|
| 1 | +# Bitvector support in Theta |
| 2 | + |
| 3 | +As of now, Theta has basic bitvector support for the CFA formalism. |
| 4 | + |
| 5 | +## Overview |
| 6 | + |
| 7 | +In Theta, every bitvector has a length, and is either signed or unsigned. It follows, that the range of every bitvector has a size of 2<sup>n</sup>. There are different operations that are available for bitvectors. It is important to note, that only operations between bitvectors with the same size and signedness are valid. |
| 8 | + |
| 9 | +Bitvectors have n bits. If the bitvector is unsigned then the values of the bits come from the binary representation of the underlying number. However, if the bitvector is signed then the values of the bits come from the two's complement representation of the underlying number. |
| 10 | + |
| 11 | +## Declaring bitvector variables |
| 12 | + |
| 13 | +To declare a bitvector variable, one has to specify the size and the signedness. |
| 14 | + |
| 15 | +``` |
| 16 | +var x1 : bv[4] // Unsigned 4-bit-long bitvector |
| 17 | +var x2 : bitvec[5] // Unsigned 5-bit-long bitvector |
| 18 | +
|
| 19 | +var u1 : ubv[4] // Unsigned 4-bit-long bitvector |
| 20 | +var u2 : ubitvec[6] // Unsigned 6-bit-long bitvector |
| 21 | +
|
| 22 | +var s1 : sbv[4] // Signed 4-bit-long bitvector |
| 23 | +var s2 : sbitvec[7] // Signed 7-bit-long bitvector |
| 24 | +
|
| 25 | +``` |
| 26 | + |
| 27 | +## Bitvector literals |
| 28 | + |
| 29 | +There is a new literal, the bitvector literal that can be used to create bitvectors. Each literal defines the size and signedness of the literal. Moreover, eah literal can be entered using three different formats: |
| 30 | + |
| 31 | +- The bitwise precise binary form |
| 32 | +- The bitwise precise hexadecimal form |
| 33 | +- And the non-bitwise-precise, although user-friendly decimal form |
| 34 | + |
| 35 | +The two bitwise precise forms specify the value for all bits directly. These are useful for unsigned bitvectors, where there is no two's complement behavior (e.g. bitfields). |
| 36 | + |
| 37 | +``` |
| 38 | +4'b0010 // Unsiged 4-bit-long bitvector literal (binary form) |
| 39 | +8'xAF // Unsiged 4-bit-long bitvector literal (hexadecimal form) |
| 40 | +
|
| 41 | +4'bu0010 // Unsiged 4-bit-long bitvector literal (binary form) |
| 42 | +8'xuAF // Unsiged 4-bit-long bitvector literal (hexadecimal form) |
| 43 | +
|
| 44 | +4'bs0010 // Signed 4-bit-long bitvector literal (binary form, not recommended) |
| 45 | +8'xsAF // Signed 4-bit-long bitvector literal (hexadecimal form, not recommended) |
| 46 | +``` |
| 47 | + |
| 48 | +The non-bitwise-precise decimal form can be used to create bitvectors that are based on numbers. Thsi form is recommended for signed bitvectors, or unsigned bitvectors that are not bitfields. |
| 49 | + |
| 50 | +``` |
| 51 | +4'd10 // Unsigned 4-bit-long bitvector literal (decimal form) |
| 52 | +
|
| 53 | +4'du10 // Unsigned 4-bit-long bitvector literal (decimal form) |
| 54 | +
|
| 55 | +4'ds5 // Signed 4-bit-long bitvector literal (decimal form, positive value) |
| 56 | +4'ds-5 // Signed 4-bit-long bitvector literal (decimal form, negative value) |
| 57 | +``` |
| 58 | + |
| 59 | +## Operations on bitvectors |
| 60 | + |
| 61 | +The following operations are defined on bitvectors. As a general rule, every binary operation requires the bitvector on the left hand side and the bitvector on the right hand side to have the same size and signedness. |
| 62 | + |
| 63 | +The operators and their precedence are based on the [operators in C langauge](https://en.cppreference.com/w/c/language/operator_precedence). |
