./Ultimate.py --spec ../sv-benchmarks/c/properties/no-overflow.prp --file ../sv-benchmarks/c/ldv-consumption/32_7a_cilled_linux-3.8-rc1-drivers--scsi--scsi_tgt.ko-main.cil.out.i --full-output --architecture 64bit -------------------------------------------------------------------------------- Checking for overflows Using default analysis Version 48c9605d Calling Ultimate with: /root/.sdkman/candidates/java/21.0.5-tem/bin/java -Dosgi.configuration.area=/storage/repos/ultimate-jdk21/releaseScripts/default/UAutomizer-linux/data/config -Xmx15G -Xms4m -jar /storage/repos/ultimate-jdk21/releaseScripts/default/UAutomizer-linux/plugins/org.eclipse.equinox.launcher_1.6.800.v20240513-1750.jar -data @noDefault -ultimatedata /storage/repos/ultimate-jdk21/releaseScripts/default/UAutomizer-linux/data -tc /storage/repos/ultimate-jdk21/releaseScripts/default/UAutomizer-linux/config/AutomizerReach.xml -i ../sv-benchmarks/c/ldv-consumption/32_7a_cilled_linux-3.8-rc1-drivers--scsi--scsi_tgt.ko-main.cil.out.i -s /storage/repos/ultimate-jdk21/releaseScripts/default/UAutomizer-linux/config/svcomp-Overflow-64bit-Automizer_Default.epf --cacsl2boogietranslator.entry.function main --witnessprinter.witness.directory /storage/repos/ultimate-jdk21/releaseScripts/default/UAutomizer-linux --witnessprinter.witness.filename witness --witnessprinter.write.witness.besides.input.file false --witnessprinter.graph.data.specification CHECK( init(main()), LTL(G ! overflow) ) --witnessprinter.graph.data.producer Automizer --witnessprinter.graph.data.architecture 64bit --witnessprinter.graph.data.programhash e3b9005361fd0095f8dbb62f5fee3acdc88198cbc01de43b11979176397f6891 --- Real Ultimate output --- This is Ultimate 0.3.0-?-48c9605-m [2025-02-08 10:07:33,383 INFO L188 SettingsManager]: Resetting all preferences to default values... [2025-02-08 10:07:33,437 INFO L114 SettingsManager]: Loading settings from /storage/repos/ultimate-jdk21/releaseScripts/default/UAutomizer-linux/config/svcomp-Overflow-64bit-Automizer_Default.epf [2025-02-08 10:07:33,441 WARN L101 SettingsManager]: Preference file contains the following unknown settings: [2025-02-08 10:07:33,442 WARN L103 SettingsManager]: * de.uni_freiburg.informatik.ultimate.core.Log level for class [2025-02-08 10:07:33,455 INFO L130 SettingsManager]: Preferences different from defaults after loading the file: [2025-02-08 10:07:33,456 INFO L151 SettingsManager]: Preferences of UltimateCore differ from their defaults: [2025-02-08 10:07:33,456 INFO L153 SettingsManager]: * Log level for class=de.uni_freiburg.informatik.ultimate.lib.smtlibutils.quantifier.QuantifierPusher=ERROR; [2025-02-08 10:07:33,460 INFO L151 SettingsManager]: Preferences of Boogie Preprocessor differ from their defaults: [2025-02-08 10:07:33,460 INFO L153 SettingsManager]: * Use memory slicer=true [2025-02-08 10:07:33,460 INFO L151 SettingsManager]: Preferences of Boogie Procedure Inliner differ from their defaults: [2025-02-08 10:07:33,460 INFO L153 SettingsManager]: * Ignore calls to procedures called more than once=ONLY_FOR_SEQUENTIAL_PROGRAMS [2025-02-08 10:07:33,460 INFO L151 SettingsManager]: Preferences of BlockEncodingV2 differ from their defaults: [2025-02-08 10:07:33,460 INFO L153 SettingsManager]: * Create parallel compositions if possible=false [2025-02-08 10:07:33,460 INFO L153 SettingsManager]: * Use SBE=true [2025-02-08 10:07:33,460 INFO L151 SettingsManager]: Preferences of CACSL2BoogieTranslator differ from their defaults: [2025-02-08 10:07:33,460 INFO L153 SettingsManager]: * Pointer base address is valid at dereference=IGNORE [2025-02-08 10:07:33,460 INFO L153 SettingsManager]: * Overapproximate operations on floating types=true [2025-02-08 10:07:33,460 INFO L153 SettingsManager]: * Check division by zero=IGNORE [2025-02-08 10:07:33,460 INFO L153 SettingsManager]: * Pointer to allocated memory at dereference=IGNORE [2025-02-08 10:07:33,460 INFO L153 SettingsManager]: * If two pointers are subtracted or compared they have the same base address=IGNORE [2025-02-08 10:07:33,460 INFO L153 SettingsManager]: * Check array bounds for arrays that are off heap=IGNORE [2025-02-08 10:07:33,460 INFO L153 SettingsManager]: * Check absence of signed integer overflows=ASSERTandASSUME [2025-02-08 10:07:33,460 INFO L153 SettingsManager]: * Check unreachability of reach_error function=false [2025-02-08 10:07:33,461 INFO L153 SettingsManager]: * Check if freed pointer was valid=false [2025-02-08 10:07:33,461 INFO L153 SettingsManager]: * Behaviour of calls to undefined functions=OVERAPPROXIMATE_BEHAVIOUR [2025-02-08 10:07:33,461 INFO L153 SettingsManager]: * Use constant arrays=true [2025-02-08 10:07:33,461 INFO L151 SettingsManager]: Preferences of IcfgBuilder differ from their defaults: [2025-02-08 10:07:33,461 INFO L153 SettingsManager]: * Size of a code block=SequenceOfStatements [2025-02-08 10:07:33,461 INFO L153 SettingsManager]: * Only consider context switches at boundaries of atomic blocks=true [2025-02-08 10:07:33,461 INFO L153 SettingsManager]: * SMT solver=External_DefaultMode [2025-02-08 10:07:33,461 INFO L153 SettingsManager]: * Command for external solver=z3 SMTLIB2_COMPLIANT=true -memory:2024 -smt2 -in -t:4000 [2025-02-08 10:07:33,461 INFO L151 SettingsManager]: Preferences of TraceAbstraction differ from their defaults: [2025-02-08 10:07:33,461 INFO L153 SettingsManager]: * Compute Interpolants along a Counterexample=FPandBP [2025-02-08 10:07:33,461 INFO L153 SettingsManager]: * Compute procedure contracts=false [2025-02-08 10:07:33,461 INFO L153 SettingsManager]: * Positions where we compute the Hoare Annotation=LoopHeads [2025-02-08 10:07:33,461 INFO L153 SettingsManager]: * Trace refinement strategy=CAMEL [2025-02-08 10:07:33,461 INFO L153 SettingsManager]: * Command for external solver=z3 SMTLIB2_COMPLIANT=true -memory:2024 -smt2 -in [2025-02-08 10:07:33,461 INFO L153 SettingsManager]: * Apply one-shot large block encoding in concurrent analysis=false [2025-02-08 10:07:33,461 INFO L153 SettingsManager]: * Automaton type used in concurrency analysis=PETRI_NET [2025-02-08 10:07:33,461 INFO L153 SettingsManager]: * Order on configurations for Petri net unfoldings=DBO [2025-02-08 10:07:33,461 INFO L153 SettingsManager]: * SMT solver=External_ModelsAndUnsatCoreMode [2025-02-08 10:07:33,461 INFO L153 SettingsManager]: * Looper check in Petri net analysis=SEMANTIC Applying setting for plugin de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator: Entry function -> main Applying setting for plugin de.uni_freiburg.informatik.ultimate.witnessprinter: Witness directory -> /storage/repos/ultimate-jdk21/releaseScripts/default/UAutomizer-linux Applying setting for plugin de.uni_freiburg.informatik.ultimate.witnessprinter: Witness filename -> witness Applying setting for plugin de.uni_freiburg.informatik.ultimate.witnessprinter: Write witness besides input file -> false Applying setting for plugin de.uni_freiburg.informatik.ultimate.witnessprinter: Graph data specification -> CHECK( init(main()), LTL(G ! overflow) ) Applying setting for plugin de.uni_freiburg.informatik.ultimate.witnessprinter: Graph data producer -> Automizer Applying setting for plugin de.uni_freiburg.informatik.ultimate.witnessprinter: Graph data architecture -> 64bit Applying setting for plugin de.uni_freiburg.informatik.ultimate.witnessprinter: Graph data programhash -> e3b9005361fd0095f8dbb62f5fee3acdc88198cbc01de43b11979176397f6891 [2025-02-08 10:07:33,685 INFO L75 nceAwareModelManager]: Repository-Root is: /tmp [2025-02-08 10:07:33,693 INFO L261 ainManager$Toolchain]: [Toolchain 1]: Applicable parser(s) successfully (re)initialized [2025-02-08 10:07:33,695 INFO L217 ainManager$Toolchain]: [Toolchain 1]: Toolchain selected. [2025-02-08 10:07:33,696 INFO L270 PluginConnector]: Initializing CDTParser... [2025-02-08 10:07:33,696 INFO L274 PluginConnector]: CDTParser initialized [2025-02-08 10:07:33,698 INFO L431 ainManager$Toolchain]: [Toolchain 1]: Parsing single file: /storage/repos/ultimate-jdk21/releaseScripts/default/UAutomizer-linux/../sv-benchmarks/c/ldv-consumption/32_7a_cilled_linux-3.8-rc1-drivers--scsi--scsi_tgt.ko-main.cil.out.i [2025-02-08 10:07:34,818 INFO L533 CDTParser]: Created temporary CDT project at /storage/repos/ultimate-jdk21/releaseScripts/default/UAutomizer-linux/data/fec67eff8/a30f2c2010b145dfaa377918d7651399/FLAGde2529158 [2025-02-08 10:07:35,230 INFO L384 CDTParser]: Found 1 translation units. [2025-02-08 10:07:35,231 INFO L180 CDTParser]: Scanning /storage/repos/ultimate-jdk21/releaseScripts/default/sv-benchmarks/c/ldv-consumption/32_7a_cilled_linux-3.8-rc1-drivers--scsi--scsi_tgt.ko-main.cil.out.i [2025-02-08 10:07:35,270 INFO L427 CDTParser]: About to delete temporary CDT project at /storage/repos/ultimate-jdk21/releaseScripts/default/UAutomizer-linux/data/fec67eff8/a30f2c2010b145dfaa377918d7651399/FLAGde2529158 [2025-02-08 10:07:35,397 INFO L435 CDTParser]: Successfully deleted /storage/repos/ultimate-jdk21/releaseScripts/default/UAutomizer-linux/data/fec67eff8/a30f2c2010b145dfaa377918d7651399 [2025-02-08 10:07:35,398 INFO L299 ainManager$Toolchain]: ####################### [Toolchain 1] ####################### [2025-02-08 10:07:35,399 INFO L133 ToolchainWalker]: Walking toolchain with 6 elements. [2025-02-08 10:07:35,400 INFO L112 PluginConnector]: ------------------------CACSL2BoogieTranslator---------------------------- [2025-02-08 10:07:35,400 INFO L270 PluginConnector]: Initializing CACSL2BoogieTranslator... [2025-02-08 10:07:35,403 INFO L274 PluginConnector]: CACSL2BoogieTranslator initialized [2025-02-08 10:07:35,403 INFO L184 PluginConnector]: Executing the observer ACSLObjectContainerObserver from plugin CACSL2BoogieTranslator for "CDTParser AST 08.02 10:07:35" (1/1) ... [2025-02-08 10:07:35,404 INFO L204 PluginConnector]: Invalid model from CACSL2BoogieTranslator for observer de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator.ACSLObjectContainerObserver@1b9500ea and model type de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 08.02 10:07:35, skipping insertion in model container [2025-02-08 10:07:35,404 INFO L184 PluginConnector]: Executing the observer CACSL2BoogieTranslatorObserver from plugin CACSL2BoogieTranslator for "CDTParser AST 08.02 10:07:35" (1/1) ... [2025-02-08 10:07:35,490 INFO L175 MainTranslator]: Built tables and reachable declarations [2025-02-08 10:07:36,769 INFO L210 PostProcessor]: Analyzing one entry point: main [2025-02-08 10:07:36,786 INFO L200 MainTranslator]: Completed pre-run [2025-02-08 10:07:36,981 WARN L75 lationResultReporter]: Unsoundness Warning: Ignoring inline assembler instruction C: __asm__ volatile ("mfence": : : "memory"); [7332] [2025-02-08 10:07:37,022 INFO L210 PostProcessor]: Analyzing one entry point: main [2025-02-08 10:07:37,060 INFO L204 MainTranslator]: Completed translation [2025-02-08 10:07:37,060 INFO L201 PluginConnector]: Adding new model de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 08.02 10:07:37 WrapperNode [2025-02-08 10:07:37,061 INFO L131 PluginConnector]: ------------------------ END CACSL2BoogieTranslator---------------------------- [2025-02-08 10:07:37,061 INFO L112 PluginConnector]: ------------------------Boogie Procedure Inliner---------------------------- [2025-02-08 10:07:37,062 INFO L270 PluginConnector]: Initializing Boogie Procedure Inliner... [2025-02-08 10:07:37,062 INFO L274 PluginConnector]: Boogie Procedure Inliner initialized [2025-02-08 10:07:37,066 INFO L184 PluginConnector]: Executing the observer TypeChecker from plugin Boogie Procedure Inliner for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 08.02 10:07:37" (1/1) ... [2025-02-08 10:07:37,093 INFO L184 PluginConnector]: Executing the observer Inliner from plugin Boogie Procedure Inliner for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 08.02 10:07:37" (1/1) ... [2025-02-08 10:07:37,139 INFO L138 Inliner]: procedures = 188, calls = 660, calls flagged for inlining = 75, calls inlined = 50, statements flattened = 1355 [2025-02-08 10:07:37,139 INFO L131 PluginConnector]: ------------------------ END Boogie Procedure Inliner---------------------------- [2025-02-08 10:07:37,140 INFO L112 PluginConnector]: ------------------------Boogie Preprocessor---------------------------- [2025-02-08 10:07:37,140 INFO L270 PluginConnector]: Initializing Boogie Preprocessor... [2025-02-08 10:07:37,140 INFO L274 PluginConnector]: Boogie Preprocessor initialized [2025-02-08 10:07:37,152 INFO L184 PluginConnector]: Executing the observer EnsureBoogieModelObserver from plugin Boogie Preprocessor for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 08.02 10:07:37" (1/1) ... [2025-02-08 10:07:37,152 INFO L184 PluginConnector]: Executing the observer TypeChecker from plugin Boogie Preprocessor for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 08.02 10:07:37" (1/1) ... [2025-02-08 10:07:37,166 INFO L184 PluginConnector]: Executing the observer MemorySlicer from plugin Boogie Preprocessor for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 08.02 10:07:37" (1/1) ... [2025-02-08 10:07:37,287 INFO L175 MemorySlicer]: Split 204 memory accesses to 8 slices as follows [2, 32, 5, 9, 12, 8, 115, 21]. 56 percent of accesses are in the largest equivalence class. The 81 initializations are split as follows [2, 4, 0, 9, 12, 0, 54, 0]. The 38 writes are split as follows [0, 28, 0, 0, 0, 0, 9, 1]. [2025-02-08 10:07:37,288 INFO L184 PluginConnector]: Executing the observer ConstExpander from plugin Boogie Preprocessor for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 08.02 10:07:37" (1/1) ... [2025-02-08 10:07:37,288 INFO L184 PluginConnector]: Executing the observer StructExpander from plugin Boogie Preprocessor for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 08.02 10:07:37" (1/1) ... [2025-02-08 10:07:37,337 INFO L184 PluginConnector]: Executing the observer ReplaceArrayAssignments from plugin Boogie Preprocessor for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 08.02 10:07:37" (1/1) ... [2025-02-08 10:07:37,341 INFO L184 PluginConnector]: Executing the observer FunctionInliner from plugin Boogie Preprocessor for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 08.02 10:07:37" (1/1) ... [2025-02-08 10:07:37,354 INFO L184 PluginConnector]: Executing the observer LTLStepAnnotator from plugin Boogie Preprocessor for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 08.02 10:07:37" (1/1) ... [2025-02-08 10:07:37,359 INFO L184 PluginConnector]: Executing the observer BoogieSymbolTableConstructor from plugin Boogie Preprocessor for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 08.02 10:07:37" (1/1) ... [2025-02-08 10:07:37,378 INFO L131 PluginConnector]: ------------------------ END Boogie Preprocessor---------------------------- [2025-02-08 10:07:37,379 INFO L112 PluginConnector]: ------------------------IcfgBuilder---------------------------- [2025-02-08 10:07:37,379 INFO L270 PluginConnector]: Initializing IcfgBuilder... [2025-02-08 10:07:37,379 INFO L274 PluginConnector]: IcfgBuilder initialized [2025-02-08 10:07:37,380 INFO L184 PluginConnector]: Executing the observer IcfgBuilderObserver from plugin IcfgBuilder for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 08.02 10:07:37" (1/1) ... [2025-02-08 10:07:37,384 INFO L173 SolverBuilder]: Constructing external solver with command: z3 SMTLIB2_COMPLIANT=true -memory:2024 -smt2 -in -t:4000 [2025-02-08 10:07:37,397 INFO L189 MonitoredProcess]: No working directory specified, using /storage/repos/ultimate-jdk21/releaseScripts/default/UAutomizer-linux/z3 [2025-02-08 10:07:37,417 INFO L229 MonitoredProcess]: Starting monitored process 1 with /storage/repos/ultimate-jdk21/releaseScripts/default/UAutomizer-linux/z3 SMTLIB2_COMPLIANT=true -memory:2024 -smt2 -in -t:4000 (exit command is (exit), workingDir is null) [2025-02-08 10:07:37,423 INFO L327 MonitoredProcess]: [MP /storage/repos/ultimate-jdk21/releaseScripts/default/UAutomizer-linux/z3 SMTLIB2_COMPLIANT=true -memory:2024 -smt2 -in -t:4000 (1)] Waiting until timeout for monitored process [2025-02-08 10:07:37,441 INFO L130 BoogieDeclarations]: Found specification of procedure __raw_spin_lock_init [2025-02-08 10:07:37,442 INFO L138 BoogieDeclarations]: Found implementation of procedure __raw_spin_lock_init [2025-02-08 10:07:37,442 INFO L130 BoogieDeclarations]: Found specification of procedure uspace_ring_map [2025-02-08 10:07:37,443 INFO L138 BoogieDeclarations]: Found implementation of procedure uspace_ring_map [2025-02-08 10:07:37,443 INFO L130 BoogieDeclarations]: Found specification of procedure scsi_unmap_user_pages [2025-02-08 10:07:37,443 INFO L138 BoogieDeclarations]: Found implementation of procedure scsi_unmap_user_pages [2025-02-08 10:07:37,443 INFO L130 BoogieDeclarations]: Found specification of procedure write~unchecked~$Pointer$#0 [2025-02-08 10:07:37,443 INFO L130 BoogieDeclarations]: Found specification of procedure write~unchecked~$Pointer$#1 [2025-02-08 10:07:37,443 INFO L130 BoogieDeclarations]: Found specification of procedure write~unchecked~$Pointer$#2 [2025-02-08 10:07:37,443 INFO L130 BoogieDeclarations]: Found specification of procedure write~unchecked~$Pointer$#3 [2025-02-08 10:07:37,443 INFO L130 BoogieDeclarations]: Found specification of procedure write~unchecked~$Pointer$#4 [2025-02-08 10:07:37,443 INFO L130 BoogieDeclarations]: Found specification of procedure write~unchecked~$Pointer$#5 [2025-02-08 10:07:37,443 INFO L130 BoogieDeclarations]: Found specification of procedure write~unchecked~$Pointer$#6 [2025-02-08 10:07:37,443 INFO L130 BoogieDeclarations]: Found specification of procedure write~unchecked~$Pointer$#7 [2025-02-08 10:07:37,443 INFO L130 BoogieDeclarations]: Found specification of procedure read~int#0 [2025-02-08 10:07:37,444 INFO L130 BoogieDeclarations]: Found specification of procedure read~int#1 [2025-02-08 10:07:37,444 INFO L130 BoogieDeclarations]: Found specification of procedure read~int#2 [2025-02-08 10:07:37,444 INFO L130 BoogieDeclarations]: Found specification of procedure read~int#3 [2025-02-08 10:07:37,444 INFO L130 BoogieDeclarations]: Found specification of procedure read~int#4 [2025-02-08 10:07:37,444 INFO L130 BoogieDeclarations]: Found specification of procedure read~int#5 [2025-02-08 10:07:37,444 INFO L130 BoogieDeclarations]: Found specification of procedure read~int#6 [2025-02-08 10:07:37,444 INFO L130 BoogieDeclarations]: Found specification of