./Ultimate.py --spec ../sv-benchmarks/c/properties/unreach-call.prp --file ../sv-benchmarks/c/ldv-consumption/32_7a_cilled_linux-3.8-rc1-drivers--scsi--scsi_tgt.ko-main.cil.out.i --full-output --architecture 64bit -------------------------------------------------------------------------------- Checking for ERROR reachability Using default analysis Version 48c9605d Calling Ultimate with: /root/.sdkman/candidates/java/21.0.5-tem/bin/java -Dosgi.configuration.area=/storage/repos/ultimate-jdk21/releaseScripts/default/UAutomizer-linux/data/config -Xmx15G -Xms4m -jar /storage/repos/ultimate-jdk21/releaseScripts/default/UAutomizer-linux/plugins/org.eclipse.equinox.launcher_1.6.800.v20240513-1750.jar -data @noDefault -ultimatedata /storage/repos/ultimate-jdk21/releaseScripts/default/UAutomizer-linux/data -tc /storage/repos/ultimate-jdk21/releaseScripts/default/UAutomizer-linux/config/AutomizerReach.xml -i ../sv-benchmarks/c/ldv-consumption/32_7a_cilled_linux-3.8-rc1-drivers--scsi--scsi_tgt.ko-main.cil.out.i -s /storage/repos/ultimate-jdk21/releaseScripts/default/UAutomizer-linux/config/svcomp-Reach-64bit-Automizer_Default.epf --cacsl2boogietranslator.entry.function main --witnessprinter.witness.directory /storage/repos/ultimate-jdk21/releaseScripts/default/UAutomizer-linux --witnessprinter.witness.filename witness --witnessprinter.write.witness.besides.input.file false --witnessprinter.graph.data.specification CHECK( init(main()), LTL(G ! call(reach_error())) ) --witnessprinter.graph.data.producer Automizer --witnessprinter.graph.data.architecture 64bit --witnessprinter.graph.data.programhash e3b9005361fd0095f8dbb62f5fee3acdc88198cbc01de43b11979176397f6891 --- Real Ultimate output --- This is Ultimate 0.3.0-?-48c9605-m [2025-02-08 02:45:11,171 INFO L188 SettingsManager]: Resetting all preferences to default values... [2025-02-08 02:45:11,233 INFO L114 SettingsManager]: Loading settings from /storage/repos/ultimate-jdk21/releaseScripts/default/UAutomizer-linux/config/svcomp-Reach-64bit-Automizer_Default.epf [2025-02-08 02:45:11,238 WARN L101 SettingsManager]: Preference file contains the following unknown settings: [2025-02-08 02:45:11,238 WARN L103 SettingsManager]: * de.uni_freiburg.informatik.ultimate.core.Log level for class [2025-02-08 02:45:11,263 INFO L130 SettingsManager]: Preferences different from defaults after loading the file: [2025-02-08 02:45:11,264 INFO L151 SettingsManager]: Preferences of UltimateCore differ from their defaults: [2025-02-08 02:45:11,264 INFO L153 SettingsManager]: * Log level for class=de.uni_freiburg.informatik.ultimate.lib.smtlibutils.quantifier.QuantifierPusher=ERROR; [2025-02-08 02:45:11,264 INFO L151 SettingsManager]: Preferences of Boogie Preprocessor differ from their defaults: [2025-02-08 02:45:11,264 INFO L153 SettingsManager]: * Use memory slicer=true [2025-02-08 02:45:11,265 INFO L151 SettingsManager]: Preferences of Boogie Procedure Inliner differ from their defaults: [2025-02-08 02:45:11,265 INFO L153 SettingsManager]: * Ignore calls to procedures called more than once=ONLY_FOR_SEQUENTIAL_PROGRAMS [2025-02-08 02:45:11,265 INFO L151 SettingsManager]: Preferences of BlockEncodingV2 differ from their defaults: [2025-02-08 02:45:11,265 INFO L153 SettingsManager]: * Create parallel compositions if possible=false [2025-02-08 02:45:11,265 INFO L153 SettingsManager]: * Use SBE=true [2025-02-08 02:45:11,266 INFO L151 SettingsManager]: Preferences of CACSL2BoogieTranslator differ from their defaults: [2025-02-08 02:45:11,266 INFO L153 SettingsManager]: * Pointer base address is valid at dereference=IGNORE [2025-02-08 02:45:11,266 INFO L153 SettingsManager]: * Overapproximate operations on floating types=true [2025-02-08 02:45:11,266 INFO L153 SettingsManager]: * Check division by zero=IGNORE [2025-02-08 02:45:11,267 INFO L153 SettingsManager]: * Pointer to allocated memory at dereference=IGNORE [2025-02-08 02:45:11,267 INFO L153 SettingsManager]: * If two pointers are subtracted or compared they have the same base address=IGNORE [2025-02-08 02:45:11,267 INFO L153 SettingsManager]: * Check array bounds for arrays that are off heap=IGNORE [2025-02-08 02:45:11,267 INFO L153 SettingsManager]: * Check if freed pointer was valid=false [2025-02-08 02:45:11,267 INFO L153 SettingsManager]: * Behaviour of calls to undefined functions=OVERAPPROXIMATE_BEHAVIOUR [2025-02-08 02:45:11,267 INFO L153 SettingsManager]: * Use constant arrays=true [2025-02-08 02:45:11,267 INFO L151 SettingsManager]: Preferences of IcfgBuilder differ from their defaults: [2025-02-08 02:45:11,267 INFO L153 SettingsManager]: * Size of a code block=SequenceOfStatements [2025-02-08 02:45:11,267 INFO L153 SettingsManager]: * Only consider context switches at boundaries of atomic blocks=true [2025-02-08 02:45:11,267 INFO L153 SettingsManager]: * SMT solver=External_DefaultMode [2025-02-08 02:45:11,267 INFO L153 SettingsManager]: * Command for external solver=z3 SMTLIB2_COMPLIANT=true -memory:2024 -smt2 -in -t:4000 [2025-02-08 02:45:11,268 INFO L151 SettingsManager]: Preferences of TraceAbstraction differ from their defaults: [2025-02-08 02:45:11,268 INFO L153 SettingsManager]: * Compute Interpolants along a Counterexample=FPandBP [2025-02-08 02:45:11,268 INFO L153 SettingsManager]: * Compute procedure contracts=false [2025-02-08 02:45:11,268 INFO L153 SettingsManager]: * Positions where we compute the Hoare Annotation=LoopHeads [2025-02-08 02:45:11,268 INFO L153 SettingsManager]: * Trace refinement strategy=CAMEL [2025-02-08 02:45:11,268 INFO L153 SettingsManager]: * Command for external solver=z3 SMTLIB2_COMPLIANT=true -memory:2024 -smt2 -in [2025-02-08 02:45:11,268 INFO L153 SettingsManager]: * Apply one-shot large block encoding in concurrent analysis=false [2025-02-08 02:45:11,269 INFO L153 SettingsManager]: * Automaton type used in concurrency analysis=PETRI_NET [2025-02-08 02:45:11,269 INFO L153 SettingsManager]: * Order on configurations for Petri net unfoldings=DBO [2025-02-08 02:45:11,269 INFO L153 SettingsManager]: * SMT solver=External_ModelsAndUnsatCoreMode [2025-02-08 02:45:11,269 INFO L153 SettingsManager]: * Looper check in Petri net analysis=SEMANTIC Applying setting for plugin de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator: Entry function -> main Applying setting for plugin de.uni_freiburg.informatik.ultimate.witnessprinter: Witness directory -> /storage/repos/ultimate-jdk21/releaseScripts/default/UAutomizer-linux Applying setting for plugin de.uni_freiburg.informatik.ultimate.witnessprinter: Witness filename -> witness Applying setting for plugin de.uni_freiburg.informatik.ultimate.witnessprinter: Write witness besides input file -> false Applying setting for plugin de.uni_freiburg.informatik.ultimate.witnessprinter: Graph data specification -> CHECK( init(main()), LTL(G ! call(reach_error())) ) Applying setting for plugin de.uni_freiburg.informatik.ultimate.witnessprinter: Graph data producer -> Automizer Applying setting for plugin de.uni_freiburg.informatik.ultimate.witnessprinter: Graph data architecture -> 64bit Applying setting for plugin de.uni_freiburg.informatik.ultimate.witnessprinter: Graph data programhash -> e3b9005361fd0095f8dbb62f5fee3acdc88198cbc01de43b11979176397f6891 [2025-02-08 02:45:11,514 INFO L75 nceAwareModelManager]: Repository-Root is: /tmp [2025-02-08 02:45:11,523 INFO L261 ainManager$Toolchain]: [Toolchain 1]: Applicable parser(s) successfully (re)initialized [2025-02-08 02:45:11,525 INFO L217 ainManager$Toolchain]: [Toolchain 1]: Toolchain selected. [2025-02-08 02:45:11,526 INFO L270 PluginConnector]: Initializing CDTParser... [2025-02-08 02:45:11,527 INFO L274 PluginConnector]: CDTParser initialized [2025-02-08 02:45:11,528 INFO L431 ainManager$Toolchain]: [Toolchain 1]: Parsing single file: /storage/repos/ultimate-jdk21/releaseScripts/default/UAutomizer-linux/../sv-benchmarks/c/ldv-consumption/32_7a_cilled_linux-3.8-rc1-drivers--scsi--scsi_tgt.ko-main.cil.out.i [2025-02-08 02:45:12,692 INFO L533 CDTParser]: Created temporary CDT project at /storage/repos/ultimate-jdk21/releaseScripts/default/UAutomizer-linux/data/53696a3fc/c4b7108768a1415db82c48921368dd1e/FLAG49541be4c [2025-02-08 02:45:13,317 INFO L384 CDTParser]: Found 1 translation units. [2025-02-08 02:45:13,317 INFO L180 CDTParser]: Scanning /storage/repos/ultimate-jdk21/releaseScripts/default/sv-benchmarks/c/ldv-consumption/32_7a_cilled_linux-3.8-rc1-drivers--scsi--scsi_tgt.ko-main.cil.out.i [2025-02-08 02:45:13,364 INFO L427 CDTParser]: About to delete temporary CDT project at /storage/repos/ultimate-jdk21/releaseScripts/default/UAutomizer-linux/data/53696a3fc/c4b7108768a1415db82c48921368dd1e/FLAG49541be4c [2025-02-08 02:45:13,380 INFO L435 CDTParser]: Successfully deleted /storage/repos/ultimate-jdk21/releaseScripts/default/UAutomizer-linux/data/53696a3fc/c4b7108768a1415db82c48921368dd1e [2025-02-08 02:45:13,383 INFO L299 ainManager$Toolchain]: ####################### [Toolchain 1] ####################### [2025-02-08 02:45:13,385 INFO L133 ToolchainWalker]: Walking toolchain with 6 elements. [2025-02-08 02:45:13,387 INFO L112 PluginConnector]: ------------------------CACSL2BoogieTranslator---------------------------- [2025-02-08 02:45:13,387 INFO L270 PluginConnector]: Initializing CACSL2BoogieTranslator... [2025-02-08 02:45:13,391 INFO L274 PluginConnector]: CACSL2BoogieTranslator initialized [2025-02-08 02:45:13,392 INFO L184 PluginConnector]: Executing the observer ACSLObjectContainerObserver from plugin CACSL2BoogieTranslator for "CDTParser AST 08.02 02:45:13" (1/1) ... [2025-02-08 02:45:13,392 INFO L204 PluginConnector]: Invalid model from CACSL2BoogieTranslator for observer de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator.ACSLObjectContainerObserver@68438d98 and model type de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 08.02 02:45:13, skipping insertion in model container [2025-02-08 02:45:13,393 INFO L184 PluginConnector]: Executing the observer CACSL2BoogieTranslatorObserver from plugin CACSL2BoogieTranslator for "CDTParser AST 08.02 02:45:13" (1/1) ... [2025-02-08 02:45:13,466 INFO L175 MainTranslator]: Built tables and reachable declarations [2025-02-08 02:45:14,503 WARN L250 ndardFunctionHandler]: Function reach_error is already implemented but we override the implementation for the call at /storage/repos/ultimate-jdk21/releaseScripts/default/sv-benchmarks/c/ldv-consumption/32_7a_cilled_linux-3.8-rc1-drivers--scsi--scsi_tgt.ko-main.cil.out.i[228448,228461] [2025-02-08 02:45:14,599 INFO L210 PostProcessor]: Analyzing one entry point: main [2025-02-08 02:45:14,622 INFO L200 MainTranslator]: Completed pre-run [2025-02-08 02:45:14,856 WARN L75 lationResultReporter]: Unsoundness Warning: Ignoring inline assembler instruction C: __asm__ volatile ("mfence": : : "memory"); [7332] [2025-02-08 02:45:14,881 WARN L250 ndardFunctionHandler]: Function reach_error is already implemented but we override the implementation for the call at /storage/repos/ultimate-jdk21/releaseScripts/default/sv-benchmarks/c/ldv-consumption/32_7a_cilled_linux-3.8-rc1-drivers--scsi--scsi_tgt.ko-main.cil.out.i[228448,228461] [2025-02-08 02:45:14,893 INFO L210 PostProcessor]: Analyzing one entry point: main [2025-02-08 02:45:14,931 INFO L204 MainTranslator]: Completed translation [2025-02-08 02:45:14,932 INFO L201 PluginConnector]: Adding new model de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 08.02 02:45:14 WrapperNode [2025-02-08 02:45:14,932 INFO L131 PluginConnector]: ------------------------ END CACSL2BoogieTranslator---------------------------- [2025-02-08 02:45:14,933 INFO L112 PluginConnector]: ------------------------Boogie Procedure Inliner---------------------------- [2025-02-08 02:45:14,933 INFO L270 PluginConnector]: Initializing Boogie Procedure Inliner... [2025-02-08 02:45:14,933 INFO L274 PluginConnector]: Boogie Procedure Inliner initialized [2025-02-08 02:45:14,938 INFO L184 PluginConnector]: Executing the observer TypeChecker from plugin Boogie Procedure Inliner for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 08.02 02:45:14" (1/1) ... [2025-02-08 02:45:14,985 INFO L184 PluginConnector]: Executing the observer Inliner from plugin Boogie Procedure Inliner for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 08.02 02:45:14" (1/1) ... [2025-02-08 02:45:15,047 INFO L138 Inliner]: procedures = 188, calls = 659, calls flagged for inlining = 74, calls inlined = 49, statements flattened = 1340 [2025-02-08 02:45:15,048 INFO L131 PluginConnector]: ------------------------ END Boogie Procedure Inliner---------------------------- [2025-02-08 02:45:15,048 INFO L112 PluginConnector]: ------------------------Boogie Preprocessor---------------------------- [2025-02-08 02:45:15,048 INFO L270 PluginConnector]: Initializing Boogie Preprocessor... [2025-02-08 02:45:15,048 INFO L274 PluginConnector]: Boogie Preprocessor initialized [2025-02-08 02:45:15,055 INFO L184 PluginConnector]: Executing the observer EnsureBoogieModelObserver from plugin Boogie Preprocessor for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 08.02 02:45:14" (1/1) ... [2025-02-08 02:45:15,055 INFO L184 PluginConnector]: Executing the observer TypeChecker from plugin Boogie Preprocessor for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 08.02 02:45:14" (1/1) ... [2025-02-08 02:45:15,062 INFO L184 PluginConnector]: Executing the observer MemorySlicer from plugin Boogie Preprocessor for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 08.02 02:45:14" (1/1) ... [2025-02-08 02:45:15,192 INFO L175 MemorySlicer]: Split 204 memory accesses to 8 slices as follows [2, 21, 9, 32, 115, 8, 12, 5]. 56 percent of accesses are in the largest equivalence class. The 81 initializations are split as follows [2, 0, 9, 4, 54, 0, 12, 0]. The 38 writes are split as follows [0, 1, 0, 28, 9, 0, 0, 0]. [2025-02-08 02:45:15,194 INFO L184 PluginConnector]: Executing the observer ConstExpander from plugin Boogie Preprocessor for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 08.02 02:45:14" (1/1) ... [2025-02-08 02:45:15,194 INFO L184 PluginConnector]: Executing the observer StructExpander from plugin Boogie Preprocessor for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 08.02 02:45:14" (1/1) ... [2025-02-08 02:45:15,237 INFO L184 PluginConnector]: Executing the observer ReplaceArrayAssignments from plugin Boogie Preprocessor for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 08.02 02:45:14" (1/1) ... [2025-02-08 02:45:15,243 INFO L184 PluginConnector]: Executing the observer FunctionInliner from plugin Boogie Preprocessor for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 08.02 02:45:14" (1/1) ... [2025-02-08 02:45:15,252 INFO L184 PluginConnector]: Executing the observer LTLStepAnnotator from plugin Boogie Preprocessor for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 08.02 02:45:14" (1/1) ... [2025-02-08 02:45:15,260 INFO L184 PluginConnector]: Executing the observer BoogieSymbolTableConstructor from plugin Boogie Preprocessor for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 08.02 02:45:14" (1/1) ... [2025-02-08 02:45:15,274 INFO L131 PluginConnector]: ------------------------ END Boogie Preprocessor---------------------------- [2025-02-08 02:45:15,275 INFO L112 PluginConnector]: ------------------------IcfgBuilder---------------------------- [2025-02-08 02:45:15,275 INFO L270 PluginConnector]: Initializing IcfgBuilder... [2025-02-08 02:45:15,275 INFO L274 PluginConnector]: IcfgBuilder initialized [2025-02-08 02:45:15,276 INFO L184 PluginConnector]: Executing the observer IcfgBuilderObserver from plugin IcfgBuilder for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 08.02 02:45:14" (1/1) ... [2025-02-08 02:45:15,281 INFO L173 SolverBuilder]: Constructing external solver with command: z3 SMTLIB2_COMPLIANT=true -memory:2024 -smt2 -in -t:4000 [2025-02-08 02:45:15,291 INFO L189 MonitoredProcess]: No working directory specified, using /storage/repos/ultimate-jdk21/releaseScripts/default/UAutomizer-linux/z3 [2025-02-08 02:45:15,304 INFO L229 MonitoredProcess]: Starting monitored process 1 with /storage/repos/ultimate-jdk21/releaseScripts/default/UAutomizer-linux/z3 SMTLIB2_COMPLIANT=true -memory:2024 -smt2 -in -t:4000 (exit command is (exit), workingDir is null) [2025-02-08 02:45:15,306 INFO L327 MonitoredProcess]: [MP /storage/repos/ultimate-jdk21/releaseScripts/default/UAutomizer-linux/z3 SMTLIB2_COMPLIANT=true -memory:2024 -smt2 -in -t:4000 (1)] Waiting until timeout for monitored process [2025-02-08 02:45:15,326 INFO L130 BoogieDeclarations]: Found specification of procedure __raw_spin_lock_init [2025-02-08 02:45:15,326 INFO L138 BoogieDeclarations]: Found implementation of procedure __raw_spin_lock_init [2025-02-08 02:45:15,327 INFO L130 