| 64 | + |
| 65 | +### Basic arithmetic operations |
| 66 | + |
| 67 | +These operations perform basic arithmetic operations on bitvectors. These operations require that the bitvector on the left hand side and the bitvector on the right hand side have the same size and signedness. These operations overflow! |
| 68 | + |
| 69 | +- **Addition:** Adds two bitvectors; `a + b` |
| 70 | +- **Subtraction:** Subtracts a from b; `a - b` |
| 71 | +- **Multiplication:** Multiplies two bitvectors; `a * b` |
| 72 | +- **Integer division:** Divides two bitvectors, and takes the integer part of the result; `a / b` |
| 73 | +- **Modulo:** Calculates (a mod b); `a mod b` |
| 74 | +- **Remainder:** Calculates the remainder of a / b; `a rem b` |
| 75 | +- **Negate:** Negates the value of a (only valid for signed bitvectors); `-a` |
| 76 | + |
| 77 | +### Bitvector specific operations |
| 78 | + |
| 79 | +These operations are specific to bitvectors only. These operations require that the bitvector on the left hand side and the bitvector on the right hand side have the same size and signedness. For the exact semantics check out the respective operators in C. These operations overflow! |
| 80 | + |
| 81 | +- **Bitwise and**: Ands two bitvectors; `a & b` |
| 82 | +- **Bitwise or**: Ors two bitvectors; `a | b` |
| 83 | +- **Bitwise xor**: XORs two bitvectors; `a ^ b` |
| 84 | +- **Bitwise shift left**: Shifts a to left with b; `a << b` |
| 85 | +- **Bitwise shift right**: Shifts a to right with b; `a >> b` |
| 86 | +- **Bitwise not:** Negates all the bits in bitvectors; `~a` |
| 87 | + |
| 88 | +### Relational operations |
| 89 | + |
| 90 | +These operations encode relational operations between bitvectors. These operations require that the bitvector on the left hand side and the bitvector on the right hand side have the same size and signedness. |
| 91 | + |
| 92 | +- **Equality**: Checks if a equals to b; `a = b` |
| 93 | +- **Non-equality**: Checks if a does not equal to b; `a /= b` |
| 94 | +- **Greater than or equals to**: Checks if a is greater than or equals to b; `a >= b` |
| 95 | +- **Greater than**: Checks if a is greater than b; `a > b` |
| 96 | +- **Less than or equals to**: Checks if a is less than or equals to b; `a <= b` |
| 97 | +- **Less than**: Checks if a is less than b; `a < b` |
| 98 | + |
| 99 | +### Conversion "operations" |
| 100 | + |
| 101 | +Bitvectors can be converted to integers, and vice-versa. However, since integers can have an arbitrily huge value, should that value be impossible to be represented in the bitvectors range, an exception will be thrown. So procede with caution! |
| 102 | + |
| 103 | +There is no explicit conversion operator, however, the assignment statement converts between the two types. |
| 104 | + |
| 105 | +``` |
| 106 | +var bv1 : bv[4] |
| 107 | +var i1 : int |
| 108 | +
|
| 109 | +// ... |
| 110 | +
|
| 111 | +L0 -> L1 { |
| 112 | + bv1 := i1 |
| 113 | + i1 := bv1 |
| 114 | +} |
| 115 | +``` |
| 116 | + |
| 117 | +## Algorithmic support for verification with bitvectors |
| 118 | + |
| 119 | +As of now, bitvectors are only partially supported due to the fact, that the underlying SMT solver, Z3 does not support interpolation when bitvectors are involved. |
| 120 | + |
| 121 | +As a result, CEGAR with predicate abstraction is not supported at all. However, CEGAR with explicit value abstraction, and with the UNSAT core refinement strategy is working preoperty, as it does not rely on the interpolation capabilities of the SMT solver. |
0 commit comments