procedure read~int#7 [2025-02-08 10:07:37,444 INFO L130 BoogieDeclarations]: Found specification of procedure hash_64 [2025-02-08 10:07:37,444 INFO L138 BoogieDeclarations]: Found implementation of procedure hash_64 [2025-02-08 10:07:37,444 INFO L130 BoogieDeclarations]: Found specification of procedure scsi_release_buffers [2025-02-08 10:07:37,444 INFO L138 BoogieDeclarations]: Found implementation of procedure scsi_release_buffers [2025-02-08 10:07:37,445 INFO L130 BoogieDeclarations]: Found specification of procedure ldv_malloc [2025-02-08 10:07:37,445 INFO L138 BoogieDeclarations]: Found implementation of procedure ldv_malloc [2025-02-08 10:07:37,445 INFO L130 BoogieDeclarations]: Found specification of procedure destroy_workqueue [2025-02-08 10:07:37,445 INFO L138 BoogieDeclarations]: Found implementation of procedure destroy_workqueue [2025-02-08 10:07:37,445 INFO L130 BoogieDeclarations]: Found specification of procedure tgt_write [2025-02-08 10:07:37,445 INFO L138 BoogieDeclarations]: Found implementation of procedure tgt_write [2025-02-08 10:07:37,445 INFO L130 BoogieDeclarations]: Found specification of procedure write~int#0 [2025-02-08 10:07:37,446 INFO L130 BoogieDeclarations]: Found specification of procedure write~int#1 [2025-02-08 10:07:37,446 INFO L130 BoogieDeclarations]: Found specification of procedure write~int#2 [2025-02-08 10:07:37,446 INFO L130 BoogieDeclarations]: Found specification of procedure write~int#3 [2025-02-08 10:07:37,446 INFO L130 BoogieDeclarations]: Found specification of procedure write~int#4 [2025-02-08 10:07:37,446 INFO L130 BoogieDeclarations]: Found specification of procedure write~int#5 [2025-02-08 10:07:37,446 INFO L130 BoogieDeclarations]: Found specification of procedure write~int#6 [2025-02-08 10:07:37,446 INFO L130 BoogieDeclarations]: Found specification of procedure write~int#7 [2025-02-08 10:07:37,446 INFO L130 BoogieDeclarations]: Found specification of procedure ldv_error [2025-02-08 10:07:37,446 INFO L138 BoogieDeclarations]: Found implementation of procedure ldv_error [2025-02-08 10:07:37,446 INFO L130 BoogieDeclarations]: Found specification of procedure ldv__builtin_expect [2025-02-08 10:07:37,447 INFO L138 BoogieDeclarations]: Found implementation of procedure ldv__builtin_expect [2025-02-08 10:07:37,447 INFO L130 BoogieDeclarations]: Found specification of procedure tgt_open [2025-02-08 10:07:37,447 INFO L138 BoogieDeclarations]: Found implementation of procedure tgt_open [2025-02-08 10:07:37,447 INFO L130 BoogieDeclarations]: Found specification of procedure kmem_cache_destroy [2025-02-08 10:07:37,447 INFO L138 BoogieDeclarations]: Found implementation of procedure kmem_cache_destroy [2025-02-08 10:07:37,447 INFO L130 BoogieDeclarations]: Found specification of procedure #Ultimate.allocOnHeap [2025-02-08 10:07:37,447 INFO L130 BoogieDeclarations]: Found specification of procedure scsi_tgt_cmd_to_host [2025-02-08 10:07:37,447 INFO L138 BoogieDeclarations]: Found implementation of procedure scsi_tgt_cmd_to_host [2025-02-08 10:07:37,447 INFO L130 BoogieDeclarations]: Found specification of procedure spinlock_check [2025-02-08 10:07:37,448 INFO L138 BoogieDeclarations]: Found implementation of procedure spinlock_check [2025-02-08 10:07:37,448 INFO L130 BoogieDeclarations]: Found specification of procedure #Ultimate.allocInit [2025-02-08 10:07:37,448 INFO L130 BoogieDeclarations]: Found specification of procedure tgt_ring_idx_inc [2025-02-08 10:07:37,448 INFO L138 BoogieDeclarations]: Found implementation of procedure tgt_ring_idx_inc [2025-02-08 10:07:37,448 INFO L130 BoogieDeclarations]: Found specification of procedure #Ultimate.allocOnStack [2025-02-08 10:07:37,448 INFO L130 BoogieDeclarations]: Found specification of procedure write~$Pointer$#0 [2025-02-08 10:07:37,448 INFO L130 BoogieDeclarations]: Found specification of procedure write~$Pointer$#1 [2025-02-08 10:07:37,448 INFO L130 BoogieDeclarations]: Found specification of procedure write~$Pointer$#2 [2025-02-08 10:07:37,448 INFO L130 BoogieDeclarations]: Found specification of procedure write~$Pointer$#3 [2025-02-08 10:07:37,448 INFO L130 BoogieDeclarations]: Found specification of procedure write~$Pointer$#4 [2025-02-08 10:07:37,448 INFO L130 BoogieDeclarations]: Found specification of procedure write~$Pointer$#5 [2025-02-08 10:07:37,448 INFO L130 BoogieDeclarations]: Found specification of procedure write~$Pointer$#6 [2025-02-08 10:07:37,448 INFO L130 BoogieDeclarations]: Found specification of procedure write~$Pointer$#7 [2025-02-08 10:07:37,448 INFO L130 BoogieDeclarations]: Found specification of procedure tgt_head_event [2025-02-08 10:07:37,448 INFO L138 BoogieDeclarations]: Found implementation of procedure tgt_head_event [2025-02-08 10:07:37,448 INFO L130 BoogieDeclarations]: Found specification of procedure scsi_host_put [2025-02-08 10:07:37,448 INFO L138 BoogieDeclarations]: Found implementation of procedure scsi_host_put [2025-02-08 10:07:37,448 INFO L130 BoogieDeclarations]: Found specification of procedure ##fun~$Pointer$~TO~int [2025-02-08 10:07:37,448 INFO L138 BoogieDeclarations]: Found implementation of procedure ##fun~$Pointer$~TO~int [2025-02-08 10:07:37,448 INFO L130 BoogieDeclarations]: Found specification of procedure read~$Pointer$#0 [2025-02-08 10:07:37,448 INFO L130 BoogieDeclarations]: Found specification of procedure read~$Pointer$#1 [2025-02-08 10:07:37,448 INFO L130 BoogieDeclarations]: Found specification of procedure read~$Pointer$#2 [2025-02-08 10:07:37,448 INFO L130 BoogieDeclarations]: Found specification of procedure read~$Pointer$#3 [2025-02-08 10:07:37,448 INFO L130 BoogieDeclarations]: Found specification of procedure read~$Pointer$#4 [2025-02-08 10:07:37,448 INFO L130 BoogieDeclarations]: Found specification of procedure read~$Pointer$#5 [2025-02-08 10:07:37,448 INFO L130 BoogieDeclarations]: Found specification of procedure read~$Pointer$#6 [2025-02-08 10:07:37,448 INFO L130 BoogieDeclarations]: Found specification of procedure read~$Pointer$#7 [2025-02-08 10:07:37,448 INFO L130 BoogieDeclarations]: Found specification of procedure spin_unlock_irqrestore [2025-02-08 10:07:37,448 INFO L138 BoogieDeclarations]: Found implementation of procedure spin_unlock_irqrestore [2025-02-08 10:07:37,448 INFO L130 BoogieDeclarations]: Found specification of procedure list_add [2025-02-08 10:07:37,448 INFO L138 BoogieDeclarations]: Found implementation of procedure list_add [2025-02-08 10:07:37,448 INFO L130 BoogieDeclarations]: Found specification of procedure ULTIMATE.dealloc [2025-02-08 10:07:37,448 INFO L130 BoogieDeclarations]: Found specification of procedure write~init~$Pointer$#0 [2025-02-08 10:07:37,448 INFO L130 BoogieDeclarations]: Found specification of procedure write~init~$Pointer$#1 [2025-02-08 10:07:37,448 INFO L130 BoogieDeclarations]: Found specification of procedure write~init~$Pointer$#2 [2025-02-08 10:07:37,448 INFO L130 BoogieDeclarations]: Found specification of procedure write~init~$Pointer$#3 [2025-02-08 10:07:37,448 INFO L130 BoogieDeclarations]: Found specification of procedure write~init~$Pointer$#4 [2025-02-08 10:07:37,449 INFO L130 BoogieDeclarations]: Found specification of procedure write~init~$Pointer$#5 [2025-02-08 10:07:37,449 INFO L130 BoogieDeclarations]: Found specification of procedure write~init~$Pointer$#6 [2025-02-08 10:07:37,449 INFO L130 BoogieDeclarations]: Found specification of procedure write~init~$Pointer$#7 [2025-02-08 10:07:37,449 INFO L130 BoogieDeclarations]: Found specification of procedure tgt_ring_exit [2025-02-08 10:07:37,449 INFO L138 BoogieDeclarations]: Found implementation of procedure tgt_ring_exit [2025-02-08 10:07:37,449 INFO L130 BoogieDeclarations]: Found specification of procedure printk [2025-02-08 10:07:37,449 INFO L138 BoogieDeclarations]: Found implementation of procedure printk [2025-02-08 10:07:37,449 INFO L130 BoogieDeclarations]: Found specification of procedure scsi_tgt_cmd_destroy [2025-02-08 10:07:37,449 INFO L138 BoogieDeclarations]: Found implementation of procedure scsi_tgt_cmd_destroy [2025-02-08 10:07:37,449 INFO L130 BoogieDeclarations]: Found specification of procedure tgt_ring_init [2025-02-08 10:07:37,449 INFO L138 BoogieDeclarations]: Found implementation of procedure tgt_ring_init [2025-02-08 10:07:37,449 INFO L130 BoogieDeclarations]: Found specification of procedure list_del [2025-02-08 10:07:37,449 INFO L138 BoogieDeclarations]: Found implementation of procedure list_del [2025-02-08 10:07:37,449 INFO L130 BoogieDeclarations]: Found specification of procedure kmem_cache_free [2025-02-08 10:07:37,449 INFO L138 BoogieDeclarations]: Found implementation of procedure kmem_cache_free [2025-02-08 10:07:37,449 INFO L130 BoogieDeclarations]: Found specification of procedure tgt_poll [2025-02-08 10:07:37,449 INFO L138 BoogieDeclarations]: Found implementation of procedure tgt_poll [2025-02-08 10:07:37,449 INFO L130 BoogieDeclarations]: Found specification of procedure _raw_spin_lock_irqsave [2025-02-08 10:07:37,449 INFO L138 BoogieDeclarations]: Found implementation of procedure _raw_spin_lock_irqsave [2025-02-08 10:07:37,449 INFO L130 BoogieDeclarations]: Found specification of procedure scsi_host_lookup [2025-02-08 10:07:37,449 INFO L138 BoogieDeclarations]: Found implementation of procedure scsi_host_lookup [2025-02-08 10:07:37,449 INFO L130 BoogieDeclarations]: Found specification of procedure tgt_mmap [2025-02-08 10:07:37,449 INFO L138 BoogieDeclarations]: Found implementation of procedure tgt_mmap [2025-02-08 10:07:37,449 INFO L130 BoogieDeclarations]: Found specification of procedure write~init~int#0 [2025-02-08 10:07:37,449 INFO L130 BoogieDeclarations]: Found specification of procedure write~init~int#1 [2025-02-08 10:07:37,449 INFO L130 BoogieDeclarations]: Found specification of procedure write~init~int#2 [2025-02-08 10:07:37,449 INFO L130 BoogieDeclarations]: Found specification of procedure write~init~int#3 [2025-02-08 10:07:37,449 INFO L130 BoogieDeclarations]: Found specification of procedure write~init~int#4 [2025-02-08 10:07:37,449 INFO L130 BoogieDeclarations]: Found specification of procedure write~init~int#5 [2025-02-08 10:07:37,452 INFO L130 BoogieDeclarations]: Found specification of procedure write~init~int#6 [2025-02-08 10:07:37,452 INFO L130 BoogieDeclarations]: Found specification of procedure write~init~int#7 [2025-02-08 10:07:37,452 INFO L130 BoogieDeclarations]: Found specification of procedure _copy_from_user [2025-02-08 10:07:37,452 INFO L138 BoogieDeclarations]: Found implementation of procedure _copy_from_user [2025-02-08 10:07:37,452 INFO L130 BoogieDeclarations]: Found specification of procedure ULTIMATE.start [2025-02-08 10:07:37,452 INFO L138 BoogieDeclarations]: Found implementation of procedure ULTIMATE.start [2025-02-08 10:07:37,775 INFO L257 CfgBuilder]: Building ICFG [2025-02-08 10:07:37,777 INFO L287 CfgBuilder]: Building CFG for each procedure with an implementation [2025-02-08 10:07:37,873 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L7553: #res#1 := 0; [2025-02-08 10:07:37,873 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L8347-1: #t~ret376#1 := vm_insert_page_#res#1;havoc vm_insert_page_#t~nondet448#1, vm_insert_page_~arg0#1.base, vm_insert_page_~arg0#1.offset, vm_insert_page_~arg1#1, vm_insert_page_~arg2#1.base, vm_insert_page_~arg2#1.offset;havoc vm_insert_page_#in~arg0#1.base, vm_insert_page_#in~arg0#1.offset, vm_insert_page_#in~arg1#1, vm_insert_page_#in~arg2#1.base, vm_insert_page_#in~arg2#1.offset;assume { :end_inline_vm_insert_page } true;assume -2147483648 <= #t~ret376#1 && #t~ret376#1 <= 2147483647;~err~18#1 := #t~ret376#1;havoc #t~ret376#1; [2025-02-08 10:07:37,873 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L8347: havoc vm_insert_page_#t~nondet448#1; [2025-02-08 10:07:37,873 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L7545-1: assume 1 + ~i~2#1 >= -2147483648; [2025-02-08 10:07:37,873 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L7545-1: assume !(1 + ~i~2#1 >= -2147483648); [2025-02-08 10:07:37,874 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L7545: assume 1 + ~i~2#1 <= 2147483647;~i~2#1 := 1 + ~i~2#1; [2025-02-08 10:07:37,874 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L7545: assume !(1 + ~i~2#1 <= 2147483647); [2025-02-08 10:07:37,874 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L7540: assume 0 != ~err~18#1;#res#1 := ~err~18#1; [2025-02-08 10:07:37,874 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L7540: assume !(0 != ~err~18#1);~addr#1 := 4096 + ~addr#1; [2025-02-08 10:07:37,874 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L8213-1: #t~ret375#1 := __phys_addr_#res#1;havoc __phys_addr_#t~nondet427#1, __phys_addr_~arg0#1;havoc __phys_addr_#in~arg0#1;assume { :end_inline___phys_addr } true;~tmp~20#1 := #t~ret375#1;~page~0#1.base, ~page~0#1.offset := 0, (if (18446719884453740544 + ~tmp~20#1 % 18446744073709551616 / 4096) % 18446744073709551616 % 18446744073709551616 <= 9223372036854775807 then (18446719884453740544 + ~tmp~20#1 % 18446744073709551616 / 4096) % 18446744073709551616 % 18446744073709551616 else (18446719884453740544 + ~tmp~20#1 % 18446744073709551616 / 4096) % 18446744073709551616 % 18446744073709551616 - 18446744073709551616);assume { :begin_inline_vm_insert_page } true;vm_insert_page_#in~arg0#1.base, vm_insert_page_#in~arg0#1.offset, vm_insert_page_#in~arg1#1, vm_insert_page_#in~arg2#1.base, vm_insert_page_#in~arg2#1.offset := ~vma#1.base, ~vma#1.offset, ~addr#1, ~page~0#1.base, ~page~0#1.offset;havoc vm_insert_page_#res#1;havoc vm_insert_page_#t~nondet448#1, vm_insert_page_~arg0#1.base, vm_insert_page_~arg0#1.offset, vm_insert_page_~arg1#1, vm_insert_page_~arg2#1.base, vm_insert_page_~arg2#1.offset;vm_insert_page_~arg0#1.base, vm_insert_page_~arg0#1.offset := vm_insert_page_#in~arg0#1.base, vm_insert_page_#in~arg0#1.offset;vm_insert_page_~arg1#1 := vm_insert_page_#in~arg1#1;vm_insert_page_~arg2#1.base, vm_insert_page_~arg2#1.offset := vm_insert_page_#in~arg2#1.base, vm_insert_page_#in~arg2#1.offset;havoc vm_insert_page_#t~nondet448#1;assume -2147483648 <= vm_insert_page_#t~nondet448#1 && vm_insert_page_#t~nondet448#1 <= 2147483647;vm_insert_page_#res#1 := vm_insert_page_#t~nondet448#1;havoc vm_insert_page_#t~nondet448#1; [2025-02-08 10:07:37,874 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L8213: havoc __phys_addr_#t~nondet427#1; [2025-02-08 10:07:37,874 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L7537: call #t~mem374#1 := read~int#6(~ring#1.base, 4 + ~ring#1.offset + 8 * ~i~2#1, 8);assume { :begin_inline___phys_addr } true;__phys_addr_#in~arg0#1 := #t~mem374#1;havoc __phys_addr_#res#1;havoc __phys_addr_#t~nondet427#1, __phys_addr_~arg0#1;__phys_addr_~arg0#1 := __phys_addr_#in~arg0#1;havoc __phys_addr_#t~nondet427#1;__phys_addr_#res#1 := __phys_addr_#t~nondet427#1;havoc __phys_addr_#t~nondet427#1; [2025-02-08 10:07:37,874 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint uspace_ring_mapFINAL: assume true; [2025-02-08 10:07:37,892 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L7298: havoc #t~mem304; [2025-02-08 10:07:37,903 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L8259: havoc blk_rq_unmap_user_#t~nondet434#1; [2025-02-08 10:07:37,940 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L6474: havoc #t~bitwise81; [2025-02-08 10:07:37,967 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L6379: havoc ~res~0#1.base, ~res~0#1.offset; [2025-02-08 10:07:37,967 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L6381-1: #t~ret47#1 := ldv_is_err_#res#1;havoc ldv_is_err_~ptr#1.base, ldv_is_err_~ptr#1.offset;havoc ldv_is_err_#in~ptr#1.base, ldv_is_err_#in~ptr#1.offset;assume { :end_inline_ldv_is_err } true;assume -9223372036854775808 <= #t~ret47#1 && #t~ret47#1 <= 9223372036854775807;assume { :begin_inline_assume_abort_if_not } true;assume_abort_if_not_#in~cond#1 := (if 0 == #t~ret47#1 then 1 else 0);havoc assume_abort_if_not_~cond#1;assume_abort_if_not_~cond#1 := assume_abort_if_not_#in~cond#1; [2025-02-08 10:07:37,967 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L6381: havoc assume_abort_if_not_~cond#1;havoc assume_abort_if_not_#in~cond#1;assume { :end_inline_assume_abort_if_not } true;havoc #t~ret47#1;#res#1.base, #res#1.offset := ~res~0#1.base, ~res~0#1.offset; [2025-02-08 10:07:37,967 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L6370: assume 0 == assume_abort_if_not_~cond#1;assume false; [2025-02-08 10:07:37,967 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L6370: assume !(0 == assume_abort_if_not_~cond#1); [2025-02-08 10:07:37,986 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L7600-1: assume 1 + ~i~3#1 >= -2147483648; [2025-02-08 10:07:37,987 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L7600-1: assume !(1 + ~i~3#1 >= -2147483648); [2025-02-08 10:07:37,987 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L7599: call #t~mem387#1 := read~int#6(~ring#1.base, 4 + ~ring#1.offset + 8 * ~i~3#1, 8);assume { :begin_inline_free_pages } true;free_pages_#in~arg0#1, free_pages_#in~arg1#1 := #t~mem387#1, 0;havoc free_pages_~arg0#1, free_pages_~arg1#1;free_pages_~arg0#1 := free_pages_#in~arg0#1;free_pages_~arg1#1 := free_pages_#in~arg1#1;havoc free_pages_~arg0#1, free_pages_~arg1#1;havoc free_pages_#in~arg0#1, free_pages_#in~arg1#1;assume { :end_inline_free_pages } true; [2025-02-08 10:07:37,987 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L7600: assume 1 + ~i~3#1 <= 2147483647;~i~3#1 := 1 + ~i~3#1; [2025-02-08 10:07:37,987 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L7600: assume !