BoogieDeclarations]: Found specification of procedure uspace_ring_map [2025-02-08 02:45:15,327 INFO L138 BoogieDeclarations]: Found implementation of procedure uspace_ring_map [2025-02-08 02:45:15,327 INFO L130 BoogieDeclarations]: Found specification of procedure scsi_unmap_user_pages [2025-02-08 02:45:15,327 INFO L138 BoogieDeclarations]: Found implementation of procedure scsi_unmap_user_pages [2025-02-08 02:45:15,327 INFO L130 BoogieDeclarations]: Found specification of procedure write~unchecked~$Pointer$#0 [2025-02-08 02:45:15,327 INFO L130 BoogieDeclarations]: Found specification of procedure write~unchecked~$Pointer$#1 [2025-02-08 02:45:15,327 INFO L130 BoogieDeclarations]: Found specification of procedure write~unchecked~$Pointer$#2 [2025-02-08 02:45:15,327 INFO L130 BoogieDeclarations]: Found specification of procedure write~unchecked~$Pointer$#3 [2025-02-08 02:45:15,327 INFO L130 BoogieDeclarations]: Found specification of procedure write~unchecked~$Pointer$#4 [2025-02-08 02:45:15,327 INFO L130 BoogieDeclarations]: Found specification of procedure write~unchecked~$Pointer$#5 [2025-02-08 02:45:15,327 INFO L130 BoogieDeclarations]: Found specification of procedure write~unchecked~$Pointer$#6 [2025-02-08 02:45:15,327 INFO L130 BoogieDeclarations]: Found specification of procedure write~unchecked~$Pointer$#7 [2025-02-08 02:45:15,327 INFO L130 BoogieDeclarations]: Found specification of procedure read~int#0 [2025-02-08 02:45:15,327 INFO L130 BoogieDeclarations]: Found specification of procedure read~int#1 [2025-02-08 02:45:15,327 INFO L130 BoogieDeclarations]: Found specification of procedure read~int#2 [2025-02-08 02:45:15,327 INFO L130 BoogieDeclarations]: Found specification of procedure read~int#3 [2025-02-08 02:45:15,327 INFO L130 BoogieDeclarations]: Found specification of procedure read~int#4 [2025-02-08 02:45:15,327 INFO L130 BoogieDeclarations]: Found specification of procedure read~int#5 [2025-02-08 02:45:15,327 INFO L130 BoogieDeclarations]: Found specification of procedure read~int#6 [2025-02-08 02:45:15,328 INFO L130 BoogieDeclarations]: Found specification of procedure read~int#7 [2025-02-08 02:45:15,328 INFO L130 BoogieDeclarations]: Found specification of procedure hash_64 [2025-02-08 02:45:15,328 INFO L138 BoogieDeclarations]: Found implementation of procedure hash_64 [2025-02-08 02:45:15,328 INFO L130 BoogieDeclarations]: Found specification of procedure scsi_release_buffers [2025-02-08 02:45:15,328 INFO L138 BoogieDeclarations]: Found implementation of procedure scsi_release_buffers [2025-02-08 02:45:15,328 INFO L130 BoogieDeclarations]: Found specification of procedure ldv_malloc [2025-02-08 02:45:15,328 INFO L138 BoogieDeclarations]: Found implementation of procedure ldv_malloc [2025-02-08 02:45:15,328 INFO L130 BoogieDeclarations]: Found specification of procedure destroy_workqueue [2025-02-08 02:45:15,328 INFO L138 BoogieDeclarations]: Found implementation of procedure destroy_workqueue [2025-02-08 02:45:15,328 INFO L130 BoogieDeclarations]: Found specification of procedure tgt_write [2025-02-08 02:45:15,328 INFO L138 BoogieDeclarations]: Found implementation of procedure tgt_write [2025-02-08 02:45:15,328 INFO L130 BoogieDeclarations]: Found specification of procedure write~int#0 [2025-02-08 02:45:15,328 INFO L130 BoogieDeclarations]: Found specification of procedure write~int#1 [2025-02-08 02:45:15,328 INFO L130 BoogieDeclarations]: Found specification of procedure write~int#2 [2025-02-08 02:45:15,328 INFO L130 BoogieDeclarations]: Found specification of procedure write~int#3 [2025-02-08 02:45:15,328 INFO L130 BoogieDeclarations]: Found specification of procedure write~int#4 [2025-02-08 02:45:15,328 INFO L130 BoogieDeclarations]: Found specification of procedure write~int#5 [2025-02-08 02:45:15,328 INFO L130 BoogieDeclarations]: Found specification of procedure write~int#6 [2025-02-08 02:45:15,328 INFO L130 BoogieDeclarations]: Found specification of procedure write~int#7 [2025-02-08 02:45:15,328 INFO L130 BoogieDeclarations]: Found specification of procedure ldv_error [2025-02-08 02:45:15,328 INFO L138 BoogieDeclarations]: Found implementation of procedure ldv_error [2025-02-08 02:45:15,328 INFO L130 BoogieDeclarations]: Found specification of procedure ldv__builtin_expect [2025-02-08 02:45:15,328 INFO L138 BoogieDeclarations]: Found implementation of procedure ldv__builtin_expect [2025-02-08 02:45:15,328 INFO L130 BoogieDeclarations]: Found specification of procedure tgt_open [2025-02-08 02:45:15,328 INFO L138 BoogieDeclarations]: Found implementation of procedure tgt_open [2025-02-08 02:45:15,328 INFO L130 BoogieDeclarations]: Found specification of procedure kmem_cache_destroy [2025-02-08 02:45:15,328 INFO L138 BoogieDeclarations]: Found implementation of procedure kmem_cache_destroy [2025-02-08 02:45:15,328 INFO L130 BoogieDeclarations]: Found specification of procedure #Ultimate.allocOnHeap [2025-02-08 02:45:15,328 INFO L130 BoogieDeclarations]: Found specification of procedure scsi_tgt_cmd_to_host [2025-02-08 02:45:15,328 INFO L138 BoogieDeclarations]: Found implementation of procedure scsi_tgt_cmd_to_host [2025-02-08 02:45:15,328 INFO L130 BoogieDeclarations]: Found specification of procedure spinlock_check [2025-02-08 02:45:15,329 INFO L138 BoogieDeclarations]: Found implementation of procedure spinlock_check [2025-02-08 02:45:15,329 INFO L130 BoogieDeclarations]: Found specification of procedure #Ultimate.allocInit [2025-02-08 02:45:15,329 INFO L130 BoogieDeclarations]: Found specification of procedure tgt_ring_idx_inc [2025-02-08 02:45:15,329 INFO L138 BoogieDeclarations]: Found implementation of procedure tgt_ring_idx_inc [2025-02-08 02:45:15,329 INFO L130 BoogieDeclarations]: Found specification of procedure #Ultimate.allocOnStack [2025-02-08 02:45:15,329 INFO L130 BoogieDeclarations]: Found specification of procedure write~$Pointer$#0 [2025-02-08 02:45:15,329 INFO L130 BoogieDeclarations]: Found specification of procedure write~$Pointer$#1 [2025-02-08 02:45:15,329 INFO L130 BoogieDeclarations]: Found specification of procedure write~$Pointer$#2 [2025-02-08 02:45:15,329 INFO L130 BoogieDeclarations]: Found specification of procedure write~$Pointer$#3 [2025-02-08 02:45:15,329 INFO L130 BoogieDeclarations]: Found specification of procedure write~$Pointer$#4 [2025-02-08 02:45:15,329 INFO L130 BoogieDeclarations]: Found specification of procedure write~$Pointer$#5 [2025-02-08 02:45:15,329 INFO L130 BoogieDeclarations]: Found specification of procedure write~$Pointer$#6 [2025-02-08 02:45:15,329 INFO L130 BoogieDeclarations]: Found specification of procedure write~$Pointer$#7 [2025-02-08 02:45:15,329 INFO L130 BoogieDeclarations]: Found specification of procedure tgt_head_event [2025-02-08 02:45:15,329 INFO L138 BoogieDeclarations]: Found implementation of procedure tgt_head_event [2025-02-08 02:45:15,329 INFO L130 BoogieDeclarations]: Found specification of procedure scsi_host_put [2025-02-08 02:45:15,329 INFO L138 BoogieDeclarations]: Found implementation of procedure scsi_host_put [2025-02-08 02:45:15,329 INFO L130 BoogieDeclarations]: Found specification of procedure ##fun~$Pointer$~TO~int [2025-02-08 02:45:15,329 INFO L138 BoogieDeclarations]: Found implementation of procedure ##fun~$Pointer$~TO~int [2025-02-08 02:45:15,329 INFO L130 BoogieDeclarations]: Found specification of procedure read~$Pointer$#0 [2025-02-08 02:45:15,329 INFO L130 BoogieDeclarations]: Found specification of procedure read~$Pointer$#1 [2025-02-08 02:45:15,329 INFO L130 BoogieDeclarations]: Found specification of procedure read~$Pointer$#2 [2025-02-08 02:45:15,329 INFO L130 BoogieDeclarations]: Found specification of procedure read~$Pointer$#3 [2025-02-08 02:45:15,329 INFO L130 BoogieDeclarations]: Found specification of procedure read~$Pointer$#4 [2025-02-08 02:45:15,329 INFO L130 BoogieDeclarations]: Found specification of procedure read~$Pointer$#5 [2025-02-08 02:45:15,329 INFO L130 BoogieDeclarations]: Found specification of procedure read~$Pointer$#6 [2025-02-08 02:45:15,329 INFO L130 BoogieDeclarations]: Found specification of procedure read~$Pointer$#7 [2025-02-08 02:45:15,329 INFO L130 BoogieDeclarations]: Found specification of procedure spin_unlock_irqrestore [2025-02-08 02:45:15,329 INFO L138 BoogieDeclarations]: Found implementation of procedure spin_unlock_irqrestore [2025-02-08 02:45:15,329 INFO L130 BoogieDeclarations]: Found specification of procedure list_add [2025-02-08 02:45:15,329 INFO L138 BoogieDeclarations]: Found implementation of procedure list_add [2025-02-08 02:45:15,329 INFO L130 BoogieDeclarations]: Found specification of procedure ULTIMATE.dealloc [2025-02-08 02:45:15,329 INFO L130 BoogieDeclarations]: Found specification of procedure write~init~$Pointer$#0 [2025-02-08 02:45:15,329 INFO L130 BoogieDeclarations]: Found specification of procedure write~init~$Pointer$#1 [2025-02-08 02:45:15,330 INFO L130 BoogieDeclarations]: Found specification of procedure write~init~$Pointer$#2 [2025-02-08 02:45:15,330 INFO L130 BoogieDeclarations]: Found specification of procedure write~init~$Pointer$#3 [2025-02-08 02:45:15,330 INFO L130 BoogieDeclarations]: Found specification of procedure write~init~$Pointer$#4 [2025-02-08 02:45:15,330 INFO L130 BoogieDeclarations]: Found specification of procedure write~init~$Pointer$#5 [2025-02-08 02:45:15,330 INFO L130 BoogieDeclarations]: Found specification of procedure write~init~$Pointer$#6 [2025-02-08 02:45:15,330 INFO L130 BoogieDeclarations]: Found specification of procedure write~init~$Pointer$#7 [2025-02-08 02:45:15,330 INFO L130 BoogieDeclarations]: Found specification of procedure tgt_ring_exit [2025-02-08 02:45:15,330 INFO L138 BoogieDeclarations]: Found implementation of procedure tgt_ring_exit [2025-02-08 02:45:15,332 INFO L130 BoogieDeclarations]: Found specification of procedure printk [2025-02-08 02:45:15,332 INFO L138 BoogieDeclarations]: Found implementation of procedure printk [2025-02-08 02:45:15,332 INFO L130 BoogieDeclarations]: Found specification of procedure scsi_tgt_cmd_destroy [2025-02-08 02:45:15,332 INFO L138 BoogieDeclarations]: Found implementation of procedure scsi_tgt_cmd_destroy [2025-02-08 02:45:15,332 INFO L130 BoogieDeclarations]: Found specification of procedure tgt_ring_init [2025-02-08 02:45:15,332 INFO L138 BoogieDeclarations]: Found implementation of procedure tgt_ring_init [2025-02-08 02:45:15,332 INFO L130 BoogieDeclarations]: Found specification of procedure list_del [2025-02-08 02:45:15,332 INFO L138 BoogieDeclarations]: Found implementation of procedure list_del [2025-02-08 02:45:15,332 INFO L130 BoogieDeclarations]: Found specification of procedure kmem_cache_free [2025-02-08 02:45:15,333 INFO L138 BoogieDeclarations]: Found implementation of procedure kmem_cache_free [2025-02-08 02:45:15,333 INFO L130 BoogieDeclarations]: Found specification of procedure tgt_poll [2025-02-08 02:45:15,333 INFO L138 BoogieDeclarations]: Found implementation of procedure tgt_poll [2025-02-08 02:45:15,333 INFO L130 BoogieDeclarations]: Found specification of procedure _raw_spin_lock_irqsave [2025-02-08 02:45:15,333 INFO L138 BoogieDeclarations]: Found implementation of procedure _raw_spin_lock_irqsave [2025-02-08 02:45:15,333 INFO L130 BoogieDeclarations]: Found specification of procedure scsi_host_lookup [2025-02-08 02:45:15,333 INFO L138 BoogieDeclarations]: Found implementation of procedure scsi_host_lookup [2025-02-08 02:45:15,333 INFO L130 BoogieDeclarations]: Found specification of procedure tgt_mmap [2025-02-08 02:45:15,333 INFO L138 BoogieDeclarations]: Found implementation of procedure tgt_mmap [2025-02-08 02:45:15,334 INFO L130 BoogieDeclarations]: Found specification of procedure write~init~int#0 [2025-02-08 02:45:15,334 INFO L130 BoogieDeclarations]: Found specification of procedure write~init~int#1 [2025-02-08 02:45:15,335 INFO L130 BoogieDeclarations]: Found specification of procedure write~init~int#2 [2025-02-08 02:45:15,335 INFO L130 BoogieDeclarations]: Found specification of procedure write~init~int#3 [2025-02-08 02:45:15,335 INFO L130 BoogieDeclarations]: Found specification of procedure write~init~int#4 [2025-02-08 02:45:15,335 INFO L130 BoogieDeclarations]: Found specification of procedure write~init~int#5 [2025-02-08 02:45:15,335 INFO L130 BoogieDeclarations]: Found specification of procedure write~init~int#6 [2025-02-08 02:45:15,335 INFO L130 BoogieDeclarations]: Found specification of procedure write~init~int#7 [2025-02-08 02:45:15,335 INFO L130 BoogieDeclarations]: Found specification of procedure _copy_from_user [2025-02-08 02:45:15,335 INFO L138 BoogieDeclarations]: Found implementation of procedure _copy_from_user [2025-02-08 02:45:15,335 INFO L130 BoogieDeclarations]: Found specification of procedure ULTIMATE.start [2025-02-08 02:45:15,335 INFO L138 BoogieDeclarations]: Found implementation of procedure ULTIMATE.start [2025-02-08 02:45:15,655 INFO L257 CfgBuilder]: Building ICFG [2025-02-08 02:45:15,658 INFO L287 CfgBuilder]: Building CFG for each procedure with an implementation [2025-02-08 02:45:15,765 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L7553: #res#1 := 0; [2025-02-08 02:45:15,765 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L8347-1: #t~ret376#1 := vm_insert_page_#res#1;havoc vm_insert_page_#t~nondet448#1, vm_insert_page_~arg0#1.base, vm_insert_page_~arg0#1.offset, vm_insert_page_~arg1#1, vm_insert_page_~arg2#1.base, vm_insert_page_~arg2#1.offset;havoc vm_insert_page_#in~arg0#1.base, vm_insert_page_#in~arg0#1.offset, vm_insert_page_#in~arg1#1, vm_insert_page_#in~arg2#1.base, vm_insert_page_#in~arg2#1.offset;assume { :end_inline_vm_insert_page } true;assume -2147483648 <= #t~ret376#1 && #t~ret376#1 <= 2147483647;~err~18#1 := #t~ret376#1;havoc #t~ret376#1; [2025-02-08 02:45:15,765 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L8347: havoc vm_insert_page_#t~nondet448#1; [2025-02-08 02:45:15,765 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L7540: assume 0 != ~err~18#1;#res#1 := ~err~18#1; [2025-02-08 02:45:15,766 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L7540: assume !(0 != ~err~18#1);~addr#1 := 4096 + ~addr#1;~i~2#1 := 1 + ~i~2#1; [2025-02-08 02:45:15,766 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L8213-1: #t~ret375#1 := __phys_addr_#res#1;havoc __phys_addr_#t~nondet427#1, __phys_addr_~arg0#1;havoc __phys_addr_#in~arg0#1;assume { :end_inline___phys_addr } true;~tmp~20#1 := #t~ret375#1;~page~0#1.base, ~page~0#1.offset := 0, (if (18446719884453740544 + ~tmp~20#1 % 18446744073709551616 / 4096) % 18446744073709551616 % 18446744073709551616 <= 9223372036854775807 then (18446719884453740544 + ~tmp~20#1 % 18446744073709551616 / 4096) % 18446744073709551616 % 18446744073709551616 else (18446719884453740544 + ~tmp~20#1 % 18446744073709551616 / 4096) % 18446744073709551616 % 18446744073709551616 - 18446744073709551616);assume { :begin_inline_vm_insert_page } true;vm_insert_page_#in~arg0#1.base, vm_insert_page_#in~arg0#1.offset, vm_insert_page_#in~arg1#1, vm_insert_page_#in~arg2#1.base, vm_insert_page_#in~arg2#1.offset := ~vma#1.base, ~vma#1.offset, ~addr#1, ~page~0#1.base, ~page~0#1.offset;havoc vm_insert_page_#res#1;havoc vm_insert_page_#t~nondet448#1, vm_insert_page_~arg0#1.base, vm_insert_page_~arg0#1.offset, vm_insert_page_~arg1#1, vm_insert_page_~arg2#1.base, vm_insert_page_~arg2#1.offset;vm_insert_page_~arg0#1.base, vm_insert_page_~arg0#1.offset := vm_insert_page_#in~arg0#1.base, vm_insert_page_#in~arg0#1.offset;vm_insert_page_~arg1#1 := vm_insert_page_#in~arg1#1;vm_insert_page_~arg2#1.base, vm_insert_page_~arg2#1.offset := vm_insert_page_#in~arg2#1.base, vm_insert_page_#in~arg2#1.offset;havoc vm_insert_page_#t~nondet448#1;assume -2147483648 <= vm_insert_page_#t~nondet448#1 && vm_insert_page_#t~nondet448#1 <= 2147483647;vm_insert_page_#res#1 := vm_insert_page_#t~nondet448#1;havoc vm_insert_page_#t~nondet448#1; [2025-02-08 02:45:15,766 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L8213: havoc __phys_addr_#t~nondet427#1; [2025-02-08 02:45:15,766 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L7537: call #t~mem374#1 := read~int#4(~ring#1.base, 4 + ~ring#1.offset + 8 * ~i~2#1, 8);assume { :begin_inline___phys_addr } true;__phys_addr_#in~arg0#1 := #t~mem374#1;havoc __phys_addr_#res#1;havoc __phys_addr_#t~nondet427#1, __phys_addr_~arg0#1;__phys_addr_~arg0#1 := __phys_addr_#in~arg0#1;havoc __phys_addr_#t~nondet427#1;__phys_addr_#res#1 := __phys_addr_#t~nondet427#1;havoc __phys_addr_#t~nondet427#1; [2025-02-08 02:45:15,766 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint uspace_ring_mapFINAL: assume true; [2025-02-08 02:45:15,782 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L7298: havoc #t~mem304; [2025-02-08 02:45:15,791 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L8259: havoc blk_rq_unmap_user_#t~nondet434#1; [2025-02-08 02:45:15,843 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L6474: havoc #t~bitwise81; [2025-02-08 02:45:15,878 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L6379: havoc ~res~0#1.base, ~res~0#1.offset; [2025-02-08 02:45:15,878 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L6381-1: #t~ret47#1 := ldv_is_err_#res#1;havoc ldv_is_err_~ptr#1.base, ldv_is_err_~ptr#1.offset;havoc ldv_is_err_#in~ptr#1.base, ldv_is_err_#in~ptr#1.offset;assume { :end_inline_ldv_is_err } true;assume -9223372036854775808 <= #t~ret47#1 && #t~ret47#1 <= 9223372036854775807;assume { :begin_inline_assume_abort_if_not } true;assume_abort_if_not_#in~cond#1 := (if 0 == #t~ret47#1 then 1 else 0);havoc assume_abort_if_not_~cond#1;assume_abort_if_not_~cond#1 := assume_abort_if_not_#in~cond#1; [2025-02-08 02:45:15,878 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L6381: havoc assume_abort_if_not_~cond#1;havoc assume_abort_if_not_#in~cond#1;assume { :end_inline_assume_abort_if_not } true;havoc #t~ret47#1;#res#1.base, #res#1.offset := ~res~0#1.base, ~res~0#1.offset; [2025-02-08 02:45:15,878 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L6370: assume 0 == assume_abort_if_not_~cond#1;assume false; [2025-02-08 02:45:15,878 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L6370: assume !