Improve int domain bitwise operators, support struct bitfields

[H-Innos]

Additions for my BSc thesis "Improving Bitwise Operation Analysis in Goblint", supervised by Simmo Saan. This includes making the logand, logor, logxor, lognot, and shift_right abstractions more precise in the interval, interval sets, defexc, and enums domains. Additionally, I added support for the analysis of bit-fields.

[michael-schwarz]

Perhaps the fixed tutorial should not be committed?

[sim642]

I fixed the merge conflicts with #1623 and #1727, bringing this up to date with master.

[sim642]

There seems to be a bug: the regression test 83/07 refine-with-interval crashes. It looks like & for intervals computes something unsound there.
EDIT: I added a unit test for the case. I'm surprised that the domain tests never construct such a case.

I also did a 60s sv-benchmarks run, which revealed 10 unsound unreach-call results:

• hardware-verification-bv/btor2c-lazyMod.adding.1.prop1-func-interl.yml
• hardware-verification-bv/btor2c-lazyMod.adding.2.prop1-func-interl.yml
• hardware-verification-bv/btor2c-lazyMod.adding.3.prop1-func-interl.yml
• hardware-verification-bv/btor2c-lazyMod.adding.4.prop1-func-interl.yml
• hardware-verification-bv/btor2c-lazyMod.adding.5.prop1-func-interl.yml
• hardware-verification-bv/btor2c-lazyMod.adding.6.prop1-func-interl.yml
• hardware-verification-bv/btor2c-lazyMod.sw_sym_ex_v.yml
• hardware-verification-bv/btor2c-lazyMod.unsafe_analog_estimation_convergence.yml
• hardware-verification-bv/btor2c-lazyMod.unsafe_intersymbol_analog_estimation_convergence.yml
• hardware-verification-bv/btor2c-lazyMod.vis_arrays_palu.yml

[sim642]

I did a new 60s sv-benchmarks run with the latest fixes. All of the unsoundness is now fixed!
What's more, with these changes we can solve 26 new tasks: https://goblint.cs.ut.ee/results/252-all-pr-1739-after2/table-generator-cmp.diff.html#/table?filter=0(0*status*(status(in(unknown)),category(notIn()))),1(0*status*(status(notIn()),category(notIn()))),2(0*status*(status(in(true)),category(notIn())))&hidden=1

[michael-schwarz]

I saw the commit message

now correctness proven for all

and got curious. What exactly are you proving here and how are you going about it? Are these manual proofs or some sort of mechanized approach? If yes, can we use it for our other domains too?

[sim642]

and got curious. What exactly are you proving here and how are you going about it? Are these manual proofs or some sort of mechanized approach? If yes, can we use it for our other domains too?

Since the thesis will be in Estonian, I can't say "wait a week". Various cases of each bitwise operation are formulated as Z3 (instead of OCaml code) queries over the bitvector SMT theory by bitblasting or whatever Z3 decides to do.
The point being that it's very difficult to reason about bits in two's complement representations of negative numbers and how those correspond to interval (or bit range) bounds. So it's an extra layer of confidence, but for manual reencoding of the OCaml implementation as Z3.

One probably could do this more widely, but the manual re-encoding is still error prone, so the guarantees aren't super strong.
In a broader context, it would be much more valuable to try to extract some domain implementations from Rocq or whatnot.

Nevertheless, I'm wondering if we should have these Z3 proof scripts added into this repository for the sake of it?

[michael-schwarz]

Interesting!

Nevertheless, I'm wondering if we should have these Z3 proof scripts added into this repository for the sake of it?

Not sure if we want to add it to the repo as it may go out of sync, but I'm definitely curious what they look like!

[H-Innos]

Not sure if we want to add it to the repo as it may go out of sync, but I'm definitely curious what they look like!

All the proofs are in this repo: https://github.com/H-Innos/Z3