/* This file is part of solidity. solidity is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version. solidity is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details. You should have received a copy of the GNU General Public License along with solidity. If not, see . */ // SPDX-License-Identifier: GPL-3.0 #include #include #include #include #ifdef HAVE_Z3_DLOPEN #include #endif using namespace std; using namespace solidity::smtutil; using namespace solidity::util; bool Z3Interface::available() { #ifdef HAVE_Z3_DLOPEN return Z3Loader::get().available(); #else return true; #endif } Z3Interface::Z3Interface(std::optional _queryTimeout): SolverInterface(_queryTimeout), m_solver(m_context) { // These need to be set globally. z3::set_param("rewriter.pull_cheap_ite", true); if (m_queryTimeout) m_context.set("timeout", int(*m_queryTimeout)); else z3::set_param("rlimit", resourceLimit); } void Z3Interface::reset() { m_constants.clear(); m_functions.clear(); m_solver.reset(); } void Z3Interface::push() { m_solver.push(); } void Z3Interface::pop() { m_solver.pop(); } void Z3Interface::declareVariable(string const& _name, SortPointer const& _sort) { smtAssert(_sort, ""); if (_sort->kind == Kind::Function) declareFunction(_name, *_sort); else if (m_constants.count(_name)) m_constants.at(_name) = m_context.constant(_name.c_str(), z3Sort(*_sort)); else m_constants.emplace(_name, m_context.constant(_name.c_str(), z3Sort(*_sort))); } void Z3Interface::declareFunction(string const& _name, Sort const& _sort) { smtAssert(_sort.kind == Kind::Function, ""); FunctionSort fSort = dynamic_cast(_sort); if (m_functions.count(_name)) m_functions.at(_name) = m_context.function(_name.c_str(), z3Sort(fSort.domain), z3Sort(*fSort.codomain)); else m_functions.emplace(_name, m_context.function(_name.c_str(), z3Sort(fSort.domain), z3Sort(*fSort.codomain))); } void Z3Interface::addAssertion(Expression const& _expr) { m_solver.add(toZ3Expr(_expr)); } pair> Z3Interface::check(vector const& _expressionsToEvaluate) { CheckResult result; vector values; try { switch (m_solver.check()) { case z3::check_result::sat: result = CheckResult::SATISFIABLE; break; case z3::check_result::unsat: result = CheckResult::UNSATISFIABLE; break; case z3::check_result::unknown: result = CheckResult::UNKNOWN; break; } if (result == CheckResult::SATISFIABLE && !_expressionsToEvaluate.empty()) { z3::model m = m_solver.get_model(); for (Expression const& e: _expressionsToEvaluate) values.push_back(util::toString(m.eval(toZ3Expr(e)))); } } catch (z3::exception const& _err) { set msgs{ /// Resource limit (rlimit) exhausted. "max. resource limit exceeded", /// User given timeout exhausted. "canceled" }; if (msgs.count(_err.msg())) result = CheckResult::UNKNOWN; else result = CheckResult::ERROR; values.clear(); } return make_pair(result, values); } z3::expr Z3Interface::toZ3Expr(Expression const& _expr) { if (_expr.arguments.empty() && m_constants.count(_expr.name)) return m_constants.at(_expr.name); z3::expr_vector arguments(m_context); for (auto const& arg: _expr.arguments) arguments.push_back(toZ3Expr(arg)); try { string const& n = _expr.name; if (m_functions.count(n)) return m_functions.at(n)(arguments); else if (m_constants.count(n)) { smtAssert(arguments.empty(), ""); return m_constants.at(n); } else if (arguments.empty()) { if (n == "true") return m_context.bool_val(true); else if (n == "false") return m_context.bool_val(false); else if (_expr.sort->kind == Kind::Sort) { auto sortSort = dynamic_pointer_cast(_expr.sort); smtAssert(sortSort, ""); return m_context.constant(n.c_str(), z3Sort(*sortSort->inner)); } else try { return m_context.int_val(n.c_str()); } catch (z3::exception const& _e) { smtAssert(false, _e.msg()); } } smtAssert(_expr.hasCorrectArity(), ""); if (n == "ite") return z3::ite(arguments[0], arguments[1], arguments[2]); else if (n == "not") return !arguments[0]; else if (n == "and") return arguments[0] && arguments[1]; else if (n == "or") return arguments[0] || arguments[1]; else if (n == "=>") return z3::implies(arguments[0], arguments[1]); else if (n == "=") return