(0 == assume_abort_if_not_~cond#1); [2025-02-08 02:45:15,894 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L7599: call #t~mem387#1 := read~int#4(~ring#1.base, 4 + ~ring#1.offset + 8 * ~i~3#1, 8);assume { :begin_inline_free_pages } true;free_pages_#in~arg0#1, free_pages_#in~arg1#1 := #t~mem387#1, 0;havoc free_pages_~arg0#1, free_pages_~arg1#1;free_pages_~arg0#1 := free_pages_#in~arg0#1;free_pages_~arg1#1 := free_pages_#in~arg1#1;havoc free_pages_~arg0#1, free_pages_~arg1#1;havoc free_pages_#in~arg0#1, free_pages_#in~arg1#1;assume { :end_inline_free_pages } true;~i~3#1 := 1 + ~i~3#1; [2025-02-08 02:45:15,894 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint tgt_ring_exitFINAL: assume true; [2025-02-08 02:45:15,898 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L8323: havoc #t~nondet444; [2025-02-08 02:45:16,216 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L6427-1: SUMMARY for call copy_from_user_#t~ret61#1 := _copy_from_user(copy_from_user_~to#1.base, copy_from_user_~to#1.offset, copy_from_user_~from#1.base, copy_from_user_~from#1.offset, copy_from_user_~n#1); srcloc: null [2025-02-08 02:45:16,216 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L6427: copy_from_user_~n#1 := copy_from_user_#t~ret61#1;havoc copy_from_user_#t~ret61#1; [2025-02-08 02:45:16,216 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L6807-1: scsi_tgt_transfer_response_#t~switch171#1 := scsi_tgt_transfer_response_#t~switch171#1 || 4182 == scsi_tgt_transfer_response_~err~2#1; [2025-02-08 02:45:16,216 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L6807: assume scsi_tgt_transfer_response_#t~switch171#1;scsi_tgt_transfer_response_#res#1 := -11; [2025-02-08 02:45:16,216 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L6807: assume !scsi_tgt_transfer_response_#t~switch171#1;havoc scsi_tgt_transfer_response_#t~switch171#1;havoc scsi_tgt_transfer_response_#t~switch171#1;scsi_tgt_transfer_response_#res#1 := 0; [2025-02-08 02:45:16,217 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L6857-1: call scsi_tgt_copy_sense_#t~mem180#1.base, scsi_tgt_copy_sense_#t~mem180#1.offset := read~$Pointer$#4(scsi_tgt_copy_sense_~cmd#1.base, 132 + scsi_tgt_copy_sense_~cmd#1.offset, 8);assume { :begin_inline_copy_from_user } true;copy_from_user_#in~to#1.base, copy_from_user_#in~to#1.offset, copy_from_user_#in~from#1.base, copy_from_user_#in~from#1.offset, copy_from_user_#in~n#1 := scsi_tgt_copy_sense_#t~mem180#1.base, scsi_tgt_copy_sense_#t~mem180#1.offset, scsi_tgt_copy_sense_~p~0#1.base, scsi_tgt_copy_sense_~p~0#1.offset, scsi_tgt_copy_sense_~tmp~10#1 % 4294967296;havoc copy_from_user_#res#1;havoc copy_from_user_#t~nondet57#1, copy_from_user_#t~ret58#1, copy_from_user_#t~ret59#1, copy_from_user_#t~ret60#1, copy_from_user_#t~ret61#1, copy_from_user_#t~ret62#1, copy_from_user_#t~ret63#1, copy_from_user_~to#1.base, copy_from_user_~to#1.offset, copy_from_user_~from#1.base, copy_from_user_~from#1.offset, copy_from_user_~n#1, copy_from_user_~sz~0#1, copy_from_user_~tmp~1#1, copy_from_user_~__ret_warn_on~0#1, copy_from_user_~tmp___0~0#1, copy_from_user_~tmp___1~0#1, copy_from_user_~tmp___2~1#1;copy_from_user_~to#1.base, copy_from_user_~to#1.offset := copy_from_user_#in~to#1.base, copy_from_user_#in~to#1.offset;copy_from_user_~from#1.base, copy_from_user_~from#1.offset := copy_from_user_#in~from#1.base, copy_from_user_#in~from#1.offset;copy_from_user_~n#1 := copy_from_user_#in~n#1;havoc copy_from_user_~sz~0#1;havoc copy_from_user_~tmp~1#1;havoc copy_from_user_~__ret_warn_on~0#1;havoc copy_from_user_~tmp___0~0#1;havoc copy_from_user_~tmp___1~0#1;havoc copy_from_user_~tmp___2~1#1;copy_from_user_~tmp~1#1 := copy_from_user_#t~nondet57#1;havoc copy_from_user_#t~nondet57#1;copy_from_user_~sz~0#1 := (if copy_from_user_~tmp~1#1 % 18446744073709551616 % 4294967296 <= 2147483647 then copy_from_user_~tmp~1#1 % 18446744073709551616 % 4294967296 else copy_from_user_~tmp~1#1 % 18446744073709551616 % 4294967296 - 4294967296);assume { :begin_inline_might_fault } true; [2025-02-08 02:45:16,217 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L6857: scsi_tgt_copy_sense_#t~ret181#1 := copy_from_user_#res#1;havoc copy_from_user_#t~nondet57#1, copy_from_user_#t~ret58#1, copy_from_user_#t~ret59#1, copy_from_user_#t~ret60#1, copy_from_user_#t~ret61#1, copy_from_user_#t~ret62#1, copy_from_user_#t~ret63#1, copy_from_user_~to#1.base, copy_from_user_~to#1.offset, copy_from_user_~from#1.base, copy_from_user_~from#1.offset, copy_from_user_~n#1, copy_from_user_~sz~0#1, copy_from_user_~tmp~1#1, copy_from_user_~__ret_warn_on~0#1, copy_from_user_~tmp___0~0#1, copy_from_user_~tmp___1~0#1, copy_from_user_~tmp___2~1#1;havoc copy_from_user_#in~to#1.base, copy_from_user_#in~to#1.offset, copy_from_user_#in~from#1.base, copy_from_user_#in~from#1.offset, copy_from_user_#in~n#1;assume { :end_inline_copy_from_user } true;scsi_tgt_copy_sense_~tmp___0~4#1 := scsi_tgt_copy_sense_#t~ret181#1;havoc scsi_tgt_copy_sense_#t~mem180#1.base, scsi_tgt_copy_sense_#t~mem180#1.offset;havoc scsi_tgt_copy_sense_#t~ret181#1; [2025-02-08 02:45:16,217 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L6973-1: SUMMARY for call scsi_tgt_kspace_exec_#t~ret220#1.base, scsi_tgt_kspace_exec_#t~ret220#1.offset := spinlock_check(scsi_tgt_kspace_exec_~qdata~4#1.base, 264 + scsi_tgt_kspace_exec_~qdata~4#1.offset); srcloc: null [2025-02-08 02:45:16,217 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L6973: scsi_tgt_kspace_exec_~tmp___0~6#1.base, scsi_tgt_kspace_exec_~tmp___0~6#1.offset := scsi_tgt_kspace_exec_#t~ret220#1.base, scsi_tgt_kspace_exec_#t~ret220#1.offset;havoc scsi_tgt_kspace_exec_#t~ret220#1.base, scsi_tgt_kspace_exec_#t~ret220#1.offset; [2025-02-08 02:45:16,217 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L6858: assume 0 != scsi_tgt_copy_sense_~tmp___0~4#1 % 18446744073709551616; [2025-02-08 02:45:16,217 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L6858: assume !(0 != scsi_tgt_copy_sense_~tmp___0~4#1 % 18446744073709551616);scsi_tgt_copy_sense_#res#1 := 0; [2025-02-08 02:45:16,217 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L6974: scsi_tgt_kspace_exec_~flags~5#1 := scsi_tgt_kspace_exec_#t~ret221#1;havoc scsi_tgt_kspace_exec_#t~ret221#1; [2025-02-08 02:45:16,217 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L6875: call scsi_tgt_abort_cmd_#t~mem190#1.base, scsi_tgt_abort_cmd_#t~mem190#1.offset := read~$Pointer$#4(scsi_tgt_abort_cmd_~cmd#1.base, 124 + scsi_tgt_abort_cmd_~cmd#1.offset, 8);call scsi_tgt_abort_cmd_#t~mem191#1.base, scsi_tgt_abort_cmd_#t~mem191#1.offset := read~$Pointer$#4(scsi_tgt_abort_cmd_#t~mem190#1.base, 344 + scsi_tgt_abort_cmd_#t~mem190#1.offset, 8);scsi_tgt_abort_cmd_~tcmd~7#1.base, scsi_tgt_abort_cmd_~tcmd~7#1.offset := scsi_tgt_abort_cmd_#t~mem191#1.base, scsi_tgt_abort_cmd_#t~mem191#1.offset;havoc scsi_tgt_abort_cmd_#t~mem190#1.base, scsi_tgt_abort_cmd_#t~mem190#1.offset;havoc scsi_tgt_abort_cmd_#t~mem191#1.base, scsi_tgt_abort_cmd_#t~mem191#1.offset; [2025-02-08 02:45:16,217 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L6974-1: SUMMARY for call scsi_tgt_kspace_exec_#t~ret221#1 := _raw_spin_lock_irqsave(scsi_tgt_kspace_exec_~tmp___0~6#1.base, scsi_tgt_kspace_exec_~tmp___0~6#1.offset); srcloc: null [2025-02-08 02:45:16,218 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L7470: event_recv_msg_#t~ret360#1 := scsi_tgt_kspace_it_nexus_rsp_#res#1;havoc scsi_tgt_kspace_it_nexus_rsp_#t~ret247#1.base, scsi_tgt_kspace_it_nexus_rsp_#t~ret247#1.offset, scsi_tgt_kspace_it_nexus_rsp_#t~ret248#1, scsi_tgt_kspace_it_nexus_rsp_#t~mem249#1.base, scsi_tgt_kspace_it_nexus_rsp_#t~mem249#1.offset, scsi_tgt_kspace_it_nexus_rsp_#t~ret250#1, scsi_tgt_kspace_it_nexus_rsp_#t~mem256#1.base, scsi_tgt_kspace_it_nexus_rsp_#t~mem256#1.offset, scsi_tgt_kspace_it_nexus_rsp_#t~mem257#1.base, scsi_tgt_kspace_it_nexus_rsp_#t~mem257#1.offset, scsi_tgt_kspace_it_nexus_rsp_#t~ret258#1, scsi_tgt_kspace_it_nexus_rsp_~host_no#1, scsi_tgt_kspace_it_nexus_rsp_~itn_id#1, scsi_tgt_kspace_it_nexus_rsp_~result#1, scsi_tgt_kspace_it_nexus_rsp_~shost~3#1.base, scsi_tgt_kspace_it_nexus_rsp_~shost~3#1.offset, scsi_tgt_kspace_it_nexus_rsp_~err~10#1;havoc scsi_tgt_kspace_it_nexus_rsp_#in~host_no#1, scsi_tgt_kspace_it_nexus_rsp_#in~itn_id#1, scsi_tgt_kspace_it_nexus_rsp_#in~result#1;assume { :end_inline_scsi_tgt_kspace_it_nexus_rsp } true;assume -2147483648 <= event_recv_msg_#t~ret360#1 && event_recv_msg_#t~ret360#1 <= 2147483647;event_recv_msg_~err~17#1 := event_recv_msg_#t~ret360#1; [2025-02-08 02:45:16,218 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L6859-1: SUMMARY for call scsi_tgt_copy_sense_#t~ret182#1 := printk(9, 0); srcloc: null [2025-02-08 02:45:16,218 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L6859: assume -2147483648 <= scsi_tgt_copy_sense_#t~ret182#1 && scsi_tgt_copy_sense_#t~ret182#1 <= 2147483647;havoc scsi_tgt_copy_sense_#t~ret182#1;scsi_tgt_copy_sense_#res#1 := -5; [2025-02-08 02:45:16,218 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L6430: assume -9223372036854775808 <= copy_from_user_#t~ret62#1 && copy_from_user_#t~ret62#1 <= 9223372036854775807;copy_from_user_~tmp___0~0#1 := copy_from_user_#t~ret62#1;havoc copy_from_user_#t~ret62#1; [2025-02-08 02:45:16,218 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L6975: SUMMARY for call list_add(scsi_tgt_kspace_exec_~tcmd~9#1.base, 84 + scsi_tgt_kspace_exec_~tcmd~9#1.offset, scsi_tgt_kspace_exec_~head~2#1.base, scsi_tgt_kspace_exec_~head~2#1.offset); srcloc: null [2025-02-08 02:45:16,218 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L6876-1: SUMMARY for call scsi_tgt_cmd_destroy(scsi_tgt_abort_cmd_~tcmd~7#1.base, scsi_tgt_abort_cmd_~tcmd~7#1.offset); srcloc: null [2025-02-08 02:45:16,218 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L6876: scsi_tgt_abort_cmd_#res#1 := scsi_tgt_abort_cmd_~err~4#1; [2025-02-08 02:45:16,218 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L6430-1: SUMMARY for call copy_from_user_#t~ret62#1 := ldv__builtin_expect((if 0 != copy_from_user_~__ret_warn_on~0#1 then 1 else 0), 0); srcloc: null [2025-02-08 02:45:16,218 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L6910: assume (tgt_cmd_hash_lookup_~tcmd~8#1.base + (84 + tgt_cmd_hash_lookup_~tcmd~8#1.offset)) % 18446744073709551616 != (tgt_cmd_hash_lookup_~head~1#1.base + tgt_cmd_hash_lookup_~head~1#1.offset) % 18446744073709551616; [2025-02-08 02:45:16,218 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L6910: assume !((tgt_cmd_hash_lookup_~tcmd~8#1.base + (84 + tgt_cmd_hash_lookup_~tcmd~8#1.offset)) % 18446744073709551616 != (tgt_cmd_hash_lookup_~head~1#1.base + tgt_cmd_hash_lookup_~head~1#1.offset) % 18446744073709551616); [2025-02-08 02:45:16,218 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L6431: assume 0 != copy_from_user_~tmp___0~0#1;assume { :begin_inline_warn_slowpath_fmt } true;warn_slowpath_fmt_#in~arg0#1.base, warn_slowpath_fmt_#in~arg0#1.offset, warn_slowpath_fmt_#in~arg1#1, warn_slowpath_fmt_#in~arg2#1.base, warn_slowpath_fmt_#in~arg2#1.offset := 3, 0, 66, 4, 0;havoc warn_slowpath_fmt_~arg0#1.base, warn_slowpath_fmt_~arg0#1.offset, warn_slowpath_fmt_~arg1#1, warn_slowpath_fmt_~arg2#1.base, warn_slowpath_fmt_~arg2#1.offset;warn_slowpath_fmt_~arg0#1.base, warn_slowpath_fmt_~arg0#1.offset := warn_slowpath_fmt_#in~arg0#1.base, warn_slowpath_fmt_#in~arg0#1.offset;warn_slowpath_fmt_~arg1#1 := warn_slowpath_fmt_#in~arg1#1;warn_slowpath_fmt_~arg2#1.base, warn_slowpath_fmt_~arg2#1.offset := warn_slowpath_fmt_#in~arg2#1.base, warn_slowpath_fmt_#in~arg2#1.offset; [2025-02-08 02:45:16,218 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L6431: assume !(0 != copy_from_user_~tmp___0~0#1); [2025-02-08 02:45:16,218 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L6976: SUMMARY for call spin_unlock_irqrestore(scsi_tgt_kspace_exec_~qdata~4#1.base, 264 + scsi_tgt_kspace_exec_~qdata~4#1.offset, scsi_tgt_kspace_exec_~flags~5#1); srcloc: null [2025-02-08 02:45:16,219 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L6960: assume 2 == scsi_tgt_kspace_exec_#t~mem211#1;havoc scsi_tgt_kspace_exec_#t~mem211#1;assume { :begin_inline_scsi_tgt_copy_sense } true;scsi_tgt_copy_sense_#in~cmd#1.base, scsi_tgt_copy_sense_#in~cmd#1.offset, scsi_tgt_copy_sense_#in~uaddr#1, scsi_tgt_copy_sense_#in~len#1 := scsi_tgt_kspace_exec_~cmd~3#1.base, scsi_tgt_kspace_exec_~cmd~3#1.offset, scsi_tgt_kspace_exec_~sense_uaddr#1, scsi_tgt_kspace_exec_~sense_len#1;havoc scsi_tgt_copy_sense_#res#1;havoc scsi_tgt_copy_sense_#t~mem180#1.base, scsi_tgt_copy_sense_#t~mem180#1.offset, scsi_tgt_copy_sense_#t~ret181#1, scsi_tgt_copy_sense_#t~ret182#1, scsi_tgt_copy_sense_~cmd#1.base, scsi_tgt_copy_sense_~cmd#1.offset, scsi_tgt_copy_sense_~uaddr#1, scsi_tgt_copy_sense_~len#1, scsi_tgt_copy_sense_~p~0#1.base, scsi_tgt_copy_sense_~p~0#1.offset, scsi_tgt_copy_sense_~__min1~0#1, scsi_tgt_copy_sense_~__min2~0#1, scsi_tgt_copy_sense_~tmp~10#1, scsi_tgt_copy_sense_~tmp___0~4#1;scsi_tgt_copy_sense_~cmd#1.base, scsi_tgt_copy_sense_~cmd#1.offset := scsi_tgt_copy_sense_#in~cmd#1.base, scsi_tgt_copy_sense_#in~cmd#1.offset;scsi_tgt_copy_sense_~uaddr#1 := scsi_tgt_copy_sense_#in~uaddr#1;scsi_tgt_copy_sense_~len#1 := scsi_tgt_copy_sense_#in~len#1;havoc scsi_tgt_copy_sense_~p~0#1.base, scsi_tgt_copy_sense_~p~0#1.offset;havoc scsi_tgt_copy_sense_~__min1~0#1;havoc scsi_tgt_copy_sense_~__min2~0#1;havoc scsi_tgt_copy_sense_~tmp~10#1;havoc scsi_tgt_copy_sense_~tmp___0~4#1;scsi_tgt_copy_sense_~p~0#1.base, scsi_tgt_copy_sense_~p~0#1.offset := 0, (if scsi_tgt_copy_sense_~uaddr#1 % 18446744073709551616 % 18446744073709551616 <= 9223372036854775807 then scsi_tgt_copy_sense_~uaddr#1 % 18446744073709551616 % 18446744073709551616 else scsi_tgt_copy_sense_~uaddr#1 % 18446744073709551616 % 18446744073709551616 - 18446744073709551616);scsi_tgt_copy_sense_~__min1~0#1 := 96;scsi_tgt_copy_sense_~__min2~0#1 := scsi_tgt_copy_sense_~len#1; [2025-02-08 02:45:16,219 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L6960: assume !