const std::string &label) { + // Sliced once per run, not once per phase: see Map2Check::sliceCachePath. + std::error_code error; + std::string key; + { + std::ifstream in(input, std::ios::binary); + if (in.is_open()) { + std::stringstream content; + content << in.rdbuf(); + key = Map2Check::sliceCacheKey( + content.str(), label, entry, + environmentKnob("MAP2CHECK_SLICER_FLAGS") + "|" + + environmentKnob("MAP2CHECK_SLICE_CLEANUP")); + } + } + const std::string cached = sliceCache + "/" + key + ".bc"; + const std::string failed = sliceCache + "/" + key + ".failed"; + if (!key.empty() && std::filesystem::exists(failed, error)) { + Map2Check::Log::Warning( + "sbt-slicer produced no usable output (cached from an earlier phase) " + "-- analysing the unsliced program"); + return false; + } + if (!key.empty() && std::filesystem::exists(cached, error) && + std::filesystem::copy_file( + cached, output, std::filesystem::copy_options::overwrite_existing, + error)) { + Map2Check::Log::Info("Slice of " + label + + ": reusing the slice from an earlier phase"); + return true; + } + + const bool sliced = + runSlicerUncached(input, output, primary, addRuntimeNames, entry, label); + if (sliced) cleanUpSlice(output); + if (!key.empty() && std::filesystem::exists(Map2Check::slicerBinary())) { + std::filesystem::create_directories(sliceCache, error); + if (sliced) { + std::filesystem::copy_file( + output, cached, std::filesystem::copy_options::overwrite_existing, + error); + } else { + std::ofstream(failed) << label << "\n"; + } + } + return sliced; +} + +void Caller::cleanUpSlice(const std::string &slice) { + const std::string passes = Map2Check::sliceCleanupPasses( + environmentKnob("MAP2CHECK_SLICE_CLEANUP")); + if (passes.empty()) return; + const std::string cleaned = slice + ".clean.bc"; + std::ostringstream command; + // Bounded like the slicer: a pass pipeline over a large module is not + // free, and it runs outside any engine's window. + const unsigned cleanupBudget = static_cast(std::max( + 2.0, std::min(0.05 * this->timeout, + static_cast(remainingSeconds()) - 5.0))); + command << "timeout -k " << Map2Check::killGracePeriod << " " + << cleanupBudget << " " << Map2Check::optBinary << " " << passes + << " " << slice << " -o " << cleaned << " >> slicer.output 2>&1"; + Map2Check::Log::Debug(command.str()); + std::error_code error; + if (system(command.str().c_str()) == 0 && + std::filesystem::exists(cleaned, error) && + std::filesystem::file_size(cleaned, error) > 0) { + std::filesystem::rename(cleaned, slice, error); + if (!error) return; + } + Map2Check::Log::Warning("could not clean up the slice (" + passes + + ") -- keeping it as sliced"); +} + +bool Caller::runSlicerUncached(const std::string &input, + const std::string &output, + std::vector primary, + bool addRuntimeNames, const std::string &entry, + const std::string &label) { const std::string slicer = Map2Check::slicerBinary(); if (!std::filesystem::exists(slicer)) { // Announced, not silently skipped. A slicer that is asked for and absent @@ -247,7 +696,8 @@ bool Caller::runSlicer(const std::string &input, const std::string &output, << static_cast(sliceBudget) << " " << slicer << " -c " << Map2Check::slicingCriteria(primary, programNondets) << " --entry=" << entry - << " -cutoff-diverging=false --statistics -o " << output << " " + << " -cutoff-diverging=false --statistics " + << environmentKnob("MAP2CHECK_SLICER_FLAGS") << " -o " << output << " " << input << " > slicer.output 2>&1"; Map2Check::Log::Debug(command.str()); const int result = system(command.str().c_str()); @@ -351,6 +801,11 @@ bool Caller::sliceInstrumented() { return !error; } +void Caller::restoreWorkingDirectory() { + std::error_code error; + std::filesystem::current_path(currentPath, error); +} + void Caller::cleanGarbage() { std::filesystem::current_path(currentPath); std::ostringstream removeCommand; @@ -373,6 +828,39 @@ void Caller::applyNonDetGenerator() { } case (NonDetGenerator::AFLPlusPlus): { Map2Check::Log::Info("Instrumenting with AFL++"); + // Built once per run: every fuzzer phase recompiles the same modules, + // and on the eca-* programs the three builds take ~24 s -- per phase, + // which under --alternate-engines was most of each fuzzer turn. Keyed by + // the two modules' content, like the slice cache. + const std::vector aflBinaries = { + programHash + "-fuzzed.out", programHash + "-witness-fuzzed.out", + programHash + "-cmplog.out"}; + std::string buildKey; + { + std::ifstream result(programHash + "-result.bc", std::ios::binary); + std::ifstream witness(programHash + "-witness-result.bc", + std::ios::binary); + std::stringstream content; + content << result.rdbuf() << "|" << witness.rdbuf(); + buildKey = Map2Check::sliceCacheKey(content.str(), "afl++", "", ""); + } + const std::string builtDir = buildCache + "/" + buildKey; + { + std::error_code cacheErr; + if (std::filesystem::exists(builtDir + "/" + aflBinaries[0], + cacheErr)) { + for (const std::string &binary : aflBinaries) { + if (std::filesystem::exists(builtDir + "/" + binary, cacheErr)) { + std::filesystem::copy_file( + builtDir + "/" + binary, binary, + std::filesystem::copy_options::overwrite_existing, cacheErr); + } + } + Map2Check::Log::Info( + "AFL++ binaries: reusing the build of an earlier phase"); + break; + } + } std::ostringstream command; command.str(""); @@ -393,24 +881,40 @@ void Caller::applyNonDetGenerator() { 1.0, std::min(0.25 * this->timeout, std::max(1.0, static_cast(remainingSeconds()) - 5.0))); - const std::string bound = "timeout -k " + - std::to_string(Map2Check::killGracePeriod) + - " " + std::to_string(static_cast(compileBudget)) + " "; + // One budget for the three builds, not one each: sequential, each + // bounded by 0.25T, they could take 0.75T -- on eca-* that ran the + // process past its deadline with no verdict (R19). Each build gets what + // is left of the shared deadline. + const auto buildDeadline = + std::chrono::steady_clock::now() + + std::chrono::duration(compileBudget); + auto bound = [&buildDeadline]() { + const double left = std::chrono::duration( + buildDeadline - std::chrono::steady_clock::now()) + .count(); + return "timeout -k " + std::to_string(Map2Check::killGracePeriod) + + " " + std::to_string(std::max(1, static_cast(left))) + " "; + }; command - << bound << Map2Check::aflClangFastBinary() + << bound() << Map2Check::aflClangFastBinary() << " -g " << Caller::postOptimizationFlags() << " -o " + programHash + "-fuzzed.out" - << " " + programHash + "-result.bc"; + << " " + programHash + "-result.bc" + // libm: a program calling sqrt/pow failed to link ("undefined + // reference to `sqrt'") and lost its fuzzer phase (Juliet CWE190/191, + // 9.0 campaign). KLEE gets libm through uClibc; the native links + // did not. + << " -lm > afl-build.log 2>&1"; - system(command.str().c_str()); + const int built = system(command.str().c_str()); std::ostringstream commandWitness; commandWitness.str(""); - commandWitness << bound << Map2Check::aflClangFastBinary() + commandWitness << bound() << Map2Check::aflClangFastBinary() << " -g " << " -o " + programHash + "-witness-fuzzed.out" - << " " + programHash + "-witness-result.bc"; + << " " + programHash + "-witness-result.bc -lm"; system(commandWitness.str().c_str()); @@ -422,21 +926,54 @@ void Caller::applyNonDetGenerator() { // tacasv1 comparison would pit an unarmed AFL++ against an armed // LibFuzzer. Optional: if it does not build, the fuzzer runs without. std::ostringstream commandCmplog; - commandCmplog << "AFL_LLVM_CMPLOG=1 " << bound + commandCmplog << "AFL_LLVM_CMPLOG=1 " << bound() << Map2Check::aflClangFastBinary() << " -g " << Caller::postOptimizationFlags() << " -o " + programHash + "-cmplog.out" - << " " + programHash + "-result.bc"; + << " " + programHash + "-result.bc -lm"; system(commandCmplog.str().c_str()); + { + std::error_code cacheErr; + if (std::filesystem::exists(aflBinaries[0], cacheErr)) { + std::filesystem::create_directories(builtDir, cacheErr); + for (const std::string &binary : aflBinaries) { + if (std::filesystem::exists(binary, cacheErr)) { + std::filesystem::copy_file( + binary, builtDir + "/" + binary, + std::filesystem::copy_options::overwrite_existing, cacheErr); + } + } + } + } + // Announced rather than discovered later as a silent no-op -- the same - // failure mode the sliced arm spent a whole campaign in. + // failure mode the sliced arm spent a whole campaign in. And for what it + // is: a link error (an undefined reach_error) used to be reported as a + // build that ran out of time. std::error_code fuzzErr; if (!std::filesystem::exists(programHash + "-fuzzed.out", fuzzErr)) { + std::string why; + if (built == 31744) { // timeout's 124 + why = "did not build within " + + std::to_string(static_cast(compileBudget)) + "s"; + } else { + std::ifstream buildLog("afl-build.log"); + // The first complaint names the cause (an undefined reference); + // the last is only clang's "linker command failed". + std::string line, firstError; + while (firstError.empty() && std::getline(buildLog, line)) { + if (line.find("error") != std::string::npos || + line.find("undefined reference") != std::string::npos) { + firstError = line; + } + } + why = "failed to build (status " + std::to_string(built) + ")" + + (firstError.empty() ? "" : ": " + firstError); + } Map2Check::Log::Warning( - "the AFL++ binary did not build within " + - std::to_string(static_cast(compileBudget)) + - "s -- skipping the fuzzer phase and leaving the budget to KLEE"); + "the AFL++ binary " + why + + " -- skipping the fuzzer phase and leaving the budget to KLEE"); } else if (!std::filesystem::exists(programHash + "-cmplog.out", fuzzErr)) { Map2Check::Log::Warning( @@ -721,9 +1258,14 @@ void Caller::executeAnalysis(std::string solvername) { // holding the budget to its last second is what turned a decided run // into an ERROR. constexpr double kPostEngineReserve = 5.0; + // With the exchange on, the fuzzer gets a real third phase: 0.2 / 0.6 / + // 0.2. Without it the hybrid keeps the 0.2 / 0.8 it was measured with. + // Alternating (--alternate-engines), main hands each phase its window. + const double kleeShare = this->seedExchange ? 0.6 : 0.8; + const double kleeCap = + this->engineWindow > 0 ? this->engineWindow : kleeShare * this->timeout; const double kleeBudget = std::max( - 1.0, std::min(0.8 * this->timeout, - this->remainingSeconds() - kPostEngineReserve)); + 1.0, std::min(kleeCap, this->remainingSeconds() - kPostEngineReserve)); kleeCommand << "timeout -k " << Map2Check::killGracePeriod << " " << static_cast(kleeBudget) << " "; kleeCommand << Map2Check::kleeBinary; @@ -761,6 +1303,17 @@ void Caller::executeAnalysis(std::string solvername) { << std::max(1u, static_cast(0.875 * kleeBudget)) << "s"; + // KLEE's own default cap is 2,000 MB, well under what a Test-Comp run + // gets; past it KLEE kills states and stops forking, and the run can no + // longer be TRUE. MAP2CHECK_KLEE_MAX_MEMORY (MB) raises it. + if (const char *maxMemory = std::getenv("MAP2CHECK_KLEE_MAX_MEMORY")) { + const std::string megabytes(maxMemory); + if (!megabytes.empty() && + megabytes.find_first_not_of("0123456789") == std::string::npos) { + kleeCommand << " --max-memory=" << megabytes; + } + } + // Halting on the first error is right when there is a property to // decide -- the answer is known, and more exploration is waste. It is @@ -777,10 +1330,44 @@ void Caller::executeAnalysis(std::string solvername) { // from nothing a path the fuzzer already walked -- which under a fixed // budget is not merely faster, it is depth the run would not otherwise // have reached. + // KLEE starts from the fuzzer's corpus when there is one, replaying + // each seed and exploring around it instead of rediscovering from + // nothing the paths the fuzzer already walked. --seed-time caps the + // replay at a quarter of the phase, so seeding cannot eat the search. std::string seedFlag; if (this->seedExchange) { - const std::string seed = exportFuzzerVectorAsKtest(); - if (!seed.empty()) seedFlag = " --seed-file=" + seed; + std::error_code seedError; + bool haveSeeds = false; + for (const auto &entry : std::filesystem::directory_iterator( + seedStore + "/ktest", seedError)) { + if (entry.is_regular_file(seedError)) { + haveSeeds = true; + break; + } + } + // KLEE's own tests from its previous turn, when the engines alternate: + // replaying them rebuilds the frontier it had reached instead of + // rediscovering it. + bool haveOwnSeeds = false; + for (const auto &entry : std::filesystem::directory_iterator( + seedStore + "/kleeprev", seedError)) { + if (entry.is_regular_file(seedError)) { + haveOwnSeeds = true; + break; + } + } + if (haveSeeds || haveOwnSeeds) { + seedFlag = std::string(haveSeeds ? " --seed-dir='" + seedStore + + "/ktest'" + : "") + + (haveOwnSeeds ? " --seed-dir='" + seedStore + "/kleeprev'" + : "") + + " --allow-seed-extension --allow-seed-truncation" + " --seed-time=" + + std::to_string(std::max( + 1u, static_cast(kleeBudget / 4))) + + "s"; + } } // Depth-first for Cover-Branches, and the reason is about what survives @@ -842,8 +1429,16 @@ void Caller::executeAnalysis(std::string solvername) { } Map2Check::Log::Debug(kleeCommand.str()); - int result = system(kleeCommand.str().c_str()); + const auto engineStarted = std::chrono::steady_clock::now(); + int result = runKleeWatched(kleeCommand.str()); + if (this->engineSeconds != nullptr) { + *this->engineSeconds = std::chrono::duration( + std::chrono::steady_clock::now() - + engineStarted) + .count(); + } if (this->seedExchange) { + if (this->stagnationLimit > 0) keepKleeTestsAsSeeds(); // Written after KLEE rather than before the next phase, because the // .ktest files are in the scratch directory that cleanGarbage() will // remove -- and because a later alternation, or a resumed run, should @@ -851,17 +1446,28 @@ void Caller::executeAnalysis(std::string solvername) { exportKleeVectorsAsSeeds(); } Map2Check::Log::Warning("Exited klee with " + std::to_string(result)); + // KLEE found nothing: its vectors, run on natively. Not for + // Cover-Branches, whose goal is no violation. + if (map2checkMode != Map2CheckMode::COVER_BRANCHES_MODE && + !isWitnessFileCreated() && + !Map2Check::hasViolatingKtest(Map2Check::kleeOutputDir)) { + replayKleeVectorsForViolation(); + } if (result == 31744) // Timeout gotTimeout = true; - // KLEE stopping on its own --max-time exits 0, like a run that explored - // every path, but it proves nothing. Treated as the timeout it is: a + // Stopped by us for want of progress: states were left, nothing proved. + if (this->stoppedOnStagnation) gotTimeout = true; + // KLEE exits 0 when its queue empties, like a run that explored every + // path -- also after its timer, a concretized input or states it killed + // itself. None of those proves anything. Treated as the timeout it is: a // violation already recorded is kept, anything else is UNKNOWN -- never // the TRUE a short path's NONE in the property file would otherwise make - // it (a reachable null dereference came back TRUE). - if (Map2Check::kleeHaltedOnTimer(Map2Check::kleeOutputDir)) { - Map2Check::Log::Warning( - "KLEE halted on its timer with states left -- not a complete " - "exploration"); + // it (a reachable null dereference, a float bug, came back TRUE). + const std::string dropped = + Map2Check::kleeDroppedPaths(Map2Check::kleeOutputDir); + if (!dropped.empty()) { + Map2Check::Log::Warning("KLEE " + dropped + + " -- not a complete exploration"); gotTimeout = true; } @@ -887,9 +1493,16 @@ void Caller::executeAnalysis(std::string solvername) { command.str(""); // Against what is LEFT, not against the nominal budget -- see // Caller::remainingSeconds. + // Alternating, the last window can be everything left: keep the same + // reserve KLEE keeps for replaying crashes and writing the suite. const double fuzzerBudget = - std::min(0.2 * this->timeout, - static_cast(this->remainingSeconds())); + this->engineWindow > 0 + ? std::max(1.0, + std::min(this->engineWindow, + static_cast(this->remainingSeconds()) - + 5.0)) + : std::min(0.2 * this->timeout, + static_cast(this->remainingSeconds())); // afl-fuzz needs a non-empty -i dir and a -o dir that does not already // exist (the hybrid may run the fuzzer phase twice). // @@ -900,7 +1513,7 @@ void Caller::executeAnalysis(std::string solvername) { // without one (the previous fuzzer could start from nothing). std::error_code seedErr; const std::string inputDir = - this->seedExchange ? std::string(Caller::seedDirectory) : "afl-in"; + this->seedExchange ? seedStore + "/afl" : std::string("afl-in"); std::filesystem::create_directories(inputDir, seedErr); if (std::filesystem::is_empty(inputDir, seedErr)) { std::ofstream seed(inputDir + "/seed"); @@ -925,6 +1538,11 @@ void Caller::executeAnalysis(std::string solvername) { << " AFL_I_DONT_CARE_ABOUT_MISSING_CRASHES=1" << " AFL_CRASHING_SEEDS_AS_NEW_CRASH=1" << " AFL_BENCH_UNTIL_CRASH=1 "; + // Alternating: the fuzzer hands the rest of its window back as soon as + // it stops finding coverage, and exits 0 doing so -- not a timeout. + if (this->stagnationLimit > 0) { + command << "AFL_EXIT_ON_TIME=" << this->stagnationLimit << " "; + } // Bounded by `timeout` alone, as the previous fuzzer was. Not also by // afl-fuzz -V: that one compares wall-clock (gettimeofday) readings, // and a clock stepped backwards -- measured at over a second under @@ -937,13 +1555,20 @@ void Caller::executeAnalysis(std::string solvername) { const bool hasCmplog = std::filesystem::exists(programHash + "-cmplog.out", cmplogErr); command << Map2Check::aflFuzzBinary() - << " -i " << inputDir + << " -i '" << inputDir << "'" << " -o afl-out"; if (hasCmplog) command << " -c ./" << programHash << "-cmplog.out"; command << " -- ./" << programHash << "-fuzzed.out" << " > fuzzer.output 2>&1"; + const auto engineStarted = std::chrono::steady_clock::now(); int result = system(command.str().c_str()); + if (this->engineSeconds != nullptr) { + *this->engineSeconds = std::chrono::duration( + std::chrono::steady_clock::now() - + engineStarted) + .count(); + } Map2Check::Log::Warning("Exited fuzzer with " + std::to_string(result)); if (result == 31744) // Timeout gotTimeout = true; @@ -982,13 +1607,8 @@ void Caller::executeAnalysis(std::string solvername) { // afl-fuzz never writes back into -i, so under --seed-exchange its // discoveries are copied into seeds/ -- the previous fuzzer grew that // directory in place. Inputs tagged ",orig:" are the seeds it started - // from, already there. - // - // Caveat, inherited unchanged from v15: seeds/ lives in the scratch - // directory, which the next phase's Caller wipes on construction, so - // this corpus does not yet reach the following KLEE or fuzzer phase. - // Making it survive changes what the hybrid measures, and belongs to - // the smart-seeds work, not to the engine swap. + // from, already there. The store is beside the scratch directory, so + // the next fuzzer phase starts from this corpus plus KLEE's vectors. if (this->seedExchange) { std::error_code queueErr; for (const auto &entry : std::filesystem::directory_iterator( @@ -998,10 +1618,16 @@ void Caller::executeAnalysis(std::string solvername) { if (name.find(",orig:") != std::string::npos) continue; std::filesystem::copy_file( entry.path(), - std::string(Caller::seedDirectory) + "/afl-" + name, + seedStore + "/afl/afl-" + name, std::filesystem::copy_options::skip_existing, queueErr); } } + // The fuzzer's corpus for the KLEE phase, unless this phase already + // decided the property. + if (this->seedExchange && this->feedsKleePhase && + !isWitnessFileCreated()) { + exportFuzzerCorpusAsKtests(); + } Map2Check::Log::Debug("Finished fuzzer"); if (isWitnessFileCreated()) { @@ -1093,12 +1719,41 @@ void Caller::compileCFile(bool is_llvm_bc) { << " -Wno-everything " << " -Winteger-overflow " << " -c -emit-llvm -g" - << " " << Caller::preOptimizationFlags() << " -o " << compiledFile + << " " << Caller::preOptimizationFlags() + << (ssaPreoptimization() ? " -Xclang -disable-O0-optnone" : "") + << " -o " << compiledFile << " " << programHash << "-preprocessed.c " << " > " << programHash << "-clang.out 2>&1"; system(command.str().c_str()); + // MAP2CHECK_PREOPT=ssa: the module in SSA form, as Clam's preprocessing + // leaves it. At -O0 clang marks every function optnone and every local + // lives in memory; KLEE then pays a memory object and a solver array per + // variable. A first probe of --add-invariants found that compiling through + // Clam with NO invariant inserted decided a loop program the plain + // pipeline left UNKNOWN (both the safe and the buggy variant) -- the gain + // was the preprocessing, not the invariants. mem2reg only promotes locals + // whose address is never taken; simplifycfg keeps common code unsunk, as + // Clam does. Neither reorders a call, so the nondet order is unchanged. + if (ssaPreoptimization()) { + std::ostringstream ssa; + ssa << Map2Check::optBinary + << " -passes='function(mem2reg,simplifycfg)'" + << " --simplifycfg-sink-common=false " << compiledFile << " -o " + << compiledFile << ".ssa.bc >> " << programHash << "-clang.out 2>&1"; + std::error_code ssaError; + if (system(ssa.str().c_str()) == 0 && + std::filesystem::exists(compiledFile + ".ssa.bc", ssaError)) { + std::filesystem::rename(compiledFile + ".ssa.bc", compiledFile, + ssaError); + } else { + Map2Check::Log::Warning( + "could not bring the module into SSA form -- analysing it as " + "compiled"); + } + } + this->pathprogram = compiledFile; } else { std::string compiledFile = programHash + "-compiled.bc"; @@ -1210,15 +1865,69 @@ void Caller::compileWithClam() { // map2check_crab_assume, which the runtime forwards to klee_assume -- so // nothing downstream needs to change. // See docs/reports/2026-08-16-crabllvm-review.md. - command << Map2Check::clamBinary() << " -o " << compiledFile << " -m 64 -g" + // MAP2CHECK_CLAM_PROFILE=memory: the configuration --add-invariants had + // until 2018-10-19, when it last reached KLEE -- memory contents tracked + // (crab-llvm's --crab-track=arr, Clam's mem) and an invariant after every + // load. From v7.3 on it ran --crab-promote-assume, which emits llvm.assume, + // which NonDetPass does not map and both KLEE 2.1 and 3.1 ignore: the + // invariants of the SV-COMP 2019/2020 builds reached nothing. Measured side + // by side against the default (num, block-entry) before choosing. + // MAP2CHECK_CLAM_PROFILE=none: Clam's pipeline without inserting anything, + // to tell the effect of compiling through Clam from that of the invariants + // (a first probe found the two pulling in opposite directions). + const char *profileEnv = std::getenv("MAP2CHECK_CLAM_PROFILE"); + const std::string profile = profileEnv != nullptr ? profileEnv : "default"; + const bool memoryProfile = profile == "memory"; + const bool noInvariants = profile == "none"; + // Bounded like the slicer: on the eca-* and product-lines programs Clam's + // analysis ran past the whole budget and the run was killed with no verdict + // (R25: 4-7 ERROR per arm). Past the bound, the fallback below compiles the + // program without invariants. + const unsigned clamBudget = static_cast(std::max( + 1.0, std::min(0.2 * this->timeout, + static_cast(remainingSeconds()) - 5.0))); + command << "timeout -k " << Map2Check::killGracePeriod << " " << clamBudget + << " " << Map2Check::clamBinary() << " -o " << compiledFile + << " -m 64 -g" << " --crab-inter" - << " --crab-track=num" - << " --crab-opt=add-invariants" - << " --crab-opt-invariants-loc=block-entry" - << " " << programHash << "-preprocessed.c "; + << (memoryProfile ? " --crab-track=mem" : " --crab-track=num") + << (noInvariants ? " --crab-opt=none" : " --crab-opt=add-invariants") + << (noInvariants ? "" + : memoryProfile ? " --crab-opt-invariants-loc=after-load" + : " --crab-opt-invariants-loc=block-entry") + << " " << programHash << "-preprocessed.c > clam.output 2>&1"; Map2Check::Log::Debug(command.str()); - system(command.str().c_str()); + const int clamResult = system(command.str().c_str()); + + std::error_code error; + if (clamResult != 0 || !std::filesystem::exists(compiledFile, error) || + std::filesystem::file_size(compiledFile, error) == 0) { + // Not the silence of the old path (issue #54): said, and the run goes on + // with the program as it is. + Map2Check::Log::Warning( + "Clam failed (status " + std::to_string(clamResult) + + ") -- analysing the program without invariants"); + compileCFile(false); + return; + } + + // How many invariants went in: the measure of what --add-invariants does. + std::ostringstream disassemble; + disassemble << Map2Check::optBinary << " -S " << compiledFile + << " -o clam-invariants.ll > /dev/null 2>&1"; + unsigned invariants = 0; + if (system(disassemble.str().c_str()) == 0) { + std::ifstream ir("clam-invariants.ll"); + std::string line; + while (std::getline(ir, line)) { + if (line.find("call void @verifier.assume") != std::string::npos) { + ++invariants; + } + } + } + Map2Check::Log::Info("Clam inserted " + std::to_string(invariants) + + " invariant(s) (" + profile + " profile)"); this->pathprogram = compiledFile; } diff --git a/modules/frontend/caller.hpp b/modules/frontend/caller.hpp index eba63101d..49a2530f0 100644 --- a/modules/frontend/caller.hpp +++ b/modules/frontend/caller.hpp @@ -93,9 +93,14 @@ class Caller { * Sizing each phase against what is LEFT keeps the sum inside the budget * however many phases there turn out to be. */ unsigned remainingSeconds() const; + /** remainingSeconds for a budget of `timeout`, without a Caller: what main + * sizes the alternating phases with. */ + static unsigned remainingOf(unsigned timeout); /** @brief Function to compile original C file removing external memory * operations calls */ void compileCFile(bool is_llvm_bc); + /** MAP2CHECK_PREOPT=ssa: compile into SSA form (see compileCFile). */ + bool ssaPreoptimization() const; /** Compiles the input through Clam so the emitted bitcode carries * verifier.assume(invariant) calls. Requires Clam dev16 installed; callers @@ -119,6 +124,11 @@ class Caller { /** Remove generated files for verification */ void cleanGarbage(); + /** Back to the directory map2check was started in, without deleting the + * scratch directory: under --debug the scratch is kept, but the next hybrid + * phase must still start from the same place (the seed store is computed + * from it). */ + void restoreWorkingDirectory(); /** Slice the program with respect to the target before analysing it. * @@ -156,22 +166,26 @@ class Caller { * is a separate decision that has to be earned by its own measurement. */ bool seedExchange = false; - /** Directory the two engines use to hand each other input vectors. - * - * A directory of files rather than a value passed from one phase to the - * next, meant to survive between phases, runs and alternations -- which is - * what time-slicing will need. AFL++ starts from it and its discoveries are - * copied back in after each fuzzer phase (afl-fuzz never writes into its -i - * dir); the KLEE phase drops its own path vectors in. - * - * NOT yet true across phases (same as v15): it sits inside the scratch - * directory, which each phase's Caller recreates empty. Fixing that is part - * of the smart-seeds work (tacasv2/v3), since it changes what the hybrid - * measures. - * - * Relative, because both engines run with the scratch directory as their - * working directory. */ - static constexpr const char* seedDirectory = "seeds"; + /** The seed store, beside the scratch directory: /.seeds with + * afl/ (fuzzer inputs), ktest/ (KLEE seeds) and replay/ (where queue entries + * are replayed). Beside, not inside: every hybrid phase recreates the scratch + * directory, and a store inside it never reached the next phase. Used only + * under --seed-exchange. */ + std::string seedStore; + /** Set by main on the hybrid's first phase: the fuzzer corpus is converted + * into KLEE seeds only when a KLEE phase follows. After the last phase the + * replays would be pure cost against a spent budget. */ + bool feedsKleePhase = false; + const std::string& seedStorePath() const { return seedStore; } + + /** Slices kept across the phases of one run (/.slice); see + * Map2Check::sliceCachePath. Removed by main with the seed store. */ + std::string sliceCache; + const std::string& sliceCachePath() const { return sliceCache; } + /** AFL++ binaries kept across the phases of one run (/.build), + * keyed by the content of the modules they are built from. */ + std::string buildCache; + const std::string& buildCachePath() const { return buildCache; } /** Writes KLEE's per-path vectors into the seed corpus. * @@ -180,12 +194,34 @@ class Caller { * fuzzer down the same path. Returns how many seeds were written. */ unsigned exportKleeVectorsAsSeeds(); - /** Writes what the fuzzer consumed as a .ktest KLEE can start from. - * - * The nondet log is the only record of a fuzzer run carrying both value and - * type, which is what a .ktest needs. Returns the path, or empty. */ - std::string exportFuzzerVectorAsKtest(); - + /** Set by main under --alternate-engines (tacas 3b): the most this phase's + * engine may run, in seconds, instead of its fixed share of the budget (0: + * the fixed shares). */ + double engineWindow = 0; + /** Seconds without new coverage after which the engine is stopped (0: never). + * AFL++ gets it as AFL_EXIT_ON_TIME; KLEE is watched through run.stats. */ + unsigned stagnationLimit = 0; + /** Whether this phase's KLEE was stopped for stagnating: incomplete. */ + bool stoppedOnStagnation = false; + /** Where to report how long this phase's engine ran (main sizes the next + * alternating phase with it); null: not reported. */ + double* engineSeconds = nullptr; + + /** At most this many fuzzer queue entries are converted into KLEE seeds. */ + static constexpr size_t kMaxSeedsFromFuzzer = 64; + + /** Converts the AFL++ queue into typed .ktest seeds for the KLEE phase, by + * replaying each entry through the witness binary inside the seed store's + * replay/ directory. Returns how many seeds were written. */ + unsigned exportFuzzerCorpusAsKtests(); + + /** The fuzzer's corpus as test-case vectors (Cover-Branches): at most `cap` + * queue entries, ranked as for KLEE, each replayed through the witness + * binary for the values it actually reads, duplicates dropped. Bounded like + * the KLEE export (5% of the budget). Empty when no fuzzer ran. */ + std::vector> fuzzerCorpusVectors(size_t cap); + + /** Instrument and execute nondeterministic generator */ void applyNonDetGenerator(); @@ -216,6 +252,25 @@ class Caller { bool runSlicer(const std::string& input, const std::string& output, std::vector primary, bool addRuntimeNames, const std::string& entry, const std::string& label); + /** runSlicer without the slice cache: what actually calls sbt-slicer. */ + bool runSlicerUncached(const std::string& input, const std::string& output, + std::vector primary, + bool addRuntimeNames, const std::string& entry, + const std::string& label); + /** Applies MAP2CHECK_SLICE_CLEANUP to a fresh slice, in place; on failure + * the slice is kept as the slicer wrote it. */ + void cleanUpSlice(const std::string& slice); + /** Runs the KLEE command, stopping it (SIGINT) once it stagnates for + * stagnationLimit seconds; plain system() when the limit is 0 or the build + * has no SQLite to read KLEE's stats with. Returns system()'s status. */ + int runKleeWatched(const std::string& command); + /** Runs KLEE's vectors natively through the fuzzer's witness binary (from + * the build cache), each completed with zeros past its end; true when one + * reached a violation, whose files are then in the scratch directory. */ + bool replayKleeVectorsForViolation(); + /** Keeps KLEE's latest tests (at most kMaxSeedsFromFuzzer) in the seed + * store's kleeprev/, to seed its next turn. */ + void keepKleeTestsAsSeeds(); }; } // namespace Map2Check diff --git a/modules/frontend/map2check.cpp b/modules/frontend/map2check.cpp index 00bb36320..bbb990c1f 100644 --- a/modules/frontend/map2check.cpp +++ b/modules/frontend/map2check.cpp @@ -16,6 +16,7 @@ #include "map2check.hpp" #include +#include #include #include #include @@ -32,6 +33,7 @@ #include "test_suite/ktest_reader.hpp" #include "test_suite/test_suite.hpp" #include "utils/gen_crypto_hash.hpp" +#include "utils/alternation.hpp" #include "utils/log.hpp" #include "utils/sha256.hpp" #include "witness/witness_include.hpp" @@ -150,7 +152,8 @@ void emitTestSuite(const std::string &outputDir, const std::string &programFile, const std::string &entryFunction, const std::string &architecture, const std::string &specification, bool foundViolation, - bool coverBranches, Map2Check::Map2CheckMode mode) { + bool coverBranches, Map2Check::Map2CheckMode mode, + const std::vector> &fuzzerVectors) { Map2Check::TestSuiteMetadata metadata; metadata.producer = std::string("Map2Check ") + Map2CheckVersion; metadata.specification = specification; @@ -176,19 +179,60 @@ void emitTestSuite(const std::string &outputDir, const std::string &programFile, // coversError is false throughout: these vectors are paths, not violations. // The violating one, when there is one, is still in klee_log.csv and still // goes out under Cover-Error. + // + // The cap is on the SUITE, not on this phase: with the engines alternating, + // every KLEE phase adds cases, and later phases replay the vectors earlier + // ones already wrote (seeds) -- those are skipped. if (coverBranches) { - std::vector> vectors = - Map2Check::readKtestVectors(Map2Check::kleeOutputDir, - kMaxBranchTestCases); - for (const std::vector &inputs : vectors) { + // The fuzzer's share first, at most half the suite, so KLEE's paths still + // find room: its corpus is ranked by new edges, the cases a coverage + // metric rewards by construction (on by default; MAP2CHECK_FUZZER_SUITE=0). + // Cases from assumption-pruned paths (see evictPrunedCase) hold no claim + // on the suite: they count toward neither share and give way when full. + size_t fromFuzzer = 0; + for (const std::vector &inputs : fuzzerVectors) { + if (writer.caseCount() - writer.prunedCount() >= + kMaxBranchTestCases / 2) { + break; + } + if (writer.hasTestCase(inputs)) continue; + if (writer.caseCount() >= kMaxBranchTestCases && + !writer.evictPrunedCase()) { + break; + } if (!writer.writeTestCase(inputs, false)) { Map2Check::Log::Warning("could not write test case to " + outputDir); return; } + ++fromFuzzer; + } + if (!fuzzerVectors.empty()) { + Map2Check::Log::Info("Test suite: " + std::to_string(fromFuzzer) + + " test cases from the fuzzer's corpus"); + } + constexpr size_t kMaxKtestsRead = 5000; + std::vector pruned; + std::vector> vectors = Map2Check::readKtestVectors( + Map2Check::kleeOutputDir, kMaxKtestsRead, &pruned); + size_t written = 0; + for (size_t i = 0; i < vectors.size(); ++i) { + const std::vector &inputs = vectors[i]; + if (writer.hasTestCase(inputs)) continue; + // Pruned vectors come last, so once one finds the suite full, all do. + if (writer.caseCount() >= kMaxBranchTestCases && + (pruned[i] || !writer.evictPrunedCase())) { + break; + } + if (!writer.writeTestCase(inputs, false, pruned[i])) { + Map2Check::Log::Warning("could not write test case to " + outputDir); + return; + } + ++written; } Map2Check::Log::Info("Test suite written to " + outputDir + " (" + - std::to_string(vectors.size()) + - " test cases from KLEE paths)"); + std::to_string(written) + + " test cases from KLEE paths, " + + std::to_string(writer.caseCount()) + " in the suite)"); return; } @@ -405,6 +449,16 @@ struct map2check_args { bool generateTestSuite = false; bool coverBranches = false; bool seedExchange = false; + // 1..3 on the hybrid path (fuzzer, KLEE, fuzzer), 0 for a single engine. + int phase = 0; + // --alternate-engines (tacas 3b): the engines take turns, each phase bounded + // by its window and stopped when it stagnates. 0 keeps the fixed shares. + bool alternateEngines = false; + double engineWindow = 0; + unsigned stagnationLimit = 0; + // Whether this phase's fuzzer corpus is converted into seeds for a KLEE + // phase that follows; -1: the fixed hybrid's rule (the first phase only). + int feedsKlee = -1; bool sliceProgram = false; std::string testSuiteDir = "test-suite"; std::string propertyFile; @@ -414,6 +468,78 @@ struct map2check_args { }; bool foundViolation = false; +// Set when a phase proved the property (TRUE). Like a violation, a proof is +// the run's answer: no later phase may run and print a verdict after it. +bool provedSafe = false; +// The seed store of the last phase, removed by main once every phase ran. +static std::string lastSeedStore; +// The slice cache of the last phase, removed by main with the seed store. +static std::string lastSliceCache; +// The AFL++ build cache of the last phase, removed by main likewise. +static std::string lastBuildCache; +// How long the last phase's engine ran; the rest of the phase is setup +// (compile, instrument, link) that no engine window accounts for. +static double lastEngineSeconds = 0; + +int map2check_execution(map2check_args args); + +/** The hybrid under --alternate-engines (tacas 3b spec): the fuzzer and KLEE + * take turns, fuzzer first, until a violation, a proof, or too little time + * for another phase. Each phase is bounded by its window -- doubled every + * round of that engine -- and ends earlier when its engine stagnates, handing + * the rest back. The fixed 0.2/0.6/0.2 split held an engine that had stopped + * progressing to the end of its share, and cut one that still was. */ +int alternateEngines(map2check_args args) { + const double budget = args.timeout; + const unsigned quiet = Map2Check::stagnationSeconds(budget); + unsigned rounds[2] = {0, 0}; + // The setup each engine's phase needed last time (compile, instrument, + // link -- time no window covers): a phase starts only if what is left + // covers its setup plus a stagnation period of engine time, and its window + // leaves the setup out. Per engine and latest, not the maximum: the first + // fuzzer phase builds the AFL++ binaries, the later ones reuse them. + double setup[2] = {0, 0}; + for (int phase = 1;; ++phase) { + const bool klee = (phase % 2 == 0); + const int self = klee ? 1 : 0; + const double left = Map2Check::Caller::remainingOf(args.timeout); + if (phase > 1 && left < quiet + setup[self]) break; + const Map2Check::Engine engine = + klee ? Map2Check::Engine::Klee : Map2Check::Engine::Fuzzer; + const unsigned round = ++rounds[self]; + args.generator = klee ? Map2Check::NonDetGenerator::Klee + : Map2Check::NonDetGenerator::AFLPlusPlus; + args.phase = phase; + args.engineWindow = Map2Check::alternationWindow( + engine, round, budget, std::max(1.0, left - setup[self])); + // Both engines' patience grows with their rounds. KLEE: coverage stops + // rising well before it finishes the paths of a proof. The fuzzer: on the + // eca-* state machines it finds new paths in bursts, and a fixed 15 s cut + // ended its turns at ~17 s where the fixed split gave it 60. + args.stagnationLimit = Map2Check::stagnationSeconds(budget, round); + // Replaying the corpus for a KLEE phase that will not get to run is + // pure cost. + args.feedsKlee = (!klee && left - setup[self] - args.engineWindow >= + quiet + setup[1]) + ? 1 + : 0; + Map2Check::Log::Info("Alternation phase " + std::to_string(phase) + ": " + + (klee ? "KLEE" : "AFL++") + ", window " + + std::to_string(static_cast( + args.engineWindow)) + " s"); + const auto started = std::chrono::steady_clock::now(); + lastEngineSeconds = 0; + const int result = map2check_execution(args); + if (result != SUCCESS) return result; + const double took = std::chrono::duration( + std::chrono::steady_clock::now() - started) + .count(); + setup[self] = std::max(0.0, took - lastEngineSeconds); + if (foundViolation || provedSafe) break; + } + return SUCCESS; +} + int map2check_execution(map2check_args args) { Map2Check::Log::Info("Started Map2Check"); // TODO(rafa.sa.xp@gmail.com): Check current mode @@ -479,6 +605,44 @@ int map2check_execution(map2check_args args) { generator); caller->c_program_fullpath = args.inputFile; caller->seedExchange = args.seedExchange; + // The store is named after the program's content, so one left by an earlier + // run (kept by --debug, or leaked by a kill) would feed that run's seeds into + // this one: every run starts from an empty store. + if (args.seedExchange && args.phase <= 1) { + std::error_code storeError; + std::filesystem::remove_all(caller->seedStorePath(), storeError); + } + // The slice cache likewise: a slice left by an earlier run is keyed by + // content and would be correct, but a ".failed" mark from a run with a + // shorter budget would refuse this one a slice it could afford. + if (args.sliceProgram && args.phase <= 1) { + std::error_code cacheError; + std::filesystem::remove_all(caller->sliceCachePath(), cacheError); + } + if (args.phase <= 1) { + std::error_code cacheError; + std::filesystem::remove_all(caller->buildCachePath(), cacheError); + } + // A run starts from an empty suite. Its phases then add to it (see + // TestSuiteWriter), and a suite left in this directory by an earlier run -- + // possibly of another program -- must not be added to. + if (args.generateTestSuite && args.phase <= 1) { + std::string suiteDir = args.testSuiteDir; + if (!fs::path(suiteDir).is_absolute()) { + suiteDir = caller->getOriginalPath() + "/" + suiteDir; + } + Map2Check::TestSuiteWriter::removeTestCases(suiteDir); + } + // Recorded now, not at the end: an exception in this phase must not leak + // the store or the slice cache past the cleanup in main. + lastSeedStore = caller->seedStorePath(); + lastSliceCache = caller->sliceCachePath(); + lastBuildCache = caller->buildCachePath(); + caller->engineSeconds = &lastEngineSeconds; + caller->feedsKleePhase = + args.feedsKlee >= 0 ? (args.feedsKlee == 1) : (args.phase == 1); + caller->engineWindow = args.engineWindow; + caller->stagnationLimit = args.stagnationLimit; caller->sliceProgram = args.sliceProgram; caller->setTimeout(args.timeout); caller->entryFunction = args.entryFunction; @@ -665,6 +829,7 @@ int map2check_execution(map2check_args args) { } else { Map2Check::Log::Info(""); Map2Check::Log::Info("VERIFICATION SUCCEEDED"); + provedSafe = true; if (args.generateWitness) generate_witness(args.inputFile, propertyViolated, args.spectTrue); } @@ -707,11 +872,23 @@ int map2check_execution(map2check_args args) { if (!fs::path(outputDir).is_absolute()) { outputDir = caller->getOriginalPath() + "/" + outputDir; } + // Cover-Branches used only KLEE's paths: the fuzzer's corpus, the inputs + // that reached new edges, was thrown away with the scratch directory. + // On by default since 9.0 (R22: 49.7% against 44.7% on the fixed hybrid; + // R26: 53.5% with the alternation); MAP2CHECK_FUZZER_SUITE=0 turns it off. + std::vector> fuzzerVectors; + const char *fuzzerSuite = std::getenv("MAP2CHECK_FUZZER_SUITE"); + if (args.coverBranches && + !(fuzzerSuite != nullptr && std::string(fuzzerSuite) == "0") && + generator == Map2Check::NonDetGenerator::AFLPlusPlus) { + fuzzerVectors = caller->fuzzerCorpusVectors(kMaxBranchTestCases); + } emitTestSuite(outputDir, caller->c_program_fullpath, args.entryFunction, args.architecture, resolveSpecification(args.propertyFile, caller->getOriginalPath(), args.mode), - foundViolation, args.coverBranches, args.mode); + foundViolation, args.coverBranches, args.mode, + fuzzerVectors); } // (6) Clean map2check execution (folders and temp files) @@ -720,9 +897,12 @@ int map2check_execution(map2check_args args) { // nondet log -- and deleting it unconditionally makes the pipeline // impossible to inspect after the fact. Debug runs are already opting into // verbosity and disk use. + lastSeedStore = caller->seedStorePath(); + lastSliceCache = caller->sliceCachePath(); if (args.debugMode) { Map2Check::Log::Info("Debug mode: keeping temp files in " + caller->getScratchDir()); + caller->restoreWorkingDirectory(); } else { Map2Check::Log::Debug("Removing temp files"); caller->cleanGarbage(); @@ -776,9 +956,17 @@ z3 (Z3 is default), btor (Boolector), and yices2 (Yices))") "the assertions (--check-asserts) or the runtime checks (--memtrack, " "--memcleanup-property, --check-overflow) before analysing it; needs " "sbt-slicer") + ("alternate-engines", + "\tthe default hybrid (needs --timeout): the fuzzer and KLEE take " + "turns, each stopped once it stops finding coverage, with windows " + "that double every round, handing each other seeds") + ("fixed-hybrid", + "\tthe 8.x hybrid instead: the fuzzer for 0.2 of the budget, then " + "KLEE (with --seed-exchange: 0.2 / 0.6 / 0.2 and a last fuzzer phase)") ("seed-exchange", "\tlet the two engines hand each other input vectors through a shared " - "seed corpus (hybrid runs; off by default)") + "seed corpus (implied by the default hybrid; with --fixed-hybrid, off " + "unless given)") ("cover-branches", "\temit one test case per path KLEE explored, from its .ktest output, " "instead of the single violating vector (Test-Comp Cover-Branches)") @@ -894,6 +1082,33 @@ z3 (Z3 is default), btor (Boolector), and yices2 (Yices))") if (vm.count("seed-exchange")) { args.seedExchange = true; } + // The hybrid is the alternation by default since 9.0: measured on the + // 213-task Cover-Error sample it ties the seed-exchange hybrid (157 each, + // against 128 for the 8.x fixed hybrid) and leads Cover-Branches (53.5% + // against 46.5%, R26). --fixed-hybrid keeps the 8.x schedule. + const bool hybrid = !vm.count("nondet-generator"); + const bool budgeted = + vm.count("timeout") && vm["timeout"].as() > 0; + if (vm.count("fixed-hybrid")) { + if (vm.count("alternate-engines")) { + Map2Check::Log::Warning( + "--fixed-hybrid and --alternate-engines both given -- using the " + "fixed hybrid"); + } + } else if (hybrid && budgeted) { + args.alternateEngines = true; + args.seedExchange = true; + } else if (vm.count("alternate-engines")) { + // Windows and stagnation are fractions of the budget, and turns only + // exist on the hybrid path: without either, say so instead of running + // something else under the flag's name. + Map2Check::Log::Warning( + !budgeted ? "--alternate-engines needs --timeout: its windows are " + "fractions of the budget -- running the fixed hybrid " + "instead" + : "--alternate-engines applies to the hybrid only -- " + "ignored with --nondet-generator"); + } if (vm.count("cover-branches")) { args.coverBranches = true; // The mode has to change too, not just the emitter. Without this the run @@ -974,14 +1189,39 @@ z3 (Z3 is default), btor (Boolector), and yices2 (Yices))") // std::cout << pathfile << std::endl; fs::path absolute_path = fs::absolute(pathfile); args.inputFile = absolute_path.string(); + // The store outlives the phases, not the run: removed on every way out + // of this block (returns and exceptions alike), unless --debug keeps it. + struct SeedStoreCleanup { + const map2check_args &args; + ~SeedStoreCleanup() { + if (args.seedExchange && !args.debugMode && !lastSeedStore.empty()) { + std::error_code storeError; + std::filesystem::remove_all(lastSeedStore, storeError); + } + if (args.sliceProgram && !args.debugMode && !lastSliceCache.empty()) { + std::error_code cacheError; + std::filesystem::remove_all(lastSliceCache, cacheError); + } + if (!args.debugMode && !lastBuildCache.empty()) { + std::error_code cacheError; + std::filesystem::remove_all(lastBuildCache, cacheError); + } + } + } seedStoreCleanup{args}; + if (args.generator == Map2Check::NonDetGenerator::None && + args.alternateEngines) { + return alternateEngines(args); + } if(args.generator == Map2Check::NonDetGenerator::None) { args.generator = Map2Check::NonDetGenerator::AFLPlusPlus; + args.phase = 1; int result = map2check_execution(args); if (result != SUCCESS) { return result; } if (!foundViolation) { args.generator = Map2Check::NonDetGenerator::Klee; + args.phase = 2; result = map2check_execution(args); if (result != SUCCESS) { return result; @@ -1000,8 +1240,9 @@ z3 (Z3 is default), btor (Boolector), and yices2 (Yices))") // Behind the flag: the hybrid was measured at 45% covered over 372 // tasks in its current shape, and that number should keep meaning what // it means until this one is measured beside it. - if (args.seedExchange && !foundViolation) { + if (args.seedExchange && !foundViolation && !provedSafe) { args.generator = Map2Check::NonDetGenerator::AFLPlusPlus; + args.phase = 3; result = map2check_execution(args); if (result != SUCCESS) { return result; diff --git a/modules/frontend/test_suite/ktest_reader.cpp b/modules/frontend/test_suite/ktest_reader.cpp index 9bbf55703..32ae30b00 100644 --- a/modules/frontend/test_suite/ktest_reader.cpp +++ b/modules/frontend/test_suite/ktest_reader.cpp @@ -9,6 +9,7 @@ #include "ktest_reader.hpp" #include +#include #include #include #include @@ -80,6 +81,16 @@ NonDetTypeInfo nonDetTypeInfo(int type) { case 13: return {"non_det_uint", sizeof(unsigned), false, true}; case 14: return {"non_det_short", sizeof(short), false, false}; case 15: return {"non_det_double", sizeof(double), true, false}; + case 16: return {"non_det_float", sizeof(float), true, false}; + case 17: return {"non_det_longlong", sizeof(int64_t), false, false}; + case 18: return {"non_det_ulonglong", sizeof(uint64_t), false, true}; + case 19: return {"non_det_u8", sizeof(uint8_t), false, true}; + case 20: return {"non_det_u16", sizeof(uint16_t), false, true}; + case 21: return {"non_det_u32", sizeof(uint32_t), false, true}; + // 22 (MEMORY_BYTE) is deliberately absent: the runtime logs a + // __VERIFIER_nondet_memory call as one row per byte, KLEE holds it as ONE + // object, and the log does not say where one call's bytes end. The seed + // stops there, as it does at a pchar. default: return {nullptr, 0, false, false}; } } @@ -87,6 +98,16 @@ NonDetTypeInfo nonDetTypeInfo(int type) { /** Encodes a logged decimal value into the object's little-endian bytes. */ void encodeValue(const std::string& text, const NonDetTypeInfo& info, std::vector* out) { + if (info.isFloating && info.width == sizeof(float)) { + float value = 0.0f; + try { + value = std::stof(text); + } catch (const std::exception&) { + value = 0.0f; + } + std::memcpy(out->data(), &value, std::min(out->size(), sizeof(float))); + return; + } if (info.isFloating) { double value = 0.0; try { @@ -146,10 +167,11 @@ int64_t signExtend(uint64_t value, size_t byteWidth) { } bool isUnsignedName(const std::string& name) { - static const char* kUnsigned[] = {"non_det_unsigned", "non_det_uint", - "non_det_ulong", "non_det_ushort", - "non_det_uchar", "non_det_size_t", - "non_det_bool", "non_det_pointer"}; + static const char* kUnsigned[] = { + "non_det_unsigned", "non_det_uint", "non_det_ulong", + "non_det_ushort", "non_det_uchar", "non_det_size_t", + "non_det_bool", "non_det_pointer", "non_det_ulonglong", + "non_det_u8", "non_det_u16", "non_det_u32"}; for (const char* candidate : kUnsigned) { if (name == candidate) return true; } @@ -158,8 +180,9 @@ bool isUnsignedName(const std::string& name) { } // namespace -std::vector readKtestFile(const std::string& path) { +std::vector readKtestFile(const std::string& path, bool* pruned) { std::vector objects; + if (pruned != nullptr) *pruned = false; std::ifstream in(path, std::ios::binary); if (!in.is_open()) return objects; @@ -212,6 +235,10 @@ std::vector readKtestFile(const std::string& path) { // A partial object is dropped, but the ones already read are kept: a // .ktest truncated by a kill still describes a usable prefix of the path, // and the same forgiving rule governs the CSV log. + if (name == kPrunedPathMarker) { + if (pruned != nullptr) *pruned = true; + continue; + } objects.push_back(KtestObject{name, std::move(bytes)}); } @@ -231,6 +258,17 @@ std::string decodeKtestObject(const KtestObject& object) { return text; } + if (object.name == "non_det_float") { + float value = 0.0f; + const size_t width = std::min(object.bytes.size(), sizeof(float)); + std::memcpy(&value, object.bytes.data(), width); + // %.9g round-trips any float, as the CSV log prints it; the validators + // parse it with %f. + char text[32]; + std::snprintf(text, sizeof(text), "%.9g", static_cast(value)); + return text; + } + const uint64_t raw = leBytesToUnsigned(object.bytes); if (isUnsignedName(object.name)) { return std::to_string(raw); @@ -241,6 +279,14 @@ std::string decodeKtestObject(const KtestObject& object) { return std::to_string(signExtend(raw, object.bytes.size())); } +std::vector decodeKtestInputs(const KtestObject& object) { + if (object.name != kMemoryObject) return {decodeKtestObject(object)}; + std::vector inputs; + inputs.reserve(object.bytes.size()); + for (uint8_t byte : object.bytes) inputs.push_back(std::to_string(byte)); + return inputs; +} + std::vector readViolatingKtest(const std::string& kleeOutDir) { std::error_code error; if (!std::filesystem::is_directory(kleeOutDir, error)) return {}; @@ -280,7 +326,8 @@ std::vector readViolatingKtest(const std::string& kleeOutDir) { std::vector inputs; inputs.reserve(objects.size()); for (const KtestObject& object : objects) { - inputs.push_back(decodeKtestObject(object)); + const std::vector decoded = decodeKtestInputs(object); + inputs.insert(inputs.end(), decoded.begin(), decoded.end()); } return inputs; } @@ -318,9 +365,63 @@ bool kleeHaltedOnTimer(const std::string& kleeOutDir) { return false; } +std::string kleeDroppedPaths(const std::string& kleeOutDir) { + if (kleeHaltedOnTimer(kleeOutDir)) return "halted on its timer"; + + const std::filesystem::path dir(kleeOutDir); + std::string line; + std::ifstream warnings((dir / "warnings.txt").string()); + while (std::getline(warnings, line)) { + if (line.find("silently concretizing") != std::string::npos) { + return "concretized a symbolic value"; + } + // Near --max-memory KLEE stops forking and follows one side of each + // branch at random, or kills states outright; either way it can still + // empty its queue and exit 0. + if (line.find("skipping fork") != std::string::npos || + line.find("over memory cap") != std::string::npos) { + return "hit its memory cap"; + } + } + + // KLEE that died (a solver crash, an LLVM assertion, the OOM killer) writes + // none of the marks below and no "done" lines -- while the paths it did + // finish may have written NONE to the property file. + bool finished = false; + std::ifstream info((dir / "info").string()); + while (std::getline(info, line)) { + if (line.find("KLEE: done: completed paths") != std::string::npos) { + finished = true; + break; + } + } + if (!finished) return "did not finish its run"; + + // A state KLEE killed leaves a test with the reason: ..err for + // an error (a model limit, a memory error, an abort that halted the search), + // .early for an early termination (memory cap, depth, ...). Not + // "partially completed paths" in info: that counts the paths an assumption + // pruned too, and read that way no program with an assume_abort_if_not + // could ever be proved. + std::error_code error; + for (const auto& entry : std::filesystem::directory_iterator(dir, error)) { + const std::string name = entry.path().filename().string(); + auto endsWith = [&name](const std::string& suffix) { + return name.size() > suffix.size() && + name.compare(name.size() - suffix.size(), suffix.size(), + suffix) == 0; + }; + if (endsWith(".err") || endsWith(".early")) { + return "terminated states early (" + name + ")"; + } + } + return ""; +} + std::vector> readKtestVectors( - const std::string& kleeOutDir, size_t limit) { + const std::string& kleeOutDir, size_t limit, std::vector* pruned) { std::vector> vectors; + if (pruned != nullptr) pruned->clear(); std::error_code error; if (!std::filesystem::is_directory(kleeOutDir, error)) return vectors; @@ -336,17 +437,27 @@ std::vector> readKtestVectors( } std::sort(paths.begin(), paths.end()); + std::vector> prunedVectors; for (const std::string& path : paths) { if (vectors.size() >= limit) break; - std::vector objects = readKtestFile(path); + bool isPruned = false; + std::vector objects = readKtestFile(path, &isPruned); if (objects.empty()) continue; + if (isPruned && prunedVectors.size() >= limit) continue; std::vector inputs; inputs.reserve(objects.size()); for (const KtestObject& object : objects) { - inputs.push_back(decodeKtestObject(object)); + const std::vector decoded = decodeKtestInputs(object); + inputs.insert(inputs.end(), decoded.begin(), decoded.end()); } + (isPruned ? prunedVectors : vectors).push_back(std::move(inputs)); + } + if (pruned != nullptr) pruned->assign(vectors.size(), false); + for (std::vector& inputs : prunedVectors) { + if (vectors.size() >= limit) break; vectors.push_back(std::move(inputs)); + if (pruned != nullptr) pruned->push_back(true); } return vectors; } @@ -402,14 +513,17 @@ std::vector readNonDetLogAsObjects(const std::string& csvPath) { if (fields.size() < 7) continue; const std::string& value = fields[5]; + // KLEE matches a seed's objects to its inputs by POSITION: a read this + // cannot express (pchar, loff_t, sector_t, or a malformed row) ends the + // seed here. Skipping it shifted every later value onto the wrong input. int type = 0; try { type = std::stoi(fields[6]); } catch (const std::exception&) { - continue; + break; } const NonDetTypeInfo info = nonDetTypeInfo(type); - if (info.name == nullptr) continue; + if (info.name == nullptr) break; KtestObject object; object.name = info.name; diff --git a/modules/frontend/test_suite/ktest_reader.hpp b/modules/frontend/test_suite/ktest_reader.hpp index f9d18febb..86d7d76ec 100644 --- a/modules/frontend/test_suite/ktest_reader.hpp +++ b/modules/frontend/test_suite/ktest_reader.hpp @@ -49,8 +49,17 @@ struct KtestObject { std::vector bytes; }; -/** Parses one .ktest file. Empty on a file that is absent or not a ktest. */ -std::vector readKtestFile(const std::string& path); +/** The object NonDetGeneratorKlee.c makes just before a failed assumption + * ends the path. It carries no input: it only marks the .ktest as a path the + * program itself declared infeasible. */ +constexpr const char* kPrunedPathMarker = "map2check_pruned"; + +/** Parses one .ktest file. Empty on a file that is absent or not a ktest. + * + * The pruned-path marker is never returned as an object; `pruned`, when given, + * says whether the file carried it. */ +std::vector readKtestFile(const std::string& path, + bool* pruned = nullptr); /** Renders one object as the decimal string a element carries. * @@ -59,6 +68,15 @@ std::vector readKtestFile(const std::string& path); * to drop a test case. */ std::string decodeKtestObject(const KtestObject& object); +/** The object NonDetGeneratorKlee.c makes for __VERIFIER_nondet_memory(p, n): + * n bytes in one object. */ +constexpr const char* kMemoryObject = "non_det_memory"; + +/** Renders one object as the elements it stands for: one, except for a + * memory object, which is one uchar input per byte -- how the validators' + * harness reads __VERIFIER_nondet_memory. */ +std::vector decodeKtestInputs(const KtestObject& object); + /** The input vector of the path KLEE flagged as an error, if there is one. * * For Cover-Error, where the suite needs the ONE vector that reaches the bug. @@ -87,14 +105,39 @@ bool hasViolatingKtest(const std::string& kleeOutDir); * NONE to the property file made a reachable null dereference read as TRUE. */ bool kleeHaltedOnTimer(const std::string& kleeOutDir); +/** Why KLEE's exploration was not exhaustive, or empty if it was. + * + * KLEE exits 0 whenever its state queue empties, and that is a proof only if + * no path was dropped on the way. Three ways to drop them, all exit 0: + * - the HaltTimer (see kleeHaltedOnTimer); + * - a symbolic input concretized ("silently concretizing" in warnings.txt): + * a nondet double pinned to 0 left one path and answered TRUE + * (float-benchs/sin_interpolated_index-1); + * - states KLEE killed with its own errors or early exits (a *.err or + * *.early test): a VLA of symbolic size did that in + * loops/insertion_sort-1-2, also answered TRUE. + * Also: KLEE hitting its memory cap ("skipping fork", "over memory cap"), and + * a KLEE that never finished (no "done: completed paths" in info -- a crash). + * A path pruned by an assumption is none of these: it ends in _exit, a + * normal exit, and leaves an ordinary .ktest. */ +std::string kleeDroppedPaths(const std::string& kleeOutDir); + /** Every input vector KLEE recorded under `kleeOutDir`, one per .ktest. * * Ordered by file name, which is KLEE's own path numbering: stable across * runs, so two runs over the same output number their test cases alike. * `limit` bounds the suite. Vectors with no objects are dropped -- a path that - * read no input is not a test case. */ + * read no input is not a test case. + * + * Paths a failed assumption pruned come after every other path. They still + * cover branches -- on a program whose every path meets a failed assumption + * they are the whole suite -- but they are usually shallow, and taken in KLEE's + * order they filled the suite's cap ahead of the deep paths: xcsp/AllInterval + * fell from 95% to 9% coverage. `pruned`, when given, flags each returned + * vector that came from such a path. */ std::vector> readKtestVectors( - const std::string& kleeOutDir, size_t limit); + const std::string& kleeOutDir, size_t limit, + std::vector* pruned = nullptr); /** Serialises objects into the byte stream a fuzzer would consume. * diff --git a/modules/frontend/test_suite/test_suite.cpp b/modules/frontend/test_suite/test_suite.cpp index 488031a99..38a40f979 100644 --- a/modules/frontend/test_suite/test_suite.cpp +++ b/modules/frontend/test_suite/test_suite.cpp @@ -8,6 +8,7 @@ #include "test_suite.hpp" +#include #include #include #include @@ -30,6 +31,10 @@ const char kTestCaseDoctype[] = "\"+//IDN sosy-lab.org//DTD test-format testcase 1.1//EN\" " "\"https://sosy-lab.org/test-format/testcase-1.1.dtd\">"; +/** Marks a case as an assumption-pruned path (see evictPrunedCase). A comment + * is outside the test format, so validators and TestCov ignore it. */ +const char kPrunedComment[] = ""; + /** Field index of the value in a nondet log row. * NonDetLog.c writes: id;line;scope;function_name;step;value;type */ constexpr size_t kValueField = 5; @@ -95,7 +100,88 @@ std::vector readNonDetLog(const std::string& csvPath) { } TestSuiteWriter::TestSuiteWriter(std::string directory) - : directory(std::move(directory)), counter(0) {} + : directory(std::move(directory)), counter(0) { + // After the cases already there: with the engines alternating, more than one + // phase writes into the same suite, and counting from 1 again overwrote the + // earlier phase's cases (tacas 3b spec). + std::error_code ec; + for (const auto& entry : + std::filesystem::directory_iterator(this->directory, ec)) { + const std::string name = entry.path().filename().string(); + static const std::string kPrefix = "testcase-"; + static const std::string kSuffix = ".xml"; + if (name.size() <= kPrefix.size() + kSuffix.size() || + name.compare(0, kPrefix.size(), kPrefix) != 0 || + name.compare(name.size() - kSuffix.size(), kSuffix.size(), kSuffix) != + 0) { + continue; + } + const std::string digits = name.substr( + kPrefix.size(), name.size() - kPrefix.size() - kSuffix.size()); + if (digits.empty() || digits.size() > 9 || + digits.find_first_not_of("0123456789") != std::string::npos) { + continue; + } + this->counter = std::max( + this->counter, static_cast(std::stoul(digits))); + // Its inputs, as written (escaped), so a later phase can skip a vector + // the suite already has. + std::ifstream in(entry.path()); + std::stringstream text; + text << in.rdbuf(); + const std::string xml = text.str(); + std::vector inputs; + static const std::string kOpen = "", kClose = ""; + for (size_t at = xml.find(kOpen); at != std::string::npos; + at = xml.find(kOpen, at)) { + const size_t end = xml.find(kClose, at + kOpen.size()); + if (end == std::string::npos) break; + inputs.push_back(xml.substr(at + kOpen.size(), end - at - kOpen.size())); + at = end + kClose.size(); + } + this->cases.insert(inputs); + if (xml.find(kPrunedComment) != std::string::npos) { + this->prunedCases[inputs] = entry.path(); + } + } +} + +bool TestSuiteWriter::evictPrunedCase() { + if (this->prunedCases.empty()) return false; + auto victim = this->prunedCases.begin(); + std::error_code ec; + std::filesystem::remove(victim->second, ec); + this->cases.erase(victim->first); + this->prunedCases.erase(victim); + return true; +} + +namespace { +std::vector escapedInputs(const std::vector& raw) { + std::vector escaped; + escaped.reserve(raw.size()); + for (const std::string& value : raw) escaped.push_back(escapeXml(value)); + return escaped; +} +} // namespace + +bool TestSuiteWriter::hasTestCase( + const std::vector& inputs) const { + return this->cases.count(escapedInputs(inputs)) > 0; +} + +void TestSuiteWriter::removeTestCases(const std::string& directory) { + std::error_code ec; + std::vector doomed; + for (const auto& entry : std::filesystem::directory_iterator(directory, ec)) { + const std::string name = entry.path().filename().string(); + if (name.rfind("testcase-", 0) == 0 && name.size() > 13 && + name.compare(name.size() - 4, 4, ".xml") == 0) { + doomed.push_back(entry.path()); + } + } + for (const auto& path : doomed) std::filesystem::remove(path, ec); +} bool TestSuiteWriter::writeMetadata(const TestSuiteMetadata& metadata) { std::error_code ec; @@ -128,7 +214,7 @@ bool TestSuiteWriter::writeMetadata(const TestSuiteMetadata& metadata) { } bool TestSuiteWriter::writeTestCase(const std::vector& inputs, - bool coversError) { + bool coversError, bool pruned) { std::error_code ec; std::filesystem::create_directories(this->directory, ec); @@ -138,6 +224,7 @@ bool TestSuiteWriter::writeTestCase(const std::vector& inputs, if (!out.is_open()) return false; out << kXmlDeclaration << "\n" << kTestCaseDoctype << "\n"; + if (pruned) out << kPrunedComment << "\n"; // coversError defaults to "false" in the DTD, so it is only spelled out when // the run actually reached the error. out << (coversError ? "\n" : "\n"); @@ -147,6 +234,11 @@ bool TestSuiteWriter::writeTestCase(const std::vector& inputs, out << " " << escapeXml(value) << "\n"; } out << "\n"; + this->cases.insert(escapedInputs(inputs)); + if (pruned) { + this->prunedCases[escapedInputs(inputs)] = + std::filesystem::path(this->directory) / name; + } out.close(); return out.good(); } diff --git a/modules/frontend/test_suite/test_suite.hpp b/modules/frontend/test_suite/test_suite.hpp index c00007242..74a4d451d 100644 --- a/modules/frontend/test_suite/test_suite.hpp +++ b/modules/frontend/test_suite/test_suite.hpp @@ -29,6 +29,9 @@ #ifndef MODULES_FRONTEND_TEST_SUITE_TEST_SUITE_HPP_ #define MODULES_FRONTEND_TEST_SUITE_TEST_SUITE_HPP_ +#include +#include +#include #include #include @@ -65,12 +68,39 @@ class TestSuiteWriter { /** Writes metadata.xml. False if the file could not be written. */ bool writeMetadata(const TestSuiteMetadata& metadata); - /** Writes testcase-.xml, numbering from 1 in call order. */ - bool writeTestCase(const std::vector& inputs, bool coversError); + /** Writes testcase-.xml, numbering after the cases already in the + * directory (an earlier phase of the same run may have written some). + * + * `pruned` marks the case as a path a failed assumption ended (an XML + * comment, which TestCov ignores), so a later phase can evict it. */ + bool writeTestCase(const std::vector& inputs, bool coversError, + bool pruned = false); + + /** How many test cases the directory holds, written earlier or by this. */ + size_t caseCount() const { return cases.size(); } + /** How many of them are assumption-pruned paths. */ + size_t prunedCount() const { return prunedCases.size(); } + /** Removes one assumption-pruned case to make room for a deeper one. + * + * The suite is written phase by phase under a cap. On xcsp/AllInterval the + * first KLEE phase found only pruned paths and filled the cap with them, and + * the deep paths of the next phase found no room: 95% coverage fell to 9%. + * False when there is no pruned case to remove. */ + bool evictPrunedCase(); + /** Whether a test case with exactly these inputs is already there. */ + bool hasTestCase(const std::vector& inputs) const; + + /** Removes every testcase-.xml from `directory` -- run once, at the start + * of a run, so a suite never mixes cases from an earlier run. */ + static void removeTestCases(const std::string& directory); private: std::string directory; unsigned counter; + /** The inputs of every case in the directory, XML-escaped as written. */ + std::set> cases; + /** The pruned cases among them, with the file each one lives in. */ + std::map, std::filesystem::path> prunedCases; }; } // namespace Map2Check diff --git a/modules/frontend/utils/alternation.hpp b/modules/frontend/utils/alternation.hpp new file mode 100644 index 000000000..e9a41663b --- /dev/null +++ b/modules/frontend/utils/alternation.hpp @@ -0,0 +1,75 @@ +/** + * Copyright (C) 2014 - 2026 Map2Check tool + * This file is part of the Map2Check tool, and is made available under + * the terms of the GNU General Public License version 2. + * + * SPDX-License-Identifier: (GPL-2.0) + **/ + +#ifndef MODULES_FRONTEND_UTILS_ALTERNATION_HPP_ +#define MODULES_FRONTEND_UTILS_ALTERNATION_HPP_ + +#include +#include + +namespace Map2Check { + +/** The two engines --alternate-engines takes turns with (tacas 3b spec). */ +enum class Engine { Fuzzer, Klee }; + +/** The most a phase of `engine` may take in its `round`-th turn (1-based): + * 0.1T for the fuzzer and 0.3T for KLEE, doubled every round, never more than + * what is left. The doubling is what lets an engine the alternation did not + * help come back with more time; an engine that stagnates earlier hands the + * rest back at once. */ +inline double alternationWindow(Engine engine, unsigned round, double budget, + double remaining) { + const double base = (engine == Engine::Fuzzer ? 0.1 : 0.3) * budget; + const double window = base * std::pow(2.0, round > 0 ? round - 1 : 0); + return std::min(window, remaining); +} + +/** How long an engine may go without new coverage before it is stagnant: + * 5% of the budget, at least 10 s (15 s at the Test-Comp 300 s). Also the + * least a phase must have left to be worth starting. */ +inline unsigned stagnationSeconds(double budget) { + return static_cast(std::max(10.0, 0.05 * budget)); +} + +/** KLEE's stagnation period in its `round`-th turn: doubled every round, like + * its window. Instruction coverage stops rising well before KLEE finishes the + * paths that make a proof, and a fixed cut would never let it get there. */ +inline unsigned stagnationSeconds(double budget, unsigned round) { + return stagnationSeconds(budget) * + (1u << std::min(round > 0 ? round - 1 : 0, 8u)); +} + +/** Decides from successive coverage samples whether an engine stagnated: no + * increase for `quietSeconds` since the last one. A sample of -1 means the + * reading failed (KLEE's stats database busy or not written yet) and is no + * evidence either way; the clock starts at the first real sample. */ +class CoverageWatch { + public: + explicit CoverageWatch(double quietSeconds) : quiet(quietSeconds) {} + + bool stagnated(long long covered, double now) { + if (covered < 0) return false; + if (!seen || covered > last) { + seen = true; + last = covered; + since = now; + return false; + } + return now - since >= quiet; + } + + private: + double quiet; + bool seen = false; + long long last = 0; + double since = 0; +}; + +} // namespace Map2Check + +#endif // MODULES_FRONTEND_UTILS_ALTERNATION_HPP_ diff --git a/modules/frontend/utils/gen_crypto_hash.cpp b/modules/frontend/utils/gen_crypto_hash.cpp index 1a26c5d1f..b1683c97d 100644 --- a/modules/frontend/utils/gen_crypto_hash.cpp +++ b/modules/frontend/utils/gen_crypto_hash.cpp @@ -38,6 +38,9 @@ int GenHash::generate_sha1_hash_for_file() { std::stringstream ss; std::ifstream file(this->filepath.c_str(), std::ios::binary | std::ios::ate); std::streamsize size = file.tellg(); + // An unreadable file reads as size -1, which std::vector rejected with a + // bare "cannot create std::vector larger than max_size()". + if (!file.is_open() || size < 0) return -1; file.seekg(0, std::ios::beg); std::vector buffer(size); diff --git a/modules/frontend/utils/seed_store.hpp b/modules/frontend/utils/seed_store.hpp new file mode 100644 index 000000000..23efb5219 --- /dev/null +++ b/modules/frontend/utils/seed_store.hpp @@ -0,0 +1,66 @@ +/** + * Copyright (C) 2014 - 2026 Map2Check tool + * This file is part of the Map2Check tool, and is made available under + * the terms of the GNU General Public License version 2. + * + * SPDX-License-Identifier: (GPL-2.0) + **/ + +#ifndef MODULES_FRONTEND_UTILS_SEED_STORE_HPP_ +#define MODULES_FRONTEND_UTILS_SEED_STORE_HPP_ + +#include +#include +#include +#include +#include + +namespace Map2Check { + +/** Where the engines leave seeds for each other under --seed-exchange. + * + * BESIDE the scratch directory, not inside it: every phase of the hybrid + * builds a new Caller, which recreates the scratch directory empty, and a + * store inside it never reached the next phase (tacasv3a spec, defect 1). */ +inline std::string seedStorePath(const std::string& cwd, + const std::string& programHash) { + return cwd + "/" + programHash + ".seeds"; +} + +/** The AFL++ queue entries to hand to KLEE: only real entries ("id:..."), + * those that reached new edges ("+cov") first, each group in queue order -- + * AFL++ zero-pads the id, so lexicographic order is id order, oldest + * (simplest) first -- and at most `cap` of them, so replaying them cannot eat + * the phase (tacas 3c). Not the seeds the fuzzer started from (",orig:"): + * those are KLEE's own vectors or an earlier round's entries, which KLEE + * already has. */ +inline std::vector selectQueueEntries( + std::vector names, size_t cap) { + names.erase(std::remove_if(names.begin(), names.end(), + [](const std::string& name) { + return name.rfind("id:", 0) != 0 || + name.find(",orig:") != std::string::npos; + }), + names.end()); + std::sort(names.begin(), names.end()); + // Ranked: the entries that reached new edges ("+cov" in AFL++'s name) before + // the ones that only changed hit counts, id order kept inside each group. + std::stable_partition(names.begin(), names.end(), [](const std::string& name) { + return name.find(",+cov") != std::string::npos; + }); + if (names.size() > cap) names.resize(cap); + return names; +} + +/** Whether a converted vector is worth a seed: not empty, and not one already + * written -- many queue entries differ only in bytes the program never reads, + * and they replay to the same typed vector. */ +inline bool isNewVector(const std::vector& bytes, + std::set>* seen) { + if (bytes.empty()) return false; + return seen->insert(bytes).second; +} + +} // namespace Map2Check + +#endif // MODULES_FRONTEND_UTILS_SEED_STORE_HPP_ diff --git a/modules/frontend/utils/slicer.hpp b/modules/frontend/utils/slicer.hpp index 2fe1880a8..4104db9db 100644 --- a/modules/frontend/utils/slicer.hpp +++ b/modules/frontend/utils/slicer.hpp @@ -10,6 +10,7 @@ #define MODULES_FRONTEND_UTILS_SLICER_HPP_ #include +#include #include #include #include @@ -27,9 +28,10 @@ namespace Map2Check { * the program and 10 in the slice; FAILED, NOT_COVERED). Keeping these calls * as criteria keeps the consumption order. * - * The first sixteen are what NonDetPass instruments; the rest are SV-COMP - * names it does not model yet, kept so their order is not lost either. The - * slicer accepts names the program does not use. */ + * All but _Bool and charp are what NonDetPass instruments (the last seven + * since issue #74); those two are SV-COMP names it does not model yet, kept so + * their order is not lost either. The slicer accepts names the program does + * not use. */ inline const std::vector& nondetFunctionNames() { static const std::vector names = { "__VERIFIER_nondet_bool", "__VERIFIER_nondet_char", @@ -43,41 +45,48 @@ inline const std::vector& nondetFunctionNames() { "__VERIFIER_nondet_float", "__VERIFIER_nondet_longlong", "__VERIFIER_nondet_ulonglong", "__VERIFIER_nondet__Bool", "__VERIFIER_nondet_u8", "__VERIFIER_nondet_u16", - "__VERIFIER_nondet_u32", "__VERIFIER_nondet_charp"}; + "__VERIFIER_nondet_u32", "__VERIFIER_nondet_charp", + "__VERIFIER_nondet_memory"}; return names; } -/** Every __VERIFIER_nondet_* symbol in a module's textual IR (`opt -S`), - * in order of first appearance. The fixed list above cannot know every name a - * benchmark declares (int128, uint128, ...), and a name missing from the - * criteria silently brings the shifted suite back. */ -inline std::vector nondetNamesInIR(const std::string& ir) { - static const std::regex symbol(R"(@(__VERIFIER_nondet_[A-Za-z0-9_]+))"); +/** Every symbol `@...` in a module's textual IR, without the '@', in + * order of first appearance. A plain scan, not std::regex: on the eca-* modules + * (megabytes of IR) the regexes took ~45 s, outside every budget, and pushed + * the run past its deadline with no verdict (R19, 4 ERROR of the slice arm). */ +inline std::vector symbolsWithPrefixInIR(const std::string& ir, + const std::string& prefix) { + auto isNameChar = [](char c) { + return std::isalnum(static_cast(c)) || c == '_'; + }; std::vector names; - for (std::sregex_iterator it(ir.begin(), ir.end(), symbol), end; it != end; - ++it) { - const std::string name = (*it)[1]; - if (std::find(names.begin(), names.end(), name) == names.end()) { + const std::string needle = "@" + prefix; + for (size_t at = ir.find(needle); at != std::string::npos; + at = ir.find(needle, at + 1)) { + size_t end = at + 1; + while (end < ir.size() && isNameChar(ir[end])) ++end; + const std::string name = ir.substr(at + 1, end - at - 1); + if (name.size() > prefix.size() && + std::find(names.begin(), names.end(), name) == names.end()) { names.push_back(name); } } return names; } +/** Every __VERIFIER_nondet_* symbol in a module's textual IR (`opt -S`), + * in order of first appearance. The fixed list above cannot know every name a + * benchmark declares (int128, uint128, ...), and a name missing from the + * criteria silently brings the shifted suite back. */ +inline std::vector nondetNamesInIR(const std::string& ir) { + return symbolsWithPrefixInIR(ir, "__VERIFIER_nondet_"); +} + /** Every map2check_* runtime symbol in a module's textual IR, in order of * first appearance. Used as the slicing criteria for the memory properties: * the property is decided by these calls, so none of them may be removed. */ inline std::vector runtimeNamesInIR(const std::string& ir) { - static const std::regex symbol(R"(@(map2check_[A-Za-z0-9_]+))"); - std::vector names; - for (std::sregex_iterator it(ir.begin(), ir.end(), symbol), end; it != end; - ++it) { - const std::string name = (*it)[1]; - if (std::find(names.begin(), names.end(), name) == names.end()) { - names.push_back(name); - } - } - return names; + return symbolsWithPrefixInIR(ir, "map2check_"); } /** Every function a module DECLARES without defining (`declare ... @f(`), in @@ -87,24 +96,38 @@ inline std::vector runtimeNamesInIR(const std::string& ir) { * the runtime checks depends on such a call, so without it as a criterion the * slicer drops the call and the bug with it (CASTLE-787-2: a wrong TRUE). */ inline std::vector externalNamesInIR(const std::string& ir) { - static const std::regex declaration( - R"((?:^|\n)declare [^\n]*?@([A-Za-z0-9_.