(1 + ~i~3#1 <= 2147483647); [2025-02-08 10:07:37,987 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint tgt_ring_exitFINAL: assume true; [2025-02-08 10:07:37,990 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L8323: havoc #t~nondet444; [2025-02-08 10:07:38,307 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L6427-1: SUMMARY for call copy_from_user_#t~ret61#1 := _copy_from_user(copy_from_user_~to#1.base, copy_from_user_~to#1.offset, copy_from_user_~from#1.base, copy_from_user_~from#1.offset, copy_from_user_~n#1); srcloc: null [2025-02-08 10:07:38,307 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L6427: copy_from_user_~n#1 := copy_from_user_#t~ret61#1;havoc copy_from_user_#t~ret61#1; [2025-02-08 10:07:38,307 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L6807-1: scsi_tgt_transfer_response_#t~switch171#1 := scsi_tgt_transfer_response_#t~switch171#1 || 4182 == scsi_tgt_transfer_response_~err~2#1; [2025-02-08 10:07:38,307 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L6807: assume scsi_tgt_transfer_response_#t~switch171#1;scsi_tgt_transfer_response_#res#1 := -11; [2025-02-08 10:07:38,308 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L6807: assume !scsi_tgt_transfer_response_#t~switch171#1;havoc scsi_tgt_transfer_response_#t~switch171#1;havoc scsi_tgt_transfer_response_#t~switch171#1;scsi_tgt_transfer_response_#res#1 := 0; [2025-02-08 10:07:38,309 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L6857-1: call scsi_tgt_copy_sense_#t~mem180#1.base, scsi_tgt_copy_sense_#t~mem180#1.offset := read~$Pointer$#6(scsi_tgt_copy_sense_~cmd#1.base, 132 + scsi_tgt_copy_sense_~cmd#1.offset, 8);assume { :begin_inline_copy_from_user } true;copy_from_user_#in~to#1.base, copy_from_user_#in~to#1.offset, copy_from_user_#in~from#1.base, copy_from_user_#in~from#1.offset, copy_from_user_#in~n#1 := scsi_tgt_copy_sense_#t~mem180#1.base, scsi_tgt_copy_sense_#t~mem180#1.offset, scsi_tgt_copy_sense_~p~0#1.base, scsi_tgt_copy_sense_~p~0#1.offset, scsi_tgt_copy_sense_~tmp~10#1 % 4294967296;havoc copy_from_user_#res#1;havoc copy_from_user_#t~nondet57#1, copy_from_user_#t~ret58#1, copy_from_user_#t~ret59#1, copy_from_user_#t~ret60#1, copy_from_user_#t~ret61#1, copy_from_user_#t~ret62#1, copy_from_user_#t~ret63#1, copy_from_user_~to#1.base, copy_from_user_~to#1.offset, copy_from_user_~from#1.base, copy_from_user_~from#1.offset, copy_from_user_~n#1, copy_from_user_~sz~0#1, copy_from_user_~tmp~1#1, copy_from_user_~__ret_warn_on~0#1, copy_from_user_~tmp___0~0#1, copy_from_user_~tmp___1~0#1, copy_from_user_~tmp___2~1#1;copy_from_user_~to#1.base, copy_from_user_~to#1.offset := copy_from_user_#in~to#1.base, copy_from_user_#in~to#1.offset;copy_from_user_~from#1.base, copy_from_user_~from#1.offset := copy_from_user_#in~from#1.base, copy_from_user_#in~from#1.offset;copy_from_user_~n#1 := copy_from_user_#in~n#1;havoc copy_from_user_~sz~0#1;havoc copy_from_user_~tmp~1#1;havoc copy_from_user_~__ret_warn_on~0#1;havoc copy_from_user_~tmp___0~0#1;havoc copy_from_user_~tmp___1~0#1;havoc copy_from_user_~tmp___2~1#1;copy_from_user_~tmp~1#1 := copy_from_user_#t~nondet57#1;havoc copy_from_user_#t~nondet57#1;copy_from_user_~sz~0#1 := (if copy_from_user_~tmp~1#1 % 18446744073709551616 % 4294967296 <= 2147483647 then copy_from_user_~tmp~1#1 % 18446744073709551616 % 4294967296 else copy_from_user_~tmp~1#1 % 18446744073709551616 % 4294967296 - 4294967296);assume { :begin_inline_might_fault } true; [2025-02-08 10:07:38,309 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L6857: scsi_tgt_copy_sense_#t~ret181#1 := copy_from_user_#res#1;havoc copy_from_user_#t~nondet57#1, copy_from_user_#t~ret58#1, copy_from_user_#t~ret59#1, copy_from_user_#t~ret60#1, copy_from_user_#t~ret61#1, copy_from_user_#t~ret62#1, copy_from_user_#t~ret63#1, copy_from_user_~to#1.base, copy_from_user_~to#1.offset, copy_from_user_~from#1.base, copy_from_user_~from#1.offset, copy_from_user_~n#1, copy_from_user_~sz~0#1, copy_from_user_~tmp~1#1, copy_from_user_~__ret_warn_on~0#1, copy_from_user_~tmp___0~0#1, copy_from_user_~tmp___1~0#1, copy_from_user_~tmp___2~1#1;havoc copy_from_user_#in~to#1.base, copy_from_user_#in~to#1.offset, copy_from_user_#in~from#1.base, copy_from_user_#in~from#1.offset, copy_from_user_#in~n#1;assume { :end_inline_copy_from_user } true;scsi_tgt_copy_sense_~tmp___0~4#1 := scsi_tgt_copy_sense_#t~ret181#1;havoc scsi_tgt_copy_sense_#t~mem180#1.base, scsi_tgt_copy_sense_#t~mem180#1.offset;havoc scsi_tgt_copy_sense_#t~ret181#1; [2025-02-08 10:07:38,309 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L6973-1: SUMMARY for call scsi_tgt_kspace_exec_#t~ret220#1.base, scsi_tgt_kspace_exec_#t~ret220#1.offset := spinlock_check(scsi_tgt_kspace_exec_~qdata~4#1.base, 264 + scsi_tgt_kspace_exec_~qdata~4#1.offset); srcloc: null [2025-02-08 10:07:38,309 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L6973: scsi_tgt_kspace_exec_~tmp___0~6#1.base, scsi_tgt_kspace_exec_~tmp___0~6#1.offset := scsi_tgt_kspace_exec_#t~ret220#1.base, scsi_tgt_kspace_exec_#t~ret220#1.offset;havoc scsi_tgt_kspace_exec_#t~ret220#1.base, scsi_tgt_kspace_exec_#t~ret220#1.offset; [2025-02-08 10:07:38,309 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L6858: assume 0 != scsi_tgt_copy_sense_~tmp___0~4#1 % 18446744073709551616; [2025-02-08 10:07:38,309 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L6858: assume !(0 != scsi_tgt_copy_sense_~tmp___0~4#1 % 18446744073709551616);scsi_tgt_copy_sense_#res#1 := 0; [2025-02-08 10:07:38,309 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L6974: scsi_tgt_kspace_exec_~flags~5#1 := scsi_tgt_kspace_exec_#t~ret221#1;havoc scsi_tgt_kspace_exec_#t~ret221#1; [2025-02-08 10:07:38,309 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L6875: call scsi_tgt_abort_cmd_#t~mem190#1.base, scsi_tgt_abort_cmd_#t~mem190#1.offset := read~$Pointer$#6(scsi_tgt_abort_cmd_~cmd#1.base, 124 + scsi_tgt_abort_cmd_~cmd#1.offset, 8);call scsi_tgt_abort_cmd_#t~mem191#1.base, scsi_tgt_abort_cmd_#t~mem191#1.offset := read~$Pointer$#6(scsi_tgt_abort_cmd_#t~mem190#1.base, 344 + scsi_tgt_abort_cmd_#t~mem190#1.offset, 8);scsi_tgt_abort_cmd_~tcmd~7#1.base, scsi_tgt_abort_cmd_~tcmd~7#1.offset := scsi_tgt_abort_cmd_#t~mem191#1.base, scsi_tgt_abort_cmd_#t~mem191#1.offset;havoc scsi_tgt_abort_cmd_#t~mem190#1.base, scsi_tgt_abort_cmd_#t~mem190#1.offset;havoc scsi_tgt_abort_cmd_#t~mem191#1.base, scsi_tgt_abort_cmd_#t~mem191#1.offset; [2025-02-08 10:07:38,309 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L6974-1: SUMMARY for call scsi_tgt_kspace_exec_#t~ret221#1 := _raw_spin_lock_irqsave(scsi_tgt_kspace_exec_~tmp___0~6#1.base, scsi_tgt_kspace_exec_~tmp___0~6#1.offset); srcloc: null [2025-02-08 10:07:38,309 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L7470: event_recv_msg_#t~ret360#1 := scsi_tgt_kspace_it_nexus_rsp_#res#1;havoc scsi_tgt_kspace_it_nexus_rsp_#t~ret247#1.base, scsi_tgt_kspace_it_nexus_rsp_#t~ret247#1.offset, scsi_tgt_kspace_it_nexus_rsp_#t~ret248#1, scsi_tgt_kspace_it_nexus_rsp_#t~mem249#1.base, scsi_tgt_kspace_it_nexus_rsp_#t~mem249#1.offset, scsi_tgt_kspace_it_nexus_rsp_#t~ret250#1, scsi_tgt_kspace_it_nexus_rsp_#t~mem256#1.base, scsi_tgt_kspace_it_nexus_rsp_#t~mem256#1.offset, scsi_tgt_kspace_it_nexus_rsp_#t~mem257#1.base, scsi_tgt_kspace_it_nexus_rsp_#t~mem257#1.offset, scsi_tgt_kspace_it_nexus_rsp_#t~ret258#1, scsi_tgt_kspace_it_nexus_rsp_~host_no#1, scsi_tgt_kspace_it_nexus_rsp_~itn_id#1, scsi_tgt_kspace_it_nexus_rsp_~result#1, scsi_tgt_kspace_it_nexus_rsp_~shost~3#1.base, scsi_tgt_kspace_it_nexus_rsp_~shost~3#1.offset, scsi_tgt_kspace_it_nexus_rsp_~err~10#1;havoc scsi_tgt_kspace_it_nexus_rsp_#in~host_no#1, scsi_tgt_kspace_it_nexus_rsp_#in~itn_id#1, scsi_tgt_kspace_it_nexus_rsp_#in~result#1;assume { :end_inline_scsi_tgt_kspace_it_nexus_rsp } true;assume -2147483648 <= event_recv_msg_#t~ret360#1 && event_recv_msg_#t~ret360#1 <= 2147483647;event_recv_msg_~err~17#1 := event_recv_msg_#t~ret360#1; [2025-02-08 10:07:38,309 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L6859-1: SUMMARY for call scsi_tgt_copy_sense_#t~ret182#1 := printk(9, 0); srcloc: null [2025-02-08 10:07:38,309 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L6859: assume -2147483648 <= scsi_tgt_copy_sense_#t~ret182#1 && scsi_tgt_copy_sense_#t~ret182#1 <= 2147483647;havoc scsi_tgt_copy_sense_#t~ret182#1;scsi_tgt_copy_sense_#res#1 := -5; [2025-02-08 10:07:38,309 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L6430: assume -9223372036854775808 <= copy_from_user_#t~ret62#1 && copy_from_user_#t~ret62#1 <= 9223372036854775807;copy_from_user_~tmp___0~0#1 := copy_from_user_#t~ret62#1;havoc copy_from_user_#t~ret62#1; [2025-02-08 10:07:38,309 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L6975: SUMMARY for call list_add(scsi_tgt_kspace_exec_~tcmd~9#1.base, 84 + scsi_tgt_kspace_exec_~tcmd~9#1.offset, scsi_tgt_kspace_exec_~head~2#1.base, scsi_tgt_kspace_exec_~head~2#1.offset); srcloc: null [2025-02-08 10:07:38,309 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L6876-1: SUMMARY for call scsi_tgt_cmd_destroy(scsi_tgt_abort_cmd_~tcmd~7#1.base, scsi_tgt_abort_cmd_~tcmd~7#1.offset); srcloc: null [2025-02-08 10:07:38,309 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L6876: scsi_tgt_abort_cmd_#res#1 := scsi_tgt_abort_cmd_~err~4#1; [2025-02-08 10:07:38,309 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L6430-1: SUMMARY for call copy_from_user_#t~ret62#1 := ldv__builtin_expect((if 0 != copy_from_user_~__ret_warn_on~0#1 then 1 else 0), 0); srcloc: null [2025-02-08 10:07:38,309 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L6910: assume (tgt_cmd_hash_lookup_~tcmd~8#1.base + (84 + tgt_cmd_hash_lookup_~tcmd~8#1.offset)) % 18446744073709551616 != (tgt_cmd_hash_lookup_~head~1#1.base + tgt_cmd_hash_lookup_~head~1#1.offset) % 18446744073709551616; [2025-02-08 10:07:38,309 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L6910: assume !((tgt_cmd_hash_lookup_~tcmd~8#1.base + (84 + tgt_cmd_hash_lookup_~tcmd~8#1.offset)) % 18446744073709551616 != (tgt_cmd_hash_lookup_~head~1#1.base + tgt_cmd_hash_lookup_~head~1#1.offset) % 18446744073709551616); [2025-02-08 10:07:38,310 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L6431: assume 0 != copy_from_user_~tmp___0~0#1;assume { :begin_inline_warn_slowpath_fmt } true;warn_slowpath_fmt_#in~arg0#1.base, warn_slowpath_fmt_#in~arg0#1.offset, warn_slowpath_fmt_#in~arg1#1, warn_slowpath_fmt_#in~arg2#1.base, warn_slowpath_fmt_#in~arg2#1.offset := 3, 0, 66, 4, 0;havoc warn_slowpath_fmt_~arg0#1.base, warn_slowpath_fmt_~arg0#1.offset, warn_slowpath_fmt_~arg1#1, warn_slowpath_fmt_~arg2#1.base, warn_slowpath_fmt_~arg2#1.offset;warn_slowpath_fmt_~arg0#1.base, warn_slowpath_fmt_~arg0#1.offset := warn_slowpath_fmt_#in~arg0#1.base, warn_slowpath_fmt_#in~arg0#1.offset;warn_slowpath_fmt_~arg1#1 := warn_slowpath_fmt_#in~arg1#1;warn_slowpath_fmt_~arg2#1.base, warn_slowpath_fmt_~arg2#1.offset := warn_slowpath_fmt_#in~arg2#1.base, warn_slowpath_fmt_#in~arg2#1.offset; [2025-02-08 10:07:38,310 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L6431: assume !(0 != copy_from_user_~tmp___0~0#1); [2025-02-08 10:07:38,310 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L6976: SUMMARY for call spin_unlock_irqrestore(scsi_tgt_kspace_exec_~qdata~4#1.base, 264 + scsi_tgt_kspace_exec_~qdata~4#1.offset, scsi_tgt_kspace_exec_~flags~5#1); srcloc: null [2025-02-08 10:07:38,310 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L6960: assume 2 == scsi_tgt_kspace_exec_#t~mem211#1;havoc scsi_tgt_kspace_exec_#t~mem211#1;assume { :begin_inline_scsi_tgt_copy_sense } true;scsi_tgt_copy_sense_#in~cmd#1.base, scsi_tgt_copy_sense_#in~cmd#1.offset, scsi_tgt_copy_sense_#in~uaddr#1, scsi_tgt_copy_sense_#in~len#1 := scsi_tgt_kspace_exec_~cmd~3#1.base, scsi_tgt_kspace_exec_~cmd~3#1.offset, scsi_tgt_kspace_exec_~sense_uaddr#1, scsi_tgt_kspace_exec_~sense_len#1;havoc scsi_tgt_copy_sense_#res#1;havoc scsi_tgt_copy_sense_#t~mem180#1.base, scsi_tgt_copy_sense_#t~mem180#1.offset, scsi_tgt_copy_sense_#t~ret181#1, scsi_tgt_copy_sense_#t~ret182#1, scsi_tgt_copy_sense_~cmd#1.base, scsi_tgt_copy_sense_~cmd#1.offset, scsi_tgt_copy_sense_~uaddr#1, scsi_tgt_copy_sense_~len#1, scsi_tgt_copy_sense_~p~0#1.base, scsi_tgt_copy_sense_~p~0#1.offset, scsi_tgt_copy_sense_~__min1~0#1, scsi_tgt_copy_sense_~__min2~0#1, scsi_tgt_copy_sense_~tmp~10#1, scsi_tgt_copy_sense_~tmp___0~4#1;scsi_tgt_copy_sense_~cmd#1.base, scsi_tgt_copy_sense_~cmd#1.offset := scsi_tgt_copy_sense_#in~cmd#1.base, scsi_tgt_copy_sense_#in~cmd#1.offset;scsi_tgt_copy_sense_~uaddr#1 := scsi_tgt_copy_sense_#in~uaddr#1;scsi_tgt_copy_sense_~len#1 := scsi_tgt_copy_sense_#in~len#1;havoc scsi_tgt_copy_sense_~p~0#1.base, scsi_tgt_copy_sense_~p~0#1.offset;havoc scsi_tgt_copy_sense_~__min1~0#1;havoc scsi_tgt_copy_sense_~__min2~0#1;havoc scsi_tgt_copy_sense_~tmp~10#1;havoc scsi_tgt_copy_sense_~tmp___0~4#1;scsi_tgt_copy_sense_~p~0#1.base, scsi_tgt_copy_sense_~p~0#1.offset := 0, (if scsi_tgt_copy_sense_~uaddr#1 % 18446744073709551616 % 18446744073709551616 <= 9223372036854775807 then scsi_tgt_copy_sense_~uaddr#1 % 18446744073709551616 % 18446744073709551616 else scsi_tgt_copy_sense_~uaddr#1 % 18446744073709551616 % 18446744073709551616 - 18446744073709551616);scsi_tgt_copy_sense_~__min1~0#1 := 96;scsi_tgt_copy_sense_~__min2~0#1 := scsi_tgt_copy_sense_~len#1; [2025-02-08 10:07:38,310 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L6960: assume !(2 == scsi_tgt_kspace_exec_#t~mem211#1);havoc scsi_tgt_kspace_exec_#t~mem211#1; [2025-02-08 10:07:38,310 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L6432: havoc warn_slowpath_fmt_~arg0#1.base, warn_slowpath_fmt_~arg0#1.offset, warn_slowpath_fmt_~arg1#1, warn_slowpath_fmt_~arg2#1.base, warn_slowpath_fmt_~arg2#1.offset;havoc warn_slowpath_fmt_#in~arg0#1.base, warn_slowpath_fmt_#in~arg0#1.offset, warn_slowpath_fmt_#in~arg1#1, warn_slowpath_fmt_#in~arg2#1.base, warn_slowpath_fmt_#in~arg2#1.offset;assume { :end_inline_warn_slowpath_fmt } true; [2025-02-08 10:07:38,310 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L6961: scsi_tgt_kspace_exec_#t~ret212#1 := scsi_tgt_copy_sense_#res#1;havoc scsi_tgt_copy_sense_#t~mem180#1.base, scsi_tgt_copy_sense_#t~mem180#1.offset, scsi_tgt_copy_sense_#t~ret181#1, scsi_tgt_copy_sense_#t~ret182#1, scsi_tgt_copy_sense_~cmd#1.base, scsi_tgt_copy_sense_~cmd#1.offset, scsi_tgt_copy_sense_~uaddr#1, scsi_tgt_copy_sense_~len#1, scsi_tgt_copy_sense_~p~0#1.base, scsi_tgt_copy_sense_~p~0#1.offset, scsi_tgt_copy_sense_~__min1~0#1, scsi_tgt_copy_sense_~__min2~0#1, scsi_tgt_copy_sense_~tmp~10#1, scsi_tgt_copy_sense_~tmp___0~4#1;havoc scsi_tgt_copy_sense_#in~cmd#1.base, scsi_tgt_copy_sense_#in~cmd#1.offset, scsi_tgt_copy_sense_#in~uaddr#1, scsi_tgt_copy_sense_#in~len#1;assume { :end_inline_scsi_tgt_copy_sense } true;assume -2147483648 <= scsi_tgt_kspace_exec_#t~ret212#1 && scsi_tgt_kspace_exec_#t~ret212#1 <= 2147483647;havoc scsi_tgt_kspace_exec_#t~ret212#1; [2025-02-08 10:07:38,310 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L6945: scsi_tgt_kspace_exec_#t~ret205#1.base, scsi_tgt_kspace_exec_#t~ret205#1.offset := tgt_cmd_hash_lookup_#res#1.base, tgt_cmd_hash_lookup_#res#1.offset;havoc tgt_cmd_hash_lookup_#t~mem192#1.base, tgt_cmd_hash_lookup_#t~mem192#1.offset, tgt_cmd_hash_lookup_#t~ret193#1, tgt_cmd_hash_lookup_#t~ret194#1.base, tgt_cmd_hash_lookup_#t~ret194#1.offset, tgt_cmd_hash_lookup_#t~ret195#1, tgt_cmd_hash_lookup_#t~mem196#1.base, tgt_cmd_hash_lookup_#t~mem196#1.offset, tgt_cmd_hash_lookup_#t~mem197#1, tgt_cmd_hash_lookup_#t~mem198#1.base, tgt_cmd_hash_lookup_#t~mem198#1.offset, tgt_cmd_hash_lookup_#t~mem199#1.base, tgt_cmd_hash_lookup_#t~mem199#1.offset, tgt_cmd_hash_lookup_~q#1.base, tgt_cmd_hash_lookup_~q#1.offset, tgt_cmd_hash_lookup_~tag#1, tgt_cmd_hash_lookup_~qdata~3#1.base, tgt_cmd_hash_lookup_~qdata~3#1.offset, tgt_cmd_hash_lookup_~rq~3#1.base, tgt_cmd_hash_lookup_~rq~3#1.offset, tgt_cmd_hash_lookup_~head~1#1.base, tgt_cmd_hash_lookup_~head~1#1.offset, tgt_cmd_hash_lookup_~tcmd~8#1.base, tgt_cmd_hash_lookup_~tcmd~8#1.offset, tgt_cmd_hash_lookup_~flags~4#1, tgt_cmd_hash_lookup_~tmp~11#1, tgt_cmd_hash_lookup_~tmp___0~5#1.base, tgt_cmd_hash_lookup_~tmp___0~5#1.offset, tgt_cmd_hash_lookup_~__mptr~2#1.base, tgt_cmd_hash_lookup_~__mptr~2#1.offset, tgt_cmd_hash_lookup_~__mptr___0~1#1.base, tgt_cmd_hash_lookup_~__mptr___0~1#1.offset;havoc tgt_cmd_hash_lookup_#in~q#1.base, tgt_cmd_hash_lookup_#in~q#1.offset, tgt_cmd_hash_lookup_#in~tag#1;assume { :end_inline_tgt_cmd_hash_lookup } true;scsi_tgt_kspace_exec_~rq~4#1.base, scsi_tgt_kspace_exec_~rq~4#1.offset := scsi_tgt_kspace_exec_#t~ret205#1.base, scsi_tgt_kspace_exec_#t~ret205#1.offset;havoc scsi_tgt_kspace_exec_#t~mem204#1.base, scsi_tgt_kspace_exec_#t~mem204#1.offset;havoc scsi_tgt_kspace_exec_#t~ret205#1.base, scsi_tgt_kspace_exec_#t~ret205#1.offset; [2025-02-08 10:07:38,311 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L6830: assume 0 != scsi_map_user_pages_~err~3#1; [2025-02-08 10:07:38,314 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L6830: assume !(0 != scsi_map_user_pages_~err~3#1);assume { :begin_inline_blk_rq_bytes } true;blk_rq_bytes_#in~rq#1.base, blk_rq_bytes_#in~rq#1.offset := scsi_map_user_pages_~rq~2#1.base, scsi_map_user_pages_~rq~2#1.offset;havoc blk_rq_bytes_#res#1;havoc blk_rq_bytes_#t~mem77#1, blk_rq_bytes_~rq#1.base, blk_rq_bytes_~rq#1.offset;blk_rq_bytes_~rq#1.base, blk_rq_bytes_~rq#1.offset := blk_rq_bytes_#in~rq#1.base, blk_rq_bytes_#in~rq#1.offset;call blk_rq_bytes_#t~mem77#1 := read~int#6(blk_rq_bytes_~rq#1.base, 80 + blk_rq_bytes_~rq#1.offset, 4);blk_rq_bytes_#res#1 := blk_rq_bytes_#t~mem77#1;havoc blk_rq_bytes_#t~mem77#1; [2025-02-08 10:07:38,314 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L6946: assume 0 == (scsi_tgt_kspace_exec_~rq~4#1.base + scsi_tgt_kspace_exec_~rq~4#1.offset) % 18446744073709551616; [2025-02-08 10:07:38,314 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L6946: assume !