(2 == scsi_tgt_kspace_exec_#t~mem211#1);havoc scsi_tgt_kspace_exec_#t~mem211#1; [2025-02-08 02:45:16,219 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L6432: havoc warn_slowpath_fmt_~arg0#1.base, warn_slowpath_fmt_~arg0#1.offset, warn_slowpath_fmt_~arg1#1, warn_slowpath_fmt_~arg2#1.base, warn_slowpath_fmt_~arg2#1.offset;havoc warn_slowpath_fmt_#in~arg0#1.base, warn_slowpath_fmt_#in~arg0#1.offset, warn_slowpath_fmt_#in~arg1#1, warn_slowpath_fmt_#in~arg2#1.base, warn_slowpath_fmt_#in~arg2#1.offset;assume { :end_inline_warn_slowpath_fmt } true; [2025-02-08 02:45:16,219 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L6961: scsi_tgt_kspace_exec_#t~ret212#1 := scsi_tgt_copy_sense_#res#1;havoc scsi_tgt_copy_sense_#t~mem180#1.base, scsi_tgt_copy_sense_#t~mem180#1.offset, scsi_tgt_copy_sense_#t~ret181#1, scsi_tgt_copy_sense_#t~ret182#1, scsi_tgt_copy_sense_~cmd#1.base, scsi_tgt_copy_sense_~cmd#1.offset, scsi_tgt_copy_sense_~uaddr#1, scsi_tgt_copy_sense_~len#1, scsi_tgt_copy_sense_~p~0#1.base, scsi_tgt_copy_sense_~p~0#1.offset, scsi_tgt_copy_sense_~__min1~0#1, scsi_tgt_copy_sense_~__min2~0#1, scsi_tgt_copy_sense_~tmp~10#1, scsi_tgt_copy_sense_~tmp___0~4#1;havoc scsi_tgt_copy_sense_#in~cmd#1.base, scsi_tgt_copy_sense_#in~cmd#1.offset, scsi_tgt_copy_sense_#in~uaddr#1, scsi_tgt_copy_sense_#in~len#1;assume { :end_inline_scsi_tgt_copy_sense } true;assume -2147483648 <= scsi_tgt_kspace_exec_#t~ret212#1 && scsi_tgt_kspace_exec_#t~ret212#1 <= 2147483647;havoc scsi_tgt_kspace_exec_#t~ret212#1; [2025-02-08 02:45:16,219 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L6945: scsi_tgt_kspace_exec_#t~ret205#1.base, scsi_tgt_kspace_exec_#t~ret205#1.offset := tgt_cmd_hash_lookup_#res#1.base, tgt_cmd_hash_lookup_#res#1.offset;havoc tgt_cmd_hash_lookup_#t~mem192#1.base, tgt_cmd_hash_lookup_#t~mem192#1.offset, tgt_cmd_hash_lookup_#t~ret193#1, tgt_cmd_hash_lookup_#t~ret194#1.base, tgt_cmd_hash_lookup_#t~ret194#1.offset, tgt_cmd_hash_lookup_#t~ret195#1, tgt_cmd_hash_lookup_#t~mem196#1.base, tgt_cmd_hash_lookup_#t~mem196#1.offset, tgt_cmd_hash_lookup_#t~mem197#1, tgt_cmd_hash_lookup_#t~mem198#1.base, tgt_cmd_hash_lookup_#t~mem198#1.offset, tgt_cmd_hash_lookup_#t~mem199#1.base, tgt_cmd_hash_lookup_#t~mem199#1.offset, tgt_cmd_hash_lookup_~q#1.base, tgt_cmd_hash_lookup_~q#1.offset, tgt_cmd_hash_lookup_~tag#1, tgt_cmd_hash_lookup_~qdata~3#1.base, tgt_cmd_hash_lookup_~qdata~3#1.offset, tgt_cmd_hash_lookup_~rq~3#1.base, tgt_cmd_hash_lookup_~rq~3#1.offset, tgt_cmd_hash_lookup_~head~1#1.base, tgt_cmd_hash_lookup_~head~1#1.offset, tgt_cmd_hash_lookup_~tcmd~8#1.base, tgt_cmd_hash_lookup_~tcmd~8#1.offset, tgt_cmd_hash_lookup_~flags~4#1, tgt_cmd_hash_lookup_~tmp~11#1, tgt_cmd_hash_lookup_~tmp___0~5#1.base, tgt_cmd_hash_lookup_~tmp___0~5#1.offset, tgt_cmd_hash_lookup_~__mptr~2#1.base, tgt_cmd_hash_lookup_~__mptr~2#1.offset, tgt_cmd_hash_lookup_~__mptr___0~1#1.base, tgt_cmd_hash_lookup_~__mptr___0~1#1.offset;havoc tgt_cmd_hash_lookup_#in~q#1.base, tgt_cmd_hash_lookup_#in~q#1.offset, tgt_cmd_hash_lookup_#in~tag#1;assume { :end_inline_tgt_cmd_hash_lookup } true;scsi_tgt_kspace_exec_~rq~4#1.base, scsi_tgt_kspace_exec_~rq~4#1.offset := scsi_tgt_kspace_exec_#t~ret205#1.base, scsi_tgt_kspace_exec_#t~ret205#1.offset;havoc scsi_tgt_kspace_exec_#t~mem204#1.base, scsi_tgt_kspace_exec_#t~mem204#1.offset;havoc scsi_tgt_kspace_exec_#t~ret205#1.base, scsi_tgt_kspace_exec_#t~ret205#1.offset; [2025-02-08 02:45:16,219 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L6830: assume 0 != scsi_map_user_pages_~err~3#1; [2025-02-08 02:45:16,219 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L6830: assume !(0 != scsi_map_user_pages_~err~3#1);assume { :begin_inline_blk_rq_bytes } true;blk_rq_bytes_#in~rq#1.base, blk_rq_bytes_#in~rq#1.offset := scsi_map_user_pages_~rq~2#1.base, scsi_map_user_pages_~rq~2#1.offset;havoc blk_rq_bytes_#res#1;havoc blk_rq_bytes_#t~mem77#1, blk_rq_bytes_~rq#1.base, blk_rq_bytes_~rq#1.offset;blk_rq_bytes_~rq#1.base, blk_rq_bytes_~rq#1.offset := blk_rq_bytes_#in~rq#1.base, blk_rq_bytes_#in~rq#1.offset;call blk_rq_bytes_#t~mem77#1 := read~int#4(blk_rq_bytes_~rq#1.base, 80 + blk_rq_bytes_~rq#1.offset, 4);blk_rq_bytes_#res#1 := blk_rq_bytes_#t~mem77#1;havoc blk_rq_bytes_#t~mem77#1; [2025-02-08 02:45:16,219 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L6946: assume 0 == (scsi_tgt_kspace_exec_~rq~4#1.base + scsi_tgt_kspace_exec_~rq~4#1.offset) % 18446744073709551616; [2025-02-08 02:45:16,220 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L6946: assume !(0 == (scsi_tgt_kspace_exec_~rq~4#1.base + scsi_tgt_kspace_exec_~rq~4#1.offset) % 18446744073709551616);call scsi_tgt_kspace_exec_#t~mem207#1.base, scsi_tgt_kspace_exec_#t~mem207#1.offset := read~$Pointer$#4(scsi_tgt_kspace_exec_~rq~4#1.base, 234 + scsi_tgt_kspace_exec_~rq~4#1.offset, 8);scsi_tgt_kspace_exec_~cmd~3#1.base, scsi_tgt_kspace_exec_~cmd~3#1.offset := scsi_tgt_kspace_exec_#t~mem207#1.base, scsi_tgt_kspace_exec_#t~mem207#1.offset;havoc scsi_tgt_kspace_exec_#t~mem207#1.base, scsi_tgt_kspace_exec_#t~mem207#1.offset; [2025-02-08 02:45:16,220 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L6451: havoc blk_rq_bytes_#t~mem77#1;scsi_map_user_pages_#t~ret179#1 := blk_rq_bytes_#res#1;havoc blk_rq_bytes_#t~mem77#1, blk_rq_bytes_~rq#1.base, blk_rq_bytes_~rq#1.offset;havoc blk_rq_bytes_#in~rq#1.base, blk_rq_bytes_#in~rq#1.offset;assume { :end_inline_blk_rq_bytes } true;call write~int#4(scsi_map_user_pages_#t~ret179#1, scsi_map_user_pages_~cmd#1.base, 100 + scsi_map_user_pages_~cmd#1.offset, 4);havoc scsi_map_user_pages_#t~ret179#1;scsi_map_user_pages_#res#1 := 0; [2025-02-08 02:45:16,220 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L6831: SUMMARY for call scsi_release_buffers(scsi_map_user_pages_~cmd#1.base, scsi_map_user_pages_~cmd#1.offset); srcloc: null [2025-02-08 02:45:16,220 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L6947-1: SUMMARY for call scsi_tgt_kspace_exec_#t~ret206#1 := printk(14, 0); srcloc: null [2025-02-08 02:45:16,220 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L6947: assume -2147483648 <= scsi_tgt_kspace_exec_#t~ret206#1 && scsi_tgt_kspace_exec_#t~ret206#1 <= 2147483647;havoc scsi_tgt_kspace_exec_#t~ret206#1;scsi_tgt_kspace_exec_~err~5#1 := -22; [2025-02-08 02:45:16,220 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L6964: assume 0 != scsi_tgt_kspace_exec_~len#1 % 4294967296;call scsi_tgt_kspace_exec_#t~mem213#1.base, scsi_tgt_kspace_exec_#t~mem213#1.offset := read~$Pointer$#4(scsi_tgt_kspace_exec_~rq~4#1.base, 344 + scsi_tgt_kspace_exec_~rq~4#1.offset, 8);assume { :begin_inline_scsi_map_user_pages } true;scsi_map_user_pages_#in~tcmd#1.base, scsi_map_user_pages_#in~tcmd#1.offset, scsi_map_user_pages_#in~cmd#1.base, scsi_map_user_pages_#in~cmd#1.offset, scsi_map_user_pages_#in~uaddr#1, scsi_map_user_pages_#in~len#1, scsi_map_user_pages_#in~rw#1 := scsi_tgt_kspace_exec_#t~mem213#1.base, scsi_tgt_kspace_exec_#t~mem213#1.offset, scsi_tgt_kspace_exec_~cmd~3#1.base, scsi_tgt_kspace_exec_~cmd~3#1.offset, scsi_tgt_kspace_exec_~uaddr#1, scsi_tgt_kspace_exec_~len#1, (if scsi_tgt_kspace_exec_~rw#1 % 256 % 4294967296 <= 2147483647 then scsi_tgt_kspace_exec_~rw#1 % 256 % 4294967296 else scsi_tgt_kspace_exec_~rw#1 % 256 % 4294967296 - 4294967296);havoc scsi_map_user_pages_#res#1;havoc scsi_map_user_pages_#t~mem172#1.base, scsi_map_user_pages_#t~mem172#1.offset, scsi_map_user_pages_#t~mem173#1.base, scsi_map_user_pages_#t~mem173#1.offset, scsi_map_user_pages_#t~mem174#1.base, scsi_map_user_pages_#t~mem174#1.offset, scsi_map_user_pages_#t~ret175#1, scsi_map_user_pages_#t~ret176#1, scsi_map_user_pages_#t~mem177#1.base, scsi_map_user_pages_#t~mem177#1.offset, scsi_map_user_pages_#t~ret178#1, scsi_map_user_pages_#t~ret179#1, scsi_map_user_pages_~tcmd#1.base, scsi_map_user_pages_~tcmd#1.offset, scsi_map_user_pages_~cmd#1.base, scsi_map_user_pages_~cmd#1.offset, scsi_map_user_pages_~uaddr#1, scsi_map_user_pages_~len#1, scsi_map_user_pages_~rw#1, scsi_map_user_pages_~q~4#1.base, scsi_map_user_pages_~q~4#1.offset, scsi_map_user_pages_~rq~2#1.base, scsi_map_user_pages_~rq~2#1.offset, scsi_map_user_pages_~err~3#1;scsi_map_user_pages_~tcmd#1.base, scsi_map_user_pages_~tcmd#1.offset := scsi_map_user_pages_#in~tcmd#1.base, scsi_map_user_pages_#in~tcmd#1.offset;scsi_map_user_pages_~cmd#1.base, scsi_map_user_pages_~cmd#1.offset := scsi_map_user_pages_#in~cmd#1.base, scsi_map_user_pages_#in~cmd#1.offset;scsi_map_user_pages_~uaddr#1 := scsi_map_user_pages_#in~uaddr#1;scsi_map_user_pages_~len#1 := scsi_map_user_pages_#in~len#1;scsi_map_user_pages_~rw#1 := scsi_map_user_pages_#in~rw#1;havoc scsi_map_user_pages_~q~4#1.base, scsi_map_user_pages_~q~4#1.offset;havoc scsi_map_user_pages_~rq~2#1.base, scsi_map_user_pages_~rq~2#1.offset;havoc scsi_map_user_pages_~err~3#1;call scsi_map_user_pages_#t~mem172#1.base, scsi_map_user_pages_#t~mem172#1.offset := read~$Pointer$#4(scsi_map_user_pages_~cmd#1.base, 124 + scsi_map_user_pages_~cmd#1.offset, 8);call scsi_map_user_pages_#t~mem173#1.base, scsi_map_user_pages_#t~mem173#1.offset := read~$Pointer$#4(scsi_map_user_pages_#t~mem172#1.base, 52 + scsi_map_user_pages_#t~mem172#1.offset, 8);scsi_map_user_pages_~q~4#1.base, scsi_map_user_pages_~q~4#1.offset := scsi_map_user_pages_#t~mem173#1.base, scsi_map_user_pages_#t~mem173#1.offset;havoc scsi_map_user_pages_#t~mem172#1.base, scsi_map_user_pages_#t~mem172#1.offset;havoc scsi_map_user_pages_#t~mem173#1.base, scsi_map_user_pages_#t~mem173#1.offset;call scsi_map_user_pages_#t~mem174#1.base, scsi_map_user_pages_#t~mem174#1.offset := read~$Pointer$#4(scsi_map_user_pages_~cmd#1.base, 124 + scsi_map_user_pages_~cmd#1.offset, 8);scsi_map_user_pages_~rq~2#1.base, scsi_map_user_pages_~rq~2#1.offset := scsi_map_user_pages_#t~mem174#1.base, scsi_map_user_pages_#t~mem174#1.offset;havoc scsi_map_user_pages_#t~mem174#1.base, scsi_map_user_pages_#t~mem174#1.offset;assume { :begin_inline_blk_rq_map_user } true;blk_rq_map_user_#in~arg0#1.base, blk_rq_map_user_#in~arg0#1.offset, blk_rq_map_user_#in~arg1#1.base, blk_rq_map_user_#in~arg1#1.offset, blk_rq_map_user_#in~arg2#1.base, blk_rq_map_user_#in~arg2#1.offset, blk_rq_map_user_#in~arg3#1.base, blk_rq_map_user_#in~arg3#1.offset, blk_rq_map_user_#in~arg4#1, blk_rq_map_user_#in~arg5#1 := scsi_map_user_pages_~q~4#1.base, scsi_map_user_pages_~q~4#1.offset, scsi_map_user_pages_~rq~2#1.base, scsi_map_user_pages_~rq~2#1.offset, 0, 0, 0, (if scsi_map_user_pages_~uaddr#1 % 18446744073709551616 % 18446744073709551616 <= 9223372036854775807 then scsi_map_user_pages_~uaddr#1 % 18446744073709551616 % 18446744073709551616 else scsi_map_user_pages_~uaddr#1 % 18446744073709551616 % 18446744073709551616 - 18446744073709551616), scsi_map_user_pages_~len#1 % 4294967296, 208;havoc blk_rq_map_user_#res#1;havoc blk_rq_map_user_#t~nondet433#1, blk_rq_map_user_~arg0#1.base, blk_rq_map_user_~arg0#1.offset, blk_rq_map_user_~arg1#1.base, blk_rq_map_user_~arg1#1.offset, blk_rq_map_user_~arg2#1.base, blk_rq_map_user_~arg2#1.offset, blk_rq_map_user_~arg3#1.base, blk_rq_map_user_~arg3#1.offset, blk_rq_map_user_~arg4#1, blk_rq_map_user_~arg5#1;blk_rq_map_user_~arg0#1.base, blk_rq_map_user_~arg0#1.offset := blk_rq_map_user_#in~arg0#1.base, blk_rq_map_user_#in~arg0#1.offset;blk_rq_map_user_~arg1#1.base, blk_rq_map_user_~arg1#1.offset := blk_rq_map_user_#in~arg1#1.base, blk_rq_map_user_#in~arg1#1.offset;blk_rq_map_user_~arg2#1.base, blk_rq_map_user_~arg2#1.offset := blk_rq_map_user_#in~arg2#1.base, blk_rq_map_user_#in~arg2#1.offset;blk_rq_map_user_~arg3#1.base, blk_rq_map_user_~arg3#1.offset := blk_rq_map_user_#in~arg3#1.base, blk_rq_map_user_#in~arg3#1.offset;blk_rq_map_user_~arg4#1 := blk_rq_map_user_#in~arg4#1;blk_rq_map_user_~arg5#1 := blk_rq_map_user_#in~arg5#1;havoc blk_rq_map_user_#t~nondet433#1;assume -2147483648 <= blk_rq_map_user_#t~nondet433#1 && blk_rq_map_user_#t~nondet433#1 <= 2147483647;blk_rq_map_user_#res#1 := blk_rq_map_user_#t~nondet433#1;havoc blk_rq_map_user_#t~nondet433#1; [2025-02-08 02:45:16,220 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L6964: assume !(0 != scsi_tgt_kspace_exec_~len#1 % 4294967296); [2025-02-08 02:45:16,220 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L6436-1: SUMMARY for call copy_from_user_#t~ret63#1 := ldv__builtin_expect((if 0 != copy_from_user_~__ret_warn_on~0#1 then 1 else 0), 0); srcloc: null [2025-02-08 02:45:16,221 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L7460: event_recv_msg_#t~ret351#1 := scsi_tgt_kspace_exec_#res#1;havoc scsi_tgt_kspace_exec_#t~ret200#1.base, scsi_tgt_kspace_exec_#t~ret200#1.offset, scsi_tgt_kspace_exec_#t~ret201#1, scsi_tgt_kspace_exec_#t~mem202#1.base, scsi_tgt_kspace_exec_#t~mem202#1.offset, scsi_tgt_kspace_exec_#t~ret203#1, scsi_tgt_kspace_exec_#t~mem204#1.base, scsi_tgt_kspace_exec_#t~mem204#1.offset, scsi_tgt_kspace_exec_#t~ret205#1.base, scsi_tgt_kspace_exec_#t~ret205#1.offset, scsi_tgt_kspace_exec_#t~ret206#1, scsi_tgt_kspace_exec_#t~mem207#1.base, scsi_tgt_kspace_exec_#t~mem207#1.offset, scsi_tgt_kspace_exec_#t~ret208#1, scsi_tgt_kspace_exec_#t~mem209#1.base, scsi_tgt_kspace_exec_#t~mem209#1.offset, scsi_tgt_kspace_exec_#t~mem210#1.base, scsi_tgt_kspace_exec_#t~mem210#1.offset, scsi_tgt_kspace_exec_#t~mem211#1, scsi_tgt_kspace_exec_#t~ret212#1, scsi_tgt_kspace_exec_#t~mem213#1.base, scsi_tgt_kspace_exec_#t~mem213#1.offset, scsi_tgt_kspace_exec_#t~ret214#1, scsi_tgt_kspace_exec_#t~ret215#1, scsi_tgt_kspace_exec_#t~mem216#1.base, scsi_tgt_kspace_exec_#t~mem216#1.offset, scsi_tgt_kspace_exec_#t~mem217#1.base, scsi_tgt_kspace_exec_#t~mem217#1.offset, scsi_tgt_kspace_exec_#t~mem218#1, scsi_tgt_kspace_exec_#t~ret219#1, scsi_tgt_kspace_exec_#t~ret220#1.base, scsi_tgt_kspace_exec_#t~ret220#1.offset, scsi_tgt_kspace_exec_#t~ret221#1, scsi_tgt_kspace_exec_#t~ret222#1, scsi_tgt_kspace_exec_~host_no#1, scsi_tgt_kspace_exec_~itn_id#1, scsi_tgt_kspace_exec_~result#1, scsi_tgt_kspace_exec_~tag#1, scsi_tgt_kspace_exec_~uaddr#1, scsi_tgt_kspace_exec_~len#1, scsi_tgt_kspace_exec_~sense_uaddr#1, scsi_tgt_kspace_exec_~sense_len#1, scsi_tgt_kspace_exec_~rw#1, scsi_tgt_kspace_exec_~shost~1#1.base, scsi_tgt_kspace_exec_~shost~1#1.offset, scsi_tgt_kspace_exec_~cmd~3#1.base, scsi_tgt_kspace_exec_~cmd~3#1.offset, scsi_tgt_kspace_exec_~rq~4#1.base, scsi_tgt_kspace_exec_~rq~4#1.offset, scsi_tgt_kspace_exec_~tcmd~9#1.base, scsi_tgt_kspace_exec_~tcmd~9#1.offset, scsi_tgt_kspace_exec_~err~5#1, scsi_tgt_kspace_exec_~qdata~4#1.base, scsi_tgt_kspace_exec_~qdata~4#1.offset, scsi_tgt_kspace_exec_~head~2#1.base, scsi_tgt_kspace_exec_~head~2#1.offset, scsi_tgt_kspace_exec_~flags~5#1, scsi_tgt_kspace_exec_~tmp~12#1, scsi_tgt_kspace_exec_~tmp___0~6#1.base, scsi_tgt_kspace_exec_~tmp___0~6#1.offset;havoc scsi_tgt_kspace_exec_#in~host_no#1, scsi_tgt_kspace_exec_#in~itn_id#1, scsi_tgt_kspace_exec_#in~result#1, scsi_tgt_kspace_exec_#in~tag#1, scsi_tgt_kspace_exec_#in~uaddr#1, scsi_tgt_kspace_exec_#in~len#1, scsi_tgt_kspace_exec_#in~sense_uaddr#1, scsi_tgt_kspace_exec_#in~sense_len#1, scsi_tgt_kspace_exec_#in~rw#1;assume { :end_inline_scsi_tgt_kspace_exec } true;assume -2147483648 <= event_recv_msg_#t~ret351#1 && event_recv_msg_#t~ret351#1 <= 2147483647;event_recv_msg_~err~17#1 := event_recv_msg_#t~ret351#1; [2025-02-08 02:45:16,221 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L6436: assume -9223372036854775808 <= copy_from_user_#t~ret63#1 && copy_from_user_#t~ret63#1 <= 9223372036854775807;havoc copy_from_user_#t~ret63#1; [2025-02-08 02:45:16,221 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L6420: assume { :end_inline_might_fault } true; [2025-02-08 02:45:16,221 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L6965: scsi_tgt_kspace_exec_#t~ret214#1 := scsi_map_user_pages_#res#1;havoc scsi_map_user_pages_#t~mem172#1.base, scsi_map_user_pages_#t~mem172#1.offset, scsi_map_user_pages_#t~mem173#1.base, scsi_map_user_pages_#t~mem173#1.offset, scsi_map_user_pages_#t~mem174#1.base, scsi_map_user_pages_#t~mem174#1.offset, scsi_map_user_pages_#t~ret175#1, scsi_map_user_pages_#t~ret176#1, scsi_map_user_pages_#t~mem177#1.base, scsi_map_user_pages_#t~mem177#1.offset, scsi_map_user_pages_#t~ret178#1, scsi_map_user_pages_#t~ret179#1, scsi_map_user_pages_~tcmd#1.base, scsi_map_user_pages_~tcmd#1.offset, scsi_map_user_pages_~cmd#1.base, scsi_map_user_pages_~cmd#1.offset, scsi_map_user_pages_~uaddr#1, scsi_map_user_pages_~len#1, scsi_map_user_pages_~rw#1, scsi_map_user_pages_~q~4#1.base, scsi_map_user_pages_~q~4#1.offset, scsi_map_user_pages_~rq~2#1.base, scsi_map_user_pages_~rq~2#1.offset, scsi_map_user_pages_~err~3#1;havoc scsi_map_user_pages_#in~tcmd#1.base, scsi_map_user_pages_#in~tcmd#1.offset, scsi_map_user_pages_#in~cmd#1.base, scsi_map_user_pages_#in~cmd#1.offset, scsi_map_user_pages_#in~uaddr#1, scsi_map_user_pages_#in~len#1, scsi_map_user_pages_#in~rw#1;assume { :end_inline_scsi_map_user_pages } true;assume -2147483648 <= scsi_tgt_kspace_exec_#t~ret214#1 && scsi_tgt_kspace_exec_#t~ret214#1 <= 2147483647;scsi_tgt_kspace_exec_~err~5#1 := scsi_tgt_kspace_exec_#t~ret214#1;havoc scsi_tgt_kspace_exec_#t~mem213#1.base, scsi_tgt_kspace_exec_#t~mem213#1.offset;havoc scsi_tgt_kspace_exec_#t~ret214#1; [2025-02-08 02:45:16,221 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L6982: scsi_tgt_kspace_exec_#t~ret222#1 := scsi_tgt_transfer_response_#res#1;havoc scsi_tgt_transfer_response_#t~ret163#1.base, scsi_tgt_transfer_response_#t~ret163#1.offset, scsi_tgt_transfer_response_#t~mem168#1.base, scsi_tgt_transfer_response_#t~mem168#1.offset, scsi_tgt_transfer_response_#t~mem169#1.base, scsi_tgt_transfer_response_#t~mem169#1.offset, scsi_tgt_transfer_response_#t~ret170#1, scsi_tgt_transfer_response_#t~switch171#1, scsi_tgt_transfer_response_~cmd#1.base, scsi_tgt_transfer_response_~cmd#1.offset, scsi_tgt_transfer_response_~shost~0#1.base, scsi_tgt_transfer_response_~shost~0#1.offset, scsi_tgt_transfer_response_~tmp~9#1.base, scsi_tgt_transfer_response_~tmp~9#1.offset, scsi_tgt_transfer_response_~err~2#1;havoc scsi_tgt_transfer_response_#in~cmd#1.base, scsi_tgt_transfer_response_#in~cmd#1.offset;assume { :end_inline_scsi_tgt_transfer_response } true;assume -2147483648 <= scsi_tgt_kspace_exec_#t~ret222#1 && scsi_tgt_kspace_exec_#t~ret222#1 <= 