$]+)\()"); + auto isNameChar = [](char c) { + return std::isalnum(static_cast(c)) || c == '_' || + c == '.' || c == '$'; + }; std::vector names; - for (std::sregex_iterator it(ir.begin(), ir.end(), declaration), end; - it != end; ++it) { - const std::string name = (*it)[1]; - // Intrinsics are not calls into code the slicer could keep -- except the - // memory ones: clang lowers memcpy/memset/memmove (and struct copies) to - // them, and an overflowing copy into a buffer nothing reads again feeds no - // criterion, so it has to be one (the strcpy case again). - if (name.rfind("llvm.", 0) == 0 && name.rfind("llvm.memcpy.", 0) != 0 && - name.rfind("llvm.memmove.", 0) != 0 && - name.rfind("llvm.memset.", 0) != 0) { - continue; - } - if (std::find(names.begin(), names.end(), name) == names.end()) { - names.push_back(name); + size_t line = 0; + while (line < ir.size()) { + size_t next = ir.find('\n', line); + if (next == std::string::npos) next = ir.size(); + if (ir.compare(line, 8, "declare ") == 0) { + const size_t at = ir.find('@', line); + if (at != std::string::npos && at < next) { + size_t end = at + 1; + while (end < next && isNameChar(ir[end])) ++end; + if (end < next && ir[end] == '(') { + const std::string name = ir.substr(at + 1, end - at - 1); + // Intrinsics are not calls into code the slicer could keep -- except + // the memory ones: clang lowers memcpy/memset/memmove (and struct + // copies) to them, and an overflowing copy into a buffer nothing + // reads again feeds no criterion, so it has to be one. + const bool intrinsic = name.rfind("llvm.", 0) == 0 && + name.rfind("llvm.memcpy.", 0) != 0 && + name.rfind("llvm.memmove.", 0) != 0 && + name.rfind("llvm.memset.", 0) != 0; + if (!intrinsic && + std::find(names.begin(), names.end(), name) == names.end()) { + names.push_back(name); + } + } + } } + line = next + 1; } return names; } @@ -224,6 +247,56 @@ inline std::string describeSlice(const std::string& criterion, return text.str(); } +/** Where the slice of each phase is kept for the next ones: /.slice, + * beside the scratch directory for the reason the seed store is (every phase + * recreates the scratch). Holds .bc for a slice, .failed for a slicer + * that failed or timed out -- which the next phase must not pay for again: on + * eca-* the slicer spent 0.2T in phase 1 AND in phase 2, and the run was + * killed past its budget with no suite (R15, 4 ERROR). */ +inline std::string sliceCachePath(const std::string& cwd, + const std::string& programHash) { + return cwd + "/" + programHash + ".slice"; +} + +/** The cache key: FNV-1a (64-bit, hex) over the input bitcode's CONTENT and + * every setting that shapes the slice, so a slice is reused only for the very + * same question. Fields are separated by a byte no name contains. */ +inline std::string sliceCacheKey(const std::string& inputContent, + const std::string& criteriaLabel, + const std::string& entry, + const std::string& slicerFlags) { + uint64_t hash = 14695981039346656037ull; + auto mix = [&hash](const std::string& field) { + for (unsigned char c : field) { + hash ^= c; + hash *= 1099511628211ull; + } + hash ^= 0xff; + hash *= 1099511628211ull; + }; + mix(inputContent); + mix(criteriaLabel); + mix(entry); + mix(slicerFlags); + static const char* digits = "0123456789abcdef"; + std::string key(16, '0'); + for (int i = 15; i >= 0; --i) { + key[i] = digits[hash & 0xf]; + hash >>= 4; + } + return key; +} + +/** The opt arguments for MAP2CHECK_SLICE_CLEANUP (an experiment knob): the dg + * slicer leaves empty blocks and dead functions behind. "light" folds them + * away; "o2" is the full pipeline, which may exploit undefined behaviour and + * is measured, not trusted. Anything else means no cleanup. */ +inline std::string sliceCleanupPasses(const std::string& knob) { + if (knob == "light") return "-passes='function(simplifycfg,dce),globaldce'"; + if (knob == "o2") return "-O2"; + return ""; +} + } // namespace Map2Check #endif // MODULES_FRONTEND_UTILS_SLICER_HPP_ diff --git a/tests/integration/test_testcomp_regressions.sh b/tests/integration/test_testcomp_regressions.sh index 867841422..5842202d3 100755 --- a/tests/integration/test_testcomp_regressions.sh +++ b/tests/integration/test_testcomp_regressions.sh @@ -428,36 +428,44 @@ int main(void) { } EOF -# Off by default: the hybrid's measured behaviour must not change until the -# exchange has earned its place beside it. +# The 8.x fixed hybrid keeps its behaviour: no exchange unless asked. (Since +# 9.0 the default hybrid is the alternation, which exchanges seeds.) ( cd "$WORK/seed" && MAP2CHECK_PATH="$MAP2CHECK_DIR" timeout -k 10 250 "$MAP2CHECK" \ - --target-function --target-function-name reach_error \ + --fixed-hybrid --target-function --target-function-name reach_error \ --debug --timeout 60 seed.c ) > "$WORK/seed/off.log" 2>&1 -scratch_off=$(find "$WORK/seed" -maxdepth 1 -name '*.map2check' -print -quit) -n_off=$(ls "$scratch_off/seeds" 2>/dev/null | wc -l) +# The seed store lives BESIDE the scratch directory (.seeds): every +# hybrid phase recreates the scratch directory, and a store inside it never +# reached the next phase (tacasv3a). +n_off=$(ls -d "$WORK/seed"/*.seeds 2>/dev/null | wc -l) if [ "$n_off" -eq 0 ]; then - ok "no seed corpus without --seed-exchange" + ok "no seed store with --fixed-hybrid and without --seed-exchange" else - fail "default behaviour" "$n_off seeds written without asking" + fail "default behaviour" "a seed store was created without asking" fi rm -rf "$WORK/seed"/*.map2check ( cd "$WORK/seed" && MAP2CHECK_PATH="$MAP2CHECK_DIR" timeout -k 10 300 "$MAP2CHECK" \ --target-function --target-function-name reach_error --seed-exchange \ --debug --timeout 60 seed.c ) > "$WORK/seed/on.log" 2>&1 -scratch_on=$(find "$WORK/seed" -maxdepth 1 -name '*.map2check' -print -quit) +store=$(ls -d "$WORK/seed"/*.seeds 2>/dev/null | head -1) # Only the fuzzer's own discoveries count: the Caller writes a placeholder -# seed into seeds/ itself, so a plain file count would pass with no copy-back. -n_on=$(ls "$scratch_on/seeds" 2>/dev/null | grep -c '^afl-') +# seed itself, so a plain file count would pass with no copy-back. +n_on=$(ls "$store/afl" 2>/dev/null | grep -c '^afl-') +if [ -n "$store" ] && [ "$n_on" -gt 0 ]; then + ok "the fuzzer discoveries reach the seed store beside the scratch ($n_on files)" +else + fail "seed store" "no store beside the scratch directory, or no fuzzer discoveries in it" +fi -# afl-fuzz never writes into its -i dir; the Caller copies its queue back in -# after the fuzzer phase, so the corpus survives the fuzzer process. (It does -# not yet survive into the next phase: each Caller recreates the scratch -# directory -- inherited from v15, left to the smart-seeds work.) -if [ "$n_on" -gt 0 ]; then - ok "the fuzzer discoveries are copied into seeds/ with --seed-exchange ($n_on files)" +# Without --debug the store is removed after the last phase. +rm -rf "$WORK/seed"/*.map2check "$WORK/seed"/*.seeds +( cd "$WORK/seed" && MAP2CHECK_PATH="$MAP2CHECK_DIR" timeout -k 10 300 "$MAP2CHECK" \ + --target-function --target-function-name reach_error --seed-exchange \ + --timeout 60 seed.c ) > "$WORK/seed/on-clean.log" 2>&1 +if [ "$(ls -d "$WORK/seed"/*.seeds 2>/dev/null | wc -l)" -eq 0 ]; then + ok "no seed store is left behind without --debug" else - fail "seed corpus" "nothing kept -- the corpus is still in-memory only" + fail "seed store cleanup" "a *.seeds directory survived a run without --debug" fi # KLEE -> fuzzer: its per-path vectors become seed files. Sound only because @@ -875,6 +883,470 @@ else ok "slicing does not invent an overflow" fi +# --- 26. the fuzzer's corpus reaches KLEE as typed seeds --------------------- +# Each queue entry is replayed through the witness binary (inside the store's +# replay/, so nothing it writes touches the phase), and the typed nondet log +# becomes a .ktest; KLEE starts from the whole set with --seed-dir. The old +# channel read a log from a scratch directory that no longer existed and sent +# at most one vector. +# An unreachable guard (44522 is not a square), so no phase can end the hybrid +# early: the fuzzer phase always hands its corpus over and KLEE always runs +# with it -- the test cannot pass without exercising the channel. +mkdir -p "$WORK/seed2" +cat > "$WORK/seed2/square.c" <<'EOF' +extern void __assert_fail(const char *, const char *, unsigned int, + const char *) __attribute__((__noreturn__)); +void reach_error(void) { __assert_fail("0", "square.c", 3, "reach_error"); } +extern int __VERIFIER_nondet_int(void); +int main(void) { + int a = __VERIFIER_nondet_int(); + int b = __VERIFIER_nondet_int(); + if (a > 100 && a < 300 && b > 0) { + if (a * a == 44522) { reach_error(); } + } + return 0; +} +EOF +( cd "$WORK/seed2" && MAP2CHECK_PATH="$MAP2CHECK_DIR" timeout -k 10 300 "$MAP2CHECK" \ + --target-function --target-function-name reach_error --seed-exchange \ + --debug --timeout 60 square.c ) > "$WORK/seed2/run.log" 2>&1 +n_seeds=$(grep -aoE "Seeded KLEE with [0-9]+ vectors from AFL\+\+" "$WORK/seed2/run.log" \ + | grep -oE "[0-9]+" | head -1) +if [ "${n_seeds:-0}" -gt 0 ] && grep -q -- "--seed-dir=" "$WORK/seed2/run.log"; then + ok "the fuzzer corpus reaches KLEE ($n_seeds seeds via --seed-dir)" +else + fail "fuzzer -> KLEE" "KLEE ran without seeds from the fuzzer" +fi +# The program is safe and KLEE proves it: that proof is the run's answer. The +# third (fuzzer) phase is for runs nothing has decided yet; running it after a +# proof printed UNKNOWN last, and every harness reads the last verdict. +last_verdict=$(grep -aoE "VERIFICATION (FAILED|SUCCEEDED|UNKNOWN)" "$WORK/seed2/run.log" | tail -1) +if [ "$last_verdict" = "VERIFICATION SUCCEEDED" ]; then + ok "a proof from the KLEE phase stays the final verdict under --seed-exchange" +else + fail "exchange verdict" "KLEE proved the program safe but the run ended with [$last_verdict]" +fi + +# --- 27. replaying the corpus must not erase a violation the fuzzer found ---- +mkdir -p "$WORK/seed3" +cat > "$WORK/seed3/easy.c" <<'EOF' +extern void __assert_fail(const char *, const char *, unsigned int, + const char *) __attribute__((__noreturn__)); +void reach_error(void) { __assert_fail("0", "easy.c", 3, "reach_error"); } +extern int __VERIFIER_nondet_int(void); +int main(void) { + int x = __VERIFIER_nondet_int(); + if (x > 1000 && x < 1100) { reach_error(); } + return 0; +} +EOF +( cd "$WORK/seed3" && MAP2CHECK_PATH="$MAP2CHECK_DIR" timeout -k 10 200 "$MAP2CHECK" \ + --target-function --target-function-name reach_error --seed-exchange \ + --timeout 30 easy.c ) > "$WORK/seed3/run.log" 2>&1 +if grep -q "VERIFICATION FAILED" "$WORK/seed3/run.log"; then + ok "a violation found by the fuzzer survives the seed replays" +else + fail "seed replay" "the violation was lost with --seed-exchange" +fi + +# --- 28. the seed store starts clean, and the last phase replays nothing ---- +# The store's name is derived from the program's content, so a store left by +# an earlier run -- a --debug run keeps it on purpose, a killed one leaks it -- +# would feed its seeds into the next run of the same program: it is wiped at +# the start of a run. And the fuzzer's corpus is converted for KLEE only when a +# KLEE phase follows; after the last phase the replays would be pure cost. +mkdir -p "$WORK/seed4" +cat > "$WORK/seed4/safe.c" <<'EOF' +extern void __assert_fail(const char *, const char *, unsigned int, + const char *) __attribute__((__noreturn__)); +void reach_error(void) { __assert_fail("0", "safe.c", 3, "reach_error"); } +extern int __VERIFIER_nondet_int(void); +int main(void) { + int a = __VERIFIER_nondet_int(); + int b = __VERIFIER_nondet_int(); + if (a > 100 && b > a) { b = b - a; } + if (a != a) { reach_error(); } + return b; +} +EOF +( cd "$WORK/seed4" && MAP2CHECK_PATH="$MAP2CHECK_DIR" timeout -k 10 300 "$MAP2CHECK" \ + --target-function --target-function-name reach_error --seed-exchange \ + --debug --timeout 60 safe.c ) > "$WORK/seed4/first.log" 2>&1 +store4=$(ls -d "$WORK/seed4"/*.seeds 2>/dev/null | head -1) +[ -n "$store4" ] && mkdir -p "$store4/ktest" && echo stale > "$store4/ktest/stale-from-an-old-run.ktest" +rm -rf "$WORK/seed4"/*.map2check +( cd "$WORK/seed4" && MAP2CHECK_PATH="$MAP2CHECK_DIR" timeout -k 10 300 "$MAP2CHECK" \ + --target-function --target-function-name reach_error --seed-exchange \ + --debug --timeout 60 safe.c ) > "$WORK/seed4/run.log" 2>&1 +replays=$(grep -c "Seeded KLEE with" "$WORK/seed4/run.log") +if [ -n "$store4" ] && [ ! -e "$store4/ktest/stale-from-an-old-run.ktest" ] && \ + [ "$replays" -le 1 ] && ! grep -q "VERIFICATION FAILED" "$WORK/seed4/run.log"; then + ok "the seed store starts clean and only the first fuzzer phase feeds KLEE" +else + fail "seed store lifecycle" "stale seed kept, $replays conversions, or a safe program reported FALSE" +fi + +# --- 29. an inline "if (!c) abort();" is an assumption, not the end of search -- +# In SV-COMP abort() is not an error: it discards the path. The benchmarks use +# it inline (seq-mthreaded/pals_*: `if(!(i2)) {abort();}`), and KLEE runs with +# --exit-on-error-type=Abort, so the first path violating that assumption ended +# the WHOLE search with exit 0 -- and the run answered TRUE for a program with a +# reachable bug. Measured: every wrong TRUE of the tacasv2 control arm in R15. +mkdir -p "$WORK/abort" +cat > "$WORK/abort/inline.c" <<'EOF' +extern void __assert_fail(const char *, const char *, unsigned int, + const char *) __attribute__((__noreturn__)); +void reach_error(void) { __assert_fail("0", "inline.c", 3, "reach_error"); } +extern void abort(void); +extern int __VERIFIER_nondet_int(void); +int main(void) { + int x = __VERIFIER_nondet_int(); + if (!(x > 0)) { abort(); } + int y = __VERIFIER_nondet_int(); + if (y == x + 1) { ERROR: { reach_error(); abort(); } } + return 0; +} +EOF +( cd "$WORK/abort" && MAP2CHECK_PATH="$MAP2CHECK_DIR" timeout -k 10 200 "$MAP2CHECK" \ + --target-function --target-function-name reach_error --nondet-generator symex \ + --timeout 45 inline.c ) > "$WORK/abort/inline.log" 2>&1 +if grep -q "VERIFICATION FAILED" "$WORK/abort/inline.log"; then + ok "an inline abort() assumption prunes the path and the bug behind it is found" +else + fail "inline abort" "the bug after an inline abort() assumption was not found: $(grep -aoE 'VERIFICATION [A-Z]+' "$WORK/abort/inline.log" | tail -1)" +fi + +# The same shape with no reachable bug must not turn into a violation. +cat > "$WORK/abort/safe.c" <<'EOF' +extern void __assert_fail(const char *, const char *, unsigned int, + const char *) __attribute__((__noreturn__)); +void reach_error(void) { __assert_fail("0", "safe.c", 3, "reach_error"); } +extern void abort(void); +extern int __VERIFIER_nondet_int(void); +int main(void) { + int x = __VERIFIER_nondet_int(); + if (!(x > 0)) { abort(); } + if (x < 0) { ERROR: { reach_error(); abort(); } } + return 0; +} +EOF +( cd "$WORK/abort" && MAP2CHECK_PATH="$MAP2CHECK_DIR" timeout -k 10 200 "$MAP2CHECK" \ + --target-function --target-function-name reach_error --nondet-generator symex \ + --timeout 45 safe.c ) > "$WORK/abort/safe.log" 2>&1 +# And it is still provable: the pruned path is not a dropped one. Reading +# KLEE's "partially completed paths" as dropped paths turned this into UNKNOWN. +if grep -q "VERIFICATION SUCCEEDED" "$WORK/abort/safe.log"; then + ok "an inline abort() assumption does not invent a violation, and is provable" +else + fail "inline abort soundness" "a safe program with an inline abort() assumption: $(grep -aoE 'VERIFICATION [A-Z]+' "$WORK/abort/safe.log" | tail -1), expected SUCCEEDED" +fi + +# --- 30. KLEE finishing after dropping paths is not a proof ----------------- +# KLEE exits 0 whenever its queue empties -- also after pinning a symbolic +# double to 0 ("silently concretizing (reason: floating point)"): one path, +# explored "completely", and float-benchs/sin_interpolated_index-1 came back +# TRUE with a reachable bug. +mkdir -p "$WORK/dropped" +cat > "$WORK/dropped/float.c" <<'EOF2' +extern void __assert_fail(const char *, const char *, unsigned int, + const char *) __attribute__((__noreturn__)); +void reach_error(void) { __assert_fail("0", "float.c", 3, "reach_error"); } +extern double __VERIFIER_nondet_double(void); +int main(void) { + double x = __VERIFIER_nondet_double(); + if (x > 179.5 && x < 180.5) { reach_error(); } + return 0; +} +EOF2 +( cd "$WORK/dropped" && MAP2CHECK_PATH="$MAP2CHECK_DIR" timeout -k 10 200 "$MAP2CHECK" \ + --target-function --target-function-name reach_error --nondet-generator symex \ + --timeout 45 float.c ) > "$WORK/dropped/float.log" 2>&1 +if grep -q "VERIFICATION SUCCEEDED" "$WORK/dropped/float.log"; then + fail "concretized verdict" "TRUE after KLEE concretized the symbolic double" +else + ok "a KLEE run that concretized an input is not reported TRUE" +fi + +# --- 31. the hybrid slices once per run, not once per phase ----------------- +# Every phase recreates the scratch directory, and each used to run sbt-slicer +# again. On eca-* the slicer timed out (0.2T) in phase 1 AND phase 2, the run +# overran its budget and was killed with no suite (R15, 4 ERROR). A slice, or a +# slicer failure, is now kept for the later phases of the same run. +mkdir -p "$WORK/slicecache" +cat > "$WORK/slicecache/safe.c" <<'EOF2' +extern void __assert_fail(const char *, const char *, unsigned int, + const char *) __attribute__((__noreturn__)); +void reach_error(void) { __assert_fail("0", "safe.c", 3, "reach_error"); } +extern int __VERIFIER_nondet_int(void); +int main(void) { + int x = __VERIFIER_nondet_int(); + int y = x > 0 ? x : -x; + if (y < 0 && x > 0) { reach_error(); } + return 0; +} +EOF2 +( cd "$WORK/slicecache" && MAP2CHECK_PATH="$MAP2CHECK_DIR" timeout -k 10 200 "$MAP2CHECK" \ + --debug --slice --target-function --target-function-name reach_error \ + --timeout 30 safe.c ) > "$WORK/slicecache/safe.log" 2>&1 +slicer_runs=$(grep -c "sbt-slicer -c" "$WORK/slicecache/safe.log") +if [ "$slicer_runs" -eq 1 ] && grep -q "reusing the slice from an earlier phase" "$WORK/slicecache/safe.log"; then + ok "a slice is computed once and reused by the later phases" +else + fail "slice cache" "sbt-slicer ran $slicer_runs time(s); reuse logged: $(grep -c 'reusing the slice' "$WORK/slicecache/safe.log")" +fi + +# A slicer failure is remembered too: the VLA makes sbt-slicer fail, and the +# later phases must not pay for it again. +cat > "$WORK/slicecache/vla.c" <<'EOF2' +extern int __VERIFIER_nondet_int(void); +int main(void) { + int n = __VERIFIER_nondet_int(); + if (n > 0 && n < 10) { + int a[n]; + a[0] = 1; + return a[0]; + } + return 0; +} +EOF2 +( cd "$WORK/slicecache" && MAP2CHECK_PATH="$MAP2CHECK_DIR" timeout -k 10 200 "$MAP2CHECK" \ + --debug --memtrack --slice --timeout 30 vla.c ) > "$WORK/slicecache/vla.log" 2>&1 +slicer_runs=$(grep -c "sbt-slicer -c" "$WORK/slicecache/vla.log") +if [ "$slicer_runs" -eq 1 ] && grep -q "no usable output (cached" "$WORK/slicecache/vla.log"; then + ok "a slicer failure is remembered by the later phases" +else + fail "slice failure cache" "sbt-slicer ran $slicer_runs time(s); cached failure logged: $(grep -c 'no usable output (cached' "$WORK/slicecache/vla.log")" +fi + +# --- 32. the fuzzer's input runs out as zeros, not as a replay of itself ----- +# Past the end of the test case the AFL++ generator used to start over from +# its first byte, so `while (__VERIFIER_nondet_int())` fed by the placeholder +# seed "A" never ended: afl-fuzz's dry run timed out on it and the fuzzer +# aborted before its first execution -- on the loop idiom sv-benchmarks is +# full of. Reads past the end now return zero. +mkdir -p "$WORK/aflloop" +cat > "$WORK/aflloop/loop.c" <<'EOF2' +extern void __assert_fail(const char *, const char *, unsigned int, + const char *) __attribute__((__noreturn__)); +void reach_error(void) { __assert_fail("0", "loop.c", 3, "reach_error"); } +extern int __VERIFIER_nondet_int(void); +int main(void) { + while (__VERIFIER_nondet_int()) { + if (__VERIFIER_nondet_int() == 7) { reach_error(); } + } + return 0; +} +EOF2 +( cd "$WORK/aflloop" && MAP2CHECK_PATH="$MAP2CHECK_DIR" timeout -k 10 200 "$MAP2CHECK" \ + --target-function --target-function-name reach_error --nondet-generator afl \ + --timeout 45 loop.c ) > "$WORK/aflloop/loop.log" 2>&1 +if grep -q "VERIFICATION FAILED" "$WORK/aflloop/loop.log"; then + ok "a nondet-driven loop does not hang the fuzzer's dry run" +else + fail "fuzzer on a nondet loop" "expected FAILED, got: $(grep -aoE 'VERIFICATION [A-Z]+' "$WORK/aflloop/loop.log" | tail -1)" +fi + +# --- 33. --alternate-engines takes turns and stops a stagnant KLEE ---------- +# The fixed 0.2/0.6/0.2 split held an engine that had stopped progressing to +# the end of its share. Alternating, each phase ends when its engine stagnates +# and the other gets the time; KLEE stopped that way was left with states, so +# the run is never TRUE, and the whole run stays inside its budget. +mkdir -p "$WORK/alternate" +cat > "$WORK/alternate/grow.c" <<'EOF2' +extern void __assert_fail(const char *, const char *, unsigned int, + const char *) __attribute__((__noreturn__)); +void reach_error(void) { __assert_fail("0", "grow.c", 3, "reach_error"); } +extern int __VERIFIER_nondet_int(void); +int main(void) { + int s = 0; + while (__VERIFIER_nondet_int()) { + if (__VERIFIER_nondet_int() > 0) s += 1; else s += 2; + if (s < 0) { reach_error(); } + } + return 0; +} +EOF2 +t0=$(date +%s) +( cd "$WORK/alternate" && MAP2CHECK_PATH="$MAP2CHECK_DIR" timeout -k 10 200 "$MAP2CHECK" \ + --alternate-engines --target-function --target-function-name reach_error \ + --timeout 60 grow.c ) > "$WORK/alternate/grow.log" 2>&1 +t1=$(date +%s) +phases=$(grep -c "Alternation phase" "$WORK/alternate/grow.log") +if [ "$phases" -ge 3 ] && grep -q "KLEE stagnated" "$WORK/alternate/grow.log" && \ + ! grep -q "VERIFICATION SUCCEEDED" "$WORK/alternate/grow.log" && \ + [ $((t1 - t0)) -le 75 ]; then + ok "the engines alternate, a stagnant KLEE is stopped, no TRUE ($phases phases, $((t1 - t0)) s)" +else + fail "alternation" "phases=$phases stagnated=$(grep -c 'KLEE stagnated' "$WORK/alternate/grow.log") elapsed=$((t1 - t0))s verdict=$(grep -aoE 'VERIFICATION [A-Z]+' "$WORK/alternate/grow.log" | tail -1)" +fi + +# --- 34. memset/memcpy/memmove are checked under LLVM 16's opaque pointers -- +# MemoryTrackPass matched the intrinsics by name, and the names carried the +# pointer types (llvm.memset.p0i8.i64) that LLVM 16 no longer writes +# (llvm.memset.p0.i64): no memory intrinsic clang emitted was checked. +mkdir -p "$WORK/intrinsics" +cat > "$WORK/intrinsics/over.c" <<'EOF2' +#include +#include +int main(void) { + char *p = malloc(8); + if (!p) return 0; + memset(p, 0, 16); + free(p); + return 0; +} +EOF2 +cat > "$WORK/intrinsics/safe.c" <<'EOF2' +#include +#include +struct S { int a[10]; char name[16]; }; +int main(void) { + char s[] = "hello, world"; + struct S x = {{1, 2, 3}, "abc"}, y; + y = x; + char *p = malloc(sizeof s); + if (!p) return 0; + memcpy(p, s, sizeof s); + memmove(p + 1, p, 4); + memset(y.name, 'z', sizeof y.name); + free(p); + return y.a[0] + s[0]; +} +EOF2 +( cd "$WORK/intrinsics" && MAP2CHECK_PATH="$MAP2CHECK_DIR" timeout -k 10 200 "$MAP2CHECK" \ + --memtrack --nondet-generator symex --timeout 45 over.c ) > "$WORK/intrinsics/over.log" 2>&1 +( cd "$WORK/intrinsics" && MAP2CHECK_PATH="$MAP2CHECK_DIR" timeout -k 10 200 "$MAP2CHECK" \ + --memtrack --nondet-generator symex --timeout 45 safe.c ) > "$WORK/intrinsics/safe.log" 2>&1 +if grep -q "FALSE-DEREF" "$WORK/intrinsics/over.log"; then + ok "a memset past the end of a heap block is a FALSE-DEREF" +else + fail "memset intrinsic" "expected FALSE-DEREF, got: $(grep -aoE 'VERIFICATION [A-Z]+' "$WORK/intrinsics/over.log" | tail -1)" +fi +if grep -q "VERIFICATION SUCCEEDED" "$WORK/intrinsics/safe.log"; then + ok "in-bounds memcpy/memmove/memset and struct copies stay TRUE" +else + fail "intrinsics soundness" "safe program: $(grep -aoE 'VERIFICATION [A-Z]+|FALSE[-_A-Z]*' "$WORK/intrinsics/safe.log" | tr '\n' ' ')" +fi + +# --- 35. a fuzzer binary that fails to link says so --------------------------- +# Every missing AFL++ binary was reported as one that "did not build within +# Ns", the budget's fault -- including a link error that no budget would fix. +mkdir -p "$WORK/afllink" +cat > "$WORK/afllink/decl.c" <<'EOF2' +extern void reach_error(void); +extern int __VERIFIER_nondet_int(void); +int main(void) { if (__VERIFIER_nondet_int() == 3) reach_error(); return 0; } +EOF2 +( cd "$WORK/afllink" && MAP2CHECK_PATH="$MAP2CHECK_DIR" timeout -k 10 100 "$MAP2CHECK" \ + --nondet-generator afl --target-function --target-function-name reach_error \ + --timeout 30 decl.c ) > "$WORK/afllink/decl.log" 2>&1 +if grep -q "AFL++ binary failed to build.*undefined reference" "$WORK/afllink/decl.log"; then + ok "a fuzzer link error is reported as one, with its cause" +else + fail "fuzzer link error" "$(grep -a 'AFL++ binary' "$WORK/afllink/decl.log" | head -1)" +fi + +# --- 36. MAP2CHECK_CHECK_CSTRINGS=1: a %s that reads past its buffer is a FALSE-DEREF +# KLEE's uClibc declares printf without defining it, so KLEE runs it as a +# native external call: the read of an unterminated string happened outside +# every check, and Juliet's CWE121 CWE193 "cpy" tasks came back TRUE. The +# strings a %s (or puts) will read are checked before the call. +mkdir -p "$WORK/cstring" +cat > "$WORK/cstring/unterminated.c" <<'EOF2' +#include +#include +int main(void) { + char buf[10]; + char src[11] = "AAAAAAAAAA"; + memcpy(buf, src, strlen(src)); + printf("%s\n", buf); + return 0; +} +EOF2 +cat > "$WORK/cstring/fine.c" <<'EOF2' +#include +#include +#include +int main(void) { + char buf[16] = "hello"; + char *heap = malloc(8); + if (!heap) return 0; + strcpy(heap, "abc"); + printf("%s %s %d %.3s %5s\n", buf, "literal", 42, heap, heap); + puts(buf); + free(heap); + return 0; +} +EOF2 +( cd "$WORK/cstring" && MAP2CHECK_CHECK_CSTRINGS=1 MAP2CHECK_PATH="$MAP2CHECK_DIR" timeout -k 10 200 "$MAP2CHECK" \ + --memtrack --nondet-generator symex --timeout 45 unterminated.c ) > "$WORK/cstring/unterminated.log" 2>&1 +( cd "$WORK/cstring" && MAP2CHECK_CHECK_CSTRINGS=1 MAP2CHECK_PATH="$MAP2CHECK_DIR" timeout -k 10 200 "$MAP2CHECK" \ + --memtrack --nondet-generator symex --timeout 45 fine.c ) > "$WORK/cstring/fine.log" 2>&1 +if grep -q "FALSE-DEREF" "$WORK/cstring/unterminated.log"; then + ok "printing an unterminated buffer with %s is a FALSE-DEREF" +else + fail "%s past the buffer" "expected FALSE-DEREF, got: $(grep -aoE 'VERIFICATION [A-Z]+' "$WORK/cstring/unterminated.log" | tail -1)" +fi +if grep -q "VERIFICATION SUCCEEDED" "$WORK/cstring/fine.log"; then + ok "terminated strings, literals, %.Ns and puts stay TRUE" +else + fail "%s soundness" "fine program: $(grep -aoE 'VERIFICATION [A-Z]+|FALSE[-_A-Z]*' "$WORK/cstring/fine.log" | tr '\n' ' ')" +fi + +# --- 37. MAP2CHECK_FUZZER_SUITE=1: the fuzzer's corpus joins a Cover-Branches suite +# The suite came only from KLEE's paths; the fuzzer's queue -- the inputs that +# reached new edges -- was thrown away with the scratch directory. +mkdir -p "$WORK/fuzzersuite" +cat > "$WORK/fuzzersuite/br.c" <<'EOF2' +extern int __VERIFIER_nondet_int(void); +int main(void) { + int a = __VERIFIER_nondet_int(), b = __VERIFIER_nondet_int(); + int r = 0; + if (a > 100) r += 1; else r -= 1; + if (b == 4242) r += 2; + return r; +} +EOF2 +( cd "$WORK/fuzzersuite" && MAP2CHECK_FUZZER_SUITE=1 MAP2CHECK_PATH="$MAP2CHECK_DIR" \ + timeout -k 10 200 "$MAP2CHECK" --cover-branches --generate-test-suite \ + --timeout 40 br.c ) > "$WORK/fuzzersuite/br.log" 2>&1 +fuzzed=$(grep -aoE "[0-9]+ test cases from the fuzzer's corpus" "$WORK/fuzzersuite/br.log" | grep -oE '^[0-9]+') +dups=$( + for f in "$WORK"/fuzzersuite/test-suite/testcase-*.xml; do grep -o '[^<]*' "$f" | tr '\n' ' '; echo; done | sort | uniq -d | wc -l) +if [ "${fuzzed:-0}" -ge 1 ] && [ "$dups" -eq 0 ]; then + ok "the fuzzer's corpus contributes test cases, without duplicates ($fuzzed)" +else + fail "fuzzer suite" "fuzzer cases=${fuzzed:-0}, duplicate cases=$dups" +fi + +# --- 38. KLEE: a dozen nondet reads still reach a verdict (issue #75) +# The runtime printed its nondet log with the values still symbolic, and +# uClibc's vfprintf forks on every digit: with ten reads KLEE reached the +# target and never finished writing the log -- UNKNOWN on a straight line. +mkdir -p "$WORK/manyreads" +cat > "$WORK/manyreads/many.c" <<'EOF2' +extern void abort(void); +void reach_error(void) {} +extern int __VERIFIER_nondet_int(void); +int main(void) { + int a[12]; + for (int i = 0; i < 12; i++) a[i] = __VERIFIER_nondet_int(); + if (a[0] == 7 && a[11] == 42) { reach_error(); abort(); } + return 0; +} +EOF2 +echo 'CHECK( init(main()), LTL(G ! call(reach_error())) )' > "$WORK/manyreads/prop.prp" +( cd "$WORK/manyreads" && MAP2CHECK_PATH="$MAP2CHECK_DIR" timeout -k 10 200 "$MAP2CHECK" \ + --nondet-generator symex --generate-test-suite --target-function --target-function-name reach_error \ + --property-file prop.prp --timeout 60 many.c ) > "$WORK/manyreads/many.log" 2>&1 +vec=$(grep -ho '[^<]*' "$WORK"/manyreads/test-suite/testcase-*.xml 2>/dev/null | sed 's///' | tr '\n' ' ') +set -- $vec +if grep -q "VERIFICATION FAILED" "$WORK/manyreads/many.log" && [ "$#" -eq 12 ] && [ "$1" = 7 ] && [ "${12}" = 42 ]; then + ok "KLEE alone finds the error behind 12 nondet reads, with the full vector" +else + fail "nondet log explosion" "$(grep -aoE 'VERIFICATION [A-Z]+' "$WORK/manyreads/many.log" | tail -1); vector: $vec" +fi + echo " ---" echo " Results: $PASSED passed, $FAILED failed" [ "$FAILED" -eq 0 ] || exit 1 diff --git a/tests/integration/test_verdict_classifier.sh b/tests/integration/test_verdict_classifier.sh index 6c03c4c73..904e1d5d3 100644 --- a/tests/integration/test_verdict_classifier.sh +++ b/tests/integration/test_verdict_classifier.sh @@ -60,6 +60,22 @@ VERIFICATION UNKNOWN' check "KLEE crash is ERROR, not TIMEOUT" \ ERROR "$HYBRID_CRASH" 0 13 60 +# The fuzzer's crash replayed through the program under test: the program +# segfaults (a nondet-sized alloca), which is what a crash replay is for. Not +# a tool failure -- the tool went on to KLEE and answered. +AFL_REPLAY_CRASH='Executing AFL++ with map2check +Exited fuzzer with 0 +timeout: the monitored command dumped core +Segmentation fault +Note: Could not replicate error +VERIFICATION UNKNOWN +Started Map2Check +Executing Klee with map2check +Exited klee with 0 +VERIFICATION UNKNOWN' +check "a crash replayed from the fuzzer is not ERROR" \ + UNKNOWN "$AFL_REPLAY_CRASH" 0 13 60 + # A definitive verdict still wins even when a phase died along the way. check "verdict survives a crash in the other phase" \ FALSE-OVERFLOW "$HYBRID_CRASH diff --git a/tests/lib/verdict_classifier.sh b/tests/lib/verdict_classifier.sh index 2eaba2b83..2040d0b08 100644 --- a/tests/lib/verdict_classifier.sh +++ b/tests/lib/verdict_classifier.sh @@ -72,7 +72,15 @@ classify_map2check_verdict() { if echo "$output" | grep -E "undefined reference to" | grep -qv "KLEE: WARNING"; then echo "ERROR"; return fi - if echo "$output" | grep -qE "Segmentation fault|dumped core|Aborted \(core dumped\)"; then + # A crash counts where the TOOL crashed. After "Exited fuzzer with" and + # before the next phase, the process that dumps core is the program under + # test, replayed on the fuzzer's crash to confirm it -- that is the program + # crashing, as it should (array-memsafety/*-alloca: a nondet-sized alloca). + if echo "$output" | awk ' + /Exited fuzzer with/ { replay = 1 } + /Started Map2Check/ { replay = 0 } + /Segmentation fault|dumped core|Aborted \(core dumped\)/ { if (!replay) found = 1 } + END { exit !found }'; then echo "ERROR"; return fi diff --git a/tests/memsafety/run_memsafety_evaluation.sh b/tests/memsafety/run_memsafety_evaluation.sh index 59808767a..11676a542 100755 --- a/tests/memsafety/run_memsafety_evaluation.sh +++ b/tests/memsafety/run_memsafety_evaluation.sh @@ -103,7 +103,7 @@ while IFS=$'\t' read -r category program data_model expected subproperty <&3; do # shellcheck disable=SC2086 # the flag strings are word lists on purpose ( cd "$work" && MAP2CHECK_PATH="$MAP2CHECK_DIR" timeout -k 10 $((BUDGET + 30)) \ "$MAP2CHECK" $MODE_FLAGS $EXTRA_FLAGS --architecture "$arch" \ - --timeout "$BUDGET" "$name" ) > "$work/map2check.log" 2>&1 "$work/map2check.log" 2>&1 `/``, so the corpus tracks the +competition's own task structure. A category that expands to no applicable task +gets no seat. + +Selection inside a category is the deterministic, nested bisection order of +`build_corpus.spread_order`, and the manifest is written round-robin, so a run +cut short by its deadline stays balanced. + +Usage: + build_corpus_official.py --property cover-error --total 0 --out ce.tsv + build_corpus_official.py --property cover-branches --total 3500 --out cb.tsv + +`--total 0` means "all applicable tasks" (no sampling). +""" + +import argparse +import glob +import os +import sys +import xml.etree.ElementTree as ET + +HERE = os.path.dirname(os.path.abspath(__file__)) +sys.path.insert(0, HERE) +import build_corpus as bc # noqa: E402 + +OFFICIAL_DEF = os.path.join(HERE, "official", "bench-defs", + "testcov-validate-test-suites-gcc-unformatted.xml") +DEF_DIR = os.path.dirname(OFFICIAL_DEF) + +RUNDEF = { + "cover-error": "Test-Comp26_coverage-error-call", + "cover-branches": "Test-Comp26_coverage-branches", +} + + +def category_name(rawname): + return rawname.rsplit(".", 1)[-1] + + +def set_file(entry, include): + """Where a definition's includesfile/excludesfile lives. + + Includes are all under sv-benchmarks/c. Excludes are either there + (DeviceDriversLinux64Large.set) or beside the definition (the ECA one), + referenced relative to it. + """ + entry = entry.strip() + if include or entry.startswith("../sv-benchmarks/c/"): + return os.path.join(bc.BENCH, os.path.basename(entry)) + return os.path.join(DEF_DIR, entry) + + +def read_set(path): + """Every .yml a set file names, resolved relative to sv-benchmarks/c.""" + paths = set() + if not os.path.isfile(path): + print(" (missing set file: %s)" % path, file=sys.stderr) + return paths + with open(path) as handle: + for line in handle: + line = line.strip() + if not line or line.startswith("#"): + continue + for hit in glob.glob(os.path.join(bc.BENCH, line)): + paths.add(os.path.realpath(hit)) + return paths + + +def applicable_categories(rundefinition, property_name): + """category -> applicable task tuples, in the definition's own order.""" + root = ET.parse(OFFICIAL_DEF).getroot() + run = next((r for r in root.findall("rundefinition") + if r.get("name") == rundefinition), None) + if run is None: + sys.exit("no rundefinition %s in %s" % (rundefinition, OFFICIAL_DEF)) + pools = {} + for tasks in run.findall("tasks"): + category = category_name(tasks.get("name")) + included = set() + for e in tasks.findall("includesfile"): + included |= read_set(set_file(e.text, True)) + excluded = set() + for e in tasks.findall("excludesfile"): + excluded |= read_set(set_file(e.text, False)) + rows = [] + for yml in sorted(included - excluded): + info = bc.task_info(yml, property_name) + if info is not None: + rows.append((yml,) + info) + if rows: + pools[category] = rows + return pools + + +def proportional_alloc(sizes, total): + """Quota per category: proportional to size, at least 1, at most size. + + Largest-remainder rounding, so the quotas add up to `total` (or to the whole + pool when that is smaller). + """ + pool = sum(sizes.values()) + target = pool if total <= 0 else min(total, pool) + categories = list(sizes) + if target <= 0: + return {c: 0 for c in categories} + if target < len(categories): + # Fewer seats than categories: keep the largest categories. + keep = set(sorted(categories, key=lambda c: (-sizes[c], c))[:target]) + return {c: (1 if c in keep else 0) for c in categories} + + ideal = {c: target * sizes[c] / pool for c in categories} + quotas = {} + for c in categories: + floor = int(ideal[c]) + quotas[c] = min(sizes[c], max(1, floor)) + short = target - sum(quotas.values()) + + # Largest fractional remainder takes the surplus, smallest gives back the + # overshoot, never below one seat and never above the pool. + if short != 0: + if short > 0: + order = sorted(categories, + key=lambda c: (-(ideal[c] - int(ideal[c])), -sizes[c], c)) + move = 1 + else: + order = sorted(categories, + key=lambda c: (ideal[c] - int(ideal[c]), sizes[c], c)) + move = -1 + guard = 0 + limit = len(order) * (max(sizes.values()) + 2) + while short != 0 and guard < limit: + for c in order: + if short == 0: + break + if move > 0 and quotas[c] < sizes[c]: + quotas[c] += 1 + short -= 1 + elif move < 0 and quotas[c] > 1: + quotas[c] -= 1 + short += 1 + guard += 1 + if short != 0: + sys.exit("proportional_alloc: could not reach target %d (off by %d)" + % (target, short)) + return quotas + + +def main(): + parser = argparse.ArgumentParser(description=__doc__, + formatter_class=argparse.RawDescriptionHelpFormatter) + parser.add_argument("--property", choices=sorted(RUNDEF), required=True) + parser.add_argument("--total", type=int, default=0, + help="target corpus size; 0 = all applicable") + parser.add_argument("--out", required=True) + args = parser.parse_args() + + if not os.path.isdir(bc.BENCH): + sys.exit("sv-benchmarks not found at %s" % bc.BENCH) + if not os.path.isfile(OFFICIAL_DEF): + sys.exit("official definition not found at %s" % OFFICIAL_DEF) + + pools = applicable_categories(RUNDEF[args.property], args.property) + sizes = {c: len(v) for c, v in pools.items()} + quotas = proportional_alloc(sizes, args.total) + + per_category = {} + print("%-45s %6s %6s" % ("category", "pool", "chosen")) + total = 0 + for category, rows in pools.items(): + chosen = bc.spread_order(rows)[:quotas[category]] + per_category[category] = [ + (category, os.path.relpath(program, bc.BENCH), data_model, + expected or "unknown") + for yml, program, data_model, expected, subproperty in chosen + ] + print("%-45s %6d %6d" % (category, sizes[category], len(chosen))) + total += len(chosen) + + depth = max((len(v) for v in per_category.values()), default=0) + rows = [] + for i in range(depth): + for category in pools: # round-robin, the definition's order + bucket = per_category[category] + if i < len(bucket): + rows.append(bucket[i]) + + with open(args.out, "w") as handle: + handle.write("# category\tprogram\tdata_model\texpected_unreach\n") + for row in rows: + handle.write("\t".join(row) + "\n") + print("total: %d tasks -> %s" % (len(rows), args.out)) + + +if __name__ == "__main__": + main() diff --git a/tests/testcomp/corpus/cover-branches-3500.tsv b/tests/testcomp/corpus/cover-branches-3500.tsv new file mode 100644 index 000000000..719e8f8e6 --- /dev/null +++ b/tests/testcomp/corpus/cover-branches-3500.tsv @@ -0,0 +1,3501 @@ +# category program data_model expected_unreach +Arrays array-fpi/s52iff_overflow.c ILP32 unknown +BitVectors bitvector/s3_clnt_3.BV.c.cil-1.c ILP32 unknown +ControlFlow openssl-simplified/s3_srvr_1a.cil.c ILP32 unknown +ECA eca-rers2012/Problem16_label00.c ILP32 false +Floats neural-networks/dubinsrejoin_79_safe.c-amalgamation.i ILP32 true +Hardness hardness/hardness_kloop_100_1loop_file-99.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.gear.1.prop3-back-serstep.c LP64 false +Heap list-ext2-properties/simple_search_value-2.i ILP32 false +Loops nla-digbench-scaling/fermat2-ll_unwindbound1.c ILP32 false +ProductLines product-lines/email_spec1_product20.cil.c ILP32 false +Recursive recursified_nla-digbench/recursified_prod4br.c ILP32 unknown +Sequentialized seq-mthreaded/pals_lcr.6.ufo.BOUNDED-12.pals.c ILP32 true +XCSP xcsp/Haystacks-08.c ILP32 true +Combinations combinations/pals_lcr.3_overflow.ufo.UNBOUNDED.pals+Problem12_label09.c ILP32 False +SoftwareSystems-AWS-C-Common aws-c-common/aws_hash_callback_c_str_eq_harness_negated.i LP64 false +SoftwareSystems-BusyBox busybox-1.22.0/printf-3.i LP64 unknown +SoftwareSystems-coreutils coreutils-v8.31/od_3args_klee-sa_ko_496_csa_nd.c LP64 unknown +SoftwareSystems-OpenBSD openbsd-6.2/if_etherip-fixed.i LP64 true +SoftwareSystems-DeviceDriversLinux64 ldv-linux-3.4-simple/43_1a_cilled_ok_nondet_linux-43_1a-drivers--media--common--tuners--mt2131.ko-ldv_main0_sequence_infinite_withcheck_stateful.cil.out.i LP64 true +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_key_freeid__unconstrained__cover_exit_unsuccess_havoc_object.i LP64 false +SoftwareSystems-uthash uthash-2.0.2/uthash_JEN_nondet_test3-1.i ILP32 true +SoftwareSystems-SQLite sqlite/sqlite_merged_comb.i LP64 unknown +Termination-BitVectors termination-bwb/not-03.c LP64 unknown +Termination-MainControlFlow termination-crafted/NestedRecursion_2a.c LP64 unknown +Termination-MainHeap termination-memory-alloca/a.07-alloca.i LP64 unknown +Arrays array-examples/standard_two_index_08.i ILP32 true +BitVectors bitvector/jain_2-2.c ILP32 unknown +ControlFlow ntdrivers/diskperf.i.cil-2.c ILP32 false +ECA eca-rers2012/Problem07_label00.c ILP32 true +Floats floats-esbmc-regression/ceil_nondet.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_cn_file-188.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.cal212.c LP64 true +Heap ldv-memsafety/memleaks_test20-1.i ILP32 unknown +Loops loops/bubble_sort-1.c ILP32 unknown +ProductLines product-lines/elevator_spec3_product25.cil.c ILP32 true +Recursive recursified_nla-digbench/recursified_cohendiv.c ILP32 unknown +Sequentialized seq-mthreaded/pals_floodmax.5.2.ufo.UNBOUNDED.pals.c ILP32 false +XCSP xcsp/Dubois-017.c ILP32 true +Combinations combinations/Problem05_label48+token_ring.04.cil-1.c ILP32 False +SoftwareSystems-AWS-C-Common aws-c-common/aws_byte_buf_from_empty_array_harness_negated.i LP64 false +SoftwareSystems-BusyBox busybox-1.22.0/fold-1.i LP64 unknown +SoftwareSystems-coreutils coreutils-v8.31/env_3args_klee-sa_ko_812-816-605_csa_nd.c LP64 unknown +SoftwareSystems-DeviceDriversLinux64 ldv-linux-3.4-simple/32_1_cilled_ok_nondet_linux-3.4-32_1-drivers--media--rc--keymaps--rc-msi-digivox-ii.ko-ldv_main0_sequence_infinite_withcheck_stateful.cil.out.i LP64 true +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_addcx__invalid_input_tdr_pa__cover_proof_havoc_memory.i LP64 false +SoftwareSystems-uthash uthash-2.0.2/uthash_JEN_nondet_test1-2.i ILP32 true +Termination-BitVectors termination-bwb/and-05.c LP64 unknown +Termination-MainControlFlow termination-crafted-lit/HeizmannHoenickeLeikePodelski-ATVA2013-Fig4.c LP64 unknown +Termination-MainHeap termination-dietlibc/atoll.i LP64 unknown +Arrays array-multidimensional/copy-partial-2-n-u.c ILP32 true +BitVectors bitvector/soft_float_1-2a.c.cil.c ILP32 true +ControlFlow openssl/s3_srvr.blast.07.i.cil-1.c ILP32 unknown +ECA eca-rers2018/Problem14.c ILP32 false +Floats neural-networks/poly_256_thresh_3_unsafe.c-amalgamation.i ILP32 false +Hardness hardness/hardness_operatoramount_amount25_file-188.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.pgm_protocol.6.prop2-func-interl.c LP64 true +Heap memsafety-cve/libredwg.i ILP32 unknown +Loops nla-digbench-scaling/lcm2_unwindbound10.c ILP32 true +ProductLines product-lines/email_spec6_product15.cil.c ILP32 false +Recursive recursive-simple/sum_non_eq-3.c ILP32 false +Sequentialized seq-mthreaded/pals_opt-floodmax.5.3.ufo.BOUNDED-10.pals.c ILP32 false +XCSP xcsp/aim-100-3-4-sat-3.c ILP32 false +Combinations combinations/pals_lcr.8.ufo.UNBOUNDED.pals+Problem12_label07.c ILP32 False +SoftwareSystems-AWS-C-Common aws-c-common/aws_priority_queue_capacity_harness.i LP64 true +SoftwareSystems-BusyBox busybox-1.22.0/tee-1.i LP64 unknown +SoftwareSystems-coreutils coreutils-v9.5-units/getlimits_decimal_absval_add_one_all_nines_cover_proof.i LP64 false +SoftwareSystems-DeviceDriversLinux64 ldv-linux-3.4-simple/43_1a_cilled_ok_nondet_linux-43_1a-drivers--media--rc--keymaps--rc-nebula.ko-ldv_main0_sequence_infinite_withcheck_stateful.cil.out.i LP64 true +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_config__unexpected__cover_entry_havoc_memory.i LP64 false +Termination-BitVectors termination-bwb/or-03.c LP64 unknown +Termination-MainControlFlow termination-nla/prod4br-both-t.c ILP32 unknown +Termination-MainHeap termination-memory-alloca/openbsd_cmemchr-alloca-1.i LP64 unknown +Arrays array-examples/sanfoundry_24-1.i ILP32 true +BitVectors bitvector/byte_add_1-2.i ILP32 unknown +ControlFlow ntdrivers-simplified/cdaudio_simpl1.cil-2.c ILP32 unknown +ECA eca-rers2012/Problem03_label00.c ILP32 true +Floats float-newlib/double_req_bl_1231b.c ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_ci_file-142.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.brp2.3.prop3-func-interl.c LP64 true +Heap heap-data/shared_mem1.i ILP32 true +Loops loop-simple/nested_2.c ILP32 true +ProductLines product-lines/elevator_spec2_product01.cil.c ILP32 true +Recursive recursified_loop-crafted/recursified_simple_array_index_value_4.i.v+lhb-reducer.c ILP32 unknown +Sequentialized seq-mthreaded/pals_floodmax.3.3.ufo.UNBOUNDED.pals.c ILP32 false +XCSP xcsp/AllInterval-019.c ILP32 false +Combinations combinations/Problem05_label44+token_ring.02.cil-1.c ILP32 False +SoftwareSystems-AWS-C-Common aws-c-common/aws_array_list_pop_back_harness_negated.i LP64 false +SoftwareSystems-BusyBox busybox-1.22.0/cut-3.i LP64 true +SoftwareSystems-coreutils coreutils-v8.31/cut_3args_klee-sa_ko_358_csa_nd.c LP64 unknown +SoftwareSystems-DeviceDriversLinux64 ldv-linux-3.4-simple/32_1_cilled_ok_nondet_linux-3.4-32_1-drivers--media--rc--keymaps--rc-cinergy.ko-ldv_main0_sequence_infinite_withcheck_stateful.cil.out.i LP64 true +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_vp_enter__invalid_input_gpa__cover_entry_havoc_object.i LP64 false +Termination-BitVectors termination-bwb/and-02-false.c LP64 unknown +Termination-MainControlFlow termination-crafted-lit/ChenFlurMukhopadhyay-SAS2012-Ex1.05.c LP64 unknown +Termination-MainHeap termination-15/cstrcpy_mixed_alloca.i LP64 unknown +Arrays array-fpi/modpf.c ILP32 false +BitVectors bitvector/s3_clnt_1.BV.c.cil-1.c ILP32 unknown +ControlFlow openssl-simplified/s3_clnt_2.cil-2.c ILP32 unknown +ECA eca-rers2012/Problem11_label00.c ILP32 false +Floats neural-networks/cartpole_7_safe.c-amalgamation.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_co_file-53.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.circular_pointer_top_w64_d128_e0.c LP64 false +Heap ldv-regression/test19.c ILP32 true +Loops nla-digbench-scaling/dijkstra-u_unwindbound10.c ILP32 false +ProductLines product-lines/email_spec0_product33.cil.c ILP32 false +Recursive recursified_nla-digbench/recursified_geo1-u.c ILP32 unknown +Sequentialized seq-mthreaded/pals_lcr-var-start-time.5.ufo.BOUNDED-10.pals.c ILP32 true +XCSP xcsp/Dubois-040.c ILP32 true +Combinations combinations/gcd_2+newton_3_7.i ILP32 False +SoftwareSystems-AWS-C-Common aws-c-common/aws_byte_cursor_eq_c_str_harness.i LP64 true +SoftwareSystems-BusyBox busybox-1.22.0/ls-incomplete-3.i LP64 unknown +SoftwareSystems-coreutils coreutils-v8.31/ln_3args_klee-sa_ko_147_csa_uaf.c LP64 unknown +SoftwareSystems-DeviceDriversLinux64 ldv-linux-3.4-simple/32_1_cilled_ok_nondet_linux-3.4-32_1-drivers--media--rc--keymaps--rc-videomate-m1f.ko-ldv_main0_sequence_infinite_withcheck_stateful.cil.out.i LP64 true +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_init__invalid_state_lifecycle__safety_requirement_havoc_memory.i LP64 true +Termination-BitVectors termination-bwb/counting-bits-BK.i LP64 unknown +Termination-MainControlFlow termination-crafted/2Nested-1.c LP64 unknown +Termination-MainHeap termination-memory-alloca/BrockschmidtCookFuhs-2013CAV-Fig1-alloca-2.i LP64 unknown +Arrays array-memsafety/count_down-alloca-1.i ILP32 unknown +BitVectors bitvector/s3_srvr_2.BV.c.cil.c ILP32 unknown +ControlFlow openssl/s3_clnt.blast.02.i.cil-2.c ILP32 unknown +ECA eca-rers2018/Problem10.c ILP32 false +Floats neural-networks/lunarlander_3_unsafe.c-amalgamation.i ILP32 false +Hardness hardness/hardness_kloop_50_while_file-142.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.lifts.7.prop1-func-interl.c LP64 true +Heap memsafety-broom/sll-shared-before.i LP64 unknown +Loops nla-digbench-scaling/geo2-ll_valuebound2.c ILP32 true +ProductLines product-lines/email_spec3_product19.cil.c ILP32 false +Recursive recursive-simple/id2_b3_o5.c ILP32 true +Sequentialized seq-mthreaded/pals_opt-floodmax.3.4.ufo.BOUNDED-6.pals.c ILP32 false +XCSP xcsp/aim-100-1-6-sat-4.c ILP32 false +Combinations combinations/pals_lcr.6.ufo.BOUNDED-12.pals+Problem12_label03.c ILP32 False +SoftwareSystems-AWS-C-Common aws-c-common/aws_is_power_of_two_harness.i LP64 true +SoftwareSystems-BusyBox busybox-1.22.0/sleep-2.i LP64 unknown +SoftwareSystems-coreutils coreutils-v8.31/uniq_3args_klee-sa_ko_292_csa_infer_uaf.c LP64 unknown +SoftwareSystems-DeviceDriversLinux64 ldv-linux-3.4-simple/43_1a_cilled_ok_nondet_linux-43_1a-drivers--media--rc--keymaps--rc-digittrade.ko-ldv_main0_sequence_infinite_withcheck_stateful.cil.out.i LP64 true +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mr_finalize__unexpected__cover_exit_havoc_object.i LP64 false +Termination-BitVectors termination-bwb/or-01-false.c LP64 unknown +Termination-MainControlFlow termination-nla/cohencu2-both-nt.c ILP32 unknown +Termination-MainHeap termination-memory-alloca/c.02-alloca.i LP64 unknown +Arrays array-programs/partial_mod_count_limited_5.c ILP32 true +BitVectors bitvector/soft_float_4-2.c.cil.c ILP32 unknown +ControlFlow openssl/s3_srvr.blast.13.i.cil-1.c ILP32 unknown +ECA eca-rers2018/Problem18.c ILP32 false +Floats neural-networks/softsign_w16_r2_case_0_safe.c-amalgamation.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_a_file-53.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.synapse.2.prop1-back-serstep.c LP64 true +Heap memsafety-cve/zchunkFixed.i ILP32 unknown +Loops nla-digbench-scaling/ps5-ll_valuebound1.c ILP32 true +ProductLines product-lines/email_spec8_product14.cil.c ILP32 true +Recursive recursive/Fibonacci04.c ILP32 false +Sequentialized seq-pthread/cs_queue-2.i ILP32 false +XCSP xcsp/aim-200-2-0-sat-2.c ILP32 false +Combinations combinations/pc_sfifo_2.cil-2+token_ring.08.cil-1.c ILP32 False +SoftwareSystems-AWS-C-Common aws-c-common/aws_string_bytes_harness.i LP64 true +SoftwareSystems-BusyBox busybox-1.22.0/uudecode-1.i LP64 unknown +SoftwareSystems-coreutils coreutils-v9.5-units/relpath_relpath_different_paths_output_cover_target.i LP64 false +SoftwareSystems-DeviceDriversLinux64 ldv-linux-3.4-simple/43_1a_cilled_ok_nondet_linux-43_1a-drivers--media--rc--keymaps--rc-winfast.ko-ldv_main0_sequence_infinite_withcheck_stateful.cil.out.i LP64 true +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_update__expected__cover_exit_havoc_object.i LP64 false +Termination-BitVectors termination-bwb/parity1.i LP64 unknown +Termination-MainControlFlow termination-restricted-15/PastaA4.c LP64 unknown +Termination-MainHeap termination-memory-linkedlists/ll_search-alloca.i LP64 unknown +Arrays array-crafted/xor1.i ILP32 true +BitVectors bitvector-regression/recHanoi03-1.c ILP32 false +ControlFlow infeasible-control-flow/unreach_branch3.c ILP32 true +ECA eca-programs/Problem102_label00.c ILP32 true +Floats float-benchs/sin_interpolated_negation.c ILP32 true +Hardness hardness/hardness_codemodifications_normal_file-12.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.arbitrated_top_n5_w8_d64_e0.c LP64 false +Heap forester-heap/sll-circular-1.i ILP32 true +Loops loop-invgen/heapsort.i ILP32 true +ProductLines product-lines/elevator_spec1_product17.cil.c ILP32 true +Recursive fuzzle-programs/08_fuzzle_50x50_50-cycle.c LP64 false +Sequentialized seq-mthreaded/pals_STARTPALS_Triplicated.1.ufo.BOUNDED-10.pals.c ILP32 false +XCSP xcsp/AllInterval-011.c ILP32 false +Combinations combinations/Problem05_label42+token_ring.08.cil-2.c ILP32 False +SoftwareSystems-AWS-C-Common aws-c-common/aws_array_list_clear_harness_negated.i LP64 false +SoftwareSystems-BusyBox busybox-1.22.0/chgrp-incomplete-2.i LP64 unknown +SoftwareSystems-coreutils coreutils-v8.31/csplit_3args_klee-sa_ko_1366-1317-1319-1334_csa_uaf.c LP64 unknown +SoftwareSystems-DeviceDriversLinux64 ldv-linux-3.4-simple/32_1_cilled_ok_nondet_linux-3.4-32_1-drivers--media--rc--keymaps--rc-anysee.ko-ldv_main0_sequence_infinite_withcheck_stateful.cil.out.i LP64 true +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_sys_rd__unconstrained__cover_exit_unsuccess_havoc_object.i LP64 false +Termination-MainControlFlow termination-crafted-lit/AliasDarteFeautrierGonnord-SAS2010-speedpldi4.c LP64 unknown +Termination-MainHeap termination-15/array20_alloca.i LP64 unknown +Arrays array-examples/standard_copy9_ground-2.i ILP32 true +BitVectors bitvector/gcd_2.c ILP32 true +ControlFlow ntdrivers-simplified/kbfiltr_simpl1.cil.c ILP32 unknown +Floats floats-cbmc-regression/float-flags-simp1.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_co_file-165.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.cal146.c LP64 true +Heap ldv-memsafety/memleaks_test12-2.i ILP32 unknown +Loops loop-zilu/benchmark40_polynomial.i ILP32 unknown +ProductLines product-lines/elevator_spec2_product29.cil.c ILP32 true +Recursive recursified_loop-simple/recursified_nested_3.c ILP32 unknown +Sequentialized seq-mthreaded/pals_floodmax.4.3.ufo.BOUNDED-8.pals.c ILP32 false +XCSP xcsp/CostasArray-12.c ILP32 false +Combinations combinations/Problem05_label46+token_ring.02.cil-1.c ILP32 True +SoftwareSystems-AWS-C-Common aws-c-common/aws_byte_buf_append_harness_negated.i LP64 false +SoftwareSystems-BusyBox busybox-1.22.0/du-2.i LP64 unknown +SoftwareSystems-coreutils coreutils-v8.31/cut_3args_klee-sa_ko_584-249-471_csa_uaf.c LP64 unknown +SoftwareSystems-DeviceDriversLinux64 ldv-linux-3.4-simple/32_1_cilled_ok_nondet_linux-3.4-32_1-drivers--media--rc--keymaps--rc-gadmei-rm008z.ko-ldv_main0_sequence_infinite_withcheck_stateful.cil.out.i LP64 true +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_export_restore__expected__cover_proof_havoc_object.i LP64 false +Termination-MainControlFlow termination-crafted-lit/ChenFlurMukhopadhyay-SAS2012-Ex3.03.c LP64 unknown +Termination-MainHeap termination-15/cstrncmp_reverse_alloca.i LP64 unknown +Arrays array-fpi/eqn4.c ILP32 true +BitVectors bitvector/modulus-1.i ILP32 unknown +ControlFlow ntdrivers/kbfiltr.i.cil-2.c ILP32 false +Floats neural-networks/cartpole_31_safe.c-amalgamation.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_ci_file-30.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.cal69.c LP64 true +Heap ldv-memsafety/memleaks_test6_1.i ILP32 unknown +Loops loops/trex04_abstracted.c ILP32 true +ProductLines product-lines/elevator_spec9_product30.cil.c ILP32 false +Recursive recursified_nla-digbench/recursified_egcd2.c ILP32 unknown +Sequentialized seq-mthreaded/pals_lcr-var-start-time.3.2.ufo.BOUNDED-6.pals.c ILP32 false +XCSP xcsp/Dubois-024.c ILP32 true +Combinations combinations/gcd_1+newton_1_5.i ILP32 False +SoftwareSystems-AWS-C-Common aws-c-common/aws_byte_buf_write_from_whole_buffer_harness.i LP64 true +SoftwareSystems-BusyBox busybox-1.22.0/hostid.i LP64 unknown +SoftwareSystems-coreutils coreutils-v8.31/join_3args_klee-sa_ko_473-810_csa_nd.c LP64 unknown +SoftwareSystems-DeviceDriversLinux64 ldv-linux-3.4-simple/32_1_cilled_ok_nondet_linux-3.4-32_1-drivers--media--rc--keymaps--rc-proteus-2309.ko-ldv_main0_sequence_infinite_withcheck_stateful.cil.out.i LP64 true +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_create__invalid_input_rdx__cover_entry_havoc_memory.i LP64 false +Termination-MainControlFlow termination-crafted-lit/Masse-VMCAI2014-Fig1b.c LP64 unknown +Termination-MainHeap termination-dietlibc/strlcat.i LP64 unknown +Arrays array-fpi/s12iff.c ILP32 false +BitVectors bitvector/s3_clnt_2.BV.c.cil-1.c ILP32 unknown +ControlFlow openssl-simplified/s3_srvr_1.cil-1.c ILP32 unknown +Floats neural-networks/dubinsrejoin_2_safe.c-amalgamation.i ILP32 true +Hardness hardness/hardness_floats_has_floats_file-76.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.exit.2.prop1-back-serstep.c LP64 true +Heap ldv-sets/test_mutex_unbounded-2.i ILP32 false +Loops nla-digbench-scaling/egcd-ll_valuebound1.c ILP32 true +ProductLines product-lines/email_spec11_product23.cil.c ILP32 true +Recursive recursified_nla-digbench/recursified_hard-ll.c ILP32 unknown +Sequentialized seq-mthreaded/pals_lcr.4.1.ufo.BOUNDED-8.pals.c ILP32 false +XCSP xcsp/Dubois-075.c ILP32 true +Combinations combinations/gcd_4+newton_3_1.i ILP32 True +SoftwareSystems-AWS-C-Common aws-c-common/aws_byte_cursor_read_be32_harness.i LP64 true +SoftwareSystems-BusyBox busybox-1.22.0/od-1.i LP64 unknown +SoftwareSystems-coreutils coreutils-v8.31/nl_3args_klee-sa_ko_172-232_csa_uaf.c LP64 unknown +SoftwareSystems-DeviceDriversLinux64 ldv-linux-3.4-simple/32_1_cilled_ok_nondet_linux-3.4-32_1-drivers--w1--slaves--w1_ds2760.ko-ldv_main0_sequence_infinite_withcheck_stateful.cil.out.i LP64 true +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_key_config__invalid_state_td_state__cover_exit_havoc_memory.i LP64 false +Termination-MainControlFlow termination-crafted/Copenhagen_disj-2.c LP64 unknown +Termination-MainHeap termination-memory-alloca/Masse-alloca.i LP64 unknown +Arrays array-fpi/ss4f.c ILP32 false +BitVectors bitvector/s3_srvr_1.BV.c.cil.c ILP32 unknown +ControlFlow openssl-simplified/s3_srvr_6.cil-2.c ILP32 unknown +Floats neural-networks/gelu_3_unsafe.c-amalgamation.i ILP32 false +Hardness hardness/hardness_kloop_25_while_file-12.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.lamport.3.prop1-func-interl.c LP64 false +Heap memsafety-broom/dll-fst-shared.i LP64 unknown +Loops nla-digbench-scaling/geo1-ll_valuebound2.c ILP32 true +ProductLines product-lines/email_spec27_product19.cil.c ILP32 false +Recursive recursified_nla-digbench/recursified_ps4.c ILP32 unknown +Sequentialized seq-mthreaded/pals_lcr.8.ufo.BOUNDED-16.pals.c ILP32 true +XCSP xcsp/Haystacks-15.c ILP32 true +Combinations combinations/pals_lcr.5.1.ufo.UNBOUNDED.pals+Problem12_label02.c ILP32 False +SoftwareSystems-AWS-C-Common aws-c-common/aws_hash_table_create_harness.i LP64 true +SoftwareSystems-BusyBox busybox-1.22.0/realpath-2.i LP64 unknown +SoftwareSystems-coreutils coreutils-v8.31/split_3args_klee-sa_ko_235_csa_nd.c LP64 unknown +SoftwareSystems-DeviceDriversLinux64 ldv-linux-3.4-simple/43_1a_cilled_ok_nondet_linux-43_1a-drivers--media--rc--keymaps--rc-ati-x10.ko-ldv_main0_sequence_infinite_withcheck_stateful.cil.out.i LP64 true +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mr_finalize__expected__cover_entry_havoc_object.i LP64 false +Termination-MainControlFlow termination-crafted/Singapore_plus.c LP64 unknown +Termination-MainHeap termination-memory-alloca/b.06-alloca.i LP64 unknown +Arrays array-memsafety/openbsd_cmemset-alloca-1.i ILP32 unknown +BitVectors bitvector/s3_srvr_3a.BV.c.cil.c ILP32 true +ControlFlow openssl/s3_srvr.blast.01.i.cil-2.c ILP32 unknown +Floats neural-networks/lunarlander_88_unsafe.c-amalgamation.i ILP32 false +Hardness hardness/hardness_operatoramount_amount10_file-165.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.needham.4.prop3-back-serstep.c LP64 true +Heap memsafety-cve/gpac_16Found.i ILP32 unknown +Loops nla-digbench-scaling/hard-u_unwindbound50.c ILP32 false +ProductLines product-lines/email_spec4_product18.cil.c ILP32 false +Recursive recursive-simple/id_o10.c ILP32 false +Sequentialized seq-mthreaded/pals_opt-floodmax.4.3.ufo.UNBOUNDED.pals.c ILP32 false +XCSP xcsp/aim-100-2-0-sat-3.c ILP32 false +Combinations combinations/pals_lcr.7.ufo.UNBOUNDED.pals+Problem12_label00.c ILP32 False +SoftwareSystems-AWS-C-Common aws-c-common/aws_linked_list_pop_back_harness_negated.i LP64 false +SoftwareSystems-BusyBox busybox-1.22.0/stty-3.i LP64 unknown +SoftwareSystems-coreutils coreutils-v8.31/uniq_3args_ok.c LP64 unknown +SoftwareSystems-DeviceDriversLinux64 ldv-linux-3.4-simple/43_1a_cilled_ok_nondet_linux-43_1a-drivers--media--rc--keymaps--rc-imon-mce.ko-ldv_main0_sequence_infinite_withcheck_stateful.cil.out.i LP64 true +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_phymem_page_reclaim__unexpected__cover_proof_havoc_object.i LP64 false +Termination-MainControlFlow termination-nla/egcd3-both-nt.c ILP32 unknown +Termination-MainHeap termination-memory-alloca/diff-alloca-1.i LP64 unknown +Arrays array-patterns/array22_pattern.c ILP32 true +BitVectors bitvector/soft_float_2a.c.cil.c ILP32 true +ControlFlow openssl/s3_srvr.blast.10.i.cil-1.c ILP32 unknown +Floats neural-networks/poly_8_8_8_thresh_2_safe.c-amalgamation.i ILP32 true +Hardness hardness/hardness_operatoramount_amount50_file-30.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.resistance.2.prop2-func-interl.c LP64 true +Heap memsafety-cve/pacparser.i ILP32 unknown +Loops nla-digbench-scaling/ps2-ll_unwindbound1.c ILP32 true +ProductLines product-lines/email_spec7_product17.cil.c ILP32 true +Recursive recursive/Addition03-1.c ILP32 true +Sequentialized seq-pthread/cs_fib-2.i ILP32 false +XCSP xcsp/aim-200-1-6-sat-2.c ILP32 false +Combinations combinations/pc_sfifo_1.cil-2+token_ring.11.cil-2.c ILP32 True +SoftwareSystems-AWS-C-Common aws-c-common/aws_priority_queue_s_sift_either_harness_negated.i LP64 false +SoftwareSystems-BusyBox busybox-1.22.0/uname-2.i LP64 unknown +SoftwareSystems-coreutils coreutils-v9.5-units/relpath_path_common_prefix_identical_cover_proof.i LP64 false +SoftwareSystems-DeviceDriversLinux64 ldv-linux-3.4-simple/43_1a_cilled_ok_nondet_linux-43_1a-drivers--media--rc--keymaps--rc-real-audio-220-32-keys.ko-ldv_main0_sequence_infinite_withcheck_stateful.cil.out.i LP64 true +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_key_config__invalid_state_sys_state__cover_exit_havoc_memory.i LP64 false +Termination-MainControlFlow termination-numeric/Fibonacci01-2-overflow.c LP64 unknown +Termination-MainHeap termination-memory-alloca/openbsd_cstrpbrk-alloca-1.i LP64 unknown +Arrays array-tiling/tcpy.c ILP32 true +BitVectors bitvector/soft_float_5.c.cil.c ILP32 unknown +ControlFlow openssl/s3_srvr.blast.16.i.cil-1.c ILP32 unknown +Floats neural-networks/tanh_6_safe.c-amalgamation.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_p_file-76.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.vcegar_QF_BV_itc99_b13_p12.c LP64 true +Heap memsafety/global-atexit-5.i ILP32 unknown +Loops nla-digbench/egcd2.c ILP32 unknown +ProductLines product-lines/email_spec9_product12.cil.c ILP32 true +Recursive recursive/recHanoi02-2.c ILP32 true +Sequentialized seq-pthread/cs_sync.i ILP32 true +XCSP xcsp/aim-200-3-4-sat-1.c ILP32 false +Combinations combinations/square_2+soft_float_4-2a.c.cil.c ILP32 False +SoftwareSystems-AWS-C-Common aws-c-common/aws_string_eq_ignore_case_harness.i LP64 true +SoftwareSystems-BusyBox busybox-1.22.0/who-2.i LP64 unknown +SoftwareSystems-coreutils coreutils-v9.5-units/relpath_relpath_potential_buffer_overflow_functional.i LP64 false +SoftwareSystems-DeviceDriversLinux64 ldv-linux-3.4-simple/43_1a_cilled_ok_nondet_linux-43_1a-drivers--regulator--userspace-consumer.ko-ldv_main0_sequence_infinite_withcheck_stateful.cil.out.i LP64 true +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_vp_enter__invalid_input_vcpu_handle__cover_exit_havoc_object.i LP64 false +Termination-MainControlFlow termination-restricted-15/b.03-no-inv_assume.c LP64 unknown +Termination-MainHeap termination-recursive-malloc/rec_malloc_ex11C.i LP64 unknown +Arrays array-crafted/bor1.i ILP32 true +ControlFlow infeasible-control-flow/conflict_branch3.c ILP32 true +Floats float-benchs/interpolation.c ILP32 true +Hardness hardness/hardness_codemodifications_functionizing_file-108.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.arbitrated_top_n2_w16_d16_e0.c LP64 false +Heap forester-heap/dll-rb-sentinel-2.i ILP32 true +Loops loop-industry-pattern/aiob_3.c ILP32 true +ProductLines product-lines/elevator_spec14_product28.cil.c ILP32 false +Recursive fuzzle-programs/04_fuzzle_60x60.c LP64 false +Sequentialized seq-mthreaded/pals_STARTPALS_ActiveStandby.4_2.ufo.BOUNDED-10.pals.c ILP32 false +XCSP xcsp/AllInterval-007.c ILP32 false +Combinations combinations/Problem05_label41+token_ring.08.cil-1.c ILP32 False +SoftwareSystems-AWS-C-Common aws-c-common/aws_array_eq_harness.i LP64 true +SoftwareSystems-BusyBox busybox-1.22.0/basename-2.i LP64 true +SoftwareSystems-coreutils coreutils-v8.31/csplit_3args_klee-sa_ko_1318-1332_csa_nd.c LP64 unknown +SoftwareSystems-DeviceDriversLinux64 ldv-linux-3.4-simple/32_1_cilled_ok_nondet_linux-3.4-32_1-drivers--leds--ledtrig-default-on.ko-ldv_main0_sequence_infinite_withcheck_stateful.cil.out.i LP64 true +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_servtd_wr__expected__cover_proof_havoc_object.i LP64 false +Termination-MainControlFlow termination-crafted-lit/AliasDarteFeautrierGonnord-SAS2010-easy2-2.c LP64 unknown +Termination-MainHeap termination-15/array09_alloca.i LP64 unknown +Arrays array-crafted/zero_sum_const_m2.c ILP32 true +ControlFlow memory-model/2SB.i ILP32 false +Floats float-newlib/double_req_bl_0670.c ILP32 true +Hardness hardness/hardness_codemodifications_steplocals_file-130.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.blocks.4.prop1-back-serstep.c LP64 false +Heap forester-heap/sll-simple-white-blue-2.i ILP32 false +Loops loop-lit/gj2007b.i ILP32 true +ProductLines product-lines/elevator_spec1_product25.cil.c ILP32 true +Recursive fuzzle-programs/12_fuzzle_50x50_CVE-2016-4492.c LP64 false +Sequentialized seq-mthreaded/pals_floodmax.3.1.ufo.BOUNDED-6.pals.c ILP32 false +XCSP xcsp/AllInterval-015.c ILP32 false +Combinations combinations/Problem05_label43+token_ring.05.cil-1.c ILP32 True +SoftwareSystems-AWS-C-Common aws-c-common/aws_array_list_get_at_harness.i LP64 true +SoftwareSystems-BusyBox busybox-1.22.0/chroot-incomplete-2.i LP64 unknown +SoftwareSystems-coreutils coreutils-v8.31/csplit_3args_klee-sa_ko_486-536-923_csa_nd.c LP64 unknown +SoftwareSystems-DeviceDriversLinux64 ldv-linux-3.4-simple/32_1_cilled_ok_nondet_linux-3.4-32_1-drivers--media--rc--keymaps--rc-avermedia-m733a-rm-k6.ko-ldv_main0_sequence_infinite_withcheck_stateful.cil.out.i LP64 true +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_vm_wr__invalid_input_rcx__cover_exit_havoc_object.i LP64 false +Termination-MainControlFlow termination-crafted-lit/ChawdharyCookGulwaniSagivYang-ESOP2008-aaron12.c LP64 unknown +Termination-MainHeap termination-15/cstrchr_malloc.i LP64 unknown +Arrays array-examples/standard_copy2_ground-1.i ILP32 false +ControlFlow ntdrivers-simplified/floppy_simpl3.cil-2.c ILP32 unknown +Floats float-newlib/float_req_bl_0875.c ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_cn_file-153.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.cal112.c LP64 true +Heap heap-manipulation/tree-2.i ILP32 false +Loops loop-zilu/benchmark18_conjunctive.i ILP32 true +ProductLines product-lines/elevator_spec2_product21.cil.c ILP32 true +Recursive recursified_loop-invariants/recursified_linear-inequality-inv-b.c ILP32 unknown +Sequentialized seq-mthreaded/pals_floodmax.3_overflow.ufo.UNBOUNDED.pals.c ILP32 false +XCSP xcsp/AllInterval-030.c ILP32 false +Combinations combinations/Problem05_label45+token_ring.05.cil-2.c ILP32 False +SoftwareSystems-AWS-C-Common aws-c-common/aws_array_list_sort_harness.i LP64 true +SoftwareSystems-BusyBox busybox-1.22.0/date-2.i LP64 unknown +SoftwareSystems-coreutils coreutils-v8.31/cut_3args_klee-sa_ko_462-471_csa_infer_nd.c LP64 unknown +SoftwareSystems-DeviceDriversLinux64 ldv-linux-3.4-simple/32_1_cilled_ok_nondet_linux-3.4-32_1-drivers--media--rc--keymaps--rc-em-terratec.ko-ldv_main0_sequence_infinite_withcheck_stateful.cil.out.i LP64 true +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_vp_enter__unexpected__safety_requirement_havoc_object.i LP64 true +Termination-MainControlFlow termination-crafted-lit/ChenFlurMukhopadhyay-SAS2012-Ex2.12.c LP64 unknown +Termination-MainHeap termination-15/cstrlen_reverse_alloca.i LP64 unknown +Arrays array-examples/standard_running-2.i ILP32 true +ControlFlow ntdrivers/cdaudio.i.cil-1.c ILP32 false +Floats floats-cdfpl/newton_2_6.i ILP32 false +Hardness hardness/hardness_fillercode_filler_pr_ci_file-176.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.cal18.c LP64 true +Heap ldv-memsafety/memleaks_test16_2.i ILP32 unknown +Loops loops-crafted-1/in-de61.c ILP32 true +ProductLines product-lines/elevator_spec3_product11.cil.c ILP32 false +Recursive recursified_nla-digbench/recursified_bresenham-ll.c ILP32 unknown +Sequentialized seq-mthreaded/pals_floodmax.4.ufo.BOUNDED-8.pals.c ILP32 true +XCSP xcsp/CostasArray-16.c ILP32 false +Combinations combinations/Problem05_label46+token_ring.12.cil-2.c ILP32 True +SoftwareSystems-AWS-C-Common aws-c-common/aws_byte_buf_eq_c_str_ignore_case_harness.i LP64 true +SoftwareSystems-BusyBox busybox-1.22.0/echo-2.i LP64 unknown +SoftwareSystems-coreutils coreutils-v8.31/env_3args_klee-sa_ko_617-835_csa_uaf.c LP64 unknown +SoftwareSystems-DeviceDriversLinux64 ldv-linux-3.4-simple/32_1_cilled_ok_nondet_linux-3.4-32_1-drivers--media--rc--keymaps--rc-kaiomy.ko-ldv_main0_sequence_infinite_withcheck_stateful.cil.out.i LP64 true +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_import_abort__unexpected__cover_entry_havoc_object.i LP64 false +Termination-MainControlFlow termination-crafted-lit/CookSeeZuleger-TACAS2013-Fig7b.c LP64 unknown +Termination-MainHeap termination-15/cstrpbrk_reverse_alloca.i LP64 unknown +Arrays array-fpi/brs5f_overflow.c ILP32 unknown +ControlFlow ntdrivers/floppy.i.cil-3.c ILP32 true +Floats loop-floats-scientific-comp/loop3.c ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_co_file-199.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.cal35.c LP64 true +Heap ldv-memsafety/memleaks_test23_1.i ILP32 unknown +Loops loops/string-2.i ILP32 false +ProductLines product-lines/elevator_spec3_productSimulator.cil.c ILP32 false +Recursive recursified_nla-digbench/recursified_divbin2.i ILP32 unknown +Sequentialized seq-mthreaded/pals_floodmax.5.ufo.BOUNDED-10.pals.c ILP32 true +XCSP xcsp/Dubois-020.c ILP32 true +Combinations combinations/Problem05_label49+token_ring.06.cil-2.c ILP32 True +SoftwareSystems-AWS-C-Common aws-c-common/aws_byte_buf_reset_harness.i LP64 true +SoftwareSystems-coreutils coreutils-v8.31/env_3args_klee-sa_ko_884-777_infer_nd.c LP64 unknown +SoftwareSystems-DeviceDriversLinux64 ldv-linux-3.4-simple/32_1_cilled_ok_nondet_linux-3.4-32_1-drivers--media--rc--keymaps--rc-pctv-sedna.ko-ldv_main0_sequence_infinite_withcheck_stateful.cil.out.i LP64 true +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_addcx__invalid_state_td_state__cover_entry_havoc_memory.i LP64 false +Termination-MainControlFlow termination-crafted-lit/LeeJonesBen-Amram-POPL2001-Ex4.c LP64 unknown +Termination-MainHeap termination-dietlibc/strcat.i LP64 unknown +Arrays array-fpi/ifeqn5f.c ILP32 false +ControlFlow openssl-simplified/s3_clnt_1.cil-1.c ILP32 unknown +Floats neural-networks/cartpole_55_safe.c-amalgamation.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_cn_file-41.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.cambridge.1.prop2-func-interl.c LP64 true +Heap ldv-regression/alias_of_return_2.i ILP32 true +Loops nla-digbench-scaling/cohencu-ll_unwindbound20.c ILP32 false +ProductLines product-lines/email_spec0_product16.cil.c ILP32 false +Recursive recursified_nla-digbench/recursified_fermat1.c ILP32 unknown +Sequentialized seq-mthreaded/pals_lcr-var-start-time.4.2.ufo.BOUNDED-8.pals.c ILP32 false +XCSP xcsp/Dubois-028.c ILP32 true +Combinations combinations/gcd_2+newton_1_2.i ILP32 True +SoftwareSystems-AWS-C-Common aws-c-common/aws_byte_cursor_advance_harness_negated.i LP64 false +SoftwareSystems-coreutils coreutils-v8.31/join_3args_klee-sa_ko_696-489_csa_uaf.c LP64 unknown +SoftwareSystems-DeviceDriversLinux64 ldv-linux-3.4-simple/32_1_cilled_ok_nondet_linux-3.4-32_1-drivers--media--rc--keymaps--rc-terratec-cinergy-xs.ko-ldv_main0_sequence_infinite_withcheck_stateful.cil.out.i LP64 true +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_create__unexpected__cover_proof_havoc_memory.i LP64 false +Termination-MainControlFlow termination-crafted-lit/Urban-WST2013-Fig2.c LP64 unknown +Termination-MainHeap termination-dietlibc/strtok_r.i LP64 unknown +Arrays array-fpi/nsqm-if.c ILP32 true +ControlFlow openssl-simplified/s3_clnt_3.cil-3.c ILP32 unknown +Floats neural-networks/cos_3_unsafe.c-amalgamation.i ILP32 false +Hardness hardness/hardness_fillercode_normal_file-64.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.driving_phils.1.prop1-back-serstep.c LP64 false +Heap ldv-regression/test27-1.c ILP32 true +Loops nla-digbench-scaling/divbin2_valuebound20.i ILP32 true +ProductLines product-lines/email_spec11_product03.cil.c ILP32 true +Recursive recursified_nla-digbench/recursified_geo2-ll2.c ILP32 unknown +Sequentialized seq-mthreaded/pals_lcr-var-start-time.6.ufo.BOUNDED-12.pals.c ILP32 true +XCSP xcsp/Dubois-055.c ILP32 true +Combinations combinations/gcd_3+newton_3_4.i ILP32 True +SoftwareSystems-AWS-C-Common aws-c-common/aws_byte_cursor_from_buf_harness_negated.i LP64 false +SoftwareSystems-coreutils coreutils-v8.31/ln_3args_klee-sa_ko_194-351_csa_uaf.c LP64 unknown +SoftwareSystems-DeviceDriversLinux64 ldv-linux-3.4-simple/32_1_cilled_ok_nondet_linux-3.4-32_1-drivers--platform--x86--topstar-laptop.ko-ldv_main0_sequence_infinite_withcheck_stateful.cil.out.i LP64 true +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_init__invalid_state_td_state__cover_exit_havoc_memory.i LP64 false +Termination-MainControlFlow termination-crafted/Bangalore_v4.c LP64 unknown +Termination-MainHeap termination-memory-alloca/CookSeeZuleger-2013TACAS-Fig7b-alloca.i LP64 unknown +Arrays array-fpi/s3lif.c ILP32 true +ControlFlow openssl-simplified/s3_srvr_11.cil.c ILP32 unknown +Floats neural-networks/dubinsrejoin_54_safe.c-amalgamation.i ILP32 true +Hardness hardness/hardness_floats_no_floats_file-87.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.firewire_tree.4.prop2-back-serstep.c LP64 true +Heap list-ext-properties/test-0158_1-1.i ILP32 unknown +Loops nla-digbench-scaling/egcd3-ll_unwindbound2.c ILP32 false +ProductLines product-lines/email_spec11_product36.cil.c ILP32 true +Recursive recursified_nla-digbench/recursified_knuth.i ILP32 unknown +Sequentialized seq-mthreaded/pals_lcr.5.1.ufo.BOUNDED-10.pals.c ILP32 false +XCSP xcsp/Dubois-095.c ILP32 true +Combinations combinations/pals_lcr.3.ufo.BOUNDED-6.pals+Problem12_label03.c ILP32 False +SoftwareSystems-AWS-C-Common aws-c-common/aws_byte_cursor_satisfies_pred_harness_negated.i LP64 false +SoftwareSystems-coreutils coreutils-v8.31/nl_3args_klee-sa_ko_569-365_csa_infer_uaf.c LP64 unknown +SoftwareSystems-DeviceDriversLinux64 ldv-linux-3.4-simple/43_1a_cilled_ok_nondet_linux-43_1a-drivers--hwmon--max1111.ko-ldv_main0_sequence_infinite_withcheck_stateful.cil.out.i LP64 true +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_key_config__unexpected__safety_requirement_havoc_memory.i LP64 true +Termination-MainControlFlow termination-crafted/Lobnya-Boolean-Reordered-1.c LP64 unknown +Termination-MainHeap termination-memory-alloca/Toulouse-MultiBranchesToLoop-alloca.i LP64 unknown +Arrays array-fpi/sina4.c ILP32 true +ControlFlow openssl-simplified/s3_srvr_3.cil.c ILP32 unknown +Floats neural-networks/erf_1_safe.c-amalgamation.i ILP32 true +Hardness hardness/hardness_kloop_25_1loop_file-108.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.hanoi.1.prop1-back-serstep.c LP64 false +Heap list-properties/list-1.i ILP32 true +Loops nla-digbench-scaling/freire2_valuebound2.c ILP32 false +ProductLines product-lines/email_spec1_product32.cil.c ILP32 false +Recursive recursified_nla-digbench/recursified_ps2.c ILP32 unknown +Sequentialized seq-mthreaded/pals_lcr.7.ufo.BOUNDED-14.pals.c ILP32 true +XCSP xcsp/Haystacks-11.c ILP32 true +Combinations combinations/pals_lcr.4.ufo.UNBOUNDED.pals+Problem12_label00.c ILP32 False +SoftwareSystems-AWS-C-Common aws-c-common/aws_hash_iter_done_harness_negated.i LP64 false +SoftwareSystems-coreutils coreutils-v8.31/od_3args_klee-sa_ko_917-491_csa_nd.c LP64 unknown +SoftwareSystems-DeviceDriversLinux64 ldv-linux-3.4-simple/43_1a_cilled_ok_nondet_linux-43_1a-drivers--media--dvb--frontends--dib3000mc.ko-ldv_main0_sequence_infinite_withcheck_stateful.cil.out.i LP64 true +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_vpflushdone__invalid_state_op_state__cover_exit_havoc_object.i LP64 false +Termination-MainControlFlow termination-crafted/Nyala-2lex-2.c LP64 unknown +Termination-MainHeap termination-memory-alloca/array03-alloca-1.i LP64 unknown +Arrays array-lopstr16/base_case.i ILP32 true +Floats neural-networks/lunarlander_16_unsafe.c-amalgamation.i ILP32 false +Hardness hardness/hardness_kloop_50_1loop_file-130.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.leader_election.2.prop1-back-serstep.c LP64 true +Heap memsafety-broom/sll-fst-data.i LP64 unknown +Loops nla-digbench-scaling/geo1-u_valuebound2.c ILP32 false +ProductLines product-lines/email_spec27_product31.cil.c ILP32 false +Recursive recursified_nla-digbench/recursified_ps6.c ILP32 unknown +Sequentialized seq-mthreaded/pals_opt-floodmax.3.2.ufo.BOUNDED-6.pals.c ILP32 false +XCSP xcsp/Haystacks-19.c ILP32 true +Combinations combinations/pals_lcr.5.ufo.UNBOUNDED.pals+Problem12_label07.c ILP32 False +SoftwareSystems-AWS-C-Common aws-c-common/aws_hash_table_init_bounded_harness_negated.i LP64 false +SoftwareSystems-coreutils coreutils-v8.31/split_3args_klee-sa_ko_664_csa_uaf.c LP64 unknown +SoftwareSystems-DeviceDriversLinux64 ldv-linux-3.4-simple/43_1a_cilled_ok_nondet_linux-43_1a-drivers--media--rc--keymaps--rc-azurewave-ad-tu700.ko-ldv_main0_sequence_infinite_withcheck_stateful.cil.out.i LP64 true +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mr_finalize__invalid_state_op_state__cover_exit_havoc_object.i LP64 false +Termination-MainControlFlow termination-crafted/Toulouse-MultiBranchesToLoop-2.c LP64 unknown +Termination-MainHeap termination-memory-alloca/b.14-alloca.i LP64 unknown +Arrays array-memsafety/cstrpbrk-alloca-2.i ILP32 unknown +Floats neural-networks/lunarlander_63_unsafe.c-amalgamation.i ILP32 false +Hardness hardness/hardness_operatoramount_amount100_file-153.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.msmie.4.prop1-back-serstep.c LP64 true +Heap memsafety-cve/dlt-daemon.i ILP32 unknown +Loops nla-digbench-scaling/geo3-ll_valuebound2.c ILP32 true +ProductLines product-lines/email_spec3_product31.cil.c ILP32 false +Recursive recursive-simple/id_b3_o2-2.c ILP32 false +Sequentialized seq-mthreaded/pals_opt-floodmax.4.1.ufo.BOUNDED-8.pals.c ILP32 false +XCSP xcsp/aim-100-1-6-unsat-3.c ILP32 true +Combinations combinations/pals_lcr.6_overflow.ufo.UNBOUNDED.pals+Problem12_label09.c ILP32 False +SoftwareSystems-AWS-C-Common aws-c-common/aws_linked_list_init_harness_negated.i LP64 false +SoftwareSystems-coreutils coreutils-v8.31/uniq_3args_klee-sa_ko_499-513-538-654_csa_uaf.c LP64 unknown +SoftwareSystems-DeviceDriversLinux64 ldv-linux-3.4-simple/43_1a_cilled_ok_nondet_linux-43_1a-drivers--media--rc--keymaps--rc-evga-indtube.ko-ldv_main0_sequence_infinite_withcheck_stateful.cil.out.i LP64 true +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_phymem_page_reclaim__invalid_state_child_count__cover_proof_havoc_object.i LP64 false +Termination-MainControlFlow termination-nla/dijkstra3-both-nt.c ILP32 unknown +Termination-MainHeap termination-memory-alloca/cstrcpy-alloca-2.i LP64 unknown +Arrays array-memsafety/openbsd_cstrstr-alloca-2.i ILP32 unknown +Floats neural-networks/poly_128_thresh_0_safe.c-amalgamation.i ILP32 true +Hardness hardness/hardness_operatoramount_amount250_file-176.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.pgm_protocol.1.prop5-func-interl.c LP64 false +Heap memsafety-cve/jhead.i ILP32 unknown +Loops nla-digbench-scaling/knuth_unwindbound100.i ILP32 true +ProductLines product-lines/email_spec4_product30.cil.c ILP32 false +Recursive recursive-simple/id_o200.c ILP32 false +XCSP xcsp/aim-100-2-0-unsat-3.c ILP32 true +Combinations combinations/pals_lcr.8.1.ufo.UNBOUNDED.pals+Problem12_label02.c ILP32 False +SoftwareSystems-AWS-C-Common aws-c-common/aws_linked_list_remove_harness.i LP64 true +SoftwareSystems-coreutils coreutils-v9.5-units/factors_valid_64bit_number_cover_target.i LP64 false +SoftwareSystems-DeviceDriversLinux64 ldv-linux-3.4-simple/43_1a_cilled_ok_nondet_linux-43_1a-drivers--media--rc--keymaps--rc-leadtek-y04g0051.ko-ldv_main0_sequence_infinite_withcheck_stateful.cil.out.i LP64 true +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_config__invalid_input_num_ptr__safety_requirement_havoc_object.i LP64 true +Termination-MainControlFlow termination-nla/geo3-both-t.c ILP32 unknown +Termination-MainHeap termination-memory-alloca/insertionsort-alloca-2.i LP64 unknown +Arrays array-multidimensional/transpose-u.c ILP32 true +Floats neural-networks/poly_4_4_4_4_thresh_5_unsafe.c-amalgamation.i ILP32 false +Hardness hardness/hardness_operatoramount_amount500_file-199.