(0 == (scsi_tgt_kspace_exec_~rq~4#1.base + scsi_tgt_kspace_exec_~rq~4#1.offset) % 18446744073709551616);call scsi_tgt_kspace_exec_#t~mem207#1.base, scsi_tgt_kspace_exec_#t~mem207#1.offset := read~$Pointer$#6(scsi_tgt_kspace_exec_~rq~4#1.base, 234 + scsi_tgt_kspace_exec_~rq~4#1.offset, 8);scsi_tgt_kspace_exec_~cmd~3#1.base, scsi_tgt_kspace_exec_~cmd~3#1.offset := scsi_tgt_kspace_exec_#t~mem207#1.base, scsi_tgt_kspace_exec_#t~mem207#1.offset;havoc scsi_tgt_kspace_exec_#t~mem207#1.base, scsi_tgt_kspace_exec_#t~mem207#1.offset; [2025-02-08 10:07:38,314 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L6451: havoc blk_rq_bytes_#t~mem77#1;scsi_map_user_pages_#t~ret179#1 := blk_rq_bytes_#res#1;havoc blk_rq_bytes_#t~mem77#1, blk_rq_bytes_~rq#1.base, blk_rq_bytes_~rq#1.offset;havoc blk_rq_bytes_#in~rq#1.base, blk_rq_bytes_#in~rq#1.offset;assume { :end_inline_blk_rq_bytes } true;call write~int#6(scsi_map_user_pages_#t~ret179#1, scsi_map_user_pages_~cmd#1.base, 100 + scsi_map_user_pages_~cmd#1.offset, 4);havoc scsi_map_user_pages_#t~ret179#1;scsi_map_user_pages_#res#1 := 0; [2025-02-08 10:07:38,314 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L6831: SUMMARY for call scsi_release_buffers(scsi_map_user_pages_~cmd#1.base, scsi_map_user_pages_~cmd#1.offset); srcloc: null [2025-02-08 10:07:38,314 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L6947-1: SUMMARY for call scsi_tgt_kspace_exec_#t~ret206#1 := printk(14, 0); srcloc: null [2025-02-08 10:07:38,314 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L6947: assume -2147483648 <= scsi_tgt_kspace_exec_#t~ret206#1 && scsi_tgt_kspace_exec_#t~ret206#1 <= 2147483647;havoc scsi_tgt_kspace_exec_#t~ret206#1;scsi_tgt_kspace_exec_~err~5#1 := -22; [2025-02-08 10:07:38,315 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L6964: assume 0 != scsi_tgt_kspace_exec_~len#1 % 4294967296;call scsi_tgt_kspace_exec_#t~mem213#1.base, scsi_tgt_kspace_exec_#t~mem213#1.offset := read~$Pointer$#6(scsi_tgt_kspace_exec_~rq~4#1.base, 344 + scsi_tgt_kspace_exec_~rq~4#1.offset, 8);assume { :begin_inline_scsi_map_user_pages } true;scsi_map_user_pages_#in~tcmd#1.base, scsi_map_user_pages_#in~tcmd#1.offset, scsi_map_user_pages_#in~cmd#1.base, scsi_map_user_pages_#in~cmd#1.offset, scsi_map_user_pages_#in~uaddr#1, scsi_map_user_pages_#in~len#1, scsi_map_user_pages_#in~rw#1 := scsi_tgt_kspace_exec_#t~mem213#1.base, scsi_tgt_kspace_exec_#t~mem213#1.offset, scsi_tgt_kspace_exec_~cmd~3#1.base, scsi_tgt_kspace_exec_~cmd~3#1.offset, scsi_tgt_kspace_exec_~uaddr#1, scsi_tgt_kspace_exec_~len#1, (if scsi_tgt_kspace_exec_~rw#1 % 256 % 4294967296 <= 2147483647 then scsi_tgt_kspace_exec_~rw#1 % 256 % 4294967296 else scsi_tgt_kspace_exec_~rw#1 % 256 % 4294967296 - 4294967296);havoc scsi_map_user_pages_#res#1;havoc scsi_map_user_pages_#t~mem172#1.base, scsi_map_user_pages_#t~mem172#1.offset, scsi_map_user_pages_#t~mem173#1.base, scsi_map_user_pages_#t~mem173#1.offset, scsi_map_user_pages_#t~mem174#1.base, scsi_map_user_pages_#t~mem174#1.offset, scsi_map_user_pages_#t~ret175#1, scsi_map_user_pages_#t~ret176#1, scsi_map_user_pages_#t~mem177#1.base, scsi_map_user_pages_#t~mem177#1.offset, scsi_map_user_pages_#t~ret178#1, scsi_map_user_pages_#t~ret179#1, scsi_map_user_pages_~tcmd#1.base, scsi_map_user_pages_~tcmd#1.offset, scsi_map_user_pages_~cmd#1.base, scsi_map_user_pages_~cmd#1.offset, scsi_map_user_pages_~uaddr#1, scsi_map_user_pages_~len#1, scsi_map_user_pages_~rw#1, scsi_map_user_pages_~q~4#1.base, scsi_map_user_pages_~q~4#1.offset, scsi_map_user_pages_~rq~2#1.base, scsi_map_user_pages_~rq~2#1.offset, scsi_map_user_pages_~err~3#1;scsi_map_user_pages_~tcmd#1.base, scsi_map_user_pages_~tcmd#1.offset := scsi_map_user_pages_#in~tcmd#1.base, scsi_map_user_pages_#in~tcmd#1.offset;scsi_map_user_pages_~cmd#1.base, scsi_map_user_pages_~cmd#1.offset := scsi_map_user_pages_#in~cmd#1.base, scsi_map_user_pages_#in~cmd#1.offset;scsi_map_user_pages_~uaddr#1 := scsi_map_user_pages_#in~uaddr#1;scsi_map_user_pages_~len#1 := scsi_map_user_pages_#in~len#1;scsi_map_user_pages_~rw#1 := scsi_map_user_pages_#in~rw#1;havoc scsi_map_user_pages_~q~4#1.base, scsi_map_user_pages_~q~4#1.offset;havoc scsi_map_user_pages_~rq~2#1.base, scsi_map_user_pages_~rq~2#1.offset;havoc scsi_map_user_pages_~err~3#1;call scsi_map_user_pages_#t~mem172#1.base, scsi_map_user_pages_#t~mem172#1.offset := read~$Pointer$#6(scsi_map_user_pages_~cmd#1.base, 124 + scsi_map_user_pages_~cmd#1.offset, 8);call scsi_map_user_pages_#t~mem173#1.base, scsi_map_user_pages_#t~mem173#1.offset := read~$Pointer$#6(scsi_map_user_pages_#t~mem172#1.base, 52 + scsi_map_user_pages_#t~mem172#1.offset, 8);scsi_map_user_pages_~q~4#1.base, scsi_map_user_pages_~q~4#1.offset := scsi_map_user_pages_#t~mem173#1.base, scsi_map_user_pages_#t~mem173#1.offset;havoc scsi_map_user_pages_#t~mem172#1.base, scsi_map_user_pages_#t~mem172#1.offset;havoc scsi_map_user_pages_#t~mem173#1.base, scsi_map_user_pages_#t~mem173#1.offset;call scsi_map_user_pages_#t~mem174#1.base, scsi_map_user_pages_#t~mem174#1.offset := read~$Pointer$#6(scsi_map_user_pages_~cmd#1.base, 124 + scsi_map_user_pages_~cmd#1.offset, 8);scsi_map_user_pages_~rq~2#1.base, scsi_map_user_pages_~rq~2#1.offset := scsi_map_user_pages_#t~mem174#1.base, scsi_map_user_pages_#t~mem174#1.offset;havoc scsi_map_user_pages_#t~mem174#1.base, scsi_map_user_pages_#t~mem174#1.offset;assume { :begin_inline_blk_rq_map_user } true;blk_rq_map_user_#in~arg0#1.base, blk_rq_map_user_#in~arg0#1.offset, blk_rq_map_user_#in~arg1#1.base, blk_rq_map_user_#in~arg1#1.offset, blk_rq_map_user_#in~arg2#1.base, blk_rq_map_user_#in~arg2#1.offset, blk_rq_map_user_#in~arg3#1.base, blk_rq_map_user_#in~arg3#1.offset, blk_rq_map_user_#in~arg4#1, blk_rq_map_user_#in~arg5#1 := scsi_map_user_pages_~q~4#1.base, scsi_map_user_pages_~q~4#1.offset, scsi_map_user_pages_~rq~2#1.base, scsi_map_user_pages_~rq~2#1.offset, 0, 0, 0, (if scsi_map_user_pages_~uaddr#1 % 18446744073709551616 % 18446744073709551616 <= 9223372036854775807 then scsi_map_user_pages_~uaddr#1 % 18446744073709551616 % 18446744073709551616 else scsi_map_user_pages_~uaddr#1 % 18446744073709551616 % 18446744073709551616 - 18446744073709551616), scsi_map_user_pages_~len#1 % 4294967296, 208;havoc blk_rq_map_user_#res#1;havoc blk_rq_map_user_#t~nondet433#1, blk_rq_map_user_~arg0#1.base, blk_rq_map_user_~arg0#1.offset, blk_rq_map_user_~arg1#1.base, blk_rq_map_user_~arg1#1.offset, blk_rq_map_user_~arg2#1.base, blk_rq_map_user_~arg2#1.offset, blk_rq_map_user_~arg3#1.base, blk_rq_map_user_~arg3#1.offset, blk_rq_map_user_~arg4#1, blk_rq_map_user_~arg5#1;blk_rq_map_user_~arg0#1.base, blk_rq_map_user_~arg0#1.offset := blk_rq_map_user_#in~arg0#1.base, blk_rq_map_user_#in~arg0#1.offset;blk_rq_map_user_~arg1#1.base, blk_rq_map_user_~arg1#1.offset := blk_rq_map_user_#in~arg1#1.base, blk_rq_map_user_#in~arg1#1.offset;blk_rq_map_user_~arg2#1.base, blk_rq_map_user_~arg2#1.offset := blk_rq_map_user_#in~arg2#1.base, blk_rq_map_user_#in~arg2#1.offset;blk_rq_map_user_~arg3#1.base, blk_rq_map_user_~arg3#1.offset := blk_rq_map_user_#in~arg3#1.base, blk_rq_map_user_#in~arg3#1.offset;blk_rq_map_user_~arg4#1 := blk_rq_map_user_#in~arg4#1;blk_rq_map_user_~arg5#1 := blk_rq_map_user_#in~arg5#1;havoc blk_rq_map_user_#t~nondet433#1;assume -2147483648 <= blk_rq_map_user_#t~nondet433#1 && blk_rq_map_user_#t~nondet433#1 <= 2147483647;blk_rq_map_user_#res#1 := blk_rq_map_user_#t~nondet433#1;havoc blk_rq_map_user_#t~nondet433#1; [2025-02-08 10:07:38,315 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L6964: assume !(0 != scsi_tgt_kspace_exec_~len#1 % 4294967296); [2025-02-08 10:07:38,315 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L6436-1: SUMMARY for call copy_from_user_#t~ret63#1 := ldv__builtin_expect((if 0 != copy_from_user_~__ret_warn_on~0#1 then 1 else 0), 0); srcloc: null [2025-02-08 10:07:38,315 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L7460: event_recv_msg_#t~ret351#1 := scsi_tgt_kspace_exec_#res#1;havoc scsi_tgt_kspace_exec_#t~ret200#1.base, scsi_tgt_kspace_exec_#t~ret200#1.offset, scsi_tgt_kspace_exec_#t~ret201#1, scsi_tgt_kspace_exec_#t~mem202#1.base, scsi_tgt_kspace_exec_#t~mem202#1.offset, scsi_tgt_kspace_exec_#t~ret203#1, scsi_tgt_kspace_exec_#t~mem204#1.base, scsi_tgt_kspace_exec_#t~mem204#1.offset, scsi_tgt_kspace_exec_#t~ret205#1.base, scsi_tgt_kspace_exec_#t~ret205#1.offset, scsi_tgt_kspace_exec_#t~ret206#1, scsi_tgt_kspace_exec_#t~mem207#1.base, scsi_tgt_kspace_exec_#t~mem207#1.offset, scsi_tgt_kspace_exec_#t~ret208#1, scsi_tgt_kspace_exec_#t~mem209#1.base, scsi_tgt_kspace_exec_#t~mem209#1.offset, scsi_tgt_kspace_exec_#t~mem210#1.base, scsi_tgt_kspace_exec_#t~mem210#1.offset, scsi_tgt_kspace_exec_#t~mem211#1, scsi_tgt_kspace_exec_#t~ret212#1, scsi_tgt_kspace_exec_#t~mem213#1.base, scsi_tgt_kspace_exec_#t~mem213#1.offset, scsi_tgt_kspace_exec_#t~ret214#1, scsi_tgt_kspace_exec_#t~ret215#1, scsi_tgt_kspace_exec_#t~mem216#1.base, scsi_tgt_kspace_exec_#t~mem216#1.offset, scsi_tgt_kspace_exec_#t~mem217#1.base, scsi_tgt_kspace_exec_#t~mem217#1.offset, scsi_tgt_kspace_exec_#t~mem218#1, scsi_tgt_kspace_exec_#t~ret219#1, scsi_tgt_kspace_exec_#t~ret220#1.base, scsi_tgt_kspace_exec_#t~ret220#1.offset, scsi_tgt_kspace_exec_#t~ret221#1, scsi_tgt_kspace_exec_#t~ret222#1, scsi_tgt_kspace_exec_~host_no#1, scsi_tgt_kspace_exec_~itn_id#1, scsi_tgt_kspace_exec_~result#1, scsi_tgt_kspace_exec_~tag#1, scsi_tgt_kspace_exec_~uaddr#1, scsi_tgt_kspace_exec_~len#1, scsi_tgt_kspace_exec_~sense_uaddr#1, scsi_tgt_kspace_exec_~sense_len#1, scsi_tgt_kspace_exec_~rw#1, scsi_tgt_kspace_exec_~shost~1#1.base, scsi_tgt_kspace_exec_~shost~1#1.offset, scsi_tgt_kspace_exec_~cmd~3#1.base, scsi_tgt_kspace_exec_~cmd~3#1.offset, scsi_tgt_kspace_exec_~rq~4#1.base, scsi_tgt_kspace_exec_~rq~4#1.offset, scsi_tgt_kspace_exec_~tcmd~9#1.base, scsi_tgt_kspace_exec_~tcmd~9#1.offset, scsi_tgt_kspace_exec_~err~5#1, scsi_tgt_kspace_exec_~qdata~4#1.base, scsi_tgt_kspace_exec_~qdata~4#1.offset, scsi_tgt_kspace_exec_~head~2#1.base, scsi_tgt_kspace_exec_~head~2#1.offset, scsi_tgt_kspace_exec_~flags~5#1, scsi_tgt_kspace_exec_~tmp~12#1, scsi_tgt_kspace_exec_~tmp___0~6#1.base, scsi_tgt_kspace_exec_~tmp___0~6#1.offset;havoc scsi_tgt_kspace_exec_#in~host_no#1, scsi_tgt_kspace_exec_#in~itn_id#1, scsi_tgt_kspace_exec_#in~result#1, scsi_tgt_kspace_exec_#in~tag#1, scsi_tgt_kspace_exec_#in~uaddr#1, scsi_tgt_kspace_exec_#in~len#1, scsi_tgt_kspace_exec_#in~sense_uaddr#1, scsi_tgt_kspace_exec_#in~sense_len#1, scsi_tgt_kspace_exec_#in~rw#1;assume { :end_inline_scsi_tgt_kspace_exec } true;assume -2147483648 <= event_recv_msg_#t~ret351#1 && event_recv_msg_#t~ret351#1 <= 2147483647;event_recv_msg_~err~17#1 := event_recv_msg_#t~ret351#1; [2025-02-08 10:07:38,315 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L6436: assume -9223372036854775808 <= copy_from_user_#t~ret63#1 && copy_from_user_#t~ret63#1 <= 9223372036854775807;havoc copy_from_user_#t~ret63#1; [2025-02-08 10:07:38,315 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L6420: assume { :end_inline_might_fault } true; [2025-02-08 10:07:38,315 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L6965: scsi_tgt_kspace_exec_#t~ret214#1 := scsi_map_user_pages_#res#1;havoc scsi_map_user_pages_#t~mem172#1.base, scsi_map_user_pages_#t~mem172#1.offset, scsi_map_user_pages_#t~mem173#1.base, scsi_map_user_pages_#t~mem173#1.offset, scsi_map_user_pages_#t~mem174#1.base, scsi_map_user_pages_#t~mem174#1.offset, scsi_map_user_pages_#t~ret175#1, scsi_map_user_pages_#t~ret176#1, scsi_map_user_pages_#t~mem177#1.base, scsi_map_user_pages_#t~mem177#1.offset, scsi_map_user_pages_#t~ret178#1, scsi_map_user_pages_#t~ret179#1, scsi_map_user_pages_~tcmd#1.base, scsi_map_user_pages_~tcmd#1.offset, scsi_map_user_pages_~cmd#1.base, scsi_map_user_pages_~cmd#1.offset, scsi_map_user_pages_~uaddr#1, scsi_map_user_pages_~len#1, scsi_map_user_pages_~rw#1, scsi_map_user_pages_~q~4#1.base, scsi_map_user_pages_~q~4#1.offset, scsi_map_user_pages_~rq~2#1.base, scsi_map_user_pages_~rq~2#1.offset, scsi_map_user_pages_~err~3#1;havoc scsi_map_user_pages_#in~tcmd#1.base, scsi_map_user_pages_#in~tcmd#1.offset, scsi_map_user_pages_#in~cmd#1.base, scsi_map_user_pages_#in~cmd#1.offset, scsi_map_user_pages_#in~uaddr#1, scsi_map_user_pages_#in~len#1, scsi_map_user_pages_#in~rw#1;assume { :end_inline_scsi_map_user_pages } true;assume -2147483648 <= scsi_tgt_kspace_exec_#t~ret214#1 && scsi_tgt_kspace_exec_#t~ret214#1 <= 2147483647;scsi_tgt_kspace_exec_~err~5#1 := scsi_tgt_kspace_exec_#t~ret214#1;havoc scsi_tgt_kspace_exec_#t~mem213#1.base, scsi_tgt_kspace_exec_#t~mem213#1.offset;havoc scsi_tgt_kspace_exec_#t~ret214#1; [2025-02-08 10:07:38,315 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L6982: scsi_tgt_kspace_exec_#t~ret222#1 := scsi_tgt_transfer_response_#res#1;havoc scsi_tgt_transfer_response_#t~ret163#1.base, scsi_tgt_transfer_response_#t~ret163#1.offset, scsi_tgt_transfer_response_#t~mem168#1.base, scsi_tgt_transfer_response_#t~mem168#1.offset, scsi_tgt_transfer_response_#t~mem169#1.base, scsi_tgt_transfer_response_#t~mem169#1.offset, scsi_tgt_transfer_response_#t~ret170#1, scsi_tgt_transfer_response_#t~switch171#1, scsi_tgt_transfer_response_~cmd#1.base, scsi_tgt_transfer_response_~cmd#1.offset, scsi_tgt_transfer_response_~shost~0#1.base, scsi_tgt_transfer_response_~shost~0#1.offset, scsi_tgt_transfer_response_~tmp~9#1.base, scsi_tgt_transfer_response_~tmp~9#1.offset, scsi_tgt_transfer_response_~err~2#1;havoc scsi_tgt_transfer_response_#in~cmd#1.base, scsi_tgt_transfer_response_#in~cmd#1.offset;assume { :end_inline_scsi_tgt_transfer_response } true;assume -2147483648 <= scsi_tgt_kspace_exec_#t~ret222#1 && scsi_tgt_kspace_exec_#t~ret222#1 <= 2147483647;scsi_tgt_kspace_exec_~err~5#1 := scsi_tgt_kspace_exec_#t~ret222#1;havoc scsi_tgt_kspace_exec_#t~ret222#1; [2025-02-08 10:07:38,315 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L6916-1: SUMMARY for call spin_unlock_irqrestore(tgt_cmd_hash_lookup_~qdata~3#1.base, 264 + tgt_cmd_hash_lookup_~qdata~3#1.offset, tgt_cmd_hash_lookup_~flags~4#1); srcloc: null [2025-02-08 10:07:38,315 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L6916: tgt_cmd_hash_lookup_#res#1.base, tgt_cmd_hash_lookup_#res#1.offset := tgt_cmd_hash_lookup_~rq~3#1.base, tgt_cmd_hash_lookup_~rq~3#1.offset; [2025-02-08 10:07:38,315 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L6982-1: assume { :begin_inline_scsi_tgt_transfer_response } true;scsi_tgt_transfer_response_#in~cmd#1.base, scsi_tgt_transfer_response_#in~cmd#1.offset := scsi_tgt_kspace_exec_~cmd~3#1.base, scsi_tgt_kspace_exec_~cmd~3#1.offset;havoc scsi_tgt_transfer_response_#res#1;havoc scsi_tgt_transfer_response_#t~ret163#1.base, scsi_tgt_transfer_response_#t~ret163#1.offset, scsi_tgt_transfer_response_#t~mem168#1.base, scsi_tgt_transfer_response_#t~mem168#1.offset, scsi_tgt_transfer_response_#t~mem169#1.base, scsi_tgt_transfer_response_#t~mem169#1.offset, scsi_tgt_transfer_response_#t~ret170#1, scsi_tgt_transfer_response_#t~switch171#1, scsi_tgt_transfer_response_~cmd#1.base, scsi_tgt_transfer_response_~cmd#1.offset, scsi_tgt_transfer_response_~shost~0#1.base, scsi_tgt_transfer_response_~shost~0#1.offset, scsi_tgt_transfer_response_~tmp~9#1.base, scsi_tgt_transfer_response_~tmp~9#1.offset, scsi_tgt_transfer_response_~err~2#1;scsi_tgt_transfer_response_~cmd#1.base, scsi_tgt_transfer_response_~cmd#1.offset := scsi_tgt_transfer_response_#in~cmd#1.base, scsi_tgt_transfer_response_#in~cmd#1.offset;havoc scsi_tgt_transfer_response_~shost~0#1.base, scsi_tgt_transfer_response_~shost~0#1.offset;havoc scsi_tgt_transfer_response_~tmp~9#1.base, scsi_tgt_transfer_response_~tmp~9#1.offset;havoc scsi_tgt_transfer_response_~err~2#1; [2025-02-08 10:07:38,316 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L6421-1: SUMMARY for call copy_from_user_#t~ret58#1 := ldv__builtin_expect((if -1 == copy_from_user_~sz~0#1 then 1 else 0), 1); srcloc: null [2025-02-08 10:07:38,316 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L6421: assume -9223372036854775808 <= copy_from_user_#t~ret58#1 && copy_from_user_#t~ret58#1 <= 9223372036854775807;copy_from_user_~tmp___1~0#1 := copy_from_user_#t~ret58#1;havoc copy_from_user_#t~ret58#1; [2025-02-08 10:07:38,316 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L8255: havoc blk_rq_map_user_#t~nondet433#1;scsi_map_user_pages_#t~ret175#1 := blk_rq_map_user_#res#1;havoc blk_rq_map_user_#t~nondet433#1, blk_rq_map_user_~arg0#1.base, blk_rq_map_user_~arg0#1.offset, blk_rq_map_user_~arg1#1.base, blk_rq_map_user_~arg1#1.offset, blk_rq_map_user_~arg2#1.base, blk_rq_map_user_~arg2#1.offset, blk_rq_map_user_~arg3#1.base, blk_rq_map_user_~arg3#1.offset, blk_rq_map_user_~arg4#1, blk_rq_map_user_~arg5#1;havoc blk_rq_map_user_#in~arg0#1.base, blk_rq_map_user_#in~arg0#1.offset, blk_rq_map_user_#in~arg1#1.base, blk_rq_map_user_#in~arg1#1.offset, blk_rq_map_user_#in~arg2#1.base, blk_rq_map_user_#in~arg2#1.offset, blk_rq_map_user_#in~arg3#1.base, blk_rq_map_user_#in~arg3#1.offset, blk_rq_map_user_#in~arg4#1, blk_rq_map_user_#in~arg5#1;assume { :end_inline_blk_rq_map_user } true;assume -2147483648 <= scsi_map_user_pages_#t~ret175#1 && scsi_map_user_pages_#t~ret175#1 <= 2147483647;scsi_map_user_pages_~err~3#1 := scsi_map_user_pages_#t~ret175#1;havoc scsi_map_user_pages_#t~ret175#1; [2025-02-08 10:07:38,316 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L6422: assume 0 != copy_from_user_~tmp___1~0#1; [2025-02-08 10:07:38,316 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L6422: assume !(0 != copy_from_user_~tmp___1~0#1); [2025-02-08 10:07:38,316 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L6967: assume 0 != scsi_tgt_kspace_exec_~err~5#1; [2025-02-08 10:07:38,316 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L6967: assume !(0 != scsi_tgt_kspace_exec_~err~5#1); [2025-02-08 10:07:38,316 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L6802: scsi_tgt_transfer_response_~tmp~9#1.base, scsi_tgt_transfer_response_~tmp~9#1.offset := scsi_tgt_transfer_response_#t~ret163#1.base, scsi_tgt_transfer_response_#t~ret163#1.offset;havoc scsi_tgt_transfer_response_#t~ret163#1.base, scsi_tgt_transfer_response_#t~ret163#1.offset;scsi_tgt_transfer_response_~shost~0#1.base, scsi_tgt_transfer_response_~shost~0#1.offset := scsi_tgt_transfer_response_~tmp~9#1.base, scsi_tgt_transfer_response_~tmp~9#1.offset;call scsi_tgt_transfer_response_#t~mem168#1.base, scsi_tgt_transfer_response_#t~mem168#1.offset := read~$Pointer$#6(scsi_tgt_transfer_response_~shost~0#1.base, 488 + scsi_tgt_transfer_response_~shost~0#1.offset, 8);call scsi_tgt_transfer_response_#t~mem169#1.base, scsi_tgt_transfer_response_#t~mem169#1.offset := read~$Pointer$#6(scsi_tgt_transfer_response_#t~mem168#1.base, 64 + scsi_tgt_transfer_response_#t~mem168#1.offset, 8);assume { :begin_inline_##fun~$Pointer$~X~$Pointer$~TO~int } true;##fun~$Pointer$~X~$Pointer$~TO~int_#in~166#1.base, ##fun~$Pointer$~X~$Pointer$~TO~int_#in~166#1.offset, ##fun~$Pointer$~X~$Pointer$~TO~int_#in~167#1.base, ##fun~$Pointer$~X~$Pointer$~TO~int_#in~167#1.offset, ##fun~$Pointer$~X~$Pointer$~TO~int_#in~#fp#1.base, ##fun~$Pointer$~X~$Pointer$~TO~int_#in~#fp#1.offset := scsi_tgt_transfer_response_~cmd#1.base, scsi_tgt_transfer_response_~cmd#1.offset, #funAddr~scsi_tgt_cmd_done.base, #funAddr~scsi_tgt_cmd_done.offset, scsi_tgt_transfer_response_#t~mem169#1.base, scsi_tgt_transfer_response_#t~mem169#1.offset;havoc ##fun~$Pointer$~X~$Pointer$~TO~int_#res#1;havoc ##fun~$Pointer$~X~$Pointer$~TO~int_#~166#1.base, ##fun~$Pointer$~X~$Pointer$~TO~int_#~166#1.offset, ##fun~$Pointer$~X~$Pointer$~TO~int_#~167#1.base, ##fun~$Pointer$~X~$Pointer$~TO~int_#~167#1.offset, ##fun~$Pointer$~X~$Pointer$~TO~int_#t~funptrres451#1, ##fun~$Pointer$~X~$Pointer$~TO~int_#t~ret452#1, ##fun~$Pointer$~X~$Pointer$~TO~int_#t~ret453#1, ##fun~$Pointer$~X~$Pointer$~TO~int_#t~ret454#1;##fun~$Pointer$~X~$Pointer$~TO~int_#~166#1.base, ##fun~$Pointer$~X~$Pointer$~TO~int_#~166#1.offset := ##fun~$Pointer$~X~$Pointer$~TO~int_#in~166#1.base, ##fun~$Pointer$~X~$Pointer$~TO~int_#in~166#1.offset;##fun~$Pointer$~X~$Pointer$~TO~int_#~167#1.base, ##fun~$Pointer$~X~$Pointer$~TO~int_#~167#1.offset := ##fun~$Pointer$~X~$Pointer$~TO~int_#in~167#1.base, ##fun~$Pointer$~X~$Pointer$~TO~int_#in~167#1.offset; [2025-02-08 10:07:38,316 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L6901-1: call tgt_cmd_hash_lookup_#t~mem197#1 := read~int#6(tgt_cmd_hash_lookup_~tcmd~8#1.base, 116 + tgt_cmd_hash_lookup_~tcmd~8#1.offset, 8); [2025-02-08 10:07:38,316 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L6901: assume tgt_cmd_hash_lookup_#t~mem197#1 % 18446744073709551616 == tgt_cmd_hash_lookup_~tag#1 % 18446744073709551616;havoc tgt_cmd_hash_lookup_#t~mem197#1;call tgt_cmd_hash_lookup_#t~mem198#1.base, tgt_cmd_hash_lookup_#t~mem198#1.offset := read~$Pointer$#6(tgt_cmd_hash_lookup_~tcmd~8#1.base, 100 + tgt_cmd_hash_lookup_~tcmd~8#1.offset, 8);tgt_cmd_hash_lookup_~rq~3#1.base, tgt_cmd_hash_lookup_~rq~3#1.offset := tgt_cmd_hash_lookup_#t~mem198#1.base, tgt_cmd_hash_lookup_#t~mem198#1.offset;havoc tgt_cmd_hash_lookup_#t~mem198#1.base, tgt_cmd_hash_lookup_#t~mem198#1.offset; [2025-02-08 10:07:38,316 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L6901: assume !