2147483647;scsi_tgt_kspace_exec_~err~5#1 := scsi_tgt_kspace_exec_#t~ret222#1;havoc scsi_tgt_kspace_exec_#t~ret222#1; [2025-02-08 02:45:16,221 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L6916-1: SUMMARY for call spin_unlock_irqrestore(tgt_cmd_hash_lookup_~qdata~3#1.base, 264 + tgt_cmd_hash_lookup_~qdata~3#1.offset, tgt_cmd_hash_lookup_~flags~4#1); srcloc: null [2025-02-08 02:45:16,221 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L6916: tgt_cmd_hash_lookup_#res#1.base, tgt_cmd_hash_lookup_#res#1.offset := tgt_cmd_hash_lookup_~rq~3#1.base, tgt_cmd_hash_lookup_~rq~3#1.offset; [2025-02-08 02:45:16,221 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L6982-1: assume { :begin_inline_scsi_tgt_transfer_response } true;scsi_tgt_transfer_response_#in~cmd#1.base, scsi_tgt_transfer_response_#in~cmd#1.offset := scsi_tgt_kspace_exec_~cmd~3#1.base, scsi_tgt_kspace_exec_~cmd~3#1.offset;havoc scsi_tgt_transfer_response_#res#1;havoc scsi_tgt_transfer_response_#t~ret163#1.base, scsi_tgt_transfer_response_#t~ret163#1.offset, scsi_tgt_transfer_response_#t~mem168#1.base, scsi_tgt_transfer_response_#t~mem168#1.offset, scsi_tgt_transfer_response_#t~mem169#1.base, scsi_tgt_transfer_response_#t~mem169#1.offset, scsi_tgt_transfer_response_#t~ret170#1, scsi_tgt_transfer_response_#t~switch171#1, scsi_tgt_transfer_response_~cmd#1.base, scsi_tgt_transfer_response_~cmd#1.offset, scsi_tgt_transfer_response_~shost~0#1.base, scsi_tgt_transfer_response_~shost~0#1.offset, scsi_tgt_transfer_response_~tmp~9#1.base, scsi_tgt_transfer_response_~tmp~9#1.offset, scsi_tgt_transfer_response_~err~2#1;scsi_tgt_transfer_response_~cmd#1.base, scsi_tgt_transfer_response_~cmd#1.offset := scsi_tgt_transfer_response_#in~cmd#1.base, scsi_tgt_transfer_response_#in~cmd#1.offset;havoc scsi_tgt_transfer_response_~shost~0#1.base, scsi_tgt_transfer_response_~shost~0#1.offset;havoc scsi_tgt_transfer_response_~tmp~9#1.base, scsi_tgt_transfer_response_~tmp~9#1.offset;havoc scsi_tgt_transfer_response_~err~2#1; [2025-02-08 02:45:16,221 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L6421-1: SUMMARY for call copy_from_user_#t~ret58#1 := ldv__builtin_expect((if -1 == copy_from_user_~sz~0#1 then 1 else 0), 1); srcloc: null [2025-02-08 02:45:16,221 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L6421: assume -9223372036854775808 <= copy_from_user_#t~ret58#1 && copy_from_user_#t~ret58#1 <= 9223372036854775807;copy_from_user_~tmp___1~0#1 := copy_from_user_#t~ret58#1;havoc copy_from_user_#t~ret58#1; [2025-02-08 02:45:16,222 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L8255: havoc blk_rq_map_user_#t~nondet433#1;scsi_map_user_pages_#t~ret175#1 := blk_rq_map_user_#res#1;havoc blk_rq_map_user_#t~nondet433#1, blk_rq_map_user_~arg0#1.base, blk_rq_map_user_~arg0#1.offset, blk_rq_map_user_~arg1#1.base, blk_rq_map_user_~arg1#1.offset, blk_rq_map_user_~arg2#1.base, blk_rq_map_user_~arg2#1.offset, blk_rq_map_user_~arg3#1.base, blk_rq_map_user_~arg3#1.offset, blk_rq_map_user_~arg4#1, blk_rq_map_user_~arg5#1;havoc blk_rq_map_user_#in~arg0#1.base, blk_rq_map_user_#in~arg0#1.offset, blk_rq_map_user_#in~arg1#1.base, blk_rq_map_user_#in~arg1#1.offset, blk_rq_map_user_#in~arg2#1.base, blk_rq_map_user_#in~arg2#1.offset, blk_rq_map_user_#in~arg3#1.base, blk_rq_map_user_#in~arg3#1.offset, blk_rq_map_user_#in~arg4#1, blk_rq_map_user_#in~arg5#1;assume { :end_inline_blk_rq_map_user } true;assume -2147483648 <= scsi_map_user_pages_#t~ret175#1 && scsi_map_user_pages_#t~ret175#1 <= 2147483647;scsi_map_user_pages_~err~3#1 := scsi_map_user_pages_#t~ret175#1;havoc scsi_map_user_pages_#t~ret175#1; [2025-02-08 02:45:16,222 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L6422: assume 0 != copy_from_user_~tmp___1~0#1; [2025-02-08 02:45:16,222 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L6422: assume !(0 != copy_from_user_~tmp___1~0#1); [2025-02-08 02:45:16,222 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L6967: assume 0 != scsi_tgt_kspace_exec_~err~5#1; [2025-02-08 02:45:16,222 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L6967: assume !(0 != scsi_tgt_kspace_exec_~err~5#1); [2025-02-08 02:45:16,222 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L6802: scsi_tgt_transfer_response_~tmp~9#1.base, scsi_tgt_transfer_response_~tmp~9#1.offset := scsi_tgt_transfer_response_#t~ret163#1.base, scsi_tgt_transfer_response_#t~ret163#1.offset;havoc scsi_tgt_transfer_response_#t~ret163#1.base, scsi_tgt_transfer_response_#t~ret163#1.offset;scsi_tgt_transfer_response_~shost~0#1.base, scsi_tgt_transfer_response_~shost~0#1.offset := scsi_tgt_transfer_response_~tmp~9#1.base, scsi_tgt_transfer_response_~tmp~9#1.offset;call scsi_tgt_transfer_response_#t~mem168#1.base, scsi_tgt_transfer_response_#t~mem168#1.offset := read~$Pointer$#4(scsi_tgt_transfer_response_~shost~0#1.base, 488 + scsi_tgt_transfer_response_~shost~0#1.offset, 8);call scsi_tgt_transfer_response_#t~mem169#1.base, scsi_tgt_transfer_response_#t~mem169#1.offset := read~$Pointer$#4(scsi_tgt_transfer_response_#t~mem168#1.base, 64 + scsi_tgt_transfer_response_#t~mem168#1.offset, 8);assume { :begin_inline_##fun~$Pointer$~X~$Pointer$~TO~int } true;##fun~$Pointer$~X~$Pointer$~TO~int_#in~166#1.base, ##fun~$Pointer$~X~$Pointer$~TO~int_#in~166#1.offset, ##fun~$Pointer$~X~$Pointer$~TO~int_#in~167#1.base, ##fun~$Pointer$~X~$Pointer$~TO~int_#in~167#1.offset, ##fun~$Pointer$~X~$Pointer$~TO~int_#in~#fp#1.base, ##fun~$Pointer$~X~$Pointer$~TO~int_#in~#fp#1.offset := scsi_tgt_transfer_response_~cmd#1.base, scsi_tgt_transfer_response_~cmd#1.offset, #funAddr~scsi_tgt_cmd_done.base, #funAddr~scsi_tgt_cmd_done.offset, scsi_tgt_transfer_response_#t~mem169#1.base, scsi_tgt_transfer_response_#t~mem169#1.offset;havoc ##fun~$Pointer$~X~$Pointer$~TO~int_#res#1;havoc ##fun~$Pointer$~X~$Pointer$~TO~int_#~166#1.base, ##fun~$Pointer$~X~$Pointer$~TO~int_#~166#1.offset, ##fun~$Pointer$~X~$Pointer$~TO~int_#~167#1.base, ##fun~$Pointer$~X~$Pointer$~TO~int_#~167#1.offset, ##fun~$Pointer$~X~$Pointer$~TO~int_#t~funptrres451#1, ##fun~$Pointer$~X~$Pointer$~TO~int_#t~ret452#1, ##fun~$Pointer$~X~$Pointer$~TO~int_#t~ret453#1, ##fun~$Pointer$~X~$Pointer$~TO~int_#t~ret454#1;##fun~$Pointer$~X~$Pointer$~TO~int_#~166#1.base, ##fun~$Pointer$~X~$Pointer$~TO~int_#~166#1.offset := ##fun~$Pointer$~X~$Pointer$~TO~int_#in~166#1.base, ##fun~$Pointer$~X~$Pointer$~TO~int_#in~166#1.offset;##fun~$Pointer$~X~$Pointer$~TO~int_#~167#1.base, ##fun~$Pointer$~X~$Pointer$~TO~int_#~167#1.offset := ##fun~$Pointer$~X~$Pointer$~TO~int_#in~167#1.base, ##fun~$Pointer$~X~$Pointer$~TO~int_#in~167#1.offset; [2025-02-08 02:45:16,222 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L6901-1: call tgt_cmd_hash_lookup_#t~mem197#1 := read~int#4(tgt_cmd_hash_lookup_~tcmd~8#1.base, 116 + tgt_cmd_hash_lookup_~tcmd~8#1.offset, 8); [2025-02-08 02:45:16,222 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L6901: assume tgt_cmd_hash_lookup_#t~mem197#1 % 18446744073709551616 == tgt_cmd_hash_lookup_~tag#1 % 18446744073709551616;havoc tgt_cmd_hash_lookup_#t~mem197#1;call tgt_cmd_hash_lookup_#t~mem198#1.base, tgt_cmd_hash_lookup_#t~mem198#1.offset := read~$Pointer$#4(tgt_cmd_hash_lookup_~tcmd~8#1.base, 100 + tgt_cmd_hash_lookup_~tcmd~8#1.offset, 8);tgt_cmd_hash_lookup_~rq~3#1.base, tgt_cmd_hash_lookup_~rq~3#1.offset := tgt_cmd_hash_lookup_#t~mem198#1.base, tgt_cmd_hash_lookup_#t~mem198#1.offset;havoc tgt_cmd_hash_lookup_#t~mem198#1.base, tgt_cmd_hash_lookup_#t~mem198#1.offset; [2025-02-08 02:45:16,222 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L6901: assume !(tgt_cmd_hash_lookup_#t~mem197#1 % 18446744073709551616 == tgt_cmd_hash_lookup_~tag#1 % 18446744073709551616);havoc tgt_cmd_hash_lookup_#t~mem197#1;call tgt_cmd_hash_lookup_#t~mem199#1.base, tgt_cmd_hash_lookup_#t~mem199#1.offset := read~$Pointer$#4(tgt_cmd_hash_lookup_~tcmd~8#1.base, 84 + tgt_cmd_hash_lookup_~tcmd~8#1.offset, 8);tgt_cmd_hash_lookup_~__mptr___0~1#1.base, tgt_cmd_hash_lookup_~__mptr___0~1#1.offset := tgt_cmd_hash_lookup_#t~mem199#1.base, tgt_cmd_hash_lookup_#t~mem199#1.offset;havoc tgt_cmd_hash_lookup_#t~mem199#1.base, tgt_cmd_hash_lookup_#t~mem199#1.offset;tgt_cmd_hash_lookup_~tcmd~8#1.base, tgt_cmd_hash_lookup_~tcmd~8#1.offset := tgt_cmd_hash_lookup_~__mptr___0~1#1.base, -10912 + tgt_cmd_hash_lookup_~__mptr___0~1#1.offset; [2025-02-08 02:45:16,222 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L6802-1: SUMMARY for call scsi_tgt_transfer_response_#t~ret163#1.base, scsi_tgt_transfer_response_#t~ret163#1.offset := scsi_tgt_cmd_to_host(scsi_tgt_transfer_response_~cmd#1.base, scsi_tgt_transfer_response_~cmd#1.offset); srcloc: null [2025-02-08 02:45:16,222 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L6439-1: copy_from_user_#res#1 := copy_from_user_~n#1; [2025-02-08 02:45:16,222 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L6984-1: SUMMARY for call scsi_host_put(scsi_tgt_kspace_exec_~shost~1#1.base, scsi_tgt_kspace_exec_~shost~1#1.offset); srcloc: null [2025-02-08 02:45:16,222 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L6984: scsi_tgt_kspace_exec_#res#1 := scsi_tgt_kspace_exec_~err~5#1; [2025-02-08 02:45:16,222 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint tgt_writeFINAL: assume true; [2025-02-08 02:45:16,223 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L6852: assume scsi_tgt_copy_sense_~__min1~0#1 % 4294967296 < scsi_tgt_copy_sense_~__min2~0#1 % 4294967296;scsi_tgt_copy_sense_~tmp~10#1 := scsi_tgt_copy_sense_~__min1~0#1; [2025-02-08 02:45:16,223 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L6852: assume !(scsi_tgt_copy_sense_~__min1~0#1 % 4294967296 < scsi_tgt_copy_sense_~__min2~0#1 % 4294967296);scsi_tgt_copy_sense_~tmp~10#1 := scsi_tgt_copy_sense_~__min2~0#1; [2025-02-08 02:45:16,223 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L6423-1: SUMMARY for call copy_from_user_#t~ret59#1 := _copy_from_user(copy_from_user_~to#1.base, copy_from_user_~to#1.offset, copy_from_user_~from#1.base, copy_from_user_~from#1.offset, copy_from_user_~n#1); srcloc: null [2025-02-08 02:45:16,223 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L6968-1: SUMMARY for call scsi_tgt_kspace_exec_#t~ret215#1 := printk(15, 0); srcloc: null [2025-02-08 02:45:16,223 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L6423: copy_from_user_~n#1 := copy_from_user_#t~ret59#1;havoc copy_from_user_#t~ret59#1; [2025-02-08 02:45:16,223 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L6968: assume -2147483648 <= scsi_tgt_kspace_exec_#t~ret215#1 && scsi_tgt_kspace_exec_#t~ret215#1 <= 2147483647;havoc scsi_tgt_kspace_exec_#t~ret215#1;call scsi_tgt_kspace_exec_#t~mem216#1.base, scsi_tgt_kspace_exec_#t~mem216#1.offset := read~$Pointer$#5(scsi_tgt_kspace_exec_~shost~1#1.base, 641 + scsi_tgt_kspace_exec_~shost~1#1.offset, 8);call scsi_tgt_kspace_exec_#t~mem217#1.base, scsi_tgt_kspace_exec_#t~mem217#1.offset := read~$Pointer$#7(scsi_tgt_kspace_exec_#t~mem216#1.base, 1736 + scsi_tgt_kspace_exec_#t~mem216#1.offset, 8);scsi_tgt_kspace_exec_~qdata~4#1.base, scsi_tgt_kspace_exec_~qdata~4#1.offset := scsi_tgt_kspace_exec_#t~mem217#1.base, scsi_tgt_kspace_exec_#t~mem217#1.offset;havoc scsi_tgt_kspace_exec_#t~mem216#1.base, scsi_tgt_kspace_exec_#t~mem216#1.offset;havoc scsi_tgt_kspace_exec_#t~mem217#1.base, scsi_tgt_kspace_exec_#t~mem217#1.offset;call scsi_tgt_kspace_exec_#t~mem218#1 := read~int#4(scsi_tgt_kspace_exec_~tcmd~9#1.base, 116 + scsi_tgt_kspace_exec_~tcmd~9#1.offset, 8); [2025-02-08 02:45:16,223 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L-1-1: ##fun~$Pointer$~X~$Pointer$~TO~int_#res#1 := ##fun~$Pointer$~X~$Pointer$~TO~int_#t~funptrres451#1;havoc ##fun~$Pointer$~X~$Pointer$~TO~int_#t~funptrres451#1;havoc ##fun~$Pointer$~X~$Pointer$~TO~int_#t~ret452#1;havoc ##fun~$Pointer$~X~$Pointer$~TO~int_#t~ret453#1;havoc ##fun~$Pointer$~X~$Pointer$~TO~int_#t~ret454#1; [2025-02-08 02:45:16,223 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L-1-2: assume -2147483648 <= ##fun~$Pointer$~X~$Pointer$~TO~int_#t~ret454#1 && ##fun~$Pointer$~X~$Pointer$~TO~int_#t~ret454#1 <= 2147483647;##fun~$Pointer$~X~$Pointer$~TO~int_#t~funptrres451#1 := ##fun~$Pointer$~X~$Pointer$~TO~int_#t~ret454#1; [2025-02-08 02:45:16,223 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L-1-3: SUMMARY for call ##fun~$Pointer$~X~$Pointer$~TO~int_#t~ret454#1 := tgt_open(##fun~$Pointer$~X~$Pointer$~TO~int_#~166#1.base, ##fun~$Pointer$~X~$Pointer$~TO~int_#~166#1.offset, ##fun~$Pointer$~X~$Pointer$~TO~int_#~167#1.base, ##fun~$Pointer$~X~$Pointer$~TO~int_#~167#1.offset); srcloc: null [2025-02-08 02:45:16,223 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L-1-4: assume -2147483648 <= ##fun~$Pointer$~X~$Pointer$~TO~int_#t~ret453#1 && ##fun~$Pointer$~X~$Pointer$~TO~int_#t~ret453#1 <= 2147483647;##fun~$Pointer$~X~$Pointer$~TO~int_#t~funptrres451#1 := ##fun~$Pointer$~X~$Pointer$~TO~int_#t~ret453#1; [2025-02-08 02:45:16,223 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L-1-5: SUMMARY for call ##fun~$Pointer$~X~$Pointer$~TO~int_#t~ret453#1 := tgt_mmap(##fun~$Pointer$~X~$Pointer$~TO~int_#~166#1.base, ##fun~$Pointer$~X~$Pointer$~TO~int_#~166#1.offset, ##fun~$Pointer$~X~$Pointer$~TO~int_#~167#1.base, ##fun~$Pointer$~X~$Pointer$~TO~int_#~167#1.offset); srcloc: null [2025-02-08 02:45:16,223 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L-1-6: ##fun~$Pointer$~X~$Pointer$~TO~int_#t~funptrres451#1 := ##fun~$Pointer$~X~$Pointer$~TO~int_#t~ret452#1; [2025-02-08 02:45:16,223 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L6870: assume -2147483648 <= scsi_tgt_abort_cmd_#t~ret188#1 && scsi_tgt_abort_cmd_#t~ret188#1 <= 2147483647;scsi_tgt_abort_cmd_~err~4#1 := scsi_tgt_abort_cmd_#t~ret188#1;havoc scsi_tgt_abort_cmd_#t~mem186#1.base, scsi_tgt_abort_cmd_#t~mem186#1.offset;havoc scsi_tgt_abort_cmd_#t~mem187#1.base, scsi_tgt_abort_cmd_#t~mem187#1.offset;havoc scsi_tgt_abort_cmd_#t~ret188#1; [2025-02-08 02:45:16,223 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L-1-7: SUMMARY for call ##fun~$Pointer$~X~$Pointer$~TO~int_#t~ret452#1 := tgt_poll(##fun~$Pointer$~X~$Pointer$~TO~int_#~166#1.base, ##fun~$Pointer$~X~$Pointer$~TO~int_#~166#1.offset, ##fun~$Pointer$~X~$Pointer$~TO~int_#~167#1.base, ##fun~$Pointer$~X~$Pointer$~TO~int_#~167#1.offset); srcloc: null [2025-02-08 02:45:16,223 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L6903: SUMMARY for call list_del(tgt_cmd_hash_lookup_~tcmd~8#1.base, 84 + tgt_cmd_hash_lookup_~tcmd~8#1.offset); srcloc: null [2025-02-08 02:45:16,224 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L-1-8: assume ##fun~$Pointer$~X~$Pointer$~TO~int_#in~#fp#1.base == #funAddr~tgt_mmap.base && ##fun~$Pointer$~X~$Pointer$~TO~int_#in~#fp#1.offset == #funAddr~tgt_mmap.offset; [2025-02-08 02:45:16,224 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L-1-8: assume !(##fun~$Pointer$~X~$Pointer$~TO~int_#in~#fp#1.base == #funAddr~tgt_mmap.base && ##fun~$Pointer$~X~$Pointer$~TO~int_#in~#fp#1.offset == #funAddr~tgt_mmap.offset); [2025-02-08 02:45:16,224 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L-1-9: assume ##fun~$Pointer$~X~$Pointer$~TO~int_#in~#fp#1.base == #funAddr~tgt_open.base && ##fun~$Pointer$~X~$Pointer$~TO~int_#in~#fp#1.offset == #funAddr~tgt_open.offset; [2025-02-08 02:45:16,224 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L-1-9: assume !