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.production_cell.1.prop1-func-interl.c LP64 false +Heap memsafety-cve/mujs.i ILP32 unknown +Loops nla-digbench-scaling/prod4br-ll_unwindbound20.c ILP32 false +ProductLines product-lines/email_spec6_product30.cil.c ILP32 false +Recursive recursive/Ackermann04.c ILP32 true +XCSP xcsp/aim-100-6-0-sat-2.c ILP32 false +Combinations combinations/pc_sfifo_1.cil-2+token_ring.01.cil-1.c ILP32 True +SoftwareSystems-AWS-C-Common aws-c-common/aws_priority_queue_push_harness.i LP64 true +SoftwareSystems-coreutils coreutils-v9.5-units/getlimits_decimal_absval_add_one_negative_cover_target.i LP64 false +SoftwareSystems-DeviceDriversLinux64 ldv-linux-3.4-simple/43_1a_cilled_ok_nondet_linux-43_1a-drivers--media--rc--keymaps--rc-pixelview-002t.ko-ldv_main0_sequence_infinite_withcheck_stateful.cil.out.i LP64 true +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_init__invalid_state_sys_state__cover_exit_havoc_memory.i LP64 false +Termination-MainControlFlow termination-nla/ps6-both-t.c ILP32 unknown +Termination-MainHeap termination-memory-alloca/openbsd_cstrcpy-alloca-1.i LP64 unknown +Arrays array-patterns/array5_pattern.c ILP32 true +Floats neural-networks/softmax_10_safe.c-amalgamation.i ILP32 true +Hardness hardness/hardness_wrappers_normal_file-41.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.shift_register_top_w16_d64_e0.c LP64 false +Heap memsafety-cve/smartdns.i ILP32 unknown +Loops nla-digbench-scaling/ps3-ll_valuebound2.c ILP32 true +ProductLines product-lines/email_spec7_product29.cil.c ILP32 false +Recursive recursive/EvenOdd03.c ILP32 false +XCSP xcsp/aim-200-1-6-unsat-2.c ILP32 true +Combinations combinations/pc_sfifo_2.cil-1+token_ring.08.cil-1.c ILP32 True +SoftwareSystems-AWS-C-Common aws-c-common/aws_ring_buffer_acquire_harness.i LP64 true +SoftwareSystems-coreutils coreutils-v9.5-units/relpath_path_common_prefix_symmetry_functional.i LP64 true +SoftwareSystems-DeviceDriversLinux64 ldv-linux-3.4-simple/43_1a_cilled_ok_nondet_linux-43_1a-drivers--media--rc--keymaps--rc-tivo.ko-ldv_main0_sequence_infinite_withcheck_stateful.cil.out.i LP64 true +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_shutdown__invalid_input_handoff_no_downgrade__cover_exit_havoc_memory.i LP64 false +Termination-MainControlFlow termination-numeric/twisted.c LP64 unknown +Termination-MainHeap termination-memory-alloca/subseq-alloca-1.i LP64 unknown +Arrays array-tiling/pnr4.c ILP32 true +Floats neural-networks/softsign_w64_r3_case_0_safe.c-amalgamation.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_ap_file-64.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.telephony.8.prop1-func-interl.c LP64 false +Heap memsafety-ext2/length_test03-1.i ILP32 unknown +Loops nla-digbench-scaling/sqrt1-ll_unwindbound2.c ILP32 true +ProductLines product-lines/email_spec8_product29.cil.c ILP32 true +Recursive recursive/McCarthy91-2.c ILP32 true +Combinations combinations/pc_sfifo_3.cil+token_ring.08.cil-2.c ILP32 False +SoftwareSystems-AWS-C-Common aws-c-common/aws_string_eq_byte_buf_ignore_case_harness_negated.i LP64 false +SoftwareSystems-coreutils coreutils-v9.5-units/relpath_relpath_matching_paths_output_cover_proof.i LP64 false +SoftwareSystems-DeviceDriversLinux64 ldv-linux-3.4-simple/43_1a_cilled_ok_nondet_linux-43_1a-drivers--mmc--host--sdricoh_cs.ko-ldv_main0_sequence_infinite_withcheck_stateful.cil.out.i LP64 true +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_update__invalid_state_lp_state__cover_proof_havoc_object.i LP64 false +Termination-MainControlFlow termination-restricted-15/PastaC7.c LP64 unknown +Termination-MainHeap termination-recursive-malloc/insertionSort_recursive.i LP64 unknown +Arrays reducercommutativity/rangesum10.i ILP32 false +Floats neural-networks/tanh_w64_r1_case_1_safe.c-amalgamation.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_s_file-88.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.vis_arrays_am2910_p2.c LP64 true +Heap memsafety/test-0232-1.i ILP32 unknown +Loops nla-digbench/lcm2.c ILP32 true +ProductLines product-lines/email_spec9_product28.cil.c ILP32 true +Recursive verifythis/prefixsum_rec.c ILP32 true +Combinations combinations/square_6+soft_float_1-2a.c.cil.c ILP32 True +SoftwareSystems-AWS-C-Common aws-c-common/sliced_aws_array_eq_harness.i LP64 true +SoftwareSystems-coreutils coreutils-v9.5-units/seq_incr_no_carry_cover_target.i LP64 unknown +SoftwareSystems-DeviceDriversLinux64 ldv-linux-3.4-simple/43_1a_cilled_ok_nondet_linux-43_1a-drivers--w1--slaves--w1_ds2408.ko-ldv_main0_sequence_infinite_withcheck_stateful.cil.out.i LP64 true +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_vp_enter__invalid_state_op_state__cover_proof_havoc_object.i LP64 false +Termination-MainControlFlow termination-restricted-15/b.15.c LP64 unknown +Termination-MainHeap termination-recursive-malloc/rec_malloc_ex7.i LP64 unknown +Arrays array-cav19/array_min_and_copy_shift_sum_add.c ILP32 true +Floats float-benchs/filter1.c.v+lhb-reducer.c ILP32 true +Hardness hardness/hardness_codemodifications_dependencies_file-193.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.adding.6.prop1-back-serstep.c LP64 false +Heap forester-heap/dll-optional-2.i ILP32 false +Loops loop-acceleration/simple_2-1.c ILP32 true +ProductLines product-lines/elevator_spec14_product20.cil.c ILP32 false +Recursive fuzzle-programs/02_fuzzle_40x40.c LP64 false +Combinations combinations/Problem05_label40+token_ring.10.cil-2.c ILP32 False +SoftwareSystems-AWS-C-Common aws-c-common/aws_array_eq_c_str_harness-1.i LP64 false +SoftwareSystems-coreutils coreutils-v8.31/comm_3args_klee-sa_ko_243_infer_uaf.c LP64 unknown +SoftwareSystems-DeviceDriversLinux64 ldv-linux-3.4-simple/32_1_cilled_ok_nondet_linux-3.4-32_1-drivers--acpi--container.ko-ldv_main0_sequence_infinite_withcheck_stateful.cil.out.i LP64 true +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_mr_report__unexpected__cover_entry_havoc_memory.i LP64 false +Termination-MainControlFlow termination-crafted-lit/AliasDarteFeautrierGonnord-SAS2010-complex.c LP64 unknown +Termination-MainHeap termination-15/array05_alloca.i LP64 unknown +Arrays array-crafted/mapavg3.i ILP32 true +Floats float-benchs/mea8000.c ILP32 true +Hardness hardness/hardness_codemodifications_functionizing_file-24.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.arbitrated_top_n3_w16_d8_e0.c LP64 false +Heap forester-heap/dll-token-1.i ILP32 true +Loops loop-invgen/SpamAssassin-loop.i.v+cfa-reducer.c ILP32 true +ProductLines product-lines/elevator_spec1_product01.cil.c ILP32 true +Recursive fuzzle-programs/06_fuzzle_50x50_0-cycle.c LP64 false +Combinations combinations/Problem05_label42+token_ring.03.cil-1.c ILP32 False +SoftwareSystems-AWS-C-Common aws-c-common/aws_array_list_back_harness_negated.i LP64 false +SoftwareSystems-coreutils coreutils-v8.31/csplit_3args_klee-sa_ko_1332_csa_nd.c LP64 unknown +SoftwareSystems-DeviceDriversLinux64 ldv-linux-3.4-simple/32_1_cilled_ok_nondet_linux-3.4-32_1-drivers--media--dvb--frontends--dvb_dummy_fe.ko-ldv_main0_sequence_infinite_withcheck_stateful.cil.out.i LP64 true +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_servtd_wr__unexpected__safety_requirement_havoc_memory.i LP64 true +Termination-MainControlFlow termination-crafted-lit/AliasDarteFeautrierGonnord-SAS2010-random1d-1.c LP64 unknown +Termination-MainHeap termination-15/array16_alloca_fixed.i LP64 unknown +Arrays array-crafted/zero_sum3.c ILP32 true +Floats float-benchs/zonotope_loose.c ILP32 true +Hardness hardness/hardness_codemodifications_normal_file-36.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.bakery.2.prop1-back-serstep.c LP64 false +Heap forester-heap/sll-rb-cnstr_1-1.i ILP32 true +Loops loop-invgen/up.i ILP32 true +ProductLines product-lines/elevator_spec1_product21.cil.c ILP32 true +Recursive fuzzle-programs/10_fuzzle_50x50_CVE-2016-4487.c LP64 false +Combinations combinations/Problem05_label42+token_ring.13.cil-2.c ILP32 True +SoftwareSystems-AWS-C-Common aws-c-common/aws_array_list_ensure_capacity_harness.i LP64 true +SoftwareSystems-coreutils coreutils-v8.31/csplit_3args_klee-sa_ko_1367-1318-1319-1332_csa_uaf.c LP64 unknown +SoftwareSystems-DeviceDriversLinux64 ldv-linux-3.4-simple/32_1_cilled_ok_nondet_linux-3.4-32_1-drivers--media--rc--keymaps--rc-ati-x10.ko-ldv_main0_sequence_infinite_withcheck_stateful.cil.out.i LP64 true +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_vm_wr__expected__cover_proof_havoc_memory.i LP64 false +Termination-MainControlFlow termination-crafted-lit/Ben-Amram-LMCS2010-Ex2.3.c LP64 unknown +Termination-MainHeap termination-15/cstrcat_malloc.i LP64 unknown +Arrays array-examples/data_structures_set_multi_proc_ground-1.i ILP32 false +Floats float-newlib/double_req_bl_0876.c ILP32 true +Hardness hardness/hardness_codemodifications_steplocals_file-47.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.brp.6.prop1-back-serstep.c LP64 false +Heap heap-data/cart.i ILP32 true +Loops loop-new/count_by_1_variant.i ILP32 true +ProductLines product-lines/elevator_spec1_product29.cil.c ILP32 true +Combinations combinations/Problem05_label43+token_ring.10.cil-1.c ILP32 False +SoftwareSystems-AWS-C-Common aws-c-common/aws_array_list_init_dynamic_harness_negated.i LP64 false +SoftwareSystems-coreutils coreutils-v8.31/csplit_3args_klee-sa_ko_685_csa_nd.c LP64 unknown +SoftwareSystems-DeviceDriversLinux64 ldv-linux-3.4-simple/32_1_cilled_ok_nondet_linux-3.4-32_1-drivers--media--rc--keymaps--rc-azurewave-ad-tu700.ko-ldv_main0_sequence_infinite_withcheck_stateful.cil.out.i LP64 true +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_vm_wr__unexpected__cover_proof_havoc_memory.i LP64 false +Termination-MainControlFlow termination-crafted-lit/ChawdharyCookGulwaniSagivYang-ESOP2008-easy2.c LP64 unknown +Termination-MainHeap termination-15/cstrcmp_mixed_alloca.i LP64 unknown +Arrays array-examples/sorting_selectionsort_2_ground.i ILP32 false +Floats float-newlib/float_req_bl_0670.c ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_ci_file-59.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.brp2.6.prop3-func-interl.c LP64 true +Heap heap-manipulation/dll_of_dll-2.i ILP32 false +Loops loop-zilu/benchmark07_linear.i ILP32 unknown +ProductLines product-lines/elevator_spec2_product17.cil.c ILP32 true +Combinations combinations/Problem05_label44+token_ring.12.cil-2.c ILP32 False +SoftwareSystems-AWS-C-Common aws-c-common/aws_array_list_push_back_harness.i LP64 true +SoftwareSystems-coreutils coreutils-v8.31/cut_3args_klee-sa_ko_368_infer_nd.c LP64 unknown +SoftwareSystems-DeviceDriversLinux64 ldv-linux-3.4-simple/32_1_cilled_ok_nondet_linux-3.4-32_1-drivers--media--rc--keymaps--rc-digittrade.ko-ldv_main0_sequence_infinite_withcheck_stateful.cil.out.i LP64 true +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_vp_enter__invalid_input_vmflag__safety_requirement_havoc_memory.i LP64 true +Termination-MainControlFlow termination-crafted-lit/ChenFlurMukhopadhyay-SAS2012-Ex2.06.c LP64 unknown +Termination-MainHeap termination-15/cstrcspn_mixed_alloca.i LP64 unknown +Arrays array-examples/standard_copy5_ground-2.i ILP32 false +Floats float-newlib/float_req_bl_1130b.c ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_cn_file-7.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.cal129.c LP64 true +Heap ldv-memsafety/memleaks_test10-1.i ILP32 unknown +Loops loop-zilu/benchmark28_linear.i ILP32 unknown +ProductLines product-lines/elevator_spec2_product25.cil.c ILP32 true +Combinations combinations/Problem05_label45+token_ring.10.cil-2.c ILP32 True +SoftwareSystems-AWS-C-Common aws-c-common/aws_array_list_swap_harness_negated.i LP64 false +SoftwareSystems-coreutils coreutils-v8.31/cut_3args_klee-sa_ko_573-462-256-471_csa_infer_uaf.c LP64 unknown +SoftwareSystems-DeviceDriversLinux64 ldv-linux-3.4-simple/32_1_cilled_ok_nondet_linux-3.4-32_1-drivers--media--rc--keymaps--rc-evga-indtube.ko-ldv_main0_sequence_infinite_withcheck_stateful.cil.out.i LP64 true +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_vp_vmcall__unexpected__cover_entry_havoc_memory.i LP64 false +Termination-MainControlFlow termination-crafted-lit/ChenFlurMukhopadhyay-SAS2012-Ex2.18.c LP64 unknown +Termination-MainHeap termination-15/cstrncat_reverse_alloca.i LP64 unknown +Arrays array-examples/standard_palindrome_ground.i ILP32 true +Floats floats-cbmc-regression/float8.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_co_file-81.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.cal162.c LP64 true +Heap ldv-memsafety/memleaks_test14_2.i ILP32 unknown +Loops loop-zilu/benchmark51_polynomial.i ILP32 true +ProductLines product-lines/elevator_spec2_productSimulator.cil.c ILP32 false +Combinations combinations/Problem05_label46+token_ring.07.cil-1.c ILP32 True +SoftwareSystems-AWS-C-Common aws-c-common/aws_byte_buf_clean_up_harness.i LP64 true +SoftwareSystems-DeviceDriversLinux64 ldv-linux-3.4-simple/32_1_cilled_ok_nondet_linux-3.4-32_1-drivers--media--rc--keymaps--rc-imon-mce.ko-ldv_main0_sequence_infinite_withcheck_stateful.cil.out.i LP64 true +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_export_restore__unexpected__safety_requirement_havoc_memory.i LP64 true +Termination-MainControlFlow termination-crafted-lit/ChenFlurMukhopadhyay-SAS2012-Ex3.09.c LP64 unknown +Termination-MainHeap termination-15/cstrncpy_reverse_alloca.i LP64 unknown +Arrays array-examples/standard_strcpy_original-2.i ILP32 true +Floats floats-cdfpl/sine_3.i ILP32 false +Hardness hardness/hardness_fillercode_filler_pr_ci_file-92.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.cal196.c LP64 true +Heap ldv-memsafety/memleaks_test18.i ILP32 unknown +Loops loops-crafted-1/sumt3.c ILP32 true +ProductLines product-lines/elevator_spec3_product20.cil.c ILP32 false +Combinations combinations/Problem05_label47+token_ring.06.cil-2.c ILP32 False +SoftwareSystems-AWS-C-Common aws-c-common/aws_byte_buf_from_array_harness.i LP64 true +SoftwareSystems-DeviceDriversLinux64 ldv-linux-3.4-simple/32_1_cilled_ok_nondet_linux-3.4-32_1-drivers--media--rc--keymaps--rc-leadtek-y04g0051.ko-ldv_main0_sequence_infinite_withcheck_stateful.cil.out.i LP64 true +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_addcx__expected__safety_requirement_havoc_memory.i LP64 true +Termination-MainControlFlow termination-crafted-lit/GulavaniGulwani-CAV2008-Fig1c.c LP64 unknown +Termination-MainHeap termination-15/cstrspn_reverse_alloca.i LP64 unknown +Arrays array-fpi/brs2f.c ILP32 false +Floats floats-nonlinear/coral-benchmark01.c ILP32 false +Hardness hardness/hardness_fillercode_filler_pr_co_file-102.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.cal23.c LP64 true +Heap ldv-memsafety/memleaks_test22_2-1.i ILP32 unknown +Loops loops/invert_string-3.c ILP32 true +ProductLines product-lines/elevator_spec3_product29.cil.c ILP32 true +Combinations combinations/Problem05_label49+token_ring.01.cil-1.c ILP32 True +SoftwareSystems-AWS-C-Common aws-c-common/aws_byte_buf_init_harness.i LP64 true +SoftwareSystems-DeviceDriversLinux64 ldv-linux-3.4-simple/32_1_cilled_ok_nondet_linux-3.4-32_1-drivers--media--rc--keymaps--rc-nebula.ko-ldv_main0_sequence_infinite_withcheck_stateful.cil.out.i LP64 true +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_addcx__invalid_state_num_tdcx__cover_entry_havoc_object.i LP64 true +Termination-MainControlFlow termination-crafted-lit/KroeningSharyginaTsitovichWintersteiger-CAV2010-Ex.c LP64 unknown +Termination-MainHeap termination-dietlibc/dirname-2.i LP64 unknown +Arrays array-fpi/condn.c ILP32 true +Floats neural-networks/cartpole_19_safe.c-amalgamation.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_ci_file-113.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.cal51.c LP64 true +Heap ldv-memsafety/memleaks_test4-1.i ILP32 unknown +Loops loops/terminator_02-2.c ILP32 true +ProductLines product-lines/elevator_spec9_product26.cil.c ILP32 false +Combinations combinations/Problem05_label49+token_ring.11.cil-2.c ILP32 True +SoftwareSystems-AWS-C-Common aws-c-common/aws_byte_buf_write_be16_harness_negated.i LP64 false +SoftwareSystems-DeviceDriversLinux64 ldv-linux-3.4-simple/32_1_cilled_ok_nondet_linux-3.4-32_1-drivers--media--rc--keymaps--rc-pixelview-002t.ko-ldv_main0_sequence_infinite_withcheck_stateful.cil.out.i LP64 true +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_addcx__unexpected__cover_entry_havoc_object.i LP64 false +Termination-MainControlFlow termination-crafted-lit/LeikeHeizmann-TACAS2014-Ex9.c LP64 unknown +Termination-MainHeap termination-dietlibc/strcmp_short.i LP64 unknown +Arrays array-fpi/ifeqn1f.c ILP32 false +Floats neural-networks/cartpole_43_safe.c-amalgamation.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_cn_file-125.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.cal85.c LP64 true +Heap ldv-memsafety/memleaks_test8_1.i ILP32 unknown +Loops nla-digbench-scaling/bresenham-ll_unwindbound50.c ILP32 false +ProductLines product-lines/email_spec0_product05.cil.c ILP32 true +Combinations combinations/gcd_1+newton_2_7.i ILP32 False +SoftwareSystems-AWS-C-Common aws-c-common/aws_byte_buf_write_from_whole_string_harness_negated.i LP64 false +SoftwareSystems-DeviceDriversLinux64 ldv-linux-3.4-simple/32_1_cilled_ok_nondet_linux-3.4-32_1-drivers--media--rc--keymaps--rc-real-audio-220-32-keys.ko-ldv_main0_sequence_infinite_withcheck_stateful.cil.out.i LP64 true +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_create__invalid_state_kot_entry__cover_proof_havoc_object.i LP64 false +Termination-MainControlFlow termination-crafted-lit/PodelskiRybalchenko-TACAS2011-Fig1.c LP64 unknown +Termination-MainHeap termination-dietlibc/strrchr.i LP64 unknown +Arrays array-fpi/indp3f.c ILP32 false +Floats neural-networks/cartpole_67_safe.c-amalgamation.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_co_file-136.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.cambridge.6.prop1-func-interl.c LP64 false +Heap ldv-regression/rule60_list2.i ILP32 true +Loops nla-digbench-scaling/cohendiv-ll_unwindbound100.c ILP32 true +ProductLines product-lines/email_spec0_product24.cil.c ILP32 true +Combinations combinations/gcd_2+newton_2_4.i ILP32 True +SoftwareSystems-AWS-C-Common aws-c-common/aws_byte_cursor_compare_lookup_harness.i LP64 true +SoftwareSystems-DeviceDriversLinux64 ldv-linux-3.4-simple/32_1_cilled_ok_nondet_linux-3.4-32_1-drivers--media--rc--keymaps--rc-tivo.ko-ldv_main0_sequence_infinite_withcheck_stateful.cil.out.i LP64 true +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_init__invalid_input_tdr_pa__cover_entry_havoc_object.i LP64 false +Termination-MainControlFlow termination-crafted-lit/cstrncmp.c LP64 unknown +Termination-MainHeap termination-dietlibc/wcsrchr.i LP64 unknown +Arrays array-fpi/ms3.c ILP32 true +Floats neural-networks/cartpole_91_safe.c-amalgamation.i ILP32 true +Hardness hardness/hardness_fillercode_normal_file-148.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.collision.4.prop1-func-interl.c LP64 true +Heap ldv-regression/test23-1.c ILP32 false +Loops nla-digbench-scaling/dijkstra-u_valuebound50.c ILP32 true +ProductLines product-lines/email_spec0_product37.cil.c ILP32 true +Combinations combinations/gcd_3+newton_2_1.i ILP32 True +SoftwareSystems-AWS-C-Common aws-c-common/aws_byte_cursor_eq_harness_negated.i LP64 false +SoftwareSystems-DeviceDriversLinux64 ldv-linux-3.4-simple/32_1_cilled_ok_nondet_linux-3.4-32_1-drivers--media--rc--keymaps--rc-winfast.ko-ldv_main0_sequence_infinite_withcheck_stateful.cil.out.i LP64 true +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_init__invalid_state_op_state__cover_exit_havoc_object.i LP64 false +Termination-MainControlFlow termination-crafted/Arrays01-EquivalentConstantIndices-1.c LP64 unknown +Termination-MainHeap termination-memory-alloca/CookSeeZuleger-2013TACAS-Fig3-alloca.i LP64 unknown +Arrays array-fpi/res1f.c ILP32 false +Floats neural-networks/dubinsrejoin_17_safe.c-amalgamation.i ILP32 true +Hardness hardness/hardness_floats_has_floats_file-159.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.elevator.4.prop1-func-interl.c LP64 true +Heap ldv-sets/test_add-1.i ILP32 false +Loops nla-digbench-scaling/divbin_valuebound100.i ILP32 true +ProductLines product-lines/email_spec11_product15.cil.c ILP32 false +Combinations combinations/gcd_4+newton_1_6.i ILP32 False +SoftwareSystems-AWS-C-Common aws-c-common/aws_byte_cursor_left_trim_pred_harness.i LP64 true +SoftwareSystems-DeviceDriversLinux64 ldv-linux-3.4-simple/32_1_cilled_ok_nondet_linux-3.4-32_1-drivers--uwb--i1480--i1480-est.ko-ldv_main0_sequence_infinite_withcheck_stateful.cil.out.i LP64 true +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_init__unexpected__cover_exit_havoc_object.i LP64 false +Termination-MainControlFlow termination-crafted/Cairo_nondet.c LP64 unknown +Termination-MainHeap termination-memory-alloca/HarrisLalNoriRajamani-2010SAS-Fig3-alloca.i LP64 unknown +Arrays array-fpi/s2if.c ILP32 true +Floats neural-networks/dubinsrejoin_41_safe.c-amalgamation.i ILP32 true +Hardness hardness/hardness_floats_no_floats_file-170.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.firewire_tree.1.prop1-func-interl.c LP64 true +Heap list-ext-properties/list-ext_1.i ILP32 unknown +Loops nla-digbench-scaling/egcd2-ll_unwindbound5.c ILP32 false +ProductLines product-lines/email_spec11_product30.cil.c ILP32 false +Combinations combinations/pals_lcr.3.1.ufo.BOUNDED-6.pals+Problem12_label04.c ILP32 False +SoftwareSystems-AWS-C-Common aws-c-common/aws_byte_cursor_read_harness_negated.i LP64 false +SoftwareSystems-DeviceDriversLinux64 ldv-linux-3.4-simple/43_1a_cilled_ok_nondet_linux-43_1a-drivers--acpi--container.ko-ldv_main0_sequence_infinite_withcheck_stateful.cil.out.i LP64 true +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_key_config__invalid_state_tdr_metadata__cover_exit_havoc_object.i LP64 false +Termination-MainControlFlow termination-crafted/Hanoi_3vars.c LP64 unknown +Termination-MainHeap termination-memory-alloca/TelAviv-Amir-Minimum-alloca.i LP64 unknown +Arrays array-fpi/s4iff_overflow.c ILP32 unknown +Floats neural-networks/dubinsrejoin_66_safe.c-amalgamation.i ILP32 true +Hardness hardness/hardness_kloop_100_1loop_file-181.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.fischer.5.prop1-func-interl.c LP64 false +Heap list-ext-properties/test-0232_1-2.i ILP32 unknown +Loops nla-digbench-scaling/fermat1-ll_unwindbound10.c ILP32 false +ProductLines product-lines/email_spec11_productSimulator.cil.c ILP32 false +Combinations combinations/pals_lcr.3.ufo.UNBOUNDED.pals+Problem12_label03.c ILP32 False +SoftwareSystems-AWS-C-Common aws-c-common/aws_hash_byte_cursor_ptr_harness_negated.i LP64 false +SoftwareSystems-DeviceDriversLinux64 ldv-linux-3.4-simple/43_1a_cilled_ok_nondet_linux-43_1a-drivers--leds--leds-bd2802.ko-ldv_main0_sequence_infinite_withcheck_stateful.cil.out.i LP64 true +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_key_freeid__invalid_state_kot__cover_proof_havoc_object.i LP64 false +Termination-MainControlFlow termination-crafted/Mysore-1.c LP64 unknown +Termination-MainHeap termination-memory-alloca/a.01-alloca.i LP64 unknown +Arrays array-fpi/s5liff.c ILP32 false +Floats neural-networks/dubinsrejoin_90_safe.c-amalgamation.i ILP32 true +Hardness hardness/hardness_kloop_100_while_file-193.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.h_FourbyFour.c LP64 true +Heap list-ext3-properties/sll_nondet_insert-1.i ILP32 false +Loops nla-digbench-scaling/fermat2-ll_valuebound5.c ILP32 true +ProductLines product-lines/email_spec1_product28.cil.c ILP32 true +Combinations combinations/pals_lcr.4.1.ufo.UNBOUNDED.pals+Problem12_label09.c ILP32 False +SoftwareSystems-AWS-C-Common aws-c-common/aws_hash_iter_begin_harness-1.i LP64 false +SoftwareSystems-DeviceDriversLinux64 ldv-linux-3.4-simple/43_1a_cilled_ok_nondet_linux-43_1a-drivers--media--common--tuners--tda9887.ko-ldv_main0_sequence_infinite_withcheck_stateful.cil.out.i LP64 true +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_vpflushdone__expected__cover_proof_havoc_memory.i LP64 false +Termination-MainControlFlow termination-crafted/NonTerminationSimple4.c LP64 unknown +Termination-MainHeap termination-memory-alloca/a.10-alloca.i LP64 unknown +Arrays array-fpi/sqmf.c ILP32 false +Floats neural-networks/gcas_10_safe.c-amalgamation.i ILP32 true +Hardness hardness/hardness_kloop_25_1loop_file-24.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.iprotocol.6.prop1-back-serstep.c LP64 false +Heap list-properties/simple_built_from_end.i ILP32 true +Loops nla-digbench-scaling/geo1-ll2_valuebound20.c ILP32 unknown +ProductLines product-lines/email_spec1_productSimulator.cil.c ILP32 false +Combinations combinations/pals_lcr.4_overflow.ufo.UNBOUNDED.pals+Problem12_label01.c ILP32 False +SoftwareSystems-AWS-C-Common aws-c-common/aws_hash_string_harness.i LP64 true +SoftwareSystems-DeviceDriversLinux64 ldv-linux-3.4-simple/43_1a_cilled_ok_nondet_linux-43_1a-drivers--media--rc--keymaps--rc-alink-dtu-m.ko-ldv_main0_sequence_infinite_withcheck_stateful.cil.out.i LP64 true +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_vpflushdone__invalid_state_tdr_metadata__cover_proof_havoc_memory.i LP64 false +Termination-MainControlFlow termination-crafted/Pure3Phase-2.c LP64 unknown +Termination-MainHeap termination-memory-alloca/b.03-no-inv_assume-alloca.i LP64 unknown +Arrays array-industry-pattern/array_of_struct_ptr_monotonic.i ILP32 true +Floats neural-networks/logistic_2_safe.c-amalgamation.i ILP32 true +Hardness hardness/hardness_kloop_25_while_file-36.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.lamport_nonatomic.5.prop1-func-interl.c LP64 true +Heap memsafety-broom/linux-hlist-fst-data.i LP64 unknown +Loops nla-digbench-scaling/geo1-u2_valuebound20.c ILP32 unknown +ProductLines product-lines/email_spec27_product27.cil.c ILP32 false +Combinations combinations/pals_lcr.5.ufo.BOUNDED-10.pals+Problem12_label06.c ILP32 False +SoftwareSystems-AWS-C-Common aws-c-common/aws_hash_table_find_harness_negated.i LP64 false +SoftwareSystems-DeviceDriversLinux64 ldv-linux-3.4-simple/43_1a_cilled_ok_nondet_linux-43_1a-drivers--media--rc--keymaps--rc-avermedia-m135a.ko-ldv_main0_sequence_infinite_withcheck_stateful.cil.out.i LP64 true +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mr_finalize__invalid_input_hkid__safety_requirement_havoc_memory.i LP64 true +Termination-MainControlFlow termination-crafted/SyntaxSupportPointer01-2.c LP64 unknown +Termination-MainHeap termination-memory-alloca/b.10-alloca.i LP64 unknown +Arrays array-memsafety-realloc/array-realloc-3.i ILP32 unknown +Floats neural-networks/lunarlander_27_unsafe.c-amalgamation.i ILP32 false +Hardness hardness/hardness_kloop_50_1loop_file-47.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.leader_filters.5.prop1-back-serstep.c LP64 true +Heap memsafety-broom/sll-nested-linux-list.i LP64 unknown +Loops nla-digbench-scaling/geo2-ll2_valuebound20.c ILP32 unknown +ProductLines product-lines/email_spec27_product35.cil.c ILP32 false +Combinations combinations/pals_lcr.6.1.ufo.BOUNDED-12.pals+Problem12_label04.c ILP32 False +SoftwareSystems-AWS-C-Common aws-c-common/aws_hash_table_put_harness.i LP64 true +SoftwareSystems-DeviceDriversLinux64 ldv-linux-3.4-simple/43_1a_cilled_ok_nondet_linux-43_1a-drivers--media--rc--keymaps--rc-cinergy-1400.ko-ldv_main0_sequence_infinite_withcheck_stateful.cil.out.i LP64 true +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mr_finalize__invalid_state_tdr_metadata__cover_entry_havoc_memory.i LP64 false +Termination-MainControlFlow termination-crafted/easy1.c LP64 unknown +Termination-MainHeap termination-memory-alloca/b.18-alloca.i LP64 unknown +Arrays array-memsafety/cstrcspn-alloca-1.i ILP32 unknown +Floats neural-networks/lunarlander_51_unsafe.c-amalgamation.i ILP32 false +Hardness hardness/hardness_kloop_50_while_file-59.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.mcs.1.prop1-func-interl.c LP64 true +Heap memsafety-cve/NanoNNG.i ILP32 unknown +Loops nla-digbench-scaling/geo3-ll2_valuebound20.c ILP32 unknown +ProductLines product-lines/email_spec3_product27.cil.c ILP32 false +Combinations combinations/pals_lcr.6.ufo.UNBOUNDED.pals+Problem12_label03.c ILP32 False +SoftwareSystems-AWS-C-Common aws-c-common/aws_linked_list_begin_harness_negated.i LP64 false +SoftwareSystems-DeviceDriversLinux64 ldv-linux-3.4-simple/43_1a_cilled_ok_nondet_linux-43_1a-drivers--media--rc--keymaps--rc-em-terratec.ko-ldv_main0_sequence_infinite_withcheck_stateful.cil.out.i LP64 true +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_phymem_page_reclaim__invalid_input_pa__cover_entry_havoc_memory.i LP64 false +Termination-MainControlFlow termination-nla/cohencu5-both-nt.c ILP32 unknown +Termination-MainHeap termination-memory-alloca/count_down-alloca-2.i LP64 unknown +Arrays array-memsafety/knapsack_alloca_unsafe.i ILP32 unknown +Floats neural-networks/lunarlander_75_safe.c-amalgamation.i ILP32 true +Hardness hardness/hardness_operatoramount_amount100_file-7.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.needham.2.prop1-func-interl.c LP64 false +Heap memsafety-cve/gpac_1.i ILP32 unknown +Loops nla-digbench-scaling/hard-ll_valuebound10.c ILP32 true +ProductLines product-lines/email_spec3_product35.cil.c ILP32 false +Combinations combinations/pals_lcr.7.1.ufo.UNBOUNDED.pals+Problem12_label09.c ILP32 False +SoftwareSystems-AWS-C-Common aws-c-common/aws_linked_list_next_harness.i LP64 true +SoftwareSystems-DeviceDriversLinux64 ldv-linux-3.4-simple/43_1a_cilled_ok_nondet_linux-43_1a-drivers--media--rc--keymaps--rc-fusionhdtv-mce.ko-ldv_main0_sequence_infinite_withcheck_stateful.cil.out.i LP64 true +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_phymem_page_reclaim__invalid_state_pamt_metadata__cover_exit_havoc_memory.i LP64 false +Termination-MainControlFlow termination-nla/dijkstra6-both-nt.c ILP32 unknown +Termination-MainHeap termination-memory-alloca/cstrncmp-alloca-2.i LP64 unknown +Arrays array-memsafety/openbsd_cstrlcpy-alloca-1.i ILP32 unknown +Floats neural-networks/lunarlander_99_unsafe.c-amalgamation.i ILP32 false +Hardness hardness/hardness_operatoramount_amount10_file-81.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.peterson.1.prop1-back-serstep.c LP64 true +Heap memsafety-cve/gpac_5.i ILP32 unknown +Loops nla-digbench-scaling/hard2_unwindbound20.c ILP32 unknown +ProductLines product-lines/email_spec4_product25.cil.c ILP32 false +Combinations combinations/pals_lcr.7_overflow.ufo.UNBOUNDED.pals+Problem12_label01.c ILP32 False +SoftwareSystems-AWS-C-Common aws-c-common/aws_linked_list_push_back_harness.i LP64 true +SoftwareSystems-DeviceDriversLinux64 ldv-linux-3.4-simple/43_1a_cilled_ok_nondet_linux-43_1a-drivers--media--rc--keymaps--rc-it913x-v2.ko-ldv_main0_sequence_infinite_withcheck_stateful.cil.out.i LP64 true +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_config__invalid_input_hkid__cover_exit_havoc_memory.i LP64 false +Termination-MainControlFlow termination-nla/freire1-both-nt.c ILP32 unknown +Termination-MainHeap termination-memory-alloca/ex3a-alloca.i LP64 unknown +Arrays array-memsafety/stroeder2-alloca-1.i ILP32 unknown +Floats neural-networks/poly_16_16_16_thresh_1_safe.c-amalgamation.i ILP32 true +Hardness hardness/hardness_operatoramount_amount250_file-92.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.pgm_protocol.4.prop1-back-serstep.c LP64 true +Heap memsafety-cve/krb5.i ILP32 unknown +Loops nla-digbench-scaling/lcm1_unwindbound100.c ILP32 false +ProductLines product-lines/email_spec4_product34.cil.c ILP32 false +Combinations combinations/pals_lcr.8.ufo.BOUNDED-16.pals+Problem12_label06.c ILP32 False +SoftwareSystems-AWS-C-Common aws-c-common/aws_mul_size_checked_harness.i LP64 true +SoftwareSystems-DeviceDriversLinux64 ldv-linux-3.4-simple/43_1a_cilled_ok_nondet_linux-43_1a-drivers--media--rc--keymaps--rc-medion-x10.ko-ldv_main0_sequence_infinite_withcheck_stateful.cil.out.i LP64 true +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_config__invalid_state_sys_state__cover_proof_havoc_memory.i LP64 false +Termination-MainControlFlow termination-nla/knuth-nosqrt-both-t.i ILP32 unknown +Termination-MainHeap termination-memory-alloca/lis-alloca-2.i LP64 unknown +Arrays array-multidimensional/init-non-constant-2-n-u.c ILP32 true +Floats neural-networks/poly_32_32_32_thresh_4_unsafe.c-amalgamation.i ILP32 false +Hardness hardness/hardness_operatoramount_amount500_file-102.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.pgm_protocol.8.prop5-func-interl.c LP64 false +Heap memsafety-cve/minizip-ngFixed.i ILP32 unknown +Loops nla-digbench-scaling/lcm2_valuebound50.c ILP32 true +ProductLines product-lines/email_spec6_product22.cil.c ILP32 false +Combinations combinations/pc_sfifo_1.cil-1+token_ring.03.cil-2.c ILP32 False +SoftwareSystems-AWS-C-Common aws-c-common/aws_priority_queue_init_dynamic_harness.i LP64 true +SoftwareSystems-DeviceDriversLinux64 ldv-linux-3.4-simple/43_1a_cilled_ok_nondet_linux-43_1a-drivers--media--rc--keymaps--rc-pctv-sedna.ko-ldv_main0_sequence_infinite_withcheck_stateful.cil.out.i LP64 true +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_init__expected__cover_proof_havoc_object.i LP64 false +Termination-MainControlFlow termination-nla/ps3-both-t.c ILP32 unknown +Termination-MainHeap termination-memory-alloca/openbsd_cstpcpy-alloca-2.i LP64 unknown +Arrays array-patterns/array16_pattern.c ILP32 true +Floats neural-networks/poly_64_64_thresh_0_safe.c-amalgamation.i ILP32 true +Hardness hardness/hardness_operatoramount_amount50_file-113.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.protocols.4.prop1-func-interl.c LP64 false +Heap memsafety-cve/openNDS_1Fixed.i ILP32 unknown +Loops nla-digbench-scaling/prodbin-ll_unwindbound100.c ILP32 true +ProductLines product-lines/email_spec6_product34.cil.c ILP32 false +Combinations combinations/pc_sfifo_1.cil-2+token_ring.06.cil-1.c ILP32 False +SoftwareSystems-AWS-C-Common aws-c-common/aws_priority_queue_remove_harness_negated.i LP64 false +SoftwareSystems-DeviceDriversLinux64 ldv-linux-3.4-simple/43_1a_cilled_ok_nondet_linux-43_1a-drivers--media--rc--keymaps--rc-powercolor-real-angel.ko-ldv_main0_sequence_infinite_withcheck_stateful.cil.out.i LP64 true +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_init__unexpected__cover_proof_havoc_object.i LP64 false +Termination-MainControlFlow termination-numeric/Avg_true.c LP64 unknown +Termination-MainHeap termination-memory-alloca/openbsd_cstrncat-alloca-1.i LP64 unknown +Arrays array-patterns/array29_pattern.c ILP32 true +Floats neural-networks/robot_5_safe.c-amalgamation.i ILP32 true +Hardness hardness/hardness_wrappers_normal_file-125.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.rushhour.1.prop1-func-interl.c LP64 false +Heap memsafety-cve/radare2Fixed.i ILP32 unknown +Loops nla-digbench-scaling/ps2-ll_valuebound5.c ILP32 true +ProductLines product-lines/email_spec7_product24.cil.c ILP32 true +Combinations combinations/pc_sfifo_2.cil-1+token_ring.02.cil-2.c ILP32 False +SoftwareSystems-AWS-C-Common aws-c-common/aws_priority_queue_size_harness.i LP64 true +SoftwareSystems-DeviceDriversLinux64 ldv-linux-3.4-simple/43_1a_cilled_ok_nondet_linux-43_1a-drivers--media--rc--keymaps--rc-technisat-usb2.ko-ldv_main0_sequence_infinite_withcheck_stateful.cil.out.i LP64 true +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_key_config__unexpected__cover_proof_havoc_object.i LP64 false +Termination-MainControlFlow termination-numeric/TerminatorRec02.c LP64 unknown +Termination-MainHeap termination-memory-alloca/selectionsort-alloca-2.i LP64 unknown +Arrays array-programs/copysome1-1.i ILP32 true +Floats neural-networks/softplus_0_safe.c-amalgamation.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_a_file-136.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.sokoban.1.prop1-func-interl.c LP64 false +Heap memsafety-cve/sofia-sip_2.i ILP32 unknown +Loops nla-digbench-scaling/ps4-ll_valuebound10.c ILP32 true +ProductLines product-lines/email_spec7_product33.cil.c ILP32 false +Combinations combinations/pc_sfifo_2.cil-1+token_ring.13.cil-1.c ILP32 False +SoftwareSystems-AWS-C-Common aws-c-common/aws_ring_buffer_init_harness.i LP64 true +SoftwareSystems-DeviceDriversLinux64 ldv-linux-3.4-simple/43_1a_cilled_ok_nondet_linux-43_1a-drivers--media--rc--keymaps--rc-twinhan1027.ko-ldv_main0_sequence_infinite_withcheck_stateful.cil.out.i LP64 true +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_shutdown__invalid_input_handoff_range__safety_requirement_havoc_object.i LP64 true +Termination-MainControlFlow termination-restricted-15/Log.c LP64 unknown +Termination-MainHeap termination-memory-linkedlists/cll_search-alloca-1.i LP64 unknown +Arrays array-tiling/mlceu.c ILP32 false +Floats neural-networks/softsign_w32_r4_case_1_unsafe.c-amalgamation.i ILP32 false +Hardness hardness/hardness_wrappers_wrapper_ap_file-148.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.szymanski.4.prop1-back-serstep.c LP64 false +Heap memsafety-ext/skiplist_3lvl.i ILP32 unknown +Loops nla-digbench-scaling/ps6-ll_unwindbound5.c ILP32 false +ProductLines product-lines/email_spec8_product21.cil.c ILP32 false +Combinations combinations/pc_sfifo_3.cil+token_ring.03.cil-1.c ILP32 False +SoftwareSystems-AWS-C-Common aws-c-common/aws_string_destroy_harness_negated.i LP64 true +SoftwareSystems-DeviceDriversLinux64 ldv-linux-3.4-simple/43_1a_cilled_ok_nondet_linux-43_1a-drivers--misc--apds9802als.ko-ldv_main0_sequence_infinite_withcheck_stateful.cil.out.i LP64 true +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_update__invalid_state_handoff_version__cover_entry_havoc_memory.i LP64 false +Termination-MainControlFlow termination-restricted-15/PastaB17.c LP64 unknown +Termination-MainHeap termination-recursive-malloc/chunk1-2.i LP64 unknown +Arrays array-tiling/revcpyswp2.c ILP32 true +Floats neural-networks/sqrt_1_safe.c-amalgamation.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_p_file-159.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.twocount32.c LP64 false +Heap memsafety-ext3/freeAlloca.c ILP32 unknown +Loops nla-digbench/bresenham.c ILP32 unknown +ProductLines product-lines/email_spec8_product33.cil.c ILP32 false +Combinations combinations/pc_sfifo_3.cil+token_ring.13.cil-2.c ILP32 True +SoftwareSystems-AWS-C-Common aws-c-common/aws_string_eq_c_str_harness.i LP64 true +SoftwareSystems-DeviceDriversLinux64 ldv-linux-3.4-simple/43_1a_cilled_ok_nondet_linux-43_1a-drivers--mtd--tests--mtd_subpagetest.ko-ldv_main0_sequence_infinite_withcheck_stateful.cil.out.i LP64 true +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_update__unexpected__cover_entry_havoc_memory.i LP64 false +Termination-MainControlFlow termination-restricted-15/a.06.c LP64 unknown +Termination-MainHeap termination-recursive-malloc/rec_malloc_ex1.i LP64 unknown +Arrays reducercommutativity/max.i ILP32 true +Floats neural-networks/tanh_w32_r2_case_1_unsafe.c-amalgamation.i ILP32 false +Hardness hardness/hardness_wrappers_wrapper_s_file-170.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.vcegar_arrays_itc99_b12_p2.c LP64 true +Heap memsafety/test-0102-1.i ILP32 unknown +Loops nla-digbench/geo2-ll.c ILP32 true +ProductLines product-lines/email_spec9_product20.cil.c ILP32 false +Combinations combinations/square_4+soft_float_3a.c.cil.c ILP32 True +SoftwareSystems-AWS-C-Common aws-c-common/aws_string_new_from_c_str_harness_negated.i LP64 false +SoftwareSystems-DeviceDriversLinux64 ldv-linux-3.4-simple/43_1a_cilled_ok_nondet_linux-43_1a-drivers--usb--misc--trancevibrator.ko-ldv_main0_sequence_infinite_withcheck_stateful.cil.out.i LP64 true +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_vp_enter__invalid_state_num_tdcx__cover_entry_havoc_memory.i LP64 true +Termination-MainControlFlow termination-restricted-15/b.09-no-inv_assume.c LP64 unknown +Arrays reducercommutativity/sep40-1.i ILP32 true +Floats neural-networks/tanh_w8_r4_case_0_safe.c-amalgamation.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_sp_file-182.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.vis_arrays_vsa16a_p7.c LP64 false +Heap memsafety/test-0235-2.i ILP32 unknown +Loops nla-digbench/ps5-ll.c ILP32 true +ProductLines product-lines/email_spec9_product32.cil.c ILP32 false +Combinations combinations/square_7+soft_float_3a.c.cil.c ILP32 True +SoftwareSystems-AWS-C-Common aws-c-common/sliced_aws_byte_cursor_eq_c_str_ignore_case_harness.i LP64 true +SoftwareSystems-DeviceDriversLinux64 ldv-linux-3.4-simple/43_1a_cilled_ok_nondet_linux-43_1a-drivers--w1--slaves--w1_ds2760.ko-ldv_main0_sequence_infinite_withcheck_stateful.cil.out.i LP64 true +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_vp_enter__invalid_state_td_state__cover_proof_havoc_memory.i LP64 false +Termination-MainControlFlow termination-restricted-15/c.02.c LP64 unknown +Arrays array-cav19/array_init_pair_symmetr2.c ILP32 true +Floats float-benchs/cast_union_tight.c ILP32 false +Hardness hardness/hardness_codemodifications_dependencies_file-145.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.adding.1.prop1-func-interl.c LP64 false +Heap forester-heap/dll-circular-1.i ILP32 false +Loops loop-acceleration/array_4.i ILP32 true +ProductLines product-lines/elevator_spec14_product11.cil.c ILP32 true +Combinations combinations/Problem05_label40+token_ring.05.cil-1.c ILP32 False +SoftwareSystems-AWS-C-Common aws-c-common/aws_add_size_checked_harness_negated.i LP64 false +SoftwareSystems-DeviceDriversLinux64 ldv-consumption/32_7a_cilled_linux-3.8-rc1-32_7a-drivers--media--dvb-frontends--stv090x.ko-ldv_main0_sequence_infinite_withcheck_stateful.cil.out.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_mr_report__expected__cover_proof_havoc_object.i LP64 false +Termination-MainControlFlow termination-crafted-lit/AliasDarteFeautrierGonnord-SAS2010-Fig2b.c LP64 unknown +Arrays array-crafted/bAnd2.i ILP32 true +Floats float-benchs/filter2_set.c ILP32 true +Hardness hardness/hardness_codemodifications_dependencies_file-61.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.anderson.4.prop1-func-interl.c LP64 true +Heap forester-heap/dll-rb-cnstr_1-1.i ILP32 true +Loops loop-crafted/simple_array_index_value_2.i ILP32 true +Combinations combinations/Problem05_label41+token_ring.02.cil-1.c ILP32 False +SoftwareSystems-AWS-C-Common aws-c-common/aws_array_eq_c_str_ignore_case_harness.i LP64 true +SoftwareSystems-DeviceDriversLinux64 ldv-linux-3.4-simple/32_1_cilled_ok_nondet_linux-3.4-32_1-drivers--hwmon--gpio-fan.ko-ldv_main0_sequence_infinite_withcheck_stateful.cil.out.i LP64 true +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_mr_report__unexpected__safety_requirement_havoc_memory.i LP64 true +Termination-MainControlFlow termination-crafted-lit/AliasDarteFeautrierGonnord-SAS2010-cousot9.c LP64 unknown +Arrays array-crafted/bor4.i ILP32 true +Floats float-benchs/inv_Newton-2.c ILP32 false +Hardness hardness/hardness_codemodifications_functionizing_file-156.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.arbitrated_top_n2_w8_d128_e0.c LP64 false +Heap forester-heap/dll-simple-white-blue-2.i ILP32 true +Loops loop-invariants/linear-inequality-inv-a.c ILP32 true +Combinations combinations/Problem05_label41+token_ring.13.cil-2.c ILP32 False +SoftwareSystems-AWS-C-Common aws-c-common/aws_array_eq_ignore_case_harness.i LP64 true +SoftwareSystems-DeviceDriversLinux64 ldv-linux-3.4-simple/32_1_cilled_ok_nondet_linux-3.4-32_1-drivers--macintosh--mac_hid.ko-ldv_main0_sequence_infinite_withcheck_stateful.cil.out.i LP64 true +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_servtd_wr__unconstrained__cover_exit_unsuccess_havoc_object.i LP64 false +Termination-MainControlFlow termination-crafted-lit/AliasDarteFeautrierGonnord-SAS2010-ndecr.c LP64 unknown +Arrays array-crafted/mapsum2.i ILP32 true +Floats float-benchs/rlim_invariant.c.v+lhb-reducer.c ILP32 true +Hardness hardness/hardness_codemodifications_functionizing_file-72.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.arbitrated_top_n4_w16_d64_e0.c LP64 false +Heap forester-heap/sll-01-2.i ILP32 false +Loops loop-invgen/apache-get-tag.i.v+lhb-reducer.c ILP32 true +Combinations combinations/Problem05_label42+token_ring.05.cil-2.c ILP32 False +SoftwareSystems-AWS-C-Common aws-c-common/aws_array_list_clean_up_harness.i LP64 true +SoftwareSystems-DeviceDriversLinux64 ldv-linux-3.4-simple/32_1_cilled_ok_nondet_linux-3.4-32_1-drivers--media--dvb--frontends--tua6100.ko-ldv_main0_sequence_infinite_withcheck_stateful.cil.out.i LP64 true +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_sys_rd__expected__cover_proof_havoc_memory.i LP64 false +Termination-MainControlFlow termination-crafted-lit/AliasDarteFeautrierGonnord-SAS2010-rsd.c LP64 unknown +Arrays array-crafted/xor4.i ILP32 true +Floats float-benchs/sqrt_biNewton_pseudoconstant.c ILP32 true +Hardness hardness/hardness_codemodifications_normal_file-168.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.at.4.prop1-func-interl.c LP64 true +Heap forester-heap/sll-optional-2.i ILP32 false +Loops loop-invgen/large_const.i ILP32 true +Combinations combinations/Problem05_label42+token_ring.11.cil-1.c ILP32 False +SoftwareSystems-AWS-C-Common aws-c-common/aws_array_list_comparator_string_harness_negated.i LP64 false +SoftwareSystems-DeviceDriversLinux64 ldv-linux-3.4-simple/32_1_cilled_ok_nondet_linux-3.4-32_1-drivers--media--rc--keymaps--rc-asus-pc39.ko-ldv_main0_sequence_infinite_withcheck_stateful.cil.out.i LP64 true +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_sys_rd__unexpected__cover_proof_havoc_object.i LP64 false +Termination-MainControlFlow termination-crafted-lit/AliasDarteFeautrierGonnord-SAS2010-while2.c LP64 unknown +Arrays array-crafted/zero_sum_const2.c ILP32 true +Floats float-newlib/double_req_bl_0660b.c ILP32 true +Hardness hardness/hardness_codemodifications_normal_file-84.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.bakery.6.prop1-func-interl.c LP64 false +Heap forester-heap/sll-rb-sentinel-2.i ILP32 false +Loops loop-lit/css2003.i ILP32 true +Combinations combinations/Problem05_label43+token_ring.02.cil-1.c ILP32 True +SoftwareSystems-AWS-C-Common aws-c-common/aws_array_list_erase_harness_negated.i LP64 true +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_vm_wr__invalid_input_field_id__cover_exit_havoc_memory.i LP64 false +Termination-MainControlFlow termination-crafted-lit/BrockschmidtCookFuhs-CAV2013-Fig1.c LP64 unknown +Arrays array-crafted/zero_sum_m2.c ILP32 true +Floats float-newlib/double_req_bl_0684b.c ILP32 true +Hardness hardness/hardness_codemodifications_steplocals_file-179.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.brp.1.prop1-func-interl.c LP64 true +Heap forester-heap/sll-token-1.i ILP32 false +Loops loop-lit/hhk2008.i ILP32 true +Combinations combinations/Problem05_label43+token_ring.07.cil-2.c ILP32 False +SoftwareSystems-AWS-C-Common aws-c-common/aws_array_list_get_at_ptr_harness.i LP64 true +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_vm_wr__unconstrained__cover_exit_success_havoc_object.i LP64 false +Termination-MainControlFlow termination-crafted-lit/ChawdharyCookGulwaniSagivYang-ESOP2008-aaron4.c LP64 unknown +Arrays array-examples/relax-2-2.i ILP32 true +Floats float-newlib/double_req_bl_1122a.c ILP32 true +Hardness hardness/hardness_codemodifications_steplocals_file-95.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.brp2.2.prop1-func-interl.c LP64 false +Heap heap-data/process_queue.i ILP32 true +Loops loop-new/gauss_sum.i.v+cfa-reducer.c ILP32 true +Combinations combinations/Problem05_label43+token_ring.12.cil-2.c ILP32 True +SoftwareSystems-AWS-C-Common aws-c-common/aws_array_list_length_harness.i LP64 true +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_vp_enter__expected__cover_exit_havoc_memory.i LP64 false +Termination-MainControlFlow termination-crafted-lit/ChenFlurMukhopadhyay-SAS2012-Ex1.01.c LP64 unknown +Arrays array-examples/sanfoundry_43_ground.i ILP32 true +Floats float-newlib/float_req_bl_0660b.c ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_ci_file-190.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.brp2.5.prop2-back-serstep.c LP64 true +Heap heap-manipulation/bubble_sort_linux-2.i ILP32 false +Loops loop-zilu/benchmark02_linear.i ILP32 true +Combinations combinations/Problem05_label44+token_ring.07.cil-1.c ILP32 False +SoftwareSystems-AWS-C-Common aws-c-common/aws_array_list_pop_front_harness_negated.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_vp_enter__invalid_input_gpa__safety_requirement_havoc_object.i LP64 true +Termination-MainControlFlow termination-crafted-lit/ChenFlurMukhopadhyay-SAS2012-Ex2.03.c LP64 unknown +Arrays array-examples/standard_compareModified_ground.i ILP32 true +Floats float-newlib/float_req_bl_0684b.c ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_cn_file-105.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.cal103.c LP64 true +Heap heap-manipulation/sll_to_dll_rev-1.i ILP32 false +Loops loop-zilu/benchmark12_linear.i ILP32 unknown +Combinations combinations/Problem05_label45+token_ring.02.cil-2.c ILP32 False +SoftwareSystems-AWS-C-Common aws-c-common/aws_array_list_set_at_harness_negated.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_vp_enter__unexpected__cover_entry_havoc_memory.i LP64 false +Termination-MainControlFlow termination-crafted-lit/ChenFlurMukhopadhyay-SAS2012-Ex2.09.c LP64 unknown +Arrays array-examples/standard_copy3_ground-2.i ILP32 false +Floats float-newlib/float_req_bl_0920a.c ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_cn_file-21.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.cal120.c LP64 true +Heap ldv-memsafety/memleaks_test1-1.i ILP32 unknown +Loops loop-zilu/benchmark24_conjunctive.i ILP32 unknown +Combinations combinations/Problem05_label45+token_ring.08.cil-1.c ILP32 True +SoftwareSystems-AWS-C-Common aws-c-common/aws_array_list_swap_contents_harness.i LP64 true +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_vp_vmcall__invalid_input_bitmap__cover_exit_havoc_object.i LP64 false +Termination-MainControlFlow termination-crafted-lit/ChenFlurMukhopadhyay-SAS2012-Ex2.15.c LP64 unknown +Arrays array-examples/standard_copy7_ground-2.i ILP32 true +Floats float-newlib/float_req_bl_1270a.c ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_co_file-116.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.cal137.c LP64 true +Heap ldv-memsafety/memleaks_test11_1.i ILP32 unknown +Loops loop-zilu/benchmark34_conjunctive.i ILP32 true +Combinations combinations/Problem05_label45+token_ring.13.cil-1.c ILP32 False +SoftwareSystems-AWS-C-Common aws-c-common/aws_byte_buf_append_dynamic_harness.i LP64 true +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_vp_vmcall__unexpected__safety_requirement_havoc_memory.i LP64 true +Termination-MainControlFlow termination-crafted-lit/ChenFlurMukhopadhyay-SAS2012-Ex2.21.c LP64 unknown +Arrays array-examples/standard_find_ground-2.i ILP32 unknown +Floats floats-cbmc-regression/float19.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_co_file-33.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.cal154.c LP64 true +Heap ldv-memsafety/memleaks_test13_2.i ILP32 unknown +Loops loop-zilu/benchmark45_disjunctive.i ILP32 unknown +Combinations combinations/Problem05_label46+token_ring.04.cil-2.c ILP32 False +SoftwareSystems-AWS-C-Common aws-c-common/aws_byte_buf_append_with_lookup_harness_negated.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_export_restore__unconstrained__cover_exit_unsuccess_havoc_object.i LP64 false +Termination-MainControlFlow termination-crafted-lit/ChenFlurMukhopadhyay-SAS2012-Ex3.06.c LP64 unknown +Arrays array-examples/standard_partition_original_ground.i ILP32 true +Floats floats-cdfpl/newton_1_7.i ILP32 false +Hardness hardness/hardness_fillercode_filler_pr_ci_file-128.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.cal170.c LP64 true +Heap ldv-memsafety/memleaks_test15-2.i ILP32 unknown +Loops loops-crafted-1/in-de31.c ILP32 true +Combinations combinations/Problem05_label46+token_ring.09.cil-2.c ILP32 False +SoftwareSystems-AWS-C-Common aws-c-common/aws_byte_buf_clean_up_secure_harness_negated.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_import_abort__expected__cover_proof_havoc_memory.i LP64 false +Termination-MainControlFlow termination-crafted-lit/ChenFlurMukhopadhyay-SAS2012-Fig1.c LP64 unknown +Arrays array-examples/standard_strcmp_ground.i ILP32 true +Floats floats-cdfpl/newton_3_4.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_ci_file-44.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.cal188.c LP64 true +Heap ldv-memsafety/memleaks_test17_2-1.i ILP32 unknown +Loops loops-crafted-1/nested_delay_nd.c ILP32 true +Combinations combinations/Problem05_label47+token_ring.01.cil-1.c ILP32 False +SoftwareSystems-AWS-C-Common aws-c-common/aws_byte_buf_eq_harness_negated.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_import_abort__unexpected__safety_requirement_havoc_object.i LP64 true +Termination-MainControlFlow termination-crafted-lit/CookSeeZuleger-TACAS2013-Fig8b.c LP64 unknown +Arrays array-examples/standard_two_index_04.i ILP32 true +Floats floats-cdfpl/square_2.i ILP32 false +Hardness hardness/hardness_fillercode_filler_pr_cn_file-139.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.cal203.c LP64 true +Heap ldv-memsafety/memleaks_test18_3.i ILP32 unknown +Loops loops-crafted-1/sumt9.c ILP32 true +Combinations combinations/Problem05_label47+token_ring.11.cil-2.c ILP32 False +SoftwareSystems-AWS-C-Common aws-c-common/aws_byte_buf_from_c_str_harness.i LP64 true +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_addcx__invalid_input_tdcx_pa__cover_proof_havoc_object.i LP64 false +Termination-MainControlFlow termination-crafted-lit/HarrisLalNoriRajamani-SAS2010-Fig2.c LP64 unknown +Arrays array-examples/standard_vector_difference_ground.i ILP32 true +Floats floats-esbmc-regression/trunc_nondet_2.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_cn_file-56.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.cal221.c LP64 true +Heap ldv-memsafety/memleaks_test21-2.i ILP32 unknown +Loops loops/insertion_sort-1-2.c ILP32 false +Combinations combinations/Problem05_label48+token_ring.09.cil-1.c ILP32 False +SoftwareSystems-AWS-C-Common aws-c-common/aws_byte_buf_init_copy_from_cursor_harness_negated.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_addcx__invalid_state_lifecycle__cover_exit_havoc_memory.i LP64 false +Termination-MainControlFlow termination-crafted-lit/HeizmannHoenickeLeikePodelski-ATVA2013-Fig7.c LP64 unknown +Arrays array-fpi/brs4f.c ILP32 false +Floats floats-nonlinear/coral-benchmark21.c ILP32 false +Hardness hardness/hardness_fillercode_filler_pr_co_file-150.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.cal26.c LP64 true +Heap ldv-memsafety/memleaks_test22_3-2.i ILP32 unknown +Loops loops/n.c24.i ILP32 false +Combinations combinations/Problem05_label49+token_ring.03.cil-2.c ILP32 True +SoftwareSystems-AWS-C-Common aws-c-common/aws_byte_buf_reserve_harness_negated.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_addcx__invalid_state_num_tdcx__safety_requirement_havoc_object.i LP64 true +Termination-MainControlFlow termination-crafted-lit/LeeJonesBen-Amram-POPL2001-Ex1.c LP64 unknown +Arrays array-fpi/condg.c ILP32 true +Floats neural-networks/cartpole_12_safe.c-amalgamation.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_co_file-67.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.cal43.c LP64 true +Heap ldv-memsafety/memleaks_test23_4.i ILP32 unknown +Loops loops/sum_array-1.c ILP32 unknown +Combinations combinations/Problem05_label49+token_ring.09.cil-1.c ILP32 True +SoftwareSystems-AWS-C-Common aws-c-common/aws_byte_buf_secure_zero_harness.i LP64 true +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_addcx__invalid_state_td_state__safety_requirement_havoc_memory.i LP64 true +Termination-MainControlFlow termination-crafted-lit/LeikeHeizmann-TACAS2014-Ex1.c LP64 unknown +Arrays array-fpi/eqn2.c ILP32 true +Floats neural-networks/cartpole_25_safe.c-amalgamation.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_ci_file-161.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.cal6.c LP64 true +Heap ldv-memsafety/memleaks_test5_1.i ILP32 unknown +Loops loops/trex01-2.i ILP32 true +Combinations combinations/Problem05_label49+token_ring.14.cil.c ILP32 False +SoftwareSystems-AWS-C-Common aws-c-common/aws_byte_buf_write_be64_harness.i LP64 true +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_addcx__unexpected__safety_requirement_havoc_object.i LP64 true +Termination-MainControlFlow termination-crafted-lit/LeikeHeizmann-WST2014-Ex6.c LP64 unknown +Arrays array-fpi/eqn5f.c ILP32 false +Floats neural-networks/cartpole_37_safe.c-amalgamation.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_ci_file-79.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.cal77.c LP64 true +Heap ldv-memsafety/memleaks_test7-1.i ILP32 unknown +Loops nla-digbench-scaling/bresenham-ll_unwindbound1.c ILP32 false +Combinations combinations/gcd_1+newton_2_2.i ILP32 True +SoftwareSystems-AWS-C-Common aws-c-common/aws_byte_buf_write_from_whole_cursor_harness.i LP64 true +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_create__invalid_input_rdx__safety_requirement_havoc_memory.i LP64 true +Termination-MainControlFlow termination-crafted-lit/PodelskiRybalchenko-LICS2004-Fig1.c LP64 unknown +Arrays array-fpi/ifeqn3f.c ILP32 false +Floats neural-networks/cartpole_49_safe.c-amalgamation.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_cn_file-173.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.cal93.c LP64 true +Heap ldv-memsafety/memleaks_test9_1.i ILP32 unknown +Loops nla-digbench-scaling/bresenham-ll_valuebound5.c ILP32 true +Combinations combinations/gcd_1+newton_3_4.i ILP32 True +SoftwareSystems-AWS-C-Common aws-c-common/aws_byte_buf_write_u8_harness.i LP64 true +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_create__invalid_state_tdr_page__cover_proof_havoc_object.i LP64 false +Termination-MainControlFlow termination-crafted-lit/PodelskiRybalchenko-TACAS2011-Fig4.c LP64 unknown +Arrays array-fpi/indp1f.c ILP32 false +Floats neural-networks/cartpole_60_safe.c-amalgamation.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_cn_file-9.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.cambridge.4.prop1-back-serstep.c LP64 true +Heap ldv-regression/rule57_ebda_blast.i ILP32 true +Loops nla-digbench-scaling/cohencu-ll_valuebound2.c ILP32 true +Combinations combinations/gcd_2+newton_1_7.i ILP32 False +SoftwareSystems-AWS-C-Common aws-c-common/aws_byte_cursor_advance_nospec_harness_negated.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_init__expected__cover_exit_havoc_memory.i LP64 false +Termination-MainControlFlow termination-crafted-lit/cstrcmp.c LP64 unknown +Arrays array-fpi/indp5f.c ILP32 false +Floats neural-networks/cartpole_73_safe.c-amalgamation.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_co_file-184.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.circular_pointer_top_w16_d128_e0.c LP64 false +Heap ldv-regression/test11.c ILP32 true +Loops nla-digbench-scaling/cohendiv-ll_valuebound10.c ILP32 true +Combinations combinations/gcd_2+newton_3_1.i ILP32 True +SoftwareSystems-AWS-C-Common aws-c-common/aws_byte_cursor_eq_byte_buf_harness_negated.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_init__invalid_input_tdr_pa__safety_requirement_havoc_object.i LP64 true +Termination-MainControlFlow termination-crafted-lit/gcd1.c LP64 unknown +Arrays array-fpi/ms1.c ILP32 true +Floats neural-networks/cartpole_85_safe.c-amalgamation.i ILP32 true +Hardness hardness/hardness_fillercode_normal_file-10.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.circular_pointer_top_w8_d8_e0.c LP64 false +Heap ldv-regression/test22-1.c ILP32 true +Loops nla-digbench-scaling/dijkstra-u_valuebound1.c ILP32 true +Combinations combinations/gcd_3+newton_1_4.i ILP32 False +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_init__invalid_state_no_tdcx__cover_proof_havoc_memory.i LP64 true +Termination-MainControlFlow termination-crafted/4NestedWith3Variables-2.c LP64 unknown +Arrays array-fpi/ms5.c ILP32 true +Floats neural-networks/cartpole_97_safe.c-amalgamation.i ILP32 true +Hardness hardness/hardness_fillercode_normal_file-196.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.cyclic_scheduler.1.prop1-back-serstep.c LP64 true +Heap ldv-regression/test24-2.c ILP32 false +Loops nla-digbench-scaling/divbin2_unwindbound5.i ILP32 true +Combinations combinations/gcd_3+newton_2_6.i ILP32 False +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_init__invalid_state_pamt_metadata__cover_entry_havoc_object.i LP64 false +Termination-MainControlFlow termination-crafted/Bangalore-1.c LP64 unknown +Arrays array-fpi/nsqmf.c ILP32 false +Floats neural-networks/dubinsrejoin_10_safe.c-amalgamation.i ILP32 true +Hardness hardness/hardness_floats_has_floats_file-110.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.driving_phils.5.prop1-func-interl.c LP64 false +Heap ldv-regression/test28-2.c ILP32 true +Loops nla-digbench-scaling/divbin_unwindbound2.i ILP32 true +Combinations combinations/gcd_4+newton_1_1.i ILP32 True +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_init__unconstrained__cover_exit_success_havoc_memory.i LP64 false +Termination-MainControlFlow termination-crafted/Benghazi_nondet-2.c LP64 unknown +Arrays array-fpi/res2f.c ILP32 false +Floats neural-networks/dubinsrejoin_23_safe.c-amalgamation.i ILP32 true +Hardness hardness/hardness_floats_has_floats_file-27.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.eq_sdp_v1.c LP64 true +Heap ldv-sets/test_mutex_double_lock.i ILP32 false +Loops nla-digbench-scaling/egcd-ll_unwindbound10.c ILP32 false +Combinations combinations/gcd_4+newton_2_3.i ILP32 True +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_key_config__invalid_input_tdr_hkid__cover_entry_havoc_object.i LP64 false +Termination-MainControlFlow termination-crafted/Collatz.c LP64 unknown +Arrays array-fpi/s1lif.c ILP32 true +Floats neural-networks/dubinsrejoin_35_safe.c-amalgamation.i ILP32 true +Hardness hardness/hardness_floats_no_floats_file-122.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.extinction.1.prop1-func-interl.c LP64 true +Heap list-ext-properties/960521-1_1-2.i ILP32 unknown +Loops nla-digbench-scaling/egcd-ll_valuebound50.c ILP32 true +Combinations combinations/gcd_4+newton_3_6.i ILP32 False +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_key_config__invalid_state_tdr_lifecycle__cover_exit_havoc_memory.i LP64 false +Termination-MainControlFlow termination-crafted/Gothenburg_v2-1.c LP64 unknown +Arrays array-fpi/s32if.c ILP32 true +Floats neural-networks/dubinsrejoin_48_safe.c-amalgamation.i ILP32 true +Hardness hardness/hardness_floats_no_floats_file-39.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.firewire_tree.2.prop3-back-serstep.c LP64 false +Heap list-ext-properties/list-ext_flag_1.i ILP32 unknown +Loops nla-digbench-scaling/egcd2-ll_valuebound20.c ILP32 true +Combinations combinations/pals_lcr.3.1.ufo.UNBOUNDED.pals+Problem12_label04.c ILP32 False +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_key_config__unconstrained__cover_exit_unsuccess_havoc_object.i LP64 false +Termination-MainControlFlow termination-crafted/LexIndexValue-Array-2.c LP64 unknown +Arrays array-fpi/s42iff.c ILP32 false +Floats neural-networks/dubinsrejoin_5_safe.c-amalgamation.i ILP32 true +Hardness hardness/hardness_kloop_100_1loop_file-133.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.firewire_tree.5.prop3-func-interl.c LP64 true +Loops nla-digbench-scaling/egcd3-ll_valuebound100.c ILP32 true +Combinations combinations/pals_lcr.3.ufo.BOUNDED-6.pals+Problem12_label08.c ILP32 False +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_key_freeid__invalid_input_tdr_hkid__cover_proof_havoc_memory.i LP64 false +Termination-MainControlFlow termination-crafted/McCarthy91_Recursion.c LP64 unknown +Arrays array-fpi/s4liff_overflow.c ILP32 unknown +Floats neural-networks/dubinsrejoin_72_safe.c-amalgamation.i ILP32 true +Hardness hardness/hardness_kloop_100_1loop_file-5.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.frogs.3.prop1-back-serstep.c LP64 false +Loops nla-digbench-scaling/fermat1-ll_valuebound1.c ILP32 true +Combinations combinations/pals_lcr.3.ufo.UNBOUNDED.pals+Problem12_label08.c ILP32 False +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_key_freeid__invalid_state_tdr_metadata__cover_entry_havoc_memory.i LP64 false +Termination-MainControlFlow termination-crafted/NestedRecursion_1a-1.c LP64 unknown +Arrays array-fpi/s5iff.c ILP32 false +Floats neural-networks/dubinsrejoin_84_unsafe.c-amalgamation.i ILP32 false +Hardness hardness/hardness_kloop_100_while_file-145.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.gear.2.prop3-func-interl.c LP64 false +Loops nla-digbench-scaling/fermat2-ll_unwindbound50.c ILP32 false +Combinations combinations/pals_lcr.4.1.ufo.BOUNDED-8.pals+Problem12_label09.c ILP32 False +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_key_freeid__unexpected__cover_proof_havoc_object.i LP64 false +Termination-MainControlFlow termination-crafted/NonTermination2.c LP64 unknown +Arrays array-fpi/sina2.c ILP32 true +Floats neural-networks/dubinsrejoin_9_safe.c-amalgamation.i ILP32 true +Hardness hardness/hardness_kloop_100_while_file-61.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.h_Vsa16.c LP64 true +Loops nla-digbench-scaling/freire1_valuebound20.c ILP32 true +Combinations combinations/pals_lcr.4.ufo.BOUNDED-8.pals+Problem12_label04.c ILP32 True +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_vpflushdone__invalid_input_tdr_hkid__cover_exit_havoc_memory.i LP64 false +Termination-MainControlFlow termination-crafted/NonTerminationSimple8.c LP64 unknown +Arrays array-fpi/sina5f.c ILP32 false +Floats neural-networks/exp_1_safe.c-amalgamation.i ILP32 true +Hardness hardness/hardness_kloop_25_1loop_file-156.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.iprotocol.1.prop1-func-interl.c LP64 false +Loops nla-digbench-scaling/geo1-ll2_unwindbound100.c ILP32 unknown +Combinations combinations/pals_lcr.4.ufo.UNBOUNDED.pals+Problem12_label05.c ILP32 True +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_vpflushdone__invalid_state_tdr_lifecycle__cover_exit_havoc_object.i LP64 false +Termination-MainControlFlow termination-crafted/Pure2Phase-1.c LP64 unknown +Arrays array-fpi/ss2f.c ILP32 false +Floats neural-networks/gcas_6_unsafe.c-amalgamation.i ILP32 false +Hardness hardness/hardness_kloop_25_1loop_file-72.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.krebs.2.prop1-func-interl.c LP64 false +Loops nla-digbench-scaling/geo1-ll_unwindbound20.c ILP32 true +Combinations combinations/pals_lcr.5.1.ufo.BOUNDED-10.pals+Problem12_label01.c ILP32 False +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_vpflushdone__unexpected__cover_exit_havoc_memory.i LP64 false +Termination-MainControlFlow termination-crafted/RecursiveNonterminating-2.c LP64 unknown +Arrays array-industry-pattern/array_monotonic.i ILP32 true +Floats neural-networks/log_3_unsafe.c-amalgamation.i ILP32 false +Hardness hardness/hardness_kloop_25_while_file-168.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.lamport_nonatomic.1.prop1-back-serstep.c LP64 true +Loops nla-digbench-scaling/geo1-u2_unwindbound100.c ILP32 unknown +Combinations combinations/pals_lcr.5.ufo.BOUNDED-10.pals+Problem12_label01.c ILP32 True +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mr_finalize__expected__safety_requirement_havoc_object.i LP64 true +Arrays array-industry-pattern/array_ptr_single_elem_init-2.i ILP32 false +Floats neural-networks/lunarlander_0_unsafe.c-amalgamation.i ILP32 false +Hardness hardness/hardness_kloop_25_while_file-84.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.lann.5.prop1-back-serstep.c LP64 true +Loops nla-digbench-scaling/geo1-u_unwindbound20.c ILP32 false +Combinations combinations/pals_lcr.5.ufo.UNBOUNDED.pals+Problem12_label01.c ILP32 True +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mr_finalize__invalid_state_lifecycle__cover_proof_havoc_memory.i LP64 false +Arrays array-lopstr16/single_elem_safe.i ILP32 true +Floats neural-networks/lunarlander_21_unsafe.c-amalgamation.i ILP32 false +Hardness hardness/hardness_kloop_50_1loop_file-179.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.leader_election.6.prop1-func-interl.c LP64 false +Loops nla-digbench-scaling/geo2-ll2_unwindbound100.c ILP32 unknown +Combinations combinations/pals_lcr.5_overflow.ufo.UNBOUNDED.pals+Problem12_label04.c ILP32 False +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mr_finalize__invalid_state_td_state__cover_entry_havoc_object.i LP64 false +Arrays array-memsafety/array02-alloca-2.i ILP32 unknown +Floats neural-networks/lunarlander_33_unsafe.c-amalgamation.i ILP32 false +Hardness hardness/hardness_kloop_50_1loop_file-95.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.lifts.2.prop1-func-interl.c LP64 true +Loops nla-digbench-scaling/geo2-ll_unwindbound20.c ILP32 true +Combinations combinations/pals_lcr.6.1.ufo.UNBOUNDED.pals+Problem12_label04.c ILP32 False +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mr_finalize__unconstrained__cover_exit_success_havoc_memory.i LP64 false +Arrays array-memsafety/cstrchr-alloca-2.i ILP32 unknown +Floats neural-networks/lunarlander_45_unsafe.c-amalgamation.i ILP32 false +Hardness hardness/hardness_kloop_50_while_file-190.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.lup.1.prop1-back-serstep.c LP64 true +Loops nla-digbench-scaling/geo3-ll2_unwindbound100.c ILP32 unknown +Combinations combinations/pals_lcr.6.ufo.BOUNDED-12.pals+Problem12_label08.c ILP32 False +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_phymem_page_reclaim__expected__cover_entry_havoc_object.i LP64 false +Arrays array-memsafety/cstrncat_unsafe.c ILP32 unknown +Floats neural-networks/lunarlander_57_unsafe.c-amalgamation.i ILP32 false +Hardness hardness/hardness_operatoramount_amount100_file-105.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.mcs.6.prop1-back-serstep.c LP64 true +Loops nla-digbench-scaling/geo3-ll_unwindbound20.c ILP32 true +Combinations combinations/pals_lcr.6.ufo.UNBOUNDED.pals+Problem12_label08.c ILP32 False +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_phymem_page_reclaim__invalid_input_pa__safety_requirement_havoc_memory.i LP64 true +Arrays array-memsafety/diff-alloca-2.i ILP32 unknown +Floats neural-networks/lunarlander_69_unsafe.c-amalgamation.i ILP32 false +Hardness hardness/hardness_operatoramount_amount100_file-21.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.needham.1.prop1-back-serstep.c LP64 false +Loops nla-digbench-scaling/hard-ll_unwindbound100.c ILP32 false +Combinations combinations/pals_lcr.7.1.ufo.BOUNDED-14.pals+Problem12_label09.c ILP32 False +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_phymem_page_reclaim__invalid_state_lifecycle__cover_exit_havoc_object.i LP64 false +Arrays array-memsafety/mult_array_unsafe.i ILP32 unknown +Floats neural-networks/lunarlander_81_unsafe.c-amalgamation.i ILP32 false +Hardness hardness/hardness_operatoramount_amount10_file-116.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.needham.3.prop2-back-serstep.c LP64 true +Loops nla-digbench-scaling/hard-u_unwindbound1.c ILP32 false +Combinations combinations/pals_lcr.7.ufo.BOUNDED-14.pals+Problem12_label04.c ILP32 True +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_phymem_page_reclaim__unconstrained__cover_exit_unsuccess_havoc_memory.i LP64 false +Arrays array-memsafety/openbsd_cstrcat-alloca-2.i ILP32 unknown +Floats neural-networks/lunarlander_92_safe.c-amalgamation.i ILP32 true +Hardness hardness/hardness_operatoramount_amount10_file-33.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.peg_solitaire.2.prop1-func-interl.c LP64 false +Loops nla-digbench-scaling/hard-u_valuebound5.c ILP32 true +Combinations combinations/pals_lcr.7.ufo.UNBOUNDED.pals+Problem12_label05.c ILP32 True +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_config__expected__cover_exit_havoc_object.i LP64 false +Arrays array-memsafety/openbsd_cstrncpy-alloca-2.i ILP32 unknown +Floats neural-networks/poly_1024_thresh_5_unsafe.c-amalgamation.i ILP32 false +Hardness hardness/hardness_operatoramount_amount250_file-128.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.peterson.5.prop1-func-interl.c LP64 false +Loops nla-digbench-scaling/hard2_valuebound2.c ILP32 true +Combinations combinations/pals_lcr.8.1.ufo.BOUNDED-16.pals+Problem12_label01.c ILP32 False +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_config__invalid_input_num_ptr__cover_entry_havoc_memory.i LP64 false +Arrays array-memsafety/selectionsort-alloca-1.i ILP32 unknown +Floats neural-networks/poly_16_16_16_16_thresh_0_safe.c-amalgamation.i ILP32 true +Hardness hardness/hardness_operatoramount_amount250_file-44.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.pgm_protocol.2.prop6-back-serstep.c LP64 true +Loops nla-digbench-scaling/knuth_valuebound100.i ILP32 true +Combinations combinations/pals_lcr.8.ufo.BOUNDED-16.pals+Problem12_label01.c ILP32 True +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_config__invalid_state_lp_state__cover_proof_havoc_object.i LP64 false +Arrays array-multidimensional/add-2-n-u.c ILP32 true +Floats neural-networks/poly_16_16_thresh_2_safe.c-amalgamation.i ILP32 true +Hardness hardness/hardness_operatoramount_amount25_file-139.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.pgm_protocol.5.prop1-func-interl.c LP64 true +Loops nla-digbench-scaling/lcm1_valuebound10.c ILP32 true +Combinations combinations/pals_lcr.8.ufo.UNBOUNDED.pals+Problem12_label01.c ILP32 True +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_config__invalid_state_tdmr_info__cover_exit_havoc_object.i LP64 false +Arrays array-multidimensional/diff-3-n-u.c ILP32 true +Floats neural-networks/poly_32_32_32_32_thresh_3_unsafe.c-amalgamation.i ILP32 false +Hardness hardness/hardness_operatoramount_amount25_file-56.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.pgm_protocol.7.prop5-back-serstep.c LP64 true +Loops nla-digbench-scaling/lcm2_valuebound1.c ILP32 true +Combinations combinations/pals_lcr.8_overflow.ufo.UNBOUNDED.pals+Problem12_label04.c ILP32 False +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_config__unexpected__safety_requirement_havoc_memory.i LP64 true +Arrays array-multidimensional/min-2-u.c ILP32 true +Floats neural-networks/poly_32_32_thresh_4_unsafe.c-amalgamation.i ILP32 false +Hardness hardness/hardness_operatoramount_amount500_file-150.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.plc.2.prop2-func-interl.c LP64 true +Loops nla-digbench-scaling/mannadiv_unwindbound5.c ILP32 false +Combinations combinations/pc_sfifo_1.cil-1+token_ring.08.cil-1.c ILP32 False +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_init__invalid_input_rcx__cover_exit_havoc_object.i LP64 false +Arrays array-patterns/array12_pattern.c ILP32 true +Floats neural-networks/poly_512_thresh_5_unsafe.c-amalgamation.i ILP32 false +Hardness hardness/hardness_operatoramount_amount500_file-67.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.production_cell.6.prop1-back-serstep.c LP64 false +Loops nla-digbench-scaling/prod4br-ll_valuebound2.c ILP32 true +Combinations combinations/pc_sfifo_1.cil-2+token_ring.03.cil-2.c ILP32 True +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_init__unconstrained__cover_exit_unsuccess_havoc_memory.i LP64 false +Arrays array-patterns/array1_pattern.c ILP32 true +Floats neural-networks/poly_8_8_8_8_thresh_1_safe.c-amalgamation.i ILP32 true +Hardness hardness/hardness_operatoramount_amount50_file-161.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.recount4.c LP64 false +Loops nla-digbench-scaling/prodbin-ll_valuebound10.c ILP32 true +Combinations combinations/pc_sfifo_1.cil-2+token_ring.08.cil-2.c ILP32 False +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_key_config__expected__cover_exit_havoc_object.i LP64 false +Arrays array-patterns/array25_pattern.c ILP32 true +Floats neural-networks/relu_2_safe.c-amalgamation.i ILP32 true +Hardness hardness/hardness_operatoramount_amount50_file-79.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.rether.4.prop1-back-serstep.c LP64 false +Loops nla-digbench-scaling/ps2-ll_unwindbound50.c ILP32 true +Combinations combinations/pc_sfifo_1.cil-2+token_ring.14.cil.c ILP32 False +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_key_config__unconstrained__cover_exit_unsuccess_havoc_memory.i LP64 false +Arrays array-patterns/array3_pattern.c ILP32 true +Floats neural-networks/sin_2_safe.c-amalgamation.i ILP32 true +Hardness hardness/hardness_wrappers_normal_file-173.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.schedule_world.1.prop1-back-serstep.c LP64 false +Loops nla-digbench-scaling/ps3-ll_unwindbound20.c ILP32 true +Combinations combinations/pc_sfifo_2.cil-1+token_ring.05.cil-1.c ILP32 True +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_shutdown__expected__cover_exit_havoc_object.i LP64 false +Arrays array-patterns/array7_pattern.c ILP32 true +Floats neural-networks/softmax_3_unsafe.c-amalgamation.i ILP32 false +Hardness hardness/hardness_wrappers_normal_file-9.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.shift_register_top_w64_d32_e0.c LP64 false +Loops nla-digbench-scaling/ps4-ll_unwindbound100.c ILP32 false +Combinations combinations/pc_sfifo_2.cil-1+token_ring.10.cil-2.c ILP32 True +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_shutdown__invalid_input_handoff_range__cover_entry_havoc_memory.i LP64 false +Arrays array-programs/partial_mod_count_limited_1.c ILP32 true +Floats neural-networks/softsign_1_safe.c-amalgamation.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_a_file-184.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.sw_loop_v.c LP64 false +Loops nla-digbench-scaling/ps5-ll_unwindbound1.c ILP32 false +Combinations combinations/pc_sfifo_2.cil-2+token_ring.02.cil-1.c ILP32 False +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_shutdown__unexpected__cover_proof_havoc_memory.i LP64 false +Floats neural-networks/softsign_w32_r1_case_0_unsafe.c-amalgamation.i ILP32 false +Hardness hardness/hardness_wrappers_wrapper_ap_file-10.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.synapse.6.prop1-func-interl.c LP64 true +Loops nla-digbench-scaling/ps5-ll_valuebound50.c ILP32 true +Combinations combinations/pc_sfifo_2.cil-2+token_ring.13.cil-2.c ILP32 False +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_update__invalid_state_handoff_data__cover_entry_havoc_object.i LP64 false +Floats neural-networks/softsign_w4_r3_case_1_unsafe.c-amalgamation.i ILP32 false +Hardness hardness/hardness_wrappers_wrapper_ap_file-196.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.telephony.3.prop1-func-interl.c LP64 false +Loops nla-digbench-scaling/ps6-ll_valuebound20.c ILP32 true +Combinations combinations/pc_sfifo_3.cil+token_ring.05.cil-2.c ILP32 False +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_update__invalid_state_handoff_version__safety_requirement_havoc_memory.i LP64 true +Floats neural-networks/softsign_w8_r2_case_0_safe.c-amalgamation.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_p_file-110.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.train-gate.4.prop1-func-interl.c LP64 true +Loops nla-digbench-scaling/sqrt1-ll_valuebound100.c ILP32 true +Combinations combinations/pc_sfifo_3.cil+token_ring.11.cil-1.c ILP32 False +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_update__invalid_state_sys_state__cover_exit_havoc_object.i LP64 false +Floats neural-networks/tanh_0_safe.c-amalgamation.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_p_file-27.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.vcegar_QF_BV_itc99_b13_p02.c LP64 true +Loops nla-digbench/dijkstra.c ILP32 unknown +Combinations combinations/square_1+soft_float_3a.c.cil.c ILP32 False +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_update__unexpected__safety_requirement_havoc_memory.i LP64 true +Floats neural-networks/tanh_w16_r3_case_0_safe.c-amalgamation.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_s_file-122.