(tgt_cmd_hash_lookup_#t~mem197#1 % 18446744073709551616 == tgt_cmd_hash_lookup_~tag#1 % 18446744073709551616);havoc tgt_cmd_hash_lookup_#t~mem197#1;call tgt_cmd_hash_lookup_#t~mem199#1.base, tgt_cmd_hash_lookup_#t~mem199#1.offset := read~$Pointer$#6(tgt_cmd_hash_lookup_~tcmd~8#1.base, 84 + tgt_cmd_hash_lookup_~tcmd~8#1.offset, 8);tgt_cmd_hash_lookup_~__mptr___0~1#1.base, tgt_cmd_hash_lookup_~__mptr___0~1#1.offset := tgt_cmd_hash_lookup_#t~mem199#1.base, tgt_cmd_hash_lookup_#t~mem199#1.offset;havoc tgt_cmd_hash_lookup_#t~mem199#1.base, tgt_cmd_hash_lookup_#t~mem199#1.offset;tgt_cmd_hash_lookup_~tcmd~8#1.base, tgt_cmd_hash_lookup_~tcmd~8#1.offset := tgt_cmd_hash_lookup_~__mptr___0~1#1.base, -10912 + tgt_cmd_hash_lookup_~__mptr___0~1#1.offset; [2025-02-08 10:07:38,316 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L6802-1: SUMMARY for call scsi_tgt_transfer_response_#t~ret163#1.base, scsi_tgt_transfer_response_#t~ret163#1.offset := scsi_tgt_cmd_to_host(scsi_tgt_transfer_response_~cmd#1.base, scsi_tgt_transfer_response_~cmd#1.offset); srcloc: null [2025-02-08 10:07:38,316 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L6439-1: copy_from_user_#res#1 := copy_from_user_~n#1; [2025-02-08 10:07:38,316 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L6984-1: SUMMARY for call scsi_host_put(scsi_tgt_kspace_exec_~shost~1#1.base, scsi_tgt_kspace_exec_~shost~1#1.offset); srcloc: null [2025-02-08 10:07:38,316 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L6984: scsi_tgt_kspace_exec_#res#1 := scsi_tgt_kspace_exec_~err~5#1; [2025-02-08 10:07:38,316 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint tgt_writeFINAL: assume true; [2025-02-08 10:07:38,316 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L6852: assume scsi_tgt_copy_sense_~__min1~0#1 % 4294967296 < scsi_tgt_copy_sense_~__min2~0#1 % 4294967296;scsi_tgt_copy_sense_~tmp~10#1 := scsi_tgt_copy_sense_~__min1~0#1; [2025-02-08 10:07:38,316 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L6852: assume !(scsi_tgt_copy_sense_~__min1~0#1 % 4294967296 < scsi_tgt_copy_sense_~__min2~0#1 % 4294967296);scsi_tgt_copy_sense_~tmp~10#1 := scsi_tgt_copy_sense_~__min2~0#1; [2025-02-08 10:07:38,316 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L6423-1: SUMMARY for call copy_from_user_#t~ret59#1 := _copy_from_user(copy_from_user_~to#1.base, copy_from_user_~to#1.offset, copy_from_user_~from#1.base, copy_from_user_~from#1.offset, copy_from_user_~n#1); srcloc: null [2025-02-08 10:07:38,316 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L6968-1: SUMMARY for call scsi_tgt_kspace_exec_#t~ret215#1 := printk(15, 0); srcloc: null [2025-02-08 10:07:38,316 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L6423: copy_from_user_~n#1 := copy_from_user_#t~ret59#1;havoc copy_from_user_#t~ret59#1; [2025-02-08 10:07:38,317 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L6968: assume -2147483648 <= scsi_tgt_kspace_exec_#t~ret215#1 && scsi_tgt_kspace_exec_#t~ret215#1 <= 2147483647;havoc scsi_tgt_kspace_exec_#t~ret215#1;call scsi_tgt_kspace_exec_#t~mem216#1.base, scsi_tgt_kspace_exec_#t~mem216#1.offset := read~$Pointer$#5(scsi_tgt_kspace_exec_~shost~1#1.base, 641 + scsi_tgt_kspace_exec_~shost~1#1.offset, 8);call scsi_tgt_kspace_exec_#t~mem217#1.base, scsi_tgt_kspace_exec_#t~mem217#1.offset := read~$Pointer$#2(scsi_tgt_kspace_exec_#t~mem216#1.base, 1736 + scsi_tgt_kspace_exec_#t~mem216#1.offset, 8);scsi_tgt_kspace_exec_~qdata~4#1.base, scsi_tgt_kspace_exec_~qdata~4#1.offset := scsi_tgt_kspace_exec_#t~mem217#1.base, scsi_tgt_kspace_exec_#t~mem217#1.offset;havoc scsi_tgt_kspace_exec_#t~mem216#1.base, scsi_tgt_kspace_exec_#t~mem216#1.offset;havoc scsi_tgt_kspace_exec_#t~mem217#1.base, scsi_tgt_kspace_exec_#t~mem217#1.offset;call scsi_tgt_kspace_exec_#t~mem218#1 := read~int#6(scsi_tgt_kspace_exec_~tcmd~9#1.base, 116 + scsi_tgt_kspace_exec_~tcmd~9#1.offset, 8); [2025-02-08 10:07:38,317 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L-1-1: ##fun~$Pointer$~X~$Pointer$~TO~int_#res#1 := ##fun~$Pointer$~X~$Pointer$~TO~int_#t~funptrres451#1;havoc ##fun~$Pointer$~X~$Pointer$~TO~int_#t~funptrres451#1;havoc ##fun~$Pointer$~X~$Pointer$~TO~int_#t~ret452#1;havoc ##fun~$Pointer$~X~$Pointer$~TO~int_#t~ret453#1;havoc ##fun~$Pointer$~X~$Pointer$~TO~int_#t~ret454#1; [2025-02-08 10:07:38,317 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L-1-2: assume -2147483648 <= ##fun~$Pointer$~X~$Pointer$~TO~int_#t~ret454#1 && ##fun~$Pointer$~X~$Pointer$~TO~int_#t~ret454#1 <= 2147483647;##fun~$Pointer$~X~$Pointer$~TO~int_#t~funptrres451#1 := ##fun~$Pointer$~X~$Pointer$~TO~int_#t~ret454#1; [2025-02-08 10:07:38,317 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L-1-3: SUMMARY for call ##fun~$Pointer$~X~$Pointer$~TO~int_#t~ret454#1 := tgt_open(##fun~$Pointer$~X~$Pointer$~TO~int_#~166#1.base, ##fun~$Pointer$~X~$Pointer$~TO~int_#~166#1.offset, ##fun~$Pointer$~X~$Pointer$~TO~int_#~167#1.base, ##fun~$Pointer$~X~$Pointer$~TO~int_#~167#1.offset); srcloc: null [2025-02-08 10:07:38,317 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L-1-4: assume -2147483648 <= ##fun~$Pointer$~X~$Pointer$~TO~int_#t~ret453#1 && ##fun~$Pointer$~X~$Pointer$~TO~int_#t~ret453#1 <= 2147483647;##fun~$Pointer$~X~$Pointer$~TO~int_#t~funptrres451#1 := ##fun~$Pointer$~X~$Pointer$~TO~int_#t~ret453#1; [2025-02-08 10:07:38,317 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L-1-5: SUMMARY for call ##fun~$Pointer$~X~$Pointer$~TO~int_#t~ret453#1 := tgt_mmap(##fun~$Pointer$~X~$Pointer$~TO~int_#~166#1.base, ##fun~$Pointer$~X~$Pointer$~TO~int_#~166#1.offset, ##fun~$Pointer$~X~$Pointer$~TO~int_#~167#1.base, ##fun~$Pointer$~X~$Pointer$~TO~int_#~167#1.offset); srcloc: null [2025-02-08 10:07:38,317 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L-1-6: ##fun~$Pointer$~X~$Pointer$~TO~int_#t~funptrres451#1 := ##fun~$Pointer$~X~$Pointer$~TO~int_#t~ret452#1; [2025-02-08 10:07:38,317 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L6870: assume -2147483648 <= scsi_tgt_abort_cmd_#t~ret188#1 && scsi_tgt_abort_cmd_#t~ret188#1 <= 2147483647;scsi_tgt_abort_cmd_~err~4#1 := scsi_tgt_abort_cmd_#t~ret188#1;havoc scsi_tgt_abort_cmd_#t~mem186#1.base, scsi_tgt_abort_cmd_#t~mem186#1.offset;havoc scsi_tgt_abort_cmd_#t~mem187#1.base, scsi_tgt_abort_cmd_#t~mem187#1.offset;havoc scsi_tgt_abort_cmd_#t~ret188#1; [2025-02-08 10:07:38,317 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L-1-7: SUMMARY for call ##fun~$Pointer$~X~$Pointer$~TO~int_#t~ret452#1 := tgt_poll(##fun~$Pointer$~X~$Pointer$~TO~int_#~166#1.base, ##fun~$Pointer$~X~$Pointer$~TO~int_#~166#1.offset, ##fun~$Pointer$~X~$Pointer$~TO~int_#~167#1.base, ##fun~$Pointer$~X~$Pointer$~TO~int_#~167#1.offset); srcloc: null [2025-02-08 10:07:38,317 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L6903: SUMMARY for call list_del(tgt_cmd_hash_lookup_~tcmd~8#1.base, 84 + tgt_cmd_hash_lookup_~tcmd~8#1.offset); srcloc: null [2025-02-08 10:07:38,317 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L-1-8: assume ##fun~$Pointer$~X~$Pointer$~TO~int_#in~#fp#1.base == #funAddr~tgt_mmap.base && ##fun~$Pointer$~X~$Pointer$~TO~int_#in~#fp#1.offset == #funAddr~tgt_mmap.offset; [2025-02-08 10:07:38,317 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L-1-8: assume !(##fun~$Pointer$~X~$Pointer$~TO~int_#in~#fp#1.base == #funAddr~tgt_mmap.base && ##fun~$Pointer$~X~$Pointer$~TO~int_#in~#fp#1.offset == #funAddr~tgt_mmap.offset); [2025-02-08 10:07:38,317 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L-1-9: assume ##fun~$Pointer$~X~$Pointer$~TO~int_#in~#fp#1.base == #funAddr~tgt_open.base && ##fun~$Pointer$~X~$Pointer$~TO~int_#in~#fp#1.offset == #funAddr~tgt_open.offset; [2025-02-08 10:07:38,317 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L-1-9: assume !(##fun~$Pointer$~X~$Pointer$~TO~int_#in~#fp#1.base == #funAddr~tgt_open.base && ##fun~$Pointer$~X~$Pointer$~TO~int_#in~#fp#1.offset == #funAddr~tgt_open.offset); [2025-02-08 10:07:38,317 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L6804: scsi_tgt_transfer_response_#t~ret170#1 := ##fun~$Pointer$~X~$Pointer$~TO~int_#res#1;havoc ##fun~$Pointer$~X~$Pointer$~TO~int_#~166#1.base, ##fun~$Pointer$~X~$Pointer$~TO~int_#~166#1.offset, ##fun~$Pointer$~X~$Pointer$~TO~int_#~167#1.base, ##fun~$Pointer$~X~$Pointer$~TO~int_#~167#1.offset, ##fun~$Pointer$~X~$Pointer$~TO~int_#t~funptrres451#1, ##fun~$Pointer$~X~$Pointer$~TO~int_#t~ret452#1, ##fun~$Pointer$~X~$Pointer$~TO~int_#t~ret453#1, ##fun~$Pointer$~X~$Pointer$~TO~int_#t~ret454#1;havoc ##fun~$Pointer$~X~$Pointer$~TO~int_#in~166#1.base, ##fun~$Pointer$~X~$Pointer$~TO~int_#in~166#1.offset, ##fun~$Pointer$~X~$Pointer$~TO~int_#in~167#1.base, ##fun~$Pointer$~X~$Pointer$~TO~int_#in~167#1.offset, ##fun~$Pointer$~X~$Pointer$~TO~int_#in~#fp#1.base, ##fun~$Pointer$~X~$Pointer$~TO~int_#in~#fp#1.offset;assume { :end_inline_##fun~$Pointer$~X~$Pointer$~TO~int } true;assume -2147483648 <= scsi_tgt_transfer_response_#t~ret170#1 && scsi_tgt_transfer_response_#t~ret170#1 <= 2147483647;scsi_tgt_transfer_response_~err~2#1 := scsi_tgt_transfer_response_#t~ret170#1;havoc scsi_tgt_transfer_response_#t~mem168#1.base, scsi_tgt_transfer_response_#t~mem168#1.offset;havoc scsi_tgt_transfer_response_#t~mem169#1.base, scsi_tgt_transfer_response_#t~mem169#1.offset;havoc scsi_tgt_transfer_response_#t~ret170#1;scsi_tgt_transfer_response_#t~switch171#1 := 4181 == scsi_tgt_transfer_response_~err~2#1; [2025-02-08 10:07:38,317 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L8340: havoc scsi_init_io_#t~nondet447#1;scsi_map_user_pages_#t~ret178#1 := scsi_init_io_#res#1;havoc scsi_init_io_#t~nondet447#1, scsi_init_io_~arg0#1.base, scsi_init_io_~arg0#1.offset, scsi_init_io_~arg1#1;havoc scsi_init_io_#in~arg0#1.base, scsi_init_io_#in~arg0#1.offset, scsi_init_io_#in~arg1#1;assume { :end_inline_scsi_init_io } true;assume -2147483648 <= scsi_map_user_pages_#t~ret178#1 && scsi_map_user_pages_#t~ret178#1 <= 2147483647;scsi_map_user_pages_~err~3#1 := scsi_map_user_pages_#t~ret178#1;havoc scsi_map_user_pages_#t~ret178#1; [2025-02-08 10:07:38,318 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L6870-1: SUMMARY for call scsi_tgt_abort_cmd_#t~ret188#1 := ##fun~$Pointer$~TO~int(scsi_tgt_abort_cmd_~cmd#1.base, scsi_tgt_abort_cmd_~cmd#1.offset, scsi_tgt_abort_cmd_#t~mem187#1.base, scsi_tgt_abort_cmd_#t~mem187#1.offset); srcloc: null [2025-02-08 10:07:38,318 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L7498: #res#1 := (if ~count#1 % 18446744073709551616 % 18446744073709551616 <= 9223372036854775807 then ~count#1 % 18446744073709551616 % 18446744073709551616 else ~count#1 % 18446744073709551616 % 18446744073709551616 - 18446744073709551616); [2025-02-08 10:07:38,318 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L6953: assume 32 == scsi_tgt_kspace_exec_~result#1;assume { :begin_inline_scsi_tgt_abort_cmd } true;scsi_tgt_abort_cmd_#in~shost#1.base, scsi_tgt_abort_cmd_#in~shost#1.offset, scsi_tgt_abort_cmd_#in~cmd#1.base, scsi_tgt_abort_cmd_#in~cmd#1.offset := scsi_tgt_kspace_exec_~shost~1#1.base, scsi_tgt_kspace_exec_~shost~1#1.offset, scsi_tgt_kspace_exec_~cmd~3#1.base, scsi_tgt_kspace_exec_~cmd~3#1.offset;havoc scsi_tgt_abort_cmd_#res#1;havoc scsi_tgt_abort_cmd_#t~mem186#1.base, scsi_tgt_abort_cmd_#t~mem186#1.offset, scsi_tgt_abort_cmd_#t~mem187#1.base, scsi_tgt_abort_cmd_#t~mem187#1.offset, scsi_tgt_abort_cmd_#t~ret188#1, scsi_tgt_abort_cmd_#t~ret189#1, scsi_tgt_abort_cmd_#t~mem190#1.base, scsi_tgt_abort_cmd_#t~mem190#1.offset, scsi_tgt_abort_cmd_#t~mem191#1.base, scsi_tgt_abort_cmd_#t~mem191#1.offset, scsi_tgt_abort_cmd_~shost#1.base, scsi_tgt_abort_cmd_~shost#1.offset, scsi_tgt_abort_cmd_~cmd#1.base, scsi_tgt_abort_cmd_~cmd#1.offset, scsi_tgt_abort_cmd_~tcmd~7#1.base, scsi_tgt_abort_cmd_~tcmd~7#1.offset, scsi_tgt_abort_cmd_~err~4#1;scsi_tgt_abort_cmd_~shost#1.base, scsi_tgt_abort_cmd_~shost#1.offset := scsi_tgt_abort_cmd_#in~shost#1.base, scsi_tgt_abort_cmd_#in~shost#1.offset;scsi_tgt_abort_cmd_~cmd#1.base, scsi_tgt_abort_cmd_~cmd#1.offset := scsi_tgt_abort_cmd_#in~cmd#1.base, scsi_tgt_abort_cmd_#in~cmd#1.offset;havoc scsi_tgt_abort_cmd_~tcmd~7#1.base, scsi_tgt_abort_cmd_~tcmd~7#1.offset;havoc scsi_tgt_abort_cmd_~err~4#1;call scsi_tgt_abort_cmd_#t~mem186#1.base, scsi_tgt_abort_cmd_#t~mem186#1.offset := read~$Pointer$#5(scsi_tgt_abort_cmd_~shost#1.base, 488 + scsi_tgt_abort_cmd_~shost#1.offset, 8);call scsi_tgt_abort_cmd_#t~mem187#1.base, scsi_tgt_abort_cmd_#t~mem187#1.offset := read~$Pointer$#2(scsi_tgt_abort_cmd_#t~mem186#1.base, 72 + scsi_tgt_abort_cmd_#t~mem186#1.offset, 8); [2025-02-08 10:07:38,318 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L6953: assume !(32 == scsi_tgt_kspace_exec_~result#1);call scsi_tgt_kspace_exec_#t~mem209#1.base, scsi_tgt_kspace_exec_#t~mem209#1.offset := read~$Pointer$#6(scsi_tgt_kspace_exec_~cmd~3#1.base, 124 + scsi_tgt_kspace_exec_~cmd~3#1.offset, 8);call scsi_tgt_kspace_exec_#t~mem210#1.base, scsi_tgt_kspace_exec_#t~mem210#1.offset := read~$Pointer$#6(scsi_tgt_kspace_exec_#t~mem209#1.base, 344 + scsi_tgt_kspace_exec_#t~mem209#1.offset, 8);scsi_tgt_kspace_exec_~tcmd~9#1.base, scsi_tgt_kspace_exec_~tcmd~9#1.offset := scsi_tgt_kspace_exec_#t~mem210#1.base, scsi_tgt_kspace_exec_#t~mem210#1.offset;havoc scsi_tgt_kspace_exec_#t~mem209#1.base, scsi_tgt_kspace_exec_#t~mem209#1.offset;havoc scsi_tgt_kspace_exec_#t~mem210#1.base, scsi_tgt_kspace_exec_#t~mem210#1.offset;call write~int#6(scsi_tgt_kspace_exec_~result#1, scsi_tgt_kspace_exec_~cmd~3#1.base, 208 + scsi_tgt_kspace_exec_~cmd~3#1.offset, 4);call scsi_tgt_kspace_exec_#t~mem211#1 := read~int#6(scsi_tgt_kspace_exec_~cmd~3#1.base, 208 + scsi_tgt_kspace_exec_~cmd~3#1.offset, 4); [2025-02-08 10:07:38,318 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L6838: scsi_map_user_pages_#res#1 := scsi_map_user_pages_~err~3#1; [2025-02-08 10:07:38,318 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L6871: assume 0 != scsi_tgt_abort_cmd_~err~4#1; [2025-02-08 10:07:38,318 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L6871: assume !(0 != scsi_tgt_abort_cmd_~err~4#1); [2025-02-08 10:07:38,318 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L6425-1: SUMMARY for call copy_from_user_#t~ret60#1 := ldv__builtin_expect((if copy_from_user_~sz~0#1 % 18446744073709551616 >= copy_from_user_~n#1 % 18446744073709551616 then 1 else 0), 1); srcloc: null [2025-02-08 10:07:38,318 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L6425: assume -9223372036854775808 <= copy_from_user_#t~ret60#1 && copy_from_user_#t~ret60#1 <= 9223372036854775807;copy_from_user_~tmp___2~1#1 := copy_from_user_#t~ret60#1;havoc copy_from_user_#t~ret60#1; [2025-02-08 10:07:38,318 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L6838-1: SUMMARY for call scsi_unmap_user_pages(scsi_map_user_pages_~tcmd#1.base, scsi_map_user_pages_~tcmd#1.offset); srcloc: null [2025-02-08 10:07:38,318 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L7466: event_recv_msg_#t~ret356#1 := scsi_tgt_kspace_tsk_mgmt_#res#1;havoc scsi_tgt_kspace_tsk_mgmt_#t~ret226#1.base, scsi_tgt_kspace_tsk_mgmt_#t~ret226#1.offset, scsi_tgt_kspace_tsk_mgmt_#t~ret227#1, scsi_tgt_kspace_tsk_mgmt_#t~mem228#1.base, scsi_tgt_kspace_tsk_mgmt_#t~mem228#1.offset, scsi_tgt_kspace_tsk_mgmt_#t~ret229#1, scsi_tgt_kspace_tsk_mgmt_#t~mem236#1.base, scsi_tgt_kspace_tsk_mgmt_#t~mem236#1.offset, scsi_tgt_kspace_tsk_mgmt_#t~mem237#1.base, scsi_tgt_kspace_tsk_mgmt_#t~mem237#1.offset, scsi_tgt_kspace_tsk_mgmt_#t~ret238#1, scsi_tgt_kspace_tsk_mgmt_~host_no#1, scsi_tgt_kspace_tsk_mgmt_~itn_id#1, scsi_tgt_kspace_tsk_mgmt_~mid#1, scsi_tgt_kspace_tsk_mgmt_~result#1, scsi_tgt_kspace_tsk_mgmt_~shost~2#1.base, scsi_tgt_kspace_tsk_mgmt_~shost~2#1.offset, scsi_tgt_kspace_tsk_mgmt_~err~7#1;havoc scsi_tgt_kspace_tsk_mgmt_#in~host_no#1, scsi_tgt_kspace_tsk_mgmt_#in~itn_id#1, scsi_tgt_kspace_tsk_mgmt_#in~mid#1, scsi_tgt_kspace_tsk_mgmt_#in~result#1;assume { :end_inline_scsi_tgt_kspace_tsk_mgmt } true;assume -2147483648 <= event_recv_msg_#t~ret356#1 && event_recv_msg_#t~ret356#1 <= 2147483647;event_recv_msg_~err~17#1 := event_recv_msg_#t~ret356#1; [2025-02-08 10:07:38,318 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L6954: scsi_tgt_kspace_exec_#t~ret208#1 := scsi_tgt_abort_cmd_#res#1;havoc scsi_tgt_abort_cmd_#t~mem186#1.base, scsi_tgt_abort_cmd_#t~mem186#1.offset, scsi_tgt_abort_cmd_#t~mem187#1.base, scsi_tgt_abort_cmd_#t~mem187#1.offset, scsi_tgt_abort_cmd_#t~ret188#1, scsi_tgt_abort_cmd_#t~ret189#1, scsi_tgt_abort_cmd_#t~mem190#1.base, scsi_tgt_abort_cmd_#t~mem190#1.offset, scsi_tgt_abort_cmd_#t~mem191#1.base, scsi_tgt_abort_cmd_#t~mem191#1.offset, scsi_tgt_abort_cmd_~shost#1.base, scsi_tgt_abort_cmd_~shost#1.offset, scsi_tgt_abort_cmd_~cmd#1.base, scsi_tgt_abort_cmd_~cmd#1.offset, scsi_tgt_abort_cmd_~tcmd~7#1.base, scsi_tgt_abort_cmd_~tcmd~7#1.offset, scsi_tgt_abort_cmd_~err~4#1;havoc scsi_tgt_abort_cmd_#in~shost#1.base, scsi_tgt_abort_cmd_#in~shost#1.offset, scsi_tgt_abort_cmd_#in~cmd#1.base, scsi_tgt_abort_cmd_#in~cmd#1.offset;assume { :end_inline_scsi_tgt_abort_cmd } true;assume -2147483648 <= scsi_tgt_kspace_exec_#t~ret208#1 && scsi_tgt_kspace_exec_#t~ret208#1 <= 2147483647;havoc scsi_tgt_kspace_exec_#t~ret208#1; [2025-02-08 10:07:38,318 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L6822: assume 0 != scsi_map_user_pages_~err~3#1; [2025-02-08 10:07:38,318 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L6822: assume !