(##fun~$Pointer$~X~$Pointer$~TO~int_#in~#fp#1.base == #funAddr~tgt_open.base && ##fun~$Pointer$~X~$Pointer$~TO~int_#in~#fp#1.offset == #funAddr~tgt_open.offset); [2025-02-08 02:45:16,224 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L6804: scsi_tgt_transfer_response_#t~ret170#1 := ##fun~$Pointer$~X~$Pointer$~TO~int_#res#1;havoc ##fun~$Pointer$~X~$Pointer$~TO~int_#~166#1.base, ##fun~$Pointer$~X~$Pointer$~TO~int_#~166#1.offset, ##fun~$Pointer$~X~$Pointer$~TO~int_#~167#1.base, ##fun~$Pointer$~X~$Pointer$~TO~int_#~167#1.offset, ##fun~$Pointer$~X~$Pointer$~TO~int_#t~funptrres451#1, ##fun~$Pointer$~X~$Pointer$~TO~int_#t~ret452#1, ##fun~$Pointer$~X~$Pointer$~TO~int_#t~ret453#1, ##fun~$Pointer$~X~$Pointer$~TO~int_#t~ret454#1;havoc ##fun~$Pointer$~X~$Pointer$~TO~int_#in~166#1.base, ##fun~$Pointer$~X~$Pointer$~TO~int_#in~166#1.offset, ##fun~$Pointer$~X~$Pointer$~TO~int_#in~167#1.base, ##fun~$Pointer$~X~$Pointer$~TO~int_#in~167#1.offset, ##fun~$Pointer$~X~$Pointer$~TO~int_#in~#fp#1.base, ##fun~$Pointer$~X~$Pointer$~TO~int_#in~#fp#1.offset;assume { :end_inline_##fun~$Pointer$~X~$Pointer$~TO~int } true;assume -2147483648 <= scsi_tgt_transfer_response_#t~ret170#1 && scsi_tgt_transfer_response_#t~ret170#1 <= 2147483647;scsi_tgt_transfer_response_~err~2#1 := scsi_tgt_transfer_response_#t~ret170#1;havoc scsi_tgt_transfer_response_#t~mem168#1.base, scsi_tgt_transfer_response_#t~mem168#1.offset;havoc scsi_tgt_transfer_response_#t~mem169#1.base, scsi_tgt_transfer_response_#t~mem169#1.offset;havoc scsi_tgt_transfer_response_#t~ret170#1;scsi_tgt_transfer_response_#t~switch171#1 := 4181 == scsi_tgt_transfer_response_~err~2#1; [2025-02-08 02:45:16,224 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L8340: havoc scsi_init_io_#t~nondet447#1;scsi_map_user_pages_#t~ret178#1 := scsi_init_io_#res#1;havoc scsi_init_io_#t~nondet447#1, scsi_init_io_~arg0#1.base, scsi_init_io_~arg0#1.offset, scsi_init_io_~arg1#1;havoc scsi_init_io_#in~arg0#1.base, scsi_init_io_#in~arg0#1.offset, scsi_init_io_#in~arg1#1;assume { :end_inline_scsi_init_io } true;assume -2147483648 <= scsi_map_user_pages_#t~ret178#1 && scsi_map_user_pages_#t~ret178#1 <= 2147483647;scsi_map_user_pages_~err~3#1 := scsi_map_user_pages_#t~ret178#1;havoc scsi_map_user_pages_#t~ret178#1; [2025-02-08 02:45:16,224 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L6870-1: SUMMARY for call scsi_tgt_abort_cmd_#t~ret188#1 := ##fun~$Pointer$~TO~int(scsi_tgt_abort_cmd_~cmd#1.base, scsi_tgt_abort_cmd_~cmd#1.offset, scsi_tgt_abort_cmd_#t~mem187#1.base, scsi_tgt_abort_cmd_#t~mem187#1.offset); srcloc: null [2025-02-08 02:45:16,224 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L7498: #res#1 := (if ~count#1 % 18446744073709551616 % 18446744073709551616 <= 9223372036854775807 then ~count#1 % 18446744073709551616 % 18446744073709551616 else ~count#1 % 18446744073709551616 % 18446744073709551616 - 18446744073709551616); [2025-02-08 02:45:16,224 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L6953: assume 32 == scsi_tgt_kspace_exec_~result#1;assume { :begin_inline_scsi_tgt_abort_cmd } true;scsi_tgt_abort_cmd_#in~shost#1.base, scsi_tgt_abort_cmd_#in~shost#1.offset, scsi_tgt_abort_cmd_#in~cmd#1.base, scsi_tgt_abort_cmd_#in~cmd#1.offset := scsi_tgt_kspace_exec_~shost~1#1.base, scsi_tgt_kspace_exec_~shost~1#1.offset, scsi_tgt_kspace_exec_~cmd~3#1.base, scsi_tgt_kspace_exec_~cmd~3#1.offset;havoc scsi_tgt_abort_cmd_#res#1;havoc scsi_tgt_abort_cmd_#t~mem186#1.base, scsi_tgt_abort_cmd_#t~mem186#1.offset, scsi_tgt_abort_cmd_#t~mem187#1.base, scsi_tgt_abort_cmd_#t~mem187#1.offset, scsi_tgt_abort_cmd_#t~ret188#1, scsi_tgt_abort_cmd_#t~ret189#1, scsi_tgt_abort_cmd_#t~mem190#1.base, scsi_tgt_abort_cmd_#t~mem190#1.offset, scsi_tgt_abort_cmd_#t~mem191#1.base, scsi_tgt_abort_cmd_#t~mem191#1.offset, scsi_tgt_abort_cmd_~shost#1.base, scsi_tgt_abort_cmd_~shost#1.offset, scsi_tgt_abort_cmd_~cmd#1.base, scsi_tgt_abort_cmd_~cmd#1.offset, scsi_tgt_abort_cmd_~tcmd~7#1.base, scsi_tgt_abort_cmd_~tcmd~7#1.offset, scsi_tgt_abort_cmd_~err~4#1;scsi_tgt_abort_cmd_~shost#1.base, scsi_tgt_abort_cmd_~shost#1.offset := scsi_tgt_abort_cmd_#in~shost#1.base, scsi_tgt_abort_cmd_#in~shost#1.offset;scsi_tgt_abort_cmd_~cmd#1.base, scsi_tgt_abort_cmd_~cmd#1.offset := scsi_tgt_abort_cmd_#in~cmd#1.base, scsi_tgt_abort_cmd_#in~cmd#1.offset;havoc scsi_tgt_abort_cmd_~tcmd~7#1.base, scsi_tgt_abort_cmd_~tcmd~7#1.offset;havoc scsi_tgt_abort_cmd_~err~4#1;call scsi_tgt_abort_cmd_#t~mem186#1.base, scsi_tgt_abort_cmd_#t~mem186#1.offset := read~$Pointer$#5(scsi_tgt_abort_cmd_~shost#1.base, 488 + scsi_tgt_abort_cmd_~shost#1.offset, 8);call scsi_tgt_abort_cmd_#t~mem187#1.base, scsi_tgt_abort_cmd_#t~mem187#1.offset := read~$Pointer$#7(scsi_tgt_abort_cmd_#t~mem186#1.base, 72 + scsi_tgt_abort_cmd_#t~mem186#1.offset, 8); [2025-02-08 02:45:16,224 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L6953: assume !(32 == scsi_tgt_kspace_exec_~result#1);call scsi_tgt_kspace_exec_#t~mem209#1.base, scsi_tgt_kspace_exec_#t~mem209#1.offset := read~$Pointer$#4(scsi_tgt_kspace_exec_~cmd~3#1.base, 124 + scsi_tgt_kspace_exec_~cmd~3#1.offset, 8);call scsi_tgt_kspace_exec_#t~mem210#1.base, scsi_tgt_kspace_exec_#t~mem210#1.offset := read~$Pointer$#4(scsi_tgt_kspace_exec_#t~mem209#1.base, 344 + scsi_tgt_kspace_exec_#t~mem209#1.offset, 8);scsi_tgt_kspace_exec_~tcmd~9#1.base, scsi_tgt_kspace_exec_~tcmd~9#1.offset := scsi_tgt_kspace_exec_#t~mem210#1.base, scsi_tgt_kspace_exec_#t~mem210#1.offset;havoc scsi_tgt_kspace_exec_#t~mem209#1.base, scsi_tgt_kspace_exec_#t~mem209#1.offset;havoc scsi_tgt_kspace_exec_#t~mem210#1.base, scsi_tgt_kspace_exec_#t~mem210#1.offset;call write~int#4(scsi_tgt_kspace_exec_~result#1, scsi_tgt_kspace_exec_~cmd~3#1.base, 208 + scsi_tgt_kspace_exec_~cmd~3#1.offset, 4);call scsi_tgt_kspace_exec_#t~mem211#1 := read~int#4(scsi_tgt_kspace_exec_~cmd~3#1.base, 208 + scsi_tgt_kspace_exec_~cmd~3#1.offset, 4); [2025-02-08 02:45:16,225 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L6838: scsi_map_user_pages_#res#1 := scsi_map_user_pages_~err~3#1; [2025-02-08 02:45:16,225 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L6871: assume 0 != scsi_tgt_abort_cmd_~err~4#1; [2025-02-08 02:45:16,225 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L6871: assume !(0 != scsi_tgt_abort_cmd_~err~4#1); [2025-02-08 02:45:16,225 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L6425-1: SUMMARY for call copy_from_user_#t~ret60#1 := ldv__builtin_expect((if copy_from_user_~sz~0#1 % 18446744073709551616 >= copy_from_user_~n#1 % 18446744073709551616 then 1 else 0), 1); srcloc: null [2025-02-08 02:45:16,225 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L6425: assume -9223372036854775808 <= copy_from_user_#t~ret60#1 && copy_from_user_#t~ret60#1 <= 9223372036854775807;copy_from_user_~tmp___2~1#1 := copy_from_user_#t~ret60#1;havoc copy_from_user_#t~ret60#1; [2025-02-08 02:45:16,225 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L6838-1: SUMMARY for call scsi_unmap_user_pages(scsi_map_user_pages_~tcmd#1.base, scsi_map_user_pages_~tcmd#1.offset); srcloc: null [2025-02-08 02:45:16,225 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L7466: event_recv_msg_#t~ret356#1 := scsi_tgt_kspace_tsk_mgmt_#res#1;havoc scsi_tgt_kspace_tsk_mgmt_#t~ret226#1.base, scsi_tgt_kspace_tsk_mgmt_#t~ret226#1.offset, scsi_tgt_kspace_tsk_mgmt_#t~ret227#1, scsi_tgt_kspace_tsk_mgmt_#t~mem228#1.base, scsi_tgt_kspace_tsk_mgmt_#t~mem228#1.offset, scsi_tgt_kspace_tsk_mgmt_#t~ret229#1, scsi_tgt_kspace_tsk_mgmt_#t~mem236#1.base, scsi_tgt_kspace_tsk_mgmt_#t~mem236#1.offset, scsi_tgt_kspace_tsk_mgmt_#t~mem237#1.base, scsi_tgt_kspace_tsk_mgmt_#t~mem237#1.offset, scsi_tgt_kspace_tsk_mgmt_#t~ret238#1, scsi_tgt_kspace_tsk_mgmt_~host_no#1, scsi_tgt_kspace_tsk_mgmt_~itn_id#1, scsi_tgt_kspace_tsk_mgmt_~mid#1, scsi_tgt_kspace_tsk_mgmt_~result#1, scsi_tgt_kspace_tsk_mgmt_~shost~2#1.base, scsi_tgt_kspace_tsk_mgmt_~shost~2#1.offset, scsi_tgt_kspace_tsk_mgmt_~err~7#1;havoc scsi_tgt_kspace_tsk_mgmt_#in~host_no#1, scsi_tgt_kspace_tsk_mgmt_#in~itn_id#1, scsi_tgt_kspace_tsk_mgmt_#in~mid#1, scsi_tgt_kspace_tsk_mgmt_#in~result#1;assume { :end_inline_scsi_tgt_kspace_tsk_mgmt } true;assume -2147483648 <= event_recv_msg_#t~ret356#1 && event_recv_msg_#t~ret356#1 <= 2147483647;event_recv_msg_~err~17#1 := event_recv_msg_#t~ret356#1; [2025-02-08 02:45:16,225 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L6954: scsi_tgt_kspace_exec_#t~ret208#1 := scsi_tgt_abort_cmd_#res#1;havoc scsi_tgt_abort_cmd_#t~mem186#1.base, scsi_tgt_abort_cmd_#t~mem186#1.offset, scsi_tgt_abort_cmd_#t~mem187#1.base, scsi_tgt_abort_cmd_#t~mem187#1.offset, scsi_tgt_abort_cmd_#t~ret188#1, scsi_tgt_abort_cmd_#t~ret189#1, scsi_tgt_abort_cmd_#t~mem190#1.base, scsi_tgt_abort_cmd_#t~mem190#1.offset, scsi_tgt_abort_cmd_#t~mem191#1.base, scsi_tgt_abort_cmd_#t~mem191#1.offset, scsi_tgt_abort_cmd_~shost#1.base, scsi_tgt_abort_cmd_~shost#1.offset, scsi_tgt_abort_cmd_~cmd#1.base, scsi_tgt_abort_cmd_~cmd#1.offset, scsi_tgt_abort_cmd_~tcmd~7#1.base, scsi_tgt_abort_cmd_~tcmd~7#1.offset, scsi_tgt_abort_cmd_~err~4#1;havoc scsi_tgt_abort_cmd_#in~shost#1.base, scsi_tgt_abort_cmd_#in~shost#1.offset, scsi_tgt_abort_cmd_#in~cmd#1.base, scsi_tgt_abort_cmd_#in~cmd#1.offset;assume { :end_inline_scsi_tgt_abort_cmd } true;assume -2147483648 <= scsi_tgt_kspace_exec_#t~ret208#1 && scsi_tgt_kspace_exec_#t~ret208#1 <= 2147483647;havoc scsi_tgt_kspace_exec_#t~ret208#1; [2025-02-08 02:45:16,225 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L6822: assume 0 != scsi_map_user_pages_~err~3#1; [2025-02-08 02:45:16,225 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L6822: assume !(0 != scsi_map_user_pages_~err~3#1);call scsi_map_user_pages_#t~mem177#1.base, scsi_map_user_pages_#t~mem177#1.offset := read~$Pointer$#4(scsi_map_user_pages_~rq~2#1.base, 92 + scsi_map_user_pages_~rq~2#1.offset, 8);call write~$Pointer$#4(scsi_map_user_pages_#t~mem177#1.base, scsi_map_user_pages_#t~mem177#1.offset, scsi_map_user_pages_~tcmd#1.base, 76 + scsi_map_user_pages_~tcmd#1.offset, 8);havoc scsi_map_user_pages_#t~mem177#1.base, scsi_map_user_pages_#t~mem177#1.offset;assume { :begin_inline_scsi_init_io } true;scsi_init_io_#in~arg0#1.base, scsi_init_io_#in~arg0#1.offset, scsi_init_io_#in~arg1#1 := scsi_map_user_pages_~cmd#1.base, scsi_map_user_pages_~cmd#1.offset, 208;havoc scsi_init_io_#res#1;havoc scsi_init_io_#t~nondet447#1, scsi_init_io_~arg0#1.base, scsi_init_io_~arg0#1.offset, scsi_init_io_~arg1#1;scsi_init_io_~arg0#1.base, scsi_init_io_~arg0#1.offset := scsi_init_io_#in~arg0#1.base, scsi_init_io_#in~arg0#1.offset;scsi_init_io_~arg1#1 := scsi_init_io_#in~arg1#1;havoc scsi_init_io_#t~nondet447#1;assume -2147483648 <= scsi_init_io_#t~nondet447#1 && scsi_init_io_#t~nondet447#1 <= 2147483647;scsi_init_io_#res#1 := scsi_init_io_#t~nondet447#1;havoc scsi_init_io_#t~nondet447#1; [2025-02-08 02:45:16,225 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L6971-1: SUMMARY for call scsi_tgt_kspace_exec_#t~ret219#1 := hash_64(scsi_tgt_kspace_exec_#t~mem218#1, 4); srcloc: null [2025-02-08 02:45:16,225 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L6426: assume 0 != copy_from_user_~tmp___2~1#1; [2025-02-08 02:45:16,225 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L6426: assume !(0 != copy_from_user_~tmp___2~1#1);copy_from_user_~__ret_warn_on~0#1 := 1; [2025-02-08 02:45:16,225 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L6971: scsi_tgt_kspace_exec_~tmp~12#1 := scsi_tgt_kspace_exec_#t~ret219#1;havoc scsi_tgt_kspace_exec_#t~mem218#1;havoc scsi_tgt_kspace_exec_#t~ret219#1;scsi_tgt_kspace_exec_~head~2#1.base, scsi_tgt_kspace_exec_~head~2#1.offset := scsi_tgt_kspace_exec_~qdata~4#1.base, 8 + scsi_tgt_kspace_exec_~qdata~4#1.offset + 16 * (if scsi_tgt_kspace_exec_~tmp~12#1 % 18446744073709551616 % 18446744073709551616 <= 9223372036854775807 then scsi_tgt_kspace_exec_~tmp~12#1 % 18446744073709551616 % 18446744073709551616 else scsi_tgt_kspace_exec_~tmp~12#1 % 18446744073709551616 % 18446744073709551616 - 18446744073709551616); [2025-02-08 02:45:16,225 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L6806: assume scsi_tgt_transfer_response_#t~switch171#1; [2025-02-08 02:45:16,225 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L6806: assume !scsi_tgt_transfer_response_#t~switch171#1; [2025-02-08 02:45:16,226 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L6872-1: SUMMARY for call scsi_tgt_abort_cmd_#t~ret189#1 := printk(10, 0); srcloc: null [2025-02-08 02:45:16,226 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L6872: assume -2147483648 <= scsi_tgt_abort_cmd_#t~ret189#1 && scsi_tgt_abort_cmd_#t~ret189#1 <= 2147483647;havoc scsi_tgt_abort_cmd_#t~ret189#1; [2025-02-08 02:45:16,226 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L6823-1: SUMMARY for call scsi_map_user_pages_#t~ret176#1 := printk(7, 0); srcloc: null [2025-02-08 02:45:16,226 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L6823: assume -2147483648 <= scsi_map_user_pages_#t~ret176#1 && scsi_map_user_pages_#t~ret176#1 <= 2147483647;havoc scsi_map_user_pages_#t~ret176#1;scsi_map_user_pages_#res#1 := scsi_map_user_pages_~err~3#1; [2025-02-08 02:45:16,243 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L7613: call ULTIMATE.dealloc(~#__key~3#1.base, ~#__key~3#1.offset);havoc ~#__key~3#1.base, ~#__key~3#1.offset; [2025-02-08 02:45:16,243 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint tgt_ring_initFINAL: assume true; [2025-02-08 02:45:16,243 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L7635: #res#1 := 0;call ULTIMATE.dealloc(~#__key~3#1.base, ~#__key~3#1.offset);havoc ~#__key~3#1.base, ~#__key~3#1.offset; [2025-02-08 02:45:16,243 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L8272-1: #t~ret389#1 := get_zeroed_page_#res#1;havoc get_zeroed_page_#t~nondet436#1, get_zeroed_page_~arg0#1;havoc get_zeroed_page_#in~arg0#1;assume { :end_inline_get_zeroed_page } true;call write~int#4(#t~ret389#1, ~ring#1.base, 4 + ~ring#1.offset + 8 * ~i~4#1, 8);call #t~mem390#1 := read~int#4(~ring#1.base, 4 + ~ring#1.offset + 8 * ~i~4#1, 8); [2025-02-08 02:45:16,243 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L8272: havoc get_zeroed_page_#t~nondet436#1; [2025-02-08 02:45:16,243 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L7623-1: SUMMARY for call #t~ret391#1 := printk(45, 0); srcloc: null [2025-02-08 02:45:16,243 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L7622: assume 0 == #t~mem390#1 % 18446744073709551616;havoc #t~mem390#1; [2025-02-08 02:45:16,243 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L7622: assume !(0 == #t~mem390#1 % 18446744073709551616);havoc #t~mem390#1;~i~4#1 := 1 + ~i~4#1; [2025-02-08 02:45:16,244 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L7623: assume -2147483648 <= #t~ret391#1 && #t~ret391#1 <= 2147483647;havoc #t~ret391#1;#res#1 := -12;call ULTIMATE.dealloc(~#__key~3#1.base, ~#__key~3#1.offset);havoc ~#__key~3#1.base, ~#__key~3#1.offset; [2025-02-08 02:45:16,244 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L7621: assume { :begin_inline_get_zeroed_page } true;get_zeroed_page_#in~arg0#1 := 208;havoc get_zeroed_page_#res#1;havoc get_zeroed_page_#t~nondet436#1, get_zeroed_page_~arg0#1;get_zeroed_page_~arg0#1 := get_zeroed_page_#in~arg0#1;havoc get_zeroed_page_#t~nondet436#1;get_zeroed_page_#res#1 := get_zeroed_page_#t~nondet436#1;havoc get_zeroed_page_#t~nondet436#1; [2025-02-08 02:45:16,272 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L8236: havoc #t~nondet431; [2025-02-08 02:45:16,281 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L8333: havoc #t~ret446.base, #t~ret446.offset; [2025-02-08 02:45:16,297 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L8232: havoc #t~nondet430; [2025-02-08 02:45:18,240 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L7096: SUMMARY for call destroy_workqueue(~scsi_tgtd~0.base, ~scsi_tgtd~0.offset); srcloc: null [2025-02-08 02:45:18,241 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L7650: assume -2147483648 <= scsi_tgt_if_init_#t~ret393#1 && scsi_tgt_if_init_#t~ret393#1 <= 2147483647;scsi_tgt_if_init_~err~20#1 := scsi_tgt_if_init_#t~ret393#1;havoc scsi_tgt_if_init_#t~ret393#1; [2025-02-08 02:45:18,241 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L7138: assume { :end_inline_scsi_tgt_exit } true;~ldv_state_variable_0~0 := 2; [2025-02-08 02:45:18,241 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L8319: havoc noop_llseek_#t~nondet443#1;ldv_main_exported_1_#t~ret404#1 := noop_llseek_#res#1;havoc noop_llseek_#t~nondet443#1, noop_llseek_~arg0#1.base, noop_llseek_~arg0#1.offset, noop_llseek_~arg1#1, noop_llseek_~arg2#1;havoc noop_llseek_#in~arg0#1.base, noop_llseek_#in~arg0#1.offset, noop_llseek_#in~arg1#1, noop_llseek_#in~arg2#1;assume { :end_inline_noop_llseek } true;assume -9223372036854775808 <= ldv_main_exported_1_#t~ret404#1 && ldv_main_exported_1_#t~ret404#1 <= 9223372036854775807;havoc ldv_main_exported_1_#t~ret404#1;~ldv_state_variable_1~0 := 2; [2025-02-08 02:45:18,241 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L7072: call ULTIMATE.dealloc(scsi_tgt_init_~#__key~2#1.base, scsi_tgt_init_~#__key~2#1.offset);havoc scsi_tgt_init_~#__key~2#1.base, scsi_tgt_init_~#__key~2#1.offset;main_#t~ret266#1 := scsi_tgt_init_#res#1;havoc scsi_tgt_init_#t~ret259#1.base, scsi_tgt_init_#t~ret259#1.offset, scsi_tgt_init_#t~ret260#1.base, scsi_tgt_init_#t~ret260#1.offset, scsi_tgt_init_#t~ret261#1, scsi_tgt_init_~err~11#1, scsi_tgt_init_~#__key~2#1.base, scsi_tgt_init_~#__key~2#1.offset, scsi_tgt_init_~__lock_name~0#1.base, scsi_tgt_init_~__lock_name~0#1.offset, scsi_tgt_init_~tmp~13#1.base, scsi_tgt_init_~tmp~13#1.offset;assume { :end_inline_scsi_tgt_init } true;assume -2147483648 <= main_#t~ret266#1 && main_#t~ret266#1 <= 2147483647;~ldv_retval_1~0 := main_#t~ret266#1;havoc main_#t~ret266#1; [2025-02-08 02:45:18,241 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L7650-1: SUMMARY for call scsi_tgt_if_init_#t~ret393#1 := tgt_ring_init(~#tx_ring~0.base, ~#tx_ring~0.offset); srcloc: null [2025-02-08 02:45:18,241 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint ULTIMATE.startFINAL: assume true; [2025-02-08 02:45:18,241 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L8187: SUMMARY for call ldv_error(); srcloc: null [2025-02-08 02:45:18,242 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L8278: havoc kmem_cache_create_#t~ret438#1.base, kmem_cache_create_#t~ret438#1.offset;scsi_tgt_init_#t~ret259#1.base, scsi_tgt_init_#t~ret259#1.offset := kmem_cache_create_#res#1.base, kmem_cache_create_#res#1.offset;havoc kmem_cache_create_#t~ret438#1.base, kmem_cache_create_#t~ret438#1.offset, kmem_cache_create_~arg0#1.base, kmem_cache_create_~arg0#1.offset, kmem_cache_create_~arg1#1, kmem_cache_create_~arg2#1, kmem_cache_create_~arg3#1, kmem_cache_create_~arg4#1.base, kmem_cache_create_~arg4#1.offset;havoc kmem_cache_create_#in~arg0#1.base, kmem_cache_create_#in~arg0#1.offset, kmem_cache_create_#in~arg1#1, kmem_cache_create_#in~arg2#1, kmem_cache_create_#in~arg3#1, kmem_cache_create_#in~arg4#1.base, kmem_cache_create_#in~arg4#1.offset;assume { :end_inline_kmem_cache_create } true;~scsi_tgt_cmd_cache~0.base, ~scsi_tgt_cmd_cache~0.offset := scsi_tgt_init_#t~ret259#1.base, scsi_tgt_init_#t~ret259#1.offset;havoc scsi_tgt_init_#t~ret259#1.base, scsi_tgt_init_#t~ret259#1.offset; [2025-02-08 02:45:18,242 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L7667: SUMMARY for call tgt_ring_exit(~#rx_ring~0.base, ~#rx_ring~0.offset); srcloc: null [2025-02-08 02:45:18,242 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L7089: scsi_tgt_init_#t~ret261#1 := scsi_tgt_if_init_#res#1;havoc scsi_tgt_if_init_#t~ret393#1, scsi_tgt_if_init_#t~ret394#1, scsi_tgt_if_init_#t~ret395#1, scsi_tgt_if_init_~err~20#1;assume { :end_inline_scsi_tgt_if_init } true;assume -2147483648 <= scsi_tgt_init_#t~ret261#1 && scsi_tgt_init_#t~ret261#1 <= 2147483647;scsi_tgt_init_~err~11#1 := scsi_tgt_init_#t~ret261#1;havoc scsi_tgt_init_#t~ret261#1; [2025-02-08 02:45:18,242 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L7106: havoc scsi_tgt_if_exit_#t~ret392#1;assume { :end_inline_scsi_tgt_if_exit } true; [2025-02-08 02:45:18,242 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L7172-1: assume { :begin_inline_ldv_check_final_state } true; [2025-02-08 02:45:18,242 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L7651: assume 0 != scsi_tgt_if_init_~err~20#1;scsi_tgt_if_init_#res#1 := scsi_tgt_if_init_~err~20#1; [2025-02-08 02:45:18,242 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L7651: assume !