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.vcegar_QF_BV_itc99_b13_p21.c LP64 true +Loops nla-digbench/fermat2.c ILP32 unknown +Combinations combinations/square_3+soft_float_4-2a.c.cil.c ILP32 False +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_vp_enter__invalid_state_lifecycle__cover_entry_havoc_object.i LP64 false +Floats neural-networks/tanh_w4_r2_case_0_safe.c-amalgamation.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_s_file-39.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.vis_QF_BV_s1269b_p3.c LP64 true +Loops nla-digbench/hard-ll.c ILP32 true +Combinations combinations/square_5+soft_float_1-3a.c.cil.c ILP32 False +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_vp_enter__invalid_state_num_tdcx__safety_requirement_havoc_memory.i LP64 true +Floats neural-networks/tanh_w64_r4_case_1_safe.c-amalgamation.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_sp_file-134.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.vis_arrays_field5.c LP64 true +Loops nla-digbench/ps2-ll.c ILP32 true +Combinations combinations/square_6+soft_float_4-3a.c.cil.c ILP32 False +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_vp_enter__invalid_state_pamt_metadata__cover_exit_havoc_object.i LP64 false +Floats neural-networks/vdp_3_unsafe.c-amalgamation.i ILP32 false +Hardness hardness/hardness_wrappers_wrapper_sp_file-50.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.vis_arrays_vsaR_p08.c LP64 true +Loops verifythis/duplets.c ILP32 true +Combinations combinations/square_8+soft_float_1-3a.c.cil.c ILP32 False +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_vp_enter__unexpected__cover_entry_havoc_object.i LP64 false +Floats float-benchs/cast_float_ptr.c ILP32 false +Hardness hardness/hardness_codemodifications_dependencies_file-120.i ILP32 true +Hardware hardware-verification-array/btor2c-lazyMod.unsafe_linked_list_fifo_n2d4.c LP64 false +Loops loop-acceleration/array_2-2.i ILP32 true +Combinations combinations/Problem05_label40+token_ring.02.cil-1.c ILP32 False +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_mr_report__expected__cover_exit_havoc_memory.i LP64 false +Floats float-benchs/divmul_diverge.c ILP32 true +Hardness hardness/hardness_codemodifications_dependencies_file-169.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.adding.3.prop1-func-interl.c LP64 false +Loops loop-acceleration/diamond_2-2.c ILP32 true +Combinations combinations/Problem05_label40+token_ring.07.cil-1.c ILP32 False +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_mr_report__unconstrained__cover_exit_success_havoc_memory.i LP64 false +Floats float-benchs/filter2.c ILP32 true +Hardness hardness/hardness_codemodifications_dependencies_file-37.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.anderson.2.prop1-back-serstep.c LP64 true +Loops loop-acceleration/simple_3-1.c ILP32 false +Combinations combinations/Problem05_label40+token_ring.12.cil-2.c ILP32 False +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_mr_report__unexpected__cover_exit_havoc_object.i LP64 false +Floats float-benchs/image_filter.c ILP32 true +Hardness hardness/hardness_codemodifications_dependencies_file-85.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.anderson.7.prop1-back-serstep.c LP64 false +Loops loop-crafted/simple_array_index_value_4.i ILP32 true +Combinations combinations/Problem05_label41+token_ring.05.cil-1.c ILP32 False +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_servtd_wr__expected__cover_entry_havoc_object.i LP64 false +Floats float-benchs/interpolation2.c.v+nlh-reducer.c ILP32 true +Hardness hardness/hardness_codemodifications_functionizing_file-131.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.arbitrated_top_n2_w32_d128_e0.c LP64 false +Loops loop-industry-pattern/mod3.c.v+sep-reducer.c ILP32 true +Combinations combinations/Problem05_label41+token_ring.10.cil-2.c ILP32 False +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_servtd_wr__unconstrained__cover_exit_success_havoc_memory.i LP64 false +Floats float-benchs/inv_sqrt_Quake.c ILP32 true +Hardness hardness/hardness_codemodifications_functionizing_file-18.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.arbitrated_top_n2_w8_d8_e0.c LP64 false +Loops loop-invariants64/linear-inequality-inv-d.c LP64 true +Combinations combinations/Problem05_label42+token_ring.01.cil-2.c ILP32 False +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_servtd_wr__unexpected__cover_exit_havoc_memory.i LP64 false +Floats float-benchs/nan_float.c ILP32 false +Hardness hardness/hardness_codemodifications_functionizing_file-48.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.arbitrated_top_n3_w8_d64_e0.c LP64 false +Loops loop-invgen/apache-get-tag.i.p+lhb-reducer.c ILP32 true +Combinations combinations/Problem05_label42+token_ring.04.cil-1.c ILP32 True +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_sys_rd__expected__cover_entry_havoc_object.i LP64 false +Floats float-benchs/sin_interpolated_bigrange_loose.c ILP32 true +Hardness hardness/hardness_codemodifications_functionizing_file-97.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.arbitrated_top_n4_w8_d64_e0.c LP64 false +Loops loop-invgen/down.i ILP32 true +Combinations combinations/Problem05_label42+token_ring.07.cil-1.c ILP32 True +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_sys_rd__expected__safety_requirement_havoc_object.i LP64 true +Floats float-benchs/sqrt_Householder_interval.c ILP32 true +Hardness hardness/hardness_codemodifications_normal_file-143.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.at.2.prop1-back-serstep.c LP64 false +Loops loop-invgen/id_build.i.v+lhb-reducer.c ILP32 true +Combinations combinations/Problem05_label42+token_ring.09.cil-2.c ILP32 False +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_sys_rd__unexpected__cover_exit_havoc_memory.i LP64 false +Floats float-benchs/zonotope_3.c.p+cfa-reducer.c ILP32 true +Hardness hardness/hardness_codemodifications_normal_file-191.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.at.6.prop1-func-interl.c LP64 false +Loops loop-invgen/nested9.i ILP32 true +Combinations combinations/Problem05_label42+token_ring.12.cil-1.c ILP32 False +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_vm_wr__expected__cover_entry_havoc_memory.i LP64 false +Floats float-newlib/double_req_bl_0320.c ILP32 true +Hardness hardness/hardness_codemodifications_normal_file-6.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.bakery.4.prop1-back-serstep.c LP64 false +Loops loop-lit/cggmp2005.i ILP32 true +Combinations combinations/Problem05_label42+token_ring.15.cil.c ILP32 False +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_vm_wr__expected__safety_requirement_havoc_object.i LP64 true +Floats float-newlib/double_req_bl_0662a.c ILP32 true +Hardness hardness/hardness_codemodifications_steplocals_file-106.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.bit-vector.c LP64 true +Loops loop-lit/gj2007.c.i.p+lhb-reducer.c ILP32 true +Combinations combinations/Problem05_label43+token_ring.03.cil-2.c ILP32 True +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_vm_wr__invalid_input_field_id__cover_proof_havoc_object.i LP64 false +Floats float-newlib/double_req_bl_0683a.c ILP32 true +Hardness hardness/hardness_codemodifications_steplocals_file-154.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.bridge.2.prop1-back-serstep.c LP64 false +Loops loop-lit/gsv2008.c.i.v+cfa-reducer.c ILP32 true +Combinations combinations/Problem05_label43+token_ring.06.cil-1.c ILP32 False +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_vm_wr__invalid_input_rcx__safety_requirement_havoc_memory.i LP64 true +Floats float-newlib/double_req_bl_0870b.c ILP32 true +Hardness hardness/hardness_codemodifications_steplocals_file-22.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.brp.3.prop1-func-interl.c LP64 false +Loops loop-lit/jm2006_variant.i ILP32 true +Combinations combinations/Problem05_label43+token_ring.08.cil-2.c ILP32 False +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_vm_wr__unexpected__cover_entry_havoc_memory.i LP64 false +Floats float-newlib/double_req_bl_0920a.c ILP32 true +Hardness hardness/hardness_codemodifications_steplocals_file-70.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.brp2.1.prop2-back-serstep.c LP64 true +Loops loop-new/count_by_nondet.i ILP32 true +Combinations combinations/Problem05_label43+token_ring.11.cil-1.c ILP32 False +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_vm_wr__unexpected__safety_requirement_havoc_object.i LP64 true +Floats float-newlib/double_req_bl_1131a.c ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_ci_file-118.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.brp2.3.prop1-back-serstep.c LP64 false +Loops loop-new/nested-1.i ILP32 true +Combinations combinations/Problem05_label43+token_ring.14.cil.c ILP32 False +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_vp_enter__expected__cover_proof_havoc_object.i LP64 false +Floats float-newlib/float_req_bl_0281.c ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_ci_file-166.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.brp2.4.prop2-func-interl.c LP64 true +Loops loop-simple/nested_5.c ILP32 true +Combinations combinations/Problem05_label44+token_ring.04.cil-1.c ILP32 False +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_vp_enter__invalid_input_gpa__cover_proof_havoc_memory.i LP64 false +Floats float-newlib/float_req_bl_0662a.c ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_ci_file-34.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.brp2.6.prop1-back-serstep.c LP64 false +Loops loop-zilu/benchmark04_conjunctive.i ILP32 true +Combinations combinations/Problem05_label44+token_ring.09.cil-1.c ILP32 False +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_vp_enter__invalid_input_vmflag__cover_exit_havoc_memory.i LP64 false +Floats float-newlib/float_req_bl_0683a.c ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_ci_file-82.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.cal1.c LP64 true +Loops loop-zilu/benchmark10_conjunctive.i ILP32 true +Combinations combinations/Problem05_label45+token_ring.01.cil-1.c ILP32 True +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_vp_enter__unconstrained__cover_exit_success_havoc_object.i LP64 false +Floats float-newlib/float_req_bl_0870b.c ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_cn_file-129.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.cal108.c LP64 true +Loops loop-zilu/benchmark15_conjunctive.i ILP32 unknown +Combinations combinations/Problem05_label45+token_ring.04.cil-1.c ILP32 True +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_vp_enter__unexpected__cover_exit_havoc_object.i LP64 false +Floats float-newlib/float_req_bl_0880.c ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_cn_file-177.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.cal116.c LP64 true +Loops loop-zilu/benchmark21_disjunctive.i ILP32 unknown +Combinations combinations/Problem05_label45+token_ring.06.cil-2.c ILP32 True +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_vp_vmcall__invalid_input_bitmap__cover_entry_havoc_memory.i LP64 false +Floats float-newlib/float_req_bl_1121b.c ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_cn_file-45.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.cal124.c LP64 true +Loops loop-zilu/benchmark26_linear.i ILP32 true +Combinations combinations/Problem05_label45+token_ring.09.cil-1.c ILP32 True +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_vp_vmcall__invalid_input_bitmap__safety_requirement_havoc_memory.i LP64 true +Floats float-newlib/float_req_bl_1211a.c ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_cn_file-93.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.cal132.c LP64 true +Loops loop-zilu/benchmark31_disjunctive.i ILP32 unknown +Combinations combinations/Problem05_label45+token_ring.11.cil-2.c ILP32 True +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_vp_vmcall__unexpected__cover_exit_havoc_object.i LP64 false +Floats float-newlib/float_req_bl_1270d.c ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_co_file-140.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.cal141.c LP64 true +Loops loop-zilu/benchmark37_conjunctive.i ILP32 true +Combinations combinations/Problem05_label45+token_ring.15.cil.c ILP32 False +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_export_restore__expected__cover_entry_havoc_object.i LP64 false +Floats floats-cbmc-regression/float-rounding1.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_co_file-189.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.cal15.c LP64 true +Loops loop-zilu/benchmark43_conjunctive.i ILP32 true +Combinations combinations/Problem05_label46+token_ring.03.cil-1.c ILP32 False +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_export_restore__unconstrained__cover_exit_success_havoc_memory.i LP64 false +Floats floats-cbmc-regression/float3.c ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_co_file-57.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.cal158.c LP64 true +Loops loop-zilu/benchmark48_linear.i ILP32 unknown +Combinations combinations/Problem05_label46+token_ring.05.cil-2.c ILP32 False +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_export_restore__unexpected__cover_exit_havoc_memory.i LP64 false +Floats floats-cdfpl/newton_1_3.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_ci_file-103.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.cal166.c LP64 true +Loops loops-crafted-1/discover_list.c ILP32 true +Combinations combinations/Problem05_label46+token_ring.08.cil-1.c ILP32 True +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_import_abort__expected__cover_entry_havoc_object.i LP64 false +Floats floats-cdfpl/newton_2_2.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_ci_file-151.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.cal175.c LP64 true +Loops loops-crafted-1/in-de42.c ILP32 true +Combinations combinations/Problem05_label46+token_ring.11.cil-1.c ILP32 False +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_import_abort__expected__safety_requirement_havoc_object.i LP64 true +Floats floats-cdfpl/newton_3_1.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_ci_file-2.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.cal183.c LP64 true +Loops loops-crafted-1/loopv2.c ILP32 true +Combinations combinations/Problem05_label46+token_ring.13.cil-2.c ILP32 True +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_import_abort__unexpected__cover_proof_havoc_memory.i LP64 false +Floats floats-cdfpl/newton_3_7.i ILP32 false +Hardness hardness/hardness_fillercode_filler_pr_ci_file-68.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.cal191.c LP64 true +Loops loops-crafted-1/sum_by_3_abstracted.c ILP32 true +Combinations combinations/Problem05_label47+token_ring.03.cil-2.c ILP32 False +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_addcx__expected__cover_exit_havoc_memory.i LP64 false +Floats floats-cdfpl/sine_6.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_cn_file-114.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.cal2.c LP64 true +Loops loops-crafted-1/sumt6.c ILP32 true +Combinations combinations/Problem05_label47+token_ring.08.cil-1.c ILP32 False +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_addcx__invalid_input_tdcx_pa__cover_entry_havoc_object.i LP64 false +Floats floats-cdfpl/square_5.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_cn_file-163.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.cal208.c LP64 true +Loops loops-crafted-1/vnew2.c ILP32 true +Combinations combinations/Problem05_label48+token_ring.01.cil-1.c ILP32 False +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_addcx__invalid_input_tdr_pa__cover_entry_havoc_memory.i LP64 false +Floats floats-esbmc-regression/fmod3.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_cn_file-31.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.cal217.c LP64 true +Loops loops/count_up_down-1.c ILP32 true +Combinations combinations/Problem05_label48+token_ring.06.cil-2.c ILP32 False +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_addcx__invalid_input_tdr_pa__safety_requirement_havoc_object.i LP64 true +Floats floats-nonlinear/bound-unconstrained.c ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_cn_file-8.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.cal225.c LP64 true +Loops loops/insertion_sort-2.c ILP32 unknown +Combinations combinations/Problem05_label48+token_ring.11.cil-2.c ILP32 False +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_addcx__invalid_state_lifecycle__cover_proof_havoc_object.i LP64 false +Floats floats-nonlinear/coral-benchmark09.c ILP32 false +Hardness hardness/hardness_fillercode_filler_pr_co_file-126.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.cal233.c LP64 true +Loops loops/matrix-1.c ILP32 true +Combinations combinations/Problem05_label49+token_ring.02.cil-1.c ILP32 True +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_addcx__invalid_state_num_tdcx__cover_proof_havoc_memory.i LP64 true +Floats loop-floats-scientific-comp/loop1-1.c ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_co_file-174.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.cal30.c LP64 true +Loops loops/nec40.c ILP32 true +Combinations combinations/Problem05_label49+token_ring.05.cil-1.c ILP32 True +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_addcx__invalid_state_pamt_metadata__cover_exit_havoc_memory.i LP64 false +Floats neural-networks/cartpole_0_safe.c-amalgamation.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_co_file-42.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.cal39.c LP64 true +Loops loops/sum01_bug02.i ILP32 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_addcx__invalid_state_td_state__cover_exit_havoc_object.i LP64 false +Floats neural-networks/cartpole_15_safe.c-amalgamation.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_co_file-90.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.cal47.c LP64 true +Loops loops/sum_array-2.i ILP32 unknown +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_addcx__unconstrained__cover_exit_success_havoc_object.i LP64 false +Floats neural-networks/cartpole_21_safe.c-amalgamation.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_ci_file-137.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.cal55.c LP64 true +Loops loops/terminator_03-2.i ILP32 true +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_addcx__unexpected__cover_proof_havoc_memory.i LP64 false +Floats neural-networks/cartpole_28_safe.c-amalgamation.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_ci_file-186.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.cal64.c LP64 true +Loops loops/trex03-1.c ILP32 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_create__invalid_input_rcx__cover_exit_havoc_memory.i LP64 false +Floats neural-networks/cartpole_34_safe.c-amalgamation.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_ci_file-54.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.cal72.c LP64 true +Loops loops/verisec_OpenSER_cases1_stripFullBoth_arr.i ILP32 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_create__invalid_input_rdx__cover_exit_havoc_object.i LP64 false +Floats neural-networks/cartpole_3_safe.c-amalgamation.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_cn_file-100.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.cal80.c LP64 true +Loops nla-digbench-scaling/bresenham-ll_unwindbound2.c ILP32 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_create__invalid_state_kot_entry__cover_entry_havoc_object.i LP64 false +Floats neural-networks/cartpole_46_safe.c-amalgamation.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_cn_file-149.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.cal89.c LP64 true +Loops nla-digbench-scaling/bresenham-ll_valuebound100.c ILP32 true +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_create__invalid_state_tdr_page__cover_exit_havoc_memory.i LP64 false +Floats neural-networks/cartpole_51_safe.c-amalgamation.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_cn_file-197.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.cal98.c LP64 true +Loops nla-digbench-scaling/cohencu-ll_unwindbound10.c ILP32 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_create__unexpected__cover_entry_havoc_memory.i LP64 false +Floats neural-networks/cartpole_58_safe.c-amalgamation.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_cn_file-65.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.cambridge.2.prop2-func-interl.c LP64 true +Loops nla-digbench-scaling/cohencu-ll_valuebound1.c ILP32 true +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_create__unexpected__safety_requirement_havoc_object.i LP64 true +Floats neural-networks/cartpole_63_safe.c-amalgamation.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_co_file-111.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.cambridge.5.prop1-back-serstep.c LP64 true +Loops nla-digbench-scaling/cohencu-ll_valuebound50.c ILP32 true +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_init__expected__cover_proof_havoc_object.i LP64 false +Floats neural-networks/cartpole_6_safe.c-amalgamation.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_co_file-16.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.cambridge.7.prop1-func-interl.c LP64 false +Loops nla-digbench-scaling/cohendiv-ll_unwindbound5.c ILP32 true +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_init__invalid_input_tdr_pa__cover_proof_havoc_memory.i LP64 false +Floats neural-networks/cartpole_76_safe.c-amalgamation.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_co_file-29.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.circular_pointer_top_w32_d128_e0.c LP64 false +Loops nla-digbench-scaling/cohendiv-ll_valuebound20.c ILP32 true +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_init__invalid_state_lifecycle__cover_exit_havoc_memory.i LP64 false +Floats neural-networks/cartpole_82_safe.c-amalgamation.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_co_file-77.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.circular_pointer_top_w64_d8_e0.c LP64 false +Loops nla-digbench-scaling/dijkstra-u_unwindbound20.c ILP32 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_init__invalid_state_no_tdcx__cover_entry_havoc_object.i LP64 true +Floats neural-networks/cartpole_88_safe.c-amalgamation.i ILP32 true +Hardness hardness/hardness_fillercode_normal_file-123.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.collision.2.prop1-back-serstep.c LP64 false +Loops nla-digbench-scaling/dijkstra-u_valuebound2.c ILP32 true +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_init__invalid_state_no_tdcx__safety_requirement_havoc_object.i LP64 true +Floats neural-networks/cartpole_94_safe.c-amalgamation.i ILP32 true +Hardness hardness/hardness_fillercode_normal_file-171.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.collision.6.prop1-func-interl.c LP64 true +Loops nla-digbench-scaling/divbin2_unwindbound100.i ILP32 true +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_init__invalid_state_op_state__safety_requirement_havoc_memory.i LP64 true +Floats neural-networks/cartpole_9_safe.c-amalgamation.i ILP32 true +Hardness hardness/hardness_fillercode_normal_file-4.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.cyclic_scheduler.3.prop1-func-interl.c LP64 true +Loops nla-digbench-scaling/divbin2_valuebound10.i ILP32 true +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_init__invalid_state_pamt_metadata__cover_proof_havoc_memory.i LP64 false +Floats neural-networks/cos_6_safe.c-amalgamation.i ILP32 true +Hardness hardness/hardness_fillercode_normal_file-88.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.driving_phils.3.prop1-back-serstep.c LP64 false +Loops nla-digbench-scaling/divbin_unwindbound1.i ILP32 true +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_init__invalid_state_td_state__cover_proof_havoc_object.i LP64 false +Floats neural-networks/dubinsrejoin_13_safe.c-amalgamation.i ILP32 true +Hardness hardness/hardness_floats_has_floats_file-134.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.elevator.2.prop1-back-serstep.c LP64 true +Loops nla-digbench-scaling/divbin_unwindbound50.i ILP32 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_init__unconstrained__cover_exit_unsuccess_havoc_object.i LP64 false +Floats neural-networks/dubinsrejoin_1_safe.c-amalgamation.i ILP32 true +Hardness hardness/hardness_floats_has_floats_file-182.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.elevator_planning.1.prop1-func-interl.c LP64 false +Loops nla-digbench-scaling/divbin_valuebound5.i ILP32 true +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_init__unexpected__safety_requirement_havoc_memory.i LP64 true +Floats neural-networks/dubinsrejoin_26_safe.c-amalgamation.i ILP32 true +Hardness hardness/hardness_floats_has_floats_file-51.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.eq_sdp_v6.c LP64 true +Loops nla-digbench-scaling/egcd-ll_unwindbound20.c ILP32 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_key_config__invalid_input_tdr_hkid__cover_proof_havoc_memory.i LP64 false +Floats neural-networks/dubinsrejoin_32_safe.c-amalgamation.i ILP32 true +Hardness hardness/hardness_floats_no_floats_file-0.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.exit.4.prop1-back-serstep.c LP64 false +Loops nla-digbench-scaling/egcd-ll_valuebound2.c ILP32 true +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_key_config__invalid_state_td_state__cover_proof_havoc_object.i LP64 false +Floats neural-networks/dubinsrejoin_38_safe.c-amalgamation.i ILP32 true +Hardness hardness/hardness_floats_no_floats_file-146.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.extinction.3.prop1-func-interl.c LP64 false +Loops nla-digbench-scaling/egcd2-ll_unwindbound100.c ILP32 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_key_config__invalid_state_tdr_lifecycle__cover_proof_havoc_object.i LP64 false +Floats neural-networks/dubinsrejoin_44_safe.c-amalgamation.i ILP32 true +Hardness hardness/hardness_floats_no_floats_file-194.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.firewire_tree.1.prop3-func-interl.c LP64 true +Loops nla-digbench-scaling/egcd2-ll_valuebound10.c ILP32 true +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_key_config__unconstrained__cover_exit_success_havoc_memory.i LP64 false +Floats neural-networks/dubinsrejoin_50_safe.c-amalgamation.i ILP32 true +Hardness hardness/hardness_floats_no_floats_file-62.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.firewire_tree.3.prop2-func-interl.c LP64 true +Loops nla-digbench-scaling/egcd3-ll_unwindbound1.c ILP32 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_key_config__unexpected__cover_exit_havoc_memory.i LP64 false +Floats neural-networks/dubinsrejoin_57_safe.c-amalgamation.i ILP32 true +Hardness hardness/hardness_kloop_100_1loop_file-109.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.firewire_tree.5.prop1-back-serstep.c LP64 true +Loops nla-digbench-scaling/egcd3-ll_unwindbound50.c ILP32 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_key_freeid__invalid_input_tdr_hkid__cover_entry_havoc_object.i LP64 false +Floats neural-networks/dubinsrejoin_62_safe.c-amalgamation.i ILP32 true +Hardness hardness/hardness_kloop_100_1loop_file-157.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.fischer.3.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_key_freeid__invalid_state_kot__cover_entry_havoc_object.i LP64 false +Floats neural-networks/dubinsrejoin_69_unsafe.c-amalgamation.i ILP32 false +Hardness hardness/hardness_kloop_100_1loop_file-25.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.fischer.7.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_key_freeid__invalid_state_tdr_lifecycle__cover_exit_havoc_memory.i LP64 false +Floats neural-networks/dubinsrejoin_75_unsafe.c-amalgamation.i ILP32 false +Hardness hardness/hardness_kloop_100_1loop_file-74.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.frogs.5.prop1-func-interl.c LP64 true +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_key_freeid__invalid_state_tdr_metadata__cover_exit_havoc_object.i LP64 false +Floats neural-networks/dubinsrejoin_81_safe.c-amalgamation.i ILP32 true +Hardness hardness/hardness_kloop_100_while_file-120.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.gear.2.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_key_freeid__unexpected__cover_exit_havoc_memory.i LP64 false +Floats neural-networks/dubinsrejoin_87_unsafe.c-amalgamation.i ILP32 false +Hardness hardness/hardness_kloop_100_while_file-169.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.h_Barrel.c LP64 true +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_vpflushdone__expected__cover_entry_havoc_memory.i LP64 false +Floats neural-networks/dubinsrejoin_93_unsafe.c-amalgamation.i ILP32 false +Hardness hardness/hardness_kloop_100_while_file-37.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.h_Spinner.c LP64 true +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_vpflushdone__expected__safety_requirement_havoc_object.i LP64 true +Floats neural-networks/elu_2_safe.c-amalgamation.i ILP32 true +Hardness hardness/hardness_kloop_100_while_file-85.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.h_b06.c LP64 true +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_vpflushdone__invalid_input_tdr_hkid__cover_proof_havoc_object.i LP64 false +Floats neural-networks/erf_4_safe.c-amalgamation.i ILP32 true +Hardness hardness/hardness_kloop_25_1loop_file-131.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.hanoi.3.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_vpflushdone__invalid_state_tdr_lifecycle__cover_entry_havoc_memory.i LP64 false +Floats neural-networks/exp_4_unsafe.c-amalgamation.i ILP32 false +Hardness hardness/hardness_kloop_25_1loop_file-18.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.iprotocol.3.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_vpflushdone__invalid_state_tdr_metadata__cover_entry_havoc_memory.i LP64 false +Floats neural-networks/gcas_2_unsafe.c-amalgamation.i ILP32 false +Hardness hardness/hardness_kloop_25_1loop_file-48.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.itc99_b12.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_vpflushdone__unconstrained__cover_exit_unsuccess_havoc_object.i LP64 false +Floats neural-networks/gcas_9_unsafe.c-amalgamation.i ILP32 false +Hardness hardness/hardness_kloop_25_1loop_file-97.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.lamport.1.prop1-back-serstep.c LP64 true +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_vpflushdone__unexpected__cover_proof_havoc_object.i LP64 false +Floats neural-networks/log_0_safe.c-amalgamation.i ILP32 true +Hardness hardness/hardness_kloop_25_while_file-143.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.lamport.6.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mr_finalize__expected__cover_proof_havoc_memory.i LP64 false +Floats neural-networks/log_6_safe.c-amalgamation.i ILP32 true +Hardness hardness/hardness_kloop_25_while_file-191.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.lamport_nonatomic.3.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mr_finalize__invalid_input_hkid__cover_exit_havoc_memory.i LP64 false +Floats neural-networks/logistic_5_unsafe.c-amalgamation.i ILP32 false +Hardness hardness/hardness_kloop_25_while_file-6.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.lann.2.prop1-func-interl.c LP64 true +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mr_finalize__invalid_state_lifecycle__cover_entry_havoc_object.i LP64 false +Floats neural-networks/lunarlander_12_safe.c-amalgamation.i ILP32 true +Hardness hardness/hardness_kloop_50_1loop_file-106.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.lann.7.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mr_finalize__invalid_state_lifecycle__safety_requirement_havoc_object.i LP64 true +Floats neural-networks/lunarlander_19_safe.c-amalgamation.i ILP32 true +Hardness hardness/hardness_kloop_50_1loop_file-154.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.leader_election.4.prop1-back-serstep.c LP64 false +Floats neural-networks/lunarlander_24_unsafe.c-amalgamation.i ILP32 false +Hardness hardness/hardness_kloop_50_1loop_file-22.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.leader_filters.2.prop1-func-interl.c LP64 false +Floats neural-networks/lunarlander_2_unsafe.c-amalgamation.i ILP32 false +Hardness hardness/hardness_kloop_50_1loop_file-70.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.leader_filters.7.prop1-back-serstep.c LP64 true +Floats neural-networks/lunarlander_36_unsafe.c-amalgamation.i ILP32 false +Hardness hardness/hardness_kloop_50_while_file-118.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.lifts.5.prop1-back-serstep.c LP64 false +Hardness hardness/hardness_kloop_50_while_file-166.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.loyd.1.prop1-func-interl.c LP64 false +Hardness hardness/hardness_kloop_50_while_file-34.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.lup.3.prop1-back-serstep.c LP64 true +Hardness hardness/hardness_kloop_50_while_file-82.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.mcs.3.prop1-func-interl.c LP64 true +Hardness hardness/hardness_operatoramount_amount100_file-129.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.msmie.1.prop1-func-interl.c LP64 true +Hardness hardness/hardness_operatoramount_amount100_file-177.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.mul11.c LP64 false +Hardness hardness/hardness_operatoramount_amount100_file-45.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.needham.1.prop3-back-serstep.c LP64 false +Hardness hardness/hardness_operatoramount_amount100_file-93.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.needham.2.prop3-func-interl.c LP64 true +Hardness hardness/hardness_operatoramount_amount10_file-140.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.needham.3.prop4-func-interl.c LP64 false +Hardness hardness/hardness_operatoramount_amount10_file-189.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.noninitstate.c LP64 false +Hardness hardness/hardness_operatoramount_amount10_file-57.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.peg_solitaire.4.prop1-func-interl.c LP64 true +Hardness hardness/hardness_operatoramount_amount250_file-103.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.peterson.3.prop1-back-serstep.c LP64 false +Hardness hardness/hardness_operatoramount_amount250_file-151.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.pgm_protocol.1.prop1-back-serstep.c LP64 true +Hardness hardness/hardness_operatoramount_amount250_file-2.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.pgm_protocol.2.prop1-func-interl.c LP64 true +Hardness hardness/hardness_operatoramount_amount250_file-68.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.pgm_protocol.3.prop2-func-interl.c LP64 true +Hardness hardness/hardness_operatoramount_amount25_file-114.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.pgm_protocol.4.prop5-back-serstep.c LP64 true +Hardness hardness/hardness_operatoramount_amount25_file-163.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.pgm_protocol.5.prop6-back-serstep.c LP64 true +Hardness hardness/hardness_operatoramount_amount25_file-31.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.pgm_protocol.6.prop6-func-interl.c LP64 true +Hardness hardness/hardness_operatoramount_amount25_file-8.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.pgm_protocol.8.prop1-back-serstep.c LP64 true +Hardness hardness/hardness_operatoramount_amount500_file-126.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.pj_icram.c LP64 true +Hardness hardness/hardness_operatoramount_amount500_file-174.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.pouring.1.prop1-back-serstep.c LP64 false +Hardness hardness/hardness_operatoramount_amount500_file-42.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.production_cell.3.prop1-func-interl.c LP64 false +Hardness hardness/hardness_operatoramount_amount500_file-90.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.protocols.2.prop1-back-serstep.c LP64 false +Hardness hardness/hardness_operatoramount_amount50_file-137.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.reader_writer.1.prop1-func-interl.c LP64 false +Hardness hardness/hardness_operatoramount_amount50_file-186.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.resistance.1.prop3-back-serstep.c LP64 true +Hardness hardness/hardness_operatoramount_amount50_file-54.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.rether.1.prop1-func-interl.c LP64 true +Hardness hardness/hardness_wrappers_normal_file-100.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.rether.6.prop1-back-serstep.c LP64 false +Hardness hardness/hardness_wrappers_normal_file-149.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.rushhour.3.prop1-func-interl.c LP64 true +Hardness hardness/hardness_wrappers_normal_file-197.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.schedule_world.3.prop1-func-interl.c LP64 false +Hardness hardness/hardness_wrappers_normal_file-65.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.shift_register_top_w32_d32_e0.c LP64 false +Hardness hardness/hardness_wrappers_wrapper_a_file-111.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.shift_register_top_w8_d16_e0.c LP64 false +Hardness hardness/hardness_wrappers_wrapper_a_file-16.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.sokoban.3.prop1-func-interl.c LP64 true +Hardness hardness/hardness_wrappers_wrapper_a_file-29.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.swap_two.c LP64 true +Hardness hardness/hardness_wrappers_wrapper_a_file-77.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.synapse.4.prop1-back-serstep.c LP64 true +Hardness hardness/hardness_wrappers_wrapper_ap_file-123.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.szymanski.1.prop1-func-interl.c LP64 true +Hardness hardness/hardness_wrappers_wrapper_ap_file-171.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.telephony.1.prop1-back-serstep.c LP64 false +Hardness hardness/hardness_wrappers_wrapper_ap_file-4.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.telephony.6.prop1-back-serstep.c LP64 false +Hardness hardness/hardness_wrappers_wrapper_ap_file-88.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.train-gate.2.prop1-back-serstep.c LP64 true +Hardness hardness/hardness_wrappers_wrapper_p_file-134.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.train-gate.6.prop1-func-interl.c LP64 true +Hardness hardness/hardness_wrappers_wrapper_p_file-182.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.v_DAIO.c LP64 false +Hardness hardness/hardness_wrappers_wrapper_p_file-51.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.vcegar_QF_BV_itc99_b13_p07.c LP64 true +Hardness hardness/hardness_wrappers_wrapper_s_file-0.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.vcegar_QF_BV_itc99_b13_p16.c LP64 true +Hardness hardness/hardness_wrappers_wrapper_s_file-146.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.vcegar_QF_BV_pj_icu_icctl_p3.c LP64 true +Hardness hardness/hardness_wrappers_wrapper_s_file-194.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.vis_QF_BV_fru32_p3.c LP64 false +Hardness hardness/hardness_wrappers_wrapper_s_file-63.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.vis_QF_BV_vMiim_p2.c LP64 false +Hardness hardness/hardness_wrappers_wrapper_sp_file-11.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.vis_arrays_bpbs_p2.c LP64 false +Hardness hardness/hardness_wrappers_wrapper_sp_file-158.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.vis_arrays_vsa16a_p2.c LP64 true +Hardness hardness/hardness_wrappers_wrapper_sp_file-26.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.vis_arrays_vsaR_p03.c LP64 true +Hardness hardness/hardness_wrappers_wrapper_sp_file-75.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.vis_arrays_vsaR_p13.c LP64 true +Hardness hardness/hardness_codemodifications_dependencies_file-109.i ILP32 true +Hardware hardware-verification-array/btor2c-lazyMod.safe_linked_list_fifo_n2d4.c LP64 true +Hardness hardness/hardness_codemodifications_dependencies_file-132.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.Huffman_dec.c LP64 true +Hardness hardness/hardness_codemodifications_dependencies_file-157.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.adding.2.prop1-func-interl.c LP64 false +Hardness hardness/hardness_codemodifications_dependencies_file-180.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.adding.4.prop1-func-interl.c LP64 false +Hardness hardness/hardness_codemodifications_dependencies_file-25.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.anderson.1.prop1-back-serstep.c LP64 false +Hardness hardness/hardness_codemodifications_dependencies_file-49.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.anderson.3.prop1-back-serstep.c LP64 false +Hardness hardness/hardness_codemodifications_dependencies_file-73.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.anderson.5.prop1-func-interl.c LP64 false +Hardness hardness/hardness_codemodifications_dependencies_file-97.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.anderson.8.prop1-back-serstep.c LP64 true +Hardness hardness/hardness_codemodifications_functionizing_file-12.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.arbitrated_top_n2_w16_d64_e0.c LP64 false +Hardness hardness/hardness_codemodifications_functionizing_file-143.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.arbitrated_top_n2_w32_d32_e0.c LP64 false +Hardness hardness/hardness_codemodifications_functionizing_file-168.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.arbitrated_top_n2_w8_d32_e0.c LP64 false +Hardness hardness/hardness_codemodifications_functionizing_file-191.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.arbitrated_top_n3_w16_d16_e0.c LP64 false +Hardness hardness/hardness_codemodifications_functionizing_file-36.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.arbitrated_top_n3_w8_d16_e0.c LP64 false +Hardness hardness/hardness_codemodifications_functionizing_file-6.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.arbitrated_top_n4_w16_d128_e0.c LP64 false +Hardness hardness/hardness_codemodifications_functionizing_file-84.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.arbitrated_top_n4_w8_d128_e0.c LP64 false +Hardness hardness/hardness_codemodifications_normal_file-107.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.arbitrated_top_n5_w8_d128_e0.c LP64 false +Hardness hardness/hardness_codemodifications_normal_file-131.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.at.1.prop1-back-serstep.c LP64 true +Hardness hardness/hardness_codemodifications_normal_file-155.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.at.3.prop1-back-serstep.c LP64 false +Hardness hardness/hardness_codemodifications_normal_file-18.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.at.5.prop1-func-interl.c LP64 true +Hardness hardness/hardness_codemodifications_normal_file-23.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.at.7.prop1-func-interl.c LP64 true +Hardness hardness/hardness_codemodifications_normal_file-48.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.bakery.3.prop1-back-serstep.c LP64 true +Hardness hardness/hardness_codemodifications_normal_file-71.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.bakery.5.prop1-back-serstep.c LP64 true +Hardness hardness/hardness_codemodifications_normal_file-96.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.bakery.7.prop1-func-interl.c LP64 true +Hardness hardness/hardness_codemodifications_steplocals_file-118.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.blocks.2.prop1-func-interl.c LP64 true +Hardness hardness/hardness_codemodifications_steplocals_file-142.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.bridge.1.prop1-back-serstep.c LP64 false +Hardness hardness/hardness_codemodifications_steplocals_file-166.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.bridge.3.prop1-back-serstep.c LP64 false +Hardness hardness/hardness_codemodifications_steplocals_file-190.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.brp.2.prop1-func-interl.c LP64 false +Hardness hardness/hardness_codemodifications_steplocals_file-34.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.brp.4.prop1-func-interl.c LP64 false +Hardness hardness/hardness_codemodifications_steplocals_file-59.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.brp2.1.prop1-back-serstep.c LP64 false +Hardness hardness/hardness_codemodifications_steplocals_file-82.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.brp2.1.prop3-back-serstep.c LP64 true +Hardness hardness/hardness_fillercode_filler_pe_ci_file-105.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.brp2.2.prop2-func-interl.c LP64 true +Hardness hardness/hardness_fillercode_filler_pe_ci_file-13.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.brp2.3.prop2-back-serstep.c LP64 true +Hardness hardness/hardness_fillercode_filler_pe_ci_file-154.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.brp2.4.prop1-func-interl.c LP64 false +Hardness hardness/hardness_fillercode_filler_pe_ci_file-178.i ILP32 true +Hardware hardware-verification-bv/btor2c-lazyMod.brp2.4.prop3-func-interl.c LP64 true +Hardness hardness/hardness_fillercode_filler_pe_ci_file-22.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_ci_file-46.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_ci_file-70.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_ci_file-94.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_cn_file-117.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_cn_file-140.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_cn_file-165.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_cn_file-189.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_cn_file-33.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_cn_file-57.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_cn_file-81.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_co_file-103.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_co_file-128.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_co_file-152.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_co_file-177.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_co_file-20.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_co_file-45.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_co_file-69.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_co_file-93.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_ci_file-115.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_ci_file-14.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_ci_file-163.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_ci_file-188.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_ci_file-31.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_ci_file-56.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_ci_file-8.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_cn_file-102.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_cn_file-126.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_cn_file-150.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_cn_file-175.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_cn_file-2.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_cn_file-43.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_cn_file-68.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_cn_file-91.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_co_file-114.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_co_file-138.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_co_file-162.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_co_file-186.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_co_file-30.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_co_file-54.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_co_file-79.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_ci_file-100.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_ci_file-125.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_ci_file-149.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_ci_file-173.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_ci_file-198.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_ci_file-42.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_ci_file-66.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_ci_file-90.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_cn_file-112.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_cn_file-137.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_cn_file-160.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_cn_file-185.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_cn_file-29.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_cn_file-53.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_cn_file-77.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_co_file-10.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_co_file-123.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_co_file-148.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_co_file-171.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_co_file-196.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_co_file-40.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_co_file-65.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_co_file-89.i ILP32 true +Hardness hardness/hardness_fillercode_normal_file-111.i ILP32 true +Hardness hardness/hardness_fillercode_normal_file-135.i ILP32 true +Hardness hardness/hardness_fillercode_normal_file-16.i ILP32 true +Hardness hardness/hardness_fillercode_normal_file-183.i ILP32 true +Hardness hardness/hardness_fillercode_normal_file-28.i ILP32 true +Hardness hardness/hardness_fillercode_normal_file-51.i ILP32 true +Hardness hardness/hardness_fillercode_normal_file-76.i ILP32 true +Hardness hardness/hardness_floats_has_floats_file-0.i ILP32 true +Hardness hardness/hardness_floats_has_floats_file-122.i ILP32 true +Hardness hardness/hardness_floats_has_floats_file-146.i ILP32 true +Hardness hardness/hardness_floats_has_floats_file-170.i ILP32 true +Hardness hardness/hardness_floats_has_floats_file-194.i ILP32 true +Hardness hardness/hardness_floats_has_floats_file-39.i ILP32 true +Hardness hardness/hardness_floats_has_floats_file-63.i ILP32 true +Hardness hardness/hardness_floats_has_floats_file-88.i ILP32 true +Hardness hardness/hardness_floats_no_floats_file-11.i ILP32 true +Hardness hardness/hardness_floats_no_floats_file-134.i ILP32 true +Hardness hardness/hardness_floats_no_floats_file-158.i ILP32 true +Hardness hardness/hardness_floats_no_floats_file-182.i ILP32 true +Hardness hardness/hardness_floats_no_floats_file-26.i ILP32 true +Hardness hardness/hardness_floats_no_floats_file-50.i ILP32 true +Hardness hardness/hardness_floats_no_floats_file-74.i ILP32 true +Hardness hardness/hardness_floats_no_floats_file-99.i ILP32 true +Hardness hardness/hardness_kloop_100_1loop_file-120.i ILP32 true +Hardness hardness/hardness_kloop_100_1loop_file-145.i ILP32 true +Hardness hardness/hardness_kloop_100_1loop_file-169.i ILP32 true +Hardness hardness/hardness_kloop_100_1loop_file-193.i ILP32 true +Hardness hardness/hardness_kloop_100_1loop_file-37.i ILP32 true +Hardness hardness/hardness_kloop_100_1loop_file-61.i ILP32 true +Hardness hardness/hardness_kloop_100_1loop_file-86.i ILP32 true +Hardness hardness/hardness_kloop_100_while_file-109.i ILP32 true +Hardness hardness/hardness_kloop_100_while_file-132.i ILP32 true +Hardness hardness/hardness_kloop_100_while_file-157.i ILP32 true +Hardness hardness/hardness_kloop_100_while_file-180.i ILP32 true +Hardness hardness/hardness_kloop_100_while_file-25.i ILP32 true +Hardness hardness/hardness_kloop_100_while_file-49.i ILP32 true +Hardness hardness/hardness_kloop_100_while_file-73.i ILP32 true +Hardness hardness/hardness_kloop_100_while_file-97.i ILP32 true +Hardness hardness/hardness_kloop_25_1loop_file-12.i ILP32 true +Hardness hardness/hardness_kloop_25_1loop_file-143.i ILP32 true +Hardness hardness/hardness_kloop_25_1loop_file-168.i ILP32 true +Hardness hardness/hardness_kloop_25_1loop_file-191.i ILP32 true +Hardness hardness/hardness_kloop_25_1loop_file-36.i ILP32 true +Hardness hardness/hardness_kloop_25_1loop_file-6.i ILP32 true +Hardness hardness/hardness_kloop_25_1loop_file-84.i ILP32 true +Hardness hardness/hardness_kloop_25_while_file-107.i ILP32 true +Hardness hardness/hardness_kloop_25_while_file-131.i ILP32 true +Hardness hardness/hardness_kloop_25_while_file-155.i ILP32 true +Hardness hardness/hardness_kloop_25_while_file-18.i ILP32 true +Hardness hardness/hardness_kloop_25_while_file-23.i ILP32 true +Hardness hardness/hardness_kloop_25_while_file-48.i ILP32 true +Hardness hardness/hardness_kloop_25_while_file-71.i ILP32 true +Hardness hardness/hardness_kloop_25_while_file-96.i ILP32 true +Hardness hardness/hardness_kloop_50_1loop_file-118.i ILP32 true +Hardness hardness/hardness_kloop_50_1loop_file-142.i ILP32 true +Hardness hardness/hardness_kloop_50_1loop_file-166.i ILP32 true +Hardness hardness/hardness_kloop_50_1loop_file-190.i ILP32 true +Hardness hardness/hardness_kloop_50_1loop_file-34.i ILP32 true +Hardness hardness/hardness_kloop_50_1loop_file-59.i ILP32 true +Hardness hardness/hardness_kloop_50_1loop_file-82.i ILP32 true +Hardness hardness/hardness_kloop_50_while_file-105.i ILP32 true +Hardness hardness/hardness_kloop_50_while_file-13.i ILP32 true +Hardness hardness/hardness_kloop_50_while_file-154.i ILP32 true +Hardness hardness/hardness_kloop_50_while_file-178.i ILP32 true +Hardness hardness/hardness_kloop_50_while_file-22.i ILP32 true +Hardness hardness/hardness_kloop_50_while_file-46.i ILP32 true +Hardness hardness/hardness_kloop_50_while_file-70.i ILP32 true +Hardness hardness/hardness_kloop_50_while_file-94.i ILP32 true +Hardness hardness/hardness_operatoramount_amount100_file-117.i ILP32 true +Hardness hardness/hardness_operatoramount_amount100_file-140.i ILP32 true +Hardness hardness/hardness_operatoramount_amount100_file-165.i ILP32 true +Hardness hardness/hardness_operatoramount_amount100_file-189.i ILP32 true +Hardness hardness/hardness_operatoramount_amount100_file-33.i ILP32 true +Hardness hardness/hardness_operatoramount_amount100_file-57.i ILP32 true +Hardness hardness/hardness_operatoramount_amount100_file-81.i ILP32 true +Hardness hardness/hardness_operatoramount_amount10_file-103.i ILP32 true +Hardness hardness/hardness_operatoramount_amount10_file-128.i ILP32 true +Hardness hardness/hardness_operatoramount_amount10_file-152.i ILP32 true +Hardness hardness/hardness_operatoramount_amount10_file-177.i ILP32 true +Hardness hardness/hardness_operatoramount_amount10_file-20.i ILP32 true +Hardness hardness/hardness_operatoramount_amount10_file-45.i ILP32 true +Hardness hardness/hardness_operatoramount_amount10_file-69.i ILP32 true +Hardness hardness/hardness_operatoramount_amount10_file-93.i ILP32 true +Hardness hardness/hardness_operatoramount_amount250_file-115.i ILP32 true +Hardness hardness/hardness_operatoramount_amount250_file-14.i ILP32 true +Hardness hardness/hardness_operatoramount_amount250_file-163.i ILP32 true +Hardness hardness/hardness_operatoramount_amount250_file-188.i ILP32 unknown +Hardness hardness/hardness_operatoramount_amount250_file-31.i ILP32 true +Hardness hardness/hardness_operatoramount_amount250_file-56.i ILP32 true +Hardness hardness/hardness_operatoramount_amount250_file-8.i ILP32 true +Hardness hardness/hardness_operatoramount_amount25_file-102.i ILP32 true +Hardness hardness/hardness_operatoramount_amount25_file-126.i ILP32 true +Hardness hardness/hardness_operatoramount_amount25_file-150.i ILP32 true +Hardness hardness/hardness_operatoramount_amount25_file-175.i ILP32 true +Hardness hardness/hardness_operatoramount_amount25_file-2.i ILP32 true +Hardness hardness/hardness_operatoramount_amount25_file-43.i ILP32 true +Hardness hardness/hardness_operatoramount_amount25_file-68.i ILP32 true +Hardness hardness/hardness_operatoramount_amount25_file-91.i ILP32 true +Hardness hardness/hardness_operatoramount_amount500_file-114.i ILP32 true +Hardness hardness/hardness_operatoramount_amount500_file-138.i ILP32 true +Hardness hardness/hardness_operatoramount_amount500_file-162.i ILP32 true +Hardness hardness/hardness_operatoramount_amount500_file-186.i ILP32 true +Hardness hardness/hardness_operatoramount_amount500_file-30.i ILP32 true +Hardness hardness/hardness_operatoramount_amount500_file-54.i ILP32 true +Hardness hardness/hardness_operatoramount_amount500_file-79.i ILP32 true +Hardness hardness/hardness_operatoramount_amount50_file-100.i ILP32 true +Hardness hardness/hardness_operatoramount_amount50_file-125.i ILP32 true +Hardness hardness/hardness_operatoramount_amount50_file-149.i ILP32 true +Hardness hardness/hardness_operatoramount_amount50_file-173.i ILP32 true +Hardness hardness/hardness_operatoramount_amount50_file-198.i ILP32 true +Hardness hardness/hardness_operatoramount_amount50_file-42.i ILP32 true +Hardness hardness/hardness_operatoramount_amount50_file-66.i ILP32 true +Hardness hardness/hardness_operatoramount_amount50_file-90.i ILP32 true +Hardness hardness/hardness_wrappers_normal_file-112.i ILP32 true +Hardness hardness/hardness_wrappers_normal_file-137.i ILP32 true +Hardness hardness/hardness_wrappers_normal_file-160.i ILP32 true +Hardness hardness/hardness_wrappers_normal_file-185.i ILP32 true +Hardness hardness/hardness_wrappers_normal_file-29.i ILP32 true +Hardness hardness/hardness_wrappers_normal_file-53.i ILP32 true +Hardness hardness/hardness_wrappers_normal_file-77.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_a_file-10.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_a_file-123.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_a_file-148.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_a_file-171.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_a_file-196.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_a_file-40.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_a_file-65.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_a_file-89.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_ap_file-111.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_ap_file-135.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_ap_file-16.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_ap_file-183.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_ap_file-28.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_ap_file-51.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_ap_file-76.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_p_file-0.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_p_file-122.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_p_file-146.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_p_file-170.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_p_file-194.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_p_file-39.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_p_file-63.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_p_file-88.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_s_file-11.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_s_file-134.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_s_file-158.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_s_file-182.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_s_file-26.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_s_file-50.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_s_file-75.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_sp_file-0.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_sp_file-121.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_sp_file-146.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_sp_file-17.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_sp_file-194.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_sp_file-38.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_sp_file-62.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_sp_file-87.i ILP32 true +Hardness hardness/hardness_codemodifications_dependencies_file-102.i ILP32 true +Hardness hardness/hardness_codemodifications_dependencies_file-114.i ILP32 true +Hardness hardness/hardness_codemodifications_dependencies_file-126.i ILP32 true +Hardness hardness/hardness_codemodifications_dependencies_file-139.i ILP32 true +Hardness hardness/hardness_codemodifications_dependencies_file-150.i ILP32 true +Hardness hardness/hardness_codemodifications_dependencies_file-162.i ILP32 true +Hardness hardness/hardness_codemodifications_dependencies_file-174.i ILP32 true +Hardness hardness/hardness_codemodifications_dependencies_file-187.i ILP32 true +Hardness hardness/hardness_codemodifications_dependencies_file-199.i ILP32 true +Hardness hardness/hardness_codemodifications_dependencies_file-30.i ILP32 true +Hardness hardness/hardness_codemodifications_dependencies_file-42.i ILP32 true +Hardness hardness/hardness_codemodifications_dependencies_file-55.i ILP32 true +Hardness hardness/hardness_codemodifications_dependencies_file-67.i ILP32 true +Hardness hardness/hardness_codemodifications_dependencies_file-79.i ILP32 true +Hardness hardness/hardness_codemodifications_dependencies_file-90.i ILP32 true +Hardness hardness/hardness_codemodifications_functionizing_file-101.i ILP32 true +Hardness hardness/hardness_codemodifications_functionizing_file-113.i ILP32 true +Hardness hardness/hardness_codemodifications_functionizing_file-125.i ILP32 true +Hardness hardness/hardness_codemodifications_functionizing_file-137.i ILP32 true +Hardness hardness/hardness_codemodifications_functionizing_file-15.i ILP32 true +Hardness hardness/hardness_codemodifications_functionizing_file-161.i ILP32 true +Hardness hardness/hardness_codemodifications_functionizing_file-173.i ILP32 true +Hardness hardness/hardness_codemodifications_functionizing_file-185.i ILP32 true +Hardness hardness/hardness_codemodifications_functionizing_file-198.i ILP32 true +Hardness hardness/hardness_codemodifications_functionizing_file-3.i ILP32 true +Hardness hardness/hardness_codemodifications_functionizing_file-41.i ILP32 true +Hardness hardness/hardness_codemodifications_functionizing_file-53.i ILP32 true +Hardness hardness/hardness_codemodifications_functionizing_file-66.i ILP32 true +Hardness hardness/hardness_codemodifications_functionizing_file-78.i ILP32 true +Hardness hardness/hardness_codemodifications_functionizing_file-90.i ILP32 true +Hardness hardness/hardness_codemodifications_normal_file-100.i ILP32 true +Hardness hardness/hardness_codemodifications_normal_file-113.i ILP32 true +Hardness hardness/hardness_codemodifications_normal_file-125.i ILP32 true +Hardness hardness/hardness_codemodifications_normal_file-137.i ILP32 true +Hardness hardness/hardness_codemodifications_normal_file-149.i ILP32 true +Hardness hardness/hardness_codemodifications_normal_file-161.i ILP32 true +Hardness hardness/hardness_codemodifications_normal_file-173.i ILP32 true +Hardness hardness/hardness_codemodifications_normal_file-185.i ILP32 true +Hardness hardness/hardness_codemodifications_normal_file-197.i ILP32 true +Hardness hardness/hardness_codemodifications_normal_file-3.i ILP32 true +Hardness hardness/hardness_codemodifications_normal_file-41.i ILP32 true +Hardness hardness/hardness_codemodifications_normal_file-53.i ILP32 true +Hardness hardness/hardness_codemodifications_normal_file-65.i ILP32 true +Hardness hardness/hardness_codemodifications_normal_file-78.i ILP32 true +Hardness hardness/hardness_codemodifications_normal_file-9.i ILP32 true +Hardness hardness/hardness_codemodifications_steplocals_file-10.i ILP32 true +Hardness hardness/hardness_codemodifications_steplocals_file-111.i ILP32 true +Hardness hardness/hardness_codemodifications_steplocals_file-124.i ILP32 true +Hardness hardness/hardness_codemodifications_steplocals_file-136.i ILP32 true +Hardness hardness/hardness_codemodifications_steplocals_file-148.i ILP32 true +Hardness hardness/hardness_codemodifications_steplocals_file-16.i ILP32 true +Hardness hardness/hardness_codemodifications_steplocals_file-172.i ILP32 true +Hardness hardness/hardness_codemodifications_steplocals_file-184.i ILP32 true +Hardness hardness/hardness_codemodifications_steplocals_file-196.i ILP32 true +Hardness hardness/hardness_codemodifications_steplocals_file-28.i ILP32 true +Hardness hardness/hardness_codemodifications_steplocals_file-40.i ILP32 true +Hardness hardness/hardness_codemodifications_steplocals_file-52.i ILP32 true +Hardness hardness/hardness_codemodifications_steplocals_file-64.i ILP32 true +Hardness hardness/hardness_codemodifications_steplocals_file-76.i ILP32 true +Hardness hardness/hardness_codemodifications_steplocals_file-89.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_ci_file-1.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_ci_file-111.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_ci_file-123.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_ci_file-136.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_ci_file-148.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_ci_file-16.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_ci_file-171.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_ci_file-184.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_ci_file-196.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_ci_file-28.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_ci_file-4.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_ci_file-52.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_ci_file-64.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_ci_file-76.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_ci_file-88.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_cn_file-1.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_cn_file-110.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_cn_file-122.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_cn_file-134.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_cn_file-147.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_cn_file-159.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_cn_file-170.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_cn_file-182.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_cn_file-195.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_cn_file-27.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_cn_file-39.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_cn_file-50.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_cn_file-63.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_cn_file-75.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_cn_file-87.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_cn_file-99.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_co_file-11.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_co_file-121.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_co_file-134.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_co_file-146.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_co_file-159.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_co_file-170.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_co_file-182.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_co_file-194.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_co_file-27.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_co_file-39.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_co_file-50.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_co_file-62.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_co_file-75.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_co_file-87.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_co_file-99.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_ci_file-109.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_ci_file-121.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_ci_file-133.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_ci_file-145.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_ci_file-157.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_ci_file-17.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_ci_file-181.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_ci_file-193.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_ci_file-25.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_ci_file-38.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_ci_file-5.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_ci_file-61.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_ci_file-73.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_ci_file-86.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_ci_file-98.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_cn_file-108.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_cn_file-12.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_cn_file-132.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_cn_file-144.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_cn_file-157.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_cn_file-169.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_cn_file-181.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_cn_file-193.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_cn_file-25.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_cn_file-37.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_cn_file-5.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_cn_file-61.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_cn_file-73.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_cn_file-85.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_cn_file-98.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_co_file-108.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_co_file-12.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_co_file-131.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_co_file-144.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_co_file-156.i ILP32 unknown +Hardness hardness/hardness_fillercode_filler_pr_co_file-168.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_co_file-18.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_co_file-192.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_co_file-24.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_co_file-36.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_co_file-48.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_co_file-60.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_co_file-72.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_co_file-84.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_co_file-96.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_ci_file-107.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_ci_file-119.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_ci_file-130.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_ci_file-142.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_ci_file-155.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_ci_file-167.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_ci_file-18.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_ci_file-191.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_ci_file-24.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_ci_file-36.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_ci_file-48.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_ci_file-6.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_ci_file-72.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_ci_file-84.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_ci_file-96.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_cn_file-106.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_cn_file-119.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_cn_file-130.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_cn_file-142.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_cn_file-154.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_cn_file-167.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_cn_file-179.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_cn_file-190.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_cn_file-22.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_cn_file-35.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_cn_file-47.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_cn_file-59.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_cn_file-70.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_cn_file-83.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_cn_file-95.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_co_file-105.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_co_file-117.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_co_file-13.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_co_file-141.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_co_file-153.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_co_file-165.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_co_file-178.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_co_file-19.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_co_file-22.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_co_file-34.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_co_file-47.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_co_file-59.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_co_file-70.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_co_file-82.