(0 != scsi_map_user_pages_~err~3#1);call scsi_map_user_pages_#t~mem177#1.base, scsi_map_user_pages_#t~mem177#1.offset := read~$Pointer$#6(scsi_map_user_pages_~rq~2#1.base, 92 + scsi_map_user_pages_~rq~2#1.offset, 8);call write~$Pointer$#6(scsi_map_user_pages_#t~mem177#1.base, scsi_map_user_pages_#t~mem177#1.offset, scsi_map_user_pages_~tcmd#1.base, 76 + scsi_map_user_pages_~tcmd#1.offset, 8);havoc scsi_map_user_pages_#t~mem177#1.base, scsi_map_user_pages_#t~mem177#1.offset;assume { :begin_inline_scsi_init_io } true;scsi_init_io_#in~arg0#1.base, scsi_init_io_#in~arg0#1.offset, scsi_init_io_#in~arg1#1 := scsi_map_user_pages_~cmd#1.base, scsi_map_user_pages_~cmd#1.offset, 208;havoc scsi_init_io_#res#1;havoc scsi_init_io_#t~nondet447#1, scsi_init_io_~arg0#1.base, scsi_init_io_~arg0#1.offset, scsi_init_io_~arg1#1;scsi_init_io_~arg0#1.base, scsi_init_io_~arg0#1.offset := scsi_init_io_#in~arg0#1.base, scsi_init_io_#in~arg0#1.offset;scsi_init_io_~arg1#1 := scsi_init_io_#in~arg1#1;havoc scsi_init_io_#t~nondet447#1;assume -2147483648 <= scsi_init_io_#t~nondet447#1 && scsi_init_io_#t~nondet447#1 <= 2147483647;scsi_init_io_#res#1 := scsi_init_io_#t~nondet447#1;havoc scsi_init_io_#t~nondet447#1; [2025-02-08 10:07:38,318 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L6971-1: SUMMARY for call scsi_tgt_kspace_exec_#t~ret219#1 := hash_64(scsi_tgt_kspace_exec_#t~mem218#1, 4); srcloc: null [2025-02-08 10:07:38,318 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L6426: assume 0 != copy_from_user_~tmp___2~1#1; [2025-02-08 10:07:38,318 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L6426: assume !(0 != copy_from_user_~tmp___2~1#1);copy_from_user_~__ret_warn_on~0#1 := 1; [2025-02-08 10:07:38,318 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L6971: scsi_tgt_kspace_exec_~tmp~12#1 := scsi_tgt_kspace_exec_#t~ret219#1;havoc scsi_tgt_kspace_exec_#t~mem218#1;havoc scsi_tgt_kspace_exec_#t~ret219#1;scsi_tgt_kspace_exec_~head~2#1.base, scsi_tgt_kspace_exec_~head~2#1.offset := scsi_tgt_kspace_exec_~qdata~4#1.base, 8 + scsi_tgt_kspace_exec_~qdata~4#1.offset + 16 * (if scsi_tgt_kspace_exec_~tmp~12#1 % 18446744073709551616 % 18446744073709551616 <= 9223372036854775807 then scsi_tgt_kspace_exec_~tmp~12#1 % 18446744073709551616 % 18446744073709551616 else scsi_tgt_kspace_exec_~tmp~12#1 % 18446744073709551616 % 18446744073709551616 - 18446744073709551616); [2025-02-08 10:07:38,318 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L6806: assume scsi_tgt_transfer_response_#t~switch171#1; [2025-02-08 10:07:38,319 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L6806: assume !scsi_tgt_transfer_response_#t~switch171#1; [2025-02-08 10:07:38,319 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L6872-1: SUMMARY for call scsi_tgt_abort_cmd_#t~ret189#1 := printk(10, 0); srcloc: null [2025-02-08 10:07:38,319 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L6872: assume -2147483648 <= scsi_tgt_abort_cmd_#t~ret189#1 && scsi_tgt_abort_cmd_#t~ret189#1 <= 2147483647;havoc scsi_tgt_abort_cmd_#t~ret189#1; [2025-02-08 10:07:38,319 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L6823-1: SUMMARY for call scsi_map_user_pages_#t~ret176#1 := printk(7, 0); srcloc: null [2025-02-08 10:07:38,319 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L6823: assume -2147483648 <= scsi_map_user_pages_#t~ret176#1 && scsi_map_user_pages_#t~ret176#1 <= 2147483647;havoc scsi_map_user_pages_#t~ret176#1;scsi_map_user_pages_#res#1 := scsi_map_user_pages_~err~3#1; [2025-02-08 10:07:38,344 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint tgt_ring_initFINAL: assume true; [2025-02-08 10:07:38,345 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L7635: #res#1 := 0;call ULTIMATE.dealloc(~#__key~3#1.base, ~#__key~3#1.offset);havoc ~#__key~3#1.base, ~#__key~3#1.offset; [2025-02-08 10:07:38,345 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L7627-1: assume 1 + ~i~4#1 >= -2147483648; [2025-02-08 10:07:38,345 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L7627-1: assume !(1 + ~i~4#1 >= -2147483648); [2025-02-08 10:07:38,345 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L7627: assume 1 + ~i~4#1 <= 2147483647;~i~4#1 := 1 + ~i~4#1; [2025-02-08 10:07:38,345 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L7627: assume !(1 + ~i~4#1 <= 2147483647); [2025-02-08 10:07:38,345 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L7623-1: SUMMARY for call #t~ret391#1 := printk(45, 0); srcloc: null [2025-02-08 10:07:38,346 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L7623: assume -2147483648 <= #t~ret391#1 && #t~ret391#1 <= 2147483647;havoc #t~ret391#1;#res#1 := -12;call ULTIMATE.dealloc(~#__key~3#1.base, ~#__key~3#1.offset);havoc ~#__key~3#1.base, ~#__key~3#1.offset; [2025-02-08 10:07:38,346 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L7621: assume { :begin_inline_get_zeroed_page } true;get_zeroed_page_#in~arg0#1 := 208;havoc get_zeroed_page_#res#1;havoc get_zeroed_page_#t~nondet436#1, get_zeroed_page_~arg0#1;get_zeroed_page_~arg0#1 := get_zeroed_page_#in~arg0#1;havoc get_zeroed_page_#t~nondet436#1;get_zeroed_page_#res#1 := get_zeroed_page_#t~nondet436#1;havoc get_zeroed_page_#t~nondet436#1; [2025-02-08 10:07:38,346 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L7613: call ULTIMATE.dealloc(~#__key~3#1.base, ~#__key~3#1.offset);havoc ~#__key~3#1.base, ~#__key~3#1.offset; [2025-02-08 10:07:38,346 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L8272-1: #t~ret389#1 := get_zeroed_page_#res#1;havoc get_zeroed_page_#t~nondet436#1, get_zeroed_page_~arg0#1;havoc get_zeroed_page_#in~arg0#1;assume { :end_inline_get_zeroed_page } true;call write~int#6(#t~ret389#1, ~ring#1.base, 4 + ~ring#1.offset + 8 * ~i~4#1, 8);call #t~mem390#1 := read~int#6(~ring#1.base, 4 + ~ring#1.offset + 8 * ~i~4#1, 8); [2025-02-08 10:07:38,346 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L8272: havoc get_zeroed_page_#t~nondet436#1; [2025-02-08 10:07:38,346 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L7622: assume 0 == #t~mem390#1 % 18446744073709551616;havoc #t~mem390#1; [2025-02-08 10:07:38,346 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L7622: assume !(0 == #t~mem390#1 % 18446744073709551616);havoc #t~mem390#1; [2025-02-08 10:07:38,379 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L8236: havoc #t~nondet431; [2025-02-08 10:07:38,389 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L8333: havoc #t~ret446.base, #t~ret446.offset; [2025-02-08 10:07:38,412 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L8232: havoc #t~nondet430; [2025-02-08 10:07:40,285 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L7096: SUMMARY for call destroy_workqueue(~scsi_tgtd~0.base, ~scsi_tgtd~0.offset); srcloc: null [2025-02-08 10:07:40,286 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L7650: assume -2147483648 <= scsi_tgt_if_init_#t~ret393#1 && scsi_tgt_if_init_#t~ret393#1 <= 2147483647;scsi_tgt_if_init_~err~20#1 := scsi_tgt_if_init_#t~ret393#1;havoc scsi_tgt_if_init_#t~ret393#1; [2025-02-08 10:07:40,286 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L7138: assume { :end_inline_scsi_tgt_exit } true;~ldv_state_variable_0~0 := 2; [2025-02-08 10:07:40,286 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L8319: havoc noop_llseek_#t~nondet443#1;ldv_main_exported_1_#t~ret404#1 := noop_llseek_#res#1;havoc noop_llseek_#t~nondet443#1, noop_llseek_~arg0#1.base, noop_llseek_~arg0#1.offset, noop_llseek_~arg1#1, noop_llseek_~arg2#1;havoc noop_llseek_#in~arg0#1.base, noop_llseek_#in~arg0#1.offset, noop_llseek_#in~arg1#1, noop_llseek_#in~arg2#1;assume { :end_inline_noop_llseek } true;assume -9223372036854775808 <= ldv_main_exported_1_#t~ret404#1 && ldv_main_exported_1_#t~ret404#1 <= 9223372036854775807;havoc ldv_main_exported_1_#t~ret404#1;~ldv_state_variable_1~0 := 2; [2025-02-08 10:07:40,286 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L7072: call ULTIMATE.dealloc(scsi_tgt_init_~#__key~2#1.base, scsi_tgt_init_~#__key~2#1.offset);havoc scsi_tgt_init_~#__key~2#1.base, scsi_tgt_init_~#__key~2#1.offset;main_#t~ret266#1 := scsi_tgt_init_#res#1;havoc scsi_tgt_init_#t~ret259#1.base, scsi_tgt_init_#t~ret259#1.offset, scsi_tgt_init_#t~ret260#1.base, scsi_tgt_init_#t~ret260#1.offset, scsi_tgt_init_#t~ret261#1, scsi_tgt_init_~err~11#1, scsi_tgt_init_~#__key~2#1.base, scsi_tgt_init_~#__key~2#1.offset, scsi_tgt_init_~__lock_name~0#1.base, scsi_tgt_init_~__lock_name~0#1.offset, scsi_tgt_init_~tmp~13#1.base, scsi_tgt_init_~tmp~13#1.offset;assume { :end_inline_scsi_tgt_init } true;assume -2147483648 <= main_#t~ret266#1 && main_#t~ret266#1 <= 2147483647;~ldv_retval_1~0 := main_#t~ret266#1;havoc main_#t~ret266#1; [2025-02-08 10:07:40,286 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L7650-1: SUMMARY for call scsi_tgt_if_init_#t~ret393#1 := tgt_ring_init(~#tx_ring~0.base, ~#tx_ring~0.offset); srcloc: null [2025-02-08 10:07:40,286 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint ULTIMATE.startFINAL: assume true; [2025-02-08 10:07:40,286 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L8187: SUMMARY for call ldv_error(); srcloc: null [2025-02-08 10:07:40,290 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L8278: havoc kmem_cache_create_#t~ret438#1.base, kmem_cache_create_#t~ret438#1.offset;scsi_tgt_init_#t~ret259#1.base, scsi_tgt_init_#t~ret259#1.offset := kmem_cache_create_#res#1.base, kmem_cache_create_#res#1.offset;havoc kmem_cache_create_#t~ret438#1.base, kmem_cache_create_#t~ret438#1.offset, kmem_cache_create_~arg0#1.base, kmem_cache_create_~arg0#1.offset, kmem_cache_create_~arg1#1, kmem_cache_create_~arg2#1, kmem_cache_create_~arg3#1, kmem_cache_create_~arg4#1.base, kmem_cache_create_~arg4#1.offset;havoc kmem_cache_create_#in~arg0#1.base, kmem_cache_create_#in~arg0#1.offset, kmem_cache_create_#in~arg1#1, kmem_cache_create_#in~arg2#1, kmem_cache_create_#in~arg3#1, kmem_cache_create_#in~arg4#1.base, kmem_cache_create_#in~arg4#1.offset;assume { :end_inline_kmem_cache_create } true;~scsi_tgt_cmd_cache~0.base, ~scsi_tgt_cmd_cache~0.offset := scsi_tgt_init_#t~ret259#1.base, scsi_tgt_init_#t~ret259#1.offset;havoc scsi_tgt_init_#t~ret259#1.base, scsi_tgt_init_#t~ret259#1.offset; [2025-02-08 10:07:40,291 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L7667: SUMMARY for call tgt_ring_exit(~#rx_ring~0.base, ~#rx_ring~0.offset); srcloc: null [2025-02-08 10:07:40,291 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L7089: scsi_tgt_init_#t~ret261#1 := scsi_tgt_if_init_#res#1;havoc scsi_tgt_if_init_#t~ret393#1, scsi_tgt_if_init_#t~ret394#1, scsi_tgt_if_init_#t~ret395#1, scsi_tgt_if_init_~err~20#1;assume { :end_inline_scsi_tgt_if_init } true;assume -2147483648 <= scsi_tgt_init_#t~ret261#1 && scsi_tgt_init_#t~ret261#1 <= 2147483647;scsi_tgt_init_~err~11#1 := scsi_tgt_init_#t~ret261#1;havoc scsi_tgt_init_#t~ret261#1; [2025-02-08 10:07:40,291 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L7750: assume ~ref_cnt~0 - 1 <= 2147483647;~ref_cnt~0 := ~ref_cnt~0 - 1; [2025-02-08 10:07:40,291 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L7750: assume !(~ref_cnt~0 - 1 <= 2147483647); [2025-02-08 10:07:40,291 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L7106: havoc scsi_tgt_if_exit_#t~ret392#1;assume { :end_inline_scsi_tgt_if_exit } true; [2025-02-08 10:07:40,291 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L7172-1: assume { :begin_inline_ldv_check_final_state } true; [2025-02-08 10:07:40,291 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L7651: assume 0 != scsi_tgt_if_init_~err~20#1;scsi_tgt_if_init_#res#1 := scsi_tgt_if_init_~err~20#1; [2025-02-08 10:07:40,291 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L7651: assume !(0 != scsi_tgt_if_init_~err~20#1); [2025-02-08 10:07:40,291 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L7172: assume { :end_inline_ldv_check_final_state } true;main_#res#1 := 0;#t~ret450#1 := main_#res#1;havoc main_#t~nondet262#1, main_#t~switch263#1, main_#t~nondet264#1, main_#t~switch265#1, main_#t~ret266#1, main_~tmp~14#1, main_~tmp___0~7#1;assume { :end_inline_main } true; [2025-02-08 10:07:40,291 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L7750-1: assume ~ref_cnt~0 - 1 >= -2147483648; [2025-02-08 10:07:40,291 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L7750-1: assume !(~ref_cnt~0 - 1 >= -2147483648); [2025-02-08 10:07:40,291 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L7098: scsi_tgt_init_#res#1 := scsi_tgt_init_~err~11#1;call ULTIMATE.dealloc(scsi_tgt_init_~#__key~2#1.base, scsi_tgt_init_~#__key~2#1.offset);havoc scsi_tgt_init_~#__key~2#1.base, scsi_tgt_init_~#__key~2#1.offset; [2025-02-08 10:07:40,291 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L7643: scsi_tgt_if_exit_#t~ret392#1 := ldv_misc_deregister_22_#res#1;havoc ldv_misc_deregister_22_#t~ret409#1, ldv_misc_deregister_22_~misc#1.base, ldv_misc_deregister_22_~misc#1.offset, ldv_misc_deregister_22_~ldv_func_res~2#1, ldv_misc_deregister_22_~tmp~23#1;havoc ldv_misc_deregister_22_#in~misc#1.base, ldv_misc_deregister_22_#in~misc#1.offset;assume { :end_inline_ldv_misc_deregister_22 } true;assume -2147483648 <= scsi_tgt_if_exit_#t~ret392#1 && scsi_tgt_if_exit_#t~ret392#1 <= 2147483647;havoc scsi_tgt_if_exit_#t~ret392#1; [2025-02-08 10:07:40,291 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L7098-1: SUMMARY for call kmem_cache_destroy(~scsi_tgt_cmd_cache~0.base, ~scsi_tgt_cmd_cache~0.offset); srcloc: null [2025-02-08 10:07:40,291 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L7090: assume 0 != scsi_tgt_init_~err~11#1; [2025-02-08 10:07:40,292 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L7090: assume !(0 != scsi_tgt_init_~err~11#1);scsi_tgt_init_#res#1 := 0;call ULTIMATE.dealloc(scsi_tgt_init_~#__key~2#1.base, scsi_tgt_init_~#__key~2#1.offset);havoc scsi_tgt_init_~#__key~2#1.base, scsi_tgt_init_~#__key~2#1.offset; [2025-02-08 10:07:40,292 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L7660: scsi_tgt_if_init_#t~ret395#1 := ldv_misc_register_23_#res#1;havoc ldv_misc_register_23_#t~ret410#1, ldv_misc_register_23_~misc#1.base, ldv_misc_register_23_~misc#1.offset, ldv_misc_register_23_~ldv_func_res~3#1, ldv_misc_register_23_~tmp~24#1;havoc ldv_misc_register_23_#in~misc#1.base, ldv_misc_register_23_#in~misc#1.offset;assume { :end_inline_ldv_misc_register_23 } true;assume -2147483648 <= scsi_tgt_if_init_#t~ret395#1 && scsi_tgt_if_init_#t~ret395#1 <= 2147483647;scsi_tgt_if_init_~err~20#1 := scsi_tgt_if_init_#t~ret395#1;havoc scsi_tgt_if_init_#t~ret395#1; [2025-02-08 10:07:40,292 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L8197-3: SUMMARY for call __alloc_workqueue_key_#t~ret426#1.base, __alloc_workqueue_key_#t~ret426#1.offset := ldv_malloc(0); srcloc: null [2025-02-08 10:07:40,292 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L8197-2: __alloc_workqueue_key_#res#1.base, __alloc_workqueue_key_#res#1.offset := __alloc_workqueue_key_#t~ret426#1.base, __alloc_workqueue_key_#t~ret426#1.offset;havoc __alloc_workqueue_key_#t~ret426#1.base, __alloc_workqueue_key_#t~ret426#1.offset; [2025-02-08 10:07:40,292 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L7107: SUMMARY for call kmem_cache_destroy(~scsi_tgt_cmd_cache~0.base, ~scsi_tgt_cmd_cache~0.offset); srcloc: null [2025-02-08 10:07:40,292 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L8197: havoc __alloc_workqueue_key_#t~ret426#1.base, __alloc_workqueue_key_#t~ret426#1.offset;scsi_tgt_init_#t~ret260#1.base, scsi_tgt_init_#t~ret260#1.offset := __alloc_workqueue_key_#res#1.base, __alloc_workqueue_key_#res#1.offset;havoc __alloc_workqueue_key_#t~ret426#1.base, __alloc_workqueue_key_#t~ret426#1.offset, __alloc_workqueue_key_~arg0#1.base, __alloc_workqueue_key_~arg0#1.offset, __alloc_workqueue_key_~arg1#1, __alloc_workqueue_key_~arg2#1, __alloc_workqueue_key_~arg3#1.base, __alloc_workqueue_key_~arg3#1.offset, __alloc_workqueue_key_~arg4#1.base, __alloc_workqueue_key_~arg4#1.offset;havoc __alloc_workqueue_key_#in~arg0#1.base, __alloc_workqueue_key_#in~arg0#1.offset, __alloc_workqueue_key_#in~arg1#1, __alloc_workqueue_key_#in~arg2#1, __alloc_workqueue_key_#in~arg3#1.base, __alloc_workqueue_key_#in~arg3#1.offset, __alloc_workqueue_key_#in~arg4#1.base, __alloc_workqueue_key_#in~arg4#1.offset;assume { :end_inline___alloc_workqueue_key } true;scsi_tgt_init_~tmp~13#1.base, scsi_tgt_init_~tmp~13#1.offset := scsi_tgt_init_#t~ret260#1.base, scsi_tgt_init_#t~ret260#1.offset;havoc scsi_tgt_init_#t~ret260#1.base, scsi_tgt_init_#t~ret260#1.offset;~scsi_tgtd~0.base, ~scsi_tgtd~0.offset := scsi_tgt_init_~tmp~13#1.base, scsi_tgt_init_~tmp~13#1.offset; [2025-02-08 10:07:40,292 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L8288: havoc ldv_tgt_fops_release_1_#t~nondet439#1;ldv_main_exported_1_#t~ret406#1 := ldv_tgt_fops_release_1_#res#1;havoc ldv_tgt_fops_release_1_#t~nondet439#1;assume { :end_inline_ldv_tgt_fops_release_1 } true;assume -2147483648 <= ldv_main_exported_1_#t~ret406#1 && ldv_main_exported_1_#t~ret406#1 <= 2147483647;havoc ldv_main_exported_1_#t~ret406#1;~ldv_state_variable_1~0 := 1; [2025-02-08 10:07:40,292 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L7132-2: assume 0 == ~ldv_retval_1~0;~ldv_state_variable_0~0 := 3; [2025-02-08 10:07:40,292 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L7132-2: assume !(0 == ~ldv_retval_1~0); [2025-02-08 10:07:40,292 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L7132-1: assume 0 != ~ldv_retval_1~0;~ldv_state_variable_0~0 := 2; [2025-02-08 10:07:40,292 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L7132-1: assume !(0 != ~ldv_retval_1~0); [2025-02-08 10:07:40,292 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L8189: assume 1 == ~ldv_mutex_mutex_of_device~0; [2025-02-08 10:07:40,292 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L8189: assume !(1 == ~ldv_mutex_mutex_of_device~0); [2025-02-08 10:07:40,292 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L7669-1: SUMMARY for call tgt_ring_exit(~#tx_ring~0.base, ~#tx_ring~0.offset); srcloc: null [2025-02-08 10:07:40,292 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L8181: assume 1 == ~ldv_mutex_cred_guard_mutex_of_signal_struct~0; [2025-02-08 10:07:40,292 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L8181: assume !