arguments[0] == arguments[1]; else if (n == "<") return arguments[0] < arguments[1]; else if (n == "<=") return arguments[0] <= arguments[1]; else if (n == ">") return arguments[0] > arguments[1]; else if (n == ">=") return arguments[0] >= arguments[1]; else if (n == "+") return arguments[0] + arguments[1]; else if (n == "-") return arguments[0] - arguments[1]; else if (n == "*") return arguments[0] * arguments[1]; else if (n == "div") return arguments[0] / arguments[1]; else if (n == "mod") return z3::mod(arguments[0], arguments[1]); else if (n == "bvnot") return ~arguments[0]; else if (n == "bvand") return arguments[0] & arguments[1]; else if (n == "bvor") return arguments[0] | arguments[1]; else if (n == "bvxor") return arguments[0] ^ arguments[1]; else if (n == "bvshl") return z3::shl(arguments[0], arguments[1]); else if (n == "bvlshr") return z3::lshr(arguments[0], arguments[1]); else if (n == "bvashr") return z3::ashr(arguments[0], arguments[1]); else if (n == "int2bv") { size_t size = std::stoul(_expr.arguments[1].name); return z3::int2bv(static_cast(size), arguments[0]); } else if (n == "bv2int") { auto intSort = dynamic_pointer_cast(_expr.sort); smtAssert(intSort, ""); return z3::bv2int(arguments[0], intSort->isSigned); } else if (n == "select") return z3::select(arguments[0], arguments[1]); else if (n == "store") return z3::store(arguments[0], arguments[1], arguments[2]); else if (n == "const_array") { shared_ptr sortSort = std::dynamic_pointer_cast(_expr.arguments[0].sort); smtAssert(sortSort, ""); auto arraySort = dynamic_pointer_cast(sortSort->inner); smtAssert(arraySort && arraySort->domain, ""); return z3::const_array(z3Sort(*arraySort->domain), arguments[1]); } else if (n == "tuple_get") { size_t index = stoul(_expr.arguments[1].name); return z3::func_decl(m_context, Z3_get_tuple_sort_field_decl(m_context, z3Sort(*_expr.arguments[0].sort), static_cast(index)))(arguments[0]); } else if (n == "tuple_constructor") { auto constructor = z3::func_decl(m_context, Z3_get_tuple_sort_mk_decl(m_context, z3Sort(*_expr.sort))); smtAssert(constructor.arity() == arguments.size(), ""); z3::expr_vector args(m_context); for (auto const& arg: arguments) args.push_back(arg); return constructor(args); } smtAssert(false); } catch (z3::exception const& _e) { smtAssert(false, _e.msg()); } smtAssert(false); // FIXME: Workaround for spurious GCC 12.1 warning (https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105794) util::unreachable(); } Expression Z3Interface::fromZ3Expr(z3::expr const& _expr) { auto sort = fromZ3Sort(_expr.get_sort()); if (_expr.is_const() || _expr.is_var()) return Expression(_expr.to_string(), {}, sort); if (_expr.is_quantifier()) { string quantifierName; if (_expr.is_exists()) quantifierName = "exists"; else if (_expr.is_forall()) quantifierName = "forall"; else if (_expr.is_lambda()) quantifierName = "lambda"; else smtAssert(false, ""); return Expression(quantifierName, {fromZ3Expr(_expr.body())}, sort); } smtAssert(_expr.is_app(), ""); vector arguments; for (unsigned i = 0; i < _expr.num_args(); ++i) arguments.push_back(fromZ3Expr(_expr.arg(i))); auto kind = _expr.decl().decl_kind(); if (_expr.is_ite()) return Expression::ite(arguments[0], arguments[1], arguments[2]); else if (_expr.is_not()) return !arguments[0]; else if (_expr.is_and()) return Expression::mkAnd(arguments); else if (_expr.is_or()) return Expression::mkOr(arguments); else if (_expr.is_implies()) return Expression::implies(arguments[0], arguments[1]); else if (_expr.is_eq()) { smtAssert(arguments.size() == 2, ""); return arguments[0] == arguments[1]; } else if (kind == Z3_OP_ULT || kind == Z3_OP_SLT) return arguments[0] < arguments[1]; else if (kind == Z3_OP_LE || kind == Z3_OP_ULEQ || kind == Z3_OP_SLEQ) return arguments[0] <= arguments[1]; else if (kind == Z3_OP_GT || kind == Z3_OP_SGT) return arguments[0] > arguments[1]; else if (kind == Z3_OP_GE || kind == Z3_OP_UGEQ || kind == Z3_OP_SGEQ) return arguments[0] >= arguments[1]; else if (kind == Z3_OP_ADD) return Expression::mkPlus(arguments); else if (kind == Z3_OP_SUB) { smtAssert(arguments.size() == 2, ""); return