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_co_file-95.i ILP32 true +Hardness hardness/hardness_fillercode_normal_file-105.i ILP32 true +Hardness hardness/hardness_fillercode_normal_file-117.i ILP32 true +Hardness hardness/hardness_fillercode_normal_file-129.i ILP32 true +Hardness hardness/hardness_fillercode_normal_file-141.i ILP32 true +Hardness hardness/hardness_fillercode_normal_file-153.i ILP32 true +Hardness hardness/hardness_fillercode_normal_file-165.i ILP32 true +Hardness hardness/hardness_fillercode_normal_file-177.i ILP32 true +Hardness hardness/hardness_fillercode_normal_file-19.i ILP32 true +Hardness hardness/hardness_fillercode_normal_file-21.i ILP32 true +Hardness hardness/hardness_fillercode_normal_file-33.i ILP32 true +Hardness hardness/hardness_fillercode_normal_file-45.i ILP32 true +Hardness hardness/hardness_fillercode_normal_file-58.i ILP32 true +Hardness hardness/hardness_fillercode_normal_file-7.i ILP32 true +Hardness hardness/hardness_fillercode_normal_file-81.i ILP32 true +Hardness hardness/hardness_fillercode_normal_file-93.i ILP32 true +Hardness hardness/hardness_floats_has_floats_file-104.i ILP32 true +Hardness hardness/hardness_floats_has_floats_file-116.i ILP32 true +Hardness hardness/hardness_floats_has_floats_file-128.i ILP32 true +Hardness hardness/hardness_floats_has_floats_file-14.i ILP32 true +Hardness hardness/hardness_floats_has_floats_file-152.i ILP32 true +Hardness hardness/hardness_floats_has_floats_file-164.i ILP32 true +Hardness hardness/hardness_floats_has_floats_file-176.i ILP32 true +Hardness hardness/hardness_floats_has_floats_file-188.i ILP32 true +Hardness hardness/hardness_floats_has_floats_file-20.i ILP32 true +Hardness hardness/hardness_floats_has_floats_file-32.i ILP32 true +Hardness hardness/hardness_floats_has_floats_file-45.i ILP32 true +Hardness hardness/hardness_floats_has_floats_file-57.i ILP32 true +Hardness hardness/hardness_floats_has_floats_file-7.i ILP32 true +Hardness hardness/hardness_floats_has_floats_file-81.i ILP32 true +Hardness hardness/hardness_floats_has_floats_file-93.i ILP32 true +Hardness hardness/hardness_floats_no_floats_file-103.i ILP32 true +Hardness hardness/hardness_floats_no_floats_file-116.i ILP32 true +Hardness hardness/hardness_floats_no_floats_file-128.i ILP32 true +Hardness hardness/hardness_floats_no_floats_file-14.i ILP32 true +Hardness hardness/hardness_floats_no_floats_file-151.i ILP32 true +Hardness hardness/hardness_floats_no_floats_file-164.i ILP32 true +Hardness hardness/hardness_floats_no_floats_file-176.i ILP32 true +Hardness hardness/hardness_floats_no_floats_file-188.i ILP32 true +Hardness hardness/hardness_floats_no_floats_file-2.i ILP32 true +Hardness hardness/hardness_floats_no_floats_file-32.i ILP32 true +Hardness hardness/hardness_floats_no_floats_file-44.i ILP32 true +Hardness hardness/hardness_floats_no_floats_file-56.i ILP32 true +Hardness hardness/hardness_floats_no_floats_file-68.i ILP32 true +Hardness hardness/hardness_floats_no_floats_file-80.i ILP32 true +Hardness hardness/hardness_floats_no_floats_file-92.i ILP32 true +Hardness hardness/hardness_kloop_100_1loop_file-102.i ILP32 true +Hardness hardness/hardness_kloop_100_1loop_file-114.i ILP32 true +Hardness hardness/hardness_kloop_100_1loop_file-127.i ILP32 true +Hardness hardness/hardness_kloop_100_1loop_file-139.i ILP32 true +Hardness hardness/hardness_kloop_100_1loop_file-150.i ILP32 true +Hardness hardness/hardness_kloop_100_1loop_file-162.i ILP32 true +Hardness hardness/hardness_kloop_100_1loop_file-175.i ILP32 true +Hardness hardness/hardness_kloop_100_1loop_file-187.i ILP32 true +Hardness hardness/hardness_kloop_100_1loop_file-199.i ILP32 true +Hardness hardness/hardness_kloop_100_1loop_file-30.i ILP32 true +Hardness hardness/hardness_kloop_100_1loop_file-43.i ILP32 true +Hardness hardness/hardness_kloop_100_1loop_file-55.i ILP32 true +Hardness hardness/hardness_kloop_100_1loop_file-68.i ILP32 true +Hardness hardness/hardness_kloop_100_1loop_file-8.i ILP32 true +Hardness hardness/hardness_kloop_100_1loop_file-92.i ILP32 true +Hardness hardness/hardness_kloop_100_while_file-102.i ILP32 true +Hardness hardness/hardness_kloop_100_while_file-114.i ILP32 true +Hardness hardness/hardness_kloop_100_while_file-126.i ILP32 true +Hardness hardness/hardness_kloop_100_while_file-139.i ILP32 true +Hardness hardness/hardness_kloop_100_while_file-150.i ILP32 true +Hardness hardness/hardness_kloop_100_while_file-162.i ILP32 true +Hardness hardness/hardness_kloop_100_while_file-174.i ILP32 true +Hardness hardness/hardness_kloop_100_while_file-187.i ILP32 true +Hardness hardness/hardness_kloop_100_while_file-199.i ILP32 true +Hardness hardness/hardness_kloop_100_while_file-30.i ILP32 true +Hardness hardness/hardness_kloop_100_while_file-42.i ILP32 true +Hardness hardness/hardness_kloop_100_while_file-55.i ILP32 true +Hardness hardness/hardness_kloop_100_while_file-67.i ILP32 true +Hardness hardness/hardness_kloop_100_while_file-79.i ILP32 true +Hardness hardness/hardness_kloop_100_while_file-90.i ILP32 true +Hardness hardness/hardness_kloop_25_1loop_file-101.i ILP32 true +Hardness hardness/hardness_kloop_25_1loop_file-113.i ILP32 true +Hardness hardness/hardness_kloop_25_1loop_file-125.i ILP32 true +Hardness hardness/hardness_kloop_25_1loop_file-137.i ILP32 true +Hardness hardness/hardness_kloop_25_1loop_file-15.i ILP32 true +Hardness hardness/hardness_kloop_25_1loop_file-161.i ILP32 true +Hardness hardness/hardness_kloop_25_1loop_file-173.i ILP32 true +Hardness hardness/hardness_kloop_25_1loop_file-185.i ILP32 true +Hardness hardness/hardness_kloop_25_1loop_file-198.i ILP32 true +Hardness hardness/hardness_kloop_25_1loop_file-3.i ILP32 true +Hardness hardness/hardness_kloop_25_1loop_file-41.i ILP32 true +Hardness hardness/hardness_kloop_25_1loop_file-53.i ILP32 true +Hardness hardness/hardness_kloop_25_1loop_file-66.i ILP32 true +Hardness hardness/hardness_kloop_25_1loop_file-78.i ILP32 true +Hardness hardness/hardness_kloop_25_1loop_file-90.i ILP32 true +Hardness hardness/hardness_kloop_25_while_file-100.i ILP32 true +Hardness hardness/hardness_kloop_25_while_file-113.i ILP32 true +Hardness hardness/hardness_kloop_25_while_file-125.i ILP32 true +Hardness hardness/hardness_kloop_25_while_file-137.i ILP32 true +Hardness hardness/hardness_kloop_25_while_file-149.i ILP32 true +Hardness hardness/hardness_kloop_25_while_file-161.i ILP32 true +Hardness hardness/hardness_kloop_25_while_file-173.i ILP32 true +Hardness hardness/hardness_kloop_25_while_file-185.i ILP32 true +Hardness hardness/hardness_kloop_25_while_file-197.i ILP32 true +Hardness hardness/hardness_kloop_25_while_file-3.i ILP32 true +Hardness hardness/hardness_kloop_25_while_file-41.i ILP32 true +Hardness hardness/hardness_kloop_25_while_file-53.i ILP32 true +Hardness hardness/hardness_kloop_25_while_file-65.i ILP32 true +Hardness hardness/hardness_kloop_25_while_file-78.i ILP32 true +Hardness hardness/hardness_kloop_25_while_file-9.i ILP32 true +Hardness hardness/hardness_kloop_50_1loop_file-10.i ILP32 true +Hardness hardness/hardness_kloop_50_1loop_file-111.i ILP32 true +Hardness hardness/hardness_kloop_50_1loop_file-124.i ILP32 true +Hardness hardness/hardness_kloop_50_1loop_file-136.i ILP32 true +Hardness hardness/hardness_kloop_50_1loop_file-148.i ILP32 true +Hardness hardness/hardness_kloop_50_1loop_file-16.i ILP32 true +Hardness hardness/hardness_kloop_50_1loop_file-172.i ILP32 true +Hardness hardness/hardness_kloop_50_1loop_file-184.i ILP32 true +Hardness hardness/hardness_kloop_50_1loop_file-196.i ILP32 true +Hardness hardness/hardness_kloop_50_1loop_file-28.i ILP32 true +Hardness hardness/hardness_kloop_50_1loop_file-40.i ILP32 true +Hardness hardness/hardness_kloop_50_1loop_file-52.i ILP32 true +Hardness hardness/hardness_kloop_50_1loop_file-64.i ILP32 true +Hardness hardness/hardness_kloop_50_1loop_file-76.i ILP32 true +Hardness hardness/hardness_kloop_50_1loop_file-89.i ILP32 true +Hardness hardness/hardness_kloop_50_while_file-1.i ILP32 true +Hardness hardness/hardness_kloop_50_while_file-111.i ILP32 true +Hardness hardness/hardness_kloop_50_while_file-123.i ILP32 true +Hardness hardness/hardness_kloop_50_while_file-136.i ILP32 true +Hardness hardness/hardness_kloop_50_while_file-148.i ILP32 true +Hardness hardness/hardness_kloop_50_while_file-16.i ILP32 true +Hardness hardness/hardness_kloop_50_while_file-171.i ILP32 true +Hardness hardness/hardness_kloop_50_while_file-184.i ILP32 true +Hardness hardness/hardness_kloop_50_while_file-196.i ILP32 true +Hardness hardness/hardness_kloop_50_while_file-28.i ILP32 true +Hardness hardness/hardness_kloop_50_while_file-4.i ILP32 true +Hardness hardness/hardness_kloop_50_while_file-52.i ILP32 true +Hardness hardness/hardness_kloop_50_while_file-64.i ILP32 true +Hardness hardness/hardness_kloop_50_while_file-76.i ILP32 true +Hardness hardness/hardness_kloop_50_while_file-88.i ILP32 true +Hardness hardness/hardness_operatoramount_amount100_file-1.i ILP32 true +Hardness hardness/hardness_operatoramount_amount100_file-110.i ILP32 true +Hardness hardness/hardness_operatoramount_amount100_file-122.i ILP32 true +Hardness hardness/hardness_operatoramount_amount100_file-134.i ILP32 true +Hardness hardness/hardness_operatoramount_amount100_file-147.i ILP32 true +Hardness hardness/hardness_operatoramount_amount100_file-159.i ILP32 true +Hardness hardness/hardness_operatoramount_amount100_file-170.i ILP32 true +Hardness hardness/hardness_operatoramount_amount100_file-182.i ILP32 true +Hardness hardness/hardness_operatoramount_amount100_file-195.i ILP32 true +Hardness hardness/hardness_operatoramount_amount100_file-27.i ILP32 true +Hardness hardness/hardness_operatoramount_amount100_file-39.i ILP32 true +Hardness hardness/hardness_operatoramount_amount100_file-50.i ILP32 true +Hardness hardness/hardness_operatoramount_amount100_file-63.i ILP32 true +Hardness hardness/hardness_operatoramount_amount100_file-75.i ILP32 true +Hardness hardness/hardness_operatoramount_amount100_file-87.i ILP32 true +Hardness hardness/hardness_operatoramount_amount100_file-99.i ILP32 true +Hardness hardness/hardness_operatoramount_amount10_file-11.i ILP32 true +Hardness hardness/hardness_operatoramount_amount10_file-121.i ILP32 true +Hardness hardness/hardness_operatoramount_amount10_file-134.i ILP32 true +Hardness hardness/hardness_operatoramount_amount10_file-146.i ILP32 true +Hardness hardness/hardness_operatoramount_amount10_file-159.i ILP32 true +Hardness hardness/hardness_operatoramount_amount10_file-170.i ILP32 true +Hardness hardness/hardness_operatoramount_amount10_file-182.i ILP32 true +Hardness hardness/hardness_operatoramount_amount10_file-194.i ILP32 true +Hardness hardness/hardness_operatoramount_amount10_file-27.i ILP32 true +Hardness hardness/hardness_operatoramount_amount10_file-39.i ILP32 true +Hardness hardness/hardness_operatoramount_amount10_file-50.i ILP32 true +Hardness hardness/hardness_operatoramount_amount10_file-62.i ILP32 true +Hardness hardness/hardness_operatoramount_amount10_file-75.i ILP32 true +Hardness hardness/hardness_operatoramount_amount10_file-87.i ILP32 true +Hardness hardness/hardness_operatoramount_amount10_file-99.i ILP32 true +Hardness hardness/hardness_operatoramount_amount250_file-109.i ILP32 true +Hardness hardness/hardness_operatoramount_amount250_file-121.i ILP32 true +Hardness hardness/hardness_operatoramount_amount250_file-133.i ILP32 true +Hardness hardness/hardness_operatoramount_amount250_file-145.i ILP32 true +Hardness hardness/hardness_operatoramount_amount250_file-157.i ILP32 true +Hardness hardness/hardness_operatoramount_amount250_file-17.i ILP32 true +Hardness hardness/hardness_operatoramount_amount250_file-181.i ILP32 true +Hardness hardness/hardness_operatoramount_amount250_file-193.i ILP32 true +Hardness hardness/hardness_operatoramount_amount250_file-25.i ILP32 true +Hardness hardness/hardness_operatoramount_amount250_file-38.i ILP32 true +Hardness hardness/hardness_operatoramount_amount250_file-5.i ILP32 true +Hardness hardness/hardness_operatoramount_amount250_file-61.i ILP32 true +Hardness hardness/hardness_operatoramount_amount250_file-73.i ILP32 true +Hardness hardness/hardness_operatoramount_amount250_file-86.i ILP32 true +Hardness hardness/hardness_operatoramount_amount250_file-98.i ILP32 true +Hardness hardness/hardness_operatoramount_amount25_file-108.i ILP32 true +Hardness hardness/hardness_operatoramount_amount25_file-12.i ILP32 true +Hardness hardness/hardness_operatoramount_amount25_file-132.i ILP32 true +Hardness hardness/hardness_operatoramount_amount25_file-144.i ILP32 true +Hardness hardness/hardness_operatoramount_amount25_file-157.i ILP32 true +Hardness hardness/hardness_operatoramount_amount25_file-169.i ILP32 true +Hardness hardness/hardness_operatoramount_amount25_file-181.i ILP32 true +Hardness hardness/hardness_operatoramount_amount25_file-193.i ILP32 true +Hardness hardness/hardness_operatoramount_amount25_file-25.i ILP32 true +Hardness hardness/hardness_operatoramount_amount25_file-37.i ILP32 true +Hardness hardness/hardness_operatoramount_amount25_file-5.i ILP32 true +Hardness hardness/hardness_operatoramount_amount25_file-61.i ILP32 true +Hardness hardness/hardness_operatoramount_amount25_file-73.i ILP32 true +Hardness hardness/hardness_operatoramount_amount25_file-85.i ILP32 true +Hardness hardness/hardness_operatoramount_amount25_file-98.i ILP32 true +Hardness hardness/hardness_operatoramount_amount500_file-108.i ILP32 true +Hardness hardness/hardness_operatoramount_amount500_file-12.i ILP32 true +Hardness hardness/hardness_operatoramount_amount500_file-131.i ILP32 true +Hardness hardness/hardness_operatoramount_amount500_file-144.i ILP32 true +Hardness hardness/hardness_operatoramount_amount500_file-156.i ILP32 unknown +Hardness hardness/hardness_operatoramount_amount500_file-168.i ILP32 true +Hardness hardness/hardness_operatoramount_amount500_file-18.i ILP32 true +Hardness hardness/hardness_operatoramount_amount500_file-192.i ILP32 true +Hardness hardness/hardness_operatoramount_amount500_file-24.i ILP32 true +Hardness hardness/hardness_operatoramount_amount500_file-36.i ILP32 true +Hardness hardness/hardness_operatoramount_amount500_file-48.i ILP32 true +Hardness hardness/hardness_operatoramount_amount500_file-60.i ILP32 true +Hardness hardness/hardness_operatoramount_amount500_file-72.i ILP32 true +Hardness hardness/hardness_operatoramount_amount500_file-84.i ILP32 true +Hardness hardness/hardness_operatoramount_amount500_file-96.i ILP32 true +Hardness hardness/hardness_operatoramount_amount50_file-107.i ILP32 true +Hardness hardness/hardness_operatoramount_amount50_file-119.i ILP32 true +Hardness hardness/hardness_operatoramount_amount50_file-130.i ILP32 true +Hardness hardness/hardness_operatoramount_amount50_file-142.i ILP32 true +Hardness hardness/hardness_operatoramount_amount50_file-155.i ILP32 true +Hardness hardness/hardness_operatoramount_amount50_file-167.i ILP32 true +Hardness hardness/hardness_operatoramount_amount50_file-18.i ILP32 true +Hardness hardness/hardness_operatoramount_amount50_file-191.i ILP32 true +Hardness hardness/hardness_operatoramount_amount50_file-24.i ILP32 true +Hardness hardness/hardness_operatoramount_amount50_file-36.i ILP32 true +Hardness hardness/hardness_operatoramount_amount50_file-48.i ILP32 true +Hardness hardness/hardness_operatoramount_amount50_file-6.i ILP32 true +Hardness hardness/hardness_operatoramount_amount50_file-72.i ILP32 true +Hardness hardness/hardness_operatoramount_amount50_file-84.i ILP32 true +Hardness hardness/hardness_operatoramount_amount50_file-96.i ILP32 true +Hardness hardness/hardness_wrappers_normal_file-106.i ILP32 true +Hardness hardness/hardness_wrappers_normal_file-119.i ILP32 true +Hardness hardness/hardness_wrappers_normal_file-130.i ILP32 true +Hardness hardness/hardness_wrappers_normal_file-142.i ILP32 true +Hardness hardness/hardness_wrappers_normal_file-154.i ILP32 true +Hardness hardness/hardness_wrappers_normal_file-167.i ILP32 true +Hardness hardness/hardness_wrappers_normal_file-179.i ILP32 true +Hardness hardness/hardness_wrappers_normal_file-190.i ILP32 true +Hardness hardness/hardness_wrappers_normal_file-22.i ILP32 true +Hardness hardness/hardness_wrappers_normal_file-35.i ILP32 true +Hardness hardness/hardness_wrappers_normal_file-47.i ILP32 true +Hardness hardness/hardness_wrappers_normal_file-59.i ILP32 true +Hardness hardness/hardness_wrappers_normal_file-70.i ILP32 true +Hardness hardness/hardness_wrappers_normal_file-83.i ILP32 true +Hardness hardness/hardness_wrappers_normal_file-95.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_a_file-105.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_a_file-117.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_a_file-13.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_a_file-141.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_a_file-153.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_a_file-165.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_a_file-178.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_a_file-19.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_a_file-22.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_a_file-34.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_a_file-47.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_a_file-59.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_a_file-70.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_a_file-82.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_a_file-95.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_ap_file-105.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_ap_file-117.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_ap_file-129.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_ap_file-141.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_ap_file-153.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_ap_file-165.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_ap_file-177.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_ap_file-19.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_ap_file-21.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_ap_file-33.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_ap_file-45.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_ap_file-58.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_ap_file-7.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_ap_file-81.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_ap_file-93.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_p_file-104.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_p_file-116.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_p_file-128.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_p_file-14.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_p_file-152.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_p_file-164.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_p_file-176.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_p_file-188.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_p_file-20.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_p_file-32.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_p_file-45.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_p_file-57.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_p_file-7.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_p_file-81.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_p_file-93.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_s_file-103.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_s_file-116.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_s_file-128.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_s_file-14.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_s_file-151.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_s_file-164.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_s_file-176.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_s_file-188.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_s_file-2.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_s_file-32.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_s_file-44.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_s_file-57.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_s_file-69.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_s_file-81.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_s_file-93.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_sp_file-103.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_sp_file-115.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_sp_file-128.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_sp_file-14.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_sp_file-151.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_sp_file-163.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_sp_file-176.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_sp_file-188.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_sp_file-2.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_sp_file-31.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_sp_file-44.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_sp_file-56.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_sp_file-69.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_sp_file-80.i ILP32 true +Hardness hardness/hardness_wrappers_wrapper_sp_file-93.i ILP32 true +Hardness hardness/hardness_codemodifications_dependencies_file-10.i ILP32 true +Hardness hardness/hardness_codemodifications_dependencies_file-105.i ILP32 true +Hardness hardness/hardness_codemodifications_dependencies_file-111.i ILP32 true +Hardness hardness/hardness_codemodifications_dependencies_file-117.i ILP32 true +Hardness hardness/hardness_codemodifications_dependencies_file-123.i ILP32 true +Hardness hardness/hardness_codemodifications_dependencies_file-129.i ILP32 true +Hardness hardness/hardness_codemodifications_dependencies_file-135.i ILP32 true +Hardness hardness/hardness_codemodifications_dependencies_file-141.i ILP32 true +Hardness hardness/hardness_codemodifications_dependencies_file-148.i ILP32 true +Hardness hardness/hardness_codemodifications_dependencies_file-153.i ILP32 true +Hardness hardness/hardness_codemodifications_dependencies_file-16.i ILP32 true +Hardness hardness/hardness_codemodifications_dependencies_file-165.i ILP32 true +Hardness hardness/hardness_codemodifications_dependencies_file-171.i ILP32 true +Hardness hardness/hardness_codemodifications_dependencies_file-177.i ILP32 true +Hardness hardness/hardness_codemodifications_dependencies_file-183.i ILP32 true +Hardness hardness/hardness_codemodifications_dependencies_file-19.i ILP32 true +Hardness hardness/hardness_codemodifications_dependencies_file-196.i ILP32 true +Hardness hardness/hardness_codemodifications_dependencies_file-21.i ILP32 true +Hardness hardness/hardness_codemodifications_dependencies_file-28.i ILP32 true +Hardness hardness/hardness_codemodifications_dependencies_file-33.i ILP32 true +Hardness hardness/hardness_codemodifications_dependencies_file-4.i ILP32 true +Hardness hardness/hardness_codemodifications_dependencies_file-45.i ILP32 true +Hardness hardness/hardness_codemodifications_dependencies_file-51.i ILP32 true +Hardness hardness/hardness_codemodifications_dependencies_file-58.i ILP32 true +Hardness hardness/hardness_codemodifications_dependencies_file-64.i ILP32 true +Hardness hardness/hardness_codemodifications_dependencies_file-7.i ILP32 true +Hardness hardness/hardness_codemodifications_dependencies_file-76.i ILP32 true +Hardness hardness/hardness_codemodifications_dependencies_file-81.i ILP32 true +Hardness hardness/hardness_codemodifications_dependencies_file-88.i ILP32 true +Hardness hardness/hardness_codemodifications_dependencies_file-93.i ILP32 true +Hardness hardness/hardness_codemodifications_functionizing_file-0.i ILP32 true +Hardness hardness/hardness_codemodifications_functionizing_file-104.i ILP32 true +Hardness hardness/hardness_codemodifications_functionizing_file-110.i ILP32 true +Hardness hardness/hardness_codemodifications_functionizing_file-116.i ILP32 true +Hardness hardness/hardness_codemodifications_functionizing_file-122.i ILP32 true +Hardness hardness/hardness_codemodifications_functionizing_file-128.i ILP32 true +Hardness hardness/hardness_codemodifications_functionizing_file-134.i ILP32 true +Hardness hardness/hardness_codemodifications_functionizing_file-14.i ILP32 true +Hardness hardness/hardness_codemodifications_functionizing_file-146.i ILP32 true +Hardness hardness/hardness_codemodifications_functionizing_file-152.i ILP32 true +Hardness hardness/hardness_codemodifications_functionizing_file-159.i ILP32 true +Hardness hardness/hardness_codemodifications_functionizing_file-164.i ILP32 true +Hardness hardness/hardness_codemodifications_functionizing_file-170.i ILP32 true +Hardness hardness/hardness_codemodifications_functionizing_file-176.i ILP32 true +Hardness hardness/hardness_codemodifications_functionizing_file-182.i ILP32 true +Hardness hardness/hardness_codemodifications_functionizing_file-188.i ILP32 true +Hardness hardness/hardness_codemodifications_functionizing_file-194.i ILP32 true +Hardness hardness/hardness_codemodifications_functionizing_file-20.i ILP32 true +Hardness hardness/hardness_codemodifications_functionizing_file-27.i ILP32 true +Hardness hardness/hardness_codemodifications_functionizing_file-32.i ILP32 true +Hardness hardness/hardness_codemodifications_functionizing_file-39.i ILP32 true +Hardness hardness/hardness_codemodifications_functionizing_file-44.i ILP32 true +Hardness hardness/hardness_codemodifications_functionizing_file-50.i ILP32 true +Hardness hardness/hardness_codemodifications_functionizing_file-56.i ILP32 true +Hardness hardness/hardness_codemodifications_functionizing_file-62.i ILP32 true +Hardness hardness/hardness_codemodifications_functionizing_file-69.i ILP32 true +Hardness hardness/hardness_codemodifications_functionizing_file-75.i ILP32 true +Hardness hardness/hardness_codemodifications_functionizing_file-80.i ILP32 true +Hardness hardness/hardness_codemodifications_functionizing_file-87.i ILP32 true +Hardness hardness/hardness_codemodifications_functionizing_file-93.i ILP32 true +Hardness hardness/hardness_codemodifications_normal_file-0.i ILP32 true +Hardness hardness/hardness_codemodifications_normal_file-103.i ILP32 true +Hardness hardness/hardness_codemodifications_normal_file-11.i ILP32 true +Hardness hardness/hardness_codemodifications_normal_file-116.i ILP32 true +Hardness hardness/hardness_codemodifications_normal_file-122.i ILP32 true +Hardness hardness/hardness_codemodifications_normal_file-128.i ILP32 true +Hardness hardness/hardness_codemodifications_normal_file-134.i ILP32 true +Hardness hardness/hardness_codemodifications_normal_file-14.i ILP32 true +Hardness hardness/hardness_codemodifications_normal_file-146.i ILP32 true +Hardness hardness/hardness_codemodifications_normal_file-151.i ILP32 true +Hardness hardness/hardness_codemodifications_normal_file-158.i ILP32 true +Hardness hardness/hardness_codemodifications_normal_file-164.i ILP32 true +Hardness hardness/hardness_codemodifications_normal_file-170.i ILP32 true +Hardness hardness/hardness_codemodifications_normal_file-176.i ILP32 true +Hardness hardness/hardness_codemodifications_normal_file-182.i ILP32 true +Hardness hardness/hardness_codemodifications_normal_file-188.i ILP32 true +Hardness hardness/hardness_codemodifications_normal_file-194.i ILP32 true +Hardness hardness/hardness_codemodifications_normal_file-2.i ILP32 true +Hardness hardness/hardness_codemodifications_normal_file-26.i ILP32 true +Hardness hardness/hardness_codemodifications_normal_file-32.i ILP32 true +Hardness hardness/hardness_codemodifications_normal_file-39.i ILP32 true +Hardness hardness/hardness_codemodifications_normal_file-44.i ILP32 true +Hardness hardness/hardness_codemodifications_normal_file-50.i ILP32 true +Hardness hardness/hardness_codemodifications_normal_file-56.i ILP32 true +Hardness hardness/hardness_codemodifications_normal_file-62.i ILP32 true +Hardness hardness/hardness_codemodifications_normal_file-68.i ILP32 true +Hardness hardness/hardness_codemodifications_normal_file-74.i ILP32 true +Hardness hardness/hardness_codemodifications_normal_file-80.i ILP32 true +Hardness hardness/hardness_codemodifications_normal_file-87.i ILP32 true +Hardness hardness/hardness_codemodifications_normal_file-92.i ILP32 true +Hardness hardness/hardness_codemodifications_normal_file-99.i ILP32 true +Hardness hardness/hardness_codemodifications_steplocals_file-102.i ILP32 true +Hardness hardness/hardness_codemodifications_steplocals_file-109.i ILP32 true +Hardness hardness/hardness_codemodifications_steplocals_file-114.i ILP32 true +Hardness hardness/hardness_codemodifications_steplocals_file-120.i ILP32 true +Hardness hardness/hardness_codemodifications_steplocals_file-127.i ILP32 true +Hardness hardness/hardness_codemodifications_steplocals_file-133.i ILP32 true +Hardness hardness/hardness_codemodifications_steplocals_file-139.i ILP32 true +Hardness hardness/hardness_codemodifications_steplocals_file-145.i ILP32 true +Hardness hardness/hardness_codemodifications_steplocals_file-150.i ILP32 true +Hardness hardness/hardness_codemodifications_steplocals_file-157.i ILP32 true +Hardness hardness/hardness_codemodifications_steplocals_file-162.i ILP32 true +Hardness hardness/hardness_codemodifications_steplocals_file-169.i ILP32 true +Hardness hardness/hardness_codemodifications_steplocals_file-175.i ILP32 true +Hardness hardness/hardness_codemodifications_steplocals_file-181.i ILP32 true +Hardness hardness/hardness_codemodifications_steplocals_file-187.i ILP32 true +Hardness hardness/hardness_codemodifications_steplocals_file-193.i ILP32 true +Hardness hardness/hardness_codemodifications_steplocals_file-199.i ILP32 true +Hardness hardness/hardness_codemodifications_steplocals_file-25.i ILP32 true +Hardness hardness/hardness_codemodifications_steplocals_file-30.i ILP32 true +Hardness hardness/hardness_codemodifications_steplocals_file-37.i ILP32 true +Hardness hardness/hardness_codemodifications_steplocals_file-43.i ILP32 true +Hardness hardness/hardness_codemodifications_steplocals_file-5.i ILP32 true +Hardness hardness/hardness_codemodifications_steplocals_file-55.i ILP32 true +Hardness hardness/hardness_codemodifications_steplocals_file-61.i ILP32 true +Hardness hardness/hardness_codemodifications_steplocals_file-67.i ILP32 true +Hardness hardness/hardness_codemodifications_steplocals_file-73.i ILP32 true +Hardness hardness/hardness_codemodifications_steplocals_file-79.i ILP32 true +Hardness hardness/hardness_codemodifications_steplocals_file-85.i ILP32 true +Hardness hardness/hardness_codemodifications_steplocals_file-91.i ILP32 true +Hardness hardness/hardness_codemodifications_steplocals_file-98.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_ci_file-101.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_ci_file-108.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_ci_file-114.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_ci_file-120.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_ci_file-126.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_ci_file-132.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_ci_file-139.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_ci_file-145.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_ci_file-150.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_ci_file-157.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_ci_file-162.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_ci_file-169.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_ci_file-174.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_ci_file-180.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_ci_file-187.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_ci_file-193.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_ci_file-199.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_ci_file-25.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_ci_file-30.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_ci_file-37.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_ci_file-42.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_ci_file-49.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_ci_file-55.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_ci_file-61.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_ci_file-67.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_ci_file-73.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_ci_file-79.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_ci_file-85.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_ci_file-90.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_ci_file-97.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_cn_file-101.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_cn_file-108.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_cn_file-113.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_cn_file-12.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_cn_file-125.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_cn_file-131.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_cn_file-137.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_cn_file-143.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_cn_file-15.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_cn_file-156.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_cn_file-161.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_cn_file-168.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_cn_file-173.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_cn_file-18.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_cn_file-185.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_cn_file-191.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_cn_file-198.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_cn_file-24.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_cn_file-3.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_cn_file-36.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_cn_file-41.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_cn_file-48.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_cn_file-53.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_cn_file-6.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_cn_file-66.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_cn_file-72.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_cn_file-78.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_cn_file-84.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_cn_file-9.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_cn_file-96.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_co_file-10.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_co_file-106.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_co_file-112.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_co_file-119.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_co_file-124.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_co_file-130.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_co_file-137.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_co_file-143.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_co_file-149.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_co_file-155.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_co_file-161.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_co_file-168.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_co_file-173.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_co_file-18.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_co_file-185.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_co_file-191.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_co_file-197.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_co_file-23.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_co_file-3.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_co_file-36.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_co_file-41.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_co_file-48.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_co_file-53.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_co_file-6.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_co_file-65.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_co_file-71.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_co_file-78.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_co_file-84.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_co_file-9.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pe_co_file-96.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_ci_file-10.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_ci_file-106.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_ci_file-111.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_ci_file-118.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_ci_file-124.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_ci_file-130.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_ci_file-136.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_ci_file-142.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_ci_file-148.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_ci_file-154.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_ci_file-16.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_ci_file-166.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_ci_file-172.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_ci_file-179.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_ci_file-184.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_ci_file-190.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_ci_file-196.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_ci_file-22.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_ci_file-28.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_ci_file-34.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_ci_file-40.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_ci_file-47.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_ci_file-52.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_ci_file-59.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_ci_file-64.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_ci_file-70.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_ci_file-76.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_ci_file-82.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_ci_file-89.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_ci_file-95.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_cn_file-1.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_cn_file-105.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_cn_file-110.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_cn_file-117.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_cn_file-122.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_cn_file-129.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_cn_file-135.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_cn_file-141.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_cn_file-147.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_cn_file-153.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_cn_file-16.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_cn_file-166.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_cn_file-171.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_cn_file-178.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_cn_file-184.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_cn_file-190.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_cn_file-196.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_cn_file-22.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_cn_file-28.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_cn_file-34.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_cn_file-4.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_cn_file-46.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_cn_file-52.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_cn_file-59.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_cn_file-64.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_cn_file-70.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_cn_file-76.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_cn_file-82.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_cn_file-88.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_cn_file-94.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_co_file-1.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_co_file-105.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_co_file-110.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_co_file-117.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_co_file-122.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_co_file-129.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_co_file-134.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_co_file-140.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_co_file-147.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_co_file-153.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_co_file-159.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_co_file-165.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_co_file-170.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_co_file-177.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_co_file-182.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_co_file-189.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_co_file-195.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_co_file-21.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_co_file-27.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_co_file-33.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_co_file-39.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_co_file-45.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_co_file-50.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_co_file-57.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_co_file-63.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_co_file-7.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_co_file-75.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_co_file-81.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_co_file-87.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_co_file-93.i ILP32 true +Hardness hardness/hardness_fillercode_filler_pr_co_file-99.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_ci_file-103.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_ci_file-11.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_ci_file-116.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_ci_file-121.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_ci_file-128.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_ci_file-133.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_ci_file-14.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_ci_file-145.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_ci_file-151.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_ci_file-158.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_ci_file-164.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_ci_file-17.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_ci_file-176.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_ci_file-182.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_ci_file-189.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_ci_file-194.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_ci_file-20.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_ci_file-27.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_ci_file-33.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_ci_file-39.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_ci_file-45.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_ci_file-50.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_ci_file-57.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_ci_file-62.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_ci_file-69.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_ci_file-75.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_ci_file-81.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_ci_file-87.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_ci_file-93.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_ci_file-99.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_cn_file-103.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_cn_file-109.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_cn_file-115.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_cn_file-121.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_cn_file-128.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_cn_file-133.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_cn_file-14.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_cn_file-145.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_cn_file-151.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_cn_file-157.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_cn_file-163.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_cn_file-17.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_cn_file-176.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_cn_file-181.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_cn_file-188.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_cn_file-193.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_cn_file-2.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_cn_file-25.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_cn_file-31.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_cn_file-38.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_cn_file-44.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_cn_file-5.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_cn_file-56.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_cn_file-61.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_cn_file-68.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_cn_file-73.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_cn_file-8.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_cn_file-86.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_cn_file-92.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_cn_file-98.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_co_file-102.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_co_file-108.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_co_file-114.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_co_file-12.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_co_file-126.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_co_file-132.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_co_file-139.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_co_file-144.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_co_file-150.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_co_file-156.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_co_file-162.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_co_file-168.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_co_file-174.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_co_file-180.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_co_file-187.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_co_file-192.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_co_file-199.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_co_file-25.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_co_file-31.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_co_file-37.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_co_file-43.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_co_file-5.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_co_file-56.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_co_file-61.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_co_file-68.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_co_file-73.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_co_file-8.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_co_file-85.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_co_file-91.i ILP32 true +Hardness hardness/hardness_fillercode_filler_ps_co_file-98.i ILP32 true +Hardness hardness/hardness_fillercode_normal_file-102.i ILP32 true +Hardness hardness/hardness_fillercode_normal_file-108.i ILP32 true +Hardness hardness/hardness_fillercode_normal_file-114.i ILP32 true +Hardness hardness/hardness_fillercode_normal_file-12.i ILP32 true +Hardness hardness/hardness_fillercode_normal_file-126.i ILP32 true +Hardness hardness/hardness_fillercode_normal_file-131.i ILP32 true +Hardness hardness/hardness_fillercode_normal_file-138.i ILP32 true +Hardness hardness/hardness_fillercode_normal_file-144.i ILP32 true +Hardness hardness/hardness_fillercode_normal_file-150.i ILP32 true +Hardness hardness/hardness_fillercode_normal_file-156.i ILP32 unknown +Hardness hardness/hardness_fillercode_normal_file-162.i ILP32 true +Hardness hardness/hardness_fillercode_normal_file-168.i ILP32 true +Hardness hardness/hardness_fillercode_normal_file-174.i ILP32 true +Hardness hardness/hardness_fillercode_normal_file-18.i ILP32 true +Hardness hardness/hardness_fillercode_normal_file-186.i ILP32 true +Hardness hardness/hardness_fillercode_normal_file-192.i ILP32 true +Hardness hardness/hardness_fillercode_normal_file-199.i ILP32 true +Hardness hardness/hardness_fillercode_normal_file-24.i ILP32 true +Hardness hardness/hardness_fillercode_normal_file-30.i ILP32 true +Hardness hardness/hardness_fillercode_normal_file-36.i ILP32 true +Hardness hardness/hardness_fillercode_normal_file-42.i ILP32 true +Hardness hardness/hardness_fillercode_normal_file-48.i ILP32 true +Hardness hardness/hardness_fillercode_normal_file-54.i ILP32 true +Hardness hardness/hardness_fillercode_normal_file-60.i ILP32 true +Hardness hardness/hardness_fillercode_normal_file-67.i ILP32 true +Hardness hardness/hardness_fillercode_normal_file-72.i ILP32 true +Hardness hardness/hardness_fillercode_normal_file-79.i ILP32 true +Hardness hardness/hardness_fillercode_normal_file-84.i ILP32 true +Hardness hardness/hardness_fillercode_normal_file-90.i ILP32 true +Hardness hardness/hardness_fillercode_normal_file-96.i ILP32 true +Hardness hardness/hardness_floats_has_floats_file-100.i ILP32 true +Hardness hardness/hardness_floats_has_floats_file-107.i ILP32 true +Hardness hardness/hardness_floats_has_floats_file-113.i ILP32 true +Hardness hardness/hardness_floats_has_floats_file-119.i ILP32 true +Hardness hardness/hardness_floats_has_floats_file-125.i ILP32 true +Hardness hardness/hardness_floats_has_floats_file-130.i ILP32 true +Hardness hardness/hardness_floats_has_floats_file-137.i ILP32 true +Hardness hardness/hardness_floats_has_floats_file-142.i ILP32 true +Hardness hardness/hardness_floats_has_floats_file-149.i ILP32 true +Hardness hardness/hardness_floats_has_floats_file-155.i ILP32 true +Hardness hardness/hardness_floats_has_floats_file-161.i ILP32 true +Hardness hardness/hardness_floats_has_floats_file-167.i ILP32 true +Hardness hardness/hardness_floats_has_floats_file-173.i ILP32 true +Hardness hardness/hardness_floats_has_floats_file-179.i ILP32 true +Hardness hardness/hardness_floats_has_floats_file-185.i ILP32 true +Hardness hardness/hardness_floats_has_floats_file-190.i ILP32 true +Hardness hardness/hardness_floats_has_floats_file-197.i ILP32 true +Hardness hardness/hardness_floats_has_floats_file-23.i ILP32 true +Hardness hardness/hardness_floats_has_floats_file-3.i ILP32 true +Hardness hardness/hardness_floats_has_floats_file-35.i ILP32 true +Hardness hardness/hardness_floats_has_floats_file-41.i ILP32 true +Hardness hardness/hardness_floats_has_floats_file-48.i ILP32 true +Hardness hardness/hardness_floats_has_floats_file-54.i ILP32 true +Hardness hardness/hardness_floats_has_floats_file-6.i ILP32 true +Hardness hardness/hardness_floats_has_floats_file-66.i ILP32 true +Hardness hardness/hardness_floats_has_floats_file-72.i ILP32 true +Hardness hardness/hardness_floats_has_floats_file-79.i ILP32 true +Hardness hardness/hardness_floats_has_floats_file-84.i ILP32 true +Hardness hardness/hardness_floats_has_floats_file-90.i ILP32 true +Hardness hardness/hardness_floats_has_floats_file-96.i ILP32 true +Hardness hardness/hardness_floats_no_floats_file-100.i ILP32 true +Hardness hardness/hardness_floats_no_floats_file-106.i ILP32 true +Hardness hardness/hardness_floats_no_floats_file-112.i ILP32 true +Hardness hardness/hardness_floats_no_floats_file-119.i ILP32 true +Hardness hardness/hardness_floats_no_floats_file-125.i ILP32 true +Hardness hardness/hardness_floats_no_floats_file-130.i ILP32 true +Hardness hardness/hardness_floats_no_floats_file-137.i ILP32 true +Hardness hardness/hardness_floats_no_floats_file-142.i ILP32 true +Hardness hardness/hardness_floats_no_floats_file-149.i ILP32 true +Hardness hardness/hardness_floats_no_floats_file-154.i ILP32 true +Hardness hardness/hardness_floats_no_floats_file-160.i ILP32 true +Hardness hardness/hardness_floats_no_floats_file-167.i ILP32 true +Hardness hardness/hardness_floats_no_floats_file-173.i ILP32 true +Hardness hardness/hardness_floats_no_floats_file-179.i ILP32 true +Hardness hardness/hardness_floats_no_floats_file-185.i ILP32 true +Hardness hardness/hardness_floats_no_floats_file-190.i ILP32 true +Hardness hardness/hardness_floats_no_floats_file-197.i ILP32 true +Hardness hardness/hardness_floats_no_floats_file-22.i ILP32 true +Hardness hardness/hardness_floats_no_floats_file-29.i ILP32 true +Hardness hardness/hardness_floats_no_floats_file-35.i ILP32 true +Hardness hardness/hardness_floats_no_floats_file-41.i ILP32 true +Hardness hardness/hardness_floats_no_floats_file-47.i ILP32 true +Hardness hardness/hardness_floats_no_floats_file-53.i ILP32 true +Hardness hardness/hardness_floats_no_floats_file-59.i ILP32 true +Hardness hardness/hardness_floats_no_floats_file-65.i ILP32 true +Hardness hardness/hardness_floats_no_floats_file-70.i ILP32 true +Hardness hardness/hardness_floats_no_floats_file-77.i ILP32 true +Hardness hardness/hardness_floats_no_floats_file-83.i ILP32 true +Hardness hardness/hardness_floats_no_floats_file-9.i ILP32 true +Hardness hardness/hardness_floats_no_floats_file-95.i ILP32 true +Hardness hardness/hardness_kloop_100_1loop_file-10.i ILP32 true +Hardness hardness/hardness_kloop_100_1loop_file-105.i ILP32 true +Hardness hardness/hardness_kloop_100_1loop_file-111.i ILP32 true +Hardness hardness/hardness_kloop_100_1loop_file-117.i ILP32 true +Hardness hardness/hardness_kloop_100_1loop_file-123.i ILP32 true +Hardness hardness/hardness_kloop_100_1loop_file-13.i ILP32 true +Hardness hardness/hardness_kloop_100_1loop_file-136.i ILP32 true +Hardness hardness/hardness_kloop_100_1loop_file-141.i ILP32 true +Hardness hardness/hardness_kloop_100_1loop_file-148.i ILP32 true +Hardness hardness/hardness_kloop_100_1loop_file-153.i ILP32 true +Hardness hardness/hardness_kloop_100_1loop_file-16.i ILP32 true +Hardness hardness/hardness_kloop_100_1loop_file-165.i ILP32 true +Hardness hardness/hardness_kloop_100_1loop_file-171.i ILP32 true +Hardness hardness/hardness_kloop_100_1loop_file-178.i ILP32 true +Hardness hardness/hardness_kloop_100_1loop_file-184.i ILP32 true +Hardness hardness/hardness_kloop_100_1loop_file-19.i ILP32 true +Hardness hardness/hardness_kloop_100_1loop_file-196.i ILP32 true +Hardness hardness/hardness_kloop_100_1loop_file-21.i ILP32 true +Hardness hardness/hardness_kloop_100_1loop_file-28.i ILP32 true +Hardness hardness/hardness_kloop_100_1loop_file-33.i ILP32 true +Hardness hardness/hardness_kloop_100_1loop_file-4.i ILP32 true +Hardness hardness/hardness_kloop_100_1loop_file-46.i ILP32 true +Hardness hardness/hardness_kloop_100_1loop_file-52.i ILP32 true +Hardness hardness/hardness_kloop_100_1loop_file-58.i ILP32 true +Hardness hardness/hardness_kloop_100_1loop_file-64.i ILP32 true +Hardness hardness/hardness_kloop_100_1loop_file-70.i ILP32 true +Hardness hardness/hardness_kloop_100_1loop_file-77.i ILP32 unknown +Hardness hardness/hardness_kloop_100_1loop_file-82.i ILP32 true +Hardness hardness/hardness_kloop_100_1loop_file-89.i ILP32 true +Hardness hardness/hardness_kloop_100_1loop_file-95.i ILP32 true +Hardness hardness/hardness_kloop_100_while_file-10.i ILP32 true +Hardness hardness/hardness_kloop_100_while_file-105.i ILP32 true +Hardness hardness/hardness_kloop_100_while_file-111.i ILP32 true +Hardness hardness/hardness_kloop_100_while_file-117.i ILP32 true +Hardness hardness/hardness_kloop_100_while_file-123.i ILP32 true +Hardness hardness/hardness_kloop_100_while_file-129.i ILP32 true +Hardness hardness/hardness_kloop_100_while_file-135.i ILP32 true +Hardness hardness/hardness_kloop_100_while_file-141.i ILP32 true +Hardness hardness/hardness_kloop_100_while_file-148.i ILP32 true +Hardness hardness/hardness_kloop_100_while_file-153.i ILP32 true +Hardness hardness/hardness_kloop_100_while_file-16.i ILP32 true +Hardness hardness/hardness_kloop_100_while_file-165.i ILP32 true +Hardness hardness/hardness_kloop_100_while_file-171.i ILP32 true +Hardness hardness/hardness_kloop_100_while_file-177.i ILP32 true +Hardness hardness/hardness_kloop_100_while_file-183.i ILP32 true +Hardness hardness/hardness_kloop_100_while_file-19.i ILP32 true +Hardness hardness/hardness_kloop_100_while_file-196.i ILP32 true +Hardness hardness/hardness_kloop_100_while_file-21.i ILP32 true +Hardness hardness/hardness_kloop_100_while_file-28.i ILP32 true +Hardness hardness/hardness_kloop_100_while_file-33.i ILP32 true +Hardness hardness/hardness_kloop_100_while_file-4.i ILP32 true +Hardness hardness/hardness_kloop_100_while_file-45.i ILP32 true +Hardness hardness/hardness_kloop_100_while_file-51.i ILP32 true +Hardness hardness/hardness_kloop_100_while_file-58.i ILP32 true +Hardness hardness/hardness_kloop_100_while_file-64.i ILP32 true +Hardness hardness/hardness_kloop_100_while_file-7.i ILP32 true +Hardness hardness/hardness_kloop_100_while_file-76.i ILP32 true +Hardness hardness/hardness_kloop_100_while_file-81.i ILP32 true +Hardness hardness/hardness_kloop_100_while_file-88.i ILP32 true +Hardness hardness/hardness_kloop_100_while_file-93.i ILP32 true +Hardness hardness/hardness_kloop_25_1loop_file-0.i ILP32 true +Hardness hardness/hardness_kloop_25_1loop_file-104.i ILP32 true +Hardness hardness/hardness_kloop_25_1loop_file-110.i ILP32 true +Hardness hardness/hardness_kloop_25_1loop_file-116.i ILP32 true +Hardness hardness/hardness_kloop_25_1loop_file-122.i ILP32 true +Hardness hardness/hardness_kloop_25_1loop_file-128.i ILP32 true +Hardness hardness/hardness_kloop_25_1loop_file-134.i ILP32 true +Hardness hardness/hardness_kloop_25_1loop_file-14.i ILP32 true +Hardness hardness/hardness_kloop_25_1loop_file-146.i ILP32 true +Hardness hardness/hardness_kloop_25_1loop_file-152.i ILP32 true +Hardness hardness/hardness_kloop_25_1loop_file-159.i ILP32 true +Hardness hardness/hardness_kloop_25_1loop_file-164.i ILP32 true +Hardness hardness/hardness_kloop_25_1loop_file-170.i ILP32 true +Hardness hardness/hardness_kloop_25_1loop_file-176.i ILP32 true +Hardness hardness/hardness_kloop_25_1loop_file-182.i ILP32 true +Hardness hardness/hardness_kloop_25_1loop_file-188.i ILP32 true +Hardness hardness/hardness_kloop_25_1loop_file-194.i ILP32 true +Hardness hardness/hardness_kloop_25_1loop_file-20.i ILP32 true +Hardness hardness/hardness_kloop_25_1loop_file-27.i ILP32 true +Hardness hardness/hardness_kloop_25_1loop_file-32.i ILP32 true +Hardness hardness/hardness_kloop_25_1loop_file-39.i ILP32 true +Hardness hardness/hardness_kloop_25_1loop_file-44.i ILP32 true +Hardness hardness/hardness_kloop_25_1loop_file-50.i ILP32 true +Hardness hardness/hardness_kloop_25_1loop_file-56.i ILP32 true +Hardness hardness/hardness_kloop_25_1loop_file-62.i ILP32 true +Hardness hardness/hardness_kloop_25_1loop_file-69.i ILP32 true +Hardness hardness/hardness_kloop_25_1loop_file-75.i ILP32 true +Hardness hardness/hardness_kloop_25_1loop_file-80.i ILP32 true +Hardness hardness/hardness_kloop_25_1loop_file-87.i ILP32 true +Hardness hardness/hardness_kloop_25_1loop_file-93.i ILP32 true +Hardness hardness/hardness_kloop_25_while_file-0.i ILP32 true +Hardness hardness/hardness_kloop_25_while_file-103.i ILP32 true +Hardness hardness/hardness_kloop_25_while_file-11.i ILP32 true +Hardness hardness/hardness_kloop_25_while_file-116.i ILP32 true +Hardness hardness/hardness_kloop_25_while_file-122.i ILP32 true +Hardness hardness/hardness_kloop_25_while_file-128.i ILP32 true +Hardness hardness/hardness_kloop_25_while_file-134.i ILP32 true +Hardness hardness/hardness_kloop_25_while_file-14.i ILP32 true +Hardness hardness/hardness_kloop_25_while_file-146.i ILP32 true +Hardness hardness/hardness_kloop_25_while_file-151.i ILP32 true +Hardness hardness/hardness_kloop_25_while_file-158.i ILP32 true +Hardness hardness/hardness_kloop_25_while_file-164.i ILP32 true +Hardness hardness/hardness_kloop_25_while_file-170.i ILP32 true +Hardness hardness/hardness_kloop_25_while_file-176.i ILP32 true +Hardness hardness/hardness_kloop_25_while_file-182.i ILP32 true +Hardness hardness/hardness_kloop_25_while_file-188.i ILP32 true +Hardness hardness/hardness_kloop_25_while_file-194.i ILP32 true +Hardness hardness/hardness_kloop_25_while_file-2.i ILP32 true +Hardness hardness/hardness_kloop_25_while_file-26.i ILP32 true +Hardness hardness/hardness_kloop_25_while_file-32.i ILP32 true +Hardness hardness/hardness_kloop_25_while_file-39.i ILP32 true +Hardness hardness/hardness_kloop_25_while_file-44.i ILP32 true +Hardness hardness/hardness_kloop_25_while_file-50.i ILP32 true +Hardness hardness/hardness_kloop_25_while_file-56.i ILP32 true +Hardness hardness/hardness_kloop_25_while_file-62.i ILP32 true +Hardness hardness/hardness_kloop_25_while_file-68.i ILP32 true +Hardness hardness/hardness_kloop_25_while_file-74.i ILP32 true +Hardness hardness/hardness_kloop_25_while_file-80.i ILP32 true +Hardness hardness/hardness_kloop_25_while_file-87.i ILP32 true +Hardness hardness/hardness_kloop_25_while_file-92.i ILP32 true +Hardness hardness/hardness_kloop_25_while_file-99.i ILP32 true +Hardness hardness/hardness_kloop_50_1loop_file-102.i ILP32 true +Hardness hardness/hardness_kloop_50_1loop_file-109.i ILP32 true +Hardness hardness/hardness_kloop_50_1loop_file-114.i ILP32 true +Hardness hardness/hardness_kloop_50_1loop_file-120.i ILP32 true +Hardness hardness/hardness_kloop_50_1loop_file-127.i ILP32 true +Hardness hardness/hardness_kloop_50_1loop_file-133.i ILP32 true +Hardness hardness/hardness_kloop_50_1loop_file-139.i ILP32 true +Hardness hardness/hardness_kloop_50_1loop_file-145.i ILP32 true +Hardness hardness/hardness_kloop_50_1loop_file-150.i ILP32 true +Hardness hardness/hardness_kloop_50_1loop_file-157.i ILP32 true +Hardness hardness/hardness_kloop_50_1loop_file-162.i ILP32 true +Hardness hardness/hardness_kloop_50_1loop_file-169.i ILP32 true +Hardness hardness/hardness_kloop_50_1loop_file-175.i ILP32 true +Hardness hardness/hardness_kloop_50_1loop_file-181.i ILP32 true +Hardness hardness/hardness_kloop_50_1loop_file-187.i ILP32 true +Hardness hardness/hardness_kloop_50_1loop_file-193.i ILP32 true +Hardness hardness/hardness_kloop_50_1loop_file-199.i ILP32 true +Hardness hardness/hardness_kloop_50_1loop_file-25.i ILP32 true +Hardness hardness/hardness_kloop_50_1loop_file-30.i ILP32 true +Hardness hardness/hardness_kloop_50_1loop_file-37.i ILP32 true +Hardness hardness/hardness_kloop_50_1loop_file-43.i ILP32 true +Hardness hardness/hardness_kloop_50_1loop_file-5.i ILP32 true +Hardness hardness/hardness_kloop_50_1loop_file-55.i ILP32 true +Hardness hardness/hardness_kloop_50_1loop_file-61.i ILP32 true +Hardness hardness/hardness_kloop_50_1loop_file-67.i ILP32 true +Hardness hardness/hardness_kloop_50_1loop_file-73.i ILP32 true +Hardness hardness/hardness_kloop_50_1loop_file-79.i ILP32 true +Hardness hardness/hardness_kloop_50_1loop_file-85.i ILP32 true +Hardness hardness/hardness_kloop_50_1loop_file-91.i ILP32 true +Hardness hardness/hardness_kloop_50_1loop_file-98.i ILP32 true diff --git a/tests/testcomp/corpus/cover-error-official.tsv b/tests/testcomp/corpus/cover-error-official.tsv new file mode 100644 index 000000000..75f1e539c --- /dev/null +++ b/tests/testcomp/corpus/cover-error-official.tsv @@ -0,0 +1,1903 @@ +# category program data_model expected_unreach +Arrays array-fpi/ms3f.c ILP32 false +BitVectors bitvector/s3_clnt_2.BV.c.cil-2a.c ILP32 false +ControlFlow ntdrivers/floppy.i.cil-1.c ILP32 false +ECA eca-rers2012/Problem18_label00.c ILP32 false +Floats floats-cdfpl/newton_1_7.i ILP32 false +Heap ldv-regression/rule57_ebda_blast_2.i ILP32 false +Loops nla-digbench-scaling/fermat1-ll_unwindbound5.c ILP32 false +ProductLines product-lines/email_spec27_product34.cil.c ILP32 false +Recursive recursive-simple/id_b3_o2-2.c ILP32 false +Sequentialized seq-mthreaded/pals_lcr-var-start-time.6.1.ufo.UNBOUNDED.pals.c ILP32 false +XCSP xcsp/aim-100-1-6-sat-3.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.iprotocol.3.prop1-back-serstep.c LP64 false +SoftwareSystems-BusyBox busybox-1.22.0/od-3.i LP64 false +SoftwareSystems-coreutils coreutils-v9.5-units/relpath_path_common_prefix_symmetry_cover_proof.i LP64 false +SoftwareSystems-OpenBSD openbsd-6.2/if_etherip-unreach-call.i LP64 false +SoftwareSystems-DeviceDriversLinux64 ldv-consumption/32_7a_cilled_linux-3.8-rc1-32_7a-drivers--media--dvb-frontends--stv090x.ko-ldv_main0_sequence_infinite_withcheck_stateful.cil.out.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_key_freeid__invalid_state_tdr_metadata__cover_exit_havoc_memory.i LP64 false +Arrays array-fpi/condgf.c ILP32 false +BitVectors bitvector-loops/verisec_sendmail_tTflag_arr_one_loop.c ILP32 false +ControlFlow ntdrivers/cdaudio.i.cil-1.c ILP32 false +ECA eca-rers2012/Problem06_label00.c ILP32 false +Floats float-benchs/nan_double.c ILP32 false +Heap forester-heap/sll-optional-2.i ILP32 false +Loops nla-digbench-scaling/bresenham-ll_unwindbound100.c ILP32 false +ProductLines product-lines/email_spec0_product22.cil.c ILP32 false +Recursive fuzzle-programs/09_fuzzle_50x50_75-cycle.c LP64 false +Sequentialized seq-mthreaded/pals_floodmax.4.3.ufo.BOUNDED-8.pals.c ILP32 false +XCSP xcsp/AllInterval-019.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.brp2.4.prop1-back-serstep.c LP64 false +SoftwareSystems-BusyBox busybox-1.22.0/ls-incomplete-2.i LP64 false +SoftwareSystems-coreutils coreutils-v9.5-units/getlimits_decimal_absval_add_one_all_nines_cover_proof.i LP64 false +SoftwareSystems-DeviceDriversLinux64 ldv-linux-3.7.3/main0_drivers--media--dvb-frontends--stv090x-ko---32_7a--linux-3.7.3.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_addcx__invalid_input_tdr_pa__cover_entry_havoc_object.i LP64 false +Arrays array-fpi/s5liff.c ILP32 false +BitVectors bitvector/soft_float_1-3a.c.cil.c ILP32 false +ControlFlow ntdrivers/kbfiltr.i.cil-2.c ILP32 false +ECA eca-rers2018/Problem14.c ILP32 false +Floats floats-cdfpl/sine_1.i ILP32 false +Heap ldv-sets/test_mutex_unlock_at_exit.i ILP32 false +Loops nla-digbench-scaling/prod4br-ll_unwindbound20.c ILP32 false +ProductLines product-lines/email_spec6_product29.cil.c ILP32 false +Recursive recursive/Addition02.c ILP32 false +Sequentialized seq-mthreaded/pals_opt-floodmax.3.4.ufo.BOUNDED-6.pals.c ILP32 false +XCSP xcsp/aim-200-1-6-sat-2.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.production_cell.5.prop1-back-serstep.c LP64 false +SoftwareSystems-BusyBox busybox-1.22.0/printf-2.i LP64 false +SoftwareSystems-coreutils coreutils-v9.5-units/relpath_relpath_identical_paths_cover_target.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_config__invalid_state_sys_state__cover_proof_havoc_object.i LP64 false +Arrays array-examples/standard_copy6_ground-1.i ILP32 false +BitVectors bitvector-loops/diamond_2-1.c ILP32 false +ControlFlow ntdrivers/diskperf.i.cil-2.c ILP32 false +ECA eca-programs/Problem103_label32.c ILP32 false +Floats float-benchs/float_int_inv_square.c ILP32 false +Heap forester-heap/dll-rb-sentinel-1.i ILP32 false +Loops loops/insertion_sort-1-2.c ILP32 false +ProductLines product-lines/elevator_spec2_product30.cil.c ILP32 false +Recursive fuzzle-programs/04_fuzzle_60x60.c LP64 false +Sequentialized seq-mthreaded/pals_floodmax.3.1.ufo.BOUNDED-6.pals.c ILP32 false +XCSP xcsp/AllInterval-011.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.arbitrated_top_n4_w16_d64_e0.c LP64 false +SoftwareSystems-BusyBox busybox-1.22.0/test-incomplete-1.i LP64 false +SoftwareSystems-coreutils coreutils-v9.5-units/factors_valid_64bit_number_cover_proof.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_vp_enter__expected__cover_proof_havoc_object.i LP64 false +Arrays array-fpi/ifeqn4f.c ILP32 false +BitVectors bitvector-regression/recHanoi03-1.c ILP32 false +ControlFlow ntdrivers/parport.i.cil-1.c ILP32 false +ECA eca-rers2012/Problem12_label00.c ILP32 false +Floats float-newlib/double_req_bl_0870a.c ILP32 false +Heap heap-manipulation/bubble_sort_linux-2.i ILP32 false +Loops nla-digbench-scaling/egcd2-ll_unwindbound2.c ILP32 false +ProductLines product-lines/email_spec1_product22.cil.c ILP32 false +Recursive fuzzle-programs/13_fuzzle_50x50_CVE-2016-4493.c LP64 false +Sequentialized seq-mthreaded/pals_floodmax.5_overflow.ufo.UNBOUNDED.pals.c ILP32 false +XCSP xcsp/CostasArray-12.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.elevator_planning.1.prop1-func-interl.c LP64 false +SoftwareSystems-coreutils coreutils-v9.5-units/getlimits_decimal_absval_add_one_positive_cover_proof.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_init__invalid_state_lifecycle__cover_proof_havoc_object.i LP64 false +Arrays array-fpi/s1iff.c ILP32 false +BitVectors bitvector/s3_clnt_3.BV.c.cil-2a.c ILP32 false +ECA eca-rers2018/Problem11.c ILP32 false +Floats floats-cdfpl/newton_2_8.i ILP32 false +Heap ldv-regression/test25-1.c ILP32 false +Loops nla-digbench-scaling/freire2_valuebound50.c ILP32 false +ProductLines product-lines/email_spec4_product19.cil.c ILP32 false +Recursive recursive-simple/id_o20.c ILP32 false +Sequentialized seq-mthreaded/pals_lcr.6.1.ufo.UNBOUNDED.pals.c ILP32 false +XCSP xcsp/aim-100-3-4-sat-2.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.mul9.c LP64 false +SoftwareSystems-coreutils coreutils-v9.5-units/relpath_path_common_prefix_valid_cover_target.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mr_finalize__invalid_state_tdr_metadata__cover_exit_havoc_memory.i LP64 false +Arrays array-industry-pattern/array_ptr_single_elem_init-2.i ILP32 false +BitVectors bitvector/soft_float_4-3a.c.cil.c ILP32 false +ECA eca-rers2018/Problem16.c ILP32 false +Floats floats-cdfpl/square_2.i ILP32 false +Heap list-ext3-properties/sll_nondet_insert-1.i ILP32 false +Loops nla-digbench-scaling/ps5-ll_unwindbound1.c ILP32 false +ProductLines product-lines/email_spec8_product22.cil.c ILP32 false +Recursive recursive/McCarthy91-1.c ILP32 false +Sequentialized seq-mthreaded/pals_opt-floodmax.5.1.ufo.UNBOUNDED.pals.c ILP32 false +XCSP xcsp/aim-200-3-4-sat-1.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.sokoban.2.prop1-back-serstep.c LP64 false +SoftwareSystems-coreutils coreutils-v9.5-units/relpath_relpath_potential_buffer_overflow_cover_target.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_shutdown__unexpected__cover_entry_havoc_object.i LP64 false +Arrays array-examples/standard_allDiff2_ground.i ILP32 false +BitVectors bitvector/byte_add-1.i ILP32 false +ECA eca-programs/Problem101_label00.c ILP32 false +Floats float-benchs/cast_union_loose.c ILP32 false +Heap forester-heap/dll-optional-2.i ILP32 false +Loops loop-invariants/linear-inequality-inv-b.c ILP32 false +ProductLines product-lines/elevator_spec1_product26.cil.c ILP32 false +Recursive fuzzle-programs/02_fuzzle_40x40.c LP64 false +Sequentialized seq-mthreaded/pals_STARTPALS_ActiveStandby.4_2.ufo.UNBOUNDED.pals.c ILP32 false +XCSP xcsp/AllInterval-007.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.arbitrated_top_n2_w32_d32_e0.c LP64 false +SoftwareSystems-coreutils coreutils-v9.5-units/factors_trivial_cover_proof.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_sys_rd__unconstrained__cover_exit_unsuccess_havoc_memory.i LP64 false +Arrays array-examples/standard_running-1.i ILP32 false +BitVectors bitvector/sum02-1.c ILP32 false +ECA eca-rers2012/Problem05_label00.c ILP32 false +Floats float-benchs/inv_Newton.c.p+cfa-reducer.c ILP32 false +Heap forester-heap/dll-token-2.i ILP32 false +Loops loops/sum03-1.i ILP32 false +ProductLines product-lines/elevator_spec3_product28.cil.c ILP32 false +Recursive fuzzle-programs/06_fuzzle_50x50_0-cycle.c LP64 false +Sequentialized seq-mthreaded/pals_floodmax.3.4.ufo.BOUNDED-6.pals.c ILP32 false +XCSP xcsp/AllInterval-015.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.bakery.4.prop1-func-interl.c LP64 false +SoftwareSystems-coreutils coreutils-v9.5-units/factors_valid_numbers_cover_proof.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_export_restore__expected__cover_exit_havoc_memory.i LP64 false +Arrays array-fpi/eqn4f.c ILP32 false +ECA eca-rers2012/Problem11_label00.c ILP32 false +Floats float-benchs/sin_interpolated_index-1.c ILP32 false +Heap forester-heap/sll-rb-sentinel-2.i ILP32 false +Loops nla-digbench-scaling/egcd-ll_unwindbound100.c ILP32 false +ProductLines product-lines/email_spec11_product26.cil.c ILP32 false +Recursive fuzzle-programs/11_fuzzle_50x50_CVE-2016-4489.c LP64 false +Sequentialized seq-mthreaded/pals_floodmax.5.1.ufo.UNBOUNDED.pals.c ILP32 false +XCSP xcsp/AllInterval-030.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.circular_pointer_top_w64_d64_e0.c LP64 false +SoftwareSystems-coreutils coreutils-v9.5-units/getlimits_decimal_absval_add_one_negative_cover_proof.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_create__invalid_input_rdx__cover_exit_havoc_memory.i LP64 false +Arrays array-fpi/indp4f.c ILP32 false +ECA eca-rers2012/Problem15_label00.c ILP32 false +Floats floats-cdfpl/newton_1_4.i ILP32 false +Heap heap-manipulation/sll_to_dll_rev-1.i ILP32 false +Loops nla-digbench-scaling/egcd3-ll_unwindbound20.c ILP32 false +ProductLines product-lines/email_spec27_product18.cil.c ILP32 false +Recursive fuzzle-programs/15_fuzzle_50x50_equality-checks.c LP64 false +Sequentialized seq-mthreaded/pals_lcr-var-start-time.4.2.ufo.BOUNDED-8.pals.c ILP32 false +XCSP xcsp/CostasArray-16.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.frogs.3.prop1-func-interl.c LP64 false +SoftwareSystems-coreutils coreutils-v9.5-units/relpath_path_common_prefix_identical_cover_proof.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_key_config__invalid_state_tdr_lifecycle__cover_entry_havoc_memory.i LP64 false +Arrays array-fpi/pcompf.c ILP32 false +ECA eca-rers2018/Problem10.c ILP32 false +Floats floats-cdfpl/newton_2_6.i ILP32 false +Heap ldv-regression/test22-3.c ILP32 false +Loops nla-digbench-scaling/fermat2-ll_unwindbound5.c ILP32 false +ProductLines product-lines/email_spec3_product27.cil.c ILP32 false +Recursive recursive-simple/id_o100.c ILP32 false +Sequentialized seq-mthreaded/pals_lcr.4.1.ufo.BOUNDED-8.pals.c ILP32 false +XCSP xcsp/aim-100-2-0-sat-2.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.lann.6.prop1-back-serstep.c LP64 false +SoftwareSystems-coreutils coreutils-v9.5-units/relpath_path_common_prefix_symmetry_cover_target.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_vpflushdone__invalid_state_tdr_metadata__cover_proof_havoc_object.i LP64 false +Arrays array-fpi/s3iff.c ILP32 false +ECA eca-rers2018/Problem12.c ILP32 false +Floats floats-cdfpl/newton_3_7.i ILP32 false +Heap ldv-sets/test_add-1.i ILP32 false +Loops nla-digbench-scaling/mannadiv_unwindbound2.c ILP32 false +ProductLines product-lines/email_spec4_product35.cil.c ILP32 false +Recursive recursive-simple/id_o3.c ILP32 false +Sequentialized seq-mthreaded/pals_lcr.8_overflow.ufo.UNBOUNDED.pals.c ILP32 false +XCSP xcsp/aim-100-6-0-sat-2.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.peg_solitaire.6.prop1-func-interl.c LP64 false +SoftwareSystems-coreutils coreutils-v9.5-units/relpath_relpath_different_paths_output_cover_target.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_phymem_page_reclaim__invalid_state_pamt_metadata__cover_exit_havoc_object.i LP64 false +Arrays array-fpi/sqm-iff.c ILP32 false +ECA eca-rers2018/Problem15.c ILP32 false +Floats floats-cdfpl/sine_3.i ILP32 false +Heap list-ext2-properties/simple_and_skiplist_2lvl-1.i ILP32 false +Loops nla-digbench-scaling/prodbin-ll_unwindbound5.c ILP32 false +ProductLines product-lines/email_spec7_product30.cil.c ILP32 false +Recursive recursive/EvenOdd03.c ILP32 false +Sequentialized seq-mthreaded/pals_opt-floodmax.4.2.ufo.UNBOUNDED.pals.c ILP32 false +XCSP xcsp/aim-200-2-0-sat-1.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.schedule_world.2.prop1-back-serstep.c LP64 false +SoftwareSystems-coreutils coreutils-v9.5-units/relpath_relpath_matching_paths_output_cover_target.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_key_config__expected__cover_entry_havoc_memory.i LP64 false +Arrays array-tiling/skippedu.c ILP32 false +ECA eca-rers2018/Problem17.c ILP32 false +Floats loop-floats-scientific-comp/loop1-2.c ILP32 false +Heap list-properties/list-2.i ILP32 false +Loops nla-digbench-scaling/ps6-ll_unwindbound10.c ILP32 false +ProductLines product-lines/email_spec9_product20.cil.c ILP32 false +Recursive verifythis/tree_del_rec_incorrect.c ILP32 false +Sequentialized seq-mthreaded/pals_opt-floodmax.5_overflow.ufo.UNBOUNDED.pals.c ILP32 false +XCSP xcsp/aim-200-6-0-sat-1.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.twocount32.c LP64 false +SoftwareSystems-coreutils coreutils-v9.5-units/seq_cmp_antisymmetry_cover_target.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_update__unexpected__cover_proof_havoc_memory.i LP64 false +Arrays array-examples/sorting_bubblesort_ground-2.i ILP32 false +ECA eca-rers2012/Problem16_label00.c ILP32 false +Floats float-benchs/cast_float_ptr.c ILP32 false +Heap forester-heap/dll-01-1.i ILP32 false +Loops loop-acceleration/diamond_1-2.c ILP32 false +ProductLines product-lines/elevator_spec14_productSimulator.cil.c ILP32 false +Recursive fuzzle-programs/01_fuzzle_30x30.c LP64 false +Sequentialized seq-mthreaded/pals_STARTPALS_ActiveStandby.4_1.ufo.BOUNDED-10.pals.c ILP32 false +XCSP xcsp/AllInterval-005.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.adding.6.prop1-func-interl.c LP64 false +SoftwareSystems-coreutils coreutils-v9.5-units/factors_trivial_cover_target.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_servtd_wr__expected__cover_exit_havoc_object.i LP64 false +Arrays array-examples/standard_copy3_ground-2.i ILP32 false +ECA eca-rers2018/Problem13.c ILP32 false +Floats float-benchs/cast_union_tight.c ILP32 false +Heap forester-heap/dll-queue-2.i ILP32 false +Loops loops/bubble_sort-2.i ILP32 false +ProductLines product-lines/elevator_spec2_product18.cil.c ILP32 false +Recursive fuzzle-programs/03_fuzzle_50x50.c LP64 false +Sequentialized seq-mthreaded/pals_STARTPALS_Triplicated.1.ufo.BOUNDED-10.pals.c ILP32 false +XCSP xcsp/AllInterval-009.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.arbitrated_top_n3_w16_d32_e0.c LP64 false +SoftwareSystems-coreutils coreutils-v9.5-units/factors_valid_64bit_number_cover_target.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_vm_wr__invalid_input_rcx__cover_entry_havoc_memory.i LP64 false +Arrays array-examples/standard_copy9_ground-1.i ILP32 false +ECA eca-rers2018/Problem18.c ILP32 false +Floats float-benchs/inv_Newton-2.c ILP32 false +Heap forester-heap/dll-simple-white-blue-1.i ILP32 false +Loops loops/n.c24.i ILP32 false +ProductLines product-lines/elevator_spec3_product19.cil.c ILP32 false +Recursive fuzzle-programs/05_fuzzle_70x70.c LP64 false +Sequentialized seq-mthreaded/pals_floodmax.3.2.ufo.UNBOUNDED.pals.c ILP32 false +XCSP xcsp/AllInterval-013.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.arbitrated_top_n5_w16_d64_e0.c LP64 false +SoftwareSystems-coreutils coreutils-v9.5-units/factors_valid_numbers_cover_target.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_vp_enter__unexpected__cover_exit_havoc_object.i LP64 false +Arrays array-fpi/brs3f.c ILP32 false +Floats float-benchs/inv_square-1.c ILP32 false +Heap forester-heap/sll-buckets-2.i ILP32 false +Loops loops/trex03-1.c ILP32 false +ProductLines product-lines/elevator_spec9_product28.cil.c ILP32 false +Recursive fuzzle-programs/07_fuzzle_50x50_25-cycle.c LP64 false +Sequentialized seq-mthreaded/pals_floodmax.4.1.ufo.BOUNDED-8.pals.c ILP32 false +XCSP xcsp/AllInterval-017.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.brp.3.prop1-back-serstep.c LP64 false +SoftwareSystems-coreutils coreutils-v9.5-units/getlimits_decimal_absval_add_one_all_nines_cover_target.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_import_abort__unconstrained__cover_exit_unsuccess_havoc_memory.i LP64 false +Arrays array-fpi/eqn1f.c ILP32 false +Floats float-benchs/nan_float.c ILP32 false +Heap forester-heap/sll-queue-2.i ILP32 false +Loops nla-digbench-scaling/bresenham-ll_unwindbound5.c ILP32 false +ProductLines product-lines/email_spec0_product35.cil.c ILP32 false +Recursive fuzzle-programs/10_fuzzle_50x50_CVE-2016-4487.c LP64 false +Sequentialized seq-mthreaded/pals_floodmax.4.4.ufo.UNBOUNDED.pals.c ILP32 false +XCSP xcsp/AllInterval-020.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.circular_pointer_top_w128_d32_e0.c LP64 false +SoftwareSystems-coreutils coreutils-v9.5-units/getlimits_decimal_absval_add_one_negative_cover_target.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_addcx__invalid_state_td_state__cover_exit_havoc_object.i LP64 false +Arrays array-fpi/ifeqn1f.c ILP32 false +Floats float-benchs/sqrt_poly2.c ILP32 false +Heap forester-heap/sll-sorted-1.i ILP32 false +Loops nla-digbench-scaling/egcd-ll_unwindbound50.c ILP32 false +ProductLines product-lines/email_spec11_productSimulator.cil.c ILP32 false +Recursive fuzzle-programs/12_fuzzle_50x50_CVE-2016-4492.c LP64 false +Sequentialized seq-mthreaded/pals_floodmax.5.3.ufo.BOUNDED-10.pals.c ILP32 false +XCSP xcsp/CostasArray-10.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.cyclic_scheduler.2.prop1-func-interl.c LP64 false +SoftwareSystems-coreutils coreutils-v9.5-units/getlimits_decimal_absval_add_one_positive_cover_target.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_create__unexpected__cover_exit_havoc_memory.i LP64 false +Arrays array-fpi/indp1f.c ILP32 false +Floats float-newlib/float_req_bl_0870a.c ILP32 false +Heap heap-manipulation/dll_of_dll-2.i ILP32 false +Loops nla-digbench-scaling/egcd3-ll_unwindbound1.c ILP32 false +ProductLines product-lines/email_spec1_product32.cil.c ILP32 false +Recursive fuzzle-programs/14_fuzzle_50x50_CVE-2016-6131.c LP64 false +Sequentialized seq-mthreaded/pals_lcr-var-start-time.3.2.ufo.BOUNDED-6.pals.c ILP32 false +XCSP xcsp/CostasArray-14.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.firewire_tree.2.prop3-func-interl.c LP64 false +SoftwareSystems-coreutils coreutils-v9.5-units/relpath_path_common_prefix_identical_cover_target.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_init__unconstrained__cover_exit_success_havoc_object.i LP64 false +Arrays array-fpi/modpf.c ILP32 false +Floats floats-cdfpl/newton_1_5.i ILP32 false +Heap heap-manipulation/tree-4.i ILP32 false +Loops nla-digbench-scaling/fermat1-ll_unwindbound10.c ILP32 false +ProductLines product-lines/email_spec27_product27.cil.c ILP32 false +Recursive recursified_loop-invariants/recursified_linear-inequality-inv-b.c ILP32 unknown +Sequentialized seq-mthreaded/pals_lcr-var-start-time.5.1.ufo.UNBOUNDED.pals.c ILP32 false +XCSP xcsp/aim-100-1-6-sat-1.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.gear.2.prop3-func-interl.c LP64 false +SoftwareSystems-coreutils coreutils-v9.5-units/relpath_path_common_prefix_valid_cover_proof.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_key_config__unexpected__cover_proof_havoc_object.i LP64 false +Arrays array-fpi/ncompf.c ILP32 false +Floats floats-cdfpl/newton_1_8.i ILP32 false +Heap ldv-regression/rule60_list2.c_1.i ILP32 false +Loops nla-digbench-scaling/fermat2-ll_unwindbound10.c ILP32 false +ProductLines product-lines/email_spec3_product18.cil.c ILP32 false +Recursive recursive-simple/id_o10.c ILP32 false +Sequentialized seq-mthreaded/pals_lcr.3.1.ufo.BOUNDED-6.pals.c ILP32 false +XCSP xcsp/aim-100-1-6-sat-4.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.krebs.3.prop1-back-serstep.c LP64 false +SoftwareSystems-coreutils coreutils-v9.5-units/relpath_relpath_different_paths_output_cover_proof.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_vpflushdone__invalid_input_tdr_hkid__cover_exit_havoc_memory.i LP64 false +Arrays array-fpi/res2f.c ILP32 false +Floats floats-cdfpl/newton_2_7.i ILP32 false +Heap ldv-regression/test23-1.c ILP32 false +Loops nla-digbench-scaling/freire2_valuebound100.c ILP32 false +ProductLines product-lines/email_spec3_product32.cil.c ILP32 false +Recursive recursive-simple/id_o1000.c ILP32 false +Sequentialized seq-mthreaded/pals_lcr.5.1.ufo.BOUNDED-10.pals.c ILP32 false +XCSP xcsp/aim-100-2-0-sat-4.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.leader_filters.6.prop1-func-interl.c LP64 false +SoftwareSystems-coreutils coreutils-v9.5-units/relpath_relpath_identical_paths_cover_proof.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mr_finalize__invalid_input_hkid__cover_proof_havoc_object.i LP64 false +Arrays array-fpi/s2iff.c ILP32 false +Floats floats-cdfpl/newton_3_6.i ILP32 false +Heap ldv-regression/test28-1.c ILP32 false +Loops nla-digbench-scaling/hard2_unwindbound5.c ILP32 false +ProductLines product-lines/email_spec4_product30.cil.c ILP32 false +Recursive recursive-simple/id_o200.c ILP32 false +Sequentialized seq-mthreaded/pals_lcr.7.1.ufo.UNBOUNDED.pals.c ILP32 false +XCSP xcsp/aim-100-3-4-sat-4.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.needham.3.prop4-back-serstep.c LP64 false +SoftwareSystems-coreutils coreutils-v9.5-units/relpath_relpath_matching_paths_output_cover_proof.