(1 == ~ldv_mutex_cred_guard_mutex_of_signal_struct~0); [2025-02-08 10:07:40,292 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L7669: scsi_tgt_if_init_#res#1 := scsi_tgt_if_init_~err~20#1; [2025-02-08 10:07:40,292 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L8305: havoc misc_register_#t~nondet441#1;ldv_misc_register_23_#t~ret410#1 := misc_register_#res#1;havoc misc_register_#t~nondet441#1, misc_register_~arg0#1.base, misc_register_~arg0#1.offset;havoc misc_register_#in~arg0#1.base, misc_register_#in~arg0#1.offset;assume { :end_inline_misc_register } true;assume -2147483648 <= ldv_misc_register_23_#t~ret410#1 && ldv_misc_register_23_#t~ret410#1 <= 2147483647;ldv_misc_register_23_~tmp~24#1 := ldv_misc_register_23_#t~ret410#1;havoc ldv_misc_register_23_#t~ret410#1;ldv_misc_register_23_~ldv_func_res~3#1 := ldv_misc_register_23_~tmp~24#1;~ldv_state_variable_1~0 := 1;ldv_misc_register_23_#res#1 := ldv_misc_register_23_~ldv_func_res~3#1; [2025-02-08 10:07:40,292 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L7661: assume 0 != scsi_tgt_if_init_~err~20#1; [2025-02-08 10:07:40,292 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L7661: assume !(0 != scsi_tgt_if_init_~err~20#1);scsi_tgt_if_init_#res#1 := 0; [2025-02-08 10:07:40,292 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L7084: assume 0 == (~scsi_tgtd~0.base + ~scsi_tgtd~0.offset) % 18446744073709551616;scsi_tgt_init_~err~11#1 := -12; [2025-02-08 10:07:40,292 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L7084: assume !(0 == (~scsi_tgtd~0.base + ~scsi_tgtd~0.offset) % 18446744073709551616);assume { :begin_inline_scsi_tgt_if_init } true;havoc scsi_tgt_if_init_#res#1;havoc scsi_tgt_if_init_#t~ret393#1, scsi_tgt_if_init_#t~ret394#1, scsi_tgt_if_init_#t~ret395#1, scsi_tgt_if_init_~err~20#1;havoc scsi_tgt_if_init_~err~20#1; [2025-02-08 10:07:40,292 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L8191: SUMMARY for call ldv_error(); srcloc: null [2025-02-08 10:07:40,292 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L8183: SUMMARY for call ldv_error(); srcloc: null [2025-02-08 10:07:40,292 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L7655-1: SUMMARY for call scsi_tgt_if_init_#t~ret394#1 := tgt_ring_init(~#rx_ring~0.base, ~#rx_ring~0.offset); srcloc: null [2025-02-08 10:07:40,292 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L7655: assume -2147483648 <= scsi_tgt_if_init_#t~ret394#1 && scsi_tgt_if_init_#t~ret394#1 <= 2147483647;scsi_tgt_if_init_~err~20#1 := scsi_tgt_if_init_#t~ret394#1;havoc scsi_tgt_if_init_#t~ret394#1; [2025-02-08 10:07:40,292 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L7077: assume 0 == (~scsi_tgt_cmd_cache~0.base + ~scsi_tgt_cmd_cache~0.offset) % 18446744073709551616;scsi_tgt_init_#res#1 := -12;call ULTIMATE.dealloc(scsi_tgt_init_~#__key~2#1.base, scsi_tgt_init_~#__key~2#1.offset);havoc scsi_tgt_init_~#__key~2#1.base, scsi_tgt_init_~#__key~2#1.offset; [2025-02-08 10:07:40,292 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L7077: assume !(0 == (~scsi_tgt_cmd_cache~0.base + ~scsi_tgt_cmd_cache~0.offset) % 18446744073709551616);scsi_tgt_init_~__lock_name~0#1.base, scsi_tgt_init_~__lock_name~0#1.offset := 28, 0;assume { :begin_inline___alloc_workqueue_key } true;__alloc_workqueue_key_#in~arg0#1.base, __alloc_workqueue_key_#in~arg0#1.offset, __alloc_workqueue_key_#in~arg1#1, __alloc_workqueue_key_#in~arg2#1, __alloc_workqueue_key_#in~arg3#1.base, __alloc_workqueue_key_#in~arg3#1.offset, __alloc_workqueue_key_#in~arg4#1.base, __alloc_workqueue_key_#in~arg4#1.offset := 29, 0, 0, 1, scsi_tgt_init_~#__key~2#1.base, scsi_tgt_init_~#__key~2#1.offset, scsi_tgt_init_~__lock_name~0#1.base, scsi_tgt_init_~__lock_name~0#1.offset;havoc __alloc_workqueue_key_#res#1.base, __alloc_workqueue_key_#res#1.offset;havoc __alloc_workqueue_key_#t~ret426#1.base, __alloc_workqueue_key_#t~ret426#1.offset, __alloc_workqueue_key_~arg0#1.base, __alloc_workqueue_key_~arg0#1.offset, __alloc_workqueue_key_~arg1#1, __alloc_workqueue_key_~arg2#1, __alloc_workqueue_key_~arg3#1.base, __alloc_workqueue_key_~arg3#1.offset, __alloc_workqueue_key_~arg4#1.base, __alloc_workqueue_key_~arg4#1.offset;__alloc_workqueue_key_~arg0#1.base, __alloc_workqueue_key_~arg0#1.offset := __alloc_workqueue_key_#in~arg0#1.base, __alloc_workqueue_key_#in~arg0#1.offset;__alloc_workqueue_key_~arg1#1 := __alloc_workqueue_key_#in~arg1#1;__alloc_workqueue_key_~arg2#1 := __alloc_workqueue_key_#in~arg2#1;__alloc_workqueue_key_~arg3#1.base, __alloc_workqueue_key_~arg3#1.offset := __alloc_workqueue_key_#in~arg3#1.base, __alloc_workqueue_key_#in~arg3#1.offset;__alloc_workqueue_key_~arg4#1.base, __alloc_workqueue_key_~arg4#1.offset := __alloc_workqueue_key_#in~arg4#1.base, __alloc_workqueue_key_#in~arg4#1.offset; [2025-02-08 10:07:40,293 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L7656: assume 0 != scsi_tgt_if_init_~err~20#1; [2025-02-08 10:07:40,293 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L7656: assume !(0 != scsi_tgt_if_init_~err~20#1);assume { :begin_inline_ldv_misc_register_23 } true;ldv_misc_register_23_#in~misc#1.base, ldv_misc_register_23_#in~misc#1.offset := ~#tgt_miscdev~0.base, ~#tgt_miscdev~0.offset;havoc ldv_misc_register_23_#res#1;havoc ldv_misc_register_23_#t~ret410#1, ldv_misc_register_23_~misc#1.base, ldv_misc_register_23_~misc#1.offset, ldv_misc_register_23_~ldv_func_res~3#1, ldv_misc_register_23_~tmp~24#1;ldv_misc_register_23_~misc#1.base, ldv_misc_register_23_~misc#1.offset := ldv_misc_register_23_#in~misc#1.base, ldv_misc_register_23_#in~misc#1.offset;havoc ldv_misc_register_23_~ldv_func_res~3#1;havoc ldv_misc_register_23_~tmp~24#1;assume { :begin_inline_misc_register } true;misc_register_#in~arg0#1.base, misc_register_#in~arg0#1.offset := ldv_misc_register_23_~misc#1.base, ldv_misc_register_23_~misc#1.offset;havoc misc_register_#res#1;havoc misc_register_#t~nondet441#1, misc_register_~arg0#1.base, misc_register_~arg0#1.offset;misc_register_~arg0#1.base, misc_register_~arg0#1.offset := misc_register_#in~arg0#1.base, misc_register_#in~arg0#1.offset;havoc misc_register_#t~nondet441#1;assume -2147483648 <= misc_register_#t~nondet441#1 && misc_register_#t~nondet441#1 <= 2147483647;misc_register_#res#1 := misc_register_#t~nondet441#1;havoc misc_register_#t~nondet441#1; [2025-02-08 10:07:40,293 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L7128: havoc ldv_main_exported_1_#t~nondet396#1, ldv_main_exported_1_#t~switch397#1, ldv_main_exported_1_#t~ret398#1, ldv_main_exported_1_#t~ret399#1, ldv_main_exported_1_#t~ret400#1, ldv_main_exported_1_#t~ret401#1, ldv_main_exported_1_#t~ret402#1, ldv_main_exported_1_#t~ret403#1, ldv_main_exported_1_#t~ret404#1, ldv_main_exported_1_#t~ret405#1, ldv_main_exported_1_#t~ret406#1, ldv_main_exported_1_~tmp~21#1;assume { :end_inline_ldv_main_exported_1 } true; [2025-02-08 10:07:40,293 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L8185: assume 1 == ~ldv_mutex_lock~0; [2025-02-08 10:07:40,293 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L8185: assume !(1 == ~ldv_mutex_lock~0); [2025-02-08 10:07:40,293 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L8301: havoc misc_deregister_#t~nondet440#1;ldv_misc_deregister_22_#t~ret409#1 := misc_deregister_#res#1;havoc misc_deregister_#t~nondet440#1, misc_deregister_~arg0#1.base, misc_deregister_~arg0#1.offset;havoc misc_deregister_#in~arg0#1.base, misc_deregister_#in~arg0#1.offset;assume { :end_inline_misc_deregister } true;assume -2147483648 <= ldv_misc_deregister_22_#t~ret409#1 && ldv_misc_deregister_22_#t~ret409#1 <= 2147483647;ldv_misc_deregister_22_~tmp~23#1 := ldv_misc_deregister_22_#t~ret409#1;havoc ldv_misc_deregister_22_#t~ret409#1;ldv_misc_deregister_22_~ldv_func_res~2#1 := ldv_misc_deregister_22_~tmp~23#1;~ldv_state_variable_1~0 := 0;ldv_misc_deregister_22_#res#1 := ldv_misc_deregister_22_~ldv_func_res~2#1; [2025-02-08 10:07:40,299 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L6769: havoc #t~mem152.base, #t~mem152.offset; [2025-02-08 10:07:40,378 INFO L? ?]: Removed 323 outVars from TransFormulas that were not future-live. [2025-02-08 10:07:40,378 INFO L308 CfgBuilder]: Performing block encoding [2025-02-08 10:07:40,399 INFO L332 CfgBuilder]: Using the 1 location(s) as analysis (start of procedure ULTIMATE.start) [2025-02-08 10:07:40,400 INFO L337 CfgBuilder]: Removed 1 assume(true) statements. [2025-02-08 10:07:40,400 INFO L201 PluginConnector]: Adding new model de.uni_freiburg.informatik.ultimate.plugins.generator.icfgbuilder CFG 08.02 10:07:40 BoogieIcfgContainer [2025-02-08 10:07:40,400 INFO L131 PluginConnector]: ------------------------ END IcfgBuilder---------------------------- [2025-02-08 10:07:40,402 INFO L112 PluginConnector]: ------------------------TraceAbstraction---------------------------- [2025-02-08 10:07:40,402 INFO L270 PluginConnector]: Initializing TraceAbstraction... [2025-02-08 10:07:40,406 INFO L274 PluginConnector]: TraceAbstraction initialized [2025-02-08 10:07:40,406 INFO L184 PluginConnector]: Executing the observer TraceAbstractionObserver from plugin TraceAbstraction for "CDTParser AST 08.02 10:07:35" (1/3) ... [2025-02-08 10:07:40,406 INFO L204 PluginConnector]: Invalid model from TraceAbstraction for observer de.uni_freiburg.informatik.ultimate.plugins.generator.traceabstraction.TraceAbstractionObserver@4bf5574f and model type de.uni_freiburg.informatik.ultimate.plugins.generator.traceabstraction AST 08.02 10:07:40, skipping insertion in model container [2025-02-08 10:07:40,406 INFO L184 PluginConnector]: Executing the observer TraceAbstractionObserver from plugin TraceAbstraction for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 08.02 10:07:37" (2/3) ... [2025-02-08 10:07:40,407 INFO L204 PluginConnector]: Invalid model from TraceAbstraction for observer de.uni_freiburg.informatik.ultimate.plugins.generator.traceabstraction.TraceAbstractionObserver@4bf5574f and model type de.uni_freiburg.informatik.ultimate.plugins.generator.traceabstraction AST 08.02 10:07:40, skipping insertion in model container [2025-02-08 10:07:40,407 INFO L184 PluginConnector]: Executing the observer TraceAbstractionObserver from plugin TraceAbstraction for "de.uni_freiburg.informatik.ultimate.plugins.generator.icfgbuilder CFG 08.02 10:07:40" (3/3) ... [2025-02-08 10:07:40,407 INFO L128 eAbstractionObserver]: Analyzing ICFG 32_7a_cilled_linux-3.8-rc1-drivers--scsi--scsi_tgt.ko-main.cil.out.i [2025-02-08 10:07:40,420 INFO L216 ceAbstractionStarter]: Automizer settings: Hoare:LoopHeads NWA Interpolation:FPandBP Determinization: PREDICATE_ABSTRACTION [2025-02-08 10:07:40,422 INFO L151 ceAbstractionStarter]: Applying trace abstraction to ICFG 32_7a_cilled_linux-3.8-rc1-drivers--scsi--scsi_tgt.ko-main.cil.out.i that has 32 procedures, 269 locations, 1 initial locations, 0 loop locations, and 10 error locations. [2025-02-08 10:07:40,470 INFO L332 AbstractCegarLoop]: ======== Iteration 0 == of CEGAR loop == AllErrorsAtOnce ======== [2025-02-08 10:07:40,482 INFO L333 AbstractCegarLoop]: Settings: SEPARATE_VIOLATION_CHECK=true, mInterprocedural=true, mMaxIterations=1000000, mWatchIteration=1000000, mArtifact=RCFG, mInterpolation=FPandBP, mInterpolantAutomaton=STRAIGHT_LINE, mDumpAutomata=false, mAutomataFormat=ATS_NUMERATE, mDumpPath=., mDeterminiation=PREDICATE_ABSTRACTION, mMinimize=MINIMIZE_SEVPA, mAutomataTypeConcurrency=PETRI_NET, mHoareTripleChecks=INCREMENTAL, mHoareAnnotationPositions=LoopHeads, mDumpOnlyReuseAutomata=false, mLimitTraceHistogram=0, mErrorLocTimeLimit=0, mLimitPathProgramCount=0, mCollectInterpolantStatistics=true, mHeuristicEmptinessCheck=false, mHeuristicEmptinessCheckAStarHeuristic=ZERO, mHeuristicEmptinessCheckAStarHeuristicRandomSeed=1337, mHeuristicEmptinessCheckSmtFeatureScoringMethod=DAGSIZE, mSMTFeatureExtraction=false, mSMTFeatureExtractionDumpPath=., mOverrideInterpolantAutomaton=false, mMcrInterpolantMethod=WP, mPorIndependenceSettings=[Lde.uni_freiburg.informatik.ultimate.lib.tracecheckerutils.partialorder.independence.IndependenceSettings;@7e372b3e, mLbeIndependenceSettings=[IndependenceType=SEMANTIC, AbstractionType=NONE, UseConditional=false, UseSemiCommutativity=true, Solver=Z3, SolverTimeout=1000ms] [2025-02-08 10:07:40,483 INFO L334 AbstractCegarLoop]: Starting to check reachability of 10 error locations. [2025-02-08 10:07:40,487 INFO L276 IsEmpty]: Start isEmpty. Operand has 218 states, 138 states have (on average 1.3985507246376812) internal successors, (193), 158 states have internal predecessors, (193), 39 states have call successors, (39), 18 states have call predecessors, (39), 15 states have return successors, (33), 33 states have call predecessors, (33), 33 states have call successors, (33) [2025-02-08 10:07:40,493 INFO L282 IsEmpty]: Finished isEmpty. Found accepting run of length 18 [2025-02-08 10:07:40,493 INFO L210 NwaCegarLoop]: Found error trace [2025-02-08 10:07:40,494 INFO L218 NwaCegarLoop]: trace histogram [1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1] [2025-02-08 10:07:40,494 INFO L396 AbstractCegarLoop]: === Iteration 1 === Targeting ULTIMATE.startErr3ASSERT_VIOLATIONINTEGER_OVERFLOW === [uspace_ring_mapErr0ASSERT_VIOLATIONINTEGER_OVERFLOW, uspace_ring_mapErr1ASSERT_VIOLATIONINTEGER_OVERFLOW, tgt_ring_exitErr0ASSERT_VIOLATIONINTEGER_OVERFLOW (and 7 more)] === [2025-02-08 10:07:40,499 INFO L157 PredicateUnifier]: Initialized classic predicate unifier [2025-02-08 10:07:40,500 INFO L85 PathProgramCache]: Analyzing trace with hash -1104171358, now seen corresponding path program 1 times [2025-02-08 10:07:40,507 INFO L118 FreeRefinementEngine]: Executing refinement strategy CAMEL [2025-02-08 10:07:40,507 INFO L334 FreeRefinementEngine]: Using trace check IpTcStrategyModuleSmtInterpolCraig [1510416208] [2025-02-08 10:07:40,507 INFO L97 rtionOrderModulation]: Keeping assertion order NOT_INCREMENTALLY [2025-02-08 10:07:40,508 INFO L127 SolverBuilder]: Constructing new instance of SMTInterpol with explicit timeout -1 ms and remaining time -1 ms [2025-02-08 10:07:40,716 INFO L108 AnnotateAndAsserter]: Assert order NOT_INCREMENTALLY partitioned 17 statements into 1 equivalence classes. [2025-02-08 10:07:40,782 INFO L111 AnnotateAndAsserter]: Assert order NOT_INCREMENTALLY issued 1 check-sat command(s) and asserted 17 of 17 statements. [2025-02-08 10:07:40,783 INFO L114 AnnotateAndAsserter]: Assert order NOT_INCREMENTALLY issued 1 check-sat command(s) [2025-02-08 10:07:40,783 INFO L115 AnnotateAndAsserter]: Conjunction of SSA is unsat [2025-02-08 10:07:40,988 INFO L134 CoverageAnalysis]: Checked inductivity of 0 backedges. 0 proven. 0 refuted. 0 times theorem prover too weak. 0 trivial. 0 not checked. [2025-02-08 10:07:40,989 INFO L136 FreeRefinementEngine]: Strategy CAMEL found an infeasible trace [2025-02-08 10:07:40,989 INFO L334 FreeRefinementEngine]: Using interpolant generator IpTcStrategyModuleSmtInterpolCraig [1510416208] [2025-02-08 10:07:40,989 INFO L158 FreeRefinementEngine]: IpTcStrategyModuleSmtInterpolCraig [1510416208] provided 1 perfect and 0 imperfect interpolant sequences [2025-02-08 10:07:40,990 INFO L185 FreeRefinementEngine]: Found 1 perfect and 0 imperfect interpolant sequences. [2025-02-08 10:07:40,990 INFO L198 FreeRefinementEngine]: Number of different interpolants: perfect sequences [3] imperfect sequences [] total 3 [2025-02-08 10:07:40,991 INFO L121 tionRefinementEngine]: Using interpolant automaton builder IpAbStrategyModuleStraightlineAll [111244839] [2025-02-08 10:07:40,991 INFO L85 oduleStraightlineAll]: Using 1 perfect interpolants to construct interpolant automaton [2025-02-08 10:07:40,993 INFO L548 AbstractCegarLoop]: INTERPOLANT automaton has 3 states [2025-02-08 10:07:40,994 INFO L100 FreeRefinementEngine]: Using predicate unifier PredicateUnifier provided by strategy CAMEL [2025-02-08 10:07:41,005 INFO L144 InterpolantAutomaton]: Constructing interpolant automaton starting with 3 interpolants. [2025-02-08 10:07:41,006 INFO L146 InterpolantAutomaton]: CoverageRelationStatistics Valid=3, Invalid=3, Unknown=0, NotChecked=0, Total=6 [2025-02-08 10:07:41,008 INFO L87 Difference]: Start difference. First operand has 218 states, 138 states have (on average 1.3985507246376812) internal successors, (193), 158 states have internal predecessors, (193), 39 states have call successors, (39), 18 states have call predecessors, (39), 15 states have return successors, (33), 33 states have call predecessors, (33), 33 states have call successors, (33) Second operand has 3 states, 3 states have (on average 5.0) internal successors, (15), 3 states have internal predecessors, (15), 1 states have call successors, (1), 1 states have call predecessors, (1), 1 states have return successors, (1), 1 states have call predecessors, (1), 1 states have call successors, (1) [2025-02-08 10:07:41,026 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2025-02-08 10:07:41,027 INFO L93 Difference]: Finished difference Result 198 states and 244 transitions. [2025-02-08 10:07:41,028 INFO L141 InterpolantAutomaton]: Switched to read-only mode: deterministic interpolant automaton has 3 states. [2025-02-08 10:07:41,033 INFO L78 Accepts]: Start accepts. Automaton has has 3 states, 3 states have (on average 5.0) internal successors, (15), 3 states have internal predecessors, (15), 1 states have call successors, (1), 1 states have call predecessors, (1), 1 states have return successors, (1), 1 states have call predecessors, (1), 1 states have call successors, (1) Word has length 17 [2025-02-08 10:07:41,033 INFO L84 Accepts]: Finished accepts. some prefix is accepted. [2025-02-08 10:07:41,036 INFO L225 Difference]: With dead ends: 198 [2025-02-08 10:07:41,036 INFO L226 Difference]: Without dead ends: 0 [2025-02-08 10:07:41,039 INFO L434 NwaCegarLoop]: 0 DeclaredPredicates, 3 GetRequests, 2 SyntacticMatches, 0 SemanticMatches, 1 ConstructedPredicates, 0 IntricatePredicates, 0 DeprecatedPredicates, 0 ImplicationChecksByTransitivity, 0.0s TimeCoverageRelationStatistics Valid=3, Invalid=3, Unknown=0, NotChecked=0, Total=6 [2025-02-08 10:07:41,041 INFO L435 NwaCegarLoop]: 36 mSDtfsCounter, 34 mSDsluCounter, 0 mSDsCounter, 0 mSdLazyCounter, 1 mSolverCounterSat, 0 mSolverCounterUnsat, 0 mSolverCounterUnknown, 0 mSolverCounterNotChecked, 0.0s Time, 0 mProtectedPredicate, 0 mProtectedAction, 