arguments[0] - arguments[1]; } else if (kind == Z3_OP_MUL) return Expression::mkMul(arguments); else if (kind == Z3_OP_DIV) { smtAssert(arguments.size() == 2, ""); return arguments[0] / arguments[1]; } else if (kind == Z3_OP_MOD) return arguments[0] % arguments[1]; else if (kind == Z3_OP_XOR) return arguments[0] ^ arguments[1]; else if (kind == Z3_OP_BNOT) return !arguments[0]; else if (kind == Z3_OP_BSHL) return arguments[0] << arguments[1]; else if (kind == Z3_OP_BLSHR) return arguments[0] >> arguments[1]; else if (kind == Z3_OP_BASHR) return Expression::ashr(arguments[0], arguments[1]); else if (kind == Z3_OP_INT2BV) return Expression::int2bv(arguments[0], _expr.get_sort().bv_size()); else if (kind == Z3_OP_BV2INT) return Expression::bv2int(arguments[0]); else if (kind == Z3_OP_EXTRACT) return Expression("extract", arguments, sort); else if (kind == Z3_OP_SELECT) return Expression::select(arguments[0], arguments[1]); else if (kind == Z3_OP_STORE) return Expression::store(arguments[0], arguments[1], arguments[2]); else if (kind == Z3_OP_CONST_ARRAY) { auto sortSort = make_shared(fromZ3Sort(_expr.get_sort())); return Expression::const_array(Expression(sortSort), arguments[0]); } else if (kind == Z3_OP_DT_CONSTRUCTOR) { auto sortSort = make_shared(fromZ3Sort(_expr.get_sort())); return Expression::tuple_constructor(Expression(sortSort), arguments); } else if (kind == Z3_OP_DT_ACCESSOR) return Expression("dt_accessor_" + _expr.decl().name().str(), arguments, sort); else if (kind == Z3_OP_DT_IS) return Expression("dt_is", {arguments.at(0)}, sort); else if ( kind == Z3_OP_UNINTERPRETED || kind == Z3_OP_RECURSIVE ) return Expression(_expr.decl().name().str(), arguments, fromZ3Sort(_expr.get_sort())); smtAssert(false); // FIXME: Workaround for spurious GCC 12.1 warning (https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105794) util::unreachable(); } z3::sort Z3Interface::z3Sort(Sort const& _sort) { switch (_sort.kind) { case Kind::Bool: return m_context.bool_sort(); case Kind::Int: return m_context.int_sort(); case Kind::BitVector: return m_context.bv_sort(dynamic_cast(_sort).size); case Kind::Array: { auto const& arraySort = dynamic_cast(_sort); return m_context.array_sort(z3Sort(*arraySort.domain), z3Sort(*arraySort.range)); } case Kind::Tuple: { auto const& tupleSort = dynamic_cast(_sort); vector cMembers; for (auto const& member: tupleSort.members) cMembers.emplace_back(member.c_str()); /// Using this instead of the function below because with that one /// we can't use `&sorts[0]` here. vector sorts; for (auto const& sort: tupleSort.components) sorts.push_back(z3Sort(*sort)); z3::func_decl_vector projs(m_context); z3::func_decl tupleConstructor = m_context.tuple_sort( tupleSort.name.c_str(), static_cast(tupleSort.members.size()), cMembers.data(), sorts.data(), projs ); return tupleConstructor.range(); } default: break; } smtAssert(false, ""); // Cannot be reached. return m_context.int_sort(); } z3::sort_vector Z3Interface::z3Sort(vector const& _sorts) { z3::sort_vector z3Sorts(m_context); for (auto const& _sort: _sorts) z3Sorts.push_back(z3Sort(*_sort)); return z3Sorts; } SortPointer Z3Interface::fromZ3Sort(z3::sort const& _sort) { if (_sort.is_bool()) return SortProvider::boolSort; if (_sort.is_int()) return SortProvider::sintSort; if (_sort.is_bv()) return make_shared(_sort.bv_size()); if (_sort.is_array()) return make_shared(fromZ3Sort(_sort.array_domain()), fromZ3Sort(_sort.array_range())); if (_sort.is_datatype()) { auto name = _sort.name().str(); auto constructor = z3::func_decl(m_context, Z3_get_tuple_sort_mk_decl(m_context, _sort)); vector memberNames; vector memberSorts; for (unsigned i = 0; i < constructor.arity(); ++i) { auto accessor = z3::func_decl(m_context, Z3_get_tuple_sort_field_decl(m_context, _sort, i)); memberNames.push_back(accessor.name().str()); memberSorts.push_back(fromZ3Sort(accessor.range())); } return make_shared(name, memberNames, memberSorts); } smtAssert(false, ""); } vector Z3Interface::fromZ3Sort(z3::sort_vector const& _sorts) { return applyMap(_sorts, [this](auto const& sort) { return fromZ3Sort(sort); }); }