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_phymem_page_reclaim__invalid_input_pa__cover_entry_havoc_memory.i LP64 false +Arrays array-fpi/s4iff.c ILP32 false +Floats floats-cdfpl/newton_3_8.i ILP32 false +Heap ldv-sets/test_mutex_double_unlock.i ILP32 false +Loops nla-digbench-scaling/prod4br-ll_unwindbound1.c ILP32 false +ProductLines product-lines/email_spec6_product16.cil.c ILP32 false +Recursive recursive-simple/sum_non_eq-3.c ILP32 false +Sequentialized seq-mthreaded/pals_opt-floodmax.3.2.ufo.BOUNDED-6.pals.c ILP32 false +XCSP xcsp/aim-100-6-0-sat-4.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.pgm_protocol.6.prop5-back-serstep.c LP64 false +SoftwareSystems-coreutils coreutils-v9.5-units/relpath_relpath_potential_buffer_overflow_cover_proof.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_config__invalid_input_hkid__cover_exit_havoc_memory.i LP64 false +Arrays array-fpi/sina3f.c ILP32 false +Floats floats-cdfpl/sine_2.i ILP32 false +Heap list-ext-properties/list-ext.i ILP32 false +Loops nla-digbench-scaling/prodbin-ll_unwindbound1.c ILP32 false +ProductLines product-lines/email_spec6_product34.cil.c ILP32 false +Recursive recursive/BallRajamani-SPIN2000-Fig1.c ILP32 false +Sequentialized seq-mthreaded/pals_opt-floodmax.4.1.ufo.BOUNDED-8.pals.c ILP32 false +XCSP xcsp/aim-200-1-6-sat-3.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.reader_writer.1.prop1-func-interl.c LP64 false +SoftwareSystems-coreutils coreutils-v9.5-units/seq_cmp_antisymmetry_cover_proof.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_init__expected__cover_proof_havoc_object.i LP64 false +Arrays array-fpi/ss2f.c ILP32 false +Floats floats-cdfpl/square_1.i ILP32 false +Heap list-ext3-properties/dll_nullified-1.i ILP32 false +Loops nla-digbench-scaling/ps4-ll_unwindbound2.c ILP32 false +ProductLines product-lines/email_spec7_product35.cil.c ILP32 false +Recursive recursive/Fibonacci04.c ILP32 false +Sequentialized seq-mthreaded/pals_opt-floodmax.4.4.ufo.BOUNDED-8.pals.c ILP32 false +XCSP xcsp/aim-200-2-0-sat-3.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.shift_register_top_w32_d16_e0.c LP64 false +SoftwareSystems-coreutils coreutils-v9.5-units/seq_incr_no_carry_cover_proof.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_shutdown__expected__cover_entry_havoc_memory.i LP64 false +Arrays array-programs/copysome1-2.i ILP32 false +Floats floats-cdfpl/square_3.i ILP32 false +Heap list-ext3-properties/sll_of_sll_nondet_append-2.i ILP32 false +Loops nla-digbench-scaling/ps5-ll_unwindbound20.c ILP32 false +ProductLines product-lines/email_spec8_product33.cil.c ILP32 false +Recursive verifythis/tree_del_rec.c ILP32 false +Sequentialized seq-mthreaded/pals_opt-floodmax.5.3.ufo.BOUNDED-10.pals.c ILP32 false +XCSP xcsp/aim-200-3-4-sat-3.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.telephony.3.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_update__invalid_state_handoff_version__cover_exit_havoc_object.i LP64 false +Arrays reducercommutativity/rangesum10.i ILP32 false +Floats loop-floats-scientific-comp/loop2-1.c ILP32 false +Heap list-properties/simple-1.i ILP32 false +Loops nla-digbench-scaling/ps6-ll_unwindbound5.c ILP32 false +ProductLines product-lines/email_spec9_product31.cil.c ILP32 false +Recursive verifythis/tree_max.c ILP32 false +Sequentialized seq-pthread/cs_queue-2.i ILP32 false +XCSP xcsp/aim-200-6-0-sat-3.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.vis_QF_BV_s1269b_p4.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_vp_enter__invalid_state_op_state__cover_proof_havoc_object.i LP64 false +Arrays array-examples/data_structures_set_multi_proc_ground-1.i ILP32 false +Floats floats-cdfpl/newton_1_6.i ILP32 false +Heap forester-heap/dll-circular-1.i ILP32 false +Loops loop-acceleration/array_2-1.i ILP32 false +ProductLines product-lines/elevator_spec14_product24.cil.c ILP32 false +Recursive fuzzle-programs/08_fuzzle_50x50_50-cycle.c LP64 false +Sequentialized seq-mthreaded/pals_STARTPALS_ActiveStandby.1.ufo.BOUNDED-10.pals.c ILP32 false +XCSP xcsp/AllInterval-006.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.adding.2.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_mr_report__unconstrained__cover_exit_unsuccess_havoc_object.i LP64 false +Arrays array-examples/sorting_selectionsort_2_ground.i ILP32 false +Floats loop-floats-scientific-comp/loop4.i ILP32 false +Heap forester-heap/dll-rb-cnstr_1-2.i ILP32 false +Loops loop-acceleration/simple_2-2.c ILP32 false +ProductLines product-lines/elevator_spec1_product20.cil.c ILP32 false +Recursive recursive-simple/id2_b3_o2.c ILP32 false +Sequentialized seq-mthreaded/pals_STARTPALS_ActiveStandby.4_1.ufo.UNBOUNDED.pals.c ILP32 false +XCSP xcsp/AllInterval-008.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.anderson.7.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_servtd_wr__unexpected__cover_exit_havoc_object.i LP64 false +Arrays array-examples/standard_copy1_ground-2.i ILP32 false +Heap forester-heap/dll-sorted-1.i ILP32 false +Loops loops-crafted-1/nested_delay_notd2.c ILP32 false +ProductLines product-lines/elevator_spec1_product30.cil.c ILP32 false +Recursive recursive/Ackermann02.c ILP32 false +Sequentialized seq-mthreaded/pals_STARTPALS_ActiveStandby.5.ufo.BOUNDED-10.pals.c ILP32 false +XCSP xcsp/AllInterval-010.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.arbitrated_top_n2_w64_d8_e0.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_vm_wr__expected__cover_exit_havoc_memory.i LP64 false +Arrays array-examples/standard_copy4_ground-2.i ILP32 false +Heap forester-heap/sll-01-2.i ILP32 false +Loops loops/count_up_down-2.c ILP32 false +ProductLines product-lines/elevator_spec2_product24.cil.c ILP32 false +Recursive recursive/Fibonacci05.c ILP32 false +Sequentialized seq-mthreaded/pals_STARTPALS_Triplicated.2.ufo.BOUNDED-10.pals.c ILP32 false +XCSP xcsp/AllInterval-012.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.arbitrated_top_n3_w8_d128_e0.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_vm_wr__unexpected__cover_entry_havoc_memory.i LP64 false +Arrays array-examples/standard_copy7_ground-1.i ILP32 false +Heap forester-heap/sll-circular-2.i ILP32 false +Loops loops/linear_search.c ILP32 false +ProductLines product-lines/elevator_spec2_productSimulator.cil.c ILP32 false +Recursive verifythis/tree_max_incorrect.c ILP32 false +Sequentialized seq-mthreaded/pals_floodmax.3.1.ufo.UNBOUNDED.pals.c ILP32 false +XCSP xcsp/AllInterval-014.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.arbitrated_top_n4_w8_d128_e0.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_vp_enter__invalid_input_vmflag__cover_exit_havoc_object.i LP64 false +Arrays array-examples/standard_minInArray_ground-1.i ILP32 false +Heap forester-heap/sll-rb-cnstr_1-2.i ILP32 false +Loops loops/string-2.i ILP32 false +ProductLines product-lines/elevator_spec3_product23.cil.c ILP32 false +Sequentialized seq-mthreaded/pals_floodmax.3.3.ufo.BOUNDED-6.pals.c ILP32 false +XCSP xcsp/AllInterval-016.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.at.2.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_vp_vmcall__invalid_input_bitmap__cover_proof_havoc_object.i LP64 false +Arrays array-fpi/brs1f.c ILP32 false +Heap forester-heap/sll-simple-white-blue-2.i ILP32 false +Loops loops/trex01-1.c ILP32 false +ProductLines product-lines/elevator_spec3_product32.cil.c ILP32 false +Sequentialized seq-mthreaded/pals_floodmax.3.4.ufo.UNBOUNDED.pals.c ILP32 false +XCSP xcsp/AllInterval-018.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.bridge.1.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_export_restore__unexpected__cover_exit_havoc_memory.i LP64 false +Arrays array-fpi/brs5f.c ILP32 false +Heap forester-heap/sll-token-1.i ILP32 false +Loops nla-digbench-scaling/bresenham-ll_unwindbound1.c ILP32 false +ProductLines product-lines/elevator_spec9_productSimulator.cil.c ILP32 false +Sequentialized seq-mthreaded/pals_floodmax.4.2.ufo.BOUNDED-8.pals.c ILP32 false +XCSP xcsp/AllInterval-025.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.brp2.1.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_addcx__expected__cover_exit_havoc_memory.i LP64 false +Arrays array-fpi/condmf.c ILP32 false +Heap heap-manipulation/merge_sort-1.i ILP32 false +Loops nla-digbench-scaling/bresenham-ll_unwindbound2.c ILP32 false +ProductLines product-lines/email_spec0_product31.cil.c ILP32 false +Sequentialized seq-mthreaded/pals_floodmax.4.3.ufo.UNBOUNDED.pals.c ILP32 false +XCSP xcsp/AllInterval-035.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.cambridge.2.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_addcx__invalid_state_lifecycle__cover_proof_havoc_object.i LP64 false +Arrays array-fpi/eqn2f.c ILP32 false +Heap heap-manipulation/tree-2.i ILP32 false +Loops nla-digbench-scaling/egcd-ll_unwindbound1.c ILP32 false +ProductLines product-lines/email_spec11_product15.cil.c ILP32 false +Sequentialized seq-mthreaded/pals_floodmax.4_overflow.ufo.UNBOUNDED.pals.c ILP32 false +XCSP xcsp/CostasArray-11.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.circular_pointer_top_w32_d128_e0.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_addcx__unexpected__cover_exit_havoc_object.i LP64 false +Arrays array-fpi/eqn5f.c ILP32 false +Heap ldv-regression/fo_test.i ILP32 false +Loops nla-digbench-scaling/egcd-ll_unwindbound20.c ILP32 false +ProductLines product-lines/email_spec11_product32.cil.c ILP32 false +Sequentialized seq-mthreaded/pals_floodmax.5.2.ufo.BOUNDED-10.pals.c ILP32 false +XCSP xcsp/CostasArray-13.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.collision.2.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_create__invalid_state_tdr_page__cover_entry_havoc_memory.i LP64 false +Arrays array-fpi/ifeqn2f.c ILP32 false +Heap ldv-regression/test21-2.c ILP32 false +Loops nla-digbench-scaling/egcd2-ll_unwindbound10.c ILP32 false +ProductLines product-lines/email_spec1_product16.cil.c ILP32 false +Sequentialized seq-mthreaded/pals_floodmax.5.4.ufo.BOUNDED-10.pals.c ILP32 false +XCSP xcsp/CostasArray-15.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.driving_phils.3.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_init__invalid_input_tdr_pa__cover_entry_havoc_memory.i LP64 false +Arrays array-fpi/ifeqn5f.c ILP32 false +Heap ldv-regression/test24-2.c ILP32 false +Loops nla-digbench-scaling/egcd2-ll_unwindbound5.c ILP32 false +ProductLines product-lines/email_spec1_product29.cil.c ILP32 false +Sequentialized seq-mthreaded/pals_lcr-var-start-time.3.1.ufo.BOUNDED-6.pals.c ILP32 false +XCSP xcsp/CostasArray-17.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.eq_sdp_v7.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_init__invalid_state_pamt_metadata__cover_exit_havoc_object.i LP64 false +Arrays array-fpi/indp2f.c ILP32 false +Heap ldv-regression/test29-1.c ILP32 false +Loops nla-digbench-scaling/egcd3-ll_unwindbound100.c ILP32 false +ProductLines product-lines/email_spec1_product35.cil.c ILP32 false +Sequentialized seq-mthreaded/pals_lcr-var-start-time.4.1.ufo.BOUNDED-8.pals.c ILP32 false +XCSP xcsp/aim-100-1-6-sat-2.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.fischer.5.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_key_config__invalid_input_tdr_hkid__cover_entry_havoc_object.i LP64 false +Arrays array-fpi/indp5f.c ILP32 false +Heap ldv-sets/test_mutex_double_lock.i ILP32 false +Loops nla-digbench-scaling/egcd3-ll_unwindbound50.c ILP32 false +ProductLines product-lines/email_spec27_product23.cil.c ILP32 false +Sequentialized seq-mthreaded/pals_lcr-var-start-time.4.2.ufo.UNBOUNDED.pals.c ILP32 false +XCSP xcsp/aim-100-2-0-sat-1.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.gear.1.prop3-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_key_config__invalid_state_tdr_metadata__cover_proof_havoc_memory.i LP64 false +Arrays array-fpi/ms1f.c ILP32 false +Heap ldv-sets/test_mutex_unbounded-2.i ILP32 false +Loops nla-digbench-scaling/fermat1-ll_unwindbound2.c ILP32 false +ProductLines product-lines/email_spec27_product31.cil.c ILP32 false +Sequentialized seq-mthreaded/pals_lcr-var-start-time.5.2.ufo.UNBOUNDED.pals.c ILP32 false +XCSP xcsp/aim-100-2-0-sat-3.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.hanoi.2.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_key_freeid__invalid_state_kot__cover_exit_havoc_object.i LP64 false +Arrays array-fpi/ms4f.c ILP32 false +Heap list-ext-properties/simple-ext.i ILP32 false +Loops nla-digbench-scaling/fermat1-ll_unwindbound50.c ILP32 false +ProductLines product-lines/email_spec27_productSimulator.cil.c ILP32 false +Sequentialized seq-mthreaded/pals_lcr-var-start-time.6.2.ufo.BOUNDED-12.pals.c ILP32 false +XCSP xcsp/aim-100-3-4-sat-1.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.iprotocol.6.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_key_freeid__unexpected__cover_proof_havoc_memory.i LP64 false +Arrays array-fpi/nsqm-iff.c ILP32 false +Heap list-ext2-properties/simple_search_value-2.i ILP32 false +Loops nla-digbench-scaling/fermat2-ll_unwindbound2.c ILP32 false +ProductLines product-lines/email_spec3_product23.cil.c ILP32 false +Sequentialized seq-mthreaded/pals_lcr.3.1.ufo.UNBOUNDED.pals.c ILP32 false +XCSP xcsp/aim-100-3-4-sat-3.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.lamport.8.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_vpflushdone__invalid_state_tdr_lifecycle__cover_entry_havoc_memory.i LP64 false +Arrays array-fpi/res1f.c ILP32 false +Heap list-ext3-properties/sll_length_check-1.i ILP32 false +Loops nla-digbench-scaling/freire2_valuebound1.c ILP32 false +ProductLines product-lines/email_spec3_product29.cil.c ILP32 false +Sequentialized seq-mthreaded/pals_lcr.4.1.ufo.UNBOUNDED.pals.c ILP32 false +XCSP xcsp/aim-100-6-0-sat-1.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.leader_election.4.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mr_finalize__expected__cover_entry_havoc_object.i LP64 false +Arrays array-fpi/res2of.c ILP32 false +Heap list-properties/alternating_list-2.i ILP32 false +Loops nla-digbench-scaling/freire2_valuebound20.c ILP32 false +ProductLines product-lines/email_spec3_product35.cil.c ILP32 false +Sequentialized seq-mthreaded/pals_lcr.5_overflow.ufo.UNBOUNDED.pals.c ILP32 false +XCSP xcsp/aim-100-6-0-sat-3.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.loyd.2.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mr_finalize__invalid_state_op_state__cover_exit_havoc_object.i LP64 false +Arrays array-fpi/s1liff.c ILP32 false +Heap list-properties/list_flag-1.i ILP32 false +Loops nla-digbench-scaling/hard2_unwindbound10.c ILP32 false +ProductLines product-lines/email_spec4_product24.cil.c ILP32 false +Sequentialized seq-mthreaded/pals_lcr.6_overflow.ufo.UNBOUNDED.pals.c ILP32 false +XCSP xcsp/aim-200-1-6-sat-1.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.needham.1.prop4-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mr_finalize__unexpected__cover_exit_havoc_memory.i LP64 false +Arrays array-fpi/s2liff.c ILP32 false +Heap list-properties/splice-1.i ILP32 false +Loops nla-digbench-scaling/mannadiv_unwindbound10.c ILP32 false +ProductLines product-lines/email_spec4_product32.cil.c ILP32 false +Sequentialized seq-mthreaded/pals_lcr.8.1.ufo.BOUNDED-16.pals.c ILP32 false +XCSP xcsp/aim-200-1-6-sat-4.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.peg_solitaire.1.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_phymem_page_reclaim__invalid_state_child_count__cover_proof_havoc_memory.i LP64 false +Arrays array-fpi/s3liff.c ILP32 false +Loops nla-digbench-scaling/mannadiv_unwindbound5.c ILP32 false +ProductLines product-lines/email_spec6_product12.cil.c ILP32 false +Sequentialized seq-mthreaded/pals_opt-floodmax.3.1.ufo.BOUNDED-6.pals.c ILP32 false +XCSP xcsp/aim-200-2-0-sat-2.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.peterson.6.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_phymem_page_reclaim__unexpected__cover_exit_havoc_object.i LP64 false +Arrays array-fpi/s52iff.c ILP32 false +Loops nla-digbench-scaling/prod4br-ll_unwindbound100.c ILP32 false +ProductLines product-lines/email_spec6_product22.cil.c ILP32 false +Sequentialized seq-mthreaded/pals_opt-floodmax.3.3.ufo.BOUNDED-6.pals.c ILP32 false +XCSP xcsp/aim-200-2-0-sat-4.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.production_cell.1.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_config__invalid_state_lp_state__cover_entry_havoc_memory.i LP64 false +Arrays array-fpi/sina1f.c ILP32 false +Loops nla-digbench-scaling/prod4br-ll_unwindbound5.c ILP32 false +ProductLines product-lines/email_spec6_product31.cil.c ILP32 false +Sequentialized seq-mthreaded/pals_opt-floodmax.3.4.ufo.UNBOUNDED.pals.c ILP32 false +XCSP xcsp/aim-200-3-4-sat-2.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.protocols.2.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_config__unexpected__cover_entry_havoc_object.i LP64 false +Arrays array-fpi/sina4f.c ILP32 false +Loops nla-digbench-scaling/prodbin-ll_unwindbound2.c ILP32 false +ProductLines product-lines/email_spec6_productSimulator.cil.c ILP32 false +Sequentialized seq-mthreaded/pals_opt-floodmax.4.1.ufo.UNBOUNDED.pals.c ILP32 false +XCSP xcsp/aim-200-3-4-sat-4.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.rether.6.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_init__invalid_state_sys_state__cover_exit_havoc_object.i LP64 false +Arrays array-fpi/sqmf.c ILP32 false +Loops nla-digbench-scaling/ps4-ll_unwindbound10.c ILP32 false +ProductLines product-lines/email_spec7_product32.cil.c ILP32 false +Sequentialized seq-mthreaded/pals_opt-floodmax.4.3.ufo.BOUNDED-8.pals.c ILP32 false +XCSP xcsp/aim-200-6-0-sat-2.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.shift_register_top_w128_d64_e0.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_key_config__invalid_state_sys_state__cover_proof_havoc_memory.i LP64 false +Arrays array-fpi/ss4f.c ILP32 false +Loops nla-digbench-scaling/ps4-ll_unwindbound5.c ILP32 false +ProductLines product-lines/email_spec8_product16.cil.c ILP32 false +Sequentialized seq-mthreaded/pals_opt-floodmax.4_overflow.ufo.UNBOUNDED.pals.c ILP32 false +XCSP xcsp/aim-200-6-0-sat-4.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.shift_register_top_w64_d8_e0.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_shutdown__invalid_input_handoff_no_downgrade__cover_proof_havoc_memory.i LP64 false +Arrays array-industry-pattern/array_single_elem_init.i ILP32 false +Loops nla-digbench-scaling/ps5-ll_unwindbound100.c ILP32 false +ProductLines product-lines/email_spec8_product30.cil.c ILP32 false +Sequentialized seq-mthreaded/pals_opt-floodmax.5.2.ufo.BOUNDED-10.pals.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.synapse.5.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_update__expected__cover_proof_havoc_object.i LP64 false +Arrays array-programs/copysome2-2.i ILP32 false +Loops nla-digbench-scaling/ps5-ll_unwindbound50.c ILP32 false +ProductLines product-lines/email_spec8_productSimulator.cil.c ILP32 false +Sequentialized seq-mthreaded/pals_opt-floodmax.5.4.ufo.BOUNDED-10.pals.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.train-gate.1.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_update__invalid_state_sys_state__cover_entry_havoc_object.i LP64 false +Arrays reducercommutativity/rangesum.i ILP32 false +Loops nla-digbench-scaling/ps6-ll_unwindbound2.c ILP32 false +ProductLines product-lines/email_spec9_product22.cil.c ILP32 false +Sequentialized seq-pthread/cs_fib-2.i ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.v_Unidec.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_vp_enter__invalid_state_lifecycle__cover_entry_havoc_memory.i LP64 false +Arrays reducercommutativity/rangesum40.i ILP32 false +Loops verifythis/tree_del_iter.c ILP32 false +ProductLines product-lines/email_spec9_product34.cil.c ILP32 false +Sequentialized seq-pthread/cs_stack-2.i ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.vis_arrays_bpbs_p4.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_vp_enter__invalid_state_td_state__cover_exit_havoc_object.i LP64 false +Arrays array-examples/sorting_bubblesort_2_ground.i ILP32 false +Loops loop-acceleration/array_3-2.i ILP32 false +ProductLines product-lines/elevator_spec14_product20.cil.c ILP32 false +Sequentialized seq-mthreaded/pals_STARTPALS_ActiveStandby.1.ufo.UNBOUNDED.pals.c ILP32 false +Hardware hardware-verification-array/btor2c-lazyMod.unsafe_ridecore_array.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_mr_report__expected__cover_proof_havoc_memory.i LP64 false +Arrays array-examples/sorting_selectionsort_ground-1.i ILP32 false +Loops loop-acceleration/multivar_1-2.c ILP32 false +ProductLines product-lines/elevator_spec14_product28.cil.c ILP32 false +Sequentialized seq-mthreaded/pals_STARTPALS_ActiveStandby.4_2.ufo.BOUNDED-10.pals.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.adding.4.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_mr_report__unexpected__cover_proof_havoc_memory.i LP64 false +Arrays array-examples/standard_copy2_ground-1.i ILP32 false +Loops loop-acceleration/simple_3-1.c ILP32 false +ProductLines product-lines/elevator_spec1_product18.cil.c ILP32 false +Sequentialized seq-mthreaded/pals_STARTPALS_ActiveStandby.5.ufo.UNBOUNDED.pals.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.anderson.3.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_servtd_wr__unconstrained__cover_exit_unsuccess_havoc_memory.i LP64 false +Arrays array-examples/standard_copy5_ground-2.i ILP32 false +Loops loop-invgen/id_trans.i ILP32 false +ProductLines product-lines/elevator_spec1_product22.cil.c ILP32 false +Sequentialized seq-mthreaded/pals_STARTPALS_Triplicated.1.ufo.UNBOUNDED.pals.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.arbitrated_top_n2_w16_d64_e0.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_sys_rd__expected__cover_exit_havoc_memory.i LP64 false +Arrays array-examples/standard_copy8_ground-2.i ILP32 false +Loops loops/array-2.c ILP32 false +ProductLines product-lines/elevator_spec1_product28.cil.c ILP32 false +Sequentialized seq-mthreaded/pals_STARTPALS_Triplicated.2.ufo.UNBOUNDED.pals.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.arbitrated_top_n2_w64_d128_e0.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_sys_rd__unexpected__cover_exit_havoc_object.i LP64 false +Arrays array-examples/standard_partition_ground-1.i ILP32 false +Loops loops/compact.c ILP32 false +ProductLines product-lines/elevator_spec1_product32.cil.c ILP32 false +Sequentialized seq-mthreaded/pals_floodmax.3.2.ufo.BOUNDED-6.pals.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.arbitrated_top_n2_w8_d64_e0.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_vm_wr__invalid_input_field_id__cover_entry_havoc_object.i LP64 false +Arrays array-fpi/brs2f.c ILP32 false +Loops loops/for_bounded_loop1.c ILP32 false +ProductLines product-lines/elevator_spec2_product20.cil.c ILP32 false +Sequentialized seq-mthreaded/pals_floodmax.3.3.ufo.UNBOUNDED.pals.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.arbitrated_top_n3_w32_d16_e0.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_vm_wr__invalid_input_rcx__cover_proof_havoc_object.i LP64 false +Arrays array-fpi/brs4f.c ILP32 false +Loops loops/invert_string-1.c ILP32 false +ProductLines product-lines/elevator_spec2_product26.cil.c ILP32 false +Sequentialized seq-mthreaded/pals_floodmax.3_overflow.ufo.UNBOUNDED.pals.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.arbitrated_top_n3_w8_d8_e0.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_vm_wr__unexpected__cover_proof_havoc_object.i LP64 false +Arrays array-fpi/condaf.c ILP32 false +Loops loops/matrix-2-2.c ILP32 false +ProductLines product-lines/elevator_spec2_product32.cil.c ILP32 false +Sequentialized seq-mthreaded/pals_floodmax.4.1.ufo.UNBOUNDED.pals.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.arbitrated_top_n4_w32_d16_e0.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_vp_enter__invalid_input_gpa__cover_proof_havoc_memory.i LP64 false +Arrays array-fpi/condnf.c ILP32 false +Loops loops/nec20.c ILP32 false +ProductLines product-lines/elevator_spec3_product03.cil.c ILP32 false +Sequentialized seq-mthreaded/pals_floodmax.4.2.ufo.UNBOUNDED.pals.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.arbitrated_top_n4_w8_d8_e0.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_vp_enter__unconstrained__cover_exit_unsuccess_havoc_memory.i LP64 false +Arrays array-fpi/eqn3f.c ILP32 false +Loops loops/sum01_bug02.i ILP32 false +ProductLines product-lines/elevator_spec3_product20.cil.c ILP32 false +Sequentialized seq-mthreaded/pals_floodmax.4.4.ufo.BOUNDED-8.pals.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.arbitrated_top_n5_w8_d32_e0.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_vp_vmcall__invalid_input_bitmap__cover_entry_havoc_memory.i LP64 false +Arrays array-fpi/ifcompf.c ILP32 false +Loops loops/terminator_01.c ILP32 false +ProductLines product-lines/elevator_spec3_product24.cil.c ILP32 false +Sequentialized seq-mthreaded/pals_floodmax.5.1.ufo.BOUNDED-10.pals.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.at.6.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_vp_vmcall__unexpected__cover_exit_havoc_memory.i LP64 false +Arrays array-fpi/ifeqn3f.c ILP32 false +Loops loops/trex02-2.c ILP32 false +ProductLines product-lines/elevator_spec3_product31.cil.c ILP32 false +Sequentialized seq-mthreaded/pals_floodmax.5.2.ufo.UNBOUNDED.pals.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.blocks.3.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_export_restore__unconstrained__cover_exit_success_havoc_object.i LP64 false +Arrays array-fpi/ifncompf.c ILP32 false +Loops loops/vogal-2.i ILP32 false +ProductLines product-lines/elevator_spec3_productSimulator.cil.c ILP32 false +Sequentialized seq-mthreaded/pals_floodmax.5.3.ufo.UNBOUNDED.pals.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.bridge.3.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_import_abort__expected__cover_entry_havoc_object.i LP64 false +Arrays array-fpi/indp3f.c ILP32 false +Loops nla-digbench-scaling/bresenham-ll_unwindbound10.c ILP32 false +ProductLines product-lines/elevator_spec9_product30.cil.c ILP32 false +Sequentialized seq-mthreaded/pals_floodmax.5.4.ufo.UNBOUNDED.pals.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.brp.5.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_import_abort__unexpected__cover_exit_havoc_object.i LP64 false +Arrays array-fpi/modnf.c ILP32 false +Loops nla-digbench-scaling/bresenham-ll_unwindbound20.c ILP32 false +ProductLines product-lines/email_spec0_product16.cil.c ILP32 false +Sequentialized seq-mthreaded/pals_lcr-var-start-time.3.1.ufo.UNBOUNDED.pals.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.brp2.2.prop3-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_addcx__invalid_input_tdcx_pa__cover_entry_havoc_object.i LP64 false +Arrays array-fpi/modsf.c ILP32 false +Loops nla-digbench-scaling/bresenham-ll_unwindbound50.c ILP32 false +ProductLines product-lines/email_spec0_product26.cil.c ILP32 false +Sequentialized seq-mthreaded/pals_lcr-var-start-time.3.2.ufo.UNBOUNDED.pals.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.brp2.5.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_addcx__invalid_state_lifecycle__cover_entry_havoc_memory.i LP64 false +Arrays array-fpi/ms2f.c ILP32 false +Loops nla-digbench-scaling/egcd-ll_unwindbound10.c ILP32 false +ProductLines product-lines/email_spec0_product33.cil.c ILP32 false +Sequentialized seq-mthreaded/pals_lcr-var-start-time.4.1.ufo.UNBOUNDED.pals.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.cambridge.7.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_addcx__invalid_state_pamt_metadata__cover_proof_havoc_memory.i LP64 false +Arrays array-fpi/ms5f.c ILP32 false +Loops nla-digbench-scaling/egcd-ll_unwindbound2.c ILP32 false +ProductLines product-lines/email_spec0_productSimulator.cil.c ILP32 false +Sequentialized seq-mthreaded/pals_lcr-var-start-time.5.1.ufo.BOUNDED-10.pals.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.circular_pointer_top_w16_d16_e0.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_addcx__unconstrained__cover_exit_unsuccess_havoc_memory.i LP64 false +Arrays array-fpi/nsqmf.c ILP32 false +Loops nla-digbench-scaling/egcd-ll_unwindbound5.c ILP32 false +ProductLines product-lines/email_spec11_product20.cil.c ILP32 false +Sequentialized seq-mthreaded/pals_lcr-var-start-time.5.2.ufo.BOUNDED-10.pals.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.circular_pointer_top_w32_d8_e0.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_create__invalid_input_rcx__cover_exit_havoc_memory.i LP64 false +Arrays array-fpi/res1of.c ILP32 false +Loops nla-digbench-scaling/egcd2-ll_unwindbound1.c ILP32 false +ProductLines product-lines/email_spec11_product30.cil.c ILP32 false +Sequentialized seq-mthreaded/pals_lcr-var-start-time.6.1.ufo.BOUNDED-12.pals.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.circular_pointer_top_w8_d16_e0.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_create__invalid_state_kot_entry__cover_entry_havoc_object.i LP64 false +Arrays array-fpi/s12iff.c ILP32 false +Loops nla-digbench-scaling/egcd2-ll_unwindbound100.c ILP32 false +ProductLines product-lines/email_spec11_product33.cil.c ILP32 false +Sequentialized seq-mthreaded/pals_lcr-var-start-time.6.2.ufo.UNBOUNDED.pals.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.count2.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_create__invalid_state_tdr_page__cover_proof_havoc_object.i LP64 false +Arrays array-fpi/s22iff.c ILP32 false +Loops nla-digbench-scaling/egcd2-ll_unwindbound20.c ILP32 false +ProductLines product-lines/email_spec1_product14.cil.c ILP32 false +Sequentialized seq-mthreaded/pals_lcr.3_overflow.ufo.UNBOUNDED.pals.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.driving_phils.1.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_init__expected__cover_entry_havoc_object.i LP64 false +Arrays array-fpi/s32iff.c ILP32 false +Loops nla-digbench-scaling/egcd2-ll_unwindbound50.c ILP32 false +ProductLines product-lines/email_spec1_product20.cil.c ILP32 false +Sequentialized seq-mthreaded/pals_lcr.4_overflow.ufo.UNBOUNDED.pals.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.driving_phils.5.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_init__invalid_input_tdr_pa__cover_proof_havoc_object.i LP64 false +Arrays array-fpi/s42iff.c ILP32 false +Loops nla-digbench-scaling/egcd3-ll_unwindbound10.c ILP32 false +ProductLines product-lines/email_spec1_product26.cil.c ILP32 false +Sequentialized seq-mthreaded/pals_lcr.5.1.ufo.UNBOUNDED.pals.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.elevator_planning.3.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_init__invalid_state_op_state__cover_proof_havoc_memory.i LP64 false +Arrays array-fpi/s4liff.c ILP32 false +Loops nla-digbench-scaling/egcd3-ll_unwindbound2.c ILP32 false +ProductLines product-lines/email_spec1_product30.cil.c ILP32 false +Sequentialized seq-mthreaded/pals_lcr.6.1.ufo.BOUNDED-12.pals.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.extinction.3.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_init__invalid_state_td_state__cover_exit_havoc_memory.i LP64 false +Arrays array-fpi/s5iff.c ILP32 false +Loops nla-digbench-scaling/egcd3-ll_unwindbound5.c ILP32 false +ProductLines product-lines/email_spec1_product33.cil.c ILP32 false +Sequentialized seq-mthreaded/pals_lcr.7.1.ufo.BOUNDED-14.pals.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.fischer.2.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_init__unexpected__cover_exit_havoc_memory.i LP64 false +Arrays array-fpi/sina2f.c ILP32 false +Loops nla-digbench-scaling/fermat1-ll_unwindbound1.c ILP32 false +ProductLines product-lines/email_spec1_productSimulator.cil.c ILP32 false +Sequentialized seq-mthreaded/pals_lcr.7_overflow.ufo.UNBOUNDED.pals.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.frogs.1.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_key_config__invalid_state_td_state__cover_entry_havoc_memory.i LP64 false +Arrays array-fpi/sina5f.c ILP32 false +Loops nla-digbench-scaling/fermat1-ll_unwindbound100.c ILP32 false +ProductLines product-lines/email_spec27_product19.cil.c ILP32 false +Sequentialized seq-mthreaded/pals_lcr.8.1.ufo.UNBOUNDED.pals.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.gear.1.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_key_config__invalid_state_tdr_lifecycle__cover_proof_havoc_object.i LP64 false +Arrays array-fpi/ss1f.c ILP32 false +Loops nla-digbench-scaling/fermat1-ll_unwindbound20.c ILP32 false +ProductLines product-lines/email_spec27_product24.cil.c ILP32 false +Sequentialized seq-mthreaded/pals_opt-floodmax.3.1.ufo.UNBOUNDED.pals.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.gear.2.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_key_config__unconstrained__cover_exit_unsuccess_havoc_object.i LP64 false +Arrays array-fpi/ss3f.c ILP32 false +Loops nla-digbench-scaling/fermat2-ll_unwindbound1.c ILP32 false +ProductLines product-lines/email_spec27_product29.cil.c ILP32 false +Sequentialized seq-mthreaded/pals_opt-floodmax.3.2.ufo.UNBOUNDED.pals.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.h_FIFO.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_key_freeid__invalid_input_tdr_hkid__cover_proof_havoc_memory.i LP64 false +Arrays array-fpi/ssinaf.c ILP32 false +Loops nla-digbench-scaling/fermat2-ll_unwindbound100.c ILP32 false +ProductLines product-lines/email_spec27_product32.cil.c ILP32 false +Sequentialized seq-mthreaded/pals_opt-floodmax.3.3.ufo.UNBOUNDED.pals.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.iprotocol.1.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_key_freeid__invalid_state_tdr_lifecycle__cover_exit_havoc_memory.i LP64 false +Arrays array-industry-pattern/check_removal_from_set_after_insertion.c ILP32 false +Loops nla-digbench-scaling/fermat2-ll_unwindbound20.c ILP32 false +ProductLines product-lines/email_spec27_product35.cil.c ILP32 false +Sequentialized seq-mthreaded/pals_opt-floodmax.3_overflow.ufo.UNBOUNDED.pals.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.iprotocol.4.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_key_freeid__unconstrained__cover_exit_unsuccess_havoc_object.i LP64 false +Arrays array-tiling/mlceu.c ILP32 false +Loops nla-digbench-scaling/fermat2-ll_unwindbound50.c ILP32 false +ProductLines product-lines/email_spec3_product13.cil.c ILP32 false +Sequentialized seq-mthreaded/pals_opt-floodmax.4.2.ufo.BOUNDED-8.pals.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.krebs.1.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_vpflushdone__expected__cover_exit_havoc_object.i LP64 false +Arrays reducercommutativity/rangesum05.i ILP32 false +Loops nla-digbench-scaling/freire2_valuebound10.c ILP32 false +ProductLines product-lines/email_spec3_product19.cil.c ILP32 false +Sequentialized seq-mthreaded/pals_opt-floodmax.4.3.ufo.UNBOUNDED.pals.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.lamport.3.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_vpflushdone__invalid_state_op_state__cover_entry_havoc_object.i LP64 false +Arrays reducercommutativity/rangesum20.i ILP32 false +Loops nla-digbench-scaling/freire2_valuebound2.c ILP32 false +ProductLines product-lines/email_spec3_product24.cil.c ILP32 false +Sequentialized seq-mthreaded/pals_opt-floodmax.4.4.ufo.UNBOUNDED.pals.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.lann.1.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_vpflushdone__invalid_state_tdr_lifecycle__cover_proof_havoc_object.i LP64 false +Arrays reducercommutativity/rangesum60.i ILP32 false +Loops nla-digbench-scaling/freire2_valuebound5.c ILP32 false +ProductLines product-lines/email_spec3_product28.cil.c ILP32 false +Sequentialized seq-mthreaded/pals_opt-floodmax.5.1.ufo.BOUNDED-10.pals.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.lann.7.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_vpflushdone__unexpected__cover_exit_havoc_memory.i LP64 false +Loops nla-digbench-scaling/hard2_unwindbound1.c ILP32 false +ProductLines product-lines/email_spec3_product30.cil.c ILP32 false +Sequentialized seq-mthreaded/pals_opt-floodmax.5.2.ufo.UNBOUNDED.pals.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.leader_election.6.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mr_finalize__invalid_input_hkid__cover_entry_havoc_memory.i LP64 false +Loops nla-digbench-scaling/hard2_unwindbound2.c ILP32 false +ProductLines product-lines/email_spec3_product33.cil.c ILP32 false +Sequentialized seq-mthreaded/pals_opt-floodmax.5.3.ufo.UNBOUNDED.pals.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.lifts.8.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mr_finalize__invalid_state_lifecycle__cover_proof_havoc_memory.i LP64 false +Loops nla-digbench-scaling/mannadiv_unwindbound1.c ILP32 false +ProductLines product-lines/email_spec3_productSimulator.cil.c ILP32 false +Sequentialized seq-mthreaded/pals_opt-floodmax.5.4.ufo.UNBOUNDED.pals.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.mul11.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mr_finalize__invalid_state_td_state__cover_exit_havoc_memory.i LP64 false +Loops nla-digbench-scaling/mannadiv_unwindbound100.c ILP32 false +ProductLines product-lines/email_spec4_product23.cil.c ILP32 false +Sequentialized seq-pthread/cs_fib_longer-2.i ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.needham.1.prop2-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mr_finalize__unconstrained__cover_exit_success_havoc_object.i LP64 false +Loops nla-digbench-scaling/mannadiv_unwindbound20.c ILP32 false +ProductLines product-lines/email_spec4_product25.cil.c ILP32 false +Sequentialized seq-pthread/cs_read_write_lock-2.i ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.needham.2.prop4-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_phymem_page_reclaim__expected__cover_entry_havoc_object.i LP64 false +Loops nla-digbench-scaling/mannadiv_unwindbound50.c ILP32 false +ProductLines product-lines/email_spec4_product31.cil.c ILP32 false +Sequentialized seq-pthread/cs_stateful-1.i ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.needham.4.prop4-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_phymem_page_reclaim__invalid_input_pa__cover_proof_havoc_object.i LP64 false +Loops nla-digbench-scaling/prod4br-ll_unwindbound10.c ILP32 false +ProductLines product-lines/email_spec4_product33.cil.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.peg_solitaire.3.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_phymem_page_reclaim__invalid_state_lifecycle__cover_exit_havoc_object.i LP64 false +Loops nla-digbench-scaling/prod4br-ll_unwindbound2.c ILP32 false +ProductLines product-lines/email_spec4_productSimulator.cil.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.peterson.3.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_phymem_page_reclaim__unconstrained__cover_exit_unsuccess_havoc_memory.i LP64 false +Loops nla-digbench-scaling/prod4br-ll_unwindbound50.c ILP32 false +ProductLines product-lines/email_spec6_product14.cil.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.pgm_protocol.3.prop5-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_config__expected__cover_exit_havoc_memory.i LP64 false +Loops nla-digbench-scaling/prodbin-ll_unwindbound10.c ILP32 false +ProductLines product-lines/email_spec6_product20.cil.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.pouring.1.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_config__invalid_input_num_ptr__cover_entry_havoc_object.i LP64 false +Loops nla-digbench-scaling/prodbin-ll_unwindbound20.c ILP32 false +ProductLines product-lines/email_spec6_product26.cil.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.production_cell.3.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_config__invalid_state_lp_state__cover_proof_havoc_object.i LP64 false +Loops nla-digbench-scaling/ps4-ll_unwindbound1.c ILP32 false +ProductLines product-lines/email_spec6_product30.cil.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.production_cell.6.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_config__invalid_state_tdmr_info__cover_proof_havoc_memory.i LP64 false +Loops nla-digbench-scaling/ps4-ll_unwindbound100.c ILP32 false +ProductLines product-lines/email_spec6_product32.cil.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.protocols.4.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_init__expected__cover_entry_havoc_memory.i LP64 false +Loops nla-digbench-scaling/ps4-ll_unwindbound20.c ILP32 false +ProductLines product-lines/email_spec6_product35.cil.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.resistance.2.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_init__invalid_input_rcx__cover_proof_havoc_memory.i LP64 false +Loops nla-digbench-scaling/ps4-ll_unwindbound50.c ILP32 false +ProductLines product-lines/email_spec7_product28.cil.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.rushhour.2.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_init__unexpected__cover_entry_havoc_memory.i LP64 false +Loops nla-digbench-scaling/ps5-ll_unwindbound10.c ILP32 false +ProductLines product-lines/email_spec7_product31.cil.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.schedule_world.3.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_key_config__expected__cover_proof_havoc_object.i LP64 false +Loops nla-digbench-scaling/ps5-ll_unwindbound2.c ILP32 false +ProductLines product-lines/email_spec7_product33.cil.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.shift_register_top_w16_d32_e0.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_key_config__unexpected__cover_entry_havoc_object.i LP64 false +Loops nla-digbench-scaling/ps5-ll_unwindbound5.c ILP32 false +ProductLines product-lines/email_spec7_productSimulator.cil.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.shift_register_top_w64_d128_e0.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_shutdown__expected__cover_proof_havoc_object.i LP64 false +Loops nla-digbench-scaling/ps6-ll_unwindbound1.c ILP32 false +ProductLines product-lines/email_spec8_product20.cil.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.shift_register_top_w8_d64_e0.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_shutdown__invalid_input_handoff_range__cover_exit_havoc_object.i LP64 false +Loops nla-digbench-scaling/ps6-ll_unwindbound100.c ILP32 false +ProductLines product-lines/email_spec8_product26.cil.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.sw_sym_ex_v.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_update__expected__cover_entry_havoc_memory.i LP64 false +Loops nla-digbench-scaling/ps6-ll_unwindbound20.c ILP32 false +ProductLines product-lines/email_spec8_product31.cil.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.szymanski.4.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_update__invalid_state_handoff_data__cover_proof_havoc_memory.i LP64 false +Loops nla-digbench-scaling/ps6-ll_unwindbound50.c ILP32 false +ProductLines product-lines/email_spec8_product34.cil.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.telephony.7.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_update__invalid_state_lp_state__cover_exit_havoc_memory.i LP64 false +Loops verifythis/tree_del_iter_incorrect.c ILP32 false +ProductLines product-lines/email_spec9_product15.cil.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.train-gate.5.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_update__unconstrained__cover_exit_unsuccess_havoc_memory.i LP64 false +ProductLines product-lines/email_spec9_product21.cil.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.unsafe_intersymbol_analog_estimation_convergence.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_vp_enter__invalid_input_vcpu_handle__cover_entry_havoc_object.i LP64 false +ProductLines product-lines/email_spec9_product26.cil.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.vis_QF_BV_fru32_p1.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_vp_enter__invalid_state_lifecycle__cover_proof_havoc_object.i LP64 false +ProductLines product-lines/email_spec9_product32.cil.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.vis_arrays_am2901.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_vp_enter__invalid_state_pamt_metadata__cover_proof_havoc_memory.i LP64 false +ProductLines product-lines/email_spec9_product35.cil.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.vis_arrays_vsa16a_p6.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_vp_enter__unexpected__cover_entry_havoc_memory.i LP64 false +ProductLines product-lines/elevator_spec14_product32.cil.c ILP32 false +Hardware hardware-verification-array/btor2c-lazyMod.unsafe_arbitrated_fifos_n2d8w8.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_mr_report__expected__cover_entry_havoc_object.i LP64 false +ProductLines product-lines/elevator_spec1_product24.cil.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.adding.1.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_mr_report__unconstrained__cover_exit_success_havoc_memory.i LP64 false +ProductLines product-lines/elevator_spec1_productSimulator.cil.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.adding.3.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_mr_report__unexpected__cover_entry_havoc_object.i LP64 false +ProductLines product-lines/elevator_spec2_product22.cil.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.adding.5.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_servtd_wr__expected__cover_entry_havoc_memory.i LP64 false +ProductLines product-lines/elevator_spec2_product28.cil.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.anderson.1.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_servtd_wr__expected__cover_proof_havoc_object.i LP64 false +ProductLines product-lines/elevator_spec3_product11.cil.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.anderson.5.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_servtd_wr__unexpected__cover_entry_havoc_memory.i LP64 false +ProductLines product-lines/elevator_spec3_product27.cil.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.arbitrated_top_n2_w16_d16_e0.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_servtd_wr__unexpected__cover_proof_havoc_object.i LP64 false +ProductLines product-lines/elevator_spec9_product26.cil.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.arbitrated_top_n2_w32_d128_e0.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_sys_rd__expected__cover_proof_havoc_object.i LP64 false +ProductLines product-lines/elevator_spec9_product32.cil.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.arbitrated_top_n2_w32_d64_e0.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_sys_rd__unexpected__cover_entry_havoc_memory.i LP64 false +ProductLines product-lines/email_spec0_product21.cil.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.arbitrated_top_n2_w64_d32_e0.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_sys_rd__unexpected__cover_proof_havoc_object.i LP64 false +ProductLines product-lines/email_spec0_product34.cil.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.arbitrated_top_n2_w8_d16_e0.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_vm_wr__expected__cover_proof_havoc_memory.i LP64 false +ProductLines product-lines/email_spec11_product22.cil.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.arbitrated_top_n3_w16_d128_e0.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_vm_wr__invalid_input_field_id__cover_exit_havoc_object.i LP64 false +ProductLines product-lines/email_spec11_product35.cil.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.arbitrated_top_n3_w16_d8_e0.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_vm_wr__invalid_input_rcx__cover_exit_havoc_memory.i LP64 false +ProductLines product-lines/email_spec1_product15.cil.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.arbitrated_top_n3_w32_d64_e0.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_vm_wr__unconstrained__cover_exit_success_havoc_object.i LP64 false +ProductLines product-lines/email_spec1_product21.cil.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.arbitrated_top_n3_w8_d32_e0.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_vm_wr__unexpected__cover_exit_havoc_memory.i LP64 false +ProductLines product-lines/email_spec1_product31.cil.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.arbitrated_top_n4_w16_d16_e0.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_vp_enter__expected__cover_exit_havoc_memory.i LP64 false +ProductLines product-lines/email_spec1_product34.cil.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.arbitrated_top_n4_w16_d8_e0.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_vp_enter__invalid_input_gpa__cover_entry_havoc_object.i LP64 false +ProductLines product-lines/email_spec27_product17.cil.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.arbitrated_top_n4_w32_d64_e0.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_vp_enter__invalid_input_vmflag__cover_entry_havoc_memory.i LP64 false +ProductLines product-lines/email_spec27_product25.cil.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.arbitrated_top_n4_w8_d32_e0.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_vp_enter__invalid_input_vmflag__cover_proof_havoc_object.i LP64 false +ProductLines product-lines/email_spec27_product30.cil.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.arbitrated_top_n5_w16_d16_e0.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_vp_enter__unexpected__cover_entry_havoc_memory.i LP64 false +ProductLines product-lines/email_spec27_product33.cil.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.arbitrated_top_n5_w8_d128_e0.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_vp_enter__unexpected__cover_proof_havoc_object.i LP64 false +ProductLines product-lines/email_spec3_product17.cil.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.arbitrated_top_n5_w8_d8_e0.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_vp_vmcall__invalid_input_bitmap__cover_exit_havoc_memory.i LP64 false +ProductLines product-lines/email_spec3_product25.cil.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.at.3.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_vp_vmcall__unconstrained__cover_exit_unsuccess_havoc_object.i LP64 false +ProductLines product-lines/email_spec3_product31.cil.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.bakery.2.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_vp_vmcall__unexpected__cover_proof_havoc_object.i LP64 false +ProductLines product-lines/email_spec3_product34.cil.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.bakery.6.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_export_restore__expected__cover_proof_havoc_memory.i LP64 false +ProductLines product-lines/email_spec4_product18.cil.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.blocks.4.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_export_restore__unconstrained__cover_exit_unsuccess_havoc_object.i LP64 false +ProductLines product-lines/email_spec4_product27.cil.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.bridge.2.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_export_restore__unexpected__cover_proof_havoc_memory.i LP64 false +ProductLines product-lines/email_spec4_product34.cil.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.brp.2.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_import_abort__expected__cover_exit_havoc_object.i LP64 false +ProductLines product-lines/email_spec6_product15.cil.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.brp.4.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_import_abort__unexpected__cover_entry_havoc_memory.i LP64 false +ProductLines product-lines/email_spec6_product21.cil.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.brp.6.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_import_abort__unexpected__cover_proof_havoc_object.i LP64 false +ProductLines product-lines/email_spec6_product28.cil.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.brp2.2.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_addcx__expected__cover_proof_havoc_memory.i LP64 false +ProductLines product-lines/email_spec6_product33.cil.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.brp2.3.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_addcx__invalid_input_tdcx_pa__cover_proof_havoc_memory.i LP64 false +ProductLines product-lines/email_spec7_product29.cil.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.brp2.4.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_addcx__invalid_input_tdr_pa__cover_exit_havoc_object.i LP64 false +ProductLines product-lines/email_spec7_product34.cil.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.brp2.6.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_addcx__invalid_state_lifecycle__cover_exit_havoc_memory.i LP64 false +ProductLines product-lines/email_spec8_product15.cil.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.cambridge.6.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_addcx__invalid_state_pamt_metadata__cover_entry_havoc_object.i LP64 false +ProductLines product-lines/email_spec8_product21.cil.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.circular_pointer_top_w128_d128_e0.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_addcx__invalid_state_td_state__cover_entry_havoc_memory.i LP64 false +ProductLines product-lines/email_spec8_product32.cil.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.circular_pointer_top_w128_d8_e0.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_addcx__invalid_state_td_state__cover_proof_havoc_object.i LP64 false +ProductLines product-lines/email_spec8_product35.cil.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.circular_pointer_top_w16_d64_e0.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_addcx__unexpected__cover_entry_havoc_memory.i LP64 false +ProductLines product-lines/email_spec9_product16.cil.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.circular_pointer_top_w32_d32_e0.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_addcx__unexpected__cover_proof_havoc_object.i LP64 false +ProductLines product-lines/email_spec9_product30.cil.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.circular_pointer_top_w64_d16_e0.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_create__invalid_input_rcx__cover_proof_havoc_object.i LP64 false +ProductLines product-lines/email_spec9_product33.cil.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.circular_pointer_top_w64_d8_e0.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_create__invalid_input_rdx__cover_proof_havoc_memory.i LP64 false +ProductLines product-lines/email_spec9_productSimulator.cil.c ILP32 false +Hardware hardware-verification-bv/btor2c-lazyMod.circular_pointer_top_w8_d64_e0.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_create__invalid_state_kot_entry__cover_exit_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.collision.5.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_create__invalid_state_tdr_page__cover_exit_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.counter_v.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_create__unconstrained__cover_exit_unsuccess_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.cyclic_scheduler.4.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_create__unexpected__cover_proof_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.driving_phils.2.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_init__expected__cover_exit_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.driving_phils.4.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_init__invalid_input_tdr_pa__cover_exit_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.dyn_partition.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_init__invalid_state_lifecycle__cover_exit_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.elevator_planning.2.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_init__invalid_state_op_state__cover_entry_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.eq_sdp_v3.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_init__invalid_state_pamt_metadata__cover_entry_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.exit.4.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_init__invalid_state_pamt_metadata__cover_proof_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.factorial4even.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_init__invalid_state_td_state__cover_proof_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.firewire_tree.4.prop3-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_init__unconstrained__cover_exit_unsuccess_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.fischer.3.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_init__unexpected__cover_proof_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.fischer.7.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_key_config__invalid_input_tdr_hkid__cover_exit_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.frogs.2.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_key_config__invalid_state_td_state__cover_exit_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.frogs.4.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_key_config__invalid_state_tdr_lifecycle__cover_exit_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.gear.1.prop2-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_key_config__invalid_state_tdr_metadata__cover_entry_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.gear.1.prop4-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_key_config__unconstrained__cover_exit_success_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.gear.2.prop2-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_key_config__unexpected__cover_exit_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.gear.2.prop4-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_key_freeid__invalid_input_tdr_hkid__cover_entry_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.hanoi.1.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_key_freeid__invalid_state_kot__cover_entry_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.hanoi.3.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_key_freeid__invalid_state_kot__cover_proof_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.iprotocol.2.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_key_freeid__invalid_state_tdr_lifecycle__cover_proof_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.iprotocol.3.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_key_freeid__invalid_state_tdr_metadata__cover_proof_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.iprotocol.5.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_key_freeid__unexpected__cover_entry_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.iprotocol.7.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_vpflushdone__expected__cover_entry_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.krebs.2.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_vpflushdone__expected__cover_proof_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.lamport.2.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_vpflushdone__invalid_input_tdr_hkid__cover_proof_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.lamport.6.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_vpflushdone__invalid_state_op_state__cover_exit_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.lamport_nonatomic.3.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_vpflushdone__invalid_state_tdr_lifecycle__cover_exit_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.lann.3.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_vpflushdone__invalid_state_tdr_metadata__cover_exit_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.lann.6.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_vpflushdone__unconstrained__cover_exit_unsuccess_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.lann.8.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_vpflushdone__unexpected__cover_proof_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.leader_election.5.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mr_finalize__expected__cover_exit_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.leader_filters.2.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mr_finalize__invalid_input_hkid__cover_exit_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.lifts.5.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mr_finalize__invalid_state_lifecycle__cover_entry_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.loyd.1.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mr_finalize__invalid_state_op_state__cover_entry_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.msmie.2.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mr_finalize__invalid_state_op_state__cover_proof_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.mul6.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mr_finalize__invalid_state_td_state__cover_proof_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.needham.1.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mr_finalize__invalid_state_tdr_metadata__cover_proof_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.needham.1.prop3-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mr_finalize__unconstrained__cover_exit_unsuccess_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.needham.2.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mr_finalize__unexpected__cover_proof_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.needham.3.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_phymem_page_reclaim__expected__cover_exit_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.needham.4.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_phymem_page_reclaim__invalid_input_pa__cover_exit_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.noninitstate.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_phymem_page_reclaim__invalid_state_child_count__cover_entry_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.peg_solitaire.2.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_phymem_page_reclaim__invalid_state_lifecycle__cover_entry_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.peg_solitaire.5.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_phymem_page_reclaim__invalid_state_pamt_metadata__cover_entry_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.peterson.2.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_phymem_page_reclaim__invalid_state_pamt_metadata__cover_proof_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.peterson.5.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_phymem_page_reclaim__unexpected__cover_entry_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.pgm_protocol.1.prop5-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_phymem_page_reclaim__unexpected__cover_proof_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.pgm_protocol.5.prop5-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_config__expected__cover_proof_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.pgm_protocol.8.prop5-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_config__invalid_input_hkid__cover_proof_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.pouring.2.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_config__invalid_input_num_ptr__cover_exit_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.production_cell.2.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_config__invalid_state_lp_state__cover_exit_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.production_cell.4.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_config__invalid_state_sys_state__cover_exit_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.production_cell.5.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_config__invalid_state_tdmr_info__cover_entry_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.protocols.1.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_config__unconstrained__cover_exit_unsuccess_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.protocols.3.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_config__unexpected__cover_exit_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.protocols.5.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_init__expected__cover_exit_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.reader_writer.3.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_init__invalid_input_rcx__cover_entry_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.rether.4.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_init__invalid_state_sys_state__cover_entry_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.rushhour.1.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_init__invalid_state_sys_state__cover_proof_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.schedule_world.1.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_init__unexpected__cover_exit_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.schedule_world.2.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_key_config__expected__cover_exit_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.shift_register_top_w128_d16_e0.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_key_config__invalid_state_sys_state__cover_entry_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.shift_register_top_w16_d128_e0.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_key_config__unconstrained__cover_exit_unsuccess_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.shift_register_top_w16_d8_e0.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_key_config__unexpected__cover_exit_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.shift_register_top_w32_d64_e0.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_shutdown__expected__cover_exit_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.shift_register_top_w64_d32_e0.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_shutdown__invalid_input_handoff_no_downgrade__cover_entry_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.shift_register_top_w8_d16_e0.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_shutdown__invalid_input_handoff_range__cover_entry_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.sokoban.1.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_shutdown__unconstrained__cover_exit_unsuccess_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.sokoban.2.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_shutdown__unexpected__cover_exit_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.synapse.1.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_update__expected__cover_exit_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.szymanski.2.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_update__invalid_state_handoff_data__cover_entry_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.telephony.1.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_update__invalid_state_handoff_version__cover_entry_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.telephony.6.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_update__invalid_state_handoff_version__cover_proof_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.telephony.8.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_update__invalid_state_lp_state__cover_proof_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.train-gate.3.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_update__invalid_state_sys_state__cover_exit_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.twocount2.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_update__unexpected__cover_entry_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.unsafe_analog_estimation_convergence.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_vp_enter__expected__cover_entry_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.v_DAIO.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_vp_enter__invalid_input_vcpu_handle__cover_exit_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.vcegar_QF_BV_usb_phy_1.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_vp_enter__invalid_state_lifecycle__cover_exit_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.vis_QF_BV_fru32_p3.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_vp_enter__invalid_state_op_state__cover_exit_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.vis_QF_BV_vMiim_p2.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_vp_enter__invalid_state_pamt_metadata__cover_entry_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.vis_arrays_bpbs_p2.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_vp_enter__invalid_state_td_state__cover_entry_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.vis_arrays_palu.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_vp_enter__invalid_state_td_state__cover_proof_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.vis_arrays_vsa16a_p8.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_vp_enter__unexpected__cover_exit_havoc_object.i LP64 false +Hardware hardware-verification-array/btor2c-lazyMod.unsafe_linked_list_fifo_n2d4.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_mr_report__expected__cover_entry_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.adding.1.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_mr_report__expected__cover_exit_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.adding.2.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_mr_report__expected__cover_proof_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.adding.3.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_mr_report__unconstrained__cover_exit_success_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.adding.4.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_mr_report__unexpected__cover_entry_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.adding.5.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_mr_report__unexpected__cover_exit_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.adding.6.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_mr_report__unexpected__cover_proof_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.anderson.1.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_servtd_wr__expected__cover_entry_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.anderson.3.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_servtd_wr__expected__cover_proof_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.anderson.5.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_servtd_wr__unconstrained__cover_exit_success_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.anderson.7.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_servtd_wr__unconstrained__cover_exit_unsuccess_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.arbitrated_top_n2_w16_d128_e0.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_servtd_wr__unexpected__cover_entry_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.arbitrated_top_n2_w16_d32_e0.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_servtd_wr__unexpected__cover_proof_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.arbitrated_top_n2_w16_d8_e0.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_sys_rd__expected__cover_entry_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.arbitrated_top_n2_w32_d16_e0.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_sys_rd__expected__cover_exit_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.arbitrated_top_n2_w32_d8_e0.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_sys_rd__unconstrained__cover_exit_success_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.arbitrated_top_n2_w64_d16_e0.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_sys_rd__unconstrained__cover_exit_unsuccess_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.arbitrated_top_n2_w64_d64_e0.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_sys_rd__unexpected__cover_entry_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.arbitrated_top_n2_w8_d128_e0.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_sys_rd__unexpected__cover_proof_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.arbitrated_top_n2_w8_d32_e0.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_vm_wr__expected__cover_entry_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.arbitrated_top_n2_w8_d8_e0.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_vm_wr__expected__cover_exit_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.arbitrated_top_n3_w16_d16_e0.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_vm_wr__expected__cover_proof_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.arbitrated_top_n3_w16_d64_e0.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_vm_wr__invalid_input_field_id__cover_exit_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.arbitrated_top_n3_w32_d128_e0.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_vm_wr__invalid_input_field_id__cover_proof_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.arbitrated_top_n3_w32_d32_e0.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_vm_wr__invalid_input_rcx__cover_entry_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.arbitrated_top_n3_w32_d8_e0.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_vm_wr__invalid_input_rcx__cover_exit_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.arbitrated_top_n3_w8_d16_e0.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_vm_wr__unconstrained__cover_exit_success_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.arbitrated_top_n3_w8_d64_e0.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_vm_wr__unconstrained__cover_exit_unsuccess_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.arbitrated_top_n4_w16_d128_e0.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_vm_wr__unexpected__cover_entry_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.arbitrated_top_n4_w16_d32_e0.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_vm_wr__unexpected__cover_exit_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.arbitrated_top_n4_w32_d128_e0.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_vp_enter__expected__cover_entry_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.arbitrated_top_n4_w32_d32_e0.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_vp_enter__expected__cover_exit_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.arbitrated_top_n4_w32_d8_e0.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_vp_enter__invalid_input_gpa__cover_entry_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.arbitrated_top_n4_w8_d16_e0.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_vp_enter__invalid_input_gpa__cover_exit_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.arbitrated_top_n4_w8_d64_e0.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_vp_enter__invalid_input_gpa__cover_proof_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.arbitrated_top_n5_w16_d128_e0.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_vp_enter__invalid_input_vmflag__cover_entry_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.arbitrated_top_n5_w16_d32_e0.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_vp_enter__invalid_input_vmflag__cover_proof_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.arbitrated_top_n5_w16_d8_e0.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_vp_enter__unconstrained__cover_exit_success_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.arbitrated_top_n5_w8_d16_e0.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_vp_enter__unconstrained__cover_exit_unsuccess_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.arbitrated_top_n5_w8_d64_e0.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_vp_enter__unexpected__cover_entry_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.at.2.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_vp_enter__unexpected__cover_proof_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.at.3.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_vp_vmcall__expected__cover_entry_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.at.6.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_vp_vmcall__invalid_input_bitmap__cover_entry_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.bakery.2.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_vp_vmcall__invalid_input_bitmap__cover_exit_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.bakery.4.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_vp_vmcall__unconstrained__cover_exit_unsuccess_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.bakery.6.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_vp_vmcall__unexpected__cover_entry_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.blocks.3.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_vp_vmcall__unexpected__cover_exit_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.blocks.4.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_export_restore__expected__cover_entry_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.bridge.1.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_export_restore__expected__cover_exit_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.bridge.2.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_export_restore__expected__cover_proof_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.bridge.3.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_export_restore__unconstrained__cover_exit_unsuccess_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.brp.2.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_export_restore__unexpected__cover_entry_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.brp.3.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_export_restore__unexpected__cover_exit_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.brp.4.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_export_restore__unexpected__cover_proof_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.brp.5.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_import_abort__expected__cover_exit_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.brp.6.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_import_abort__expected__cover_proof_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.brp2.1.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_import_abort__unconstrained__cover_exit_unsuccess_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.brp2.2.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_import_abort__unexpected__cover_entry_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.brp2.2.prop3-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_import_abort__unexpected__cover_proof_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.brp2.3.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_addcx__expected__cover_entry_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.brp2.5.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_addcx__expected__cover_exit_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.brp2.6.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_addcx__expected__cover_proof_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.cambridge.2.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_addcx__invalid_input_tdcx_pa__cover_exit_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.cambridge.6.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_addcx__invalid_input_tdcx_pa__cover_proof_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.cambridge.7.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_addcx__invalid_input_tdr_pa__cover_exit_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.cav14_example_v.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_addcx__invalid_input_tdr_pa__cover_proof_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.circular_pointer_top_w128_d16_e0.