34 SdHoareTripleChecker+Valid, 36 SdHoareTripleChecker+Invalid, 1 SdHoareTripleChecker+Unknown, 0 SdHoareTripleChecker+Unchecked, 0.0s SdHoareTripleChecker+Time, 0 IncrementalHoareTripleChecker+Valid, 1 IncrementalHoareTripleChecker+Invalid, 0 IncrementalHoareTripleChecker+Unknown, 0 IncrementalHoareTripleChecker+Unchecked, 0.0s IncrementalHoareTripleChecker+Time [2025-02-08 10:07:41,042 INFO L436 NwaCegarLoop]: SdHoareTripleChecker [34 Valid, 36 Invalid, 1 Unknown, 0 Unchecked, 0.0s Time], IncrementalHoareTripleChecker [0 Valid, 1 Invalid, 0 Unknown, 0 Unchecked, 0.0s Time] [2025-02-08 10:07:41,050 INFO L82 GeneralOperation]: Start minimizeSevpa. Operand 0 states. [2025-02-08 10:07:41,056 INFO L88 GeneralOperation]: Finished minimizeSevpa. Reduced states from 0 to 0. [2025-02-08 10:07:41,057 INFO L82 GeneralOperation]: Start removeUnreachable. Operand has 0 states, 0 states have (on average 0.0) internal successors, (0), 0 states have internal predecessors, (0), 0 states have call successors, (0), 0 states have call predecessors, (0), 0 states have return successors, (0), 0 states have call predecessors, (0), 0 states have call successors, (0) [2025-02-08 10:07:41,059 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 0 states to 0 states and 0 transitions. [2025-02-08 10:07:41,061 INFO L78 Accepts]: Start accepts. Automaton has 0 states and 0 transitions. Word has length 17 [2025-02-08 10:07:41,061 INFO L84 Accepts]: Finished accepts. word is rejected. [2025-02-08 10:07:41,061 INFO L471 AbstractCegarLoop]: Abstraction has 0 states and 0 transitions. [2025-02-08 10:07:41,061 INFO L472 AbstractCegarLoop]: INTERPOLANT automaton has has 3 states, 3 states have (on average 5.0) internal successors, (15), 3 states have internal predecessors, (15), 1 states have call successors, (1), 1 states have call predecessors, (1), 1 states have return successors, (1), 1 states have call predecessors, (1), 1 states have call successors, (1) [2025-02-08 10:07:41,064 INFO L276 IsEmpty]: Start isEmpty. Operand 0 states and 0 transitions. [2025-02-08 10:07:41,064 INFO L282 IsEmpty]: Finished isEmpty. No accepting run. [2025-02-08 10:07:41,067 INFO L782 garLoopResultBuilder]: Registering result SAFE for location uspace_ring_mapErr0ASSERT_VIOLATIONINTEGER_OVERFLOW (9 of 10 remaining) [2025-02-08 10:07:41,067 INFO L782 garLoopResultBuilder]: Registering result SAFE for location uspace_ring_mapErr1ASSERT_VIOLATIONINTEGER_OVERFLOW (8 of 10 remaining) [2025-02-08 10:07:41,067 INFO L782 garLoopResultBuilder]: Registering result SAFE for location tgt_ring_exitErr0ASSERT_VIOLATIONINTEGER_OVERFLOW (7 of 10 remaining) [2025-02-08 10:07:41,067 INFO L782 garLoopResultBuilder]: Registering result SAFE for location tgt_ring_exitErr1ASSERT_VIOLATIONINTEGER_OVERFLOW (6 of 10 remaining) [2025-02-08 10:07:41,067 INFO L782 garLoopResultBuilder]: Registering result SAFE for location tgt_ring_initErr0ASSERT_VIOLATIONINTEGER_OVERFLOW (5 of 10 remaining) [2025-02-08 10:07:41,067 INFO L782 garLoopResultBuilder]: Registering result SAFE for location tgt_ring_initErr1ASSERT_VIOLATIONINTEGER_OVERFLOW (4 of 10 remaining) [2025-02-08 10:07:41,067 INFO L782 garLoopResultBuilder]: Registering result SAFE for location ULTIMATE.startErr0ASSERT_VIOLATIONINTEGER_OVERFLOW (3 of 10 remaining) [2025-02-08 10:07:41,067 INFO L782 garLoopResultBuilder]: Registering result SAFE for location ULTIMATE.startErr1ASSERT_VIOLATIONINTEGER_OVERFLOW (2 of 10 remaining) [2025-02-08 10:07:41,067 INFO L782 garLoopResultBuilder]: Registering result SAFE for location ULTIMATE.startErr2ASSERT_VIOLATIONINTEGER_OVERFLOW (1 of 10 remaining) [2025-02-08 10:07:41,067 INFO L782 garLoopResultBuilder]: Registering result SAFE for location ULTIMATE.startErr3ASSERT_VIOLATIONINTEGER_OVERFLOW (0 of 10 remaining) [2025-02-08 10:07:41,071 WARN L453 AbstractCegarLoop]: Destroyed unattended storables created during the last iteration: SelfDestructingSolverStorable0 [2025-02-08 10:07:41,073 INFO L422 BasicCegarLoop]: Path program histogram: [1] [2025-02-08 10:07:41,074 INFO L343 DoubleDeckerVisitor]: Before removal of dead ends 0 states and 0 transitions. [2025-02-08 10:07:41,162 INFO L170 ceAbstractionStarter]: Computing trace abstraction results [2025-02-08 10:07:41,167 INFO L201 PluginConnector]: Adding new model de.uni_freiburg.informatik.ultimate.plugins.generator.traceabstraction CFG 08.02 10:07:41 BoogieIcfgContainer [2025-02-08 10:07:41,168 INFO L131 PluginConnector]: ------------------------ END TraceAbstraction---------------------------- [2025-02-08 10:07:41,168 INFO L112 PluginConnector]: ------------------------Witness Printer---------------------------- [2025-02-08 10:07:41,168 INFO L270 PluginConnector]: Initializing Witness Printer... [2025-02-08 10:07:41,168 INFO L274 PluginConnector]: Witness Printer initialized [2025-02-08 10:07:41,169 INFO L184 PluginConnector]: Executing the observer RCFGCatcher from plugin Witness Printer for "de.uni_freiburg.informatik.ultimate.plugins.generator.icfgbuilder CFG 08.02 10:07:40" (3/4) ... [2025-02-08 10:07:41,170 INFO L146 WitnessPrinter]: Generating witness for correct program [2025-02-08 10:07:41,173 INFO L385 IcfgBacktranslator]: Ignoring RootEdge to procedure tgt_ring_idx_inc [2025-02-08 10:07:41,173 INFO L385 IcfgBacktranslator]: Ignoring RootEdge to procedure __raw_spin_lock_init [2025-02-08 10:07:41,173 INFO L385 IcfgBacktranslator]: Ignoring RootEdge to procedure tgt_ring_exit [2025-02-08 10:07:41,173 INFO L385 IcfgBacktranslator]: Ignoring RootEdge to procedure uspace_ring_map [2025-02-08 10:07:41,173 INFO L385 IcfgBacktranslator]: Ignoring RootEdge to procedure printk [2025-02-08 10:07:41,173 INFO L385 IcfgBacktranslator]: Ignoring RootEdge to procedure scsi_tgt_cmd_destroy [2025-02-08 10:07:41,173 INFO L385 IcfgBacktranslator]: Ignoring RootEdge to procedure tgt_write [2025-02-08 10:07:41,173 INFO L385 IcfgBacktranslator]: Ignoring RootEdge to procedure tgt_ring_init [2025-02-08 10:07:41,173 INFO L385 IcfgBacktranslator]: Ignoring RootEdge to procedure ldv_error [2025-02-08 10:07:41,173 INFO L385 IcfgBacktranslator]: Ignoring RootEdge to procedure list_del [2025-02-08 10:07:41,173 INFO L385 IcfgBacktranslator]: Ignoring RootEdge to procedure kmem_cache_free [2025-02-08 10:07:41,173 INFO L385 IcfgBacktranslator]: Ignoring RootEdge to procedure tgt_head_event [2025-02-08 10:07:41,173 INFO L385 IcfgBacktranslator]: Ignoring RootEdge to procedure tgt_poll [2025-02-08 10:07:41,173 INFO L385 IcfgBacktranslator]: Ignoring RootEdge to procedure scsi_unmap_user_pages [2025-02-08 10:07:41,173 INFO L385 IcfgBacktranslator]: Ignoring RootEdge to procedure _raw_spin_lock_irqsave [2025-02-08 10:07:41,173 INFO L385 IcfgBacktranslator]: Ignoring RootEdge to procedure scsi_host_put [2025-02-08 10:07:41,174 INFO L385 IcfgBacktranslator]: Ignoring RootEdge to procedure hash_64 [2025-02-08 10:07:41,174 INFO L385 IcfgBacktranslator]: Ignoring RootEdge to procedure ##fun~$Pointer$~TO~int [2025-02-08 10:07:41,174 INFO L385 IcfgBacktranslator]: Ignoring RootEdge to procedure ldv__builtin_expect [2025-02-08 10:07:41,174 INFO L385 IcfgBacktranslator]: Ignoring RootEdge to procedure tgt_open [2025-02-08 10:07:41,174 INFO L385 IcfgBacktranslator]: Ignoring RootEdge to procedure scsi_host_lookup [2025-02-08 10:07:41,174 INFO L385 IcfgBacktranslator]: Ignoring RootEdge to procedure tgt_mmap [2025-02-08 10:07:41,174 INFO L385 IcfgBacktranslator]: Ignoring RootEdge to procedure scsi_release_buffers [2025-02-08 10:07:41,174 INFO L385 IcfgBacktranslator]: Ignoring RootEdge to procedure kmem_cache_destroy [2025-02-08 10:07:41,174 INFO L385 IcfgBacktranslator]: Ignoring RootEdge to procedure spin_unlock_irqrestore [2025-02-08 10:07:41,174 INFO L385 IcfgBacktranslator]: Ignoring RootEdge to procedure ldv_malloc [2025-02-08 10:07:41,174 INFO L385 IcfgBacktranslator]: Ignoring RootEdge to procedure destroy_workqueue [2025-02-08 10:07:41,174 INFO L385 IcfgBacktranslator]: Ignoring RootEdge to procedure _copy_from_user [2025-02-08 10:07:41,174 INFO L385 IcfgBacktranslator]: Ignoring RootEdge to procedure list_add [2025-02-08 10:07:41,174 INFO L385 IcfgBacktranslator]: Ignoring RootEdge to procedure scsi_tgt_cmd_to_host [2025-02-08 10:07:41,175 INFO L385 IcfgBacktranslator]: Ignoring RootEdge to procedure spinlock_check [2025-02-08 10:07:41,189 INFO L919 BoogieBacktranslator]: Reduced CFG by removing 93 nodes and edges [2025-02-08 10:07:41,190 INFO L919 BoogieBacktranslator]: Reduced CFG by removing 39 nodes and edges [2025-02-08 10:07:41,190 INFO L919 BoogieBacktranslator]: Reduced CFG by removing 17 nodes and edges [2025-02-08 10:07:41,191 INFO L919 BoogieBacktranslator]: Reduced CFG by removing 5 nodes and edges [2025-02-08 10:07:41,192 INFO L919 BoogieBacktranslator]: Reduced CFG by removing 2 nodes and edges [2025-02-08 10:07:41,193 INFO L919 BoogieBacktranslator]: Reduced CFG by removing 1 nodes and edges [2025-02-08 10:07:41,292 INFO L149 WitnessManager]: Wrote witness to /storage/repos/ultimate-jdk21/releaseScripts/default/UAutomizer-linux/witness.graphml [2025-02-08 10:07:41,292 INFO L149 WitnessManager]: Wrote witness to /storage/repos/ultimate-jdk21/releaseScripts/default/UAutomizer-linux/witness.yml [2025-02-08 10:07:41,292 INFO L131 PluginConnector]: ------------------------ END Witness Printer---------------------------- [2025-02-08 10:07:41,293 INFO L158 Benchmark]: Toolchain (without parser) took 5893.55ms. Allocated memory was 142.6MB in the beginning and 226.5MB in the end (delta: 83.9MB). Free memory was 103.6MB in the beginning and 82.6MB in the end (delta: 20.9MB). Peak memory consumption was 104.8MB. Max. memory is 16.1GB. [2025-02-08 10:07:41,293 INFO L158 Benchmark]: CDTParser took 0.41ms. Allocated memory is still 201.3MB. Free memory is still 124.7MB. There was no memory consumed. Max. memory is 16.1GB. [2025-02-08 10:07:41,293 INFO L158 Benchmark]: CACSL2BoogieTranslator took 1660.76ms. Allocated memory is still 142.6MB. Free memory was 103.1MB in the beginning and 66.5MB in the end (delta: 36.6MB). Peak memory consumption was 102.8MB. Max. memory is 16.1GB. [2025-02-08 10:07:41,293 INFO L158 Benchmark]: Boogie Procedure Inliner took 77.73ms. Allocated memory is still 142.6MB. Free memory was 66.5MB in the beginning and 57.4MB in the end (delta: 9.1MB). Peak memory consumption was 8.4MB. Max. memory is 16.1GB. [2025-02-08 10:07:41,293 INFO L158 Benchmark]: Boogie Preprocessor took 238.55ms. Allocated memory is still 142.6MB. Free memory was 57.4MB in the beginning and 74.4MB in the end (delta: -17.0MB). Peak memory consumption was 34.4MB. Max. memory is 16.1GB. [2025-02-08 10:07:41,294 INFO L158 Benchmark]: IcfgBuilder took 3021.32ms. Allocated memory was 142.6MB in the beginning and 226.5MB in the end (delta: 83.9MB). Free memory was 74.4MB in the beginning and 125.2MB in the end (delta: -50.8MB). Peak memory consumption was 48.5MB. Max. memory is 16.1GB. [2025-02-08 10:07:41,294 INFO L158 Benchmark]: TraceAbstraction took 765.62ms. Allocated memory is still 226.5MB. Free memory was 125.2MB in the beginning and 96.1MB in the end (delta: 29.0MB). Peak memory consumption was 27.4MB. Max. memory is 16.1GB. [2025-02-08 10:07:41,294 INFO L158 Benchmark]: Witness Printer took 124.01ms. Allocated memory is still 226.5MB. Free memory was 96.1MB in the beginning and 82.6MB in the end (delta: 13.5MB). Peak memory consumption was 16.8MB. Max. memory is 16.1GB. [2025-02-08 10:07:41,295 INFO L338 ainManager$Toolchain]: ####################### End [Toolchain 1] ####################### --- Results --- * Results from de.uni_freiburg.informatik.ultimate.core: - StatisticsResult: Toolchain Benchmarks Benchmark results are: * CDTParser took 0.41ms. Allocated memory is still 201.3MB. Free memory is still 124.7MB. There was no memory consumed. Max. memory is 16.1GB. * CACSL2BoogieTranslator took 1660.76ms. Allocated memory is still 142.6MB. Free memory was 103.1MB in the beginning and 66.5MB in the end (delta: 36.6MB). Peak memory consumption was 102.8MB. Max. memory is 16.1GB. * Boogie Procedure Inliner took 77.73ms. Allocated memory is still 142.6MB. Free memory was 66.5MB in the beginning and 57.4MB in the end (delta: 9.1MB). Peak memory consumption was 8.4MB. Max. memory is 16.1GB. * Boogie Preprocessor took 238.55ms. Allocated memory is still 142.6MB. Free memory was 57.4MB in the beginning and 74.4MB in the end (delta: -17.0MB). Peak memory consumption was 34.4MB. Max. memory is 16.1GB. * IcfgBuilder took 3021.32ms. Allocated memory was 142.6MB in the beginning and 226.5MB in the end (delta: 83.9MB). Free memory was 74.4MB in the beginning and 125.2MB in the end (delta: -50.8MB). Peak memory consumption was 48.5MB. Max. memory is 16.1GB. * TraceAbstraction took 765.62ms. Allocated memory is still 226.5MB. Free memory was 125.2MB in the beginning and 96.1MB in the end (delta: 29.0MB). Peak memory consumption was 27.4MB. Max. memory is 16.1GB. * Witness Printer took 124.01ms. Allocated memory is still 226.5MB. Free memory was 96.1MB in the beginning and 82.6MB in the end (delta: 13.5MB). Peak memory consumption was 16.8MB. Max. memory is 16.1GB. * Results from de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator: - GenericResultAtLocation [Line: 7332]: Unsoundness Warning Ignoring inline assembler instruction C: __asm__ volatile ("mfence": : : "memory"); [7332] * Results from de.uni_freiburg.informatik.ultimate.plugins.generator.traceabstraction: - StatisticsResult: ErrorAutomatonStatistics NumberErrorTraces: 0, NumberStatementsAllTraces: 0, NumberRelevantStatements: 0, 0.0s ErrorAutomatonConstructionTimeTotal, 0.0s FaulLocalizationTime, NumberStatementsFirstTrace: -1, TraceLengthAvg: 0, 0.0s ErrorAutomatonConstructionTimeAvg, 0.0s ErrorAutomatonDifferenceTimeAvg, 0.0s ErrorAutomatonDifferenceTimeTotal, NumberOfNoEnhancement: 0, NumberOfFiniteEnhancement: 0, NumberOfInfiniteEnhancement: 0 - PositiveResult [Line: 7545]: integer overflow can never occur For all program executions holds that integer overflow can never occur at this location - PositiveResult [Line: 7545]: integer overflow can never occur For all program executions holds that integer overflow can never occur at this location - PositiveResult [Line: 7600]: integer overflow can never occur For all program executions holds that integer overflow can never occur at this location - PositiveResult [Line: 7600]: integer overflow can never occur For all program executions holds that integer overflow can never occur at this location - PositiveResult [Line: 7627]: integer overflow can never occur For all program executions holds that integer overflow can never occur at this location - PositiveResult [Line: 7627]: integer overflow can never occur For all program executions holds that integer overflow can never occur at this location - PositiveResult [Line: 7750]: integer overflow can never occur For all program executions holds that integer overflow can never occur at this location - PositiveResult [Line: 7750]: integer overflow can never occur For all program executions holds that integer overflow can never occur at this location - PositiveResult [Line: 7740]: integer overflow can never occur For all program executions holds that integer overflow can never occur at this location - PositiveResult [Line: 7740]: integer overflow can never occur For all program executions holds that integer overflow can never occur at this location - StatisticsResult: Ultimate Automizer benchmark data CFG has 32 procedures, 269 locations, 10 error locations. Started 1 CEGAR loops. OverallTime: 0.6s, OverallIterations: 1, TraceHistogramMax: 1, PathProgramHistogramMax: 1, EmptinessCheckTime: 0.0s, AutomataDifference: 0.0s, DeadEndRemovalTime: 0.0s, HoareAnnotationTime: 0.0s, InitialAbstractionConstructionTime: 0.0s, HoareTripleCheckerStatistics: 0 mSolverCounterUnknown, 34 SdHoareTripleChecker+Valid, 0.0s IncrementalHoareTripleChecker+Time, 0 mSdLazyCounter, 34 mSDsluCounter, 36 SdHoareTripleChecker+Invalid, 0.0s Time, 0 mProtectedAction, 0 SdHoareTripleChecker+Unchecked, 0 IncrementalHoareTripleChecker+Unchecked, 0 mSDsCounter, 0 IncrementalHoareTripleChecker+Valid, 0 mProtectedPredicate, 1 IncrementalHoareTripleChecker+Invalid, 1 SdHoareTripleChecker+Unknown, 0 mSolverCounterNotChecked, 0 mSolverCounterUnsat, 36 mSDtfsCounter, 1 mSolverCounterSat, 0.0s SdHoareTripleChecker+Time, 0 IncrementalHoareTripleChecker+Unknown, PredicateUnifierStatistics: 0 DeclaredPredicates, 3 GetRequests, 2 SyntacticMatches, 0 SemanticMatches, 1 ConstructedPredicates, 0 IntricatePredicates, 0 DeprecatedPredicates, 0 ImplicationChecksByTransitivity, 0.0s Time, 0.0s BasicInterpolantAutomatonTime, BiggestAbstraction: size=218occurred in iteration=0, InterpolantAutomatonStates: 3, traceCheckStatistics: No data available, InterpolantConsolidationStatistics: No data available, PathInvariantsStatistics: No data available, 0/0 InterpolantCoveringCapability, TotalInterpolationStatistics: No data available, 0.0s DumpTime, AutomataMinimizationStatistics: 0.0s AutomataMinimizationTime, 1 MinimizatonAttempts, 0 StatesRemovedByMinimization, 0 NontrivialMinimizations, HoareAnnotationStatistics: No data available, RefinementEngineStatistics: TRACE_CHECK: 0.0s SsaConstructionTime, 0.1s SatisfiabilityAnalysisTime, 0.2s InterpolantComputationTime, 17 NumberOfCodeBlocks, 17 NumberOfCodeBlocksAsserted, 1 NumberOfCheckSat, 16 ConstructedInterpolants, 0 QuantifiedInterpolants, 22 SizeOfPredicates, 0 NumberOfNonLiveVariables, 0 ConjunctsInSsa, 0 ConjunctsInUnsatCore, 1 InterpolantComputations, 1 PerfectInterpolantSequences, 0/0 InterpolantCoveringCapability, INVARIANT_SYNTHESIS: No data available, INTERPOLANT_CONSOLIDATION: No data available, ABSTRACT_INTERPRETATION: No data available, PDR: No data available, ACCELERATED_INTERPOLATION: No data available, SIFA: No data available, ReuseStatistics: No data available, ConComCheckerStatistics: No data available - AllSpecificationsHoldResult: All specifications hold 10 specifications checked. All of them hold RESULT: Ultimate proved your program to be correct! [2025-02-08 10:07:41,316 INFO L552 MonitoredProcess]: [MP /storage/repos/ultimate-jdk21/releaseScripts/default/UAutomizer-linux/z3 SMTLIB2_COMPLIANT=true -memory:2024 -smt2 -in -t:4000 (1)] Ended with exit code 0 Received shutdown request... --- End real Ultimate output --- Execution finished normally Writing output log to file Ultimate.log Result: TRUE