|
| 1 | +# Lemmas for MIR symbolic execution |
| 2 | + |
| 3 | +This file contains basic lemmas required for symbolic execution of MIR programs using `kmir`. |
| 4 | + |
| 5 | +Lemmas are simpliciations of symbolic function application that aims to confirm conditions for rewrite rules to avoid spurious branching on symbolic program parts. |
| 6 | + |
| 7 | +Some of the lemmas relate to the control flow implementation in `kmir.md` and will be needed in various proofs (for instance the simplification of list size for partially-symbolic lists of locals or stack frames). |
| 8 | +Others are related to helper functions used for integer arithmetic. |
| 9 | + |
| 10 | +```k |
| 11 | +requires "../rt/data.md" |
| 12 | +requires "../kmir.md" |
| 13 | +
|
| 14 | +module KMIR-LEMMAS |
| 15 | + imports RT-DATA-HIGH |
| 16 | +
|
| 17 | + imports LIST |
| 18 | + imports INT-SYMBOLIC |
| 19 | + imports BOOL |
| 20 | +``` |
| 21 | +## Simplifications for lists to avoid spurious branching on error cases in control flow |
| 22 | + |
| 23 | +Rewrite rules that look up locals or stack frames require that an index into the respective `List`s in the configuration be within the bounds of the locals list/stack. Therefore, the `size` function on lists needs to be computed. The following simplifications allow for locals and stacks to have concrete values in the beginning but a symbolic rest (of unknown size). |
| 24 | +The lists used in the semantics are cons-lists, so only rules with a head element match are required. |
| 25 | + |
| 26 | +```k |
| 27 | + rule N <Int size(_LIST:List) => true |
| 28 | + requires N <Int 0 |
| 29 | + [simplification, symbolic(_LIST)] |
| 30 | +
|
| 31 | + rule N <Int size(ListItem(_) REST:List) => N -Int 1 <Int size(REST) |
| 32 | + requires 0 <Int N |
| 33 | + [simplification, symbolic(REST)] |
| 34 | +``` |
| 35 | + |
| 36 | +## Simplifications related to the `truncate` function |
| 37 | + |
| 38 | +The `truncate` function is used in various overflow checks in integer arithmetic. |
| 39 | +Therefore, its value range should be simplified for symbolic input asserted to be in range. |
| 40 | + |
| 41 | +```k |
| 42 | + rule truncate(VAL, WIDTH, Unsigned) => VAL |
| 43 | + requires VAL <Int (1 <<Int WIDTH) |
| 44 | + andBool 0 <=Int VAL |
| 45 | + [simplification] |
| 46 | +
|
| 47 | + rule truncate(VAL, WIDTH, Signed) => VAL |
| 48 | + requires VAL <Int (1 <<Int (WIDTH -Int 1)) |
| 49 | + andBool 0 -Int (1 <<Int (WIDTH -Int 1)) <=Int VAL |
| 50 | + [simplification] |
| 51 | +
|
| 52 | +``` |
| 53 | + |
| 54 | + |
| 55 | +```k |
| 56 | +endmodule |
| 57 | +``` |
0 commit comments