(0 != scsi_tgt_if_init_~err~20#1); [2025-02-08 02:45:18,242 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L7172: assume { :end_inline_ldv_check_final_state } true;main_#res#1 := 0;#t~ret450#1 := main_#res#1;havoc main_#t~nondet262#1, main_#t~switch263#1, main_#t~nondet264#1, main_#t~switch265#1, main_#t~ret266#1, main_~tmp~14#1, main_~tmp___0~7#1;assume { :end_inline_main } true; [2025-02-08 02:45:18,242 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L7098: scsi_tgt_init_#res#1 := scsi_tgt_init_~err~11#1;call ULTIMATE.dealloc(scsi_tgt_init_~#__key~2#1.base, scsi_tgt_init_~#__key~2#1.offset);havoc scsi_tgt_init_~#__key~2#1.base, scsi_tgt_init_~#__key~2#1.offset; [2025-02-08 02:45:18,242 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L7643: scsi_tgt_if_exit_#t~ret392#1 := ldv_misc_deregister_22_#res#1;havoc ldv_misc_deregister_22_#t~ret409#1, ldv_misc_deregister_22_~misc#1.base, ldv_misc_deregister_22_~misc#1.offset, ldv_misc_deregister_22_~ldv_func_res~2#1, ldv_misc_deregister_22_~tmp~23#1;havoc ldv_misc_deregister_22_#in~misc#1.base, ldv_misc_deregister_22_#in~misc#1.offset;assume { :end_inline_ldv_misc_deregister_22 } true;assume -2147483648 <= scsi_tgt_if_exit_#t~ret392#1 && scsi_tgt_if_exit_#t~ret392#1 <= 2147483647;havoc scsi_tgt_if_exit_#t~ret392#1; [2025-02-08 02:45:18,242 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L7098-1: SUMMARY for call kmem_cache_destroy(~scsi_tgt_cmd_cache~0.base, ~scsi_tgt_cmd_cache~0.offset); srcloc: null [2025-02-08 02:45:18,242 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L7090: assume 0 != scsi_tgt_init_~err~11#1; [2025-02-08 02:45:18,243 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L7090: assume !(0 != scsi_tgt_init_~err~11#1);scsi_tgt_init_#res#1 := 0;call ULTIMATE.dealloc(scsi_tgt_init_~#__key~2#1.base, scsi_tgt_init_~#__key~2#1.offset);havoc scsi_tgt_init_~#__key~2#1.base, scsi_tgt_init_~#__key~2#1.offset; [2025-02-08 02:45:18,243 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L7660: scsi_tgt_if_init_#t~ret395#1 := ldv_misc_register_23_#res#1;havoc ldv_misc_register_23_#t~ret410#1, ldv_misc_register_23_~misc#1.base, ldv_misc_register_23_~misc#1.offset, ldv_misc_register_23_~ldv_func_res~3#1, ldv_misc_register_23_~tmp~24#1;havoc ldv_misc_register_23_#in~misc#1.base, ldv_misc_register_23_#in~misc#1.offset;assume { :end_inline_ldv_misc_register_23 } true;assume -2147483648 <= scsi_tgt_if_init_#t~ret395#1 && scsi_tgt_if_init_#t~ret395#1 <= 2147483647;scsi_tgt_if_init_~err~20#1 := scsi_tgt_if_init_#t~ret395#1;havoc scsi_tgt_if_init_#t~ret395#1; [2025-02-08 02:45:18,243 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L8197-3: SUMMARY for call __alloc_workqueue_key_#t~ret426#1.base, __alloc_workqueue_key_#t~ret426#1.offset := ldv_malloc(0); srcloc: null [2025-02-08 02:45:18,243 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L8197-2: __alloc_workqueue_key_#res#1.base, __alloc_workqueue_key_#res#1.offset := __alloc_workqueue_key_#t~ret426#1.base, __alloc_workqueue_key_#t~ret426#1.offset;havoc __alloc_workqueue_key_#t~ret426#1.base, __alloc_workqueue_key_#t~ret426#1.offset; [2025-02-08 02:45:18,243 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L7107: SUMMARY for call kmem_cache_destroy(~scsi_tgt_cmd_cache~0.base, ~scsi_tgt_cmd_cache~0.offset); srcloc: null [2025-02-08 02:45:18,243 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L8197: havoc __alloc_workqueue_key_#t~ret426#1.base, __alloc_workqueue_key_#t~ret426#1.offset;scsi_tgt_init_#t~ret260#1.base, scsi_tgt_init_#t~ret260#1.offset := __alloc_workqueue_key_#res#1.base, __alloc_workqueue_key_#res#1.offset;havoc __alloc_workqueue_key_#t~ret426#1.base, __alloc_workqueue_key_#t~ret426#1.offset, __alloc_workqueue_key_~arg0#1.base, __alloc_workqueue_key_~arg0#1.offset, __alloc_workqueue_key_~arg1#1, __alloc_workqueue_key_~arg2#1, __alloc_workqueue_key_~arg3#1.base, __alloc_workqueue_key_~arg3#1.offset, __alloc_workqueue_key_~arg4#1.base, __alloc_workqueue_key_~arg4#1.offset;havoc __alloc_workqueue_key_#in~arg0#1.base, __alloc_workqueue_key_#in~arg0#1.offset, __alloc_workqueue_key_#in~arg1#1, __alloc_workqueue_key_#in~arg2#1, __alloc_workqueue_key_#in~arg3#1.base, __alloc_workqueue_key_#in~arg3#1.offset, __alloc_workqueue_key_#in~arg4#1.base, __alloc_workqueue_key_#in~arg4#1.offset;assume { :end_inline___alloc_workqueue_key } true;scsi_tgt_init_~tmp~13#1.base, scsi_tgt_init_~tmp~13#1.offset := scsi_tgt_init_#t~ret260#1.base, scsi_tgt_init_#t~ret260#1.offset;havoc scsi_tgt_init_#t~ret260#1.base, scsi_tgt_init_#t~ret260#1.offset;~scsi_tgtd~0.base, ~scsi_tgtd~0.offset := scsi_tgt_init_~tmp~13#1.base, scsi_tgt_init_~tmp~13#1.offset; [2025-02-08 02:45:18,243 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L8288: havoc ldv_tgt_fops_release_1_#t~nondet439#1;ldv_main_exported_1_#t~ret406#1 := ldv_tgt_fops_release_1_#res#1;havoc ldv_tgt_fops_release_1_#t~nondet439#1;assume { :end_inline_ldv_tgt_fops_release_1 } true;assume -2147483648 <= ldv_main_exported_1_#t~ret406#1 && ldv_main_exported_1_#t~ret406#1 <= 2147483647;havoc ldv_main_exported_1_#t~ret406#1;~ldv_state_variable_1~0 := 1;~ref_cnt~0 := ~ref_cnt~0 - 1; [2025-02-08 02:45:18,243 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L7132-2: assume 0 == ~ldv_retval_1~0;~ldv_state_variable_0~0 := 3; [2025-02-08 02:45:18,243 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L7132-2: assume !(0 == ~ldv_retval_1~0); [2025-02-08 02:45:18,243 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L7132-1: assume 0 != ~ldv_retval_1~0;~ldv_state_variable_0~0 := 2; [2025-02-08 02:45:18,243 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L7132-1: assume !(0 != ~ldv_retval_1~0); [2025-02-08 02:45:18,243 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L8189: assume 1 == ~ldv_mutex_mutex_of_device~0; [2025-02-08 02:45:18,244 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L8189: assume !(1 == ~ldv_mutex_mutex_of_device~0); [2025-02-08 02:45:18,244 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L7669-1: SUMMARY for call tgt_ring_exit(~#tx_ring~0.base, ~#tx_ring~0.offset); srcloc: null [2025-02-08 02:45:18,244 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L8181: assume 1 == ~ldv_mutex_cred_guard_mutex_of_signal_struct~0; [2025-02-08 02:45:18,244 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L8181: assume !(1 == ~ldv_mutex_cred_guard_mutex_of_signal_struct~0); [2025-02-08 02:45:18,244 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L7669: scsi_tgt_if_init_#res#1 := scsi_tgt_if_init_~err~20#1; [2025-02-08 02:45:18,244 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L8305: havoc misc_register_#t~nondet441#1;ldv_misc_register_23_#t~ret410#1 := misc_register_#res#1;havoc misc_register_#t~nondet441#1, misc_register_~arg0#1.base, misc_register_~arg0#1.offset;havoc misc_register_#in~arg0#1.base, misc_register_#in~arg0#1.offset;assume { :end_inline_misc_register } true;assume -2147483648 <= ldv_misc_register_23_#t~ret410#1 && ldv_misc_register_23_#t~ret410#1 <= 2147483647;ldv_misc_register_23_~tmp~24#1 := ldv_misc_register_23_#t~ret410#1;havoc ldv_misc_register_23_#t~ret410#1;ldv_misc_register_23_~ldv_func_res~3#1 := ldv_misc_register_23_~tmp~24#1;~ldv_state_variable_1~0 := 1;ldv_misc_register_23_#res#1 := ldv_misc_register_23_~ldv_func_res~3#1; [2025-02-08 02:45:18,244 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L7661: assume 0 != scsi_tgt_if_init_~err~20#1; [2025-02-08 02:45:18,244 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L7661: assume !(0 != scsi_tgt_if_init_~err~20#1);scsi_tgt_if_init_#res#1 := 0; [2025-02-08 02:45:18,244 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L7084: assume 0 == (~scsi_tgtd~0.base + ~scsi_tgtd~0.offset) % 18446744073709551616;scsi_tgt_init_~err~11#1 := -12; [2025-02-08 02:45:18,244 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L7084: assume !(0 == (~scsi_tgtd~0.base + ~scsi_tgtd~0.offset) % 18446744073709551616);assume { :begin_inline_scsi_tgt_if_init } true;havoc scsi_tgt_if_init_#res#1;havoc scsi_tgt_if_init_#t~ret393#1, scsi_tgt_if_init_#t~ret394#1, scsi_tgt_if_init_#t~ret395#1, scsi_tgt_if_init_~err~20#1;havoc scsi_tgt_if_init_~err~20#1; [2025-02-08 02:45:18,244 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L8191: SUMMARY for call ldv_error(); srcloc: null [2025-02-08 02:45:18,245 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L8183: SUMMARY for call ldv_error(); srcloc: null [2025-02-08 02:45:18,245 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L7655-1: SUMMARY for call scsi_tgt_if_init_#t~ret394#1 := tgt_ring_init(~#rx_ring~0.base, ~#rx_ring~0.offset); srcloc: null [2025-02-08 02:45:18,245 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L7655: assume -2147483648 <= scsi_tgt_if_init_#t~ret394#1 && scsi_tgt_if_init_#t~ret394#1 <= 2147483647;scsi_tgt_if_init_~err~20#1 := scsi_tgt_if_init_#t~ret394#1;havoc scsi_tgt_if_init_#t~ret394#1; [2025-02-08 02:45:18,245 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L7077: assume 0 == (~scsi_tgt_cmd_cache~0.base + ~scsi_tgt_cmd_cache~0.offset) % 18446744073709551616;scsi_tgt_init_#res#1 := -12;call ULTIMATE.dealloc(scsi_tgt_init_~#__key~2#1.base, scsi_tgt_init_~#__key~2#1.offset);havoc scsi_tgt_init_~#__key~2#1.base, scsi_tgt_init_~#__key~2#1.offset; [2025-02-08 02:45:18,245 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L7077: assume !(0 == (~scsi_tgt_cmd_cache~0.base + ~scsi_tgt_cmd_cache~0.offset) % 18446744073709551616);scsi_tgt_init_~__lock_name~0#1.base, scsi_tgt_init_~__lock_name~0#1.offset := 28, 0;assume { :begin_inline___alloc_workqueue_key } true;__alloc_workqueue_key_#in~arg0#1.base, __alloc_workqueue_key_#in~arg0#1.offset, __alloc_workqueue_key_#in~arg1#1, __alloc_workqueue_key_#in~arg2#1, __alloc_workqueue_key_#in~arg3#1.base, __alloc_workqueue_key_#in~arg3#1.offset, __alloc_workqueue_key_#in~arg4#1.base, __alloc_workqueue_key_#in~arg4#1.offset := 29, 0, 0, 1, scsi_tgt_init_~#__key~2#1.base, scsi_tgt_init_~#__key~2#1.offset, scsi_tgt_init_~__lock_name~0#1.base, scsi_tgt_init_~__lock_name~0#1.offset;havoc __alloc_workqueue_key_#res#1.base, __alloc_workqueue_key_#res#1.offset;havoc __alloc_workqueue_key_#t~ret426#1.base, __alloc_workqueue_key_#t~ret426#1.offset, __alloc_workqueue_key_~arg0#1.base, __alloc_workqueue_key_~arg0#1.offset, __alloc_workqueue_key_~arg1#1, __alloc_workqueue_key_~arg2#1, __alloc_workqueue_key_~arg3#1.base, __alloc_workqueue_key_~arg3#1.offset, __alloc_workqueue_key_~arg4#1.base, __alloc_workqueue_key_~arg4#1.offset;__alloc_workqueue_key_~arg0#1.base, __alloc_workqueue_key_~arg0#1.offset := __alloc_workqueue_key_#in~arg0#1.base, __alloc_workqueue_key_#in~arg0#1.offset;__alloc_workqueue_key_~arg1#1 := __alloc_workqueue_key_#in~arg1#1;__alloc_workqueue_key_~arg2#1 := __alloc_workqueue_key_#in~arg2#1;__alloc_workqueue_key_~arg3#1.base, __alloc_workqueue_key_~arg3#1.offset := __alloc_workqueue_key_#in~arg3#1.base, __alloc_workqueue_key_#in~arg3#1.offset;__alloc_workqueue_key_~arg4#1.base, __alloc_workqueue_key_~arg4#1.offset := __alloc_workqueue_key_#in~arg4#1.base, __alloc_workqueue_key_#in~arg4#1.offset; [2025-02-08 02:45:18,245 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L7656: assume 0 != scsi_tgt_if_init_~err~20#1; [2025-02-08 02:45:18,245 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L7656: assume !(0 != scsi_tgt_if_init_~err~20#1);assume { :begin_inline_ldv_misc_register_23 } true;ldv_misc_register_23_#in~misc#1.base, ldv_misc_register_23_#in~misc#1.offset := ~#tgt_miscdev~0.base, ~#tgt_miscdev~0.offset;havoc ldv_misc_register_23_#res#1;havoc ldv_misc_register_23_#t~ret410#1, ldv_misc_register_23_~misc#1.base, ldv_misc_register_23_~misc#1.offset, ldv_misc_register_23_~ldv_func_res~3#1, ldv_misc_register_23_~tmp~24#1;ldv_misc_register_23_~misc#1.base, ldv_misc_register_23_~misc#1.offset := ldv_misc_register_23_#in~misc#1.base, ldv_misc_register_23_#in~misc#1.offset;havoc ldv_misc_register_23_~ldv_func_res~3#1;havoc ldv_misc_register_23_~tmp~24#1;assume { :begin_inline_misc_register } true;misc_register_#in~arg0#1.base, misc_register_#in~arg0#1.offset := ldv_misc_register_23_~misc#1.base, ldv_misc_register_23_~misc#1.offset;havoc misc_register_#res#1;havoc misc_register_#t~nondet441#1, misc_register_~arg0#1.base, misc_register_~arg0#1.offset;misc_register_~arg0#1.base, misc_register_~arg0#1.offset := misc_register_#in~arg0#1.base, misc_register_#in~arg0#1.offset;havoc misc_register_#t~nondet441#1;assume -2147483648 <= misc_register_#t~nondet441#1 && misc_register_#t~nondet441#1 <= 2147483647;misc_register_#res#1 := misc_register_#t~nondet441#1;havoc misc_register_#t~nondet441#1; [2025-02-08 02:45:18,245 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L7128: havoc ldv_main_exported_1_#t~nondet396#1, ldv_main_exported_1_#t~switch397#1, ldv_main_exported_1_#t~ret398#1, ldv_main_exported_1_#t~ret399#1, ldv_main_exported_1_#t~ret400#1, ldv_main_exported_1_#t~ret401#1, ldv_main_exported_1_#t~ret402#1, ldv_main_exported_1_#t~ret403#1, ldv_main_exported_1_#t~ret404#1, ldv_main_exported_1_#t~ret405#1, ldv_main_exported_1_#t~ret406#1, ldv_main_exported_1_~tmp~21#1;assume { :end_inline_ldv_main_exported_1 } true; [2025-02-08 02:45:18,245 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L8185: assume 1 == ~ldv_mutex_lock~0; [2025-02-08 02:45:18,245 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L8185: assume !