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_addcx__invalid_state_lifecycle__cover_entry_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.circular_pointer_top_w128_d64_e0.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_addcx__invalid_state_lifecycle__cover_exit_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.circular_pointer_top_w16_d128_e0.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_addcx__invalid_state_pamt_metadata__cover_entry_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.circular_pointer_top_w16_d32_e0.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_addcx__invalid_state_pamt_metadata__cover_exit_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.circular_pointer_top_w16_d8_e0.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_addcx__invalid_state_pamt_metadata__cover_proof_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.circular_pointer_top_w32_d16_e0.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_addcx__invalid_state_td_state__cover_entry_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.circular_pointer_top_w32_d64_e0.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_addcx__invalid_state_td_state__cover_proof_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.circular_pointer_top_w64_d128_e0.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_addcx__unconstrained__cover_exit_success_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.circular_pointer_top_w64_d32_e0.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_addcx__unconstrained__cover_exit_unsuccess_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.circular_pointer_top_w8_d128_e0.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_addcx__unexpected__cover_entry_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.circular_pointer_top_w8_d32_e0.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_addcx__unexpected__cover_proof_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.circular_pointer_top_w8_d8_e0.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_create__invalid_input_rcx__cover_entry_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.collision.2.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_create__invalid_input_rcx__cover_exit_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.collision.5.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_create__invalid_input_rdx__cover_entry_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.count4.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_create__invalid_input_rdx__cover_exit_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.cyclic_scheduler.2.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_create__invalid_input_rdx__cover_proof_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.cyclic_scheduler.4.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_create__invalid_state_kot_entry__cover_exit_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.diagonal_v.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_create__invalid_state_kot_entry__cover_proof_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.driving_phils.1.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_create__invalid_state_tdr_page__cover_entry_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.driving_phils.2.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_create__invalid_state_tdr_page__cover_exit_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.driving_phils.3.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_create__unconstrained__cover_exit_unsuccess_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.driving_phils.4.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_create__unexpected__cover_entry_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.driving_phils.5.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_create__unexpected__cover_exit_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.elevator_planning.1.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_create__unexpected__cover_proof_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.elevator_planning.2.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_init__expected__cover_exit_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.elevator_planning.3.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_init__expected__cover_proof_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.eq_sdp_v5.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_init__invalid_input_tdr_pa__cover_entry_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.ethernet.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_init__invalid_input_tdr_pa__cover_exit_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.exit.4.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_init__invalid_state_lifecycle__cover_entry_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.extinction.3.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_init__invalid_state_lifecycle__cover_exit_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.firewire_tree.2.prop3-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_init__invalid_state_op_state__cover_entry_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.firewire_tree.4.prop3-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_init__invalid_state_op_state__cover_exit_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.fischer.2.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_init__invalid_state_op_state__cover_proof_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.fischer.3.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_init__invalid_state_pamt_metadata__cover_entry_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.fischer.5.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_init__invalid_state_pamt_metadata__cover_proof_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.fischer.7.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_init__invalid_state_td_state__cover_entry_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.frogs.1.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_init__invalid_state_td_state__cover_exit_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.frogs.2.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_init__invalid_state_td_state__cover_proof_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.frogs.3.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_init__unconstrained__cover_exit_unsuccess_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.frogs.4.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_init__unexpected__cover_entry_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.gear.1.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_init__unexpected__cover_exit_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.gear.1.prop2-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_init__unexpected__cover_proof_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.gear.1.prop3-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_key_config__invalid_input_tdr_hkid__cover_exit_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.gear.1.prop4-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_key_config__invalid_input_tdr_hkid__cover_proof_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.gear.2.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_key_config__invalid_state_td_state__cover_entry_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.gear.2.prop2-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_key_config__invalid_state_td_state__cover_proof_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.gear.2.prop3-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_key_config__invalid_state_tdr_lifecycle__cover_entry_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.gear.2.prop4-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_key_config__invalid_state_tdr_lifecycle__cover_exit_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.h_CRC.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_key_config__invalid_state_tdr_metadata__cover_entry_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.h_b05.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_key_config__invalid_state_tdr_metadata__cover_exit_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.hanoi.1.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_key_config__invalid_state_tdr_metadata__cover_proof_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.hanoi.2.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_key_config__unconstrained__cover_exit_success_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.hanoi.3.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_key_config__unexpected__cover_entry_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.iprotocol.1.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_key_config__unexpected__cover_exit_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.iprotocol.2.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_key_freeid__invalid_input_tdr_hkid__cover_entry_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.iprotocol.4.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_key_freeid__invalid_input_tdr_hkid__cover_exit_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.iprotocol.5.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_key_freeid__invalid_input_tdr_hkid__cover_proof_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.iprotocol.6.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_key_freeid__invalid_state_kot__cover_entry_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.iprotocol.7.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_key_freeid__invalid_state_kot__cover_proof_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.itc99_b12.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_key_freeid__invalid_state_tdr_lifecycle__cover_entry_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.krebs.1.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_key_freeid__invalid_state_tdr_lifecycle__cover_exit_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.krebs.2.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_key_freeid__invalid_state_tdr_metadata__cover_entry_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.krebs.3.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_key_freeid__invalid_state_tdr_metadata__cover_exit_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.lamport.2.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_key_freeid__invalid_state_tdr_metadata__cover_proof_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.lamport.3.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_key_freeid__unexpected__cover_entry_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.lamport.6.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_key_freeid__unexpected__cover_exit_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.lamport.8.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_key_freeid__unexpected__cover_proof_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.lamport_nonatomic.3.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_vpflushdone__expected__cover_entry_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.lann.1.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_vpflushdone__expected__cover_proof_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.lann.3.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_vpflushdone__invalid_input_tdr_hkid__cover_entry_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.lann.7.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_vpflushdone__invalid_input_tdr_hkid__cover_exit_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.lann.8.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_vpflushdone__invalid_input_tdr_hkid__cover_proof_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.leader_election.4.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_vpflushdone__invalid_state_op_state__cover_exit_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.leader_election.5.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_vpflushdone__invalid_state_op_state__cover_proof_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.leader_election.6.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_vpflushdone__invalid_state_tdr_lifecycle__cover_entry_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.leader_filters.2.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_vpflushdone__invalid_state_tdr_lifecycle__cover_exit_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.leader_filters.6.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_vpflushdone__invalid_state_tdr_metadata__cover_entry_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.lifts.5.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_vpflushdone__invalid_state_tdr_metadata__cover_exit_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.lifts.8.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_vpflushdone__unconstrained__cover_exit_unsuccess_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.loyd.1.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_vpflushdone__unexpected__cover_entry_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.loyd.2.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_vpflushdone__unexpected__cover_exit_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.msmie.2.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_vpflushdone__unexpected__cover_proof_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.mul10.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mr_finalize__expected__cover_exit_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.mul5.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mr_finalize__expected__cover_proof_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.mul8.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mr_finalize__invalid_input_hkid__cover_entry_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.needham.1.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mr_finalize__invalid_input_hkid__cover_exit_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.needham.1.prop2-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mr_finalize__invalid_state_lifecycle__cover_entry_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.needham.1.prop3-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mr_finalize__invalid_state_lifecycle__cover_exit_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.needham.1.prop4-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mr_finalize__invalid_state_lifecycle__cover_proof_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.needham.2.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mr_finalize__invalid_state_op_state__cover_entry_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.needham.2.prop4-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mr_finalize__invalid_state_op_state__cover_proof_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.needham.3.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mr_finalize__invalid_state_td_state__cover_entry_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.needham.3.prop4-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mr_finalize__invalid_state_td_state__cover_exit_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.needham.4.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mr_finalize__invalid_state_tdr_metadata__cover_entry_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.needham.4.prop4-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mr_finalize__invalid_state_tdr_metadata__cover_exit_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.peg_solitaire.1.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mr_finalize__invalid_state_tdr_metadata__cover_proof_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.peg_solitaire.2.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mr_finalize__unconstrained__cover_exit_unsuccess_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.peg_solitaire.3.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mr_finalize__unexpected__cover_entry_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.peg_solitaire.5.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mr_finalize__unexpected__cover_exit_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.peg_solitaire.6.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mr_finalize__unexpected__cover_proof_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.peterson.2.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_phymem_page_reclaim__expected__cover_exit_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.peterson.3.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_phymem_page_reclaim__expected__cover_proof_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.peterson.5.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_phymem_page_reclaim__invalid_input_pa__cover_entry_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.peterson.6.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_phymem_page_reclaim__invalid_input_pa__cover_exit_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.pgm_protocol.1.prop5-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_phymem_page_reclaim__invalid_state_child_count__cover_entry_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.pgm_protocol.3.prop5-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_phymem_page_reclaim__invalid_state_child_count__cover_exit_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.pgm_protocol.5.prop5-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_phymem_page_reclaim__invalid_state_child_count__cover_proof_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.pgm_protocol.6.prop5-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_phymem_page_reclaim__invalid_state_lifecycle__cover_entry_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.pgm_protocol.8.prop5-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_phymem_page_reclaim__invalid_state_lifecycle__cover_proof_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.pouring.1.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_phymem_page_reclaim__invalid_state_pamt_metadata__cover_entry_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.pouring.2.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_phymem_page_reclaim__invalid_state_pamt_metadata__cover_proof_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.production_cell.1.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_phymem_page_reclaim__unconstrained__cover_exit_success_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.production_cell.2.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_phymem_page_reclaim__unconstrained__cover_exit_unsuccess_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.production_cell.3.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_phymem_page_reclaim__unexpected__cover_entry_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.production_cell.4.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_phymem_page_reclaim__unexpected__cover_proof_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.production_cell.6.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_config__expected__cover_entry_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.protocols.1.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_config__expected__cover_exit_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.protocols.2.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_config__invalid_input_hkid__cover_entry_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.protocols.3.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_config__invalid_input_hkid__cover_exit_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.protocols.4.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_config__invalid_input_hkid__cover_proof_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.protocols.5.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_config__invalid_input_num_ptr__cover_exit_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.reader_writer.1.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_config__invalid_input_num_ptr__cover_proof_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.reader_writer.3.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_config__invalid_state_lp_state__cover_entry_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.recount4.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_config__invalid_state_lp_state__cover_exit_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.resistance.2.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_config__invalid_state_sys_state__cover_entry_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.rether.4.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_config__invalid_state_sys_state__cover_exit_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.rether.6.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_config__invalid_state_tdmr_info__cover_entry_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.rushhour.1.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_config__invalid_state_tdmr_info__cover_exit_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.rushhour.2.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_config__invalid_state_tdmr_info__cover_proof_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.schedule_world.1.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_config__unconstrained__cover_exit_unsuccess_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.schedule_world.3.prop1-back-serstep.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_config__unexpected__cover_exit_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.shift_register_top_w128_d128_e0.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_config__unexpected__cover_proof_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.shift_register_top_w128_d32_e0.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_init__expected__cover_entry_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.shift_register_top_w128_d8_e0.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_init__expected__cover_exit_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.shift_register_top_w16_d16_e0.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_init__invalid_input_rcx__cover_entry_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.shift_register_top_w16_d64_e0.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_init__invalid_input_rcx__cover_exit_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.shift_register_top_w32_d128_e0.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_init__invalid_input_rcx__cover_proof_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.shift_register_top_w32_d32_e0.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_init__invalid_state_sys_state__cover_entry_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.shift_register_top_w32_d8_e0.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_init__invalid_state_sys_state__cover_proof_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.shift_register_top_w64_d16_e0.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_init__unconstrained__cover_exit_unsuccess_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.shift_register_top_w64_d64_e0.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_init__unexpected__cover_entry_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.shift_register_top_w8_d128_e0.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_init__unexpected__cover_proof_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.shift_register_top_w8_d32_e0.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_key_config__expected__cover_entry_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.shift_register_top_w8_d8_e0.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_key_config__expected__cover_exit_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.sokoban.1.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_key_config__invalid_state_sys_state__cover_entry_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.sw_loop_v.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_key_config__invalid_state_sys_state__cover_exit_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.synabs2.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_key_config__invalid_state_sys_state__cover_proof_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.synapse.1.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_key_config__unconstrained__cover_exit_unsuccess_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.synapse.5.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_key_config__unexpected__cover_exit_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.szymanski.2.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_key_config__unexpected__cover_proof_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.szymanski.4.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_shutdown__expected__cover_entry_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.telephony.1.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_shutdown__expected__cover_exit_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.telephony.3.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_shutdown__invalid_input_handoff_no_downgrade__cover_entry_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.telephony.6.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_shutdown__invalid_input_handoff_no_downgrade__cover_exit_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.telephony.7.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_shutdown__invalid_input_handoff_no_downgrade__cover_proof_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.telephony.8.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_shutdown__invalid_input_handoff_range__cover_entry_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.train-gate.1.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_shutdown__invalid_input_handoff_range__cover_proof_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.train-gate.3.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_shutdown__unconstrained__cover_exit_unsuccess_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.train-gate.5.prop1-func-interl.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_shutdown__unexpected__cover_exit_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.twocount2c.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_shutdown__unexpected__cover_proof_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.unknown_ridecore.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_update__expected__cover_entry_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.unsafe_buggy_ridecore.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_update__expected__cover_exit_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.usb_phy.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_update__invalid_state_handoff_data__cover_entry_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.v_FIFO.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_update__invalid_state_handoff_data__cover_exit_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.v_non-pipelined-microprocessor.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_update__invalid_state_handoff_data__cover_proof_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.vcegar_arrays_itc99_b12_p1.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_update__invalid_state_handoff_version__cover_entry_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.vis_QF_BV_fru32_p2.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_update__invalid_state_handoff_version__cover_proof_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.vis_QF_BV_rotate32.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_update__invalid_state_lp_state__cover_entry_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.vis_QF_BV_spinner32.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_update__invalid_state_lp_state__cover_exit_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.vis_arrays_FIFOs.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_update__invalid_state_lp_state__cover_proof_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.vis_arrays_bpbs_p1.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_update__invalid_state_sys_state__cover_exit_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.vis_arrays_bpbs_p3.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_update__invalid_state_sys_state__cover_proof_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.vis_arrays_buf_bug.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_update__unconstrained__cover_exit_unsuccess_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.vis_arrays_two_p1.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_update__unexpected__cover_exit_havoc_memory.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.vis_arrays_vsa16a_p7.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_update__unexpected__cover_proof_havoc_object.i LP64 false +Hardware hardware-verification-bv/btor2c-lazyMod.vis_arrays_vsaR_p01.c LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_vp_enter__expected__cover_entry_havoc_object.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_vp_enter__invalid_input_vcpu_handle__cover_exit_havoc_memory.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_vp_enter__invalid_input_vcpu_handle__cover_proof_havoc_memory.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_vp_enter__invalid_state_lifecycle__cover_entry_havoc_object.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_vp_enter__invalid_state_lifecycle__cover_exit_havoc_object.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_vp_enter__invalid_state_op_state__cover_entry_havoc_memory.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_vp_enter__invalid_state_op_state__cover_exit_havoc_object.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_vp_enter__invalid_state_pamt_metadata__cover_entry_havoc_memory.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_vp_enter__invalid_state_pamt_metadata__cover_exit_havoc_memory.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_vp_enter__invalid_state_pamt_metadata__cover_proof_havoc_object.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_vp_enter__invalid_state_td_state__cover_entry_havoc_object.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_vp_enter__invalid_state_td_state__cover_proof_havoc_memory.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_vp_enter__unconstrained__cover_exit_unsuccess_havoc_memory.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_vp_enter__unexpected__cover_entry_havoc_object.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_vp_enter__unexpected__cover_proof_havoc_memory.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_mr_report__expected__cover_exit_havoc_object.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_mr_report__unconstrained__cover_exit_unsuccess_havoc_memory.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_mr_report__unexpected__cover_exit_havoc_object.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_servtd_wr__expected__cover_exit_havoc_memory.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_servtd_wr__unconstrained__cover_exit_success_havoc_object.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_servtd_wr__unexpected__cover_exit_havoc_memory.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_sys_rd__expected__cover_entry_havoc_object.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_sys_rd__expected__cover_proof_havoc_memory.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_sys_rd__unconstrained__cover_exit_success_havoc_object.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_sys_rd__unexpected__cover_exit_havoc_memory.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_vm_wr__expected__cover_entry_havoc_object.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_vm_wr__invalid_input_field_id__cover_entry_havoc_memory.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_vm_wr__invalid_input_field_id__cover_proof_havoc_object.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_vm_wr__invalid_input_rcx__cover_proof_havoc_memory.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_vm_wr__unconstrained__cover_exit_unsuccess_havoc_object.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_vm_wr__unexpected__cover_proof_havoc_memory.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_vp_enter__expected__cover_entry_havoc_object.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_vp_enter__expected__cover_proof_havoc_memory.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_vp_enter__invalid_input_gpa__cover_exit_havoc_object.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_vp_enter__invalid_input_vmflag__cover_exit_havoc_memory.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_vp_enter__unconstrained__cover_exit_success_havoc_object.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_vp_enter__unexpected__cover_exit_havoc_memory.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_vp_vmcall__expected__cover_entry_havoc_object.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_vp_vmcall__invalid_input_bitmap__cover_proof_havoc_memory.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_vp_vmcall__unexpected__cover_entry_havoc_object.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdg_vp_vmcall__unexpected__cover_proof_havoc_memory.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_export_restore__expected__cover_entry_havoc_object.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_export_restore__unconstrained__cover_exit_success_havoc_memory.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_export_restore__unexpected__cover_entry_havoc_object.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_import_abort__expected__cover_entry_havoc_memory.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_import_abort__expected__cover_proof_havoc_object.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_import_abort__unexpected__cover_exit_havoc_memory.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_addcx__expected__cover_entry_havoc_object.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_addcx__invalid_input_tdcx_pa__cover_entry_havoc_memory.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_addcx__invalid_input_tdcx_pa__cover_exit_havoc_object.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_addcx__invalid_input_tdr_pa__cover_entry_havoc_memory.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_addcx__invalid_input_tdr_pa__cover_proof_havoc_object.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_addcx__invalid_state_lifecycle__cover_proof_havoc_memory.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_addcx__invalid_state_pamt_metadata__cover_exit_havoc_object.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_addcx__invalid_state_td_state__cover_exit_havoc_memory.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_addcx__unconstrained__cover_exit_success_havoc_object.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_addcx__unexpected__cover_exit_havoc_memory.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_create__invalid_input_rcx__cover_entry_havoc_object.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_create__invalid_input_rcx__cover_proof_havoc_memory.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_create__invalid_input_rdx__cover_entry_havoc_object.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_create__invalid_state_kot_entry__cover_entry_havoc_memory.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_create__invalid_state_kot_entry__cover_proof_havoc_object.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_create__invalid_state_tdr_page__cover_proof_havoc_memory.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_create__unexpected__cover_entry_havoc_object.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_init__expected__cover_entry_havoc_memory.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_init__expected__cover_proof_havoc_object.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_init__invalid_input_tdr_pa__cover_proof_havoc_memory.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_init__invalid_state_lifecycle__cover_entry_havoc_object.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_init__invalid_state_lifecycle__cover_proof_havoc_memory.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_init__invalid_state_op_state__cover_exit_havoc_object.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_init__invalid_state_pamt_metadata__cover_exit_havoc_memory.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_init__invalid_state_td_state__cover_entry_havoc_object.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_init__unconstrained__cover_exit_success_havoc_memory.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_init__unexpected__cover_entry_havoc_object.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_key_config__invalid_input_tdr_hkid__cover_entry_havoc_memory.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_key_config__invalid_input_tdr_hkid__cover_proof_havoc_object.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_key_config__invalid_state_td_state__cover_exit_havoc_memory.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_key_config__invalid_state_td_state__cover_proof_havoc_object.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_key_config__invalid_state_tdr_lifecycle__cover_proof_havoc_memory.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_key_config__invalid_state_tdr_metadata__cover_exit_havoc_object.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_key_config__unconstrained__cover_exit_unsuccess_havoc_memory.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_key_config__unexpected__cover_entry_havoc_object.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_key_config__unexpected__cover_proof_havoc_memory.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_key_freeid__invalid_input_tdr_hkid__cover_exit_havoc_object.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_key_freeid__invalid_state_kot__cover_exit_havoc_memory.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_key_freeid__invalid_state_tdr_lifecycle__cover_entry_havoc_object.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_key_freeid__invalid_state_tdr_lifecycle__cover_proof_havoc_memory.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_key_freeid__invalid_state_tdr_metadata__cover_entry_havoc_object.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_key_freeid__unconstrained__cover_exit_unsuccess_havoc_memory.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_key_freeid__unexpected__cover_exit_havoc_object.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_vpflushdone__expected__cover_exit_havoc_memory.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_vpflushdone__invalid_input_tdr_hkid__cover_entry_havoc_object.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_vpflushdone__invalid_state_op_state__cover_entry_havoc_memory.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_vpflushdone__invalid_state_op_state__cover_proof_havoc_object.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_vpflushdone__invalid_state_tdr_lifecycle__cover_proof_havoc_memory.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_vpflushdone__invalid_state_tdr_metadata__cover_entry_havoc_object.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_vpflushdone__invalid_state_tdr_metadata__cover_proof_havoc_memory.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mng_vpflushdone__unexpected__cover_entry_havoc_object.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mr_finalize__expected__cover_entry_havoc_memory.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mr_finalize__expected__cover_proof_havoc_object.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mr_finalize__invalid_input_hkid__cover_proof_havoc_memory.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mr_finalize__invalid_state_lifecycle__cover_exit_havoc_object.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mr_finalize__invalid_state_op_state__cover_exit_havoc_memory.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mr_finalize__invalid_state_td_state__cover_entry_havoc_object.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mr_finalize__invalid_state_td_state__cover_proof_havoc_memory.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mr_finalize__invalid_state_tdr_metadata__cover_entry_havoc_object.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mr_finalize__unconstrained__cover_exit_success_havoc_memory.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_mr_finalize__unexpected__cover_entry_havoc_object.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_phymem_page_reclaim__expected__cover_entry_havoc_memory.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_phymem_page_reclaim__expected__cover_proof_havoc_object.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_phymem_page_reclaim__invalid_input_pa__cover_proof_havoc_memory.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_phymem_page_reclaim__invalid_state_child_count__cover_exit_havoc_object.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_phymem_page_reclaim__invalid_state_lifecycle__cover_exit_havoc_memory.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_phymem_page_reclaim__invalid_state_lifecycle__cover_proof_havoc_object.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_phymem_page_reclaim__invalid_state_pamt_metadata__cover_exit_havoc_memory.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_phymem_page_reclaim__unconstrained__cover_exit_success_havoc_object.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_phymem_page_reclaim__unexpected__cover_exit_havoc_memory.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_config__expected__cover_entry_havoc_object.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_config__expected__cover_proof_havoc_memory.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_config__invalid_input_hkid__cover_entry_havoc_object.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_config__invalid_input_num_ptr__cover_entry_havoc_memory.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_config__invalid_input_num_ptr__cover_proof_havoc_object.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_config__invalid_state_lp_state__cover_proof_havoc_memory.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_config__invalid_state_sys_state__cover_entry_havoc_object.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_config__invalid_state_sys_state__cover_proof_havoc_memory.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_config__invalid_state_tdmr_info__cover_exit_havoc_object.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_config__unexpected__cover_entry_havoc_memory.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_config__unexpected__cover_proof_havoc_object.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_init__expected__cover_proof_havoc_memory.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_init__invalid_input_rcx__cover_exit_havoc_object.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_init__invalid_state_sys_state__cover_exit_havoc_memory.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_init__unconstrained__cover_exit_unsuccess_havoc_object.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_init__unexpected__cover_exit_havoc_memory.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_init__unexpected__cover_proof_havoc_object.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_key_config__expected__cover_proof_havoc_memory.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_key_config__invalid_state_sys_state__cover_exit_havoc_object.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_key_config__unexpected__cover_entry_havoc_memory.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_key_config__unexpected__cover_proof_havoc_object.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_shutdown__expected__cover_proof_havoc_memory.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_shutdown__invalid_input_handoff_no_downgrade__cover_exit_havoc_object.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_shutdown__invalid_input_handoff_range__cover_exit_havoc_memory.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_shutdown__invalid_input_handoff_range__cover_proof_havoc_object.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_shutdown__unexpected__cover_entry_havoc_memory.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_shutdown__unexpected__cover_proof_havoc_object.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_update__expected__cover_proof_havoc_memory.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_update__invalid_state_handoff_data__cover_exit_havoc_object.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_update__invalid_state_handoff_version__cover_exit_havoc_memory.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_update__invalid_state_lp_state__cover_entry_havoc_object.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_update__invalid_state_sys_state__cover_entry_havoc_memory.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_update__invalid_state_sys_state__cover_proof_havoc_object.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_update__unexpected__cover_entry_havoc_memory.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_sys_update__unexpected__cover_exit_havoc_object.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_vp_enter__invalid_input_vcpu_handle__cover_entry_havoc_memory.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_vp_enter__invalid_input_vcpu_handle__cover_proof_havoc_object.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_vp_enter__invalid_state_lifecycle__cover_proof_havoc_memory.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_vp_enter__invalid_state_op_state__cover_entry_havoc_object.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_vp_enter__invalid_state_op_state__cover_proof_havoc_memory.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_vp_enter__invalid_state_pamt_metadata__cover_exit_havoc_object.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_vp_enter__invalid_state_td_state__cover_exit_havoc_memory.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_vp_enter__unconstrained__cover_exit_unsuccess_havoc_object.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_vp_enter__unexpected__cover_exit_havoc_memory.i LP64 false +SoftwareSystems-Intel-TDX-Module intel-tdx-module/tdh_vp_enter__unexpected__cover_proof_havoc_object.i LP64 false diff --git a/tests/testcomp/expected.txt b/tests/testcomp/expected.txt index 38b0185a6..4249c1712 100644 --- a/tests/testcomp/expected.txt +++ b/tests/testcomp/expected.txt @@ -17,20 +17,13 @@ no_input.c COVERED char_input.c COVERED unreachable.c NOT_COVERED -# loop_reads.c -- NOT_COVERED, and the reason is now known (finding K). +# loop_reads.c -- COVERED since issue #75 (commit 8da579488). # -# Map2Check DOES find the violation here. Running with --debug shows -# "TARGET-REACHED found" -- the property file is written -- and then KLEE is -# killed by the timeout while still exploring other states, at which point -# map2check.cpp forces the verdict to UNKNOWN and throws the violation away: -# -# if (caller->isTimeout()) { propertyViolated = UNKNOWN; } -# -# So no suite is emitted and the suite cannot cover anything. The emitter is -# never reached, and the emitter is not at fault. -# -# This line becomes COVERED once the verdict logic consults the property before -# forcing UNKNOWN on timeout. The gate will insist on the update, which is the -# point of keeping the case here instead of deleting it. -# See docs/reports/2026-08-12-castle-juliet-findings.md, finding K. -loop_reads.c NOT_COVERED +# It was NOT_COVERED from finding K until then: KLEE reached the target but +# forked on every symbolic value written to the nondet log (vfprintf), so the +# run ran out of budget before a test vector came out. Concretizing the log +# before writing it removed the explosion. +# Measured at BUDGET=120: install_v99b NOT_COVERED, install_v99c COVERED (2/2). +# See docs/reports/2026-08-12-castle-juliet-findings.md (finding K) and the +# issue #75 entry in docs/reports/tacas-experiment-log.md. +loop_reads.c COVERED diff --git a/tests/testcomp/official/Dockerfile b/tests/testcomp/official/Dockerfile new file mode 100644 index 000000000..84c1e82c9 --- /dev/null +++ b/tests/testcomp/official/Dockerfile @@ -0,0 +1,43 @@ +# Test-Comp 2026 reproduction environment. +# +# The base is the image the competition publishes as "mostly the same packages +# as the competition machines" (Ubuntu 24.04; competition-scripts +# test/Dockerfile.user.2026). On top of it, the two components the +# testcomp26 tag of gitlab.com/sosy-lab/test-comp/bench-defs pins: +# - BenchExec 3.34 (submodule benchexec @ 829bf7a4583e), which runs both the +# test generator and the validator under the official limits; +# - TestCov 3.11.post3 (fm-tools testcov.yml, Zenodo 10.5281/zenodo.17698774) +# and TestCoCa testcomp26 (fm-tools testcoca.yml, Zenodo +# 10.5281/zenodo.17819536): the five validators of the category structure +# (TestCov x {gcc, clang} x {formatted, unformatted}, plus TestCoCa). A +# task's score is the best coverage any of them measures. +# See docs/reports/2026-10-06-ambiente-testcomp-oficial.md. +# +# Run it privileged, as BenchExec needs to manage cgroups: +# docker run --privileged --cap-drop=all ... map2check-testcomp-env +FROM registry.gitlab.com/sosy-lab/benchmarking/competition-scripts/user@sha256:2a38216dfc6ceb6ebbb80f07dae8abd4b87b4c619d7c6db2256dc98e608ebc47 + +RUN apt-get update \ + && apt-get install -y --no-install-recommends python3-pip zip unzip xmlstarlet ca-certificates curl fuse-overlayfs \ + && rm -rf /var/lib/apt/lists/* + +RUN pip install --break-system-packages --no-cache-dir benchexec==3.34 + +ARG TESTCOV_URL=https://zenodo.org/api/records/17698774/files/testcov-3.11.post3.zip/content +ARG TESTCOV_SHA256=604c234cb2ef6f8aa46bc0dd8fa146104d7d368b7285d0d8e9cd8bc99a7813b1 +RUN curl -sSL -o /tmp/testcov.zip "$TESTCOV_URL" \ + && echo "$TESTCOV_SHA256 /tmp/testcov.zip" | sha256sum -c - \ + && unzip -q /tmp/testcov.zip -d /opt \ + && rm /tmp/testcov.zip \ + && /opt/testcov/bin/testcov --version + +ARG TESTCOCA_URL=https://zenodo.org/api/records/17819536/files/testcoca.zip/content +ARG TESTCOCA_SHA256=14e57b70ee8ccb72899daa14ec7132cca217d8c334bf8b29940ca703ff32036f +RUN curl -sSL -o /tmp/testcoca.zip "$TESTCOCA_URL" \ + && echo "$TESTCOCA_SHA256 /tmp/testcoca.zip" | sha256sum -c - \ + && unzip -q /tmp/testcoca.zip -d /opt \ + && rm /tmp/testcoca.zip + +COPY init.sh /init.sh +ENTRYPOINT ["/init.sh"] +CMD ["bash"] diff --git a/tests/testcomp/official/bench-defs/excludes/ECA-excludes.set b/tests/testcomp/official/bench-defs/excludes/ECA-excludes.set new file mode 100644 index 000000000..3252e5878 --- /dev/null +++ b/tests/testcomp/official/bench-defs/excludes/ECA-excludes.set @@ -0,0 +1,1027 @@ +../../sv-benchmarks/c/eca-programs/Problem101_label01.yml +../../sv-benchmarks/c/eca-programs/Problem101_label02.yml +../../sv-benchmarks/c/eca-programs/Problem101_label03.yml +../../sv-benchmarks/c/eca-programs/Problem101_label04.yml +../../sv-benchmarks/c/eca-programs/Problem101_label05.yml +../../sv-benchmarks/c/eca-programs/Problem101_label06.yml +../../sv-benchmarks/c/eca-programs/Problem101_label07.yml +../../sv-benchmarks/c/eca-programs/Problem101_label08.yml +../../sv-benchmarks/c/eca-programs/Problem101_label09.yml +../../sv-benchmarks/c/eca-programs/Problem101_label10.yml +../../sv-benchmarks/c/eca-programs/Problem101_label11.yml +../../sv-benchmarks/c/eca-programs/Problem101_label12.yml +../../sv-benchmarks/c/eca-programs/Problem101_label13.yml +../../sv-benchmarks/c/eca-programs/Problem101_label14.yml +../../sv-benchmarks/c/eca-programs/Problem101_label15.yml +../../sv-benchmarks/c/eca-programs/Problem101_label16.yml +../../sv-benchmarks/c/eca-programs/Problem101_label17.yml +../../sv-benchmarks/c/eca-programs/Problem101_label18.yml +../../sv-benchmarks/c/eca-programs/Problem101_label19.yml +../../sv-benchmarks/c/eca-programs/Problem101_label20.yml +../../sv-benchmarks/c/eca-programs/Problem101_label21.yml +../../sv-benchmarks/c/eca-programs/Problem101_label22.yml +../../sv-benchmarks/c/eca-programs/Problem101_label23.yml +../../sv-benchmarks/c/eca-programs/Problem102_label01.yml +../../sv-benchmarks/c/eca-programs/Problem102_label02.yml +../../sv-benchmarks/c/eca-programs/Problem102_label03.yml +../../sv-benchmarks/c/eca-programs/Problem102_label04.yml +../../sv-benchmarks/c/eca-programs/Problem102_label05.yml +../../sv-benchmarks/c/eca-programs/Problem102_label06.yml +../../sv-benchmarks/c/eca-programs/Problem102_label07.yml +../../sv-benchmarks/c/eca-programs/Problem102_label08.yml +../../sv-benchmarks/c/eca-programs/Problem102_label09.yml +../../sv-benchmarks/c/eca-programs/Problem102_label10.yml +../../sv-benchmarks/c/eca-programs/Problem102_label11.yml +../../sv-benchmarks/c/eca-programs/Problem102_label12.yml +../../sv-benchmarks/c/eca-programs/Problem102_label13.yml +../../sv-benchmarks/c/eca-programs/Problem102_label14.yml +../../sv-benchmarks/c/eca-programs/Problem102_label15.yml +../../sv-benchmarks/c/eca-programs/Problem102_label16.yml +../../sv-benchmarks/c/eca-programs/Problem102_label17.yml +../../sv-benchmarks/c/eca-programs/Problem102_label18.yml +../../sv-benchmarks/c/eca-programs/Problem102_label19.yml +../../sv-benchmarks/c/eca-programs/Problem102_label20.yml +../../sv-benchmarks/c/eca-programs/Problem102_label21.yml +../../sv-benchmarks/c/eca-programs/Problem102_label22.yml +../../sv-benchmarks/c/eca-programs/Problem102_label23.yml +../../sv-benchmarks/c/eca-programs/Problem102_label24.yml +../../sv-benchmarks/c/eca-programs/Problem102_label25.yml +../../sv-benchmarks/c/eca-programs/Problem102_label26.yml +../../sv-benchmarks/c/eca-programs/Problem102_label27.yml +../../sv-benchmarks/c/eca-programs/Problem102_label28.yml +../../sv-benchmarks/c/eca-programs/Problem102_label29.yml +../../sv-benchmarks/c/eca-programs/Problem102_label30.yml +../../sv-benchmarks/c/eca-programs/Problem102_label31.yml +../../sv-benchmarks/c/eca-programs/Problem102_label32.yml +../../sv-benchmarks/c/eca-programs/Problem102_label33.yml +../../sv-benchmarks/c/eca-programs/Problem102_label34.yml +../../sv-benchmarks/c/eca-programs/Problem102_label35.yml +../../sv-benchmarks/c/eca-programs/Problem102_label36.yml +../../sv-benchmarks/c/eca-programs/Problem102_label37.yml +../../sv-benchmarks/c/eca-programs/Problem102_label38.yml +../../sv-benchmarks/c/eca-programs/Problem102_label39.yml +../../sv-benchmarks/c/eca-programs/Problem102_label40.yml +../../sv-benchmarks/c/eca-programs/Problem102_label41.yml +../../sv-benchmarks/c/eca-programs/Problem102_label42.yml +../../sv-benchmarks/c/eca-programs/Problem102_label43.yml +../../sv-benchmarks/c/eca-programs/Problem102_label44.yml +../../sv-benchmarks/c/eca-programs/Problem102_label45.yml +../../sv-benchmarks/c/eca-programs/Problem102_label46.yml +../../sv-benchmarks/c/eca-programs/Problem102_label47.yml +../../sv-benchmarks/c/eca-programs/Problem102_label48.yml +../../sv-benchmarks/c/eca-programs/Problem102_label49.yml +../../sv-benchmarks/c/eca-programs/Problem102_label50.yml +../../sv-benchmarks/c/eca-programs/Problem102_label51.yml +../../sv-benchmarks/c/eca-programs/Problem102_label52.yml +../../sv-benchmarks/c/eca-programs/Problem102_label53.yml +../../sv-benchmarks/c/eca-programs/Problem102_label54.yml +../../sv-benchmarks/c/eca-programs/Problem102_label55.yml +../../sv-benchmarks/c/eca-programs/Problem102_label56.yml +../../sv-benchmarks/c/eca-programs/Problem102_label57.yml +../../sv-benchmarks/c/eca-programs/Problem102_label58.yml +../../sv-benchmarks/c/eca-programs/Problem102_label59.yml +../../sv-benchmarks/c/eca-programs/Problem103_label35.yml +../../sv-benchmarks/c/eca-programs/Problem103_label40.yml +../../sv-benchmarks/c/eca-programs/Problem103_label41.yml +../../sv-benchmarks/c/eca-programs/Problem103_label42.yml +../../sv-benchmarks/c/eca-programs/Problem103_label43.yml +../../sv-benchmarks/c/eca-programs/Problem103_label44.yml +../../sv-benchmarks/c/eca-programs/Problem103_label45.yml +../../sv-benchmarks/c/eca-programs/Problem103_label46.yml +../../sv-benchmarks/c/eca-programs/Problem103_label47.yml +../../sv-benchmarks/c/eca-programs/Problem103_label48.yml +../../sv-benchmarks/c/eca-programs/Problem103_label49.yml +../../sv-benchmarks/c/eca-programs/Problem103_label50.yml +../../sv-benchmarks/c/eca-programs/Problem103_label51.yml +../../sv-benchmarks/c/eca-programs/Problem103_label52.yml +../../sv-benchmarks/c/eca-programs/Problem103_label53.yml +../../sv-benchmarks/c/eca-programs/Problem103_label54.yml +../../sv-benchmarks/c/eca-programs/Problem103_label55.yml +../../sv-benchmarks/c/eca-programs/Problem103_label56.yml +../../sv-benchmarks/c/eca-programs/Problem103_label57.yml +../../sv-benchmarks/c/eca-programs/Problem103_label58.yml +../../sv-benchmarks/c/eca-programs/Problem103_label59.yml +../../sv-benchmarks/c/eca-rers2012/Problem03_label01.yml +../../sv-benchmarks/c/eca-rers2012/Problem03_label02.yml +../../sv-benchmarks/c/eca-rers2012/Problem03_label03.yml +../../sv-benchmarks/c/eca-rers2012/Problem03_label04.yml +../../sv-benchmarks/c/eca-rers2012/Problem03_label05.yml +../../sv-benchmarks/c/eca-rers2012/Problem03_label06.yml +../../sv-benchmarks/c/eca-rers2012/Problem03_label07.yml +../../sv-benchmarks/c/eca-rers2012/Problem03_label08.yml +../../sv-benchmarks/c/eca-rers2012/Problem03_label09.yml +../../sv-benchmarks/c/eca-rers2012/Problem03_label10.yml +../../sv-benchmarks/c/eca-rers2012/Problem03_label11.yml +../../sv-benchmarks/c/eca-rers2012/Problem03_label12.yml +../../sv-benchmarks/c/eca-rers2012/Problem03_label13.yml +../../sv-benchmarks/c/eca-rers2012/Problem03_label14.yml +../../sv-benchmarks/c/eca-rers2012/Problem03_label15.yml +../../sv-benchmarks/c/eca-rers2012/Problem03_label16.yml +../../sv-benchmarks/c/eca-rers2012/Problem03_label17.yml +../../sv-benchmarks/c/eca-rers2012/Problem03_label18.yml +../../sv-benchmarks/c/eca-rers2012/Problem03_label19.yml +../../sv-benchmarks/c/eca-rers2012/Problem03_label20.yml +../../sv-benchmarks/c/eca-rers2012/Problem03_label21.yml +../../sv-benchmarks/c/eca-rers2012/Problem03_label22.yml +../../sv-benchmarks/c/eca-rers2012/Problem03_label23.yml +../../sv-benchmarks/c/eca-rers2012/Problem03_label24.yml +../../sv-benchmarks/c/eca-rers2012/Problem03_label25.yml +../../sv-benchmarks/c/eca-rers2012/Problem03_label26.yml +../../sv-benchmarks/c/eca-rers2012/Problem03_label27.yml +../../sv-benchmarks/c/eca-rers2012/Problem03_label28.yml +../../sv-benchmarks/c/eca-rers2012/Problem03_label29.yml +../../sv-benchmarks/c/eca-rers2012/Problem03_label30.yml +../../sv-benchmarks/c/eca-rers2012/Problem03_label31.yml +../../sv-benchmarks/c/eca-rers2012/Problem03_label32.yml +../../sv-benchmarks/c/eca-rers2012/Problem03_label33.yml +../../sv-benchmarks/c/eca-rers2012/Problem03_label34.yml +../../sv-benchmarks/c/eca-rers2012/Problem03_label35.yml +../../sv-benchmarks/c/eca-rers2012/Problem03_label36.yml +../../sv-benchmarks/c/eca-rers2012/Problem03_label37.yml +../../sv-benchmarks/c/eca-rers2012/Problem03_label38.yml +../../sv-benchmarks/c/eca-rers2012/Problem03_label39.yml +../../sv-benchmarks/c/eca-rers2012/Problem03_label40.yml +../../sv-benchmarks/c/eca-rers2012/Problem03_label41.yml +../../sv-benchmarks/c/eca-rers2012/Problem03_label42.yml +../../sv-benchmarks/c/eca-rers2012/Problem03_label43.yml +../../sv-benchmarks/c/eca-rers2012/Problem03_label44.yml +../../sv-benchmarks/c/eca-rers2012/Problem03_label45.yml +../../sv-benchmarks/c/eca-rers2012/Problem03_label46.yml +../../sv-benchmarks/c/eca-rers2012/Problem03_label47.yml +../../sv-benchmarks/c/eca-rers2012/Problem03_label48.yml +../../sv-benchmarks/c/eca-rers2012/Problem03_label49.yml +../../sv-benchmarks/c/eca-rers2012/Problem03_label50.yml +../../sv-benchmarks/c/eca-rers2012/Problem03_label51.yml +../../sv-benchmarks/c/eca-rers2012/Problem03_label52.yml +../../sv-benchmarks/c/eca-rers2012/Problem03_label53.yml +../../sv-benchmarks/c/eca-rers2012/Problem03_label54.yml +../../sv-benchmarks/c/eca-rers2012/Problem03_label55.yml +../../sv-benchmarks/c/eca-rers2012/Problem03_label56.yml +../../sv-benchmarks/c/eca-rers2012/Problem03_label57.yml +../../sv-benchmarks/c/eca-rers2012/Problem03_label58.yml +../../sv-benchmarks/c/eca-rers2012/Problem03_label59.yml +../../sv-benchmarks/c/eca-rers2012/Problem04_label01.yml +../../sv-benchmarks/c/eca-rers2012/Problem04_label02.yml +../../sv-benchmarks/c/eca-rers2012/Problem04_label03.yml +../../sv-benchmarks/c/eca-rers2012/Problem04_label04.yml +../../sv-benchmarks/c/eca-rers2012/Problem04_label05.yml +../../sv-benchmarks/c/eca-rers2012/Problem04_label06.yml +../../sv-benchmarks/c/eca-rers2012/Problem04_label07.yml +../../sv-benchmarks/c/eca-rers2012/Problem04_label08.yml +../../sv-benchmarks/c/eca-rers2012/Problem04_label09.yml +../../sv-benchmarks/c/eca-rers2012/Problem04_label10.yml +../../sv-benchmarks/c/eca-rers2012/Problem04_label13.yml +../../sv-benchmarks/c/eca-rers2012/Problem04_label15.yml +../../sv-benchmarks/c/eca-rers2012/Problem04_label16.yml +../../sv-benchmarks/c/eca-rers2012/Problem04_label18.yml +../../sv-benchmarks/c/eca-rers2012/Problem04_label19.yml +../../sv-benchmarks/c/eca-rers2012/Problem04_label21.yml +../../sv-benchmarks/c/eca-rers2012/Problem04_label22.yml +../../sv-benchmarks/c/eca-rers2012/Problem04_label25.yml +../../sv-benchmarks/c/eca-rers2012/Problem04_label26.yml +../../sv-benchmarks/c/eca-rers2012/Problem04_label28.yml +../../sv-benchmarks/c/eca-rers2012/Problem04_label30.yml +../../sv-benchmarks/c/eca-rers2012/Problem04_label31.yml +../../sv-benchmarks/c/eca-rers2012/Problem04_label32.yml +../../sv-benchmarks/c/eca-rers2012/Problem04_label33.yml +../../sv-benchmarks/c/eca-rers2012/Problem04_label34.yml +../../sv-benchmarks/c/eca-rers2012/Problem04_label35.yml +../../sv-benchmarks/c/eca-rers2012/Problem04_label38.yml +../../sv-benchmarks/c/eca-rers2012/Problem04_label39.yml +../../sv-benchmarks/c/eca-rers2012/Problem04_label41.yml +../../sv-benchmarks/c/eca-rers2012/Problem04_label45.yml +../../sv-benchmarks/c/eca-rers2012/Problem04_label47.yml +../../sv-benchmarks/c/eca-rers2012/Problem04_label48.yml +../../sv-benchmarks/c/eca-rers2012/Problem04_label50.yml +../../sv-benchmarks/c/eca-rers2012/Problem04_label51.yml +../../sv-benchmarks/c/eca-rers2012/Problem04_label52.yml +../../sv-benchmarks/c/eca-rers2012/Problem04_label53.yml +../../sv-benchmarks/c/eca-rers2012/Problem04_label54.yml +../../sv-benchmarks/c/eca-rers2012/Problem04_label55.yml +../../sv-benchmarks/c/eca-rers2012/Problem04_label56.yml +../../sv-benchmarks/c/eca-rers2012/Problem04_label59.yml +../../sv-benchmarks/c/eca-rers2012/Problem05_label01.yml +../../sv-benchmarks/c/eca-rers2012/Problem05_label02.yml +../../sv-benchmarks/c/eca-rers2012/Problem05_label03.yml +../../sv-benchmarks/c/eca-rers2012/Problem05_label04.yml +../../sv-benchmarks/c/eca-rers2012/Problem05_label05.yml +../../sv-benchmarks/c/eca-rers2012/Problem05_label06.yml +../../sv-benchmarks/c/eca-rers2012/Problem05_label07.yml +../../sv-benchmarks/c/eca-rers2012/Problem05_label08.yml +../../sv-benchmarks/c/eca-rers2012/Problem05_label09.yml +../../sv-benchmarks/c/eca-rers2012/Problem05_label10.yml +../../sv-benchmarks/c/eca-rers2012/Problem05_label11.yml +../../sv-benchmarks/c/eca-rers2012/Problem05_label12.yml +../../sv-benchmarks/c/eca-rers2012/Problem05_label13.yml +../../sv-benchmarks/c/eca-rers2012/Problem05_label14.yml +../../sv-benchmarks/c/eca-rers2012/Problem05_label15.yml +../../sv-benchmarks/c/eca-rers2012/Problem05_label16.yml +../../sv-benchmarks/c/eca-rers2012/Problem05_label17.yml +../../sv-benchmarks/c/eca-rers2012/Problem05_label18.yml +../../sv-benchmarks/c/eca-rers2012/Problem05_label19.yml +../../sv-benchmarks/c/eca-rers2012/Problem05_label20.yml +../../sv-benchmarks/c/eca-rers2012/Problem05_label21.yml +../../sv-benchmarks/c/eca-rers2012/Problem05_label22.yml +../../sv-benchmarks/c/eca-rers2012/Problem05_label23.yml +../../sv-benchmarks/c/eca-rers2012/Problem05_label24.yml +../../sv-benchmarks/c/eca-rers2012/Problem05_label25.yml +../../sv-benchmarks/c/eca-rers2012/Problem05_label26.yml +../../sv-benchmarks/c/eca-rers2012/Problem05_label27.yml +../../sv-benchmarks/c/eca-rers2012/Problem05_label28.yml +../../sv-benchmarks/c/eca-rers2012/Problem05_label29.yml +../../sv-benchmarks/c/eca-rers2012/Problem05_label30.yml +../../sv-benchmarks/c/eca-rers2012/Problem05_label31.yml +../../sv-benchmarks/c/eca-rers2012/Problem05_label32.yml +../../sv-benchmarks/c/eca-rers2012/Problem05_label33.yml +../../sv-benchmarks/c/eca-rers2012/Problem05_label34.yml +../../sv-benchmarks/c/eca-rers2012/Problem05_label35.yml +../../sv-benchmarks/c/eca-rers2012/Problem05_label36.yml +../../sv-benchmarks/c/eca-rers2012/Problem05_label37.yml +../../sv-benchmarks/c/eca-rers2012/Problem05_label38.yml +../../sv-benchmarks/c/eca-rers2012/Problem05_label39.yml +../../sv-benchmarks/c/eca-rers2012/Problem05_label40.yml +../../sv-benchmarks/c/eca-rers2012/Problem05_label41.yml +../../sv-benchmarks/c/eca-rers2012/Problem05_label42.yml +../../sv-benchmarks/c/eca-rers2012/Problem05_label43.yml +../../sv-benchmarks/c/eca-rers2012/Problem05_label44.yml +../../sv-benchmarks/c/eca-rers2012/Problem05_label45.yml +../../sv-benchmarks/c/eca-rers2012/Problem05_label46.yml +../../sv-benchmarks/c/eca-rers2012/Problem05_label47.yml +../../sv-benchmarks/c/eca-rers2012/Problem05_label48.yml +../../sv-benchmarks/c/eca-rers2012/Problem05_label49.yml +../../sv-benchmarks/c/eca-rers2012/Problem05_label50.yml +../../sv-benchmarks/c/eca-rers2012/Problem05_label51.yml +../../sv-benchmarks/c/eca-rers2012/Problem05_label52.yml +../../sv-benchmarks/c/eca-rers2012/Problem05_label53.yml +../../sv-benchmarks/c/eca-rers2012/Problem05_label54.yml +../../sv-benchmarks/c/eca-rers2012/Problem05_label55.yml +../../sv-benchmarks/c/eca-rers2012/Problem05_label56.yml +../../sv-benchmarks/c/eca-rers2012/Problem05_label57.yml +../../sv-benchmarks/c/eca-rers2012/Problem05_label58.yml +../../sv-benchmarks/c/eca-rers2012/Problem05_label59.yml +../../sv-benchmarks/c/eca-rers2012/Problem06_label01.yml +../../sv-benchmarks/c/eca-rers2012/Problem06_label02.yml +../../sv-benchmarks/c/eca-rers2012/Problem06_label03.yml +../../sv-benchmarks/c/eca-rers2012/Problem06_label04.yml +../../sv-benchmarks/c/eca-rers2012/Problem06_label05.yml +../../sv-benchmarks/c/eca-rers2012/Problem06_label06.yml +../../sv-benchmarks/c/eca-rers2012/Problem06_label07.yml +../../sv-benchmarks/c/eca-rers2012/Problem06_label08.yml +../../sv-benchmarks/c/eca-rers2012/Problem06_label09.yml +../../sv-benchmarks/c/eca-rers2012/Problem06_label10.yml +../../sv-benchmarks/c/eca-rers2012/Problem06_label11.yml +../../sv-benchmarks/c/eca-rers2012/Problem06_label12.yml +../../sv-benchmarks/c/eca-rers2012/Problem06_label13.yml +../../sv-benchmarks/c/eca-rers2012/Problem06_label14.yml +../../sv-benchmarks/c/eca-rers2012/Problem06_label15.yml +../../sv-benchmarks/c/eca-rers2012/Problem06_label16.yml +../../sv-benchmarks/c/eca-rers2012/Problem06_label17.yml +../../sv-benchmarks/c/eca-rers2012/Problem06_label18.yml +../../sv-benchmarks/c/eca-rers2012/Problem06_label19.yml +../../sv-benchmarks/c/eca-rers2012/Problem06_label20.yml +../../sv-benchmarks/c/eca-rers2012/Problem06_label21.yml +../../sv-benchmarks/c/eca-rers2012/Problem06_label22.yml +../../sv-benchmarks/c/eca-rers2012/Problem06_label23.yml +../../sv-benchmarks/c/eca-rers2012/Problem06_label24.yml +../../sv-benchmarks/c/eca-rers2012/Problem06_label25.yml +../../sv-benchmarks/c/eca-rers2012/Problem06_label26.yml +../../sv-benchmarks/c/eca-rers2012/Problem06_label27.yml +../../sv-benchmarks/c/eca-rers2012/Problem06_label28.yml +../../sv-benchmarks/c/eca-rers2012/Problem06_label29.yml +../../sv-benchmarks/c/eca-rers2012/Problem06_label30.yml +../../sv-benchmarks/c/eca-rers2012/Problem06_label31.yml +../../sv-benchmarks/c/eca-rers2012/Problem06_label32.yml +../../sv-benchmarks/c/eca-rers2012/Problem06_label33.yml +../../sv-benchmarks/c/eca-rers2012/Problem06_label34.yml +../../sv-benchmarks/c/eca-rers2012/Problem06_label35.yml +../../sv-benchmarks/c/eca-rers2012/Problem06_label36.yml +../../sv-benchmarks/c/eca-rers2012/Problem06_label37.yml +../../sv-benchmarks/c/eca-rers2012/Problem06_label38.yml +../../sv-benchmarks/c/eca-rers2012/Problem06_label39.yml +../../sv-benchmarks/c/eca-rers2012/Problem06_label40.yml +../../sv-benchmarks/c/eca-rers2012/Problem06_label41.yml +../../sv-benchmarks/c/eca-rers2012/Problem06_label42.yml +../../sv-benchmarks/c/eca-rers2012/Problem06_label43.yml +../../sv-benchmarks/c/eca-rers2012/Problem06_label44.yml +../../sv-benchmarks/c/eca-rers2012/Problem06_label45.yml +../../sv-benchmarks/c/eca-rers2012/Problem06_label46.yml +../../sv-benchmarks/c/eca-rers2012/Problem06_label47.yml +../../sv-benchmarks/c/eca-rers2012/Problem06_label48.yml +../../sv-benchmarks/c/eca-rers2012/Problem06_label49.yml +../../sv-benchmarks/c/eca-rers2012/Problem06_label50.yml +../../sv-benchmarks/c/eca-rers2012/Problem06_label51.yml +../../sv-benchmarks/c/eca-rers2012/Problem06_label52.yml +../../sv-benchmarks/c/eca-rers2012/Problem06_label53.yml +../../sv-benchmarks/c/eca-rers2012/Problem06_label54.yml +../../sv-benchmarks/c/eca-rers2012/Problem06_label55.yml +../../sv-benchmarks/c/eca-rers2012/Problem06_label56.yml +../../sv-benchmarks/c/eca-rers2012/Problem06_label57.yml +../../sv-benchmarks/c/eca-rers2012/Problem06_label58.yml +../../sv-benchmarks/c/eca-rers2012/Problem06_label59.yml +../../sv-benchmarks/c/eca-rers2012/Problem07_label01.yml +../../sv-benchmarks/c/eca-rers2012/Problem07_label02.yml +../../sv-benchmarks/c/eca-rers2012/Problem07_label03.yml +../../sv-benchmarks/c/eca-rers2012/Problem07_label04.yml +../../sv-benchmarks/c/eca-rers2012/Problem07_label05.yml +../../sv-benchmarks/c/eca-rers2012/Problem07_label06.yml +../../sv-benchmarks/c/eca-rers2012/Problem07_label07.yml +../../sv-benchmarks/c/eca-rers2012/Problem07_label08.yml +../../sv-benchmarks/c/eca-rers2012/Problem07_label09.yml +../../sv-benchmarks/c/eca-rers2012/Problem07_label10.yml +../../sv-benchmarks/c/eca-rers2012/Problem07_label11.yml +../../sv-benchmarks/c/eca-rers2012/Problem07_label12.yml +../../sv-benchmarks/c/eca-rers2012/Problem07_label13.yml +../../sv-benchmarks/c/eca-rers2012/Problem07_label14.yml +../../sv-benchmarks/c/eca-rers2012/Problem07_label15.yml +../../sv-benchmarks/c/eca-rers2012/Problem07_label16.yml +../../sv-benchmarks/c/eca-rers2012/Problem07_label17.yml +../../sv-benchmarks/c/eca-rers2012/Problem07_label18.yml +../../sv-benchmarks/c/eca-rers2012/Problem07_label19.yml +../../sv-benchmarks/c/eca-rers2012/Problem07_label20.yml +../../sv-benchmarks/c/eca-rers2012/Problem07_label21.yml +../../sv-benchmarks/c/eca-rers2012/Problem07_label22.yml +../../sv-benchmarks/c/eca-rers2012/Problem07_label23.yml +../../sv-benchmarks/c/eca-rers2012/Problem07_label24.yml +../../sv-benchmarks/c/eca-rers2012/Problem07_label25.yml +../../sv-benchmarks/c/eca-rers2012/Problem07_label26.yml +../../sv-benchmarks/c/eca-rers2012/Problem07_label27.yml +../../sv-benchmarks/c/eca-rers2012/Problem07_label28.yml +../../sv-benchmarks/c/eca-rers2012/Problem07_label29.yml +../../sv-benchmarks/c/eca-rers2012/Problem07_label30.yml +../../sv-benchmarks/c/eca-rers2012/Problem07_label31.yml +../../sv-benchmarks/c/eca-rers2012/Problem07_label32.yml +../../sv-benchmarks/c/eca-rers2012/Problem07_label33.yml +../../sv-benchmarks/c/eca-rers2012/Problem07_label34.yml +../../sv-benchmarks/c/eca-rers2012/Problem07_label35.yml +../../sv-benchmarks/c/eca-rers2012/Problem07_label36.yml +../../sv-benchmarks/c/eca-rers2012/Problem07_label37.yml +../../sv-benchmarks/c/eca-rers2012/Problem07_label38.yml +../../sv-benchmarks/c/eca-rers2012/Problem07_label39.yml +../../sv-benchmarks/c/eca-rers2012/Problem07_label40.yml +../../sv-benchmarks/c/eca-rers2012/Problem07_label41.yml +../../sv-benchmarks/c/eca-rers2012/Problem07_label42.yml +../../sv-benchmarks/c/eca-rers2012/Problem07_label43.yml +../../sv-benchmarks/c/eca-rers2012/Problem07_label44.yml +../../sv-benchmarks/c/eca-rers2012/Problem07_label45.yml +../../sv-benchmarks/c/eca-rers2012/Problem07_label46.yml +../../sv-benchmarks/c/eca-rers2012/Problem07_label47.yml +../../sv-benchmarks/c/eca-rers2012/Problem07_label48.yml +../../sv-benchmarks/c/eca-rers2012/Problem07_label49.yml +../../sv-benchmarks/c/eca-rers2012/Problem07_label50.yml +../../sv-benchmarks/c/eca-rers2012/Problem07_label51.yml +../../sv-benchmarks/c/eca-rers2012/Problem07_label52.yml +../../sv-benchmarks/c/eca-rers2012/Problem07_label53.yml +../../sv-benchmarks/c/eca-rers2012/Problem07_label54.yml +../../sv-benchmarks/c/eca-rers2012/Problem07_label55.yml +../../sv-benchmarks/c/eca-rers2012/Problem07_label56.yml +../../sv-benchmarks/c/eca-rers2012/Problem07_label57.yml +../../sv-benchmarks/c/eca-rers2012/Problem07_label58.yml +../../sv-benchmarks/c/eca-rers2012/Problem07_label59.yml +../../sv-benchmarks/c/eca-rers2012/Problem08_label01.yml +../../sv-benchmarks/c/eca-rers2012/Problem08_label02.yml +../../sv-benchmarks/c/eca-rers2012/Problem08_label03.yml +../../sv-benchmarks/c/eca-rers2012/Problem08_label04.yml +../../sv-benchmarks/c/eca-rers2012/Problem08_label05.yml +../../sv-benchmarks/c/eca-rers2012/Problem08_label06.yml +../../sv-benchmarks/c/eca-rers2012/Problem08_label07.yml +../../sv-benchmarks/c/eca-rers2012/Problem08_label08.yml +../../sv-benchmarks/c/eca-rers2012/Problem08_label09.yml +../../sv-benchmarks/c/eca-rers2012/Problem08_label10.yml +../../sv-benchmarks/c/eca-rers2012/Problem08_label11.yml +../../sv-benchmarks/c/eca-rers2012/Problem08_label12.yml +../../sv-benchmarks/c/eca-rers2012/Problem08_label13.yml +../../sv-benchmarks/c/eca-rers2012/Problem08_label14.yml +../../sv-benchmarks/c/eca-rers2012/Problem08_label15.yml +../../sv-benchmarks/c/eca-rers2012/Problem08_label16.yml +../../sv-benchmarks/c/eca-rers2012/Problem08_label17.yml +../../sv-benchmarks/c/eca-rers2012/Problem08_label18.yml +../../sv-benchmarks/c/eca-rers2012/Problem08_label19.yml +../../sv-benchmarks/c/eca-rers2012/Problem08_label20.yml +../../sv-benchmarks/c/eca-rers2012/Problem08_label21.yml +../../sv-benchmarks/c/eca-rers2012/Problem08_label22.yml +../../sv-benchmarks/c/eca-rers2012/Problem08_label23.yml +../../sv-benchmarks/c/eca-rers2012/Problem08_label24.yml +../../sv-benchmarks/c/eca-rers2012/Problem08_label25.yml +../../sv-benchmarks/c/eca-rers2012/Problem08_label26.yml +../../sv-benchmarks/c/eca-rers2012/Problem08_label27.yml +../../sv-benchmarks/c/eca-rers2012/Problem08_label28.yml +../../sv-benchmarks/c/eca-rers2012/Problem08_label29.yml +../../sv-benchmarks/c/eca-rers2012/Problem08_label30.yml +../../sv-benchmarks/c/eca-rers2012/Problem08_label31.yml +../../sv-benchmarks/c/eca-rers2012/Problem08_label32.yml +../../sv-benchmarks/c/eca-rers2012/Problem08_label33.yml +../../sv-benchmarks/c/eca-rers2012/Problem08_label34.yml +../../sv-benchmarks/c/eca-rers2012/Problem08_label35.yml +../../sv-benchmarks/c/eca-rers2012/Problem08_label36.yml +../../sv-benchmarks/c/eca-rers2012/Problem08_label37.yml +../../sv-benchmarks/c/eca-rers2012/Problem08_label38.yml +../../sv-benchmarks/c/eca-rers2012/Problem08_label39.yml +../../sv-benchmarks/c/eca-rers2012/Problem08_label40.yml +../../sv-benchmarks/c/eca-rers2012/Problem08_label41.yml +../../sv-benchmarks/c/eca-rers2012/Problem08_label42.yml +../../sv-benchmarks/c/eca-rers2012/Problem08_label43.yml +../../sv-benchmarks/c/eca-rers2012/Problem08_label44.yml +../../sv-benchmarks/c/eca-rers2012/Problem08_label45.yml +../../sv-benchmarks/c/eca-rers2012/Problem08_label46.yml +../../sv-benchmarks/c/eca-rers2012/Problem08_label47.yml +../../sv-benchmarks/c/eca-rers2012/Problem08_label48.yml +../../sv-benchmarks/c/eca-rers2012/Problem08_label49.yml +../../sv-benchmarks/c/eca-rers2012/Problem08_label50.yml +../../sv-benchmarks/c/eca-rers2012/Problem08_label51.yml +../../sv-benchmarks/c/eca-rers2012/Problem08_label52.yml +../../sv-benchmarks/c/eca-rers2012/Problem08_label53.yml +../../sv-benchmarks/c/eca-rers2012/Problem08_label54.yml +../../sv-benchmarks/c/eca-rers2012/Problem08_label55.yml +../../sv-benchmarks/c/eca-rers2012/Problem08_label56.yml +../../sv-benchmarks/c/eca-rers2012/Problem08_label57.yml +../../sv-benchmarks/c/eca-rers2012/Problem08_label58.yml +../../sv-benchmarks/c/eca-rers2012/Problem08_label59.yml +../../sv-benchmarks/c/eca-rers2012/Problem09_label01.yml +../../sv-benchmarks/c/eca-rers2012/Problem09_label02.yml +../../sv-benchmarks/c/eca-rers2012/Problem09_label03.yml +../../sv-benchmarks/c/eca-rers2012/Problem09_label04.yml +../../sv-benchmarks/c/eca-rers2012/Problem09_label05.yml +../../sv-benchmarks/c/eca-rers2012/Problem09_label06.yml +../../sv-benchmarks/c/eca-rers2012/Problem09_label07.yml +../../sv-benchmarks/c/eca-rers2012/Problem09_label08.yml +../../sv-benchmarks/c/eca-rers2012/Problem09_label09.yml +../../sv-benchmarks/c/eca-rers2012/Problem09_label10.yml +../../sv-benchmarks/c/eca-rers2012/Problem09_label11.yml +../../sv-benchmarks/c/eca-rers2012/Problem09_label12.yml +../../sv-benchmarks/c/eca-rers2012/Problem09_label13.yml +../../sv-benchmarks/c/eca-rers2012/Problem09_label14.yml +../../sv-benchmarks/c/eca-rers2012/Problem09_label15.yml +../../sv-benchmarks/c/eca-rers2012/Problem09_label16.yml +../../sv-benchmarks/c/eca-rers2012/Problem09_label17.yml +../../sv-benchmarks/c/eca-rers2012/Problem09_label18.yml +../../sv-benchmarks/c/eca-rers2012/Problem09_label19.yml +../../sv-benchmarks/c/eca-rers2012/Problem09_label20.yml +../../sv-benchmarks/c/eca-rers2012/Problem09_label21.yml +../../sv-benchmarks/c/eca-rers2012/Problem09_label22.yml +../../sv-benchmarks/c/eca-rers2012/Problem09_label23.yml +../../sv-benchmarks/c/eca-rers2012/Problem09_label24.yml +../../sv-benchmarks/c/eca-rers2012/Problem09_label25.yml +../../sv-benchmarks/c/eca-rers2012/Problem09_label26.yml +../../sv-benchmarks/c/eca-rers2012/Problem09_label27.yml +../../sv-benchmarks/c/eca-rers2012/Problem09_label28.yml +../../sv-benchmarks/c/eca-rers2012/Problem09_label29.yml +../../sv-benchmarks/c/eca-rers2012/Problem09_label30.yml +../../sv-benchmarks/c/eca-rers2012/Problem09_label31.yml +../../sv-benchmarks/c/eca-rers2012/Problem09_label32.yml +../../sv-benchmarks/c/eca-rers2012/Problem09_label33.yml +../../sv-benchmarks/c/eca-rers2012/Problem09_label34.yml +../../sv-benchmarks/c/eca-rers2012/Problem09_label35.yml +../../sv-benchmarks/c/eca-rers2012/Problem09_label36.yml +../../sv-benchmarks/c/eca-rers2012/Problem09_label37.yml +../../sv-benchmarks/c/eca-rers2012/Problem09_label38.yml +../../sv-benchmarks/c/eca-rers2012/Problem09_label39.yml +../../sv-benchmarks/c/eca-rers2012/Problem09_label40.yml +../../sv-benchmarks/c/eca-rers2012/Problem09_label41.yml +../../sv-benchmarks/c/eca-rers2012/Problem09_label42.yml +../../sv-benchmarks/c/eca-rers2012/Problem09_label43.yml +../../sv-benchmarks/c/eca-rers2012/Problem09_label44.yml +../../sv-benchmarks/c/eca-rers2012/Problem09_label45.yml +../../sv-benchmarks/c/eca-rers2012/Problem09_label46.yml +../../sv-benchmarks/c/eca-rers2012/Problem09_label47.yml +../../sv-benchmarks/c/eca-rers2012/Problem09_label48.yml +../../sv-benchmarks/c/eca-rers2012/Problem09_label49.yml +../../sv-benchmarks/c/eca-rers2012/Problem09_label50.yml +../../sv-benchmarks/c/eca-rers2012/Problem09_label51.yml +../../sv-benchmarks/c/eca-rers2012/Problem09_label52.yml +../../sv-benchmarks/c/eca-rers2012/Problem09_label53.yml +../../sv-benchmarks/c/eca-rers2012/Problem09_label54.yml +../../sv-benchmarks/c/eca-rers2012/Problem09_label55.yml +../../sv-benchmarks/c/eca-rers2012/Problem09_label56.yml +../../sv-benchmarks/c/eca-rers2012/Problem09_label57.yml +../../sv-benchmarks/c/eca-rers2012/Problem09_label58.yml +../../sv-benchmarks/c/eca-rers2012/Problem09_label59.yml +../../sv-benchmarks/c/eca-rers2012/Problem10_label01.yml +../../sv-benchmarks/c/eca-rers2012/Problem10_label02.yml +../../sv-benchmarks/c/eca-rers2012/Problem10_label03.yml +../../sv-benchmarks/c/eca-rers2012/Problem10_label04.yml +../../sv-benchmarks/c/eca-rers2012/Problem10_label05.yml +../../sv-benchmarks/c/eca-rers2012/Problem10_label06.yml +../../sv-benchmarks/c/eca-rers2012/Problem10_label07.yml +../../sv-benchmarks/c/eca-rers2012/Problem10_label08.yml +../../sv-benchmarks/c/eca-rers2012/Problem10_label09.yml +../../sv-benchmarks/c/eca-rers2012/Problem10_label10.yml +../../sv-benchmarks/c/eca-rers2012/Problem10_label11.yml +../../sv-benchmarks/c/eca-rers2012/Problem10_label12.yml +../../sv-benchmarks/c/eca-rers2012/Problem10_label13.yml +../../sv-benchmarks/c/eca-rers2012/Problem10_label14.yml +../../sv-benchmarks/c/eca-rers2012/Problem10_label15.yml +../../sv-benchmarks/c/eca-rers2012/Problem10_label16.yml +../../sv-benchmarks/c/eca-rers2012/Problem10_label17.yml +../../sv-benchmarks/c/eca-rers2012/Problem10_label18.yml +../../sv-benchmarks/c/eca-rers2012/Problem10_label19.yml +../../sv-benchmarks/c/eca-rers2012/Problem10_label20.yml +../../sv-benchmarks/c/eca-rers2012/Problem10_label21.yml +../../sv-benchmarks/c/eca-rers2012/Problem10_label22.yml +../../sv-benchmarks/c/eca-rers2012/Problem10_label23.yml +../../sv-benchmarks/c/eca-rers2012/Problem10_label24.yml +../../sv-benchmarks/c/eca-rers2012/Problem10_label25.yml +../../sv-benchmarks/c/eca-rers2012/Problem10_label26.yml +../../sv-benchmarks/c/eca-rers2012/Problem10_label27.yml +../../sv-benchmarks/c/eca-rers2012/Problem10_label28.yml +../../sv-benchmarks/c/eca-rers2012/Problem10_label29.yml +../../sv-benchmarks/c/eca-rers2012/Problem10_label30.yml +../../sv-benchmarks/c/eca-rers2012/Problem10_label31.yml +../../sv-benchmarks/c/eca-rers2012/Problem10_label32.yml +../../sv-benchmarks/c/eca-rers2012/Problem10_label33.yml +../../sv-benchmarks/c/eca-rers2012/Problem10_label34.yml +../../sv-benchmarks/c/eca-rers2012/Problem10_label35.yml +../../sv-benchmarks/c/eca-rers2012/Problem10_label36.yml +../../sv-benchmarks/c/eca-rers2012/Problem10_label37.yml +../../sv-benchmarks/c/eca-rers2012/Problem10_label38.yml +../../sv-benchmarks/c/eca-rers2012/Problem10_label39.yml +../../sv-benchmarks/c/eca-rers2012/Problem10_label40.yml +../../sv-benchmarks/c/eca-rers2012/Problem10_label41.yml +../../sv-benchmarks/c/eca-rers2012/Problem10_label42.yml +../../sv-benchmarks/c/eca-rers2012/Problem10_label43.yml +../../sv-benchmarks/c/eca-rers2012/Problem10_label44.yml +../../sv-benchmarks/c/eca-rers2012/Problem10_label45.yml +../../sv-benchmarks/c/eca-rers2012/Problem10_label46.yml +../../sv-benchmarks/c/eca-rers2012/Problem10_label47.yml +../../sv-benchmarks/c/eca-rers2012/Problem10_label48.yml +../../sv-benchmarks/c/eca-rers2012/Problem10_label49.yml +../../sv-benchmarks/c/eca-rers2012/Problem10_label50.yml +../../sv-benchmarks/c/eca-rers2012/Problem10_label51.yml +../../sv-benchmarks/c/eca-rers2012/Problem10_label52.yml +../../sv-benchmarks/c/eca-rers2012/Problem10_label53.yml +../../sv-benchmarks/c/eca-rers2012/Problem10_label54.yml +../../sv-benchmarks/c/eca-rers2012/Problem10_label55.yml +../../sv-benchmarks/c/eca-rers2012/Problem10_label56.yml +../../sv-benchmarks/c/eca-rers2012/Problem10_label57.yml +../../sv-benchmarks/c/eca-rers2012/Problem10_label58.yml +../../sv-benchmarks/c/eca-rers2012/Problem10_label59.yml +../../sv-benchmarks/c/eca-rers2012/Problem11_label01.yml +../../sv-benchmarks/c/eca-rers2012/Problem11_label02.yml +../../sv-benchmarks/c/eca-rers2012/Problem11_label03.yml +../../sv-benchmarks/c/eca-rers2012/Problem11_label04.yml +../../sv-benchmarks/c/eca-rers2012/Problem11_label05.yml +../../sv-benchmarks/c/eca-rers2012/Problem11_label06.yml +../../sv-benchmarks/c/eca-rers2012/Problem11_label07.yml +../../sv-benchmarks/c/eca-rers2012/Problem11_label08.yml +../../sv-benchmarks/c/eca-rers2012/Problem11_label09.yml +../../sv-benchmarks/c/eca-rers2012/Problem11_label10.yml +../../sv-benchmarks/c/eca-rers2012/Problem11_label11.yml +../../sv-benchmarks/c/eca-rers2012/Problem11_label12.yml +../../sv-benchmarks/c/eca-rers2012/Problem11_label13.yml +../../sv-benchmarks/c/eca-rers2012/Problem11_label14.yml +../../sv-benchmarks/c/eca-rers2012/Problem11_label15.yml +../../sv-benchmarks/c/eca-rers2012/Problem11_label16.yml +../../sv-benchmarks/c/eca-rers2012/Problem11_label17.yml +../../sv-benchmarks/c/eca-rers2012/Problem11_label18.yml +../../sv-benchmarks/c/eca-rers2012/Problem11_label19.yml +../../sv-benchmarks/c/eca-rers2012/Problem11_label20.yml +../../sv-benchmarks/c/eca-rers2012/Problem11_label21.yml +../../sv-benchmarks/c/eca-rers2012/Problem11_label22.yml +../../sv-benchmarks/c/eca-rers2012/Problem11_label23.yml +../../sv-benchmarks/c/eca-rers2012/Problem11_label24.yml +../../sv-benchmarks/c/eca-rers2012/Problem11_label25.yml +../../sv-benchmarks/c/eca-rers2012/Problem11_label26.yml +../../sv-benchmarks/c/eca-rers2012/Problem11_label27.yml +../../sv-benchmarks/c/eca-rers2012/Problem11_label28.yml +../../sv-benchmarks/c/eca-rers2012/Problem11_label29.yml +../../sv-benchmarks/c/eca-rers2012/Problem11_label30.yml +../../sv-benchmarks/c/eca-rers2012/Problem11_label31.yml +../../sv-benchmarks/c/eca-rers2012/Problem11_label32.yml +../../sv-benchmarks/c/eca-rers2012/Problem11_label33.yml +../../sv-benchmarks/c/eca-rers2012/Problem11_label34.yml +../../sv-benchmarks/c/eca-rers2012/Problem11_label35.yml +../../sv-benchmarks/c/eca-rers2012/Problem11_label36.yml +../../sv-benchmarks/c/eca-rers2012/Problem11_label37.yml +../../sv-benchmarks/c/eca-rers2012/Problem11_label38.yml +../../sv-benchmarks/c/eca-rers2012/Problem11_label39.yml +../../sv-benchmarks/c/eca-rers2012/Problem11_label40.yml +../../sv-benchmarks/c/eca-rers2012/Problem11_label41.yml +../../sv-benchmarks/c/eca-rers2012/Problem11_label42.yml +../../sv-benchmarks/c/eca-rers2012/Problem11_label43.yml +../../sv-benchmarks/c/eca-rers2012/Problem11_label44.yml +../../sv-benchmarks/c/eca-rers2012/Problem11_label45.yml +../../sv-benchmarks/c/eca-rers2012/Problem11_label46.yml +../../sv-benchmarks/c/eca-rers2012/Problem11_label47.yml +../../sv-benchmarks/c/eca-rers2012/Problem11_label48.yml +../../sv-benchmarks/c/eca-rers2012/Problem11_label49.yml +../../sv-benchmarks/c/eca-rers2012/Problem11_label50.yml +../../sv-benchmarks/c/eca-rers2012/Problem11_label51.yml +../../sv-benchmarks/c/eca-rers2012/Problem11_label52.yml +../../sv-benchmarks/c/eca-rers2012/Problem11_label53.yml +../../sv-benchmarks/c/eca-rers2012/Problem11_label54.yml +../../sv-benchmarks/c/eca-rers2012/Problem11_label55.yml +../../sv-benchmarks/c/eca-rers2012/Problem11_label56.yml +../../sv-benchmarks/c/eca-rers2012/Problem11_label57.yml +../../sv-benchmarks/c/eca-rers2012/Problem11_label58.yml +../../sv-benchmarks/c/eca-rers2012/Problem11_label59.yml +../../sv-benchmarks/c/eca-rers2012/Problem12_label01.yml +../../sv-benchmarks/c/eca-rers2012/Problem12_label02.yml +../../sv-benchmarks/c/eca-rers2012/Problem12_label03.yml +../../sv-benchmarks/c/eca-rers2012/Problem12_label04.yml +../../sv-benchmarks/c/eca-rers2012/Problem12_label05.yml +../../sv-benchmarks/c/eca-rers2012/Problem12_label06.yml +../../sv-benchmarks/c/eca-rers2012/Problem12_label07.yml +../../sv-benchmarks/c/eca-rers2012/Problem12_label08.yml +../../sv-benchmarks/c/eca-rers2012/Problem12_label09.yml +../../sv-benchmarks/c/eca-rers2012/Problem12_label10.yml +../../sv-benchmarks/c/eca-rers2012/Problem12_label11.yml +../../sv-benchmarks/c/eca-rers2012/Problem12_label12.yml +../../sv-benchmarks/c/eca-rers2012/Problem12_label13.yml +../../sv-benchmarks/c/eca-rers2012/Problem12_label14.yml +../../sv-benchmarks/c/eca-rers2012/Problem12_label15.yml +../../sv-benchmarks/c/eca-rers2012/Problem12_label16.yml +../../sv-benchmarks/c/eca-rers2012/Problem12_label17.yml +../../sv-benchmarks/c/eca-rers2012/Problem12_label18.yml +../../sv-benchmarks/c/eca-rers2012/Problem12_label19.yml +../../sv-benchmarks/c/eca-rers2012/Problem12_label20.yml +../../sv-benchmarks/c/eca-rers2012/Problem12_label21.yml +../../sv-benchmarks/c/eca-rers2012/Problem12_label22.yml +../../sv-benchmarks/c/eca-rers2012/Problem12_label23.yml +../../sv-benchmarks/c/eca-rers2012/Problem12_label24.yml +../../sv-benchmarks/c/eca-rers2012/Problem12_label25.yml +../../sv-benchmarks/c/eca-rers2012/Problem12_label26.yml +../../sv-benchmarks/c/eca-rers2012/Problem12_label27.yml +../../sv-benchmarks/c/eca-rers2012/Problem12_label28.yml +../../sv-benchmarks/c/eca-rers2012/Problem12_label29.yml +../../sv-benchmarks/c/eca-rers2012/Problem12_label30.yml +../../sv-benchmarks/c/eca-rers2012/Problem12_label31.yml +../../sv-benchmarks/c/eca-rers2012/Problem12_label32.yml +../../sv-benchmarks/c/eca-rers2012/Problem12_label33.yml +../../sv-benchmarks/c/eca-rers2012/Problem12_label34.yml +../../sv-benchmarks/c/eca-rers2012/Problem12_label35.yml +../../sv-benchmarks/c/eca-rers2012/Problem12_label36.yml +../../sv-benchmarks/c/eca-rers2012/Problem12_label37.yml +../../sv-benchmarks/c/eca-rers2012/Problem12_label38.yml +../../sv-benchmarks/c/eca-rers2012/Problem12_label39.yml +../../sv-benchmarks/c/eca-rers2012/Problem12_label40.yml +../../sv-benchmarks/c/eca-rers2012/Problem12_label41.yml +../../sv-benchmarks/c/eca-rers2012/Problem12_label42.yml +../../sv-benchmarks/c/eca-rers2012/Problem12_label43.yml +../../sv-benchmarks/c/eca-rers2012/Problem12_label44.yml +../../sv-benchmarks/c/eca-rers2012/Problem12_label45.yml +../../sv-benchmarks/c/eca-rers2012/Problem12_label46.yml +../../sv-benchmarks/c/eca-rers2012/Problem12_label47.yml +../../sv-benchmarks/c/eca-rers2012/Problem12_label48.yml +../../sv-benchmarks/c/eca-rers2012/Problem12_label49.yml +../../sv-benchmarks/c/eca-rers2012/Problem12_label50.yml +../../sv-benchmarks/c/eca-rers2012/Problem12_label51.yml +../../sv-benchmarks/c/eca-rers2012/Problem12_label52.yml +../../sv-benchmarks/c/eca-rers2012/Problem12_label53.yml +../../sv-benchmarks/c/eca-rers2012/Problem12_label54.yml +../../sv-benchmarks/c/eca-rers2012/Problem12_label55.yml +../../sv-benchmarks/c/eca-rers2012/Problem12_label56.yml +../../sv-benchmarks/c/eca-rers2012/Problem12_label57.yml +../../sv-benchmarks/c/eca-rers2012/Problem12_label58.yml +../../sv-benchmarks/c/eca-rers2012/Problem12_label59.yml +../../sv-benchmarks/c/eca-rers2012/Problem13_label01.yml +../../sv-benchmarks/c/eca-rers2012/Problem13_label02.yml +../../sv-benchmarks/c/eca-rers2012/Problem13_label03.yml +../../sv-benchmarks/c/eca-rers2012/Problem13_label04.yml +../../sv-benchmarks/c/eca-rers2012/Problem13_label05.yml +../../sv-benchmarks/c/eca-rers2012/Problem13_label06.yml +../../sv-benchmarks/c/eca-rers2012/Problem13_label07.yml +../../sv-benchmarks/c/eca-rers2012/Problem13_label08.yml +../../sv-benchmarks/c/eca-rers2012/Problem13_label09.yml +../../sv-benchmarks/c/eca-rers2012/Problem13_label10.yml +../../sv-benchmarks/c/eca-rers2012/Problem13_label11.yml +../../sv-benchmarks/c/eca-rers2012/Problem13_label12.yml +../../sv-benchmarks/c/eca-rers2012/Problem13_label13.yml +../../sv-benchmarks/c/eca-rers2012/Problem13_label14.yml +../../sv-benchmarks/c/eca-rers2012/Problem13_label15.yml +../../sv-benchmarks/c/eca-rers2012/Problem13_label16.yml +../../sv-benchmarks/c/eca-rers2012/Problem13_label17.yml +../../sv-benchmarks/c/eca-rers2012/Problem13_label18.yml +../../sv-benchmarks/c/eca-rers2012/Problem13_label19.yml +../../sv-benchmarks/c/eca-rers2012/Problem13_label20.yml +../../sv-benchmarks/c/eca-rers2012/Problem13_label21.yml +../../sv-benchmarks/c/eca-rers2012/Problem13_label22.yml +../../sv-benchmarks/c/eca-rers2012/Problem13_label23.yml +../../sv-benchmarks/c/eca-rers2012/Problem13_label24.yml +../../sv-benchmarks/c/eca-rers2012/Problem13_label25.yml +../../sv-benchmarks/c/eca-rers2012/Problem13_label26.yml +../../sv-benchmarks/c/eca-rers2012/Problem13_label27.yml +../../sv-benchmarks/c/eca-rers2012/Problem13_label28.yml +../../sv-benchmarks/c/eca-rers2012/Problem13_label29.yml +../../sv-benchmarks/c/eca-rers2012/Problem13_label30.yml +../../sv-benchmarks/c/eca-rers2012/Problem13_label31.yml +../../sv-benchmarks/c/eca-rers2012/Problem13_label32.yml +../../sv-benchmarks/c/eca-rers2012/Problem13_label33.yml +../../sv-benchmarks/c/eca-rers2012/Problem13_label34.yml +../../sv-benchmarks/c/eca-rers2012/Problem13_label35.yml +../../sv-benchmarks/c/eca-rers2012/Problem13_label36.yml +../../sv-benchmarks/c/eca-rers2012/Problem13_label37.yml +../../sv-benchmarks/c/eca-rers2012/Problem13_label38.yml +../../sv-benchmarks/c/eca-rers2012/Problem13_label39.yml +../../sv-benchmarks/c/eca-rers2012/Problem13_label40.yml +../../sv-benchmarks/c/eca-rers2012/Problem13_label41.yml +../../sv-benchmarks/c/eca-rers2012/Problem13_label42.yml +../../sv-benchmarks/c/eca-rers2012/Problem13_label43.yml +../../sv-benchmarks/c/eca-rers2012/Problem13_label44.yml +../../sv-benchmarks/c/eca-rers2012/Problem13_label45.yml +../../sv-benchmarks/c/eca-rers2012/Problem13_label46.yml +../../sv-benchmarks/c/eca-rers2012/Problem13_label47.yml +../../sv-benchmarks/c/eca-rers2012/Problem13_label48.yml +../../sv-benchmarks/c/eca-rers2012/Problem13_label49.yml +../../sv-benchmarks/c/eca-rers2012/Problem13_label50.yml +../../sv-benchmarks/c/eca-rers2012/Problem13_label51.yml +../../sv-benchmarks/c/eca-rers2012/Problem13_label52.yml +../../sv-benchmarks/c/eca-rers2012/Problem13_label53.yml +../../sv-benchmarks/c/eca-rers2012/Problem13_label54.yml +../../sv-benchmarks/c/eca-rers2012/Problem13_label55.yml +../../sv-benchmarks/c/eca-rers2012/Problem13_label56.yml +../../sv-benchmarks/c/eca-rers2012/Problem13_label57.yml +../../sv-benchmarks/c/eca-rers2012/Problem13_label58.yml +../../sv-benchmarks/c/eca-rers2012/Problem13_label59.yml +../../sv-benchmarks/c/eca-rers2012/Problem15_label01.yml +../../sv-benchmarks/c/eca-rers2012/Problem15_label02.yml +../../sv-benchmarks/c/eca-rers2012/Problem15_label03.yml +../../sv-benchmarks/c/eca-rers2012/Problem15_label04.yml +../../sv-benchmarks/c/eca-rers2012/Problem15_label05.yml +../../sv-benchmarks/c/eca-rers2012/Problem15_label06.yml +../../sv-benchmarks/c/eca-rers2012/Problem15_label07.yml +../../sv-benchmarks/c/eca-rers2012/Problem15_label08.yml +../../sv-benchmarks/c/eca-rers2012/Problem15_label09.yml +../../sv-benchmarks/c/eca-rers2012/Problem15_label10.yml +../../sv-benchmarks/c/eca-rers2012/Problem15_label11.yml +../../sv-benchmarks/c/eca-rers2012/Problem15_label12.yml +../../sv-benchmarks/c/eca-rers2012/Problem15_label13.yml +../../sv-benchmarks/c/eca-rers2012/Problem15_label14.yml +../../sv-benchmarks/c/eca-rers2012/Problem15_label15.yml +../../sv-benchmarks/c/eca-rers2012/Problem15_label16.yml +../../sv-benchmarks/c/eca-rers2012/Problem15_label17.yml +../../sv-benchmarks/c/eca-rers2012/Problem15_label19.yml +../../sv-benchmarks/c/eca-rers2012/Problem15_label20.yml +../../sv-benchmarks/c/eca-rers2012/Problem15_label21.yml +../../sv-benchmarks/c/eca-rers2012/Problem15_label22.yml +../../sv-benchmarks/c/eca-rers2012/Problem15_label23.yml +../../sv-benchmarks/c/eca-rers2012/Problem15_label24.yml +../../sv-benchmarks/c/eca-rers2012/Problem15_label25.yml +../../sv-benchmarks/c/eca-rers2012/Problem15_label26.yml +../../sv-benchmarks/c/eca-rers2012/Problem15_label27.yml +../../sv-benchmarks/c/eca-rers2012/Problem15_label28.yml +../../sv-benchmarks/c/eca-rers2012/Problem15_label29.yml +../../sv-benchmarks/c/eca-rers2012/Problem15_label30.yml +../../sv-benchmarks/c/eca-rers2012/Problem15_label31.yml +../../sv-benchmarks/c/eca-rers2012/Problem15_label32.yml +../../sv-benchmarks/c/eca-rers2012/Problem15_label33.yml +../../sv-benchmarks/c/eca-rers2012/Problem15_label34.yml +../../sv-benchmarks/c/eca-rers2012/Problem15_label35.yml +../../sv-benchmarks/c/eca-rers2012/Problem15_label36.yml +../../sv-benchmarks/c/eca-rers2012/Problem15_label37.yml +../../sv-benchmarks/c/eca-rers2012/Problem15_label38.yml +../../sv-benchmarks/c/eca-rers2012/Problem15_label39.yml +../../sv-benchmarks/c/eca-rers2012/Problem15_label40.yml +../../sv-benchmarks/c/eca-rers2012/Problem15_label41.yml +../../sv-benchmarks/c/eca-rers2012/Problem15_label42.yml +../../sv-benchmarks/c/eca-rers2012/Problem15_label43.yml +../../sv-benchmarks/c/eca-rers2012/Problem15_label44.yml +../../sv-benchmarks/c/eca-rers2012/Problem15_label45.yml +../../sv-benchmarks/c/eca-rers2012/Problem15_label46.yml +../../sv-benchmarks/c/eca-rers2012/Problem15_label47.yml +../../sv-benchmarks/c/eca-rers2012/Problem15_label48.yml +../../sv-benchmarks/c/eca-rers2012/Problem15_label49.yml +../../sv-benchmarks/c/eca-rers2012/Problem15_label50.yml +../../sv-benchmarks/c/eca-rers2012/Problem15_label51.yml +../../sv-benchmarks/c/eca-rers2012/Problem15_label52.yml +../../sv-benchmarks/c/eca-rers2012/Problem15_label53.yml +../../sv-benchmarks/c/eca-rers2012/Problem15_label54.yml +../../sv-benchmarks/c/eca-rers2012/Problem15_label55.yml +../../sv-benchmarks/c/eca-rers2012/Problem15_label56.yml +../../sv-benchmarks/c/eca-rers2012/Problem15_label57.yml +../../sv-benchmarks/c/eca-rers2012/Problem15_label58.yml +../../sv-benchmarks/c/eca-rers2012/Problem15_label59.yml +../../sv-benchmarks/c/eca-rers2012/Problem16_label01.yml +../../sv-benchmarks/c/eca-rers2012/Problem16_label02.yml +../../sv-benchmarks/c/eca-rers2012/Problem16_label03.yml +../../sv-benchmarks/c/eca-rers2012/Problem16_label04.yml +../../sv-benchmarks/c/eca-rers2012/Problem16_label05.yml +../../sv-benchmarks/c/eca-rers2012/Problem16_label06.yml +../../sv-benchmarks/c/eca-rers2012/Problem16_label07.yml +../../sv-benchmarks/c/eca-rers2012/Problem16_label08.yml +../../sv-benchmarks/c/eca-rers2012/Problem16_label09.yml +../../sv-benchmarks/c/eca-rers2012/Problem16_label10.yml +../../sv-benchmarks/c/eca-rers2012/Problem16_label11.yml +../../sv-benchmarks/c/eca-rers2012/Problem16_label12.yml +../../sv-benchmarks/c/eca-rers2012/Problem16_label13.yml +../../sv-benchmarks/c/eca-rers2012/Problem16_label14.yml +../../sv-benchmarks/c/eca-rers2012/Problem16_label15.yml +../../sv-benchmarks/c/eca-rers2012/Problem16_label16.yml +../../sv-benchmarks/c/eca-rers2012/Problem16_label17.yml +../../sv-benchmarks/c/eca-rers2012/Problem16_label18.yml +../../sv-benchmarks/c/eca-rers2012/Problem16_label19.yml +../../sv-benchmarks/c/eca-rers2012/Problem16_label20.yml +../../sv-benchmarks/c/eca-rers2012/Problem16_label21.yml +../../sv-benchmarks/c/eca-rers2012/Problem16_label22.yml +../../sv-benchmarks/c/eca-rers2012/Problem16_label23.yml +../../sv-benchmarks/c/eca-rers2012/Problem16_label24.yml +../../sv-benchmarks/c/eca-rers2012/Problem16_label25.yml +../../sv-benchmarks/c/eca-rers2012/Problem16_label26.yml +../../sv-benchmarks/c/eca-rers2012/Problem16_label27.yml +../../sv-benchmarks/c/eca-rers2012/Problem16_label28.yml +../../sv-benchmarks/c/eca-rers2012/Problem16_label29.yml +../../sv-benchmarks/c/eca-rers2012/Problem16_label30.yml +../../sv-benchmarks/c/eca-rers2012/Problem16_label31.yml +../../sv-benchmarks/c/eca-rers2012/Problem16_label32.yml +../../sv-benchmarks/c/eca-rers2012/Problem16_label33.yml +../../sv-benchmarks/c/eca-rers2012/Problem16_label34.yml +../../sv-benchmarks/c/eca-rers2012/Problem16_label35.yml +../../sv-benchmarks/c/eca-rers2012/Problem16_label36.yml +../../sv-benchmarks/c/eca-rers2012/Problem16_label37.yml +../../sv-benchmarks/c/eca-rers2012/Problem16_label38.yml +../../sv-benchmarks/c/eca-rers2012/Problem16_label39.yml +../../sv-benchmarks/c/eca-rers2012/Problem16_label40.yml +../../sv-benchmarks/c/eca-rers2012/Problem16_label41.yml +../../sv-benchmarks/c/eca-rers2012/Problem16_label42.yml +../../sv-benchmarks/c/eca-rers2012/Problem16_label43.yml +../../sv-benchmarks/c/eca-rers2012/Problem16_label44.yml +../../sv-benchmarks/c/eca-rers2012/Problem16_label45.yml +../../sv-benchmarks/c/eca-rers2012/Problem16_label46.yml +../../sv-benchmarks/c/eca-rers2012/Problem16_label47.yml +../../sv-benchmarks/c/eca-rers2012/Problem16_label48.yml +../../sv-benchmarks/c/eca-rers2012/Problem16_label49.yml +../../sv-benchmarks/c/eca-rers2012/Problem16_label50.yml +../../sv-benchmarks/c/eca-rers2012/Problem16_label51.yml +../../sv-benchmarks/c/eca-rers2012/Problem16_label52.yml +../../sv-benchmarks/c/eca-rers2012/Problem16_label53.yml +../../sv-benchmarks/c/eca-rers2012/Problem16_label54.yml +../../sv-benchmarks/c/eca-rers2012/Problem16_label55.yml +../../sv-benchmarks/c/eca-rers2012/Problem16_label56.yml +../../sv-benchmarks/c/eca-rers2012/Problem16_label57.yml +../../sv-benchmarks/c/eca-rers2012/Problem16_label58.yml +../../sv-benchmarks/c/eca-rers2012/Problem16_label59.yml +../../sv-benchmarks/c/eca-rers2012/Problem17_label01.yml +../../sv-benchmarks/c/eca-rers2012/Problem17_label02.yml +../../sv-benchmarks/c/eca-rers2012/Problem17_label03.yml +../../sv-benchmarks/c/eca-rers2012/Problem17_label04.yml +../../sv-benchmarks/c/eca-rers2012/Problem17_label05.yml +../../sv-benchmarks/c/eca-rers2012/Problem17_label06.yml +../../sv-benchmarks/c/eca-rers2012/Problem17_label07.yml +../../sv-benchmarks/c/eca-rers2012/Problem17_label08.yml +../../sv-benchmarks/c/eca-rers2012/Problem17_label09.yml +../../sv-benchmarks/c/eca-rers2012/Problem17_label10.yml +../../sv-benchmarks/c/eca-rers2012/Problem17_label11.yml +../../sv-benchmarks/c/eca-rers2012/Problem17_label12.yml +../../sv-benchmarks/c/eca-rers2012/Problem17_label13.yml +../../sv-benchmarks/c/eca-rers2012/Problem17_label14.yml +../../sv-benchmarks/c/eca-rers2012/Problem17_label15.yml +../../sv-benchmarks/c/eca-rers2012/Problem17_label16.yml +../../sv-benchmarks/c/eca-rers2012/Problem17_label17.yml +../../sv-benchmarks/c/eca-rers2012/Problem17_label18.yml +../../sv-benchmarks/c/eca-rers2012/Problem17_label19.yml +../../sv-benchmarks/c/eca-rers2012/Problem17_label20.yml +../../sv-benchmarks/c/eca-rers2012/Problem17_label21.yml +../../sv-benchmarks/c/eca-rers2012/Problem17_label22.yml +../../sv-benchmarks/c/eca-rers2012/Problem17_label23.yml +../../sv-benchmarks/c/eca-rers2012/Problem17_label24.yml +../../sv-benchmarks/c/eca-rers2012/Problem17_label25.yml +../../sv-benchmarks/c/eca-rers2012/Problem17_label26.yml +../../sv-benchmarks/c/eca-rers2012/Problem17_label27.yml +../../sv-benchmarks/c/eca-rers2012/Problem17_label28.yml +../../sv-benchmarks/c/eca-rers2012/Problem17_label29.yml +../../sv-benchmarks/c/eca-rers2012/Problem17_label30.yml +../../sv-benchmarks/c/eca-rers2012/Problem17_label31.yml +../../sv-benchmarks/c/eca-rers2012/Problem17_label32.yml +../../sv-benchmarks/c/eca-rers2012/Problem17_label33.yml +../../sv-benchmarks/c/eca-rers2012/Problem17_label34.yml +../../sv-benchmarks/c/eca-rers2012/Problem17_label35.yml +../../sv-benchmarks/c/eca-rers2012/Problem17_label36.yml +../../sv-benchmarks/c/eca-rers2012/Problem17_label37.yml +../../sv-benchmarks/c/eca-rers2012/Problem17_label38.yml +../../sv-benchmarks/c/eca-rers2012/Problem17_label39.yml +../../sv-benchmarks/c/eca-rers2012/Problem17_label40.yml +../../sv-benchmarks/c/eca-rers2012/Problem17_label41.yml +../../sv-benchmarks/c/eca-rers2012/Problem17_label42.yml +../../sv-benchmarks/c/eca-rers2012/Problem17_label43.yml +../../sv-benchmarks/c/eca-rers2012/Problem17_label44.yml +../../sv-benchmarks/c/eca-rers2012/Problem17_label45.yml +../../sv-benchmarks/c/eca-rers2012/Problem17_label46.yml +../../sv-benchmarks/c/eca-rers2012/Problem17_label47.yml +../../sv-benchmarks/c/eca-rers2012/Problem17_label48.yml +../../sv-benchmarks/c/eca-rers2012/Problem17_label49.yml +../../sv-benchmarks/c/eca-rers2012/Problem17_label50.yml +../../sv-benchmarks/c/eca-rers2012/Problem17_label51.yml +../../sv-benchmarks/c/eca-rers2012/Problem17_label52.yml +../../sv-benchmarks/c/eca-rers2012/Problem17_label53.yml +../../sv-benchmarks/c/eca-rers2012/Problem17_label54.yml +../../sv-benchmarks/c/eca-rers2012/Problem17_label55.yml +../../sv-benchmarks/c/eca-rers2012/Problem17_label56.yml +../../sv-benchmarks/c/eca-rers2012/Problem17_label57.yml +../../sv-benchmarks/c/eca-rers2012/Problem17_label58.yml +../../sv-benchmarks/c/eca-rers2012/Problem17_label59.yml +../../sv-benchmarks/c/eca-rers2012/Problem18_label01.yml +../../sv-benchmarks/c/eca-rers2012/Problem18_label02.yml +../../sv-benchmarks/c/eca-rers2012/Problem18_label03.yml +../../sv-benchmarks/c/eca-rers2012/Problem18_label04.yml +../../sv-benchmarks/c/eca-rers2012/Problem18_label05.yml +../../sv-benchmarks/c/eca-rers2012/Problem18_label06.yml +../../sv-benchmarks/c/eca-rers2012/Problem18_label07.yml +../../sv-benchmarks/c/eca-rers2012/Problem18_label08.yml +../../sv-benchmarks/c/eca-rers2012/Problem18_label09.yml +../../sv-benchmarks/c/eca-rers2012/Problem18_label10.yml +../../sv-benchmarks/c/eca-rers2012/Problem18_label11.yml +../../sv-benchmarks/c/eca-rers2012/Problem18_label12.yml +../../sv-benchmarks/c/eca-rers2012/Problem18_label13.yml +../../sv-benchmarks/c/eca-rers2012/Problem18_label14.yml +../../sv-benchmarks/c/eca-rers2012/Problem18_label15.yml +../../sv-benchmarks/c/eca-rers2012/Problem18_label16.yml +../../sv-benchmarks/c/eca-rers2012/Problem18_label17.yml +../../sv-benchmarks/c/eca-rers2012/Problem18_label18.yml +../../sv-benchmarks/c/eca-rers2012/Problem18_label19.yml +../../sv-benchmarks/c/eca-rers2012/Problem18_label20.yml +../../sv-benchmarks/c/eca-rers2012/Problem18_label21.yml +../../sv-benchmarks/c/eca-rers2012/Problem18_label22.yml +../../sv-benchmarks/c/eca-rers2012/Problem18_label23.yml +../../sv-benchmarks/c/eca-rers2012/Problem18_label24.yml +../../sv-benchmarks/c/eca-rers2012/Problem18_label25.yml +../../sv-benchmarks/c/eca-rers2012/Problem18_label26.yml +../../sv-benchmarks/c/eca-rers2012/Problem18_label27.yml +../../sv-benchmarks/c/eca-rers2012/Problem18_label28.yml +../../sv-benchmarks/c/eca-rers2012/Problem18_label29.yml +../../sv-benchmarks/c/eca-rers2012/Problem18_label30.yml +../../sv-benchmarks/c/eca-rers2012/Problem18_label31.yml +../../sv-benchmarks/c/eca-rers2012/Problem18_label32.yml +../../sv-benchmarks/c/eca-rers2012/Problem18_label33.yml +../../sv-benchmarks/c/eca-rers2012/Problem18_label34.yml +../../sv-benchmarks/c/eca-rers2012/Problem18_label35.yml +../../sv-benchmarks/c/eca-rers2012/Problem18_label36.yml +../../sv-benchmarks/c/eca-rers2012/Problem18_label37.yml +../../sv-benchmarks/c/eca-rers2012/Problem18_label38.yml +../../sv-benchmarks/c/eca-rers2012/Problem18_label39.yml +../../sv-benchmarks/c/eca-rers2012/Problem18_label40.yml +../../sv-benchmarks/c/eca-rers2012/Problem18_label41.yml +../../sv-benchmarks/c/eca-rers2012/Problem18_label42.yml +../../sv-benchmarks/c/eca-rers2012/Problem18_label43.yml +../../sv-benchmarks/c/eca-rers2012/Problem18_label44.yml +../../sv-benchmarks/c/eca-rers2012/Problem18_label45.yml +../../sv-benchmarks/c/eca-rers2012/Problem18_label46.yml +../../sv-benchmarks/c/eca-rers2012/Problem18_label47.yml +../../sv-benchmarks/c/eca-rers2012/Problem18_label48.yml +../../sv-benchmarks/c/eca-rers2012/Problem18_label49.yml +../../sv-benchmarks/c/eca-rers2012/Problem18_label50.yml +../../sv-benchmarks/c/eca-rers2012/Problem18_label51.yml +../../sv-benchmarks/c/eca-rers2012/Problem18_label52.yml +../../sv-benchmarks/c/eca-rers2012/Problem18_label53.yml +../../sv-benchmarks/c/eca-rers2012/Problem18_label54.yml +../../sv-benchmarks/c/eca-rers2012/Problem18_label55.yml +../../sv-benchmarks/c/eca-rers2012/Problem18_label56.yml +../../sv-benchmarks/c/eca-rers2012/Problem18_label57.yml +../../sv-benchmarks/c/eca-rers2012/Problem18_label58.yml +../../sv-benchmarks/c/eca-rers2012/Problem18_label59.yml +../../sv-benchmarks/c/eca-rers2012/Problem19_label01.yml +../../sv-benchmarks/c/eca-rers2012/Problem19_label02.yml +../../sv-benchmarks/c/eca-rers2012/Problem19_label03.yml +../../sv-benchmarks/c/eca-rers2012/Problem19_label04.yml +../../sv-benchmarks/c/eca-rers2012/Problem19_label05.yml +../../sv-benchmarks/c/eca-rers2012/Problem19_label06.yml +../../sv-benchmarks/c/eca-rers2012/Problem19_label07.yml +../../sv-benchmarks/c/eca-rers2012/Problem19_label08.yml +../../sv-benchmarks/c/eca-rers2012/Problem19_label09.yml +../../sv-benchmarks/c/eca-rers2012/Problem19_label10.yml +../../sv-benchmarks/c/eca-rers2012/Problem19_label11.yml +../../sv-benchmarks/c/eca-rers2012/Problem19_label12.yml +../../sv-benchmarks/c/eca-rers2012/Problem19_label13.yml +../../sv-benchmarks/c/eca-rers2012/Problem19_label14.yml +../../sv-benchmarks/c/eca-rers2012/Problem19_label15.yml +../../sv-benchmarks/c/eca-rers2012/Problem19_label16.yml +../../sv-benchmarks/c/eca-rers2012/Problem19_label17.yml +../../sv-benchmarks/c/eca-rers2012/Problem19_label18.yml +../../sv-benchmarks/c/eca-rers2012/Problem19_label19.yml +../../sv-benchmarks/c/eca-rers2012/Problem19_label20.yml +../../sv-benchmarks/c/eca-rers2012/Problem19_label21.yml +../../sv-benchmarks/c/eca-rers2012/Problem19_label22.yml +../../sv-benchmarks/c/eca-rers2012/Problem19_label23.yml +../../sv-benchmarks/c/eca-rers2012/Problem19_label24.yml +../../sv-benchmarks/c/eca-rers2012/Problem19_label25.yml +../../sv-benchmarks/c/eca-rers2012/Problem19_label26.yml +../../sv-benchmarks/c/eca-rers2012/Problem19_label27.yml +../../sv-benchmarks/c/eca-rers2012/Problem19_label28.yml +../../sv-benchmarks/c/eca-rers2012/Problem19_label29.yml +../../sv-benchmarks/c/eca-rers2012/Problem19_label30.yml +../../sv-benchmarks/c/eca-rers2012/Problem19_label31.yml +../../sv-benchmarks/c/eca-rers2012/Problem19_label32.yml +../../sv-benchmarks/c/eca-rers2012/Problem19_label33.yml +../../sv-benchmarks/c/eca-rers2012/Problem19_label34.yml +../../sv-benchmarks/c/eca-rers2012/Problem19_label35.yml +../../sv-benchmarks/c/eca-rers2012/Problem19_label36.yml +../../sv-benchmarks/c/eca-rers2012/Problem19_label37.yml +../../sv-benchmarks/c/eca-rers2012/Problem19_label38.yml +../../sv-benchmarks/c/eca-rers2012/Problem19_label39.yml +../../sv-benchmarks/c/eca-rers2012/Problem19_label40.yml +../../sv-benchmarks/c/eca-rers2012/Problem19_label41.yml +../../sv-benchmarks/c/eca-rers2012/Problem19_label42.yml +../../sv-benchmarks/c/eca-rers2012/Problem19_label43.yml +../../sv-benchmarks/c/eca-rers2012/Problem19_label44.yml +../../sv-benchmarks/c/eca-rers2012/Problem19_label45.yml +../../sv-benchmarks/c/eca-rers2012/Problem19_label46.yml +../../sv-benchmarks/c/eca-rers2012/Problem19_label47.yml +../../sv-benchmarks/c/eca-rers2012/Problem19_label48.yml +../../sv-benchmarks/c/eca-rers2012/Problem19_label49.yml +../../sv-benchmarks/c/eca-rers2012/Problem19_label50.yml +../../sv-benchmarks/c/eca-rers2012/Problem19_label51.yml +../../sv-benchmarks/c/eca-rers2012/Problem19_label52.yml +../../sv-benchmarks/c/eca-rers2012/Problem19_label53.yml +../../sv-benchmarks/c/eca-rers2012/Problem19_label54.yml +../../sv-benchmarks/c/eca-rers2012/Problem19_label55.yml +../../sv-benchmarks/c/eca-rers2012/Problem19_label56.yml +../../sv-benchmarks/c/eca-rers2012/Problem19_label57.yml +../../sv-benchmarks/c/eca-rers2012/Problem19_label58.yml +../../sv-benchmarks/c/eca-rers2012/Problem19_label59.yml diff --git a/tests/testcomp/official/bench-defs/map2check.xml b/tests/testcomp/official/bench-defs/map2check.xml new file mode 100644 index 000000000..14dfc0cc3 --- /dev/null +++ b/tests/testcomp/official/bench-defs/map2check.xml @@ -0,0 +1,28 @@ + + + + + + + + **/test-suite + + + ../sv-benchmarks/c/properties/coverage-error-call.prp + + ../sv-benchmarks/c/ReachSafety-ControlFlow.set + + + + + ../sv-benchmarks/c/properties/coverage-branches.prp + + ../sv-benchmarks/c/ReachSafety-ControlFlow.set + + + + diff --git a/tests/testcomp/official/bench-defs/testcoca-validate-test-suites-clang-formatted.xml b/tests/testcomp/official/bench-defs/testcoca-validate-test-suites-clang-formatted.xml new file mode 100644 index 000000000..2f9257102 --- /dev/null +++ b/tests/testcomp/official/bench-defs/testcoca-validate-test-suites-clang-formatted.xml @@ -0,0 +1,171 @@ + + + + + + + **output/** + + \ No newline at end of file diff --git a/tests/testcomp/official/bench-defs/testcov-validate-test-suites-clang-formatted.xml b/tests/testcomp/official/bench-defs/testcov-validate-test-suites-clang-formatted.xml new file mode 100644 index 000000000..73cb97758 --- /dev/null +++ b/tests/testcomp/official/bench-defs/testcov-validate-test-suites-clang-formatted.xml @@ -0,0 +1,182 @@ + + + + + + + **output/** + + \ No newline at end of file diff --git a/tests/testcomp/official/bench-defs/testcov-validate-test-suites-clang-unformatted.xml b/tests/testcomp/official/bench-defs/testcov-validate-test-suites-clang-unformatted.xml new file mode 100644 index 000000000..5591bb122 --- /dev/null +++ b/tests/testcomp/official/bench-defs/testcov-validate-test-suites-clang-unformatted.xml @@ -0,0 +1,181 @@ + + + + + + + **output/** + + \ No newline at end of file diff --git a/tests/testcomp/official/bench-defs/testcov-validate-test-suites-gcc-formatted.xml b/tests/testcomp/official/bench-defs/testcov-validate-test-suites-gcc-formatted.xml new file mode 100644 index 000000000..d6ca78924 --- /dev/null +++ b/tests/testcomp/official/bench-defs/testcov-validate-test-suites-gcc-formatted.xml @@ -0,0 +1,178 @@ + + + + + + + **output/** + + \ No newline at end of file diff --git a/tests/testcomp/official/bench-defs/testcov-validate-test-suites-gcc-unformatted.xml b/tests/testcomp/official/bench-defs/testcov-validate-test-suites-gcc-unformatted.xml new file mode 100644 index 000000000..4d2e17c75 --- /dev/null +++ b/tests/testcomp/official/bench-defs/testcov-validate-test-suites-gcc-unformatted.xml @@ -0,0 +1,177 @@ + + + + + + + **output/** + + \ No newline at end of file diff --git a/tests/testcomp/official/init.sh b/tests/testcomp/official/init.sh new file mode 100755 index 000000000..c0b592e96 --- /dev/null +++ b/tests/testcomp/official/init.sh @@ -0,0 +1,12 @@ +#!/bin/sh +# Entry point of the Test-Comp reproduction image: a separate cgroup for +# BenchExec, as its doc/benchexec-in-container.md prescribes for cgroups v2. +# Without it BenchExec cannot limit or measure the runs it starts. +set -eu +mkdir -p /sys/fs/cgroup/init /sys/fs/cgroup/benchexec +echo $$ > /sys/fs/cgroup/init/cgroup.procs +for controller in $(cat /sys/fs/cgroup/cgroup.controllers); do + echo "+$controller" > /sys/fs/cgroup/cgroup.subtree_control + echo "+$controller" > /sys/fs/cgroup/benchexec/cgroup.subtree_control +done +exec "$@" diff --git a/tests/testcomp/official/run.sh b/tests/testcomp/official/run.sh new file mode 100755 index 000000000..e9359d29f --- /dev/null +++ b/tests/testcomp/official/run.sh @@ -0,0 +1,54 @@ +#!/bin/bash +# Runs a Test-Comp 2026 step (testcomp.py generate | validate) in the +# reproduction image. +# +# tests/testcomp/official/run.sh generate --property cover-branches \ +# --tasks tests/testcomp/corpus/cover-branches-q400.tsv \ +# --archive map2check-testcomp.zip --suites OUT/suites --out OUT/gen +# tests/testcomp/official/run.sh validate --property cover-branches \ +# --tasks tests/testcomp/corpus/cover-branches-q400.tsv \ +# --suites OUT/suites --out OUT/val +# +# Anything after -- goes to BenchExec (e.g. -- --timelimit 300s for a run +# deliberately shorter than the competition's). +# +# The image is map2check-testcomp-env (docker build -t map2check-testcomp-env +# tests/testcomp/official). BenchExec needs --privileged to manage cgroups and +# /dev/fuse for the overlays it creates. +# +# The repository is mounted at /m2c and $DATA_DIR (default: the repository's +# parent) at /data, and the paths given on the command line are translated: the +# container's /home must stay free, because BenchExec overlays it, and an +# overlay over a bind mount below it fails ("Failed to create overlay mount"). +set -euo pipefail +REPO=$(cd "$(dirname "$0")/../../.." && pwd) +DATA_DIR=$(cd "${DATA_DIR:-$REPO/..}" && pwd) +IMAGE=${IMAGE:-map2check-testcomp-env} +SV=${SV_BENCHMARKS:-$REPO/tests/testcomp/bench/sv-benchmarks/c} + +inside() { + local path + path=$(realpath -m "$1") + case "$path" in + "$REPO"|"$REPO"/*) echo "/m2c${path#"$REPO"}" ;; + "$DATA_DIR"/*) echo "/data${path#"$DATA_DIR"}" ;; + *) echo "path outside the repository and DATA_DIR: $1" >&2; exit 2 ;; + esac +} + +args=() +expect_path=0 +for arg in "$@"; do + if [ "$expect_path" = 1 ]; then args+=("$(inside "$arg")"); expect_path=0; continue; fi + case "$arg" in + --tasks|--suites|--out|--archive) args+=("$arg"); expect_path=1 ;; + *) args+=("$arg") ;; + esac +done +step=${args[0]:?generate or validate} + +exec docker run --rm --privileged --cap-drop=all --device /dev/fuse \ + -v "$REPO:/m2c" -v "$DATA_DIR:/data" -w /m2c -e HOST_OWNER="$(id -u):$(id -g)" \ + ${DOCKER_ARGS:-} "$IMAGE" \ + python3 /m2c/tests/testcomp/official/testcomp.py "$step" \ + --sv-benchmarks "$(inside "$SV")" "${args[@]:1}" diff --git a/tests/testcomp/official/testcomp.py b/tests/testcomp/official/testcomp.py new file mode 100755 index 000000000..90725394d --- /dev/null +++ b/tests/testcomp/official/testcomp.py @@ -0,0 +1,319 @@ +#!/usr/bin/env python3 +"""Runs Map2Check through Test-Comp 2026 the way the competition does. + +Runs inside the reproduction image (Dockerfile; run.sh starts it). Two steps, +each one a BenchExec run of an official-style benchmark definition: + + generate the Map2Check tool archive (utils/testcomp-archive/make-archive.sh) + under bench-defs/map2check.xml: 15 min of CPU time, 15 GB, 4 cores, + like every Test-Comp 2026 test generator. Each task's test-suite/ + is then zipped into the layout the validators read. + + validate the five validators of the testcomp26 category structure -- TestCov + with gcc and clang, formatted and unformatted, and TestCoCa -- from + their official definitions in bench-defs/, unchanged except for + the task set and the location of the suites. The scores are merged + as the competition merges them (competition-scripts, + prepare_tables/export_adjusted_csvs.py, update_score_tester): + coverage-branches the BEST coverage any validator measured; + coverage-error-call 1 point if ANY validator answers TRUE. + +What is rewritten in a definition, and why: + - the tasks, replaced by --tasks; + - ../sv-benchmarks/c/ and results-verified/LOGDIR/, replaced by our paths; + - , dropped: it pins the competition's hardware. + +As the competition scripts do (execute-runcollection.sh), BenchExec runs from +inside a fresh copy of the tool with --tool-directory . and the overlays +--read-only-dir / --overlay-dir /home/ --overlay-dir ./. Task inputs are +staged into a copy per step, because tools write beside the program (TestCov's +.c.i), and on the competition's VerifierCloud the inputs sit in the +run's own writable directory. + +Suites live at ///test-suite.zip, e.g. +suites/Test-Comp26_coverage-branches/AllInterval-011.yml/test-suite.zip +(BenchExec's ${taskdef_name} keeps the .yml). +""" + +import argparse +import bz2 +import csv +import glob +import os +import shutil +import subprocess +import sys +import xml.etree.ElementTree as ET +import zipfile + +import yaml + +HERE = os.path.dirname(os.path.abspath(__file__)) +DEFS = os.path.join(HERE, "bench-defs") +REPO = os.path.dirname(os.path.dirname(os.path.dirname(HERE))) + +VALIDATORS = { + "testcov-validate-test-suites-gcc-unformatted": "/opt/testcov", + "testcov-validate-test-suites-gcc-formatted": "/opt/testcov", + "testcov-validate-test-suites-clang-unformatted": "/opt/testcov", + "testcov-validate-test-suites-clang-formatted": "/opt/testcov", + "testcoca-validate-test-suites-clang-formatted": "/opt/testcoca", +} + +PROPERTIES = { + "cover-branches": "Test-Comp26_coverage-branches", + "cover-error": "Test-Comp26_coverage-error-call", +} + +OFFICIAL_LOGDIRS = ("../../results-verified/LOGDIR/", "../results-verified/LOGDIR/") + + +# --- shared ------------------------------------------------------------------- + +def stage_tasks(task_list, sv_benchmarks, staging): + """Copies each task's inputs -- the .yml, the files it names, and the + property files -- into `staging`, keeping their paths relative to + sv-benchmarks. Returns the staged .yml paths. + + `task_list` holds manifest rows (categoryprogram...) or bare paths + to a .c, .i or .yml.""" + shutil.rmtree(staging, ignore_errors=True) + shutil.copytree(os.path.join(sv_benchmarks, "properties"), + os.path.join(staging, "properties")) + tasks = [] + with open(task_list) as listing: + for line in listing: + line = line.strip() + if not line or line.startswith("#"): + continue + path = line.split("\t")[1] if "\t" in line else line + stem, _ = os.path.splitext(path) + yml = os.path.join(sv_benchmarks, stem + ".yml") + if not os.path.isfile(yml): + sys.exit(f"no task definition for {path}: {yml}") + with open(yml) as handle: + inputs = yaml.safe_load(handle)["input_files"] + inputs = [inputs] if isinstance(inputs, str) else inputs + target_dir = os.path.join(staging, os.path.dirname(stem)) + os.makedirs(target_dir, exist_ok=True) + for name in [os.path.basename(yml)] + inputs: + shutil.copy2(os.path.join(os.path.dirname(yml), name), + os.path.join(target_dir, name)) + # Some tasks carry property files of their own (eca-rers2018/), named + # relative to the task definition. BenchExec resolves every property + # a definition lists, so one missing file aborts the whole run -- and + # with it every task's result. + local_properties = os.path.join(os.path.dirname(yml), "properties") + if os.path.isdir(local_properties): + shutil.copytree(local_properties, + os.path.join(target_dir, "properties"), + dirs_exist_ok=True) + tasks.append(os.path.join(target_dir, os.path.basename(yml))) + return tasks + + +def rewrite_definition(source, rundefinition, tasks, staging, suites, out_path): + """`source`, narrowed to one run definition, our tasks and our paths.""" + tree = ET.parse(source) + root = tree.getroot() + for require in root.findall("require"): + root.remove(require) + kept = False + for run in list(root.findall("rundefinition")): + if run.get("name") != rundefinition: + root.remove(run) + continue + kept = True + for element in run.iter(): + if element.text: + for logdir in OFFICIAL_LOGDIRS: + element.text = element.text.replace(logdir, suites + "/") + element.text = element.text.replace("../sv-benchmarks/c/", staging + "/") + for old in run.findall("tasks"): + run.remove(old) + group = ET.SubElement(run, "tasks", name="map2check") + for task in tasks: + ET.SubElement(group, "include").text = task + if not kept: + sys.exit(f"{source}: no rundefinition {rundefinition}") + os.makedirs(os.path.dirname(out_path), exist_ok=True) + tree.write(out_path, xml_declaration=True, encoding="utf-8") + return out_path + + +def run_benchexec(definition, tool_dir, out_dir, staging, args, env=None): + """BenchExec from inside `tool_dir`, with the competition's overlays.""" + command = [ + "benchexec", definition, + "--tool-directory", ".", + "--outputpath", out_dir + "/", + "--numOfThreads", str(args.threads), + # Results are read once and the whole output directory is removed after + # each validator (see validate); compression is BenchExec's default. + "--read-only-dir", "/", "--overlay-dir", "/home/", "--overlay-dir", "./", + # An overlay, not full access: what one run writes beside a program + # must not reach the next. + "--overlay-dir", staging, + ] + command += args.benchexec_args + print("+", " ".join(command), flush=True) + return subprocess.call(command, cwd=tool_dir, env=env) + + +def read_results(out_dir): + """task -> (status, coverage %) from the BenchExec result XMLs in out_dir.""" + found = {} + paths = glob.glob(os.path.join(out_dir, "*.results.*.xml")) + paths += glob.glob(os.path.join(out_dir, "*.results.*.xml.bz2")) + for path in paths: + opener = bz2.open if path.endswith(".bz2") else open + with opener(path, "rb") as handle: + root = ET.parse(handle).getroot() + for run in root.findall("run"): + values = {c.get("title"): c.get("value") for c in run.findall("column")} + coverage = (values.get("branches_covered") or "").replace("%", "").strip() + found[os.path.basename(run.get("name"))] = (values.get("status", ""), coverage) + return found + + +def hand_back(path): + """BenchExec runs as root in the container; give the results back.""" + owner = os.environ.get("HOST_OWNER") + if owner: + subprocess.call(["chown", "-R", owner, path]) + + +# --- generate ----------------------------------------------------------------- + +def generate(args): + rundefinition = PROPERTIES[args.property] + out = os.path.abspath(args.out) + os.makedirs(out, exist_ok=True) + staging = os.path.join(out, "sv-benchmarks") + tasks = stage_tasks(args.tasks, os.path.abspath(args.sv_benchmarks), staging) + print(f"{len(tasks)} tasks, {rundefinition}", flush=True) + + definition = rewrite_definition(os.path.join(DEFS, "map2check.xml"), rundefinition, + tasks, staging, "", os.path.join(out, "defs", "map2check.xml")) + + # A fresh copy of the tool, unpacked as the competition unpacks archives. + tool_root = os.path.join(out, "tool") + shutil.rmtree(tool_root, ignore_errors=True) + subprocess.check_call(["unzip", "-q", os.path.abspath(args.archive), "-d", tool_root]) + tool_dir = os.path.join(tool_root, "map2check") + + # The tool-info module lives in the repository, not in BenchExec. + env = dict(os.environ) + env["PYTHONPATH"] = os.path.join(REPO, "utils") + os.pathsep + env.get("PYTHONPATH", "") + result_dir = os.path.join(out, "results") + os.makedirs(result_dir, exist_ok=True) + code = run_benchexec(definition, tool_dir, result_dir, staging, args, env=env) + + # /..files//.yml/test-suite/ + suites = os.path.abspath(args.suites) + count = 0 + for suite_dir in glob.glob(os.path.join(result_dir, "*.files", rundefinition, "*", "test-suite")): + taskdef = os.path.basename(os.path.dirname(suite_dir)) + target = os.path.join(suites, rundefinition, taskdef) + os.makedirs(target, exist_ok=True) + with zipfile.ZipFile(os.path.join(target, "test-suite.zip"), "w", + zipfile.ZIP_DEFLATED) as archive: + for name in sorted(os.listdir(suite_dir)): + archive.write(os.path.join(suite_dir, name), name) + count += 1 + shutil.rmtree(tool_root, ignore_errors=True) + # The suites are zipped out; the tool tree, the staged sv-benchmarks and the + # BenchExec output (whose .files hold every test-suite) are scratch. + shutil.rmtree(result_dir, ignore_errors=True) + shutil.rmtree(staging, ignore_errors=True) + hand_back(out) + hand_back(suites) + print(f"{count} suites in {os.path.join(suites, rundefinition)}") + return code + + +# --- validate ----------------------------------------------------------------- + +def validate(args): + rundefinition = PROPERTIES[args.property] + suites = os.path.abspath(args.suites) + out = os.path.abspath(args.out) + staging = os.path.join(out, "sv-benchmarks") + tasks = stage_tasks(args.tasks, os.path.abspath(args.sv_benchmarks), staging) + print(f"{len(tasks)} tasks, {rundefinition}", flush=True) + + per_validator = {} + for name in args.validators.split(","): + definition = rewrite_definition(os.path.join(DEFS, name + ".xml"), rundefinition, + tasks, staging, suites, + os.path.join(out, "defs", name + ".xml")) + result_dir = os.path.join(out, "results", name) + os.makedirs(result_dir, exist_ok=True) + # A fresh copy of the validator: TestCov's --format writes beside itself. + work = os.path.join(out, "tool") + shutil.rmtree(work, ignore_errors=True) + shutil.copytree(VALIDATORS[name], work, symlinks=True) + if run_benchexec(definition, work, result_dir, staging, args) != 0: + print(f"warning: benchexec exited non-zero for {name}", flush=True) + shutil.rmtree(work, ignore_errors=True) + per_validator[name] = read_results(result_dir) + # Keep the scratch when debugging (MAP2CHECK_KEEP_RESULTS=1); otherwise + # drop it, or a few-thousand-task corpus fills the disk. + if not os.environ.get("MAP2CHECK_KEEP_RESULTS"): + shutil.rmtree(result_dir, ignore_errors=True) + if not os.environ.get("MAP2CHECK_KEEP_RESULTS"): + shutil.rmtree(staging, ignore_errors=True) + + names = list(per_validator) + with open(os.path.join(out, "scores.csv"), "w", newline="") as handle: + writer = csv.writer(handle) + writer.writerow(["task"] + [f"{n}:{c}" for n in names for c in ("status", "coverage")] + + ["score", "best_validator"]) + for task in tasks: + key = os.path.basename(task) + row, best, best_by = [key], 0.0, "" + for name in names: + status, coverage = per_validator[name].get(key, ("MISSING", "")) + row += [status, coverage] + if args.property == "cover-error": + value = 1.0 if status == "true" else 0.0 + else: + try: + value = float(coverage) / 100 + except ValueError: + value = 0.0 + if value > best: + best, best_by = value, name + writer.writerow(row + [f"{best:.4f}", best_by]) + hand_back(out) + print(f"scores: {os.path.join(out, 'scores.csv')}") + return 0 + + +def main(): + parser = argparse.ArgumentParser(description=__doc__, + formatter_class=argparse.RawDescriptionHelpFormatter) + sub = parser.add_subparsers(dest="step", required=True) + for step in ("generate", "validate"): + p = sub.add_parser(step) + p.add_argument("--property", choices=PROPERTIES, required=True) + p.add_argument("--tasks", required=True, + help="manifest TSV or list of task paths (.c/.i/.yml)") + p.add_argument("--suites", required=True) + p.add_argument("--sv-benchmarks", required=True, + help="the c/ directory of sv-benchmarks") + p.add_argument("--out", required=True) + p.add_argument("--threads", type=int, default=3) + p.add_argument("benchexec_args", nargs="*", + help="after --, extra BenchExec options " + "(e.g. --timelimit 300s, a deliberate deviation)") + if step == "generate": + p.add_argument("--archive", required=True, help="the Map2Check tool archive") + else: + p.add_argument("--validators", default=",".join(VALIDATORS)) + args = parser.parse_args() + sys.exit(generate(args) if args.step == "generate" else validate(args)) + + +if __name__ == "__main__": + main() diff --git a/tests/testcomp/run_testcomp_evaluation.sh b/tests/testcomp/run_testcomp_evaluation.sh index c587bb34b..9838ccbb9 100755 --- a/tests/testcomp/run_testcomp_evaluation.sh +++ b/tests/testcomp/run_testcomp_evaluation.sh @@ -24,6 +24,10 @@ # BUDGET seconds given to map2check per task (default 60) # TESTCOV_S seconds given to TestCov per task (default 90) # DEADLINE_S stop starting new tasks after this many seconds (default 18000) +# SUITES_DIR if set, keep every suite as +# $SUITES_DIR//.yml/test-suite.zip, the layout +# tests/testcomp/official/run.sh validate reads (the official +# validators need the suites, not this harness's verdict) # # The container needs gcc-multilib. Most sv-benchmarks tasks declare ILP32, and # without it TestCov cannot compile the program for -32 and reports no Result @@ -146,7 +150,7 @@ while IFS=$'\t' read -r category program data_model expected <&3; do $GENERATOR_FLAG $EXTRA_FLAGS --generate-test-suite $GOAL_FLAGS \ --property-file prop.prp --architecture "$arch" \ --timeout "$BUDGET" "$name" - ) > "$work/map2check.log" 2>&1 "$work/map2check.log" 2>&1 "$work/testcov.log" 2>&1 "$work/testcov.log" 2>&1 /dev/null fi + if [ -n "${SUITES_DIR:-}" ] && [ -f "$work/suite.zip" ]; then + rundef=$([ "$PROPERTY" = "cover-branches" ] && echo Test-Comp26_coverage-branches \ + || echo Test-Comp26_coverage-error-call) + taskdef=$(basename "${program%.*}").yml + mkdir -p "$SUITES_DIR/$rundef/$taskdef" + cp "$work/suite.zip" "$SUITES_DIR/$rundef/$taskdef/test-suite.zip" + fi + rm -rf "$work" processed=$((processed + 1)) done 3< "$MANIFEST" diff --git a/tests/unit/backend-library/CMakeLists.txt b/tests/unit/backend-library/CMakeLists.txt index baca1f5e7..0c7101072 100644 --- a/tests/unit/backend-library/CMakeLists.txt +++ b/tests/unit/backend-library/CMakeLists.txt @@ -44,9 +44,16 @@ add_executable(MemTrackTest $ ) +add_executable(NonDetLogTest + NonDetLogTest.cpp + $ + ${DEFAULT_CONTAINER_LIB} +) + map2check_test(AllocationLogTest) map2check_test(HeapLogTest) map2check_test(ContainerReallocTest) map2check_test(BTreeTest) map2check_test(ContainerBTreeTest) -map2check_test(MemTrackTest) \ No newline at end of file +map2check_test(MemTrackTest) +map2check_test(NonDetLogTest) diff --git a/tests/unit/backend-library/NonDetLogTest.cpp b/tests/unit/backend-library/NonDetLogTest.cpp new file mode 100644 index 000000000..20ee622b8 --- /dev/null +++ b/tests/unit/backend-library/NonDetLogTest.cpp @@ -0,0 +1,86 @@ +#include +extern "C" { +#include +} + +#include +#include +#include +#include +#include +#include + +/* NonDetLog.c takes its step counter from Map2CheckFunctions.c; the test + * links only the log and its container. */ +extern "C" { +static unsigned current_step = 0; +unsigned map2check_get_current_step() { return current_step; } +void map2check_next_current_step() { current_step++; } +} + +namespace { +std::string readFile(const std::string &path) { + std::ifstream in(path); + std::stringstream text; + text << in.rdbuf(); + return text.str(); +} +} // namespace + +class NonDetLogTest : public ::testing::Test { + protected: + void SetUp() override { + previous = std::filesystem::current_path(); + directory = std::filesystem::temp_directory_path() / + ("nondetlog-" + std::to_string(::getpid())); + std::filesystem::create_directories(directory); + std::filesystem::current_path(directory); + current_step = 0; + nondet_log_init(); + } + void TearDown() override { + nondet_log_destroy(); + std::filesystem::current_path(previous); + std::filesystem::remove_all(directory); + } + + std::filesystem::path previous; + std::filesystem::path directory; +}; + +/* The writer formats numbers by hand, not with fprintf (issue #75: under KLEE + * uClibc's vfprintf cost ~7,000 instructions a call). Every expected line + * below is what the fprintf version printed for the same row, so the file the + * frontend parses is byte for byte the same. */ +TEST_F(NonDetLogTest, WritesEveryTypeExactlyAsPrintfDid) { + map2check_nondet_int(10, 3, -1, "__VERIFIER_nondet_int"); + map2check_nondet_int(11, 3, INT_MIN, "__VERIFIER_nondet_int"); + map2check_nondet_unsigned(1, 2, UINT_MAX, "u"); + map2check_nondet_longlong(5, 6, LLONG_MIN, "ll"); + map2check_nondet_ulonglong(7, 8, ULLONG_MAX, "ull"); + map2check_nondet_double(9, 9, 1.5, "d"); + map2check_nondet_double(9, 9, -0.0, "d"); + map2check_nondet_float(9, 9, 1e-30f, "f"); + map2check_nondet_float(9, 9, 0.1f, "f"); + map2check_nondet_memory_byte(0, 0, 200, "__VERIFIER_nondet_memory"); + map2check_nondet_int(1, 1, 7, "a_function_name_that_is_exactly_34c"); + + ASSERT_TRUE(nondet_log_to_file(map2check_nondet_get_log())); + EXPECT_EQ(readFile("klee_log.csv"), + "0;10;3;__VERIFIER_nondet_int;0;-1;0\n" + "1;11;3;__VERIFIER_nondet_int;1;-2147483648;0\n" + "2;1;2;u;2;4294967295;5\n" + "3;5;6;ll;3;-9223372036854775808;17\n" + "4;7;8;ull;4;18446744073709551615;18\n" + "5;9;9;d;5;1.500000;15\n" + "6;9;9;d;6;-0.000000;15\n" + "7;9;9;f;7;1e-30;16\n" + "8;9;9;f;8;0.100000001;16\n" + "9;0;0;__VERIFIER_nondet_memory;9;200;22\n" + "10;1;1;a_function_name_that_is_exactly_34c;10;7;0\n"); +} + +TEST_F(NonDetLogTest, AnEmptyLogIsAnEmptyFile) { + ASSERT_TRUE(nondet_log_to_file(map2check_nondet_get_log())); + EXPECT_EQ(readFile("klee_log.csv"), ""); +} diff --git a/tests/unit/frontend/AlternationTest.cpp b/tests/unit/frontend/AlternationTest.cpp new file mode 100644 index 000000000..18139ff18 --- /dev/null +++ b/tests/unit/frontend/AlternationTest.cpp @@ -0,0 +1,59 @@ +/** + * Copyright (C) 2014 - 2026 Map2Check tool + * This file is part of the Map2Check tool, and is made available under + * the terms of the GNU General Public License version 2. + * + * SPDX-License-Identifier: (GPL-2.0) + **/ + +#include + +#include "../../../modules/frontend/utils/alternation.hpp" + +using Map2Check::Engine; + +TEST(AlternationWindow, StartsAtTheBaseShareOfTheBudget) { + EXPECT_DOUBLE_EQ(Map2Check::alternationWindow(Engine::Fuzzer, 1, 300, 300), + 30); + EXPECT_DOUBLE_EQ(Map2Check::alternationWindow(Engine::Klee, 1, 300, 270), 90); +} + +TEST(AlternationWindow, DoublesEveryRound) { + EXPECT_DOUBLE_EQ(Map2Check::alternationWindow(Engine::Fuzzer, 2, 300, 300), + 60); + EXPECT_DOUBLE_EQ(Map2Check::alternationWindow(Engine::Klee, 3, 300, 1000), + 360); +} + +TEST(AlternationWindow, NeverExceedsWhatIsLeft) { + EXPECT_DOUBLE_EQ(Map2Check::alternationWindow(Engine::Klee, 2, 300, 40), 40); +} + +TEST(StagnationSeconds, IsFivePercentButAtLeastTen) { + EXPECT_EQ(Map2Check::stagnationSeconds(300), 15u); + EXPECT_EQ(Map2Check::stagnationSeconds(60), 10u); +} + +TEST(CoverageWatch, StagnatesOnlyAfterTheQuietPeriod) { + Map2Check::CoverageWatch watch(10); + EXPECT_FALSE(watch.stagnated(100, 0)); + EXPECT_FALSE(watch.stagnated(100, 9)); + EXPECT_FALSE(watch.stagnated(120, 9.5)); // progress resets the clock + EXPECT_FALSE(watch.stagnated(120, 19)); + EXPECT_TRUE(watch.stagnated(120, 19.5)); +} + +TEST(CoverageWatch, AnUnreadableSampleIsNotEvidence) { + Map2Check::CoverageWatch watch(10); + EXPECT_FALSE(watch.stagnated(-1, 0)); + EXPECT_FALSE(watch.stagnated(-1, 50)); // never read: no verdict on progress + EXPECT_FALSE(watch.stagnated(5, 51)); + EXPECT_FALSE(watch.stagnated(-1, 60)); + EXPECT_TRUE(watch.stagnated(5, 61.5)); +} + +TEST(StagnationSeconds, KleesPatienceDoublesWithItsRounds) { + EXPECT_EQ(Map2Check::stagnationSeconds(300, 1), 15u); + EXPECT_EQ(Map2Check::stagnationSeconds(300, 2), 30u); + EXPECT_EQ(Map2Check::stagnationSeconds(300, 3), 60u); +} diff --git a/tests/unit/frontend/CMakeLists.txt b/tests/unit/frontend/CMakeLists.txt index 35d6a0390..3c734e637 100644 --- a/tests/unit/frontend/CMakeLists.txt +++ b/tests/unit/frontend/CMakeLists.txt @@ -20,3 +20,13 @@ add_executable(SlicerTest SlicerTest.cpp ) map2check_test(SlicerTest) + +add_executable(SeedStoreTest + SeedStoreTest.cpp +) +map2check_test(SeedStoreTest) + +add_executable(AlternationTest + AlternationTest.cpp +) +map2check_test(AlternationTest) diff --git a/tests/unit/frontend/KtestReaderTest.cpp b/tests/unit/frontend/KtestReaderTest.cpp index e9c07f76f..040267e1f 100644 --- a/tests/unit/frontend/KtestReaderTest.cpp +++ b/tests/unit/frontend/KtestReaderTest.cpp @@ -16,6 +16,7 @@ #include #include +#include #include #include #include @@ -90,6 +91,18 @@ std::vector leDouble(double value) { return bytes; } +std::vector le64(int64_t value) { + std::vector bytes(8); + std::memcpy(bytes.data(), &value, 8); + return bytes; +} + +std::vector leFloat(float value) { + std::vector bytes(4); + std::memcpy(bytes.data(), &value, 4); + return bytes; +} + fs::path freshDir(const std::string& name) { fs::path d = fs::temp_directory_path() / ("m2c_ktest_" + name); fs::remove_all(d); @@ -252,6 +265,63 @@ TEST(ReadKtestVectors, DropsVectorsWithNoObjects) { fs::remove_all(d); } +// A path a failed assumption pruned carries the marker object. The marker is +// not an input, and such paths come after every other one, so shallow pruned +// paths cannot crowd deep ones out of a capped suite. +TEST(ReadKtestFile, StripsThePrunedPathMarker) { + fs::path d = freshDir("marker"); + KtestBuilder() + .object("non_det_int", le32(5)) + .object("map2check_pruned", {0}) + .writeTo(d / "test000001.ktest"); + bool pruned = false; + auto objects = + Map2Check::readKtestFile((d / "test000001.ktest").string(), &pruned); + EXPECT_TRUE(pruned); + ASSERT_EQ(objects.size(), 1u); + EXPECT_EQ(objects[0].name, "non_det_int"); + fs::remove_all(d); +} + +TEST(ReadKtestVectors, PrunedPathsComeLast) { + fs::path d = freshDir("pruned"); + KtestBuilder() + .object("non_det_int", le32(1)) + .object("map2check_pruned", {0}) + .writeTo(d / "test000001.ktest"); + KtestBuilder().object("non_det_int", le32(2)).writeTo(d / "test000002.ktest"); + KtestBuilder() + .object("non_det_int", le32(3)) + .object("map2check_pruned", {0}) + .writeTo(d / "test000003.ktest"); + KtestBuilder().object("non_det_int", le32(4)).writeTo(d / "test000004.ktest"); + + auto all = Map2Check::readKtestVectors(d.string(), 100); + ASSERT_EQ(all.size(), 4u); + EXPECT_EQ(all[0], std::vector{"2"}); + EXPECT_EQ(all[1], std::vector{"4"}); + EXPECT_EQ(all[2], std::vector{"1"}); + EXPECT_EQ(all[3], std::vector{"3"}); + + auto capped = Map2Check::readKtestVectors(d.string(), 3); + ASSERT_EQ(capped.size(), 3u); + EXPECT_EQ(capped[2], std::vector{"1"}); + fs::remove_all(d); +} + +// Only pruned paths: they are the whole suite rather than none of it. +TEST(ReadKtestVectors, OnlyPrunedPathsStillMakeASuite) { + fs::path d = freshDir("onlypruned"); + KtestBuilder() + .object("non_det_int", le32(7)) + .object("map2check_pruned", {0}) + .writeTo(d / "test000001.ktest"); + auto vectors = Map2Check::readKtestVectors(d.string(), 100); + ASSERT_EQ(vectors.size(), 1u); + EXPECT_EQ(vectors[0], std::vector{"7"}); + fs::remove_all(d); +} + TEST(ReadKtestVectors, MissingDirectoryYieldsNothing) { EXPECT_TRUE(Map2Check::readKtestVectors("/nonexistent/klee-last", 10).empty()); } @@ -307,3 +377,227 @@ TEST(KleeHaltedOnTimer, AFinishedRunIsNotHalted) { EXPECT_FALSE(Map2Check::kleeHaltedOnTimer("/nonexistent/klee-last")); fs::remove_all(d); } + +// KLEE also exits 0 after dropping paths without running out of them: a +// symbolic double concretized to 0 (float-benchs/sin_interpolated_index-1: one +// path, answered TRUE), or states killed by its own errors (a VLA of symbolic +// size in loops/insertion_sort-1-2: "partially completed paths = 2", TRUE). +TEST(KleeDroppedPaths, ConcretizingAnInputDropsPaths) { + fs::path d = freshDir("concretized"); + std::ofstream(d / "warnings.txt") + << "KLEE: WARNING ONCE: silently concretizing (reason: floating point) " + "expression (ReadLSB w64 0 non_det_double) to value 0 (x.c:155)\n"; + std::ofstream(d / "info") << "KLEE: done: partially completed paths = 0\n"; + EXPECT_FALSE(Map2Check::kleeDroppedPaths(d.string()).empty()); + fs::remove_all(d); +} + +TEST(KleeDroppedPaths, AStateKilledByAnErrorDropsPaths) { + fs::path d = freshDir("killed"); + std::ofstream(d / "test000001.ktest") << ""; + std::ofstream(d / "test000001.model.err") << "Error: concretized symbolic size\n"; + EXPECT_FALSE(Map2Check::kleeDroppedPaths(d.string()).empty()); + fs::remove_all(d); +} + +TEST(KleeDroppedPaths, AStateTerminatedEarlyDropsPaths) { + fs::path d = freshDir("early"); + std::ofstream(d / "test000002.early") << "Memory limit exceeded\n"; + EXPECT_FALSE(Map2Check::kleeDroppedPaths(d.string()).empty()); + fs::remove_all(d); +} + +// KLEE that died -- a solver crash, an LLVM assertion, the OOM killer -- +// writes no HaltTimer, no .err and no "done" lines, and may leave NONE in the +// property file from the paths it did finish. +TEST(KleeDroppedPaths, ARunThatNeverFinishedDropsPaths) { + fs::path d = freshDir("crashed"); + std::ofstream(d / "info") << "KLEE: output directory is \"x\"\n"; + std::ofstream(d / "test000001.ktest") << ""; + EXPECT_FALSE(Map2Check::kleeDroppedPaths(d.string()).empty()); + fs::remove_all(d); +} + +// Near --max-memory KLEE stops forking and follows one side of each branch +// at random; it logs that once and can still exit 0. +TEST(KleeDroppedPaths, SkippingForksDropsPaths) { + fs::path d = freshDir("skipfork"); + std::ofstream(d / "warnings.txt") + << "KLEE: WARNING ONCE: skipping fork (memory cap exceeded)\n"; + std::ofstream(d / "info") << "KLEE: done: completed paths = 3\n"; + EXPECT_FALSE(Map2Check::kleeDroppedPaths(d.string()).empty()); + fs::remove_all(d); +} + +// A path pruned by an assumption is not a dropped path, and KLEE counts it +// among the "partially completed" all the same (klee_silent_exit and a failed +// klee_assume alike). Reading that counter made every program with an +// assume_abort_if_not unprovable: TRUE became UNKNOWN. +TEST(KleeDroppedPaths, AnAssumptionPrunedPathDropsNothing) { + fs::path d = freshDir("pruned"); + std::ofstream(d / "info") << "KLEE: done: completed paths = 1\n" + "KLEE: done: partially completed paths = 1\n"; + std::ofstream(d / "test000001.ktest") << ""; + EXPECT_TRUE(Map2Check::kleeDroppedPaths(d.string()).empty()); + fs::remove_all(d); +} + +TEST(KleeDroppedPaths, TheHaltTimerDropsPaths) { + fs::path d = freshDir("halted"); + std::ofstream(d / "messages.txt") << "KLEE: HaltTimer invoked\n"; + EXPECT_FALSE(Map2Check::kleeDroppedPaths(d.string()).empty()); + fs::remove_all(d); +} + +TEST(KleeDroppedPaths, AnExhaustedRunDropsNothing) { + fs::path d = freshDir("exhausted"); + std::ofstream(d / "warnings.txt") + << "KLEE: WARNING ONCE: calling external: close(12)\n"; + std::ofstream(d / "info") << "KLEE: done: completed paths = 7\n" + "KLEE: done: partially completed paths = 0\n"; + std::ofstream(d / "messages.txt") << "KLEE: output directory is \"x\"\n"; + EXPECT_TRUE(Map2Check::kleeDroppedPaths(d.string()).empty()); + fs::remove_all(d); +} + +// --- the nondet log as seeds ------------------------------------------------- + +// KLEE matches a seed's objects to its symbolic inputs by POSITION. A read the +// converter cannot express (a pchar, a loff_t) must end the seed there: skipping +// it shifted every later object onto the wrong input. +TEST(ReadNonDetLogAsObjects, StopsAtTheFirstUnsupportedRead) { + fs::path d = freshDir("nondetlog"); + std::ofstream(d / "klee_log.csv") + << "1;0;main;0;x;7;0\n" // int 7 + << "2;0;main;0;s;0;9\n" // pchar: unsupported + << "3;0;main;0;y;9;0\n"; // int 9, must not be taken + const auto objects = + Map2Check::readNonDetLogAsObjects((d / "klee_log.csv").string()); + ASSERT_EQ(objects.size(), 1u); + EXPECT_EQ(objects[0].name, "non_det_int"); + fs::remove_all(d); +} + +TEST(ReadKtestVectors, FlagsThePrunedVectors) { + fs::path d = freshDir("prunedflags"); + KtestBuilder() + .object("non_det_int", le32(1)) + .object("map2check_pruned", {0}) + .writeTo(d / "test000001.ktest"); + KtestBuilder().object("non_det_int", le32(2)).writeTo(d / "test000002.ktest"); + std::vector pruned; + auto vectors = Map2Check::readKtestVectors(d.string(), 100, &pruned); + ASSERT_EQ(vectors.size(), 2u); + ASSERT_EQ(pruned.size(), 2u); + EXPECT_FALSE(pruned[0]); + EXPECT_TRUE(pruned[1]); + EXPECT_EQ(vectors[1], std::vector{"1"}); + fs::remove_all(d); +} + +// --- the types issue #74 added ------------------------------------------------ + +// Intel-TDX reads __VERIFIER_nondet_ulonglong, and its values span all 64 +// bits: one decoded through the 32-bit path is a different input. +TEST(DecodeKtestObject, DecodesSixtyFourBitTypes) { + EXPECT_EQ(Map2Check::decodeKtestObject(obj("non_det_longlong", le64(-5))), + "-5"); + EXPECT_EQ(Map2Check::decodeKtestObject(obj("non_det_ulonglong", le64(-1))), + "18446744073709551615"); +} + +TEST(DecodeKtestObject, DecodesTheFixedWidthUnsignedTypes) { + EXPECT_EQ(Map2Check::decodeKtestObject(obj("non_det_u8", {0xff})), "255"); + EXPECT_EQ(Map2Check::decodeKtestObject(obj("non_det_u16", {0xff, 0xff})), + "65535"); + EXPECT_EQ(Map2Check::decodeKtestObject(obj("non_det_u32", le32(-1))), + "4294967295"); +} + +// Four bytes read as an integer is the failure mode a float has without its +// own name. The text must also round-trip: the validator parses it with %f, +// and a fixed six decimals turns 1e-30 into 0. +TEST(DecodeKtestObject, DecodesFloatsSoTheyRoundTrip) { + EXPECT_EQ(Map2Check::decodeKtestObject(obj("non_det_float", leFloat(1.5f))), + "1.5"); + const std::string tiny = + Map2Check::decodeKtestObject(obj("non_det_float", leFloat(1e-30f))); + EXPECT_EQ(std::strtof(tiny.c_str(), nullptr), 1e-30f) << "got " << tiny; +} + +// The validators' harness reads __VERIFIER_nondet_memory(p, n) as n uchar +// inputs, one per byte; KLEE holds it as one object of n bytes. +TEST(DecodeKtestInputs, ExpandsMemoryIntoOneUcharPerByte) { + EXPECT_EQ(Map2Check::decodeKtestInputs(obj("non_det_memory", {1, 0, 255})), + (std::vector{"1", "0", "255"})); + EXPECT_EQ(Map2Check::decodeKtestInputs(obj("non_det_int", le32(-2))), + std::vector{"-2"}); +} + +TEST(ReadKtestVectors, ExpandsMemoryObjectsInPlace) { + fs::path d = freshDir("memory"); + KtestBuilder() + .object("non_det_int", le32(7)) + .object("non_det_memory", {9, 8}) + .object("non_det_ulonglong", le64(3)) + .writeTo(d / "test000001.ktest"); + auto vectors = Map2Check::readKtestVectors(d.string(), 100); + ASSERT_EQ(vectors.size(), 1u); + EXPECT_EQ(vectors[0], (std::vector{"7", "9", "8", "3"})); + fs::remove_all(d); +} + +TEST(ReadViolatingKtest, ExpandsMemoryObjectsInPlace) { + fs::path d = freshDir("memoryerr"); + KtestBuilder() + .object("non_det_memory", {4, 5}) + .writeTo(d / "test000001.ktest"); + std::ofstream(d / "test000001.abort.err") << "abort"; + EXPECT_EQ(Map2Check::readViolatingKtest(d.string()), + (std::vector{"4", "5"})); + fs::remove_all(d); +} + +// Enumerators 16-21 of NONDET_TYPE (Map2CheckTypes.h). +TEST(ReadNonDetLogAsObjects, ConvertsTheTypesIssue74Added) { + fs::path d = freshDir("nondetlog74"); + std::ofstream(d / "klee_log.csv") + << "0;1;0;main;0;1.5;16\n" + << "1;1;0;main;1;-3;17\n" + << "2;1;0;main;2;18446744073709551615;18\n" + << "3;1;0;main;3;200;19\n" + << "4;1;0;main;4;60000;20\n" + << "5;1;0;main;5;4000000000;21\n"; + const auto objects = + Map2Check::readNonDetLogAsObjects((d / "klee_log.csv").string()); + ASSERT_EQ(objects.size(), 6u); + EXPECT_EQ(objects[0].name, "non_det_float"); + EXPECT_EQ(objects[0].bytes, leFloat(1.5f)); + EXPECT_EQ(objects[1].name, "non_det_longlong"); + EXPECT_EQ(objects[1].bytes, le64(-3)); + EXPECT_EQ(objects[2].name, "non_det_ulonglong"); + EXPECT_EQ(objects[2].bytes, le64(-1)); + EXPECT_EQ(objects[3].name, "non_det_u8"); + EXPECT_EQ(objects[3].bytes, std::vector{200}); + EXPECT_EQ(objects[4].name, "non_det_u16"); + EXPECT_EQ(objects[4].bytes, (std::vector{0x60, 0xea})); + EXPECT_EQ(objects[5].name, "non_det_u32"); + EXPECT_EQ(objects[5].bytes, le32(static_cast(4000000000u))); + fs::remove_all(d); +} + +// The runtime logs __VERIFIER_nondet_memory(p, n) as n MEMORY_BYTE rows while +// KLEE makes one n-byte object, and the log does not mark where a call ends. +// n one-byte seed objects would not match it, so the seed stops there. +TEST(ReadNonDetLogAsObjects, StopsAtAMemoryByte) { + fs::path d = freshDir("nondetlogmem"); + std::ofstream(d / "klee_log.csv") + << "0;1;0;main;0;7;0\n" + << "1;0;0;__VERIFIER_nondet_memory;1;3;22\n" + << "2;1;0;main;2;9;0\n"; + const auto objects = + Map2Check::readNonDetLogAsObjects((d / "klee_log.csv").string()); + ASSERT_EQ(objects.size(), 1u); + EXPECT_EQ(objects[0].name, "non_det_int"); + fs::remove_all(d); +} diff --git a/tests/unit/frontend/SeedStoreTest.cpp b/tests/unit/frontend/SeedStoreTest.cpp new file mode 100644 index 000000000..d7b40dbf3 --- /dev/null +++ b/tests/unit/frontend/SeedStoreTest.cpp @@ -0,0 +1,67 @@ +/** + * Copyright (C) 2014 - 2026 Map2Check tool + * This file is part of the Map2Check tool, and is made available under + * the terms of the GNU General Public License version 2. + * + * SPDX-License-Identifier: (GPL-2.0) + **/ + +#include + +#include +#include +#include + +#include "../../../modules/frontend/utils/seed_store.hpp" + +// Next to the scratch directory, not inside it: every hybrid phase recreates +// the scratch directory, and a store inside it never reached the next phase. +TEST(SeedStorePath, SitsBesideTheScratchDirectory) { + EXPECT_EQ(Map2Check::seedStorePath("/work", "abc.map2check"), + "/work/abc.map2check.seeds"); +} + +TEST(SelectQueueEntries, KeepsOnlyQueueEntriesInIdOrderUpToTheCap) { + const std::vector names = { + "id:000002,src:000000,time:9", ".state", "README.txt", + "id:000000,time:0,execs:0,orig:seed", "id:000001,src:000000,time:5"}; + const std::vector chosen = + Map2Check::selectQueueEntries(names, 2); + ASSERT_EQ(chosen.size(), 2u); + // The ",orig:" seed is not the fuzzer's discovery (see the test below). + EXPECT_EQ(chosen[0], "id:000001,src:000000,time:5"); + EXPECT_EQ(chosen[1], "id:000002,src:000000,time:9"); +} + +TEST(IsNewVector, RejectsEmptyAndDuplicateVectors) { + std::set> seen; + EXPECT_FALSE(Map2Check::isNewVector({}, &seen)); + EXPECT_TRUE(Map2Check::isNewVector({1, 2}, &seen)); + EXPECT_FALSE(Map2Check::isNewVector({1, 2}, &seen)); + EXPECT_TRUE(Map2Check::isNewVector({1, 3}, &seen)); +} + +// The fuzzer's own seeds come back in its queue tagged ",orig:" -- the KLEE +// vectors, the previous rounds' entries -- and KLEE already has those. Only +// what this round discovered is worth replaying (tacas 3b). +TEST(SelectQueueEntries, SkipsTheSeedsTheFuzzerStartedFrom) { + const auto picked = Map2Check::selectQueueEntries( + {"id:000000,time:0,execs:0,orig:klee-0", "id:000001,src:000000,op:havoc"}, + 8); + ASSERT_EQ(picked.size(), 1u); + EXPECT_EQ(picked[0], "id:000001,src:000000,op:havoc"); +} + +// Ranked (tacas 3c): the entries that reached new edges ("+cov") first, then +// the ones that only changed hit counts, each in id order -- so when the queue +// outgrows the cap, the seeds KLEE gets are the ones that went somewhere new. +TEST(SelectQueueEntries, PutsNewCoverageFirst) { + const auto picked = Map2Check::selectQueueEntries( + {"id:000001,src:000000,op:havoc", "id:000002,src:000001,op:havoc,+cov", + "id:000003,src:000000,op:havoc", "id:000004,src:000002,op:havoc,+cov"}, + 3); + ASSERT_EQ(picked.size(), 3u); + EXPECT_EQ(picked[0], "id:000002,src:000001,op:havoc,+cov"); + EXPECT_EQ(picked[1], "id:000004,src:000002,op:havoc,+cov"); + EXPECT_EQ(picked[2], "id:000001,src:000000,op:havoc"); +} diff --git a/tests/unit/frontend/SlicerTest.cpp b/tests/unit/frontend/SlicerTest.cpp index 12e9babe6..707df2e97 100644 --- a/tests/unit/frontend/SlicerTest.cpp +++ b/tests/unit/frontend/SlicerTest.cpp @@ -34,7 +34,9 @@ TEST(NondetFunctionNames, CoversWhatNonDetPassInstruments) { const auto& names = Map2Check::nondetFunctionNames(); for (const char* type : {"bool", "char", "uchar", "short", "ushort", "int", "uint", "unsigned", "long", "ulong", "size_t", - "loff_t", "sector_t", "pointer", "pchar", "double"}) { + "loff_t", "sector_t", "pointer", "pchar", "double", + "float", "longlong", "ulonglong", "u8", "u16", "u32", + "memory"}) { const std::string name = std::string("__VERIFIER_nondet_") + type; EXPECT_NE(std::find(names.begin(), names.end(), name), names.end()) << name; } @@ -199,3 +201,46 @@ TEST(InstrumentedSliceCriteria, CollectsRuntimeThenExternalNames) { EXPECT_EQ(criteria[0], "map2check_check_deref"); EXPECT_EQ(criteria[1], "strcpy"); } + +// --- the slice cache (tacas 2d) ---------------------------------------------- + +// Every hybrid phase recreates the scratch directory and used to slice again: +// on eca-* the slicer timed out in phase 1 AND phase 2, and the run blew its +// budget. The cache reuses a slice only for the very same input and settings. +TEST(SliceCacheKey, IsDeterministic) { + EXPECT_EQ(Map2Check::sliceCacheKey("BC", "reach_error", "main", ""), + Map2Check::sliceCacheKey("BC", "reach_error", "main", "")); +} + +TEST(SliceCacheKey, ChangesWithEveryInput) { + const std::string base = + Map2Check::sliceCacheKey("BC", "reach_error", "main", ""); + EXPECT_NE(base, Map2Check::sliceCacheKey("BD", "reach_error", "main", "")); + EXPECT_NE(base, Map2Check::sliceCacheKey("BC", "reach_errors", "main", "")); + EXPECT_NE(base, Map2Check::sliceCacheKey("BC", "reach_error", "mai", "")); + EXPECT_NE(base, + Map2Check::sliceCacheKey("BC", "reach_error", "main", "--pta=fs")); + // Field boundaries count: moving a character between fields is another key. + EXPECT_NE(Map2Check::sliceCacheKey("B", "Creach_error", "main", ""), base); +} + +TEST(SliceCacheKey, IsAFileName) { + const std::string key = + Map2Check::sliceCacheKey("BC", "reach_error", "main", "--cda=ntscd"); + EXPECT_EQ(key.size(), 16u); + EXPECT_EQ(key.find_first_not_of("0123456789abcdef"), std::string::npos); +} + +TEST(SliceCachePath, SitsBesideTheScratchDirectory) { + EXPECT_EQ(Map2Check::sliceCachePath("/w", "abc.map2check"), + "/w/abc.map2check.slice"); +} + +TEST(SliceCleanupPasses, MapsTheKnob) { + EXPECT_EQ(Map2Check::sliceCleanupPasses(""), ""); + EXPECT_EQ(Map2Check::sliceCleanupPasses("none"), ""); + EXPECT_EQ(Map2Check::sliceCleanupPasses("light"), + "-passes='function(simplifycfg,dce),globaldce'"); + EXPECT_EQ(Map2Check::sliceCleanupPasses("o2"), "-O2"); + EXPECT_EQ(Map2Check::sliceCleanupPasses("bogus"), ""); +} diff --git a/tests/unit/frontend/TestSuiteTest.cpp b/tests/unit/frontend/TestSuiteTest.cpp index e8dafdec5..34e704ccc 100644 --- a/tests/unit/frontend/TestSuiteTest.cpp +++ b/tests/unit/frontend/TestSuiteTest.cpp @@ -262,3 +262,76 @@ TEST(IsoUtcNow, MatchesTheFormatTheFormatExpects) { EXPECT_EQ(now[16], ':'); EXPECT_EQ(now[19], 'Z'); } + +// Engines alternate (tacas 3b): more than one phase writes test cases into the +// same suite. A writer counting from 1 again overwrote the earlier phase's. +TEST(TestSuiteWriter, NumbersAfterTheCasesAlreadyThere) { + fs::path d = freshDir("tc_continue"); + { + Map2Check::TestSuiteWriter first(d.string()); + ASSERT_TRUE(first.writeTestCase({"1"}, false)); + ASSERT_TRUE(first.writeTestCase({"2"}, false)); + } + Map2Check::TestSuiteWriter second(d.string()); + ASSERT_TRUE(second.writeTestCase({"3"}, false)); + EXPECT_NE(slurp(d / "testcase-1.xml").find("1"), + std::string::npos); + EXPECT_NE(slurp(d / "testcase-3.xml").find("3"), + std::string::npos); +} + +// Under alternation every KLEE phase adds Cover-Branches cases: the cap and +// the duplicates are counted across phases, not per phase. +TEST(TestSuiteWriter, KnowsTheCasesAnEarlierWriterLeft) { + fs::path d = freshDir("tc_known"); + { + Map2Check::TestSuiteWriter first(d.string()); + ASSERT_TRUE(first.writeTestCase({"1", "a /dev/null || { apt-get update -qq && apt-get install -y -qq patchelf > /dev/null; } +command -v zip > /dev/null || { apt-get update -qq && apt-get install -y -qq zip > /dev/null; } + +STAGE=$(mktemp -d) +T=$STAGE/map2check +mkdir -p "$T"/{bin,lib,include,lib/afl} + +# --- Map2Check ------------------------------------------------------------- +cp -a "$INSTALL/map2check" "$T/" +cp -aL "$INSTALL/lib/." "$T/lib/" 2>/dev/null || true +rm -rf "$T/lib/clang" "$T/lib/klee" "$T/lib/libz3*" +cp "$HERE/../map2check-testcomp-wrapper.py" "$T/" +chmod +x "$T/map2check-testcomp-wrapper.py" + +# --- LLVM 16 --------------------------------------------------------------- +for tool in clang opt llvm-link; do cp -L "$LLVM/bin/$tool" "$T/bin/"; done +mkdir -p "$T/lib/clang" +cp -aL "$LLVM/lib/clang/16" "$T/lib/clang/" +cp -aL "$LLVM/lib/clang/16/include/." "$T/include/" + +# --- KLEE ------------------------------------------------------------------ +cp -L "$KLEE/bin/klee" "$KLEE/bin/kleaver" "$T/bin/" +cp -L "$KLEE/bin/ktest-tool" "$T/bin/" 2>/dev/null || true +mkdir -p "$T/lib/klee" +cp -aL "$KLEE/lib/klee/runtime" "$T/lib/klee/" + +# --- AFL++ ----------------------------------------------------------------- +cp -L "$AFL_ROOT/bin/afl-fuzz" "$AFL_ROOT/bin/afl-cc" "$T/bin/" +# Copies, not symlinks: an archive without links unpacks the same with any zip +# tool. afl-cc picks its mode from argv[0], so a copy behaves as the link would. +cp "$T/bin/afl-cc" "$T/bin/afl-clang-fast" +cp -aL "$AFL_ROOT/lib/afl/." "$T/lib/afl/" + +# --- shared libraries ------------------------------------------------------ +# Everything ldd resolves outside glibc (and the loader), for every ELF here. +is_glibc() { + case "$(basename "$1")" in + libc.so*|libm.so*|libdl.so*|libpthread.so*|librt.so*|ld-linux*|libresolv.so*|libutil.so*) return 0 ;; + esac + return 1 +} +elves=$(find "$T" -type f \( -perm -u+x -o -name '*.so*' \) -exec sh -c 'head -c4 "$1" | grep -q "ELF"' _ {} \; -print) +for elf in $elves; do + { ldd "$elf" 2>/dev/null || true; } | awk '/=> \//{print $3}' | while read -r lib; do + is_glibc "$lib" && continue + [ -e "$T/lib/$(basename "$lib")" ] || cp -L "$lib" "$T/lib/" + done +done +# Libraries bring their own dependencies: one more round over lib/. +for lib in "$T"/lib/*.so*; do + { ldd "$lib" 2>/dev/null || true; } | awk '/=> \//{print $3}' | while read -r dep; do + is_glibc "$dep" && continue + [ -e "$T/lib/$(basename "$dep")" ] || cp -L "$dep" "$T/lib/" + done +done + +# --- RUNPATH --------------------------------------------------------------- +for elf in $(find "$T" -type f -exec sh -c 'head -c4 "$1" | grep -q "ELF"' _ {} \; -print); do + dir=$(dirname "$elf") + rel=$(realpath --relative-to="$dir" "$T/lib") + # Relocatable objects (afl-compiler-rt.o) and static archives have no RUNPATH. + if patchelf --print-rpath "$elf" > /dev/null 2>&1; then + patchelf --set-rpath "\$ORIGIN/$rel" "$elf" + fi +done + +# --- check and zip --------------------------------------------------------- +missing=$(for elf in "$T"/map2check "$T"/bin/* "$T"/lib/*.so* "$T"/lib/afl/*.so; do + [ -f "$elf" ] || continue + { ldd "$elf" 2>/dev/null || true; } | grep "not found" | sed "s#^#$(basename "$elf"): #" || true +done | sort -u) +if [ -n "$missing" ]; then echo "unresolved libraries:"; echo "$missing"; exit 1; fi + +rm -f "$OUT" +if [ -n "$(find "$T" -type l)" ]; then echo "symlinks left in the archive:"; find "$T" -type l; exit 1; fi +(cd "$STAGE" && zip -qr "$OUT" map2check) +echo "archive: $OUT ($(du -h "$OUT" | cut -f1), $(find "$T" -type f | wc -l) files)" +rm -rf "$STAGE"