(1 == ~ldv_mutex_lock~0); [2025-02-08 02:45:18,245 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L8301: havoc misc_deregister_#t~nondet440#1;ldv_misc_deregister_22_#t~ret409#1 := misc_deregister_#res#1;havoc misc_deregister_#t~nondet440#1, misc_deregister_~arg0#1.base, misc_deregister_~arg0#1.offset;havoc misc_deregister_#in~arg0#1.base, misc_deregister_#in~arg0#1.offset;assume { :end_inline_misc_deregister } true;assume -2147483648 <= ldv_misc_deregister_22_#t~ret409#1 && ldv_misc_deregister_22_#t~ret409#1 <= 2147483647;ldv_misc_deregister_22_~tmp~23#1 := ldv_misc_deregister_22_#t~ret409#1;havoc ldv_misc_deregister_22_#t~ret409#1;ldv_misc_deregister_22_~ldv_func_res~2#1 := ldv_misc_deregister_22_~tmp~23#1;~ldv_state_variable_1~0 := 0;ldv_misc_deregister_22_#res#1 := ldv_misc_deregister_22_~ldv_func_res~2#1; [2025-02-08 02:45:18,250 INFO L1324 $ProcedureCfgBuilder]: dead code at ProgramPoint L6769: havoc #t~mem152.base, #t~mem152.offset; [2025-02-08 02:45:18,325 INFO L? ?]: Removed 323 outVars from TransFormulas that were not future-live. [2025-02-08 02:45:18,325 INFO L308 CfgBuilder]: Performing block encoding [2025-02-08 02:45:18,346 INFO L332 CfgBuilder]: Using the 1 location(s) as analysis (start of procedure ULTIMATE.start) [2025-02-08 02:45:18,346 INFO L337 CfgBuilder]: Removed 1 assume(true) statements. [2025-02-08 02:45:18,346 INFO L201 PluginConnector]: Adding new model de.uni_freiburg.informatik.ultimate.plugins.generator.icfgbuilder CFG 08.02 02:45:18 BoogieIcfgContainer [2025-02-08 02:45:18,347 INFO L131 PluginConnector]: ------------------------ END IcfgBuilder---------------------------- [2025-02-08 02:45:18,348 INFO L112 PluginConnector]: ------------------------TraceAbstraction---------------------------- [2025-02-08 02:45:18,351 INFO L270 PluginConnector]: Initializing TraceAbstraction... [2025-02-08 02:45:18,355 INFO L274 PluginConnector]: TraceAbstraction initialized [2025-02-08 02:45:18,355 INFO L184 PluginConnector]: Executing the observer TraceAbstractionObserver from plugin TraceAbstraction for "CDTParser AST 08.02 02:45:13" (1/3) ... [2025-02-08 02:45:18,356 INFO L204 PluginConnector]: Invalid model from TraceAbstraction for observer de.uni_freiburg.informatik.ultimate.plugins.generator.traceabstraction.TraceAbstractionObserver@4dd55623 and model type de.uni_freiburg.informatik.ultimate.plugins.generator.traceabstraction AST 08.02 02:45:18, skipping insertion in model container [2025-02-08 02:45:18,356 INFO L184 PluginConnector]: Executing the observer TraceAbstractionObserver from plugin TraceAbstraction for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 08.02 02:45:14" (2/3) ... [2025-02-08 02:45:18,356 INFO L204 PluginConnector]: Invalid model from TraceAbstraction for observer de.uni_freiburg.informatik.ultimate.plugins.generator.traceabstraction.TraceAbstractionObserver@4dd55623 and model type de.uni_freiburg.informatik.ultimate.plugins.generator.traceabstraction AST 08.02 02:45:18, skipping insertion in model container [2025-02-08 02:45:18,356 INFO L184 PluginConnector]: Executing the observer TraceAbstractionObserver from plugin TraceAbstraction for "de.uni_freiburg.informatik.ultimate.plugins.generator.icfgbuilder CFG 08.02 02:45:18" (3/3) ... [2025-02-08 02:45:18,357 INFO L128 eAbstractionObserver]: Analyzing ICFG 32_7a_cilled_linux-3.8-rc1-drivers--scsi--scsi_tgt.ko-main.cil.out.i [2025-02-08 02:45:18,369 INFO L216 ceAbstractionStarter]: Automizer settings: Hoare:LoopHeads NWA Interpolation:FPandBP Determinization: PREDICATE_ABSTRACTION [2025-02-08 02:45:18,374 INFO L151 ceAbstractionStarter]: Applying trace abstraction to ICFG 32_7a_cilled_linux-3.8-rc1-drivers--scsi--scsi_tgt.ko-main.cil.out.i that has 32 procedures, 264 locations, 1 initial locations, 0 loop locations, and 1 error locations. [2025-02-08 02:45:18,426 INFO L332 AbstractCegarLoop]: ======== Iteration 0 == of CEGAR loop == AllErrorsAtOnce ======== [2025-02-08 02:45:18,436 INFO L333 AbstractCegarLoop]: Settings: SEPARATE_VIOLATION_CHECK=true, mInterprocedural=true, mMaxIterations=1000000, mWatchIteration=1000000, mArtifact=RCFG, mInterpolation=FPandBP, mInterpolantAutomaton=STRAIGHT_LINE, mDumpAutomata=false, mAutomataFormat=ATS_NUMERATE, mDumpPath=., mDeterminiation=PREDICATE_ABSTRACTION, mMinimize=MINIMIZE_SEVPA, mAutomataTypeConcurrency=PETRI_NET, mHoareTripleChecks=INCREMENTAL, mHoareAnnotationPositions=LoopHeads, mDumpOnlyReuseAutomata=false, mLimitTraceHistogram=0, mErrorLocTimeLimit=0, mLimitPathProgramCount=0, mCollectInterpolantStatistics=true, mHeuristicEmptinessCheck=false, mHeuristicEmptinessCheckAStarHeuristic=ZERO, mHeuristicEmptinessCheckAStarHeuristicRandomSeed=1337, mHeuristicEmptinessCheckSmtFeatureScoringMethod=DAGSIZE, mSMTFeatureExtraction=false, mSMTFeatureExtractionDumpPath=., mOverrideInterpolantAutomaton=false, mMcrInterpolantMethod=WP, mPorIndependenceSettings=[Lde.uni_freiburg.informatik.ultimate.lib.tracecheckerutils.partialorder.independence.IndependenceSettings;@2f8d462d, mLbeIndependenceSettings=[IndependenceType=SEMANTIC, AbstractionType=NONE, UseConditional=false, UseSemiCommutativity=true, Solver=Z3, SolverTimeout=1000ms] [2025-02-08 02:45:18,438 INFO L334 AbstractCegarLoop]: Starting to check reachability of 1 error locations. [2025-02-08 02:45:18,442 INFO L276 IsEmpty]: Start isEmpty. Operand has 214 states, 136 states have (on average 1.3897058823529411) internal successors, (189), 154 states have internal predecessors, (189), 39 states have call successors, (39), 18 states have call predecessors, (39), 15 states have return successors, (33), 33 states have call predecessors, (33), 33 states have call successors, (33) [2025-02-08 02:45:18,451 INFO L282 IsEmpty]: Finished isEmpty. No accepting run. [2025-02-08 02:45:18,455 INFO L782 garLoopResultBuilder]: Registering result SAFE for location ldv_errorErr0ASSERT_VIOLATIONERROR_FUNCTION (0 of 1 remaining) [2025-02-08 02:45:18,458 INFO L422 BasicCegarLoop]: Path program histogram: [] [2025-02-08 02:45:18,465 INFO L343 DoubleDeckerVisitor]: Before removal of dead ends has 214 states, 136 states have (on average 1.3897058823529411) internal successors, (189), 154 states have internal predecessors, (189), 39 states have call successors, (39), 18 states have call predecessors, (39), 15 states have return successors, (33), 33 states have call predecessors, (33), 33 states have call successors, (33) [2025-02-08 02:45:18,561 INFO L170 ceAbstractionStarter]: Computing trace abstraction results [2025-02-08 02:45:18,565 INFO L201 PluginConnector]: Adding new model de.uni_freiburg.informatik.ultimate.plugins.generator.traceabstraction CFG 08.02 02:45:18 BoogieIcfgContainer [2025-02-08 02:45:18,565 INFO L131 PluginConnector]: ------------------------ END TraceAbstraction---------------------------- [2025-02-08 02:45:18,566 INFO L112 PluginConnector]: ------------------------Witness Printer---------------------------- [2025-02-08 02:45:18,566 INFO L270 PluginConnector]: Initializing Witness Printer... [2025-02-08 02:45:18,566 INFO L274 PluginConnector]: Witness Printer initialized [2025-02-08 02:45:18,567 INFO L184 PluginConnector]: Executing the observer RCFGCatcher from plugin Witness Printer for "de.uni_freiburg.informatik.ultimate.plugins.generator.icfgbuilder CFG 08.02 02:45:18" (3/4) ... [2025-02-08 02:45:18,568 INFO L146 WitnessPrinter]: Generating witness for correct program [2025-02-08 02:45:18,570 INFO L385 IcfgBacktranslator]: Ignoring RootEdge to procedure tgt_ring_idx_inc [2025-02-08 02:45:18,570 INFO L385 IcfgBacktranslator]: Ignoring RootEdge to procedure __raw_spin_lock_init [2025-02-08 02:45:18,571 INFO L385 IcfgBacktranslator]: Ignoring RootEdge to procedure tgt_ring_exit [2025-02-08 02:45:18,571 INFO L385 IcfgBacktranslator]: Ignoring RootEdge to procedure uspace_ring_map [2025-02-08 02:45:18,571 INFO L385 IcfgBacktranslator]: Ignoring RootEdge to procedure printk [2025-02-08 02:45:18,571 INFO L385 IcfgBacktranslator]: Ignoring RootEdge to procedure scsi_tgt_cmd_destroy [2025-02-08 02:45:18,571 INFO L385 IcfgBacktranslator]: Ignoring RootEdge to procedure tgt_write [2025-02-08 02:45:18,571 INFO L385 IcfgBacktranslator]: Ignoring RootEdge to procedure tgt_ring_init [2025-02-08 02:45:18,571 INFO L385 IcfgBacktranslator]: Ignoring RootEdge to procedure ldv_error [2025-02-08 02:45:18,571 INFO L385 IcfgBacktranslator]: Ignoring RootEdge to procedure list_del [2025-02-08 02:45:18,571 INFO L385 IcfgBacktranslator]: Ignoring RootEdge to procedure kmem_cache_free [2025-02-08 02:45:18,571 INFO L385 IcfgBacktranslator]: Ignoring RootEdge to procedure tgt_head_event [2025-02-08 02:45:18,571 INFO L385 IcfgBacktranslator]: Ignoring RootEdge to procedure tgt_poll [2025-02-08 02:45:18,571 INFO L385 IcfgBacktranslator]: Ignoring RootEdge to procedure scsi_unmap_user_pages [2025-02-08 02:45:18,571 INFO L385 IcfgBacktranslator]: Ignoring RootEdge to procedure _raw_spin_lock_irqsave [2025-02-08 02:45:18,571 INFO L385 IcfgBacktranslator]: Ignoring RootEdge to procedure scsi_host_put [2025-02-08 02:45:18,571 INFO L385 IcfgBacktranslator]: Ignoring RootEdge to procedure hash_64 [2025-02-08 02:45:18,572 INFO L385 IcfgBacktranslator]: Ignoring RootEdge to procedure ##fun~$Pointer$~TO~int [2025-02-08 02:45:18,572 INFO L385 IcfgBacktranslator]: Ignoring RootEdge to procedure ldv__builtin_expect [2025-02-08 02:45:18,572 INFO L385 IcfgBacktranslator]: Ignoring RootEdge to procedure tgt_open [2025-02-08 02:45:18,572 INFO L385 IcfgBacktranslator]: Ignoring RootEdge to procedure scsi_host_lookup [2025-02-08 02:45:18,572 INFO L385 IcfgBacktranslator]: Ignoring RootEdge to procedure tgt_mmap [2025-02-08 02:45:18,572 INFO L385 IcfgBacktranslator]: Ignoring RootEdge to procedure scsi_release_buffers [2025-02-08 02:45:18,572 INFO L385 IcfgBacktranslator]: Ignoring RootEdge to procedure kmem_cache_destroy [2025-02-08 02:45:18,572 INFO L385 IcfgBacktranslator]: Ignoring RootEdge to procedure spin_unlock_irqrestore [2025-02-08 02:45:18,572 INFO L385 IcfgBacktranslator]: Ignoring RootEdge to procedure ldv_malloc [2025-02-08 02:45:18,572 INFO L385 IcfgBacktranslator]: Ignoring RootEdge to procedure destroy_workqueue [2025-02-08 02:45:18,572 INFO L385 IcfgBacktranslator]: Ignoring RootEdge to procedure _copy_from_user [2025-02-08 02:45:18,572 INFO L385 IcfgBacktranslator]: Ignoring RootEdge to procedure list_add [2025-02-08 02:45:18,573 INFO L385 IcfgBacktranslator]: Ignoring RootEdge to procedure scsi_tgt_cmd_to_host [2025-02-08 02:45:18,573 INFO L385 IcfgBacktranslator]: Ignoring RootEdge to procedure spinlock_check [2025-02-08 02:45:18,586 INFO L919 BoogieBacktranslator]: Reduced CFG by removing 93 nodes and edges [2025-02-08 02:45:18,587 INFO L919 BoogieBacktranslator]: Reduced CFG by removing 39 nodes and edges [2025-02-08 02:45:18,588 INFO L919 BoogieBacktranslator]: Reduced CFG by removing 17 nodes and edges [2025-02-08 02:45:18,589 INFO L919 BoogieBacktranslator]: Reduced CFG by removing 5 nodes and edges [2025-02-08 02:45:18,590 INFO L919 BoogieBacktranslator]: Reduced CFG by removing 2 nodes and edges [2025-02-08 02:45:18,590 INFO L919 BoogieBacktranslator]: Reduced CFG by removing 1 nodes and edges [2025-02-08 02:45:18,710 INFO L149 WitnessManager]: Wrote witness to /storage/repos/ultimate-jdk21/releaseScripts/default/UAutomizer-linux/witness.graphml [2025-02-08 02:45:18,710 INFO L149 WitnessManager]: Wrote witness to /storage/repos/ultimate-jdk21/releaseScripts/default/UAutomizer-linux/witness.yml [2025-02-08 02:45:18,710 INFO L131 PluginConnector]: ------------------------ END Witness Printer---------------------------- [2025-02-08 02:45:18,712 INFO L158 Benchmark]: Toolchain (without parser) took 5326.80ms. Allocated memory was 142.6MB in the beginning and 335.5MB in the end (delta: 192.9MB). Free memory was 101.4MB in the beginning and 168.7MB in the end (delta: -67.3MB). Peak memory consumption was 123.3MB. Max. memory is 16.1GB. [2025-02-08 02:45:18,712 INFO L158 Benchmark]: CDTParser took 0.30ms. Allocated memory is still 201.3MB. Free memory is still 126.5MB. There was no memory consumed. Max. memory is 16.1GB. [2025-02-08 02:45:18,713 INFO L158 Benchmark]: CACSL2BoogieTranslator took 1545.48ms. Allocated memory is still 142.6MB. Free memory was 101.4MB in the beginning and 65.0MB in the end (delta: 36.4MB). Peak memory consumption was 92.3MB. Max. memory is 16.1GB. [2025-02-08 02:45:18,713 INFO L158 Benchmark]: Boogie Procedure Inliner took 114.70ms. Allocated memory is still 142.6MB. Free memory was 65.0MB in the beginning and 56.5MB in the end (delta: 8.5MB). Peak memory consumption was 8.4MB. Max. memory is 16.1GB. [2025-02-08 02:45:18,713 INFO L158 Benchmark]: Boogie Preprocessor took 226.32ms. Allocated memory is still 142.6MB. Free memory was 56.5MB in the beginning and 70.7MB in the end (delta: -14.2MB). Peak memory consumption was 34.7MB. Max. memory is 16.1GB. [2025-02-08 02:45:18,714 INFO L158 Benchmark]: IcfgBuilder took 3071.48ms. Allocated memory was 142.6MB in the beginning and 335.5MB in the end (delta: 192.9MB). Free memory was 70.7MB in the beginning and 195.2MB in the end (delta: -124.5MB). Peak memory consumption was 65.0MB. Max. memory is 16.1GB. [2025-02-08 02:45:18,714 INFO L158 Benchmark]: TraceAbstraction took 216.96ms. Allocated memory is still 335.5MB. Free memory was 195.2MB in the beginning and 182.6MB in the end (delta: 12.6MB). Peak memory consumption was 16.8MB. Max. memory is 16.1GB. [2025-02-08 02:45:18,716 INFO L158 Benchmark]: Witness Printer took 144.67ms. Allocated memory is still 335.5MB. Free memory was 182.6MB in the beginning and 168.7MB in the end (delta: 13.9MB). Peak memory consumption was 8.4MB. Max. memory is 16.1GB. [2025-02-08 02:45:18,717 INFO L338 ainManager$Toolchain]: ####################### End [Toolchain 1] ####################### --- Results --- * Results from de.uni_freiburg.informatik.ultimate.core: - StatisticsResult: Toolchain Benchmarks Benchmark results are: * CDTParser took 0.30ms. Allocated memory is still 201.3MB. Free memory is still 126.5MB. There was no memory consumed. Max. memory is 16.1GB. * CACSL2BoogieTranslator took 1545.48ms. Allocated memory is still 142.6MB. Free memory was 101.4MB in the beginning and 65.0MB in the end (delta: 36.4MB). Peak memory consumption was 92.3MB. Max. memory is 16.1GB. * Boogie Procedure Inliner took 114.70ms. Allocated memory is still 142.6MB. Free memory was 65.0MB in the beginning and 56.5MB in the end (delta: 8.5MB). Peak memory consumption was 8.4MB. Max. memory is 16.1GB. * Boogie Preprocessor took 226.32ms. Allocated memory is still 142.6MB. Free memory was 56.5MB in the beginning and 70.7MB in the end (delta: -14.2MB). Peak memory consumption was 34.7MB. Max. memory is 16.1GB. * IcfgBuilder took 3071.48ms. Allocated memory was 142.6MB in the beginning and 335.5MB in the end (delta: 192.9MB). Free memory was 70.7MB in the beginning and 195.2MB in the end (delta: -124.5MB). Peak memory consumption was 65.0MB. Max. memory is 16.1GB. * TraceAbstraction took 216.96ms. Allocated memory is still 335.5MB. Free memory was 195.2MB in the beginning and 182.6MB in the end (delta: 12.6MB). Peak memory consumption was 16.8MB. Max. memory is 16.1GB. * Witness Printer took 144.67ms. Allocated memory is still 335.5MB. Free memory was 182.6MB in the beginning and 168.7MB in the end (delta: 13.9MB). Peak memory consumption was 8.4MB. Max. memory is 16.1GB. * Results from de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator: - GenericResultAtLocation [Line: 7332]: Unsoundness Warning Ignoring inline assembler instruction C: __asm__ volatile ("mfence": : : "memory"); [7332] * Results from de.uni_freiburg.informatik.ultimate.plugins.generator.traceabstraction: - StatisticsResult: ErrorAutomatonStatistics NumberErrorTraces: 0, NumberStatementsAllTraces: 0, NumberRelevantStatements: 0, 0.0s ErrorAutomatonConstructionTimeTotal, 0.0s FaulLocalizationTime, NumberStatementsFirstTrace: -1, TraceLengthAvg: 0, 0.0s ErrorAutomatonConstructionTimeAvg, 0.0s ErrorAutomatonDifferenceTimeAvg, 0.0s ErrorAutomatonDifferenceTimeTotal, NumberOfNoEnhancement: 0, NumberOfFiniteEnhancement: 0, NumberOfInfiniteEnhancement: 0 - PositiveResult [Line: 7845]: a call to reach_error is unreachable For all program executions holds that a call to reach_error is unreachable at this location - StatisticsResult: Ultimate Automizer benchmark data CFG has 32 procedures, 264 locations, 1 error locations. Started 1 CEGAR loops. OverallTime: 0.0s, OverallIterations: 0, TraceHistogramMax: 0, PathProgramHistogramMax: 0, EmptinessCheckTime: 0.0s, AutomataDifference: 0.0s, DeadEndRemovalTime: 0.0s, HoareAnnotationTime: 0.0s, InitialAbstractionConstructionTime: 0.0s, HoareTripleCheckerStatistics: , PredicateUnifierStatistics: No data available, 0.0s BasicInterpolantAutomatonTime, BiggestAbstraction: size=214occurred in iteration=0, InterpolantAutomatonStates: 0, traceCheckStatistics: No data available, InterpolantConsolidationStatistics: No data available, PathInvariantsStatistics: No data available, 0/0 InterpolantCoveringCapability, TotalInterpolationStatistics: No data available, 0.0s DumpTime, AutomataMinimizationStatistics: No data available, HoareAnnotationStatistics: No data available, RefinementEngineStatistics: No data available, ReuseStatistics: No data available, ConComCheckerStatistics: No data available - AllSpecificationsHoldResult: All specifications hold 1 specifications checked. All of them hold RESULT: Ultimate proved your program to be correct! [2025-02-08 02:45:18,736 INFO L540 MonitoredProcess]: [MP /storage/repos/ultimate-jdk21/releaseScripts/default/UAutomizer-linux/z3 SMTLIB2_COMPLIANT=true -memory:2024 -smt2 -in -t:4000 (1)] Forceful destruction successful, exit code 0 Received shutdown request... --- End real Ultimate output --- Execution finished normally Writing output log to file Ultimate.log Result: TRUE